1 // RUN: clang-cc -analyze -checker-cfref -analyzer-store=basic -analyzer-constraints=basic -verify %s && 2 // RUN: clang-cc -analyze -checker-cfref -analyzer-store=basic-new-cast -analyzer-constraints=basic -verify %s && 3 // RUN: clang-cc -analyze -checker-cfref -analyzer-store=basic -analyzer-constraints=range -verify %s && 4 // RUN: clang-cc -analyze -checker-cfref -analyzer-store=basic-new-cast -analyzer-constraints=range -verify %s 5 6 // RegionStore now has an infinite recursion with this test case. 7 // RUN: clang-cc -analyze -checker-cfref -analyzer-store=region -analyzer-constraints=basic -verify %s && 8 // RUN: clang-cc -analyze -checker-cfref -analyzer-store=region -analyzer-constraints=range -verify %s 9 10 struct s { 11 int data; 12 int data_array[10]; 13 }; 14 15 typedef struct { 16 int data; 17 } STYPE; 18 19 void g(char *p); 20 void g1(struct s* p); 21 22 // Array to pointer conversion. Array in the struct field. 23 void f(void) { 24 int a[10]; 25 int (*p)[10]; 26 p = &a; 27 (*p)[3] = 1; 28 29 struct s d; 30 struct s *q; 31 q = &d; 32 q->data = 3; 33 d.data_array[9] = 17; 34 } 35 36 // StringLiteral in lvalue context and pointer to array type. 37 // p: ElementRegion, q: StringRegion 38 void f2() { 39 char *p = "/usr/local"; 40 char (*q)[4]; 41 q = &"abc"; 42 } 43 44 // Typedef'ed struct definition. 45 void f3() { 46 STYPE s; 47 } 48 49 // Initialize array with InitExprList. 50 void f4() { 51 int a[] = { 1, 2, 3}; 52 int b[3] = { 1, 2 }; 53 struct s c[] = {{1,{1}}}; 54 } 55 56 // Struct variable in lvalue context. 57 // Assign UnknownVal to the whole struct. 58 void f5() { 59 struct s data; 60 g1(&data); 61 } 62 63 // AllocaRegion test. 64 void f6() { 65 char *p; 66 p = __builtin_alloca(10); 67 g(p); 68 char c = *p; 69 p[1] = 'a'; 70 // Test if RegionStore::EvalBinOp converts the alloca region to element 71 // region. 72 p += 2; 73 } 74 75 struct s2; 76 77 void g2(struct s2 *p); 78 79 // Incomplete struct pointer used as function argument. 80 void f7() { 81 struct s2 *p = __builtin_alloca(10); 82 g2(p); 83 } 84 85 // sizeof() is unsigned while -1 is signed in array index. 86 void f8() { 87 int a[10]; 88 a[sizeof(a)/sizeof(int) - 1] = 1; // no-warning 89 } 90 91 // Initialization of struct array elements. 92 void f9() { 93 struct s a[10]; 94 } 95 96 // Initializing array with string literal. 97 void f10() { 98 char a1[4] = "abc"; 99 char a3[6] = "abc"; 100 } 101 102 // Retrieve the default value of element/field region. 103 void f11() { 104 struct s a; 105 g1(&a); 106 if (a.data == 0) // no-warning 107 a.data = 1; 108 } 109 110 // Convert unsigned offset to signed when creating ElementRegion from 111 // SymbolicRegion. 112 void f12(int *list) { 113 unsigned i = 0; 114 list[i] = 1; 115 } 116 117 struct s1 { 118 struct s2 { 119 int d; 120 } e; 121 }; 122 123 // The binding of a.e.d should not be removed. Test recursive subregion map 124 // building: a->e, e->d. Only then 'a' could be added to live region roots. 125 void f13(double timeout) { 126 struct s1 a; 127 a.e.d = (long) timeout; 128 if (a.e.d == 10) 129 a.e.d = 4; 130 } 131 132 struct s3 { 133 int a[2]; 134 }; 135 136 static struct s3 opt; 137 138 // Test if the embedded array is retrieved correctly. 139 void f14() { 140 struct s3 my_opt = opt; 141 } 142 143 void bar(int*); 144 145 // Test if the array is correctly invalidated. 146 void f15() { 147 int a[10]; 148 bar(a); 149 if (a[1]) // no-warning 150 1; 151 } 152 153 struct s3 p[1]; 154 155 // Code from postgresql. 156 // Current cast logic of region store mistakenly leaves the final result region 157 // an ElementRegion of type 'char'. Then load a nonloc::SymbolVal from it and 158 // assigns to 'a'. 159 void f16(struct s3 *p) { 160 struct s3 a = *((struct s3*) ((char*) &p[0])); 161 } 162 163 void inv(struct s1 *); 164 165 // Invalidate the struct field. 166 void f17() { 167 struct s1 t; 168 int x; 169 inv(&t); 170 if (t.e.d) 171 x = 1; 172 } 173 174 void read(char*); 175 176 void f18() { 177 char *q; 178 char *p = (char *) __builtin_alloca(10); 179 read(p); 180 q = p; 181 q++; 182 if (*q) { // no-warning 183 } 184 } 185