281 lines · c
1// RUN: %clang_analyze_cc1 -verify \2// RUN: -Wno-alloc-size \3// RUN: -analyzer-checker=core \4// RUN: -analyzer-checker=alpha.deadcode.UnreachableCode \5// RUN: -analyzer-checker=unix.Malloc \6// RUN: -analyzer-checker=debug.ExprInspection \7// RUN: -analyzer-config unix.DynamicMemoryModeling:Optimistic=true %s8 9typedef __typeof(sizeof(int)) size_t;10void *malloc(size_t);11void free(void *);12void *realloc(void *ptr, size_t size);13void *calloc(size_t nmemb, size_t size);14void __attribute((ownership_returns(malloc))) *my_malloc(size_t);15void __attribute((ownership_takes(malloc, 1))) my_free(void *);16void my_freeBoth(void *, void *)17 __attribute((ownership_holds(malloc, 1, 2)));18void __attribute((ownership_returns(malloc, 1))) *my_malloc2(size_t);19void __attribute((ownership_holds(malloc, 1))) my_hold(void *);20 21// Duplicate attributes are silly, but not an error.22// Duplicate attribute has no extra effect.23// If two are of different kinds, that is an error and reported as such.24void __attribute((ownership_holds(malloc, 1)))25__attribute((ownership_holds(malloc, 1)))26__attribute((ownership_holds(malloc, 3))) my_hold2(void *, void *, void *);27 28__attribute((ownership_returns(user_malloc, 1))) void *user_malloc(size_t);29__attribute((ownership_takes(user_malloc, 1))) void user_free(void *);30 31void clang_analyzer_dump(int);32 33void *my_malloc3(size_t);34void *myglobalpointer;35struct stuff {36 void *somefield;37};38struct stuff myglobalstuff;39 40void f1(void) {41 int *p = malloc(12);42 return; // expected-warning{{Potential leak of memory pointed to by}}43}44 45void f2(void) {46 int *p = malloc(12);47 free(p);48 free(p); // expected-warning{{Attempt to release already released memory}}49}50 51void f2_realloc_0(void) {52 int *p = malloc(12);53 realloc(p,0);54 realloc(p,0); // expected-warning{{Attempt to release already released memory}}55}56 57void f2_realloc_1(void) {58 int *p = malloc(12);59 int *q = realloc(p,0); // no-warning60}61 62// ownership attributes tests63void naf1(void) {64 int *p = my_malloc3(12);65 return; // no-warning66}67 68void n2af1(void) {69 int *p = my_malloc2(12);70 return; // expected-warning{{Potential leak of memory pointed to by}}71}72 73void af1(void) {74 int *p = my_malloc(12);75 return; // expected-warning{{Potential leak of memory pointed to by}}76}77 78void af1_b(void) {79 int *p = my_malloc(12);80} // expected-warning{{Potential leak of memory pointed to by}}81 82void af1_c(void) {83 myglobalpointer = my_malloc(12); // no-warning84}85 86void af1_d(void) {87 struct stuff mystuff;88 mystuff.somefield = my_malloc(12);89} // expected-warning{{Potential leak of memory pointed to by}}90 91// Test that we can pass out allocated memory via pointer-to-pointer.92void af1_e(void **pp) {93 *pp = my_malloc(42); // no-warning94}95 96void af1_f(struct stuff *somestuff) {97 somestuff->somefield = my_malloc(12); // no-warning98}99 100// Allocating memory for a field via multiple indirections to our arguments is OK.101void af1_g(struct stuff **pps) {102 *pps = my_malloc(sizeof(struct stuff)); // no-warning103 (*pps)->somefield = my_malloc(42); // no-warning104}105 106void af2(void) {107 int *p = my_malloc(12);108 my_free(p);109 free(p); // expected-warning{{Attempt to release already released memory}}110}111 112void af2b(void) {113 int *p = my_malloc(12);114 free(p);115 my_free(p); // expected-warning{{Attempt to release already released memory}}116}117 118void af2c(void) {119 int *p = my_malloc(12);120 free(p);121 my_hold(p); // expected-warning{{Attempt to release already released memory}}122}123 124void af2d(void) {125 int *p = my_malloc(12);126 free(p);127 my_hold2(0, 0, p); // expected-warning{{Attempt to release already released memory}}128}129 130// No leak if malloc returns null.131void af2e(void) {132 int *p = my_malloc(12);133 if (!p)134 return; // no-warning135 free(p); // no-warning136}137 138// This case inflicts a possible double-free.139void af3(void) {140 int *p = my_malloc(12);141 my_hold(p);142 free(p); // expected-warning{{Attempt to release non-owned memory}}143}144 145int * af4(void) {146 int *p = my_malloc(12);147 my_free(p);148 return p; // expected-warning{{Use of memory after it is released}}149}150 151// This case is (possibly) ok, be conservative152int * af5(void) {153 int *p = my_malloc(12);154 my_hold(p);155 return p; // no-warning156}157 158 159 160// This case tests that storing malloc'ed memory to a static variable which is161// then returned is not leaked. In the absence of known contracts for functions162// or inter-procedural analysis, this is a conservative answer.163int *f3(void) {164 static int *p = 0;165 p = malloc(12);166 return p; // no-warning167}168 169// This case tests that storing malloc'ed memory to a static global variable170// which is then returned is not leaked. In the absence of known contracts for171// functions or inter-procedural analysis, this is a conservative answer.172static int *p_f4 = 0;173int *f4(void) {174 p_f4 = malloc(12);175 return p_f4; // no-warning176}177 178int *f5(void) {179 int *q = malloc(12);180 q = realloc(q, 20);181 return q; // no-warning182}183 184void f6(void) {185 int *p = malloc(12);186 if (!p)187 return; // no-warning188 else189 free(p);190}191 192void f6_realloc(void) {193 int *p = malloc(12);194 if (!p)195 return; // no-warning196 else197 realloc(p,0);198}199 200 201char *doit2(void);202void pr6069(void) {203 char *buf = doit2();204 free(buf);205}206 207void pr6293(void) {208 free(0);209}210 211void f7(void) {212 char *x = (char*) malloc(4);213 free(x);214 x[0] = 'a'; // expected-warning{{Use of memory after it is released}}215}216 217void f7_realloc(void) {218 char *x = (char*) malloc(4);219 realloc(x,0);220 x[0] = 'a'; // expected-warning{{Use of memory after it is released}}221}222 223void mallocCastToVoid(void) {224 void *p = malloc(2);225 const void *cp = p; // not crash226 free(p);227}228 229void mallocCastToFP(void) {230 void *p = malloc(2);231 void (*fp)(void) = p; // not crash232 free(p);233}234 235// This tests that malloc() buffers are undefined by default236char mallocGarbage (void) {237 char *buf = malloc(2);238 char result = buf[1]; // expected-warning{{uninitialized}}239 free(buf);240 return result;241}242 243// This tests that calloc() buffers need to be freed244void callocNoFree (void) {245 char *buf = calloc(2,2);246 return; // expected-warning{{Potential leak of memory pointed to by}}247}248 249// These test that calloc() buffers are zeroed by default250char callocZeroesGood (void) {251 char *buf = calloc(2,2);252 char result = buf[3]; // no-warning253 if (buf[1] == 0) {254 free(buf);255 }256 return result; // no-warning257}258 259char callocZeroesBad (void) {260 char *buf = calloc(2,2);261 char result = buf[3]; // no-warning262 if (buf[1] != 0) {263 free(buf); // expected-warning{{never executed}}264 }265 return result; // expected-warning{{Potential leak of memory pointed to by}}266}267 268void testMultipleFreeAnnotations(void) {269 int *p = malloc(12);270 int *q = malloc(12);271 my_freeBoth(p, q);272}273 274void testNoUninitAttr(void) {275 int *p = user_malloc(sizeof(int));276 int read = p[0]; // no-warning277 clang_analyzer_dump(p[0]); // expected-warning{{Unknown}}278 user_free(p);279}280 281