malloc.c revision 40add2983dedcf489d7ad8c7bccc58b6ae368ee4 
1// RUN: %clang_cc1 -analyze -analyzer-checker=core,experimental.deadcode.UnreachableCode,experimental.core.CastSize,experimental.unix.Malloc -analyzer-store=region -verify %s
2#include "system-header-simulator.h"
3
4typedef __typeof(sizeof(int)) size_t;
5void *malloc(size_t);
6void *valloc(size_t);
7void free(void *);
8void *realloc(void *ptr, size_t size);
9void *reallocf(void *ptr, size_t size);
10void *calloc(size_t nmemb, size_t size);
11
12void myfoo(int *p);
13void myfooint(int p);
14
15void f1() {
16  int *p = malloc(12);
17  return; // expected-warning{{Allocated memory never released. Potential memory leak.}}
18}
19
20void f2() {
21  int *p = malloc(12);
22  free(p);
23  free(p); // expected-warning{{Try to free a memory block that has been released}}
24}
25
26void f2_realloc_0() {
27  int *p = malloc(12);
28  realloc(p,0);
29  realloc(p,0); // expected-warning{{Try to free a memory block that has been released}}
30}
31
32void f2_realloc_1() {
33  int *p = malloc(12);
34  int *q = realloc(p,0); // no-warning
35}
36
37void reallocNotNullPtr(unsigned sizeIn) {
38  unsigned size = 12;
39  char *p = (char*)malloc(size);
40  if (p) {
41    char *q = (char*)realloc(p, sizeIn);
42    char x = *q; // expected-warning {{Allocated memory never released.}}
43  }
44}
45
46int *realloctest1() {
47  int *q = malloc(12);
48  q = realloc(q, 20);
49  return q; // no warning - returning the allocated value
50}
51
52// p should be freed if realloc fails.
53void reallocFails() {
54  char *p = malloc(12);
55  char *r = realloc(p, 12+1);
56  if (!r) {
57    free(p);
58  } else {
59    free(r);
60  }
61}
62
63void reallocSizeZero1() {
64  char *p = malloc(12);
65  char *r = realloc(p, 0);
66  if (!r) {
67    free(p);
68  } else {
69    free(r);
70  }
71}
72
73void reallocSizeZero2() {
74  char *p = malloc(12);
75  char *r = realloc(p, 0);
76  if (!r) {
77    free(p);
78  } else {
79    free(r);
80  }
81  free(p); // expected-warning {{Try to free a memory block that has been released}}
82}
83
84void reallocSizeZero3() {
85  char *p = malloc(12);
86  char *r = realloc(p, 0);
87  free(r);
88}
89
90void reallocSizeZero4() {
91  char *r = realloc(0, 0);
92  free(r);
93}
94
95void reallocSizeZero5() {
96  char *r = realloc(0, 0);
97}
98
99void reallocPtrZero1() {
100  char *r = realloc(0, 12); // expected-warning {{Allocated memory never released.}}
101}
102
103void reallocPtrZero2() {
104  char *r = realloc(0, 12);
105  if (r)
106    free(r);
107}
108
109void reallocPtrZero3() {
110  char *r = realloc(0, 12);
111  free(r);
112}
113
114void reallocRadar6337483_1() {
115    char *buf = malloc(100);
116    buf = (char*)realloc(buf, 0x1000000);
117    if (!buf) {
118        return;// expected-warning {{Allocated memory never released.}}
119    }
120    free(buf);
121}
122
123void reallocRadar6337483_2() {
124    char *buf = malloc(100);
125    char *buf2 = (char*)realloc(buf, 0x1000000);
126    if (!buf2) { // expected-warning {{Allocated memory never released.}}
127      ;
128    } else {
129      free(buf2);
130    }
131}
132
133void reallocRadar6337483_3() {
134    char * buf = malloc(100);
135    char * tmp;
136    tmp = (char*)realloc(buf, 0x1000000);
137    if (!tmp) {
138        free(buf);
139        return;
140    }
141    buf = tmp;
142    free(buf);
143}
144
145void reallocRadar6337483_4() {
146    char *buf = malloc(100);
147    char *buf2 = (char*)realloc(buf, 0x1000000);
148    if (!buf2) {
149      return;  // expected-warning {{Allocated memory never released.}}
150    } else {
151      free(buf2);
152    }
153}
154
155int *reallocfTest1() {
156  int *q = malloc(12);
157  q = reallocf(q, 20);
158  return q; // no warning - returning the allocated value
159}
160
161void reallocfRadar6337483_4() {
162    char *buf = malloc(100);
163    char *buf2 = (char*)reallocf(buf, 0x1000000);
164    if (!buf2) {
165      return;  // no warning - reallocf frees even on failure
166    } else {
167      free(buf2);
168    }
169}
170
171void reallocfRadar6337483_3() {
172    char * buf = malloc(100);
173    char * tmp;
174    tmp = (char*)reallocf(buf, 0x1000000);
175    if (!tmp) {
176        free(buf); // expected-warning {{Try to free a memory block that has been released}}
177        return;
178    }
179    buf = tmp;
180    free(buf);
181}
182
183void reallocfPtrZero1() {
184  char *r = reallocf(0, 12); // expected-warning {{Allocated memory never released.}}
185}
186
187
188// This case tests that storing malloc'ed memory to a static variable which is
189// then returned is not leaked.  In the absence of known contracts for functions
190// or inter-procedural analysis, this is a conservative answer.
191int *f3() {
192  static int *p = 0;
193  p = malloc(12);
194  return p; // no-warning
195}
196
197// This case tests that storing malloc'ed memory to a static global variable
198// which is then returned is not leaked.  In the absence of known contracts for
199// functions or inter-procedural analysis, this is a conservative answer.
200static int *p_f4 = 0;
201int *f4() {
202  p_f4 = malloc(12);
203  return p_f4; // no-warning
204}
205
206int *f5() {
207  int *q = malloc(12);
208  q = realloc(q, 20);
209  return q; // no-warning
210}
211
212void f6() {
213  int *p = malloc(12);
214  if (!p)
215    return; // no-warning
216  else
217    free(p);
218}
219
220void f6_realloc() {
221  int *p = malloc(12);
222  if (!p)
223    return; // no-warning
224  else
225    realloc(p,0);
226}
227
228
229char *doit2();
230void pr6069() {
231  char *buf = doit2();
232  free(buf);
233}
234
235void pr6293() {
236  free(0);
237}
238
239void f7() {
240  char *x = (char*) malloc(4);
241  free(x);
242  x[0] = 'a'; // expected-warning{{Use of dynamically allocated memory after it is freed.}}
243}
244
245void f7_realloc() {
246  char *x = (char*) malloc(4);
247  realloc(x,0);
248  x[0] = 'a'; // expected-warning{{Use of dynamically allocated memory after it is freed.}}
249}
250
251void PR6123() {
252  int *x = malloc(11); // expected-warning{{Cast a region whose size is not a multiple of the destination type size.}}
253}
254
255void PR7217() {
256  int *buf = malloc(2); // expected-warning{{Cast a region whose size is not a multiple of the destination type size.}}
257  buf[1] = 'c'; // not crash
258}
259
260void mallocCastToVoid() {
261  void *p = malloc(2);
262  const void *cp = p; // not crash
263  free(p);
264}
265
266void mallocCastToFP() {
267  void *p = malloc(2);
268  void (*fp)() = p; // not crash
269  free(p);
270}
271
272// This tests that malloc() buffers are undefined by default
273char mallocGarbage () {
274	char *buf = malloc(2);
275	char result = buf[1]; // expected-warning{{undefined}}
276	free(buf);
277	return result;
278}
279
280// This tests that calloc() buffers need to be freed
281void callocNoFree () {
282  char *buf = calloc(2,2);
283  return; // expected-warning{{never released}}
284}
285
286// These test that calloc() buffers are zeroed by default
287char callocZeroesGood () {
288	char *buf = calloc(2,2);
289	char result = buf[3]; // no-warning
290	if (buf[1] == 0) {
291	  free(buf);
292	}
293	return result; // no-warning
294}
295
296char callocZeroesBad () {
297	char *buf = calloc(2,2);
298	char result = buf[3]; // no-warning
299	if (buf[1] != 0) {
300	  free(buf); // expected-warning{{never executed}}
301	}
302	return result; // expected-warning{{never released}}
303}
304
305void nullFree() {
306  int *p = 0;
307  free(p); // no warning - a nop
308}
309
310void paramFree(int *p) {
311  myfoo(p);
312  free(p); // no warning
313  myfoo(p); // TODO: This should be a warning.
314}
315
316int* mallocEscapeRet() {
317  int *p = malloc(12);
318  return p; // no warning
319}
320
321void mallocEscapeFoo() {
322  int *p = malloc(12);
323  myfoo(p);
324  return; // no warning
325}
326
327void mallocEscapeFree() {
328  int *p = malloc(12);
329  myfoo(p);
330  free(p);
331}
332
333void mallocEscapeFreeFree() {
334  int *p = malloc(12);
335  myfoo(p);
336  free(p);
337  free(p); // expected-warning{{Try to free a memory block that has been released}}
338}
339
340void mallocEscapeFreeUse() {
341  int *p = malloc(12);
342  myfoo(p);
343  free(p);
344  myfoo(p); // expected-warning{{Use of dynamically allocated memory after it is freed.}}
345}
346
347int *myalloc();
348void myalloc2(int **p);
349
350void mallocEscapeFreeCustomAlloc() {
351  int *p = malloc(12);
352  myfoo(p);
353  free(p);
354  p = myalloc();
355  free(p); // no warning
356}
357
358void mallocEscapeFreeCustomAlloc2() {
359  int *p = malloc(12);
360  myfoo(p);
361  free(p);
362  myalloc2(&p);
363  free(p); // no warning
364}
365
366void mallocBindFreeUse() {
367  int *x = malloc(12);
368  int *y = x;
369  free(y);
370  myfoo(x); // expected-warning{{Use of dynamically allocated memory after it is freed.}}
371}
372
373void mallocEscapeMalloc() {
374  int *p = malloc(12);
375  myfoo(p);
376  p = malloc(12); // expected-warning{{Allocated memory never released. Potential memory leak.}}
377}
378
379void mallocMalloc() {
380  int *p = malloc(12);
381  p = malloc(12); // expected-warning{{Allocated memory never released. Potential memory leak}}
382}
383
384void mallocFreeMalloc() {
385  int *p = malloc(12);
386  free(p);
387  p = malloc(12);
388  free(p);
389}
390
391void mallocFreeUse_params() {
392  int *p = malloc(12);
393  free(p);
394  myfoo(p); //expected-warning{{Use of dynamically allocated memory after it is freed}}
395}
396
397void mallocFreeUse_params2() {
398  int *p = malloc(12);
399  free(p);
400  myfooint(*p); //expected-warning{{Use of dynamically allocated memory after it is freed}}
401}
402
403void mallocFailedOrNot() {
404  int *p = malloc(12);
405  if (!p)
406    free(p);
407  else
408    free(p);
409}
410
411struct StructWithInt {
412  int g;
413};
414
415int *mallocReturnFreed() {
416  int *p = malloc(12);
417  free(p);
418  return p; // expected-warning {{Use of dynamically allocated}}
419}
420
421int useAfterFreeStruct() {
422  struct StructWithInt *px= malloc(sizeof(struct StructWithInt));
423  px->g = 5;
424  free(px);
425  return px->g; // expected-warning {{Use of dynamically allocated}}
426}
427
428void nonSymbolAsFirstArg(int *pp, struct StructWithInt *p);
429
430void mallocEscapeFooNonSymbolArg() {
431  struct StructWithInt *p = malloc(sizeof(struct StructWithInt));
432  nonSymbolAsFirstArg(&p->g, p);
433  return; // no warning
434}
435
436void mallocFailedOrNotLeak() {
437  int *p = malloc(12);
438  if (p == 0)
439    return; // no warning
440  else
441    return; // expected-warning {{Allocated memory never released. Potential memory leak.}}
442}
443
444int vallocTest() {
445  char *mem = valloc(12);
446  return 0; // expected-warning {{Allocated memory never released. Potential memory leak.}}
447}
448
449void vallocEscapeFreeUse() {
450  int *p = valloc(12);
451  myfoo(p);
452  free(p);
453  myfoo(p); // expected-warning{{Use of dynamically allocated memory after it is freed.}}
454}
455
456int *Gl;
457struct GlStTy {
458  int *x;
459};
460
461struct GlStTy GlS = {0};
462
463void GlobalFree() {
464  free(Gl);
465}
466
467void GlobalMalloc() {
468  Gl = malloc(12);
469}
470
471void GlobalStructMalloc() {
472  int *a = malloc(12);
473  GlS.x = a;
474}
475
476void GlobalStructMallocFree() {
477  int *a = malloc(12);
478  GlS.x = a;
479  free(GlS.x);
480}
481
482// Region escape testing.
483
484unsigned takePtrToPtr(int **p);
485void PassTheAddrOfAllocatedData(int f) {
486  int *p = malloc(12);
487  // We don't know what happens after the call. Should stop tracking here.
488  if (takePtrToPtr(&p))
489    f++;
490  free(p); // no warning
491}
492
493struct X {
494  int *p;
495};
496unsigned takePtrToStruct(struct X *s);
497int ** foo2(int *g, int f) {
498  int *p = malloc(12);
499  struct X *px= malloc(sizeof(struct X));
500  px->p = p;
501  // We don't know what happens after this call. Should not track px nor p.
502  if (takePtrToStruct(px))
503    f++;
504  free(p);
505  return 0;
506}
507
508struct X* RegInvalidationDetect1(struct X *s2) {
509  struct X *px= malloc(sizeof(struct X));
510  px->p = 0;
511  px = s2;
512  return px; // expected-warning {{Allocated memory never released. Potential memory leak.}}
513}
514
515struct X* RegInvalidationGiveUp1() {
516  int *p = malloc(12);
517  struct X *px= malloc(sizeof(struct X));
518  px->p = p;
519  return px;
520}
521
522int **RegInvalidationDetect2(int **pp) {
523  int *p = malloc(12);
524  pp = &p;
525  pp++;
526  return 0;// expected-warning {{Allocated memory never released. Potential memory leak.}}
527}
528
529extern void exit(int) __attribute__ ((__noreturn__));
530void mallocExit(int *g) {
531  struct xx *p = malloc(12);
532  if (g != 0)
533    exit(1);
534  free(p);
535  return;
536}
537
538extern void __assert_fail (__const char *__assertion, __const char *__file,
539    unsigned int __line, __const char *__function)
540     __attribute__ ((__noreturn__));
541#define assert(expr) \
542  ((expr)  ? (void)(0)  : __assert_fail (#expr, __FILE__, __LINE__, __func__))
543void mallocAssert(int *g) {
544  struct xx *p = malloc(12);
545
546  assert(g != 0);
547  free(p);
548  return;
549}
550
551void doNotInvalidateWhenPassedToSystemCalls(char *s) {
552  char *p = malloc(12);
553  strlen(p);
554  strcpy(p, s); // expected-warning {{leak}}
555}
556
557// Below are the known false positives.
558
559// TODO: There should be no warning here. This one might be difficult to get rid of.
560void dependsOnValueOfPtr(int *g, unsigned f) {
561  int *p;
562
563  if (f) {
564    p = g;
565  } else {
566    p = malloc(12);
567  }
568
569  if (p != g)
570    free(p);
571  else
572    return; // expected-warning{{Allocated memory never released. Potential memory leak}}
573  return;
574}
575
576// TODO: Should this be a warning?
577// Here we are returning a pointer one past the allocated value. An idiom which
578// can be used for implementing special malloc. The correct uses of this might
579// be rare enough so that we could keep this as a warning.
580static void *specialMalloc(int n){
581  int *p;
582  p = malloc( n+8 );
583  if( p ){
584    p[0] = n;
585    p++;
586  }
587  return p;// expected-warning {{Allocated memory never released. Potential memory leak.}}
588}
589