clang/test/Analysis/ptr-arith.c

   1 // RUN: %clang_analyze_cc1 -analyzer-checker=alpha.core.FixedAddr,alpha.core.PointerArithm,alpha.core.PointerSub,debug.ExprInspection -Wno-pointer-to-int-cast -verify -triple x86_64-apple-darwin9 -Wno-tautological-pointer-compare -analyzer-config eagerly-assume=false %s
   2 // RUN: %clang_analyze_cc1 -analyzer-checker=alpha.core.FixedAddr,alpha.core.PointerArithm,alpha.core.PointerSub,debug.ExprInspection -Wno-pointer-to-int-cast -verify -triple i686-apple-darwin9 -Wno-tautological-pointer-compare -analyzer-config eagerly-assume=false %s
   3
   4 void clang_analyzer_eval(int);
   5 void clang_analyzer_dump(int);
   6
   7 void f1(void) {
   8   int a[10];
   9   int *p = a;
  10   ++p;
  11 }
  12
  13 char* foo(void);
  14
  15 void f2(void) {
  16   char *p = foo();
  17   ++p;
  18 }
  19
  20 // This test case checks if we get the right rvalue type of a TypedViewRegion.
  21 // The ElementRegion's type depends on the array region's rvalue type. If it was
  22 // a pointer type, we would get a loc::SymbolVal for '*p'.
  23 void* memchr(const void *, int, __typeof__(sizeof(0)));
  24 static int
  25 domain_port (const char *domain_b, const char *domain_e,
  26              const char **domain_e_ptr)
  27 {
  28   int port = 0;
  29
  30   const char *p;
  31   const char *colon = memchr (domain_b, ':', domain_e - domain_b);
  32
  33   for (p = colon + 1; p < domain_e ; p++)
  34     port = 10 * port + (*p - '0');
  35   return port;
  36 }
  37
  38 void f3(void) {
  39   int x, y;
  40   int d = &y - &x; // expected-warning{{Subtraction of two pointers that do not point to the same memory chunk may cause incorrect result}}
  41
  42   int a[10];
  43   int *p = &a[2];
  44   int *q = &a[8];
  45   d = q-p; // no-warning
  46 }
  47
  48 void f4(void) {
  49   int *p;
  50   p = (int*) 0x10000; // expected-warning{{Using a fixed address is not portable because that address will probably not be valid in all environments or platforms}}
  51 }
  52
  53 void f5(void) {
  54   int x, y;
  55   int *p;
  56   p = &x + 1;  // expected-warning{{Pointer arithmetic on non-array variables relies on memory layout, which is dangerous}}
  57
  58   int a[10];
  59   p = a + 1; // no-warning
  60 }
  61
  62 // Allow arithmetic on different symbolic regions.
  63 void f6(int *p, int *q) {
  64   int d = q - p; // no-warning
  65 }
  66
  67 void null_operand(int *a) {
  68 start:
  69   // LHS is a label, RHS is NULL
  70   clang_analyzer_eval(&&start != 0); // expected-warning{{TRUE}}
  71   clang_analyzer_eval(&&start >= 0); // expected-warning{{TRUE}}
  72   clang_analyzer_eval(&&start > 0); // expected-warning{{TRUE}}
  73   clang_analyzer_eval((&&start - 0) != 0); // expected-warning{{TRUE}}
  74
  75   // LHS is a non-symbolic value, RHS is NULL
  76   clang_analyzer_eval(&a != 0); // expected-warning{{TRUE}}
  77   clang_analyzer_eval(&a >= 0); // expected-warning{{TRUE}}
  78   clang_analyzer_eval(&a > 0); // expected-warning{{TRUE}}
  79   clang_analyzer_eval((&a - 0) != 0); // expected-warning{{TRUE}}
  80
  81   // LHS is NULL, RHS is non-symbolic
  82   // The same code is used for labels and non-symbolic values.
  83   clang_analyzer_eval(0 != &a); // expected-warning{{TRUE}}
  84   clang_analyzer_eval(0 <= &a); // expected-warning{{TRUE}}
  85   clang_analyzer_eval(0 < &a); // expected-warning{{TRUE}}
  86
  87   // LHS is a symbolic value, RHS is NULL
  88   clang_analyzer_eval(a != 0); // expected-warning{{UNKNOWN}}
  89   clang_analyzer_eval(a >= 0); // expected-warning{{TRUE}}
  90   clang_analyzer_eval(a <= 0); // expected-warning{{UNKNOWN}}
  91   clang_analyzer_eval((a - 0) != 0); // expected-warning{{UNKNOWN}}
  92
  93   // LHS is NULL, RHS is a symbolic value
  94   clang_analyzer_eval(0 != a); // expected-warning{{UNKNOWN}}
  95   clang_analyzer_eval(0 <= a); // expected-warning{{TRUE}}
  96   clang_analyzer_eval(0 < a); // expected-warning{{UNKNOWN}}
  97 }
  98
  99 void const_locs(void) {
 100   char *a = (char*)0x1000;
 101   char *b = (char*)0x1100;
 102 start:
 103   clang_analyzer_eval(a != b); // expected-warning{{TRUE}}
 104   clang_analyzer_eval(a < b); // expected-warning{{TRUE}}
 105   clang_analyzer_eval(a <= b); // expected-warning{{TRUE}}
 106   clang_analyzer_eval((b-a) == 0x100); // expected-warning{{TRUE}}
 107
 108   clang_analyzer_eval(&&start == a); // expected-warning{{UNKNOWN}}
 109   clang_analyzer_eval(a == &&start); // expected-warning{{UNKNOWN}}
 110   clang_analyzer_eval(&a == (char**)a); // expected-warning{{UNKNOWN}}
 111   clang_analyzer_eval((char**)a == &a); // expected-warning{{UNKNOWN}}
 112 }
 113
 114 void array_matching_types(void) {
 115   int array[10];
 116   int *a = &array[2];
 117   int *b = &array[5];
 118
 119   clang_analyzer_eval(a != b); // expected-warning{{TRUE}}
 120   clang_analyzer_eval(a < b); // expected-warning{{TRUE}}
 121   clang_analyzer_eval(a <= b); // expected-warning{{TRUE}}
 122   clang_analyzer_eval((b-a) != 0); // expected-warning{{TRUE}}
 123 }
 124
 125 // This takes a different code path than array_matching_types()
 126 void array_different_types(void) {
 127   int array[10];
 128   int *a = &array[2];
 129   char *b = (char*)&array[5];
 130
 131   clang_analyzer_eval(a != b); // expected-warning{{TRUE}} expected-warning{{comparison of distinct pointer types}}
 132   clang_analyzer_eval(a < b); // expected-warning{{TRUE}} expected-warning{{comparison of distinct pointer types}}
 133   clang_analyzer_eval(a <= b); // expected-warning{{TRUE}} expected-warning{{comparison of distinct pointer types}}
 134 }
 135
 136 struct test { int x; int y; };
 137 void struct_fields(void) {
 138   struct test a, b;
 139
 140   clang_analyzer_eval(&a.x != &a.y); // expected-warning{{TRUE}}
 141   clang_analyzer_eval(&a.x < &a.y); // expected-warning{{TRUE}}
 142   clang_analyzer_eval(&a.x <= &a.y); // expected-warning{{TRUE}}
 143
 144   clang_analyzer_eval(&a.x != &b.x); // expected-warning{{TRUE}}
 145   clang_analyzer_eval(&a.x > &b.x); // expected-warning{{UNKNOWN}}
 146   clang_analyzer_eval(&a.x >= &b.x); // expected-warning{{UNKNOWN}}
 147 }
 148
 149 void mixed_region_types(void) {
 150   struct test s;
 151   int array[2];
 152   void *a = &array, *b = &s;
 153
 154   clang_analyzer_eval(&a != &b); // expected-warning{{TRUE}}
 155   clang_analyzer_eval(&a > &b); // expected-warning{{UNKNOWN}}
 156   clang_analyzer_eval(&a >= &b); // expected-warning{{UNKNOWN}}
 157 }
 158
 159 void symbolic_region(int *p) {
 160   int a;
 161
 162   clang_analyzer_eval(&a != p); // expected-warning{{TRUE}}
 163   clang_analyzer_eval(&a > p); // expected-warning{{UNKNOWN}}
 164   clang_analyzer_eval(&a >= p); // expected-warning{{UNKNOWN}}
 165 }
 166
 167 void PR7527 (int *p) {
 168   if (((int) p) & 1) // not crash
 169     return;
 170 }
 171
 172 void use_symbols(int *lhs, int *rhs) {
 173   clang_analyzer_eval(lhs < rhs); // expected-warning{{UNKNOWN}}
 174   if (lhs < rhs)
 175     return;
 176   clang_analyzer_eval(lhs < rhs); // expected-warning{{FALSE}}
 177
 178   clang_analyzer_eval(lhs - rhs); // expected-warning{{UNKNOWN}}
 179   if ((lhs - rhs) != 5)
 180     return;
 181   clang_analyzer_eval((lhs - rhs) == 5); // expected-warning{{TRUE}}
 182 }
 183
 184 void equal_implies_zero(int *lhs, int *rhs) {
 185   clang_analyzer_eval(lhs == rhs); // expected-warning{{UNKNOWN}}
 186   if (lhs == rhs) {
 187     clang_analyzer_eval(lhs != rhs); // expected-warning{{FALSE}}
 188     clang_analyzer_eval((rhs - lhs) == 0); // expected-warning{{TRUE}}
 189     return;
 190   }
 191   clang_analyzer_eval(lhs == rhs); // expected-warning{{FALSE}}
 192   clang_analyzer_eval(lhs != rhs); // expected-warning{{TRUE}}
 193   clang_analyzer_eval((rhs - lhs) == 0); // expected-warning{{FALSE}}
 194 }
 195
 196 void zero_implies_equal(int *lhs, int *rhs) {
 197   clang_analyzer_eval((rhs - lhs) == 0); // expected-warning{{UNKNOWN}}
 198   if ((rhs - lhs) == 0) {
 199     clang_analyzer_eval(lhs != rhs); // expected-warning{{FALSE}}
 200     clang_analyzer_eval(lhs == rhs); // expected-warning{{TRUE}}
 201     return;
 202   }
 203   clang_analyzer_eval((rhs - lhs) == 0); // expected-warning{{FALSE}}
 204   clang_analyzer_eval(lhs == rhs); // expected-warning{{FALSE}}
 205   clang_analyzer_eval(lhs != rhs); // expected-warning{{TRUE}}
 206 }
 207
 208 void comparisons_imply_size(int *lhs, int *rhs) {
 209   clang_analyzer_eval(lhs <= rhs); // expected-warning{{UNKNOWN}}
 210
 211   if (lhs > rhs) {
 212     clang_analyzer_eval((rhs - lhs) == 0); // expected-warning{{FALSE}}
 213     return;
 214   }
 215
 216   clang_analyzer_eval(lhs <= rhs); // expected-warning{{TRUE}}
 217 // FIXME: In Z3ConstraintManager, ptrdiff_t is mapped to signed bitvector. However, this does not directly imply the unsigned comparison.
 218 #ifdef ANALYZER_CM_Z3
 219   clang_analyzer_eval((rhs - lhs) >= 0); // expected-warning{{UNKNOWN}}
 220 #else
 221   clang_analyzer_eval((rhs - lhs) >= 0); // expected-warning{{TRUE}}
 222 #endif
 223   clang_analyzer_eval((rhs - lhs) > 0); // expected-warning{{UNKNOWN}}
 224
 225   if (lhs >= rhs) {
 226     clang_analyzer_eval((rhs - lhs) == 0); // expected-warning{{TRUE}}
 227     return;
 228   }
 229
 230   clang_analyzer_eval(lhs == rhs); // expected-warning{{FALSE}}
 231   clang_analyzer_eval(lhs < rhs); // expected-warning{{TRUE}}
 232 #ifdef ANALYZER_CM_Z3
 233   clang_analyzer_eval((rhs - lhs) > 0); // expected-warning{{UNKNOWN}}
 234 #else
 235   clang_analyzer_eval((rhs - lhs) > 0); // expected-warning{{TRUE}}
 236 #endif
 237 }
 238
 239 void size_implies_comparison(int *lhs, int *rhs) {
 240   clang_analyzer_eval(lhs <= rhs); // expected-warning{{UNKNOWN}}
 241
 242   if ((rhs - lhs) < 0) {
 243     clang_analyzer_eval(lhs == rhs); // expected-warning{{FALSE}}
 244     return;
 245   }
 246
 247 #ifdef ANALYZER_CM_Z3
 248   clang_analyzer_eval(lhs <= rhs); // expected-warning{{UNKNOWN}}
 249 #else
 250   clang_analyzer_eval(lhs <= rhs); // expected-warning{{TRUE}}
 251 #endif
 252   clang_analyzer_eval((rhs - lhs) >= 0); // expected-warning{{TRUE}}
 253   clang_analyzer_eval((rhs - lhs) > 0); // expected-warning{{UNKNOWN}}
 254
 255   if ((rhs - lhs) <= 0) {
 256     clang_analyzer_eval(lhs == rhs); // expected-warning{{TRUE}}
 257     return;
 258   }
 259
 260   clang_analyzer_eval(lhs == rhs); // expected-warning{{FALSE}}
 261 #ifdef ANALYZER_CM_Z3
 262   clang_analyzer_eval(lhs < rhs); // expected-warning{{UNKNOWN}}
 263 #else
 264   clang_analyzer_eval(lhs < rhs); // expected-warning{{TRUE}}
 265 #endif
 266   clang_analyzer_eval((rhs - lhs) > 0); // expected-warning{{TRUE}}
 267 }
 268
 269 void zero_implies_reversed_equal(int *lhs, int *rhs) {
 270   clang_analyzer_eval((rhs - lhs) == 0); // expected-warning{{UNKNOWN}}
 271   if ((rhs - lhs) == 0) {
 272     clang_analyzer_eval(rhs != lhs); // expected-warning{{FALSE}}
 273     clang_analyzer_eval(rhs == lhs); // expected-warning{{TRUE}}
 274     return;
 275   }
 276   clang_analyzer_eval((rhs - lhs) == 0); // expected-warning{{FALSE}}
 277   clang_analyzer_eval(rhs == lhs); // expected-warning{{FALSE}}
 278   clang_analyzer_eval(rhs != lhs); // expected-warning{{TRUE}}
 279 }
 280
 281 void canonical_equal(int *lhs, int *rhs) {
 282   clang_analyzer_eval(lhs == rhs); // expected-warning{{UNKNOWN}}
 283   if (lhs == rhs) {
 284     clang_analyzer_eval(rhs == lhs); // expected-warning{{TRUE}}
 285     return;
 286   }
 287   clang_analyzer_eval(lhs == rhs); // expected-warning{{FALSE}}
 288   clang_analyzer_eval(rhs == lhs); // expected-warning{{FALSE}}
 289 }
 290
 291 void compare_element_region_and_base(int *p) {
 292   int *q = p - 1;
 293   clang_analyzer_eval(p == q); // expected-warning{{FALSE}}
 294 }
 295
 296 struct Point {
 297   int x;
 298   int y;
 299 };
 300 void symbolicFieldRegion(struct Point *points, int i, int j) {
 301   clang_analyzer_eval(&points[i].x == &points[j].x);// expected-warning{{UNKNOWN}}
 302   clang_analyzer_eval(&points[i].x == &points[i].y);// expected-warning{{FALSE}}
 303   clang_analyzer_eval(&points[i].x < &points[i].y);// expected-warning{{TRUE}}
 304 }
 305
 306 void negativeIndex(char *str) {
 307   *(str + 1) = 'a';
 308   clang_analyzer_eval(*(str + 1) == 'a'); // expected-warning{{TRUE}}
 309   clang_analyzer_eval(*(str - 1) == 'a'); // expected-warning{{UNKNOWN}}
 310
 311   char *ptr1 = str - 1;
 312   clang_analyzer_eval(*ptr1 == 'a'); // expected-warning{{UNKNOWN}}
 313
 314   char *ptr2 = str;
 315   ptr2 -= 1;
 316   clang_analyzer_eval(*ptr2 == 'a'); // expected-warning{{UNKNOWN}}
 317
 318   char *ptr3 = str;
 319   --ptr3;
 320   clang_analyzer_eval(*ptr3 == 'a'); // expected-warning{{UNKNOWN}}
 321 }
 322
 323 void test_no_crash_on_pointer_to_label(void) {
 324   char *a = &&label;
 325   a[0] = 0;
 326 label:;
 327 }
 328
 329 typedef __attribute__((__ext_vector_type__(2))) float simd_float2;
 330 float test_nowarning_on_vector_deref(void) {
 331   simd_float2 x = {0, 1};
 332   return x[1]; // no-warning
 333 }
 334
 335 struct s {
 336   int v;
 337 };
 338
 339 // These three expressions should produce the same sym vals.
 340 void struct_pointer_canon(struct s *ps) {
 341   struct s ss = *ps;
 342   clang_analyzer_dump((*ps).v);
 343   // expected-warning-re@-1{{reg_${{[[:digit:]]+}}<int Element{SymRegion{reg_${{[[:digit:]]+}}<struct s * ps>},0 S64b,struct s}.v>}}
 344   clang_analyzer_dump(ps[0].v);
 345   // expected-warning-re@-1{{reg_${{[[:digit:]]+}}<int Element{SymRegion{reg_${{[[:digit:]]+}}<struct s * ps>},0 S64b,struct s}.v>}}
 346   clang_analyzer_dump(ps->v);
 347   // expected-warning-re@-1{{reg_${{[[:digit:]]+}}<int Element{SymRegion{reg_${{[[:digit:]]+}}<struct s * ps>},0 S64b,struct s}.v>}}
 348   clang_analyzer_eval((*ps).v == ps[0].v); // expected-warning{{TRUE}}
 349   clang_analyzer_eval((*ps).v == ps->v);   // expected-warning{{TRUE}}
 350   clang_analyzer_eval(ps[0].v == ps->v);   // expected-warning{{TRUE}}
 351 }
 352
 353 void struct_pointer_canon_bidim(struct s **ps) {
 354   struct s ss = **ps;
 355   clang_analyzer_eval(&(ps[0][0].v) == &((*ps)->v)); // expected-warning{{TRUE}}
 356 }
 357
 358 typedef struct s T1;
 359 typedef struct s T2;
 360 void struct_pointer_canon_typedef(T1 *ps) {
 361   T2 ss = *ps;
 362   clang_analyzer_dump((*ps).v);
 363   // expected-warning-re@-1{{reg_${{[[:digit:]]+}}<int Element{SymRegion{reg_${{[[:digit:]]+}}<T1 * ps>},0 S64b,struct s}.v>}}
 364   clang_analyzer_dump(ps[0].v);
 365   // expected-warning-re@-1{{reg_${{[[:digit:]]+}}<int Element{SymRegion{reg_${{[[:digit:]]+}}<T1 * ps>},0 S64b,struct s}.v>}}
 366   clang_analyzer_dump(ps->v);
 367   // expected-warning-re@-1{{reg_${{[[:digit:]]+}}<int Element{SymRegion{reg_${{[[:digit:]]+}}<T1 * ps>},0 S64b,struct s}.v>}}
 368   clang_analyzer_eval((*ps).v == ps[0].v); // expected-warning{{TRUE}}
 369   clang_analyzer_eval((*ps).v == ps->v);   // expected-warning{{TRUE}}
 370   clang_analyzer_eval(ps[0].v == ps->v);   // expected-warning{{TRUE}}
 371 }
 372
 373 void struct_pointer_canon_bidim_typedef(T1 **ps) {
 374   T2 ss = **ps;
 375   clang_analyzer_eval(&(ps[0][0].v) == &((*ps)->v)); // expected-warning{{TRUE}}
 376 }
 377
 378 void struct_pointer_canon_const(const struct s *ps) {
 379   struct s ss = *ps;
 380   clang_analyzer_dump((*ps).v);
 381   // expected-warning-re@-1{{reg_${{[[:digit:]]+}}<int Element{SymRegion{reg_${{[[:digit:]]+}}<const struct s * ps>},0 S64b,struct s}.v>}}
 382   clang_analyzer_dump(ps[0].v);
 383   // expected-warning-re@-1{{reg_${{[[:digit:]]+}}<int Element{SymRegion{reg_${{[[:digit:]]+}}<const struct s * ps>},0 S64b,struct s}.v>}}
 384   clang_analyzer_dump(ps->v);
 385   // expected-warning-re@-1{{reg_${{[[:digit:]]+}}<int Element{SymRegion{reg_${{[[:digit:]]+}}<const struct s * ps>},0 S64b,struct s}.v>}}
 386   clang_analyzer_eval((*ps).v == ps[0].v); // expected-warning{{TRUE}}
 387   clang_analyzer_eval((*ps).v == ps->v);   // expected-warning{{TRUE}}
 388   clang_analyzer_eval(ps[0].v == ps->v);   // expected-warning{{TRUE}}
 389 }