malloc.c revision 0860cd0646ed40f87085df39563f2c5f7f77750b 
1// RUN: %clang_cc1 -analyze -analyzer-checker=core,experimental.deadcode.UnreachableCode,experimental.core.CastSize,experimental.unix.Malloc -analyzer-store=region -verify %s
2typedef __typeof(sizeof(int)) size_t;
3void *malloc(size_t);
4void free(void *);
5void *realloc(void *ptr, size_t size);
6void *calloc(size_t nmemb, size_t size);
7
8void myfoo(int *p);
9void myfooint(int p);
10
11void f1() {
12  int *p = malloc(12);
13  return; // expected-warning{{Allocated memory never released. Potential memory leak.}}
14}
15
16void f2() {
17  int *p = malloc(12);
18  free(p);
19  free(p); // expected-warning{{Try to free a memory block that has been released}}
20}
21
22void f2_realloc_0() {
23  int *p = malloc(12);
24  realloc(p,0);
25  realloc(p,0); // expected-warning{{Try to free a memory block that has been released}}
26}
27
28void f2_realloc_1() {
29  int *p = malloc(12);
30  int *q = realloc(p,0); // no-warning
31}
32
33// This case tests that storing malloc'ed memory to a static variable which is
34// then returned is not leaked.  In the absence of known contracts for functions
35// or inter-procedural analysis, this is a conservative answer.
36int *f3() {
37  static int *p = 0;
38  p = malloc(12);
39  return p; // no-warning
40}
41
42// This case tests that storing malloc'ed memory to a static global variable
43// which is then returned is not leaked.  In the absence of known contracts for
44// functions or inter-procedural analysis, this is a conservative answer.
45static int *p_f4 = 0;
46int *f4() {
47  p_f4 = malloc(12);
48  return p_f4; // no-warning
49}
50
51int *f5() {
52  int *q = malloc(12);
53  q = realloc(q, 20);
54  return q; // no-warning
55}
56
57void f6() {
58  int *p = malloc(12);
59  if (!p)
60    return; // no-warning
61  else
62    free(p);
63}
64
65void f6_realloc() {
66  int *p = malloc(12);
67  if (!p)
68    return; // no-warning
69  else
70    realloc(p,0);
71}
72
73
74char *doit2();
75void pr6069() {
76  char *buf = doit2();
77  free(buf);
78}
79
80void pr6293() {
81  free(0);
82}
83
84void f7() {
85  char *x = (char*) malloc(4);
86  free(x);
87  x[0] = 'a'; // expected-warning{{Use of dynamically allocated memory after it is freed.}}
88}
89
90void f7_realloc() {
91  char *x = (char*) malloc(4);
92  realloc(x,0);
93  x[0] = 'a'; // expected-warning{{Use of dynamically allocated memory after it is freed.}}
94}
95
96void PR6123() {
97  int *x = malloc(11); // expected-warning{{Cast a region whose size is not a multiple of the destination type size.}}
98}
99
100void PR7217() {
101  int *buf = malloc(2); // expected-warning{{Cast a region whose size is not a multiple of the destination type size.}}
102  buf[1] = 'c'; // not crash
103}
104
105void mallocCastToVoid() {
106  void *p = malloc(2);
107  const void *cp = p; // not crash
108  free(p);
109}
110
111void mallocCastToFP() {
112  void *p = malloc(2);
113  void (*fp)() = p; // not crash
114  free(p);
115}
116
117// This tests that malloc() buffers are undefined by default
118char mallocGarbage () {
119	char *buf = malloc(2);
120	char result = buf[1]; // expected-warning{{undefined}}
121	free(buf);
122	return result;
123}
124
125// This tests that calloc() buffers need to be freed
126void callocNoFree () {
127  char *buf = calloc(2,2);
128  return; // expected-warning{{never released}}
129}
130
131// These test that calloc() buffers are zeroed by default
132char callocZeroesGood () {
133	char *buf = calloc(2,2);
134	char result = buf[3]; // no-warning
135	if (buf[1] == 0) {
136	  free(buf);
137	}
138	return result; // no-warning
139}
140
141char callocZeroesBad () {
142	char *buf = calloc(2,2);
143	char result = buf[3]; // no-warning
144	if (buf[1] != 0) {
145	  free(buf); // expected-warning{{never executed}}
146	}
147	return result; // expected-warning{{never released}}
148}
149
150void nullFree() {
151  int *p = 0;
152  free(p); // no warning - a nop
153}
154
155void paramFree(int *p) {
156  myfoo(p);
157  free(p); // no warning
158  myfoo(p); // TODO: This should be a warning.
159}
160
161int* mallocEscapeRet() {
162  int *p = malloc(12);
163  return p; // no warning
164}
165
166void mallocEscapeFoo() {
167  int *p = malloc(12);
168  myfoo(p);
169  return; // no warning
170}
171
172void mallocEscapeFree() {
173  int *p = malloc(12);
174  myfoo(p);
175  free(p);
176}
177
178void mallocEscapeFreeFree() {
179  int *p = malloc(12);
180  myfoo(p);
181  free(p);
182  free(p); // expected-warning{{Try to free a memory block that has been released}}
183}
184
185void mallocEscapeFreeUse() {
186  int *p = malloc(12);
187  myfoo(p);
188  free(p);
189  myfoo(p); // expected-warning{{Use of dynamically allocated memory after it is freed.}}
190}
191
192int *myalloc();
193void myalloc2(int **p);
194
195void mallocEscapeFreeCustomAlloc() {
196  int *p = malloc(12);
197  myfoo(p);
198  free(p);
199  p = myalloc();
200  free(p); // no warning
201}
202
203void mallocEscapeFreeCustomAlloc2() {
204  int *p = malloc(12);
205  myfoo(p);
206  free(p);
207  myalloc2(&p);
208  free(p); // no warning
209}
210
211void mallocBindFreeUse() {
212  int *x = malloc(12);
213  int *y = x;
214  free(y);
215  myfoo(x); // expected-warning{{Use of dynamically allocated memory after it is freed.}}
216}
217
218void mallocEscapeMalloc() {
219  int *p = malloc(12);
220  myfoo(p);
221  p = malloc(12); // expected-warning{{Allocated memory never released. Potential memory leak.}}
222}
223
224void mallocMalloc() {
225  int *p = malloc(12);
226  p = malloc(12); // expected-warning{{Allocated memory never released. Potential memory leak}}
227}
228
229void mallocFreeMalloc() {
230  int *p = malloc(12);
231  free(p);
232  p = malloc(12);
233  free(p);
234}
235
236void mallocFreeUse_params() {
237  int *p = malloc(12);
238  free(p);
239  myfoo(p); //expected-warning{{Use of dynamically allocated memory after it is freed}}
240  myfooint(*p); //expected-warning{{Use of dynamically allocated memory after it is freed}}
241}
242
243void mallocFailedOrNot() {
244  int *p = malloc(12);
245  if (!p)
246    free(p);
247  else
248    free(p);
249}
250
251struct StructWithInt {
252  int g;
253};
254
255int *mallocReturnFreed() {
256  int *p = malloc(12);
257  free(p);
258  return p; // expected-warning {{Use of dynamically allocated}}
259}
260
261int useAfterFreeStruct() {
262  struct StructWithInt *px= malloc(sizeof(struct StructWithInt));
263  px->g = 5;
264  free(px);
265  return px->g; // expected-warning {{Use of dynamically allocated}}
266}
267
268void nonSymbolAsFirstArg(int *pp, struct StructWithInt *p);
269
270void mallocEscapeFooNonSymbolArg() {
271  struct StructWithInt *p = malloc(sizeof(struct StructWithInt));
272  nonSymbolAsFirstArg(&p->g, p);
273  return; // no warning
274}
275
276void mallocFailedOrNotLeak() {
277  int *p = malloc(12);
278  if (p == 0)
279    return; // no warning
280  else
281    return; // expected-warning {{Allocated memory never released. Potential memory leak.}}
282}
283
284int *Gl;
285struct GlStTy {
286  int *x;
287};
288
289struct GlStTy GlS = {0};
290
291void GlobalFree() {
292  free(Gl);
293}
294
295void GlobalMalloc() {
296  Gl = malloc(12);
297}
298
299void GlobalStructMalloc() {
300  int *a = malloc(12);
301  GlS.x = a;
302}
303
304void GlobalStructMallocFree() {
305  int *a = malloc(12);
306  GlS.x = a;
307  free(GlS.x);
308}
309
310// Region escape testing.
311
312unsigned takePtrToPtr(int **p);
313void PassTheAddrOfAllocatedData(int f) {
314  int *p = malloc(12);
315  // We don't know what happens after the call. Should stop tracking here.
316  if (takePtrToPtr(&p))
317    f++;
318  free(p); // no warning
319}
320
321struct X {
322  int *p;
323};
324unsigned takePtrToStruct(struct X *s);
325int ** foo2(int *g, int f) {
326  int *p = malloc(12);
327  struct X *px= malloc(sizeof(struct X));
328  px->p = p;
329  // We don't know what happens after this call. Should not track px nor p.
330  if (takePtrToStruct(px))
331    f++;
332  free(p);
333  return 0;
334}
335
336struct X* RegInvalidationDetect1(struct X *s2) {
337  struct X *px= malloc(sizeof(struct X));
338  px->p = 0;
339  px = s2;
340  return px; // expected-warning {{Allocated memory never released. Potential memory leak.}}
341}
342
343struct X* RegInvalidationGiveUp1() {
344  int *p = malloc(12);
345  struct X *px= malloc(sizeof(struct X));
346  px->p = p;
347  return px;
348}
349
350int **RegInvalidationDetect2(int **pp) {
351  int *p = malloc(12);
352  pp = &p;
353  pp++;
354  return 0;// expected-warning {{Allocated memory never released. Potential memory leak.}}
355}
356
357extern void exit(int) __attribute__ ((__noreturn__));
358void mallocExit(int *g) {
359  struct xx *p = malloc(12);
360  if (g != 0)
361    exit(1);
362  free(p);
363  return;
364}
365
366extern void __assert_fail (__const char *__assertion, __const char *__file,
367    unsigned int __line, __const char *__function)
368     __attribute__ ((__noreturn__));
369#define assert(expr) \
370  ((expr)  ? (void)(0)  : __assert_fail (#expr, __FILE__, __LINE__, __func__))
371void mallocAssert(int *g) {
372  struct xx *p = malloc(12);
373
374  assert(g != 0);
375  free(p);
376  return;
377}
378
379// Below are the known false positives.
380
381// TODO: There should be no warning here.
382void reallocFails(int *g, int f) {
383  char *p = malloc(12);
384  char *r = realloc(p, 12+1);
385  if (!r) {
386    free(p); // expected-warning {{Try to free a memory block that has been released}}
387  } else {
388    free(r);
389  }
390}
391
392// TODO: There should be no warning here. This one might be difficult to get rid of.
393void dependsOnValueOfPtr(int *g, unsigned f) {
394  int *p;
395
396  if (f) {
397    p = g;
398  } else {
399    p = malloc(12);
400  }
401
402  if (p != g)
403    free(p);
404  else
405    return; // expected-warning{{Allocated memory never released. Potential memory leak}}
406  return;
407}
408
409// TODO: Should this be a warning?
410// Here we are returning a pointer one past the allocated value. An idiom which
411// can be used for implementing special malloc. The correct uses of this might
412// be rare enough so that we could keep this as a warning.
413static void *specialMalloc(int n){
414  int *p;
415  p = malloc( n+8 );
416  if( p ){
417    p[0] = n;
418    p++;
419  }
420  return p;// expected-warning {{Allocated memory never released. Potential memory leak.}}
421}
422