1 // RUN: %clang_analyze_cc1 -analyzer-checker=alpha.core.FixedAddr,alpha.core.PointerArithm,alpha.core.PointerSub,debug.ExprInspection -Wno-pointer-to-int-cast -verify -triple x86_64-apple-darwin9 -Wno-tautological-pointer-compare -analyzer-config eagerly-assume=false %s
2 // RUN: %clang_analyze_cc1 -analyzer-checker=alpha.core.FixedAddr,alpha.core.PointerArithm,alpha.core.PointerSub,debug.ExprInspection -Wno-pointer-to-int-cast -verify -triple i686-apple-darwin9 -Wno-tautological-pointer-compare -analyzer-config eagerly-assume=false %s
3 
4 void clang_analyzer_eval(int);
5 void clang_analyzer_dump(int);
6 
f1(void)7 void f1(void) {
8   int a[10];
9   int *p = a;
10   ++p;
11 }
12 
13 char* foo(void);
14 
f2(void)15 void f2(void) {
16   char *p = foo();
17   ++p;
18 }
19 
20 // This test case checks if we get the right rvalue type of a TypedViewRegion.
21 // The ElementRegion's type depends on the array region's rvalue type. If it was
22 // a pointer type, we would get a loc::SymbolVal for '*p'.
23 void* memchr(const void *, int, __typeof__(sizeof(0)));
24 static int
domain_port(const char * domain_b,const char * domain_e,const char ** domain_e_ptr)25 domain_port (const char *domain_b, const char *domain_e,
26              const char **domain_e_ptr)
27 {
28   int port = 0;
29 
30   const char *p;
31   const char *colon = memchr (domain_b, ':', domain_e - domain_b);
32 
33   for (p = colon + 1; p < domain_e ; p++)
34     port = 10 * port + (*p - '0');
35   return port;
36 }
37 
f3(void)38 void f3(void) {
39   int x, y;
40   int d = &y - &x; // expected-warning{{Subtraction of two pointers that do not point to the same memory chunk may cause incorrect result}}
41 
42   int a[10];
43   int *p = &a[2];
44   int *q = &a[8];
45   d = q-p; // no-warning
46 }
47 
f4(void)48 void f4(void) {
49   int *p;
50   p = (int*) 0x10000; // expected-warning{{Using a fixed address is not portable because that address will probably not be valid in all environments or platforms}}
51 }
52 
f5(void)53 void f5(void) {
54   int x, y;
55   int *p;
56   p = &x + 1;  // expected-warning{{Pointer arithmetic on non-array variables relies on memory layout, which is dangerous}}
57 
58   int a[10];
59   p = a + 1; // no-warning
60 }
61 
62 // Allow arithmetic on different symbolic regions.
f6(int * p,int * q)63 void f6(int *p, int *q) {
64   int d = q - p; // no-warning
65 }
66 
null_operand(int * a)67 void null_operand(int *a) {
68 start:
69   // LHS is a label, RHS is NULL
70   clang_analyzer_eval(&&start != 0); // expected-warning{{TRUE}}
71   clang_analyzer_eval(&&start >= 0); // expected-warning{{TRUE}}
72   clang_analyzer_eval(&&start > 0); // expected-warning{{TRUE}}
73   clang_analyzer_eval((&&start - 0) != 0); // expected-warning{{TRUE}}
74 
75   // LHS is a non-symbolic value, RHS is NULL
76   clang_analyzer_eval(&a != 0); // expected-warning{{TRUE}}
77   clang_analyzer_eval(&a >= 0); // expected-warning{{TRUE}}
78   clang_analyzer_eval(&a > 0); // expected-warning{{TRUE}}
79   clang_analyzer_eval((&a - 0) != 0); // expected-warning{{TRUE}}
80 
81   // LHS is NULL, RHS is non-symbolic
82   // The same code is used for labels and non-symbolic values.
83   clang_analyzer_eval(0 != &a); // expected-warning{{TRUE}}
84   clang_analyzer_eval(0 <= &a); // expected-warning{{TRUE}}
85   clang_analyzer_eval(0 < &a); // expected-warning{{TRUE}}
86 
87   // LHS is a symbolic value, RHS is NULL
88   clang_analyzer_eval(a != 0); // expected-warning{{UNKNOWN}}
89   clang_analyzer_eval(a >= 0); // expected-warning{{TRUE}}
90   clang_analyzer_eval(a <= 0); // expected-warning{{UNKNOWN}}
91   clang_analyzer_eval((a - 0) != 0); // expected-warning{{UNKNOWN}}
92 
93   // LHS is NULL, RHS is a symbolic value
94   clang_analyzer_eval(0 != a); // expected-warning{{UNKNOWN}}
95   clang_analyzer_eval(0 <= a); // expected-warning{{TRUE}}
96   clang_analyzer_eval(0 < a); // expected-warning{{UNKNOWN}}
97 }
98 
const_locs(void)99 void const_locs(void) {
100   char *a = (char*)0x1000;
101   char *b = (char*)0x1100;
102 start:
103   clang_analyzer_eval(a != b); // expected-warning{{TRUE}}
104   clang_analyzer_eval(a < b); // expected-warning{{TRUE}}
105   clang_analyzer_eval(a <= b); // expected-warning{{TRUE}}
106   clang_analyzer_eval((b-a) == 0x100); // expected-warning{{TRUE}}
107 
108   clang_analyzer_eval(&&start == a); // expected-warning{{UNKNOWN}}
109   clang_analyzer_eval(a == &&start); // expected-warning{{UNKNOWN}}
110   clang_analyzer_eval(&a == (char**)a); // expected-warning{{UNKNOWN}}
111   clang_analyzer_eval((char**)a == &a); // expected-warning{{UNKNOWN}}
112 }
113 
array_matching_types(void)114 void array_matching_types(void) {
115   int array[10];
116   int *a = &array[2];
117   int *b = &array[5];
118 
119   clang_analyzer_eval(a != b); // expected-warning{{TRUE}}
120   clang_analyzer_eval(a < b); // expected-warning{{TRUE}}
121   clang_analyzer_eval(a <= b); // expected-warning{{TRUE}}
122   clang_analyzer_eval((b-a) != 0); // expected-warning{{TRUE}}
123 }
124 
125 // This takes a different code path than array_matching_types()
array_different_types(void)126 void array_different_types(void) {
127   int array[10];
128   int *a = &array[2];
129   char *b = (char*)&array[5];
130 
131   clang_analyzer_eval(a != b); // expected-warning{{TRUE}} expected-warning{{comparison of distinct pointer types}}
132   clang_analyzer_eval(a < b); // expected-warning{{TRUE}} expected-warning{{comparison of distinct pointer types}}
133   clang_analyzer_eval(a <= b); // expected-warning{{TRUE}} expected-warning{{comparison of distinct pointer types}}
134 }
135 
136 struct test { int x; int y; };
struct_fields(void)137 void struct_fields(void) {
138   struct test a, b;
139 
140   clang_analyzer_eval(&a.x != &a.y); // expected-warning{{TRUE}}
141   clang_analyzer_eval(&a.x < &a.y); // expected-warning{{TRUE}}
142   clang_analyzer_eval(&a.x <= &a.y); // expected-warning{{TRUE}}
143 
144   clang_analyzer_eval(&a.x != &b.x); // expected-warning{{TRUE}}
145   clang_analyzer_eval(&a.x > &b.x); // expected-warning{{UNKNOWN}}
146   clang_analyzer_eval(&a.x >= &b.x); // expected-warning{{UNKNOWN}}
147 }
148 
mixed_region_types(void)149 void mixed_region_types(void) {
150   struct test s;
151   int array[2];
152   void *a = &array, *b = &s;
153 
154   clang_analyzer_eval(&a != &b); // expected-warning{{TRUE}}
155   clang_analyzer_eval(&a > &b); // expected-warning{{UNKNOWN}}
156   clang_analyzer_eval(&a >= &b); // expected-warning{{UNKNOWN}}
157 }
158 
symbolic_region(int * p)159 void symbolic_region(int *p) {
160   int a;
161 
162   clang_analyzer_eval(&a != p); // expected-warning{{TRUE}}
163   clang_analyzer_eval(&a > p); // expected-warning{{UNKNOWN}}
164   clang_analyzer_eval(&a >= p); // expected-warning{{UNKNOWN}}
165 }
166 
PR7527(int * p)167 void PR7527 (int *p) {
168   if (((int) p) & 1) // not crash
169     return;
170 }
171 
use_symbols(int * lhs,int * rhs)172 void use_symbols(int *lhs, int *rhs) {
173   clang_analyzer_eval(lhs < rhs); // expected-warning{{UNKNOWN}}
174   if (lhs < rhs)
175     return;
176   clang_analyzer_eval(lhs < rhs); // expected-warning{{FALSE}}
177 
178   clang_analyzer_eval(lhs - rhs); // expected-warning{{UNKNOWN}}
179   if ((lhs - rhs) != 5)
180     return;
181   clang_analyzer_eval((lhs - rhs) == 5); // expected-warning{{TRUE}}
182 }
183 
equal_implies_zero(int * lhs,int * rhs)184 void equal_implies_zero(int *lhs, int *rhs) {
185   clang_analyzer_eval(lhs == rhs); // expected-warning{{UNKNOWN}}
186   if (lhs == rhs) {
187     clang_analyzer_eval(lhs != rhs); // expected-warning{{FALSE}}
188     clang_analyzer_eval((rhs - lhs) == 0); // expected-warning{{TRUE}}
189     return;
190   }
191   clang_analyzer_eval(lhs == rhs); // expected-warning{{FALSE}}
192   clang_analyzer_eval(lhs != rhs); // expected-warning{{TRUE}}
193   clang_analyzer_eval((rhs - lhs) == 0); // expected-warning{{FALSE}}
194 }
195 
zero_implies_equal(int * lhs,int * rhs)196 void zero_implies_equal(int *lhs, int *rhs) {
197   clang_analyzer_eval((rhs - lhs) == 0); // expected-warning{{UNKNOWN}}
198   if ((rhs - lhs) == 0) {
199     clang_analyzer_eval(lhs != rhs); // expected-warning{{FALSE}}
200     clang_analyzer_eval(lhs == rhs); // expected-warning{{TRUE}}
201     return;
202   }
203   clang_analyzer_eval((rhs - lhs) == 0); // expected-warning{{FALSE}}
204   clang_analyzer_eval(lhs == rhs); // expected-warning{{FALSE}}
205   clang_analyzer_eval(lhs != rhs); // expected-warning{{TRUE}}
206 }
207 
comparisons_imply_size(int * lhs,int * rhs)208 void comparisons_imply_size(int *lhs, int *rhs) {
209   clang_analyzer_eval(lhs <= rhs); // expected-warning{{UNKNOWN}}
210 
211   if (lhs > rhs) {
212     clang_analyzer_eval((rhs - lhs) == 0); // expected-warning{{FALSE}}
213     return;
214   }
215 
216   clang_analyzer_eval(lhs <= rhs); // expected-warning{{TRUE}}
217 // FIXME: In Z3ConstraintManager, ptrdiff_t is mapped to signed bitvector. However, this does not directly imply the unsigned comparison.
218 #ifdef ANALYZER_CM_Z3
219   clang_analyzer_eval((rhs - lhs) >= 0); // expected-warning{{UNKNOWN}}
220 #else
221   clang_analyzer_eval((rhs - lhs) >= 0); // expected-warning{{TRUE}}
222 #endif
223   clang_analyzer_eval((rhs - lhs) > 0); // expected-warning{{UNKNOWN}}
224 
225   if (lhs >= rhs) {
226     clang_analyzer_eval((rhs - lhs) == 0); // expected-warning{{TRUE}}
227     return;
228   }
229 
230   clang_analyzer_eval(lhs == rhs); // expected-warning{{FALSE}}
231   clang_analyzer_eval(lhs < rhs); // expected-warning{{TRUE}}
232 #ifdef ANALYZER_CM_Z3
233   clang_analyzer_eval((rhs - lhs) > 0); // expected-warning{{UNKNOWN}}
234 #else
235   clang_analyzer_eval((rhs - lhs) > 0); // expected-warning{{TRUE}}
236 #endif
237 }
238 
size_implies_comparison(int * lhs,int * rhs)239 void size_implies_comparison(int *lhs, int *rhs) {
240   clang_analyzer_eval(lhs <= rhs); // expected-warning{{UNKNOWN}}
241 
242   if ((rhs - lhs) < 0) {
243     clang_analyzer_eval(lhs == rhs); // expected-warning{{FALSE}}
244     return;
245   }
246 
247 #ifdef ANALYZER_CM_Z3
248   clang_analyzer_eval(lhs <= rhs); // expected-warning{{UNKNOWN}}
249 #else
250   clang_analyzer_eval(lhs <= rhs); // expected-warning{{TRUE}}
251 #endif
252   clang_analyzer_eval((rhs - lhs) >= 0); // expected-warning{{TRUE}}
253   clang_analyzer_eval((rhs - lhs) > 0); // expected-warning{{UNKNOWN}}
254 
255   if ((rhs - lhs) <= 0) {
256     clang_analyzer_eval(lhs == rhs); // expected-warning{{TRUE}}
257     return;
258   }
259 
260   clang_analyzer_eval(lhs == rhs); // expected-warning{{FALSE}}
261 #ifdef ANALYZER_CM_Z3
262   clang_analyzer_eval(lhs < rhs); // expected-warning{{UNKNOWN}}
263 #else
264   clang_analyzer_eval(lhs < rhs); // expected-warning{{TRUE}}
265 #endif
266   clang_analyzer_eval((rhs - lhs) > 0); // expected-warning{{TRUE}}
267 }
268 
zero_implies_reversed_equal(int * lhs,int * rhs)269 void zero_implies_reversed_equal(int *lhs, int *rhs) {
270   clang_analyzer_eval((rhs - lhs) == 0); // expected-warning{{UNKNOWN}}
271   if ((rhs - lhs) == 0) {
272     clang_analyzer_eval(rhs != lhs); // expected-warning{{FALSE}}
273     clang_analyzer_eval(rhs == lhs); // expected-warning{{TRUE}}
274     return;
275   }
276   clang_analyzer_eval((rhs - lhs) == 0); // expected-warning{{FALSE}}
277   clang_analyzer_eval(rhs == lhs); // expected-warning{{FALSE}}
278   clang_analyzer_eval(rhs != lhs); // expected-warning{{TRUE}}
279 }
280 
canonical_equal(int * lhs,int * rhs)281 void canonical_equal(int *lhs, int *rhs) {
282   clang_analyzer_eval(lhs == rhs); // expected-warning{{UNKNOWN}}
283   if (lhs == rhs) {
284     clang_analyzer_eval(rhs == lhs); // expected-warning{{TRUE}}
285     return;
286   }
287   clang_analyzer_eval(lhs == rhs); // expected-warning{{FALSE}}
288   clang_analyzer_eval(rhs == lhs); // expected-warning{{FALSE}}
289 }
290 
compare_element_region_and_base(int * p)291 void compare_element_region_and_base(int *p) {
292   int *q = p - 1;
293   clang_analyzer_eval(p == q); // expected-warning{{FALSE}}
294 }
295 
296 struct Point {
297   int x;
298   int y;
299 };
symbolicFieldRegion(struct Point * points,int i,int j)300 void symbolicFieldRegion(struct Point *points, int i, int j) {
301   clang_analyzer_eval(&points[i].x == &points[j].x);// expected-warning{{UNKNOWN}}
302   clang_analyzer_eval(&points[i].x == &points[i].y);// expected-warning{{FALSE}}
303   clang_analyzer_eval(&points[i].x < &points[i].y);// expected-warning{{TRUE}}
304 }
305 
negativeIndex(char * str)306 void negativeIndex(char *str) {
307   *(str + 1) = 'a';
308   clang_analyzer_eval(*(str + 1) == 'a'); // expected-warning{{TRUE}}
309   clang_analyzer_eval(*(str - 1) == 'a'); // expected-warning{{UNKNOWN}}
310 
311   char *ptr1 = str - 1;
312   clang_analyzer_eval(*ptr1 == 'a'); // expected-warning{{UNKNOWN}}
313 
314   char *ptr2 = str;
315   ptr2 -= 1;
316   clang_analyzer_eval(*ptr2 == 'a'); // expected-warning{{UNKNOWN}}
317 
318   char *ptr3 = str;
319   --ptr3;
320   clang_analyzer_eval(*ptr3 == 'a'); // expected-warning{{UNKNOWN}}
321 }
322 
test_no_crash_on_pointer_to_label(void)323 void test_no_crash_on_pointer_to_label(void) {
324   char *a = &&label;
325   a[0] = 0;
326 label:;
327 }
328 
329 typedef __attribute__((__ext_vector_type__(2))) float simd_float2;
test_nowarning_on_vector_deref(void)330 float test_nowarning_on_vector_deref(void) {
331   simd_float2 x = {0, 1};
332   return x[1]; // no-warning
333 }
334 
335 struct s {
336   int v;
337 };
338 
339 // These three expressions should produce the same sym vals.
struct_pointer_canon(struct s * ps)340 void struct_pointer_canon(struct s *ps) {
341   struct s ss = *ps;
342   clang_analyzer_dump((*ps).v);
343   // expected-warning-re@-1{{reg_${{[[:digit:]]+}}<int SymRegion{reg_${{[[:digit:]]+}}<struct s * ps>}.v>}}
344   clang_analyzer_dump(ps[0].v);
345   // expected-warning-re@-1{{reg_${{[[:digit:]]+}}<int SymRegion{reg_${{[[:digit:]]+}}<struct s * ps>}.v>}}
346   clang_analyzer_dump(ps->v);
347   // expected-warning-re@-1{{reg_${{[[:digit:]]+}}<int SymRegion{reg_${{[[:digit:]]+}}<struct s * ps>}.v>}}
348   clang_analyzer_eval((*ps).v == ps[0].v); // expected-warning{{TRUE}}
349   clang_analyzer_eval((*ps).v == ps->v);   // expected-warning{{TRUE}}
350   clang_analyzer_eval(ps[0].v == ps->v);   // expected-warning{{TRUE}}
351 }
352 
struct_pointer_canon_bidim(struct s ** ps)353 void struct_pointer_canon_bidim(struct s **ps) {
354   struct s ss = **ps;
355   clang_analyzer_eval(&(ps[0][0].v) == &((*ps)->v)); // expected-warning{{TRUE}}
356 }
357 
358 typedef struct s T1;
359 typedef struct s T2;
struct_pointer_canon_typedef(T1 * ps)360 void struct_pointer_canon_typedef(T1 *ps) {
361   T2 ss = *ps;
362   clang_analyzer_dump((*ps).v);
363   // expected-warning-re@-1{{reg_${{[[:digit:]]+}}<int SymRegion{reg_${{[[:digit:]]+}}<T1 * ps>}.v>}}
364   clang_analyzer_dump(ps[0].v);
365   // expected-warning-re@-1{{reg_${{[[:digit:]]+}}<int SymRegion{reg_${{[[:digit:]]+}}<T1 * ps>}.v>}}
366   clang_analyzer_dump(ps->v);
367   // expected-warning-re@-1{{reg_${{[[:digit:]]+}}<int SymRegion{reg_${{[[:digit:]]+}}<T1 * ps>}.v>}}
368   clang_analyzer_eval((*ps).v == ps[0].v); // expected-warning{{TRUE}}
369   clang_analyzer_eval((*ps).v == ps->v);   // expected-warning{{TRUE}}
370   clang_analyzer_eval(ps[0].v == ps->v);   // expected-warning{{TRUE}}
371 }
372 
struct_pointer_canon_bidim_typedef(T1 ** ps)373 void struct_pointer_canon_bidim_typedef(T1 **ps) {
374   T2 ss = **ps;
375   clang_analyzer_eval(&(ps[0][0].v) == &((*ps)->v)); // expected-warning{{TRUE}}
376 }
377 
struct_pointer_canon_const(const struct s * ps)378 void struct_pointer_canon_const(const struct s *ps) {
379   struct s ss = *ps;
380   clang_analyzer_dump((*ps).v);
381   // expected-warning-re@-1{{reg_${{[[:digit:]]+}}<int SymRegion{reg_${{[[:digit:]]+}}<const struct s * ps>}.v>}}
382   clang_analyzer_dump(ps[0].v);
383   // expected-warning-re@-1{{reg_${{[[:digit:]]+}}<int SymRegion{reg_${{[[:digit:]]+}}<const struct s * ps>}.v>}}
384   clang_analyzer_dump(ps->v);
385   // expected-warning-re@-1{{reg_${{[[:digit:]]+}}<int SymRegion{reg_${{[[:digit:]]+}}<const struct s * ps>}.v>}}
386   clang_analyzer_eval((*ps).v == ps[0].v); // expected-warning{{TRUE}}
387   clang_analyzer_eval((*ps).v == ps->v);   // expected-warning{{TRUE}}
388   clang_analyzer_eval(ps[0].v == ps->v);   // expected-warning{{TRUE}}
389 }
390