summaryrefslogtreecommitdiff
path: root/clang/test/Analysis/ptr-arith.c
diff options
context:
space:
mode:
Diffstat (limited to 'clang/test/Analysis/ptr-arith.c')
-rw-r--r--clang/test/Analysis/ptr-arith.c288
1 files changed, 288 insertions, 0 deletions
diff --git a/clang/test/Analysis/ptr-arith.c b/clang/test/Analysis/ptr-arith.c
new file mode 100644
index 0000000..fb37f1c
--- /dev/null
+++ b/clang/test/Analysis/ptr-arith.c
@@ -0,0 +1,288 @@
+// RUN: %clang_cc1 -analyze -analyzer-checker=experimental.core.FixedAddr,experimental.core.PointerArithm,experimental.core.PointerSub -analyzer-store=region -verify -triple x86_64-apple-darwin9 %s
+// RUN: %clang_cc1 -analyze -analyzer-checker=experimental.core.FixedAddr,experimental.core.PointerArithm,experimental.core.PointerSub -analyzer-store=region -verify -triple i686-apple-darwin9 %s
+
+// Used to trigger warnings for unreachable paths.
+#define WARN do { int a, b; int c = &b-&a; } while (0)
+
+void f1() {
+ int a[10];
+ int *p = a;
+ ++p;
+}
+
+char* foo();
+
+void f2() {
+ char *p = foo();
+ ++p;
+}
+
+// This test case checks if we get the right rvalue type of a TypedViewRegion.
+// The ElementRegion's type depends on the array region's rvalue type. If it was
+// a pointer type, we would get a loc::SymbolVal for '*p'.
+void* memchr();
+static int
+domain_port (const char *domain_b, const char *domain_e,
+ const char **domain_e_ptr)
+{
+ int port = 0;
+
+ const char *p;
+ const char *colon = memchr (domain_b, ':', domain_e - domain_b);
+
+ for (p = colon + 1; p < domain_e ; p++)
+ port = 10 * port + (*p - '0');
+ return port;
+}
+
+void f3() {
+ int x, y;
+ int d = &y - &x; // expected-warning{{Subtraction of two pointers that do not point to the same memory chunk may cause incorrect result.}}
+
+ int a[10];
+ int *p = &a[2];
+ int *q = &a[8];
+ d = q-p; // no-warning
+}
+
+void f4() {
+ int *p;
+ p = (int*) 0x10000; // expected-warning{{Using a fixed address is not portable because that address will probably not be valid in all environments or platforms.}}
+}
+
+void f5() {
+ int x, y;
+ int *p;
+ p = &x + 1; // expected-warning{{Pointer arithmetic done on non-array variables means reliance on memory layout, which is dangerous.}}
+
+ int a[10];
+ p = a + 1; // no-warning
+}
+
+// Allow arithmetic on different symbolic regions.
+void f6(int *p, int *q) {
+ int d = q - p; // no-warning
+}
+
+void null_operand(int *a) {
+start:
+ // LHS is a label, RHS is NULL
+ if (&&start == 0)
+ WARN; // no-warning
+ if (&&start < 0)
+ WARN; // no-warning
+ if (&&start <= 0)
+ WARN; // no-warning
+ if (!(&&start != 0))
+ WARN; // no-warning
+ if (!(&&start > 0))
+ WARN; // no-warning
+ if (!(&&start >= 0))
+ WARN; // no-warning
+ if (!(&&start - 0))
+ WARN; // no-warning
+
+ // LHS is a non-symbolic value, RHS is NULL
+ if (&a == 0)
+ WARN; // no-warning
+ if (&a < 0)
+ WARN; // no-warning
+ if (&a <= 0)
+ WARN; // no-warning
+ if (!(&a != 0))
+ WARN; // no-warning
+ if (!(&a > 0))
+ WARN; // no-warning
+ if (!(&a >= 0))
+ WARN; // no-warning
+
+ if (!(&a - 0)) // expected-warning{{Pointer arithmetic done on non-array variables}}
+ WARN; // no-warning
+
+ // LHS is NULL, RHS is non-symbolic
+ // The same code is used for labels and non-symbolic values.
+ if (0 == &a)
+ WARN; // no-warning
+ if (0 > &a)
+ WARN; // no-warning
+ if (0 >= &a)
+ WARN; // no-warning
+ if (!(0 != &a))
+ WARN; // no-warning
+ if (!(0 < &a))
+ WARN; // no-warning
+ if (!(0 <= &a))
+ WARN; // no-warning
+
+ // LHS is a symbolic value, RHS is NULL
+ if (a == 0)
+ WARN; // expected-warning{{}}
+ if (a < 0)
+ WARN; // no-warning
+ if (a <= 0)
+ WARN; // expected-warning{{}}
+ if (!(a != 0))
+ WARN; // expected-warning{{}}
+ if (!(a > 0))
+ WARN; // expected-warning{{}}
+ if (!(a >= 0))
+ WARN; // no-warning
+ if (!(a - 0))
+ WARN; // expected-warning{{}}
+
+ // LHS is NULL, RHS is a symbolic value
+ if (0 == a)
+ WARN; // expected-warning{{}}
+ if (0 > a)
+ WARN; // no-warning
+ if (0 >= a)
+ WARN; // expected-warning{{}}
+ if (!(0 != a))
+ WARN; // expected-warning{{}}
+ if (!(0 < a))
+ WARN; // expected-warning{{}}
+ if (!(0 <= a))
+ WARN; // no-warning
+}
+
+void const_locs() {
+ char *a = (char*)0x1000;
+ char *b = (char*)0x1100;
+start:
+ if (a==b)
+ WARN; // no-warning
+ if (!(a!=b))
+ WARN; // no-warning
+ if (a>b)
+ WARN; // no-warning
+ if (b<a)
+ WARN; // no-warning
+ if (a>=b)
+ WARN; // no-warning
+ if (b<=a)
+ WARN; // no-warning
+ if (b-a != 0x100)
+ WARN; // no-warning
+
+ if (&&start == a)
+ WARN; // expected-warning{{}}
+ if (a == &&start)
+ WARN; // expected-warning{{}}
+ if (&a == (char**)a)
+ WARN; // expected-warning{{}}
+ if ((char**)a == &a)
+ WARN; // expected-warning{{}}
+}
+
+void array_matching_types() {
+ int array[10];
+ int *a = &array[2];
+ int *b = &array[5];
+
+ if (a==b)
+ WARN; // no-warning
+ if (!(a!=b))
+ WARN; // no-warning
+ if (a>b)
+ WARN; // no-warning
+ if (b<a)
+ WARN; // no-warning
+ if (a>=b)
+ WARN; // no-warning
+ if (b<=a)
+ WARN; // no-warning
+ if ((b-a) == 0)
+ WARN; // no-warning
+}
+
+// This takes a different code path than array_matching_types()
+void array_different_types() {
+ int array[10];
+ int *a = &array[2];
+ char *b = (char*)&array[5];
+
+ if (a==b) // expected-warning{{comparison of distinct pointer types}}
+ WARN; // no-warning
+ if (!(a!=b)) // expected-warning{{comparison of distinct pointer types}}
+ WARN; // no-warning
+ if (a>b) // expected-warning{{comparison of distinct pointer types}}
+ WARN; // no-warning
+ if (b<a) // expected-warning{{comparison of distinct pointer types}}
+ WARN; // no-warning
+ if (a>=b) // expected-warning{{comparison of distinct pointer types}}
+ WARN; // no-warning
+ if (b<=a) // expected-warning{{comparison of distinct pointer types}}
+ WARN; // no-warning
+}
+
+struct test { int x; int y; };
+void struct_fields() {
+ struct test a, b;
+
+ if (&a.x == &a.y)
+ WARN; // no-warning
+ if (!(&a.x != &a.y))
+ WARN; // no-warning
+ if (&a.x > &a.y)
+ WARN; // no-warning
+ if (&a.y < &a.x)
+ WARN; // no-warning
+ if (&a.x >= &a.y)
+ WARN; // no-warning
+ if (&a.y <= &a.x)
+ WARN; // no-warning
+
+ if (&a.x == &b.x)
+ WARN; // no-warning
+ if (!(&a.x != &b.x))
+ WARN; // no-warning
+ if (&a.x > &b.x)
+ WARN; // expected-warning{{}}
+ if (&b.x < &a.x)
+ WARN; // expected-warning{{}}
+ if (&a.x >= &b.x)
+ WARN; // expected-warning{{}}
+ if (&b.x <= &a.x)
+ WARN; // expected-warning{{}}
+}
+
+void mixed_region_types() {
+ struct test s;
+ int array[2];
+ void *a = &array, *b = &s;
+
+ if (&a == &b)
+ WARN; // no-warning
+ if (!(&a != &b))
+ WARN; // no-warning
+ if (&a > &b)
+ WARN; // expected-warning{{}}
+ if (&b < &a)
+ WARN; // expected-warning{{}}
+ if (&a >= &b)
+ WARN; // expected-warning{{}}
+ if (&b <= &a)
+ WARN; // expected-warning{{}}
+}
+
+void symbolic_region(int *p) {
+ int a;
+
+ if (&a == p)
+ WARN; // no-warning
+ if (&a != p)
+ WARN; // expected-warning{{}}
+ if (&a > p)
+ WARN; // expected-warning{{}}
+ if (&a < p)
+ WARN; // expected-warning{{}}
+ if (&a >= p)
+ WARN; // expected-warning{{}}
+ if (&a <= p)
+ WARN; // expected-warning{{}}
+}
+
+void PR7527 (int *p) {
+ if (((int) p) & 1) // not crash
+ return;
+}
generated by cgit v1.2.3 (git 2.50.1) at 2025-10-31 21:51:43 +0000