331 lines · c
1// RUN: %clang_analyze_cc1 -triple i386-apple-darwin10 -Wno-int-conversion -Wno-strict-prototypes -Wno-tautological-constant-compare -Wtautological-unsigned-zero-compare -analyzer-checker=core,deadcode,alpha.core -std=gnu99 -analyzer-purge=none -verify %s -Wno-error=return-type2// RUN: %clang_analyze_cc1 -triple i386-apple-darwin10 -Wno-int-conversion -Wno-strict-prototypes -Wno-tautological-constant-compare -Wtautological-unsigned-zero-compare -analyzer-checker=core,deadcode,alpha.core -std=gnu99 -verify %s -Wno-error=return-type3 4typedef unsigned uintptr_t;5 6extern void __assert_fail (__const char *__assertion, __const char *__file,7 unsigned int __line, __const char *__function)8 __attribute__ ((__noreturn__));9 10#define assert(expr) \11 ((expr) ? (void)(0) : __assert_fail (#expr, __FILE__, __LINE__, __func__))12 13void f1(int *p) {14 if (p) *p = 1;15 else *p = 0; // expected-warning{{ereference}}16}17 18struct foo_struct {19 int x;20};21 22int f2(struct foo_struct* p) {23 24 if (p)25 p->x = 1;26 27 return p->x++; // expected-warning{{Access to field 'x' results in a dereference of a null pointer (loaded from variable 'p')}}28}29 30int f3(char* x) {31 32 int i = 2;33 34 if (x)35 return x[i - 1];36 37 return x[i+1]; // expected-warning{{Array access (from variable 'x') results in a null pointer dereference}}38}39 40int f3_b(char* x) {41 42 int i = 2;43 44 if (x)45 return x[i - 1];46 47 return x[i+1]++; // expected-warning{{Array access (from variable 'x') results in a null pointer dereference}}48}49 50int f4(int *p) {51 52 uintptr_t x = (uintptr_t) p;53 54 if (x)55 return 1;56 57 int *q = (int*) x;58 return *q; // expected-warning{{Dereference of null pointer (loaded from variable 'q')}}59}60 61int f4_b(void) {62 short array[2];63 uintptr_t x = array;64 short *p = x;65 66 // The following branch should be infeasible.67 if (!(p == &array[0])) {68 p = 0;69 *p = 1; // no-warning70 }71 72 if (p) {73 *p = 5; // no-warning74 p = 0;75 }76 else return; // expected-warning {{non-void function 'f4_b' should return a value}}77 78 *p += 10; // expected-warning{{Dereference of null pointer}}79 return 0;80}81 82int f5(void) {83 84 char *s = "hello world";85 return s[0]; // no-warning86}87 88int bar(int* p, int q) __attribute__((nonnull));89 90int f6(int *p) {91 return !p ? bar(p, 1) // expected-warning {{Null pointer passed to 1st parameter expecting 'nonnull'}}92 : bar(p, 0); // no-warning93}94 95int bar2(int* p, int q) __attribute__((nonnull(1)));96 97int f6b(int *p) {98 return !p ? bar2(p, 1) // expected-warning {{Null pointer passed to 1st parameter expecting 'nonnull'}}99 : bar2(p, 0); // no-warning100}101 102int bar3(int*p, int q, int *r) __attribute__((nonnull(1,3)));103 104int f6c(int *p, int *q) {105 return !p ? bar3(q, 2, p) // expected-warning {{Null pointer passed to 3rd parameter expecting 'nonnull'}}106 : bar3(p, 2, q); // no-warning107}108 109void f6d(int *p) {110 bar(p, 0);111 // At this point, 'p' cannot be null.112 if (!p) {113 int *q = 0;114 *q = 0xDEADBEEF; // no-warning115 }116}117 118void f6e(int *p, int offset) {119 // PR7406 - crash from treating an UnknownVal as defined, to see if it's 0.120 bar((p+offset)+1, 0); // not crash121}122 123int* qux();124 125int f7(int x) {126 127 int* p = 0;128 129 if (0 == x)130 p = qux();131 132 if (0 == x)133 *p = 1; // no-warning134 135 return x;136}137 138int* f7b(int *x) {139 140 int* p = 0;141 142 if (((void*)0) == x)143 p = qux();144 145 if (((void*)0) == x)146 *p = 1; // no-warning147 148 return x;149}150 151int* f7c(int *x) {152 153 int* p = 0;154 155 if (((void*)0) == x)156 p = qux();157 158 if (((void*)0) != x)159 return x;160 161 // If we reach here then 'p' is not null.162 *p = 1; // no-warning163 return x;164}165 166int* f7c2(int *x) {167 168 int* p = 0;169 170 if (((void*)0) == x)171 p = qux();172 173 if (((void*)0) == x)174 return x;175 176 *p = 1; // expected-warning{{null}}177 return x;178}179 180 181void f8(int *p, int *q) {182 if (!p)183 if (p)184 *p = 1; // no-warning185 186 if (q)187 if (!q)188 *q = 1; // no-warning189}190 191int* qux();192 193int f9(unsigned len) {194 assert (len != 0);195 int *p = 0;196 unsigned i;197 198 for (i = 0; i < len; ++i)199 p = qux(i);200 201 return *p++; // no-warning202}203 204int f9b(unsigned len) {205 assert (len > 0); // note use of '>'206 int *p = 0;207 unsigned i;208 209 for (i = 0; i < len; ++i)210 p = qux(i);211 212 return *p++; // no-warning213}214 215int* f10(int* p, signed char x, int y) {216 // This line tests symbolication with compound assignments where the217 // LHS and RHS have different bitwidths. The new symbolic value218 // for 'x' should have a bitwidth of 8.219 x &= y;220 221 // This tests that our symbolication worked, and that we correctly test222 // x against 0 (with the same bitwidth).223 if (!x) {224 if (!p) return 0;225 *p = 10;226 }227 else p = 0;228 229 if (!x)230 *p = 5; // no-warning231 232 return p;233}234 235void f11(unsigned i) {236 int *x = 0;237 if (i >= 0) { // expected-warning{{always true}}238 // always true239 } else {240 *x = 42; // no-warning241 }242}243 244void f11b(unsigned i) {245 int *x = 0;246 if (i <= ~(unsigned)0) {247 // always true248 } else {249 *x = 42; // no-warning250 }251}252 253// Test case for switch statements with weird case arms.254typedef int BOOL, *PBOOL, *LPBOOL;255typedef long LONG_PTR, *PLONG_PTR;256typedef unsigned long ULONG_PTR, *PULONG_PTR;257typedef ULONG_PTR DWORD_PTR, *PDWORD_PTR;258typedef LONG_PTR LRESULT;259typedef struct _F12ITEM *HF12ITEM;260 261void f12(HF12ITEM i, char *q) {262 char *p = 0;263 switch ((DWORD_PTR) i) {264 case 0 ... 10:265 p = q;266 break;267 case (DWORD_PTR) ((HF12ITEM) - 65535):268 return;269 default:270 return;271 }272 273 *p = 1; // no-warning274}275 276// Test handling of translating between integer "pointers" and back.277void f13(void) {278 int *x = 0;279 if (((((int) x) << 2) + 1) >> 1) *x = 1;280}281 282// PR 4759 - Attribute non-null checking by the analyzer was not correctly283// handling pointer values that were undefined.284void pr4759_aux(int *p) __attribute__((nonnull));285 286void pr4759(void) {287 int *p;288 pr4759_aux(p); // expected-warning{{1st function call argument is an uninitialized value}}289}290 291// Relax function call arguments invalidation to be aware of const292// arguments. Test with function pointers.293void ttt(const int *nptr);294void ttt2(const int *nptr);295typedef void (*NoConstType)(int*);296int foo10595327(int b) {297 void (*fp)(int *);298 // We use path sensitivity to get the function declaration. Even when the299 // function pointer is cast to non-pointer-to-const parameter type, we can300 // find the right function declaration.301 if (b > 5)302 fp = (NoConstType)ttt2;303 else304 fp = (NoConstType)ttt;305 int x = 3;306 int y = x + 1;307 int *p = 0;308 fp(&y);309 if (x == y)310 return *p; // no-warning311 return 0;312}313 314#define AS_ATTRIBUTE volatile __attribute__((address_space(256)))315#define _get_base() ((void * AS_ATTRIBUTE *)0)316void* test_address_space_array(unsigned long slot) {317 return _get_base()[slot]; // no-warning318}319void test_address_space_condition(int AS_ATTRIBUTE *cpu_data) {320 if (cpu_data == 0) {321 *cpu_data = 3; // no-warning322 }323}324struct X { int member; };325int test_address_space_member(void) {326 struct X AS_ATTRIBUTE *data = (struct X AS_ATTRIBUTE *)0UL;327 int ret;328 ret = data->member; // no-warning329 return ret;330}331