1 // RUN: %clang_analyze_cc1 -verify %s \ 2 // RUN: -analyzer-checker=core,alpha.unix.StdCLibraryFunctions \ 3 // RUN: -analyzer-config alpha.unix.StdCLibraryFunctions:ModelPOSIX=true \ 4 // RUN: -analyzer-output=text 5 6 #include "Inputs/std-c-library-functions-POSIX.h" 7 #define NULL ((void *)0) 8 9 char *getenv(const char *); 10 int isalpha(int); 11 int isdigit(int); 12 int islower(int); 13 14 char test_getenv() { 15 char *env = getenv("VAR"); // \ 16 // expected-note{{Assuming the environment variable does not exist}} \ 17 // expected-note{{'env' initialized here}} 18 19 return env[0]; // \ 20 // expected-warning{{Array access (from variable 'env') results in a null pointer dereference}} \ 21 // expected-note {{Array access (from variable 'env') results in a null pointer dereference}} 22 } 23 24 int test_isalpha(int *x, char c, char d) { 25 int iad = isalpha(d);// \ 26 // expected-note{{Assuming the character is non-alphabetical}} 27 if (isalpha(c)) {// \ 28 // expected-note{{Taking true branch}} \ 29 // expected-note{{Assuming the character is alphabetical}} 30 x = NULL; // \ 31 // expected-note{{Null pointer value stored to 'x'}} 32 } 33 34 return *x; // \ 35 // expected-warning{{Dereference of null pointer (loaded from variable 'x')}} \ 36 // expected-note {{Dereference of null pointer (loaded from variable 'x')}} 37 } 38 39 int test_isdigit(int *x, char c) { 40 if (!isdigit(c)) {// \ 41 // expected-note{{Assuming the character is not a digit}} \ 42 // expected-note{{Taking true branch}} 43 x = NULL; // \ 44 // expected-note{{Null pointer value stored to 'x'}} 45 } 46 47 return *x; // \ 48 // expected-warning{{Dereference of null pointer (loaded from variable 'x')}} \ 49 // expected-note {{Dereference of null pointer (loaded from variable 'x')}} 50 } 51 52 int test_islower(int *x) { 53 char c = 'c'; 54 // No "Assuming..." note. We aren't assuming anything. We *know*. 55 if (islower(c)) { // \ 56 // expected-note{{Taking true branch}} 57 x = NULL; // \ 58 // expected-note{{Null pointer value stored to 'x'}} 59 } 60 61 return *x; // \ 62 // expected-warning{{Dereference of null pointer (loaded from variable 'x')}} \ 63 // expected-note {{Dereference of null pointer (loaded from variable 'x')}} 64 } 65 66 int test_bugpath_notes(FILE *f1, char c, FILE *f2) { 67 int f = fileno(f2); // \ 68 // expected-note{{Assuming that 'fileno' is successful}} 69 if (f == -1) // \ 70 // expected-note{{Taking false branch}} 71 return 0; 72 int l = islower(c); 73 f = fileno(f1); // \ 74 // expected-note{{Value assigned to 'f'}} \ 75 // expected-note{{Assuming that 'fileno' fails}} 76 return dup(f); // \ 77 // expected-warning{{The 1st argument to 'dup' is -1 but should be >= 0}} \ 78 // expected-note{{The 1st argument to 'dup' is -1 but should be >= 0}} 79 } 80