145 lines · c
1// RUN: %clang_analyze_cc1 -analyzer-checker=core,alpha.core -verify %s2 3extern void __assert_fail (__const char *__assertion, __const char *__file,4 unsigned int __line, __const char *__function)5 __attribute__ ((__noreturn__));6 7#define assert(expr) \8 ((expr) ? (void)(0) : __assert_fail (#expr, __FILE__, __LINE__, __func__))9 10typedef unsigned long long uintptr_t;11 12void f0(void) {13 int *p = (int*) 0x10000; // Should not crash here.14 *p = 3; // expected-warning{{Dereference of a fixed address}}15}16 17void f1(int *p) {18 if (p != (int *)-1)19 *p = 1;20 else21 *p = 0; // expected-warning{{Dereference of a fixed address}}22}23 24struct f2_struct {25 int x;26};27 28int f2(struct f2_struct* p) {29 30 if (p != (struct f2_struct *)1)31 p->x = 1;32 33 return p->x++; // expected-warning{{Access to field 'x' results in a dereference of a fixed address (loaded from variable 'p')}}34}35 36int f3_1(char* x) {37 int i = 2;38 39 if (x != (char *)1)40 return x[i - 1];41 42 return x[i+1]; // expected-warning{{Array access (from variable 'x') results in a dereference of a fixed address}}43}44 45int f3_2(char* x) {46 int i = 2;47 48 if (x != (char *)1)49 return x[i - 1];50 51 return x[i+1]++; // expected-warning{{Array access (from variable 'x') results in a dereference of a fixed address}}52}53 54int f4_1(int *p) {55 uintptr_t x = (uintptr_t) p;56 57 if (x != (uintptr_t)1)58 return 1;59 60 int *q = (int*) x;61 return *q; // expected-warning{{Dereference of a fixed address (loaded from variable 'q')}}62}63 64int f4_2(void) {65 short array[2];66 uintptr_t x = (uintptr_t)array;67 short *p = (short *)x;68 69 // The following branch should be infeasible.70 if (!(p == &array[0])) {71 p = (short *)1;72 *p = 1; // no-warning73 }74 75 if (p != (short *)1) {76 *p = 5; // no-warning77 p = (short *)1; // expected-warning {{Using a fixed address is not portable}}78 }79 else return 1;80 81 *p += 10; // expected-warning{{Dereference of a fixed}}82 return 0;83}84 85int f5(void) {86 char *s = "hello world";87 return s[0]; // no-warning88}89 90void f6(int *p, int *q) {91 if (p != (int *)1)92 if (p == (int *)1)93 *p = 1; // no-warning94 95 if (q == (int *)1)96 if (q != (int *)1)97 *q = 1; // no-warning98}99 100int* qux(int);101 102int f7_1(unsigned len) {103 assert (len != 0);104 int *p = (int *)1;105 unsigned i;106 107 for (i = 0; i < len; ++i)108 p = qux(i);109 110 return *p++; // no-warning111}112 113int f7_2(unsigned len) {114 assert (len > 0); // note use of '>'115 int *p = (int *)1;116 unsigned i;117 118 for (i = 0; i < len; ++i)119 p = qux(i);120 121 return *p++; // no-warning122}123 124struct f8_s {125 int x;126 int y[2];127};128 129void f8(struct f8_s *s, int coin) {130 if (s != (struct f8_s *)7)131 return;132 133 if (coin)134 s->x = 5; // expected-warning{{Access to field 'x' results in a dereference of a fixed address (loaded from variable 's')}}135 else136 s->y[1] = 6; // expected-warning{{Array access (via field 'y') results in a dereference of a fixed address}}137}138 139void f9() {140 int (*p_function) (char, char) = (int (*)(char, char))0x04040; // FIXME: warn at this initialization141 p_function = (int (*)(char, char))0x04080; // expected-warning {{Using a fixed address is not portable}}142 // FIXME: there should be a warning from calling the function pointer with fixed address143 int x = (*p_function) ('x', 'y');144}145