1*f4a2713aSLionel Sambuc // RUN: %clang_cc1 -verify -analyze -analyzer-checker=core,alpha.security.ArrayBound -analyzer-store=region %s 2*f4a2713aSLionel Sambuc 3*f4a2713aSLionel Sambuc struct tea_cheese { unsigned magic; }; 4*f4a2713aSLionel Sambuc typedef struct tea_cheese kernel_tea_cheese_t; 5*f4a2713aSLionel Sambuc extern kernel_tea_cheese_t _wonky_gesticulate_cheese; 6*f4a2713aSLionel Sambuc 7*f4a2713aSLionel Sambuc // This test case exercises the ElementRegion::getRValueType() logic. 8*f4a2713aSLionel Sambuc test1(void)9*f4a2713aSLionel Sambucvoid test1( void ) { 10*f4a2713aSLionel Sambuc kernel_tea_cheese_t *wonky = &_wonky_gesticulate_cheese; 11*f4a2713aSLionel Sambuc struct load_wine *cmd = (void*) &wonky[1]; 12*f4a2713aSLionel Sambuc cmd = cmd; 13*f4a2713aSLionel Sambuc char *p = (void*) &wonky[1]; 14*f4a2713aSLionel Sambuc kernel_tea_cheese_t *q = &wonky[1]; 15*f4a2713aSLionel Sambuc // This test case tests both the RegionStore logic (doesn't crash) and 16*f4a2713aSLionel Sambuc // the out-of-bounds checking. We don't expect the warning for now since 17*f4a2713aSLionel Sambuc // out-of-bound checking is temporarily disabled. 18*f4a2713aSLionel Sambuc kernel_tea_cheese_t r = *q; // expected-warning{{Access out-of-bound array element (buffer overflow)}} 19*f4a2713aSLionel Sambuc } 20*f4a2713aSLionel Sambuc test1_b(void)21*f4a2713aSLionel Sambucvoid test1_b( void ) { 22*f4a2713aSLionel Sambuc kernel_tea_cheese_t *wonky = &_wonky_gesticulate_cheese; 23*f4a2713aSLionel Sambuc struct load_wine *cmd = (void*) &wonky[1]; 24*f4a2713aSLionel Sambuc cmd = cmd; 25*f4a2713aSLionel Sambuc char *p = (void*) &wonky[1]; 26*f4a2713aSLionel Sambuc *p = 1; // expected-warning{{Access out-of-bound array element (buffer overflow)}} 27*f4a2713aSLionel Sambuc } 28