164 lines · c
1// RUN: %clang_analyze_cc1 -analyzer-checker=core,unix.Malloc,security.ArrayBound,debug.ExprInspection \2// RUN: -analyzer-config eagerly-assume=false -verify %s3 4// When the checker security.ArrayBound encounters an array subscript operation5// that _may be_ in bounds, it assumes that indexing _is_ in bound. This test6// file validates these assumptions.7 8void clang_analyzer_value(int);9 10// Simple case: memory area with a static extent.11 12extern int FiveInts[5];13 14void int_plus_one(int len) {15 (void)FiveInts[len + 1]; // no-warning16 clang_analyzer_value(len); // expected-warning {{{ [-1, 3] }}}17}18 19void int_neutral(int len) {20 (void)FiveInts[len]; // no-warning21 clang_analyzer_value(len); // expected-warning {{{ [0, 4] }}}22}23 24void int_minus_one(int len) {25 (void)FiveInts[len - 1]; // no-warning26 clang_analyzer_value(len); // expected-warning {{{ [1, 5] }}}27}28 29void unsigned_plus_one(unsigned len) {30 (void)FiveInts[len + 1]; // no-warning31 clang_analyzer_value(len); // expected-warning {{{ [0, 3] }}}32}33 34void unsigned_neutral(unsigned len) {35 (void)FiveInts[len]; // no-warning36 clang_analyzer_value(len); // expected-warning {{{ [0, 4] }}}37}38 39void unsigned_minus_one(unsigned len) {40 (void)FiveInts[len - 1]; // no-warning41 clang_analyzer_value(len); // expected-warning {{{ [1, 5] }}}42}43 44void ll_plus_one(long long len) {45 (void)FiveInts[len + 1]; // no-warning46 clang_analyzer_value(len); // expected-warning {{{ [-1, 3] }}}47}48 49void ll_neutral(long long len) {50 (void)FiveInts[len]; // no-warning51 clang_analyzer_value(len); // expected-warning {{{ [0, 4] }}}52}53 54void ll_minus_one(long long len) {55 (void)FiveInts[len - 1]; // no-warning56 clang_analyzer_value(len); // expected-warning {{{ [1, 5] }}}57}58 59void ull_plus_one(unsigned long long len) {60 (void)FiveInts[len + 1]; // no-warning61 clang_analyzer_value(len); // expected-warning {{{ [0, 3] }}}62}63 64void ull_neutral(unsigned long long len) {65 (void)FiveInts[len]; // no-warning66 clang_analyzer_value(len); // expected-warning {{{ [0, 4] }}}67}68 69void ull_minus_one(unsigned long long len) {70 (void)FiveInts[len - 1]; // no-warning71 clang_analyzer_value(len); // expected-warning {{{ [1, 5] }}}72}73 74// Also try the same with a dynamically allocated memory block, because in the75// past there were issues with the type/signedness of dynamic extent symbols.76 77typedef __typeof(sizeof(int)) size_t;78void *malloc(size_t);79void free(void *);80 81void dyn_int_plus_one(int len) {82 char *p = malloc(5);83 p[len + 1] = 1; // no-warning84 clang_analyzer_value(len); // expected-warning {{{ [-1, 3] }}}85 free(p);86}87 88void dyn_int_neutral(int len) {89 char *p = malloc(5);90 p[len] = 1; // no-warning91 clang_analyzer_value(len); // expected-warning {{{ [0, 4] }}}92 free(p);93}94 95void dyn_int_minus_one(int len) {96 char *p = malloc(5);97 p[len - 1] = 1; // no-warning98 clang_analyzer_value(len); // expected-warning {{{ [1, 5] }}}99 free(p);100}101 102void dyn_unsigned_plus_one(unsigned len) {103 char *p = malloc(5);104 p[len + 1] = 1; // no-warning105 clang_analyzer_value(len); // expected-warning {{{ [0, 3] }}}106 free(p);107}108 109void dyn_unsigned_neutral(unsigned len) {110 char *p = malloc(5);111 p[len] = 1; // no-warning112 clang_analyzer_value(len); // expected-warning {{{ [0, 4] }}}113 free(p);114}115 116void dyn_unsigned_minus_one(unsigned len) {117 char *p = malloc(5);118 p[len - 1] = 1; // no-warning119 clang_analyzer_value(len); // expected-warning {{{ [1, 5] }}}120 free(p);121}122 123void dyn_ll_plus_one(long long len) {124 char *p = malloc(5);125 p[len + 1] = 1; // no-warning126 clang_analyzer_value(len); // expected-warning {{{ [-1, 3] }}}127 free(p);128}129 130void dyn_ll_neutral(long long len) {131 char *p = malloc(5);132 p[len] = 1; // no-warning133 clang_analyzer_value(len); // expected-warning {{{ [0, 4] }}}134 free(p);135}136 137void dyn_ll_minus_one(long long len) {138 char *p = malloc(5);139 p[len - 1] = 1; // no-warning140 clang_analyzer_value(len); // expected-warning {{{ [1, 5] }}}141 free(p);142}143 144void dyn_ull_plus_one(unsigned long long len) {145 char *p = malloc(5);146 p[len + 1] = 1; // no-warning147 clang_analyzer_value(len); // expected-warning {{{ [0, 3] }}}148 free(p);149}150 151void dyn_ull_neutral(unsigned long long len) {152 char *p = malloc(5);153 p[len] = 1; // no-warning154 clang_analyzer_value(len); // expected-warning {{{ [0, 4] }}}155 free(p);156}157 158void dyn_ull_minus_one(unsigned long long len) {159 char *p = malloc(5);160 p[len - 1] = 1; // no-warning161 clang_analyzer_value(len); // expected-warning {{{ [1, 5] }}}162 free(p);163}164