167 lines · c
1// RUN: %clang_analyze_cc1 -triple hexagon-unknown-linux -verify %s \2// RUN: -analyzer-checker=core,security.VAList \3// RUN: -analyzer-disable-checker=core.CallAndMessage \4// RUN: -analyzer-output=text5//6// RUN: %clang_analyze_cc1 -triple x86_64-pc-linux-gnu -verify %s \7// RUN: -analyzer-checker=core,security.VAList \8// RUN: -analyzer-disable-checker=core.CallAndMessage \9// RUN: -analyzer-output=text10//11// RUN: %clang_analyze_cc1 -triple x86_64-pc-linux-gnu %s \12// RUN: -analyzer-checker=core,security.VAList13 14#include "Inputs/system-header-simulator-for-valist.h"15 16void f1(int fst, ...) {17 va_list va;18 (void)va_arg(va, int); // expected-warning{{va_arg() is called on an uninitialized va_list}}19 // expected-note@-1{{va_arg() is called on an uninitialized va_list}}20}21 22int f2(int fst, ...) {23 va_list va;24 va_start(va, fst); // expected-note{{Initialized va_list}}25 va_end(va); // expected-note{{Ended va_list}}26 return va_arg(va, int); // expected-warning{{va_arg() is called on an already released va_list}}27 // expected-note@-1{{va_arg() is called on an already released va_list}}28}29 30void f3(int fst, ...) {31 va_list va, va2;32 va_start(va, fst);33 va_copy(va2, va);34 va_end(va);35 (void)va_arg(va2, int);36 va_end(va2);37} //no-warning38 39void f4(int cond, ...) {40 va_list va;41 if (cond) { // expected-note{{Assuming 'cond' is 0}}42 // expected-note@-1{{Taking false branch}}43 va_start(va, cond);44 (void)va_arg(va,int);45 }46 va_end(va); //expected-warning{{va_end() is called on an uninitialized va_list}}47 // expected-note@-1{{va_end() is called on an uninitialized va_list}}48}49 50void f7(int *fst, ...) {51 va_list x;52 va_list *y = &x;53 va_start(*y,fst);54 (void)va_arg(x, int);55 va_end(x);56} // no-warning57 58void f8(int *fst, ...) {59 va_list x;60 va_list *y = &x;61 va_start(*y,fst); // expected-note{{Initialized va_list}}62 va_end(x); // expected-note{{Ended va_list}}63 (void)va_arg(*y, int); //expected-warning{{va_arg() is called on an already released va_list}}64 // expected-note@-1{{va_arg() is called on an already released va_list}}65}66 67void reinitOk(int *fst, ...) {68 va_list va;69 va_start(va, fst);70 (void)va_arg(va, int);71 va_end(va);72 va_start(va, fst);73 (void)va_arg(va, int);74 va_end(va);75} // no-warning76 77void reinit3(int *fst, ...) {78 va_list va;79 va_start(va, fst); // expected-note{{Initialized va_list}}80 (void)va_arg(va, int);81 va_end(va); // expected-note{{Ended va_list}}82 va_start(va, fst); // expected-note{{Initialized va_list}}83 (void)va_arg(va, int);84 va_end(va); // expected-note{{Ended va_list}}85 (void)va_arg(va, int); //expected-warning{{va_arg() is called on an already released va_list}}86 // expected-note@-1{{va_arg() is called on an already released va_list}}87}88 89void copyUnint(int fst, ...) {90 va_list va, va2;91 va_copy(va, va2); // expected-warning{{Uninitialized va_list is copied}}92 // expected-note@-1{{Uninitialized va_list is copied}}93}94 95void g1(int fst, ...) {96 va_list va;97 va_end(va); // expected-warning{{va_end() is called on an uninitialized va_list}}98 // expected-note@-1{{va_end() is called on an uninitialized va_list}}99}100 101void g2(int fst, ...) {102 va_list va;103 va_start(va, fst); // expected-note{{Initialized va_list}}104 va_end(va); // expected-note{{Ended va_list}}105 va_end(va); // expected-warning{{va_end() is called on an already released va_list}}106 // expected-note@-1{{va_end() is called on an already released va_list}}107}108 109void is_sink(int fst, ...) {110 va_list va;111 va_end(va); // expected-warning{{va_end() is called on an uninitialized va_list}}112 // expected-note@-1{{va_end() is called on an uninitialized va_list}}113 *((volatile int *)0) = 1;114}115 116// NOTE: this is invalid, as the man page of va_end requires that "Each invocation of va_start()117// must be matched by a corresponding invocation of va_end() in the same function."118void ends_arg(va_list arg) {119 va_end(arg);120} //no-warning121 122void uses_arg(va_list arg) {123 (void)va_arg(arg, int);124} //no-warning125 126void call_vprintf_ok(int isstring, ...) {127 va_list va;128 va_start(va, isstring);129 vprintf(isstring ? "%s" : "%d", va);130 va_end(va);131} //no-warning132 133void call_some_other_func(int n, ...) {134 va_list va;135 some_library_function(n, va);136} //no-warning137 138void inlined_uses_arg_good(va_list arg) {139 (void)va_arg(arg, int);140}141 142void call_inlined_uses_arg_good(int fst, ...) {143 va_list va;144 va_start(va, fst);145 inlined_uses_arg_good(va);146 va_end(va);147}148 149void va_copy_test(va_list arg) {150 va_list dst;151 va_copy(dst, arg);152 va_end(dst);153}154 155void all_state_changes(va_list unknown, int fst, ...) {156 va_list va, va2;157 va_start(va, fst); // expected-note{{Initialized va_list}}158 va_copy(va, unknown); // expected-note{{Copied unknown contents into the va_list}}159 va_end(va); // expected-note{{Ended va_list}}160 va_start(va, fst); // expected-note{{Initialized va_list}}161 va_copy(va, va2); // expected-note{{Copied uninitialized contents into the va_list}}162 va_start(va, fst); // expected-note{{Initialized va_list}}163 va_end(va); // expected-note{{Ended va_list}}164 va_end(va); // expected-warning{{va_end() is called on an already released va_list}}165 // expected-note@-1{{va_end() is called on an already released va_list}}166}167