case EQ_EXPR:
case NE_EXPR:
+ case GE_EXPR:
+ case GT_EXPR:
+ case LE_EXPR:
+ case LT_EXPR:
{
/* ...and "(inner_lhs OP inner_rhs) == 0"
then (inner_lhs OP inner_rhs) must have the same
void test_1 (void)
{
- int16_t *ptr = malloc (21 * sizeof (int16_t));
+ int16_t *ptr = (int16_t *) malloc (21 * sizeof (int16_t));
free (ptr);
}
void test_2 (void)
{
- int32_t *ptr = malloc (21 * sizeof (int16_t)); /* { dg-line malloc2 } */
+ int32_t *ptr = (int32_t *) malloc (21 * sizeof (int16_t)); /* { dg-line malloc2 } */
free (ptr);
/* { dg-warning "allocated buffer size is not a multiple of the pointee's size \\\[CWE-131\\\]" "warning" { target *-*-* } malloc2 } */
/* { dg-message "42 bytes" "note" { target *-*-* } malloc2 } */
- /* { dg-message "'int32_t \\*' (\\\{aka '(long )?int \\*'\\\})? here; 'sizeof \\(int32_t (\\\{aka (long )?int\\\})?\\)' is '4'" "note" { target *-*-* } malloc2 } */
+ /* { dg-message "'int32_t \\*' (\\\{aka '(long )?int \\*'\\\})? here; 'sizeof \\(int32_t (\\\{aka (long )?int\\\})?\\)' is '4'" "note" { target c } malloc2 } */
+ /* { dg-message "'int32_t\\*' (\\\{aka '(long )?int\\*'\\\})? here; 'sizeof \\(int32_t (\\\{aka (long )?int\\\})?\\)' is '4'" "note" { target c++ } malloc2 } */
}
void test_3 (void)
free (iptr);
/* { dg-warning "allocated buffer size is not a multiple of the pointee's size \\\[CWE-131\\\]" "warning" { target *-*-* } assign4 } */
- /* { dg-message "'int32_t \\*' (\\\{aka '(long )?int \\*'\\\})? here; 'sizeof \\(int32_t (\\\{aka (long )?int\\\})?\\)' is '4'" "note" { target *-*-* } assign4 } */
+ /* { dg-message "'int32_t \\*' (\\\{aka '(long )?int \\*'\\\})? here; 'sizeof \\(int32_t (\\\{aka (long )?int\\\})?\\)' is '4'" "note" { target c } assign4 } */
+ /* { dg-message "'int32_t\\*' (\\\{aka '(long )?int\\*'\\\})? here; 'sizeof \\(int32_t (\\\{aka (long )?int\\\})?\\)' is '4'" "note" { target c++ } assign4 } */
}
void test_5 (void)
free (iptr);
/* { dg-warning "allocated buffer size is not a multiple of the pointee's size \\\[CWE-131\\\]" "warning" { target *-*-* } assign6 } */
- /* { dg-message "'int32_t \\*' (\\\{aka '(long )?int \\*'\\\})? here; 'sizeof \\(int32_t (\\\{aka (long )?int\\\})?\\)' is '4'" "note" { target *-*-* } assign6 } */
+ /* { dg-message "'int32_t \\*' (\\\{aka '(long )?int \\*'\\\})? here; 'sizeof \\(int32_t (\\\{aka (long )?int\\\})?\\)' is '4'" "note" { target c } assign6 } */
+ /* { dg-message "'int32_t\\*' (\\\{aka '(long )?int\\*'\\\})? here; 'sizeof \\(int32_t (\\\{aka (long )?int\\\})?\\)' is '4'" "note" { target c++ } assign6 } */
}
void test_7 (void)
void test_8 (void)
{
- int32_t *buf = create_buffer(4 * sizeof (int));
+ int32_t *buf = (int32_t *) create_buffer(4 * sizeof (int));
free (buf);
}
impl_region_model_context::warn. To ensure that the indentation
in the diagnostic is right, the warning has to be emitted on an EN
that is after the return edge. */
- int32_t *buf = create_buffer(42); /* { dg-warning "" "" { xfail *-*-* } } */
+ int32_t *buf = (int32_t *) create_buffer(42); /* { dg-warning "" "" { xfail *-*-* } } */
free (buf);
}
void test_10 (int32_t n)
{
- char *ptr = malloc (7 * n);
+ char *ptr = (char *) malloc (7 * n);
free (ptr);
}
void test_11 ()
{
/* 3.0 is folded to an int before the analyzer runs. */
- int32_t *ptr = malloc (3.0); /* { dg-line malloc11 } */
+ int32_t *ptr = (int32_t *) malloc (3.0); /* { dg-line malloc11 } */
free (ptr);
/* { dg-warning "allocated buffer size is not a multiple of the pointee's size \\\[CWE-131\\\]" "warning" { target *-*-* } malloc11 } */
- /* { dg-message "'int32_t \\*' (\\\{aka '(long )?int \\*'\\\})? here; 'sizeof \\(int32_t (\\\{aka (long )?int\\\})?\\)' is '4'" "note" { target *-*-* } malloc11 } */
+ /* { dg-message "'int32_t \\*' (\\\{aka '(long )?int \\*'\\\})? here; 'sizeof \\(int32_t (\\\{aka (long )?int\\\})?\\)' is '4'" "note" { target c } malloc11 } */
+ /* { dg-message "'int32_t\\*' (\\\{aka '(long )?int\\*'\\\})? here; 'sizeof \\(int32_t (\\\{aka (long )?int\\\})?\\)' is '4'" "note" { target c++ } malloc11 } */
}
void test_1 (int32_t n)
{
- int16_t *ptr = malloc (n * sizeof (int16_t));
+ int16_t *ptr = (int16_t *)malloc (n * sizeof (int16_t));
free (ptr);
}
void test_2 (int32_t n)
{
- int32_t *ptr = malloc (n * sizeof (int16_t)); /* { dg-line malloc2 } */
+ int32_t *ptr = (int32_t *)malloc (n * sizeof (int16_t)); /* { dg-line malloc2 } */
free (ptr);
/* { dg-warning "allocated buffer size is not a multiple of the pointee's size \\\[CWE-131\\\]" "warning" { target *-*-* } malloc2 } */
/* { dg-message "'\[a-z0-9\\*\\(\\)\\s\]*' bytes" "note" { target *-*-* } malloc2 } */
- /* { dg-message "'int32_t \\*' (\\\{aka '(long )?int \\*'\\\})? here; 'sizeof \\(int32_t (\\\{aka (long )?int\\\})?\\)' is '4" "note" { target *-*-* } malloc2 } */
+ /* { dg-message "'int32_t \\*' (\\\{aka '(long )?int \\*'\\\})? here; 'sizeof \\(int32_t (\\\{aka (long )?int\\\})?\\)' is '4" "note" { target c } malloc2 } */
+ /* { dg-message "'int32_t\\*' (\\\{aka '(long )?int\\*'\\\})? here; 'sizeof \\(int32_t (\\\{aka (long )?int\\\})?\\)' is '4" "note" { target c++ } malloc2 } */
}
void test_3 (int32_t n)
free (iptr);
/* { dg-warning "allocated buffer size is not a multiple of the pointee's size \\\[CWE-131\\\]" "warning" { target *-*-* } assign4 } */
- /* { dg-message "'int32_t \\*' (\\\{aka '(long )?int \\*'\\\})? here; 'sizeof \\(int32_t (\\\{aka (long )?int\\\})?\\)' is '4'" "note" { target *-*-* } assign4 } */
+ /* { dg-message "'int32_t \\*' (\\\{aka '(long )?int \\*'\\\})? here; 'sizeof \\(int32_t (\\\{aka (long )?int\\\})?\\)' is '4'" "note" { target c } assign4 } */
+ /* { dg-message "'int32_t\\*' (\\\{aka '(long )?int\\*'\\\})? here; 'sizeof \\(int32_t (\\\{aka (long )?int\\\})?\\)' is '4'" "note" { target c++ } assign4 } */
}
void test_5 (void)
void test_7(int32_t n)
{
- int32_t *buf = create_buffer(n * sizeof (int32_t));
+ int32_t *buf = (int32_t *)create_buffer(n * sizeof (int32_t));
free (buf);
}
impl_region_model_context::warn. To ensure that the indentation
in the diagnostic is right, the warning has to be emitted on an EN
that is after the return edge. */
- int32_t *buf = create_buffer(n * sizeof(int16_t)); /* { dg-warning "" "" { xfail *-*-* } } */
+ int32_t *buf = (int32_t *)create_buffer(n * sizeof(int16_t)); /* { dg-warning "" "" { xfail *-*-* } } */
free (buf);
}
else
free (ptr);
/* { dg-warning "allocated buffer size is not a multiple of the pointee's size \\\[CWE-131\\\]" "warning" { target *-*-* } assign12 } */
- /* { dg-message "'int32_t \\*' (\\\{aka '(long )?int \\*'\\\})? here; 'sizeof \\(int32_t (\\\{aka (long )?int\\\})?\\)' is '4'" "note" { target *-*-* } assign12 } */
+ /* { dg-message "'int32_t \\*' (\\\{aka '(long )?int \\*'\\\})? here; 'sizeof \\(int32_t (\\\{aka (long )?int\\\})?\\)' is '4'" "note" { target c } assign12 } */
+ /* { dg-message "'int32_t\\*' (\\\{aka '(long )?int\\*'\\\})? here; 'sizeof \\(int32_t (\\\{aka (long )?int\\\})?\\)' is '4'" "note" { target c++ } assign12 } */
}
void test_13 (void)
/* n is an initial_svalue and guarded such that there is no equiv_class
for n itself but only for a binop_svalue containing n. */
if (n % sizeof (int) == 0)
- ptr = malloc (n);
+ ptr = (int *)malloc (n);
return ptr;
}
/* { dg-warning "allocated buffer size is not a multiple of the pointee's size \\\[CWE-131\\\]" "warning" { target *-*-* } malloc1 } */
/* { dg-message "3 bytes" "note" { target *-*-* } malloc1 } */
- /* { dg-message "'int32_t \\*' (\\\{aka '(long )?int \\*'\\\})? here; 'sizeof \\(int32_t (\\\{aka (long )?int\\\})?\\)' is '4'" "note" { target *-*-* } malloc1 } */
+ /* { dg-message "'int32_t \\*' (\\\{aka '(long )?int \\*'\\\})? here; 'sizeof \\(int32_t (\\\{aka (long )?int\\\})?\\)' is '4'" "note" { target c } malloc1 } */
+ /* { dg-message "'int32_t\\*' (\\\{aka '(long )?int\\*'\\\})? here; 'sizeof \\(int32_t (\\\{aka (long )?int\\\})?\\)' is '4'" "note" { target c++ } malloc1 } */
}
void test_2 (void)
{
- int32_t *ptr = malloc (10 + sizeof(int32_t)); /* { dg-line malloc2 } */
+ int32_t *ptr = (int32_t *) malloc (10 + sizeof(int32_t)); /* { dg-line malloc2 } */
free (ptr);
/* { dg-warning "allocated buffer size is not a multiple of the pointee's size \\\[CWE-131\\\]" "warning" { target *-*-* } malloc2 } */
/* { dg-message "14 bytes" "note" { target *-*-* } malloc2 } */
- /* { dg-message "'int32_t \\*' (\\\{aka '(long )?int \\*'\\\})? here; 'sizeof \\(int32_t (\\\{aka (long )?int\\\})?\\)' is '4'" "note" { target *-*-* } malloc2 } */
+ /* { dg-message "'int32_t \\*' (\\\{aka '(long )?int \\*'\\\})? here; 'sizeof \\(int32_t (\\\{aka (long )?int\\\})?\\)' is '4'" "note" { target c } malloc2 } */
+ /* { dg-message "'int32_t\\*' (\\\{aka '(long )?int\\*'\\\})? here; 'sizeof \\(int32_t (\\\{aka (long )?int\\\})?\\)' is '4'" "note" { target c++ } malloc2 } */
}
void test_3 (int32_t n)
{
- int32_t *ptr = malloc (n + sizeof (int32_t)); /* { dg-line malloc3 } */
+ int32_t *ptr = (int32_t *) malloc (n + sizeof (int32_t)); /* { dg-line malloc3 } */
free (ptr);
/* { dg-warning "allocated buffer size is not a multiple of the pointee's size \\\[CWE-131\\\]" "warning" { target *-*-* } malloc3 } */
/* { dg-message "'\[a-z0-9\\+\\(\\)\\s\]*' bytes" "note" { target *-*-* } malloc3 } */
- /* { dg-message "'int32_t \\*' (\\\{aka '(long )?int \\*'\\\})? here; 'sizeof \\(int32_t (\\\{aka (long )?int\\\})?\\)' is '4'" "note" { target *-*-* } malloc3 } */
+ /* { dg-message "'int32_t \\*' (\\\{aka '(long )?int \\*'\\\})? here; 'sizeof \\(int32_t (\\\{aka (long )?int\\\})?\\)' is '4'" "note" { target c } malloc3 } */
+ /* { dg-message "'int32_t\\*' (\\\{aka '(long )?int\\*'\\\})? here; 'sizeof \\(int32_t (\\\{aka (long )?int\\\})?\\)' is '4'" "note" { target c++ } malloc3 } */
}
void test_4 (int32_t n, int32_t m)
{
- int32_t *ptr = malloc ((n + m) * sizeof (int32_t));
+ int32_t *ptr = (int32_t *) malloc ((n + m) * sizeof (int32_t));
free (ptr);
}
void test_1 (void)
{
- struct base *ptr = malloc (5 * sizeof (struct base));
+ struct base *ptr = (struct base *) malloc (5 * sizeof (struct base));
free (ptr);
}
void test_2 (void)
{
- int32_t *ptr = malloc (5 * sizeof (struct base)); /* { dg-line malloc2 } */
+ int32_t *ptr = (int32_t *) malloc (5 * sizeof (struct base)); /* { dg-line malloc2 } */
free (ptr);
/* { dg-warning "allocated buffer size is not a multiple of the pointee's size \\\[CWE-131\\\]" "warning" { target *-*-* } malloc2 } */
/* { dg-message "\\d+ bytes" "note" { target *-*-* } malloc2 } */
- /* { dg-message "'int32_t \\*' (\\\{aka '(long )?int \\*'\\\})? here; 'sizeof \\(int32_t (\\\{aka (long )?int\\\})?\\)' is '4'" "note" { target *-*-* } malloc2 } */
+ /* { dg-message "'int32_t \\*' (\\\{aka '(long )?int \\*'\\\})? here; 'sizeof \\(int32_t (\\\{aka (long )?int\\\})?\\)' is '4'" "note" { target c } malloc2 } */
+ /* { dg-message "'int32_t\\*' (\\\{aka '(long )?int\\*'\\\})? here; 'sizeof \\(int32_t (\\\{aka (long )?int\\\})?\\)' is '4'" "note" { target c++ } malloc2 } */
}
void test_3 (void)
{
/* Even though 10 bytes is not a multiple of 4, we do not warn to prevent
a false positive in case s is the base struct of a struct inheritance. */
- struct base *ptr = malloc (10);
+ struct base *ptr = (struct base *) malloc (10);
free (ptr);
}
void test_4 (void)
{
- struct var_len *ptr = malloc (10);
+ struct var_len *ptr = (struct var_len *) malloc (10);
free (ptr);
}
{
/* For constant sizes, we warn if the buffer
is too small to hold a single struct. */
- struct base *ptr = malloc (1); /* { dg-line malloc5 } */
+ struct base *ptr = (struct base *) malloc (1); /* { dg-line malloc5 } */
free (ptr);
/* { dg-warning "allocated buffer size is not a multiple of the pointee's size \\\[CWE-131\\\]" "warning" { target *-*-* } malloc5 } */
/* { dg-message "allocated 1 byte here" "note" { target *-*-* } malloc5 } */
- /* { dg-message "'struct base \\*' here; 'sizeof \\(struct base\\)' is '\\d+'" "note" { target *-*-* } malloc5 } */
+ /* { dg-message "'struct base \\*' here; 'sizeof \\(struct base\\)' is '\\d+'" "note" { target c } malloc5 } */
+ /* { dg-message "'base\\*' here; 'sizeof \\(base\\)' is '\\d+'" "note" { target c++ } malloc5 } */
}
| | |
| | (5) second 'free' here; first 'free' was at (2)
|
- { dg-end-multiline-output "" } */
+ { dg-end-multiline-output "" { target c } } */
+/* { dg-begin-multiline-output "" }
+ NN | free (ptr);
+ | ~~~~~^~~~~
+ 'void test_1(void*, int, int)': event 1
+ |
+ | NN | calls_free_1 (ptr);
+ | | ~~~~~~~~~~~~~^~~~~
+ | | |
+ | | (1) calling 'calls_free_1' from 'test_1'
+ |
+ +--> 'void calls_free_1(void*)': event 2
+ |
+ | NN | free (ptr);
+ | | ~~~~~^~~~~
+ | | |
+ | | (2) first 'free' here
+ |
+ <------+
+ |
+ 'void test_1(void*, int, int)': events 3-4
+ |
+ | NN | calls_free_1 (ptr);
+ | | ~~~~~~~~~~~~~^~~~~
+ | | |
+ | | (3) returning to 'test_1' from 'calls_free_1'
+ |......
+ | NN | calls_free_1 (ptr);
+ | | ~~~~~~~~~~~~~~~~~~
+ | | |
+ | | (4) passing freed pointer 'ptr' in call to 'calls_free_1' from 'test_1'
+ |
+ +--> 'void calls_free_1(void*)': event 5
+ |
+ | NN | free (ptr);
+ | | ~~~~~^~~~~
+ | | |
+ | | (5) second 'free' here; first 'free' was at (2)
+ |
+ { dg-end-multiline-output "" { target c++ } } */
void calls_free_2 (void *ptr)
{
| | |
| | (5) second 'free' here; first 'free' was at (2)
|
- { dg-end-multiline-output "" } */
+ { dg-end-multiline-output "" { target c } } */
+/* { dg-begin-multiline-output "" }
+ NN | free (ptr);
+ | ~~~~~^~~~~
+ 'void test_2(void*, int, int)': event 1
+ |
+ | NN | calls_free_2 (ptr);
+ | | ~~~~~~~~~~~~~^~~~~
+ | | |
+ | | (1) calling 'calls_free_2' from 'test_2'
+ |
+ +--> 'void calls_free_2(void*)': event 2
+ |
+ | NN | free (ptr);
+ | | ~~~~~^~~~~
+ | | |
+ | | (2) first 'free' here
+ |
+ <------+
+ |
+ 'void test_2(void*, int, int)': events 3-4
+ |
+ | NN | calls_free_2 (ptr);
+ | | ~~~~~~~~~~~~~^~~~~
+ | | |
+ | | (3) returning to 'test_2' from 'calls_free_2'
+ |......
+ | NN | calls_free_2 (ptr);
+ | | ~~~~~~~~~~~~~~~~~~
+ | | |
+ | | (4) passing freed pointer 'ptr' in call to 'calls_free_2' from 'test_2'
+ |
+ +--> 'void calls_free_2(void*)': event 5
+ |
+ | NN | free (ptr);
+ | | ~~~~~^~~~~
+ | | |
+ | | (5) second 'free' here; first 'free' was at (2)
+ |
+ { dg-end-multiline-output "" { target c++ } } */
// TODO: range cases
| | |
| | (2) second 'free' here; first 'free' was at (1)
|
- { dg-end-multiline-output "" } */
+ { dg-end-multiline-output "" { target c } } */
+/* { dg-begin-multiline-output "" }
+ NN | free (ptr);
+ | ~~~~~^~~~~
+ 'void test_3(void*)': events 1-2
+ |
+ | NN | free (ptr);
+ | | ~~~~~^~~~~
+ | | |
+ | | (1) first 'free' here
+ | NN | called_by_test_3 ();
+ | NN | free (ptr);
+ | | ~~~~~~~~~~
+ | | |
+ | | (2) second 'free' here; first 'free' was at (1)
+ |
+ { dg-end-multiline-output "" { target c++ } } */
| | |
| | (8) second 'free' here; first 'free' was at (4)
|
- { dg-end-multiline-output "" } */
+ { dg-end-multiline-output "" { target c } } */
+/* { dg-begin-multiline-output "" }
+ NN | free (ptr);
+ | ~~~~~^~~~~
+ 'void test_1(void*, int, int)': events 1-2
+ |
+ | NN | void test_1 (void *ptr, int a, int b)
+ | | ^~~~~~
+ | | |
+ | | (1) entry to 'test_1'
+ |......
+ | NN | calls_free_1 (ptr);
+ | | ~~~~~~~~~~~~~~~~~~
+ | | |
+ | | (2) calling 'calls_free_1' from 'test_1'
+ |
+ +--> 'void calls_free_1(void*)': events 3-4
+ |
+ | NN | void calls_free_1 (void *ptr)
+ | | ^~~~~~~~~~~~
+ | | |
+ | | (3) entry to 'calls_free_1'
+ | NN | {
+ | NN | free (ptr);
+ | | ~~~~~~~~~~
+ | | |
+ | | (4) first 'free' here
+ |
+ <------+
+ |
+ 'void test_1(void*, int, int)': events 5-6
+ |
+ | NN | calls_free_1 (ptr);
+ | | ~~~~~~~~~~~~~^~~~~
+ | | |
+ | | (5) returning to 'test_1' from 'calls_free_1'
+ |......
+ | NN | calls_free_1 (ptr);
+ | | ~~~~~~~~~~~~~~~~~~
+ | | |
+ | | (6) passing freed pointer 'ptr' in call to 'calls_free_1' from 'test_1'
+ |
+ +--> 'void calls_free_1(void*)': events 7-8
+ |
+ | NN | void calls_free_1 (void *ptr)
+ | | ^~~~~~~~~~~~
+ | | |
+ | | (7) entry to 'calls_free_1'
+ | NN | {
+ | NN | free (ptr);
+ | | ~~~~~~~~~~
+ | | |
+ | | (8) second 'free' here; first 'free' was at (4)
+ |
+ { dg-end-multiline-output "" { target c++ } } */
void calls_free_2 (void *ptr)
{
| | |
| | (8) second 'free' here; first 'free' was at (4)
|
- { dg-end-multiline-output "" } */
+ { dg-end-multiline-output "" { target c } } */
+/* { dg-begin-multiline-output "" }
+ NN | free (ptr);
+ | ~~~~~^~~~~
+ 'void test_2(void*, int, int)': events 1-2
+ |
+ | NN | void test_2 (void *ptr, int a, int b)
+ | | ^~~~~~
+ | | |
+ | | (1) entry to 'test_2'
+ |......
+ | NN | calls_free_2 (ptr);
+ | | ~~~~~~~~~~~~~~~~~~
+ | | |
+ | | (2) calling 'calls_free_2' from 'test_2'
+ |
+ +--> 'void calls_free_2(void*)': events 3-4
+ |
+ | NN | void calls_free_2 (void *ptr)
+ | | ^~~~~~~~~~~~
+ | | |
+ | | (3) entry to 'calls_free_2'
+ | NN | {
+ | NN | free (ptr);
+ | | ~~~~~~~~~~
+ | | |
+ | | (4) first 'free' here
+ |
+ <------+
+ |
+ 'void test_2(void*, int, int)': events 5-6
+ |
+ | NN | calls_free_2 (ptr);
+ | | ~~~~~~~~~~~~~^~~~~
+ | | |
+ | | (5) returning to 'test_2' from 'calls_free_2'
+ |......
+ | NN | calls_free_2 (ptr);
+ | | ~~~~~~~~~~~~~~~~~~
+ | | |
+ | | (6) passing freed pointer 'ptr' in call to 'calls_free_2' from 'test_2'
+ |
+ +--> 'void calls_free_2(void*)': events 7-8
+ |
+ | NN | void calls_free_2 (void *ptr)
+ | | ^~~~~~~~~~~~
+ | | |
+ | | (7) entry to 'calls_free_2'
+ | NN | {
+ | NN | free (ptr);
+ | | ~~~~~~~~~~
+ | | |
+ | | (8) second 'free' here; first 'free' was at (4)
+ |
+ { dg-end-multiline-output "" { target c++ } } */
/* The call/return to this function shouldn't appear in the path. */
| | |
| | (2) second 'free' here; first 'free' was at (1)
|
- { dg-end-multiline-output "" } */
+ { dg-end-multiline-output "" { target c } } */
+/* { dg-begin-multiline-output "" }
+ NN | free (ptr);
+ | ~~~~~^~~~~
+ 'void test_3(void*)': events 1-2
+ |
+ | NN | free (ptr);
+ | | ~~~~~^~~~~
+ | | |
+ | | (1) first 'free' here
+ | NN | called_by_test_3 ();
+ | NN | free (ptr);
+ | | ~~~~~~~~~~
+ | | |
+ | | (2) second 'free' here; first 'free' was at (1)
+ |
+ { dg-end-multiline-output "" { target c++ } } */
| | |
| | (12) second 'free' here; first 'free' was at (6)
|
- { dg-end-multiline-output "" } */
+ { dg-end-multiline-output "" { target c } } */
+/* { dg-begin-multiline-output "" }
+ NN | free (ptr);
+ | ~~~~~^~~~~
+ 'void test_1(void*, int, int)': events 1-4
+ |
+ | NN | void test_1 (void *ptr, int a, int b)
+ | | ^~~~~~
+ | | |
+ | | (1) entry to 'test_1'
+ | NN | {
+ | NN | if (a)
+ | | ~~
+ | | |
+ | | (2) following 'true' branch (when 'a != 0')...
+ | NN | calls_free_1 (ptr);
+ | | ~~~~~~~~~~~~~~~~~~
+ | | |
+ | | (3) ...to here
+ | | (4) calling 'calls_free_1' from 'test_1'
+ |
+ +--> 'void calls_free_1(void*)': events 5-6
+ |
+ | NN | void calls_free_1 (void *ptr)
+ | | ^~~~~~~~~~~~
+ | | |
+ | | (5) entry to 'calls_free_1'
+ | NN | {
+ | NN | free (ptr);
+ | | ~~~~~~~~~~
+ | | |
+ | | (6) first 'free' here
+ |
+ <------+
+ |
+ 'void test_1(void*, int, int)': events 7-10
+ |
+ | NN | calls_free_1 (ptr);
+ | | ~~~~~~~~~~~~~^~~~~
+ | | |
+ | | (7) returning to 'test_1' from 'calls_free_1'
+ | NN |
+ | NN | if (b)
+ | | ~~
+ | | |
+ | | (8) following 'false' branch (when 'b == 0')...
+ |......
+ | NN | calls_free_1 (ptr);
+ | | ~~~~~~~~~~~~~~~~~~
+ | | |
+ | | (9) ...to here
+ | | (10) passing freed pointer 'ptr' in call to 'calls_free_1' from 'test_1'
+ |
+ +--> 'void calls_free_1(void*)': events 11-12
+ |
+ | NN | void calls_free_1 (void *ptr)
+ | | ^~~~~~~~~~~~
+ | | |
+ | | (11) entry to 'calls_free_1'
+ | NN | {
+ | NN | free (ptr);
+ | | ~~~~~~~~~~
+ | | |
+ | | (12) second 'free' here; first 'free' was at (6)
+ |
+ { dg-end-multiline-output "" { target c++ } } */
void calls_free_2 (void *ptr)
{
| | |
| | (12) second 'free' here; first 'free' was at (6)
|
- { dg-end-multiline-output "" } */
+ { dg-end-multiline-output "" { target c } } */
+/* { dg-begin-multiline-output "" }
+ NN | free (ptr);
+ | ~~~~~^~~~~
+ 'void test_2(void*, int, int)': events 1-4
+ |
+ | NN | void test_2 (void *ptr, int a, int b)
+ | | ^~~~~~
+ | | |
+ | | (1) entry to 'test_2'
+ | NN | {
+ | NN | switch (a)
+ | | ~~~~~~
+ | | |
+ | | (2) following 'case 3:' branch...
+ |......
+ | NN | case 3:
+ | | ~~~~
+ | | |
+ | | (3) ...to here
+ | NN | calls_free_2 (ptr);
+ | | ~~~~~~~~~~~~~~~~~~
+ | | |
+ | | (4) calling 'calls_free_2' from 'test_2'
+ |
+ +--> 'void calls_free_2(void*)': events 5-6
+ |
+ | NN | void calls_free_2 (void *ptr)
+ | | ^~~~~~~~~~~~
+ | | |
+ | | (5) entry to 'calls_free_2'
+ | NN | {
+ | NN | free (ptr);
+ | | ~~~~~~~~~~
+ | | |
+ | | (6) first 'free' here
+ |
+ <------+
+ |
+ 'void test_2(void*, int, int)': events 7-10
+ |
+ | NN | calls_free_2 (ptr);
+ | | ~~~~~~~~~~~~~^~~~~
+ | | |
+ | | (7) returning to 'test_2' from 'calls_free_2'
+ |......
+ | NN | switch (b)
+ | | ~~~~~~
+ | | |
+ | | (8) following 'default:' branch...
+ | NN | {
+ | NN | default:
+ | | ~~~~~~~
+ | | |
+ | | (9) ...to here
+ | NN | calls_free_2 (ptr);
+ | | ~~~~~~~~~~~~~~~~~~
+ | | |
+ | | (10) passing freed pointer 'ptr' in call to 'calls_free_2' from 'test_2'
+ |
+ +--> 'void calls_free_2(void*)': events 11-12
+ |
+ | NN | void calls_free_2 (void *ptr)
+ | | ^~~~~~~~~~~~
+ | | |
+ | | (11) entry to 'calls_free_2'
+ | NN | {
+ | NN | free (ptr);
+ | | ~~~~~~~~~~
+ | | |
+ | | (12) second 'free' here; first 'free' was at (6)
+ |
+ { dg-end-multiline-output "" { target c++ } } */
// TODO: range cases
| | |
| | (2) second 'free' here; first 'free' was at (1)
|
- { dg-end-multiline-output "" } */
+ { dg-end-multiline-output "" { target c } } */
+/* { dg-begin-multiline-output "" }
+ NN | free (ptr);
+ | ~~~~~^~~~~
+ 'void test_3(void*)': events 1-2
+ |
+ | NN | free (ptr);
+ | | ~~~~~^~~~~
+ | | |
+ | | (1) first 'free' here
+ | NN | called_by_test_3 ();
+ | NN | free (ptr);
+ | | ~~~~~~~~~~
+ | | |
+ | | (2) second 'free' here; first 'free' was at (1)
+ |
+ { dg-end-multiline-output "" { target c++ } } */
| | |
| | (12) second 'free' here; first 'free' was at (6)
|
- { dg-end-multiline-output "" } */
+ { dg-end-multiline-output "" { target c } } */
+/* { dg-begin-multiline-output "" }
+ NN | free (ptr);
+ | ~~~~~^~~~~
+ 'void test_1(void*, int, int)': events 1-4
+ |
+ | NN | void test_1 (void *ptr, int a, int b)
+ | | ^~~~~~
+ | | |
+ | | (1) entry to 'test_1'
+ | NN | {
+ | NN | if (a)
+ | | ~~
+ | | |
+ | | (2) following 'true' branch (when 'a != 0')...
+ | NN | calls_free_1 (ptr);
+ | | ~~~~~~~~~~~~~~~~~~
+ | | |
+ | | (3) ...to here
+ | | (4) calling 'calls_free_1' from 'test_1'
+ |
+ +--> 'void calls_free_1(void*)': events 5-6
+ |
+ | NN | void calls_free_1 (void *ptr)
+ | | ^~~~~~~~~~~~
+ | | |
+ | | (5) entry to 'calls_free_1'
+ | NN | {
+ | NN | free (ptr);
+ | | ~~~~~~~~~~
+ | | |
+ | | (6) first 'free' here
+ |
+ <------+
+ |
+ 'void test_1(void*, int, int)': events 7-10
+ |
+ | NN | calls_free_1 (ptr);
+ | | ~~~~~~~~~~~~~^~~~~
+ | | |
+ | | (7) returning to 'test_1' from 'calls_free_1'
+ | NN |
+ | NN | if (b)
+ | | ~~
+ | | |
+ | | (8) following 'false' branch (when 'b == 0')...
+ |......
+ | NN | calls_free_1 (ptr);
+ | | ~~~~~~~~~~~~~~~~~~
+ | | |
+ | | (9) ...to here
+ | | (10) passing freed pointer 'ptr' in call to 'calls_free_1' from 'test_1'
+ |
+ +--> 'void calls_free_1(void*)': events 11-12
+ |
+ | NN | void calls_free_1 (void *ptr)
+ | | ^~~~~~~~~~~~
+ | | |
+ | | (11) entry to 'calls_free_1'
+ | NN | {
+ | NN | free (ptr);
+ | | ~~~~~~~~~~
+ | | |
+ | | (12) second 'free' here; first 'free' was at (6)
+ |
+ { dg-end-multiline-output "" { target c++ } } */
void calls_free_2 (void *ptr)
{
| | |
| | (12) second 'free' here; first 'free' was at (6)
|
- { dg-end-multiline-output "" } */
+ { dg-end-multiline-output "" { target c } } */
+/* { dg-begin-multiline-output "" }
+ NN | free (ptr);
+ | ~~~~~^~~~~
+ 'void test_2(void*, int, int)': events 1-4
+ |
+ | NN | void test_2 (void *ptr, int a, int b)
+ | | ^~~~~~
+ | | |
+ | | (1) entry to 'test_2'
+ | NN | {
+ | NN | switch (a)
+ | | ~~~~~~
+ | | |
+ | | (2) following 'case 3:' branch...
+ |......
+ | NN | case 3:
+ | | ~~~~
+ | | |
+ | | (3) ...to here
+ | NN | calls_free_2 (ptr);
+ | | ~~~~~~~~~~~~~~~~~~
+ | | |
+ | | (4) calling 'calls_free_2' from 'test_2'
+ |
+ +--> 'void calls_free_2(void*)': events 5-6
+ |
+ | NN | void calls_free_2 (void *ptr)
+ | | ^~~~~~~~~~~~
+ | | |
+ | | (5) entry to 'calls_free_2'
+ | NN | {
+ | NN | free (ptr);
+ | | ~~~~~~~~~~
+ | | |
+ | | (6) first 'free' here
+ |
+ <------+
+ |
+ 'void test_2(void*, int, int)': events 7-10
+ |
+ | NN | calls_free_2 (ptr);
+ | | ~~~~~~~~~~~~~^~~~~
+ | | |
+ | | (7) returning to 'test_2' from 'calls_free_2'
+ |......
+ | NN | switch (b)
+ | | ~~~~~~
+ | | |
+ | | (8) following 'default:' branch...
+ | NN | {
+ | NN | default:
+ | | ~~~~~~~
+ | | |
+ | | (9) ...to here
+ | NN | calls_free_2 (ptr);
+ | | ~~~~~~~~~~~~~~~~~~
+ | | |
+ | | (10) passing freed pointer 'ptr' in call to 'calls_free_2' from 'test_2'
+ |
+ +--> 'void calls_free_2(void*)': events 11-12
+ |
+ | NN | void calls_free_2 (void *ptr)
+ | | ^~~~~~~~~~~~
+ | | |
+ | | (11) entry to 'calls_free_2'
+ | NN | {
+ | NN | free (ptr);
+ | | ~~~~~~~~~~
+ | | |
+ | | (12) second 'free' here; first 'free' was at (6)
+ |
+ { dg-end-multiline-output "" { target c++ } } */
// TODO: range cases
| | |
| | (2) second 'free' here; first 'free' was at (1)
|
- { dg-end-multiline-output "" } */
+ { dg-end-multiline-output "" { target c } } */
+/* { dg-begin-multiline-output "" }
+ NN | free (ptr);
+ | ~~~~~^~~~~
+ 'void test_3(void*)': events 1-2
+ |
+ | NN | free (ptr);
+ | | ~~~~~^~~~~
+ | | |
+ | | (1) first 'free' here
+ | NN | called_by_test_3 ();
+ | NN | free (ptr);
+ | | ~~~~~~~~~~
+ | | |
+ | | (2) second 'free' here; first 'free' was at (1)
+ |
+ { dg-end-multiline-output "" { target c++ } } */
-#include "analyzer-decls.h"
+#include "../../gcc.dg/analyzer/analyzer-decls.h"
typedef __SIZE_TYPE__ size_t;
int test_one_arg_concrete_int_ptr (void)
{
- int *x = my_alloc (1); /* { dg-warning "allocated buffer size is not a multiple of the pointee's size" } */
+ int *x = (int *) my_alloc (1); /* { dg-warning "allocated buffer size is not a multiple of the pointee's size" } */
__analyzer_dump_capacity (x); /* { dg-warning "capacity: '\\(\[^\n\r\]*\\)1'" } */
x[0] = 0; /* { dg-warning "buffer overflow" } */
return 0;
void test_one_arg_concrete (void)
{
- char *p = my_alloc (10);
+ char *p = (char *) my_alloc (10);
__analyzer_dump_capacity (p); /* { dg-warning "capacity: '\\(\[^\n\r\]*\\)10'" } */
p[0] = 'a';
p[9] = 'b';
void test_one_arg_symbolic (size_t sz)
{
- char *p = my_alloc (sz);
+ char *p = (char *) my_alloc (sz);
__analyzer_dump_capacity (p); /* { dg-warning "capacity: 'INIT_VAL\\(sz" } */
}
void test_two_args_concrete (void)
{
- char *p = my_alloc_2 (2, 5);
+ char *p = (char *) my_alloc_2 (2, 5);
__analyzer_dump_capacity (p); /* { dg-warning "capacity: '\\(\[^\n\r\]*\\)10'" } */
p[0] = 'a';
p[9] = 'b';
void test_two_args_symbolic_first (size_t sz)
{
- char *p = my_alloc_2 (sz, 5);
+ char *p = (char *) my_alloc_2 (sz, 5);
__analyzer_dump_capacity (p); /* { dg-warning "capacity: '\\(INIT_VAL\\(sz\[^\n\r\]*\\*\\(size_t\\)5\\)'" } */
}
void test_two_args_symbolic_second (size_t sz)
{
- char *p = my_alloc_2 (5, sz);
+ char *p = (char *) my_alloc_2 (5, sz);
__analyzer_dump_capacity (p); /* { dg-warning "capacity: '\\(INIT_VAL\\(sz\[^\n\r\]*\\*\\(size_t\\)5\\)'" } */
}
void test_two_args_symbolic_both (size_t a, size_t b)
{
- char *p = my_alloc_2 (a, b);
+ char *p = (char *) my_alloc_2 (a, b);
__analyzer_dump_capacity (p); /* { dg-warning "capacity: '\\(INIT_VAL\\(a\[^\n\r\]*\\*INIT_VAL\\(b" } */
}
void test_one_arg_concrete_fnptr (my_alloc_t fnptr)
{
- char *p = fnptr (10);
+ char *p = (char *) fnptr (10);
__analyzer_dump_capacity (p); /* { dg-warning "capacity: '\\(\[^\n\r\]*\\)10'" } */
p[0] = 'a';
p[9] = 'b';
void test_two_args_concrete_fnptr (my_alloc_2_t fnptr)
{
- char *p = fnptr (2, 5);
+ char *p = (char *) fnptr (2, 5);
__analyzer_dump_capacity (p); /* { dg-warning "capacity: '\\(\[^\n\r\]*\\)10'" } */
p[0] = 'a';
p[9] = 'b';
char *
test_cast_1 (char *buf, idx_t buf_count)
{
- return xirealloc (buf, buf_count + 1);
+ return (char *) xirealloc (buf, buf_count + 1);
}
void *alloc_cast_2 (signed char x, signed char y)
#include <stdlib.h>
#include <string.h>
-#include "analyzer-decls.h"
+#include "../../gcc.dg/analyzer/analyzer-decls.h"
int *malloc_int (int i)
{
- int *res = malloc (sizeof (int));
+ int *res = (int *) malloc (sizeof (int));
if (!res)
return NULL;
*res = i;
void test_leak (int x)
{
- int *p = malloc_int (x); /* { dg-message "when 'malloc_int' returns pointer to heap-allocated buffer" } */
+ int *p = malloc_int (x); /* { dg-message "when 'malloc_int' returns pointer to heap-allocated buffer" "" { target c } } */
+ /* { dg-message "when 'int\\* malloc_int\\(int\\)' returns pointer to heap-allocated buffer" "" { target c++ } .-1 } */
} /* { dg-message "leak of 'p'" } */
void *wrapped_malloc (size_t sz)
void test_use_without_check (size_t sz)
{
- char *buf = wrapped_malloc (sz); /* { dg-message "this call could return NULL" } */
+ char *buf = (char *) wrapped_malloc (sz); /* { dg-message "this call could return NULL" } */
memset (buf, 'x', sz); /* { dg-warning "use of possibly-NULL 'buf' where non-null expected" } */
wrapped_free (buf);
}
void test_out_of_bounds (size_t sz)
{
- char *buf = wrapped_malloc (sz);
+ char *buf = (char *) wrapped_malloc (sz);
if (!buf)
return;
memset (buf, 'x', sz);
/* { dg-additional-options "-fanalyzer-call-summaries -Wno-analyzer-too-complex" } */
+/* { dg-skip-if "c++98 has no noreturn attribute" { c++98_only } } */
+
+#ifdef __cplusplus
+#define _Noreturn [[noreturn]]
+#endif
typedef __SIZE_TYPE__ size_t;
typedef struct _IO_FILE FILE;
static char *string_dup(const char *string) {
char *buf;
- if ((buf = malloc(strlen(string) + 1)) == ((void *)0))
+ if ((buf = (char *) malloc(strlen(string) + 1)) == ((void *)0))
failed("malloc() failed");
return strcpy(buf, string);
if ((p = (struct mydata *)malloc(sizeof(struct mydata))) == ((void *)0))
failed("malloc() failed");
- p->link = ((void *)0);
+ p->link = (struct mydata *)((void *)0);
p->name = string_dup(name);
p->type = string_dup(type);
/* { dg-require-effective-target alloca } */
#include <stdlib.h>
-#include "analyzer-decls.h"
+#include "../../gcc.dg/analyzer/analyzer-decls.h"
typedef unsigned __INT32_TYPE__ u32;
static struct s * __attribute__((noinline))
alloc_s (size_t num)
{
- struct s *p = malloc (sizeof(struct s) + num);
+ struct s *p = (struct s *) malloc (sizeof(struct s) + num);
return p;
}
--- /dev/null
+#include <stdlib.h>
+
+struct ptr_wrapper
+{
+ int *ptr;
+};
+
+struct ptr_wrapper
+test_1 (void)
+{
+ struct ptr_wrapper r;
+ r.ptr = (int *) malloc (sizeof (int));
+ return r;
+}
+
+struct ptr_wrapper
+test_2 (void)
+{
+ struct ptr_wrapper r, s;
+ r.ptr = (int *) malloc (sizeof (int));
+ s = r;
+ return s;
+}
+
+struct nested
+{
+ struct ptr_wrapper w;
+};
+
+struct nested
+test_3 (void)
+{
+ struct nested n;
+ n.w.ptr = (int *) malloc (sizeof (int));
+ return n;
+}
+
+void test_4 (void)
+{
+ struct ptr_wrapper r;
+ r.ptr = (int *) malloc (sizeof (int)); /* { dg-message "allocated here" } */
+} /* { dg-warning "leak of 'r.ptr'" "" { target c } } */
+/* { dg-warning "leak of 'r.ptr_wrapper::ptr'" "" { target c++ } .-1 } */
+/* { dg-bogus "leak of '<unknown>'" "unknown leak" { target *-*-* } .-1 } */
+
+static struct ptr_wrapper __attribute__((noinline))
+called_by_test_5a (void)
+{
+ struct ptr_wrapper r;
+ r.ptr = (int *) malloc (sizeof (int)); /* { dg-message "allocated here" } */
+ return r;
+}
+
+void test_5a (void)
+{
+ struct ptr_wrapper q = called_by_test_5a ();
+} /* { dg-warning "leak of 'q.ptr'" "" { target c } } */
+/* { dg-warning "leak of 'q.ptr_wrapper::ptr'" "" { target c++ } .-1 } */
+
+static struct ptr_wrapper __attribute__((noinline))
+called_by_test_5b (void)
+{
+ struct ptr_wrapper r;
+ r.ptr = (int *) malloc (sizeof (int));
+ return r; /* { dg-warning "leak of '<return-value>.ptr'" "" { target c } } */
+ /* TODO: show the allocation point; improve above messages. C++ does show it. */
+}
+
+void test_5b (void)
+{
+ called_by_test_5b ();
+} /* { dg-warning "leak of '<anonymous>.ptr_wrapper::ptr'" "" { target c++ } } */
int *test (int *buf, int n, int *out)
{
int i;
- int *result = malloc (sizeof (int) * n);
+ int *result = (int *) malloc (sizeof (int) * n);
/* A loop, to ensure we have phi nodes. */
for (i = 0; i < n; i++)
-#include "analyzer-decls.h"
-
-#define NULL ((void *)0)
+#include "../../gcc.dg/analyzer/analyzer-decls.h"
extern void unknown_fn (void *);
__analyzer_dump_escaped (); /* { dg-warning "escaped: 0: " } */
unknown_fn (&local_1);
- __analyzer_dump_escaped (); /* { dg-warning "escaped: 1: 'local_1'" } */
+ __analyzer_dump_escaped (); /* { dg-warning "escaped: 1: 'local_1'" "" { target c } } */
+ /* { dg-warning "escaped: 1: 'int local_1'" "" { target c++ } .-1 } */
/* Should be idempotent. */
unknown_fn (&local_1);
- __analyzer_dump_escaped (); /* { dg-warning "escaped: 1: 'local_1'" } */
+ __analyzer_dump_escaped (); /* { dg-warning "escaped: 1: 'local_1'" "" { target c } } */
+ /* { dg-warning "escaped: 1: 'int local_1'" "" { target c++ } .-1 } */
/* Escape a static global. */
unknown_fn (&only_used_by_test_1);
- __analyzer_dump_escaped (); /* { dg-warning "escaped: 2: 'local_1', 'only_used_by_test_1'" } */
+ __analyzer_dump_escaped (); /* { dg-warning "escaped: 2: 'local_1', 'only_used_by_test_1'" "" { target c } } */
+ /* { dg-warning "escaped: 2: 'int local_1', 'int only_used_by_test_1'" "" { target c++ } .-1 } */
}
-#define NULL ((void*)0)
+#include "../../gcc.dg/analyzer/analyzer-decls.h"
void *test_1 (void)
{
/* { dg-do "compile" } */
-#define NULL ((void *) 0)
+#include "../../gcc.dg/analyzer/analyzer-decls.h"
typedef struct _IO_FILE FILE;
extern char *fgets(char *__restrict __s, int __n,
--- /dev/null
+/* { dg-additional-options "-fno-exceptions" } */
+typedef struct FILE FILE;
+
+FILE* fopen (const char*, const char*);
+int fclose (FILE*);
+char *fgets (char *, int, FILE *);
+
+#include "../../gcc.dg/analyzer/analyzer-decls.h"
+
+void f0(const char *str)
+{
+ FILE * fp = fopen(str, "r"); /* { dg-message "opened here" } */
+ // ideally warning should be located at the end of the function
+ char buf[10];
+ fgets(buf, 10, fp);
+} /* { dg-warning "leak of FILE 'fp'" } */
+
+void f1(const char *str)
+{
+ FILE * fp = fopen(str, "r"); /* { dg-message "opened here" } */
+ // ideally warning should be located at the end of the function
+ char buf[10];
+
+ while (fgets(buf, 10, fp) != NULL)
+ {
+ /* Do something with buf */
+ }
+} /* { dg-warning "leak of FILE 'fp'" } */
+
+void f2(const char *str, int flag)
+{
+ FILE * fp = fopen(str, "r"); /* { dg-message "opened here" } */
+ // ideally warning should be located at the end of the function
+ char buf[10];
+
+ while (fgets(buf, 10, fp) != NULL)
+ {
+ /* Do something with buf */
+ }
+ if (flag) /* { dg-message "when 'flag == 0'" } */
+ fclose(fp);
+} /* { dg-warning "leak of FILE 'fp'" } */
+
+extern void called_by_f3( FILE * fp);
+
+void f3(const char *str)
+{
+ FILE * fp = fopen(str, "r");
+ char buf[10];
+
+ while (fgets(buf, 10, fp) != NULL)
+ {
+ /* Do something with buf */
+ }
+ /* Not sure if fclose executed by called_by_f3 or not. Say nothing */
+ called_by_f3(fp);
+}
+
+void f4(const char *str)
+{
+ FILE * fp = fopen(str, "r");
+ char buf[10];
+
+ while (fgets(buf, 10, fp) != NULL)
+ {
+ /* Do something with buf */
+ }
+ /* Nothing to say here. */
+ fclose(fp);
+}
+
+int main(int argc, const char * argv[])
+{
+ FILE * fp = fopen(argv[0], "r");
+ char buf[10];
+
+ while (fgets(buf, 10, fp) != NULL)
+ {
+ /* Do something with buf */
+ }
+ /* Nothing to say here, because we are in main. */
+}
-#include "analyzer-decls.h"
+#include "../../gcc.dg/analyzer/analyzer-decls.h"
typedef struct base_obj
{
#include <stdlib.h>
#include <string.h>
-#include "analyzer-decls.h"
+#include "../../gcc.dg/analyzer/analyzer-decls.h"
typedef struct base_obj base_obj;
typedef struct string_obj string_obj;
else
b->yy_buf_size *= 2;
- b->yy_ch_buf = (char *) /* { dg-warning "leak of '\\*b.yy_ch_buf'" } */
+ b->yy_ch_buf = (char *) /* { dg-warning "leak of '\\*b.yy_ch_buf'" "" { target c } } */
+ /* { dg-warning "leak of '\\*b.yy_buffer_state::yy_ch_buf'" "" { target c++ } .-1 } */
/* Include room in for 2 EOB chars. */
yyrealloc( (void *) b->yy_ch_buf,
(yy_size_t) (b->yy_buf_size + 2) );
#include <stdlib.h>
#include <string.h>
+#include "../../gcc.dg/analyzer/analyzer-decls.h"
struct str {
size_t len;
struct str *
test_const_size (void)
{
- struct str *str = malloc(sizeof(str) + 10);
+ struct str *str = (struct str *) malloc(sizeof(str) + 10);
if (str) {
str->len = 10;
memset(str->data, 'x', 10);
test_const_size_oob_1 (void)
{
/* Forgetting to add space for the trailing array. */
- struct str *str = malloc(sizeof(str));
+ struct str *str = (struct str *) malloc(sizeof(str));
if (str) {
str->len = 10;
memset(str->data, 'x', 10); /* { dg-warning "heap-based buffer overflow" "Wanalyzer-out-of-bounds" } */
- /* { dg-warning "'memset' writing 10 bytes into a region of size 0 overflows the destination" "Wstringop-overflow" { target *-*-* } .-1 } */
+ /* { dg-warning "'memset' writing 10 bytes into a region of size 0 overflows the destination" "Wstringop-overflow" { target c } .-1 } */
+ /* { dg-warning "'void\\* memset\\(void\\*, int, size_t\\)' writing 10 bytes into a region of size 0 overflows the destination" "Wstringop-overflow" { target c++ } .-2 } */
return str;
}
return NULL;
struct str *
test_const_size_oob_2 (void)
{
- struct str *str = malloc(sizeof(str) + 10);
+ struct str *str = (struct str *) malloc(sizeof(str) + 10);
if (str) {
str->len = 10;
/* Using the wrong size here. */
memset(str->data, 'x', 11); /* { dg-warning "heap-based buffer overflow" "Wanalyzer-out-of-bounds" } */
- /* { dg-warning "'memset' writing 11 bytes into a region of size 10 overflows the destination" "Wstringop-overflow" { target *-*-* } .-1 } */
+ /* { dg-warning "'memset' writing 11 bytes into a region of size 10 overflows the destination" "Wstringop-overflow" { target c } .-1 } */
+ /* { dg-warning "'void\\* memset\\(void\\*, int, size_t\\)' writing 11 bytes into a region of size 10 overflows the destination" "Wstringop-overflow" { target c++ } .-2 } */
+
return str;
}
return NULL;
struct str *
test_symbolic_size (size_t len)
{
- struct str *str = malloc(sizeof(str) + len);
+ struct str *str = (struct str *) malloc(sizeof(str) + len);
if (str) {
str->len = len;
memset(str->data, 'x', len);
test_symbolic_size_oob (size_t len)
{
/* Forgetting to add space for the trailing array. */
- struct str *str = malloc(sizeof(str));
+ struct str *str = (struct str *) malloc(sizeof(str));
if (str) {
str->len = len;
memset(str->data, 'x', len); /* { dg-warning "heap-based buffer overflow" "PR analyzer/98247" { xfail *-*-* } } */
struct str *
test_symbolic_size_with_terminator (size_t len)
{
- struct str *str = malloc(sizeof(str) + len + 1);
+ struct str *str = (struct str *) malloc(sizeof(str) + len + 1);
if (str) {
str->len = len;
memset(str->data, 'x', len);
test_symbolic_size_with_terminator_oob (size_t len)
{
/* Forgetting to add 1 for the terminator. */
- struct str *str = malloc(sizeof(str) + len);
+ struct str *str = (struct str *) malloc(sizeof(str) + len);
if (str) {
str->len = len;
memset(str->data, 'x', len);
-#include "analyzer-decls.h"
+#include "../../gcc.dg/analyzer/analyzer-decls.h"
void test_1 (void)
{
--- /dev/null
+typedef struct FILE FILE;
+FILE *fopen (const char *pathname, const char *mode);
+#include "../../gcc.dg/analyzer/analyzer-decls.h"
+
+FILE *
+test_passthrough (const char *pathname, const char *mode)
+{
+ return fopen (pathname, mode);
+}
+
+FILE *
+test_null_pathname (const char *pathname, const char *mode)
+{
+ return fopen (NULL, mode);
+}
+
+FILE *
+test_null_mode (const char *pathname)
+{
+ return fopen (pathname, NULL);
+}
+
+FILE *
+test_simple_r (void)
+{
+ return fopen ("foo.txt", "r");
+}
+
+FILE *
+test_swapped_args (void)
+{
+ return fopen ("r", "foo.txt"); /* TODO: would be nice to detect this. */
+}
+
+FILE *
+test_uninitialized_pathname (const char *mode)
+{
+ char buf[10];
+ return fopen (buf, mode); /* { dg-warning "use of uninitialized value 'buf\\\[0\\\]'" } */
+ /* { dg-message "while looking for null terminator for argument 1 \\('&buf'\\) of 'fopen'..." "event" { target c } .-1 } */
+ /* { dg-message "while looking for null terminator for argument 1 \\('& buf'\\) of 'FILE\\* fopen\\(const char\\*, const char\\*\\)'..." "event" { target c++ } .-2 } */
+}
+
+FILE *
+test_uninitialized_mode (const char *filename)
+{
+ char buf[10];
+ return fopen (filename, buf); /* { dg-warning "use of uninitialized value 'buf\\\[0\\\]'" } */
+ /* { dg-message "while looking for null terminator for argument 2 \\('&buf'\\) of 'fopen'..." "event" { target c } .-1 } */
+ /* { dg-message "while looking for null terminator for argument 2 \\('& buf'\\) of 'FILE\\* fopen\\(const char\\*, const char\\*\\)'..." "event" { target c++ } .-2 } */
+}
+
/* { dg-additional-options "-fdump-analyzer-untracked" } */
-#include "analyzer-decls.h"
+#include "../../gcc.dg/analyzer/analyzer-decls.h"
struct S
{
#include <stdlib.h>
-#include "analyzer-decls.h"
+#include "../../gcc.dg/analyzer/analyzer-decls.h"
typedef void (*fn_ptr_t) (void *);
/* { dg-skip-if "" { powerpc*-*-aix* } } */
#include <stdio.h>
-#include "analyzer-decls.h"
+#include "../../gcc.dg/analyzer/analyzer-decls.h"
int test_1 (void)
{
void test_1 (float f)
{
- int *ptr = malloc (sizeof (int) * f); /* { dg-line test_1 } */
+ int *ptr = (int *)malloc (sizeof (int) * f); /* { dg-line test_1 } */
free (ptr);
/* { dg-warning "use of floating-point arithmetic here might yield unexpected results" "warning" { target *-*-* } test_1 } */
void test_2 (int n)
{
- int *ptr = malloc (n * 3.1); /* { dg-line test_2 } */
+ int *ptr = (int *)malloc (n * 3.1); /* { dg-line test_2 } */
free (ptr);
/* { dg-warning "use of floating-point arithmetic here might yield unexpected results" "warning" { target *-*-* } test_2 } */
- /* { dg-message "operand '\(\\d|e|f|\\.|\\+|\)+' is of type 'double'" "note" { target *-*-* } test_2 } */
+ /* { dg-message "operand '\(\\d|e|f|l|\\.|\\+|\)+' is of type '\(long \)?double'" "note" { target *-*-* } test_2 } */
/* { dg-message "only use operands of an integer type inside the size argument" "note" { target *-*-* } test_2 } */
}
void test_4 (int n)
{
- int *ptr = calloc(1.7 * n, sizeof (int)); /* { dg-line test_4 } */
+ int *ptr = (int *)calloc(1.7 * n, sizeof (int)); /* { dg-line test_4 } */
free (ptr);
/* { dg-warning "use of floating-point arithmetic here might yield unexpected results" "warning" { target *-*-* } test_4 } */
- /* { dg-message "operand '\(\\d|e|f|\\.|\\+|\)+' is of type 'double'" "note" { target *-*-* } test_4 } */
+ /* { dg-message "operand '\(\\d|e|f|l|\\.|\\+|\)+' is of type '\(long \)?double'" "note" { target *-*-* } test_4 } */
/* { dg-message "only use operands of an integer type inside the size argument" "note" { target *-*-* } test_4 } */
}
int test_5 (float f)
{
- int *ptr = __builtin_alloca (sizeof (int) * f); /* { dg-line test_5 } */
+ int *ptr = (int *)__builtin_alloca (sizeof (int) * f); /* { dg-line test_5 } */
*ptr = 4;
return *ptr;
int test_6 (float f)
{
- int *ptr = __builtin_alloca (1.7f * f * 2.3f); /* { dg-line test_6 } */
+ int *ptr = (int *)__builtin_alloca (1.7f * f * 2.3f); /* { dg-line test_6 } */
*ptr = 4;
return *ptr;
| (5) recursive entry to 'foo'; previously entered at (1)
| (6) apparently infinite recursion
|
- { dg-end-multiline-output "" } */
+ { dg-end-multiline-output "" { target c } } */
+/* { dg-begin-multiline-output "" }
+ foo (flag);
+ ~~~~^~~~~~
+ 'void foo(int)': events 1-4 (depth 1)
+ |
+ | void foo (int flag)
+ | ^~~
+ | |
+ | (1) initial entry to 'foo'
+ |
+ | if (flag)
+ | ~~
+ | |
+ | (2) following 'true' branch (when 'flag != 0')...
+ | foo (flag);
+ | ~~~~~~~~~~
+ | |
+ | (3) ...to here
+ | (4) calling 'foo' from 'foo'
+ |
+ +--> 'void foo(int)': events 5-6 (depth 2)
+ |
+ | void foo (int flag)
+ | ^~~
+ | |
+ | (5) recursive entry to 'foo'; previously entered at (1)
+ | (6) apparently infinite recursion
+ |
+ { dg-end-multiline-output "" { target c++ } } */
| (5) recursive entry to 'mutual_2'; previously entered at (1)
| (6) apparently infinite chain of mutually-recursive function calls, consuming 2 stack frames per recursion
|
- { dg-end-multiline-output "" } */
+ { dg-end-multiline-output "" { target c } } */
+/* { dg-begin-multiline-output "" }
+ mutual_2 ();
+ ~~~~~~~~~^~
+ 'void mutual_2()': events 1-2 (depth 1)
+ |
+ | void mutual_2 (void)
+ | ^~~~~~~~
+ | |
+ | (1) initial entry to 'mutual_2'
+ |
+ | mutual_1 ();
+ | ~~~~~~~~~~~
+ | |
+ | (2) calling 'mutual_1' from 'mutual_2'
+ |
+ +--> 'void mutual_1()': events 3-4 (depth 2)
+ |
+ | void mutual_1 (void)
+ | ^~~~~~~~
+ | |
+ | (3) entry to 'mutual_1'
+ |
+ | mutual_2 ();
+ | ~~~~~~~~~~~
+ | |
+ | (4) calling 'mutual_2' from 'mutual_1'
+ |
+ +--> 'void mutual_2()': events 5-6 (depth 3)
+ |
+ | void mutual_2 (void)
+ | ^~~~~~~~
+ | |
+ | (5) recursive entry to 'mutual_2'; previously entered at (1)
+ | (6) apparently infinite chain of mutually-recursive function calls, consuming 2 stack frames per recursion
+ |
+ { dg-end-multiline-output "" { target c++ } } */
/* { dg-begin-multiline-output "" }
| (5) recursive entry to 'mutual_1'; previously entered at (1)
| (6) apparently infinite chain of mutually-recursive function calls, consuming 2 stack frames per recursion
|
- { dg-end-multiline-output "" } */
+ { dg-end-multiline-output "" { target c } } */
+/* { dg-begin-multiline-output "" }
+ mutual_1 ();
+ ~~~~~~~~~^~
+ 'void mutual_1()': events 1-2 (depth 1)
+ |
+ | void mutual_1 (void)
+ | ^~~~~~~~
+ | |
+ | (1) initial entry to 'mutual_1'
+ |
+ | mutual_2 ();
+ | ~~~~~~~~~~~
+ | |
+ | (2) calling 'mutual_2' from 'mutual_1'
+ |
+ +--> 'void mutual_2()': events 3-4 (depth 2)
+ |
+ | void mutual_2 (void)
+ | ^~~~~~~~
+ | |
+ | (3) entry to 'mutual_2'
+ |
+ | mutual_1 ();
+ | ~~~~~~~~~~~
+ | |
+ | (4) calling 'mutual_1' from 'mutual_2'
+ |
+ +--> 'void mutual_1()': events 5-6 (depth 3)
+ |
+ | void mutual_1 (void)
+ | ^~~~~~~~
+ | |
+ | (5) recursive entry to 'mutual_1'; previously entered at (1)
+ | (6) apparently infinite chain of mutually-recursive function calls, consuming 2 stack frames per recursion
+ |
+ { dg-end-multiline-output "" { target c++ } } */
| |
| (5) second 'free' here; first 'free' was at (3)
|
- { dg-end-multiline-output "" } */
+ { dg-end-multiline-output "" { target c } } */
+/* { dg-begin-multiline-output "" }
+ __builtin_free (p);
+ ~~~~~~~~~~~~~~~^~~
+ 'void bar(void*)': events 1-2 (depth 1)
+ |
+ | void bar (void *q)
+ | ^~~
+ | |
+ | (1) entry to 'bar'
+ |
+ | foo (q);
+ | ~
+ | |
+ | (2) inlined call to 'foo' from 'bar'
+ |
+ +--> 'void foo(void*)': event 3 (depth 2)
+ |
+ | __builtin_free (p);
+ | ~~~~~~~~~~~~~~~^~~
+ | |
+ | (3) first 'free' here
+ |
+ <------+
+ |
+ 'void bar(void*)': event 4 (depth 1)
+ |
+ | foo (q);
+ | ^
+ | |
+ | (4) inlined call to 'foo' from 'bar'
+ |
+ +--> 'void foo(void*)': event 5 (depth 2)
+ |
+ | __builtin_free (p);
+ | ~~~~~~~~~~~~~~~^~~
+ | |
+ | (5) second 'free' here; first 'free' was at (3)
+ |
+ { dg-end-multiline-output "" { target c++ } } */
void foo (void *p)
{
__builtin_free (p); /* { dg-warning "double-'free' of 'q'" "warning" } */
- /* { dg-message "\\(1\\) first 'free' here \\(fndecl 'bar', depth 1\\)" "1st free message" { target *-*-* } .-1 } */
- /* { dg-message "\\(2\\) second 'free' here; first 'free' was at \\(1\\) \\(fndecl 'bar', depth 1\\)" "2nd free message" { target *-*-* } .-2 } */
+ /* { dg-message "\\(1\\) first 'free' here \\(fndecl 'bar', depth 1\\)" "1st free message" { target c } .-1 } */
+ /* { dg-message "\\(1\\) first 'free' here \\(fndecl 'void bar\\(void\\*\\)', depth 1\\)" "1st free message" { target c++ } .-2 } */
+ /* { dg-message "\\(2\\) second 'free' here; first 'free' was at \\(1\\) \\(fndecl 'bar', depth 1\\)" "2nd free message" { target c } .-3 } */
+ /* { dg-message "\\(2\\) second 'free' here; first 'free' was at \\(1\\) \\(fndecl 'void bar\\(void\\*\\)', depth 1\\)" "2nd free message" { target c++ } .-4 } */
}
void bar (void *q)
--- /dev/null
+/* Verify that we can reconstruct fndecl and stack depth information
+ after early inlining. */
+
+/* { dg-additional-options "-O2 -fdiagnostics-show-path-depths" } */
+
+void foo (void *p)
+{
+ __builtin_free (p); /* { dg-warning "double-'free' of 'q'" "warning" } */
+ /* { dg-message "\\(3\\) first 'free' here \\(fndecl 'foo', depth 2\\)" "1st free message" { target c } .-1 } */
+ /* { dg-message "\\(3\\) first 'free' here \\(fndecl 'void foo\\(void\\*\\)', depth 2\\)" "1st free message" { target c++ } .-2 } */
+ /* { dg-message "\\(5\\) second 'free' here; first 'free' was at \\(3\\) \\(fndecl 'foo', depth 2\\)" "2nd free message" { target c } .-3 } */
+ /* { dg-message "\\(5\\) second 'free' here; first 'free' was at \\(3\\) \\(fndecl 'void foo\\(void\\*\\)', depth 2\\)" "2nd free message" { target c++ } .-4 } */
+}
+
+void bar (void *q) /* { dg-message "\\(1\\) entry to 'bar' \\(fndecl 'bar', depth 1\\)" "" { target c } } */
+/* { dg-message "\\(1\\) entry to 'bar' \\(fndecl 'void bar\\(void\\*\\)', depth 1\\)" "" { target c++ } .-1 } */
+{
+ foo (q); /* { dg-message "\\(2\\) inlined call to 'foo' from 'bar' \\(fndecl 'bar', depth 1\\)" "" { target c } } */
+ /* { dg-message "\\(2\\) inlined call to 'foo' from 'bar' \\(fndecl 'void bar\\\(void\\*\\)', depth 1\\)" "" { target c++ } .-1 } */
+ foo (q); /* { dg-message "\\(4\\) inlined call to 'foo' from 'bar' \\(fndecl 'bar', depth 1\\)" "" { target c } } */
+ /* { dg-message "\\(4\\) inlined call to 'foo' from 'bar' \\(fndecl 'void bar\\\(void\\*\\)', depth 1\\)" "" { target c++ } .-1 } */
+}
| |
| (4) second 'free' here; first 'free' was at (3)
|
- { dg-end-multiline-output "" } */
+ { dg-end-multiline-output "" { target c } } */
+/* { dg-begin-multiline-output "" }
+ __builtin_free (p);
+ ~~~~~~~~~~~~~~~^~~
+ 'void bar(void*)': events 1-2 (depth 1)
+ |
+ | void bar (void *q)
+ | ^~~
+ | |
+ | (1) entry to 'bar'
+ |
+ | __analyzer_foo (q);
+ | ~
+ | |
+ | (2) inlined call to '__analyzer_foo' from 'bar'
+ |
+ +--> 'void __analyzer_foo(void*)': events 3-4 (depth 2)
+ |
+ | __builtin_free (p);
+ | ~~~~~~~~~~~~~~~^~~
+ | |
+ | (3) first 'free' here
+ |
+ | __builtin_free (p);
+ | ~~~~~~~~~~~~~~~~~~
+ | |
+ | (4) second 'free' here; first 'free' was at (3)
+ |
+ { dg-end-multiline-output "" { target c++ } } */
--- /dev/null
+/* Verify that we can reconstruct fndecl and stack depth information
+ after early inlining. */
+
+/* { dg-additional-options "-O2 -fdiagnostics-show-path-depths" } */
+
+static void __analyzer_foo (void *p)
+{
+ __builtin_free (p); /* { dg-message "\\(3\\) first 'free' here \\(fndecl '__analyzer_foo', depth 2\\)" "1st free message" { target c } } */
+ /* { dg-message "\\(3\\) first 'free' here \\(fndecl 'void __analyzer_foo\\(void\\*\\)', depth 2\\)" "1st free message" { target c++ } .-1 } */
+
+ __builtin_free (p); /* { dg-warning "double-'free' of 'q'" "warning" } */
+ /* { dg-message "\\(4\\) second 'free' here; first 'free' was at \\(3\\) \\(fndecl '__analyzer_foo', depth 2\\)" "2nd free message" { target c } .-1 } */
+ /* { dg-message "\\(4\\) second 'free' here; first 'free' was at \\(3\\) \\(fndecl 'void __analyzer_foo\\(void\\*\\)', depth 2\\)" "2nd free message" { target c++ } .-2 } */
+}
+
+void bar (void *q) /* { dg-message "\\(1\\) entry to 'bar' \\(fndecl 'bar', depth 1\\)" "" { target c } } */
+/* { dg-message "\\(1\\) entry to 'bar' \\(fndecl 'void bar\\(void\\*\\)', depth 1\\)" "" { target c++ } .-1 } */
+{
+ __analyzer_foo (q); /* { dg-message "\\(2\\) inlined call to '__analyzer_foo' from 'bar' \\(fndecl 'bar', depth 1\\)" "" { target c } } */
+ /* { dg-message "\\(2\\) inlined call to '__analyzer_foo' from 'bar' \\(fndecl 'void bar\\(void\\*\\)', depth 1\\)" "" { target c++ } .-1 } */
+}
| |
| (5) second 'free' here; first 'free' was at (3)
|
- { dg-end-multiline-output "" } */
+ { dg-end-multiline-output "" { target c } } */
+/* { dg-begin-multiline-output "" }
+ __builtin_free (p);
+ ~~~~~~~~~~~~~~~^~~
+ 'void outer(void*)': events 1-2 (depth 1)
+ |
+ | outer (void *r)
+ | ^~~~~
+ | |
+ | (1) entry to 'outer'
+ |
+ | middle (r);
+ | ~
+ | |
+ | (2) inlined call to 'middle' from 'outer'
+ |
+ +--> 'void middle(void*)': events 3-4 (depth 2)
+ |
+ | __builtin_free (q);
+ | ~~~~~~~~~~~~~~~^~~
+ | |
+ | (3) first 'free' here
+ | inner (q);
+ | ~
+ | |
+ | (4) inlined call to 'inner' from 'middle'
+ |
+ +--> 'void inner(void*)': event 5 (depth 3)
+ |
+ | __builtin_free (p);
+ | ~~~~~~~~~~~~~~~^~~
+ | |
+ | (5) second 'free' here; first 'free' was at (3)
+ |
+ { dg-end-multiline-output "" { target c++ } } */
--- /dev/null
+/* Verify that we can reconstruct fndecl and stack depth information
+ after early inlining. */
+
+/* { dg-additional-options "-O2 -fdiagnostics-show-path-depths" } */
+
+static inline void
+inner (void *p)
+{
+ __builtin_free (p); /* { dg-warning "double-'free' of 'r'" } */
+ /* { dg-message "\\(5\\) second 'free' here; first 'free' was at \\(3\\) \\(fndecl 'inner', depth 3\\)" "2nd free message" { target c } .-1 } */
+ /* { dg-message "\\(5\\) second 'free' here; first 'free' was at \\(3\\) \\(fndecl 'void inner\\(void\\*\\)', depth 3\\)" "2nd free message" { target c++ } .-2 } */
+}
+
+static inline void
+middle (void *q)
+{
+ __builtin_free (q); /* { dg-message "\\(3\\) first 'free' here \\(fndecl 'middle', depth 2\\)" "1st free message" { target c } } */
+ /* { dg-message "\\(3\\) first 'free' here \\(fndecl 'void middle\\(void\\*\\)', depth 2\\)" "1st free message" { target c++ } .-1 } */
+ inner (q); /* { dg-message "\\(4\\) inlined call to 'inner' from 'middle' \\(fndecl 'middle', depth 2\\)" "" { target c } } */
+ /* { dg-message "\\(4\\) inlined call to 'inner' from 'middle' \\(fndecl 'void middle\\(void\\*\\)', depth 2\\)" "" { target c++ } .-1 } */
+}
+
+void
+outer (void *r) /* { dg-message "\\(1\\) entry to 'outer' \\(fndecl 'outer', depth 1\\)" "" { target c } } */
+/* { dg-message "\\(1\\) entry to 'outer' \\(fndecl 'void outer\\(void\\*\\)', depth 1\\)" "" { target c++ } .-1 } */
+{
+ middle (r); /* { dg-message "\\(2\\) inlined call to 'middle' from 'outer' \\(fndecl 'outer', depth 1\\)" "" { target c } } */
+ /* { dg-message "\\(2\\) inlined call to 'middle' from 'outer' \\(fndecl 'void outer\\(void\\*\\)', depth 1\\)" "" { target c++ } .-1 } */
+}
| |
| (5) second 'free' here; first 'free' was at (4)
|
- { dg-end-multiline-output "" } */
+ { dg-end-multiline-output "" { target c } } */
+/* { dg-begin-multiline-output "" }
+ __builtin_free (q);
+ ~~~~~~~~~~~~~~~^~~
+ 'void outer(void*)': events 1-2 (depth 1)
+ |
+ | outer (void *r)
+ | ^~~~~
+ | |
+ | (1) entry to 'outer'
+ |
+ | middle (r);
+ | ~
+ | |
+ | (2) inlined call to 'middle' from 'outer'
+ |
+ +--> 'void middle(void*)': event 3 (depth 2)
+ |
+ | inner (q);
+ | ^
+ | |
+ | (3) inlined call to 'inner' from 'middle'
+ |
+ +--> 'void inner(void*)': event 4 (depth 3)
+ |
+ | __builtin_free (p);
+ | ~~~~~~~~~~~~~~~^~~
+ | |
+ | (4) first 'free' here
+ |
+ <------+
+ |
+ 'void middle(void*)': event 5 (depth 2)
+ |
+ | __builtin_free (q);
+ | ~~~~~~~~~~~~~~~^~~
+ | |
+ | (5) second 'free' here; first 'free' was at (4)
+ |
+ { dg-end-multiline-output "" { target c++ } } */
| |
| (11) second 'free' here; first 'free' was at (7)
|
- { dg-end-multiline-output "" } */
+ { dg-end-multiline-output "" { target c } } */
+/* { dg-begin-multiline-output "" }
+ __builtin_free (p);
+ ~~~~~~~~~~~~~~~^~~
+ 'void depth_1(void*)': events 1-2 (depth 1)
+ |
+ | depth_1 (void *p1)
+ | ^~~~~~~
+ | |
+ | (1) entry to 'depth_1'
+ |
+ | depth_2 (p1);
+ | ~
+ | |
+ | (2) inlined call to 'depth_2' from 'depth_1'
+ |
+ +--> 'void depth_2(void*)': event 3 (depth 2)
+ |
+ | depth_3 (p2);
+ | ^
+ | |
+ | (3) inlined call to 'depth_3' from 'depth_2'
+ |
+ +--> 'void depth_3(void*)': event 4 (depth 3)
+ |
+ | depth_4 (p3);
+ | ^
+ | |
+ | (4) inlined call to 'depth_4' from 'depth_3'
+ |
+ +--> 'void depth_4(void*)': event 5 (depth 4)
+ |
+ | depth_5 (p4);
+ | ^
+ | |
+ | (5) inlined call to 'depth_5' from 'depth_4'
+ |
+ +--> 'void depth_5(void*)': event 6 (depth 5)
+ |
+ | depth_6 (p5);
+ | ^
+ | |
+ | (6) inlined call to 'depth_6' from 'depth_5'
+ |
+ +--> 'void depth_6(void*)': event 7 (depth 6)
+ |
+ | __builtin_free (p);
+ | ~~~~~~~~~~~~~~~^~~
+ | |
+ | (7) first 'free' here
+ |
+ <--------------------+
+ |
+ 'void depth_3(void*)': event 8 (depth 3)
+ |
+ | depth_4 (p3);
+ | ^
+ | |
+ | (8) inlined call to 'depth_4' from 'depth_3'
+ |
+ +--> 'void depth_4(void*)': event 9 (depth 4)
+ |
+ | depth_5 (p4);
+ | ^
+ | |
+ | (9) inlined call to 'depth_5' from 'depth_4'
+ |
+ +--> 'void depth_5(void*)': event 10 (depth 5)
+ |
+ | depth_6 (p5);
+ | ^
+ | |
+ | (10) inlined call to 'depth_6' from 'depth_5'
+ |
+ +--> 'void depth_6(void*)': event 11 (depth 6)
+ |
+ | __builtin_free (p);
+ | ~~~~~~~~~~~~~~~^~~
+ | |
+ | (11) second 'free' here; first 'free' was at (7)
+ |
+ { dg-end-multiline-output "" { target c++ } } */
--- /dev/null
+/* Verify that we can reconstruct fndecl and stack depth information
+ after early inlining. */
+
+/* { dg-additional-options "-O2 -fdiagnostics-show-path-depths" } */
+
+/* We want the reconstructed call/return hierarchy to show
+ that two calls happen at depth_3, without any spurious events
+ popping the stack back any further. */
+
+static inline void
+depth_6 (void *p)
+{
+ __builtin_free (p); /* { dg-warning "double-'free' of 'p1'" "warning" } */
+ /* { dg-message "\\(7\\) first 'free' here \\(fndecl 'depth_6', depth 6\\)" "1st free message" { target c } .-1 } */
+ /* { dg-message "\\(7\\) first 'free' here \\(fndecl 'void depth_6\\(void\\*\\)', depth 6\\)" "1st free message" { target c++ } .-2 } */
+ /* { dg-message "\\(11\\) second 'free' here; first 'free' was at \\(7\\) \\(fndecl 'depth_6', depth 6\\)" "2nd free message" { target c } .-3 } */
+ /* { dg-message "\\(11\\) second 'free' here; first 'free' was at \\(7\\) \\(fndecl 'void depth_6\\(void\\*\\)', depth 6\\)" "2nd free message" { target c++ } .-4 } */
+}
+
+static inline void
+depth_5 (void *p5)
+{
+ depth_6 (p5); /* { dg-message "\\(6\\) inlined call to 'depth_6' from 'depth_5' \\(fndecl 'depth_5', depth 5\\)" "event 6" { target c } } */
+ /* { dg-message "\\(6\\) inlined call to 'depth_6' from 'depth_5' \\(fndecl 'void depth_5\\(void\\*\\)', depth 5\\)" "event 6" { target c++ } .-1 } */
+ /* { dg-message "\\(10\\) inlined call to 'depth_6' from 'depth_5' \\(fndecl 'depth_5', depth 5\\)" "event 10" { target c } .-2 } */
+ /* { dg-message "\\(10\\) inlined call to 'depth_6' from 'depth_5' \\(fndecl 'void depth_5\\(void\\*\\)', depth 5\\)" "event 10" { target c++ } .-3 } */
+}
+
+static inline void
+depth_4 (void *p4)
+{
+ depth_5 (p4); /* { dg-message "\\(5\\) inlined call to 'depth_5' from 'depth_4' \\(fndecl 'depth_4', depth 4\\)" "event 5" { target c } } */
+ /* { dg-message "\\(5\\) inlined call to 'depth_5' from 'depth_4' \\(fndecl 'void depth_4\\(void\\*\\)', depth 4\\)" "event 5" { target c++ } .-1 } */
+ /* { dg-message "\\(9\\) inlined call to 'depth_5' from 'depth_4' \\(fndecl 'depth_4', depth 4\\)" "event 9" { target c } .-2 } */
+ /* { dg-message "\\(9\\) inlined call to 'depth_5' from 'depth_4' \\(fndecl 'void depth_4\\(void\\*\\)', depth 4\\)" "event 9" { target c++ } .-3 } */
+}
+
+static inline void
+depth_3 (void *p3)
+{
+ depth_4 (p3); /* { dg-message "\\(4\\) inlined call to 'depth_4' from 'depth_3' \\(fndecl 'depth_3', depth 3\\)" "" { target c } } */
+ /* { dg-message "\\(4\\) inlined call to 'depth_4' from 'depth_3' \\(fndecl 'void depth_3\\(void\\*\\)', depth 3\\)" "" { target c++ } .-1 } */
+ depth_4 (p3); /* { dg-message "\\(8\\) inlined call to 'depth_4' from 'depth_3' \\(fndecl 'depth_3', depth 3\\)" "" { target c } } */
+ /* { dg-message "\\(8\\) inlined call to 'depth_4' from 'depth_3' \\(fndecl 'void depth_3\\(void\\*\\)', depth 3\\)" "" { target c++ } .-1 } */
+}
+
+static inline void
+depth_2 (void *p2)
+{
+ depth_3 (p2); /* { dg-message "\\(3\\) inlined call to 'depth_3' from 'depth_2' \\(fndecl 'depth_2', depth 2\\)" "" { target c } } */
+ /* { dg-message "\\(3\\) inlined call to 'depth_3' from 'depth_2' \\(fndecl 'void depth_2\\(void\\*\\)', depth 2\\)" "" { target c++ } .-1 } */
+}
+
+void
+depth_1 (void *p1) /* { dg-message "\\(1\\) entry to 'depth_1' \\(fndecl 'depth_1', depth 1\\)" "" { target c } } */
+/* { dg-message "\\(1\\) entry to 'depth_1' \\(fndecl 'void depth_1\\(void\\*\\)', depth 1\\)" "" { target c++ } .-1 } */
+{
+ depth_2 (p1); /* { dg-message "\\(2\\) inlined call to 'depth_2' from 'depth_1' \\(fndecl 'depth_1', depth 1\\)" "" { target c } } */
+ /* { dg-message "\\(2\\) inlined call to 'depth_2' from 'depth_1' \\(fndecl 'void depth_1\\(void\\*\\)', depth 1\\)" "" { target c++ } .-1 } */
+}
/* { dg-skip-if "" { "avr-*-*" } } */
#include <errno.h>
-#include "analyzer-decls.h"
+#include "../../gcc.dg/analyzer/analyzer-decls.h"
extern int isatty(int fd);
extern int close(int fd);
#include <stdlib.h>
+#include "../../gcc.dg/analyzer/analyzer-decls.h"
void *ptr;
-void *test (void)
+void test (void)
{
ptr = malloc (1024);
ptr = NULL; /* { dg-warning "leak of 'ptr'" } */
void test_1 (void)
{
- struct s1 *a = malloc (sizeof (struct s1));
+ struct s1 *a = (struct s1 *) malloc (sizeof (struct s1));
if (!a)
return;
a->ptr = malloc (1024); /* { dg-message "allocated here" } */
{
struct s2 arr[5];
arr[3].m_arr[4] = malloc (1024); /* { dg-message "allocated here" } */
-} /* { dg-warning "leak of 'arr\\\[3\\\].m_arr\\\[4\\\]'" } */
+} /* { dg-warning "leak of 'arr\\\[3\\\].m_arr\\\[4\\\]'" "" { target c } } */
+/* { dg-warning "leak of 'arr\\\[3\\\].s2::m_arr\\\[4\\\]'" "" { target c++ } .-1 } */
void test_2b (int i)
{
struct s2 arr[5];
arr[3].m_arr[i] = malloc (1024); /* { dg-message "allocated here" } */
-} /* { dg-warning "leak of 'arr\\\[3\\\].m_arr\\\[i\\\]'" } */
+} /* { dg-warning "leak of 'arr\\\[3\\\].m_arr\\\[i\\\]'" "" { target c } } */
+/* { dg-warning "leak of 'arr\\\[3\\\].s2::m_arr\\\[i\\\]'" "" { target c++ } .-1 } */
void test_2c (int i)
{
struct s2 arr[5];
arr[i].m_arr[4] = malloc (1024); /* { dg-message "allocated here" } */
-} /* { dg-warning "leak of 'arr\\\[i\\\].m_arr\\\[4\\\]'" } */
+} /* { dg-warning "leak of 'arr\\\[i\\\].m_arr\\\[4\\\]'" "" { target c } } */
+/* { dg-warning "leak of 'arr\\\[i\\\].s2::m_arr\\\[4\\\]'" "" { target c++ } .-1 } */
+
void test_2d (int i, int j)
{
struct s2 arr[5];
arr[i].m_arr[j] = malloc (1024); /* { dg-message "allocated here" } */
-} /* { dg-warning "leak of 'arr\\\[i\\\].m_arr\\\[j\\\]'" } */
+} /* { dg-warning "leak of 'arr\\\[i\\\].m_arr\\\[j\\\]'" "" { target c } } */
+/* { dg-warning "leak of 'arr\\\[i\\\].s2::m_arr\\\[j\\\]'" "" { target c++ } .-1 } */
/* Example involving fields. */
void test_3 (void)
{
- struct s3 *a = malloc (sizeof (struct s3));
- a->m_right = malloc (sizeof (struct s3)); /* { dg-warning "dereference of possibly-NULL 'a'" } */
- a->m_right->m_left = malloc (sizeof (struct s3)); /* { dg-warning "dereference of possibly-NULL '\\*a.m_right'" } */
+ struct s3 *a = (struct s3 *) malloc (sizeof (struct s3));
+ a->m_right = (struct s3 *) malloc (sizeof (struct s3)); /* { dg-warning "dereference of possibly-NULL 'a'" } */
+ a->m_right->m_left = (struct s3 *) malloc (sizeof (struct s3)); /* { dg-warning "dereference of possibly-NULL '\\*a.m_right'" "" { target c } } */
+ /* { dg-warning "dereference of possibly-NULL '\\*a.s3::m_right'" "" { target c++ } .-1 } */
} /* { dg-warning "leak of 'a'" "leak of a" } */
/* { dg-warning "leak of '<unknown>'" "leak of unknown" { target *-*-* } .-1 } */
/* TODO: rather than '<unknown>', we should print 'a->m_right'
static struct s4_sub *
make_s4_sub (void)
{
- struct s4_sub *sub = malloc (sizeof (struct s4_sub)); /* { dg-message "allocated here" } */
+ struct s4_sub *sub = (struct s4_sub *) malloc (sizeof (struct s4_sub)); /* { dg-message "allocated here" } */
if (!sub)
return NULL;
sub->m_buffer = malloc (1024); /* { dg-message "allocated here" } */
#include <stdlib.h>
-#include "analyzer-decls.h"
+#include "../../gcc.dg/analyzer/analyzer-decls.h"
struct iter
{
struct iter *it = iter_new (0, n, 1);
while (!iter_done_p (it))
{
- __analyzer_eval (it->val < n); /* { dg-warning "TRUE" "true" { xfail *-*-* } } */
+ __analyzer_eval (it->val < n); /* { dg-warning "TRUE" "true" } */
/* { dg-bogus "UNKNOWN" "unknown" { xfail *-*-* } .-1 } */
/* TODO(xfail^^^): ideally we ought to figure out i > 0 after 1st iteration. */
-#include "analyzer-decls.h"
+#include "../../gcc.dg/analyzer/analyzer-decls.h"
void test(int n)
{
/* { dg-additional-options "-fno-analyzer-state-purge" } */
-#include "analyzer-decls.h"
+#include "../../gcc.dg/analyzer/analyzer-decls.h"
struct s
{
/* { dg-additional-options "-fno-analyzer-state-purge" } */
-#include "analyzer-decls.h"
+#include "../../gcc.dg/analyzer/analyzer-decls.h"
union u
{
/* Example of nested loops. */
-#include "analyzer-decls.h"
+#include "../../gcc.dg/analyzer/analyzer-decls.h"
void test(void)
{
-#include "analyzer-decls.h"
+#include "../../gcc.dg/analyzer/analyzer-decls.h"
void test(int n)
{
-#include "analyzer-decls.h"
+#include "../../gcc.dg/analyzer/analyzer-decls.h"
void test(int start, int end, int step)
{
-#include "analyzer-decls.h"
+#include "../../gcc.dg/analyzer/analyzer-decls.h"
void test(int start, int end, int step)
{
-#include "analyzer-decls.h"
+#include "../../gcc.dg/analyzer/analyzer-decls.h"
void test(int start, int end, int step)
{
-#include "analyzer-decls.h"
+#include "../../gcc.dg/analyzer/analyzer-decls.h"
void test(int start, int end)
{
-#include "analyzer-decls.h"
+#include "../../gcc.dg/analyzer/analyzer-decls.h"
void test(void)
{
/* Don't complain about leaks due to exiting from "main". */
-void main (void)
+int main (void)
{
void *p = malloc (1024);
+ return 0;
}
void *p = malloc (sizeof (int));
if (!p)
return;
- int *q = p;
+ int *q = (int *) p;
if (!q)
return;
free (q);
/* do something interesting with bar */
/* ... */
- free(bar); /* { dg-warning "'free' of '&bar' which points to memory on the stack" } */
+ free(bar); /* { dg-warning "'free' of '&bar' which points to memory on the stack" "" { target c } } */
+ /* { dg-warning "'free' of '& bar' which points to memory on the stack" "" { target c++ } .-1 } */
}
record_t bar[MAX_SIZE]; //Global var
/* do something interesting with bar */
/* ... */
- free(bar); /* { dg-warning "'free' of '&bar' which points to memory not on the heap" } */
+ free(bar); /* { dg-warning "'free' of '&bar' which points to memory not on the heap" "" { target c } } */
+ /* { dg-warning "'free' of '& bar' which points to memory not on the heap" "" { target c++ } .-1 } */
}
int *test_4 (void)
{
allocator_t alloc_fn = get_malloc ();
- int *ptr = alloc_fn (sizeof (int)); /* { dg-message "this call could return NULL" } */
+ int *ptr = (int *) alloc_fn (sizeof (int)); /* { dg-message "this call could return NULL" } */
*ptr = 42; /* { dg-warning "dereference of possibly-NULL 'ptr'" } */
return ptr;
}
-int *test_5 (void)
+void test_5 (void)
{
allocator_t alloc_fn = get_alloca ();
deallocator_t dealloc_fn = get_free ();
- int *ptr = alloc_fn (sizeof (int)); /* dg-message "region created on stack here" } */
+ int *ptr = (int *) alloc_fn (sizeof (int)); /* dg-message "region created on stack here" } */
dealloc_fn (ptr); /* { dg-warning "'free' of 'ptr' which points to memory on the stack" } */
}
#include <stdlib.h>
-#include "analyzer-decls.h"
+#include "../../gcc.dg/analyzer/analyzer-decls.h"
extern void foo (int *);
| | (11) ...to here
| | (12) second 'free' here; first 'free' was at (6)
|
- { dg-end-multiline-output "" } */
+ { dg-end-multiline-output "" { target c } } */
+/* { dg-begin-multiline-output "" }
+ NN | free (victim);
+ | ~~~~~^~~~~~~~
+ 'void test(void*)': events 1-2
+ |
+ | NN | void test (void *ptr)
+ | | ^~~~
+ | | |
+ | | (1) entry to 'test'
+ |......
+ | NN | may_call_free (ptr);
+ | | ~~~~~~~~~~~~~~~~~~~
+ | | |
+ | | (2) calling 'may_call_free' from 'test'
+ |
+ +--> 'void may_call_free(void*)': events 3-6
+ |
+ | NN | may_call_free (void *victim)
+ | | ^~~~~~~~~~~~~
+ | | |
+ | | (3) entry to 'may_call_free'
+ | NN | {
+ | NN | if (some_condition ())
+ | | ~~
+ | | |
+ | | (4) following 'false' branch...
+ |......
+ | NN | free (victim);
+ | | ~~~~~~~~~~~~~
+ | | |
+ | | (5) ...to here
+ | | (6) first 'free' here
+ |
+ <------+
+ |
+ 'void test(void*)': events 7-8
+ |
+ | NN | may_call_free (ptr);
+ | | ~~~~~~~~~~~~~~^~~~~
+ | | |
+ | | (7) returning to 'test' from 'may_call_free'
+ |......
+ | NN | may_call_free (ptr);
+ | | ~~~~~~~~~~~~~~~~~~~
+ | | |
+ | | (8) passing freed pointer 'ptr' in call to 'may_call_free' from 'test'
+ |
+ +--> 'void may_call_free(void*)': events 9-12
+ |
+ | NN | may_call_free (void *victim)
+ | | ^~~~~~~~~~~~~
+ | | |
+ | | (9) entry to 'may_call_free'
+ | NN | {
+ | NN | if (some_condition ())
+ | | ~~
+ | | |
+ | | (10) following 'false' branch...
+ |......
+ | NN | free (victim);
+ | | ~~~~~~~~~~~~~
+ | | |
+ | | (11) ...to here
+ | | (12) second 'free' here; first 'free' was at (6)
+ |
+ { dg-end-multiline-output "" { target c++ } } */
void test(void *p)
{
- calls_free(p);
+ calls_free((int *) p);
free(p); /* { dg-warning "double-'free' of 'p'" } */
}
static int *calls_malloc(void)
{
- return malloc(sizeof(int));
+ return (int *) malloc(sizeof(int));
}
int *test(void)
void test_1(void *p)
{
- maybe_calls_free_1(p, 1);
- maybe_calls_free_1(p, 1);
+ maybe_calls_free_1((int *) p, 1);
+ maybe_calls_free_1((int *) p, 1);
}
/**************************************************************************/
void test_2(void *p)
{
- maybe_calls_free_2(p, 0);
- maybe_calls_free_2(p, 0);
+ maybe_calls_free_2((int *) p, 0);
+ maybe_calls_free_2((int *) p, 0);
}
| | |
| | (6) 'result' could be NULL: unchecked value from (4)
|
- { dg-end-multiline-output "" } */
+ { dg-end-multiline-output "" { target c } } */
+/* { dg-begin-multiline-output "" }
+ NN | result->i = i;
+ | ~~~~~~~~~~^~~
+ 'boxed_int* make_boxed_int(int)': events 1-2
+ |
+ | NN | make_boxed_int (int i)
+ | | ^~~~~~~~~~~~~~
+ | | |
+ | | (1) entry to 'make_boxed_int'
+ | NN | {
+ | NN | boxed_int *result = (boxed_int *)wrapped_malloc (sizeof (boxed_int));
+ | | ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
+ | | |
+ | | (2) calling 'wrapped_malloc' from 'make_boxed_int'
+ |
+ +--> 'void* wrapped_malloc(size_t)': events 3-4
+ |
+ | NN | void *wrapped_malloc (size_t size)
+ | | ^~~~~~~~~~~~~~
+ | | |
+ | | (3) entry to 'wrapped_malloc'
+ | NN | {
+ | NN | return malloc (size);
+ | | ~~~~~~~~~~~~~
+ | | |
+ | | (4) this call could return NULL
+ |
+ <------+
+ |
+ 'boxed_int* make_boxed_int(int)': events 5-6
+ |
+ | NN | boxed_int *result = (boxed_int *)wrapped_malloc (sizeof (boxed_int));
+ | | ~~~~~~~~~~~~~~~^~~~~~~~~~~~~~~~~~~~
+ | | |
+ | | (5) possible return of NULL to 'make_boxed_int' from 'wrapped_malloc'
+ | NN | result->i = i;
+ | | ~~~~~~~~~~~~~
+ | | |
+ | | (6) 'result' could be NULL: unchecked value from (4)
+ |
+ { dg-end-multiline-output "" { target c++ } } */
/* { dg-warning "double-'free' of 'ptr'" "" { target *-*-* } 2 } */
-int test (void *ptr)
+void test (void *ptr)
{
WRAPPED_FREE (ptr); /* { dg-message "in expansion of macro 'WRAPPED_FREE'" } */
WRAPPED_FREE (ptr); /* { dg-message "in expansion of macro 'WRAPPED_FREE'" } */
| NN | WRAPPED_FREE (ptr);
| | ^~~~~~~~~~~~
|
- { dg-end-multiline-output "" } */
+ { dg-end-multiline-output "" { target c } } */
+ /* { dg-begin-multiline-output "" }
+ NN | #define WRAPPED_FREE(PTR) free(PTR)
+ | ~~~~^~~~~
+ NN | WRAPPED_FREE (ptr);
+ | ^~~~~~~~~~~~
+ 'void test(void*)': event 1
+ |
+ |
+ | NN | #define WRAPPED_FREE(PTR) free(PTR)
+ | | ~~~~^~~~~
+ | | |
+ | | (1) first 'free' here
+ | NN | WRAPPED_FREE (ptr);
+ | | ^~~~~~~~~~~~
+ |
+ 'void test(void*)': event 2
+ |
+ |
+ | NN | #define WRAPPED_FREE(PTR) free(PTR)
+ | | ~~~~^~~~~
+ | | |
+ | | (2) second 'free' here; first 'free' was at (1)
+ | NN | WRAPPED_FREE (ptr);
+ | | ^~~~~~~~~~~~
+ |
+ { dg-end-multiline-output "" { target c++ } } */
}
/* { dg-message "first 'free' here" "1st free event" { target *-*-* } 2 } */
/* { dg-message "second 'free' here" "2nd free event" { target *-*-* } 2 } */
-int test (void *ptr)
+void test (void *ptr)
{
WRAPPED_FREE (ptr); /* { dg-message "in expansion of macro 'WRAPPED_FREE'" } */
WRAPPED_FREE (ptr); /* { dg-message "in expansion of macro 'WRAPPED_FREE'" } */
--- /dev/null
+/* { dg-additional-options "-fdiagnostics-show-line-numbers -fdiagnostics-path-format=inline-events -fdiagnostics-show-caret -fno-exceptions" } */
+/* { dg-enable-nn-line-numbers "" } */
+
+#include <stdlib.h>
+
+void test_1 (void)
+{
+ void *ptr = malloc (1024);
+ free (ptr);
+ free (ptr); /* { dg-warning "double-'free' of 'ptr'" } */
+}
+/* { dg-begin-multiline-output "" }
+ NN | free (ptr);
+ | ^~~~~~~~~~
+ 'test_1': events 1-3
+ |
+ | NN | void *ptr = malloc (1024);
+ | | ^~~~~~~~~~~~~
+ | | |
+ | | (1) allocated here
+ | NN | free (ptr);
+ | | ~~~~~~~~~~
+ | | |
+ | | (2) first 'free' here
+ | NN | free (ptr);
+ | | ~~~~~~~~~~
+ | | |
+ | | (3) second 'free' here; first 'free' was at (2)
+ |
+ { dg-end-multiline-output "" { target c } } */
+/* { dg-begin-multiline-output "" }
+ NN | free (ptr);
+ | ~~~~~^~~~~
+ 'void test_1()': events 1-3
+ |
+ | NN | void *ptr = malloc (1024);
+ | | ~~~~~~~^~~~~~
+ | | |
+ | | (1) allocated here
+ | NN | free (ptr);
+ | | ~~~~~~~~~~
+ | | |
+ | | (2) first 'free' here
+ | NN | free (ptr);
+ | | ~~~~~~~~~~
+ | | |
+ | | (3) second 'free' here; first 'free' was at (2)
+ |
+ { dg-end-multiline-output "" { target c++ } } */
+
+void test_2 (int x, int y)
+{
+ void *ptr = malloc (1024);
+ if (x)
+ free (ptr);
+ if (y)
+ free (ptr); /* { dg-warning "double-'free' of 'ptr'" } */
+} /* { dg-warning "leak of 'ptr'" } */
+
+/* "double-'free' of 'ptr'". */
+/* { dg-begin-multiline-output "" }
+ NN | free (ptr);
+ | ^~~~~~~~~~
+ 'test_2': events 1-7
+ |
+ | NN | void *ptr = malloc (1024);
+ | | ^~~~~~~~~~~~~
+ | | |
+ | | (1) allocated here
+ | NN | if (x)
+ | | ~
+ | | |
+ | | (2) following 'true' branch (when 'x != 0')...
+ | NN | free (ptr);
+ | | ~~~~~~~~~~
+ | | |
+ | | (3) ...to here
+ | | (4) first 'free' here
+ | NN | if (y)
+ | | ~
+ | | |
+ | | (5) following 'true' branch (when 'y != 0')...
+ | NN | free (ptr);
+ | | ~~~~~~~~~~
+ | | |
+ | | (6) ...to here
+ | | (7) second 'free' here; first 'free' was at (4)
+ |
+ { dg-end-multiline-output "" { target c } } */
+/* { dg-begin-multiline-output "" }
+ NN | free (ptr);
+ | ~~~~~^~~~~
+ 'void test_2(int, int)': events 1-7
+ |
+ | NN | void *ptr = malloc (1024);
+ | | ~~~~~~~^~~~~~
+ | | |
+ | | (1) allocated here
+ | NN | if (x)
+ | | ~~
+ | | |
+ | | (2) following 'true' branch (when 'x != 0')...
+ | NN | free (ptr);
+ | | ~~~~~~~~~~
+ | | |
+ | | (3) ...to here
+ | | (4) first 'free' here
+ | NN | if (y)
+ | | ~~
+ | | |
+ | | (5) following 'true' branch (when 'y != 0')...
+ | NN | free (ptr);
+ | | ~~~~~~~~~~
+ | | |
+ | | (6) ...to here
+ | | (7) second 'free' here; first 'free' was at (4)
+ |
+ { dg-end-multiline-output "" { target c++ } } */
+
+/* "leak of 'ptr'. */
+/* { dg-begin-multiline-output "" }
+ NN | }
+ | ^
+ 'test_2': events 1-6
+ |
+ | NN | void *ptr = malloc (1024);
+ | | ^~~~~~~~~~~~~
+ | | |
+ | | (1) allocated here
+ | NN | if (x)
+ | | ~
+ | | |
+ | | (2) following 'false' branch (when 'x == 0')...
+ | NN | free (ptr);
+ | NN | if (y)
+ | | ~
+ | | |
+ | | (3) ...to here
+ | | (4) following 'false' branch (when 'y == 0')...
+ | NN | free (ptr);
+ | NN | }
+ | | ~
+ | | |
+ | | (5) ...to here
+ | | (6) 'ptr' leaks here; was allocated at (1)
+ |
+ { dg-end-multiline-output "" { target c } } */
+/* { dg-begin-multiline-output "" }
+ NN | }
+ | ^
+ 'void test_2(int, int)': events 1-6
+ |
+ | NN | void *ptr = malloc (1024);
+ | | ~~~~~~~^~~~~~
+ | | |
+ | | (1) allocated here
+ | NN | if (x)
+ | | ~~
+ | | |
+ | | (2) following 'false' branch (when 'x == 0')...
+ | NN | free (ptr);
+ | NN | if (y)
+ | | ~~
+ | | |
+ | | (3) ...to here
+ | | (4) following 'false' branch (when 'y == 0')...
+ | NN | free (ptr);
+ | NN | }
+ | | ~
+ | | |
+ | | (5) ...to here
+ | | (6) 'ptr' leaks here; was allocated at (1)
+ |
+ { dg-end-multiline-output "" { target c++ } } */
+
+int test_3 (int x, int y)
+{
+ int *ptr = (int *)malloc (sizeof (int));
+ *ptr = 42; /* { dg-warning "dereference of possibly-NULL 'ptr'" } */
+ if (x)
+ free (ptr);
+
+ *ptr = 19; /* { dg-warning "use after 'free' of 'ptr'" } */
+ // TODO: two warnings here: one is from sm-malloc, the other from region model
+
+ if (y)
+ free (ptr); /* No double-'free' warning: we've already attempted
+ to dereference it above. */
+ return *ptr; /* { dg-warning "use after 'free' of 'ptr'" "use-after-free" } */
+ /* { dg-warning "leak of 'ptr'" "leak" { target *-*-* } .-1 } */
+}
+
+/* "dereference of possibly-NULL 'ptr'". */
+/* { dg-begin-multiline-output "" }
+ NN | *ptr = 42;
+ | ~~~~~^~~~
+ 'test_3': events 1-2
+ |
+ | NN | int *ptr = (int *)malloc (sizeof (int));
+ | | ^~~~~~~~~~~~~~~~~~~~~
+ | | |
+ | | (1) this call could return NULL
+ | NN | *ptr = 42;
+ | | ~~~~~~~~~
+ | | |
+ | | (2) 'ptr' could be NULL: unchecked value from (1)
+ |
+ { dg-end-multiline-output "" { target c } } */
+/* { dg-begin-multiline-output "" }
+ NN | *ptr = 42;
+ | ~~~~~^~~~
+ 'int test_3(int, int)': events 1-2
+ |
+ | NN | int *ptr = (int *)malloc (sizeof (int));
+ | | ~~~~~~~^~~~~~~~~~~~~~
+ | | |
+ | | (1) this call could return NULL
+ | NN | *ptr = 42;
+ | | ~~~~~~~~~
+ | | |
+ | | (2) 'ptr' could be NULL: unchecked value from (1)
+ |
+ { dg-end-multiline-output "" { target c++ } } */
+
+/* "use after 'free' of 'ptr'". */
+/* { dg-begin-multiline-output "" }
+ NN | *ptr = 19;
+ | ~~~~~^~~~
+ 'test_3': events 1-6
+ |
+ | NN | int *ptr = (int *)malloc (sizeof (int));
+ | | ^~~~~~~~~~~~~~~~~~~~~
+ | | |
+ | | (1) allocated here
+ | NN | *ptr = 42;
+ | | ~~~~~~~~~
+ | | |
+ | | (2) assuming 'ptr' is non-NULL
+ | NN | if (x)
+ | | ~
+ | | |
+ | | (3) following 'true' branch (when 'x != 0')...
+ | NN | free (ptr);
+ | | ~~~~~~~~~~
+ | | |
+ | | (4) ...to here
+ | | (5) freed here
+ | NN |
+ | NN | *ptr = 19;
+ | | ~~~~~~~~~
+ | | |
+ | | (6) use after 'free' of 'ptr'; freed at (5)
+ |
+ { dg-end-multiline-output "" { target c } } */
+/* { dg-begin-multiline-output "" }
+ NN | *ptr = 19;
+ | ~~~~~^~~~
+ 'int test_3(int, int)': events 1-6
+ |
+ | NN | int *ptr = (int *)malloc (sizeof (int));
+ | | ~~~~~~~^~~~~~~~~~~~~~
+ | | |
+ | | (1) allocated here
+ | NN | *ptr = 42;
+ | | ~~~~~~~~~
+ | | |
+ | | (2) assuming 'ptr' is non-NULL
+ | NN | if (x)
+ | | ~~
+ | | |
+ | | (3) following 'true' branch (when 'x != 0')...
+ | NN | free (ptr);
+ | | ~~~~~~~~~~
+ | | |
+ | | (4) ...to here
+ | | (5) freed here
+ | NN |
+ | NN | *ptr = 19;
+ | | ~~~~~~~~~
+ | | |
+ | | (6) use after 'free' of 'ptr'; freed at (5)
+ |
+ { dg-end-multiline-output "" { target c++ } } */
+
+/* "use after 'free' of 'ptr'". */
+/* { dg-begin-multiline-output "" }
+ NN | return *ptr;
+ | ^~~~
+ 'test_3': events 1-8
+ |
+ | NN | int *ptr = (int *)malloc (sizeof (int));
+ | | ^~~~~~~~~~~~~~~~~~~~~
+ | | |
+ | | (1) allocated here
+ | NN | *ptr = 42;
+ | | ~~~~~~~~~
+ | | |
+ | | (2) assuming 'ptr' is non-NULL
+ | NN | if (x)
+ | | ~
+ | | |
+ | | (3) following 'false' branch (when 'x == 0')...
+ |......
+ | NN | *ptr = 19;
+ | | ~~~~~~~~~
+ | | |
+ | | (4) ...to here
+ |......
+ | NN | if (y)
+ | | ~
+ | | |
+ | | (5) following 'true' branch (when 'y != 0')...
+ | NN | free (ptr);
+ | | ~~~~~~~~~~
+ | | |
+ | | (6) ...to here
+ | | (7) freed here
+ | NN |
+ | NN | return *ptr;
+ | | ~~~~
+ | | |
+ | | (8) use after 'free' of 'ptr'; freed at (7)
+ |
+ { dg-end-multiline-output "" { target c } } */
+/* { dg-begin-multiline-output "" }
+ NN | return *ptr;
+ | ^~~
+ 'int test_3(int, int)': events 1-8
+ |
+ | NN | int *ptr = (int *)malloc (sizeof (int));
+ | | ~~~~~~~^~~~~~~~~~~~~~
+ | | |
+ | | (1) allocated here
+ | NN | *ptr = 42;
+ | | ~~~~~~~~~
+ | | |
+ | | (2) assuming 'ptr' is non-NULL
+ | NN | if (x)
+ | | ~~
+ | | |
+ | | (3) following 'false' branch (when 'x == 0')...
+ |......
+ | NN | *ptr = 19;
+ | | ~~~~~~~~~
+ | | |
+ | | (4) ...to here
+ |......
+ | NN | if (y)
+ | | ~~
+ | | |
+ | | (5) following 'true' branch (when 'y != 0')...
+ | NN | free (ptr);
+ | | ~~~~~~~~~~
+ | | |
+ | | (6) ...to here
+ | | (7) freed here
+ | NN |
+ | NN | return *ptr;
+ | | ~~~
+ | | |
+ | | (8) use after 'free' of 'ptr'; freed at (7)
+ |
+ { dg-end-multiline-output "" { target c++ } } */
+
+/* "leak of 'ptr'". */
+/* { dg-begin-multiline-output "" }
+ NN | return *ptr;
+ | ^~~~
+ 'test_3': events 1-7
+ |
+ | NN | int *ptr = (int *)malloc (sizeof (int));
+ | | ^~~~~~~~~~~~~~~~~~~~~
+ | | |
+ | | (1) allocated here
+ | NN | *ptr = 42;
+ | | ~~~~~~~~~
+ | | |
+ | | (2) assuming 'ptr' is non-NULL
+ | NN | if (x)
+ | | ~
+ | | |
+ | | (3) following 'false' branch (when 'x == 0')...
+ |......
+ | NN | *ptr = 19;
+ | | ~~~~~~~~~
+ | | |
+ | | (4) ...to here
+ |......
+ | NN | if (y)
+ | | ~
+ | | |
+ | | (5) following 'false' branch (when 'y == 0')...
+ |......
+ | NN | return *ptr;
+ | | ~~~~
+ | | |
+ | | (6) ...to here
+ | | (7) 'ptr' leaks here; was allocated at (1)
+ |
+ { dg-end-multiline-output "" { target c } } */
+/* { dg-begin-multiline-output "" }
+ NN | return *ptr;
+ | ^~~
+ 'int test_3(int, int)': events 1-7
+ |
+ | NN | int *ptr = (int *)malloc (sizeof (int));
+ | | ~~~~~~~^~~~~~~~~~~~~~
+ | | |
+ | | (1) allocated here
+ | NN | *ptr = 42;
+ | | ~~~~~~~~~
+ | | |
+ | | (2) assuming 'ptr' is non-NULL
+ | NN | if (x)
+ | | ~~
+ | | |
+ | | (3) following 'false' branch (when 'x == 0')...
+ |......
+ | NN | *ptr = 19;
+ | | ~~~~~~~~~
+ | | |
+ | | (4) ...to here
+ |......
+ | NN | if (y)
+ | | ~~
+ | | |
+ | | (5) following 'false' branch (when 'y == 0')...
+ |......
+ | NN | return *ptr;
+ | | ~~~
+ | | |
+ | | (6) ...to here
+ | | (7) 'ptr' leaks here; was allocated at (1)
+ |
+ { dg-end-multiline-output "" { target c++ } } */
/* Reduced from SoftEtherVPN's src/Cedar/WebUI.c. */
-
-#define NULL ((void *)0)
+#include "../../gcc.dg/analyzer/analyzer-decls.h"
typedef int (COMPARE)(void *p1, void *p2);
typedef unsigned int UINT;
typedef unsigned long int UINT64;
#define LIST_DATA(o, i) (((o) != NULL) ? ((o)->p[(i)]) : NULL)
#define LIST_NUM(o) (((o) != NULL) ? (o)->num_item : 0)
-
+#ifdef __cplusplus
+#ifndef _Bool
+typedef bool _Bool;
+#endif
+#endif
struct STRMAP_ENTRY
{
for(i=0; i<LIST_NUM(Expired); i++)
{
- STRMAP_ENTRY *entry = LIST_DATA(Expired, i);
+ STRMAP_ENTRY *entry = (STRMAP_ENTRY*)LIST_DATA(Expired, i);
Delete(wu->Contexts, entry);
Free(entry->Name);
- WuFreeContext(entry->Value);
+ WuFreeContext((WU_CONTEXT*)entry->Value);
Free(entry);
}
ReleaseList(Expired);
void test4 (void)
{
- int *arr = malloc (4 * sizeof (int));
+ int *arr = (int *)malloc (4 * sizeof (int));
if (!arr)
return;
void test5 (void)
{
- int *arr = malloc (4 * sizeof (int));
+ int *arr = (int *)malloc (4 * sizeof (int));
if (!arr)
return;
extern int is_valid (void);
-int returnChunkSize (void *ptr)
+int returnChunkSize (int *ptr)
{
/* If chunk info is valid, return the size of usable memory,
else, return -1 to indicate an error. */
void test4 (void)
{
int n = 4;
- int *arr = malloc (n * sizeof (int));
+ int *arr = (int *)malloc (n * sizeof (int));
if (!arr)
return;
memset (arr, 0, n * sizeof(int));
void test5 (void)
{
int n = 4;
- int *arr = malloc (n * sizeof (int));
+ int *arr = (int *)malloc (n * sizeof (int));
if (!arr)
return;
memset (arr, 0, n * sizeof(int));
void test1 (size_t size)
{
- char *buf = __builtin_malloc (size);
+ char *buf = (char *)__builtin_malloc (size);
if (!buf) return;
buf[size] = '\0'; /* { dg-warning "heap-based buffer overflow" } */
void test2 (size_t size)
{
- char *buf = __builtin_malloc (size);
+ char *buf = (char *)__builtin_malloc (size);
if (!buf) return;
buf[size + 1] = '\0'; /* { dg-warning "heap-based buffer overflow" } */
void test3 (size_t size, size_t op)
{
- char *buf = __builtin_malloc (size);
+ char *buf = (char *)__builtin_malloc (size);
if (!buf) return;
buf[size + op] = '\0'; /* { dg-warning "heap-based buffer overflow" } */
void test4 (size_t size, unsigned short s)
{
- char *buf = __builtin_alloca (size);
+ char *buf = (char *)__builtin_alloca (size);
buf[size + s] = '\0'; /* { dg-warning "stack-based buffer overflow" } */
}
void test5 (size_t size)
{
- int32_t *buf = __builtin_alloca (4 * size);
+ int32_t *buf = (int32_t *)__builtin_alloca (4 * size);
buf[size] = 42; /* { dg-warning "stack-based buffer overflow" } */
}
void test6 (size_t size)
{
- int32_t *buf = __builtin_alloca (4 * size);
+ int32_t *buf = (int32_t *)__builtin_alloca (4 * size);
memset (buf, 0, 4 * size);
int32_t last = *(buf + 4 * size); /* { dg-warning "stack-based buffer over-read" } */
}
void test7 (size_t size)
{
- int32_t *buf = __builtin_alloca (4 * size + 3); /* { dg-warning "allocated buffer size is not a multiple of the pointee's size" } */
+ int32_t *buf = (int32_t *)__builtin_alloca (4 * size + 3); /* { dg-warning "allocated buffer size is not a multiple of the pointee's size" } */
buf[size] = 42; /* { dg-warning "stack-based buffer overflow" } */
}
void test11 (size_t size)
{
- int32_t *buf = __builtin_alloca (4 * size + 5); /* { dg-warning "allocated buffer size is not a multiple of the pointee's size" } */
+ int32_t *buf = (int32_t *)__builtin_alloca (4 * size + 5); /* { dg-warning "allocated buffer size is not a multiple of the pointee's size" } */
buf[size] = 42;
}
size_t len_x = __builtin_strlen (x);
size_t len_y = __builtin_strlen (y);
size_t sz = len_x + len_y + 1;
- char *result = __builtin_malloc (sz);
+ char *result = (char *)__builtin_malloc (sz);
if (!result)
return NULL;
__builtin_memcpy (result, x, len_x);
size_t len_y = __builtin_strlen (y);
/* BUG (root cause): forgot to add 1 for terminator. */
size_t sz = len_x + len_y;
- char *result = __builtin_malloc (sz);
+ char *result = (char *)__builtin_malloc (sz);
if (!result)
return NULL;
__builtin_memcpy (result, x, len_x);
void test6 (size_t size)
{
- int32_t *buf = __builtin_alloca (4 * size);
+ int32_t *buf = (int32_t *) __builtin_alloca (4 * size);
memset (buf, 0, 4 * size);
int32_t last = *(buf + 4 * size); /* { dg-warning "stack-based buffer over-read" } */
}
void test7 (size_t size)
{
- int32_t *buf = __builtin_alloca (4 * size + 3); /* { dg-warning "allocated buffer size is not a multiple of the pointee's size" } */
+ int32_t *buf = (int32_t *) __builtin_alloca (4 * size + 3); /* { dg-warning "allocated buffer size is not a multiple of the pointee's size" } */
buf[size] = 42; /* { dg-warning "stack-based buffer overflow" } */
}
size_t len_y = __builtin_strlen (y);
/* BUG (root cause): forgot to add 1 for terminator. */
size_t sz = len_x + len_y;
- char *result = __builtin_malloc (sz);
+ char *result = (char *) __builtin_malloc (sz);
if (!result)
return NULL;
__builtin_memcpy (result, x, len_x);
make_str_badly (const char *src)
{
size_t len = strlen(src);
- struct str *str = malloc(sizeof(str) + len); /* { dg-message "\\(1\\) capacity: 'len \\+ 8' bytes" } */
+ struct str *str = (struct str *) malloc(sizeof(str) + len); /* { dg-message "\\(1\\) capacity: 'len \\+ 8' bytes" "" { target c } } */
+ /* { dg-message "\\(1\\) capacity: '\\(len \\+ 8\\)' bytes" "" { target c++ } .-1 } */
if (!str)
return NULL;
str->len = len;
void test2 (size_t size)
{
- int32_t *buf = __builtin_malloc (size * sizeof(int32_t)); /* { dg-message "\\(1\\) capacity: 'size \\* 4' bytes" } */
+ int32_t *buf = (int32_t *) __builtin_malloc (size * sizeof(int32_t)); /* { dg-message "\\(1\\) capacity: 'size \\* 4' bytes" "" { target c } } */
+ /* { dg-message "\\(1\\) capacity: '\\(size \\* 4\\)' bytes" "" { target c++ } .-1 } */
if (!buf) return;
buf[size + 1] = 42; /* { dg-warning "heap-based buffer overflow" } */
/* { dg-do "compile" } */
typedef __SIZE_TYPE__ size_t;
-#define NULL ((void *) 0)
+#include "../../gcc.dg/analyzer/analyzer-decls.h"
extern const char *foo (void);
extern size_t bar (void);
which is MIT-licensed. */
typedef __SIZE_TYPE__ size_t;
-#define NULL ((void *)0)
+#include "../../gcc.dg/analyzer/analyzer-decls.h"
extern size_t strlen (const char *__s)
__attribute__ ((__nothrow__ , __leaf__))
tmp.word = teststr;
wordlen = strlen(tmp.word);
- if ((tmp.word_state = malloc(wordlen+1)) == NULL)
+ if ((tmp.word_state = (char *) malloc(wordlen+1)) == NULL)
goto err;
- if ((rval = malloc(sizeof(*rval))) == NULL)
+ if ((rval = (struct game_state *) malloc(sizeof(*rval))) == NULL)
goto err;
memcpy(rval, &tmp, sizeof(*rval));
--- /dev/null
+/* { dg-additional-options "-fno-exceptions" } */
+#include "../../gcc.dg/analyzer/pr109577.c"
--- /dev/null
+/* Simplified version of test to ensure we issue a FILE * leak diagnostic,
+ reproducing a feasibility issue.
+ Adapted from intl/localealias.c, with all #includes removed. */
+
+/* { dg-do "compile" } */
+/* { dg-additional-options "-fno-exceptions" } */
+
+/* Handle aliases for locale names.
+ Copyright (C) 1995-1999, 2000-2001, 2003 Free Software Foundation, Inc.
+
+ This program is free software; you can redistribute it and/or modify it
+ under the terms of the GNU Library General Public License as published
+ by the Free Software Foundation; either version 2, or (at your option)
+ any later version.
+
+ This program is distributed in the hope that it will be useful,
+ but WITHOUT ANY WARRANTY; without even the implied warranty of
+ MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU
+ Library General Public License for more details.
+
+ You should have received a copy of the GNU Library General Public
+ License along with this program; if not, write to the Free Software
+ Foundation, Inc., 51 Franklin Street - Fifth Floor, Boston, MA 02110-1301,
+ USA. */
+
+
+#include "../../gcc.dg/analyzer/analyzer-decls.h"
+/* Minimal version of system headers. */
+typedef __SIZE_TYPE__ size_t;
+
+typedef struct _IO_FILE FILE;
+extern FILE *fopen (const char *__restrict __filename,
+ const char *__restrict __modes);
+extern size_t fread(void *ptr, size_t size, size_t nmemb, FILE *stream);
+extern int fclose (FILE *__stream);
+
+extern int isspace (int) __attribute__((__nothrow__, __leaf__));
+
+/* Cleaned-up body of localealias.c follows. */
+
+size_t
+read_alias_file (const char *fname, int fname_len)
+{
+ FILE *fp;
+ size_t added;
+ char buf[400];
+ char *alias;
+ char *value;
+ char *cp;
+
+ fp = fopen (fname, "r"); /* { dg-message "opened here" } */
+ if (fp == NULL)
+ return 0;
+
+ if (fread (buf, sizeof buf, 1, fp) != 1)
+ {
+ fclose (fp);
+ return 0;
+ }
+
+ cp = buf;
+
+ /* Ignore leading white space. */
+ while (isspace ((unsigned char)cp[0]))
+ ++cp;
+
+ if (cp[0] != '\0' && cp[0] != '#')
+ {
+ alias = cp++;
+ while (cp[0] != '\0' && !isspace ((unsigned char)cp[0]))
+ ++cp;
+ if (cp[0] != '\0')
+ *cp++ = '\0';
+
+ while (isspace ((unsigned char)cp[0]))
+ ++cp;
+
+ if (cp[0] != '\0')
+ return 42; /* { dg-warning "leak of FILE 'fp'" } */
+ }
+
+ fclose(fp);
+
+ return 0;
+}
int idx);
extern const EVP_PKEY_ASN1_METHOD hmac_asn1_meth;
static const EVP_PKEY_ASN1_METHOD *standard_methods[] = {&hmac_asn1_meth};
-static struct stack_st_EVP_PKEY_ASN1_METHOD *app_methods = ((void *)0);
+static struct stack_st_EVP_PKEY_ASN1_METHOD *app_methods = (struct stack_st_EVP_PKEY_ASN1_METHOD *) ((void *)0);
int EVP_PKEY_asn1_get_count(void) {
int num = (sizeof(standard_methods) / sizeof((standard_methods)[0]));
const EVP_PKEY_ASN1_METHOD *EVP_PKEY_asn1_get0(int idx) {
int num = (sizeof(standard_methods) / sizeof((standard_methods)[0]));
if (idx < 0)
- return ((void *)0);
+ return (const EVP_PKEY_ASN1_METHOD *) ((void *)0);
if (idx < num)
return standard_methods[idx];
idx -= num;
const EVP_PKEY_ASN1_METHOD *EVP_PKEY_asn1_find_str(ENGINE **pe, const char *str,
int len) {
int i;
- const EVP_PKEY_ASN1_METHOD *ameth = ((void *)0);
+ const EVP_PKEY_ASN1_METHOD *ameth = (const EVP_PKEY_ASN1_METHOD *) ((void *)0);
if (pe) {
ENGINE *e;
*pe = e;
return ameth;
}
- *pe = ((void *)0);
+ *pe = (ENGINE *) ((void *)0);
}
for (i = EVP_PKEY_asn1_get_count(); i-- > 0;) {
ameth = EVP_PKEY_asn1_get0(i);
continue;
return ameth;
}
- return ((void *)0);
+ return (const EVP_PKEY_ASN1_METHOD *) ((void *)0);
}
-#include "analyzer-decls.h"
-#define NULL ((void *)0)
+#include "../../gcc.dg/analyzer/analyzer-decls.h"
void *x, *y;
--- /dev/null
+/* { dg-additional-options "-Wno-analyzer-too-complex" } */
+/* { dg-additional-options "-fno-exceptions" } */
+
+/* Verify absence of false positive from -Wanalyzer-mismatching-deallocation
+ on realloc(3).
+ Based on https://github.com/libguestfs/libguestfs/blob/f19fd566f6387ce7e4d82409528c9dde374d25e0/daemon/command.c#L115
+ which is GPLv2 or later. */
+
+typedef __SIZE_TYPE__ size_t;
+typedef __builtin_va_list va_list;
+
+#include "../../gcc.dg/analyzer/analyzer-decls.h"
+
+extern void *malloc (size_t __size)
+ __attribute__ ((__nothrow__ , __leaf__))
+ __attribute__ ((__malloc__))
+ __attribute__ ((__alloc_size__ (1)));
+extern void perror (const char *__s);
+extern void *realloc (void *__ptr, size_t __size)
+ __attribute__ ((__nothrow__ , __leaf__))
+ __attribute__ ((__warn_unused_result__))
+ __attribute__ ((__alloc_size__ (2)));
+
+extern void guestfs_int_cleanup_free (void *ptr);
+extern int commandrvf (char **stdoutput, char **stderror, unsigned flags,
+ char const* const *argv);
+#define CLEANUP_FREE __attribute__((cleanup(guestfs_int_cleanup_free)))
+
+int
+commandrf (char **stdoutput, char **stderror, unsigned flags,
+ const char *name, ...)
+{
+ va_list args;
+ CLEANUP_FREE const char **argv = NULL;
+ char *s;
+ int i, r;
+
+ /* Collect the command line arguments into an array. */
+ i = 2;
+ argv = (const char **) malloc (sizeof (char *) * i);
+
+ if (argv == NULL) {
+ perror ("malloc");
+ return -1;
+ }
+ argv[0] = (char *) name;
+ argv[1] = NULL;
+
+ __builtin_va_start (args, name);
+
+ while ((s = __builtin_va_arg (args, char *)) != NULL) {
+ const char **p = (const char **) realloc (argv, sizeof (char *) * (++i)); /* { dg-bogus "'free'" } */
+ if (p == NULL) {
+ perror ("realloc");
+ __builtin_va_end (args);
+ return -1;
+ }
+ argv = p;
+ argv[i-2] = s;
+ argv[i-1] = NULL;
+ }
+
+ __builtin_va_end (args);
+
+ r = commandrvf (stdoutput, stderror, flags, argv);
+
+ return r;
+}
typedef __SIZE_TYPE__ size_t;
typedef __builtin_va_list va_list;
-#define NULL ((void *)0)
+#include "../../gcc.dg/analyzer/analyzer-decls.h"
extern void free (void *);
extern void *realloc (void *__ptr, size_t __size)
typedef __SIZE_TYPE__ size_t;
-#define NULL ((void *)0)
+#include "../../gcc.dg/analyzer/analyzer-decls.h"
extern void *malloc (size_t __size)
__attribute__ ((__nothrow__ , __leaf__))
int test_1 (void)
{
{
- int *q = malloc (1024);
+ int *q = (int *) malloc (1024);
}
return 42; /* { dg-warning "leak of 'q'" } */
/* { dg-enable-nn-line-numbers "" } */
/* { dg-require-effective-target indirect_jumps } */
-#include "test-setjmp.h"
+#include "../../gcc.dg/analyzer/test-setjmp.h"
#include <stddef.h>
-#include "analyzer-decls.h"
+#include "../../gcc.dg/analyzer/analyzer-decls.h"
extern void foo (int);
| | |
| | (8) here
|
- { dg-end-multiline-output "" } */
+ { dg-end-multiline-output "" { target c } } */
+/* { dg-begin-multiline-output "" }
+ NN | __analyzer_dump_path ();
+ | ~~~~~~~~~~~~~~~~~~~~~^~
+ 'void test_2()': event 1
+ |
+ | NN | i = SETJMP(env);
+ | | ^~~~~~
+ | | |
+ | | (1) 'setjmp' called here
+ |
+ 'void test_2()': events 2-4
+ |
+ | NN | if (i != 0)
+ | | ^~
+ | | |
+ | | (2) following 'false' branch (when 'i == 0')...
+ |......
+ | NN | longjmp (env, 1);
+ | | ~~~~~~~~~~~~~~~~
+ | | |
+ | | (3) ...to here
+ | | (4) rewinding within 'test_2' from 'longjmp'...
+ |
+ 'void test_2()': event 5
+ |
+ | NN | i = SETJMP(env);
+ | | ^~~~~~
+ | | |
+ | | (5) ...to 'setjmp' (saved at (1))
+ |
+ 'void test_2()': events 6-8
+ |
+ | NN | if (i != 0)
+ | | ^~
+ | | |
+ | | (6) following 'true' branch (when 'i != 0')...
+ | NN | {
+ | NN | foo (2);
+ | | ~~~~~~~
+ | | |
+ | | (7) ...to here
+ | NN | __analyzer_dump_path ();
+ | | ~~~~~~~~~~~~~~~~~~~~~~~
+ | | |
+ | | (8) here
+ |
+ { dg-end-multiline-output "" { target c++ } } */
void test_3 (void)
{
/* { dg-enable-nn-line-numbers "" } */
/* { dg-require-effective-target indirect_jumps } */
-#include "test-setjmp.h"
+#include "../../gcc.dg/analyzer/test-setjmp.h"
#include <stddef.h>
-#include "analyzer-decls.h"
+#include "../../gcc.dg/analyzer/analyzer-decls.h"
static jmp_buf env;
| | |
| | (7) 'longjmp' called after enclosing function of 'setjmp' returned at (5)
|
- { dg-end-multiline-output "" } */
+ { dg-end-multiline-output "" { target c } } */
+/* { dg-begin-multiline-output "" }
+ NN | longjmp (env, 42);
+ | ~~~~~~~~^~~~~~~~~
+ 'void outer()': events 1-2
+ |
+ | NN | void outer (void)
+ | | ^~~~~
+ | | |
+ | | (1) entry to 'outer'
+ |......
+ | NN | inner ();
+ | | ~~~~~~~~
+ | | |
+ | | (2) calling 'inner' from 'outer'
+ |
+ +--> 'void inner()': event 3
+ |
+ | NN | static void inner (void)
+ | | ^~~~~
+ | | |
+ | | (3) entry to 'inner'
+ |
+ 'void inner()': event 4
+ |
+ | NN | SETJMP (env);
+ | | ^~~~~~
+ | | |
+ | | (4) 'setjmp' called here
+ |
+ 'void inner()': event 5
+ |
+ | NN | }
+ | | ^
+ | | |
+ | | (5) stack frame is popped here, invalidating saved environment
+ |
+ <------+
+ |
+ 'void outer()': events 6-7
+ |
+ | NN | inner ();
+ | | ~~~~~~^~
+ | | |
+ | | (6) returning to 'outer' from 'inner'
+ | NN |
+ | NN | longjmp (env, 42);
+ | | ~~~~~~~~~~~~~~~~~
+ | | |
+ | | (7) 'longjmp' called after enclosing function of 'setjmp' returned at (5)
+ |
+ { dg-end-multiline-output "" { target c++ } } */
/* { dg-enable-nn-line-numbers "" } */
/* { dg-require-effective-target indirect_jumps } */
-#include "test-setjmp.h"
+#include "../../gcc.dg/analyzer/test-setjmp.h"
#include <stddef.h>
-#include "analyzer-decls.h"
+#include "../../gcc.dg/analyzer/analyzer-decls.h"
extern int foo (int) __attribute__ ((__pure__));
foo (3);
}
+/* { dg-begin-multiline-output "" }
+ NN | __analyzer_dump_path ();
+ | ~~~~~~~~~~~~~~~~~~~~~^~
+ 'void outer()': event 1
+ |
+ | NN | void outer (void)
+ | | ^~~~~
+ | | |
+ | | (1) entry to 'outer'
+ |
+ 'void outer()': event 2
+ |
+ | NN | i = SETJMP(env);
+ | | ^~~~~~
+ | | |
+ | | (2) 'setjmp' called here
+ |
+ 'void outer()': events 3-5
+ |
+ | NN | if (i != 0)
+ | | ^~
+ | | |
+ | | (3) following 'false' branch (when 'i == 0')...
+ |......
+ | NN | inner ();
+ | | ~~~~~~~~
+ | | |
+ | | (4) ...to here
+ | | (5) calling 'inner' from 'outer'
+ |
+ +--> 'void inner()': events 6-7
+ |
+ | NN | static void inner (void)
+ | | ^~~~~
+ | | |
+ | | (6) entry to 'inner'
+ |......
+ | NN | longjmp (env, unknown_val);
+ | | ~~~~~~~~~~~~~~~~~~~~~~~~~~
+ | | |
+ | | (7) rewinding from 'longjmp' in 'inner'...
+ |
+ <------+
+ |
+ 'void outer()': event 8
+ |
+ | NN | i = SETJMP(env);
+ | | ^~~~~~
+ | | |
+ | | (8) ...to 'setjmp' in 'outer' (saved at (2))
+ |
+ 'void outer()': events 9-11
+ |
+ | NN | if (i != 0)
+ | | ^~
+ | | |
+ | | (9) following 'true' branch (when 'i != 0')...
+ |......
+ | NN | __analyzer_dump_path ();
+ | | ~~~~~~~~~~~~~~~~~~~~~~~
+ | | |
+ | | (10) ...to here
+ | | (11) here
+ |
+ { dg-end-multiline-output "" { target c++ } } */
/* { dg-begin-multiline-output "" }
NN | __analyzer_dump_path ();
| ^~~~~~~~~~~~~~~~~~~~~~~
| | |
| | (11) here
|
- { dg-end-multiline-output "" } */
+ { dg-end-multiline-output "" { target c } } */
void custom_logger(const char *msg)
{
- fprintf(stderr, "LOG: %s", msg); /* { dg-warning "call to 'fprintf' from within signal handler" } */
+ fprintf(stderr, "LOG: %s", msg); /* { dg-warning "call to 'fprintf' from within signal handler" "" { target c } } */
+ /* { dg-warning "call to 'int fprintf\\(FILE\\*, const char\\*, ...\\)' from within signal handler" "" { target c++ } .-1 } */
}
static void int_handler(int signum)
| | |
| | (7) call to 'fprintf' from within signal handler
|
- { dg-end-multiline-output "" } */
+ { dg-end-multiline-output "" { target c } } */
+/* { dg-begin-multiline-output "" }
+ NN | fprintf(stderr, "LOG: %s", msg);
+ | ~~~~~~~^~~~~~~~~~~~~~~~~~~~~~~~
+ 'void test()': events 1-2
+ |
+ | NN | void test (void)
+ | | ^~~~
+ | | |
+ | | (1) entry to 'test'
+ |......
+ | NN | signal(SIGINT, int_handler);
+ | | ~~~~~~~~~~~~~~~~~~~~~~~~~~~
+ | | |
+ | | (2) registering 'void int_handler(int)' as signal handler
+ |
+ event 3
+ |
+ |cc1plus:
+ | (3): later on, when the signal is delivered to the process
+ |
+ +--> 'void int_handler(int)': events 4-5
+ |
+ | NN | static void int_handler(int signum)
+ | | ^~~~~~~~~~~
+ | | |
+ | | (4) entry to 'int_handler'
+ | NN | {
+ | NN | custom_logger("got signal");
+ | | ~~~~~~~~~~~~~~~~~~~~~~~~~~~
+ | | |
+ | | (5) calling 'custom_logger' from 'int_handler'
+ |
+ +--> 'void custom_logger(const char*)': events 6-7
+ |
+ | NN | void custom_logger(const char *msg)
+ | | ^~~~~~~~~~~~~
+ | | |
+ | | (6) entry to 'custom_logger'
+ | NN | {
+ | NN | fprintf(stderr, "LOG: %s", msg);
+ | | ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
+ | | |
+ | | (7) call to 'int fprintf(FILE*, const char*, ...)' from within signal handler
+ |
+ { dg-end-multiline-output "" { target c++ } } */
void custom_logger(const char *msg)
{
- fprintf(stderr, "LOG: %s", msg); /* { dg-warning "call to 'fprintf' from within signal handler" } */
+ fprintf(stderr, "LOG: %s", msg); /* { dg-warning "call to 'fprintf' from within signal handler" "" { target c } } */
+ /* { dg-warning "call to 'int fprintf\\(FILE\\*, const char\\*, ...\\)' from within signal handler" "" { target c++ } .-1 } */
}
static void int_handler(int signum)
| | |
| | (9) call to 'fprintf' from within signal handler
|
- { dg-end-multiline-output "" } */
+ { dg-end-multiline-output "" { target c } } */
+/* { dg-begin-multiline-output "" }
+ NN | fprintf(stderr, "LOG: %s", msg);
+ | ~~~~~~~^~~~~~~~~~~~~~~~~~~~~~~~
+ 'void test()': events 1-2
+ |
+ | NN | void test (void)
+ | | ^~~~
+ | | |
+ | | (1) entry to 'test'
+ | NN | {
+ | NN | __analyzer_register_handler ();
+ | | ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
+ | | |
+ | | (2) calling '__analyzer_register_handler' from 'test'
+ |
+ +--> 'void __analyzer_register_handler()': events 3-4
+ |
+ | NN | static void __analyzer_register_handler ()
+ | | ^~~~~~~~~~~~~~~~~~~~~~~~~~~
+ | | |
+ | | (3) entry to '__analyzer_register_handler'
+ | NN | {
+ | NN | signal(SIGINT, int_handler);
+ | | ~~~~~~~~~~~~~~~~~~~~~~~~~~~
+ | | |
+ | | (4) registering 'void int_handler(int)' as signal handler
+ |
+ event 5
+ |
+ |cc1plus:
+ | (5): later on, when the signal is delivered to the process
+ |
+ +--> 'void int_handler(int)': events 6-7
+ |
+ | NN | static void int_handler(int signum)
+ | | ^~~~~~~~~~~
+ | | |
+ | | (6) entry to 'int_handler'
+ | NN | {
+ | NN | custom_logger("got signal");
+ | | ~~~~~~~~~~~~~~~~~~~~~~~~~~~
+ | | |
+ | | (7) calling 'custom_logger' from 'int_handler'
+ |
+ +--> 'void custom_logger(const char*)': events 8-9
+ |
+ | NN | void custom_logger(const char *msg)
+ | | ^~~~~~~~~~~~~
+ | | |
+ | | (8) entry to 'custom_logger'
+ | NN | {
+ | NN | fprintf(stderr, "LOG: %s", msg);
+ | | ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
+ | | |
+ | | (9) call to 'int fprintf(FILE*, const char*, ...)' from within signal handler
+ |
+ { dg-end-multiline-output "" { target c++ } } */
+++ /dev/null
-#include <stdlib.h>
-
-struct ptr_wrapper
-{
- int *ptr;
-};
-
-struct ptr_wrapper
-test_1 (void)
-{
- struct ptr_wrapper r;
- r.ptr = malloc (sizeof (int));
- return r;
-}
-
-struct ptr_wrapper
-test_2 (void)
-{
- struct ptr_wrapper r, s;
- r.ptr = malloc (sizeof (int));
- s = r;
- return s;
-}
-
-struct nested
-{
- struct ptr_wrapper w;
-};
-
-struct nested
-test_3 (void)
-{
- struct nested n;
- n.w.ptr = malloc (sizeof (int));
- return n;
-}
-
-void test_4 (void)
-{
- struct ptr_wrapper r;
- r.ptr = malloc (sizeof (int)); /* { dg-message "allocated here" } */
-} /* { dg-warning "leak of 'r.ptr'" } */
-/* { dg-bogus "leak of '<unknown>'" "unknown leak" { target *-*-* } .-1 } */
-
-static struct ptr_wrapper __attribute__((noinline))
-called_by_test_5a (void)
-{
- struct ptr_wrapper r;
- r.ptr = malloc (sizeof (int)); /* { dg-message "allocated here" } */
- return r;
-}
-
-void test_5a (void)
-{
- struct ptr_wrapper q = called_by_test_5a ();
-} /* { dg-warning "leak of 'q.ptr'" } */
-
-static struct ptr_wrapper __attribute__((noinline))
-called_by_test_5b (void)
-{
- struct ptr_wrapper r;
- r.ptr = malloc (sizeof (int));
- return r; /* { dg-warning "leak of '<return-value>.ptr'" } */
- /* TODO: show the allocation point; improve above message. */
-}
-
-void test_5b (void)
-{
- called_by_test_5b ();
-}
+/* C only: C++ exceptions double the fopen leak warnings.
+ Therefore this test has been duplicated as
+ c-c++-common/analyzer/file-pr58237-noexcept.c */
+
typedef struct FILE FILE;
FILE* fopen (const char*, const char*);
int fclose (FILE*);
char *fgets (char *, int, FILE *);
-#define NULL ((void *)0)
+#include "analyzer-decls.h"
void f0(const char *str)
{
FILE * fp = fopen(str, "r"); /* { dg-message "opened here" } */
+ // ideally warning should be located at the end of the function
char buf[10];
fgets(buf, 10, fp);
} /* { dg-warning "leak of FILE 'fp'" } */
void f1(const char *str)
{
FILE * fp = fopen(str, "r"); /* { dg-message "opened here" } */
+ // ideally warning should be located at the end of the function
char buf[10];
while (fgets(buf, 10, fp) != NULL)
void f2(const char *str, int flag)
{
FILE * fp = fopen(str, "r"); /* { dg-message "opened here" } */
+ // ideally warning should be located at the end of the function
char buf[10];
while (fgets(buf, 10, fp) != NULL)
fclose(fp);
}
-void main(int argc, const char * argv[])
+int main(int argc, const char * argv[])
{
FILE * fp = fopen(argv[0], "r");
char buf[10];
+/* C only: C++ FE fpermissive already emits an error for initializer
+ string too long.
+ C++ compatible parts have been moved into c-c++-common/analyzer/fopen-2.c */
+
typedef struct FILE FILE;
FILE *fopen (const char *pathname, const char *mode);
-#define NULL ((void *)0)
-
-FILE *
-test_passthrough (const char *pathname, const char *mode)
-{
- return fopen (pathname, mode);
-}
-
-FILE *
-test_null_pathname (const char *pathname, const char *mode)
-{
- return fopen (NULL, mode);
-}
-
-FILE *
-test_null_mode (const char *pathname)
-{
- return fopen (pathname, NULL);
-}
-
-FILE *
-test_simple_r (void)
-{
- return fopen ("foo.txt", "r");
-}
-
-FILE *
-test_swapped_args (void)
-{
- return fopen ("r", "foo.txt"); /* TODO: would be nice to detect this. */
-}
FILE *
test_unterminated_pathname (const char *mode)
return fopen (filename, buf); /* { dg-warning "stack-based buffer over-read" } */
/* { dg-message "while looking for null terminator for argument 2 \\('&buf'\\) of 'fopen'..." "event" { target *-*-* } .-1 } */
}
-
-FILE *
-test_uninitialized_pathname (const char *mode)
-{
- char buf[10];
- return fopen (buf, mode); /* { dg-warning "use of uninitialized value 'buf\\\[0\\\]'" } */
- /* { dg-message "while looking for null terminator for argument 1 \\('&buf'\\) of 'fopen'..." "event" { target *-*-* } .-1 } */
-}
-
-FILE *
-test_uninitialized_mode (const char *filename)
-{
- char buf[10];
- return fopen (filename, buf); /* { dg-warning "use of uninitialized value 'buf\\\[0\\\]'" } */
- /* { dg-message "while looking for null terminator for argument 2 \\('&buf'\\) of 'fopen'..." "event" { target *-*-* } .-1 } */
-}
-
+++ /dev/null
-/* Verify that we can reconstruct fndecl and stack depth information
- after early inlining. */
-
-/* { dg-additional-options "-O2 -fdiagnostics-show-path-depths" } */
-
-void foo (void *p)
-{
- __builtin_free (p); /* { dg-warning "double-'free' of 'q'" "warning" } */
- /* { dg-message "\\(3\\) first 'free' here \\(fndecl 'foo', depth 2\\)" "1st free message" { target *-*-* } .-1 } */
- /* { dg-message "\\(5\\) second 'free' here; first 'free' was at \\(3\\) \\(fndecl 'foo', depth 2\\)" "2nd free message" { target *-*-* } .-2 } */
-}
-
-void bar (void *q) /* { dg-message "\\(1\\) entry to 'bar' \\(fndecl 'bar', depth 1\\)" } */
-{
- foo (q); /* { dg-message "\\(2\\) inlined call to 'foo' from 'bar' \\(fndecl 'bar', depth 1\\)" } */
- foo (q); /* { dg-message "\\(4\\) inlined call to 'foo' from 'bar' \\(fndecl 'bar', depth 1\\)" } */
-}
+++ /dev/null
-/* Verify that we can reconstruct fndecl and stack depth information
- after early inlining. */
-
-/* { dg-additional-options "-O2 -fdiagnostics-show-path-depths" } */
-
-static void __analyzer_foo (void *p)
-{
- __builtin_free (p); /* { dg-message "\\(3\\) first 'free' here \\(fndecl '__analyzer_foo', depth 2\\)" "1st free message" } */
-
- __builtin_free (p); /* { dg-warning "double-'free' of 'q'" "warning" } */
- /* { dg-message "\\(4\\) second 'free' here; first 'free' was at \\(3\\) \\(fndecl '__analyzer_foo', depth 2\\)" "2nd free message" { target *-*-* } .-1 } */
-}
-
-void bar (void *q) /* { dg-message "\\(1\\) entry to 'bar' \\(fndecl 'bar', depth 1\\)" } */
-{
- __analyzer_foo (q); /* { dg-message "\\(2\\) inlined call to '__analyzer_foo' from 'bar' \\(fndecl 'bar', depth 1\\)" } */
-}
+++ /dev/null
-/* Verify that we can reconstruct fndecl and stack depth information
- after early inlining. */
-
-/* { dg-additional-options "-O2 -fdiagnostics-show-path-depths" } */
-
-static inline void
-inner (void *p)
-{
- __builtin_free (p); /* { dg-warning "double-'free' of 'r'" } */
- /* { dg-message "\\(5\\) second 'free' here; first 'free' was at \\(3\\) \\(fndecl 'inner', depth 3\\)" "2nd free message" { target *-*-* } .-1 } */
-}
-
-static inline void
-middle (void *q)
-{
- __builtin_free (q); /* { dg-message "\\(3\\) first 'free' here \\(fndecl 'middle', depth 2\\)" "1st free message" } */
- inner (q); /* { dg-message "\\(4\\) inlined call to 'inner' from 'middle' \\(fndecl 'middle', depth 2\\)" } */
-}
-
-void
-outer (void *r) /* { dg-message "\\(1\\) entry to 'outer' \\(fndecl 'outer', depth 1\\)" } */
-{
- middle (r); /* { dg-message "\\(2\\) inlined call to 'middle' from 'outer' \\(fndecl 'outer', depth 1\\)" } */
-}
+++ /dev/null
-/* Verify that we can reconstruct fndecl and stack depth information
- after early inlining. */
-
-/* { dg-additional-options "-O2 -fdiagnostics-show-path-depths" } */
-
-/* We want the reconstructed call/return hierarchy to show
- that two calls happen at depth_3, without any spurious events
- popping the stack back any further. */
-
-static inline void
-depth_6 (void *p)
-{
- __builtin_free (p); /* { dg-warning "double-'free' of 'p1'" "warning" } */
- /* { dg-message "\\(7\\) first 'free' here \\(fndecl 'depth_6', depth 6\\)" "1st free message" { target *-*-* } .-1 } */
- /* { dg-message "\\(11\\) second 'free' here; first 'free' was at \\(7\\) \\(fndecl 'depth_6', depth 6\\)" "2nd free message" { target *-*-* } .-2 } */
-}
-
-static inline void
-depth_5 (void *p5)
-{
- depth_6 (p5); /* { dg-message "\\(6\\) inlined call to 'depth_6' from 'depth_5' \\(fndecl 'depth_5', depth 5\\)" "event 6" } */
- /* { dg-message "\\(10\\) inlined call to 'depth_6' from 'depth_5' \\(fndecl 'depth_5', depth 5\\)" "event 10" { target *-*-* } .-1 } */
-}
-
-static inline void
-depth_4 (void *p4)
-{
- depth_5 (p4); /* { dg-message "\\(5\\) inlined call to 'depth_5' from 'depth_4' \\(fndecl 'depth_4', depth 4\\)" "event 5" } */
- /* { dg-message "\\(9\\) inlined call to 'depth_5' from 'depth_4' \\(fndecl 'depth_4', depth 4\\)" "event 9" { target *-*-* } .-1 } */
-}
-
-static inline void
-depth_3 (void *p3)
-{
- depth_4 (p3); /* { dg-message "\\(4\\) inlined call to 'depth_4' from 'depth_3' \\(fndecl 'depth_3', depth 3\\)" } */
- depth_4 (p3); /* { dg-message "\\(8\\) inlined call to 'depth_4' from 'depth_3' \\(fndecl 'depth_3', depth 3\\)" } */
-}
-
-static inline void
-depth_2 (void *p2)
-{
- depth_3 (p2); /* { dg-message "\\(3\\) inlined call to 'depth_3' from 'depth_2' \\(fndecl 'depth_2', depth 2\\)" } */
-}
-
-void
-depth_1 (void *p1) /* { dg-message "\\(1\\) entry to 'depth_1' \\(fndecl 'depth_1', depth 1\\)" } */
-{
- depth_2 (p1); /* { dg-message "\\(2\\) inlined call to 'depth_2' from 'depth_1' \\(fndecl 'depth_1', depth 1\\)" } */
-}
/* { dg-additional-options "-Wno-incompatible-pointer-types" } */
+/* C only: Wno-incompatible-pointer-types is not valid for C++. */
#include <stdlib.h>
void *hv (struct foo **tm)
{
void *p = __builtin_malloc (4);
- *tm = p;
+ *tm = (struct foo *) p;
if (!p)
abort ();
return p;
void a5 (void)
{
struct bar *qb = NULL;
- hv (&qb);
+ hv ((struct foo **) &qb);
} /* { dg-warning "leak of 'qb'" } */
/* { dg-additional-options "-fdiagnostics-show-line-numbers -fdiagnostics-path-format=inline-events -fdiagnostics-show-caret" } */
/* { dg-enable-nn-line-numbers "" } */
+/* C only: C++ exceptions mess up events. Therefore this test has been duplicated
+ as c-c++-common/analyzer/malloc-paths-9-noexcept.c */
#include <stdlib.h>
/* { dg-additional-options "-O2" } */
+/* C only: C++ FE optimizes argstr_get_word completely away
+ and therefore the number of SN diminishes compared to C,
+ making the analysis bails out early. */
+
extern void free (void *__ptr) __attribute__ ((__nothrow__ , __leaf__));
enum pipecmd_tag
struct pipecmd {
enum pipecmd_tag tag;
- union {
+ union pipecmd_union_t {
struct pipecmd_process {
int argc;
int argv_max;
} u;
};
+#ifdef __cplusplus
+typedef pipecmd::pipecmd_union_t::pipecmd_process pipecmd_process_t;
+typedef pipecmd::pipecmd_union_t::pipecmd_sequence pipecmd_sequence_t;
+#else
+typedef struct pipecmd_process pipecmd_process_t;
+typedef struct pipecmd_sequence pipecmd_sequence_t;
+#endif
+
static char *argstr_get_word (const char **argstr)
{
while (**argstr) {
switch (**argstr) {
case ' ':
case '\t':
- return (void *) 0;
+ return (char *) ((void *) 0);
}
}
- return (void *) 0;
+ return (char *) ((void *) 0);
}
struct pipecmd *pipecmd_new_argstr (const char *argstr)
{
argstr_get_word (&argstr);
- return (void *) 0;
+ return (struct pipecmd *) ((void *) 0);
}
void pipecmd_free (struct pipecmd *cmd)
switch (cmd->tag) {
case PIPECMD_PROCESS: {
- struct pipecmd_process *cmdp = &cmd->u.process;
+ pipecmd_process_t *cmdp = &cmd->u.process;
for (i = 0; i < cmdp->argc; ++i)
free (cmdp->argv[i]);
}
case PIPECMD_SEQUENCE: {
- struct pipecmd_sequence *cmds = &cmd->u.sequence;
+ pipecmd_sequence_t *cmds = &cmd->u.sequence;
for (i = 0; i < cmds->ncommands; ++i)
pipecmd_free (cmds->commands[i]);
+/* C only: C++ exceptions cause a malloc leak after "safer" returns.
+ Therefore this test has been duplicated as
+ c-c++-common/analyzer/pr109577-noexcept.c */
+
void *malloc (unsigned long);
double *
unsafe (unsigned long n)
{
- return malloc (n * sizeof (double));
+ return (double *) malloc (n * sizeof (double));
}
double *
unsigned long nbytes;
if (__builtin_mul_overflow (n, sizeof (double), &nbytes))
return 0;
- return malloc (nbytes);
+ return (double *) malloc (nbytes); /* Exceptions enabled cause a leak here. */
}
/* { dg-do "compile" } */
+/* C only: C++ exceptions cause another fopen leak warning to be emitted at line 54.
+ Therefore this test has been duplicated as
+ c-c++-common/analyzer/pr93355-localealias-feasibility-noexcept.c */
+
/* Handle aliases for locale names.
Copyright (C) 1995-1999, 2000-2001, 2003 Free Software Foundation, Inc.
Foundation, Inc., 51 Franklin Street - Fifth Floor, Boston, MA 02110-1301,
USA. */
-/* Minimal version of system headers. */
+#include "../../gcc.dg/analyzer/analyzer-decls.h"
+/* Minimal version of system headers. */
typedef __SIZE_TYPE__ size_t;
-#define NULL ((void *)0)
typedef struct _IO_FILE FILE;
extern FILE *fopen (const char *__restrict __filename,
/* { dg-additional-options "-Wno-analyzer-too-complex" } */
+/* C only: C++ exceptions cause a Wanalyzer-va-list-leak warning to be emitted
+ at the end of commandrf. Therefore this test has been duplicated as
+ c-c++-common/analyzer/pr99193-1-noexcept.c */
+
/* Verify absence of false positive from -Wanalyzer-mismatching-deallocation
on realloc(3).
Based on https://github.com/libguestfs/libguestfs/blob/f19fd566f6387ce7e4d82409528c9dde374d25e0/daemon/command.c#L115
typedef __SIZE_TYPE__ size_t;
typedef __builtin_va_list va_list;
-#define NULL ((void *)0)
+#include "analyzer-decls.h"
extern void *malloc (size_t __size)
__attribute__ ((__nothrow__ , __leaf__))
/* Collect the command line arguments into an array. */
i = 2;
- argv = malloc (sizeof (char *) * i);
+ argv = (const char **) malloc (sizeof (char *) * i);
if (argv == NULL) {
perror ("malloc");
__builtin_va_start (args, name);
while ((s = __builtin_va_arg (args, char *)) != NULL) {
- const char **p = realloc (argv, sizeof (char *) * (++i)); /* { dg-bogus "'free'" } */
+ const char **p = (const char **) realloc (argv, sizeof (char *) * (++i)); /* { dg-bogus "'free'" } */
if (p == NULL) {
perror ("realloc");
__builtin_va_end (args);
projects / thirdparty / gcc.git / commitdiff
