clang/test/Analysis/malloc-overflow.c

   1 // RUN: %clang_analyze_cc1 -analyzer-checker=alpha.security.MallocOverflow -verify %s
   2
   3 #define NULL ((void *) 0)
   4 typedef __typeof__(sizeof(int)) size_t;
   5 extern void * malloc(size_t);
   6
   7 void * f1(int n)
   8 {
   9   return malloc(n * sizeof(int));  // expected-warning {{the computation of the size of the memory allocation may overflow}}
  10 }
  11
  12 void * f2(int n)
  13 {
  14   return malloc(sizeof(int) * n); // // expected-warning {{the computation of the size of the memory allocation may overflow}}
  15 }
  16
  17 void * f3(void)
  18 {
  19   return malloc(4 * sizeof(int));  // no-warning
  20 }
  21
  22 struct s4
  23 {
  24   int n;
  25 };
  26
  27 void * f4(struct s4 *s)
  28 {
  29   return malloc(s->n * sizeof(int)); // expected-warning {{the computation of the size of the memory allocation may overflow}}
  30 }
  31
  32 void * f5(struct s4 *s)
  33 {
  34   struct s4 s2 = *s;
  35   return malloc(s2.n * sizeof(int)); // expected-warning {{the computation of the size of the memory allocation may overflow}}
  36 }
  37
  38 void * f6(int n)
  39 {
  40   return malloc((n + 1) * sizeof(int)); // expected-warning {{the computation of the size of the memory allocation may overflow}}
  41 }
  42
  43 extern void * malloc (size_t);
  44
  45 void * f7(int n)
  46 {
  47   if (n > 10)
  48     return NULL;
  49   return malloc(n * sizeof(int));  // no-warning
  50 }
  51
  52 void * f8(int n)
  53 {
  54   if (n < 10)
  55     return malloc(n * sizeof(int));  // no-warning
  56   else
  57     return NULL;
  58 }
  59
  60 void * f9(int n)
  61 {
  62   int * x = malloc(n * sizeof(int));  // expected-warning {{the computation of the size of the memory allocation may overflow}}
  63   for (int i = 0; i < n; i++)
  64     x[i] = i;
  65   return x;
  66 }
  67
  68 void * f10(int n)
  69 {
  70   int * x = malloc(n * sizeof(int));  // expected-warning {{the computation of the size of the memory allocation may overflow}}
  71   int i = 0;
  72   while (i < n)
  73     x[i++] = 0;
  74   return x;
  75 }
  76
  77 void * f11(int n)
  78 {
  79   int * x = malloc(n * sizeof(int));  // expected-warning {{the computation of the size of the memory allocation may overflow}}
  80   int i = 0;
  81   do {
  82     x[i++] = 0;
  83   } while (i < n);
  84   return x;
  85 }
  86
  87 void * f12(int n)
  88 {
  89   n = (n > 10 ? 10 : n);
  90   int * x = malloc(n * sizeof(int));  // no-warning
  91   for (int i = 0; i < n; i++)
  92     x[i] = i;
  93   return x;
  94 }
  95
  96 struct s13
  97 {
  98   int n;
  99 };
 100
 101 void * f13(struct s13 *s)
 102 {
 103   if (s->n > 10)
 104     return NULL;
 105   return malloc(s->n * sizeof(int)); // no-warning
 106 }
 107
 108 void * f14(int n)
 109 {
 110   if (n < 0)
 111     return NULL;
 112   return malloc(n * sizeof(int));  // expected-warning {{the computation of the size of the memory allocation may overflow}}
 113 }
 114
 115 void *check_before_malloc(int n, int x) {
 116   int *p = NULL;
 117   if (n > 10)
 118     return NULL;
 119   if (x == 42)
 120     p = malloc(n * sizeof(int)); // no-warning, the check precedes the allocation
 121
 122   // Do some other stuff, e.g. initialize the memory.
 123   return p;
 124 }
 125
 126 void *check_after_malloc(int n, int x) {
 127   int *p = NULL;
 128   if (x == 42)
 129     p = malloc(n * sizeof(int)); // expected-warning {{the computation of the size of the memory allocation may overflow}}
 130
 131   // The check is after the allocation!
 132   if (n > 10) {
 133     // Do something conditionally.
 134   }
 135   return p;
 136 }
 137
 138 #define GREATER_THAN(lhs, rhs) (lhs > rhs)
 139 void *check_after_malloc_using_macros(int n, int x) {
 140   int *p = NULL;
 141   if (x == 42)
 142     p = malloc(n * sizeof(int)); // expected-warning {{the computation of the size of the memory allocation may overflow}}
 143
 144   if (GREATER_THAN(n, 10))
 145     return NULL;
 146
 147   // Do some other stuff, e.g. initialize the memory.
 148   return p;
 149 }
 150 #undef GREATER_THAN