1a4de17562d13d7a8188108243c4cfbd52f33229aPirama Arumuga Nainar// RUN: %clang_cc1 -triple x86_64-unknown-unknown -analyze -analyzer-checker=alpha.security.MallocOverflow,unix -verify %s 2a4de17562d13d7a8188108243c4cfbd52f33229aPirama Arumuga Nainar 3a4de17562d13d7a8188108243c4cfbd52f33229aPirama Arumuga Nainartypedef __typeof__(sizeof(int)) size_t; 4a4de17562d13d7a8188108243c4cfbd52f33229aPirama Arumuga Nainarextern void *malloc(size_t); 5a4de17562d13d7a8188108243c4cfbd52f33229aPirama Arumuga Nainarextern void free(void *ptr); 6a4de17562d13d7a8188108243c4cfbd52f33229aPirama Arumuga Nainar 7a4de17562d13d7a8188108243c4cfbd52f33229aPirama Arumuga Nainarvoid *malloc(unsigned long s); 8a4de17562d13d7a8188108243c4cfbd52f33229aPirama Arumuga Nainar 9a4de17562d13d7a8188108243c4cfbd52f33229aPirama Arumuga Nainarstruct table { 10a4de17562d13d7a8188108243c4cfbd52f33229aPirama Arumuga Nainar int nentry; 11a4de17562d13d7a8188108243c4cfbd52f33229aPirama Arumuga Nainar unsigned *table; 12a4de17562d13d7a8188108243c4cfbd52f33229aPirama Arumuga Nainar unsigned offset_max; 13a4de17562d13d7a8188108243c4cfbd52f33229aPirama Arumuga Nainar}; 14a4de17562d13d7a8188108243c4cfbd52f33229aPirama Arumuga Nainar 15a4de17562d13d7a8188108243c4cfbd52f33229aPirama Arumuga Nainarstatic int table_build(struct table *t) { 16a4de17562d13d7a8188108243c4cfbd52f33229aPirama Arumuga Nainar 17a4de17562d13d7a8188108243c4cfbd52f33229aPirama Arumuga Nainar t->nentry = ((t->offset_max >> 2) + 31) / 32; 18a4de17562d13d7a8188108243c4cfbd52f33229aPirama Arumuga Nainar t->table = (unsigned *)malloc(sizeof(unsigned) * t->nentry); // expected-warning {{the computation of the size of the memory allocation may overflow}} 19a4de17562d13d7a8188108243c4cfbd52f33229aPirama Arumuga Nainar 20a4de17562d13d7a8188108243c4cfbd52f33229aPirama Arumuga Nainar int n; 21a4de17562d13d7a8188108243c4cfbd52f33229aPirama Arumuga Nainar n = 10000; 22a4de17562d13d7a8188108243c4cfbd52f33229aPirama Arumuga Nainar int *p = malloc(sizeof(int) * n); // no-warning 23a4de17562d13d7a8188108243c4cfbd52f33229aPirama Arumuga Nainar 24a4de17562d13d7a8188108243c4cfbd52f33229aPirama Arumuga Nainar free(p); 25a4de17562d13d7a8188108243c4cfbd52f33229aPirama Arumuga Nainar return t->nentry; 26a4de17562d13d7a8188108243c4cfbd52f33229aPirama Arumuga Nainar} 27a4de17562d13d7a8188108243c4cfbd52f33229aPirama Arumuga Nainar 28a4de17562d13d7a8188108243c4cfbd52f33229aPirama Arumuga Nainarstatic int table_build_1(struct table *t) { 29a4de17562d13d7a8188108243c4cfbd52f33229aPirama Arumuga Nainar t->nentry = (sizeof(struct table) * 2 + 31) / 32; 30a4de17562d13d7a8188108243c4cfbd52f33229aPirama Arumuga Nainar t->table = (unsigned *)malloc(sizeof(unsigned) * t->nentry); // no-warning 31a4de17562d13d7a8188108243c4cfbd52f33229aPirama Arumuga Nainar return t->nentry; 32a4de17562d13d7a8188108243c4cfbd52f33229aPirama Arumuga Nainar} 33a4de17562d13d7a8188108243c4cfbd52f33229aPirama Arumuga Nainar 34a4de17562d13d7a8188108243c4cfbd52f33229aPirama Arumuga Nainarvoid *f(int n) { 35a4de17562d13d7a8188108243c4cfbd52f33229aPirama Arumuga Nainar return malloc(n * 0 * sizeof(int)); // expected-warning {{Call to 'malloc' has an allocation size of 0 bytes}} 36a4de17562d13d7a8188108243c4cfbd52f33229aPirama Arumuga Nainar} 37