80 lines · c
1// RUN: %clang_analyze_cc1 -verify %s -std=gnu99 \2// RUN: -analyzer-checker=core \3// RUN: -analyzer-checker=alpha.core \4// RUN: -analyzer-checker=unix \5// RUN: -analyzer-checker=alpha.unix6 7#include "Inputs/system-header-simulator.h"8 9typedef __typeof(sizeof(int)) size_t;10void *memset(void *__s, int __c, size_t __n);11void *malloc(size_t __size);12void free(void *__ptr);13 14// The store for 'a[1]' should not be removed mistakenly. SymbolicRegions may15// also be live roots.16void f14(int *a) {17 int i;18 a[1] = 1;19 i = a[1];20 if (i != 1) {21 int *p = 0;22 i = *p; // no-warning23 }24}25 26void foo(void) {27 int *x = malloc(sizeof(int));28 memset(x, 0, sizeof(int));29 int n = 1 / *x; // expected-warning {{Division by zero}}30 free(x);31}32 33void bar(void) {34 int *x = malloc(sizeof(int));35 memset(x, 0, 1);36 int n = 1 / *x; // no-warning37 free(x);38}39 40void testConcreteNull(void) {41 int *x = 0;42 memset(x, 0, 1); // expected-warning {{Null pointer passed as 1st argument to memory set function}}43}44 45void testStackArray(void) {46 char buf[13];47 memset(buf, 0, 1); // no-warning48}49 50void testHeapSymbol(void) {51 char *buf = (char *)malloc(13);52 memset(buf, 0, 1); // no-warning53 free(buf);54}55 56void testStackArrayOutOfBound(void) {57 char buf[1];58 memset(buf, 0, 1024);59 // expected-warning@-1 {{Memory set function overflows the destination buffer}}60 // expected-warning@-2 {{'memset' will always overflow; destination buffer has size 1, but size argument is 1024}}61}62 63void testHeapSymbolOutOfBound(void) {64 char *buf = (char *)malloc(1);65 memset(buf, 0, 1024);66 // expected-warning@-1 {{Memory set function overflows the destination buffer}}67 free(buf);68}69 70void testStackArraySameSize(void) {71 char buf[1];72 memset(buf, 0, sizeof(buf)); // no-warning73}74 75void testHeapSymbolSameSize(void) {76 char *buf = (char *)malloc(1);77 memset(buf, 0, 1); // no-warning78 free(buf);79}80