45 lines · c
1// RUN: %clang_analyze_cc1 -analyzer-checker=core,unix.Malloc -verify %s2 3#include "Inputs/system-header-simulator-for-malloc.h"4 5struct Obj {6 int field;7};8 9void use(void *ptr);10 11void test_direct_param_uaf() {12 int *p = (int *)malloc(sizeof(int));13 free(p);14 use(p); // expected-warning{{Use of memory after it is released}}15}16 17void test_struct_field_uaf() {18 struct Obj *o = (struct Obj *)malloc(sizeof(struct Obj));19 free(o);20 use(&o->field); // expected-warning{{Use of memory after it is released}}21}22 23void test_no_warning_const_int() {24 use((void *)0x1234); // no-warning25}26 27void test_no_warning_stack() {28 int x = 42;29 use(&x); // no-warning30}31 32void test_nested_alloc() {33 struct Obj *o = (struct Obj *)malloc(sizeof(struct Obj));34 use(o); // no-warning35 free(o);36 use(o); // expected-warning{{Use of memory after it is released}}37}38 39void test_nested_field() {40 struct Obj *o = (struct Obj *)malloc(sizeof(struct Obj));41 int *f = &o->field;42 free(o);43 use(f); // expected-warning{{Use of memory after it is released}}44}45