outofbound.c revision 9618b858e2b4f79aa2b8b0291e9c833cee0435f8
1565e465c6d0093f1bf8414b2cabdc842022385a9Ted Kremenek// RUN: %clang_cc1 -analyze -analyzer-experimental-internal-checks -analyzer-experimental-checks -analyzer-check-objc-mem -analyzer-store=region -verify %s 23ed04d37573c566205d965d2e91d54ccae898d0aZhongxing Xu 33ed04d37573c566205d965d2e91d54ccae898d0aZhongxing Xutypedef __typeof(sizeof(int)) size_t; 43ed04d37573c566205d965d2e91d54ccae898d0aZhongxing Xuvoid *malloc(size_t); 520f0178a232029bea7f34adecb6e5bdd6fada483Zhongxing Xu 620f0178a232029bea7f34adecb6e5bdd6fada483Zhongxing Xuchar f1() { 720f0178a232029bea7f34adecb6e5bdd6fada483Zhongxing Xu char* s = "abcd"; 8f9e96843e8a0afd0d5f58ba224fb8d57cba8effaTed Kremenek char c = s[4]; // no-warning 958e689fead1490611bcd114fb707bfc08a12049eZhongxing Xu return s[5] + c; // expected-warning{{Access out-of-bound array element (buffer overflow)}} 1020f0178a232029bea7f34adecb6e5bdd6fada483Zhongxing Xu} 113ed04d37573c566205d965d2e91d54ccae898d0aZhongxing Xu 123ed04d37573c566205d965d2e91d54ccae898d0aZhongxing Xuvoid f2() { 133ed04d37573c566205d965d2e91d54ccae898d0aZhongxing Xu int *p = malloc(12); 143ed04d37573c566205d965d2e91d54ccae898d0aZhongxing Xu p[3] = 4; // expected-warning{{Access out-of-bound array element (buffer overflow)}} 153ed04d37573c566205d965d2e91d54ccae898d0aZhongxing Xu} 169618b858e2b4f79aa2b8b0291e9c833cee0435f8Zhongxing Xu 179618b858e2b4f79aa2b8b0291e9c833cee0435f8Zhongxing Xustruct three_words { 189618b858e2b4f79aa2b8b0291e9c833cee0435f8Zhongxing Xu int c[3]; 199618b858e2b4f79aa2b8b0291e9c833cee0435f8Zhongxing Xu}; 209618b858e2b4f79aa2b8b0291e9c833cee0435f8Zhongxing Xu 219618b858e2b4f79aa2b8b0291e9c833cee0435f8Zhongxing Xustruct seven_words { 229618b858e2b4f79aa2b8b0291e9c833cee0435f8Zhongxing Xu int c[7]; 239618b858e2b4f79aa2b8b0291e9c833cee0435f8Zhongxing Xu}; 249618b858e2b4f79aa2b8b0291e9c833cee0435f8Zhongxing Xu 259618b858e2b4f79aa2b8b0291e9c833cee0435f8Zhongxing Xuvoid f3() { 269618b858e2b4f79aa2b8b0291e9c833cee0435f8Zhongxing Xu struct three_words a, *p; 279618b858e2b4f79aa2b8b0291e9c833cee0435f8Zhongxing Xu p = &a; 289618b858e2b4f79aa2b8b0291e9c833cee0435f8Zhongxing Xu p[0] = a; // no-warning 299618b858e2b4f79aa2b8b0291e9c833cee0435f8Zhongxing Xu p[1] = a; // expected-warning{{Access out-of-bound array element (buffer overflow)}} 309618b858e2b4f79aa2b8b0291e9c833cee0435f8Zhongxing Xu} 319618b858e2b4f79aa2b8b0291e9c833cee0435f8Zhongxing Xu 329618b858e2b4f79aa2b8b0291e9c833cee0435f8Zhongxing Xuvoid f4() { 339618b858e2b4f79aa2b8b0291e9c833cee0435f8Zhongxing Xu struct seven_words c; 349618b858e2b4f79aa2b8b0291e9c833cee0435f8Zhongxing Xu struct three_words a, *p = (struct three_words *)&c; 359618b858e2b4f79aa2b8b0291e9c833cee0435f8Zhongxing Xu p[0] = a; // no-warning 369618b858e2b4f79aa2b8b0291e9c833cee0435f8Zhongxing Xu p[1] = a; // no-warning 379618b858e2b4f79aa2b8b0291e9c833cee0435f8Zhongxing Xu p[2] = a; // expected-warning{{Access out-of-bound array element (buffer overflow)}} 389618b858e2b4f79aa2b8b0291e9c833cee0435f8Zhongxing Xu} 39