clang/test/Analysis/diagnostics/deref-track-symbolic-region.cpp

   1 // RUN: %clang_analyze_cc1 -analyzer-checker=core -analyzer-output=text -verify %s
   2
   3 struct S {
   4   int *x;
   5   int y;
   6 };
   7
   8 S &getSomeReference();
   9 void test(S *p) {
  10   S &r = *p;   //expected-note {{'r' initialized here}}
  11   if (p) return;
  12                //expected-note@-1{{Taking false branch}}
  13                //expected-note@-2{{Assuming 'p' is null}}
  14   r.y = 5; // expected-warning {{Access to field 'y' results in a dereference of a null pointer (loaded from variable 'r')}}
  15            // expected-note@-1{{Access to field 'y' results in a dereference of a null pointer (loaded from variable 'r')}}
  16 }
  17
  18 void testRefParam(int *ptr) {
  19         int &ref = *ptr; // expected-note {{'ref' initialized here}}
  20         if (ptr)
  21     // expected-note@-1{{Assuming 'ptr' is null}}
  22     // expected-note@-2{{Taking false branch}}
  23                 return;
  24
  25         extern void use(int &ref);
  26         use(ref); // expected-warning{{Forming reference to null pointer}}
  27             // expected-note@-1{{Forming reference to null pointer}}
  28 }
  29
  30 int testRefToNullPtr() {
  31   int *p = 0;         // expected-note {{'p' initialized to a null pointer value}}
  32   int *const &p2 = p; // expected-note{{'p2' initialized here}}
  33   int *p3 = p2;       // expected-note {{'p3' initialized to a null pointer value}}
  34   return *p3;         // expected-warning {{Dereference of null pointer}}
  35                       // expected-note@-1{{Dereference of null pointer}}
  36 }
  37
  38 int testRefToNullPtr2() {
  39   int *p = 0;         // expected-note {{'p' initialized to a null pointer value}}
  40   int *const &p2 = p; // expected-note{{'p2' initialized here}}
  41   return *p2;         //expected-warning {{Dereference of null pointer}}
  42                       // expected-note@-1{{Dereference of null pointer}}
  43 }
  44
  45 void testMemberNullPointerDeref() {
  46   struct Wrapper {char c; int *ptr; };
  47   Wrapper w = {'a', nullptr};           // expected-note {{'w.ptr' initialized to a null pointer value}}
  48   *w.ptr = 1;                           //expected-warning {{Dereference of null pointer}}
  49                                         // expected-note@-1{{Dereference of null pointer}}
  50 }
  51
  52 void testMemberNullReferenceDeref() {
  53   struct Wrapper {char c; int &ref; };
  54   Wrapper w = {.c = 'a', .ref = *(int *)0 }; // expected-note {{'w.ref' initialized to a null pointer value}}
  55                                              // expected-warning@-1 {{binding dereferenced null pointer to reference has undefined behavior}}
  56   w.ref = 1;                                 //expected-warning {{Dereference of null pointer}}
  57                                              // expected-note@-1{{Dereference of null pointer}}
  58 }
  59
  60 void testReferenceToPointerWithNullptr() {
  61   int *i = nullptr;                   // expected-note {{'i' initialized to a null pointer value}}
  62   struct Wrapper {char c; int *&a;};
  63   Wrapper w {'c', i};                 // expected-note{{'w.a' initialized here}}
  64   *(w.a) = 25;                        // expected-warning {{Dereference of null pointer}}
  65                                       // expected-note@-1 {{Dereference of null pointer}}
  66 }
  67
  68 void testNullReferenceToPointer() {
  69   struct Wrapper {char c; int *&a;};
  70   Wrapper w {'c', *(int **)0 };           // expected-note{{'w.a' initialized to a null pointer value}}
  71                                           // expected-warning@-1 {{binding dereferenced null pointer to reference has undefined behavior}}
  72   w.a = nullptr;                          // expected-warning {{Dereference of null pointer}}
  73                                           // expected-note@-1 {{Dereference of null pointer}}
  74 }