clang/test/Analysis/malloc.cpp

   1 // RUN: %clang_analyze_cc1 -w -verify %s \
   2 // RUN:   -analyzer-checker=core \
   3 // RUN:   -analyzer-checker=alpha.deadcode.UnreachableCode \
   4 // RUN:   -analyzer-checker=alpha.core.CastSize \
   5 // RUN:   -analyzer-checker=unix.Malloc \
   6 // RUN:   -analyzer-checker=cplusplus.NewDelete
   7
   8 // RUN: %clang_analyze_cc1 -w -verify %s \
   9 // RUN:   -triple i386-unknown-linux-gnu \
  10 // RUN:   -analyzer-checker=core \
  11 // RUN:   -analyzer-checker=alpha.deadcode.UnreachableCode \
  12 // RUN:   -analyzer-checker=alpha.core.CastSize \
  13 // RUN:   -analyzer-checker=unix.Malloc \
  14 // RUN:   -analyzer-checker=cplusplus.NewDelete
  15
  16 // RUN: %clang_analyze_cc1 -w -verify %s -DTEST_INLINABLE_ALLOCATORS \
  17 // RUN:   -analyzer-checker=core \
  18 // RUN:   -analyzer-checker=alpha.deadcode.UnreachableCode \
  19 // RUN:   -analyzer-checker=alpha.core.CastSize \
  20 // RUN:   -analyzer-checker=unix.Malloc \
  21 // RUN:   -analyzer-checker=cplusplus.NewDelete
  22
  23 // RUN: %clang_analyze_cc1 -w -verify %s -DTEST_INLINABLE_ALLOCATORS \
  24 // RUN:   -triple i386-unknown-linux-gnu \
  25 // RUN:   -analyzer-checker=core \
  26 // RUN:   -analyzer-checker=alpha.deadcode.UnreachableCode \
  27 // RUN:   -analyzer-checker=alpha.core.CastSize \
  28 // RUN:   -analyzer-checker=unix.Malloc \
  29 // RUN:   -analyzer-checker=cplusplus.NewDelete
  30
  31 #include "Inputs/system-header-simulator-cxx.h"
  32
  33 typedef __typeof(sizeof(int)) size_t;
  34 void *malloc(size_t);
  35 void free(void *);
  36 void *realloc(void *ptr, size_t size);
  37 void *calloc(size_t nmemb, size_t size);
  38 char *strdup(const char *s);
  39
  40 void checkThatMallocCheckerIsRunning() {
  41   malloc(4);
  42 } // expected-warning{{leak}}
  43
  44 struct Foo {
  45     mutable void* m_data;
  46     Foo(void* data) : m_data(data) {}
  47 };
  48 Foo aFunction() {
  49     return malloc(10);
  50 }
  51
  52 // Assume that functions which take a function pointer can free memory even if
  53 // they are defined in system headers and take the const pointer to the
  54 // allocated memory.
  55 // Test default parameter.
  56 int const_ptr_and_callback_def_param(int, const char*, int n, void(*)(void*) = free);
  57 void r11160612_3() {
  58   char *x = (char*)malloc(12);
  59   const_ptr_and_callback_def_param(0, x, 12);
  60 }
  61
  62 int const_ptr_and_callback_def_param_null(int, const char*, int n, void(*)(void*) = 0);
  63 void r11160612_no_callback() {
  64   char *x = (char*)malloc(12);
  65   const_ptr_and_callback_def_param_null(0, x, 12);
  66 } // expected-warning{{leak}}
  67
  68 // Test member function pointer.
  69 struct CanFreeMemory {
  70   static void myFree(void*);
  71 };
  72 //This is handled because we look at the type of the parameter(not argument).
  73 void r11160612_3(CanFreeMemory* p) {
  74   char *x = (char*)malloc(12);
  75   const_ptr_and_callback_def_param(0, x, 12, p->myFree);
  76 }
  77
  78
  79 namespace PR13751 {
  80   class OwningVector {
  81     void **storage;
  82     size_t length;
  83   public:
  84     OwningVector();
  85     ~OwningVector();
  86     void push_back(void *Item) {
  87       storage[length++] = Item;
  88     }
  89   };
  90
  91   void testDestructors() {
  92     OwningVector v;
  93     v.push_back(malloc(4));
  94     // no leak warning; freed in destructor
  95   }
  96 }
  97
  98 struct X { void *a; };
  99
 100 struct X get() {
 101   struct X result;
 102   result.a = malloc(4);
 103   return result; // no-warning
 104 }
 105
 106 // Ensure that regions accessible through a LazyCompoundVal trigger region escape.
 107 // Malloc checker used to report leaks for the following two test cases.
 108 struct Property {
 109   char* getterName;
 110   Property(char* n)
 111   : getterName(n) {}
 112
 113 };
 114 void append(Property x);
 115
 116 void appendWrapper(char *getterName) {
 117   append(Property(getterName));
 118 }
 119 void foo(const char* name) {
 120   char* getterName = strdup(name);
 121   appendWrapper(getterName); // no-warning
 122 }
 123
 124 struct NestedProperty {
 125   Property prop;
 126   NestedProperty(Property p)
 127   : prop(p) {}
 128 };
 129 void appendNested(NestedProperty x);
 130
 131 void appendWrapperNested(char *getterName) {
 132   appendNested(NestedProperty(Property(getterName)));
 133 }
 134 void fooNested(const char* name) {
 135   char* getterName = strdup(name);
 136   appendWrapperNested(getterName); // no-warning
 137 }
 138
 139 namespace PR31226 {
 140   struct b2 {
 141     int f;
 142   };
 143
 144   struct b1 : virtual b2 {
 145     void m();
 146   };
 147
 148   struct d : b1, b2 {
 149   };
 150
 151   void f() {
 152     d *p = new d();
 153     p->m(); // no-crash // no-warning
 154   }
 155 }
 156
 157 // Allow __cxa_demangle to escape.
 158 char* test_cxa_demangle(const char* sym) {
 159   size_t funcnamesize = 256;
 160   char* funcname = (char*)malloc(funcnamesize);
 161   int status;
 162   char* ret = abi::__cxa_demangle(sym, funcname, &funcnamesize, &status);
 163   if (status == 0) {
 164     funcname = ret;
 165   }
 166   return funcname; // no-warning
 167 }
 168
 169 namespace argument_leak {
 170 class A {
 171   char *name;
 172
 173 public:
 174   char *getName() {
 175     if (!name) {
 176       name = static_cast<char *>(malloc(10));
 177     }
 178     return name;
 179   }
 180   ~A() {
 181     if (name) {
 182       delete[] name;
 183     }
 184   }
 185 };
 186
 187 void test(A a) {
 188   (void)a.getName();
 189 }
 190 } // namespace argument_leak
 191
 192 #define ZERO_SIZE_PTR ((void *)16)
 193
 194 void test_delete_ZERO_SIZE_PTR() {
 195   int *Ptr = (int *)ZERO_SIZE_PTR;
 196   // ZERO_SIZE_PTR is specially handled but only for malloc family
 197   delete Ptr; // expected-warning{{Argument to 'delete' is a constant address (16)}}
 198 }
 199
 200 namespace pr46253_class {
 201 class a {
 202   void *realloc(int, bool = false) { realloc(1); } // no-crash
 203 };
 204 } // namespace pr46253_class
 205
 206 namespace pr46253_retty{
 207 void realloc(void *ptr, size_t size) { realloc(ptr, size); } // no-crash
 208 } // namespace pr46253_retty
 209
 210 namespace pr46253_paramty{
 211 void *realloc(void **ptr, size_t size) { realloc(ptr, size); } // no-crash
 212 } // namespace pr46253_paramty
 213
 214 namespace pr46253_paramty2{
 215 void *realloc(void *ptr, int size) { realloc(ptr, size); } // no-crash
 216 } // namespace pr46253_paramty2