blob: c755d5ef120bc6dba549d64fc003419e801b676d [file] [log] [blame]
Jordy Rose467f7c82011-06-14 01:40:43 +00001// RUN: %clang_cc1 -analyze -analyzer-checker=core,unix.experimental.CString,deadcode.experimental.UnreachableCode -analyzer-store=region -Wno-null-dereference -verify %s
2// RUN: %clang_cc1 -analyze -DUSE_BUILTINS -analyzer-checker=core,unix.experimental.CString,deadcode.experimental.UnreachableCode -analyzer-store=region -Wno-null-dereference -verify %s
3// RUN: %clang_cc1 -analyze -DVARIANT -analyzer-checker=core,unix.experimental.CString,deadcode.experimental.UnreachableCode -analyzer-store=region -Wno-null-dereference -verify %s
4// RUN: %clang_cc1 -analyze -DUSE_BUILTINS -DVARIANT -analyzer-checker=core,unix.experimental.CString,deadcode.experimental.UnreachableCode -analyzer-store=region -Wno-null-dereference -verify %s
Jordy Rose19c5dd12010-07-27 01:37:31 +00005
6//===----------------------------------------------------------------------===
7// Declarations
8//===----------------------------------------------------------------------===
9
10// Some functions are so similar to each other that they follow the same code
11// path, such as memcpy and __memcpy_chk, or memcmp and bcmp. If VARIANT is
12// defined, make sure to use the variants instead to make sure they are still
13// checked by the analyzer.
14
15// Some functions are implemented as builtins. These should be #defined as
16// BUILTIN(f), which will prepend "__builtin_" if USE_BUILTINS is defined.
17
Chris Lattnerfc8f0e12011-04-15 05:22:18 +000018// Functions that have variants and are also available as builtins should be
Jordy Rose19c5dd12010-07-27 01:37:31 +000019// declared carefully! See memcpy() for an example.
20
21#ifdef USE_BUILTINS
22# define BUILTIN(f) __builtin_ ## f
23#else /* USE_BUILTINS */
24# define BUILTIN(f) f
25#endif /* USE_BUILTINS */
26
Jordy Rosee64f3112010-08-16 07:51:42 +000027#define NULL 0
Jordy Rose19c5dd12010-07-27 01:37:31 +000028typedef typeof(sizeof(int)) size_t;
29
30//===----------------------------------------------------------------------===
31// strlen()
32//===----------------------------------------------------------------------===
33
34#define strlen BUILTIN(strlen)
35size_t strlen(const char *s);
36
37void strlen_constant0() {
38 if (strlen("123") != 3)
Jordy Rosea5261542010-08-14 21:02:52 +000039 (void)*(char*)0; // no-warning
Jordy Rose19c5dd12010-07-27 01:37:31 +000040}
41
42void strlen_constant1() {
43 const char *a = "123";
44 if (strlen(a) != 3)
Jordy Rosea5261542010-08-14 21:02:52 +000045 (void)*(char*)0; // no-warning
Jordy Rose19c5dd12010-07-27 01:37:31 +000046}
47
48void strlen_constant2(char x) {
49 char a[] = "123";
Jordy Rosea5261542010-08-14 21:02:52 +000050 if (strlen(a) != 3)
51 (void)*(char*)0; // no-warning
Jordy Rose19c5dd12010-07-27 01:37:31 +000052 a[0] = x;
53 if (strlen(a) != 3)
54 (void)*(char*)0; // expected-warning{{null}}
55}
56
57size_t strlen_null() {
Jordy Rose9e49d9f2011-06-20 02:06:40 +000058 return strlen(0); // expected-warning{{Null pointer argument in call to string length function}}
Jordy Rose19c5dd12010-07-27 01:37:31 +000059}
60
61size_t strlen_fn() {
Jordy Rose9e49d9f2011-06-20 02:06:40 +000062 return strlen((char*)&strlen_fn); // expected-warning{{Argument to string length function is the address of the function 'strlen_fn', which is not a null-terminated string}}
Jordy Rose19c5dd12010-07-27 01:37:31 +000063}
64
65size_t strlen_nonloc() {
66label:
Jordy Rose9e49d9f2011-06-20 02:06:40 +000067 return strlen((char*)&&label); // expected-warning{{Argument to string length function is the address of the label 'label', which is not a null-terminated string}}
Jordy Rose19c5dd12010-07-27 01:37:31 +000068}
Jordy Rosea5261542010-08-14 21:02:52 +000069
70void strlen_subregion() {
Carl Norume224ba72011-03-07 22:57:45 +000071 struct two_strings { char a[2], b[2]; };
Jordy Rosea5261542010-08-14 21:02:52 +000072 extern void use_two_strings(struct two_strings *);
73
74 struct two_strings z;
75 use_two_strings(&z);
76
77 size_t a = strlen(z.a);
78 z.b[0] = 5;
79 size_t b = strlen(z.a);
80 if (a == 0 && b != 0)
81 (void)*(char*)0; // expected-warning{{never executed}}
82
83 use_two_strings(&z);
84
85 size_t c = strlen(z.a);
86 if (a == 0 && c != 0)
87 (void)*(char*)0; // expected-warning{{null}}
88}
89
90extern void use_string(char *);
91void strlen_argument(char *x) {
92 size_t a = strlen(x);
93 size_t b = strlen(x);
94 if (a == 0 && b != 0)
95 (void)*(char*)0; // expected-warning{{never executed}}
96
97 use_string(x);
98
99 size_t c = strlen(x);
100 if (a == 0 && c != 0)
101 (void)*(char*)0; // expected-warning{{null}}
102}
103
104extern char global_str[];
105void strlen_global() {
106 size_t a = strlen(global_str);
107 size_t b = strlen(global_str);
108 if (a == 0 && b != 0)
109 (void)*(char*)0; // expected-warning{{never executed}}
110
111 // Call a function with unknown effects, which should invalidate globals.
112 use_string(0);
113
114 size_t c = strlen(global_str);
115 if (a == 0 && c != 0)
116 (void)*(char*)0; // expected-warning{{null}}
117}
118
119void strlen_indirect(char *x) {
120 size_t a = strlen(x);
121 char *p = x;
122 char **p2 = &p;
123 size_t b = strlen(x);
124 if (a == 0 && b != 0)
125 (void)*(char*)0; // expected-warning{{never executed}}
126
127 extern void use_string_ptr(char*const*);
128 use_string_ptr(p2);
129
130 size_t c = strlen(x);
131 if (a == 0 && c != 0)
132 (void)*(char*)0; // expected-warning{{null}}
133}
134
135void strlen_liveness(const char *x) {
136 if (strlen(x) < 5)
137 return;
138 if (strlen(x) < 5)
139 (void)*(char*)0; // no-warning
140}
Jordy Rosee64f3112010-08-16 07:51:42 +0000141
142//===----------------------------------------------------------------------===
Ted Kremenekbe4242c2011-02-22 04:55:05 +0000143// strnlen()
144//===----------------------------------------------------------------------===
145
146#define strnlen BUILTIN(strnlen)
147size_t strnlen(const char *s, size_t maxlen);
148
149void strnlen_constant0() {
150 if (strnlen("123", 10) != 3)
151 (void)*(char*)0; // no-warning
152}
153
154void strnlen_constant1() {
155 const char *a = "123";
156 if (strnlen(a, 10) != 3)
157 (void)*(char*)0; // no-warning
158}
159
160void strnlen_constant2(char x) {
161 char a[] = "123";
162 if (strnlen(a, 10) != 3)
163 (void)*(char*)0; // no-warning
164 a[0] = x;
165 if (strnlen(a, 10) != 3)
166 (void)*(char*)0; // expected-warning{{null}}
167}
168
169void strnlen_constant4() {
170 if (strnlen("123456", 3) != 3)
171 (void)*(char*)0; // no-warning
172}
173
174void strnlen_constant5() {
175 const char *a = "123456";
176 if (strnlen(a, 3) != 3)
177 (void)*(char*)0; // no-warning
178}
179
180void strnlen_constant6(char x) {
181 char a[] = "123456";
182 if (strnlen(a, 3) != 3)
183 (void)*(char*)0; // no-warning
184 a[0] = x;
185 if (strnlen(a, 3) != 3)
186 (void)*(char*)0; // expected-warning{{null}}
187}
188
189size_t strnlen_null() {
Jordy Rose9e49d9f2011-06-20 02:06:40 +0000190 return strnlen(0, 3); // expected-warning{{Null pointer argument in call to string length function}}
Ted Kremenekbe4242c2011-02-22 04:55:05 +0000191}
192
193size_t strnlen_fn() {
Jordy Rose9e49d9f2011-06-20 02:06:40 +0000194 return strnlen((char*)&strlen_fn, 3); // expected-warning{{Argument to string length function is the address of the function 'strlen_fn', which is not a null-terminated string}}
Ted Kremenekbe4242c2011-02-22 04:55:05 +0000195}
196
197size_t strnlen_nonloc() {
198label:
Jordy Rose9e49d9f2011-06-20 02:06:40 +0000199 return strnlen((char*)&&label, 3); // expected-warning{{Argument to string length function is the address of the label 'label', which is not a null-terminated string}}
Ted Kremenekbe4242c2011-02-22 04:55:05 +0000200}
201
Jordy Rose793bff32011-06-14 01:15:31 +0000202void strnlen_zero() {
203 if (strnlen("abc", 0) != 0)
Ted Kremenekbe4242c2011-02-22 04:55:05 +0000204 (void)*(char*)0; // no-warning
Jordy Rose793bff32011-06-14 01:15:31 +0000205 if (strnlen(NULL, 0) != 0) // no-warning
206 (void)*(char*)0; // no-warning
207}
208
209size_t strnlen_compound_literal() {
210 // This used to crash because we don't model the string lengths of
211 // compound literals.
212 return strnlen((char[]) { 'a', 'b', 0 }, 1);
213}
214
215size_t strnlen_unknown_limit(float f) {
216 // This used to crash because we don't model the integer values of floats.
217 return strnlen("abc", (int)f);
218}
219
220void strnlen_is_not_strlen(char *x) {
221 if (strnlen(x, 10) != strlen(x))
222 (void)*(char*)0; // expected-warning{{null}}
223}
224
225void strnlen_at_limit(char *x) {
226 size_t len = strnlen(x, 10);
227 if (len > 10)
228 (void)*(char*)0; // expected-warning{{never executed}}
229 if (len == 10)
230 (void)*(char*)0; // expected-warning{{null}}
231}
232
233void strnlen_less_than_limit(char *x) {
234 size_t len = strnlen(x, 10);
235 if (len > 10)
236 (void)*(char*)0; // expected-warning{{never executed}}
237 if (len < 10)
238 (void)*(char*)0; // expected-warning{{null}}
239}
240
241void strnlen_at_actual(size_t limit) {
242 size_t len = strnlen("abc", limit);
243 if (len > 3)
244 (void)*(char*)0; // expected-warning{{never executed}}
245 if (len == 3)
246 (void)*(char*)0; // expected-warning{{null}}
247}
248
249void strnlen_less_than_actual(size_t limit) {
250 size_t len = strnlen("abc", limit);
251 if (len > 3)
252 (void)*(char*)0; // expected-warning{{never executed}}
253 if (len < 3)
254 (void)*(char*)0; // expected-warning{{null}}
Ted Kremenekbe4242c2011-02-22 04:55:05 +0000255}
256
257//===----------------------------------------------------------------------===
Jordy Rosee64f3112010-08-16 07:51:42 +0000258// strcpy()
259//===----------------------------------------------------------------------===
260
261#ifdef VARIANT
262
263#define __strcpy_chk BUILTIN(__strcpy_chk)
264char *__strcpy_chk(char *restrict s1, const char *restrict s2, size_t destlen);
265
266#define strcpy(a,b) __strcpy_chk(a,b,(size_t)-1)
267
268#else /* VARIANT */
269
270#define strcpy BUILTIN(strcpy)
271char *strcpy(char *restrict s1, const char *restrict s2);
272
273#endif /* VARIANT */
274
275
276void strcpy_null_dst(char *x) {
Jordy Rose9e49d9f2011-06-20 02:06:40 +0000277 strcpy(NULL, x); // expected-warning{{Null pointer argument in call to string copy function}}
Jordy Rosee64f3112010-08-16 07:51:42 +0000278}
279
280void strcpy_null_src(char *x) {
Jordy Rose9e49d9f2011-06-20 02:06:40 +0000281 strcpy(x, NULL); // expected-warning{{Null pointer argument in call to string copy function}}
Jordy Rosee64f3112010-08-16 07:51:42 +0000282}
283
284void strcpy_fn(char *x) {
Jordy Rose9e49d9f2011-06-20 02:06:40 +0000285 strcpy(x, (char*)&strcpy_fn); // expected-warning{{Argument to string copy function is the address of the function 'strcpy_fn', which is not a null-terminated string}}
Jordy Rosee64f3112010-08-16 07:51:42 +0000286}
287
288void strcpy_effects(char *x, char *y) {
289 char a = x[0];
290
291 if (strcpy(x, y) != x)
292 (void)*(char*)0; // no-warning
293
294 if (strlen(x) != strlen(y))
295 (void)*(char*)0; // no-warning
296
297 if (a != x[0])
298 (void)*(char*)0; // expected-warning{{null}}
299}
300
301void strcpy_overflow(char *y) {
302 char x[4];
303 if (strlen(y) == 4)
Jordy Rose9e49d9f2011-06-20 02:06:40 +0000304 strcpy(x, y); // expected-warning{{String copy function overflows destination buffer}}
Jordy Rosee64f3112010-08-16 07:51:42 +0000305}
306
307void strcpy_no_overflow(char *y) {
308 char x[4];
309 if (strlen(y) == 3)
310 strcpy(x, y); // no-warning
311}
312
313//===----------------------------------------------------------------------===
314// stpcpy()
315//===----------------------------------------------------------------------===
316
317#ifdef VARIANT
318
319#define __stpcpy_chk BUILTIN(__stpcpy_chk)
320char *__stpcpy_chk(char *restrict s1, const char *restrict s2, size_t destlen);
321
322#define stpcpy(a,b) __stpcpy_chk(a,b,(size_t)-1)
323
324#else /* VARIANT */
325
326#define stpcpy BUILTIN(stpcpy)
327char *stpcpy(char *restrict s1, const char *restrict s2);
328
329#endif /* VARIANT */
330
331
332void stpcpy_effect(char *x, char *y) {
333 char a = x[0];
334
335 if (stpcpy(x, y) != &x[strlen(y)])
336 (void)*(char*)0; // no-warning
337
338 if (strlen(x) != strlen(y))
339 (void)*(char*)0; // no-warning
340
341 if (a != x[0])
342 (void)*(char*)0; // expected-warning{{null}}
343}
344
345void stpcpy_overflow(char *y) {
346 char x[4];
347 if (strlen(y) == 4)
Jordy Rose9e49d9f2011-06-20 02:06:40 +0000348 stpcpy(x, y); // expected-warning{{String copy function overflows destination buffer}}
Jordy Rosee64f3112010-08-16 07:51:42 +0000349}
350
351void stpcpy_no_overflow(char *y) {
352 char x[4];
353 if (strlen(y) == 3)
354 stpcpy(x, y); // no-warning
355}
Lenny Maiorani067bbd02011-04-09 15:12:58 +0000356
357//===----------------------------------------------------------------------===
358// strcat()
359//===----------------------------------------------------------------------===
360
361#ifdef VARIANT
362
363#define __strcat_chk BUILTIN(__strcat_chk)
364char *__strcat_chk(char *restrict s1, const char *restrict s2, size_t destlen);
365
366#define strcat(a,b) __strcat_chk(a,b,(size_t)-1)
367
368#else /* VARIANT */
369
370#define strcat BUILTIN(strcat)
371char *strcat(char *restrict s1, const char *restrict s2);
372
373#endif /* VARIANT */
374
375
376void strcat_null_dst(char *x) {
Jordy Rose9e49d9f2011-06-20 02:06:40 +0000377 strcat(NULL, x); // expected-warning{{Null pointer argument in call to string copy function}}
Lenny Maiorani067bbd02011-04-09 15:12:58 +0000378}
379
380void strcat_null_src(char *x) {
Jordy Rose9e49d9f2011-06-20 02:06:40 +0000381 strcat(x, NULL); // expected-warning{{Null pointer argument in call to string copy function}}
Lenny Maiorani067bbd02011-04-09 15:12:58 +0000382}
383
384void strcat_fn(char *x) {
Jordy Rose9e49d9f2011-06-20 02:06:40 +0000385 strcat(x, (char*)&strcat_fn); // expected-warning{{Argument to string copy function is the address of the function 'strcat_fn', which is not a null-terminated string}}
Lenny Maiorani067bbd02011-04-09 15:12:58 +0000386}
387
388void strcat_effects(char *y) {
389 char x[8] = "123";
390 size_t orig_len = strlen(x);
391 char a = x[0];
392
393 if (strlen(y) != 4)
394 return;
395
396 if (strcat(x, y) != x)
397 (void)*(char*)0; // no-warning
398
399 if ((int)strlen(x) != (orig_len + strlen(y)))
400 (void)*(char*)0; // no-warning
Lenny Maiorani067bbd02011-04-09 15:12:58 +0000401}
402
403void strcat_overflow_0(char *y) {
404 char x[4] = "12";
405 if (strlen(y) == 4)
Jordy Rose9e49d9f2011-06-20 02:06:40 +0000406 strcat(x, y); // expected-warning{{String copy function overflows destination buffer}}
Lenny Maiorani067bbd02011-04-09 15:12:58 +0000407}
408
409void strcat_overflow_1(char *y) {
410 char x[4] = "12";
411 if (strlen(y) == 3)
Jordy Rose9e49d9f2011-06-20 02:06:40 +0000412 strcat(x, y); // expected-warning{{String copy function overflows destination buffer}}
Lenny Maiorani067bbd02011-04-09 15:12:58 +0000413}
414
415void strcat_overflow_2(char *y) {
416 char x[4] = "12";
417 if (strlen(y) == 2)
Jordy Rose9e49d9f2011-06-20 02:06:40 +0000418 strcat(x, y); // expected-warning{{String copy function overflows destination buffer}}
Lenny Maiorani067bbd02011-04-09 15:12:58 +0000419}
420
421void strcat_no_overflow(char *y) {
422 char x[5] = "12";
423 if (strlen(y) == 2)
424 strcat(x, y); // no-warning
425}
426
Jordy Rosed5af0e12011-06-15 05:52:56 +0000427void strcat_symbolic_dst_length(char *dst) {
428 strcat(dst, "1234");
429 if (strlen(dst) < 4)
430 (void)*(char*)0; // no-warning
431}
432
433void strcat_symbolic_src_length(char *src) {
434 char dst[8] = "1234";
435 strcat(dst, src);
436 if (strlen(dst) < 4)
437 (void)*(char*)0; // no-warning
438}
439
440void strcat_unknown_src_length(char *src, int offset) {
441 char dst[8] = "1234";
442 strcat(dst, &src[offset]);
443 if (strlen(dst) < 4)
444 (void)*(char*)0; // no-warning
445}
446
447// There is no strcat_unknown_dst_length because if we can't get a symbolic
448// length for the "before" strlen, we won't be able to set one for "after".
449
450void strcat_too_big(char *dst, char *src) {
451 if (strlen(dst) != (((size_t)0) - 2))
452 return;
453 if (strlen(src) != 2)
454 return;
455 strcat(dst, src); // expected-warning{{This expression will create a string whose length is too big to be represented as a size_t}}
456}
457
Lenny Maiorani067bbd02011-04-09 15:12:58 +0000458
459//===----------------------------------------------------------------------===
Jordy Rose5e5f1502011-06-20 03:49:16 +0000460// strncpy()
461//===----------------------------------------------------------------------===
462
463#ifdef VARIANT
464
465#define __strncpy_chk BUILTIN(__strncpy_chk)
466char *__strncpy_chk(char *restrict s1, const char *restrict s2, size_t n, size_t destlen);
467
468#define strncpy(a,b,n) __strncpy_chk(a,b,n,(size_t)-1)
469
470#else /* VARIANT */
471
472#define strncpy BUILTIN(strncpy)
473char *strncpy(char *restrict s1, const char *restrict s2, size_t n);
474
475#endif /* VARIANT */
476
477
478void strncpy_null_dst(char *x) {
479 strncpy(NULL, x, 5); // expected-warning{{Null pointer argument in call to string copy function}}
480}
481
482void strncpy_null_src(char *x) {
483 strncpy(x, NULL, 5); // expected-warning{{Null pointer argument in call to string copy function}}
484}
485
486void strncpy_fn(char *x) {
487 strncpy(x, (char*)&strcpy_fn, 5); // expected-warning{{Argument to string copy function is the address of the function 'strcpy_fn', which is not a null-terminated string}}
488}
489
490void strncpy_effects(char *x, char *y) {
491 char a = x[0];
492
493 if (strncpy(x, y, 5) != x)
494 (void)*(char*)0; // no-warning
495
496 if (strlen(x) != strlen(y))
497 (void)*(char*)0; // expected-warning{{null}}
498
499 if (a != x[0])
500 (void)*(char*)0; // expected-warning{{null}}
501}
502
503void strncpy_overflow(char *y) {
504 char x[4];
505 if (strlen(y) == 4)
506 strncpy(x, y, 5); // expected-warning{{Size argument is greater than the length of the destination buffer}}
507}
508
509void strncpy_no_overflow(char *y) {
510 char x[4];
511 if (strlen(y) == 3)
512 strncpy(x, y, 5); // expected-warning{{Size argument is greater than the length of the destination buffer}}
513}
514
515void strncpy_no_overflow2(char *y, int n) {
516 if (n <= 4)
517 return;
518
519 char x[4];
520 if (strlen(y) == 3)
521 strncpy(x, y, n); // expected-warning{{Size argument is greater than the length of the destination buffer}}
522}
523
524void strncpy_truncate(char *y) {
525 char x[4];
526 if (strlen(y) == 4)
527 strncpy(x, y, 3); // no-warning
528}
529
530void strncpy_no_truncate(char *y) {
531 char x[4];
532 if (strlen(y) == 3)
533 strncpy(x, y, 3); // no-warning
534}
535
536void strncpy_exactly_matching_buffer(char *y) {
537 char x[4];
538 strncpy(x, y, 4); // no-warning
539
540 // strncpy does not null-terminate, so we have no idea what the strlen is
541 // after this.
542 if (strlen(x) > 4)
543 (void)*(int*)0; // expected-warning{{null}}
544}
545
546void strncpy_exactly_matching_buffer2(char *y) {
547 if (strlen(y) >= 4)
548 return;
549
550 char x[4];
551 strncpy(x, y, 4); // no-warning
552
553 // This time, we know that y fits in x anyway.
554 if (strlen(x) > 3)
555 (void)*(int*)0; // no-warning
556}
557
558//===----------------------------------------------------------------------===
Lenny Maiorani067bbd02011-04-09 15:12:58 +0000559// strncat()
560//===----------------------------------------------------------------------===
561
562#ifdef VARIANT
563
564#define __strncat_chk BUILTIN(__strncat_chk)
565char *__strncat_chk(char *restrict s1, const char *restrict s2, size_t n, size_t destlen);
566
567#define strncat(a,b,c) __strncat_chk(a,b,c, (size_t)-1)
568
569#else /* VARIANT */
570
571#define strncat BUILTIN(strncat)
572char *strncat(char *restrict s1, const char *restrict s2, size_t n);
573
574#endif /* VARIANT */
575
576
577void strncat_null_dst(char *x) {
Jordy Rose9e49d9f2011-06-20 02:06:40 +0000578 strncat(NULL, x, 4); // expected-warning{{Null pointer argument in call to string copy function}}
Lenny Maiorani067bbd02011-04-09 15:12:58 +0000579}
580
581void strncat_null_src(char *x) {
Jordy Rose9e49d9f2011-06-20 02:06:40 +0000582 strncat(x, NULL, 4); // expected-warning{{Null pointer argument in call to string copy function}}
Lenny Maiorani067bbd02011-04-09 15:12:58 +0000583}
584
585void strncat_fn(char *x) {
Jordy Rose9e49d9f2011-06-20 02:06:40 +0000586 strncat(x, (char*)&strncat_fn, 4); // expected-warning{{Argument to string copy function is the address of the function 'strncat_fn', which is not a null-terminated string}}
Lenny Maiorani067bbd02011-04-09 15:12:58 +0000587}
588
589void strncat_effects(char *y) {
590 char x[8] = "123";
591 size_t orig_len = strlen(x);
592 char a = x[0];
593
594 if (strlen(y) != 4)
595 return;
596
597 if (strncat(x, y, strlen(y)) != x)
598 (void)*(char*)0; // no-warning
599
600 if (strlen(x) != orig_len + strlen(y))
601 (void)*(char*)0; // no-warning
Lenny Maiorani067bbd02011-04-09 15:12:58 +0000602}
603
604void strncat_overflow_0(char *y) {
605 char x[4] = "12";
606 if (strlen(y) == 4)
Jordy Rose9e49d9f2011-06-20 02:06:40 +0000607 strncat(x, y, strlen(y)); // expected-warning{{String copy function overflows destination buffer}}
Lenny Maiorani067bbd02011-04-09 15:12:58 +0000608}
609
610void strncat_overflow_1(char *y) {
611 char x[4] = "12";
612 if (strlen(y) == 3)
Jordy Rose9e49d9f2011-06-20 02:06:40 +0000613 strncat(x, y, strlen(y)); // expected-warning{{String copy function overflows destination buffer}}
Lenny Maiorani067bbd02011-04-09 15:12:58 +0000614}
615
616void strncat_overflow_2(char *y) {
617 char x[4] = "12";
618 if (strlen(y) == 2)
Jordy Rose9e49d9f2011-06-20 02:06:40 +0000619 strncat(x, y, strlen(y)); // expected-warning{{String copy function overflows destination buffer}}
Lenny Maiorani067bbd02011-04-09 15:12:58 +0000620}
621
622void strncat_overflow_3(char *y) {
623 char x[4] = "12";
624 if (strlen(y) == 4)
Jordy Rose9e49d9f2011-06-20 02:06:40 +0000625 strncat(x, y, 2); // expected-warning{{String copy function overflows destination buffer}}
Lenny Maiorani067bbd02011-04-09 15:12:58 +0000626}
627void strncat_no_overflow_1(char *y) {
628 char x[5] = "12";
629 if (strlen(y) == 2)
630 strncat(x, y, strlen(y)); // no-warning
631}
632
633void strncat_no_overflow_2(char *y) {
634 char x[4] = "12";
635 if (strlen(y) == 4)
636 strncat(x, y, 1); // no-warning
637}
Lenny Maiorani318dd922011-04-12 17:08:43 +0000638
639//===----------------------------------------------------------------------===
640// strcmp()
641//===----------------------------------------------------------------------===
642
643#define strcmp BUILTIN(strcmp)
Jordy Roseadc42d42011-06-16 07:13:34 +0000644int strcmp(const char * s1, const char * s2);
Lenny Maiorani318dd922011-04-12 17:08:43 +0000645
646void strcmp_constant0() {
647 if (strcmp("123", "123") != 0)
648 (void)*(char*)0; // no-warning
649}
650
651void strcmp_constant_and_var_0() {
652 char *x = "123";
653 if (strcmp(x, "123") != 0)
654 (void)*(char*)0; // no-warning
655}
656
657void strcmp_constant_and_var_1() {
658 char *x = "123";
659 if (strcmp("123", x) != 0)
660 (void)*(char*)0; // no-warning
661}
662
663void strcmp_0() {
664 char *x = "123";
665 char *y = "123";
666 if (strcmp(x, y) != 0)
667 (void)*(char*)0; // no-warning
668}
669
670void strcmp_1() {
671 char *x = "234";
672 char *y = "123";
673 if (strcmp(x, y) != 1)
674 (void)*(char*)0; // no-warning
675}
676
677void strcmp_2() {
678 char *x = "123";
679 char *y = "234";
680 if (strcmp(x, y) != -1)
681 (void)*(char*)0; // no-warning
682}
683
684void strcmp_null_0() {
685 char *x = NULL;
686 char *y = "123";
Jordy Rose9e49d9f2011-06-20 02:06:40 +0000687 strcmp(x, y); // expected-warning{{Null pointer argument in call to string comparison function}}
Lenny Maiorani318dd922011-04-12 17:08:43 +0000688}
689
690void strcmp_null_1() {
691 char *x = "123";
692 char *y = NULL;
Jordy Rose9e49d9f2011-06-20 02:06:40 +0000693 strcmp(x, y); // expected-warning{{Null pointer argument in call to string comparison function}}
Lenny Maiorani318dd922011-04-12 17:08:43 +0000694}
695
696void strcmp_diff_length_0() {
697 char *x = "12345";
698 char *y = "234";
699 if (strcmp(x, y) != -1)
700 (void)*(char*)0; // no-warning
701}
702
703void strcmp_diff_length_1() {
704 char *x = "123";
705 char *y = "23456";
706 if (strcmp(x, y) != -1)
707 (void)*(char*)0; // no-warning
708}
709
710void strcmp_diff_length_2() {
711 char *x = "12345";
712 char *y = "123";
713 if (strcmp(x, y) != 1)
714 (void)*(char*)0; // no-warning
715}
716
717void strcmp_diff_length_3() {
718 char *x = "123";
719 char *y = "12345";
720 if (strcmp(x, y) != -1)
721 (void)*(char*)0; // no-warning
722}
723
Jordy Roseadc42d42011-06-16 07:13:34 +0000724void strcmp_embedded_null () {
725 if (strcmp("\0z", "\0y") != 0)
726 (void)*(char*)0; // no-warning
727}
728
729void strcmp_unknown_arg (char *unknown) {
730 if (strcmp(unknown, unknown) != 0)
731 (void)*(char*)0; // no-warning
732}
733
Lenny Maiorani357f6ee2011-04-25 22:21:00 +0000734//===----------------------------------------------------------------------===
735// strncmp()
736//===----------------------------------------------------------------------===
737
738#define strncmp BUILTIN(strncmp)
Jordy Roseadc42d42011-06-16 07:13:34 +0000739int strncmp(const char *s1, const char *s2, size_t n);
Lenny Maiorani357f6ee2011-04-25 22:21:00 +0000740
741void strncmp_constant0() {
742 if (strncmp("123", "123", 3) != 0)
743 (void)*(char*)0; // no-warning
744}
745
746void strncmp_constant_and_var_0() {
747 char *x = "123";
748 if (strncmp(x, "123", 3) != 0)
749 (void)*(char*)0; // no-warning
750}
751
752void strncmp_constant_and_var_1() {
753 char *x = "123";
754 if (strncmp("123", x, 3) != 0)
755 (void)*(char*)0; // no-warning
756}
757
758void strncmp_0() {
759 char *x = "123";
760 char *y = "123";
761 if (strncmp(x, y, 3) != 0)
762 (void)*(char*)0; // no-warning
763}
764
765void strncmp_1() {
766 char *x = "234";
767 char *y = "123";
768 if (strncmp(x, y, 3) != 1)
769 (void)*(char*)0; // no-warning
770}
771
772void strncmp_2() {
773 char *x = "123";
774 char *y = "234";
775 if (strncmp(x, y, 3) != -1)
776 (void)*(char*)0; // no-warning
777}
778
779void strncmp_null_0() {
780 char *x = NULL;
781 char *y = "123";
Jordy Rose9e49d9f2011-06-20 02:06:40 +0000782 strncmp(x, y, 3); // expected-warning{{Null pointer argument in call to string comparison function}}
Lenny Maiorani357f6ee2011-04-25 22:21:00 +0000783}
784
785void strncmp_null_1() {
786 char *x = "123";
787 char *y = NULL;
Jordy Rose9e49d9f2011-06-20 02:06:40 +0000788 strncmp(x, y, 3); // expected-warning{{Null pointer argument in call to string comparison function}}
Lenny Maiorani357f6ee2011-04-25 22:21:00 +0000789}
790
791void strncmp_diff_length_0() {
792 char *x = "12345";
793 char *y = "234";
794 if (strncmp(x, y, 5) != -1)
795 (void)*(char*)0; // no-warning
796}
797
798void strncmp_diff_length_1() {
799 char *x = "123";
800 char *y = "23456";
801 if (strncmp(x, y, 5) != -1)
802 (void)*(char*)0; // no-warning
803}
804
805void strncmp_diff_length_2() {
806 char *x = "12345";
807 char *y = "123";
808 if (strncmp(x, y, 5) != 1)
809 (void)*(char*)0; // no-warning
810}
811
812void strncmp_diff_length_3() {
813 char *x = "123";
814 char *y = "12345";
815 if (strncmp(x, y, 5) != -1)
816 (void)*(char*)0; // no-warning
817}
818
819void strncmp_diff_length_4() {
820 char *x = "123";
821 char *y = "12345";
822 if (strncmp(x, y, 3) != 0)
823 (void)*(char*)0; // no-warning
824}
825
826void strncmp_diff_length_5() {
827 char *x = "012";
828 char *y = "12345";
829 if (strncmp(x, y, 3) != -1)
830 (void)*(char*)0; // no-warning
831}
832
833void strncmp_diff_length_6() {
834 char *x = "234";
835 char *y = "12345";
836 if (strncmp(x, y, 3) != 1)
837 (void)*(char*)0; // no-warning
838}
839
Jordy Roseadc42d42011-06-16 07:13:34 +0000840void strncmp_embedded_null () {
841 if (strncmp("ab\0zz", "ab\0yy", 4) != 0)
842 (void)*(char*)0; // no-warning
843}
844
Lenny Maioranibd1d16a2011-04-28 15:09:11 +0000845//===----------------------------------------------------------------------===
846// strcasecmp()
847//===----------------------------------------------------------------------===
848
849#define strcasecmp BUILTIN(strcasecmp)
Jordy Roseadc42d42011-06-16 07:13:34 +0000850int strcasecmp(const char *s1, const char *s2);
Lenny Maioranibd1d16a2011-04-28 15:09:11 +0000851
852void strcasecmp_constant0() {
853 if (strcasecmp("abc", "Abc") != 0)
854 (void)*(char*)0; // no-warning
855}
856
857void strcasecmp_constant_and_var_0() {
858 char *x = "abc";
859 if (strcasecmp(x, "Abc") != 0)
860 (void)*(char*)0; // no-warning
861}
862
863void strcasecmp_constant_and_var_1() {
864 char *x = "abc";
865 if (strcasecmp("Abc", x) != 0)
866 (void)*(char*)0; // no-warning
867}
868
869void strcasecmp_0() {
870 char *x = "abc";
871 char *y = "Abc";
872 if (strcasecmp(x, y) != 0)
873 (void)*(char*)0; // no-warning
874}
875
876void strcasecmp_1() {
877 char *x = "Bcd";
878 char *y = "abc";
879 if (strcasecmp(x, y) != 1)
880 (void)*(char*)0; // no-warning
881}
882
883void strcasecmp_2() {
884 char *x = "abc";
885 char *y = "Bcd";
886 if (strcasecmp(x, y) != -1)
887 (void)*(char*)0; // no-warning
888}
889
890void strcasecmp_null_0() {
891 char *x = NULL;
892 char *y = "123";
Jordy Rose9e49d9f2011-06-20 02:06:40 +0000893 strcasecmp(x, y); // expected-warning{{Null pointer argument in call to string comparison function}}
Lenny Maioranibd1d16a2011-04-28 15:09:11 +0000894}
895
896void strcasecmp_null_1() {
897 char *x = "123";
898 char *y = NULL;
Jordy Rose9e49d9f2011-06-20 02:06:40 +0000899 strcasecmp(x, y); // expected-warning{{Null pointer argument in call to string comparison function}}
Lenny Maioranibd1d16a2011-04-28 15:09:11 +0000900}
901
902void strcasecmp_diff_length_0() {
903 char *x = "abcde";
904 char *y = "aBd";
905 if (strcasecmp(x, y) != -1)
906 (void)*(char*)0; // no-warning
907}
908
909void strcasecmp_diff_length_1() {
910 char *x = "abc";
911 char *y = "aBdef";
912 if (strcasecmp(x, y) != -1)
913 (void)*(char*)0; // no-warning
914}
915
916void strcasecmp_diff_length_2() {
917 char *x = "aBcDe";
918 char *y = "abc";
919 if (strcasecmp(x, y) != 1)
920 (void)*(char*)0; // no-warning
921}
922
923void strcasecmp_diff_length_3() {
924 char *x = "aBc";
925 char *y = "abcde";
926 if (strcasecmp(x, y) != -1)
927 (void)*(char*)0; // no-warning
928}
Lenny Maiorani454fd2d2011-05-02 19:05:49 +0000929
Jordy Roseadc42d42011-06-16 07:13:34 +0000930void strcasecmp_embedded_null () {
931 if (strcasecmp("ab\0zz", "ab\0yy") != 0)
932 (void)*(char*)0; // no-warning
933}
934
Lenny Maiorani454fd2d2011-05-02 19:05:49 +0000935//===----------------------------------------------------------------------===
936// strncasecmp()
937//===----------------------------------------------------------------------===
938
939#define strncasecmp BUILTIN(strncasecmp)
Jordy Roseadc42d42011-06-16 07:13:34 +0000940int strncasecmp(const char *s1, const char *s2, size_t n);
Lenny Maiorani454fd2d2011-05-02 19:05:49 +0000941
942void strncasecmp_constant0() {
943 if (strncasecmp("abc", "Abc", 3) != 0)
944 (void)*(char*)0; // no-warning
945}
946
947void strncasecmp_constant_and_var_0() {
948 char *x = "abc";
949 if (strncasecmp(x, "Abc", 3) != 0)
950 (void)*(char*)0; // no-warning
951}
952
953void strncasecmp_constant_and_var_1() {
954 char *x = "abc";
955 if (strncasecmp("Abc", x, 3) != 0)
956 (void)*(char*)0; // no-warning
957}
958
959void strncasecmp_0() {
960 char *x = "abc";
961 char *y = "Abc";
962 if (strncasecmp(x, y, 3) != 0)
963 (void)*(char*)0; // no-warning
964}
965
966void strncasecmp_1() {
967 char *x = "Bcd";
968 char *y = "abc";
969 if (strncasecmp(x, y, 3) != 1)
970 (void)*(char*)0; // no-warning
971}
972
973void strncasecmp_2() {
974 char *x = "abc";
975 char *y = "Bcd";
976 if (strncasecmp(x, y, 3) != -1)
977 (void)*(char*)0; // no-warning
978}
979
980void strncasecmp_null_0() {
981 char *x = NULL;
982 char *y = "123";
Jordy Rose9e49d9f2011-06-20 02:06:40 +0000983 strncasecmp(x, y, 3); // expected-warning{{Null pointer argument in call to string comparison function}}
Lenny Maiorani454fd2d2011-05-02 19:05:49 +0000984}
985
986void strncasecmp_null_1() {
987 char *x = "123";
988 char *y = NULL;
Jordy Rose9e49d9f2011-06-20 02:06:40 +0000989 strncasecmp(x, y, 3); // expected-warning{{Null pointer argument in call to string comparison function}}
Lenny Maiorani454fd2d2011-05-02 19:05:49 +0000990}
991
992void strncasecmp_diff_length_0() {
993 char *x = "abcde";
994 char *y = "aBd";
995 if (strncasecmp(x, y, 5) != -1)
996 (void)*(char*)0; // no-warning
997}
998
999void strncasecmp_diff_length_1() {
1000 char *x = "abc";
1001 char *y = "aBdef";
1002 if (strncasecmp(x, y, 5) != -1)
1003 (void)*(char*)0; // no-warning
1004}
1005
1006void strncasecmp_diff_length_2() {
1007 char *x = "aBcDe";
1008 char *y = "abc";
1009 if (strncasecmp(x, y, 5) != 1)
1010 (void)*(char*)0; // no-warning
1011}
1012
1013void strncasecmp_diff_length_3() {
1014 char *x = "aBc";
1015 char *y = "abcde";
1016 if (strncasecmp(x, y, 5) != -1)
1017 (void)*(char*)0; // no-warning
1018}
1019
1020void strncasecmp_diff_length_4() {
1021 char *x = "abcde";
1022 char *y = "aBc";
1023 if (strncasecmp(x, y, 3) != 0)
1024 (void)*(char*)0; // no-warning
1025}
1026
1027void strncasecmp_diff_length_5() {
1028 char *x = "abcde";
1029 char *y = "aBd";
1030 if (strncasecmp(x, y, 3) != -1)
1031 (void)*(char*)0; // no-warning
1032}
1033
1034void strncasecmp_diff_length_6() {
1035 char *x = "aBDe";
1036 char *y = "abc";
1037 if (strncasecmp(x, y, 3) != 1)
1038 (void)*(char*)0; // no-warning
1039}
Jordy Roseadc42d42011-06-16 07:13:34 +00001040
1041void strncasecmp_embedded_null () {
1042 if (strncasecmp("ab\0zz", "ab\0yy", 4) != 0)
1043 (void)*(char*)0; // no-warning
1044}