clang/test/Analysis/cert/env34-c.c

   1 // RUN: %clang_analyze_cc1 \
   2 // RUN:  -analyzer-checker=alpha.security.cert.env.InvalidPtr\
   3 // RUN:  -analyzer-output=text -verify -Wno-unused %s
   4
   5 #include "../Inputs/system-header-simulator.h"
   6 char *getenv(const char *name);
   7 char *setlocale(int category, const char *locale);
   8 char *strerror(int errnum);
   9
  10 typedef struct {
  11   char * field;
  12 } lconv;
  13 lconv *localeconv(void);
  14
  15 typedef struct {
  16 } tm;
  17 char *asctime(const tm *timeptr);
  18
  19 int strcmp(const char*, const char*);
  20 extern void foo(char *e);
  21 extern char* bar(void);
  22
  23
  24 void getenv_test1(void) {
  25   char *p;
  26
  27   p = getenv("VAR");
  28   *p; // no-warning
  29
  30   p = getenv("VAR2");
  31   *p; // no-warning, getenv result was assigned to the same pointer
  32 }
  33
  34 void getenv_test2(void) {
  35   char *p, *p2;
  36
  37   p = getenv("VAR");
  38   // expected-note@-1{{previous function call was here}}
  39   *p; // no-warning
  40
  41   p2 = getenv("VAR2");
  42   // expected-note@-1{{'getenv' call may invalidate the result of the previous 'getenv'}}
  43
  44   *p;
  45   // expected-warning@-1{{dereferencing an invalid pointer}}
  46   // expected-note@-2{{dereferencing an invalid pointer}}
  47 }
  48
  49 void getenv_test3(void) {
  50   char *p, *p2, *p3;
  51
  52   p = getenv("VAR");
  53   *p; // no-warning
  54
  55   p = getenv("VAR2");
  56   // expected-note@-1{{previous function call was here}}
  57   p2 = getenv("VAR2");
  58   // expected-note@-1{{'getenv' call may invalidate the result of the previous 'getenv'}}
  59
  60   p3 = getenv("VAR3");
  61
  62   *p;
  63   // expected-warning@-1{{dereferencing an invalid pointer}}
  64   // expected-note@-2{{dereferencing an invalid pointer}}
  65 }
  66
  67 void getenv_test4(void) {
  68   char *p, *p2, *p3;
  69
  70   p = getenv("VAR");
  71   // expected-note@-1{{previous function call was here}}
  72   p2 = getenv("VAR2");
  73   // expected-note@-1{{'getenv' call may invalidate the result of the previous 'getenv'}}
  74   p3 = getenv("VAR3");
  75
  76   *p;
  77   // expected-warning@-1{{dereferencing an invalid pointer}}
  78   // expected-note@-2{{dereferencing an invalid pointer}}
  79 }
  80
  81 void getenv_test5(void) {
  82   char *p, *p2, *p3;
  83
  84   p = getenv("VAR");
  85   p2 = getenv("VAR2");
  86   // expected-note@-1{{previous function call was here}}
  87   p3 = getenv("VAR3");
  88   // expected-note@-1{{'getenv' call may invalidate the result of the previous 'getenv'}}
  89
  90   *p2;
  91   // expected-warning@-1{{dereferencing an invalid pointer}}
  92   // expected-note@-2{{dereferencing an invalid pointer}}
  93 }
  94
  95 void getenv_test6(void) {
  96   char *p, *p2;
  97   p = getenv("VAR");
  98   *p; // no-warning
  99
 100   p = getenv("VAR2");
 101   // expected-note@-1{{previous function call was here}}
 102   *p; // no-warning
 103
 104   p2 = getenv("VAR3");
 105   // expected-note@-1{{previous function call was here}}
 106   // expected-note@-2{{'getenv' call may invalidate the result of the previous 'getenv'}}
 107
 108   *p;
 109   // expected-warning@-1{{dereferencing an invalid pointer}}
 110   // expected-note@-2{{dereferencing an invalid pointer}}
 111
 112   *p2; // no-warning
 113
 114   p = getenv("VAR4");
 115   // expected-note@-1{{'getenv' call may invalidate the result of the previous 'getenv'}}
 116
 117   *p; // no-warning
 118   *p2;
 119   // expected-warning@-1{{dereferencing an invalid pointer}}
 120   // expected-note@-2{{dereferencing an invalid pointer}}
 121 }
 122
 123 void getenv_test7(void) {
 124   char *p, *p2;
 125   p = getenv("VAR");
 126   // expected-note@-1{{previous function call was here}}
 127   *p; // no-warning
 128
 129   p2 = getenv("VAR2");
 130   // expected-note@-1{{'getenv' call may invalidate the result of the previous 'getenv'}}
 131
 132   foo(p);
 133   // expected-warning@-1{{use of invalidated pointer 'p' in a function call}}
 134   // expected-note@-2{{use of invalidated pointer 'p' in a function call}}
 135 }
 136
 137 void getenv_test8(void) {
 138   static const char *array[] = {
 139      0,
 140      0,
 141      "/var/tmp",
 142      "/usr/tmp",
 143      "/tmp",
 144      "."
 145   };
 146
 147   if( !array[0] )
 148   // expected-note@-1{{Taking true branch}}
 149     array[0] = getenv("TEMPDIR");
 150     // expected-note@-1{{previous function call was here}}
 151
 152   if( !array[1] )
 153   // expected-note@-1{{Taking true branch}}
 154     array[1] = getenv("TMPDIR");
 155   // expected-note@-1{{'getenv' call may invalidate the result of the previous 'getenv'}}
 156
 157   *array[0];
 158   // expected-warning@-1{{dereferencing an invalid pointer}}
 159   // expected-note@-2{{dereferencing an invalid pointer}}
 160 }
 161
 162 void getenv_test9(void) {
 163   char *p, *p2;
 164   p = getenv("something");
 165   p = bar();
 166   p2 = getenv("something");
 167   *p; // no-warning: p does not point to getenv anymore
 168 }
 169
 170 void getenv_test10(void) {
 171   strcmp(getenv("VAR1"), getenv("VAR2"));
 172   // expected-note@-1{{'getenv' call may invalidate the result of the previous 'getenv'}}
 173   // expected-note@-2{{previous function call was here}}
 174   // expected-warning@-3{{use of invalidated pointer 'getenv("VAR1")' in a function call}}
 175   // expected-note@-4{{use of invalidated pointer 'getenv("VAR1")' in a function call}}
 176 }
 177
 178 void dereference_pointer(char* a) {
 179   *a;
 180   // expected-warning@-1{{dereferencing an invalid pointer}}
 181   // expected-note@-2{{dereferencing an invalid pointer}}
 182 }
 183
 184 void getenv_test11(void) {
 185   char *p = getenv("VAR");
 186   // expected-note@-1{{previous function call was here}}
 187
 188   char *pp = getenv("VAR2");
 189   // expected-note@-1{{'getenv' call may invalidate the result of the previous 'getenv'}}
 190
 191   dereference_pointer(p);
 192   // expected-note@-1{{Calling 'dereference_pointer'}}
 193 }
 194
 195 void getenv_test12(int flag1, int flag2) {
 196   char *p = getenv("VAR");
 197   // expected-note@-1{{previous function call was here}}
 198
 199   if (flag1) {
 200     // expected-note@-1{{Assuming 'flag1' is not equal to 0}}
 201     // expected-note@-2{{Taking true branch}}
 202     char *pp = getenv("VAR2");
 203     // expected-note@-1{{'getenv' call may invalidate the result of the previous 'getenv'}}
 204   }
 205
 206   if (flag2) {
 207     // expected-note@-1{{Assuming 'flag2' is not equal to 0}}
 208     // expected-note@-2{{Taking true branch}}
 209     *p;
 210     // expected-warning@-1{{dereferencing an invalid pointer}}
 211     // expected-note@-2{{dereferencing an invalid pointer}}
 212   }
 213 }
 214
 215 void setlocale_test1(void) {
 216   char *p, *p2;
 217   p = setlocale(0, "VAR");
 218   *p; // no-warning
 219
 220   p = setlocale(0, "VAR2");
 221   // expected-note@-1{{previous function call was here}}
 222   *p; // no-warning
 223
 224   p2 = setlocale(0, "VAR3");
 225   // expected-note@-1{{'setlocale' call may invalidate the result of the previous 'setlocale'}}
 226
 227   *p;
 228   // expected-warning@-1{{dereferencing an invalid pointer}}
 229   // expected-note@-2{{dereferencing an invalid pointer}}
 230 }
 231
 232 void setlocale_test2(int flag) {
 233   char *p, *p2;
 234   p = setlocale(0, "VAR");
 235   *p; // no-warning
 236
 237   p = setlocale(0, "VAR2");
 238   // expected-note@-1{{previous function call was here}}
 239   *p; // no-warning
 240
 241   if (flag) {
 242     // expected-note@-1{{Assuming 'flag' is not equal to 0}}
 243     // expected-note@-2{{Taking true branch}}
 244     p2 = setlocale(0, "VAR3");
 245     // expected-note@-1{{'setlocale' call may invalidate the result of the previous 'setlocale'}}
 246   }
 247
 248   *p;
 249   // expected-warning@-1{{dereferencing an invalid pointer}}
 250   // expected-note@-2{{dereferencing an invalid pointer}}
 251 }
 252
 253 void strerror_test1(void) {
 254   char *p, *p2;
 255
 256   p = strerror(0);
 257   *p; // no-warning
 258
 259   p = strerror(1);
 260   // expected-note@-1{{previous function call was here}}
 261   *p; // no-warning
 262
 263   p2 = strerror(2);
 264   // expected-note@-1{{'strerror' call may invalidate the result of the previous 'strerror'}}
 265
 266   *p;
 267   // expected-warning@-1{{dereferencing an invalid pointer}}
 268   // expected-note@-2{{dereferencing an invalid pointer}}
 269 }
 270
 271 void strerror_test2(int errno) {
 272   char *p, *p2;
 273
 274   p = strerror(0);
 275   *p; // no-warning
 276
 277   p = strerror(1);
 278   // expected-note@-1{{previous function call was here}}
 279   *p; // no-warning
 280
 281   if (0 == 1) {
 282     // expected-note@-1{{0 is not equal to 1}}
 283     // expected-note@-2{{Taking false branch}}
 284     p2 = strerror(2);
 285   }
 286
 287   *p; // no-warning
 288
 289   if (errno) {
 290     // expected-note@-1{{Assuming 'errno' is not equal to 0}}
 291     // expected-note@-2{{Taking true branch}}
 292     p2 = strerror(errno);
 293     // expected-note@-1{{'strerror' call may invalidate the result of the previous 'strerror'}}
 294   }
 295
 296   *p;
 297   // expected-warning@-1{{dereferencing an invalid pointer}}
 298   // expected-note@-2{{dereferencing an invalid pointer}}
 299 }
 300
 301 void asctime_test(void) {
 302   const tm *t;
 303   const tm *tt;
 304
 305   char* p = asctime(t);
 306   // expected-note@-1{{previous function call was here}}
 307   char* pp = asctime(tt);
 308   // expected-note@-1{{'asctime' call may invalidate the result of the previous 'asctime'}}
 309
 310   *p;
 311   // expected-warning@-1{{dereferencing an invalid pointer}}
 312   // expected-note@-2{{dereferencing an invalid pointer}}
 313 }
 314
 315 void localeconv_test1(void) {
 316   lconv *lc1 = localeconv();
 317   // expected-note@-1{{previous function call was here}}
 318   lconv *lc2 = localeconv();
 319   // expected-note@-1{{'localeconv' call may invalidate the result of the previous 'localeconv'}}
 320
 321   *lc1;
 322   // expected-warning@-1{{dereferencing an invalid pointer}}
 323   // expected-note@-2{{dereferencing an invalid pointer}}
 324 }
 325
 326 void localeconv_test2(void) {
 327   // TODO: false negative
 328   lconv *lc1 = localeconv();
 329   lconv *lc2 = localeconv();
 330   lc1->field;
 331 }