xref: /llvm-project/clang/test/Analysis/null-deref-ps.c (revision 0f1c1be1968076d6f96f8a7bcc4a15cf195ecd97)
1 // RUN: %clang_analyze_cc1 -triple i386-apple-darwin10 -Wno-int-conversion -Wno-strict-prototypes -Wno-tautological-constant-compare -Wtautological-unsigned-zero-compare -analyzer-checker=core,deadcode,alpha.core -std=gnu99 -analyzer-purge=none -verify %s -Wno-error=return-type
2 // RUN: %clang_analyze_cc1 -triple i386-apple-darwin10 -Wno-int-conversion -Wno-strict-prototypes -Wno-tautological-constant-compare -Wtautological-unsigned-zero-compare -analyzer-checker=core,deadcode,alpha.core -std=gnu99 -verify %s -Wno-error=return-type
3 
4 typedef unsigned uintptr_t;
5 
6 extern void __assert_fail (__const char *__assertion, __const char *__file,
7     unsigned int __line, __const char *__function)
8      __attribute__ ((__noreturn__));
9 
10 #define assert(expr) \
11   ((expr)  ? (void)(0)  : __assert_fail (#expr, __FILE__, __LINE__, __func__))
12 
f1(int * p)13 void f1(int *p) {
14   if (p) *p = 1;
15   else *p = 0; // expected-warning{{ereference}}
16 }
17 
18 struct foo_struct {
19   int x;
20 };
21 
f2(struct foo_struct * p)22 int f2(struct foo_struct* p) {
23 
24   if (p)
25     p->x = 1;
26 
27   return p->x++; // expected-warning{{Access to field 'x' results in a dereference of a null pointer (loaded from variable 'p')}}
28 }
29 
f3(char * x)30 int f3(char* x) {
31 
32   int i = 2;
33 
34   if (x)
35     return x[i - 1];
36 
37   return x[i+1]; // expected-warning{{Array access (from variable 'x') results in a null pointer dereference}}
38 }
39 
f3_b(char * x)40 int f3_b(char* x) {
41 
42   int i = 2;
43 
44   if (x)
45     return x[i - 1];
46 
47   return x[i+1]++; // expected-warning{{Array access (from variable 'x') results in a null pointer dereference}}
48 }
49 
f4(int * p)50 int f4(int *p) {
51 
52   uintptr_t x = (uintptr_t) p;
53 
54   if (x)
55     return 1;
56 
57   int *q = (int*) x;
58   return *q; // expected-warning{{Dereference of null pointer (loaded from variable 'q')}}
59 }
60 
f4_b(void)61 int f4_b(void) {
62   short array[2];
63   uintptr_t x = array;
64   short *p = x;
65 
66   // The following branch should be infeasible.
67   if (!(p == &array[0])) {
68     p = 0;
69     *p = 1; // no-warning
70   }
71 
72   if (p) {
73     *p = 5; // no-warning
74     p = 0;
75   }
76   else return; // expected-warning {{non-void function 'f4_b' should return a value}}
77 
78   *p += 10; // expected-warning{{Dereference of null pointer}}
79   return 0;
80 }
81 
f5(void)82 int f5(void) {
83 
84   char *s = "hello world";
85   return s[0]; // no-warning
86 }
87 
88 int bar(int* p, int q) __attribute__((nonnull));
89 
f6(int * p)90 int f6(int *p) {
91   return !p ? bar(p, 1) // expected-warning {{Null pointer passed to 1st parameter expecting 'nonnull'}}
92          : bar(p, 0);   // no-warning
93 }
94 
95 int bar2(int* p, int q) __attribute__((nonnull(1)));
96 
f6b(int * p)97 int f6b(int *p) {
98   return !p ? bar2(p, 1) // expected-warning {{Null pointer passed to 1st parameter expecting 'nonnull'}}
99          : bar2(p, 0);   // no-warning
100 }
101 
102 int bar3(int*p, int q, int *r) __attribute__((nonnull(1,3)));
103 
f6c(int * p,int * q)104 int f6c(int *p, int *q) {
105    return !p ? bar3(q, 2, p) // expected-warning {{Null pointer passed to 3rd parameter expecting 'nonnull'}}
106              : bar3(p, 2, q); // no-warning
107 }
108 
f6d(int * p)109 void f6d(int *p) {
110   bar(p, 0);
111   // At this point, 'p' cannot be null.
112   if (!p) {
113     int *q = 0;
114     *q = 0xDEADBEEF; // no-warning
115   }
116 }
117 
f6e(int * p,int offset)118 void f6e(int *p, int offset) {
119   // PR7406 - crash from treating an UnknownVal as defined, to see if it's 0.
120   bar((p+offset)+1, 0); // not crash
121 }
122 
123 int* qux();
124 
f7(int x)125 int f7(int x) {
126 
127   int* p = 0;
128 
129   if (0 == x)
130     p = qux();
131 
132   if (0 == x)
133     *p = 1; // no-warning
134 
135   return x;
136 }
137 
f7b(int * x)138 int* f7b(int *x) {
139 
140   int* p = 0;
141 
142   if (((void*)0) == x)
143     p = qux();
144 
145   if (((void*)0) == x)
146     *p = 1; // no-warning
147 
148   return x;
149 }
150 
f7c(int * x)151 int* f7c(int *x) {
152 
153   int* p = 0;
154 
155   if (((void*)0) == x)
156     p = qux();
157 
158   if (((void*)0) != x)
159     return x;
160 
161   // If we reach here then 'p' is not null.
162   *p = 1; // no-warning
163   return x;
164 }
165 
f7c2(int * x)166 int* f7c2(int *x) {
167 
168   int* p = 0;
169 
170   if (((void*)0) == x)
171     p = qux();
172 
173   if (((void*)0) == x)
174     return x;
175 
176   *p = 1; // expected-warning{{null}}
177   return x;
178 }
179 
180 
f8(int * p,int * q)181 void f8(int *p, int *q) {
182   if (!p)
183     if (p)
184       *p = 1; // no-warning
185 
186   if (q)
187     if (!q)
188       *q = 1; // no-warning
189 }
190 
191 int* qux();
192 
f9(unsigned len)193 int f9(unsigned len) {
194   assert (len != 0);
195   int *p = 0;
196   unsigned i;
197 
198   for (i = 0; i < len; ++i)
199    p = qux(i);
200 
201   return *p++; // no-warning
202 }
203 
f9b(unsigned len)204 int f9b(unsigned len) {
205   assert (len > 0);  // note use of '>'
206   int *p = 0;
207   unsigned i;
208 
209   for (i = 0; i < len; ++i)
210    p = qux(i);
211 
212   return *p++; // no-warning
213 }
214 
f10(int * p,signed char x,int y)215 int* f10(int* p, signed char x, int y) {
216   // This line tests symbolication with compound assignments where the
217   // LHS and RHS have different bitwidths.  The new symbolic value
218   // for 'x' should have a bitwidth of 8.
219   x &= y;
220 
221   // This tests that our symbolication worked, and that we correctly test
222   // x against 0 (with the same bitwidth).
223   if (!x) {
224     if (!p) return 0;
225     *p = 10;
226   }
227   else p = 0;
228 
229   if (!x)
230     *p = 5; // no-warning
231 
232   return p;
233 }
234 
f11(unsigned i)235 void f11(unsigned i) {
236   int *x = 0;
237   if (i >= 0) { // expected-warning{{always true}}
238     // always true
239   } else {
240     *x = 42; // no-warning
241   }
242 }
243 
f11b(unsigned i)244 void f11b(unsigned i) {
245   int *x = 0;
246   if (i <= ~(unsigned)0) {
247     // always true
248   } else {
249     *x = 42; // no-warning
250   }
251 }
252 
253 // Test case for switch statements with weird case arms.
254 typedef int     BOOL, *PBOOL, *LPBOOL;
255 typedef long    LONG_PTR, *PLONG_PTR;
256 typedef unsigned long ULONG_PTR, *PULONG_PTR;
257 typedef ULONG_PTR DWORD_PTR, *PDWORD_PTR;
258 typedef LONG_PTR LRESULT;
259 typedef struct _F12ITEM *HF12ITEM;
260 
f12(HF12ITEM i,char * q)261 void f12(HF12ITEM i, char *q) {
262   char *p = 0;
263   switch ((DWORD_PTR) i) {
264   case 0 ... 10:
265     p = q;
266     break;
267   case (DWORD_PTR) ((HF12ITEM) - 65535):
268     return;
269   default:
270     return;
271   }
272 
273   *p = 1; // no-warning
274 }
275 
276 // Test handling of translating between integer "pointers" and back.
f13(void)277 void f13(void) {
278   int *x = 0;
279   if (((((int) x) << 2) + 1) >> 1) *x = 1;
280 }
281 
282 // PR 4759 - Attribute non-null checking by the analyzer was not correctly
283 // handling pointer values that were undefined.
284 void pr4759_aux(int *p) __attribute__((nonnull));
285 
pr4759(void)286 void pr4759(void) {
287   int *p;
288   pr4759_aux(p); // expected-warning{{1st function call argument is an uninitialized value}}
289 }
290 
291 // Relax function call arguments invalidation to be aware of const
292 // arguments. Test with function pointers.
293 void ttt(const int *nptr);
294 void ttt2(const int *nptr);
295 typedef void (*NoConstType)(int*);
foo10595327(int b)296 int foo10595327(int b) {
297   void (*fp)(int *);
298   // We use path sensitivity to get the function declaration. Even when the
299   // function pointer is cast to non-pointer-to-const parameter type, we can
300   // find the right function declaration.
301   if (b > 5)
302     fp = (NoConstType)ttt2;
303   else
304     fp = (NoConstType)ttt;
305   int x = 3;
306   int y = x + 1;
307   int *p = 0;
308   fp(&y);
309   if (x == y)
310       return *p; // no-warning
311   return 0;
312 }
313 
314 #define AS_ATTRIBUTE volatile __attribute__((address_space(256)))
315 #define _get_base() ((void * AS_ATTRIBUTE *)0)
test_address_space_array(unsigned long slot)316 void* test_address_space_array(unsigned long slot) {
317   return _get_base()[slot]; // no-warning
318 }
test_address_space_condition(int AS_ATTRIBUTE * cpu_data)319 void test_address_space_condition(int AS_ATTRIBUTE *cpu_data) {
320    if (cpu_data == 0) {
321     *cpu_data = 3; // no-warning
322   }
323 }
324 struct X { int member; };
test_address_space_member(void)325 int test_address_space_member(void) {
326   struct X AS_ATTRIBUTE *data = (struct X AS_ATTRIBUTE *)0UL;
327   int ret;
328   ret = data->member; // no-warning
329   return ret;
330 }
331