184 lines · c
1// RUN: %clang_analyze_cc1 -analyzer-checker=core,unix.Malloc -verify %s2 3#include "Inputs/system-header-simulator.h"4 5typedef void* gpointer;6typedef const void* gconstpointer;7typedef unsigned long gsize;8typedef unsigned int guint;9 10gpointer g_malloc(gsize n_bytes);11gpointer g_malloc0(gsize n_bytes);12gpointer g_realloc(gpointer mem, gsize n_bytes);13gpointer g_try_malloc(gsize n_bytes);14gpointer g_try_malloc0(gsize n_bytes);15gpointer g_try_realloc(gpointer mem, gsize n_bytes);16gpointer g_malloc_n(gsize n_blocks, gsize n_block_bytes);17gpointer g_malloc0_n(gsize n_blocks, gsize n_block_bytes);18gpointer g_realloc_n(gpointer mem, gsize n_blocks, gsize n_block_bytes);19gpointer g_try_malloc_n(gsize n_blocks, gsize n_block_bytes);20gpointer g_try_malloc0_n(gsize n_blocks, gsize n_block_bytes);21gpointer g_try_realloc_n(gpointer mem, gsize n_blocks, gsize n_block_bytes);22void g_free(gpointer mem);23gpointer g_memdup(gconstpointer mem, guint byte_size);24gpointer g_strconcat(gconstpointer string1, ...);25 26static const gsize n_bytes = 1024;27 28void f1(void) {29 gpointer g1 = g_malloc(n_bytes);30 gpointer g2 = g_malloc0(n_bytes);31 g1 = g_realloc(g1, n_bytes * 2);32 gpointer g3 = g_try_malloc(n_bytes);33 gpointer g4 = g_try_malloc0(n_bytes);34 g3 = g_try_realloc(g3, n_bytes * 2);35 gpointer g5 = g_malloc_n(n_bytes, sizeof(char));36 gpointer g6 = g_malloc0_n(n_bytes, sizeof(char));37 g5 = g_realloc_n(g5, n_bytes * 2, sizeof(char));38 gpointer g7 = g_try_malloc_n(n_bytes, sizeof(char));39 gpointer g8 = g_try_malloc0_n(n_bytes, sizeof(char));40 g7 = g_try_realloc_n(g7, n_bytes * 2, sizeof(char));41 42 g_free(g1);43 g_free(g2);44 g_free(g2); // expected-warning{{Attempt to release already released memory}}45}46 47void f2(void) {48 gpointer g1 = g_malloc(n_bytes);49 gpointer g2 = g_malloc0(n_bytes);50 g1 = g_realloc(g1, n_bytes * 2);51 gpointer g3 = g_try_malloc(n_bytes);52 gpointer g4 = g_try_malloc0(n_bytes);53 g3 = g_try_realloc(g3, n_bytes * 2);54 gpointer g5 = g_malloc_n(n_bytes, sizeof(char));55 gpointer g6 = g_malloc0_n(n_bytes, sizeof(char));56 g5 = g_realloc_n(g5, n_bytes * 2, sizeof(char));57 gpointer g7 = g_try_malloc_n(n_bytes, sizeof(char));58 gpointer g8 = g_try_malloc0_n(n_bytes, sizeof(char));59 g7 = g_try_realloc_n(g7, n_bytes * 2, sizeof(char));60 61 g_free(g1);62 g_free(g2);63 g_free(g3);64 g3 = g_memdup(g3, n_bytes); // expected-warning{{Use of memory after it is released}}65}66 67void f3(void) {68 gpointer g1 = g_malloc(n_bytes);69 gpointer g2 = g_malloc0(n_bytes);70 g1 = g_realloc(g1, n_bytes * 2);71 gpointer g3 = g_try_malloc(n_bytes);72 gpointer g4 = g_try_malloc0(n_bytes);73 g3 = g_try_realloc(g3, n_bytes * 2); // expected-warning{{Potential leak of memory pointed to by 'g4'}}74 gpointer g5 = g_malloc_n(n_bytes, sizeof(char));75 gpointer g6 = g_malloc0_n(n_bytes, sizeof(char));76 g5 = g_realloc_n(g5, n_bytes * 2, sizeof(char)); // expected-warning{{Potential leak of memory pointed to by 'g6'}}77 gpointer g7 = g_try_malloc_n(n_bytes, sizeof(char)); // expected-warning{{Potential leak of memory pointed to by 'g5'}}78 gpointer g8 = g_try_malloc0_n(n_bytes, sizeof(char));79 g7 = g_try_realloc_n(g7, n_bytes * 2, sizeof(char)); // expected-warning{{Potential leak of memory pointed to by 'g8'}}80 81 g_free(g1); // expected-warning{{Potential leak of memory pointed to by 'g7'}}82 g_free(g2);83 g_free(g3);84}85 86void f4(void) {87 gpointer g1 = g_malloc(n_bytes);88 gpointer g2 = g_malloc0(n_bytes);89 g1 = g_realloc(g1, n_bytes * 2);90 gpointer g3 = g_try_malloc(n_bytes);91 gpointer g4 = g_try_malloc0(n_bytes);92 g3 = g_try_realloc(g3, n_bytes * 2);93 gpointer g5 = g_malloc_n(n_bytes, sizeof(char));94 gpointer g6 = g_malloc0_n(n_bytes, sizeof(char));95 g5 = g_realloc_n(g5, n_bytes * 2, sizeof(char)); // expected-warning{{Potential leak of memory pointed to by 'g6'}}96 gpointer g7 = g_try_malloc_n(n_bytes, sizeof(char)); // expected-warning{{Potential leak of memory pointed to by 'g5'}}97 gpointer g8 = g_try_malloc0_n(n_bytes, sizeof(char));98 g7 = g_try_realloc_n(g7, n_bytes * 2, sizeof(char)); // expected-warning{{Potential leak of memory pointed to by 'g8'}}99 100 g_free(g1); // expected-warning{{Potential leak of memory pointed to by 'g7'}}101 g_free(g2);102 g_free(g3);103 g_free(g4);104}105 106void f5(void) {107 gpointer g1 = g_malloc(n_bytes);108 gpointer g2 = g_malloc0(n_bytes);109 g1 = g_realloc(g1, n_bytes * 2);110 gpointer g3 = g_try_malloc(n_bytes);111 gpointer g4 = g_try_malloc0(n_bytes);112 g3 = g_try_realloc(g3, n_bytes * 2);113 gpointer g5 = g_malloc_n(n_bytes, sizeof(char));114 gpointer g6 = g_malloc0_n(n_bytes, sizeof(char));115 g5 = g_realloc_n(g5, n_bytes * 2, sizeof(char)); // expected-warning{{Potential leak of memory pointed to by 'g6'}}116 gpointer g7 = g_try_malloc_n(n_bytes, sizeof(char));117 gpointer g8 = g_try_malloc0_n(n_bytes, sizeof(char));118 g7 = g_try_realloc_n(g7, n_bytes * 2, sizeof(char)); // expected-warning{{Potential leak of memory pointed to by 'g8'}}119 120 g_free(g1); // expected-warning{{Potential leak of memory pointed to by 'g7'}}121 g_free(g2);122 g_free(g3);123 g_free(g4);124 g_free(g5);125}126 127void f6(void) {128 gpointer g1 = g_malloc(n_bytes);129 gpointer g2 = g_malloc0(n_bytes);130 g1 = g_realloc(g1, n_bytes * 2);131 gpointer g3 = g_try_malloc(n_bytes);132 gpointer g4 = g_try_malloc0(n_bytes);133 g3 = g_try_realloc(g3, n_bytes * 2);134 gpointer g5 = g_malloc_n(n_bytes, sizeof(char));135 gpointer g6 = g_malloc0_n(n_bytes, sizeof(char));136 g5 = g_realloc_n(g5, n_bytes * 2, sizeof(char));137 gpointer g7 = g_try_malloc_n(n_bytes, sizeof(char));138 gpointer g8 = g_try_malloc0_n(n_bytes, sizeof(char));139 g7 = g_try_realloc_n(g7, n_bytes * 2, sizeof(char)); // expected-warning{{Potential leak of memory pointed to by 'g8'}}140 141 g_free(g1); // expected-warning{{Potential leak of memory pointed to by 'g7'}}142 g_free(g2);143 g_free(g3);144 g_free(g4);145 g_free(g5);146 g_free(g6);147}148 149void f7(void) {150 gpointer g1 = g_malloc(n_bytes);151 gpointer g2 = g_malloc0(n_bytes);152 g1 = g_realloc(g1, n_bytes * 2);153 gpointer g3 = g_try_malloc(n_bytes);154 gpointer g4 = g_try_malloc0(n_bytes);155 g3 = g_try_realloc(g3, n_bytes * 2);156 gpointer g5 = g_malloc_n(n_bytes, sizeof(char));157 gpointer g6 = g_malloc0_n(n_bytes, sizeof(char));158 g5 = g_realloc_n(g5, n_bytes * 2, sizeof(char));159 gpointer g7 = g_try_malloc_n(n_bytes, sizeof(char));160 gpointer g8 = g_try_malloc0_n(n_bytes, sizeof(char));161 g7 = g_try_realloc_n(g7, n_bytes * 2, sizeof(char)); // expected-warning{{Potential leak of memory pointed to by 'g8'}}162 163 g_free(g1);164 g_free(g2);165 g_free(g3);166 g_free(g4);167 g_free(g5);168 g_free(g6);169 g_free(g7);170}171 172void f8(void) {173 typedef struct {174 gpointer str;175 } test_struct;176 177 test_struct *s1 = (test_struct *)g_malloc0(sizeof(test_struct));178 test_struct *s2 = (test_struct *)g_memdup(s1, sizeof(test_struct));179 gpointer str = g_strconcat("text", s1->str, s2->str, NULL); // no-warning180 g_free(str);181 g_free(s2);182 g_free(s1);183}184