clang/test/Analysis/null-deref-ps-region.c

   1 // RUN: %clang_analyze_cc1 -verify %s -std=gnu99 \
   2 // RUN:  -analyzer-checker=core \
   3 // RUN:  -analyzer-checker=alpha.core \
   4 // RUN:  -analyzer-checker=unix \
   5 // RUN:  -analyzer-checker=alpha.unix
   6
   7 #include "Inputs/system-header-simulator.h"
   8
   9 typedef __typeof(sizeof(int)) size_t;
  10 void *memset(void *__s, int __c, size_t __n);
  11 void *malloc(size_t __size);
  12 void free(void *__ptr);
  13
  14 // The store for 'a[1]' should not be removed mistakenly. SymbolicRegions may
  15 // also be live roots.
  16 void f14(int *a) {
  17   int i;
  18   a[1] = 1;
  19   i = a[1];
  20   if (i != 1) {
  21     int *p = 0;
  22     i = *p; // no-warning
  23   }
  24 }
  25
  26 void foo(void) {
  27   int *x = malloc(sizeof(int));
  28   memset(x, 0, sizeof(int));
  29   int n = 1 / *x; // expected-warning {{Division by zero}}
  30   free(x);
  31 }
  32
  33 void bar(void) {
  34   int *x = malloc(sizeof(int));
  35   memset(x, 0, 1);
  36   int n = 1 / *x; // no-warning
  37   free(x);
  38 }
  39
  40 void testConcreteNull(void) {
  41   int *x = 0;
  42   memset(x, 0, 1); // expected-warning {{Null pointer passed as 1st argument to memory set function}}
  43 }
  44
  45 void testStackArray(void) {
  46   char buf[13];
  47   memset(buf, 0, 1); // no-warning
  48 }
  49
  50 void testHeapSymbol(void) {
  51   char *buf = (char *)malloc(13);
  52   memset(buf, 0, 1); // no-warning
  53   free(buf);
  54 }
  55
  56 void testStackArrayOutOfBound(void) {
  57   char buf[1];
  58   memset(buf, 0, 1024);
  59   // expected-warning@-1 {{Memory set function overflows the destination buffer}}
  60   // expected-warning@-2 {{'memset' will always overflow; destination buffer has size 1, but size argument is 1024}}
  61 }
  62
  63 void testHeapSymbolOutOfBound(void) {
  64   char *buf = (char *)malloc(1);
  65   memset(buf, 0, 1024);
  66   // expected-warning@-1 {{Memory set function overflows the destination buffer}}
  67   free(buf);
  68 }
  69
  70 void testStackArraySameSize(void) {
  71   char buf[1];
  72   memset(buf, 0, sizeof(buf)); // no-warning
  73 }
  74
  75 void testHeapSymbolSameSize(void) {
  76   char *buf = (char *)malloc(1);
  77   memset(buf, 0, 1); // no-warning
  78   free(buf);
  79 }