outofbound.c revision 9618b858e2b4f79aa2b8b0291e9c833cee0435f8
1565e465c6d0093f1bf8414b2cabdc842022385a9Ted Kremenek// RUN: %clang_cc1 -analyze -analyzer-experimental-internal-checks -analyzer-experimental-checks -analyzer-check-objc-mem -analyzer-store=region -verify %s
23ed04d37573c566205d965d2e91d54ccae898d0aZhongxing Xu
33ed04d37573c566205d965d2e91d54ccae898d0aZhongxing Xutypedef __typeof(sizeof(int)) size_t;
43ed04d37573c566205d965d2e91d54ccae898d0aZhongxing Xuvoid *malloc(size_t);
520f0178a232029bea7f34adecb6e5bdd6fada483Zhongxing Xu
620f0178a232029bea7f34adecb6e5bdd6fada483Zhongxing Xuchar f1() {
720f0178a232029bea7f34adecb6e5bdd6fada483Zhongxing Xu  char* s = "abcd";
8f9e96843e8a0afd0d5f58ba224fb8d57cba8effaTed Kremenek  char c = s[4]; // no-warning
958e689fead1490611bcd114fb707bfc08a12049eZhongxing Xu  return s[5] + c; // expected-warning{{Access out-of-bound array element (buffer overflow)}}
1020f0178a232029bea7f34adecb6e5bdd6fada483Zhongxing Xu}
113ed04d37573c566205d965d2e91d54ccae898d0aZhongxing Xu
123ed04d37573c566205d965d2e91d54ccae898d0aZhongxing Xuvoid f2() {
133ed04d37573c566205d965d2e91d54ccae898d0aZhongxing Xu  int *p = malloc(12);
143ed04d37573c566205d965d2e91d54ccae898d0aZhongxing Xu  p[3] = 4; // expected-warning{{Access out-of-bound array element (buffer overflow)}}
153ed04d37573c566205d965d2e91d54ccae898d0aZhongxing Xu}
169618b858e2b4f79aa2b8b0291e9c833cee0435f8Zhongxing Xu
179618b858e2b4f79aa2b8b0291e9c833cee0435f8Zhongxing Xustruct three_words {
189618b858e2b4f79aa2b8b0291e9c833cee0435f8Zhongxing Xu  int c[3];
199618b858e2b4f79aa2b8b0291e9c833cee0435f8Zhongxing Xu};
209618b858e2b4f79aa2b8b0291e9c833cee0435f8Zhongxing Xu
219618b858e2b4f79aa2b8b0291e9c833cee0435f8Zhongxing Xustruct seven_words {
229618b858e2b4f79aa2b8b0291e9c833cee0435f8Zhongxing Xu  int c[7];
239618b858e2b4f79aa2b8b0291e9c833cee0435f8Zhongxing Xu};
249618b858e2b4f79aa2b8b0291e9c833cee0435f8Zhongxing Xu
259618b858e2b4f79aa2b8b0291e9c833cee0435f8Zhongxing Xuvoid f3() {
269618b858e2b4f79aa2b8b0291e9c833cee0435f8Zhongxing Xu  struct three_words a, *p;
279618b858e2b4f79aa2b8b0291e9c833cee0435f8Zhongxing Xu  p = &a;
289618b858e2b4f79aa2b8b0291e9c833cee0435f8Zhongxing Xu  p[0] = a; // no-warning
299618b858e2b4f79aa2b8b0291e9c833cee0435f8Zhongxing Xu  p[1] = a; // expected-warning{{Access out-of-bound array element (buffer overflow)}}
309618b858e2b4f79aa2b8b0291e9c833cee0435f8Zhongxing Xu}
319618b858e2b4f79aa2b8b0291e9c833cee0435f8Zhongxing Xu
329618b858e2b4f79aa2b8b0291e9c833cee0435f8Zhongxing Xuvoid f4() {
339618b858e2b4f79aa2b8b0291e9c833cee0435f8Zhongxing Xu  struct seven_words c;
349618b858e2b4f79aa2b8b0291e9c833cee0435f8Zhongxing Xu  struct three_words a, *p = (struct three_words *)&c;
359618b858e2b4f79aa2b8b0291e9c833cee0435f8Zhongxing Xu  p[0] = a; // no-warning
369618b858e2b4f79aa2b8b0291e9c833cee0435f8Zhongxing Xu  p[1] = a; // no-warning
379618b858e2b4f79aa2b8b0291e9c833cee0435f8Zhongxing Xu  p[2] = a; // expected-warning{{Access out-of-bound array element (buffer overflow)}}
389618b858e2b4f79aa2b8b0291e9c833cee0435f8Zhongxing Xu}
39