null-deref-ps.c revision c037eac3bda3c636c961aab6377beea3242e81e4
1// RUN: clang-cc -analyze -std=gnu99 -checker-cfref -verify %s -analyzer-constraints=basic -analyzer-store=basic && 2// RUN: clang-cc -analyze -std=gnu99 -checker-cfref -verify %s -analyzer-constraints=basic -analyzer-store=basic-old-cast && 3// RUN: clang-cc -analyze -std=gnu99 -checker-cfref -verify %s -analyzer-constraints=range -analyzer-store=basic && 4// RUN: clang-cc -analyze -std=gnu99 -checker-cfref -verify %s -analyzer-constraints=range -analyzer-store=basic-old-cast && 5// RUN: clang-cc -analyze -std=gnu99 -checker-cfref -analyzer-store=region -analyzer-constraints=range -analyzer-purge-dead=false -verify %s && 6// RUN: clang-cc -analyze -std=gnu99 -checker-cfref -analyzer-store=region -analyzer-constraints=range -verify %s 7 8#include<stdint.h> 9#include <assert.h> 10 11void f1(int *p) { 12 if (p) *p = 1; 13 else *p = 0; // expected-warning{{ereference}} 14} 15 16struct foo_struct { 17 int x; 18}; 19 20int f2(struct foo_struct* p) { 21 22 if (p) 23 p->x = 1; 24 25 return p->x++; // expected-warning{{Dereference of null pointer.}} 26} 27 28int f3(char* x) { 29 30 int i = 2; 31 32 if (x) 33 return x[i - 1]; 34 35 return x[i+1]; // expected-warning{{Dereference of null pointer.}} 36} 37 38int f3_b(char* x) { 39 40 int i = 2; 41 42 if (x) 43 return x[i - 1]; 44 45 return x[i+1]++; // expected-warning{{Dereference of null pointer.}} 46} 47 48int f4(int *p) { 49 50 uintptr_t x = (uintptr_t) p; 51 52 if (x) 53 return 1; 54 55 int *q = (int*) x; 56 return *q; // expected-warning{{Dereference of null pointer.}} 57} 58 59int f4_b() { 60 short array[2]; 61 uintptr_t x = array; // expected-warning{{incompatible pointer to integer conversion initializing}} 62 short *p = x; // expected-warning{{incompatible integer to pointer conversion initializing}} 63 64 // The following branch should be infeasible. 65 if (!(p = &array[0])) { 66 p = 0; 67 *p = 1; // no-warning 68 } 69 70 if (p) { 71 *p = 5; // no-warning 72 p = 0; 73 } 74 else return; // expected-warning {{non-void function 'f4_b' should return a value}} 75 76 *p += 10; // expected-warning{{Dereference of null pointer}} 77} 78 79 80int f5() { 81 82 char *s = "hello world"; 83 return s[0]; // no-warning 84} 85 86int bar(int* p, int q) __attribute__((nonnull)); 87 88int f6(int *p) { 89 return !p ? bar(p, 1) // expected-warning {{Null pointer passed as an argument to a 'nonnull' parameter}} 90 : bar(p, 0); // no-warning 91} 92 93int bar2(int* p, int q) __attribute__((nonnull(1))); 94 95int f6b(int *p) { 96 return !p ? bar2(p, 1) // expected-warning {{Null pointer passed as an argument to a 'nonnull' parameter}} 97 : bar2(p, 0); // no-warning 98} 99 100int bar3(int*p, int q, int *r) __attribute__((nonnull(1,3))); 101 102int f6c(int *p, int *q) { 103 return !p ? bar3(q, 2, p) // expected-warning {{Null pointer passed as an argument to a 'nonnull' parameter}} 104 : bar3(p, 2, q); // no-warning 105} 106 107int* qux(); 108 109int f7(int x) { 110 111 int* p = 0; 112 113 if (0 == x) 114 p = qux(); 115 116 if (0 == x) 117 *p = 1; // no-warning 118 119 return x; 120} 121 122int* f7b(int *x) { 123 124 int* p = 0; 125 126 if (((void*)0) == x) 127 p = qux(); 128 129 if (((void*)0) == x) 130 *p = 1; // no-warning 131 132 return x; 133} 134 135int* f7c(int *x) { 136 137 int* p = 0; 138 139 if (((void*)0) == x) 140 p = qux(); 141 142 if (((void*)0) != x) 143 return x; 144 145 // If we reach here then 'p' is not null. 146 *p = 1; // no-warning 147 return x; 148} 149 150int* f7c2(int *x) { 151 152 int* p = 0; 153 154 if (((void*)0) == x) 155 p = qux(); 156 157 if (((void*)0) == x) 158 return x; 159 160 *p = 1; // expected-warning{{null}} 161 return x; 162} 163 164 165int f8(int *p, int *q) { 166 if (!p) 167 if (p) 168 *p = 1; // no-warning 169 170 if (q) 171 if (!q) 172 *q = 1; // no-warning 173} 174 175int* qux(); 176 177int f9(unsigned len) { 178 assert (len != 0); 179 int *p = 0; 180 unsigned i; 181 182 for (i = 0; i < len; ++i) 183 p = qux(i); 184 185 return *p++; // no-warning 186} 187 188int f9b(unsigned len) { 189 assert (len > 0); // note use of '>' 190 int *p = 0; 191 unsigned i; 192 193 for (i = 0; i < len; ++i) 194 p = qux(i); 195 196 return *p++; // no-warning 197} 198 199int* f10(int* p, signed char x, int y) { 200 // This line tests symbolication with compound assignments where the 201 // LHS and RHS have different bitwidths. The new symbolic value 202 // for 'x' should have a bitwidth of 8. 203 x &= y; 204 205 // This tests that our symbolication worked, and that we correctly test 206 // x against 0 (with the same bitwidth). 207 if (!x) { 208 if (!p) return; // expected-warning {{non-void function 'f10' should return a value}} 209 *p = 10; 210 } 211 else p = 0; 212 213 if (!x) 214 *p = 5; // no-warning 215 216 return p; 217} 218 219// Test case from <rdar://problem/6407949> 220void f11(unsigned i) { 221 int *x = 0; 222 if (i >= 0) { 223 // always true 224 } else { 225 *x = 42; // no-warning 226 } 227} 228 229void f11b(unsigned i) { 230 int *x = 0; 231 if (i <= ~(unsigned)0) { 232 // always true 233 } else { 234 *x = 42; // no-warning 235 } 236} 237 238// Test case for switch statements with weird case arms. 239typedef int BOOL, *PBOOL, *LPBOOL; 240typedef long LONG_PTR, *PLONG_PTR; 241typedef unsigned long ULONG_PTR, *PULONG_PTR; 242typedef ULONG_PTR DWORD_PTR, *PDWORD_PTR; 243typedef LONG_PTR LRESULT; 244typedef struct _F12ITEM *HF12ITEM; 245 246void f12(HF12ITEM i, char *q) { 247 char *p = 0; 248 switch ((DWORD_PTR) i) { 249 case 0 ... 10: 250 p = q; 251 break; 252 case (DWORD_PTR) ((HF12ITEM) - 65535): 253 return; 254 default: 255 return; 256 } 257 258 *p = 1; // no-warning 259} 260 261// Test handling of translating between integer "pointers" and back. 262void f13() { 263 int *x = 0; 264 if (((((int) x) << 2) + 1) >> 1) *x = 1; // no-warning 265} 266 267 268