diff options
Diffstat (limited to 'clang/test/Analysis/misc-ps-region-store.m')
| -rw-r--r-- | clang/test/Analysis/misc-ps-region-store.m | 1343 |
1 files changed, 1343 insertions, 0 deletions
diff --git a/clang/test/Analysis/misc-ps-region-store.m b/clang/test/Analysis/misc-ps-region-store.m new file mode 100644 index 0000000..d263d4d --- /dev/null +++ b/clang/test/Analysis/misc-ps-region-store.m @@ -0,0 +1,1343 @@ +// RUN: %clang_cc1 -triple i386-apple-darwin9 -analyze -analyzer-checker=core,experimental.deadcode.IdempotentOperations,experimental.core.CastToStruct,experimental.security.ReturnPtrRange,experimental.security.ArrayBound -analyzer-store=region -verify -fblocks -analyzer-opt-analyze-nested-blocks -Wno-objc-root-class %s +// RUN: %clang_cc1 -triple x86_64-apple-darwin9 -DTEST_64 -analyze -analyzer-checker=core,experimental.deadcode.IdempotentOperations,experimental.core.CastToStruct,experimental.security.ReturnPtrRange,experimental.security.ArrayBound -analyzer-store=region -verify -fblocks -analyzer-opt-analyze-nested-blocks -Wno-objc-root-class %s + +typedef long unsigned int size_t; +void *memcpy(void *, const void *, size_t); +void *alloca(size_t); + +typedef struct objc_selector *SEL; +typedef signed char BOOL; +typedef int NSInteger; +typedef unsigned int NSUInteger; +typedef struct _NSZone NSZone; +@class NSInvocation, NSMethodSignature, NSCoder, NSString, NSEnumerator; +@protocol NSObject - (BOOL)isEqual:(id)object; @end +@protocol NSCopying - (id)copyWithZone:(NSZone *)zone; @end +@protocol NSMutableCopying - (id)mutableCopyWithZone:(NSZone *)zone; @end +@protocol NSCoding - (void)encodeWithCoder:(NSCoder *)aCoder; @end +@interface NSObject <NSObject> {} - (id)init; @end +extern id NSAllocateObject(Class aClass, NSUInteger extraBytes, NSZone *zone); +@interface NSString : NSObject <NSCopying, NSMutableCopying, NSCoding> +- (NSUInteger)length; ++ (id)stringWithUTF8String:(const char *)nullTerminatedCString; +@end extern NSString * const NSBundleDidLoadNotification; +@interface NSAssertionHandler : NSObject {} ++ (NSAssertionHandler *)currentHandler; +- (void)handleFailureInMethod:(SEL)selector object:(id)object file:(NSString *)fileName lineNumber:(NSInteger)line description:(NSString *)format,...; +@end +extern NSString * const NSConnectionReplyMode; + +#ifdef TEST_64 +typedef long long int64_t; +typedef int64_t intptr_t; +#else +typedef int int32_t; +typedef int32_t intptr_t; +#endif + +//--------------------------------------------------------------------------- +// Test case 'checkaccess_union' differs for region store and basic store. +// The basic store doesn't reason about compound literals, so the code +// below won't fire an "uninitialized value" warning. +//--------------------------------------------------------------------------- + +// PR 2948 (testcase; crash on VisitLValue for union types) +// http://llvm.org/bugs/show_bug.cgi?id=2948 +void checkaccess_union() { + int ret = 0, status; + // Since RegionStore doesn't handle unions yet, + // this branch condition won't be triggered + // as involving an uninitialized value. + if (((((__extension__ (((union { // no-warning + __typeof (status) __in; int __i;} + ) + { + .__in = (status)} + ).__i))) & 0xff00) >> 8) == 1) + ret = 1; +} + +// Check our handling of fields being invalidated by function calls. +struct test2_struct { int x; int y; char* s; }; +void test2_help(struct test2_struct* p); + +char test2() { + struct test2_struct s; + test2_help(&s); + char *p = 0; + + if (s.x > 1) { + if (s.s != 0) { + p = "hello"; + } + } + + if (s.x > 1) { + if (s.s != 0) { + return *p; + } + } + + return 'a'; +} + +// BasicStore handles this case incorrectly because it doesn't reason about +// the value pointed to by 'x' and thus creates different symbolic values +// at the declarations of 'a' and 'b' respectively. RegionStore handles +// it correctly. See the companion test in 'misc-ps-basic-store.m'. +void test_trivial_symbolic_comparison_pointer_parameter(int *x) { + int a = *x; + int b = *x; + if (a != b) { + int *p = 0; + *p = 0xDEADBEEF; // no-warning + } +} + +// This is a modified test from 'misc-ps.m'. Here we have the extra +// NULL dereferences which are pruned out by RegionStore's symbolic reasoning +// of fields. +typedef struct _BStruct { void *grue; } BStruct; +void testB_aux(void *ptr); + +void testB(BStruct *b) { + { + int *__gruep__ = ((int *)&((b)->grue)); + int __gruev__ = *__gruep__; + int __gruev2__ = *__gruep__; + if (__gruev__ != __gruev2__) { + int *p = 0; + *p = 0xDEADBEEF; // no-warning + } + + testB_aux(__gruep__); + } + { + int *__gruep__ = ((int *)&((b)->grue)); + int __gruev__ = *__gruep__; + int __gruev2__ = *__gruep__; + if (__gruev__ != __gruev2__) { + int *p = 0; + *p = 0xDEADBEEF; // no-warning + } + + if (~0 != __gruev__) {} + } +} + +void testB_2(BStruct *b) { + { + int **__gruep__ = ((int **)&((b)->grue)); + int *__gruev__ = *__gruep__; + testB_aux(__gruep__); + } + { + int **__gruep__ = ((int **)&((b)->grue)); + int *__gruev__ = *__gruep__; + if ((int*)~0 != __gruev__) {} + } +} + +// This test case is a reduced case of a caching bug discovered by an +// assertion failure in RegionStoreManager::BindArray. Essentially the +// DeclStmt is evaluated twice, but on the second loop iteration the +// engine caches out. Previously a false transition would cause UnknownVal +// to bind to the variable, firing an assertion failure. This bug was fixed +// in r76262. +void test_declstmt_caching() { +again: + { + const char a[] = "I like to crash"; + goto again; + } +} + +//===----------------------------------------------------------------------===// +// Reduced test case from <rdar://problem/7114618>. +// Basically a null check is performed on the field value, which is then +// assigned to a variable and then checked again. +//===----------------------------------------------------------------------===// +struct s_7114618 { int *p; }; +void test_rdar_7114618(struct s_7114618 *s) { + if (s->p) { + int *p = s->p; + if (!p) { + // Infeasible + int *dead = 0; + *dead = 0xDEADBEEF; // no-warning + } + } +} + +// Test pointers increment correctly. +void f() { + int a[2]; + a[1] = 3; + int *p = a; + p++; + if (*p != 3) { + int *q = 0; + *q = 3; // no-warning + } +} + +//===----------------------------------------------------------------------===// +// <rdar://problem/7185607> +// Bit-fields of a struct should be invalidated when blasting the entire +// struct with an integer constant. +//===----------------------------------------------------------------------===// +struct test_7185607 { + int x : 10; + int y : 22; +}; +int rdar_test_7185607() { + struct test_7185607 s; // Uninitialized. + *((unsigned *) &s) = 0U; + return s.x; // no-warning +} + +//===----------------------------------------------------------------------===// +// <rdar://problem/7242006> [RegionStore] compound literal assignment with +// floats not honored +// This test case is mirrored in misc-ps.m, but this case is a negative. +//===----------------------------------------------------------------------===// +typedef float CGFloat; +typedef struct _NSSize { + CGFloat width; + CGFloat height; +} NSSize; + +CGFloat rdar7242006_negative(CGFloat x) { + NSSize y; + return y.width; // expected-warning{{garbage}} +} + +//===----------------------------------------------------------------------===// +// <rdar://problem/7249340> - Allow binding of values to symbolic regions. +// This test case shows how RegionStore tracks the value bound to 'x' +// after the assignment. +//===----------------------------------------------------------------------===// +typedef int* ptr_rdar_7249340; +void rdar_7249340(ptr_rdar_7249340 x) { + *x = 1; + if (*x) + return; + int *p = 0; // This is unreachable. + *p = 0xDEADBEEF; // no-warning +} + +//===----------------------------------------------------------------------===// +// <rdar://problem/7249327> - This test case tests both value tracking of +// array values and that we handle symbolic values that are casted +// between different integer types. Note the assignment 'n = *a++'; here +// 'n' is and 'int' and '*a' is 'unsigned'. Previously we got a false positive +// at 'x += *b++' (undefined value) because we got a false path. +//===----------------------------------------------------------------------===// +int rdar_7249327_aux(void); + +void rdar_7249327(unsigned int A[2*32]) { + int B[2*32]; + int *b; + unsigned int *a; + int x = 0; + + int n; + + a = A; + b = B; + + n = *a++; + if (n) + *b++ = rdar_7249327_aux(); + + a = A; + b = B; + + n = *a++; // expected-warning{{Assigned value is always the same as the existing value}} + if (n) + x += *b++; // no-warning +} + +//===----------------------------------------------------------------------===// +// <rdar://problem/6914474> - Check that 'x' is invalidated because its +// address is passed in as a value to a struct. +//===----------------------------------------------------------------------===// +struct doodad_6914474 { int *v; }; +extern void prod_6914474(struct doodad_6914474 *d); +int rdar_6914474(void) { + int x; + struct doodad_6914474 d; + d.v = &x; + prod_6914474(&d); + return x; // no-warning +} + +// Test invalidation of a single field. +struct s_test_field_invalidate { + int x; +}; +extern void test_invalidate_field(int *x); +int test_invalidate_field_test() { + struct s_test_field_invalidate y; + test_invalidate_field(&y.x); + return y.x; // no-warning +} +int test_invalidate_field_test_positive() { + struct s_test_field_invalidate y; + return y.x; // expected-warning{{garbage}} +} + +// This test case illustrates how a typeless array of bytes casted to a +// struct should be treated as initialized. RemoveDeadBindings previously +// had a bug that caused 'x' to lose its default symbolic value after the +// assignment to 'p', thus causing 'p->z' to evaluate to "undefined". +struct ArrayWrapper { unsigned char y[16]; }; +struct WrappedStruct { unsigned z; }; + +void test_handle_array_wrapper_helper(); + +int test_handle_array_wrapper() { + struct ArrayWrapper x; + test_handle_array_wrapper_helper(&x); + struct WrappedStruct *p = (struct WrappedStruct*) x.y; // expected-warning{{Casting a non-structure type to a structure type and accessing a field can lead to memory access errors or data corruption.}} + return p->z; // no-warning +} + +//===----------------------------------------------------------------------===// +// <rdar://problem/7261075> [RegionStore] crash when +// handling load: '*((unsigned int *)"????")' +//===----------------------------------------------------------------------===// + +int rdar_7261075(void) { + unsigned int var = 0; + if (var == *((unsigned int *)"????")) + return 1; + return 0; +} + +//===----------------------------------------------------------------------===// +// <rdar://problem/7275774> false path due to limited pointer +// arithmetic constraints +//===----------------------------------------------------------------------===// + +void rdar_7275774(void *data, unsigned n) { + if (!(data || n == 0)) + return; + + unsigned short *p = (unsigned short*) data; + unsigned short *q = p + (n / 2); + + if (p < q) { + // If we reach here, 'p' cannot be null. If 'p' is null, then 'n' must + // be '0', meaning that this branch is not feasible. + *p = *q; // no-warning + } +} + +//===----------------------------------------------------------------------===// +// <rdar://problem/7312221> +// +// Test that Objective-C instance variables aren't prematurely pruned +// from the analysis state. +//===----------------------------------------------------------------------===// + +struct rdar_7312221_value { int x; }; + +@interface RDar7312221 +{ + struct rdar_7312221_value *y; +} +- (void) doSomething_7312221; +@end + +extern struct rdar_7312221_value *rdar_7312221_helper(); +extern int rdar_7312221_helper_2(id o); +extern void rdar_7312221_helper_3(int z); + +@implementation RDar7312221 +- (void) doSomething_7312221 { + if (y == 0) { + y = rdar_7312221_helper(); + if (y != 0) { + y->x = rdar_7312221_helper_2(self); + // The following use of 'y->x' previously triggered a null dereference, as the value of 'y' + // before 'y = rdar_7312221_helper()' would be used. + rdar_7312221_helper_3(y->x); // no-warning + } + } +} +@end + +struct rdar_7312221_container { + struct rdar_7312221_value *y; +}; + +extern int rdar_7312221_helper_4(struct rdar_7312221_container *s); + +// This test case essentially matches the one in [RDar7312221 doSomething_7312221]. +void doSomething_7312221_with_struct(struct rdar_7312221_container *Self) { + if (Self->y == 0) { + Self->y = rdar_7312221_helper(); + if (Self->y != 0) { + Self->y->x = rdar_7312221_helper_4(Self); + rdar_7312221_helper_3(Self->y->x); // no-warning + } + } +} + +//===----------------------------------------------------------------------===// +// <rdar://problem/7332673> - Just more tests cases for regions +//===----------------------------------------------------------------------===// + +void rdar_7332673_test1() { + char value[1]; + if ( *(value) != 1 ) {} // expected-warning{{The left operand of '!=' is a garbage value}} +} +int rdar_7332673_test2_aux(char *x); +void rdar_7332673_test2() { + char *value; + if ( rdar_7332673_test2_aux(value) != 1 ) {} // expected-warning{{Function call argument is an uninitialized value}} +} + +//===----------------------------------------------------------------------===// +// <rdar://problem/7347252>: Because of a bug in +// RegionStoreManager::RemoveDeadBindings(), the symbol for s->session->p +// would incorrectly be pruned from the state after the call to +// rdar7347252_malloc1(), and would incorrectly result in a warning about +// passing a null pointer to rdar7347252_memcpy(). +//===----------------------------------------------------------------------===// + +struct rdar7347252_AA { char *p;}; +typedef struct { + struct rdar7347252_AA *session; + int t; + char *q; +} rdar7347252_SSL1; + +int rdar7347252_f(rdar7347252_SSL1 *s); +char *rdar7347252_malloc1(int); +char *rdar7347252_memcpy1(char *d, char *s, int n) __attribute__((nonnull (1,2))); + +int rdar7347252(rdar7347252_SSL1 *s) { + rdar7347252_f(s); // the SymbolicRegion of 's' is set a default binding of conjured symbol + if (s->session->p == ((void*)0)) { + if ((s->session->p = rdar7347252_malloc1(10)) == ((void*)0)) { + return 0; + } + rdar7347252_memcpy1(s->session->p, "aa", 2); // no-warning + } + return 0; +} + +//===----------------------------------------------------------------------===// +// PR 5316 - "crash when accessing field of lazy compound value" +// Previously this caused a crash at the MemberExpr '.chr' when loading +// a field value from a LazyCompoundVal +//===----------------------------------------------------------------------===// + +typedef unsigned int pr5316_wint_t; +typedef pr5316_wint_t pr5316_REFRESH_CHAR; +typedef struct { + pr5316_REFRESH_CHAR chr; +} +pr5316_REFRESH_ELEMENT; +static void pr5316(pr5316_REFRESH_ELEMENT *dst, const pr5316_REFRESH_ELEMENT *src) { + while ((*dst++ = *src++).chr != L'\0') ; +} + +//===----------------------------------------------------------------------===// +// Exercise creating ElementRegion with symbolic super region. +//===----------------------------------------------------------------------===// +void element_region_with_symbolic_superregion(int* p) { + int *x; + int a; + if (p[0] == 1) + x = &a; + if (p[0] == 1) + (void)*x; // no-warning +} + +//===----------------------------------------------------------------------===// +// Test returning an out-of-bounds pointer (CWE-466) +//===----------------------------------------------------------------------===// + +static int test_cwe466_return_outofbounds_pointer_a[10]; +int *test_cwe466_return_outofbounds_pointer() { + int *p = test_cwe466_return_outofbounds_pointer_a+10; + return p; // expected-warning{{Returned pointer value points outside the original object}} +} + +//===----------------------------------------------------------------------===// +// PR 3135 - Test case that shows that a variable may get invalidated when its +// address is included in a structure that is passed-by-value to an unknown function. +//===----------------------------------------------------------------------===// + +typedef struct { int *a; } pr3135_structure; +int pr3135_bar(pr3135_structure *x); +int pr3135() { + int x; + pr3135_structure y = { &x }; + // the call to pr3135_bar may initialize x + if (pr3135_bar(&y) && x) // no-warning + return 1; + return 0; +} + +//===----------------------------------------------------------------------===// +// <rdar://problem/7403269> - Test that we handle compound initializers with +// partially unspecified array values. Previously this caused a crash. +//===----------------------------------------------------------------------===// + +typedef struct RDar7403269 { + unsigned x[10]; + unsigned y; +} RDar7403269; + +void rdar7403269() { + RDar7403269 z = { .y = 0 }; + if (z.x[4] == 0) + return; + int *p = 0; + *p = 0xDEADBEEF; // no-warning +} + +typedef struct RDar7403269_b { + struct zorg { int w; int k; } x[10]; + unsigned y; +} RDar7403269_b; + +void rdar7403269_b() { + RDar7403269_b z = { .y = 0 }; + if (z.x[5].w == 0) + return; + int *p = 0; + *p = 0xDEADBEEF; // no-warning +} + +void rdar7403269_b_pos() { + RDar7403269_b z = { .y = 0 }; + if (z.x[5].w == 1) + return; + int *p = 0; + *p = 0xDEADBEEF; // expected-warning{{Dereference of null pointer}} +} + + +//===----------------------------------------------------------------------===// +// Test that incrementing a non-null pointer results in a non-null pointer. +// (<rdar://problem/7191542>) +//===----------------------------------------------------------------------===// + +void test_increment_nonnull_rdar_7191542(const char *path) { + const char *alf = 0; + + for (;;) { + // When using basic-store, we get a null dereference here because we lose information + // about path after the pointer increment. + char c = *path++; // no-warning + if (c == 'a') { + alf = path; + } + + if (alf) + return; + } +} + +//===----------------------------------------------------------------------===// +// Test that the store (implicitly) tracks values for doubles/floats that are +// uninitialized (<rdar://problem/6811085>) +//===----------------------------------------------------------------------===// + +double rdar_6811085(void) { + double u; + return u + 10; // expected-warning{{The left operand of '+' is a garbage value}} +} + +//===----------------------------------------------------------------------===// +// Path-sensitive tests for blocks. +//===----------------------------------------------------------------------===// + +void indirect_block_call(void (^f)()); + +int blocks_1(int *p, int z) { + __block int *q = 0; + void (^bar)() = ^{ q = p; }; + + if (z == 1) { + // The call to 'bar' might cause 'q' to be invalidated. + bar(); + *q = 0x1; // no-warning + } + else if (z == 2) { + // The function 'indirect_block_call' might invoke bar, thus causing + // 'q' to possibly be invalidated. + indirect_block_call(bar); + *q = 0x1; // no-warning + } + else { + *q = 0xDEADBEEF; // expected-warning{{Dereference of null pointer}} + } + return z; +} + +int blocks_2(int *p, int z) { + int *q = 0; + void (^bar)(int **) = ^(int **r){ *r = p; }; + + if (z) { + // The call to 'bar' might cause 'q' to be invalidated. + bar(&q); + *q = 0x1; // no-warning + } + else { + *q = 0xDEADBEEF; // expected-warning{{Dereference of null pointer}} + } + return z; +} + +// Test that the value of 'x' is considered invalidated after the block +// is passed as an argument to the message expression. +typedef void (^RDar7582031CB)(void); +@interface RDar7582031 +- rdar7582031:RDar7582031CB; +- rdar7582031_b:RDar7582031CB; +@end + +// Test with one block. +unsigned rdar7582031(RDar7582031 *o) { + __block unsigned x; + [o rdar7582031:^{ x = 1; }]; + return x; // no-warning +} + +// Test with two blocks. +unsigned long rdar7582031_b(RDar7582031 *o) { + __block unsigned y; + __block unsigned long x; + [o rdar7582031:^{ y = 1; }]; + [o rdar7582031_b:^{ x = 1LL; }]; + return x + (unsigned long) y; // no-warning +} + +// Show we get an error when 'o' is null because the message +// expression has no effect. +unsigned long rdar7582031_b2(RDar7582031 *o) { + __block unsigned y; + __block unsigned long x; + if (o) + return 1; + [o rdar7582031:^{ y = 1; }]; + [o rdar7582031_b:^{ x = 1LL; }]; + return x + (unsigned long) y; // expected-warning{{The left operand of '+' is a garbage value}} +} + +// Show that we handle static variables also getting invalidated. +void rdar7582031_aux(void (^)(void)); +RDar7582031 *rdar7582031_aux_2(); + +unsigned rdar7582031_static() { + static RDar7582031 *o = 0; + rdar7582031_aux(^{ o = rdar7582031_aux_2(); }); + + __block unsigned x; + [o rdar7582031:^{ x = 1; }]; + return x; // no-warning +} + +//===----------------------------------------------------------------------===// +// <rdar://problem/7462324> - Test that variables passed using __blocks +// are not treated as being uninitialized. +//===----------------------------------------------------------------------===// + +typedef void (^RDar_7462324_Callback)(id obj); + +@interface RDar7462324 +- (void) foo:(id)target; +- (void) foo_positive:(id)target; + +@end + +@implementation RDar7462324 +- (void) foo:(id)target { + __block RDar_7462324_Callback builder = ((void*) 0); + builder = ^(id object) { + if (object) { + builder(self); // no-warning + } + }; + builder(target); +} +- (void) foo_positive:(id)target { + __block RDar_7462324_Callback builder = ((void*) 0); + builder = ^(id object) { + id x; + if (object) { + builder(x); // expected-warning{{Function call argument is an uninitialized value}} + } + }; + builder(target); +} +@end + +//===----------------------------------------------------------------------===// +// <rdar://problem/7468209> - Scanning for live variables within a block should +// not crash on variables passed by reference via __block. +//===----------------------------------------------------------------------===// + +int rdar7468209_aux(); +void rdar7468209_aux_2(); + +void rdar7468209() { + __block int x = 0; + ^{ + x = rdar7468209_aux(); + // We need a second statement so that 'x' would be removed from the store if it wasn't + // passed by reference. + rdar7468209_aux_2(); + }(); +} + +//===----------------------------------------------------------------------===// +// PR 5857 - Test loading an integer from a byte array that has also been +// reinterpreted to be loaded as a field. +//===----------------------------------------------------------------------===// + +typedef struct { int x; } TestFieldLoad; +int pr5857(char *src) { + TestFieldLoad *tfl = (TestFieldLoad *) (intptr_t) src; + int y = tfl->x; + long long *z = (long long *) (intptr_t) src; + long long w = 0; + int n = 0; + for (n = 0; n < y; ++n) { + // Previously we crashed analyzing this statement. + w = *z++; + } + return 1; +} + +//===----------------------------------------------------------------------===// +// PR 4358 - Without field-sensitivity, this code previously triggered +// a false positive that 'uninit' could be uninitialized at the call +// to pr4358_aux(). +//===----------------------------------------------------------------------===// + +struct pr4358 { + int bar; + int baz; +}; +void pr4358_aux(int x); +void pr4358(struct pr4358 *pnt) { + int uninit; + if (pnt->bar < 3) { + uninit = 1; + } else if (pnt->baz > 2) { + uninit = 3; + } else if (pnt->baz <= 2) { + uninit = 2; + } + pr4358_aux(uninit); // no-warning +} + +//===----------------------------------------------------------------------===// +// <rdar://problem/7526777> +// Test handling fields of values returned from function calls or +// message expressions. +//===----------------------------------------------------------------------===// + +typedef struct testReturn_rdar_7526777 { + int x; + int y; +} testReturn_rdar_7526777; + +@interface TestReturnStruct_rdar_7526777 +- (testReturn_rdar_7526777) foo; +@end + +int test_return_struct(TestReturnStruct_rdar_7526777 *x) { + return [x foo].x; +} + +testReturn_rdar_7526777 test_return_struct_2_aux_rdar_7526777(); + +int test_return_struct_2_rdar_7526777() { + return test_return_struct_2_aux_rdar_7526777().x; +} + +//===----------------------------------------------------------------------===// +// <rdar://problem/7527292> Assertion failed: (Op == BinaryOperator::Add || +// Op == BinaryOperator::Sub) +// This test case previously triggered an assertion failure due to a discrepancy +// been the loaded/stored value in the array +//===----------------------------------------------------------------------===// + +_Bool OSAtomicCompareAndSwapPtrBarrier( void *__oldValue, void *__newValue, void * volatile *__theValue ); + +void rdar_7527292() { + static id Cache7527292[32]; + for (signed long idx = 0; + idx < 32; + idx++) { + id v = Cache7527292[idx]; + if (v && OSAtomicCompareAndSwapPtrBarrier(v, ((void*)0), (void * volatile *)(Cache7527292 + idx))) { + } + } +} + +//===----------------------------------------------------------------------===// +// <rdar://problem/7515938> - Handle initialization of incomplete arrays +// in structures using a compound value. Previously this crashed. +//===----------------------------------------------------------------------===// + +struct rdar_7515938 { + int x; + int y[]; +}; + +const struct rdar_7515938 *rdar_7515938() { + static const struct rdar_7515938 z = { 0, { 1, 2 } }; + if (z.y[0] != 1) { + int *p = 0; + *p = 0xDEADBEEF; // no-warning + } + return &z; +} + +struct rdar_7515938_str { + int x; + char y[]; +}; + +const struct rdar_7515938_str *rdar_7515938_str() { + static const struct rdar_7515938_str z = { 0, "hello" }; + return &z; +} + +//===----------------------------------------------------------------------===// +// Assorted test cases from PR 4172. +//===----------------------------------------------------------------------===// + +struct PR4172A_s { int *a; }; + +void PR4172A_f2(struct PR4172A_s *p); + +int PR4172A_f1(void) { + struct PR4172A_s m; + int b[4]; + m.a = b; + PR4172A_f2(&m); + return b[3]; // no-warning +} + +struct PR4172B_s { int *a; }; + +void PR4172B_f2(struct PR4172B_s *p); + +int PR4172B_f1(void) { + struct PR4172B_s m; + int x; + m.a = &x; + PR4172B_f2(&m); + return x; // no-warning +} + +//===----------------------------------------------------------------------===// +// Test invalidation of values in struct literals. +//===----------------------------------------------------------------------===// + +struct s_rev96062 { int *x; int *y; }; +struct s_rev96062_nested { struct s_rev96062 z; }; + +void test_a_rev96062_aux(struct s_rev96062 *s); +void test_a_rev96062_aux2(struct s_rev96062_nested *s); + +int test_a_rev96062() { + int a, b; + struct s_rev96062 x = { &a, &b }; + test_a_rev96062_aux(&x); + return a + b; // no-warning +} +int test_b_rev96062() { + int a, b; + struct s_rev96062 x = { &a, &b }; + struct s_rev96062 z = x; + test_a_rev96062_aux(&z); + return a + b; // no-warning +} +int test_c_rev96062() { + int a, b; + struct s_rev96062 x = { &a, &b }; + struct s_rev96062_nested w = { x }; + struct s_rev96062_nested z = w; + test_a_rev96062_aux2(&z); + return a + b; // no-warning +} + +//===----------------------------------------------------------------------===// +// <rdar://problem/7242010> - The access to y[0] at the bottom previously +// was reported as an uninitialized value. +//===----------------------------------------------------------------------===// + +char *rdar_7242010(int count, char **y) { + char **x = alloca((count + 4) * sizeof(*x)); + x[0] = "hi"; + x[1] = "there"; + x[2] = "every"; + x[3] = "body"; + memcpy(x + 4, y, count * sizeof(*x)); + y = x; + return y[0]; // no-warning +} + +//===----------------------------------------------------------------------===// +// <rdar://problem/7770737> +//===----------------------------------------------------------------------===// + +struct rdar_7770737_s { intptr_t p; }; +void rdar_7770737_aux(struct rdar_7770737_s *p); +int rdar_7770737(void) +{ + int x; + + // Previously 'f' was not properly invalidated, causing the use of + // an uninitailized value below. + struct rdar_7770737_s f = { .p = (intptr_t)&x }; + rdar_7770737_aux(&f); + return x; // no-warning +} +int rdar_7770737_pos(void) +{ + int x; + struct rdar_7770737_s f = { .p = (intptr_t)&x }; + return x; // expected-warning{{Undefined or garbage value returned to caller}} +} + +//===----------------------------------------------------------------------===// +// Test handling of the implicit 'isa' field. For now we don't do anything +// interesting. +//===----------------------------------------------------------------------===// + +void pr6302(id x, Class y) { + // This previously crashed the analyzer (reported in PR 6302) + x->isa = y; // expected-warning {{direct access to objective-c's isa is deprecated in favor of object_setClass() and object_getClass()}} +} + +//===----------------------------------------------------------------------===// +// Specially handle global variables that are declared constant. In the +// example below, this forces the loop to take exactly 2 iterations. +//===----------------------------------------------------------------------===// + +const int pr6288_L_N = 2; +void pr6288_(void) { + int x[2]; + int *px[2]; + int i; + for (i = 0; i < pr6288_L_N; i++) + px[i] = &x[i]; + *(px[0]) = 0; // no-warning +} + +void pr6288_pos(int z) { + int x[2]; + int *px[2]; + int i; + for (i = 0; i < z; i++) + px[i] = &x[i]; // expected-warning{{Access out-of-bound array element (buffer overflow)}} + *(px[0]) = 0; // expected-warning{{Dereference of undefined pointer value}} +} + +void pr6288_b(void) { + const int L_N = 2; + int x[2]; + int *px[2]; + int i; + for (i = 0; i < L_N; i++) + px[i] = &x[i]; + *(px[0]) = 0; // no-warning +} + +// <rdar://problem/7817800> - A bug in RemoveDeadBindings was causing instance variable bindings +// to get prematurely pruned from the state. +@interface Rdar7817800 { + char *x; +} +- (void) rdar7817800_baz; +@end + +char *rdar7817800_foobar(); +void rdar7817800_qux(void*); + +@implementation Rdar7817800 +- (void) rdar7817800_baz { + if (x) + rdar7817800_qux(x); + x = rdar7817800_foobar(); + // Previously this triggered a bogus null dereference warning. + x[1] = 'a'; // no-warning +} +@end + +// PR 6036 - This test case triggered a crash inside StoreManager::CastRegion because the size +// of 'unsigned long (*)[0]' is 0. +struct pr6036_a { int pr6036_b; }; +struct pr6036_c; +void u132monitk (struct pr6036_c *pr6036_d) { + (void) ((struct pr6036_a *) (unsigned long (*)[0]) ((char *) pr6036_d - 1))->pr6036_b; // expected-warning{{Casting a non-structure type to a structure type and accessing a field can lead to memory access errors or data corruption}} +} + +// <rdar://problem/7813989> - ?-expressions used as a base of a member expression should be treated as an lvalue +typedef struct rdar7813989_NestedVal { int w; } rdar7813989_NestedVal; +typedef struct rdar7813989_Val { rdar7813989_NestedVal nv; } rdar7813989_Val; + +int rdar7813989(int x, rdar7813989_Val *a, rdar7813989_Val *b) { + // This previously crashed with an assertion failure. + int z = (x ? a->nv : b->nv).w; + return z + 1; +} + +// PR 6844 - Don't crash on vaarg expression. +typedef __builtin_va_list va_list; +void map(int srcID, ...) { + va_list ap; + int i; + for (i = 0; i < srcID; i++) { + int v = __builtin_va_arg(ap, int); + } +} + +// PR 6854 - crash when casting symbolic memory address to a float +// Handle casting from a symbolic region to a 'float'. This isn't +// really all that intelligent, but previously this caused a crash +// in SimpleSValuator. +void pr6854(void * arg) { + void * a = arg; + *(void**)a = arg; + float f = *(float*) a; +} + +// <rdar://problem/8032791> False positive due to symbolic store not find +// value because of 'const' qualifier +double rdar_8032791_2(); +double rdar_8032791_1() { + struct R8032791 { double x[2]; double y; } + data[3] = { + {{1.0, 3.0}, 3.0}, // 1 2 3 + {{1.0, 1.0}, 0.0}, // 1 1 2 2 3 3 + {{1.0, 3.0}, 1.0} // 1 2 3 + }; + + double x = 0.0; + for (unsigned i = 0 ; i < 3; i++) { + const struct R8032791 *p = &data[i]; + x += p->y + rdar_8032791_2(); // no-warning + } + return x; +} + +// PR 7450 - Handle pointer arithmetic with __builtin_alloca +void pr_7450_aux(void *x); +void pr_7450() { + void *p = __builtin_alloca(10); + // Don't crash when analyzing the following statement. + pr_7450_aux(p + 8); +} + +// <rdar://problem/8243408> - Symbolicate struct values returned by value. +struct s_rdar_8243408 { int x; }; +extern struct s_rdar_8243408 rdar_8243408_aux(void); +void rdar_8243408(void) { + struct s_rdar_8243408 a = { 1 }, *b = 0; + while (a.x && !b) + a = rdar_8243408_aux(); + + // Previously there was a false error here with 'b' being null. + (void) (a.x && b->x); // no-warning + + // Introduce a null deref to ensure we are checking this path. + int *p = 0; + *p = 0xDEADBEEF; // expected-warning{{Dereference of null pointer}} +} + +// <rdar://problem/8258814> +int r8258814() +{ + int foo; + int * a = &foo; + a[0] = 10; + // Do not warn that the value of 'foo' is uninitialized. + return foo; // no-warning +} + +// PR 8052 - Don't crash when reasoning about loads from a function address.\n +typedef unsigned int __uint32_t; +typedef unsigned long vm_offset_t; +typedef __uint32_t pd_entry_t; +typedef unsigned char u_char; +typedef unsigned int u_int; +typedef unsigned long u_long; +extern int bootMP_size; +void bootMP(void); +static void +pr8052(u_int boot_addr) +{ + int x; + int size = *(int *) ((u_long) & bootMP_size); + u_char *src = (u_char *) ((u_long) bootMP); + u_char *dst = (u_char *) boot_addr + ((vm_offset_t) ((((((((1 << +12) / (sizeof(pd_entry_t))) - 1) - 1) - (260 - 2))) << 22) | ((0) << 12))); + for (x = 0; + x < size; + ++x) + *dst++ = *src++; +} + +// PR 8015 - don't return undefined values for arrays when using a valid +// symbolic index +int pr8015_A(); +void pr8015_B(const char *); + +void pr8015_C() { + int number = pr8015_A(); + const char *numbers[] = { "zero" }; + if (number == 0) { + pr8015_B(numbers[number]); // no-warning + } +} + +// Tests that we correctly handle that 'number' is perfectly constrained +// after 'if (nunber == 0)', allowing us to resolve that +// numbers[number] == numbers[0]. +void pr8015_D_FIXME() { + int number = pr8015_A(); + const char *numbers[] = { "zero" }; + if (number == 0) { + if (numbers[number] == numbers[0]) // expected-warning{{Both operands to '==' always have the same value}} + return; + // Unreachable. + int *p = 0; + *p = 0xDEADBEEF; // no-warnng + } +} + +void pr8015_E() { + // Similar to pr8015_C, but number is allowed to be a valid range. + unsigned number = pr8015_A(); + const char *numbers[] = { "zero", "one", "two" }; + if (number < 3) { + pr8015_B(numbers[number]); // no-warning + } +} + +void pr8015_F_FIXME() { + // Similar to pr8015_E, but like pr8015_D we check if the pointer + // is the same as one of the string literals. The null dereference + // here is not feasible in practice, so this is a false positive. + int number = pr8015_A(); + const char *numbers[] = { "zero", "one", "two" }; + if (number < 3) { + const char *p = numbers[number]; + if (p == numbers[0] || p == numbers[1] || p == numbers[2]) + return; + int *q = 0; + *q = 0xDEADBEEF; // expected-warning{{Dereference of null pointer}} + } +} + +// PR 8141. Previously the statement expression in the for loop caused +// the CFG builder to crash. +struct list_pr8141 +{ + struct list_pr8141 *tail; +}; + +struct list_pr8141 * +pr8141 (void) { + struct list_pr8141 *items; + for (;; items = ({ do { } while (0); items->tail; })) // expected-warning{{Dereference of undefined pointer value}} + { + } +} + +// Don't crash when building the CFG. +void do_not_crash(int x) { + while (x - ({do {} while (0); x; })) { + } +} + +// <rdar://problem/8424269> - Handle looking at the size of a VLA in +// ArrayBoundChecker. Nothing intelligent (yet); just don't crash. +typedef struct RDar8424269_A { + int RDar8424269_C; +} RDar8424269_A; +static void RDar8424269_B(RDar8424269_A *p, unsigned char *RDar8424269_D, + const unsigned char *RDar8424269_E, int RDar8424269_F, + int b_w, int b_h, int dx, int dy) { + int x, y, b, r, l; + unsigned char tmp2t[3][RDar8424269_F * (32 + 8)]; + unsigned char *tmp2 = tmp2t[0]; + if (p && !p->RDar8424269_C) + b = 15; + tmp2 = tmp2t[1]; + if (b & 2) { // expected-warning{{The left operand of '&' is a garbage value}} + for (y = 0; y < b_h; y++) { + for (x = 0; x < b_w + 1; x++) { + int am = 0; + tmp2[x] = am; + } + } + } + tmp2 = tmp2t[2]; +} + +// <rdar://problem/8642434> - Handle transparent unions with the AttrNonNullChecker. +typedef union { + struct rdar_8642434_typeA *_dq; +} +rdar_8642434_typeB __attribute__((transparent_union)); + +__attribute__((visibility("default"))) __attribute__((__nonnull__)) __attribute__((__nothrow__)) +void rdar_8642434_funcA(rdar_8642434_typeB object); + +void rdar_8642434_funcB(struct rdar_8642434_typeA *x, struct rdar_8642434_typeA *y) { + rdar_8642434_funcA(x); + if (!y) + rdar_8642434_funcA(y); // expected-warning{{Null pointer passed as an argument to a 'nonnull' parameter}} +} + +// <rdar://problem/8848957> - Handle loads and stores from a symbolic index +// into array without warning about an uninitialized value being returned. +// While RegionStore can't fully reason about this example, it shouldn't +// warn here either. +typedef struct s_test_rdar8848957 { + int x, y, z; +} s_test_rdar8848957; + +s_test_rdar8848957 foo_rdar8848957(); +int rdar8848957(int index) { + s_test_rdar8848957 vals[10]; + vals[index] = foo_rdar8848957(); + return vals[index].x; // no-warning +} + +// PR 9049 - crash on symbolicating unions. This test exists solely to +// test that the analyzer doesn't crash. +typedef struct pr9048_cdev *pr9048_cdev_t; +typedef union pr9048_abstracted_disklabel { void *opaque; } pr9048_disklabel_t; +struct pr9048_diskslice { pr9048_disklabel_t ds_label; }; +struct pr9048_diskslices { + int dss_secmult; + struct pr9048_diskslice dss_slices[16]; +}; +void pr9048(pr9048_cdev_t dev, struct pr9048_diskslices * ssp, unsigned int slice) +{ + pr9048_disklabel_t lp; + struct pr9048_diskslice *sp; + sp = &ssp->dss_slices[slice]; + if (ssp->dss_secmult == 1) { + } else if ((lp = sp->ds_label).opaque != ((void *) 0)) { + } +} + +// Test Store reference counting in the presence of Lazy compound values. +// This previously caused an infinite recursion. +typedef struct {} Rdar_9103310_A; +typedef struct Rdar_9103310_B Rdar_9103310_B_t; +struct Rdar_9103310_B { + unsigned char Rdar_9103310_C[101]; +}; +void Rdar_9103310_E(Rdar_9103310_A * x, struct Rdar_9103310_C * b) { // expected-warning {{declaration of 'struct Rdar_9103310_C' will not be visible outside of this function}} + char Rdar_9103310_D[4][4] = { "a", "b", "c", "d"}; + int i; + Rdar_9103310_B_t *y = (Rdar_9103310_B_t *) x; + for (i = 0; i < 101; i++) { + Rdar_9103310_F(b, "%2d%s ", (y->Rdar_9103310_C[i]) / 4, Rdar_9103310_D[(y->Rdar_9103310_C[i]) % 4]); // expected-warning {{implicit declaration of function 'Rdar_9103310_F' is invalid in C99}} + } +} + +// Test handling binding lazy compound values to a region and then have +// specific elements have other bindings. +int PR9455() { + char arr[4] = "000"; + arr[0] = '1'; + if (arr[1] == '0') + return 1; + int *p = 0; + *p = 0xDEADBEEF; // no-warning + return 1; +} +int PR9455_2() { + char arr[4] = "000"; + arr[0] = '1'; + if (arr[1] == '0') { + int *p = 0; + *p = 0xDEADBEEF; // expected-warning {{null}} + } + return 1; +} + +// Test initialization of substructs via lazy compound values. +typedef float RDar9163742_Float; + +typedef struct { + RDar9163742_Float x, y; +} RDar9163742_Point; +typedef struct { + RDar9163742_Float width, height; +} RDar9163742_Size; +typedef struct { + RDar9163742_Point origin; + RDar9163742_Size size; +} RDar9163742_Rect; + +extern RDar9163742_Rect RDar9163742_RectIntegral(RDar9163742_Rect); + +RDar9163742_Rect RDar9163742_IntegralRect(RDar9163742_Rect frame) +{ + RDar9163742_Rect integralFrame; + integralFrame.origin.x = frame.origin.x; + integralFrame.origin.y = frame.origin.y; + integralFrame.size = frame.size; + return RDar9163742_RectIntegral(integralFrame); // no-warning; all fields initialized +} + +// Test correct handling of prefix '--' operator. +void rdar9444714() { + int x; + char str[ 32 ]; + char buf[ 32 ]; + char * dst; + char * ptr; + + x = 1234; + dst = str; + ptr = buf; + do + { + *ptr++ = (char)( '0' + ( x % 10 ) ); + x /= 10; + } while( x > 0 ); + + while( ptr > buf ) + { + *dst++ = *( --( ptr ) ); // no-warning + } + *dst = '\0'; +} + +// Test handling symbolic elements with field accesses. +// <rdar://problem/11127008> +typedef struct { + unsigned value; +} RDar11127008; + +signed rdar_11127008_index(); + +static unsigned rdar_11127008(void) { + RDar11127008 values[] = {{.value = 0}, {.value = 1}}; + signed index = rdar_11127008_index(); + if (index < 0) return 0; + if (index >= 2) return 0; + return values[index].value; +} + |