44 lines · c
1// RUN: %clang_analyze_cc1 -triple x86_64-pc-linux-gnu -analyzer-checker=core,security.VAList -analyzer-output=text -verify %s2 3#include "Inputs/system-header-simulator-for-valist.h"4 5// This is called in call_inlined_uses_arg(),6// and the warning is generated during the analysis of call_inlined_uses_arg().7void inlined_uses_arg(va_list arg) {8 (void)va_arg(arg, int); // expected-warning{{va_arg() is called on an uninitialized va_list}}9 // expected-note@-1{{va_arg() is called on an uninitialized va_list}}10}11 12void call_inlined_uses_arg(int fst, ...) {13 va_list va;14 inlined_uses_arg(va); // expected-note{{Calling 'inlined_uses_arg'}}15}16 17int va_list_get_int(va_list *va) {18 return va_arg(*va, int); // no-warning19}20 21struct MyVaList {22 va_list l;23};24int va_list_get_int2(struct MyVaList *va) {25 return va_arg(va->l, int); // no-warning26}27 28void call_vprintf_bad(int isstring, ...) {29 va_list va;30 vprintf(isstring ? "%s" : "%d", va); // expected-warning{{Function 'vprintf' is called with an uninitialized va_list argument}}31 // expected-note@-1{{Function 'vprintf' is called with an uninitialized va_list argument}}32 // expected-note@-2{{Assuming 'isstring' is 0}}33 // expected-note@-3{{'?' condition is false}}34}35 36void call_vsprintf_bad(char *buffer, ...) {37 va_list va;38 va_start(va, buffer); // expected-note{{Initialized va_list}}39 va_end(va); // expected-note{{Ended va_list}}40 vsprintf(buffer, "%s %d %d %lf %03d", va); // expected-warning{{Function 'vsprintf' is called with an already released va_list argument}}41 // expected-note@-1{{Function 'vsprintf' is called with an already released va_list argument}}42}43 44