Ted Kremenek | 5188507 | 2011-03-24 00:28:47 +0000 | [diff] [blame] | 1 | // RUN: %clang_cc1 -analyze -analyzer-checker=core,cplusplus.experimental.CString -analyzer-store=region -verify %s |
| 2 | // RUN: %clang_cc1 -analyze -DUSE_BUILTINS -analyzer-checker=core,cplusplus.experimental.CString -analyzer-store=region -verify %s |
| 3 | // RUN: %clang_cc1 -analyze -DVARIANT -analyzer-checker=core,cplusplus.experimental.CString -analyzer-store=region -verify %s |
| 4 | // RUN: %clang_cc1 -analyze -DUSE_BUILTINS -DVARIANT -analyzer-checker=core,cplusplus.experimental.CString -analyzer-store=region -verify %s |
Jordy Rose | ccbf7ee | 2010-07-06 23:11:01 +0000 | [diff] [blame] | 5 | |
| 6 | //===----------------------------------------------------------------------=== |
| 7 | // Declarations |
| 8 | //===----------------------------------------------------------------------=== |
| 9 | |
Jordy Rose | a6b808c | 2010-07-07 07:48:06 +0000 | [diff] [blame] | 10 | // Some functions are so similar to each other that they follow the same code |
Jordy Rose | bc56d1f | 2010-07-07 08:15:01 +0000 | [diff] [blame] | 11 | // path, such as memcpy and __memcpy_chk, or memcmp and bcmp. If VARIANT is |
| 12 | // defined, make sure to use the variants instead to make sure they are still |
| 13 | // checked by the analyzer. |
Jordy Rose | ccbf7ee | 2010-07-06 23:11:01 +0000 | [diff] [blame] | 14 | |
| 15 | // Some functions are implemented as builtins. These should be #defined as |
| 16 | // BUILTIN(f), which will prepend "__builtin_" if USE_BUILTINS is defined. |
| 17 | |
Chris Lattner | fc8f0e1 | 2011-04-15 05:22:18 +0000 | [diff] [blame^] | 18 | // Functions that have variants and are also available as builtins should be |
Jordy Rose | a6b808c | 2010-07-07 07:48:06 +0000 | [diff] [blame] | 19 | // declared carefully! See memcpy() for an example. |
Jordy Rose | ccbf7ee | 2010-07-06 23:11:01 +0000 | [diff] [blame] | 20 | |
| 21 | #ifdef USE_BUILTINS |
| 22 | # define BUILTIN(f) __builtin_ ## f |
| 23 | #else /* USE_BUILTINS */ |
| 24 | # define BUILTIN(f) f |
| 25 | #endif /* USE_BUILTINS */ |
| 26 | |
| 27 | typedef typeof(sizeof(int)) size_t; |
| 28 | |
| 29 | //===----------------------------------------------------------------------=== |
| 30 | // memcpy() |
| 31 | //===----------------------------------------------------------------------=== |
| 32 | |
Jordy Rose | a6b808c | 2010-07-07 07:48:06 +0000 | [diff] [blame] | 33 | #ifdef VARIANT |
Jordy Rose | ccbf7ee | 2010-07-06 23:11:01 +0000 | [diff] [blame] | 34 | |
| 35 | #define __memcpy_chk BUILTIN(__memcpy_chk) |
| 36 | void *__memcpy_chk(void *restrict s1, const void *restrict s2, size_t n, |
| 37 | size_t destlen); |
| 38 | |
| 39 | #define memcpy(a,b,c) __memcpy_chk(a,b,c,(size_t)-1) |
| 40 | |
Jordy Rose | a6b808c | 2010-07-07 07:48:06 +0000 | [diff] [blame] | 41 | #else /* VARIANT */ |
Jordy Rose | ccbf7ee | 2010-07-06 23:11:01 +0000 | [diff] [blame] | 42 | |
| 43 | #define memcpy BUILTIN(memcpy) |
| 44 | void *memcpy(void *restrict s1, const void *restrict s2, size_t n); |
| 45 | |
Jordy Rose | a6b808c | 2010-07-07 07:48:06 +0000 | [diff] [blame] | 46 | #endif /* VARIANT */ |
Jordy Rose | ccbf7ee | 2010-07-06 23:11:01 +0000 | [diff] [blame] | 47 | |
| 48 | |
| 49 | void memcpy0 () { |
| 50 | char src[] = {1, 2, 3, 4}; |
Jordy Rose | e64f311 | 2010-08-16 07:51:42 +0000 | [diff] [blame] | 51 | char dst[4] = {0}; |
Jordy Rose | ccbf7ee | 2010-07-06 23:11:01 +0000 | [diff] [blame] | 52 | |
| 53 | memcpy(dst, src, 4); // no-warning |
| 54 | |
| 55 | if (memcpy(dst, src, 4) != dst) { |
Tom Care | 7bce3a1 | 2010-07-27 23:30:21 +0000 | [diff] [blame] | 56 | (void)*(char*)0; // no-warning |
Jordy Rose | ccbf7ee | 2010-07-06 23:11:01 +0000 | [diff] [blame] | 57 | } |
Jordy Rose | e64f311 | 2010-08-16 07:51:42 +0000 | [diff] [blame] | 58 | |
| 59 | if (dst[0] != 0) |
| 60 | (void)*(char*)0; // expected-warning{{null}} |
Jordy Rose | ccbf7ee | 2010-07-06 23:11:01 +0000 | [diff] [blame] | 61 | } |
| 62 | |
| 63 | void memcpy1 () { |
| 64 | char src[] = {1, 2, 3, 4}; |
| 65 | char dst[10]; |
| 66 | |
Jordy Rose | e64f311 | 2010-08-16 07:51:42 +0000 | [diff] [blame] | 67 | memcpy(dst, src, 5); // expected-warning{{Byte string function accesses out-of-bound array element}} |
Jordy Rose | ccbf7ee | 2010-07-06 23:11:01 +0000 | [diff] [blame] | 68 | } |
| 69 | |
| 70 | void memcpy2 () { |
| 71 | char src[] = {1, 2, 3, 4}; |
| 72 | char dst[1]; |
| 73 | |
Jordy Rose | e64f311 | 2010-08-16 07:51:42 +0000 | [diff] [blame] | 74 | memcpy(dst, src, 4); // expected-warning{{Byte string function overflows destination buffer}} |
Jordy Rose | ccbf7ee | 2010-07-06 23:11:01 +0000 | [diff] [blame] | 75 | } |
| 76 | |
| 77 | void memcpy3 () { |
| 78 | char src[] = {1, 2, 3, 4}; |
| 79 | char dst[3]; |
| 80 | |
| 81 | memcpy(dst+1, src+2, 2); // no-warning |
| 82 | } |
| 83 | |
| 84 | void memcpy4 () { |
| 85 | char src[] = {1, 2, 3, 4}; |
| 86 | char dst[10]; |
| 87 | |
Jordy Rose | e64f311 | 2010-08-16 07:51:42 +0000 | [diff] [blame] | 88 | memcpy(dst+2, src+2, 3); // expected-warning{{Byte string function accesses out-of-bound array element}} |
Jordy Rose | ccbf7ee | 2010-07-06 23:11:01 +0000 | [diff] [blame] | 89 | } |
| 90 | |
| 91 | void memcpy5() { |
| 92 | char src[] = {1, 2, 3, 4}; |
| 93 | char dst[3]; |
| 94 | |
Jordy Rose | e64f311 | 2010-08-16 07:51:42 +0000 | [diff] [blame] | 95 | memcpy(dst+2, src+2, 2); // expected-warning{{Byte string function overflows destination buffer}} |
Jordy Rose | ccbf7ee | 2010-07-06 23:11:01 +0000 | [diff] [blame] | 96 | } |
| 97 | |
| 98 | void memcpy6() { |
| 99 | int a[4] = {0}; |
| 100 | memcpy(a, a, 8); // expected-warning{{overlapping}} |
| 101 | } |
| 102 | |
| 103 | void memcpy7() { |
| 104 | int a[4] = {0}; |
| 105 | memcpy(a+2, a+1, 8); // expected-warning{{overlapping}} |
| 106 | } |
| 107 | |
| 108 | void memcpy8() { |
| 109 | int a[4] = {0}; |
| 110 | memcpy(a+1, a+2, 8); // expected-warning{{overlapping}} |
| 111 | } |
| 112 | |
| 113 | void memcpy9() { |
| 114 | int a[4] = {0}; |
| 115 | memcpy(a+2, a+1, 4); // no-warning |
| 116 | memcpy(a+1, a+2, 4); // no-warning |
| 117 | } |
| 118 | |
Jordy Rose | a6b808c | 2010-07-07 07:48:06 +0000 | [diff] [blame] | 119 | void memcpy10() { |
| 120 | char a[4] = {0}; |
| 121 | memcpy(0, a, 4); // expected-warning{{Null pointer argument in call to byte string function}} |
| 122 | } |
| 123 | |
| 124 | void memcpy11() { |
| 125 | char a[4] = {0}; |
| 126 | memcpy(a, 0, 4); // expected-warning{{Null pointer argument in call to byte string function}} |
| 127 | } |
| 128 | |
| 129 | void memcpy12() { |
| 130 | char a[4] = {0}; |
| 131 | memcpy(0, a, 0); // no-warning |
Lenny Maiorani | b8b875b | 2011-03-31 21:36:53 +0000 | [diff] [blame] | 132 | } |
| 133 | |
| 134 | void memcpy13() { |
| 135 | char a[4] = {0}; |
Jordy Rose | a6b808c | 2010-07-07 07:48:06 +0000 | [diff] [blame] | 136 | memcpy(a, 0, 0); // no-warning |
| 137 | } |
| 138 | |
Jordy Rose | ccbf7ee | 2010-07-06 23:11:01 +0000 | [diff] [blame] | 139 | //===----------------------------------------------------------------------=== |
Lenny Maiorani | b8b875b | 2011-03-31 21:36:53 +0000 | [diff] [blame] | 140 | // mempcpy() |
| 141 | //===----------------------------------------------------------------------=== |
| 142 | |
| 143 | #define mempcpy BUILTIN(mempcpy) |
| 144 | void *mempcpy(void *restrict s1, const void *restrict s2, size_t n); |
| 145 | |
| 146 | void mempcpy0 () { |
| 147 | char src[] = {1, 2, 3, 4}; |
| 148 | char dst[5] = {0}; |
| 149 | |
| 150 | mempcpy(dst, src, 4); // no-warning |
| 151 | |
| 152 | if (mempcpy(dst, src, 4) != &dst[4]) { |
| 153 | (void)*(char*)0; // no-warning |
| 154 | } |
| 155 | |
| 156 | if (dst[0] != 0) |
| 157 | (void)*(char*)0; // expected-warning{{null}} |
| 158 | } |
| 159 | |
| 160 | void mempcpy1 () { |
| 161 | char src[] = {1, 2, 3, 4}; |
| 162 | char dst[10]; |
| 163 | |
| 164 | mempcpy(dst, src, 5); // expected-warning{{Byte string function accesses out-of-bound array element}} |
| 165 | } |
| 166 | |
| 167 | void mempcpy2 () { |
| 168 | char src[] = {1, 2, 3, 4}; |
| 169 | char dst[1]; |
| 170 | |
| 171 | mempcpy(dst, src, 4); // expected-warning{{Byte string function overflows destination buffer}} |
| 172 | } |
| 173 | |
| 174 | void mempcpy3 () { |
| 175 | char src[] = {1, 2, 3, 4}; |
| 176 | char dst[3]; |
| 177 | |
| 178 | mempcpy(dst+1, src+2, 2); // no-warning |
| 179 | } |
| 180 | |
| 181 | void mempcpy4 () { |
| 182 | char src[] = {1, 2, 3, 4}; |
| 183 | char dst[10]; |
| 184 | |
| 185 | mempcpy(dst+2, src+2, 3); // expected-warning{{Byte string function accesses out-of-bound array element}} |
| 186 | } |
| 187 | |
| 188 | void mempcpy5() { |
| 189 | char src[] = {1, 2, 3, 4}; |
| 190 | char dst[3]; |
| 191 | |
| 192 | mempcpy(dst+2, src+2, 2); // expected-warning{{Byte string function overflows destination buffer}} |
| 193 | } |
| 194 | |
| 195 | void mempcpy6() { |
| 196 | int a[4] = {0}; |
| 197 | mempcpy(a, a, 8); // expected-warning{{overlapping}} |
| 198 | } |
| 199 | |
| 200 | void mempcpy7() { |
| 201 | int a[4] = {0}; |
| 202 | mempcpy(a+2, a+1, 8); // expected-warning{{overlapping}} |
| 203 | } |
| 204 | |
| 205 | void mempcpy8() { |
| 206 | int a[4] = {0}; |
| 207 | mempcpy(a+1, a+2, 8); // expected-warning{{overlapping}} |
| 208 | } |
| 209 | |
| 210 | void mempcpy9() { |
| 211 | int a[4] = {0}; |
| 212 | mempcpy(a+2, a+1, 4); // no-warning |
| 213 | mempcpy(a+1, a+2, 4); // no-warning |
| 214 | } |
| 215 | |
| 216 | void mempcpy10() { |
| 217 | char a[4] = {0}; |
| 218 | mempcpy(0, a, 4); // expected-warning{{Null pointer argument in call to byte string function}} |
| 219 | } |
| 220 | |
| 221 | void mempcpy11() { |
| 222 | char a[4] = {0}; |
| 223 | mempcpy(a, 0, 4); // expected-warning{{Null pointer argument in call to byte string function}} |
| 224 | } |
| 225 | |
| 226 | void mempcpy12() { |
| 227 | char a[4] = {0}; |
| 228 | mempcpy(0, a, 0); // no-warning |
| 229 | } |
| 230 | |
| 231 | void mempcpy13() { |
| 232 | char a[4] = {0}; |
| 233 | mempcpy(a, 0, 0); // no-warning |
| 234 | } |
| 235 | |
| 236 | //===----------------------------------------------------------------------=== |
Jordy Rose | ccbf7ee | 2010-07-06 23:11:01 +0000 | [diff] [blame] | 237 | // memmove() |
| 238 | //===----------------------------------------------------------------------=== |
| 239 | |
Jordy Rose | a6b808c | 2010-07-07 07:48:06 +0000 | [diff] [blame] | 240 | #ifdef VARIANT |
Jordy Rose | ccbf7ee | 2010-07-06 23:11:01 +0000 | [diff] [blame] | 241 | |
| 242 | #define __memmove_chk BUILTIN(__memmove_chk) |
| 243 | void *__memmove_chk(void *s1, const void *s2, size_t n, size_t destlen); |
| 244 | |
| 245 | #define memmove(a,b,c) __memmove_chk(a,b,c,(size_t)-1) |
| 246 | |
Jordy Rose | a6b808c | 2010-07-07 07:48:06 +0000 | [diff] [blame] | 247 | #else /* VARIANT */ |
Jordy Rose | ccbf7ee | 2010-07-06 23:11:01 +0000 | [diff] [blame] | 248 | |
| 249 | #define memmove BUILTIN(memmove) |
| 250 | void *memmove(void *s1, const void *s2, size_t n); |
| 251 | |
Jordy Rose | a6b808c | 2010-07-07 07:48:06 +0000 | [diff] [blame] | 252 | #endif /* VARIANT */ |
Jordy Rose | ccbf7ee | 2010-07-06 23:11:01 +0000 | [diff] [blame] | 253 | |
| 254 | |
| 255 | void memmove0 () { |
| 256 | char src[] = {1, 2, 3, 4}; |
Jordy Rose | e64f311 | 2010-08-16 07:51:42 +0000 | [diff] [blame] | 257 | char dst[4] = {0}; |
Jordy Rose | ccbf7ee | 2010-07-06 23:11:01 +0000 | [diff] [blame] | 258 | |
| 259 | memmove(dst, src, 4); // no-warning |
| 260 | |
| 261 | if (memmove(dst, src, 4) != dst) { |
Tom Care | 7bce3a1 | 2010-07-27 23:30:21 +0000 | [diff] [blame] | 262 | (void)*(char*)0; // no-warning |
Jordy Rose | ccbf7ee | 2010-07-06 23:11:01 +0000 | [diff] [blame] | 263 | } |
Jordy Rose | e64f311 | 2010-08-16 07:51:42 +0000 | [diff] [blame] | 264 | |
| 265 | if (dst[0] != 0) |
| 266 | (void)*(char*)0; // expected-warning{{null}} |
Jordy Rose | ccbf7ee | 2010-07-06 23:11:01 +0000 | [diff] [blame] | 267 | } |
| 268 | |
| 269 | void memmove1 () { |
| 270 | char src[] = {1, 2, 3, 4}; |
| 271 | char dst[10]; |
| 272 | |
| 273 | memmove(dst, src, 5); // expected-warning{{out-of-bound}} |
| 274 | } |
| 275 | |
| 276 | void memmove2 () { |
| 277 | char src[] = {1, 2, 3, 4}; |
| 278 | char dst[1]; |
| 279 | |
Jordy Rose | e64f311 | 2010-08-16 07:51:42 +0000 | [diff] [blame] | 280 | memmove(dst, src, 4); // expected-warning{{overflow}} |
Jordy Rose | ccbf7ee | 2010-07-06 23:11:01 +0000 | [diff] [blame] | 281 | } |
| 282 | |
| 283 | //===----------------------------------------------------------------------=== |
Jordy Rose | bc56d1f | 2010-07-07 08:15:01 +0000 | [diff] [blame] | 284 | // memcmp() |
| 285 | //===----------------------------------------------------------------------=== |
| 286 | |
| 287 | #ifdef VARIANT |
| 288 | |
| 289 | #define bcmp BUILTIN(bcmp) |
| 290 | // __builtin_bcmp is not defined with const in Builtins.def. |
| 291 | int bcmp(/*const*/ void *s1, /*const*/ void *s2, size_t n); |
| 292 | #define memcmp bcmp |
| 293 | |
| 294 | #else /* VARIANT */ |
| 295 | |
| 296 | #define memcmp BUILTIN(memcmp) |
| 297 | int memcmp(const void *s1, const void *s2, size_t n); |
| 298 | |
| 299 | #endif /* VARIANT */ |
| 300 | |
| 301 | |
| 302 | void memcmp0 () { |
| 303 | char a[] = {1, 2, 3, 4}; |
| 304 | char b[4] = { 0 }; |
| 305 | |
| 306 | memcmp(a, b, 4); // no-warning |
| 307 | } |
| 308 | |
| 309 | void memcmp1 () { |
| 310 | char a[] = {1, 2, 3, 4}; |
| 311 | char b[10] = { 0 }; |
| 312 | |
| 313 | memcmp(a, b, 5); // expected-warning{{out-of-bound}} |
| 314 | } |
| 315 | |
| 316 | void memcmp2 () { |
| 317 | char a[] = {1, 2, 3, 4}; |
| 318 | char b[1] = { 0 }; |
| 319 | |
| 320 | memcmp(a, b, 4); // expected-warning{{out-of-bound}} |
| 321 | } |
| 322 | |
| 323 | void memcmp3 () { |
| 324 | char a[] = {1, 2, 3, 4}; |
| 325 | |
| 326 | if (memcmp(a, a, 4)) |
Tom Care | 7bce3a1 | 2010-07-27 23:30:21 +0000 | [diff] [blame] | 327 | (void)*(char*)0; // no-warning |
Jordy Rose | bc56d1f | 2010-07-07 08:15:01 +0000 | [diff] [blame] | 328 | } |
| 329 | |
| 330 | void memcmp4 (char *input) { |
| 331 | char a[] = {1, 2, 3, 4}; |
| 332 | |
| 333 | if (memcmp(a, input, 4)) |
| 334 | (void)*(char*)0; // expected-warning{{null}} |
| 335 | } |
| 336 | |
| 337 | void memcmp5 (char *input) { |
| 338 | char a[] = {1, 2, 3, 4}; |
| 339 | |
| 340 | if (memcmp(a, 0, 0)) // no-warning |
Tom Care | 7bce3a1 | 2010-07-27 23:30:21 +0000 | [diff] [blame] | 341 | (void)*(char*)0; // no-warning |
Jordy Rose | bc56d1f | 2010-07-07 08:15:01 +0000 | [diff] [blame] | 342 | if (memcmp(0, a, 0)) // no-warning |
Tom Care | 7bce3a1 | 2010-07-27 23:30:21 +0000 | [diff] [blame] | 343 | (void)*(char*)0; // no-warning |
Jordy Rose | bc56d1f | 2010-07-07 08:15:01 +0000 | [diff] [blame] | 344 | if (memcmp(a, input, 0)) // no-warning |
Tom Care | 7bce3a1 | 2010-07-27 23:30:21 +0000 | [diff] [blame] | 345 | (void)*(char*)0; // no-warning |
Jordy Rose | bc56d1f | 2010-07-07 08:15:01 +0000 | [diff] [blame] | 346 | } |
| 347 | |
Jordy Rose | d325ffb | 2010-07-08 23:57:29 +0000 | [diff] [blame] | 348 | void memcmp6 (char *a, char *b, size_t n) { |
| 349 | int result = memcmp(a, b, n); |
| 350 | if (result != 0) |
| 351 | return; |
| 352 | if (n == 0) |
| 353 | (void)*(char*)0; // expected-warning{{null}} |
| 354 | } |
| 355 | |
Jordy Rose | b6a4026 | 2010-08-05 23:11:30 +0000 | [diff] [blame] | 356 | int memcmp7 (char *a, size_t x, size_t y, size_t n) { |
| 357 | // We used to crash when either of the arguments was unknown. |
| 358 | return memcmp(a, &a[x*y], n) + |
| 359 | memcmp(&a[x*y], a, n); |
| 360 | } |
| 361 | |
Jordy Rose | bc56d1f | 2010-07-07 08:15:01 +0000 | [diff] [blame] | 362 | //===----------------------------------------------------------------------=== |
Jordy Rose | ccbf7ee | 2010-07-06 23:11:01 +0000 | [diff] [blame] | 363 | // bcopy() |
| 364 | //===----------------------------------------------------------------------=== |
| 365 | |
| 366 | #define bcopy BUILTIN(bcopy) |
| 367 | // __builtin_bcopy is not defined with const in Builtins.def. |
| 368 | void bcopy(/*const*/ void *s1, void *s2, size_t n); |
| 369 | |
| 370 | |
| 371 | void bcopy0 () { |
| 372 | char src[] = {1, 2, 3, 4}; |
Jordy Rose | e64f311 | 2010-08-16 07:51:42 +0000 | [diff] [blame] | 373 | char dst[4] = {0}; |
Jordy Rose | ccbf7ee | 2010-07-06 23:11:01 +0000 | [diff] [blame] | 374 | |
| 375 | bcopy(src, dst, 4); // no-warning |
Jordy Rose | e64f311 | 2010-08-16 07:51:42 +0000 | [diff] [blame] | 376 | |
| 377 | if (dst[0] != 0) |
| 378 | (void)*(char*)0; // expected-warning{{null}} |
Jordy Rose | ccbf7ee | 2010-07-06 23:11:01 +0000 | [diff] [blame] | 379 | } |
| 380 | |
| 381 | void bcopy1 () { |
| 382 | char src[] = {1, 2, 3, 4}; |
| 383 | char dst[10]; |
| 384 | |
| 385 | bcopy(src, dst, 5); // expected-warning{{out-of-bound}} |
| 386 | } |
| 387 | |
| 388 | void bcopy2 () { |
| 389 | char src[] = {1, 2, 3, 4}; |
| 390 | char dst[1]; |
| 391 | |
Jordy Rose | e64f311 | 2010-08-16 07:51:42 +0000 | [diff] [blame] | 392 | bcopy(src, dst, 4); // expected-warning{{overflow}} |
Jordy Rose | ccbf7ee | 2010-07-06 23:11:01 +0000 | [diff] [blame] | 393 | } |