Jordy Rose | ccbf7ee | 2010-07-06 23:11:01 +0000 | [diff] [blame] | 1 | // RUN: %clang_cc1 -analyze -analyzer-experimental-internal-checks -analyzer-check-objc-mem -analyzer-store=region -analyzer-experimental-checks -verify %s |
| 2 | // RUN: %clang_cc1 -analyze -DUSE_BUILTINS -analyzer-experimental-internal-checks -analyzer-check-objc-mem -analyzer-store=region -analyzer-experimental-checks -verify %s |
Jordy Rose | a6b808c | 2010-07-07 07:48:06 +0000 | [diff] [blame] | 3 | // RUN: %clang_cc1 -analyze -DVARIANT -analyzer-experimental-internal-checks -analyzer-check-objc-mem -analyzer-store=region -analyzer-experimental-checks -verify %s |
| 4 | // RUN: %clang_cc1 -analyze -DUSE_BUILTINS -DVARIANT -analyzer-experimental-internal-checks -analyzer-check-objc-mem -analyzer-store=region -analyzer-experimental-checks -verify %s |
Jordy Rose | ccbf7ee | 2010-07-06 23:11:01 +0000 | [diff] [blame] | 5 | |
| 6 | //===----------------------------------------------------------------------=== |
| 7 | // Declarations |
| 8 | //===----------------------------------------------------------------------=== |
| 9 | |
Jordy Rose | a6b808c | 2010-07-07 07:48:06 +0000 | [diff] [blame] | 10 | // Some functions are so similar to each other that they follow the same code |
Jordy Rose | bc56d1f | 2010-07-07 08:15:01 +0000 | [diff] [blame] | 11 | // path, such as memcpy and __memcpy_chk, or memcmp and bcmp. If VARIANT is |
| 12 | // defined, make sure to use the variants instead to make sure they are still |
| 13 | // checked by the analyzer. |
Jordy Rose | ccbf7ee | 2010-07-06 23:11:01 +0000 | [diff] [blame] | 14 | |
| 15 | // Some functions are implemented as builtins. These should be #defined as |
| 16 | // BUILTIN(f), which will prepend "__builtin_" if USE_BUILTINS is defined. |
| 17 | |
Jordy Rose | a6b808c | 2010-07-07 07:48:06 +0000 | [diff] [blame] | 18 | // Functions that have variants and are also availabe as builtins should be |
| 19 | // declared carefully! See memcpy() for an example. |
Jordy Rose | ccbf7ee | 2010-07-06 23:11:01 +0000 | [diff] [blame] | 20 | |
| 21 | #ifdef USE_BUILTINS |
| 22 | # define BUILTIN(f) __builtin_ ## f |
| 23 | #else /* USE_BUILTINS */ |
| 24 | # define BUILTIN(f) f |
| 25 | #endif /* USE_BUILTINS */ |
| 26 | |
| 27 | typedef typeof(sizeof(int)) size_t; |
| 28 | |
| 29 | //===----------------------------------------------------------------------=== |
| 30 | // memcpy() |
| 31 | //===----------------------------------------------------------------------=== |
| 32 | |
Jordy Rose | a6b808c | 2010-07-07 07:48:06 +0000 | [diff] [blame] | 33 | #ifdef VARIANT |
Jordy Rose | ccbf7ee | 2010-07-06 23:11:01 +0000 | [diff] [blame] | 34 | |
| 35 | #define __memcpy_chk BUILTIN(__memcpy_chk) |
| 36 | void *__memcpy_chk(void *restrict s1, const void *restrict s2, size_t n, |
| 37 | size_t destlen); |
| 38 | |
| 39 | #define memcpy(a,b,c) __memcpy_chk(a,b,c,(size_t)-1) |
| 40 | |
Jordy Rose | a6b808c | 2010-07-07 07:48:06 +0000 | [diff] [blame] | 41 | #else /* VARIANT */ |
Jordy Rose | ccbf7ee | 2010-07-06 23:11:01 +0000 | [diff] [blame] | 42 | |
| 43 | #define memcpy BUILTIN(memcpy) |
| 44 | void *memcpy(void *restrict s1, const void *restrict s2, size_t n); |
| 45 | |
Jordy Rose | a6b808c | 2010-07-07 07:48:06 +0000 | [diff] [blame] | 46 | #endif /* VARIANT */ |
Jordy Rose | ccbf7ee | 2010-07-06 23:11:01 +0000 | [diff] [blame] | 47 | |
| 48 | |
| 49 | void memcpy0 () { |
| 50 | char src[] = {1, 2, 3, 4}; |
Jordy Rose | e64f311 | 2010-08-16 07:51:42 +0000 | [diff] [blame^] | 51 | char dst[4] = {0}; |
Jordy Rose | ccbf7ee | 2010-07-06 23:11:01 +0000 | [diff] [blame] | 52 | |
| 53 | memcpy(dst, src, 4); // no-warning |
| 54 | |
| 55 | if (memcpy(dst, src, 4) != dst) { |
Tom Care | 7bce3a1 | 2010-07-27 23:30:21 +0000 | [diff] [blame] | 56 | (void)*(char*)0; // no-warning |
Jordy Rose | ccbf7ee | 2010-07-06 23:11:01 +0000 | [diff] [blame] | 57 | } |
Jordy Rose | e64f311 | 2010-08-16 07:51:42 +0000 | [diff] [blame^] | 58 | |
| 59 | if (dst[0] != 0) |
| 60 | (void)*(char*)0; // expected-warning{{null}} |
Jordy Rose | ccbf7ee | 2010-07-06 23:11:01 +0000 | [diff] [blame] | 61 | } |
| 62 | |
| 63 | void memcpy1 () { |
| 64 | char src[] = {1, 2, 3, 4}; |
| 65 | char dst[10]; |
| 66 | |
Jordy Rose | e64f311 | 2010-08-16 07:51:42 +0000 | [diff] [blame^] | 67 | memcpy(dst, src, 5); // expected-warning{{Byte string function accesses out-of-bound array element}} |
Jordy Rose | ccbf7ee | 2010-07-06 23:11:01 +0000 | [diff] [blame] | 68 | } |
| 69 | |
| 70 | void memcpy2 () { |
| 71 | char src[] = {1, 2, 3, 4}; |
| 72 | char dst[1]; |
| 73 | |
Jordy Rose | e64f311 | 2010-08-16 07:51:42 +0000 | [diff] [blame^] | 74 | memcpy(dst, src, 4); // expected-warning{{Byte string function overflows destination buffer}} |
Jordy Rose | ccbf7ee | 2010-07-06 23:11:01 +0000 | [diff] [blame] | 75 | } |
| 76 | |
| 77 | void memcpy3 () { |
| 78 | char src[] = {1, 2, 3, 4}; |
| 79 | char dst[3]; |
| 80 | |
| 81 | memcpy(dst+1, src+2, 2); // no-warning |
| 82 | } |
| 83 | |
| 84 | void memcpy4 () { |
| 85 | char src[] = {1, 2, 3, 4}; |
| 86 | char dst[10]; |
| 87 | |
Jordy Rose | e64f311 | 2010-08-16 07:51:42 +0000 | [diff] [blame^] | 88 | memcpy(dst+2, src+2, 3); // expected-warning{{Byte string function accesses out-of-bound array element}} |
Jordy Rose | ccbf7ee | 2010-07-06 23:11:01 +0000 | [diff] [blame] | 89 | } |
| 90 | |
| 91 | void memcpy5() { |
| 92 | char src[] = {1, 2, 3, 4}; |
| 93 | char dst[3]; |
| 94 | |
Jordy Rose | e64f311 | 2010-08-16 07:51:42 +0000 | [diff] [blame^] | 95 | memcpy(dst+2, src+2, 2); // expected-warning{{Byte string function overflows destination buffer}} |
Jordy Rose | ccbf7ee | 2010-07-06 23:11:01 +0000 | [diff] [blame] | 96 | } |
| 97 | |
| 98 | void memcpy6() { |
| 99 | int a[4] = {0}; |
| 100 | memcpy(a, a, 8); // expected-warning{{overlapping}} |
| 101 | } |
| 102 | |
| 103 | void memcpy7() { |
| 104 | int a[4] = {0}; |
| 105 | memcpy(a+2, a+1, 8); // expected-warning{{overlapping}} |
| 106 | } |
| 107 | |
| 108 | void memcpy8() { |
| 109 | int a[4] = {0}; |
| 110 | memcpy(a+1, a+2, 8); // expected-warning{{overlapping}} |
| 111 | } |
| 112 | |
| 113 | void memcpy9() { |
| 114 | int a[4] = {0}; |
| 115 | memcpy(a+2, a+1, 4); // no-warning |
| 116 | memcpy(a+1, a+2, 4); // no-warning |
| 117 | } |
| 118 | |
Jordy Rose | a6b808c | 2010-07-07 07:48:06 +0000 | [diff] [blame] | 119 | void memcpy10() { |
| 120 | char a[4] = {0}; |
| 121 | memcpy(0, a, 4); // expected-warning{{Null pointer argument in call to byte string function}} |
| 122 | } |
| 123 | |
| 124 | void memcpy11() { |
| 125 | char a[4] = {0}; |
| 126 | memcpy(a, 0, 4); // expected-warning{{Null pointer argument in call to byte string function}} |
| 127 | } |
| 128 | |
| 129 | void memcpy12() { |
| 130 | char a[4] = {0}; |
| 131 | memcpy(0, a, 0); // no-warning |
| 132 | memcpy(a, 0, 0); // no-warning |
| 133 | } |
| 134 | |
Jordy Rose | ccbf7ee | 2010-07-06 23:11:01 +0000 | [diff] [blame] | 135 | //===----------------------------------------------------------------------=== |
| 136 | // memmove() |
| 137 | //===----------------------------------------------------------------------=== |
| 138 | |
Jordy Rose | a6b808c | 2010-07-07 07:48:06 +0000 | [diff] [blame] | 139 | #ifdef VARIANT |
Jordy Rose | ccbf7ee | 2010-07-06 23:11:01 +0000 | [diff] [blame] | 140 | |
| 141 | #define __memmove_chk BUILTIN(__memmove_chk) |
| 142 | void *__memmove_chk(void *s1, const void *s2, size_t n, size_t destlen); |
| 143 | |
| 144 | #define memmove(a,b,c) __memmove_chk(a,b,c,(size_t)-1) |
| 145 | |
Jordy Rose | a6b808c | 2010-07-07 07:48:06 +0000 | [diff] [blame] | 146 | #else /* VARIANT */ |
Jordy Rose | ccbf7ee | 2010-07-06 23:11:01 +0000 | [diff] [blame] | 147 | |
| 148 | #define memmove BUILTIN(memmove) |
| 149 | void *memmove(void *s1, const void *s2, size_t n); |
| 150 | |
Jordy Rose | a6b808c | 2010-07-07 07:48:06 +0000 | [diff] [blame] | 151 | #endif /* VARIANT */ |
Jordy Rose | ccbf7ee | 2010-07-06 23:11:01 +0000 | [diff] [blame] | 152 | |
| 153 | |
| 154 | void memmove0 () { |
| 155 | char src[] = {1, 2, 3, 4}; |
Jordy Rose | e64f311 | 2010-08-16 07:51:42 +0000 | [diff] [blame^] | 156 | char dst[4] = {0}; |
Jordy Rose | ccbf7ee | 2010-07-06 23:11:01 +0000 | [diff] [blame] | 157 | |
| 158 | memmove(dst, src, 4); // no-warning |
| 159 | |
| 160 | if (memmove(dst, src, 4) != dst) { |
Tom Care | 7bce3a1 | 2010-07-27 23:30:21 +0000 | [diff] [blame] | 161 | (void)*(char*)0; // no-warning |
Jordy Rose | ccbf7ee | 2010-07-06 23:11:01 +0000 | [diff] [blame] | 162 | } |
Jordy Rose | e64f311 | 2010-08-16 07:51:42 +0000 | [diff] [blame^] | 163 | |
| 164 | if (dst[0] != 0) |
| 165 | (void)*(char*)0; // expected-warning{{null}} |
Jordy Rose | ccbf7ee | 2010-07-06 23:11:01 +0000 | [diff] [blame] | 166 | } |
| 167 | |
| 168 | void memmove1 () { |
| 169 | char src[] = {1, 2, 3, 4}; |
| 170 | char dst[10]; |
| 171 | |
| 172 | memmove(dst, src, 5); // expected-warning{{out-of-bound}} |
| 173 | } |
| 174 | |
| 175 | void memmove2 () { |
| 176 | char src[] = {1, 2, 3, 4}; |
| 177 | char dst[1]; |
| 178 | |
Jordy Rose | e64f311 | 2010-08-16 07:51:42 +0000 | [diff] [blame^] | 179 | memmove(dst, src, 4); // expected-warning{{overflow}} |
Jordy Rose | ccbf7ee | 2010-07-06 23:11:01 +0000 | [diff] [blame] | 180 | } |
| 181 | |
| 182 | //===----------------------------------------------------------------------=== |
Jordy Rose | bc56d1f | 2010-07-07 08:15:01 +0000 | [diff] [blame] | 183 | // memcmp() |
| 184 | //===----------------------------------------------------------------------=== |
| 185 | |
| 186 | #ifdef VARIANT |
| 187 | |
| 188 | #define bcmp BUILTIN(bcmp) |
| 189 | // __builtin_bcmp is not defined with const in Builtins.def. |
| 190 | int bcmp(/*const*/ void *s1, /*const*/ void *s2, size_t n); |
| 191 | #define memcmp bcmp |
| 192 | |
| 193 | #else /* VARIANT */ |
| 194 | |
| 195 | #define memcmp BUILTIN(memcmp) |
| 196 | int memcmp(const void *s1, const void *s2, size_t n); |
| 197 | |
| 198 | #endif /* VARIANT */ |
| 199 | |
| 200 | |
| 201 | void memcmp0 () { |
| 202 | char a[] = {1, 2, 3, 4}; |
| 203 | char b[4] = { 0 }; |
| 204 | |
| 205 | memcmp(a, b, 4); // no-warning |
| 206 | } |
| 207 | |
| 208 | void memcmp1 () { |
| 209 | char a[] = {1, 2, 3, 4}; |
| 210 | char b[10] = { 0 }; |
| 211 | |
| 212 | memcmp(a, b, 5); // expected-warning{{out-of-bound}} |
| 213 | } |
| 214 | |
| 215 | void memcmp2 () { |
| 216 | char a[] = {1, 2, 3, 4}; |
| 217 | char b[1] = { 0 }; |
| 218 | |
| 219 | memcmp(a, b, 4); // expected-warning{{out-of-bound}} |
| 220 | } |
| 221 | |
| 222 | void memcmp3 () { |
| 223 | char a[] = {1, 2, 3, 4}; |
| 224 | |
| 225 | if (memcmp(a, a, 4)) |
Tom Care | 7bce3a1 | 2010-07-27 23:30:21 +0000 | [diff] [blame] | 226 | (void)*(char*)0; // no-warning |
Jordy Rose | bc56d1f | 2010-07-07 08:15:01 +0000 | [diff] [blame] | 227 | } |
| 228 | |
| 229 | void memcmp4 (char *input) { |
| 230 | char a[] = {1, 2, 3, 4}; |
| 231 | |
| 232 | if (memcmp(a, input, 4)) |
| 233 | (void)*(char*)0; // expected-warning{{null}} |
| 234 | } |
| 235 | |
| 236 | void memcmp5 (char *input) { |
| 237 | char a[] = {1, 2, 3, 4}; |
| 238 | |
| 239 | if (memcmp(a, 0, 0)) // no-warning |
Tom Care | 7bce3a1 | 2010-07-27 23:30:21 +0000 | [diff] [blame] | 240 | (void)*(char*)0; // no-warning |
Jordy Rose | bc56d1f | 2010-07-07 08:15:01 +0000 | [diff] [blame] | 241 | if (memcmp(0, a, 0)) // no-warning |
Tom Care | 7bce3a1 | 2010-07-27 23:30:21 +0000 | [diff] [blame] | 242 | (void)*(char*)0; // no-warning |
Jordy Rose | bc56d1f | 2010-07-07 08:15:01 +0000 | [diff] [blame] | 243 | if (memcmp(a, input, 0)) // no-warning |
Tom Care | 7bce3a1 | 2010-07-27 23:30:21 +0000 | [diff] [blame] | 244 | (void)*(char*)0; // no-warning |
Jordy Rose | bc56d1f | 2010-07-07 08:15:01 +0000 | [diff] [blame] | 245 | } |
| 246 | |
Jordy Rose | d325ffb | 2010-07-08 23:57:29 +0000 | [diff] [blame] | 247 | void memcmp6 (char *a, char *b, size_t n) { |
| 248 | int result = memcmp(a, b, n); |
| 249 | if (result != 0) |
| 250 | return; |
| 251 | if (n == 0) |
| 252 | (void)*(char*)0; // expected-warning{{null}} |
| 253 | } |
| 254 | |
Jordy Rose | b6a4026 | 2010-08-05 23:11:30 +0000 | [diff] [blame] | 255 | int memcmp7 (char *a, size_t x, size_t y, size_t n) { |
| 256 | // We used to crash when either of the arguments was unknown. |
| 257 | return memcmp(a, &a[x*y], n) + |
| 258 | memcmp(&a[x*y], a, n); |
| 259 | } |
| 260 | |
Jordy Rose | bc56d1f | 2010-07-07 08:15:01 +0000 | [diff] [blame] | 261 | //===----------------------------------------------------------------------=== |
Jordy Rose | ccbf7ee | 2010-07-06 23:11:01 +0000 | [diff] [blame] | 262 | // bcopy() |
| 263 | //===----------------------------------------------------------------------=== |
| 264 | |
| 265 | #define bcopy BUILTIN(bcopy) |
| 266 | // __builtin_bcopy is not defined with const in Builtins.def. |
| 267 | void bcopy(/*const*/ void *s1, void *s2, size_t n); |
| 268 | |
| 269 | |
| 270 | void bcopy0 () { |
| 271 | char src[] = {1, 2, 3, 4}; |
Jordy Rose | e64f311 | 2010-08-16 07:51:42 +0000 | [diff] [blame^] | 272 | char dst[4] = {0}; |
Jordy Rose | ccbf7ee | 2010-07-06 23:11:01 +0000 | [diff] [blame] | 273 | |
| 274 | bcopy(src, dst, 4); // no-warning |
Jordy Rose | e64f311 | 2010-08-16 07:51:42 +0000 | [diff] [blame^] | 275 | |
| 276 | if (dst[0] != 0) |
| 277 | (void)*(char*)0; // expected-warning{{null}} |
Jordy Rose | ccbf7ee | 2010-07-06 23:11:01 +0000 | [diff] [blame] | 278 | } |
| 279 | |
| 280 | void bcopy1 () { |
| 281 | char src[] = {1, 2, 3, 4}; |
| 282 | char dst[10]; |
| 283 | |
| 284 | bcopy(src, dst, 5); // expected-warning{{out-of-bound}} |
| 285 | } |
| 286 | |
| 287 | void bcopy2 () { |
| 288 | char src[] = {1, 2, 3, 4}; |
| 289 | char dst[1]; |
| 290 | |
Jordy Rose | e64f311 | 2010-08-16 07:51:42 +0000 | [diff] [blame^] | 291 | bcopy(src, dst, 4); // expected-warning{{overflow}} |
Jordy Rose | ccbf7ee | 2010-07-06 23:11:01 +0000 | [diff] [blame] | 292 | } |