1 // RUN: %clang_analyze_cc1 -verify %s \ 2 // RUN: -analyzer-checker=core,apiModeling \ 3 // RUN: -analyzer-output=text 4 5 #define NULL ((void *)0) 6 7 char *getenv(const char *); 8 int isalpha(int); 9 int isdigit(int); 10 int islower(int); 11 12 char test_getenv() { 13 char *env = getenv("VAR"); // \ 14 // expected-note{{Assuming the environment variable does not exist}} \ 15 // expected-note{{'env' initialized here}} 16 17 return env[0]; // \ 18 // expected-warning{{Array access (from variable 'env') results in a null pointer dereference}} \ 19 // expected-note {{Array access (from variable 'env') results in a null pointer dereference}} 20 } 21 22 int test_isalpha(int *x, char c) { 23 if (isalpha(c)) {// \ 24 // expected-note{{Assuming the character is alphabetical}} \ 25 // expected-note{{Taking true branch}} 26 x = NULL; // \ 27 // expected-note{{Null pointer value stored to 'x'}} 28 } 29 30 return *x; // \ 31 // expected-warning{{Dereference of null pointer (loaded from variable 'x')}} \ 32 // expected-note {{Dereference of null pointer (loaded from variable 'x')}} 33 } 34 35 int test_isdigit(int *x, char c) { 36 if (!isdigit(c)) {// \ 37 // expected-note{{Assuming the character is not a digit}} \ 38 // expected-note{{Taking true branch}} 39 x = NULL; // \ 40 // expected-note{{Null pointer value stored to 'x'}} 41 } 42 43 return *x; // \ 44 // expected-warning{{Dereference of null pointer (loaded from variable 'x')}} \ 45 // expected-note {{Dereference of null pointer (loaded from variable 'x')}} 46 } 47 48 int test_islower(int *x) { 49 char c = 'c'; 50 // No "Assuming..." note. We aren't assuming anything. We *know*. 51 if (islower(c)) { // \ 52 // expected-note{{Taking true branch}} 53 x = NULL; // \ 54 // expected-note{{Null pointer value stored to 'x'}} 55 } 56 57 return *x; // \ 58 // expected-warning{{Dereference of null pointer (loaded from variable 'x')}} \ 59 // expected-note {{Dereference of null pointer (loaded from variable 'x')}} 60 } 61