malloc.c revision c4b5bd89e1ef611c7a31b767763030acc45274c8 
1// RUN: %clang_cc1 -analyze -analyzer-experimental-internal-checks -analyzer-check-objc-mem -analyzer-experimental-checks -analyzer-store=region -verify %s
2typedef __typeof(sizeof(int)) size_t;
3void *malloc(size_t);
4void free(void *);
5void *realloc(void *ptr, size_t size);
6void *calloc(size_t nmemb, size_t size);
7
8void f1() {
9  int *p = malloc(12);
10  return; // expected-warning{{Allocated memory never released. Potential memory leak.}}
11}
12
13void f1_b() {
14  int *p = malloc(12); // expected-warning{{Allocated memory never released. Potential memory leak.}}
15}
16
17void f2() {
18  int *p = malloc(12);
19  free(p);
20  free(p); // expected-warning{{Try to free a memory block that has been released}}
21}
22
23// This case tests that storing malloc'ed memory to a static variable which is
24// then returned is not leaked.  In the absence of known contracts for functions
25// or inter-procedural analysis, this is a conservative answer.
26int *f3() {
27  static int *p = 0;
28  p = malloc(12);
29  return p; // no-warning
30}
31
32// This case tests that storing malloc'ed memory to a static global variable
33// which is then returned is not leaked.  In the absence of known contracts for
34// functions or inter-procedural analysis, this is a conservative answer.
35static int *p_f4 = 0;
36int *f4() {
37  p_f4 = malloc(12);
38  return p_f4; // no-warning
39}
40
41int *f5() {
42  int *q = malloc(12);
43  q = realloc(q, 20);
44  return q; // no-warning
45}
46
47void f6() {
48  int *p = malloc(12);
49  if (!p)
50    return; // no-warning
51  else
52    free(p);
53}
54
55char *doit2();
56void pr6069() {
57  char *buf = doit2();
58  free(buf);
59}
60
61void pr6293() {
62  free(0);
63}
64
65void f7() {
66  char *x = (char*) malloc(4);
67  free(x);
68  x[0] = 'a'; // expected-warning{{Use dynamically allocated memory after it is freed.}}
69}
70
71void PR6123() {
72  int *x = malloc(11); // expected-warning{{Cast a region whose size is not a multiple of the destination type size.}}
73}
74
75void PR7217() {
76  int *buf = malloc(2); // expected-warning{{Cast a region whose size is not a multiple of the destination type size.}}
77  buf[1] = 'c'; // not crash
78}
79
80void mallocCastToVoid() {
81  void *p = malloc(2);
82  const void *cp = p; // not crash
83  free(p);
84}
85
86void mallocCastToFP() {
87  void *p = malloc(2);
88  void (*fp)() = p; // not crash
89  free(p);
90}
91
92// This tests that malloc() buffers are undefined by default
93char mallocGarbage () {
94	char *buf = malloc(2);
95	char result = buf[1]; // expected-warning{{undefined}}
96	free(buf);
97	return result;
98}
99
100// This tests that calloc() buffers need to be freed
101void callocNoFree () {
102  char *buf = calloc(2,2);
103  return; // expected-warning{{never released}}
104}
105
106// These test that calloc() buffers are zeroed by default
107char callocZeroesGood () {
108	char *buf = calloc(2,2);
109	char result = buf[3]; // no-warning
110	if (buf[1] == 0) {
111	  free(buf);
112	}
113	return result; // no-warning
114}
115
116char callocZeroesBad () {
117	char *buf = calloc(2,2);
118	char result = buf[3]; // no-warning
119	if (buf[1] != 0) {
120	  free(buf); // expected-warning{{never executed}}
121	}
122	return result; // expected-warning{{never released}}
123}
124