1 // RUN: %clang_analyze_cc1 -w -verify %s \
2 // RUN:   -analyzer-checker=core \
3 // RUN:   -analyzer-checker=alpha.deadcode.UnreachableCode \
4 // RUN:   -analyzer-checker=alpha.core.CastSize \
5 // RUN:   -analyzer-checker=unix.Malloc \
6 // RUN:   -analyzer-checker=cplusplus.NewDelete
7 
8 // RUN: %clang_analyze_cc1 -w -verify %s \
9 // RUN:   -triple i386-unknown-linux-gnu \
10 // RUN:   -analyzer-checker=core \
11 // RUN:   -analyzer-checker=alpha.deadcode.UnreachableCode \
12 // RUN:   -analyzer-checker=alpha.core.CastSize \
13 // RUN:   -analyzer-checker=unix.Malloc \
14 // RUN:   -analyzer-checker=cplusplus.NewDelete
15 
16 // RUN: %clang_analyze_cc1 -w -verify %s -DTEST_INLINABLE_ALLOCATORS \
17 // RUN:   -analyzer-checker=core \
18 // RUN:   -analyzer-checker=alpha.deadcode.UnreachableCode \
19 // RUN:   -analyzer-checker=alpha.core.CastSize \
20 // RUN:   -analyzer-checker=unix.Malloc \
21 // RUN:   -analyzer-checker=cplusplus.NewDelete
22 
23 // RUN: %clang_analyze_cc1 -w -verify %s -DTEST_INLINABLE_ALLOCATORS \
24 // RUN:   -triple i386-unknown-linux-gnu \
25 // RUN:   -analyzer-checker=core \
26 // RUN:   -analyzer-checker=alpha.deadcode.UnreachableCode \
27 // RUN:   -analyzer-checker=alpha.core.CastSize \
28 // RUN:   -analyzer-checker=unix.Malloc \
29 // RUN:   -analyzer-checker=cplusplus.NewDelete
30 
31 #include "Inputs/system-header-simulator-cxx.h"
32 
33 typedef __typeof(sizeof(int)) size_t;
34 void *malloc(size_t);
35 void free(void *);
36 void *realloc(void *ptr, size_t size);
37 void *calloc(size_t nmemb, size_t size);
38 char *strdup(const char *s);
39 
40 void checkThatMallocCheckerIsRunning() {
41   malloc(4);
42 } // expected-warning{{leak}}
43 
44 // Test for radar://11110132.
45 struct Foo {
46     mutable void* m_data;
47     Foo(void* data) : m_data(data) {}
48 };
49 Foo aFunction() {
50     return malloc(10);
51 }
52 
53 // Assume that functions which take a function pointer can free memory even if
54 // they are defined in system headers and take the const pointer to the
55 // allocated memory. (radar://11160612)
56 // Test default parameter.
57 int const_ptr_and_callback_def_param(int, const char*, int n, void(*)(void*) = free);
58 void r11160612_3() {
59   char *x = (char*)malloc(12);
60   const_ptr_and_callback_def_param(0, x, 12);
61 }
62 
63 int const_ptr_and_callback_def_param_null(int, const char*, int n, void(*)(void*) = 0);
64 void r11160612_no_callback() {
65   char *x = (char*)malloc(12);
66   const_ptr_and_callback_def_param_null(0, x, 12);
67 } // expected-warning{{leak}}
68 
69 // Test member function pointer.
70 struct CanFreeMemory {
71   static void myFree(void*);
72 };
73 //This is handled because we look at the type of the parameter(not argument).
74 void r11160612_3(CanFreeMemory* p) {
75   char *x = (char*)malloc(12);
76   const_ptr_and_callback_def_param(0, x, 12, p->myFree);
77 }
78 
79 
80 namespace PR13751 {
81   class OwningVector {
82     void **storage;
83     size_t length;
84   public:
85     OwningVector();
86     ~OwningVector();
87     void push_back(void *Item) {
88       storage[length++] = Item;
89     }
90   };
91 
92   void testDestructors() {
93     OwningVector v;
94     v.push_back(malloc(4));
95     // no leak warning; freed in destructor
96   }
97 }
98 
99 struct X { void *a; };
100 
101 struct X get() {
102   struct X result;
103   result.a = malloc(4);
104   return result; // no-warning
105 }
106 
107 // Ensure that regions accessible through a LazyCompoundVal trigger region escape.
108 // Malloc checker used to report leaks for the following two test cases.
109 struct Property {
110   char* getterName;
111   Property(char* n)
112   : getterName(n) {}
113 
114 };
115 void append(Property x);
116 
117 void appendWrapper(char *getterName) {
118   append(Property(getterName));
119 }
120 void foo(const char* name) {
121   char* getterName = strdup(name);
122   appendWrapper(getterName); // no-warning
123 }
124 
125 struct NestedProperty {
126   Property prop;
127   NestedProperty(Property p)
128   : prop(p) {}
129 };
130 void appendNested(NestedProperty x);
131 
132 void appendWrapperNested(char *getterName) {
133   appendNested(NestedProperty(Property(getterName)));
134 }
135 void fooNested(const char* name) {
136   char* getterName = strdup(name);
137   appendWrapperNested(getterName); // no-warning
138 }
139 
140 namespace PR31226 {
141   struct b2 {
142     int f;
143   };
144 
145   struct b1 : virtual b2 {
146     void m();
147   };
148 
149   struct d : b1, b2 {
150   };
151 
152   void f() {
153     d *p = new d();
154     p->m(); // no-crash // no-warning
155   }
156 }
157 
158 // Allow __cxa_demangle to escape.
159 char* test_cxa_demangle(const char* sym) {
160   size_t funcnamesize = 256;
161   char* funcname = (char*)malloc(funcnamesize);
162   int status;
163   char* ret = abi::__cxa_demangle(sym, funcname, &funcnamesize, &status);
164   if (status == 0) {
165     funcname = ret;
166   }
167   return funcname; // no-warning
168 }
169 
170 namespace argument_leak {
171 class A {
172   char *name;
173 
174 public:
175   char *getName() {
176     if (!name) {
177       name = static_cast<char *>(malloc(10));
178     }
179     return name;
180   }
181   ~A() {
182     if (name) {
183       delete[] name;
184     }
185   }
186 };
187 
188 void test(A a) {
189   (void)a.getName();
190 }
191 } // namespace argument_leak
192 
193 #define ZERO_SIZE_PTR ((void *)16)
194 
195 void test_delete_ZERO_SIZE_PTR() {
196   int *Ptr = (int *)ZERO_SIZE_PTR;
197   // ZERO_SIZE_PTR is specially handled but only for malloc family
198   delete Ptr; // expected-warning{{Argument to 'delete' is a constant address (16)}}
199 }
200 
201 namespace pr46253_class {
202 class a {
203   void *realloc(int, bool = false) { realloc(1); } // no-crash
204 };
205 } // namespace pr46253_class
206 
207 namespace pr46253_retty{
208 void realloc(void *ptr, size_t size) { realloc(ptr, size); } // no-crash
209 } // namespace pr46253_retty
210 
211 namespace pr46253_paramty{
212 void *realloc(void **ptr, size_t size) { realloc(ptr, size); } // no-crash
213 } // namespace pr46253_paramty
214 
215 namespace pr46253_paramty2{
216 void *realloc(void *ptr, int size) { realloc(ptr, size); } // no-crash
217 } // namespace pr46253_paramty2
218