1// RUN: %clang_cc1 -analyze -analyzer-store=region -analyzer-checker=core,unix.Malloc -fblocks -verify %s 2// RUN: %clang_cc1 -analyze -analyzer-store=region -analyzer-checker=core,unix.Malloc -fblocks -verify -analyzer-config unix.Malloc:Optimistic=true %s 3typedef __typeof(sizeof(int)) size_t; 4void free(void *); 5void *alloca(size_t); 6 7void t1 () { 8 int a[] = { 1 }; 9 free(a); // expected-warning {{Argument to free() is the address of the local variable 'a', which is not memory allocated by malloc()}} 10} 11 12void t2 () { 13 int a = 1; 14 free(&a); // expected-warning {{Argument to free() is the address of the local variable 'a', which is not memory allocated by malloc()}} 15} 16 17void t3 () { 18 static int a[] = { 1 }; 19 free(a); // expected-warning {{Argument to free() is the address of the static variable 'a', which is not memory allocated by malloc()}} 20} 21 22void t4 (char *x) { 23 free(x); // no-warning 24} 25 26void t5 () { 27 extern char *ptr(); 28 free(ptr()); // no-warning 29} 30 31void t6 () { 32 free((void*)1000); // expected-warning {{Argument to free() is a constant address (1000), which is not memory allocated by malloc()}} 33} 34 35void t7 (char **x) { 36 free(*x); // no-warning 37} 38 39void t8 (char **x) { 40 // ugh 41 free((*x)+8); // no-warning 42} 43 44void t9 () { 45label: 46 free(&&label); // expected-warning {{Argument to free() is the address of the label 'label', which is not memory allocated by malloc()}} 47} 48 49void t10 () { 50 free((void*)&t10); // expected-warning {{Argument to free() is the address of the function 't10', which is not memory allocated by malloc()}} 51} 52 53void t11 () { 54 char *p = (char*)alloca(2); 55 free(p); // expected-warning {{Memory allocated by alloca() should not be deallocated}} 56} 57 58void t12 () { 59 char *p = (char*)__builtin_alloca(2); 60 free(p); // expected-warning {{Memory allocated by alloca() should not be deallocated}} 61} 62 63void t13 () { 64 free(^{return;}); // expected-warning {{Argument to free() is a block, which is not memory allocated by malloc()}} 65} 66 67void t14 (char a) { 68 free(&a); // expected-warning {{Argument to free() is the address of the parameter 'a', which is not memory allocated by malloc()}} 69} 70 71static int someGlobal[2]; 72void t15 () { 73 free(someGlobal); // expected-warning {{Argument to free() is the address of the global variable 'someGlobal', which is not memory allocated by malloc()}} 74} 75 76void t16 (char **x, int offset) { 77 // Unknown value 78 free(x[offset]); // no-warning 79} 80