119 lines · c
1// RUN: %clang_analyze_cc1 -fblocks -verify %s \2// RUN: -analyzer-checker=core \3// RUN: -analyzer-checker=unix.Malloc4//5// RUN: %clang_analyze_cc1 -fblocks -verify %s \6// RUN: -analyzer-checker=core \7// RUN: -analyzer-checker=unix.Malloc \8// RUN: -analyzer-config unix.DynamicMemoryModeling:Optimistic=true9typedef __typeof(sizeof(int)) size_t;10void free(void *);11void *alloca(size_t);12 13void t1 (void) {14 int a[] = { 1 };15 free(a);16 // expected-warning@-1{{Argument to 'free()' is the address of the local variable 'a', which is not memory allocated by 'malloc()'}}17 // expected-warning@-2{{attempt to call free on non-heap object 'a'}}18}19 20void t2 (void) {21 int a = 1;22 free(&a);23 // expected-warning@-1{{Argument to 'free()' is the address of the local variable 'a', which is not memory allocated by 'malloc()'}}24 // expected-warning@-2{{attempt to call free on non-heap object 'a'}}25}26 27void t3 (void) {28 static int a[] = { 1 };29 free(a);30 // expected-warning@-1{{Argument to 'free()' is the address of the static variable 'a', which is not memory allocated by 'malloc()'}}31 // expected-warning@-2{{attempt to call free on non-heap object 'a'}}32}33 34void t4 (char *x) {35 free(x); // no-warning36}37 38void t5 (void) {39 extern char *ptr(void);40 free(ptr()); // no-warning41}42 43void t6 (void) {44 free((void*)1000);45 // expected-warning@-1{{Argument to 'free()' is a constant address (1000), which is not memory allocated by 'malloc()'}}46 // expected-warning@-2{{attempt to call free on non-heap object '(void *)1000'}}47}48 49void t7 (char **x) {50 free(*x); // no-warning51}52 53void t8 (char **x) {54 // ugh55 free((*x)+8); // no-warning56}57 58void t9 (void) {59label:60 free(&&label);61 // expected-warning@-1{{Argument to 'free()' is the address of the label 'label', which is not memory allocated by 'malloc()'}}62 // expected-warning@-2{{attempt to call free on non-heap object 'label'}}63}64 65void t10 (void) {66 free((void*)&t10);67 // expected-warning@-1{{Argument to 'free()' is the address of the function 't10', which is not memory allocated by 'malloc()'}}68 // expected-warning@-2{{attempt to call free on non-heap object 't10'}}69}70 71void t11 (void) {72 char *p = (char*)alloca(2);73 free(p); // expected-warning {{Memory allocated by 'alloca()' should not be deallocated}}74}75 76void t12 (void) {77 char *p = (char*)__builtin_alloca(2);78 free(p); // expected-warning {{Memory allocated by 'alloca()' should not be deallocated}}79}80 81void t13 (void) {82 free(^{return;});83 // expected-warning@-1{{Argument to 'free()' is a block, which is not memory allocated by 'malloc()'}}84 // expected-warning@-2{{attempt to call free on non-heap object: block expression}}85}86 87void t14 (char a) {88 free(&a);89 // expected-warning@-1{{Argument to 'free()' is the address of the parameter 'a', which is not memory allocated by 'malloc()'}}90 // expected-warning@-2{{attempt to call free on non-heap object 'a'}}91}92 93static int someGlobal[2];94void t15 (void) {95 free(someGlobal);96 // expected-warning@-1{{Argument to 'free()' is the address of the global variable 'someGlobal', which is not memory allocated by 'malloc()'}}97 // expected-warning@-2{{attempt to call free on non-heap object 'someGlobal'}}98}99 100void t16 (char **x, int offset) {101 // Unknown value102 free(x[offset]); // no-warning103}104 105int *iptr(void);106void t17(void) {107 free(iptr); // Oops, forgot to call iptr().108 // expected-warning@-1{{Argument to 'free()' is the address of the function 'iptr', which is not memory allocated by 'malloc()'}}109 // expected-warning@-2{{attempt to call free on non-heap object 'iptr'}}110}111 112struct S {113 const char* p;114};115 116void t18 (struct S s) {117 free((void*)(unsigned long long)s.p); // no warning118}119