clang/test/Analysis/casts.c

   1 // RUN: %clang_analyze_cc1 -triple x86_64-apple-darwin9 -fenable-matrix -analyzer-checker=core,alpha.core,debug.ExprInspection -Wno-pointer-to-int-cast -Wno-strict-prototypes -verify -analyzer-config eagerly-assume=false %s
   2 // RUN: %clang_analyze_cc1 -triple i386-apple-darwin9 -fenable-matrix -analyzer-checker=core,alpha.core,debug.ExprInspection -Wno-pointer-to-int-cast -Wno-strict-prototypes -verify -analyzer-config eagerly-assume=false %s
   3 // RUN: %clang_analyze_cc1 -triple x86_64-apple-darwin9 -fenable-matrix -analyzer-checker=core,alpha.core,debug.ExprInspection -Wno-pointer-to-int-cast -Wno-strict-prototypes -verify -DEAGERLY_ASSUME=1 -w %s
   4 // RUN: %clang_analyze_cc1 -triple i386-apple-darwin9 -fenable-matrix -analyzer-checker=core,alpha.core,debug.ExprInspection -Wno-pointer-to-int-cast -Wno-strict-prototypes -verify -DEAGERLY_ASSUME=1 -DBIT32=1 -w %s
   5
   6 extern void clang_analyzer_eval(_Bool);
   7
   8 // Test if the 'storage' region gets properly initialized after it is cast to
   9 // 'struct sockaddr *'.
  10
  11 typedef unsigned char __uint8_t;
  12 typedef unsigned int __uint32_t;
  13 typedef __uint32_t __darwin_socklen_t;
  14 typedef __uint8_t sa_family_t;
  15 typedef __darwin_socklen_t socklen_t;
  16 struct sockaddr { sa_family_t sa_family; };
  17 struct sockaddr_storage {};
  18
  19 void getsockname();
  20
  21 #ifndef EAGERLY_ASSUME
  22
  23 void f(int sock) {
  24   struct sockaddr_storage storage;
  25   struct sockaddr* sockaddr = (struct sockaddr*)&storage; // expected-warning{{Casting data to a larger structure type and accessing a field can lead to memory access errors or data corruption}}
  26   socklen_t addrlen = sizeof(storage);
  27   getsockname(sock, sockaddr, &addrlen);
  28   switch (sockaddr->sa_family) { // no-warning
  29   default:
  30     ;
  31   }
  32 }
  33
  34 struct s {
  35   struct s *value;
  36 };
  37
  38 void f1(struct s **pval) {
  39   int *tbool = ((void*)0);
  40   struct s *t = *pval;
  41   pval = &(t->value);
  42   tbool = (int *)pval; // use the cast-to type 'int *' to create element region.
  43   char c = (unsigned char) *tbool; // Should use cast-to type to create symbol.
  44   if (*tbool == -1) // here load the element region with the correct type 'int'
  45     (void)3;
  46 }
  47
  48 void f2(const char *str) {
  49  unsigned char ch, cl, *p;
  50
  51  p = (unsigned char *)str;
  52  ch = *p++; // use cast-to type 'unsigned char' to create element region.
  53  cl = *p++;
  54  if(!cl)
  55     cl = 'a';
  56 }
  57
  58 // Test cast VariableSizeArray to pointer does not crash.
  59 void *memcpy(void *, void const *, unsigned long);
  60 typedef unsigned char Byte;
  61 void doit(char *data, int len) {
  62     if (len) {
  63         Byte buf[len];
  64         memcpy(buf, data, len);
  65     }
  66 }
  67
  68 // PR 6013 and 6035 - Test that a cast of a pointer to long and then to int does not crash SValuator.
  69 void pr6013_6035_test(void *p) {
  70   unsigned int foo;
  71   foo = ((long)(p));
  72   (void) foo;
  73 }
  74
  75 // PR12511 and radar://11215362 - Test that we support SymCastExpr, which represents symbolic int to float cast.
  76 char ttt(int intSeconds) {
  77   double seconds = intSeconds;
  78   if (seconds)
  79     return 0;
  80   return 0;
  81 }
  82
  83 int foo (int* p) {
  84   int y = 0;
  85   if (p == 0) {
  86     if ((*((void**)&p)) == (void*)0) // Test that the cast to void preserves the symbolic region.
  87       return 0;
  88     else
  89       return 5/y; // This code should be unreachable: no-warning.
  90   }
  91   return 0;
  92 }
  93
  94 void castsToBool(void) {
  95   clang_analyzer_eval(0); // expected-warning{{FALSE}}
  96   clang_analyzer_eval(0U); // expected-warning{{FALSE}}
  97   clang_analyzer_eval((void *)0); // expected-warning{{FALSE}}
  98
  99   clang_analyzer_eval(1); // expected-warning{{TRUE}}
 100   clang_analyzer_eval(1U); // expected-warning{{TRUE}}
 101   clang_analyzer_eval(-1); // expected-warning{{TRUE}}
 102   clang_analyzer_eval(0x100); // expected-warning{{TRUE}}
 103   clang_analyzer_eval(0x100U); // expected-warning{{TRUE}}
 104   clang_analyzer_eval((void *)0x100); // expected-warning{{TRUE}}
 105
 106   extern int symbolicInt;
 107   clang_analyzer_eval(symbolicInt); // expected-warning{{UNKNOWN}}
 108   if (symbolicInt)
 109     clang_analyzer_eval(symbolicInt); // expected-warning{{TRUE}}
 110
 111   extern void *symbolicPointer;
 112   clang_analyzer_eval(symbolicPointer); // expected-warning{{UNKNOWN}}
 113   if (symbolicPointer)
 114     clang_analyzer_eval(symbolicPointer); // expected-warning{{TRUE}}
 115
 116   int localInt;
 117   int* ptr = &localInt;
 118   clang_analyzer_eval(ptr); // expected-warning{{TRUE}}
 119   clang_analyzer_eval(&castsToBool); // expected-warning{{TRUE}}
 120   clang_analyzer_eval("abc"); // expected-warning{{TRUE}}
 121
 122   extern float globalFloat;
 123   clang_analyzer_eval(globalFloat); // expected-warning{{UNKNOWN}}
 124 }
 125
 126 void locAsIntegerCasts(void *p) {
 127   int x = (int) p;
 128   clang_analyzer_eval(++x < 10); // no-crash // expected-warning{{UNKNOWN}}
 129 }
 130
 131 void multiDimensionalArrayPointerCasts(void) {
 132   static int x[10][10];
 133   int *y1 = &(x[3][5]);
 134   char *z = ((char *) y1) + 2;
 135   int *y2 = (int *)(z - 2);
 136   int *y3 = ((int *)x) + 35; // This is offset for [3][5].
 137
 138   clang_analyzer_eval(y1 == y2); // expected-warning{{TRUE}}
 139
 140   // FIXME: should be FALSE (i.e. equal pointers).
 141   clang_analyzer_eval(y1 - y2); // expected-warning{{UNKNOWN}}
 142   // FIXME: should be TRUE (i.e. same symbol).
 143   clang_analyzer_eval(*y1 == *y2); // expected-warning{{UNKNOWN}}
 144
 145   clang_analyzer_eval(*((char *)y1) == *((char *) y2)); // expected-warning{{TRUE}}
 146
 147   clang_analyzer_eval(y1 == y3); // expected-warning{{TRUE}}
 148
 149   // FIXME: should be FALSE (i.e. equal pointers).
 150   clang_analyzer_eval(y1 - y3); // expected-warning{{UNKNOWN}}
 151   // FIXME: should be TRUE (i.e. same symbol).
 152   clang_analyzer_eval(*y1 == *y3); // expected-warning{{UNKNOWN}}
 153
 154   clang_analyzer_eval(*((char *)y1) == *((char *) y3)); // expected-warning{{TRUE}}
 155 }
 156
 157 void *getVoidPtr(void);
 158
 159 void testCastVoidPtrToIntPtrThroughIntTypedAssignment(void) {
 160   int *x;
 161   (*((int *)(&x))) = (int)getVoidPtr();
 162   *x = 1; // no-crash
 163 }
 164
 165 void testCastUIntPtrToIntPtrThroughIntTypedAssignment(void) {
 166   unsigned u;
 167   int *x;
 168   (*((int *)(&x))) = (int)&u;
 169   *x = 1;
 170   clang_analyzer_eval(u == 1); // expected-warning{{TRUE}}
 171 }
 172
 173 void testCastVoidPtrToIntPtrThroughUIntTypedAssignment(void) {
 174   int *x;
 175   (*((int *)(&x))) = (int)(unsigned *)getVoidPtr();
 176   *x = 1; // no-crash
 177 }
 178
 179 void testLocNonLocSymbolAssume(int a, int *b) {
 180   if ((int)b < a) {} // no-crash
 181 }
 182
 183 void testLocNonLocSymbolRemainder(int a, int *b) {
 184   int c = ((int)b) % a;
 185   if (a == 1) {
 186     c += 1;
 187   }
 188 }
 189
 190 void testSwitchWithSizeofs(void) {
 191   switch (sizeof(char) == 1) { // expected-warning{{switch condition has boolean value}}
 192   case sizeof(char):; // no-crash
 193   }
 194 }
 195
 196 void test_ToUnion_cast(unsigned long long x) {
 197   union Key {
 198     unsigned long long data;
 199   };
 200   void clang_analyzer_dump_union(union Key);
 201   clang_analyzer_dump_union((union Key)x); // expected-warning {{Unknown}}
 202 }
 203
 204 typedef char cx5x5 __attribute__((matrix_type(5, 5)));
 205 typedef int ix5x5 __attribute__((matrix_type(5, 5)));
 206 void test_MatrixCast_cast(cx5x5 c) {
 207   void clang_analyzer_dump_ix5x5(ix5x5);
 208   clang_analyzer_dump_ix5x5((ix5x5)c); // expected-warning {{Unknown}}
 209 }
 210
 211 void test_VectorSplat_cast(long x) {
 212   typedef int __attribute__((ext_vector_type(2))) V;
 213   void clang_analyzer_dump_V(V);
 214   clang_analyzer_dump_V((V)x); // expected-warning {{Unknown}}
 215 }
 216
 217 #endif
 218
 219 #ifdef EAGERLY_ASSUME
 220
 221 int globalA;
 222 extern int globalFunc(void);
 223 void no_crash_on_symsym_cast_to_long(void) {
 224   char c = globalFunc() - 5;
 225   c == 0;
 226   globalA -= c;
 227   globalA == 3;
 228   (long)globalA << 48;
 229   #ifdef BIT32
 230   // expected-warning@-2{{The result of the left shift is undefined due to shifting by '48', which is greater or equal to the width of type 'long'}}
 231   #else
 232   // expected-no-diagnostics
 233   #endif
 234 }
 235
 236 #endif
 237
 238 char no_crash_SymbolCast_of_float_type_aux(int *p) {
 239   *p += 1;
 240   return *p;
 241 }
 242
 243 void no_crash_SymbolCast_of_float_type(void) {
 244   extern float x;
 245   char (*f)() = no_crash_SymbolCast_of_float_type_aux;
 246   f(&x);
 247 }
 248
 249 double no_crash_reinterpret_double_as_int(double a) {
 250   *(int *)&a = 1;
 251   return a * a;
 252 }
 253
 254 double no_crash_reinterpret_double_as_ptr(double a) {
 255   *(void **)&a = 0;
 256   return a * a;
 257 }
 258
 259 double no_crash_reinterpret_double_as_sym_int(double a, int b) {
 260   *(int *)&a = b;
 261   return a * a;
 262 }
 263
 264 double no_crash_reinterpret_double_as_sym_ptr(double a, void * b) {
 265   *(void **)&a = b;
 266   return a * a;
 267 }
 268
 269 void no_crash_reinterpret_char_as_uchar(char ***a, int *b) {
 270   *(unsigned char **)a = (unsigned char *)b;
 271   if (**a == 0) // no-crash
 272     ;
 273 }
 274
 275 // PR50179.
 276 struct S {};
 277 void symbolic_offset(struct S *ptr, int i) {
 278   const struct S *pS = ptr + i;
 279   struct S s = *pS; // no-crash
 280 }