1 // RUN: %clang_analyze_cc1 -analyzer-checker=unix.Malloc,core,alpha.core.CallAndMessageUnInitRefArg,debug.ExprInspection -analyzer-output=text -verify %s
2 
3 void clang_analyzer_warnIfReached();
4 
5 // Passing uninitialized const data to function
6 #include "Inputs/system-header-simulator.h"
7 
8 typedef __typeof(sizeof(int)) size_t;
9 void *malloc(size_t);
10 void *valloc(size_t);
11 void free(void *);
12 
13 
14 void doStuff3(const int y){}
15 void doStuff2(int g){}
16 void doStuff_pointerToConstInt(const int *u){};
17 void doStuff_arrayOfConstInt(const int a[]){};
18 
19 void doStuff_constPointerToConstInt              (int const * const u){};
20 void doStuff_constPointerToConstPointerToConstInt(int const * const * const u){};
21 void doStuff_pointerToConstPointerToConstInt(int const * const * u){};
22 void doStuff_pointerToPointerToConstInt       (int const **u){};
23 void doStuff_constStaticSizedArray(const int a[static 10]) {}
24 void doStuff_variadic(const int *u, ...){};
25 
26 void f_1(void) {
27   int t;
28   int* tp = &t;        // expected-note {{'tp' initialized here}}
29   doStuff_pointerToConstInt(tp);  // expected-warning {{1st function call argument is a pointer to uninitialized value}}
30                        // expected-note@-1 {{1st function call argument is a pointer to uninitialized value}}
31 }
32 
33 void f_1_1(void) {
34   int t;
35   int* tp1 = &t;
36   int* tp2 = tp1;        // expected-note {{'tp2' initialized here}}
37   doStuff_pointerToConstInt(tp2);  // expected-warning {{1st function call argument is a pointer to uninitialized value}}
38                        // expected-note@-1 {{1st function call argument is a pointer to uninitialized value}}
39 }
40 
41 
42 int *f_2_sub(int *p) {
43   return p;
44 }
45 
46 void f_2(void) {
47   int t;
48   int* p = f_2_sub(&t);
49   int* tp = p; // expected-note {{'tp' initialized here}}
50   doStuff_pointerToConstInt(tp); // expected-warning {{1st function call argument is a pointer to uninitialized value}}
51                       // expected-note@-1 {{1st function call argument is a pointer to uninitialized value}}
52 }
53 
54 int z;
55 void f_3(void) {
56       doStuff_pointerToConstInt(&z);  // no warning
57 }
58 
59 void f_4(void) {
60       int x=5;
61       doStuff_pointerToConstInt(&x);  // no warning
62 }
63 
64 void f_5(void) {
65   int ta[5];
66   int* tp = ta;        // expected-note {{'tp' initialized here}}
67   doStuff_pointerToConstInt(tp);  // expected-warning {{1st function call argument is a pointer to uninitialized value}}
68                        // expected-note@-1 {{1st function call argument is a pointer to uninitialized value}}
69 }
70 
71 void f_5_1(void) {
72   int ta[5];        // expected-note {{'ta' initialized here}}
73   doStuff_pointerToConstInt(ta);  // expected-warning {{1st function call argument is a pointer to uninitialized value}}
74                        // expected-note@-1 {{1st function call argument is a pointer to uninitialized value}}
75 }
76 
77 void f_6(void) {
78   int ta[5] = {1,2,3,4,5};
79   int* tp = ta;
80   doStuff_pointerToConstInt(tp); // no-warning
81 }
82 
83 void f_6_1(void) {
84   int ta[5] = {1,2,3,4,5};
85   doStuff_pointerToConstInt(ta); // no-warning
86 }
87 
88 void f_7(void) {
89       int z;        // expected-note {{'z' declared without an initial value}}
90       int y=z;      // expected-warning {{Assigned value is garbage or undefined}}
91                     // expected-note@-1 {{Assigned value is garbage or undefined}}
92       doStuff3(y);
93 }
94 
95 void f_8(void) {
96       int g;       // expected-note {{'g' declared without an initial value}}
97       doStuff2(g); // expected-warning {{1st function call argument is an uninitialized value}}
98                    // expected-note@-1 {{1st function call argument is an uninitialized value}}
99 }
100 
101 void f_9(void) {
102   int  a[6];
103   int const *ptau = a;             // expected-note {{'ptau' initialized here}}
104   doStuff_arrayOfConstInt(ptau);    // expected-warning {{1st function call argument is a pointer to uninitialized value}}
105                                    // expected-note@-1 {{1st function call argument is a pointer to uninitialized value}}
106 }
107 
108 void f_10(void) {
109   int  a[6];                     // expected-note {{'a' initialized here}}
110   doStuff_arrayOfConstInt(a);    // expected-warning {{1st function call argument is a pointer to uninitialized value}}
111                                  // expected-note@-1 {{1st function call argument is a pointer to uninitialized value}}
112 }
113 
114 void f_11(void) {
115   int t[10];                    //expected-note {{'t' initialized here}}
116   doStuff_constStaticSizedArray(t);  // expected-warning {{1st function call argument is a pointer to uninitialized value}}
117                                 // expected-note@-1 {{1st function call argument is a pointer to uninitialized value}}
118 }
119 
120 void f_12(void) {
121   int t[10] = {0,1,2,3,4,5,6,7,8,9};
122   doStuff_constStaticSizedArray(t);  // no-warning
123 
124 }
125 
126 // https://bugs.llvm.org/show_bug.cgi?id=35419
127 void f11_0(void) {
128   int x; // expected-note {{'x' declared without an initial value}}
129   x++; // expected-warning {{The expression is an uninitialized value. The computed value will also be garbage}}
130        // expected-note@-1 {{The expression is an uninitialized value. The computed value will also be garbage}}
131   clang_analyzer_warnIfReached(); // no-warning
132 }
133 void f11_1(void) {
134   int x; // expected-note {{'x' declared without an initial value}}
135   ++x; // expected-warning {{The expression is an uninitialized value. The computed value will also be garbage}}
136        // expected-note@-1 {{The expression is an uninitialized value. The computed value will also be garbage}}
137   clang_analyzer_warnIfReached(); // no-warning
138 }
139 void f11_2(void) {
140   int x; // expected-note {{'x' declared without an initial value}}
141   x--; // expected-warning {{The expression is an uninitialized value. The computed value will also be garbage}}
142        // expected-note@-1 {{The expression is an uninitialized value. The computed value will also be garbage}}
143   clang_analyzer_warnIfReached(); // no-warning
144 }
145 void f11_3(void) {
146   int x; // expected-note {{'x' declared without an initial value}}
147   --x; // expected-warning {{The expression is an uninitialized value. The computed value will also be garbage}}
148        // expected-note@-1 {{The expression is an uninitialized value. The computed value will also be garbage}}
149   clang_analyzer_warnIfReached(); // no-warning
150 }
151 
152 int f_malloc_1(void) {
153   int *ptr;
154 
155   ptr = (int *)malloc(sizeof(int)); // expected-note {{Value assigned to 'ptr'}}
156 
157   doStuff_pointerToConstInt(ptr); // expected-warning {{1st function call argument is a pointer to uninitialized value}}
158                        // expected-note@-1 {{1st function call argument is a pointer to uninitialized value}}
159   free(ptr);
160   return 0;
161 }
162 
163 int f_malloc_2(void) {
164   int *ptr;
165 
166   ptr = (int *)malloc(sizeof(int));
167   *ptr = 25;
168 
169   doStuff_pointerToConstInt(ptr); // no warning
170   free(ptr);
171   return 0;
172 }
173 
174 // uninit pointer, uninit val
175 void f_variadic_unp_unv(void) {
176   int t;
177   int v;
178   int* tp = &t;           // expected-note {{'tp' initialized here}}
179   doStuff_variadic(tp,v);  // expected-warning {{1st function call argument is a pointer to uninitialized value}}
180                           // expected-note@-1 {{1st function call argument is a pointer to uninitialized value}}
181 }
182 // uninit pointer, init val
183 void f_variadic_unp_inv(void) {
184   int t;
185   int v = 3;
186   int* tp = &t;           // expected-note {{'tp' initialized here}}
187   doStuff_variadic(tp,v);  // expected-warning {{1st function call argument is a pointer to uninitialized value}}
188                           // expected-note@-1 {{1st function call argument is a pointer to uninitialized value}}
189 }
190 
191 // init pointer, uninit val
192 void f_variadic_inp_unv(void) {
193   int t=5;
194   int v;                  // expected-note {{'v' declared without an initial value}}
195   int* tp = &t;
196   doStuff_variadic(tp,v);// expected-warning {{2nd function call argument is an uninitialized value}}
197                           // expected-note@-1 {{2nd function call argument is an uninitialized value}}
198 }
199 
200 // init pointer, init val
201 void f_variadic_inp_inv(void) {
202   int t=5;
203   int v = 3;
204   int* tp = &t;
205   doStuff_variadic(tp,v); // no-warning
206 }
207 
208 // init pointer, init pointer
209 void f_variadic_inp_inp(void) {
210   int t=5;
211   int u=3;
212   int *vp = &u ;
213   int *tp = &t;
214   doStuff_variadic(tp,vp); // no-warning
215 }
216 
217 //uninit pointer, init pointer
218 void f_variadic_unp_inp(void) {
219   int t;
220   int u=3;
221   int *vp = &u ;
222   int *tp = &t;             // expected-note {{'tp' initialized here}}
223   doStuff_variadic(tp,vp); // expected-warning {{1st function call argument is a pointer to uninitialized value}}
224                             // expected-note@-1 {{1st function call argument is a pointer to uninitialized value}}
225 }
226 
227 //init pointer, uninit pointer
228 void f_variadic_inp_unp(void) {
229   int t=5;
230   int u;
231   int *vp = &u ;
232   int *tp = &t;
233   doStuff_variadic(tp,vp); // no-warning
234 }
235 
236 //uninit pointer, uninit pointer
237 void f_variadic_unp_unp(void) {
238   int t;
239   int u;
240   int *vp = &u ;
241   int *tp = &t;             // expected-note {{'tp' initialized here}}
242   doStuff_variadic(tp,vp); // expected-warning {{1st function call argument is a pointer to uninitialized value}}
243                             // expected-note@-1 {{1st function call argument is a pointer to uninitialized value}}
244 }
245