247 lines · cpp
1// RUN: %clang_analyze_cc1 -fblocks -verify %s \2// RUN: -analyzer-checker=core \3// RUN: -analyzer-checker=unix.Malloc4//5// RUN: %clang_analyze_cc1 -fblocks -verify %s \6// RUN: -analyzer-checker=core \7// RUN: -analyzer-checker=unix.Malloc \8// RUN: -analyzer-config unix.DynamicMemoryModeling:Optimistic=true9namespace std {10 using size_t = decltype(sizeof(int));11 void free(void *);12}13 14extern "C" void free(void *);15extern "C" void *alloca(std::size_t);16 17void t1a () {18 int a[] = { 1 };19 free(a);20 // expected-warning@-1{{Argument to 'free()' is the address of the local variable 'a', which is not memory allocated by 'malloc()'}}21 // expected-warning@-2{{attempt to call free on non-heap object 'a'}}22}23 24void t1b () {25 int a[] = { 1 };26 std::free(a);27 // expected-warning@-1{{Argument to 'free()' is the address of the local variable 'a', which is not memory allocated by 'malloc()'}}28 // expected-warning@-2{{attempt to call std::free on non-heap object 'a'}}29}30 31void t2a () {32 int a = 1;33 free(&a);34 // expected-warning@-1{{Argument to 'free()' is the address of the local variable 'a', which is not memory allocated by 'malloc()'}}35 // expected-warning@-2{{attempt to call free on non-heap object 'a'}}36}37 38void t2b () {39 int a = 1;40 std::free(&a);41 // expected-warning@-1{{Argument to 'free()' is the address of the local variable 'a', which is not memory allocated by 'malloc()'}}42 // expected-warning@-2{{attempt to call std::free on non-heap object 'a'}}43}44 45void t3a () {46 static int a[] = { 1 };47 free(a);48 // expected-warning@-1{{Argument to 'free()' is the address of the static variable 'a', which is not memory allocated by 'malloc()'}}49 // expected-warning@-2{{attempt to call free on non-heap object 'a'}}50}51 52void t3b () {53 static int a[] = { 1 };54 std::free(a);55 // expected-warning@-1{{Argument to 'free()' is the address of the static variable 'a', which is not memory allocated by 'malloc()'}}56 // expected-warning@-2{{attempt to call std::free on non-heap object 'a'}}57}58 59void t4a (char *x) {60 free(x); // no-warning61}62 63void t4b (char *x) {64 std::free(x); // no-warning65}66 67void t5a () {68 extern char *ptr();69 free(ptr()); // no-warning70}71 72void t5b () {73 extern char *ptr();74 std::free(ptr()); // no-warning75}76 77void t6a () {78 free((void*)1000);79 // expected-warning@-1{{Argument to 'free()' is a constant address (1000), which is not memory allocated by 'malloc()'}}80 // expected-warning@-2{{attempt to call free on non-heap object '(void *)1000'}}81}82 83void t6b () {84 std::free((void*)1000);85 // expected-warning@-1{{Argument to 'free()' is a constant address (1000), which is not memory allocated by 'malloc()'}}86 // expected-warning@-2{{attempt to call std::free on non-heap object '(void *)1000'}}87}88 89void t7a (char **x) {90 free(*x); // no-warning91}92 93void t7b (char **x) {94 std::free(*x); // no-warning95}96 97void t8a (char **x) {98 // ugh99 free((*x)+8); // no-warning100}101 102void t8b (char **x) {103 // ugh104 std::free((*x)+8); // no-warning105}106 107void t9a () {108label:109 free(&&label);110 // expected-warning@-1{{Argument to 'free()' is the address of the label 'label', which is not memory allocated by 'malloc()'}}111 // expected-warning@-2{{attempt to call free on non-heap object 'label'}}112}113 114void t9b () {115label:116 std::free(&&label);117 // expected-warning@-1{{Argument to 'free()' is the address of the label 'label', which is not memory allocated by 'malloc()'}}118 // expected-warning@-2{{attempt to call std::free on non-heap object 'label'}}119}120 121void t10a () {122 free((void*)&t10a);123 // expected-warning@-1{{Argument to 'free()' is the address of the function 't10a', which is not memory allocated by 'malloc()'}}124 // expected-warning@-2{{attempt to call free on non-heap object 't10a'}}125}126 127void t10b () {128 std::free((void*)&t10b);129 // expected-warning@-1{{Argument to 'free()' is the address of the function 't10b', which is not memory allocated by 'malloc()'}}130 // expected-warning@-2{{attempt to call std::free on non-heap object 't10b'}}131}132 133void t11a () {134 char *p = (char*)alloca(2);135 free(p); // expected-warning {{Memory allocated by 'alloca()' should not be deallocated}}136}137 138void t11b () {139 char *p = (char*)alloca(2);140 std::free(p); // expected-warning {{Memory allocated by 'alloca()' should not be deallocated}}141}142 143void t12a () {144 char *p = (char*)__builtin_alloca(2);145 free(p); // expected-warning {{Memory allocated by 'alloca()' should not be deallocated}}146}147 148void t12b () {149 char *p = (char*)__builtin_alloca(2);150 std::free(p); // expected-warning {{Memory allocated by 'alloca()' should not be deallocated}}151}152 153void t13a () {154 free(^{return;});155 // expected-warning@-1{{Argument to 'free()' is a block, which is not memory allocated by 'malloc()'}}156 // expected-warning@-2{{attempt to call free on non-heap object: block expression}}157}158 159void t13b () {160 std::free(^{return;});161 // expected-warning@-1{{Argument to 'free()' is a block, which is not memory allocated by 'malloc()'}}162 // expected-warning@-2{{attempt to call std::free on non-heap object: block expression}}163}164 165void t14a () {166 free((void *)+[]{ return; });167 // expected-warning@-1{{Argument to 'free()' is the address of the function '__invoke', which is not memory allocated by 'malloc()'}}168 // expected-warning@-2{{attempt to call free on non-heap object: lambda-to-function-pointer conversion}}169}170 171void t14b () {172 std::free((void *)+[]{ return; });173 // expected-warning@-1{{Argument to 'free()' is the address of the function '__invoke', which is not memory allocated by 'malloc()'}}174 // expected-warning@-2{{attempt to call std::free on non-heap object: lambda-to-function-pointer conversion}}175}176 177void t15a (char a) {178 free(&a);179 // expected-warning@-1{{Argument to 'free()' is the address of the parameter 'a', which is not memory allocated by 'malloc()'}}180 // expected-warning@-2{{attempt to call free on non-heap object 'a'}}181}182 183void t15b (char a) {184 std::free(&a);185 // expected-warning@-1{{Argument to 'free()' is the address of the parameter 'a', which is not memory allocated by 'malloc()'}}186 // expected-warning@-2{{attempt to call std::free on non-heap object 'a'}}187}188 189static int someGlobal[2];190void t16a () {191 free(someGlobal);192 // expected-warning@-1{{Argument to 'free()' is the address of the global variable 'someGlobal', which is not memory allocated by 'malloc()'}}193 // expected-warning@-2{{attempt to call free on non-heap object 'someGlobal'}}194}195 196void t16b () {197 std::free(someGlobal);198 // expected-warning@-1{{Argument to 'free()' is the address of the global variable 'someGlobal', which is not memory allocated by 'malloc()'}}199 // expected-warning@-2{{attempt to call std::free on non-heap object 'someGlobal'}}200}201 202void t17a (char **x, int offset) {203 // Unknown value204 free(x[offset]); // no-warning205}206 207void t17b (char **x, int offset) {208 // Unknown value209 std::free(x[offset]); // no-warning210}211 212struct S {213 const char* p;214};215 216void t18_C_style_C_style_free (S s) {217 free((void*)(unsigned long long)s.p); // no warning218}219 220void t18_C_style_C_style_std_free (S s) {221 std::free((void*)(unsigned long long)s.p); // no warning222}223 224void t18_C_style_reinterpret_free (S s) {225 free((void*)reinterpret_cast<unsigned long long>(s.p)); // no warning226}227 228void t18_C_style_reinterpret_std_free (S s) {229 std::free((void*)reinterpret_cast<unsigned long long>(s.p)); // no warning230}231 232void t18_reinterpret_C_style_free (S s) {233 free(reinterpret_cast<void*>((unsigned long long)(s.p))); // no warning234}235 236void t18_reinterpret_C_style_std_free (S s) {237 std::free(reinterpret_cast<void*>((unsigned long long)(s.p))); // no warning238}239 240void t18_reinterpret_reinterpret_free (S s) {241 free(reinterpret_cast<void*>(reinterpret_cast<unsigned long long>(s.p))); // no warning242}243 244void t18_reinterpret_reinterpret_std_free (S s) {245 std::free(reinterpret_cast<void*>(reinterpret_cast<unsigned long long>(s.p))); // no warning246}247