blob: 20cc3114875977b80ac0148f4e87b2e744f6d2f4 (
plain)
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
169
170
171
172
173
174
175
176
177
178
179
180
181
182
183
184
|
// RUN: %clang_cc1 -analyze -analyzer-checker=core -analyzer-config suppress-null-return-paths=false -verify %s
// RUN: %clang_cc1 -analyze -analyzer-checker=core -verify -DSUPPRESSED=1 %s
// RUN: %clang_cc1 -analyze -analyzer-checker=core -analyzer-config avoid-suppressing-null-argument-paths=true -DSUPPRESSED=1 -DNULL_ARGS=1 -verify %s
int opaquePropertyCheck(void *object);
int coin();
int *getNull() {
return 0;
}
int *dynCastToInt(void *ptr) {
if (opaquePropertyCheck(ptr))
return (int *)ptr;
return 0;
}
int *dynCastOrNull(void *ptr) {
if (!ptr)
return 0;
if (opaquePropertyCheck(ptr))
return (int *)ptr;
return 0;
}
void testDynCast(void *p) {
int *casted = dynCastToInt(p);
*casted = 1;
#ifndef SUPPRESSED
// expected-warning@-2 {{Dereference of null pointer}}
#endif
}
void testDynCastOrNull(void *p) {
int *casted = dynCastOrNull(p);
*casted = 1;
#ifndef SUPPRESSED
// expected-warning@-2 {{Dereference of null pointer}}
#endif
}
void testBranch(void *p) {
int *casted;
// Although the report will be suppressed on one branch, it should still be
// valid on the other.
if (coin()) {
casted = dynCastToInt(p);
} else {
if (p)
return;
casted = (int *)p;
}
*casted = 1; // expected-warning {{Dereference of null pointer}}
}
void testBranchReversed(void *p) {
int *casted;
// Although the report will be suppressed on one branch, it should still be
// valid on the other.
if (coin()) {
if (p)
return;
casted = (int *)p;
} else {
casted = dynCastToInt(p);
}
*casted = 1; // expected-warning {{Dereference of null pointer}}
}
// --------------------------
// "Suppression suppression"
// --------------------------
void testDynCastOrNullOfNull() {
// Don't suppress when one of the arguments is NULL.
int *casted = dynCastOrNull(0);
*casted = 1;
#if !SUPPRESSED || NULL_ARGS
// expected-warning@-2 {{Dereference of null pointer}}
#endif
}
void testDynCastOfNull() {
// Don't suppress when one of the arguments is NULL.
int *casted = dynCastToInt(0);
*casted = 1;
#if !SUPPRESSED || NULL_ARGS
// expected-warning@-2 {{Dereference of null pointer}}
#endif
}
int *lookUpInt(int unused) {
if (coin())
return 0;
static int x;
return &x;
}
void testZeroIsNotNull() {
// /Do/ suppress when the argument is 0 (an integer).
int *casted = lookUpInt(0);
*casted = 1;
#ifndef SUPPRESSED
// expected-warning@-2 {{Dereference of null pointer}}
#endif
}
void testTrackNull() {
// /Do/ suppress if the null argument came from another call returning null.
int *casted = dynCastOrNull(getNull());
*casted = 1;
#ifndef SUPPRESSED
// expected-warning@-2 {{Dereference of null pointer}}
#endif
}
void testTrackNullVariable() {
// /Do/ suppress if the null argument came from another call returning null.
int *ptr;
ptr = getNull();
int *casted = dynCastOrNull(ptr);
*casted = 1;
#ifndef SUPPRESSED
// expected-warning@-2 {{Dereference of null pointer}}
#endif
}
// ---------------------------------------
// FALSE NEGATIVES (over-suppression)
// ---------------------------------------
void testNoArguments() {
// In this case the function has no branches, and MUST return null.
int *casted = getNull();
*casted = 1;
#ifndef SUPPRESSED
// expected-warning@-2 {{Dereference of null pointer}}
#endif
}
int *getNullIfNonNull(void *input) {
if (input)
return 0;
static int x;
return &x;
}
void testKnownPath(void *input) {
if (!input)
return;
// In this case we have a known value for the argument, and thus the path
// through the function doesn't ever split.
int *casted = getNullIfNonNull(input);
*casted = 1;
#ifndef SUPPRESSED
// expected-warning@-2 {{Dereference of null pointer}}
#endif
}
int *alwaysReturnNull(void *input) {
if (opaquePropertyCheck(input))
return 0;
return 0;
}
void testAlwaysReturnNull(void *input) {
// In this case all paths out of the function return 0, but they are all
// dominated by a branch whose condition we don't know!
int *casted = alwaysReturnNull(input);
*casted = 1;
#ifndef SUPPRESSED
// expected-warning@-2 {{Dereference of null pointer}}
#endif
}
|
