stack-addr-ps.cpp revision 112344ab7f96cf482bce80530676712c282756d5
1782f63ecd124f9384f988dc7e0cf4ae1540c15f6Jeffrey Yasskin// RUN: %clang_cc1 -analyze -analyzer-checker=core -analyzer-store=region -verify %s
268957a919084ab8bbd1f01d534db1d6f31d0f459Ted Kremenek
3112344ab7f96cf482bce80530676712c282756d5Jordan Rosetypedef __INTPTR_TYPE__ intptr_t;
4112344ab7f96cf482bce80530676712c282756d5Jordan Rose
568957a919084ab8bbd1f01d534db1d6f31d0f459Ted Kremenekconst int& g() {
668957a919084ab8bbd1f01d534db1d6f31d0f459Ted Kremenek  int s;
7782f63ecd124f9384f988dc7e0cf4ae1540c15f6Jeffrey Yasskin  return s; // expected-warning{{Address of stack memory associated with local variable 's' returned}} expected-warning{{reference to stack memory associated with local variable 's' returned}}
868957a919084ab8bbd1f01d534db1d6f31d0f459Ted Kremenek}
926e10bea3d2e9d2979194890e51b98ecea165a96Argyrios Kyrtzidis
1026e10bea3d2e9d2979194890e51b98ecea165a96Argyrios Kyrtzidisconst int& g2() {
1126e10bea3d2e9d2979194890e51b98ecea165a96Argyrios Kyrtzidis  int s1;
1226e10bea3d2e9d2979194890e51b98ecea165a96Argyrios Kyrtzidis  int &s2 = s1; // expected-note {{binding reference variable 's2' here}}
13782f63ecd124f9384f988dc7e0cf4ae1540c15f6Jeffrey Yasskin  return s2; // expected-warning{{Address of stack memory associated with local variable 's1' returned}} expected-warning {{reference to stack memory associated with local variable 's1' returned}}
1426e10bea3d2e9d2979194890e51b98ecea165a96Argyrios Kyrtzidis}
1526e10bea3d2e9d2979194890e51b98ecea165a96Argyrios Kyrtzidis
1626e10bea3d2e9d2979194890e51b98ecea165a96Argyrios Kyrtzidisconst int& g3() {
1726e10bea3d2e9d2979194890e51b98ecea165a96Argyrios Kyrtzidis  int s1;
1826e10bea3d2e9d2979194890e51b98ecea165a96Argyrios Kyrtzidis  int &s2 = s1; // expected-note {{binding reference variable 's2' here}}
1926e10bea3d2e9d2979194890e51b98ecea165a96Argyrios Kyrtzidis  int &s3 = s2; // expected-note {{binding reference variable 's3' here}}
20782f63ecd124f9384f988dc7e0cf4ae1540c15f6Jeffrey Yasskin  return s3; // expected-warning{{Address of stack memory associated with local variable 's1' returned}} expected-warning {{reference to stack memory associated with local variable 's1' returned}}
2126e10bea3d2e9d2979194890e51b98ecea165a96Argyrios Kyrtzidis}
2226e10bea3d2e9d2979194890e51b98ecea165a96Argyrios Kyrtzidis
2326e10bea3d2e9d2979194890e51b98ecea165a96Argyrios Kyrtzidisint get_value();
2426e10bea3d2e9d2979194890e51b98ecea165a96Argyrios Kyrtzidis
255e5440ba9c135f523f72e7e7c5da59d390d697c5Jordan Roseconst int &get_reference1() { return get_value(); } // expected-warning{{Address of stack memory associated with temporary object of type 'int' returned}} expected-warning {{returning reference to local temporary}}
2626e10bea3d2e9d2979194890e51b98ecea165a96Argyrios Kyrtzidis
2726e10bea3d2e9d2979194890e51b98ecea165a96Argyrios Kyrtzidisconst int &get_reference2() {
2826e10bea3d2e9d2979194890e51b98ecea165a96Argyrios Kyrtzidis  const int &x = get_value(); // expected-note {{binding reference variable 'x' here}}
295e5440ba9c135f523f72e7e7c5da59d390d697c5Jordan Rose  return x; // expected-warning{{Address of stack memory associated with temporary object of type 'int' returned}} expected-warning {{returning reference to local temporary}}
3026e10bea3d2e9d2979194890e51b98ecea165a96Argyrios Kyrtzidis}
3126e10bea3d2e9d2979194890e51b98ecea165a96Argyrios Kyrtzidis
3226e10bea3d2e9d2979194890e51b98ecea165a96Argyrios Kyrtzidisconst int &get_reference3() {
3326e10bea3d2e9d2979194890e51b98ecea165a96Argyrios Kyrtzidis  const int &x1 = get_value(); // expected-note {{binding reference variable 'x1' here}}
3426e10bea3d2e9d2979194890e51b98ecea165a96Argyrios Kyrtzidis  const int &x2 = x1; // expected-note {{binding reference variable 'x2' here}}
355e5440ba9c135f523f72e7e7c5da59d390d697c5Jordan Rose  return x2; // expected-warning{{Address of stack memory associated with temporary object of type 'int' returned}} expected-warning {{returning reference to local temporary}}
3626e10bea3d2e9d2979194890e51b98ecea165a96Argyrios Kyrtzidis}
3726e10bea3d2e9d2979194890e51b98ecea165a96Argyrios Kyrtzidis
3826e10bea3d2e9d2979194890e51b98ecea165a96Argyrios Kyrtzidisint global_var;
3926e10bea3d2e9d2979194890e51b98ecea165a96Argyrios Kyrtzidisint *f1() {
4026e10bea3d2e9d2979194890e51b98ecea165a96Argyrios Kyrtzidis  int &y = global_var;
4126e10bea3d2e9d2979194890e51b98ecea165a96Argyrios Kyrtzidis  return &y;
4226e10bea3d2e9d2979194890e51b98ecea165a96Argyrios Kyrtzidis}
4326e10bea3d2e9d2979194890e51b98ecea165a96Argyrios Kyrtzidis
4426e10bea3d2e9d2979194890e51b98ecea165a96Argyrios Kyrtzidisint *f2() {
4526e10bea3d2e9d2979194890e51b98ecea165a96Argyrios Kyrtzidis  int x1;
4626e10bea3d2e9d2979194890e51b98ecea165a96Argyrios Kyrtzidis  int &x2 = x1; // expected-note {{binding reference variable 'x2' here}}
47782f63ecd124f9384f988dc7e0cf4ae1540c15f6Jeffrey Yasskin  return &x2; // expected-warning{{Address of stack memory associated with local variable 'x1' returned}} expected-warning {{address of stack memory associated with local variable 'x1' returned}}
4826e10bea3d2e9d2979194890e51b98ecea165a96Argyrios Kyrtzidis}
4926e10bea3d2e9d2979194890e51b98ecea165a96Argyrios Kyrtzidis
5026e10bea3d2e9d2979194890e51b98ecea165a96Argyrios Kyrtzidisint *f3() {
5126e10bea3d2e9d2979194890e51b98ecea165a96Argyrios Kyrtzidis  int x1;
5226e10bea3d2e9d2979194890e51b98ecea165a96Argyrios Kyrtzidis  int *const &x2 = &x1; // expected-note {{binding reference variable 'x2' here}}
536a835dddf45922e71a87637fdfac0863de65123cTed Kremenek  return x2; // expected-warning {{address of stack memory associated with local variable 'x1' returned}} expected-warning {{Address of stack memory associated with local variable 'x1' returned to caller}}
5426e10bea3d2e9d2979194890e51b98ecea165a96Argyrios Kyrtzidis}
5526e10bea3d2e9d2979194890e51b98ecea165a96Argyrios Kyrtzidis
5626e10bea3d2e9d2979194890e51b98ecea165a96Argyrios Kyrtzidisconst int *f4() {
5726e10bea3d2e9d2979194890e51b98ecea165a96Argyrios Kyrtzidis  const int &x1 = get_value(); // expected-note {{binding reference variable 'x1' here}}
5826e10bea3d2e9d2979194890e51b98ecea165a96Argyrios Kyrtzidis  const int &x2 = x1; // expected-note {{binding reference variable 'x2' here}}
595e5440ba9c135f523f72e7e7c5da59d390d697c5Jordan Rose  return &x2; // expected-warning{{Address of stack memory associated with temporary object of type 'int' returned}} expected-warning {{returning address of local temporary}}
6026e10bea3d2e9d2979194890e51b98ecea165a96Argyrios Kyrtzidis}
6126e10bea3d2e9d2979194890e51b98ecea165a96Argyrios Kyrtzidis
6226e10bea3d2e9d2979194890e51b98ecea165a96Argyrios Kyrtzidisstruct S {
6326e10bea3d2e9d2979194890e51b98ecea165a96Argyrios Kyrtzidis  int x;
6426e10bea3d2e9d2979194890e51b98ecea165a96Argyrios Kyrtzidis};
6526e10bea3d2e9d2979194890e51b98ecea165a96Argyrios Kyrtzidis
6626e10bea3d2e9d2979194890e51b98ecea165a96Argyrios Kyrtzidisint *mf() {
6726e10bea3d2e9d2979194890e51b98ecea165a96Argyrios Kyrtzidis  S s1;
6826e10bea3d2e9d2979194890e51b98ecea165a96Argyrios Kyrtzidis  S &s2 = s1; // expected-note {{binding reference variable 's2' here}}
6926e10bea3d2e9d2979194890e51b98ecea165a96Argyrios Kyrtzidis  int &x = s2.x; // expected-note {{binding reference variable 'x' here}}
70782f63ecd124f9384f988dc7e0cf4ae1540c15f6Jeffrey Yasskin  return &x; // expected-warning{{Address of stack memory associated with local variable 's1' returned}} expected-warning {{address of stack memory associated with local variable 's1' returned}}
7126e10bea3d2e9d2979194890e51b98ecea165a96Argyrios Kyrtzidis}
7226e10bea3d2e9d2979194890e51b98ecea165a96Argyrios Kyrtzidis
7326e10bea3d2e9d2979194890e51b98ecea165a96Argyrios Kyrtzidisvoid *lf() {
7426e10bea3d2e9d2979194890e51b98ecea165a96Argyrios Kyrtzidis    label:
7526e10bea3d2e9d2979194890e51b98ecea165a96Argyrios Kyrtzidis    void *const &x = &&label; // expected-note {{binding reference variable 'x' here}}
7626e10bea3d2e9d2979194890e51b98ecea165a96Argyrios Kyrtzidis    return x; // expected-warning {{returning address of label, which is local}}
7726e10bea3d2e9d2979194890e51b98ecea165a96Argyrios Kyrtzidis}
7826e10bea3d2e9d2979194890e51b98ecea165a96Argyrios Kyrtzidis
7926e10bea3d2e9d2979194890e51b98ecea165a96Argyrios Kyrtzidistemplate <typename T>
8026e10bea3d2e9d2979194890e51b98ecea165a96Argyrios Kyrtzidisstruct TS {
8126e10bea3d2e9d2979194890e51b98ecea165a96Argyrios Kyrtzidis  int *get();
8226e10bea3d2e9d2979194890e51b98ecea165a96Argyrios Kyrtzidis  int *m() {
8326e10bea3d2e9d2979194890e51b98ecea165a96Argyrios Kyrtzidis    int *&x = get();
8426e10bea3d2e9d2979194890e51b98ecea165a96Argyrios Kyrtzidis    return x;
8526e10bea3d2e9d2979194890e51b98ecea165a96Argyrios Kyrtzidis  }
8626e10bea3d2e9d2979194890e51b98ecea165a96Argyrios Kyrtzidis};
87e720ce7a3b1c1bfa5f7482183caa6e31fca9a3fbArgyrios Kyrtzidis
88e720ce7a3b1c1bfa5f7482183caa6e31fca9a3fbArgyrios Kyrtzidis// rdar://11345441
89e720ce7a3b1c1bfa5f7482183caa6e31fca9a3fbArgyrios Kyrtzidisint* f5() {
905965b7c7ddf8d9635426943a05441c71cb59fef6Hans Wennborg  int& i = i; // expected-warning {{Assigned value is garbage or undefined}} expected-note {{binding reference variable 'i' here}} expected-warning{{reference 'i' is not yet bound to a value when used within its own initialization}}
91e720ce7a3b1c1bfa5f7482183caa6e31fca9a3fbArgyrios Kyrtzidis  return &i; // expected-warning {{address of stack memory associated with local variable 'i' returned}}
92e720ce7a3b1c1bfa5f7482183caa6e31fca9a3fbArgyrios Kyrtzidis}
93f08740ba5903d089a53cc315c19286e2189f9ff3Ted Kremenek
94f08740ba5903d089a53cc315c19286e2189f9ff3Ted Kremenekvoid *radar13226577() {
95f08740ba5903d089a53cc315c19286e2189f9ff3Ted Kremenek    void *p = &p;
96f08740ba5903d089a53cc315c19286e2189f9ff3Ted Kremenek    return p; // expected-warning {{stack memory associated with local variable 'p' returned to caller}}
97f08740ba5903d089a53cc315c19286e2189f9ff3Ted Kremenek}
98f08740ba5903d089a53cc315c19286e2189f9ff3Ted Kremenek
99112344ab7f96cf482bce80530676712c282756d5Jordan Rosenamespace rdar13296133 {
100112344ab7f96cf482bce80530676712c282756d5Jordan Rose  class ConvertsToBool {
101112344ab7f96cf482bce80530676712c282756d5Jordan Rose  public:
102112344ab7f96cf482bce80530676712c282756d5Jordan Rose    operator bool() const { return this; }
103112344ab7f96cf482bce80530676712c282756d5Jordan Rose  };
104112344ab7f96cf482bce80530676712c282756d5Jordan Rose
105112344ab7f96cf482bce80530676712c282756d5Jordan Rose  class ConvertsToIntptr {
106112344ab7f96cf482bce80530676712c282756d5Jordan Rose  public:
107112344ab7f96cf482bce80530676712c282756d5Jordan Rose    operator intptr_t() const { return reinterpret_cast<intptr_t>(this); }
108112344ab7f96cf482bce80530676712c282756d5Jordan Rose  };
109112344ab7f96cf482bce80530676712c282756d5Jordan Rose
110112344ab7f96cf482bce80530676712c282756d5Jordan Rose  class ConvertsToPointer {
111112344ab7f96cf482bce80530676712c282756d5Jordan Rose  public:
112112344ab7f96cf482bce80530676712c282756d5Jordan Rose    operator const void *() const { return this; }
113112344ab7f96cf482bce80530676712c282756d5Jordan Rose  };
114112344ab7f96cf482bce80530676712c282756d5Jordan Rose
115112344ab7f96cf482bce80530676712c282756d5Jordan Rose  intptr_t returnAsNonLoc() {
116112344ab7f96cf482bce80530676712c282756d5Jordan Rose    ConvertsToIntptr obj;
117112344ab7f96cf482bce80530676712c282756d5Jordan Rose    return obj; // expected-warning{{Address of stack memory associated with local variable 'obj' returned to caller}}
118112344ab7f96cf482bce80530676712c282756d5Jordan Rose  }
119112344ab7f96cf482bce80530676712c282756d5Jordan Rose
120112344ab7f96cf482bce80530676712c282756d5Jordan Rose  bool returnAsBool() {
121112344ab7f96cf482bce80530676712c282756d5Jordan Rose    ConvertsToBool obj;
122112344ab7f96cf482bce80530676712c282756d5Jordan Rose    return obj; // no-warning
123112344ab7f96cf482bce80530676712c282756d5Jordan Rose  }
124112344ab7f96cf482bce80530676712c282756d5Jordan Rose
125112344ab7f96cf482bce80530676712c282756d5Jordan Rose  intptr_t returnAsNonLocViaPointer() {
126112344ab7f96cf482bce80530676712c282756d5Jordan Rose    ConvertsToPointer obj;
127112344ab7f96cf482bce80530676712c282756d5Jordan Rose    return reinterpret_cast<intptr_t>(static_cast<const void *>(obj)); // expected-warning{{Address of stack memory associated with local variable 'obj' returned to caller}}
128112344ab7f96cf482bce80530676712c282756d5Jordan Rose  }
129112344ab7f96cf482bce80530676712c282756d5Jordan Rose
130112344ab7f96cf482bce80530676712c282756d5Jordan Rose  bool returnAsBoolViaPointer() {
131112344ab7f96cf482bce80530676712c282756d5Jordan Rose    ConvertsToPointer obj;
132112344ab7f96cf482bce80530676712c282756d5Jordan Rose    return obj; // no-warning
133112344ab7f96cf482bce80530676712c282756d5Jordan Rose  }
134112344ab7f96cf482bce80530676712c282756d5Jordan Rose}
135112344ab7f96cf482bce80530676712c282756d5Jordan Rose
136