clang/test/Analysis/array-bound-v2-constraint-check.c

   1 // RUN: %clang_analyze_cc1 -analyzer-checker=core,unix.Malloc,alpha.security.ArrayBoundV2,debug.ExprInspection \
   2 // RUN:   -analyzer-config eagerly-assume=false -verify %s
   3
   4 void clang_analyzer_eval(int);
   5 void clang_analyzer_printState(void);
   6
   7 typedef typeof(sizeof(int)) size_t;
   8 const char a[] = "abcd"; // extent: 5 bytes
   9
  10 void symbolic_size_t_and_int0(size_t len) {
  11   (void)a[len + 1]; // no-warning
  12   // We infered that the 'len' must be in a specific range to make the previous indexing valid.
  13   // len: [0,3]
  14   clang_analyzer_eval(len <= 3); // expected-warning {{TRUE}}
  15   clang_analyzer_eval(len <= 2); // expected-warning {{UNKNOWN}}
  16 }
  17
  18 void symbolic_size_t_and_int1(size_t len) {
  19   (void)a[len]; // no-warning
  20   // len: [0,4]
  21   clang_analyzer_eval(len <= 4); // expected-warning {{TRUE}}
  22   clang_analyzer_eval(len <= 3); // expected-warning {{UNKNOWN}}
  23 }
  24
  25 void symbolic_size_t_and_int2(size_t len) {
  26   (void)a[len - 1]; // no-warning
  27   // len: [1,5]
  28   clang_analyzer_eval(1 <= len && len <= 5); // expected-warning {{TRUE}}
  29   clang_analyzer_eval(2 <= len);             // expected-warning {{UNKNOWN}}
  30   clang_analyzer_eval(len <= 4);             // expected-warning {{UNKNOWN}}
  31 }
  32
  33 void symbolic_uint_and_int0(unsigned len) {
  34   (void)a[len + 1]; // no-warning
  35   // len: [0,3]
  36   clang_analyzer_eval(0 <= len && len <= 3); // expected-warning {{TRUE}}
  37   clang_analyzer_eval(1 <= len);             // expected-warning {{UNKNOWN}}
  38   clang_analyzer_eval(len <= 2);             // expected-warning {{UNKNOWN}}
  39 }
  40
  41 void symbolic_uint_and_int1(unsigned len) {
  42   (void)a[len]; // no-warning
  43   // len: [0,4]
  44   clang_analyzer_eval(0 <= len && len <= 4); // expected-warning {{TRUE}}
  45   clang_analyzer_eval(1 <= len);             // expected-warning {{UNKNOWN}}
  46   clang_analyzer_eval(len <= 3);             // expected-warning {{UNKNOWN}}
  47 }
  48 void symbolic_uint_and_int2(unsigned len) {
  49   (void)a[len - 1]; // no-warning
  50   // len: [1,5]
  51   clang_analyzer_eval(1 <= len && len <= 5); // expected-warning {{TRUE}}
  52   clang_analyzer_eval(2 <= len);             // expected-warning {{UNKNOWN}}
  53   clang_analyzer_eval(len <= 4);             // expected-warning {{UNKNOWN}}
  54 }
  55
  56 void symbolic_int_and_int0(int len) {
  57   (void)a[len + 1]; // no-warning
  58   // len: [-1,3]
  59   clang_analyzer_eval(-1 <= len && len <= 3); // expected-warning {{TRUE}}
  60   clang_analyzer_eval(0 <= len);              // expected-warning {{UNKNOWN}}
  61   clang_analyzer_eval(len <= 2);              // expected-warning {{UNKNOWN}}
  62 }
  63 void symbolic_int_and_int1(int len) {
  64   (void)a[len]; // no-warning
  65   // len: [0,4]
  66   clang_analyzer_eval(0 <= len && len <= 4); // expected-warning {{TRUE}}
  67   clang_analyzer_eval(1 <= len);             // expected-warning {{UNKNOWN}}
  68   clang_analyzer_eval(len <= 3);             // expected-warning {{UNKNOWN}}
  69 }
  70 void symbolic_int_and_int2(int len) {
  71   (void)a[len - 1]; // no-warning
  72   // len: [1,5]
  73   clang_analyzer_eval(1 <= len && len <= 5); // expected-warning {{TRUE}}
  74   clang_analyzer_eval(2 <= len);             // expected-warning {{UNKNOWN}}
  75   clang_analyzer_eval(len <= 4);             // expected-warning {{UNKNOWN}}
  76 }
  77
  78 void symbolic_longlong_and_int0(long long len) {
  79   (void)a[len + 1]; // no-warning
  80   // len: [-1,3]
  81   clang_analyzer_eval(-1 <= len && len <= 3); // expected-warning {{TRUE}}
  82   clang_analyzer_eval(0 <= len);              // expected-warning {{UNKNOWN}}
  83   clang_analyzer_eval(len <= 2);              // expected-warning {{UNKNOWN}}
  84 }
  85
  86 void *malloc(size_t);
  87 void free(void *);
  88 void symbolic_longlong_and_int0_dynamic_extent(long long len) {
  89   char *b = malloc(5);
  90   (void)b[len + 1]; // no-warning
  91   // len: [-1,3]
  92   clang_analyzer_eval(-1 <= len && len <= 3); // expected-warning {{TRUE}}
  93   clang_analyzer_eval(0 <= len);              // expected-warning {{UNKNOWN}}
  94   clang_analyzer_eval(len <= 2);              // expected-warning {{UNKNOWN}}
  95   free(b);
  96 }
  97
  98 void symbolic_longlong_and_int1(long long len) {
  99   (void)a[len]; // no-warning
 100   // len: [0,4]
 101   clang_analyzer_eval(0 <= len && len <= 4); // expected-warning {{TRUE}}
 102   clang_analyzer_eval(1 <= len);             // expected-warning {{UNKNOWN}}
 103   clang_analyzer_eval(len <= 3);             // expected-warning {{UNKNOWN}}
 104 }
 105
 106 void symbolic_longlong_and_int2(long long len) {
 107   (void)a[len - 1]; // no-warning
 108   // len: [1,5]
 109   clang_analyzer_eval(1 <= len && len <= 5); // expected-warning {{TRUE}}
 110   clang_analyzer_eval(2 <= len);             // expected-warning {{UNKNOWN}}
 111   clang_analyzer_eval(len <= 4);             // expected-warning {{UNKNOWN}}
 112 }