Ted Kremenek | cdc3a89 | 2012-08-24 20:39:55 +0000 | [diff] [blame^] | 1 | // RUN: %clang_cc1 -analyze -analyzer-checker=core,alpha.core.CastToStruct -analyzer-store=region -analyzer-constraints=range -verify %s |
Zhongxing Xu | ef8b28e | 2008-10-17 05:19:52 +0000 | [diff] [blame] | 2 | |
Zhongxing Xu | 72e1682 | 2008-10-24 08:51:58 +0000 | [diff] [blame] | 3 | struct s { |
4 | int data; | ||||
5 | int data_array[10]; | ||||
6 | }; | ||||
Zhongxing Xu | ef8b28e | 2008-10-17 05:19:52 +0000 | [diff] [blame] | 7 | |
Zhongxing Xu | 234a7d2 | 2008-10-27 09:19:25 +0000 | [diff] [blame] | 8 | typedef struct { |
9 | int data; | ||||
10 | } STYPE; | ||||
11 | |||||
Zhongxing Xu | 9184412 | 2009-05-20 09:18:48 +0000 | [diff] [blame] | 12 | void g(char *p); |
Zhongxing Xu | 04b90bc | 2008-11-02 13:17:44 +0000 | [diff] [blame] | 13 | void g1(struct s* p); |
14 | |||||
Zhongxing Xu | 661fc39 | 2008-11-25 01:45:11 +0000 | [diff] [blame] | 15 | // Array to pointer conversion. Array in the struct field. |
Zhongxing Xu | ef8b28e | 2008-10-17 05:19:52 +0000 | [diff] [blame] | 16 | void f(void) { |
17 | int a[10]; | ||||
18 | int (*p)[10]; | ||||
19 | p = &a; | ||||
20 | (*p)[3] = 1; | ||||
21 | |||||
22 | struct s d; | ||||
23 | struct s *q; | ||||
24 | q = &d; | ||||
Zhongxing Xu | 72e1682 | 2008-10-24 08:51:58 +0000 | [diff] [blame] | 25 | q->data = 3; |
26 | d.data_array[9] = 17; | ||||
Zhongxing Xu | ef8b28e | 2008-10-17 05:19:52 +0000 | [diff] [blame] | 27 | } |
Zhongxing Xu | 2e97120 | 2008-10-25 14:11:23 +0000 | [diff] [blame] | 28 | |
Zhongxing Xu | 661fc39 | 2008-11-25 01:45:11 +0000 | [diff] [blame] | 29 | // StringLiteral in lvalue context and pointer to array type. |
30 | // p: ElementRegion, q: StringRegion | ||||
Zhongxing Xu | 2e97120 | 2008-10-25 14:11:23 +0000 | [diff] [blame] | 31 | void f2() { |
32 | char *p = "/usr/local"; | ||||
33 | char (*q)[4]; | ||||
34 | q = &"abc"; | ||||
35 | } | ||||
Zhongxing Xu | 234a7d2 | 2008-10-27 09:19:25 +0000 | [diff] [blame] | 36 | |
Zhongxing Xu | 661fc39 | 2008-11-25 01:45:11 +0000 | [diff] [blame] | 37 | // Typedef'ed struct definition. |
Zhongxing Xu | 234a7d2 | 2008-10-27 09:19:25 +0000 | [diff] [blame] | 38 | void f3() { |
39 | STYPE s; | ||||
40 | } | ||||
Zhongxing Xu | df2aa1e | 2008-10-31 10:23:14 +0000 | [diff] [blame] | 41 | |
Zhongxing Xu | 661fc39 | 2008-11-25 01:45:11 +0000 | [diff] [blame] | 42 | // Initialize array with InitExprList. |
Zhongxing Xu | df2aa1e | 2008-10-31 10:23:14 +0000 | [diff] [blame] | 43 | void f4() { |
44 | int a[] = { 1, 2, 3}; | ||||
45 | int b[3] = { 1, 2 }; | ||||
Zhongxing Xu | b61f49c | 2009-01-23 10:23:13 +0000 | [diff] [blame] | 46 | struct s c[] = {{1,{1}}}; |
Zhongxing Xu | df2aa1e | 2008-10-31 10:23:14 +0000 | [diff] [blame] | 47 | } |
Zhongxing Xu | 04b90bc | 2008-11-02 13:17:44 +0000 | [diff] [blame] | 48 | |
Zhongxing Xu | 661fc39 | 2008-11-25 01:45:11 +0000 | [diff] [blame] | 49 | // Struct variable in lvalue context. |
Zhongxing Xu | 5834ed6 | 2009-01-13 01:49:57 +0000 | [diff] [blame] | 50 | // Assign UnknownVal to the whole struct. |
Zhongxing Xu | 04b90bc | 2008-11-02 13:17:44 +0000 | [diff] [blame] | 51 | void f5() { |
52 | struct s data; | ||||
53 | g1(&data); | ||||
54 | } | ||||
Zhongxing Xu | b670133 | 2008-11-13 07:59:15 +0000 | [diff] [blame] | 55 | |
Zhongxing Xu | 661fc39 | 2008-11-25 01:45:11 +0000 | [diff] [blame] | 56 | // AllocaRegion test. |
Zhongxing Xu | b670133 | 2008-11-13 07:59:15 +0000 | [diff] [blame] | 57 | void f6() { |
58 | char *p; | ||||
59 | p = __builtin_alloca(10); | ||||
Zhongxing Xu | 9184412 | 2009-05-20 09:18:48 +0000 | [diff] [blame] | 60 | g(p); |
61 | char c = *p; | ||||
Zhongxing Xu | b670133 | 2008-11-13 07:59:15 +0000 | [diff] [blame] | 62 | p[1] = 'a'; |
Zhongxing Xu | 2acc399 | 2009-05-20 09:03:10 +0000 | [diff] [blame] | 63 | // Test if RegionStore::EvalBinOp converts the alloca region to element |
64 | // region. | ||||
Zhongxing Xu | 262fd03 | 2009-05-20 09:00:16 +0000 | [diff] [blame] | 65 | p += 2; |
Zhongxing Xu | b670133 | 2008-11-13 07:59:15 +0000 | [diff] [blame] | 66 | } |
Zhongxing Xu | fb75b25 | 2008-11-13 08:44:52 +0000 | [diff] [blame] | 67 | |
68 | struct s2; | ||||
69 | |||||
70 | void g2(struct s2 *p); | ||||
71 | |||||
Zhongxing Xu | 661fc39 | 2008-11-25 01:45:11 +0000 | [diff] [blame] | 72 | // Incomplete struct pointer used as function argument. |
Zhongxing Xu | fb75b25 | 2008-11-13 08:44:52 +0000 | [diff] [blame] | 73 | void f7() { |
74 | struct s2 *p = __builtin_alloca(10); | ||||
75 | g2(p); | ||||
76 | } | ||||
Zhongxing Xu | 26134a1 | 2008-11-13 09:20:05 +0000 | [diff] [blame] | 77 | |
Zhongxing Xu | 661fc39 | 2008-11-25 01:45:11 +0000 | [diff] [blame] | 78 | // sizeof() is unsigned while -1 is signed in array index. |
Zhongxing Xu | 26134a1 | 2008-11-13 09:20:05 +0000 | [diff] [blame] | 79 | void f8() { |
80 | int a[10]; | ||||
Zhongxing Xu | 33d7cbf | 2008-11-24 23:45:56 +0000 | [diff] [blame] | 81 | a[sizeof(a)/sizeof(int) - 1] = 1; // no-warning |
Zhongxing Xu | 26134a1 | 2008-11-13 09:20:05 +0000 | [diff] [blame] | 82 | } |
Zhongxing Xu | 617ff31 | 2008-11-18 13:30:46 +0000 | [diff] [blame] | 83 | |
Zhongxing Xu | 661fc39 | 2008-11-25 01:45:11 +0000 | [diff] [blame] | 84 | // Initialization of struct array elements. |
Zhongxing Xu | 617ff31 | 2008-11-18 13:30:46 +0000 | [diff] [blame] | 85 | void f9() { |
86 | struct s a[10]; | ||||
87 | } | ||||
Zhongxing Xu | 27cae9e | 2008-11-30 05:51:19 +0000 | [diff] [blame] | 88 | |
89 | // Initializing array with string literal. | ||||
90 | void f10() { | ||||
91 | char a1[4] = "abc"; | ||||
Zhongxing Xu | 27cae9e | 2008-11-30 05:51:19 +0000 | [diff] [blame] | 92 | char a3[6] = "abc"; |
93 | } | ||||
Zhongxing Xu | 562c4d9 | 2009-01-23 11:22:12 +0000 | [diff] [blame] | 94 | |
95 | // Retrieve the default value of element/field region. | ||||
96 | void f11() { | ||||
97 | struct s a; | ||||
Zhongxing Xu | 9184412 | 2009-05-20 09:18:48 +0000 | [diff] [blame] | 98 | g1(&a); |
Zhongxing Xu | 562c4d9 | 2009-01-23 11:22:12 +0000 | [diff] [blame] | 99 | if (a.data == 0) // no-warning |
100 | a.data = 1; | ||||
101 | } | ||||
Zhongxing Xu | 3450a55 | 2009-02-19 08:42:43 +0000 | [diff] [blame] | 102 | |
103 | // Convert unsigned offset to signed when creating ElementRegion from | ||||
104 | // SymbolicRegion. | ||||
105 | void f12(int *list) { | ||||
106 | unsigned i = 0; | ||||
107 | list[i] = 1; | ||||
108 | } | ||||
Zhongxing Xu | c57bc59 | 2009-03-18 02:07:30 +0000 | [diff] [blame] | 109 | |
110 | struct s1 { | ||||
111 | struct s2 { | ||||
112 | int d; | ||||
113 | } e; | ||||
114 | }; | ||||
115 | |||||
116 | // The binding of a.e.d should not be removed. Test recursive subregion map | ||||
117 | // building: a->e, e->d. Only then 'a' could be added to live region roots. | ||||
118 | void f13(double timeout) { | ||||
119 | struct s1 a; | ||||
John McCall | 680523a | 2009-11-07 03:30:10 +0000 | [diff] [blame] | 120 | a.e.d = (int) timeout; |
Zhongxing Xu | c57bc59 | 2009-03-18 02:07:30 +0000 | [diff] [blame] | 121 | if (a.e.d == 10) |
122 | a.e.d = 4; | ||||
123 | } | ||||
Zhongxing Xu | 3e001f3 | 2009-05-03 00:27:40 +0000 | [diff] [blame] | 124 | |
125 | struct s3 { | ||||
126 | int a[2]; | ||||
127 | }; | ||||
128 | |||||
129 | static struct s3 opt; | ||||
130 | |||||
131 | // Test if the embedded array is retrieved correctly. | ||||
132 | void f14() { | ||||
133 | struct s3 my_opt = opt; | ||||
134 | } | ||||
Zhongxing Xu | 264e937 | 2009-05-12 10:10:00 +0000 | [diff] [blame] | 135 | |
136 | void bar(int*); | ||||
137 | |||||
138 | // Test if the array is correctly invalidated. | ||||
139 | void f15() { | ||||
140 | int a[10]; | ||||
141 | bar(a); | ||||
142 | if (a[1]) // no-warning | ||||
Anders Carlsson | 9668b1f | 2009-07-30 22:37:41 +0000 | [diff] [blame] | 143 | (void)1; |
Zhongxing Xu | 264e937 | 2009-05-12 10:10:00 +0000 | [diff] [blame] | 144 | } |
Zhongxing Xu | 3f6978a | 2009-06-11 09:11:27 +0000 | [diff] [blame] | 145 | |
146 | struct s3 p[1]; | ||||
147 | |||||
148 | // Code from postgresql. | ||||
149 | // Current cast logic of region store mistakenly leaves the final result region | ||||
150 | // an ElementRegion of type 'char'. Then load a nonloc::SymbolVal from it and | ||||
151 | // assigns to 'a'. | ||||
152 | void f16(struct s3 *p) { | ||||
Ted Kremenek | c4bac8e | 2012-08-16 17:45:23 +0000 | [diff] [blame] | 153 | struct s3 a = *((struct s3*) ((char*) &p[0])); // expected-warning{{Casting a non-structure type to a structure type and accessing a field can lead to memory access errors or data corruption}} |
Zhongxing Xu | 3f6978a | 2009-06-11 09:11:27 +0000 | [diff] [blame] | 154 | } |
Zhongxing Xu | 6bd8a52 | 2009-06-28 13:59:24 +0000 | [diff] [blame] | 155 | |
156 | void inv(struct s1 *); | ||||
157 | |||||
158 | // Invalidate the struct field. | ||||
159 | void f17() { | ||||
160 | struct s1 t; | ||||
161 | int x; | ||||
162 | inv(&t); | ||||
163 | if (t.e.d) | ||||
164 | x = 1; | ||||
165 | } | ||||
Zhongxing Xu | a03f157 | 2009-06-29 06:43:40 +0000 | [diff] [blame] | 166 | |
167 | void read(char*); | ||||
168 | |||||
169 | void f18() { | ||||
170 | char *q; | ||||
171 | char *p = (char *) __builtin_alloca(10); | ||||
172 | read(p); | ||||
173 | q = p; | ||||
174 | q++; | ||||
175 | if (*q) { // no-warning | ||||
176 | } | ||||
177 | } |