1 // RUN: clang-cc -analyze -checker-cfref -analyzer-store=basic -verify %s &&
2 // RUN: clang-cc -analyze -checker-cfref -analyzer-store=region -verify %s
3 
4 #include <stdlib.h>
5 
6 int* f1() {
7   int x = 0;
8   return &x; // expected-warning{{Address of stack memory associated with local variable 'x' returned.}} expected-warning{{address of stack memory associated with local variable 'x' returned}}
9 }
10 
11 int* f2(int y) {
12   return &y;  // expected-warning{{Address of stack memory associated with local variable 'y' returned.}} expected-warning{{address of stack memory associated with local variable 'y' returned}}
13 }
14 
15 int* f3(int x, int *y) {
16   int w = 0;
17 
18   if (x)
19     y = &w;
20 
21   return y; // expected-warning{{Address of stack memory associated with local variable 'w' returned.}}
22 }
23 
24 void* compound_literal(int x, int y) {
25   if (x)
26     return &(unsigned short){((unsigned short)0x22EF)}; // expected-warning{{Address of stack memory}}
27 
28   int* array[] = {};
29   struct s { int z; double y; int w; };
30 
31   if (y)
32     return &((struct s){ 2, 0.4, 5 * 8 }); // expected-warning{{Address of stack memory}}
33 
34 
35   void* p = &((struct s){ 42, 0.4, x ? 42 : 0 });
36   return p; // expected-warning{{Address of stack memory}}
37 }
38 
39 void* alloca_test() {
40   void* p = __builtin_alloca(10);
41   return p; // expected-warning{{Address of stack memory}}
42 }
43 
44 int array_test(int x[2]) {
45   return x[0]; // no-warning
46 }
47 
48 struct baz {
49   int x;
50   int y[2];
51 };
52 
53 int struct_test(struct baz byVal, int flag) {
54   if (flag)
55     return byVal.x; // no-warning
56   else {
57     return byVal.y[0]; // no-warning
58   }
59 }
60