malloc-annotations.c revision 0d53ab4024488d0c6cd283992be3fd4b67099bd3 
1// RUN: %clang_cc1 -analyze -analyzer-checker=core,experimental.deadcode.UnreachableCode,experimental.core.CastSize,experimental.unix.MallocWithAnnotations -analyzer-store=region -verify %s
2typedef __typeof(sizeof(int)) size_t;
3void *malloc(size_t);
4void free(void *);
5void *realloc(void *ptr, size_t size);
6void *calloc(size_t nmemb, size_t size);
7void __attribute((ownership_returns(malloc))) *my_malloc(size_t);
8void __attribute((ownership_takes(malloc, 1))) my_free(void *);
9void my_freeBoth(void *, void *)
10       __attribute((ownership_holds(malloc, 1, 2)));
11void __attribute((ownership_returns(malloc, 1))) *my_malloc2(size_t);
12void __attribute((ownership_holds(malloc, 1))) my_hold(void *);
13
14// Duplicate attributes are silly, but not an error.
15// Duplicate attribute has no extra effect.
16// If two are of different kinds, that is an error and reported as such.
17void __attribute((ownership_holds(malloc, 1)))
18__attribute((ownership_holds(malloc, 1)))
19__attribute((ownership_holds(malloc, 3))) my_hold2(void *, void *, void *);
20void *my_malloc3(size_t);
21void *myglobalpointer;
22struct stuff {
23  void *somefield;
24};
25struct stuff myglobalstuff;
26
27void f1() {
28  int *p = malloc(12);
29  return; // expected-warning{{Memory is never released; potential leak}}
30}
31
32void f2() {
33  int *p = malloc(12);
34  free(p);
35  free(p); // expected-warning{{Attempt to free released memory}}
36}
37
38void f2_realloc_0() {
39  int *p = malloc(12);
40  realloc(p,0);
41  realloc(p,0); // expected-warning{{Attempt to free released memory}}
42}
43
44void f2_realloc_1() {
45  int *p = malloc(12);
46  int *q = realloc(p,0); // no-warning
47}
48
49// ownership attributes tests
50void naf1() {
51  int *p = my_malloc3(12);
52  return; // no-warning
53}
54
55void n2af1() {
56  int *p = my_malloc2(12);
57  return; // expected-warning{{Memory is never released; potential leak}}
58}
59
60void af1() {
61  int *p = my_malloc(12);
62  return; // expected-warning{{Memory is never released; potential leak}}
63}
64
65void af1_b() {
66  int *p = my_malloc(12); // expected-warning{{Memory is never released; potential leak}}
67}
68
69void af1_c() {
70  myglobalpointer = my_malloc(12); // no-warning
71}
72
73void af1_d() {
74  struct stuff mystuff;
75  mystuff.somefield = my_malloc(12); // expected-warning{{Memory is never released; potential leak}}
76}
77
78// Test that we can pass out allocated memory via pointer-to-pointer.
79void af1_e(void **pp) {
80  *pp = my_malloc(42); // no-warning
81}
82
83void af1_f(struct stuff *somestuff) {
84  somestuff->somefield = my_malloc(12); // no-warning
85}
86
87// Allocating memory for a field via multiple indirections to our arguments is OK.
88void af1_g(struct stuff **pps) {
89  *pps = my_malloc(sizeof(struct stuff)); // no-warning
90  (*pps)->somefield = my_malloc(42); // no-warning
91}
92
93void af2() {
94  int *p = my_malloc(12);
95  my_free(p);
96  free(p); // expected-warning{{Attempt to free released memory}}
97}
98
99void af2b() {
100  int *p = my_malloc(12);
101  free(p);
102  my_free(p); // expected-warning{{Attempt to free released memory}}
103}
104
105void af2c() {
106  int *p = my_malloc(12);
107  free(p);
108  my_hold(p); // expected-warning{{Attempt to free released memory}}
109}
110
111void af2d() {
112  int *p = my_malloc(12);
113  free(p);
114  my_hold2(0, 0, p); // expected-warning{{Attempt to free released memory}}
115}
116
117// No leak if malloc returns null.
118void af2e() {
119  int *p = my_malloc(12);
120  if (!p)
121    return; // no-warning
122  free(p); // no-warning
123}
124
125// This case inflicts a possible double-free.
126void af3() {
127  int *p = my_malloc(12);
128  my_hold(p);
129  free(p); // expected-warning{{Attempt to free non-owned memory}}
130}
131
132int * af4() {
133  int *p = my_malloc(12);
134  my_free(p);
135  return p; // expected-warning{{Use of memory after it is freed}}
136}
137
138// This case is (possibly) ok, be conservative
139int * af5() {
140  int *p = my_malloc(12);
141  my_hold(p);
142  return p; // no-warning
143}
144
145
146
147// This case tests that storing malloc'ed memory to a static variable which is
148// then returned is not leaked.  In the absence of known contracts for functions
149// or inter-procedural analysis, this is a conservative answer.
150int *f3() {
151  static int *p = 0;
152  p = malloc(12);
153  return p; // no-warning
154}
155
156// This case tests that storing malloc'ed memory to a static global variable
157// which is then returned is not leaked.  In the absence of known contracts for
158// functions or inter-procedural analysis, this is a conservative answer.
159static int *p_f4 = 0;
160int *f4() {
161  p_f4 = malloc(12);
162  return p_f4; // no-warning
163}
164
165int *f5() {
166  int *q = malloc(12);
167  q = realloc(q, 20);
168  return q; // no-warning
169}
170
171void f6() {
172  int *p = malloc(12);
173  if (!p)
174    return; // no-warning
175  else
176    free(p);
177}
178
179void f6_realloc() {
180  int *p = malloc(12);
181  if (!p)
182    return; // no-warning
183  else
184    realloc(p,0);
185}
186
187
188char *doit2();
189void pr6069() {
190  char *buf = doit2();
191  free(buf);
192}
193
194void pr6293() {
195  free(0);
196}
197
198void f7() {
199  char *x = (char*) malloc(4);
200  free(x);
201  x[0] = 'a'; // expected-warning{{Use of memory after it is freed}}
202}
203
204void f7_realloc() {
205  char *x = (char*) malloc(4);
206  realloc(x,0);
207  x[0] = 'a'; // expected-warning{{Use of memory after it is freed}}
208}
209
210void PR6123() {
211  int *x = malloc(11); // expected-warning{{Cast a region whose size is not a multiple of the destination type size.}}
212}
213
214void PR7217() {
215  int *buf = malloc(2); // expected-warning{{Cast a region whose size is not a multiple of the destination type size.}}
216  buf[1] = 'c'; // not crash
217}
218
219void mallocCastToVoid() {
220  void *p = malloc(2);
221  const void *cp = p; // not crash
222  free(p);
223}
224
225void mallocCastToFP() {
226  void *p = malloc(2);
227  void (*fp)() = p; // not crash
228  free(p);
229}
230
231// This tests that malloc() buffers are undefined by default
232char mallocGarbage () {
233  char *buf = malloc(2);
234  char result = buf[1]; // expected-warning{{undefined}}
235  free(buf);
236  return result;
237}
238
239// This tests that calloc() buffers need to be freed
240void callocNoFree () {
241  char *buf = calloc(2,2);
242  return; // expected-warning{{never released}}
243}
244
245// These test that calloc() buffers are zeroed by default
246char callocZeroesGood () {
247  char *buf = calloc(2,2);
248  char result = buf[3]; // no-warning
249  if (buf[1] == 0) {
250    free(buf);
251  }
252  return result; // no-warning
253}
254
255char callocZeroesBad () {
256  char *buf = calloc(2,2);
257  char result = buf[3]; // no-warning
258  if (buf[1] != 0) {
259    free(buf); // expected-warning{{never executed}}
260  }
261  return result; // expected-warning{{never released}}
262}
263
264void testMultipleFreeAnnotations() {
265  int *p = malloc(12);
266  int *q = malloc(12);
267  my_freeBoth(p, q);
268}
269
270