string.c revision 8912aaedb413b15f6dd1d8997d80e1d505f7d52f 
1// RUN: %clang_cc1 -analyze -analyzer-checker=core,unix.experimental.CString,deadcode.experimental.UnreachableCode -analyzer-store=region -Wno-null-dereference -verify %s
2// RUN: %clang_cc1 -analyze -DUSE_BUILTINS -analyzer-checker=core,unix.experimental.CString,deadcode.experimental.UnreachableCode -analyzer-store=region -Wno-null-dereference -verify %s
3// RUN: %clang_cc1 -analyze -DVARIANT -analyzer-checker=core,unix.experimental.CString,deadcode.experimental.UnreachableCode -analyzer-store=region -Wno-null-dereference -verify %s
4// RUN: %clang_cc1 -analyze -DUSE_BUILTINS -DVARIANT -analyzer-checker=core,unix.experimental.CString,deadcode.experimental.UnreachableCode -analyzer-store=region -Wno-null-dereference -verify %s
5
6//===----------------------------------------------------------------------===
7// Declarations
8//===----------------------------------------------------------------------===
9
10// Some functions are so similar to each other that they follow the same code
11// path, such as memcpy and __memcpy_chk, or memcmp and bcmp. If VARIANT is
12// defined, make sure to use the variants instead to make sure they are still
13// checked by the analyzer.
14
15// Some functions are implemented as builtins. These should be #defined as
16// BUILTIN(f), which will prepend "__builtin_" if USE_BUILTINS is defined.
17
18// Functions that have variants and are also available as builtins should be
19// declared carefully! See memcpy() for an example.
20
21#ifdef USE_BUILTINS
22# define BUILTIN(f) __builtin_ ## f
23#else /* USE_BUILTINS */
24# define BUILTIN(f) f
25#endif /* USE_BUILTINS */
26
27#define NULL 0
28typedef typeof(sizeof(int)) size_t;
29
30//===----------------------------------------------------------------------===
31// strlen()
32//===----------------------------------------------------------------------===
33
34#define strlen BUILTIN(strlen)
35size_t strlen(const char *s);
36
37void strlen_constant0() {
38  if (strlen("123") != 3)
39    (void)*(char*)0; // no-warning
40}
41
42void strlen_constant1() {
43  const char *a = "123";
44  if (strlen(a) != 3)
45    (void)*(char*)0; // no-warning
46}
47
48void strlen_constant2(char x) {
49  char a[] = "123";
50  if (strlen(a) != 3)
51    (void)*(char*)0; // no-warning
52  a[0] = x;
53  if (strlen(a) != 3)
54    (void)*(char*)0; // expected-warning{{null}}
55}
56
57size_t strlen_null() {
58  return strlen(0); // expected-warning{{Null pointer argument in call to string length function}}
59}
60
61size_t strlen_fn() {
62  return strlen((char*)&strlen_fn); // expected-warning{{Argument to string length function is the address of the function 'strlen_fn', which is not a null-terminated string}}
63}
64
65size_t strlen_nonloc() {
66label:
67  return strlen((char*)&&label); // expected-warning{{Argument to string length function is the address of the label 'label', which is not a null-terminated string}}
68}
69
70void strlen_subregion() {
71  struct two_strings { char a[2], b[2]; };
72  extern void use_two_strings(struct two_strings *);
73
74  struct two_strings z;
75  use_two_strings(&z);
76
77  size_t a = strlen(z.a);
78  z.b[0] = 5;
79  size_t b = strlen(z.a);
80  if (a == 0 && b != 0)
81    (void)*(char*)0; // expected-warning{{never executed}}
82
83  use_two_strings(&z);
84
85  size_t c = strlen(z.a);
86  if (a == 0 && c != 0)
87    (void)*(char*)0; // expected-warning{{null}}
88}
89
90extern void use_string(char *);
91void strlen_argument(char *x) {
92  size_t a = strlen(x);
93  size_t b = strlen(x);
94  if (a == 0 && b != 0)
95    (void)*(char*)0; // expected-warning{{never executed}}
96
97  use_string(x);
98
99  size_t c = strlen(x);
100  if (a == 0 && c != 0)
101    (void)*(char*)0; // expected-warning{{null}}
102}
103
104extern char global_str[];
105void strlen_global() {
106  size_t a = strlen(global_str);
107  size_t b = strlen(global_str);
108  if (a == 0 && b != 0)
109    (void)*(char*)0; // expected-warning{{never executed}}
110
111  // Call a function with unknown effects, which should invalidate globals.
112  use_string(0);
113
114  size_t c = strlen(global_str);
115  if (a == 0 && c != 0)
116    (void)*(char*)0; // expected-warning{{null}}
117}
118
119void strlen_indirect(char *x) {
120  size_t a = strlen(x);
121  char *p = x;
122  char **p2 = &p;
123  size_t b = strlen(x);
124  if (a == 0 && b != 0)
125    (void)*(char*)0; // expected-warning{{never executed}}
126
127  extern void use_string_ptr(char*const*);
128  use_string_ptr(p2);
129
130  size_t c = strlen(x);
131  if (a == 0 && c != 0)
132    (void)*(char*)0; // expected-warning{{null}}
133}
134
135void strlen_liveness(const char *x) {
136  if (strlen(x) < 5)
137    return;
138  if (strlen(x) < 5)
139    (void)*(char*)0; // no-warning
140}
141
142//===----------------------------------------------------------------------===
143// strnlen()
144//===----------------------------------------------------------------------===
145
146#define strnlen BUILTIN(strnlen)
147size_t strnlen(const char *s, size_t maxlen);
148
149void strnlen_constant0() {
150  if (strnlen("123", 10) != 3)
151    (void)*(char*)0; // no-warning
152}
153
154void strnlen_constant1() {
155  const char *a = "123";
156  if (strnlen(a, 10) != 3)
157    (void)*(char*)0; // no-warning
158}
159
160void strnlen_constant2(char x) {
161  char a[] = "123";
162  if (strnlen(a, 10) != 3)
163    (void)*(char*)0; // no-warning
164  a[0] = x;
165  if (strnlen(a, 10) != 3)
166    (void)*(char*)0; // expected-warning{{null}}
167}
168
169void strnlen_constant4() {
170  if (strnlen("123456", 3) != 3)
171    (void)*(char*)0; // no-warning
172}
173
174void strnlen_constant5() {
175  const char *a = "123456";
176  if (strnlen(a, 3) != 3)
177    (void)*(char*)0; // no-warning
178}
179
180void strnlen_constant6(char x) {
181  char a[] = "123456";
182  if (strnlen(a, 3) != 3)
183    (void)*(char*)0; // no-warning
184  a[0] = x;
185  if (strnlen(a, 3) != 3)
186    (void)*(char*)0; // expected-warning{{null}}
187}
188
189size_t strnlen_null() {
190  return strnlen(0, 3); // expected-warning{{Null pointer argument in call to string length function}}
191}
192
193size_t strnlen_fn() {
194  return strnlen((char*)&strlen_fn, 3); // expected-warning{{Argument to string length function is the address of the function 'strlen_fn', which is not a null-terminated string}}
195}
196
197size_t strnlen_nonloc() {
198label:
199  return strnlen((char*)&&label, 3); // expected-warning{{Argument to string length function is the address of the label 'label', which is not a null-terminated string}}
200}
201
202void strnlen_zero() {
203  if (strnlen("abc", 0) != 0)
204    (void)*(char*)0; // no-warning
205  if (strnlen(NULL, 0) != 0) // no-warning
206    (void)*(char*)0; // no-warning
207}
208
209size_t strnlen_compound_literal() {
210  // This used to crash because we don't model the string lengths of
211  // compound literals.
212  return strnlen((char[]) { 'a', 'b', 0 }, 1);
213}
214
215size_t strnlen_unknown_limit(float f) {
216  // This used to crash because we don't model the integer values of floats.
217  return strnlen("abc", (int)f);
218}
219
220void strnlen_is_not_strlen(char *x) {
221  if (strnlen(x, 10) != strlen(x))
222    (void)*(char*)0; // expected-warning{{null}}
223}
224
225void strnlen_at_limit(char *x) {
226  size_t len = strnlen(x, 10);
227  if (len > 10)
228    (void)*(char*)0; // expected-warning{{never executed}}
229  if (len == 10)
230    (void)*(char*)0; // expected-warning{{null}}
231}
232
233void strnlen_less_than_limit(char *x) {
234  size_t len = strnlen(x, 10);
235  if (len > 10)
236    (void)*(char*)0; // expected-warning{{never executed}}
237  if (len < 10)
238    (void)*(char*)0; // expected-warning{{null}}
239}
240
241void strnlen_at_actual(size_t limit) {
242  size_t len = strnlen("abc", limit);
243  if (len > 3)
244    (void)*(char*)0; // expected-warning{{never executed}}
245  if (len == 3)
246    (void)*(char*)0; // expected-warning{{null}}
247}
248
249void strnlen_less_than_actual(size_t limit) {
250  size_t len = strnlen("abc", limit);
251  if (len > 3)
252    (void)*(char*)0; // expected-warning{{never executed}}
253  if (len < 3)
254    (void)*(char*)0; // expected-warning{{null}}
255}
256
257//===----------------------------------------------------------------------===
258// strcpy()
259//===----------------------------------------------------------------------===
260
261#ifdef VARIANT
262
263#define __strcpy_chk BUILTIN(__strcpy_chk)
264char *__strcpy_chk(char *restrict s1, const char *restrict s2, size_t destlen);
265
266#define strcpy(a,b) __strcpy_chk(a,b,(size_t)-1)
267
268#else /* VARIANT */
269
270#define strcpy BUILTIN(strcpy)
271char *strcpy(char *restrict s1, const char *restrict s2);
272
273#endif /* VARIANT */
274
275
276void strcpy_null_dst(char *x) {
277  strcpy(NULL, x); // expected-warning{{Null pointer argument in call to string copy function}}
278}
279
280void strcpy_null_src(char *x) {
281  strcpy(x, NULL); // expected-warning{{Null pointer argument in call to string copy function}}
282}
283
284void strcpy_fn(char *x) {
285  strcpy(x, (char*)&strcpy_fn); // expected-warning{{Argument to string copy function is the address of the function 'strcpy_fn', which is not a null-terminated string}}
286}
287
288void strcpy_effects(char *x, char *y) {
289  char a = x[0];
290
291  if (strcpy(x, y) != x)
292    (void)*(char*)0; // no-warning
293
294  if (strlen(x) != strlen(y))
295    (void)*(char*)0; // no-warning
296
297  if (a != x[0])
298    (void)*(char*)0; // expected-warning{{null}}
299}
300
301void strcpy_overflow(char *y) {
302  char x[4];
303  if (strlen(y) == 4)
304    strcpy(x, y); // expected-warning{{String copy function overflows destination buffer}}
305}
306
307void strcpy_no_overflow(char *y) {
308  char x[4];
309  if (strlen(y) == 3)
310    strcpy(x, y); // no-warning
311}
312
313//===----------------------------------------------------------------------===
314// stpcpy()
315//===----------------------------------------------------------------------===
316
317#ifdef VARIANT
318
319#define __stpcpy_chk BUILTIN(__stpcpy_chk)
320char *__stpcpy_chk(char *restrict s1, const char *restrict s2, size_t destlen);
321
322#define stpcpy(a,b) __stpcpy_chk(a,b,(size_t)-1)
323
324#else /* VARIANT */
325
326#define stpcpy BUILTIN(stpcpy)
327char *stpcpy(char *restrict s1, const char *restrict s2);
328
329#endif /* VARIANT */
330
331
332void stpcpy_effect(char *x, char *y) {
333  char a = x[0];
334
335  if (stpcpy(x, y) != &x[strlen(y)])
336    (void)*(char*)0; // no-warning
337
338  if (strlen(x) != strlen(y))
339    (void)*(char*)0; // no-warning
340
341  if (a != x[0])
342    (void)*(char*)0; // expected-warning{{null}}
343}
344
345void stpcpy_overflow(char *y) {
346  char x[4];
347  if (strlen(y) == 4)
348    stpcpy(x, y); // expected-warning{{String copy function overflows destination buffer}}
349}
350
351void stpcpy_no_overflow(char *y) {
352  char x[4];
353  if (strlen(y) == 3)
354    stpcpy(x, y); // no-warning
355}
356
357//===----------------------------------------------------------------------===
358// strcat()
359//===----------------------------------------------------------------------===
360
361#ifdef VARIANT
362
363#define __strcat_chk BUILTIN(__strcat_chk)
364char *__strcat_chk(char *restrict s1, const char *restrict s2, size_t destlen);
365
366#define strcat(a,b) __strcat_chk(a,b,(size_t)-1)
367
368#else /* VARIANT */
369
370#define strcat BUILTIN(strcat)
371char *strcat(char *restrict s1, const char *restrict s2);
372
373#endif /* VARIANT */
374
375
376void strcat_null_dst(char *x) {
377  strcat(NULL, x); // expected-warning{{Null pointer argument in call to string copy function}}
378}
379
380void strcat_null_src(char *x) {
381  strcat(x, NULL); // expected-warning{{Null pointer argument in call to string copy function}}
382}
383
384void strcat_fn(char *x) {
385  strcat(x, (char*)&strcat_fn); // expected-warning{{Argument to string copy function is the address of the function 'strcat_fn', which is not a null-terminated string}}
386}
387
388void strcat_effects(char *y) {
389  char x[8] = "123";
390  size_t orig_len = strlen(x);
391  char a = x[0];
392
393  if (strlen(y) != 4)
394    return;
395
396  if (strcat(x, y) != x)
397    (void)*(char*)0; // no-warning
398
399  if ((int)strlen(x) != (orig_len + strlen(y)))
400    (void)*(char*)0; // no-warning
401}
402
403void strcat_overflow_0(char *y) {
404  char x[4] = "12";
405  if (strlen(y) == 4)
406    strcat(x, y); // expected-warning{{String copy function overflows destination buffer}}
407}
408
409void strcat_overflow_1(char *y) {
410  char x[4] = "12";
411  if (strlen(y) == 3)
412    strcat(x, y); // expected-warning{{String copy function overflows destination buffer}}
413}
414
415void strcat_overflow_2(char *y) {
416  char x[4] = "12";
417  if (strlen(y) == 2)
418    strcat(x, y); // expected-warning{{String copy function overflows destination buffer}}
419}
420
421void strcat_no_overflow(char *y) {
422  char x[5] = "12";
423  if (strlen(y) == 2)
424    strcat(x, y); // no-warning
425}
426
427void strcat_symbolic_dst_length(char *dst) {
428	strcat(dst, "1234");
429	if (strlen(dst) < 4)
430		(void)*(char*)0; // no-warning
431}
432
433void strcat_symbolic_src_length(char *src) {
434	char dst[8] = "1234";
435	strcat(dst, src);
436	if (strlen(dst) < 4)
437		(void)*(char*)0; // no-warning
438}
439
440void strcat_unknown_src_length(char *src, int offset) {
441	char dst[8] = "1234";
442	strcat(dst, &src[offset]);
443	if (strlen(dst) < 4)
444		(void)*(char*)0; // no-warning
445}
446
447// There is no strcat_unknown_dst_length because if we can't get a symbolic
448// length for the "before" strlen, we won't be able to set one for "after".
449
450void strcat_too_big(char *dst, char *src) {
451	if (strlen(dst) != (((size_t)0) - 2))
452		return;
453	if (strlen(src) != 2)
454		return;
455	strcat(dst, src); // expected-warning{{This expression will create a string whose length is too big to be represented as a size_t}}
456}
457
458
459//===----------------------------------------------------------------------===
460// strncpy()
461//===----------------------------------------------------------------------===
462
463#ifdef VARIANT
464
465#define __strncpy_chk BUILTIN(__strncpy_chk)
466char *__strncpy_chk(char *restrict s1, const char *restrict s2, size_t n, size_t destlen);
467
468#define strncpy(a,b,n) __strncpy_chk(a,b,n,(size_t)-1)
469
470#else /* VARIANT */
471
472#define strncpy BUILTIN(strncpy)
473char *strncpy(char *restrict s1, const char *restrict s2, size_t n);
474
475#endif /* VARIANT */
476
477
478void strncpy_null_dst(char *x) {
479  strncpy(NULL, x, 5); // expected-warning{{Null pointer argument in call to string copy function}}
480}
481
482void strncpy_null_src(char *x) {
483  strncpy(x, NULL, 5); // expected-warning{{Null pointer argument in call to string copy function}}
484}
485
486void strncpy_fn(char *x) {
487  strncpy(x, (char*)&strcpy_fn, 5); // expected-warning{{Argument to string copy function is the address of the function 'strcpy_fn', which is not a null-terminated string}}
488}
489
490void strncpy_effects(char *x, char *y) {
491  char a = x[0];
492
493  if (strncpy(x, y, 5) != x)
494    (void)*(char*)0; // no-warning
495
496  if (strlen(x) != strlen(y))
497    (void)*(char*)0; // expected-warning{{null}}
498
499  if (a != x[0])
500    (void)*(char*)0; // expected-warning{{null}}
501}
502
503void strncpy_overflow(char *y) {
504  char x[4];
505  if (strlen(y) == 4)
506    strncpy(x, y, 5); // expected-warning{{Size argument is greater than the length of the destination buffer}}
507}
508
509void strncpy_no_overflow(char *y) {
510  char x[4];
511  if (strlen(y) == 3)
512    strncpy(x, y, 5); // expected-warning{{Size argument is greater than the length of the destination buffer}}
513}
514
515void strncpy_no_overflow2(char *y, int n) {
516	if (n <= 4)
517		return;
518
519  char x[4];
520  if (strlen(y) == 3)
521    strncpy(x, y, n); // expected-warning{{Size argument is greater than the length of the destination buffer}}
522}
523
524void strncpy_truncate(char *y) {
525  char x[4];
526  if (strlen(y) == 4)
527    strncpy(x, y, 3); // no-warning
528}
529
530void strncpy_no_truncate(char *y) {
531  char x[4];
532  if (strlen(y) == 3)
533    strncpy(x, y, 3); // no-warning
534}
535
536void strncpy_exactly_matching_buffer(char *y) {
537	char x[4];
538	strncpy(x, y, 4); // no-warning
539
540	// strncpy does not null-terminate, so we have no idea what the strlen is
541	// after this.
542	if (strlen(x) > 4)
543		(void)*(int*)0; // expected-warning{{null}}
544}
545
546void strncpy_exactly_matching_buffer2(char *y) {
547	if (strlen(y) >= 4)
548		return;
549
550	char x[4];
551	strncpy(x, y, 4); // no-warning
552
553	// This time, we know that y fits in x anyway.
554	if (strlen(x) > 3)
555		(void)*(int*)0; // no-warning
556}
557
558//===----------------------------------------------------------------------===
559// strncat()
560//===----------------------------------------------------------------------===
561
562#ifdef VARIANT
563
564#define __strncat_chk BUILTIN(__strncat_chk)
565char *__strncat_chk(char *restrict s1, const char *restrict s2, size_t n, size_t destlen);
566
567#define strncat(a,b,c) __strncat_chk(a,b,c, (size_t)-1)
568
569#else /* VARIANT */
570
571#define strncat BUILTIN(strncat)
572char *strncat(char *restrict s1, const char *restrict s2, size_t n);
573
574#endif /* VARIANT */
575
576
577void strncat_null_dst(char *x) {
578  strncat(NULL, x, 4); // expected-warning{{Null pointer argument in call to string copy function}}
579}
580
581void strncat_null_src(char *x) {
582  strncat(x, NULL, 4); // expected-warning{{Null pointer argument in call to string copy function}}
583}
584
585void strncat_fn(char *x) {
586  strncat(x, (char*)&strncat_fn, 4); // expected-warning{{Argument to string copy function is the address of the function 'strncat_fn', which is not a null-terminated string}}
587}
588
589void strncat_effects(char *y) {
590  char x[8] = "123";
591  size_t orig_len = strlen(x);
592  char a = x[0];
593
594  if (strlen(y) != 4)
595    return;
596
597  if (strncat(x, y, strlen(y)) != x)
598    (void)*(char*)0; // no-warning
599
600  if (strlen(x) != orig_len + strlen(y))
601    (void)*(char*)0; // no-warning
602}
603
604void strncat_overflow_0(char *y) {
605  char x[4] = "12";
606  if (strlen(y) == 4)
607    strncat(x, y, strlen(y)); // expected-warning{{Size argument is greater than the free space in the destination buffer}}
608}
609
610void strncat_overflow_1(char *y) {
611  char x[4] = "12";
612  if (strlen(y) == 3)
613    strncat(x, y, strlen(y)); // expected-warning{{Size argument is greater than the free space in the destination buffer}}
614}
615
616void strncat_overflow_2(char *y) {
617  char x[4] = "12";
618  if (strlen(y) == 2)
619    strncat(x, y, strlen(y)); // expected-warning{{Size argument is greater than the free space in the destination buffer}}
620}
621
622void strncat_overflow_3(char *y) {
623  char x[4] = "12";
624  if (strlen(y) == 4)
625    strncat(x, y, 2); // expected-warning{{Size argument is greater than the free space in the destination buffer}}
626}
627void strncat_no_overflow_1(char *y) {
628  char x[5] = "12";
629  if (strlen(y) == 2)
630    strncat(x, y, strlen(y)); // no-warning
631}
632
633void strncat_no_overflow_2(char *y) {
634  char x[4] = "12";
635  if (strlen(y) == 4)
636    strncat(x, y, 1); // no-warning
637}
638
639void strncat_symbolic_dst_length(char *dst) {
640  strncat(dst, "1234", 5);
641  if (strlen(dst) < 4)
642    (void)*(char*)0; // no-warning
643}
644
645void strncat_symbolic_src_length(char *src) {
646  char dst[8] = "1234";
647  strncat(dst, src, 3);
648  if (strlen(dst) < 4)
649    (void)*(char*)0; // no-warning
650
651  char dst2[8] = "1234";
652  strncat(dst2, src, 4); // expected-warning{{Size argument is greater than the free space in the destination buffer}}
653}
654
655void strncat_unknown_src_length(char *src, int offset) {
656  char dst[8] = "1234";
657  strncat(dst, &src[offset], 3);
658  if (strlen(dst) < 4)
659    (void)*(char*)0; // no-warning
660
661  char dst2[8] = "1234";
662  strncat(dst2, &src[offset], 4); // expected-warning{{Size argument is greater than the free space in the destination buffer}}
663}
664
665// There is no strncat_unknown_dst_length because if we can't get a symbolic
666// length for the "before" strlen, we won't be able to set one for "after".
667
668void strncat_symbolic_limit(unsigned limit) {
669  char dst[6] = "1234";
670  char src[] = "567";
671  strncat(dst, src, limit); // no-warning
672  if (strlen(dst) < 4)
673    (void)*(char*)0; // no-warning
674  if (strlen(dst) == 4)
675    (void)*(char*)0; // expected-warning{{null}}
676}
677
678void strncat_unknown_limit(float limit) {
679  char dst[6] = "1234";
680  char src[] = "567";
681  strncat(dst, src, (size_t)limit); // no-warning
682  if (strlen(dst) < 4)
683    (void)*(char*)0; // no-warning
684  if (strlen(dst) == 4)
685    (void)*(char*)0; // expected-warning{{null}}
686}
687
688void strncat_too_big(char *dst, char *src) {
689  if (strlen(dst) != (((size_t)0) - 2))
690    return;
691  if (strlen(src) != 2)
692    return;
693  strncat(dst, src, 2); // expected-warning{{This expression will create a string whose length is too big to be represented as a size_t}}
694}
695
696//===----------------------------------------------------------------------===
697// strcmp()
698//===----------------------------------------------------------------------===
699
700#define strcmp BUILTIN(strcmp)
701int strcmp(const char * s1, const char * s2);
702
703void strcmp_constant0() {
704  if (strcmp("123", "123") != 0)
705    (void)*(char*)0; // no-warning
706}
707
708void strcmp_constant_and_var_0() {
709  char *x = "123";
710  if (strcmp(x, "123") != 0)
711    (void)*(char*)0; // no-warning
712}
713
714void strcmp_constant_and_var_1() {
715  char *x = "123";
716    if (strcmp("123", x) != 0)
717    (void)*(char*)0; // no-warning
718}
719
720void strcmp_0() {
721  char *x = "123";
722  char *y = "123";
723  if (strcmp(x, y) != 0)
724    (void)*(char*)0; // no-warning
725}
726
727void strcmp_1() {
728  char *x = "234";
729  char *y = "123";
730  if (strcmp(x, y) != 1)
731    (void)*(char*)0; // no-warning
732}
733
734void strcmp_2() {
735  char *x = "123";
736  char *y = "234";
737  if (strcmp(x, y) != -1)
738    (void)*(char*)0; // no-warning
739}
740
741void strcmp_null_0() {
742  char *x = NULL;
743  char *y = "123";
744  strcmp(x, y); // expected-warning{{Null pointer argument in call to string comparison function}}
745}
746
747void strcmp_null_1() {
748  char *x = "123";
749  char *y = NULL;
750  strcmp(x, y); // expected-warning{{Null pointer argument in call to string comparison function}}
751}
752
753void strcmp_diff_length_0() {
754  char *x = "12345";
755  char *y = "234";
756  if (strcmp(x, y) != -1)
757    (void)*(char*)0; // no-warning
758}
759
760void strcmp_diff_length_1() {
761  char *x = "123";
762  char *y = "23456";
763  if (strcmp(x, y) != -1)
764    (void)*(char*)0; // no-warning
765}
766
767void strcmp_diff_length_2() {
768  char *x = "12345";
769  char *y = "123";
770  if (strcmp(x, y) != 1)
771    (void)*(char*)0; // no-warning
772}
773
774void strcmp_diff_length_3() {
775  char *x = "123";
776  char *y = "12345";
777  if (strcmp(x, y) != -1)
778    (void)*(char*)0; // no-warning
779}
780
781void strcmp_embedded_null () {
782	if (strcmp("\0z", "\0y") != 0)
783		(void)*(char*)0; // no-warning
784}
785
786void strcmp_unknown_arg (char *unknown) {
787	if (strcmp(unknown, unknown) != 0)
788		(void)*(char*)0; // no-warning
789}
790
791//===----------------------------------------------------------------------===
792// strncmp()
793//===----------------------------------------------------------------------===
794
795#define strncmp BUILTIN(strncmp)
796int strncmp(const char *s1, const char *s2, size_t n);
797
798void strncmp_constant0() {
799  if (strncmp("123", "123", 3) != 0)
800    (void)*(char*)0; // no-warning
801}
802
803void strncmp_constant_and_var_0() {
804  char *x = "123";
805  if (strncmp(x, "123", 3) != 0)
806    (void)*(char*)0; // no-warning
807}
808
809void strncmp_constant_and_var_1() {
810  char *x = "123";
811  if (strncmp("123", x, 3) != 0)
812    (void)*(char*)0; // no-warning
813}
814
815void strncmp_0() {
816  char *x = "123";
817  char *y = "123";
818  if (strncmp(x, y, 3) != 0)
819    (void)*(char*)0; // no-warning
820}
821
822void strncmp_1() {
823  char *x = "234";
824  char *y = "123";
825  if (strncmp(x, y, 3) != 1)
826    (void)*(char*)0; // no-warning
827}
828
829void strncmp_2() {
830  char *x = "123";
831  char *y = "234";
832  if (strncmp(x, y, 3) != -1)
833    (void)*(char*)0; // no-warning
834}
835
836void strncmp_null_0() {
837  char *x = NULL;
838  char *y = "123";
839  strncmp(x, y, 3); // expected-warning{{Null pointer argument in call to string comparison function}}
840}
841
842void strncmp_null_1() {
843  char *x = "123";
844  char *y = NULL;
845  strncmp(x, y, 3); // expected-warning{{Null pointer argument in call to string comparison function}}
846}
847
848void strncmp_diff_length_0() {
849  char *x = "12345";
850  char *y = "234";
851  if (strncmp(x, y, 5) != -1)
852    (void)*(char*)0; // no-warning
853}
854
855void strncmp_diff_length_1() {
856  char *x = "123";
857  char *y = "23456";
858  if (strncmp(x, y, 5) != -1)
859    (void)*(char*)0; // no-warning
860}
861
862void strncmp_diff_length_2() {
863  char *x = "12345";
864  char *y = "123";
865  if (strncmp(x, y, 5) != 1)
866    (void)*(char*)0; // no-warning
867}
868
869void strncmp_diff_length_3() {
870  char *x = "123";
871  char *y = "12345";
872  if (strncmp(x, y, 5) != -1)
873    (void)*(char*)0; // no-warning
874}
875
876void strncmp_diff_length_4() {
877  char *x = "123";
878  char *y = "12345";
879  if (strncmp(x, y, 3) != 0)
880    (void)*(char*)0; // no-warning
881}
882
883void strncmp_diff_length_5() {
884  char *x = "012";
885  char *y = "12345";
886  if (strncmp(x, y, 3) != -1)
887    (void)*(char*)0; // no-warning
888}
889
890void strncmp_diff_length_6() {
891  char *x = "234";
892  char *y = "12345";
893  if (strncmp(x, y, 3) != 1)
894    (void)*(char*)0; // no-warning
895}
896
897void strncmp_embedded_null () {
898	if (strncmp("ab\0zz", "ab\0yy", 4) != 0)
899		(void)*(char*)0; // no-warning
900}
901
902//===----------------------------------------------------------------------===
903// strcasecmp()
904//===----------------------------------------------------------------------===
905
906#define strcasecmp BUILTIN(strcasecmp)
907int strcasecmp(const char *s1, const char *s2);
908
909void strcasecmp_constant0() {
910  if (strcasecmp("abc", "Abc") != 0)
911    (void)*(char*)0; // no-warning
912}
913
914void strcasecmp_constant_and_var_0() {
915  char *x = "abc";
916  if (strcasecmp(x, "Abc") != 0)
917    (void)*(char*)0; // no-warning
918}
919
920void strcasecmp_constant_and_var_1() {
921  char *x = "abc";
922    if (strcasecmp("Abc", x) != 0)
923    (void)*(char*)0; // no-warning
924}
925
926void strcasecmp_0() {
927  char *x = "abc";
928  char *y = "Abc";
929  if (strcasecmp(x, y) != 0)
930    (void)*(char*)0; // no-warning
931}
932
933void strcasecmp_1() {
934  char *x = "Bcd";
935  char *y = "abc";
936  if (strcasecmp(x, y) != 1)
937    (void)*(char*)0; // no-warning
938}
939
940void strcasecmp_2() {
941  char *x = "abc";
942  char *y = "Bcd";
943  if (strcasecmp(x, y) != -1)
944    (void)*(char*)0; // no-warning
945}
946
947void strcasecmp_null_0() {
948  char *x = NULL;
949  char *y = "123";
950  strcasecmp(x, y); // expected-warning{{Null pointer argument in call to string comparison function}}
951}
952
953void strcasecmp_null_1() {
954  char *x = "123";
955  char *y = NULL;
956  strcasecmp(x, y); // expected-warning{{Null pointer argument in call to string comparison function}}
957}
958
959void strcasecmp_diff_length_0() {
960  char *x = "abcde";
961  char *y = "aBd";
962  if (strcasecmp(x, y) != -1)
963    (void)*(char*)0; // no-warning
964}
965
966void strcasecmp_diff_length_1() {
967  char *x = "abc";
968  char *y = "aBdef";
969  if (strcasecmp(x, y) != -1)
970    (void)*(char*)0; // no-warning
971}
972
973void strcasecmp_diff_length_2() {
974  char *x = "aBcDe";
975  char *y = "abc";
976  if (strcasecmp(x, y) != 1)
977    (void)*(char*)0; // no-warning
978}
979
980void strcasecmp_diff_length_3() {
981  char *x = "aBc";
982  char *y = "abcde";
983  if (strcasecmp(x, y) != -1)
984    (void)*(char*)0; // no-warning
985}
986
987void strcasecmp_embedded_null () {
988	if (strcasecmp("ab\0zz", "ab\0yy") != 0)
989		(void)*(char*)0; // no-warning
990}
991
992//===----------------------------------------------------------------------===
993// strncasecmp()
994//===----------------------------------------------------------------------===
995
996#define strncasecmp BUILTIN(strncasecmp)
997int strncasecmp(const char *s1, const char *s2, size_t n);
998
999void strncasecmp_constant0() {
1000  if (strncasecmp("abc", "Abc", 3) != 0)
1001    (void)*(char*)0; // no-warning
1002}
1003
1004void strncasecmp_constant_and_var_0() {
1005  char *x = "abc";
1006  if (strncasecmp(x, "Abc", 3) != 0)
1007    (void)*(char*)0; // no-warning
1008}
1009
1010void strncasecmp_constant_and_var_1() {
1011  char *x = "abc";
1012  if (strncasecmp("Abc", x, 3) != 0)
1013    (void)*(char*)0; // no-warning
1014}
1015
1016void strncasecmp_0() {
1017  char *x = "abc";
1018  char *y = "Abc";
1019  if (strncasecmp(x, y, 3) != 0)
1020    (void)*(char*)0; // no-warning
1021}
1022
1023void strncasecmp_1() {
1024  char *x = "Bcd";
1025  char *y = "abc";
1026  if (strncasecmp(x, y, 3) != 1)
1027    (void)*(char*)0; // no-warning
1028}
1029
1030void strncasecmp_2() {
1031  char *x = "abc";
1032  char *y = "Bcd";
1033  if (strncasecmp(x, y, 3) != -1)
1034    (void)*(char*)0; // no-warning
1035}
1036
1037void strncasecmp_null_0() {
1038  char *x = NULL;
1039  char *y = "123";
1040  strncasecmp(x, y, 3); // expected-warning{{Null pointer argument in call to string comparison function}}
1041}
1042
1043void strncasecmp_null_1() {
1044  char *x = "123";
1045  char *y = NULL;
1046  strncasecmp(x, y, 3); // expected-warning{{Null pointer argument in call to string comparison function}}
1047}
1048
1049void strncasecmp_diff_length_0() {
1050  char *x = "abcde";
1051  char *y = "aBd";
1052  if (strncasecmp(x, y, 5) != -1)
1053    (void)*(char*)0; // no-warning
1054}
1055
1056void strncasecmp_diff_length_1() {
1057  char *x = "abc";
1058  char *y = "aBdef";
1059  if (strncasecmp(x, y, 5) != -1)
1060    (void)*(char*)0; // no-warning
1061}
1062
1063void strncasecmp_diff_length_2() {
1064  char *x = "aBcDe";
1065  char *y = "abc";
1066  if (strncasecmp(x, y, 5) != 1)
1067    (void)*(char*)0; // no-warning
1068}
1069
1070void strncasecmp_diff_length_3() {
1071  char *x = "aBc";
1072  char *y = "abcde";
1073  if (strncasecmp(x, y, 5) != -1)
1074    (void)*(char*)0; // no-warning
1075}
1076
1077void strncasecmp_diff_length_4() {
1078  char *x = "abcde";
1079  char *y = "aBc";
1080  if (strncasecmp(x, y, 3) != 0)
1081    (void)*(char*)0; // no-warning
1082}
1083
1084void strncasecmp_diff_length_5() {
1085  char *x = "abcde";
1086  char *y = "aBd";
1087  if (strncasecmp(x, y, 3) != -1)
1088    (void)*(char*)0; // no-warning
1089}
1090
1091void strncasecmp_diff_length_6() {
1092  char *x = "aBDe";
1093  char *y = "abc";
1094  if (strncasecmp(x, y, 3) != 1)
1095    (void)*(char*)0; // no-warning
1096}
1097
1098void strncasecmp_embedded_null () {
1099	if (strncasecmp("ab\0zz", "ab\0yy", 4) != 0)
1100		(void)*(char*)0; // no-warning
1101}
1102