1 // RUN: %clang_analyze_cc1 -verify %s -std=gnu99 \
2 // RUN: -analyzer-checker=core \
3 // RUN: -analyzer-checker=alpha.core \
4 // RUN: -analyzer-checker=unix \
5 // RUN: -analyzer-checker=alpha.unix
6
7 #include "Inputs/system-header-simulator.h"
8
9 typedef __typeof(sizeof(int)) size_t;
10 void *memset(void *__s, int __c, size_t __n);
11 void *malloc(size_t __size);
12 void free(void *__ptr);
13
14 // The store for 'a[1]' should not be removed mistakenly. SymbolicRegions may
15 // also be live roots.
f14(int * a)16 void f14(int *a) {
17 int i;
18 a[1] = 1;
19 i = a[1];
20 if (i != 1) {
21 int *p = 0;
22 i = *p; // no-warning
23 }
24 }
25
foo(void)26 void foo(void) {
27 int *x = malloc(sizeof(int));
28 memset(x, 0, sizeof(int));
29 int n = 1 / *x; // expected-warning {{Division by zero}}
30 free(x);
31 }
32
bar(void)33 void bar(void) {
34 int *x = malloc(sizeof(int));
35 memset(x, 0, 1);
36 int n = 1 / *x; // no-warning
37 free(x);
38 }
39
testConcreteNull(void)40 void testConcreteNull(void) {
41 int *x = 0;
42 memset(x, 0, 1); // expected-warning {{Null pointer passed as 1st argument to memory set function}}
43 }
44
testStackArray(void)45 void testStackArray(void) {
46 char buf[13];
47 memset(buf, 0, 1); // no-warning
48 }
49
testHeapSymbol(void)50 void testHeapSymbol(void) {
51 char *buf = (char *)malloc(13);
52 memset(buf, 0, 1); // no-warning
53 free(buf);
54 }
55
testStackArrayOutOfBound(void)56 void testStackArrayOutOfBound(void) {
57 char buf[1];
58 memset(buf, 0, 1024);
59 // expected-warning@-1 {{Memory set function overflows the destination buffer}}
60 // expected-warning@-2 {{'memset' will always overflow; destination buffer has size 1, but size argument is 1024}}
61 }
62
testHeapSymbolOutOfBound(void)63 void testHeapSymbolOutOfBound(void) {
64 char *buf = (char *)malloc(1);
65 memset(buf, 0, 1024);
66 // expected-warning@-1 {{Memory set function overflows the destination buffer}}
67 free(buf);
68 }
69
testStackArraySameSize(void)70 void testStackArraySameSize(void) {
71 char buf[1];
72 memset(buf, 0, sizeof(buf)); // no-warning
73 }
74
testHeapSymbolSameSize(void)75 void testHeapSymbolSameSize(void) {
76 char *buf = (char *)malloc(1);
77 memset(buf, 0, 1); // no-warning
78 free(buf);
79 }
80