clang/test/Analysis/malloc.cpp

   1 // RUN: %clang_analyze_cc1 -w -verify %s \
   2 // RUN:   -analyzer-checker=core \
   3 // RUN:   -analyzer-checker=alpha.deadcode.UnreachableCode \
   4 // RUN:   -analyzer-checker=alpha.core.CastSize \
   5 // RUN:   -analyzer-checker=unix.Malloc \
   6 // RUN:   -analyzer-checker=cplusplus.NewDelete
   7
   8 // RUN: %clang_analyze_cc1 -w -verify %s \
   9 // RUN:   -triple i386-unknown-linux-gnu \
  10 // RUN:   -analyzer-checker=core \
  11 // RUN:   -analyzer-checker=alpha.deadcode.UnreachableCode \
  12 // RUN:   -analyzer-checker=alpha.core.CastSize \
  13 // RUN:   -analyzer-checker=unix.Malloc \
  14 // RUN:   -analyzer-checker=cplusplus.NewDelete
  15
  16 // RUN: %clang_analyze_cc1 -w -verify %s -DTEST_INLINABLE_ALLOCATORS \
  17 // RUN:   -analyzer-checker=core \
  18 // RUN:   -analyzer-checker=alpha.deadcode.UnreachableCode \
  19 // RUN:   -analyzer-checker=alpha.core.CastSize \
  20 // RUN:   -analyzer-checker=unix.Malloc \
  21 // RUN:   -analyzer-checker=cplusplus.NewDelete
  22
  23 // RUN: %clang_analyze_cc1 -w -verify %s -DTEST_INLINABLE_ALLOCATORS \
  24 // RUN:   -triple i386-unknown-linux-gnu \
  25 // RUN:   -analyzer-checker=core \
  26 // RUN:   -analyzer-checker=alpha.deadcode.UnreachableCode \
  27 // RUN:   -analyzer-checker=alpha.core.CastSize \
  28 // RUN:   -analyzer-checker=unix.Malloc \
  29 // RUN:   -analyzer-checker=cplusplus.NewDelete
  30
  31 #include "Inputs/system-header-simulator-cxx.h"
  32
  33 typedef __typeof(sizeof(int)) size_t;
  34 void *malloc(size_t);
  35 void free(void *);
  36 void *realloc(void *ptr, size_t size);
  37 void *calloc(size_t nmemb, size_t size);
  38 char *strdup(const char *s);
  39
  40 void checkThatMallocCheckerIsRunning() {
  41   malloc(4);
  42 } // expected-warning{{leak}}
  43
  44 // Test for radar://11110132.
  45 struct Foo {
  46     mutable void* m_data;
  47     Foo(void* data) : m_data(data) {}
  48 };
  49 Foo aFunction() {
  50     return malloc(10);
  51 }
  52
  53 // Assume that functions which take a function pointer can free memory even if
  54 // they are defined in system headers and take the const pointer to the
  55 // allocated memory. (radar://11160612)
  56 // Test default parameter.
  57 int const_ptr_and_callback_def_param(int, const char*, int n, void(*)(void*) = free);
  58 void r11160612_3() {
  59   char *x = (char*)malloc(12);
  60   const_ptr_and_callback_def_param(0, x, 12);
  61 }
  62
  63 int const_ptr_and_callback_def_param_null(int, const char*, int n, void(*)(void*) = 0);
  64 void r11160612_no_callback() {
  65   char *x = (char*)malloc(12);
  66   const_ptr_and_callback_def_param_null(0, x, 12);
  67 } // expected-warning{{leak}}
  68
  69 // Test member function pointer.
  70 struct CanFreeMemory {
  71   static void myFree(void*);
  72 };
  73 //This is handled because we look at the type of the parameter(not argument).
  74 void r11160612_3(CanFreeMemory* p) {
  75   char *x = (char*)malloc(12);
  76   const_ptr_and_callback_def_param(0, x, 12, p->myFree);
  77 }
  78
  79
  80 namespace PR13751 {
  81   class OwningVector {
  82     void **storage;
  83     size_t length;
  84   public:
  85     OwningVector();
  86     ~OwningVector();
  87     void push_back(void *Item) {
  88       storage[length++] = Item;
  89     }
  90   };
  91
  92   void testDestructors() {
  93     OwningVector v;
  94     v.push_back(malloc(4));
  95     // no leak warning; freed in destructor
  96   }
  97 }
  98
  99 struct X { void *a; };
 100
 101 struct X get() {
 102   struct X result;
 103   result.a = malloc(4);
 104   return result; // no-warning
 105 }
 106
 107 // Ensure that regions accessible through a LazyCompoundVal trigger region escape.
 108 // Malloc checker used to report leaks for the following two test cases.
 109 struct Property {
 110   char* getterName;
 111   Property(char* n)
 112   : getterName(n) {}
 113
 114 };
 115 void append(Property x);
 116
 117 void appendWrapper(char *getterName) {
 118   append(Property(getterName));
 119 }
 120 void foo(const char* name) {
 121   char* getterName = strdup(name);
 122   appendWrapper(getterName); // no-warning
 123 }
 124
 125 struct NestedProperty {
 126   Property prop;
 127   NestedProperty(Property p)
 128   : prop(p) {}
 129 };
 130 void appendNested(NestedProperty x);
 131
 132 void appendWrapperNested(char *getterName) {
 133   appendNested(NestedProperty(Property(getterName)));
 134 }
 135 void fooNested(const char* name) {
 136   char* getterName = strdup(name);
 137   appendWrapperNested(getterName); // no-warning
 138 }
 139
 140 namespace PR31226 {
 141   struct b2 {
 142     int f;
 143   };
 144
 145   struct b1 : virtual b2 {
 146     void m();
 147   };
 148
 149   struct d : b1, b2 {
 150   };
 151
 152   void f() {
 153     d *p = new d();
 154     p->m(); // no-crash // no-warning
 155   }
 156 }
 157
 158 // Allow __cxa_demangle to escape.
 159 char* test_cxa_demangle(const char* sym) {
 160   size_t funcnamesize = 256;
 161   char* funcname = (char*)malloc(funcnamesize);
 162   int status;
 163   char* ret = abi::__cxa_demangle(sym, funcname, &funcnamesize, &status);
 164   if (status == 0) {
 165     funcname = ret;
 166   }
 167   return funcname; // no-warning
 168 }
 169
 170 namespace argument_leak {
 171 class A {
 172   char *name;
 173
 174 public:
 175   char *getName() {
 176     if (!name) {
 177       name = static_cast<char *>(malloc(10));
 178     }
 179     return name;
 180   }
 181   ~A() {
 182     if (name) {
 183       delete[] name;
 184     }
 185   }
 186 };
 187
 188 void test(A a) {
 189   (void)a.getName();
 190 }
 191 } // namespace argument_leak
 192
 193 #define ZERO_SIZE_PTR ((void *)16)
 194
 195 void test_delete_ZERO_SIZE_PTR() {
 196   int *Ptr = (int *)ZERO_SIZE_PTR;
 197   // ZERO_SIZE_PTR is specially handled but only for malloc family
 198   delete Ptr; // expected-warning{{Argument to 'delete' is a constant address (16)}}
 199 }
 200
 201 namespace pr46253_class {
 202 class a {
 203   void *realloc(int, bool = false) { realloc(1); } // no-crash
 204 };
 205 } // namespace pr46253_class
 206
 207 namespace pr46253_retty{
 208 void realloc(void *ptr, size_t size) { realloc(ptr, size); } // no-crash
 209 } // namespace pr46253_retty
 210
 211 namespace pr46253_paramty{
 212 void *realloc(void **ptr, size_t size) { realloc(ptr, size); } // no-crash
 213 } // namespace pr46253_paramty
 214
 215 namespace pr46253_paramty2{
 216 void *realloc(void *ptr, int size) { realloc(ptr, size); } // no-crash
 217 } // namespace pr46253_paramty2