186 lines · cpp
1// RUN: %clang_analyze_cc1 -std=c++20 \2// RUN: -analyzer-checker=core,unix,cplusplus,debug.ExprInspection \3// RUN: -triple x86_64-unknown-linux-gnu \4// RUN: -verify %s5 6#include "Inputs/system-header-simulator-cxx.h"7 8typedef __SIZE_TYPE__ size_t;9void *malloc(size_t);10void *alloca(size_t);11void *realloc(void *ptr, size_t size);12void *calloc(size_t number, size_t size);13void free(void *);14 15struct S {16 int f;17};18 19void clang_analyzer_dump(int);20void clang_analyzer_dump(const void *);21void clang_analyzer_dumpExtent(int);22void clang_analyzer_dumpExtent(const void *);23void clang_analyzer_dumpElementCount(int);24void clang_analyzer_dumpElementCount(const void *);25 26int clang_analyzer_getExtent(void *);27void clang_analyzer_eval(bool);28 29void var_simple_ref() {30 int a = 13;31 clang_analyzer_dump(&a); // expected-warning {{a}}32 clang_analyzer_dumpExtent(&a); // expected-warning {{4 S64b}}33 clang_analyzer_dumpElementCount(&a); // expected-warning {{1 S64b}}34}35 36void var_simple_ptr(int *a) {37 clang_analyzer_dump(a); // expected-warning {{SymRegion{reg_$1<int * a>}}}38 clang_analyzer_dumpExtent(a); // expected-warning {{extent_$2{SymRegion{reg_$1<int * a>}}}}39 clang_analyzer_dumpElementCount(a); // expected-warning {{(extent_$2{SymRegion{reg_$1<int * a>}}) / 4}}40}41 42void var_array() {43 int a[] = {1, 2, 3};44 clang_analyzer_dump(a); // expected-warning {{Element{a,0 S64b,int}}}45 clang_analyzer_dumpExtent(a); // expected-warning {{12 S64b}}46 clang_analyzer_dumpElementCount(a); // expected-warning {{3 S64b}}47}48 49void string() {50 clang_analyzer_dump("foo"); // expected-warning {{Element{"foo",0 S64b,char}}}51 clang_analyzer_dumpExtent("foo"); // expected-warning {{4 S64b}}52 clang_analyzer_dumpElementCount("foo"); // expected-warning {{4 S64b}}53}54 55void struct_simple_ptr(S *a) {56 clang_analyzer_dump(a); // expected-warning {{SymRegion{reg_$1<S * a>}}}57 clang_analyzer_dumpExtent(a); // expected-warning {{extent_$2{SymRegion{reg_$1<S * a>}}}}58 clang_analyzer_dumpElementCount(a); // expected-warning {{(extent_$2{SymRegion{reg_$1<S * a>}}) / 4}}59}60 61void field_ref(S a) {62 clang_analyzer_dump(&a.f); // expected-warning {{a.f}}63 clang_analyzer_dumpExtent(&a.f); // expected-warning {{4 S64b}}64 clang_analyzer_dumpElementCount(&a.f); // expected-warning {{1 S64b}}65}66 67void field_ptr(S *a) {68 clang_analyzer_dump(&a->f); // expected-warning {{Element{SymRegion{reg_$1<S * a>},0 S64b,struct S}.f}}69 clang_analyzer_dumpExtent(&a->f); // expected-warning {{extent_$2{SymRegion{reg_$1<S * a>}}}}70 clang_analyzer_dumpElementCount(&a->f); // expected-warning {{(extent_$2{SymRegion{reg_$1<S * a>}}) / 4U}}71}72 73void symbolic_array() {74 int *a = new int[3];75 clang_analyzer_dump(a); // expected-warning {{Element{HeapSymRegion{conj}}76 clang_analyzer_dumpExtent(a); // expected-warning {{12 S64b}}77 clang_analyzer_dumpElementCount(a); // expected-warning {{3 S64b}}78 delete[] a;79}80 81void symbolic_placement_new() {82 char *buf = new char[sizeof(int) * 3];83 int *a = new (buf) int(12);84 clang_analyzer_dump(a); // expected-warning {{Element{HeapSymRegion{conj}}85 clang_analyzer_dumpExtent(a); // expected-warning {{12 S64b}}86 clang_analyzer_dumpElementCount(a); // expected-warning {{3 S64b}}87 delete[] buf;88}89 90void symbolic_malloc() {91 int *a = (int *)malloc(12);92 clang_analyzer_dump(a); // expected-warning {{Element{HeapSymRegion{conj}}93 clang_analyzer_dumpExtent(a); // expected-warning {{12 S64b}}94 clang_analyzer_dumpElementCount(a); // expected-warning {{3 S64b}}95 free(a);96}97 98void symbolic_alloca() {99 int *a = (int *)alloca(12);100 clang_analyzer_dump(a); // expected-warning {{Element{alloca{}}101 clang_analyzer_dumpExtent(a); // expected-warning {{12 S64b}}102 clang_analyzer_dumpElementCount(a); // expected-warning {{3 S64b}}103}104 105void symbolic_complex() {106 int *a = (int *)malloc(4);107 clang_analyzer_dumpExtent(a); // expected-warning {{4 S64b}}108 clang_analyzer_dumpElementCount(a); // expected-warning {{1 S64b}}109 110 int *b = (int *)realloc(a, sizeof(int) * 2);111 clang_analyzer_dumpExtent(b); // expected-warning {{8 S64b}}112 clang_analyzer_dumpElementCount(b); // expected-warning {{2 S64b}}113 free(b);114 115 int *c = (int *)calloc(3, 4);116 clang_analyzer_dumpExtent(c); // expected-warning {{12 S64b}}117 clang_analyzer_dumpElementCount(c); // expected-warning {{3 S64b}}118 free(c);119}120 121void signedness_equality() {122 char *a = new char[sizeof(char) * 13];123 char *b = (char *)malloc(13);124 125 clang_analyzer_dump(clang_analyzer_getExtent(a)); // expected-warning {{13 S64b}}126 clang_analyzer_dump(clang_analyzer_getExtent(b)); // expected-warning {{13 S64b}}127 clang_analyzer_eval(clang_analyzer_getExtent(a) ==128 clang_analyzer_getExtent(b));129 // expected-warning@-2 {{TRUE}}130 131 delete[] a;132 free(b);133}134 135void default_new_aligned() {136 struct alignas(32) S {};137 138 S *a = new S[10];139 140 clang_analyzer_dump(a); // expected-warning {{Element{HeapSymRegion{conj}}141 clang_analyzer_dumpExtent(a); // expected-warning {{320 S64b}}142 clang_analyzer_dumpElementCount(a); // expected-warning {{10 S64b}}143 144 delete[] a;145}146 147void *operator new[](std::size_t, std::align_val_t, bool hack) throw();148 149void user_defined_new() {150 int *a = new (std::align_val_t(32), true) int[10];151 152 clang_analyzer_dump(a); // expected-warning {{Element{SymRegion{conj}}153 clang_analyzer_dumpExtent(a); // expected-warning-re {{{{^extent_\$[0-9]\{SymRegion{conj}}}}154 clang_analyzer_dumpElementCount(a); // expected-warning-re {{{{^\(extent_\$[0-9]\{SymRegion{conj.*\) / 4}}}}155 156 operator delete[](a, std::align_val_t(32));157}158 159int a[5][0];160struct T {161 int x[];162};163 164T t[5];165void zero_sized_element() {166 clang_analyzer_dumpExtent(a); // expected-warning {{0 S64b}}167 clang_analyzer_dumpElementCount(a); // expected-warning {{5 S64b}}168 clang_analyzer_dumpExtent(t); // expected-warning {{0 S64b}}169 clang_analyzer_dumpElementCount(t); // expected-warning {{5 S64b}}170}171 172void extent_with_offset() {173 int nums[] = {1,2,3};174 char *p = (char*)&nums[1];175 176 clang_analyzer_dumpExtent(p); // expected-warning {{8 S64b}}177 clang_analyzer_dumpElementCount(p); // expected-warning {{8 S64b}}178 ++p;179 clang_analyzer_dumpExtent(p); // expected-warning {{7 S64b}}180 clang_analyzer_dumpElementCount(p); // expected-warning {{7 S64b}}181 ++p;182 int *q = (int*)p;183 clang_analyzer_dumpExtent(q); // expected-warning {{6 S64b}}184 clang_analyzer_dumpElementCount(q); // expected-warning {{1 S64b}}185}186