281 lines · c
1// RUN: %clang_analyze_cc1 -triple x86_64-apple-darwin9 -fenable-matrix -analyzer-checker=core,alpha.core,debug.ExprInspection -Wno-pointer-to-int-cast -Wno-strict-prototypes -verify -analyzer-config eagerly-assume=false %s2// RUN: %clang_analyze_cc1 -triple i386-apple-darwin9 -fenable-matrix -analyzer-checker=core,alpha.core,debug.ExprInspection -Wno-pointer-to-int-cast -Wno-strict-prototypes -verify -analyzer-config eagerly-assume=false %s3// RUN: %clang_analyze_cc1 -triple x86_64-apple-darwin9 -fenable-matrix -analyzer-checker=core,alpha.core,debug.ExprInspection -Wno-pointer-to-int-cast -Wno-strict-prototypes -verify -DEAGERLY_ASSUME=1 -w %s4// RUN: %clang_analyze_cc1 -triple i386-apple-darwin9 -fenable-matrix -analyzer-checker=core,alpha.core,debug.ExprInspection -Wno-pointer-to-int-cast -Wno-strict-prototypes -verify -DEAGERLY_ASSUME=1 -DBIT32=1 -w %s5 6extern void clang_analyzer_eval(_Bool);7 8// Test if the 'storage' region gets properly initialized after it is cast to9// 'struct sockaddr *'. 10 11typedef unsigned char __uint8_t;12typedef unsigned int __uint32_t;13typedef __uint32_t __darwin_socklen_t;14typedef __uint8_t sa_family_t;15typedef __darwin_socklen_t socklen_t;16struct sockaddr { sa_family_t sa_family; };17struct sockaddr_storage {};18 19void getsockname();20 21#ifndef EAGERLY_ASSUME22 23void f(int sock) {24 struct sockaddr_storage storage;25 struct sockaddr* sockaddr = (struct sockaddr*)&storage; // expected-warning{{Casting data to a larger structure type and accessing a field can lead to memory access errors or data corruption}}26 socklen_t addrlen = sizeof(storage);27 getsockname(sock, sockaddr, &addrlen);28 switch (sockaddr->sa_family) { // no-warning29 default:30 ;31 }32}33 34struct s {35 struct s *value;36};37 38void f1(struct s **pval) {39 int *tbool = ((void*)0);40 struct s *t = *pval;41 pval = &(t->value);42 tbool = (int *)pval; // use the cast-to type 'int *' to create element region.43 char c = (unsigned char) *tbool; // Should use cast-to type to create symbol.44 if (*tbool == -1) // here load the element region with the correct type 'int'45 (void)3;46}47 48void f2(const char *str) {49 unsigned char ch, cl, *p;50 51 p = (unsigned char *)str;52 ch = *p++; // use cast-to type 'unsigned char' to create element region.53 cl = *p++;54 if(!cl)55 cl = 'a';56}57 58// Test cast VariableSizeArray to pointer does not crash.59void *memcpy(void *, void const *, unsigned long);60typedef unsigned char Byte;61void doit(char *data, int len) {62 if (len) {63 Byte buf[len];64 memcpy(buf, data, len);65 }66}67 68// PR 6013 and 6035 - Test that a cast of a pointer to long and then to int does not crash SValuator.69void pr6013_6035_test(void *p) {70 unsigned int foo;71 foo = ((long)(p));72 (void) foo;73}74 75// PR12511 - Test that we support SymCastExpr, which represents symbolic int to float cast.76char ttt(int intSeconds) {77 double seconds = intSeconds;78 if (seconds)79 return 0;80 return 0;81}82 83int foo (int* p) {84 int y = 0;85 if (p == 0) {86 if ((*((void**)&p)) == (void*)0) // Test that the cast to void preserves the symbolic region.87 return 0;88 else89 return 5/y; // This code should be unreachable: no-warning.90 }91 return 0;92}93 94void castsToBool(void) {95 clang_analyzer_eval(0); // expected-warning{{FALSE}}96 clang_analyzer_eval(0U); // expected-warning{{FALSE}}97 clang_analyzer_eval((void *)0); // expected-warning{{FALSE}}98 99 clang_analyzer_eval(1); // expected-warning{{TRUE}}100 clang_analyzer_eval(1U); // expected-warning{{TRUE}}101 clang_analyzer_eval(-1); // expected-warning{{TRUE}}102 clang_analyzer_eval(0x100); // expected-warning{{TRUE}}103 clang_analyzer_eval(0x100U); // expected-warning{{TRUE}}104 clang_analyzer_eval((void *)0x100); // expected-warning{{TRUE}}105 106 extern int symbolicInt;107 clang_analyzer_eval(symbolicInt); // expected-warning{{UNKNOWN}}108 if (symbolicInt)109 clang_analyzer_eval(symbolicInt); // expected-warning{{TRUE}}110 111 extern void *symbolicPointer;112 clang_analyzer_eval(symbolicPointer); // expected-warning{{UNKNOWN}}113 if (symbolicPointer)114 clang_analyzer_eval(symbolicPointer); // expected-warning{{TRUE}}115 116 int localInt;117 int* ptr = &localInt;118 clang_analyzer_eval(ptr); // expected-warning{{TRUE}}119 clang_analyzer_eval(&castsToBool); // expected-warning{{TRUE}}120 clang_analyzer_eval("abc"); // expected-warning{{TRUE}}121 122 extern float globalFloat;123 clang_analyzer_eval(globalFloat); // expected-warning{{UNKNOWN}}124}125 126void locAsIntegerCasts(void *p) {127 int x = (int) p;128 clang_analyzer_eval(++x < 10); // no-crash // expected-warning{{UNKNOWN}}129}130 131void multiDimensionalArrayPointerCasts(void) {132 static int x[10][10];133 int *y1 = &(x[3][5]);134 char *z = ((char *) y1) + 2;135 int *y2 = (int *)(z - 2);136 int *y3 = ((int *)x) + 35; // This is offset for [3][5].137 138 clang_analyzer_eval(y1 == y2); // expected-warning{{TRUE}}139 140 // FIXME: should be FALSE (i.e. equal pointers).141 clang_analyzer_eval(y1 - y2); // expected-warning{{UNKNOWN}}142 // FIXME: should be TRUE (i.e. same symbol).143 clang_analyzer_eval(*y1 == *y2); // expected-warning{{UNKNOWN}}144 145 clang_analyzer_eval(*((char *)y1) == *((char *) y2)); // expected-warning{{TRUE}}146 147 clang_analyzer_eval(y1 == y3); // expected-warning{{TRUE}}148 149 // FIXME: should be FALSE (i.e. equal pointers).150 clang_analyzer_eval(y1 - y3); // expected-warning{{UNKNOWN}}151 // FIXME: should be TRUE (i.e. same symbol).152 clang_analyzer_eval(*y1 == *y3); // expected-warning{{UNKNOWN}}153 154 clang_analyzer_eval(*((char *)y1) == *((char *) y3)); // expected-warning{{TRUE}}155}156 157void *getVoidPtr(void);158 159void testCastVoidPtrToIntPtrThroughIntTypedAssignment(void) {160 int *x;161 (*((int *)(&x))) = (int)getVoidPtr();162 *x = 1; // no-crash163}164 165void testCastUIntPtrToIntPtrThroughIntTypedAssignment(void) {166 unsigned u;167 int *x;168 (*((int *)(&x))) = (int)&u;169 *x = 1;170 clang_analyzer_eval(u == 1); // expected-warning{{TRUE}}171}172 173void testCastVoidPtrToIntPtrThroughUIntTypedAssignment(void) {174 int *x;175 (*((int *)(&x))) = (int)(unsigned *)getVoidPtr();176 *x = 1; // no-crash177}178 179void testLocNonLocSymbolAssume(int a, int *b) {180 if ((int)b < a) {} // no-crash181}182 183void testLocNonLocSymbolRemainder(int a, int *b) {184 int c = ((int)b) % a;185 if (a == 1) {186 c += 1;187 }188}189 190void testSwitchWithSizeofs(void) {191 switch (sizeof(char) == 1) { // expected-warning{{switch condition has boolean value}}192 case sizeof(char):; // no-crash193 }194}195 196void test_ToUnion_cast(unsigned long long x) {197 union Key {198 unsigned long long data;199 };200 void clang_analyzer_dump_union(union Key);201 clang_analyzer_dump_union((union Key)x); // expected-warning {{Unknown}}202}203 204typedef char cx5x5 __attribute__((matrix_type(5, 5)));205typedef int ix5x5 __attribute__((matrix_type(5, 5)));206void test_MatrixCast_cast(cx5x5 c) {207 void clang_analyzer_dump_ix5x5(ix5x5);208 clang_analyzer_dump_ix5x5((ix5x5)c); // expected-warning {{Unknown}}209}210 211void test_VectorSplat_cast(long x) {212 typedef int __attribute__((ext_vector_type(2))) V;213 void clang_analyzer_dump_V(V);214 clang_analyzer_dump_V((V)x); // expected-warning {{Unknown}}215}216 217#endif218 219#ifdef EAGERLY_ASSUME220 221int globalA;222extern int globalFunc(void);223void no_crash_on_symsym_cast_to_long(void) {224 char c = globalFunc() - 5;225 c == 0;226 globalA -= c;227 globalA == 3;228 (long)globalA << 48;229 #ifdef BIT32230 // expected-warning@-2{{Left shift by '48' overflows the capacity of 'long'}}231 #else232 // expected-no-diagnostics233 #endif234}235 236#endif237 238char no_crash_SymbolCast_of_float_type_aux(int *p) {239 *p += 1;240 return *p;241}242 243void no_crash_SymbolCast_of_float_type(void) {244 extern float x;245 char (*f)() = no_crash_SymbolCast_of_float_type_aux;246 f(&x);247}248 249double no_crash_reinterpret_double_as_int(double a) {250 *(int *)&a = 1;251 return a * a;252}253 254double no_crash_reinterpret_double_as_ptr(double a) {255 *(void **)&a = 0;256 return a * a;257}258 259double no_crash_reinterpret_double_as_sym_int(double a, int b) {260 *(int *)&a = b;261 return a * a;262}263 264double no_crash_reinterpret_double_as_sym_ptr(double a, void * b) {265 *(void **)&a = b;266 return a * a;267}268 269void no_crash_reinterpret_char_as_uchar(char ***a, int *b) {270 *(unsigned char **)a = (unsigned char *)b;271 if (**a == 0) // no-crash272 ;273}274 275// PR50179.276struct S {};277void symbolic_offset(struct S *ptr, int i) {278 const struct S *pS = ptr + i;279 struct S s = *pS; // no-crash280}281