blob: c0e1d8b7e39f7107af1100f6e0aa749b60668fb9 (
plain)
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
|
// RUN: clang-cc -analyze -checker-simple -analyzer-store=basic -analyzer-constraints=basic -verify %s &&
// RUN: clang-cc -analyze -checker-cfref -analyzer-store=basic -analyzer-constraints=basic -verify %s &&
// RUN: clang-cc -analyze -checker-cfref -analyzer-store=basic -analyzer-constraints=range -verify %s
// RegionStore now has an infinite recursion with this test case.
// NOWORK: clang-cc -analyze -checker-cfref -analyzer-store=region -analyzer-constraints=basic -verify %s &&
// NOWORK: clang-cc -analyze -checker-cfref -analyzer-store=region -analyzer-constraints=range -verify %s
struct s {
int data;
int data_array[10];
};
typedef struct {
int data;
} STYPE;
void g(char *p);
void g1(struct s* p);
// Array to pointer conversion. Array in the struct field.
void f(void) {
int a[10];
int (*p)[10];
p = &a;
(*p)[3] = 1;
struct s d;
struct s *q;
q = &d;
q->data = 3;
d.data_array[9] = 17;
}
// StringLiteral in lvalue context and pointer to array type.
// p: ElementRegion, q: StringRegion
void f2() {
char *p = "/usr/local";
char (*q)[4];
q = &"abc";
}
// Typedef'ed struct definition.
void f3() {
STYPE s;
}
// Initialize array with InitExprList.
void f4() {
int a[] = { 1, 2, 3};
int b[3] = { 1, 2 };
struct s c[] = {{1,{1}}};
}
// Struct variable in lvalue context.
// Assign UnknownVal to the whole struct.
void f5() {
struct s data;
g1(&data);
}
// AllocaRegion test.
void f6() {
char *p;
p = __builtin_alloca(10);
g(p);
char c = *p;
p[1] = 'a';
// Test if RegionStore::EvalBinOp converts the alloca region to element
// region.
p += 2;
}
struct s2;
void g2(struct s2 *p);
// Incomplete struct pointer used as function argument.
void f7() {
struct s2 *p = __builtin_alloca(10);
g2(p);
}
// sizeof() is unsigned while -1 is signed in array index.
void f8() {
int a[10];
a[sizeof(a)/sizeof(int) - 1] = 1; // no-warning
}
// Initialization of struct array elements.
void f9() {
struct s a[10];
}
// Initializing array with string literal.
void f10() {
char a1[4] = "abc";
char a3[6] = "abc";
}
// Retrieve the default value of element/field region.
void f11() {
struct s a;
g1(&a);
if (a.data == 0) // no-warning
a.data = 1;
}
// Convert unsigned offset to signed when creating ElementRegion from
// SymbolicRegion.
void f12(int *list) {
unsigned i = 0;
list[i] = 1;
}
struct s1 {
struct s2 {
int d;
} e;
};
// The binding of a.e.d should not be removed. Test recursive subregion map
// building: a->e, e->d. Only then 'a' could be added to live region roots.
void f13(double timeout) {
struct s1 a;
a.e.d = (long) timeout;
if (a.e.d == 10)
a.e.d = 4;
}
struct s3 {
int a[2];
};
static struct s3 opt;
// Test if the embedded array is retrieved correctly.
void f14() {
struct s3 my_opt = opt;
}
void bar(int*);
// Test if the array is correctly invalidated.
void f15() {
int a[10];
bar(a);
if (a[1]) // no-warning
1;
}
|
