248 lines · plain
1// RUN: %clang_analyze_cc1 -triple x86_64-apple-darwin -analyzer-output=text\2// RUN: -analyzer-checker=osx.coreFoundation.containers.PointerSizedValues\3// RUN: -analyzer-checker=osx.coreFoundation.containers.OutOfBounds\4// RUN: -verify %s5 6typedef const struct __CFAllocator * CFAllocatorRef;7typedef const struct __CFString * CFStringRef;8typedef unsigned char Boolean;9typedef signed long CFIndex;10extern11const CFAllocatorRef kCFAllocatorDefault;12typedef const void * (*CFArrayRetainCallBack)(CFAllocatorRef allocator, const void *value);13typedef void (*CFArrayReleaseCallBack)(CFAllocatorRef allocator, const void *value);14typedef CFStringRef (*CFArrayCopyDescriptionCallBack)(const void *value);15typedef Boolean (*CFArrayEqualCallBack)(const void *value1, const void *value2);16typedef struct {17 CFIndex version;18 CFArrayRetainCallBack retain;19 CFArrayReleaseCallBack release;20 CFArrayCopyDescriptionCallBack copyDescription;21 CFArrayEqualCallBack equal;22} CFArrayCallBacks;23typedef const struct __CFArray * CFArrayRef;24CFArrayRef CFArrayCreate(CFAllocatorRef allocator, const void **values, CFIndex numValues, const CFArrayCallBacks *callBacks);25typedef struct __CFArray * CFMutableArrayRef;26typedef const struct __CFString * CFStringRef;27enum {28 kCFNumberSInt8Type = 1,29 kCFNumberSInt16Type = 2,30 kCFNumberSInt32Type = 3,31 kCFNumberSInt64Type = 4,32 kCFNumberFloat32Type = 5,33 kCFNumberFloat64Type = 6,34 kCFNumberCharType = 7,35 kCFNumberShortType = 8,36 kCFNumberIntType = 9,37 kCFNumberLongType = 10,38 kCFNumberLongLongType = 11,39 kCFNumberFloatType = 12,40 kCFNumberDoubleType = 13,41 kCFNumberCFIndexType = 14,42 kCFNumberNSIntegerType = 15,43 kCFNumberCGFloatType = 16,44 kCFNumberMaxType = 1645};46typedef CFIndex CFNumberType;47typedef const struct __CFNumber * CFNumberRef;48typedef CFIndex CFComparisonResult;49typedef const struct __CFDictionary * CFDictionaryRef;50typedef const void * (*CFDictionaryRetainCallBack)(CFAllocatorRef allocator, const void *value);51typedef void (*CFDictionaryReleaseCallBack)(CFAllocatorRef allocator, const void *value);52typedef CFStringRef (*CFDictionaryCopyDescriptionCallBack)(const void *value);53typedef Boolean (*CFDictionaryEqualCallBack)(const void *value1, const void *value2);54typedef Boolean (*CFArrayEqualCallBack)(const void *value1, const void *value2);55typedef Boolean (*CFSetEqualCallBack)(const void *value1, const void *value2);56typedef const void * (*CFSetRetainCallBack)(CFAllocatorRef allocator, const void *value);57typedef void (*CFSetReleaseCallBack)(CFAllocatorRef allocator, const void *value);58typedef CFStringRef (*CFSetCopyDescriptionCallBack)(const void *value);59typedef struct {60 CFIndex version;61 CFSetRetainCallBack retain;62 CFSetReleaseCallBack release;63 CFSetCopyDescriptionCallBack copyDescription;64 CFSetEqualCallBack equal;65} CFSetCallBacks;66typedef struct {67 CFIndex version;68 CFDictionaryRetainCallBack retain;69 CFDictionaryReleaseCallBack release;70 CFDictionaryCopyDescriptionCallBack copyDescription;71 CFDictionaryEqualCallBack equal;72} CFDictionaryKeyCallBacks;73typedef struct {74 CFIndex version;75 CFDictionaryRetainCallBack retain;76 CFDictionaryReleaseCallBack release;77 CFDictionaryCopyDescriptionCallBack copyDescription;78 CFDictionaryEqualCallBack equal;79} CFDictionaryValueCallBacks;80CFDictionaryRef CFDictionaryCreate(CFAllocatorRef allocator, const void **keys, const void **values, CFIndex numValues, const CFDictionaryKeyCallBacks *keyCallBacks, const CFDictionaryValueCallBacks *valueCallBacks);81extern82const CFDictionaryValueCallBacks kCFTypeDictionaryValueCallBacks;83typedef const struct __CFSet * CFSetRef;84extern85const CFSetCallBacks kCFTypeSetCallBacks;86extern87const CFDictionaryKeyCallBacks kCFCopyStringDictionaryKeyCallBacks;88extern89const void *CFArrayGetValueAtIndex(CFArrayRef theArray, CFIndex idx);90extern91CFIndex CFArrayGetCount(CFArrayRef theArray);92CFDictionaryRef CFDictionaryCreate(CFAllocatorRef allocator, const void **keys, const void **values, CFIndex numValues, const 93CFDictionaryKeyCallBacks *keyCallBacks, const CFDictionaryValueCallBacks *valueCallBacks);94CFNumberRef CFNumberCreate(CFAllocatorRef allocator, CFNumberType theType, const void *valuePtr);95extern96CFSetRef CFSetCreate(CFAllocatorRef allocator, const void **values, CFIndex numValues, const CFSetCallBacks *callBacks);97#define CFSTR(cStr) ((CFStringRef) __builtin___CFStringMakeConstantString ("" cStr ""))98#define NULL __null99 100// Done with the headers.101// Test alpha.osx.cocoa.ContainerAPI checker.102void testContainers(int **xNoWarn, CFIndex count) {103 int x[] = { 1, 2, 3 };104 CFArrayRef foo = CFArrayCreate(kCFAllocatorDefault, (const void **) x, sizeof(x) / sizeof(x[0]), 0);105 // expected-warning@-1 {{The second argument to 'CFArrayCreate' must be a C array of pointer-sized}}106 // expected-note@-2 {{The second argument to 'CFArrayCreate' must be a C array of pointer-sized}}107 108 CFArrayRef fooNoWarn = CFArrayCreate(kCFAllocatorDefault, (const void **) xNoWarn, sizeof(xNoWarn) / sizeof(xNoWarn[0]), 0); // no warning109 CFArrayRef fooNoWarn2 = CFArrayCreate(kCFAllocatorDefault, 0, sizeof(xNoWarn) / sizeof(xNoWarn[0]), 0);// no warning, passing in 0110 CFArrayRef fooNoWarn3 = CFArrayCreate(kCFAllocatorDefault, NULL, sizeof(xNoWarn) / sizeof(xNoWarn[0]), 0);// no warning, passing in NULL111 112 CFSetRef set = CFSetCreate(NULL, (const void **)x, 3, &kCFTypeSetCallBacks);113 // expected-warning@-1 {{The second argument to 'CFSetCreate' must be a C array of pointer-sized values}}114 // expected-note@-2 {{The second argument to 'CFSetCreate' must be a C array of pointer-sized values}}115 CFArrayRef* pairs = new CFArrayRef[count];116 CFSetRef fSet = CFSetCreate(kCFAllocatorDefault, (const void**) pairs, count - 1, &kCFTypeSetCallBacks);// no warning117}118 119void CreateDict(int *elems) {120 const short days28 = 28;121 const short days30 = 30;122 const short days31 = 31;123 CFIndex numValues = 6; 124 CFStringRef keys[6];125 CFNumberRef values[6];126 keys[0] = CFSTR("January"); values[0] = CFNumberCreate(kCFAllocatorDefault, kCFNumberShortType, &days31);127 keys[1] = CFSTR("February"); values[1] = CFNumberCreate(kCFAllocatorDefault, kCFNumberShortType, &days28);128 keys[2] = CFSTR("March"); values[2] = CFNumberCreate(kCFAllocatorDefault, kCFNumberShortType, &days31);129 keys[3] = CFSTR("April"); values[3] = CFNumberCreate(kCFAllocatorDefault, kCFNumberShortType, &days30);130 keys[4] = CFSTR("May"); values[4] = CFNumberCreate(kCFAllocatorDefault, kCFNumberShortType, &days31);131 keys[5] = CFSTR("June"); values[5] = CFNumberCreate(kCFAllocatorDefault, kCFNumberShortType, &days30);132 133 const CFDictionaryKeyCallBacks keyCB = kCFCopyStringDictionaryKeyCallBacks;134 const CFDictionaryValueCallBacks valCB = kCFTypeDictionaryValueCallBacks;135 CFDictionaryRef dict1 = CFDictionaryCreate(kCFAllocatorDefault, (const void**)keys, (const void**)values, numValues, &keyCB, &valCB); // no warning136 CFDictionaryRef dict2 = CFDictionaryCreate(kCFAllocatorDefault, (const void**)elems[0], (const void**)values, numValues, &keyCB, &valCB);137 // expected-warning@-1 {{The second argument to 'CFDictionaryCreate' must be a C array of}}138 // expected-note@-2 {{The second argument to 'CFDictionaryCreate' must be a C array of}}139 // expected-warning@-3{{cast to 'const void **' from smaller integer type 'int'}}140 CFDictionaryRef dict3 = CFDictionaryCreate(kCFAllocatorDefault, (const void**)keys, (const void**)elems, numValues, &keyCB, &valCB);141 // expected-warning@-1 {{The third argument to 'CFDictionaryCreate' must be a C array of pointer-sized values}}142 // expected-note@-2 {{The third argument to 'CFDictionaryCreate' must be a C array of pointer-sized values}}143}144 145void OutOfBoundsSymbolicOffByOne(const void ** input, CFIndex S) {146 CFArrayRef array;147 array = CFArrayCreate(kCFAllocatorDefault, input, S, 0);148 const void *s1 = CFArrayGetValueAtIndex(array, 0); // no warning149 const void *s2 = CFArrayGetValueAtIndex(array, S-1); // no warning150 const void *s3 = CFArrayGetValueAtIndex(array, S); // expected-warning {{Index is out of bounds}}151 // expected-note@-1 {{Index is out of bounds}}152}153 154void OutOfBoundsConst(const void ** input, CFIndex S) {155 CFArrayRef array;156 array = CFArrayCreate(kCFAllocatorDefault, input, 3, 0);157 const void *s1 = CFArrayGetValueAtIndex(array, 0); // no warning158 const void *s2 = CFArrayGetValueAtIndex(array, 2); // no warning159 const void *s3 = CFArrayGetValueAtIndex(array, 5); // expected-warning {{Index is out of bounds}}160 // expected-note@-1 {{Index is out of bounds}}161 162 // TODO: The solver is probably not strong enough here.163 CFIndex sIndex;164 for (sIndex = 0 ; sIndex <= 5 ; sIndex += 3 ) {165 const void *s = CFArrayGetValueAtIndex(array, sIndex); 166 } 167}168 169void OutOfBoundsZiro(const void ** input, CFIndex S) {170 CFArrayRef array;171 // The API allows to set the size to 0. Check that we don't undeflow when the size is 0.172 array = CFArrayCreate(kCFAllocatorDefault, 0, 0, 0);173 const void *s1 = CFArrayGetValueAtIndex(array, 0); // expected-warning {{Index is out of bounds}}174 // expected-note@-1 {{Index is out of bounds}}175}176 177void TestGetCount(CFArrayRef A, CFIndex sIndex) {178 CFIndex sCount = CFArrayGetCount(A); // expected-note{{'sCount' initialized here}}179 if (sCount > sIndex) // expected-note{{Assuming 'sCount' is <= 'sIndex'}}180 // expected-note@-1{{Taking false branch}}181 const void *s1 = CFArrayGetValueAtIndex(A, sIndex);182 const void *s2 = CFArrayGetValueAtIndex(A, sCount);// expected-warning {{Index is out of bounds}}183 // expected-note@-1 {{Index is out of bounds}}184}185 186typedef void* XX[3];187void TestPointerToArray(int *elems, void *p1, void *p2, void *p3, unsigned count, void* fn[], char cp[]) {188 void* x[] = { p1, p2, p3 };189 CFArrayCreate(0, (const void **) &x, count, 0); // no warning190 191 void* y[] = { p1, p2, p3 };192 CFArrayCreate(0, (const void **) y, count, 0); // no warning193 XX *z = &x;194 CFArrayCreate(0, (const void **) z, count, 0); // no warning195 196 CFArrayCreate(0, (const void **) &fn, count, 0); // false negative197 CFArrayCreate(0, (const void **) fn, count, 0); // no warning198 CFArrayCreate(0, (const void **) cp, count, 0); // expected-warning {{The second argument to 'CFArrayCreate' must be a C array of pointer-sized}}199 // expected-note@-1 {{The second argument to 'CFArrayCreate' must be a C array of pointer-sized}}200 201 char cc[] = { 0, 2, 3 };202 CFArrayCreate(0, (const void **) &cc, count, 0); // expected-warning {{The second argument to 'CFArrayCreate' must be a C array of pointer-sized}}203 // expected-note@-1 {{The second argument to 'CFArrayCreate' must be a C array of pointer-sized}}204 CFArrayCreate(0, (const void **) cc, count, 0); // expected-warning {{The second argument to 'CFArrayCreate' must be a C array of pointer-sized}}205 // expected-note@-1 {{The second argument to 'CFArrayCreate' must be a C array of pointer-sized}}206}207 208void TestUndef(CFArrayRef A, CFIndex sIndex, void* x[]) {209 unsigned undefVal;210 const void *s1 = CFArrayGetValueAtIndex(A, undefVal);211 212 unsigned undefVal2;213 CFArrayRef B = CFArrayCreate(0, (const void **) &x, undefVal2, 0); 214 const void *s2 = CFArrayGetValueAtIndex(B, 2);215}216 217void TestConst(CFArrayRef A, CFIndex sIndex, void* x[]) {218 CFArrayRef B = CFArrayCreate(0, (const void **) &x, 4, 0); 219 const void *s1 = CFArrayGetValueAtIndex(B, 2);220 221}222 223void TestNullArray() {224 CFArrayGetValueAtIndex(0, 0);225}226 227void ArrayRefMutableEscape(CFMutableArrayRef a);228void ArrayRefEscape(CFArrayRef a);229 230void TestCFMutableArrayRefEscapeViaMutableArgument(CFMutableArrayRef a) {231 CFIndex aLen = CFArrayGetCount(a);232 ArrayRefMutableEscape(a);233 234 // ArrayRefMutableEscape could mutate a to make it have235 // at least aLen + 1 elements, so do not report an error here.236 CFArrayGetValueAtIndex(a, aLen);237}238 239void TestCFMutableArrayRefEscapeViaImmutableArgument(CFMutableArrayRef a) {240 CFIndex aLen = CFArrayGetCount(a); // expected-note{{'aLen' initialized here}}241 ArrayRefEscape(a);242 243 // ArrayRefEscape is declared to take a CFArrayRef (i.e, an immutable array)244 // so we assume it does not change the length of a.245 CFArrayGetValueAtIndex(a, aLen); // expected-warning {{Index is out of bounds}}246 // expected-note@-1 {{Index is out of bounds}}247}248