outofbound.c revision b7e3aabf8f0fe4210d6a0aaec8a2b5770cab9186
1565e465c6d0093f1bf8414b2cabdc842022385a9Ted Kremenek// RUN: %clang_cc1 -analyze -analyzer-experimental-internal-checks -analyzer-experimental-checks -analyzer-check-objc-mem -analyzer-store=region -verify %s 23ed04d37573c566205d965d2e91d54ccae898d0aZhongxing Xu 33ed04d37573c566205d965d2e91d54ccae898d0aZhongxing Xutypedef __typeof(sizeof(int)) size_t; 43ed04d37573c566205d965d2e91d54ccae898d0aZhongxing Xuvoid *malloc(size_t); 5a5ce966d1a23d84aa5e849cf0ed62494e736ea6aZhongxing Xuvoid *calloc(size_t, size_t); 620f0178a232029bea7f34adecb6e5bdd6fada483Zhongxing Xu 720f0178a232029bea7f34adecb6e5bdd6fada483Zhongxing Xuchar f1() { 820f0178a232029bea7f34adecb6e5bdd6fada483Zhongxing Xu char* s = "abcd"; 9f9e96843e8a0afd0d5f58ba224fb8d57cba8effaTed Kremenek char c = s[4]; // no-warning 1058e689fead1490611bcd114fb707bfc08a12049eZhongxing Xu return s[5] + c; // expected-warning{{Access out-of-bound array element (buffer overflow)}} 1120f0178a232029bea7f34adecb6e5bdd6fada483Zhongxing Xu} 123ed04d37573c566205d965d2e91d54ccae898d0aZhongxing Xu 133ed04d37573c566205d965d2e91d54ccae898d0aZhongxing Xuvoid f2() { 143ed04d37573c566205d965d2e91d54ccae898d0aZhongxing Xu int *p = malloc(12); 153ed04d37573c566205d965d2e91d54ccae898d0aZhongxing Xu p[3] = 4; // expected-warning{{Access out-of-bound array element (buffer overflow)}} 163ed04d37573c566205d965d2e91d54ccae898d0aZhongxing Xu} 179618b858e2b4f79aa2b8b0291e9c833cee0435f8Zhongxing Xu 189618b858e2b4f79aa2b8b0291e9c833cee0435f8Zhongxing Xustruct three_words { 199618b858e2b4f79aa2b8b0291e9c833cee0435f8Zhongxing Xu int c[3]; 209618b858e2b4f79aa2b8b0291e9c833cee0435f8Zhongxing Xu}; 219618b858e2b4f79aa2b8b0291e9c833cee0435f8Zhongxing Xu 229618b858e2b4f79aa2b8b0291e9c833cee0435f8Zhongxing Xustruct seven_words { 239618b858e2b4f79aa2b8b0291e9c833cee0435f8Zhongxing Xu int c[7]; 249618b858e2b4f79aa2b8b0291e9c833cee0435f8Zhongxing Xu}; 259618b858e2b4f79aa2b8b0291e9c833cee0435f8Zhongxing Xu 269618b858e2b4f79aa2b8b0291e9c833cee0435f8Zhongxing Xuvoid f3() { 279618b858e2b4f79aa2b8b0291e9c833cee0435f8Zhongxing Xu struct three_words a, *p; 289618b858e2b4f79aa2b8b0291e9c833cee0435f8Zhongxing Xu p = &a; 299618b858e2b4f79aa2b8b0291e9c833cee0435f8Zhongxing Xu p[0] = a; // no-warning 309618b858e2b4f79aa2b8b0291e9c833cee0435f8Zhongxing Xu p[1] = a; // expected-warning{{Access out-of-bound array element (buffer overflow)}} 319618b858e2b4f79aa2b8b0291e9c833cee0435f8Zhongxing Xu} 329618b858e2b4f79aa2b8b0291e9c833cee0435f8Zhongxing Xu 339618b858e2b4f79aa2b8b0291e9c833cee0435f8Zhongxing Xuvoid f4() { 349618b858e2b4f79aa2b8b0291e9c833cee0435f8Zhongxing Xu struct seven_words c; 359618b858e2b4f79aa2b8b0291e9c833cee0435f8Zhongxing Xu struct three_words a, *p = (struct three_words *)&c; 369618b858e2b4f79aa2b8b0291e9c833cee0435f8Zhongxing Xu p[0] = a; // no-warning 379618b858e2b4f79aa2b8b0291e9c833cee0435f8Zhongxing Xu p[1] = a; // no-warning 389618b858e2b4f79aa2b8b0291e9c833cee0435f8Zhongxing Xu p[2] = a; // expected-warning{{Access out-of-bound array element (buffer overflow)}} 399618b858e2b4f79aa2b8b0291e9c833cee0435f8Zhongxing Xu} 40a5ce966d1a23d84aa5e849cf0ed62494e736ea6aZhongxing Xu 41a5ce966d1a23d84aa5e849cf0ed62494e736ea6aZhongxing Xuvoid f5() { 42a5ce966d1a23d84aa5e849cf0ed62494e736ea6aZhongxing Xu char *p = calloc(2,2); 43a5ce966d1a23d84aa5e849cf0ed62494e736ea6aZhongxing Xu p[3] = '.'; // no-warning 44a5ce966d1a23d84aa5e849cf0ed62494e736ea6aZhongxing Xu p[4] = '!'; // expected-warning{{out-of-bound}} 45a5ce966d1a23d84aa5e849cf0ed62494e736ea6aZhongxing Xu} 464d912b24b393fe6b7422e5502f3a330cbdc5c6b7Jordy Rose 474d912b24b393fe6b7422e5502f3a330cbdc5c6b7Jordy Rosevoid f6() { 484d912b24b393fe6b7422e5502f3a330cbdc5c6b7Jordy Rose char a[2]; 494d912b24b393fe6b7422e5502f3a330cbdc5c6b7Jordy Rose int *b = (int*)a; 504d912b24b393fe6b7422e5502f3a330cbdc5c6b7Jordy Rose b[1] = 3; // expected-warning{{out-of-bound}} 514d912b24b393fe6b7422e5502f3a330cbdc5c6b7Jordy Rose} 5232f2656b90900ac04c4b50e87c16749d0ceb9ef2Jordy Rose 5332f2656b90900ac04c4b50e87c16749d0ceb9ef2Jordy Rosevoid f7() { 5432f2656b90900ac04c4b50e87c16749d0ceb9ef2Jordy Rose struct three_words a; 5532f2656b90900ac04c4b50e87c16749d0ceb9ef2Jordy Rose a.c[3] = 1; // expected-warning{{out-of-bound}} 5632f2656b90900ac04c4b50e87c16749d0ceb9ef2Jordy Rose} 5752e04c537633377fb14cfa4fa3c95e3e510fc942Jordy Rose 5852e04c537633377fb14cfa4fa3c95e3e510fc942Jordy Rosevoid vla(int a) { 5952e04c537633377fb14cfa4fa3c95e3e510fc942Jordy Rose if (a == 5) { 6052e04c537633377fb14cfa4fa3c95e3e510fc942Jordy Rose int x[a]; 6152e04c537633377fb14cfa4fa3c95e3e510fc942Jordy Rose x[4] = 4; // no-warning 6252e04c537633377fb14cfa4fa3c95e3e510fc942Jordy Rose x[5] = 5; // expected-warning{{out-of-bound}} 6352e04c537633377fb14cfa4fa3c95e3e510fc942Jordy Rose } 6452e04c537633377fb14cfa4fa3c95e3e510fc942Jordy Rose} 65b7e3aabf8f0fe4210d6a0aaec8a2b5770cab9186Jordy Rose 66b7e3aabf8f0fe4210d6a0aaec8a2b5770cab9186Jordy Rosevoid sizeof_vla(int a) { 67b7e3aabf8f0fe4210d6a0aaec8a2b5770cab9186Jordy Rose if (a == 5) { 68b7e3aabf8f0fe4210d6a0aaec8a2b5770cab9186Jordy Rose char x[a]; 69b7e3aabf8f0fe4210d6a0aaec8a2b5770cab9186Jordy Rose int y[sizeof(x)]; 70b7e3aabf8f0fe4210d6a0aaec8a2b5770cab9186Jordy Rose y[4] = 4; // no-warning 71b7e3aabf8f0fe4210d6a0aaec8a2b5770cab9186Jordy Rose y[5] = 5; // expected-warning{{out-of-bound}} 72b7e3aabf8f0fe4210d6a0aaec8a2b5770cab9186Jordy Rose } 73b7e3aabf8f0fe4210d6a0aaec8a2b5770cab9186Jordy Rose} 74