282 lines · plain
1// RUN: %clang_analyze_cc1 -analyzer-checker=core,unix.MismatchedDeallocator -fblocks -verify %s2// RUN: %clang_analyze_cc1 -analyzer-checker=core,unix.MismatchedDeallocator -fblocks -DTEST_INLINABLE_ALLOCATORS -verify %s3 4#include "Inputs/system-header-simulator-objc.h"5#include "Inputs/system-header-simulator-cxx.h"6 7typedef __typeof__(sizeof(int)) size_t;8void *malloc(size_t);9void *realloc(void *ptr, size_t size);10void *calloc(size_t nmemb, size_t size);11char *strdup(const char *s);12void __attribute((ownership_returns(malloc))) *my_malloc(size_t);13 14void free(void *);15void __attribute((ownership_takes(malloc, 1))) my_free(void *);16 17void __attribute((ownership_returns(malloc1))) *my_malloc1(size_t);18void __attribute((ownership_takes(malloc1, 1))) my_free1(void *);19 20void __attribute((ownership_returns(malloc2))) *my_malloc2(size_t);21 22// The order of these declarations are important to verify that analisys still works even23// if there are less specific declarations of the same functions24void __attribute((ownership_returns(malloc3))) *my_malloc3(size_t);25void *my_malloc3(size_t);26 27void *my_malloc4(size_t);28void __attribute((ownership_returns(malloc4))) *my_malloc4(size_t);29 30//---------------------------------------------------------------31// Test if an allocation function matches deallocation function32//---------------------------------------------------------------33 34//--------------- test malloc family35void testMalloc1() {36 int *p = (int *)malloc(sizeof(int));37 delete p; // expected-warning{{Memory allocated by 'malloc()' should be deallocated by 'free()', not 'delete'}}38}39 40void testMalloc2() {41 int *p = (int *)malloc(8);42 int *q = (int *)realloc(p, 16);43 delete q; // expected-warning{{Memory allocated by 'realloc()' should be deallocated by 'free()', not 'delete'}}44}45 46void testMalloc3() {47 int *p = (int *)calloc(1, sizeof(int));48 delete p; // expected-warning{{Memory allocated by 'calloc()' should be deallocated by 'free()', not 'delete'}}49}50 51void testMalloc4(const char *s) {52 char *p = strdup(s);53 delete p; // expected-warning{{Memory allocated by 'strdup()' should be deallocated by 'free()', not 'delete'}}54}55 56void testMalloc5() {57 int *p = (int *)my_malloc(sizeof(int));58 delete p; // expected-warning{{Memory allocated by 'my_malloc()' should be deallocated by 'free()', not 'delete'}}59}60 61void testMalloc6() {62 int *p = (int *)malloc(sizeof(int));63 operator delete(p); // expected-warning{{Memory allocated by 'malloc()' should be deallocated by 'free()', not 'operator delete'}}64}65 66void testMalloc7() {67 int *p = (int *)malloc(sizeof(int));68 delete[] p; // expected-warning{{Memory allocated by 'malloc()' should be deallocated by 'free()', not 'delete[]'}}69}70 71void testMalloc8() {72 int *p = (int *)malloc(sizeof(int));73 operator delete[](p); // expected-warning{{Memory allocated by 'malloc()' should be deallocated by 'free()', not 'operator delete[]'}}74}75 76void testMalloc9() {77 int *p = (int *)my_malloc(sizeof(int));78 my_free(p); // no warning79}80 81void testMalloc10() {82 int *p = (int *)my_malloc1(sizeof(int));83 my_free1(p); // no warning84}85 86void testMalloc11() {87 int *p = (int *)my_malloc1(sizeof(int));88 my_free(p); // expected-warning{{Memory allocated by 'my_malloc1()' should be deallocated by function that takes ownership of 'malloc1', not 'my_free()', which takes ownership of 'malloc'}}89}90 91void testMalloc12() {92 int *p = (int *)my_malloc2(sizeof(int));93 my_free1(p); // expected-warning{{Memory allocated by 'my_malloc2()' should be deallocated by function that takes ownership of 'malloc2', not 'my_free1()', which takes ownership of 'malloc1'}}94}95 96void testMalloc13() {97 int *p = (int *)my_malloc1(sizeof(int));98 free(p); // expected-warning{{Memory allocated by 'my_malloc1()' should be deallocated by function that takes ownership of 'malloc1', not 'free()'}}99}100 101void testMalloc14() {102 int *p = (int *)my_malloc3(sizeof(int));103 free(p); // expected-warning{{Memory allocated by 'my_malloc3()' should be deallocated by function that takes ownership of 'malloc3', not 'free()'}}104}105 106void testMalloc15() {107 int *p = (int *)my_malloc4(sizeof(int));108 free(p); // expected-warning{{Memory allocated by 'my_malloc4()' should be deallocated by function that takes ownership of 'malloc4', not 'free()'}}109}110 111void testAlloca() {112 int *p = (int *)__builtin_alloca(sizeof(int));113 delete p; // expected-warning{{Memory allocated by 'alloca()' should not be deallocated}}114}115 116//--------------- test new family117void testNew1() {118 int *p = new int;119 free(p); // expected-warning{{Memory allocated by 'new' should be deallocated by 'delete', not 'free()'}}120}121 122void testNew2() {123 int *p = (int *)operator new(0);124 free(p); // expected-warning{{Memory allocated by 'operator new' should be deallocated by 'delete', not 'free()'}}125}126 127void testNew3() {128 int *p = new int[1];129 free(p); // expected-warning{{Memory allocated by 'new[]' should be deallocated by 'delete[]', not 'free()'}}130}131 132void testNew4() {133 int *p = new int;134 realloc(p, sizeof(long)); // expected-warning{{Memory allocated by 'new' should be deallocated by 'delete', not 'realloc()'}}135}136 137void testNew5() {138 int *p = (int *)operator new(0);139 realloc(p, sizeof(long)); // expected-warning{{Memory allocated by 'operator new' should be deallocated by 'delete', not 'realloc()'}}140}141 142void testNew6() {143 int *p = new int[1];144 realloc(p, sizeof(long)); // expected-warning{{Memory allocated by 'new[]' should be deallocated by 'delete[]', not 'realloc()'}}145}146 147int *allocInt() {148 return new int;149}150void testNew7() {151 int *p = allocInt();152 delete[] p; // expected-warning{{Memory allocated by 'new' should be deallocated by 'delete', not 'delete[]'}}153}154 155void testNew8() {156 int *p = (int *)operator new(0);157 delete[] p; // expected-warning{{Memory allocated by 'operator new' should be deallocated by 'delete', not 'delete[]'}}158}159 160int *allocIntArray(unsigned c) {161 return new int[c];162}163 164void testNew9() {165 int *p = allocIntArray(1);166 delete p; // expected-warning{{Memory allocated by 'new[]' should be deallocated by 'delete[]', not 'delete'}}167}168 169void testNew10() {170 int *p = (int *)operator new[](0);171 delete p; // expected-warning{{Memory allocated by 'operator new[]' should be deallocated by 'delete[]', not 'delete'}}172}173 174void testNew11(NSUInteger dataLength) {175 int *p = new int;176 NSData *d = [NSData dataWithBytesNoCopy:p length:sizeof(int) freeWhenDone:1]; // expected-warning{{+dataWithBytesNoCopy:length:freeWhenDone: cannot take ownership of memory allocated by 'new'}}177}178 179//-------------------------------------------------------180// Check for intersection with unix.Malloc bounded with 181// unix.MismatchedDeallocator182//-------------------------------------------------------183 184// new/delete oparators are subjects of cplusplus.NewDelete.185void testNewDeleteNoWarn() {186 int i;187 delete &i; // no-warning188 189 int *p1 = new int;190 delete ++p1; // no-warning191 192 int *p2 = new int;193 delete p2;194 delete p2; // no-warning195 196 int *p3 = new int; // no-warning197}198 199void testDeleteOpAfterFree() {200 int *p = (int *)malloc(sizeof(int));201 free(p);202 operator delete(p); // no-warning203}204 205void testDeleteAfterFree() {206 int *p = (int *)malloc(sizeof(int));207 free(p);208 delete p; // no-warning209}210 211void testStandardPlacementNewAfterFree() {212 int *p = (int *)malloc(sizeof(int));213 free(p);214 p = new(p) int; // no-warning215}216 217//---------------------------------------------------------------218// Check for intersection with cplusplus.NewDelete bounded with 219// unix.MismatchedDeallocator220//---------------------------------------------------------------221 222// malloc()/free() are subjects of unix.Malloc and unix.MallocWithAnnotations223void testMallocFreeNoWarn() {224 int i;225 free(&i); // no-warning226 227 int *p1 = (int *)malloc(sizeof(int));228 free(++p1); // no-warning229 230 int *p2 = (int *)malloc(sizeof(int));231 free(p2);232 free(p2); // no-warning233 234 int *p3 = (int *)malloc(sizeof(int)); // no-warning235}236 237void testFreeAfterDelete() {238 int *p = new int; 239 delete p;240 free(p); // no-warning241}242 243void testStandardPlacementNewAfterDelete() {244 int *p = new int; 245 delete p;246 p = new(p) int; // no-warning247}248 249 250// Smart pointer example251template <typename T>252struct SimpleSmartPointer {253 T *ptr;254 255 explicit SimpleSmartPointer(T *p = 0) : ptr(p) {}256 ~SimpleSmartPointer() {257 delete ptr;258 // expected-warning@-1 {{Memory allocated by 'new[]' should be deallocated by 'delete[]', not 'delete'}}259 // expected-warning@-2 {{Memory allocated by 'malloc()' should be deallocated by 'free()', not 'delete'}}260 }261};262 263void testSimpleSmartPointerArrayNew() {264 {265 SimpleSmartPointer<int> a(new int);266 } // no-warning267 268 {269 SimpleSmartPointer<int> a(new int[4]);270 }271}272 273void testSimpleSmartPointerMalloc() {274 {275 SimpleSmartPointer<int> a(new int);276 } // no-warning277 278 {279 SimpleSmartPointer<int> a((int *)malloc(4));280 }281}282