summaryrefslogtreecommitdiff
path: root/clang/test/Analysis/malloc-overflow.c
blob: 714fd3d308adb7911b29cb4ab748e436a67fe3e1 (about) (plain)
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
// RUN: %clang_cc1 -analyze -analyzer-checker=experimental.security.MallocOverflow -verify %s

#define NULL ((void *) 0)
typedef __typeof__(sizeof(int)) size_t;
extern void * malloc(size_t);

void * f1(int n)
{
  return malloc(n * sizeof(int));  // expected-warning {{the computation of the size of the memory allocation may overflow}}
}

void * f2(int n)
{
  return malloc(sizeof(int) * n); // // expected-warning {{the computation of the size of the memory allocation may overflow}}
}

void * f3()
{
  return malloc(4 * sizeof(int));  // no-warning
}

struct s4
{
  int n;
};

void * f4(struct s4 *s)
{
  return malloc(s->n * sizeof(int)); // expected-warning {{the computation of the size of the memory allocation may overflow}}
}

void * f5(struct s4 *s)
{
  struct s4 s2 = *s;
  return malloc(s2.n * sizeof(int)); // expected-warning {{the computation of the size of the memory allocation may overflow}}
}

void * f6(int n)
{
  return malloc((n + 1) * sizeof(int)); // expected-warning {{the computation of the size of the memory allocation may overflow}}
}

extern void * malloc (size_t);

void * f7(int n)
{
  if (n > 10)
    return NULL;
  return malloc(n * sizeof(int));  // no-warning
}

void * f8(int n)
{
  if (n < 10)
    return malloc(n * sizeof(int));  // no-warning
  else
    return NULL;
}

void * f9(int n)
{
  int * x = malloc(n * sizeof(int));  // expected-warning {{the computation of the size of the memory allocation may overflow}}
  for (int i = 0; i < n; i++)
    x[i] = i;
  return x;
}

void * f10(int n)
{
  int * x = malloc(n * sizeof(int));  // expected-warning {{the computation of the size of the memory allocation may overflow}}
  int i = 0;
  while (i < n)
    x[i++] = 0;
  return x;
}

void * f11(int n)
{
  int * x = malloc(n * sizeof(int));  // expected-warning {{the computation of the size of the memory allocation may overflow}}
  int i = 0;
  do {
    x[i++] = 0;
  } while (i < n);
  return x;
}

void * f12(int n)
{
  n = (n > 10 ? 10 : n);
  int * x = malloc(n * sizeof(int));  // no-warning
  for (int i = 0; i < n; i++)
    x[i] = i;
  return x;
}

struct s13
{
  int n;
};

void * f13(struct s13 *s)
{
  if (s->n > 10)
    return NULL;
  return malloc(s->n * sizeof(int));  // no warning
}

void * f14(int n)
{
  if (n < 0)
    return NULL;
  return malloc(n * sizeof(int));  // expected-warning {{the computation of the size of the memory allocation may overflow}}
}