240 lines · cpp
1// RUN: %clang_analyze_cc1 -w -verify %s \2// RUN: -analyzer-checker=core \3// RUN: -analyzer-checker=alpha.deadcode.UnreachableCode \4// RUN: -analyzer-checker=unix.Malloc \5// RUN: -analyzer-checker=cplusplus.NewDelete \6// RUN: -analyzer-checker=optin.taint.TaintPropagation \7// RUN: -analyzer-checker=optin.taint.TaintedAlloc8 9// RUN: %clang_analyze_cc1 -w -verify %s \10// RUN: -triple i386-unknown-linux-gnu \11// RUN: -analyzer-checker=core \12// RUN: -analyzer-checker=alpha.deadcode.UnreachableCode \13// RUN: -analyzer-checker=unix.Malloc \14// RUN: -analyzer-checker=cplusplus.NewDelete \15// RUN: -analyzer-checker=optin.taint.TaintPropagation \16// RUN: -analyzer-checker=optin.taint.TaintedAlloc17 18// RUN: %clang_analyze_cc1 -w -verify %s -DTEST_INLINABLE_ALLOCATORS \19// RUN: -analyzer-checker=core \20// RUN: -analyzer-checker=alpha.deadcode.UnreachableCode \21// RUN: -analyzer-checker=unix.Malloc \22// RUN: -analyzer-checker=cplusplus.NewDelete \23// RUN: -analyzer-checker=optin.taint.TaintPropagation \24// RUN: -analyzer-checker=optin.taint.TaintedAlloc25 26// RUN: %clang_analyze_cc1 -w -verify %s -DTEST_INLINABLE_ALLOCATORS \27// RUN: -triple i386-unknown-linux-gnu \28// RUN: -analyzer-checker=core \29// RUN: -analyzer-checker=alpha.deadcode.UnreachableCode \30// RUN: -analyzer-checker=unix.Malloc \31// RUN: -analyzer-checker=cplusplus.NewDelete \32// RUN: -analyzer-checker=optin.taint.TaintPropagation \33// RUN: -analyzer-checker=optin.taint.TaintedAlloc34 35#include "Inputs/system-header-simulator-cxx.h"36 37typedef __typeof(sizeof(int)) size_t;38void *malloc(size_t);39void free(void *);40void *realloc(void *ptr, size_t size);41void *calloc(size_t nmemb, size_t size);42char *strdup(const char *s);43int scanf( const char* format, ... );44 45void taintAlloc() {46 size_t size = 0;47 scanf("%zu", &size);48 int *ptr = new int[size];// expected-warning{{Memory allocation function is called with a tainted (potentially attacker controlled) value}}49 delete[] ptr;50}51 52void checkThatMallocCheckerIsRunning() {53 malloc(4);54} // expected-warning{{leak}}55 56struct Foo {57 mutable void* m_data;58 Foo(void* data) : m_data(data) {}59};60Foo aFunction() {61 return malloc(10);62}63 64// Assume that functions which take a function pointer can free memory even if65// they are defined in system headers and take the const pointer to the66// allocated memory.67// Test default parameter.68int const_ptr_and_callback_def_param(int, const char*, int n, void(*)(void*) = free);69void r11160612_3() {70 char *x = (char*)malloc(12);71 const_ptr_and_callback_def_param(0, x, 12);72}73 74int const_ptr_and_callback_def_param_null(int, const char*, int n, void(*)(void*) = 0);75void r11160612_no_callback() {76 char *x = (char*)malloc(12);77 const_ptr_and_callback_def_param_null(0, x, 12);78} // expected-warning{{leak}}79 80// Test member function pointer.81struct CanFreeMemory {82 static void myFree(void*);83};84//This is handled because we look at the type of the parameter(not argument).85void r11160612_3(CanFreeMemory* p) {86 char *x = (char*)malloc(12);87 const_ptr_and_callback_def_param(0, x, 12, p->myFree);88}89 90 91namespace PR13751 {92 class OwningVector {93 void **storage;94 size_t length;95 public:96 OwningVector();97 ~OwningVector();98 void push_back(void *Item) {99 storage[length++] = Item;100 }101 };102 103 void testDestructors() {104 OwningVector v;105 v.push_back(malloc(4));106 // no leak warning; freed in destructor107 }108}109 110struct X { void *a; };111 112struct X get() {113 struct X result;114 result.a = malloc(4);115 return result; // no-warning116}117 118// Ensure that regions accessible through a LazyCompoundVal trigger region escape.119// Malloc checker used to report leaks for the following two test cases.120struct Property {121 char* getterName;122 Property(char* n)123 : getterName(n) {}124 125};126void append(Property x);127 128void appendWrapper(char *getterName) {129 append(Property(getterName));130}131void foo(const char* name) {132 char* getterName = strdup(name);133 appendWrapper(getterName); // no-warning134}135 136struct NestedProperty {137 Property prop;138 NestedProperty(Property p)139 : prop(p) {}140};141void appendNested(NestedProperty x);142 143void appendWrapperNested(char *getterName) {144 appendNested(NestedProperty(Property(getterName)));145}146void fooNested(const char* name) {147 char* getterName = strdup(name);148 appendWrapperNested(getterName); // no-warning149}150 151namespace PR31226 {152 struct b2 {153 int f;154 };155 156 struct b1 : virtual b2 {157 void m();158 };159 160 struct d : b1, b2 {161 };162 163 void f() {164 d *p = new d();165 p->m(); // no-crash // no-warning166 }167}168 169// Allow __cxa_demangle to escape.170char* test_cxa_demangle(const char* sym) {171 size_t funcnamesize = 256;172 char* funcname = (char*)malloc(funcnamesize);173 int status;174 char* ret = abi::__cxa_demangle(sym, funcname, &funcnamesize, &status);175 if (status == 0) {176 funcname = ret;177 }178 return funcname; // no-warning179}180 181namespace argument_leak {182class A {183 char *name;184 185public:186 char *getName() {187 if (!name) {188 name = static_cast<char *>(malloc(10));189 }190 return name;191 }192 ~A() {193 if (name) {194 delete[] name;195 }196 }197};198 199void test(A a) {200 (void)a.getName();201}202} // namespace argument_leak203 204#define ZERO_SIZE_PTR ((void *)16)205 206void test_delete_ZERO_SIZE_PTR() {207 int *Ptr = (int *)ZERO_SIZE_PTR;208 // ZERO_SIZE_PTR is specially handled but only for malloc family209 delete Ptr; // expected-warning{{Argument to 'delete' is a constant address (16)}}210}211 212namespace pr46253_class {213class a {214 void *realloc(int, bool = false) { realloc(1); } // no-crash215};216} // namespace pr46253_class217 218namespace pr46253_retty{219void realloc(void *ptr, size_t size) { realloc(ptr, size); } // no-crash220} // namespace pr46253_retty221 222namespace pr46253_paramty{223void *realloc(void **ptr, size_t size) { realloc(ptr, size); } // no-crash224} // namespace pr46253_paramty225 226namespace pr46253_paramty2{227void *realloc(void *ptr, int size) { realloc(ptr, size); } // no-crash228} // namespace pr46253_paramty2229 230namespace pr81597 {231struct S {};232struct T {233 void free(const S& s);234};235void f(T& t) {236 S s;237 t.free(s); // no-warning: This is not the free you are looking for...238}239} // namespace pr81597240