xref: /llvm-project/clang/test/Analysis/free.cpp (revision 893a303962608469ec5bd01fe44e82c935152e9c) 
1 // RUN: %clang_analyze_cc1 -fblocks -verify %s \
2 // RUN:   -analyzer-checker=core \
3 // RUN:   -analyzer-checker=unix.Malloc
4 //
5 // RUN: %clang_analyze_cc1 -fblocks -verify %s \
6 // RUN:   -analyzer-checker=core \
7 // RUN:   -analyzer-checker=unix.Malloc \
8 // RUN:   -analyzer-config unix.DynamicMemoryModeling:Optimistic=true
9 namespace std {
10   using size_t = decltype(sizeof(int));
11   void free(void *);
12 }
13 
14 extern "C" void free(void *);
15 extern "C" void *alloca(std::size_t);
16 
17 void t1a () {
18   int a[] = { 1 };
19   free(a);
20   // expected-warning@-1{{Argument to 'free()' is the address of the local variable 'a', which is not memory allocated by 'malloc()'}}
21   // expected-warning@-2{{attempt to call free on non-heap object 'a'}}
22 }
23 
24 void t1b () {
25   int a[] = { 1 };
26   std::free(a);
27   // expected-warning@-1{{Argument to 'free()' is the address of the local variable 'a', which is not memory allocated by 'malloc()'}}
28   // expected-warning@-2{{attempt to call std::free on non-heap object 'a'}}
29 }
30 
31 void t2a () {
32   int a = 1;
33   free(&a);
34   // expected-warning@-1{{Argument to 'free()' is the address of the local variable 'a', which is not memory allocated by 'malloc()'}}
35   // expected-warning@-2{{attempt to call free on non-heap object 'a'}}
36 }
37 
38 void t2b () {
39   int a = 1;
40   std::free(&a);
41   // expected-warning@-1{{Argument to 'free()' is the address of the local variable 'a', which is not memory allocated by 'malloc()'}}
42   // expected-warning@-2{{attempt to call std::free on non-heap object 'a'}}
43 }
44 
45 void t3a () {
46   static int a[] = { 1 };
47   free(a);
48   // expected-warning@-1{{Argument to 'free()' is the address of the static variable 'a', which is not memory allocated by 'malloc()'}}
49   // expected-warning@-2{{attempt to call free on non-heap object 'a'}}
50 }
51 
52 void t3b () {
53   static int a[] = { 1 };
54   std::free(a);
55   // expected-warning@-1{{Argument to 'free()' is the address of the static variable 'a', which is not memory allocated by 'malloc()'}}
56   // expected-warning@-2{{attempt to call std::free on non-heap object 'a'}}
57 }
58 
59 void t4a (char *x) {
60   free(x); // no-warning
61 }
62 
63 void t4b (char *x) {
64   std::free(x); // no-warning
65 }
66 
67 void t5a () {
68   extern char *ptr();
69   free(ptr()); // no-warning
70 }
71 
72 void t5b () {
73   extern char *ptr();
74   std::free(ptr()); // no-warning
75 }
76 
77 void t6a () {
78   free((void*)1000);
79   // expected-warning@-1{{Argument to 'free()' is a constant address (1000), which is not memory allocated by 'malloc()'}}
80   // expected-warning@-2{{attempt to call free on non-heap object '(void *)1000'}}
81 }
82 
83 void t6b () {
84   std::free((void*)1000);
85   // expected-warning@-1{{Argument to 'free()' is a constant address (1000), which is not memory allocated by 'malloc()'}}
86   // expected-warning@-2{{attempt to call std::free on non-heap object '(void *)1000'}}
87 }
88 
89 void t7a (char **x) {
90   free(*x); // no-warning
91 }
92 
93 void t7b (char **x) {
94   std::free(*x); // no-warning
95 }
96 
97 void t8a (char **x) {
98   // ugh
99   free((*x)+8); // no-warning
100 }
101 
102 void t8b (char **x) {
103   // ugh
104   std::free((*x)+8); // no-warning
105 }
106 
107 void t9a () {
108 label:
109   free(&&label);
110   // expected-warning@-1{{Argument to 'free()' is the address of the label 'label', which is not memory allocated by 'malloc()'}}
111   // expected-warning@-2{{attempt to call free on non-heap object 'label'}}
112 }
113 
114 void t9b () {
115 label:
116   std::free(&&label);
117   // expected-warning@-1{{Argument to 'free()' is the address of the label 'label', which is not memory allocated by 'malloc()'}}
118   // expected-warning@-2{{attempt to call std::free on non-heap object 'label'}}
119 }
120 
121 void t10a () {
122   free((void*)&t10a);
123   // expected-warning@-1{{Argument to 'free()' is the address of the function 't10a', which is not memory allocated by 'malloc()'}}
124   // expected-warning@-2{{attempt to call free on non-heap object 't10a'}}
125 }
126 
127 void t10b () {
128   std::free((void*)&t10b);
129   // expected-warning@-1{{Argument to 'free()' is the address of the function 't10b', which is not memory allocated by 'malloc()'}}
130   // expected-warning@-2{{attempt to call std::free on non-heap object 't10b'}}
131 }
132 
133 void t11a () {
134   char *p = (char*)alloca(2);
135   free(p); // expected-warning {{Memory allocated by 'alloca()' should not be deallocated}}
136 }
137 
138 void t11b () {
139   char *p = (char*)alloca(2);
140   std::free(p); // expected-warning {{Memory allocated by 'alloca()' should not be deallocated}}
141 }
142 
143 void t12a () {
144   char *p = (char*)__builtin_alloca(2);
145   free(p); // expected-warning {{Memory allocated by 'alloca()' should not be deallocated}}
146 }
147 
148 void t12b () {
149   char *p = (char*)__builtin_alloca(2);
150   std::free(p); // expected-warning {{Memory allocated by 'alloca()' should not be deallocated}}
151 }
152 
153 void t13a () {
154   free(^{return;});
155   // expected-warning@-1{{Argument to 'free()' is a block, which is not memory allocated by 'malloc()'}}
156   // expected-warning@-2{{attempt to call free on non-heap object: block expression}}
157 }
158 
159 void t13b () {
160   std::free(^{return;});
161   // expected-warning@-1{{Argument to 'free()' is a block, which is not memory allocated by 'malloc()'}}
162   // expected-warning@-2{{attempt to call std::free on non-heap object: block expression}}
163 }
164 
165 void t14a () {
166   free((void *)+[]{ return; });
167   // expected-warning@-1{{Argument to 'free()' is the address of the function '__invoke', which is not memory allocated by 'malloc()'}}
168   // expected-warning@-2{{attempt to call free on non-heap object: lambda-to-function-pointer conversion}}
169 }
170 
171 void t14b () {
172   std::free((void *)+[]{ return; });
173   // expected-warning@-1{{Argument to 'free()' is the address of the function '__invoke', which is not memory allocated by 'malloc()'}}
174   // expected-warning@-2{{attempt to call std::free on non-heap object: lambda-to-function-pointer conversion}}
175 }
176 
177 void t15a (char a) {
178   free(&a);
179   // expected-warning@-1{{Argument to 'free()' is the address of the parameter 'a', which is not memory allocated by 'malloc()'}}
180   // expected-warning@-2{{attempt to call free on non-heap object 'a'}}
181 }
182 
183 void t15b (char a) {
184   std::free(&a);
185   // expected-warning@-1{{Argument to 'free()' is the address of the parameter 'a', which is not memory allocated by 'malloc()'}}
186   // expected-warning@-2{{attempt to call std::free on non-heap object 'a'}}
187 }
188 
189 static int someGlobal[2];
190 void t16a () {
191   free(someGlobal);
192   // expected-warning@-1{{Argument to 'free()' is the address of the global variable 'someGlobal', which is not memory allocated by 'malloc()'}}
193   // expected-warning@-2{{attempt to call free on non-heap object 'someGlobal'}}
194 }
195 
196 void t16b () {
197   std::free(someGlobal);
198   // expected-warning@-1{{Argument to 'free()' is the address of the global variable 'someGlobal', which is not memory allocated by 'malloc()'}}
199   // expected-warning@-2{{attempt to call std::free on non-heap object 'someGlobal'}}
200 }
201 
202 void t17a (char **x, int offset) {
203   // Unknown value
204   free(x[offset]); // no-warning
205 }
206 
207 void t17b (char **x, int offset) {
208   // Unknown value
209   std::free(x[offset]); // no-warning
210 }
211 
212 struct S {
213   const char* p;
214 };
215 
216 void t18_C_style_C_style_free (S s) {
217   free((void*)(unsigned long long)s.p); // no warning
218 }
219 
220 void t18_C_style_C_style_std_free (S s) {
221   std::free((void*)(unsigned long long)s.p); // no warning
222 }
223 
224 void t18_C_style_reinterpret_free (S s) {
225   free((void*)reinterpret_cast<unsigned long long>(s.p)); // no warning
226 }
227 
228 void t18_C_style_reinterpret_std_free (S s) {
229   std::free((void*)reinterpret_cast<unsigned long long>(s.p)); // no warning
230 }
231 
232 void t18_reinterpret_C_style_free (S s) {
233   free(reinterpret_cast<void*>((unsigned long long)(s.p))); // no warning
234 }
235 
236 void t18_reinterpret_C_style_std_free (S s) {
237   std::free(reinterpret_cast<void*>((unsigned long long)(s.p))); // no warning
238 }
239 
240 void t18_reinterpret_reinterpret_free (S s) {
241   free(reinterpret_cast<void*>(reinterpret_cast<unsigned long long>(s.p))); // no warning
242 }
243 
244 void t18_reinterpret_reinterpret_std_free (S s) {
245   std::free(reinterpret_cast<void*>(reinterpret_cast<unsigned long long>(s.p))); // no warning
246 }
247