90 lines · cpp
1// Refer issue 55019 for more details.2// A supplemental test case of pr22954.c for other functions modeled in3// the CStringChecker.4 5// RUN: %clang_analyze_cc1 %s -verify \6// RUN: -analyzer-checker=core \7// RUN: -analyzer-checker=unix \8// RUN: -analyzer-checker=debug.ExprInspection9 10#include "Inputs/system-header-simulator.h"11#include "Inputs/system-header-simulator-cxx.h"12 13void *malloc(size_t);14void free(void *);15 16struct mystruct {17 void *ptr;18 char arr[4];19};20 21void clang_analyzer_dump(const void *);22 23// CStringChecker::memsetAux24void fmemset() {25 mystruct x;26 x.ptr = malloc(1);27 clang_analyzer_dump(x.ptr); // expected-warning {{HeapSymRegion}}28 memset(x.arr, 0, sizeof(x.arr));29 clang_analyzer_dump(x.ptr); // expected-warning {{HeapSymRegion}}30 free(x.ptr); // no-leak-warning31}32 33// CStringChecker::evalCopyCommon34void fmemcpy() {35 mystruct x;36 x.ptr = malloc(1);37 clang_analyzer_dump(x.ptr); // expected-warning {{HeapSymRegion}}38 memcpy(x.arr, "hi", 2);39 clang_analyzer_dump(x.ptr); // expected-warning {{HeapSymRegion}}40 free(x.ptr); // no-leak-warning41}42 43// CStringChecker::evalStrcpyCommon44void fstrcpy() {45 mystruct x;46 x.ptr = malloc(1);47 clang_analyzer_dump(x.ptr); // expected-warning {{HeapSymRegion}}48 strcpy(x.arr, "hi");49 clang_analyzer_dump(x.ptr); // expected-warning {{HeapSymRegion}}50 free(x.ptr); // no-leak-warning51}52 53void fstrncpy() {54 mystruct x;55 x.ptr = malloc(1);56 clang_analyzer_dump(x.ptr); // expected-warning {{HeapSymRegion}}57 strncpy(x.arr, "hi", sizeof(x.arr));58 clang_analyzer_dump(x.ptr); // expected-warning {{HeapSymRegion}}59 free(x.ptr); // no-leak-warning60}61 62// CStringChecker::evalStrsep63void fstrsep() {64 mystruct x;65 x.ptr = malloc(1);66 clang_analyzer_dump(x.ptr); // expected-warning {{HeapSymRegion}}67 char *p = x.arr;68 (void)strsep(&p, "x");69 clang_analyzer_dump(x.ptr); // expected-warning {{HeapSymRegion}}70 free(x.ptr); // no-leak-warning71}72 73// CStringChecker::evalStdCopyCommon74void fstdcopy() {75 mystruct x;76 x.ptr = new char;77 clang_analyzer_dump(x.ptr); // expected-warning {{HeapSymRegion}}78 79 const char *p = "x";80 std::copy(p, p + 1, x.arr);81 82 // FIXME: As we currently cannot know whether the copy overflows, the checker83 // invalidates the entire `x` object. When the copy size through iterators84 // can be correctly modeled, we can then update the verify direction from85 // SymRegion to HeapSymRegion as this std::copy call never overflows and86 // hence the pointer `x.ptr` shall not be invalidated.87 clang_analyzer_dump(x.ptr); // expected-warning {{SymRegion}}88 delete static_cast<char*>(x.ptr); // no-leak-warning89}90