1 // RUN: clang-cc -analyze -checker-cfref -analyzer-store=basic -analyzer-constraints=basic -verify %s && 2 // RUN: clang-cc -analyze -checker-cfref -analyzer-store=basic -analyzer-constraints=range -verify %s 3 4 // RegionStore now has an infinite recursion with this test case. 5 // RUN: clang-cc -analyze -checker-cfref -analyzer-store=region -analyzer-constraints=basic -verify %s && 6 // RUN: clang-cc -analyze -checker-cfref -analyzer-store=region -analyzer-constraints=range -verify %s 7 8 struct s { 9 int data; 10 int data_array[10]; 11 }; 12 13 typedef struct { 14 int data; 15 } STYPE; 16 17 void g(char *p); 18 void g1(struct s* p); 19 20 // Array to pointer conversion. Array in the struct field. 21 void f(void) { 22 int a[10]; 23 int (*p)[10]; 24 p = &a; 25 (*p)[3] = 1; 26 27 struct s d; 28 struct s *q; 29 q = &d; 30 q->data = 3; 31 d.data_array[9] = 17; 32 } 33 34 // StringLiteral in lvalue context and pointer to array type. 35 // p: ElementRegion, q: StringRegion 36 void f2() { 37 char *p = "/usr/local"; 38 char (*q)[4]; 39 q = &"abc"; 40 } 41 42 // Typedef'ed struct definition. 43 void f3() { 44 STYPE s; 45 } 46 47 // Initialize array with InitExprList. 48 void f4() { 49 int a[] = { 1, 2, 3}; 50 int b[3] = { 1, 2 }; 51 struct s c[] = {{1,{1}}}; 52 } 53 54 // Struct variable in lvalue context. 55 // Assign UnknownVal to the whole struct. 56 void f5() { 57 struct s data; 58 g1(&data); 59 } 60 61 // AllocaRegion test. 62 void f6() { 63 char *p; 64 p = __builtin_alloca(10); 65 g(p); 66 char c = *p; 67 p[1] = 'a'; 68 // Test if RegionStore::EvalBinOp converts the alloca region to element 69 // region. 70 p += 2; 71 } 72 73 struct s2; 74 75 void g2(struct s2 *p); 76 77 // Incomplete struct pointer used as function argument. 78 void f7() { 79 struct s2 *p = __builtin_alloca(10); 80 g2(p); 81 } 82 83 // sizeof() is unsigned while -1 is signed in array index. 84 void f8() { 85 int a[10]; 86 a[sizeof(a)/sizeof(int) - 1] = 1; // no-warning 87 } 88 89 // Initialization of struct array elements. 90 void f9() { 91 struct s a[10]; 92 } 93 94 // Initializing array with string literal. 95 void f10() { 96 char a1[4] = "abc"; 97 char a3[6] = "abc"; 98 } 99 100 // Retrieve the default value of element/field region. 101 void f11() { 102 struct s a; 103 g1(&a); 104 if (a.data == 0) // no-warning 105 a.data = 1; 106 } 107 108 // Convert unsigned offset to signed when creating ElementRegion from 109 // SymbolicRegion. 110 void f12(int *list) { 111 unsigned i = 0; 112 list[i] = 1; 113 } 114 115 struct s1 { 116 struct s2 { 117 int d; 118 } e; 119 }; 120 121 // The binding of a.e.d should not be removed. Test recursive subregion map 122 // building: a->e, e->d. Only then 'a' could be added to live region roots. 123 void f13(double timeout) { 124 struct s1 a; 125 a.e.d = (long) timeout; 126 if (a.e.d == 10) 127 a.e.d = 4; 128 } 129 130 struct s3 { 131 int a[2]; 132 }; 133 134 static struct s3 opt; 135 136 // Test if the embedded array is retrieved correctly. 137 void f14() { 138 struct s3 my_opt = opt; 139 } 140 141 void bar(int*); 142 143 // Test if the array is correctly invalidated. 144 void f15() { 145 int a[10]; 146 bar(a); 147 if (a[1]) // no-warning 148 1; 149 } 150 151 struct s3 p[1]; 152 153 // Code from postgresql. 154 // Current cast logic of region store mistakenly leaves the final result region 155 // an ElementRegion of type 'char'. Then load a nonloc::SymbolVal from it and 156 // assigns to 'a'. 157 void f16(struct s3 *p) { 158 struct s3 a = *((struct s3*) ((char*) &p[0])); 159 } 160 161 void inv(struct s1 *); 162 163 // Invalidate the struct field. 164 void f17() { 165 struct s1 t; 166 int x; 167 inv(&t); 168 if (t.e.d) 169 x = 1; 170 } 171 172 void read(char*); 173 174 void f18() { 175 char *q; 176 char *p = (char *) __builtin_alloca(10); 177 read(p); 178 q = p; 179 q++; 180 if (*q) { // no-warning 181 } 182 } 183