| // RUN: clang-cc -analyze -std=gnu99 -checker-cfref -verify %s -analyzer-constraints=basic -analyzer-store=basic && |
| // RUN: clang-cc -analyze -std=gnu99 -checker-cfref -verify %s -analyzer-constraints=range -analyzer-store=basic && |
| // RUN: clang-cc -analyze -std=gnu99 -checker-cfref -analyzer-store=region -analyzer-constraints=range -analyzer-purge-dead=false -verify %s && |
| // RUN: clang-cc -analyze -std=gnu99 -checker-cfref -analyzer-store=region -analyzer-constraints=range -verify %s |
| |
| #include<stdint.h> |
| #include <assert.h> |
| |
| void f1(int *p) { |
| if (p) *p = 1; |
| else *p = 0; // expected-warning{{ereference}} |
| } |
| |
| struct foo_struct { |
| int x; |
| }; |
| |
| int f2(struct foo_struct* p) { |
| |
| if (p) |
| p->x = 1; |
| |
| return p->x++; // expected-warning{{Dereference of null pointer.}} |
| } |
| |
| int f3(char* x) { |
| |
| int i = 2; |
| |
| if (x) |
| return x[i - 1]; |
| |
| return x[i+1]; // expected-warning{{Dereference of null pointer.}} |
| } |
| |
| int f3_b(char* x) { |
| |
| int i = 2; |
| |
| if (x) |
| return x[i - 1]; |
| |
| return x[i+1]++; // expected-warning{{Dereference of null pointer.}} |
| } |
| |
| int f4(int *p) { |
| |
| uintptr_t x = (uintptr_t) p; |
| |
| if (x) |
| return 1; |
| |
| int *q = (int*) x; |
| return *q; // expected-warning{{Dereference of null pointer.}} |
| } |
| |
| int f4_b() { |
| short array[2]; |
| uintptr_t x = array; // expected-warning{{incompatible pointer to integer conversion initializing}} |
| short *p = x; // expected-warning{{incompatible integer to pointer conversion initializing}} |
| |
| // The following branch should be infeasible. |
| if (!(p = &array[0])) { |
| p = 0; |
| *p = 1; // no-warning |
| } |
| |
| if (p) { |
| *p = 5; // no-warning |
| p = 0; |
| } |
| else return; // expected-warning {{non-void function 'f4_b' should return a value}} |
| |
| *p += 10; // expected-warning{{Dereference of null pointer}} |
| return 0; |
| } |
| |
| |
| int f5() { |
| |
| char *s = "hello world"; |
| return s[0]; // no-warning |
| } |
| |
| int bar(int* p, int q) __attribute__((nonnull)); |
| |
| int f6(int *p) { |
| return !p ? bar(p, 1) // expected-warning {{Null pointer passed as an argument to a 'nonnull' parameter}} |
| : bar(p, 0); // no-warning |
| } |
| |
| int bar2(int* p, int q) __attribute__((nonnull(1))); |
| |
| int f6b(int *p) { |
| return !p ? bar2(p, 1) // expected-warning {{Null pointer passed as an argument to a 'nonnull' parameter}} |
| : bar2(p, 0); // no-warning |
| } |
| |
| int bar3(int*p, int q, int *r) __attribute__((nonnull(1,3))); |
| |
| int f6c(int *p, int *q) { |
| return !p ? bar3(q, 2, p) // expected-warning {{Null pointer passed as an argument to a 'nonnull' parameter}} |
| : bar3(p, 2, q); // no-warning |
| } |
| |
| void f6d(int *p) { |
| bar(p, 0); |
| // At this point, 'p' cannot be null. |
| if (!p) { |
| int *q = 0; |
| *q = 0xDEADBEEF; // no-warning |
| } |
| } |
| |
| int* qux(); |
| |
| int f7(int x) { |
| |
| int* p = 0; |
| |
| if (0 == x) |
| p = qux(); |
| |
| if (0 == x) |
| *p = 1; // no-warning |
| |
| return x; |
| } |
| |
| int* f7b(int *x) { |
| |
| int* p = 0; |
| |
| if (((void*)0) == x) |
| p = qux(); |
| |
| if (((void*)0) == x) |
| *p = 1; // no-warning |
| |
| return x; |
| } |
| |
| int* f7c(int *x) { |
| |
| int* p = 0; |
| |
| if (((void*)0) == x) |
| p = qux(); |
| |
| if (((void*)0) != x) |
| return x; |
| |
| // If we reach here then 'p' is not null. |
| *p = 1; // no-warning |
| return x; |
| } |
| |
| int* f7c2(int *x) { |
| |
| int* p = 0; |
| |
| if (((void*)0) == x) |
| p = qux(); |
| |
| if (((void*)0) == x) |
| return x; |
| |
| *p = 1; // expected-warning{{null}} |
| return x; |
| } |
| |
| |
| void f8(int *p, int *q) { |
| if (!p) |
| if (p) |
| *p = 1; // no-warning |
| |
| if (q) |
| if (!q) |
| *q = 1; // no-warning |
| } |
| |
| int* qux(); |
| |
| int f9(unsigned len) { |
| assert (len != 0); |
| int *p = 0; |
| unsigned i; |
| |
| for (i = 0; i < len; ++i) |
| p = qux(i); |
| |
| return *p++; // no-warning |
| } |
| |
| int f9b(unsigned len) { |
| assert (len > 0); // note use of '>' |
| int *p = 0; |
| unsigned i; |
| |
| for (i = 0; i < len; ++i) |
| p = qux(i); |
| |
| return *p++; // no-warning |
| } |
| |
| int* f10(int* p, signed char x, int y) { |
| // This line tests symbolication with compound assignments where the |
| // LHS and RHS have different bitwidths. The new symbolic value |
| // for 'x' should have a bitwidth of 8. |
| x &= y; |
| |
| // This tests that our symbolication worked, and that we correctly test |
| // x against 0 (with the same bitwidth). |
| if (!x) { |
| if (!p) return; // expected-warning {{non-void function 'f10' should return a value}} |
| *p = 10; |
| } |
| else p = 0; |
| |
| if (!x) |
| *p = 5; // no-warning |
| |
| return p; |
| } |
| |
| // Test case from <rdar://problem/6407949> |
| void f11(unsigned i) { |
| int *x = 0; |
| if (i >= 0) { |
| // always true |
| } else { |
| *x = 42; // no-warning |
| } |
| } |
| |
| void f11b(unsigned i) { |
| int *x = 0; |
| if (i <= ~(unsigned)0) { |
| // always true |
| } else { |
| *x = 42; // no-warning |
| } |
| } |
| |
| // Test case for switch statements with weird case arms. |
| typedef int BOOL, *PBOOL, *LPBOOL; |
| typedef long LONG_PTR, *PLONG_PTR; |
| typedef unsigned long ULONG_PTR, *PULONG_PTR; |
| typedef ULONG_PTR DWORD_PTR, *PDWORD_PTR; |
| typedef LONG_PTR LRESULT; |
| typedef struct _F12ITEM *HF12ITEM; |
| |
| void f12(HF12ITEM i, char *q) { |
| char *p = 0; |
| switch ((DWORD_PTR) i) { |
| case 0 ... 10: |
| p = q; |
| break; |
| case (DWORD_PTR) ((HF12ITEM) - 65535): |
| return; |
| default: |
| return; |
| } |
| |
| *p = 1; // no-warning |
| } |
| |
| // Test handling of translating between integer "pointers" and back. |
| void f13() { |
| int *x = 0; |
| if (((((int) x) << 2) + 1) >> 1) *x = 1; // no-warning |
| } |
| |
| |