Ted Kremenek | 033a07e | 2011-08-03 23:14:55 +0000 | [diff] [blame] | 1 | // RUN: %clang_cc1 -analyze -analyzer-checker=core,experimental.core.CastToStruct -analyzer-store=region -analyzer-constraints=basic -verify %s |
| 2 | // RUN: %clang_cc1 -analyze -analyzer-checker=core,experimental.core.CastToStruct -analyzer-store=region -analyzer-constraints=range -verify %s |
Zhongxing Xu | ef8b28e | 2008-10-17 05:19:52 +0000 | [diff] [blame] | 3 | |
Zhongxing Xu | 72e1682 | 2008-10-24 08:51:58 +0000 | [diff] [blame] | 4 | struct s { |
| 5 | int data; |
| 6 | int data_array[10]; |
| 7 | }; |
Zhongxing Xu | ef8b28e | 2008-10-17 05:19:52 +0000 | [diff] [blame] | 8 | |
Zhongxing Xu | 234a7d2 | 2008-10-27 09:19:25 +0000 | [diff] [blame] | 9 | typedef struct { |
| 10 | int data; |
| 11 | } STYPE; |
| 12 | |
Zhongxing Xu | 9184412 | 2009-05-20 09:18:48 +0000 | [diff] [blame] | 13 | void g(char *p); |
Zhongxing Xu | 04b90bc | 2008-11-02 13:17:44 +0000 | [diff] [blame] | 14 | void g1(struct s* p); |
| 15 | |
Zhongxing Xu | 661fc39 | 2008-11-25 01:45:11 +0000 | [diff] [blame] | 16 | // Array to pointer conversion. Array in the struct field. |
Zhongxing Xu | ef8b28e | 2008-10-17 05:19:52 +0000 | [diff] [blame] | 17 | void f(void) { |
| 18 | int a[10]; |
| 19 | int (*p)[10]; |
| 20 | p = &a; |
| 21 | (*p)[3] = 1; |
| 22 | |
| 23 | struct s d; |
| 24 | struct s *q; |
| 25 | q = &d; |
Zhongxing Xu | 72e1682 | 2008-10-24 08:51:58 +0000 | [diff] [blame] | 26 | q->data = 3; |
| 27 | d.data_array[9] = 17; |
Zhongxing Xu | ef8b28e | 2008-10-17 05:19:52 +0000 | [diff] [blame] | 28 | } |
Zhongxing Xu | 2e97120 | 2008-10-25 14:11:23 +0000 | [diff] [blame] | 29 | |
Zhongxing Xu | 661fc39 | 2008-11-25 01:45:11 +0000 | [diff] [blame] | 30 | // StringLiteral in lvalue context and pointer to array type. |
| 31 | // p: ElementRegion, q: StringRegion |
Zhongxing Xu | 2e97120 | 2008-10-25 14:11:23 +0000 | [diff] [blame] | 32 | void f2() { |
| 33 | char *p = "/usr/local"; |
| 34 | char (*q)[4]; |
| 35 | q = &"abc"; |
| 36 | } |
Zhongxing Xu | 234a7d2 | 2008-10-27 09:19:25 +0000 | [diff] [blame] | 37 | |
Zhongxing Xu | 661fc39 | 2008-11-25 01:45:11 +0000 | [diff] [blame] | 38 | // Typedef'ed struct definition. |
Zhongxing Xu | 234a7d2 | 2008-10-27 09:19:25 +0000 | [diff] [blame] | 39 | void f3() { |
| 40 | STYPE s; |
| 41 | } |
Zhongxing Xu | df2aa1e | 2008-10-31 10:23:14 +0000 | [diff] [blame] | 42 | |
Zhongxing Xu | 661fc39 | 2008-11-25 01:45:11 +0000 | [diff] [blame] | 43 | // Initialize array with InitExprList. |
Zhongxing Xu | df2aa1e | 2008-10-31 10:23:14 +0000 | [diff] [blame] | 44 | void f4() { |
| 45 | int a[] = { 1, 2, 3}; |
| 46 | int b[3] = { 1, 2 }; |
Zhongxing Xu | b61f49c | 2009-01-23 10:23:13 +0000 | [diff] [blame] | 47 | struct s c[] = {{1,{1}}}; |
Zhongxing Xu | df2aa1e | 2008-10-31 10:23:14 +0000 | [diff] [blame] | 48 | } |
Zhongxing Xu | 04b90bc | 2008-11-02 13:17:44 +0000 | [diff] [blame] | 49 | |
Zhongxing Xu | 661fc39 | 2008-11-25 01:45:11 +0000 | [diff] [blame] | 50 | // Struct variable in lvalue context. |
Zhongxing Xu | 5834ed6 | 2009-01-13 01:49:57 +0000 | [diff] [blame] | 51 | // Assign UnknownVal to the whole struct. |
Zhongxing Xu | 04b90bc | 2008-11-02 13:17:44 +0000 | [diff] [blame] | 52 | void f5() { |
| 53 | struct s data; |
| 54 | g1(&data); |
| 55 | } |
Zhongxing Xu | b670133 | 2008-11-13 07:59:15 +0000 | [diff] [blame] | 56 | |
Zhongxing Xu | 661fc39 | 2008-11-25 01:45:11 +0000 | [diff] [blame] | 57 | // AllocaRegion test. |
Zhongxing Xu | b670133 | 2008-11-13 07:59:15 +0000 | [diff] [blame] | 58 | void f6() { |
| 59 | char *p; |
| 60 | p = __builtin_alloca(10); |
Zhongxing Xu | 9184412 | 2009-05-20 09:18:48 +0000 | [diff] [blame] | 61 | g(p); |
| 62 | char c = *p; |
Zhongxing Xu | b670133 | 2008-11-13 07:59:15 +0000 | [diff] [blame] | 63 | p[1] = 'a'; |
Zhongxing Xu | 2acc399 | 2009-05-20 09:03:10 +0000 | [diff] [blame] | 64 | // Test if RegionStore::EvalBinOp converts the alloca region to element |
| 65 | // region. |
Zhongxing Xu | 262fd03 | 2009-05-20 09:00:16 +0000 | [diff] [blame] | 66 | p += 2; |
Zhongxing Xu | b670133 | 2008-11-13 07:59:15 +0000 | [diff] [blame] | 67 | } |
Zhongxing Xu | fb75b25 | 2008-11-13 08:44:52 +0000 | [diff] [blame] | 68 | |
| 69 | struct s2; |
| 70 | |
| 71 | void g2(struct s2 *p); |
| 72 | |
Zhongxing Xu | 661fc39 | 2008-11-25 01:45:11 +0000 | [diff] [blame] | 73 | // Incomplete struct pointer used as function argument. |
Zhongxing Xu | fb75b25 | 2008-11-13 08:44:52 +0000 | [diff] [blame] | 74 | void f7() { |
| 75 | struct s2 *p = __builtin_alloca(10); |
| 76 | g2(p); |
| 77 | } |
Zhongxing Xu | 26134a1 | 2008-11-13 09:20:05 +0000 | [diff] [blame] | 78 | |
Zhongxing Xu | 661fc39 | 2008-11-25 01:45:11 +0000 | [diff] [blame] | 79 | // sizeof() is unsigned while -1 is signed in array index. |
Zhongxing Xu | 26134a1 | 2008-11-13 09:20:05 +0000 | [diff] [blame] | 80 | void f8() { |
| 81 | int a[10]; |
Zhongxing Xu | 33d7cbf | 2008-11-24 23:45:56 +0000 | [diff] [blame] | 82 | a[sizeof(a)/sizeof(int) - 1] = 1; // no-warning |
Zhongxing Xu | 26134a1 | 2008-11-13 09:20:05 +0000 | [diff] [blame] | 83 | } |
Zhongxing Xu | 617ff31 | 2008-11-18 13:30:46 +0000 | [diff] [blame] | 84 | |
Zhongxing Xu | 661fc39 | 2008-11-25 01:45:11 +0000 | [diff] [blame] | 85 | // Initialization of struct array elements. |
Zhongxing Xu | 617ff31 | 2008-11-18 13:30:46 +0000 | [diff] [blame] | 86 | void f9() { |
| 87 | struct s a[10]; |
| 88 | } |
Zhongxing Xu | 27cae9e | 2008-11-30 05:51:19 +0000 | [diff] [blame] | 89 | |
| 90 | // Initializing array with string literal. |
| 91 | void f10() { |
| 92 | char a1[4] = "abc"; |
Zhongxing Xu | 27cae9e | 2008-11-30 05:51:19 +0000 | [diff] [blame] | 93 | char a3[6] = "abc"; |
| 94 | } |
Zhongxing Xu | 562c4d9 | 2009-01-23 11:22:12 +0000 | [diff] [blame] | 95 | |
| 96 | // Retrieve the default value of element/field region. |
| 97 | void f11() { |
| 98 | struct s a; |
Zhongxing Xu | 9184412 | 2009-05-20 09:18:48 +0000 | [diff] [blame] | 99 | g1(&a); |
Zhongxing Xu | 562c4d9 | 2009-01-23 11:22:12 +0000 | [diff] [blame] | 100 | if (a.data == 0) // no-warning |
| 101 | a.data = 1; |
| 102 | } |
Zhongxing Xu | 3450a55 | 2009-02-19 08:42:43 +0000 | [diff] [blame] | 103 | |
| 104 | // Convert unsigned offset to signed when creating ElementRegion from |
| 105 | // SymbolicRegion. |
| 106 | void f12(int *list) { |
| 107 | unsigned i = 0; |
| 108 | list[i] = 1; |
| 109 | } |
Zhongxing Xu | c57bc59 | 2009-03-18 02:07:30 +0000 | [diff] [blame] | 110 | |
| 111 | struct s1 { |
| 112 | struct s2 { |
| 113 | int d; |
| 114 | } e; |
| 115 | }; |
| 116 | |
| 117 | // The binding of a.e.d should not be removed. Test recursive subregion map |
| 118 | // building: a->e, e->d. Only then 'a' could be added to live region roots. |
| 119 | void f13(double timeout) { |
| 120 | struct s1 a; |
John McCall | 680523a | 2009-11-07 03:30:10 +0000 | [diff] [blame] | 121 | a.e.d = (int) timeout; |
Zhongxing Xu | c57bc59 | 2009-03-18 02:07:30 +0000 | [diff] [blame] | 122 | if (a.e.d == 10) |
| 123 | a.e.d = 4; |
| 124 | } |
Zhongxing Xu | 3e001f3 | 2009-05-03 00:27:40 +0000 | [diff] [blame] | 125 | |
| 126 | struct s3 { |
| 127 | int a[2]; |
| 128 | }; |
| 129 | |
| 130 | static struct s3 opt; |
| 131 | |
| 132 | // Test if the embedded array is retrieved correctly. |
| 133 | void f14() { |
| 134 | struct s3 my_opt = opt; |
| 135 | } |
Zhongxing Xu | 264e937 | 2009-05-12 10:10:00 +0000 | [diff] [blame] | 136 | |
| 137 | void bar(int*); |
| 138 | |
| 139 | // Test if the array is correctly invalidated. |
| 140 | void f15() { |
| 141 | int a[10]; |
| 142 | bar(a); |
| 143 | if (a[1]) // no-warning |
Anders Carlsson | 9668b1f | 2009-07-30 22:37:41 +0000 | [diff] [blame] | 144 | (void)1; |
Zhongxing Xu | 264e937 | 2009-05-12 10:10:00 +0000 | [diff] [blame] | 145 | } |
Zhongxing Xu | 3f6978a | 2009-06-11 09:11:27 +0000 | [diff] [blame] | 146 | |
| 147 | struct s3 p[1]; |
| 148 | |
| 149 | // Code from postgresql. |
| 150 | // Current cast logic of region store mistakenly leaves the final result region |
| 151 | // an ElementRegion of type 'char'. Then load a nonloc::SymbolVal from it and |
| 152 | // assigns to 'a'. |
| 153 | void f16(struct s3 *p) { |
Zhongxing Xu | 4f3dc69 | 2009-11-09 08:07:38 +0000 | [diff] [blame] | 154 | struct s3 a = *((struct s3*) ((char*) &p[0])); // expected-warning{{Casting a non-structure type to a structure type and accessing a field can lead to memory access errors or data corruption.}} |
Zhongxing Xu | 3f6978a | 2009-06-11 09:11:27 +0000 | [diff] [blame] | 155 | } |
Zhongxing Xu | 6bd8a52 | 2009-06-28 13:59:24 +0000 | [diff] [blame] | 156 | |
| 157 | void inv(struct s1 *); |
| 158 | |
| 159 | // Invalidate the struct field. |
| 160 | void f17() { |
| 161 | struct s1 t; |
| 162 | int x; |
| 163 | inv(&t); |
| 164 | if (t.e.d) |
| 165 | x = 1; |
| 166 | } |
Zhongxing Xu | a03f157 | 2009-06-29 06:43:40 +0000 | [diff] [blame] | 167 | |
| 168 | void read(char*); |
| 169 | |
| 170 | void f18() { |
| 171 | char *q; |
| 172 | char *p = (char *) __builtin_alloca(10); |
| 173 | read(p); |
| 174 | q = p; |
| 175 | q++; |
| 176 | if (*q) { // no-warning |
| 177 | } |
| 178 | } |