39 lines · c
1// RUN: %clang_analyze_cc1 %s \2// RUN: -analyzer-checker=core \3// RUN: -analyzer-checker=alpha.unix.cstring.OutOfBounds,alpha.unix.cstring.UninitializedRead \4// RUN: -analyzer-config eagerly-assume=false \5// RUN: -verify6 7// expected-no-diagnostics8 9typedef typeof(sizeof(int)) size_t;10void *memmove(void *, const void *, size_t);11 12typedef struct {13 char a[1024];14} b;15int c;16b *invalidate();17int d() {18 b *a = invalidate();19 if (c < 1024)20 return 0;21 int f = c & ~3, g = f;22 g--;23 if (g)24 return 0;25 26 // Parent state is already infeasible.27 // clang_analyzer_printState();28 // "constraints": [29 // { "symbol": "(derived_$3{conj_$0{int, LC1, S728, #1},c}) & -4", "range": "{ [1, 1] }" },30 // { "symbol": "derived_$3{conj_$0{int, LC1, S728, #1},c}", "range": "{ [1024, 2147483647] }" }31 // ],32 33 // This sould not crash!34 // It crashes in baseline, since there both true and false states are nullptr!35 memmove(a->a, &a->a[f], c - f);36 37 return 0;38}39