1// RUN: %clang_cc1 -analyze -analyzer-checker=core,unix.MismatchedDeallocator -fblocks -verify %s
2
3#include "Inputs/system-header-simulator-objc.h"
4#include "Inputs/system-header-simulator-cxx.h"
5
6typedef __typeof__(sizeof(int)) size_t;
7void *malloc(size_t);
8void *realloc(void *ptr, size_t size);
9void *calloc(size_t nmemb, size_t size);
10char *strdup(const char *s);
11void __attribute((ownership_returns(malloc))) *my_malloc(size_t);
12
13void free(void *);
14void __attribute((ownership_takes(malloc, 1))) my_free(void *);
15
16//---------------------------------------------------------------
17// Test if an allocation function matches deallocation function
18//---------------------------------------------------------------
19
20//--------------- test malloc family
21void testMalloc1() {
22  int *p = (int *)malloc(sizeof(int));
23  delete p; // expected-warning{{Memory allocated by malloc() should be deallocated by free(), not 'delete'}}
24}
25
26void testMalloc2() {
27  int *p = (int *)malloc(8);
28  int *q = (int *)realloc(p, 16);
29  delete q; // expected-warning{{Memory allocated by realloc() should be deallocated by free(), not 'delete'}}
30}
31
32void testMalloc3() {
33  int *p = (int *)calloc(1, sizeof(int));
34  delete p; // expected-warning{{Memory allocated by calloc() should be deallocated by free(), not 'delete'}}
35}
36
37void testMalloc4(const char *s) {
38  char *p = strdup(s);
39  delete p; // expected-warning{{Memory allocated by strdup() should be deallocated by free(), not 'delete'}}
40}
41
42void testMalloc5() {
43  int *p = (int *)my_malloc(sizeof(int));
44  delete p; // expected-warning{{Memory allocated by my_malloc() should be deallocated by free(), not 'delete'}}
45}
46
47void testMalloc6() {
48  int *p = (int *)malloc(sizeof(int));
49  operator delete(p); // expected-warning{{Memory allocated by malloc() should be deallocated by free(), not operator delete}}
50}
51
52void testMalloc7() {
53  int *p = (int *)malloc(sizeof(int));
54  delete[] p; // expected-warning{{Memory allocated by malloc() should be deallocated by free(), not 'delete[]'}}
55}
56
57void testMalloc8() {
58  int *p = (int *)malloc(sizeof(int));
59  operator delete[](p); // expected-warning{{Memory allocated by malloc() should be deallocated by free(), not operator delete[]}}
60}
61
62//--------------- test new family
63void testNew1() {
64  int *p = new int;
65  free(p); // expected-warning{{Memory allocated by 'new' should be deallocated by 'delete', not free()}}
66}
67
68void testNew2() {
69  int *p = (int *)operator new(0);
70  free(p); // expected-warning{{Memory allocated by operator new should be deallocated by 'delete', not free()}}
71}
72
73void testNew3() {
74  int *p = new int[1];
75  free(p); // expected-warning{{Memory allocated by 'new[]' should be deallocated by 'delete[]', not free()}}
76}
77
78void testNew4() {
79  int *p = new int;
80  realloc(p, sizeof(long)); // expected-warning{{Memory allocated by 'new' should be deallocated by 'delete', not realloc()}}
81}
82
83void testNew5() {
84  int *p = (int *)operator new(0);
85  realloc(p, sizeof(long)); // expected-warning{{Memory allocated by operator new should be deallocated by 'delete', not realloc()}}
86}
87
88void testNew6() {
89  int *p = new int[1];
90  realloc(p, sizeof(long)); // expected-warning{{Memory allocated by 'new[]' should be deallocated by 'delete[]', not realloc()}}
91}
92
93void testNew7() {
94  int *p = new int;
95  delete[] p; // expected-warning{{Memory allocated by 'new' should be deallocated by 'delete', not 'delete[]'}}
96}
97
98void testNew8() {
99  int *p = (int *)operator new(0);
100  delete[] p; // expected-warning{{Memory allocated by operator new should be deallocated by 'delete', not 'delete[]'}}
101}
102
103void testNew9() {
104  int *p = new int[1];
105  delete p; // expected-warning{{Memory allocated by 'new[]' should be deallocated by 'delete[]', not 'delete'}}
106}
107
108void testNew10() {
109  int *p = (int *)operator new[](0);
110  delete p; // expected-warning{{Memory allocated by operator new[] should be deallocated by 'delete[]', not 'delete'}}
111}
112
113void testNew11(NSUInteger dataLength) {
114  int *p = new int;
115  NSData *d = [NSData dataWithBytesNoCopy:p length:sizeof(int) freeWhenDone:1]; // expected-warning{{+dataWithBytesNoCopy:length:freeWhenDone: cannot take ownership of memory allocated by 'new'}}
116}
117
118//-------------------------------------------------------
119// Check for intersection with unix.Malloc bounded with 
120// unix.MismatchedDeallocator
121//-------------------------------------------------------
122
123// new/delete oparators are subjects of cplusplus.NewDelete.
124void testNewDeleteNoWarn() {
125  int i;
126  delete &i; // no-warning
127
128  int *p1 = new int;
129  delete ++p1; // no-warning
130
131  int *p2 = new int;
132  delete p2;
133  delete p2; // no-warning
134
135  int *p3 = new int; // no-warning
136}
137
138void testDeleteOpAfterFree() {
139  int *p = (int *)malloc(sizeof(int));
140  free(p);
141  operator delete(p); // no-warning
142}
143
144void testDeleteAfterFree() {
145  int *p = (int *)malloc(sizeof(int));
146  free(p);
147  delete p; // no-warning
148}
149
150void testStandardPlacementNewAfterFree() {
151  int *p = (int *)malloc(sizeof(int));
152  free(p);
153  p = new(p) int; // no-warning
154}
155
156//---------------------------------------------------------------
157// Check for intersection with cplusplus.NewDelete bounded with 
158// unix.MismatchedDeallocator
159//---------------------------------------------------------------
160
161// malloc()/free() are subjects of unix.Malloc and unix.MallocWithAnnotations
162void testMallocFreeNoWarn() {
163  int i;
164  free(&i); // no-warning
165
166  int *p1 = (int *)malloc(sizeof(int));
167  free(++p1); // no-warning
168
169  int *p2 = (int *)malloc(sizeof(int));
170  free(p2);
171  free(p2); // no-warning
172
173  int *p3 = (int *)malloc(sizeof(int)); // no-warning
174}
175
176void testFreeAfterDelete() {
177  int *p = new int;  
178  delete p;
179  free(p); // no-warning
180}
181
182void testStandardPlacementNewAfterDelete() {
183  int *p = new int;  
184  delete p;
185  p = new(p) int; // no-warning
186}
187
188
189// Smart pointer example
190template <typename T>
191struct SimpleSmartPointer {
192  T *ptr;
193
194  explicit SimpleSmartPointer(T *p = 0) : ptr(p) {}
195  ~SimpleSmartPointer() {
196    delete ptr;
197    // expected-warning@-1 {{Memory allocated by 'new[]' should be deallocated by 'delete[]', not 'delete'}}
198    // expected-warning@-2 {{Memory allocated by malloc() should be deallocated by free(), not 'delete'}}
199  }
200};
201
202void testSimpleSmartPointerArrayNew() {
203  {
204    SimpleSmartPointer<int> a(new int);
205  } // no-warning
206
207  {
208    SimpleSmartPointer<int> a(new int[4]);
209  }
210}
211
212void testSimpleSmartPointerMalloc() {
213  {
214    SimpleSmartPointer<int> a(new int);
215  } // no-warning
216
217  {
218    SimpleSmartPointer<int> a((int *)malloc(4));
219  }
220}
221