array-struct.c revision 6c07bdba93b095b66e2c8c82dd5ed458fa8285ea
1// RUN: clang-cc -analyze -checker-cfref -analyzer-store=basic -analyzer-constraints=basic -verify %s && 2// RUN: clang-cc -analyze -checker-cfref -analyzer-store=basic -analyzer-constraints=range -verify %s 3 4// RegionStore now has an infinite recursion with this test case. 5// NOWORK: clang-cc -analyze -checker-cfref -analyzer-store=region -analyzer-constraints=basic -verify %s && 6// NOWORK: clang-cc -analyze -checker-cfref -analyzer-store=region -analyzer-constraints=range -verify %s 7 8struct s { 9 int data; 10 int data_array[10]; 11}; 12 13typedef struct { 14 int data; 15} STYPE; 16 17void g(char *p); 18void g1(struct s* p); 19 20// Array to pointer conversion. Array in the struct field. 21void f(void) { 22 int a[10]; 23 int (*p)[10]; 24 p = &a; 25 (*p)[3] = 1; 26 27 struct s d; 28 struct s *q; 29 q = &d; 30 q->data = 3; 31 d.data_array[9] = 17; 32} 33 34// StringLiteral in lvalue context and pointer to array type. 35// p: ElementRegion, q: StringRegion 36void f2() { 37 char *p = "/usr/local"; 38 char (*q)[4]; 39 q = &"abc"; 40} 41 42// Typedef'ed struct definition. 43void f3() { 44 STYPE s; 45} 46 47// Initialize array with InitExprList. 48void f4() { 49 int a[] = { 1, 2, 3}; 50 int b[3] = { 1, 2 }; 51 struct s c[] = {{1,{1}}}; 52} 53 54// Struct variable in lvalue context. 55// Assign UnknownVal to the whole struct. 56void f5() { 57 struct s data; 58 g1(&data); 59} 60 61// AllocaRegion test. 62void f6() { 63 char *p; 64 p = __builtin_alloca(10); 65 g(p); 66 char c = *p; 67 p[1] = 'a'; 68 // Test if RegionStore::EvalBinOp converts the alloca region to element 69 // region. 70 p += 2; 71} 72 73struct s2; 74 75void g2(struct s2 *p); 76 77// Incomplete struct pointer used as function argument. 78void f7() { 79 struct s2 *p = __builtin_alloca(10); 80 g2(p); 81} 82 83// sizeof() is unsigned while -1 is signed in array index. 84void f8() { 85 int a[10]; 86 a[sizeof(a)/sizeof(int) - 1] = 1; // no-warning 87} 88 89// Initialization of struct array elements. 90void f9() { 91 struct s a[10]; 92} 93 94// Initializing array with string literal. 95void f10() { 96 char a1[4] = "abc"; 97 char a3[6] = "abc"; 98} 99 100// Retrieve the default value of element/field region. 101void f11() { 102 struct s a; 103 g1(&a); 104 if (a.data == 0) // no-warning 105 a.data = 1; 106} 107 108// Convert unsigned offset to signed when creating ElementRegion from 109// SymbolicRegion. 110void f12(int *list) { 111 unsigned i = 0; 112 list[i] = 1; 113} 114 115struct s1 { 116 struct s2 { 117 int d; 118 } e; 119}; 120 121// The binding of a.e.d should not be removed. Test recursive subregion map 122// building: a->e, e->d. Only then 'a' could be added to live region roots. 123void f13(double timeout) { 124 struct s1 a; 125 a.e.d = (long) timeout; 126 if (a.e.d == 10) 127 a.e.d = 4; 128} 129 130struct s3 { 131 int a[2]; 132}; 133 134static struct s3 opt; 135 136// Test if the embedded array is retrieved correctly. 137void f14() { 138 struct s3 my_opt = opt; 139} 140 141void bar(int*); 142 143// Test if the array is correctly invalidated. 144void f15() { 145 int a[10]; 146 bar(a); 147 if (a[1]) // no-warning 148 1; 149} 150 151struct s3 p[1]; 152 153// Code from postgresql. 154// Current cast logic of region store mistakenly leaves the final result region 155// an ElementRegion of type 'char'. Then load a nonloc::SymbolVal from it and 156// assigns to 'a'. 157void f16(struct s3 *p) { 158 struct s3 a = *((struct s3*) ((char*) &p[0])); 159} 160