clang/test/Analysis/gmalloc.c

   1 // RUN: %clang_cc1 -analyze -analyzer-checker=core,unix.Malloc -verify %s
   2
   3 #include "Inputs/system-header-simulator.h"
   4
   5 typedef void* gpointer;
   6 typedef const void* gconstpointer;
   7 typedef unsigned long gsize;
   8 typedef unsigned int guint;
   9
  10 gpointer g_malloc(gsize n_bytes);
  11 gpointer g_malloc0(gsize n_bytes);
  12 gpointer g_realloc(gpointer mem, gsize n_bytes);
  13 gpointer g_try_malloc(gsize n_bytes);
  14 gpointer g_try_malloc0(gsize n_bytes);
  15 gpointer g_try_realloc(gpointer mem, gsize n_bytes);
  16 gpointer g_malloc_n(gsize n_blocks, gsize n_block_bytes);
  17 gpointer g_malloc0_n(gsize n_blocks, gsize n_block_bytes);
  18 gpointer g_realloc_n(gpointer mem, gsize n_blocks, gsize n_block_bytes);
  19 gpointer g_try_malloc_n(gsize n_blocks, gsize n_block_bytes);
  20 gpointer g_try_malloc0_n(gsize n_blocks, gsize n_block_bytes);
  21 gpointer g_try_realloc_n(gpointer mem, gsize n_blocks, gsize n_block_bytes);
  22 void g_free(gpointer mem);
  23 gpointer g_memdup(gconstpointer mem, guint byte_size);
  24 gpointer g_strconcat(gconstpointer string1, ...);
  25
  26 static const gsize n_bytes = 1024;
  27
  28 void f1(void) {
  29   gpointer g1 = g_malloc(n_bytes);
  30   gpointer g2 = g_malloc0(n_bytes);
  31   g1 = g_realloc(g1, n_bytes * 2);
  32   gpointer g3 = g_try_malloc(n_bytes);
  33   gpointer g4 = g_try_malloc0(n_bytes);
  34   g3 = g_try_realloc(g3, n_bytes * 2);
  35   gpointer g5 = g_malloc_n(n_bytes, sizeof(char));
  36   gpointer g6 = g_malloc0_n(n_bytes, sizeof(char));
  37   g5 = g_realloc_n(g5, n_bytes * 2, sizeof(char));
  38   gpointer g7 = g_try_malloc_n(n_bytes, sizeof(char));
  39   gpointer g8 = g_try_malloc0_n(n_bytes, sizeof(char));
  40   g7 = g_try_realloc_n(g7, n_bytes * 2, sizeof(char));
  41
  42   g_free(g1);
  43   g_free(g2);
  44   g_free(g2); // expected-warning{{Attempt to free released memory}}
  45 }
  46
  47 void f2(void) {
  48   gpointer g1 = g_malloc(n_bytes);
  49   gpointer g2 = g_malloc0(n_bytes);
  50   g1 = g_realloc(g1, n_bytes * 2);
  51   gpointer g3 = g_try_malloc(n_bytes);
  52   gpointer g4 = g_try_malloc0(n_bytes);
  53   g3 = g_try_realloc(g3, n_bytes * 2);
  54   gpointer g5 = g_malloc_n(n_bytes, sizeof(char));
  55   gpointer g6 = g_malloc0_n(n_bytes, sizeof(char));
  56   g5 = g_realloc_n(g5, n_bytes * 2, sizeof(char));
  57   gpointer g7 = g_try_malloc_n(n_bytes, sizeof(char));
  58   gpointer g8 = g_try_malloc0_n(n_bytes, sizeof(char));
  59   g7 = g_try_realloc_n(g7, n_bytes * 2, sizeof(char));
  60
  61   g_free(g1);
  62   g_free(g2);
  63   g_free(g3);
  64   g3 = g_memdup(g3, n_bytes); // expected-warning{{Use of memory after it is freed}}
  65 }
  66
  67 void f3(void) {
  68   gpointer g1 = g_malloc(n_bytes);
  69   gpointer g2 = g_malloc0(n_bytes);
  70   g1 = g_realloc(g1, n_bytes * 2);
  71   gpointer g3 = g_try_malloc(n_bytes);
  72   gpointer g4 = g_try_malloc0(n_bytes);
  73   g3 = g_try_realloc(g3, n_bytes * 2); // expected-warning{{Potential leak of memory pointed to by 'g4'}}
  74   gpointer g5 = g_malloc_n(n_bytes, sizeof(char));
  75   gpointer g6 = g_malloc0_n(n_bytes, sizeof(char));
  76   g5 = g_realloc_n(g5, n_bytes * 2, sizeof(char)); // expected-warning{{Potential leak of memory pointed to by 'g6'}}
  77   gpointer g7 = g_try_malloc_n(n_bytes, sizeof(char)); // expected-warning{{Potential leak of memory pointed to by 'g5'}}
  78   gpointer g8 = g_try_malloc0_n(n_bytes, sizeof(char));
  79   g7 = g_try_realloc_n(g7, n_bytes * 2, sizeof(char)); // expected-warning{{Potential leak of memory pointed to by 'g8'}}
  80
  81   g_free(g1); // expected-warning{{Potential leak of memory pointed to by 'g7'}}
  82   g_free(g2);
  83   g_free(g3);
  84 }
  85
  86 void f4(void) {
  87   gpointer g1 = g_malloc(n_bytes);
  88   gpointer g2 = g_malloc0(n_bytes);
  89   g1 = g_realloc(g1, n_bytes * 2);
  90   gpointer g3 = g_try_malloc(n_bytes);
  91   gpointer g4 = g_try_malloc0(n_bytes);
  92   g3 = g_try_realloc(g3, n_bytes * 2);
  93   gpointer g5 = g_malloc_n(n_bytes, sizeof(char));
  94   gpointer g6 = g_malloc0_n(n_bytes, sizeof(char));
  95   g5 = g_realloc_n(g5, n_bytes * 2, sizeof(char)); // expected-warning{{Potential leak of memory pointed to by 'g6'}}
  96   gpointer g7 = g_try_malloc_n(n_bytes, sizeof(char)); // expected-warning{{Potential leak of memory pointed to by 'g5'}}
  97   gpointer g8 = g_try_malloc0_n(n_bytes, sizeof(char));
  98   g7 = g_try_realloc_n(g7, n_bytes * 2, sizeof(char)); // expected-warning{{Potential leak of memory pointed to by 'g8'}}
  99
 100   g_free(g1); // expected-warning{{Potential leak of memory pointed to by 'g7'}}
 101   g_free(g2);
 102   g_free(g3);
 103   g_free(g4);
 104 }
 105
 106 void f5(void) {
 107   gpointer g1 = g_malloc(n_bytes);
 108   gpointer g2 = g_malloc0(n_bytes);
 109   g1 = g_realloc(g1, n_bytes * 2);
 110   gpointer g3 = g_try_malloc(n_bytes);
 111   gpointer g4 = g_try_malloc0(n_bytes);
 112   g3 = g_try_realloc(g3, n_bytes * 2);
 113   gpointer g5 = g_malloc_n(n_bytes, sizeof(char));
 114   gpointer g6 = g_malloc0_n(n_bytes, sizeof(char));
 115   g5 = g_realloc_n(g5, n_bytes * 2, sizeof(char)); // expected-warning{{Potential leak of memory pointed to by 'g6'}}
 116   gpointer g7 = g_try_malloc_n(n_bytes, sizeof(char));
 117   gpointer g8 = g_try_malloc0_n(n_bytes, sizeof(char));
 118   g7 = g_try_realloc_n(g7, n_bytes * 2, sizeof(char)); // expected-warning{{Potential leak of memory pointed to by 'g8'}}
 119
 120   g_free(g1); // expected-warning{{Potential leak of memory pointed to by 'g7'}}
 121   g_free(g2);
 122   g_free(g3);
 123   g_free(g4);
 124   g_free(g5);
 125 }
 126
 127 void f6(void) {
 128   gpointer g1 = g_malloc(n_bytes);
 129   gpointer g2 = g_malloc0(n_bytes);
 130   g1 = g_realloc(g1, n_bytes * 2);
 131   gpointer g3 = g_try_malloc(n_bytes);
 132   gpointer g4 = g_try_malloc0(n_bytes);
 133   g3 = g_try_realloc(g3, n_bytes * 2);
 134   gpointer g5 = g_malloc_n(n_bytes, sizeof(char));
 135   gpointer g6 = g_malloc0_n(n_bytes, sizeof(char));
 136   g5 = g_realloc_n(g5, n_bytes * 2, sizeof(char));
 137   gpointer g7 = g_try_malloc_n(n_bytes, sizeof(char));
 138   gpointer g8 = g_try_malloc0_n(n_bytes, sizeof(char));
 139   g7 = g_try_realloc_n(g7, n_bytes * 2, sizeof(char)); // expected-warning{{Potential leak of memory pointed to by 'g8'}}
 140
 141   g_free(g1); // expected-warning{{Potential leak of memory pointed to by 'g7'}}
 142   g_free(g2);
 143   g_free(g3);
 144   g_free(g4);
 145   g_free(g5);
 146   g_free(g6);
 147 }
 148
 149 void f7(void) {
 150   gpointer g1 = g_malloc(n_bytes);
 151   gpointer g2 = g_malloc0(n_bytes);
 152   g1 = g_realloc(g1, n_bytes * 2);
 153   gpointer g3 = g_try_malloc(n_bytes);
 154   gpointer g4 = g_try_malloc0(n_bytes);
 155   g3 = g_try_realloc(g3, n_bytes * 2);
 156   gpointer g5 = g_malloc_n(n_bytes, sizeof(char));
 157   gpointer g6 = g_malloc0_n(n_bytes, sizeof(char));
 158   g5 = g_realloc_n(g5, n_bytes * 2, sizeof(char));
 159   gpointer g7 = g_try_malloc_n(n_bytes, sizeof(char));
 160   gpointer g8 = g_try_malloc0_n(n_bytes, sizeof(char));
 161   g7 = g_try_realloc_n(g7, n_bytes * 2, sizeof(char)); // expected-warning{{Potential leak of memory pointed to by 'g8'}}
 162
 163   g_free(g1);
 164   g_free(g2);
 165   g_free(g3);
 166   g_free(g4);
 167   g_free(g5);
 168   g_free(g6);
 169   g_free(g7);
 170 }
 171
 172 void f8(void) {
 173   typedef struct {
 174     gpointer str;
 175   } test_struct;
 176
 177   test_struct *s1 = (test_struct *)g_malloc0(sizeof(test_struct));
 178   test_struct *s2 = (test_struct *)g_memdup(s1, sizeof(test_struct));
 179   gpointer str = g_strconcat("text", s1->str, s2->str, NULL); // no-warning
 180   g_free(str);
 181   g_free(s2);
 182   g_free(s1);
 183 }