malloc.c revision 7a29070e01c1b48f85b7d3fced5315db8958fae2
1// RUN: %clang_cc1 -analyze -analyzer-checker=core,alpha.deadcode.UnreachableCode,alpha.core.CastSize,unix.Malloc,debug.ExprInspection -analyzer-store=region -verify %s 2// REQUIRES: LP64 3 4#include "Inputs/system-header-simulator.h" 5 6void clang_analyzer_eval(int); 7 8typedef __typeof(sizeof(int)) size_t; 9void *malloc(size_t); 10void *valloc(size_t); 11void free(void *); 12void *realloc(void *ptr, size_t size); 13void *reallocf(void *ptr, size_t size); 14void *calloc(size_t nmemb, size_t size); 15char *strdup(const char *s); 16char *strndup(const char *s, size_t n); 17 18void myfoo(int *p); 19void myfooint(int p); 20char *fooRetPtr(); 21 22void f1() { 23 int *p = malloc(12); 24 return; // expected-warning{{Memory is never released; potential leak of memory pointed to by 'p'}} 25} 26 27void f2() { 28 int *p = malloc(12); 29 free(p); 30 free(p); // expected-warning{{Attempt to free released memory}} 31} 32 33void f2_realloc_0() { 34 int *p = malloc(12); 35 realloc(p,0); 36 realloc(p,0); // expected-warning{{Attempt to free released memory}} 37} 38 39void f2_realloc_1() { 40 int *p = malloc(12); 41 int *q = realloc(p,0); // no-warning 42} 43 44void reallocNotNullPtr(unsigned sizeIn) { 45 unsigned size = 12; 46 char *p = (char*)malloc(size); 47 if (p) { 48 char *q = (char*)realloc(p, sizeIn); 49 char x = *q; // expected-warning {{Memory is never released; potential leak of memory pointed to by 'q'}} 50 } 51} 52 53int *realloctest1() { 54 int *q = malloc(12); 55 q = realloc(q, 20); 56 return q; // no warning - returning the allocated value 57} 58 59// p should be freed if realloc fails. 60void reallocFails() { 61 char *p = malloc(12); 62 char *r = realloc(p, 12+1); 63 if (!r) { 64 free(p); 65 } else { 66 free(r); 67 } 68} 69 70void reallocSizeZero1() { 71 char *p = malloc(12); 72 char *r = realloc(p, 0); 73 if (!r) { 74 free(p); // expected-warning {{Attempt to free released memory}} 75 } else { 76 free(r); 77 } 78} 79 80void reallocSizeZero2() { 81 char *p = malloc(12); 82 char *r = realloc(p, 0); 83 if (!r) { 84 free(p); // expected-warning {{Attempt to free released memory}} 85 } else { 86 free(r); 87 } 88 free(p); // expected-warning {{Attempt to free released memory}} 89} 90 91void reallocSizeZero3() { 92 char *p = malloc(12); 93 char *r = realloc(p, 0); 94 free(r); 95} 96 97void reallocSizeZero4() { 98 char *r = realloc(0, 0); 99 free(r); 100} 101 102void reallocSizeZero5() { 103 char *r = realloc(0, 0); 104} 105 106void reallocPtrZero1() { 107 char *r = realloc(0, 12); 108} // expected-warning {{Memory is never released; potential leak of memory pointed to by 'r'}} 109 110void reallocPtrZero2() { 111 char *r = realloc(0, 12); 112 if (r) 113 free(r); 114} 115 116void reallocPtrZero3() { 117 char *r = realloc(0, 12); 118 free(r); 119} 120 121void reallocRadar6337483_1() { 122 char *buf = malloc(100); 123 buf = (char*)realloc(buf, 0x1000000); 124 if (!buf) { 125 return;// expected-warning {{Memory is never released; potential leak}} 126 } 127 free(buf); 128} 129 130void reallocRadar6337483_2() { 131 char *buf = malloc(100); 132 char *buf2 = (char*)realloc(buf, 0x1000000); 133 if (!buf2) { 134 ; 135 } else { 136 free(buf2); 137 } 138} // expected-warning {{Memory is never released; potential leak}} 139 140void reallocRadar6337483_3() { 141 char * buf = malloc(100); 142 char * tmp; 143 tmp = (char*)realloc(buf, 0x1000000); 144 if (!tmp) { 145 free(buf); 146 return; 147 } 148 buf = tmp; 149 free(buf); 150} 151 152void reallocRadar6337483_4() { 153 char *buf = malloc(100); 154 char *buf2 = (char*)realloc(buf, 0x1000000); 155 if (!buf2) { 156 return; // expected-warning {{Memory is never released; potential leak}} 157 } else { 158 free(buf2); 159 } 160} 161 162int *reallocfTest1() { 163 int *q = malloc(12); 164 q = reallocf(q, 20); 165 return q; // no warning - returning the allocated value 166} 167 168void reallocfRadar6337483_4() { 169 char *buf = malloc(100); 170 char *buf2 = (char*)reallocf(buf, 0x1000000); 171 if (!buf2) { 172 return; // no warning - reallocf frees even on failure 173 } else { 174 free(buf2); 175 } 176} 177 178void reallocfRadar6337483_3() { 179 char * buf = malloc(100); 180 char * tmp; 181 tmp = (char*)reallocf(buf, 0x1000000); 182 if (!tmp) { 183 free(buf); // expected-warning {{Attempt to free released memory}} 184 return; 185 } 186 buf = tmp; 187 free(buf); 188} 189 190void reallocfPtrZero1() { 191 char *r = reallocf(0, 12); 192} // expected-warning {{Memory is never released; potential leak}} 193 194 195// This case tests that storing malloc'ed memory to a static variable which is 196// then returned is not leaked. In the absence of known contracts for functions 197// or inter-procedural analysis, this is a conservative answer. 198int *f3() { 199 static int *p = 0; 200 p = malloc(12); 201 return p; // no-warning 202} 203 204// This case tests that storing malloc'ed memory to a static global variable 205// which is then returned is not leaked. In the absence of known contracts for 206// functions or inter-procedural analysis, this is a conservative answer. 207static int *p_f4 = 0; 208int *f4() { 209 p_f4 = malloc(12); 210 return p_f4; // no-warning 211} 212 213int *f5() { 214 int *q = malloc(12); 215 q = realloc(q, 20); 216 return q; // no-warning 217} 218 219void f6() { 220 int *p = malloc(12); 221 if (!p) 222 return; // no-warning 223 else 224 free(p); 225} 226 227void f6_realloc() { 228 int *p = malloc(12); 229 if (!p) 230 return; // no-warning 231 else 232 realloc(p,0); 233} 234 235 236char *doit2(); 237void pr6069() { 238 char *buf = doit2(); 239 free(buf); 240} 241 242void pr6293() { 243 free(0); 244} 245 246void f7() { 247 char *x = (char*) malloc(4); 248 free(x); 249 x[0] = 'a'; // expected-warning{{Use of memory after it is freed}} 250} 251 252void f8() { 253 char *x = (char*) malloc(4); 254 free(x); 255 char *y = strndup(x, 4); // expected-warning{{Use of memory after it is freed}} 256} 257 258void f7_realloc() { 259 char *x = (char*) malloc(4); 260 realloc(x,0); 261 x[0] = 'a'; // expected-warning{{Use of memory after it is freed}} 262} 263 264void PR6123() { 265 int *x = malloc(11); // expected-warning{{Cast a region whose size is not a multiple of the destination type size}} 266} 267 268void PR7217() { 269 int *buf = malloc(2); // expected-warning{{Cast a region whose size is not a multiple of the destination type size}} 270 buf[1] = 'c'; // not crash 271} 272 273void mallocCastToVoid() { 274 void *p = malloc(2); 275 const void *cp = p; // not crash 276 free(p); 277} 278 279void mallocCastToFP() { 280 void *p = malloc(2); 281 void (*fp)() = p; // not crash 282 free(p); 283} 284 285// This tests that malloc() buffers are undefined by default 286char mallocGarbage () { 287 char *buf = malloc(2); 288 char result = buf[1]; // expected-warning{{undefined}} 289 free(buf); 290 return result; 291} 292 293// This tests that calloc() buffers need to be freed 294void callocNoFree () { 295 char *buf = calloc(2,2); 296 return; // expected-warning{{never released}} 297} 298 299// These test that calloc() buffers are zeroed by default 300char callocZeroesGood () { 301 char *buf = calloc(2,2); 302 char result = buf[3]; // no-warning 303 if (buf[1] == 0) { 304 free(buf); 305 } 306 return result; // no-warning 307} 308 309char callocZeroesBad () { 310 char *buf = calloc(2,2); 311 char result = buf[3]; // no-warning 312 if (buf[1] != 0) { 313 free(buf); // expected-warning{{never executed}} 314 } 315 return result; // expected-warning{{never released}} 316} 317 318void nullFree() { 319 int *p = 0; 320 free(p); // no warning - a nop 321} 322 323void paramFree(int *p) { 324 myfoo(p); 325 free(p); // no warning 326 myfoo(p); // expected-warning {{Use of memory after it is freed}} 327} 328 329int* mallocEscapeRet() { 330 int *p = malloc(12); 331 return p; // no warning 332} 333 334void mallocEscapeFoo() { 335 int *p = malloc(12); 336 myfoo(p); 337 return; // no warning 338} 339 340void mallocEscapeFree() { 341 int *p = malloc(12); 342 myfoo(p); 343 free(p); 344} 345 346void mallocEscapeFreeFree() { 347 int *p = malloc(12); 348 myfoo(p); 349 free(p); 350 free(p); // expected-warning{{Attempt to free released memory}} 351} 352 353void mallocEscapeFreeUse() { 354 int *p = malloc(12); 355 myfoo(p); 356 free(p); 357 myfoo(p); // expected-warning{{Use of memory after it is freed}} 358} 359 360int *myalloc(); 361void myalloc2(int **p); 362 363void mallocEscapeFreeCustomAlloc() { 364 int *p = malloc(12); 365 myfoo(p); 366 free(p); 367 p = myalloc(); 368 free(p); // no warning 369} 370 371void mallocEscapeFreeCustomAlloc2() { 372 int *p = malloc(12); 373 myfoo(p); 374 free(p); 375 myalloc2(&p); 376 free(p); // no warning 377} 378 379void mallocBindFreeUse() { 380 int *x = malloc(12); 381 int *y = x; 382 free(y); 383 myfoo(x); // expected-warning{{Use of memory after it is freed}} 384} 385 386void mallocEscapeMalloc() { 387 int *p = malloc(12); 388 myfoo(p); 389 p = malloc(12); 390} // expected-warning{{Memory is never released; potential leak}} 391 392void mallocMalloc() { 393 int *p = malloc(12); 394 p = malloc(12); 395} // expected-warning {{Memory is never released; potential leak}} 396 397void mallocFreeMalloc() { 398 int *p = malloc(12); 399 free(p); 400 p = malloc(12); 401 free(p); 402} 403 404void mallocFreeUse_params() { 405 int *p = malloc(12); 406 free(p); 407 myfoo(p); //expected-warning{{Use of memory after it is freed}} 408} 409 410void mallocFreeUse_params2() { 411 int *p = malloc(12); 412 free(p); 413 myfooint(*p); //expected-warning{{Use of memory after it is freed}} 414} 415 416void mallocFailedOrNot() { 417 int *p = malloc(12); 418 if (!p) 419 free(p); 420 else 421 free(p); 422} 423 424struct StructWithInt { 425 int g; 426}; 427 428int *mallocReturnFreed() { 429 int *p = malloc(12); 430 free(p); 431 return p; // expected-warning {{Use of memory after it is freed}} 432} 433 434int useAfterFreeStruct() { 435 struct StructWithInt *px= malloc(sizeof(struct StructWithInt)); 436 px->g = 5; 437 free(px); 438 return px->g; // expected-warning {{Use of memory after it is freed}} 439} 440 441void nonSymbolAsFirstArg(int *pp, struct StructWithInt *p); 442 443void mallocEscapeFooNonSymbolArg() { 444 struct StructWithInt *p = malloc(sizeof(struct StructWithInt)); 445 nonSymbolAsFirstArg(&p->g, p); 446 return; // no warning 447} 448 449void mallocFailedOrNotLeak() { 450 int *p = malloc(12); 451 if (p == 0) 452 return; // no warning 453 else 454 return; // expected-warning {{Memory is never released; potential leak}} 455} 456 457void mallocAssignment() { 458 char *p = malloc(12); 459 p = fooRetPtr(); 460} // expected-warning {{leak}} 461 462int vallocTest() { 463 char *mem = valloc(12); 464 return 0; // expected-warning {{Memory is never released; potential leak}} 465} 466 467void vallocEscapeFreeUse() { 468 int *p = valloc(12); 469 myfoo(p); 470 free(p); 471 myfoo(p); // expected-warning{{Use of memory after it is freed}} 472} 473 474int *Gl; 475struct GlStTy { 476 int *x; 477}; 478 479struct GlStTy GlS = {0}; 480 481void GlobalFree() { 482 free(Gl); 483} 484 485void GlobalMalloc() { 486 Gl = malloc(12); 487} 488 489void GlobalStructMalloc() { 490 int *a = malloc(12); 491 GlS.x = a; 492} 493 494void GlobalStructMallocFree() { 495 int *a = malloc(12); 496 GlS.x = a; 497 free(GlS.x); 498} 499 500char *ArrayG[12]; 501 502void globalArrayTest() { 503 char *p = (char*)malloc(12); 504 ArrayG[0] = p; 505} 506 507// Make sure that we properly handle a pointer stored into a local struct/array. 508typedef struct _StructWithPtr { 509 int *memP; 510} StructWithPtr; 511 512static StructWithPtr arrOfStructs[10]; 513 514void testMalloc() { 515 int *x = malloc(12); 516 StructWithPtr St; 517 St.memP = x; 518 arrOfStructs[0] = St; // no-warning 519} 520 521StructWithPtr testMalloc2() { 522 int *x = malloc(12); 523 StructWithPtr St; 524 St.memP = x; 525 return St; // no-warning 526} 527 528int *testMalloc3() { 529 int *x = malloc(12); 530 int *y = x; 531 return y; // no-warning 532} 533 534void testStructLeak() { 535 StructWithPtr St; 536 St.memP = malloc(12); 537 return; // expected-warning {{Memory is never released; potential leak of memory pointed to by 'St.memP'}} 538} 539 540void testElemRegion1() { 541 char *x = (void*)malloc(2); 542 int *ix = (int*)x; 543 free(&(x[0])); 544} 545 546void testElemRegion2(int **pp) { 547 int *p = malloc(12); 548 *pp = p; 549 free(pp[0]); 550} 551 552void testElemRegion3(int **pp) { 553 int *p = malloc(12); 554 *pp = p; 555 free(*pp); 556} 557// Region escape testing. 558 559unsigned takePtrToPtr(int **p); 560void PassTheAddrOfAllocatedData(int f) { 561 int *p = malloc(12); 562 // We don't know what happens after the call. Should stop tracking here. 563 if (takePtrToPtr(&p)) 564 f++; 565 free(p); // no warning 566} 567 568struct X { 569 int *p; 570}; 571unsigned takePtrToStruct(struct X *s); 572int ** foo2(int *g, int f) { 573 int *p = malloc(12); 574 struct X *px= malloc(sizeof(struct X)); 575 px->p = p; 576 // We don't know what happens after this call. Should not track px nor p. 577 if (takePtrToStruct(px)) 578 f++; 579 free(p); 580 return 0; 581} 582 583struct X* RegInvalidationDetect1(struct X *s2) { 584 struct X *px= malloc(sizeof(struct X)); 585 px->p = 0; 586 px = s2; 587 return px; // expected-warning {{Memory is never released; potential leak}} 588} 589 590struct X* RegInvalidationGiveUp1() { 591 int *p = malloc(12); 592 struct X *px= malloc(sizeof(struct X)); 593 px->p = p; 594 return px; 595} 596 597int **RegInvalidationDetect2(int **pp) { 598 int *p = malloc(12); 599 pp = &p; 600 pp++; 601 return 0;// expected-warning {{Memory is never released; potential leak}} 602} 603 604extern void exit(int) __attribute__ ((__noreturn__)); 605void mallocExit(int *g) { 606 struct xx *p = malloc(12); 607 if (g != 0) 608 exit(1); 609 free(p); 610 return; 611} 612 613extern void __assert_fail (__const char *__assertion, __const char *__file, 614 unsigned int __line, __const char *__function) 615 __attribute__ ((__noreturn__)); 616#define assert(expr) \ 617 ((expr) ? (void)(0) : __assert_fail (#expr, __FILE__, __LINE__, __func__)) 618void mallocAssert(int *g) { 619 struct xx *p = malloc(12); 620 621 assert(g != 0); 622 free(p); 623 return; 624} 625 626void doNotInvalidateWhenPassedToSystemCalls(char *s) { 627 char *p = malloc(12); 628 strlen(p); 629 strcpy(p, s); 630} // expected-warning {{leak}} 631 632// Rely on the CString checker evaluation of the strcpy API to convey that the result of strcpy is equal to p. 633void symbolLostWithStrcpy(char *s) { 634 char *p = malloc(12); 635 p = strcpy(p, s); 636 free(p); 637} 638 639 640// The same test as the one above, but with what is actually generated on a mac. 641static __inline char * 642__inline_strcpy_chk (char *restrict __dest, const char *restrict __src) 643{ 644 return __builtin___strcpy_chk (__dest, __src, __builtin_object_size (__dest, 2 > 1)); 645} 646 647void symbolLostWithStrcpy_InlineStrcpyVersion(char *s) { 648 char *p = malloc(12); 649 p = ((__builtin_object_size (p, 0) != (size_t) -1) ? __builtin___strcpy_chk (p, s, __builtin_object_size (p, 2 > 1)) : __inline_strcpy_chk (p, s)); 650 free(p); 651} 652 653// Here we are returning a pointer one past the allocated value. An idiom which 654// can be used for implementing special malloc. The correct uses of this might 655// be rare enough so that we could keep this as a warning. 656static void *specialMalloc(int n){ 657 int *p; 658 p = malloc( n+8 ); 659 if( p ){ 660 p[0] = n; 661 p++; 662 } 663 return p; 664} 665 666// Potentially, the user could free the struct by performing pointer arithmetic on the return value. 667// This is a variation of the specialMalloc issue, though probably would be more rare in correct code. 668int *specialMallocWithStruct() { 669 struct StructWithInt *px= malloc(sizeof(struct StructWithInt)); 670 return &(px->g); 671} 672 673// Test various allocation/deallocation functions. 674void testStrdup(const char *s, unsigned validIndex) { 675 char *s2 = strdup(s); 676 s2[validIndex + 1] = 'b'; 677} // expected-warning {{Memory is never released; potential leak}} 678 679int testStrndup(const char *s, unsigned validIndex, unsigned size) { 680 char *s2 = strndup(s, size); 681 s2 [validIndex + 1] = 'b'; 682 if (s2[validIndex] != 'a') 683 return 0; 684 else 685 return 1;// expected-warning {{Memory is never released; potential leak}} 686} 687 688void testStrdupContentIsDefined(const char *s, unsigned validIndex) { 689 char *s2 = strdup(s); 690 char result = s2[1];// no warning 691 free(s2); 692} 693 694// ---------------------------------------------------------------------------- 695// Test the system library functions to which the pointer can escape. 696// This tests false positive suppression. 697 698// For now, we assume memory passed to pthread_specific escapes. 699// TODO: We could check that if a new pthread binding is set, the existing 700// binding must be freed; otherwise, a memory leak can occur. 701void testPthereadSpecificEscape(pthread_key_t key) { 702 void *buf = malloc(12); 703 pthread_setspecific(key, buf); // no warning 704} 705 706// PR12101: Test funopen(). 707static int releasePtr(void *_ctx) { 708 free(_ctx); 709 return 0; 710} 711FILE *useFunOpen() { 712 void *ctx = malloc(sizeof(int)); 713 FILE *f = funopen(ctx, 0, 0, 0, releasePtr); // no warning 714 if (f == 0) { 715 free(ctx); 716 } 717 return f; 718} 719FILE *useFunOpenNoReleaseFunction() { 720 void *ctx = malloc(sizeof(int)); 721 FILE *f = funopen(ctx, 0, 0, 0, 0); 722 if (f == 0) { 723 free(ctx); 724 } 725 return f; // expected-warning{{leak}} 726} 727 728static int readNothing(void *_ctx, char *buf, int size) { 729 return 0; 730} 731FILE *useFunOpenReadNoRelease() { 732 void *ctx = malloc(sizeof(int)); 733 FILE *f = funopen(ctx, readNothing, 0, 0, 0); 734 if (f == 0) { 735 free(ctx); 736 } 737 return f; // expected-warning{{leak}} 738} 739 740// Test setbuf, setvbuf. 741int my_main_no_warning() { 742 char *p = malloc(100); 743 setvbuf(stdout, p, 0, 100); 744 return 0; 745} 746int my_main_no_warning2() { 747 char *p = malloc(100); 748 setbuf(__stdoutp, p); 749 return 0; 750} 751int my_main_warn(FILE *f) { 752 char *p = malloc(100); 753 setvbuf(f, p, 0, 100); 754 return 0;// expected-warning {{leak}} 755} 756 757// <rdar://problem/10978247>. 758// some people use stack allocated memory as an optimization to avoid 759// a heap allocation for small work sizes. This tests the analyzer's 760// understanding that the malloc'ed memory is not the same as stackBuffer. 761void radar10978247(int myValueSize) { 762 char stackBuffer[128]; 763 char *buffer; 764 765 if (myValueSize <= sizeof(stackBuffer)) 766 buffer = stackBuffer; 767 else 768 buffer = malloc(myValueSize); 769 770 // do stuff with the buffer 771 if (buffer != stackBuffer) 772 free(buffer); 773} 774 775void radar10978247_positive(int myValueSize) { 776 char stackBuffer[128]; 777 char *buffer; 778 779 if (myValueSize <= sizeof(stackBuffer)) 780 buffer = stackBuffer; 781 else 782 buffer = malloc(myValueSize); 783 784 // do stuff with the buffer 785 if (buffer == stackBuffer) 786 return; 787 else 788 return; // expected-warning {{leak}} 789} 790// <rdar://problem/11269741> Previously this triggered a false positive 791// because malloc() is known to return uninitialized memory and the binding 792// of 'o' to 'p->n' was not getting propertly handled. Now we report a leak. 793struct rdar11269741_a_t { 794 struct rdar11269741_b_t { 795 int m; 796 } n; 797}; 798 799int rdar11269741(struct rdar11269741_b_t o) 800{ 801 struct rdar11269741_a_t *p = (struct rdar11269741_a_t *) malloc(sizeof(*p)); 802 p->n = o; 803 return p->n.m; // expected-warning {{leak}} 804} 805 806// Pointer arithmetic, returning an ElementRegion. 807void *radar11329382(unsigned bl) { 808 void *ptr = malloc (16); 809 ptr = ptr + (2 - bl); 810 return ptr; // no warning 811} 812 813void __assert_rtn(const char *, const char *, int, const char *) __attribute__((__noreturn__)); 814int strcmp(const char *, const char *); 815char *a (void); 816void radar11270219(void) { 817 char *x = a(), *y = a(); 818 (__builtin_expect(!(x && y), 0) ? __assert_rtn(__func__, "/Users/zaks/tmp/ex.c", 24, "x && y") : (void)0); 819 strcmp(x, y); // no warning 820} 821 822void radar_11358224_test_double_assign_ints_positive_2() 823{ 824 void *ptr = malloc(16); 825 ptr = ptr; 826} // expected-warning {{leak}} 827 828// Assume that functions which take a function pointer can free memory even if 829// they are defined in system headers and take the const pointer to the 830// allocated memory. (radar://11160612) 831int const_ptr_and_callback(int, const char*, int n, void(*)(void*)); 832void r11160612_1() { 833 char *x = malloc(12); 834 const_ptr_and_callback(0, x, 12, free); // no - warning 835} 836 837// Null is passed as callback. 838void r11160612_2() { 839 char *x = malloc(12); 840 const_ptr_and_callback(0, x, 12, 0); 841} // expected-warning {{leak}} 842 843// Callback is passed to a function defined in a system header. 844void r11160612_4() { 845 char *x = malloc(12); 846 sqlite3_bind_text_my(0, x, 12, free); // no - warning 847} 848 849// Passing callbacks in a struct. 850void r11160612_5(StWithCallback St) { 851 void *x = malloc(12); 852 dealocateMemWhenDoneByVal(x, St); 853} 854void r11160612_6(StWithCallback St) { 855 void *x = malloc(12); 856 dealocateMemWhenDoneByRef(&St, x); 857} 858 859int mySub(int, int); 860int myAdd(int, int); 861int fPtr(unsigned cond, int x) { 862 return (cond ? mySub : myAdd)(x, x); 863} 864 865// Test anti-aliasing. 866 867void dependsOnValueOfPtr(int *g, unsigned f) { 868 int *p; 869 870 if (f) { 871 p = g; 872 } else { 873 p = malloc(12); 874 } 875 876 if (p != g) 877 free(p); 878 else 879 return; // no warning 880 return; 881} 882 883int CMPRegionHeapToStack() { 884 int x = 0; 885 int *x1 = malloc(8); 886 int *x2 = &x; 887 clang_analyzer_eval(x1 == x2); // expected-warning{{FALSE}} 888 free(x1); 889 return x; 890} 891 892int CMPRegionHeapToHeap2() { 893 int x = 0; 894 int *x1 = malloc(8); 895 int *x2 = malloc(8); 896 int *x4 = x1; 897 int *x5 = x2; 898 clang_analyzer_eval(x4 == x5); // expected-warning{{FALSE}} 899 free(x1); 900 free(x2); 901 return x; 902} 903 904int CMPRegionHeapToHeap() { 905 int x = 0; 906 int *x1 = malloc(8); 907 int *x4 = x1; 908 if (x1 == x4) { 909 free(x1); 910 return 5/x; // expected-warning{{Division by zero}} 911 } 912 return x;// expected-warning{{This statement is never executed}} 913} 914 915int HeapAssignment() { 916 int m = 0; 917 int *x = malloc(4); 918 int *y = x; 919 *x = 5; 920 clang_analyzer_eval(*x != *y); // expected-warning{{FALSE}} 921 free(x); 922 return 0; 923} 924 925int *retPtr(); 926int *retPtrMightAlias(int *x); 927int cmpHeapAllocationToUnknown() { 928 int zero = 0; 929 int *yBefore = retPtr(); 930 int *m = malloc(8); 931 int *yAfter = retPtrMightAlias(m); 932 clang_analyzer_eval(yBefore == m); // expected-warning{{FALSE}} 933 clang_analyzer_eval(yAfter == m); // expected-warning{{FALSE}} 934 free(m); 935 return 0; 936} 937 938void localArrayTest() { 939 char *p = (char*)malloc(12); 940 char *ArrayL[12]; 941 ArrayL[0] = p; 942} // expected-warning {{leak}} 943 944void localStructTest() { 945 StructWithPtr St; 946 StructWithPtr *pSt = &St; 947 pSt->memP = malloc(12); 948} // expected-warning{{Memory is never released; potential leak}} 949 950// Test double assignment through integers. 951static long glob; 952void test_double_assign_ints() 953{ 954 void *ptr = malloc (16); // no-warning 955 glob = (long)(unsigned long)ptr; 956} 957 958void test_double_assign_ints_positive() 959{ 960 void *ptr = malloc(16); 961 (void*)(long)(unsigned long)ptr; // expected-warning {{unused}} 962} // expected-warning {{leak}} 963 964 965void testCGContextNoLeak() 966{ 967 void *ptr = malloc(16); 968 CGContextRef context = CGBitmapContextCreate(ptr); 969 970 // Because you can get the data back out like this, even much later, 971 // CGBitmapContextCreate is one of our "stop-tracking" exceptions. 972 free(CGBitmapContextGetData(context)); 973} 974 975void testCGContextLeak() 976{ 977 void *ptr = malloc(16); 978 CGContextRef context = CGBitmapContextCreate(ptr); 979 // However, this time we're just leaking the data, because the context 980 // object doesn't escape and it hasn't been freed in this function. 981} 982 983// Allow xpc context to escape. radar://11635258 984// TODO: Would be great if we checked that the finalize_connection_context actually releases it. 985static void finalize_connection_context(void *ctx) { 986 int *context = ctx; 987 free(context); 988} 989void foo (xpc_connection_t peer) { 990 int *ctx = calloc(1, sizeof(int)); 991 xpc_connection_set_context(peer, ctx); 992 xpc_connection_set_finalizer_f(peer, finalize_connection_context); 993 xpc_connection_resume(peer); 994} 995 996// Make sure we catch errors when we free in a function which does not allocate memory. 997void freeButNoMalloc(int *p, int x){ 998 if (x) { 999 free(p); 1000 //user forgot a return here. 1001 } 1002 free(p); // expected-warning {{Attempt to free released memory}} 1003} 1004 1005struct HasPtr { 1006 char *p; 1007}; 1008 1009char* reallocButNoMalloc(struct HasPtr *a, int c, int size) { 1010 int *s; 1011 char *b = realloc(a->p, size); 1012 char *m = realloc(a->p, size); // expected-warning {{Attempt to free released memory}} 1013 return a->p; 1014} 1015 1016// We should not warn in this case since the caller will presumably free a->p in all cases. 1017int reallocButNoMallocPR13674(struct HasPtr *a, int c, int size) { 1018 int *s; 1019 char *b = realloc(a->p, size); 1020 if (b == 0) 1021 return -1; 1022 a->p = b; 1023 return 0; 1024} 1025 1026// Test realloc with no visible malloc. 1027void *test(void *ptr) { 1028 void *newPtr = realloc(ptr, 4); 1029 if (newPtr == 0) { 1030 if (ptr) 1031 free(ptr); // no-warning 1032 } 1033 return newPtr; 1034} 1035 1036 1037char *testLeakWithinReturn(char *str) { 1038 return strdup(strdup(str)); // expected-warning{{leak}} 1039} 1040 1041// ---------------------------------------------------------------------------- 1042// False negatives. 1043 1044// TODO: This is another false negative. 1045void testMallocWithParam(int **p) { 1046 *p = (int*) malloc(sizeof(int)); 1047 *p = 0; 1048} 1049 1050void testMallocWithParam_2(int **p) { 1051 *p = (int*) malloc(sizeof(int)); 1052} 1053