1 // RUN: %clang_cc1 -analyze -analyzer-checker=core,unix.Malloc -verify %s
2 
3 #include "Inputs/system-header-simulator.h"
4 
5 typedef void* gpointer;
6 typedef const void* gconstpointer;
7 typedef unsigned long gsize;
8 typedef unsigned int guint;
9 
10 gpointer g_malloc(gsize n_bytes);
11 gpointer g_malloc0(gsize n_bytes);
12 gpointer g_realloc(gpointer mem, gsize n_bytes);
13 gpointer g_try_malloc(gsize n_bytes);
14 gpointer g_try_malloc0(gsize n_bytes);
15 gpointer g_try_realloc(gpointer mem, gsize n_bytes);
16 gpointer g_malloc_n(gsize n_blocks, gsize n_block_bytes);
17 gpointer g_malloc0_n(gsize n_blocks, gsize n_block_bytes);
18 gpointer g_realloc_n(gpointer mem, gsize n_blocks, gsize n_block_bytes);
19 gpointer g_try_malloc_n(gsize n_blocks, gsize n_block_bytes);
20 gpointer g_try_malloc0_n(gsize n_blocks, gsize n_block_bytes);
21 gpointer g_try_realloc_n(gpointer mem, gsize n_blocks, gsize n_block_bytes);
22 void g_free(gpointer mem);
23 gpointer g_memdup(gconstpointer mem, guint byte_size);
24 gpointer g_strconcat(gconstpointer string1, ...);
25 
26 static const gsize n_bytes = 1024;
27 
28 void f1(void) {
29   gpointer g1 = g_malloc(n_bytes);
30   gpointer g2 = g_malloc0(n_bytes);
31   g1 = g_realloc(g1, n_bytes * 2);
32   gpointer g3 = g_try_malloc(n_bytes);
33   gpointer g4 = g_try_malloc0(n_bytes);
34   g3 = g_try_realloc(g3, n_bytes * 2);
35   gpointer g5 = g_malloc_n(n_bytes, sizeof(char));
36   gpointer g6 = g_malloc0_n(n_bytes, sizeof(char));
37   g5 = g_realloc_n(g5, n_bytes * 2, sizeof(char));
38   gpointer g7 = g_try_malloc_n(n_bytes, sizeof(char));
39   gpointer g8 = g_try_malloc0_n(n_bytes, sizeof(char));
40   g7 = g_try_realloc_n(g7, n_bytes * 2, sizeof(char));
41 
42   g_free(g1);
43   g_free(g2);
44   g_free(g2); // expected-warning{{Attempt to free released memory}}
45 }
46 
47 void f2(void) {
48   gpointer g1 = g_malloc(n_bytes);
49   gpointer g2 = g_malloc0(n_bytes);
50   g1 = g_realloc(g1, n_bytes * 2);
51   gpointer g3 = g_try_malloc(n_bytes);
52   gpointer g4 = g_try_malloc0(n_bytes);
53   g3 = g_try_realloc(g3, n_bytes * 2);
54   gpointer g5 = g_malloc_n(n_bytes, sizeof(char));
55   gpointer g6 = g_malloc0_n(n_bytes, sizeof(char));
56   g5 = g_realloc_n(g5, n_bytes * 2, sizeof(char));
57   gpointer g7 = g_try_malloc_n(n_bytes, sizeof(char));
58   gpointer g8 = g_try_malloc0_n(n_bytes, sizeof(char));
59   g7 = g_try_realloc_n(g7, n_bytes * 2, sizeof(char));
60 
61   g_free(g1);
62   g_free(g2);
63   g_free(g3);
64   g3 = g_memdup(g3, n_bytes); // expected-warning{{Use of memory after it is freed}}
65 }
66 
67 void f3(void) {
68   gpointer g1 = g_malloc(n_bytes);
69   gpointer g2 = g_malloc0(n_bytes);
70   g1 = g_realloc(g1, n_bytes * 2);
71   gpointer g3 = g_try_malloc(n_bytes);
72   gpointer g4 = g_try_malloc0(n_bytes);
73   g3 = g_try_realloc(g3, n_bytes * 2); // expected-warning{{Potential leak of memory pointed to by 'g4'}}
74   gpointer g5 = g_malloc_n(n_bytes, sizeof(char));
75   gpointer g6 = g_malloc0_n(n_bytes, sizeof(char));
76   g5 = g_realloc_n(g5, n_bytes * 2, sizeof(char)); // expected-warning{{Potential leak of memory pointed to by 'g6'}}
77   gpointer g7 = g_try_malloc_n(n_bytes, sizeof(char)); // expected-warning{{Potential leak of memory pointed to by 'g5'}}
78   gpointer g8 = g_try_malloc0_n(n_bytes, sizeof(char));
79   g7 = g_try_realloc_n(g7, n_bytes * 2, sizeof(char)); // expected-warning{{Potential leak of memory pointed to by 'g8'}}
80 
81   g_free(g1); // expected-warning{{Potential leak of memory pointed to by 'g7'}}
82   g_free(g2);
83   g_free(g3);
84 }
85 
86 void f4(void) {
87   gpointer g1 = g_malloc(n_bytes);
88   gpointer g2 = g_malloc0(n_bytes);
89   g1 = g_realloc(g1, n_bytes * 2);
90   gpointer g3 = g_try_malloc(n_bytes);
91   gpointer g4 = g_try_malloc0(n_bytes);
92   g3 = g_try_realloc(g3, n_bytes * 2);
93   gpointer g5 = g_malloc_n(n_bytes, sizeof(char));
94   gpointer g6 = g_malloc0_n(n_bytes, sizeof(char));
95   g5 = g_realloc_n(g5, n_bytes * 2, sizeof(char)); // expected-warning{{Potential leak of memory pointed to by 'g6'}}
96   gpointer g7 = g_try_malloc_n(n_bytes, sizeof(char)); // expected-warning{{Potential leak of memory pointed to by 'g5'}}
97   gpointer g8 = g_try_malloc0_n(n_bytes, sizeof(char));
98   g7 = g_try_realloc_n(g7, n_bytes * 2, sizeof(char)); // expected-warning{{Potential leak of memory pointed to by 'g8'}}
99 
100   g_free(g1); // expected-warning{{Potential leak of memory pointed to by 'g7'}}
101   g_free(g2);
102   g_free(g3);
103   g_free(g4);
104 }
105 
106 void f5(void) {
107   gpointer g1 = g_malloc(n_bytes);
108   gpointer g2 = g_malloc0(n_bytes);
109   g1 = g_realloc(g1, n_bytes * 2);
110   gpointer g3 = g_try_malloc(n_bytes);
111   gpointer g4 = g_try_malloc0(n_bytes);
112   g3 = g_try_realloc(g3, n_bytes * 2);
113   gpointer g5 = g_malloc_n(n_bytes, sizeof(char));
114   gpointer g6 = g_malloc0_n(n_bytes, sizeof(char));
115   g5 = g_realloc_n(g5, n_bytes * 2, sizeof(char)); // expected-warning{{Potential leak of memory pointed to by 'g6'}}
116   gpointer g7 = g_try_malloc_n(n_bytes, sizeof(char));
117   gpointer g8 = g_try_malloc0_n(n_bytes, sizeof(char));
118   g7 = g_try_realloc_n(g7, n_bytes * 2, sizeof(char)); // expected-warning{{Potential leak of memory pointed to by 'g8'}}
119 
120   g_free(g1); // expected-warning{{Potential leak of memory pointed to by 'g7'}}
121   g_free(g2);
122   g_free(g3);
123   g_free(g4);
124   g_free(g5);
125 }
126 
127 void f6(void) {
128   gpointer g1 = g_malloc(n_bytes);
129   gpointer g2 = g_malloc0(n_bytes);
130   g1 = g_realloc(g1, n_bytes * 2);
131   gpointer g3 = g_try_malloc(n_bytes);
132   gpointer g4 = g_try_malloc0(n_bytes);
133   g3 = g_try_realloc(g3, n_bytes * 2);
134   gpointer g5 = g_malloc_n(n_bytes, sizeof(char));
135   gpointer g6 = g_malloc0_n(n_bytes, sizeof(char));
136   g5 = g_realloc_n(g5, n_bytes * 2, sizeof(char));
137   gpointer g7 = g_try_malloc_n(n_bytes, sizeof(char));
138   gpointer g8 = g_try_malloc0_n(n_bytes, sizeof(char));
139   g7 = g_try_realloc_n(g7, n_bytes * 2, sizeof(char)); // expected-warning{{Potential leak of memory pointed to by 'g8'}}
140 
141   g_free(g1); // expected-warning{{Potential leak of memory pointed to by 'g7'}}
142   g_free(g2);
143   g_free(g3);
144   g_free(g4);
145   g_free(g5);
146   g_free(g6);
147 }
148 
149 void f7(void) {
150   gpointer g1 = g_malloc(n_bytes);
151   gpointer g2 = g_malloc0(n_bytes);
152   g1 = g_realloc(g1, n_bytes * 2);
153   gpointer g3 = g_try_malloc(n_bytes);
154   gpointer g4 = g_try_malloc0(n_bytes);
155   g3 = g_try_realloc(g3, n_bytes * 2);
156   gpointer g5 = g_malloc_n(n_bytes, sizeof(char));
157   gpointer g6 = g_malloc0_n(n_bytes, sizeof(char));
158   g5 = g_realloc_n(g5, n_bytes * 2, sizeof(char));
159   gpointer g7 = g_try_malloc_n(n_bytes, sizeof(char));
160   gpointer g8 = g_try_malloc0_n(n_bytes, sizeof(char));
161   g7 = g_try_realloc_n(g7, n_bytes * 2, sizeof(char)); // expected-warning{{Potential leak of memory pointed to by 'g8'}}
162 
163   g_free(g1);
164   g_free(g2);
165   g_free(g3);
166   g_free(g4);
167   g_free(g5);
168   g_free(g6);
169   g_free(g7);
170 }
171 
172 void f8(void) {
173   typedef struct {
174     gpointer str;
175   } test_struct;
176 
177   test_struct *s1 = (test_struct *)g_malloc0(sizeof(test_struct));
178   test_struct *s2 = (test_struct *)g_memdup(s1, sizeof(test_struct));
179   gpointer str = g_strconcat("text", s1->str, s2->str, NULL); // no-warning
180   g_free(str);
181   g_free(s2);
182   g_free(s1);
183 }
184