outofbound.c revision 32f2656b90900ac04c4b50e87c16749d0ceb9ef2
1565e465c6d0093f1bf8414b2cabdc842022385a9Ted Kremenek// RUN: %clang_cc1 -analyze -analyzer-experimental-internal-checks -analyzer-experimental-checks -analyzer-check-objc-mem -analyzer-store=region -verify %s 23ed04d37573c566205d965d2e91d54ccae898d0aZhongxing Xu 33ed04d37573c566205d965d2e91d54ccae898d0aZhongxing Xutypedef __typeof(sizeof(int)) size_t; 43ed04d37573c566205d965d2e91d54ccae898d0aZhongxing Xuvoid *malloc(size_t); 5a5ce966d1a23d84aa5e849cf0ed62494e736ea6aZhongxing Xuvoid *calloc(size_t, size_t); 620f0178a232029bea7f34adecb6e5bdd6fada483Zhongxing Xu 720f0178a232029bea7f34adecb6e5bdd6fada483Zhongxing Xuchar f1() { 820f0178a232029bea7f34adecb6e5bdd6fada483Zhongxing Xu char* s = "abcd"; 9f9e96843e8a0afd0d5f58ba224fb8d57cba8effaTed Kremenek char c = s[4]; // no-warning 1058e689fead1490611bcd114fb707bfc08a12049eZhongxing Xu return s[5] + c; // expected-warning{{Access out-of-bound array element (buffer overflow)}} 1120f0178a232029bea7f34adecb6e5bdd6fada483Zhongxing Xu} 123ed04d37573c566205d965d2e91d54ccae898d0aZhongxing Xu 133ed04d37573c566205d965d2e91d54ccae898d0aZhongxing Xuvoid f2() { 143ed04d37573c566205d965d2e91d54ccae898d0aZhongxing Xu int *p = malloc(12); 153ed04d37573c566205d965d2e91d54ccae898d0aZhongxing Xu p[3] = 4; // expected-warning{{Access out-of-bound array element (buffer overflow)}} 163ed04d37573c566205d965d2e91d54ccae898d0aZhongxing Xu} 179618b858e2b4f79aa2b8b0291e9c833cee0435f8Zhongxing Xu 189618b858e2b4f79aa2b8b0291e9c833cee0435f8Zhongxing Xustruct three_words { 199618b858e2b4f79aa2b8b0291e9c833cee0435f8Zhongxing Xu int c[3]; 209618b858e2b4f79aa2b8b0291e9c833cee0435f8Zhongxing Xu}; 219618b858e2b4f79aa2b8b0291e9c833cee0435f8Zhongxing Xu 229618b858e2b4f79aa2b8b0291e9c833cee0435f8Zhongxing Xustruct seven_words { 239618b858e2b4f79aa2b8b0291e9c833cee0435f8Zhongxing Xu int c[7]; 249618b858e2b4f79aa2b8b0291e9c833cee0435f8Zhongxing Xu}; 259618b858e2b4f79aa2b8b0291e9c833cee0435f8Zhongxing Xu 269618b858e2b4f79aa2b8b0291e9c833cee0435f8Zhongxing Xuvoid f3() { 279618b858e2b4f79aa2b8b0291e9c833cee0435f8Zhongxing Xu struct three_words a, *p; 289618b858e2b4f79aa2b8b0291e9c833cee0435f8Zhongxing Xu p = &a; 299618b858e2b4f79aa2b8b0291e9c833cee0435f8Zhongxing Xu p[0] = a; // no-warning 309618b858e2b4f79aa2b8b0291e9c833cee0435f8Zhongxing Xu p[1] = a; // expected-warning{{Access out-of-bound array element (buffer overflow)}} 319618b858e2b4f79aa2b8b0291e9c833cee0435f8Zhongxing Xu} 329618b858e2b4f79aa2b8b0291e9c833cee0435f8Zhongxing Xu 339618b858e2b4f79aa2b8b0291e9c833cee0435f8Zhongxing Xuvoid f4() { 349618b858e2b4f79aa2b8b0291e9c833cee0435f8Zhongxing Xu struct seven_words c; 359618b858e2b4f79aa2b8b0291e9c833cee0435f8Zhongxing Xu struct three_words a, *p = (struct three_words *)&c; 369618b858e2b4f79aa2b8b0291e9c833cee0435f8Zhongxing Xu p[0] = a; // no-warning 379618b858e2b4f79aa2b8b0291e9c833cee0435f8Zhongxing Xu p[1] = a; // no-warning 389618b858e2b4f79aa2b8b0291e9c833cee0435f8Zhongxing Xu p[2] = a; // expected-warning{{Access out-of-bound array element (buffer overflow)}} 399618b858e2b4f79aa2b8b0291e9c833cee0435f8Zhongxing Xu} 40a5ce966d1a23d84aa5e849cf0ed62494e736ea6aZhongxing Xu 41a5ce966d1a23d84aa5e849cf0ed62494e736ea6aZhongxing Xuvoid f5() { 42a5ce966d1a23d84aa5e849cf0ed62494e736ea6aZhongxing Xu char *p = calloc(2,2); 43a5ce966d1a23d84aa5e849cf0ed62494e736ea6aZhongxing Xu p[3] = '.'; // no-warning 44a5ce966d1a23d84aa5e849cf0ed62494e736ea6aZhongxing Xu p[4] = '!'; // expected-warning{{out-of-bound}} 45a5ce966d1a23d84aa5e849cf0ed62494e736ea6aZhongxing Xu} 464d912b24b393fe6b7422e5502f3a330cbdc5c6b7Jordy Rose 474d912b24b393fe6b7422e5502f3a330cbdc5c6b7Jordy Rosevoid f6() { 484d912b24b393fe6b7422e5502f3a330cbdc5c6b7Jordy Rose char a[2]; 494d912b24b393fe6b7422e5502f3a330cbdc5c6b7Jordy Rose int *b = (int*)a; 504d912b24b393fe6b7422e5502f3a330cbdc5c6b7Jordy Rose b[1] = 3; // expected-warning{{out-of-bound}} 514d912b24b393fe6b7422e5502f3a330cbdc5c6b7Jordy Rose} 5232f2656b90900ac04c4b50e87c16749d0ceb9ef2Jordy Rose 5332f2656b90900ac04c4b50e87c16749d0ceb9ef2Jordy Rosevoid f7() { 5432f2656b90900ac04c4b50e87c16749d0ceb9ef2Jordy Rose struct three_words a; 5532f2656b90900ac04c4b50e87c16749d0ceb9ef2Jordy Rose a.c[3] = 1; // expected-warning{{out-of-bound}} 5632f2656b90900ac04c4b50e87c16749d0ceb9ef2Jordy Rose} 57