malloc.c revision ab28099e3bd4859585ccb316f9f571c8c6b035fd
1// RUN: %clang_cc1 -analyze -analyzer-experimental-internal-checks -analyzer-check-objc-mem -analyzer-experimental-checks -analyzer-store=region -verify %s 2typedef __typeof(sizeof(int)) size_t; 3void *malloc(size_t); 4void free(void *); 5void *realloc(void *ptr, size_t size); 6void *calloc(size_t nmemb, size_t size); 7 8void f1() { 9 int *p = malloc(12); 10 return; // expected-warning{{Allocated memory never released. Potential memory leak.}} 11} 12 13void f1_b() { 14 int *p = malloc(12); // expected-warning{{Allocated memory never released. Potential memory leak.}} 15} 16 17void f2() { 18 int *p = malloc(12); 19 free(p); 20 free(p); // expected-warning{{Try to free a memory block that has been released}} 21} 22 23// This case tests that storing malloc'ed memory to a static variable which is 24// then returned is not leaked. In the absence of known contracts for functions 25// or inter-procedural analysis, this is a conservative answer. 26int *f3() { 27 static int *p = 0; 28 p = malloc(12); 29 return p; // no-warning 30} 31 32// This case tests that storing malloc'ed memory to a static global variable 33// which is then returned is not leaked. In the absence of known contracts for 34// functions or inter-procedural analysis, this is a conservative answer. 35static int *p_f4 = 0; 36int *f4() { 37 p_f4 = malloc(12); 38 return p_f4; // no-warning 39} 40 41int *f5() { 42 int *q = malloc(12); 43 q = realloc(q, 20); 44 return q; // no-warning 45} 46 47void f6() { 48 int *p = malloc(12); 49 if (!p) 50 return; // no-warning 51 else 52 free(p); 53} 54 55char *doit2(); 56void pr6069() { 57 char *buf = doit2(); 58 free(buf); 59} 60 61void pr6293() { 62 free(0); 63} 64 65void f7() { 66 char *x = (char*) malloc(4); 67 free(x); 68 x[0] = 'a'; // expected-warning{{Use dynamically allocated memory after it is freed.}} 69} 70 71void PR6123() { 72 int *x = malloc(11); // expected-warning{{Cast a region whose size is not a multiple of the destination type size.}} 73} 74 75void PR7217() { 76 int *buf = malloc(2); // expected-warning{{Cast a region whose size is not a multiple of the destination type size.}} 77 buf[1] = 'c'; // not crash 78 79} 80