class feasible_node;
+class known_function;
+ class builtin_known_function;
+ class internal_known_function;
+
/* Forward decls of functions. */
extern void dump_tree (pretty_printer *pp, tree t);
{
return;
}
+
+ virtual const builtin_known_function *
+ dyn_cast_builtin_kf () const { return NULL; }
+};
+
+/* Subclass of known_function for builtin functions. */
+
+class builtin_known_function : public known_function
+{
+public:
+ virtual enum built_in_function builtin_code () const = 0;
+ tree builtin_decl () const {
+ gcc_assert (builtin_code () < END_BUILTINS);
+ return builtin_info[builtin_code ()].decl;
+ }
+
+ const builtin_known_function *
+ dyn_cast_builtin_kf () const final override { return this; }
};
/* Subclass of known_function for IFN_* functions. */
/* Handler for "alloca". */
-class kf_alloca : public known_function
+class kf_alloca : public builtin_known_function
{
public:
bool matches_call_types_p (const call_details &cd) const final override
{
return cd.num_args () == 1;
}
+ enum built_in_function builtin_code () const final override
+ {
+ return BUILT_IN_ALLOCA;
+ }
void impl_call_pre (const call_details &cd) const final override;
};
/* Handler for "calloc". */
-class kf_calloc : public known_function
+class kf_calloc : public builtin_known_function
{
public:
bool matches_call_types_p (const call_details &cd) const final override
&& cd.arg_is_size_p (0)
&& cd.arg_is_size_p (1));
}
+ enum built_in_function builtin_code () const final override
+ {
+ return BUILT_IN_CALLOC;
+ }
+
void impl_call_pre (const call_details &cd) const final override;
};
all pointers to the region to the "freed" state together, regardless
of casts. */
-class kf_free : public known_function
+class kf_free : public builtin_known_function
{
public:
bool matches_call_types_p (const call_details &cd) const final override
{
- return (cd.num_args () == 0 && cd.arg_is_pointer_p (0));
+ return (cd.num_args () == 1 && cd.arg_is_pointer_p (0));
+ }
+ enum built_in_function builtin_code () const final override
+ {
+ return BUILT_IN_FREE;
}
void impl_call_post (const call_details &cd) const final override;
};
/* Handle the on_call_pre part of "malloc". */
-class kf_malloc : public known_function
+class kf_malloc : public builtin_known_function
{
public:
bool matches_call_types_p (const call_details &cd) const final override
return (cd.num_args () == 1
&& cd.arg_is_size_p (0));
}
+ enum built_in_function builtin_code () const final override
+ {
+ return BUILT_IN_MALLOC;
+ }
void impl_call_pre (const call_details &cd) const final override;
};
/* TODO: complain about overlapping src and dest for the memcpy
variants. */
-class kf_memcpy_memmove : public known_function
+class kf_memcpy_memmove : public builtin_known_function
{
public:
+ enum kf_memcpy_memmove_variant
+ {
+ KF_MEMCPY,
+ KF_MEMCPY_CHK,
+ KF_MEMMOVE,
+ KF_MEMMOVE_CHK,
+ };
+ kf_memcpy_memmove (enum kf_memcpy_memmove_variant variant)
+ : m_variant (variant) {};
bool matches_call_types_p (const call_details &cd) const final override
{
return (cd.num_args () == 3
&& cd.arg_is_pointer_p (1)
&& cd.arg_is_size_p (2));
}
+ enum built_in_function builtin_code () const final override
+ {
+ switch (m_variant)
+ {
+ case KF_MEMCPY:
+ return BUILT_IN_MEMCPY;
+ case KF_MEMCPY_CHK:
+ return BUILT_IN_MEMCPY_CHK;
+ case KF_MEMMOVE:
+ return BUILT_IN_MEMMOVE;
+ case KF_MEMMOVE_CHK:
+ return BUILT_IN_MEMMOVE_CHK;
+ default:
+ gcc_unreachable ();
+ }
+ }
void impl_call_pre (const call_details &cd) const final override;
+private:
+ const enum kf_memcpy_memmove_variant m_variant;
};
void
/* Handler for "memset" and "__builtin_memset". */
-class kf_memset : public known_function
+class kf_memset : public builtin_known_function
{
public:
+ kf_memset (bool chk_variant) : m_chk_variant (chk_variant) {}
bool matches_call_types_p (const call_details &cd) const final override
{
return (cd.num_args () == 3 && cd.arg_is_pointer_p (0));
}
-
+ enum built_in_function builtin_code () const final override
+ {
+ return m_chk_variant ? BUILT_IN_MEMSET_CHK : BUILT_IN_MEMSET;
+ }
void impl_call_pre (const call_details &cd) const final override;
+private:
+ const bool m_chk_variant;
};
void
Each of these has a custom_edge_info subclass, which updates
the region_model and sm-state of the destination state. */
-class kf_realloc : public known_function
+class kf_realloc : public builtin_known_function
{
public:
bool matches_call_types_p (const call_details &cd) const final override
&& cd.arg_is_pointer_p (0)
&& cd.arg_is_size_p (1));
}
+
+ enum built_in_function builtin_code () const final override
+ {
+ return BUILT_IN_REALLOC;
+ }
+
void impl_call_post (const call_details &cd) const final override;
};
/* Handler for "strchr" and "__builtin_strchr". */
-class kf_strchr : public known_function
+class kf_strchr : public builtin_known_function
{
public:
bool matches_call_types_p (const call_details &cd) const final override
{
cd.check_for_null_terminated_string_arg (0);
}
+
+ enum built_in_function builtin_code () const final override
+ {
+ return BUILT_IN_STRCHR;
+ }
void impl_call_post (const call_details &cd) const final override;
};
int sprintf(char *str, const char *format, ...);
*/
-class kf_sprintf : public known_function
+class kf_sprintf : public builtin_known_function
{
public:
bool matches_call_types_p (const call_details &cd) const final override
&& cd.arg_is_pointer_p (1));
}
+ enum built_in_function builtin_code () const final override
+ {
+ return BUILT_IN_SPRINTF;
+ }
+
void impl_call_pre (const call_details &cd) const final override
{
/* For now, merely assume that the destination buffer gets set to a
/* Handler for "strcat" and "__builtin_strcat_chk". */
-class kf_strcat : public known_function
+class kf_strcat : public builtin_known_function
{
public:
- kf_strcat (unsigned int num_args) : m_num_args (num_args) {}
+ kf_strcat (unsigned int num_args, bool chk_variant)
+ : m_num_args (num_args),
+ m_chk_variant (chk_variant) {}
bool matches_call_types_p (const call_details &cd) const final override
{
return (cd.num_args () == m_num_args
&& cd.arg_is_pointer_p (1));
}
+ enum built_in_function builtin_code () const final override
+ {
+ return m_chk_variant ? BUILT_IN_STRCAT_CHK : BUILT_IN_STRCAT;
+ }
+
void impl_call_pre (const call_details &cd) const final override
{
region_model *model = cd.get_model ();
private:
unsigned int m_num_args;
+ const bool m_chk_variant;
};
/* Handler for "strcpy" and "__builtin_strcpy_chk". */
-class kf_strcpy : public known_function
+class kf_strcpy : public builtin_known_function
{
public:
- kf_strcpy (unsigned int num_args) : m_num_args (num_args) {}
+ kf_strcpy (unsigned int num_args, bool chk_variant)
+ : m_num_args (num_args),
+ m_chk_variant (chk_variant) {}
bool matches_call_types_p (const call_details &cd) const final override
{
return (cd.num_args () == m_num_args
&& cd.arg_is_pointer_p (0)
&& cd.arg_is_pointer_p (1));
}
-
+ enum built_in_function builtin_code () const final override
+ {
+ return m_chk_variant ? BUILT_IN_STRCPY_CHK : BUILT_IN_STRCPY;
+ }
void impl_call_pre (const call_details &cd) const final override;
private:
unsigned int m_num_args;
+ const bool m_chk_variant;
};
void
/* Handler for "strdup" and "__builtin_strdup". */
-class kf_strdup : public known_function
+class kf_strdup : public builtin_known_function
{
public:
bool matches_call_types_p (const call_details &cd) const final override
{
return (cd.num_args () == 1 && cd.arg_is_pointer_p (0));
}
+ enum built_in_function builtin_code () const final override
+ {
+ return BUILT_IN_STRDUP;
+ }
void impl_call_pre (const call_details &cd) const final override
{
region_model *model = cd.get_model ();
/* Handler for "strlen" and for "__analyzer_get_strlen". */
-class kf_strlen : public known_function
+class kf_strlen : public builtin_known_function
{
public:
bool matches_call_types_p (const call_details &cd) const final override
{
return (cd.num_args () == 1 && cd.arg_is_pointer_p (0));
}
+ enum built_in_function builtin_code () const final override
+ {
+ return BUILT_IN_STRLEN;
+ }
+
void impl_call_pre (const call_details &cd) const final override
{
if (const svalue *strlen_sval
/* Handler for "strndup" and "__builtin_strndup". */
-class kf_strndup : public known_function
+class kf_strndup : public builtin_known_function
{
public:
bool matches_call_types_p (const call_details &cd) const final override
{
return (cd.num_args () == 2 && cd.arg_is_pointer_p (0));
}
+ enum built_in_function builtin_code () const final override
+ {
+ return BUILT_IN_STRNDUP;
+ }
void impl_call_pre (const call_details &cd) const final override
{
region_model *model = cd.get_model ();
kfm.add (IFN_UBSAN_BOUNDS, make_unique<kf_ubsan_bounds> ());
}
- /* Built-ins the analyzer has known_functions for. */
+ /* GCC built-ins that do not correspond to a function
+ in the standard library. */
{
- kfm.add (BUILT_IN_ALLOCA, make_unique<kf_alloca> ());
- kfm.add (BUILT_IN_ALLOCA_WITH_ALIGN, make_unique<kf_alloca> ());
- kfm.add (BUILT_IN_CALLOC, make_unique<kf_calloc> ());
kfm.add (BUILT_IN_EXPECT, make_unique<kf_expect> ());
kfm.add (BUILT_IN_EXPECT_WITH_PROBABILITY, make_unique<kf_expect> ());
- kfm.add (BUILT_IN_FREE, make_unique<kf_free> ());
- kfm.add (BUILT_IN_MALLOC, make_unique<kf_malloc> ());
- kfm.add (BUILT_IN_MEMCPY, make_unique<kf_memcpy_memmove> ());
- kfm.add (BUILT_IN_MEMCPY_CHK, make_unique<kf_memcpy_memmove> ());
- kfm.add (BUILT_IN_MEMMOVE, make_unique<kf_memcpy_memmove> ());
- kfm.add (BUILT_IN_MEMMOVE_CHK, make_unique<kf_memcpy_memmove> ());
- kfm.add (BUILT_IN_MEMSET, make_unique<kf_memset> ());
- kfm.add (BUILT_IN_MEMSET_CHK, make_unique<kf_memset> ());
- kfm.add (BUILT_IN_REALLOC, make_unique<kf_realloc> ());
- kfm.add (BUILT_IN_SPRINTF, make_unique<kf_sprintf> ());
+ kfm.add (BUILT_IN_ALLOCA_WITH_ALIGN, make_unique<kf_alloca> ());
kfm.add (BUILT_IN_STACK_RESTORE, make_unique<kf_stack_restore> ());
kfm.add (BUILT_IN_STACK_SAVE, make_unique<kf_stack_save> ());
- kfm.add (BUILT_IN_STRCAT, make_unique<kf_strcat> (2));
- kfm.add (BUILT_IN_STRCAT_CHK, make_unique<kf_strcat> (3));
- kfm.add (BUILT_IN_STRCHR, make_unique<kf_strchr> ());
- kfm.add (BUILT_IN_STRCPY, make_unique<kf_strcpy> (2));
- kfm.add (BUILT_IN_STRCPY_CHK, make_unique<kf_strcpy> (3));
- kfm.add (BUILT_IN_STRDUP, make_unique<kf_strdup> ());
- kfm.add (BUILT_IN_STRNDUP, make_unique<kf_strndup> ());
- kfm.add (BUILT_IN_STRLEN, make_kf_strlen ());
register_atomic_builtins (kfm);
register_varargs_builtins (kfm);
}
- /* Known builtins and C standard library functions. */
+ /* Known builtins and C standard library functions
+ the analyzer has known functions for. */
{
- kfm.add ("memset", make_unique<kf_memset> ());
- kfm.add ("strcat", make_unique<kf_strcat> (2));
+ kfm.add ("alloca", make_unique<kf_alloca> ());
+ kfm.add ("__builtin_alloca", make_unique<kf_alloca> ());
+ kfm.add ("calloc", make_unique<kf_calloc> ());
+ kfm.add ("__builtin_calloc", make_unique<kf_calloc> ());
+ kfm.add ("free", make_unique<kf_free> ());
+ kfm.add ("__builtin_free", make_unique<kf_free> ());
+ kfm.add ("malloc", make_unique<kf_malloc> ());
+ kfm.add ("__builtin_malloc", make_unique<kf_malloc> ());
+ kfm.add ("memcpy",
+ make_unique<kf_memcpy_memmove> (kf_memcpy_memmove::KF_MEMCPY));
+ kfm.add ("__builtin_memcpy",
+ make_unique<kf_memcpy_memmove> (kf_memcpy_memmove::KF_MEMCPY));
+ kfm.add ("__memcpy_chk", make_unique<kf_memcpy_memmove>
+ (kf_memcpy_memmove::KF_MEMCPY_CHK));
+ kfm.add ("__builtin___memcpy_chk", make_unique<kf_memcpy_memmove>
+ (kf_memcpy_memmove::KF_MEMCPY_CHK));
+ kfm.add ("memmove",
+ make_unique<kf_memcpy_memmove> (kf_memcpy_memmove::KF_MEMMOVE));
+ kfm.add ("__builtin_memmove",
+ make_unique<kf_memcpy_memmove> (kf_memcpy_memmove::KF_MEMMOVE));
+ kfm.add ("__memmove_chk", make_unique<kf_memcpy_memmove>
+ (kf_memcpy_memmove::KF_MEMMOVE_CHK));
+ kfm.add ("__builtin___memmove_chk", make_unique<kf_memcpy_memmove>
+ (kf_memcpy_memmove::KF_MEMMOVE_CHK));
+ kfm.add ("memset", make_unique<kf_memset> (false));
+ kfm.add ("__builtin_memset", make_unique<kf_memset> (false));
+ kfm.add ("__memset_chk", make_unique<kf_memset> (true));
+ kfm.add ("__builtin___memset_chk", make_unique<kf_memset> (true));
+ kfm.add ("realloc", make_unique<kf_realloc> ());
+ kfm.add ("__builtin_realloc", make_unique<kf_realloc> ());
+ kfm.add ("sprintf", make_unique<kf_sprintf> ());
+ kfm.add ("__builtin_sprintf", make_unique<kf_sprintf> ());
+ kfm.add ("strchr", make_unique<kf_strchr> ());
+ kfm.add ("__builtin_strchr", make_unique<kf_strchr> ());
+ kfm.add ("strcpy", make_unique<kf_strcpy> (2, false));
+ kfm.add ("__builtin_strcpy", make_unique<kf_strcpy> (2, false));
+ kfm.add ("__strcpy_chk", make_unique<kf_strcpy> (3, true));
+ kfm.add ("__builtin___strcpy_chk", make_unique<kf_strcpy> (3, true));
+ kfm.add ("strcat", make_unique<kf_strcat> (2, false));
+ kfm.add ("__builtin_strcat", make_unique<kf_strcat> (2, false));
+ kfm.add ("__strcat_chk", make_unique<kf_strcat> (3, true));
+ kfm.add ("__builtin___strcat_chk", make_unique<kf_strcat> (3, true));
kfm.add ("strdup", make_unique<kf_strdup> ());
+ kfm.add ("__builtin_strdup", make_unique<kf_strdup> ());
kfm.add ("strndup", make_unique<kf_strndup> ());
+ kfm.add ("__builtin_strndup", make_unique<kf_strndup> ());
+ kfm.add ("strlen", make_unique<kf_strlen> ());
+ kfm.add ("__builtin_strlen", make_unique<kf_strlen> ());
+
+ register_atomic_builtins (kfm);
+ register_varargs_builtins (kfm);
}
/* Known POSIX functions, and some non-standard extensions. */
return m_combined_fns_arr[name];
}
+const known_function *
+known_function_manager::
+get_normal_builtin (const builtin_known_function *builtin_kf) const
+{
+ return get_normal_builtin (builtin_kf->builtin_code ());
+}
+
/* Get any known_function matching IDENTIFIER, without type-checking.
Return NULL if there isn't one. */
DISABLE_COPY_AND_ASSIGN (known_function_manager);
const known_function *get_normal_builtin (enum built_in_function name) const;
+ const known_function *
+ get_normal_builtin (const builtin_known_function *builtin_kf) const;
const known_function *get_by_identifier (tree identifier) const;
/* Map from identifier to known_function instance.
return known_fn_mgr->get_internal_fn (ifn);
}
+/* Get any builtin_known_function for CALL and emit any warning to CTXT
+ if not NULL.
+
+ The call must match all assumptions made by the known_function (such as
+ e.g. "argument 1's type must be a pointer type").
+
+ Return NULL if no builtin_known_function is found, or it does
+ not match the assumption(s).
+
+ Internally calls get_known_function to find a known_function and cast it
+ to a builtin_known_function.
+
+ For instance, calloc is a C builtin, defined in gcc/builtins.def
+ by the DEF_LIB_BUILTIN macro. Such builtins are recognized by the
+ analyzer by their name, so that even in C++ or if the user redeclares
+ them but mismatch their signature, they are still recognized as builtins.
+
+ Cases when a supposed builtin is not flagged as one by the FE:
+
+ The C++ FE does not recognize calloc as a builtin if it has not been
+ included from a standard header, but the C FE does. Hence in C++ if
+ CALL comes from a calloc and stdlib is not included,
+ gcc/tree.h:fndecl_built_in_p (CALL) would be false.
+
+ In C code, a __SIZE_TYPE__ calloc (__SIZE_TYPE__, __SIZE_TYPE__) user
+ declaration has obviously a mismatching signature from the standard, and
+ its function_decl tree won't be unified by
+ gcc/c-decl.cc:match_builtin_function_types.
+
+ Yet in both cases the analyzer should treat the calls as a builtin calloc
+ so that extra attributes unspecified by the standard but added by GCC
+ (e.g. sprintf attributes in gcc/builtins.def), useful for the detection of
+ dangerous behavior, are indeed processed.
+
+ Therefore for those cases when a "builtin flag" is not added by the FE,
+ builtins' kf are derived from builtin_known_function, whose method
+ builtin_known_function::builtin_decl returns the builtin's
+ function_decl tree as defined in gcc/builtins.def, with all the extra
+ attributes. */
+
+const builtin_known_function *
+region_model::get_builtin_kf (const gcall *call,
+ region_model_context *ctxt /* = NULL */) const
+{
+ region_model *mut_this = const_cast <region_model *> (this);
+ tree callee_fndecl = mut_this->get_fndecl_for_call (call, ctxt);
+ if (! callee_fndecl)
+ return NULL;
+
+ call_details cd (call, mut_this, ctxt);
+ if (const known_function *kf = get_known_function (callee_fndecl, cd))
+ return kf->dyn_cast_builtin_kf ();
+
+ return NULL;
+}
+
/* Update this model for the CALL stmt, using CTXT to report any
diagnostics - the first half.
bool include_terminator,
const svalue **out_sval);
+ const builtin_known_function *
+ get_builtin_kf (const gcall *call,
+ region_model_context *ctxt = NULL) const;
+
private:
const region *get_lvalue_1 (path_var pv, region_model_context *ctxt) const;
const svalue *get_rvalue_1 (path_var pv, region_model_context *ctxt) const;
const gcall *call, const tree callee_fndecl, const char *attr_name,
access_directions fd_attr_access_dir) const
{
-
- tree attrs = TYPE_ATTRIBUTES (TREE_TYPE (callee_fndecl));
+ /* Handle interesting fd attributes of the callee_fndecl,
+ or prioritize those of the builtin that callee_fndecl is
+ expected to be.
+ Might want this to be controlled by a flag. */
+ tree fndecl = callee_fndecl;
+ /* If call is recognized as a builtin known_function,
+ use that builtin's function_decl. */
+ if (const region_model *old_model = sm_ctxt->get_old_region_model ())
+ if (const builtin_known_function *builtin_kf
+ = old_model->get_builtin_kf (call))
+ fndecl = builtin_kf->builtin_decl ();
+
+ tree attrs = TYPE_ATTRIBUTES (TREE_TYPE (fndecl));
attrs = lookup_attribute (attr_name, attrs);
if (!attrs)
return;
// attributes
{
+ /* Do use the fndecl that caused the warning so that the
+ misused attributes are printed and the user not confused. */
if (is_closed_fd_p (state))
{
sm_ctxt->warn (node, stmt, arg,
make_unique<fd_use_after_close>
(*this, diag_arg,
- callee_fndecl, attr_name,
+ fndecl, attr_name,
arg_idx));
continue;
}
sm_ctxt->warn (node, stmt, arg,
make_unique<fd_use_without_check>
(*this, diag_arg,
- callee_fndecl, attr_name,
+ fndecl, attr_name,
arg_idx));
continue;
}
node, stmt, arg,
make_unique<fd_access_mode_mismatch> (*this, diag_arg,
DIRS_WRITE,
- callee_fndecl,
+ fndecl,
attr_name,
arg_idx));
}
node, stmt, arg,
make_unique<fd_access_mode_mismatch> (*this, diag_arg,
DIRS_READ,
- callee_fndecl,
+ fndecl,
attr_name,
arg_idx));
}
malloc_state_machine *mutable_this
= const_cast <malloc_state_machine *> (this);
- /* Handle "__attribute__((malloc(FOO)))". */
- if (const deallocator_set *deallocators
+ /* Handle interesting attributes of the callee_fndecl,
+ or prioritize those of the builtin that callee_fndecl is expected
+ to be.
+ Might want this to be controlled by a flag. */
+ {
+ tree fndecl = callee_fndecl;
+ /* If call is recognized as a builtin known_function, use that
+ builtin's function_decl. */
+ if (const region_model *old_model = sm_ctxt->get_old_region_model ())
+ if (const builtin_known_function *builtin_kf
+ = old_model->get_builtin_kf (call))
+ fndecl = builtin_kf->builtin_decl ();
+
+ /* Handle "__attribute__((malloc(FOO)))". */
+ if (const deallocator_set *deallocators
= mutable_this->get_or_create_custom_deallocator_set
- (callee_fndecl))
+ (fndecl))
+ {
+ tree attrs = TYPE_ATTRIBUTES (TREE_TYPE (fndecl));
+ bool returns_nonnull
+ = lookup_attribute ("returns_nonnull", attrs);
+ on_allocator_call (sm_ctxt, call, deallocators, returns_nonnull);
+ }
+
{
- tree attrs = TYPE_ATTRIBUTES (TREE_TYPE (callee_fndecl));
- bool returns_nonnull
- = lookup_attribute ("returns_nonnull", attrs);
- on_allocator_call (sm_ctxt, call, deallocators, returns_nonnull);
+ /* Handle "__attribute__((nonnull))". */
+ tree fntype = TREE_TYPE (fndecl);
+ bitmap nonnull_args = get_nonnull_args (fntype);
+ if (nonnull_args)
+ {
+ for (unsigned i = 0; i < gimple_call_num_args (stmt); i++)
+ {
+ tree arg = gimple_call_arg (stmt, i);
+ if (TREE_CODE (TREE_TYPE (arg)) != POINTER_TYPE)
+ continue;
+ /* If we have a nonnull-args, and either all pointers, or
+ just the specified pointers. */
+ if (bitmap_empty_p (nonnull_args)
+ || bitmap_bit_p (nonnull_args, i))
+ {
+ state_t state = sm_ctxt->get_state (stmt, arg);
+ /* Can't use a switch as the states are non-const. */
+ /* Do use the fndecl that caused the warning so that the
+ misused attributes are printed and the user not
+ confused. */
+ if (unchecked_p (state))
+ {
+ tree diag_arg = sm_ctxt->get_diagnostic_tree (arg);
+ sm_ctxt->warn (node, stmt, arg,
+ make_unique<possible_null_arg>
+ (*this, diag_arg, fndecl, i));
+ const allocation_state *astate
+ = as_a_allocation_state (state);
+ sm_ctxt->set_next_state (stmt, arg,
+ astate->get_nonnull ());
+ }
+ else if (state == m_null)
+ {
+ tree diag_arg = sm_ctxt->get_diagnostic_tree (arg);
+ sm_ctxt->warn (node, stmt, arg,
+ make_unique<null_arg>
+ (*this, diag_arg, fndecl, i));
+ sm_ctxt->set_next_state (stmt, arg, m_stop);
+ }
+ else if (state == m_start)
+ maybe_assume_non_null (sm_ctxt, arg, stmt);
+ }
+ }
+ BITMAP_FREE (nonnull_args);
+ }
}
- /* Handle "__attribute__((nonnull))". */
- {
- tree fntype = TREE_TYPE (callee_fndecl);
- bitmap nonnull_args = get_nonnull_args (fntype);
- if (nonnull_args)
+ /* Check for this after nonnull, so that if we have both
+ then we transition to "freed", rather than "checked". */
+ unsigned dealloc_argno = fndecl_dealloc_argno (fndecl);
+ if (dealloc_argno != UINT_MAX)
{
- for (unsigned i = 0; i < gimple_call_num_args (stmt); i++)
- {
- tree arg = gimple_call_arg (stmt, i);
- if (TREE_CODE (TREE_TYPE (arg)) != POINTER_TYPE)
- continue;
- /* If we have a nonnull-args, and either all pointers, or just
- the specified pointers. */
- if (bitmap_empty_p (nonnull_args)
- || bitmap_bit_p (nonnull_args, i))
- {
- state_t state = sm_ctxt->get_state (stmt, arg);
- /* Can't use a switch as the states are non-const. */
- if (unchecked_p (state))
- {
- tree diag_arg = sm_ctxt->get_diagnostic_tree (arg);
- sm_ctxt->warn (node, stmt, arg,
- make_unique<possible_null_arg>
- (*this, diag_arg, callee_fndecl, i));
- const allocation_state *astate
- = as_a_allocation_state (state);
- sm_ctxt->set_next_state (stmt, arg,
- astate->get_nonnull ());
- }
- else if (state == m_null)
- {
- tree diag_arg = sm_ctxt->get_diagnostic_tree (arg);
- sm_ctxt->warn (node, stmt, arg,
- make_unique<null_arg>
- (*this, diag_arg, callee_fndecl, i));
- sm_ctxt->set_next_state (stmt, arg, m_stop);
- }
- else if (state == m_start)
- maybe_assume_non_null (sm_ctxt, arg, stmt);
- }
- }
- BITMAP_FREE (nonnull_args);
+ const deallocator *d
+ = mutable_this->get_or_create_deallocator (fndecl);
+ on_deallocator_call (sm_ctxt, node, call, d, dealloc_argno);
}
}
-
- /* Check for this after nonnull, so that if we have both
- then we transition to "freed", rather than "checked". */
- unsigned dealloc_argno = fndecl_dealloc_argno (callee_fndecl);
- if (dealloc_argno != UINT_MAX)
- {
- const deallocator *d
- = mutable_this->get_or_create_deallocator (callee_fndecl);
- on_deallocator_call (sm_ctxt, node, call, d, dealloc_argno);
- }
}
/* Look for pointers explicitly being compared against zero
-#include "analyzer-decls.h"
-
-#define NULL ((void *)0)
+#include "../../gcc.dg/analyzer/analyzer-decls.h"
struct s1
{
void test_2 (struct s2 **pp2, struct s2 *p2_parm)
{
/* Ensure that p2_glob is modified. */
- p2_glob = __builtin_malloc (sizeof (struct s2));
+ p2_glob = (struct s2 *) __builtin_malloc (sizeof (struct s2));
if (!p2_glob)
return;
void test_3 (struct s3 **pp3, struct s3 *p3_parm)
{
- p3_glob = __builtin_malloc (sizeof (struct s3));
+ p3_glob = (struct s3 *) __builtin_malloc (sizeof (struct s3));
if (!p3_glob)
return;
void foo(char **args[], int *argc)
{
*argc = 1;
- (*args)[0] = __builtin_malloc(42);
+ (*args)[0] = (char *) __builtin_malloc(42);
}
--- /dev/null
+/* { dg-additional-options "-fdiagnostics-path-format=inline-events -fdiagnostics-show-caret" } */
+
+#include <stdint.h>
+
+void test_constant_1 (void)
+{
+ int32_t *ptr = (int32_t *) __builtin_malloc (1); /* { dg-warning "allocated buffer size is not a multiple of the pointee's size" } */
+ __builtin_free (ptr);
+}
+
+/* { dg-begin-multiline-output "" }
+ int32_t *ptr = (int32_t *) __builtin_malloc (1);
+ ^~~~~~~~~~~~~~~~~~~~
+ 'test_constant_1': events 1-2
+ |
+ | int32_t *ptr = (int32_t *) __builtin_malloc (1);
+ | ^~~~~~~~~~~~~~~~~~~~
+ | |
+ | (1) allocated 1 byte here
+ | (2) assigned to 'int32_t *'
+ |
+ { dg-end-multiline-output "" { target c } } */
+/* { dg-begin-multiline-output "" }
+ int32_t *ptr = (int32_t *) __builtin_malloc (1);
+ ~~~~~~~~~~~~~~~~~^~~
+ 'void test_constant_1()': events 1-2
+ |
+ | int32_t *ptr = (int32_t *) __builtin_malloc (1);
+ | ~~~~~~~~~~~~~~~~~^~~
+ | |
+ | (1) allocated 1 byte here
+ | (2) assigned to 'int32_t*' {aka '{re:long :re?}int*'} here; 'sizeof (int32_t {aka {re:long :re?}int})' is '4'
+ |
+ { dg-end-multiline-output "" { target c++ } } */
+
+void test_constant_2 (void)
+{
+ int32_t *ptr = (int32_t *) __builtin_malloc (2); /* { dg-warning "allocated buffer size is not a multiple of the pointee's size" } */
+ __builtin_free (ptr);
+}
+
+/* { dg-begin-multiline-output "" }
+ int32_t *ptr = (int32_t *) __builtin_malloc (2);
+ ^~~~~~~~~~~~~~~~~~~~
+ 'test_constant_2': events 1-2
+ |
+ | int32_t *ptr = (int32_t *) __builtin_malloc (2);
+ | ^~~~~~~~~~~~~~~~~~~~
+ | |
+ | (1) allocated 2 bytes here
+ | (2) assigned to 'int32_t *'
+ |
+ { dg-end-multiline-output "" { target c } } */
+
+/* { dg-begin-multiline-output "" }
+ int32_t *ptr = (int32_t *) __builtin_malloc (2);
+ ~~~~~~~~~~~~~~~~~^~~
+ 'void test_constant_2()': events 1-2
+ |
+ | int32_t *ptr = (int32_t *) __builtin_malloc (2);
+ | ~~~~~~~~~~~~~~~~~^~~
+ | |
+ | (1) allocated 2 bytes here
+ | (2) assigned to 'int32_t*' {aka '{re:long :re?}int*'} here; 'sizeof (int32_t {aka {re:long :re?}int})' is '4'
+ |
+ { dg-end-multiline-output "" { target c++ } } */
+
+void test_symbolic (int n)
+{
+ int32_t *ptr = (int32_t *) __builtin_malloc (n * 2); /* { dg-warning "allocated buffer size is not a multiple of the pointee's size" } */
+ __builtin_free (ptr);
+}
+
+/* { dg-begin-multiline-output "" }
+ int32_t *ptr = (int32_t *) __builtin_malloc (n * 2);
+ ^~~~~~~~~~~~~~~~~~~~~~~~
+ 'test_symbolic': event 1
+ |
+ | int32_t *ptr = (int32_t *) __builtin_malloc (n * 2);
+ | ^~~~~~~~~~~~~~~~~~~~~~~~
+ | |
+ | (1) allocated 'n * 2' bytes and assigned to 'int32_t *'
+ |
+ { dg-end-multiline-output "" { target c } } */
+
+/* { dg-begin-multiline-output "" }
+ int32_t *ptr = (int32_t *) __builtin_malloc (n * 2);
+ ~~~~~~~~~~~~~~~~~^~~~~~~
+ 'void test_symbolic(int)': event 1
+ |
+ | int32_t *ptr = (int32_t *) __builtin_malloc (n * 2);
+ | ~~~~~~~~~~~~~~~~~^~~~~~~
+ | |
+ | (1) allocated '(n * 2)' bytes and assigned to 'int32_t*' {aka '{re:long :re?}int*'} here; 'sizeof (int32_t {aka {re:long :re?}int})' is '4'
+ |
+ { dg-end-multiline-output "" { target c++ } } */
--- /dev/null
+/* { dg-additional-options "-fdiagnostics-path-format=inline-events -fdiagnostics-show-caret -fanalyzer-fine-grained" } */
+/* { dg-require-effective-target alloca } */
+
+#include <stdint.h>
+
+void test_constant_1 (void)
+{
+ int32_t *ptr = (int32_t *) __builtin_alloca (1); /* { dg-warning "allocated buffer size is not a multiple of the pointee's size" } */
+}
+
+/* { dg-begin-multiline-output "" }
+ int32_t *ptr = (int32_t *) __builtin_alloca (1);
+ ^~~~~~~~~~~~~~~~~~~~
+ 'test_constant_1': events 1-2
+ |
+ | int32_t *ptr = (int32_t *) __builtin_alloca (1);
+ | ^~~~~~~~~~~~~~~~~~~~
+ | |
+ | (1) allocated 1 byte here
+ | (2) assigned to 'int32_t *'
+ |
+ { dg-end-multiline-output "" { target c } } */
+/* { dg-begin-multiline-output "" }
+ int32_t *ptr = (int32_t *) __builtin_alloca (1);
+ ~~~~~~~~~~~~~~~~~^~~
+ 'void test_constant_1()': events 1-2
+ |
+ | int32_t *ptr = (int32_t *) __builtin_alloca (1);
+ | ~~~~~~~~~~~~~~~~~^~~
+ | |
+ | (1) allocated 1 byte here
+ | (2) assigned to 'int32_t*' {aka '{re:long :re?}int*'} here; 'sizeof (int32_t {aka {re:long :re?}int})' is '4'
+ |
+ { dg-end-multiline-output "" { target c++ } } */
+
+void test_constant_2 (void)
+{
+ int32_t *ptr = (int32_t *) __builtin_alloca (2); /* { dg-warning "allocated buffer size is not a multiple of the pointee's size" } */
+}
+
+/* { dg-begin-multiline-output "" }
+ int32_t *ptr = (int32_t *) __builtin_alloca (2);
+ ^~~~~~~~~~~~~~~~~~~~
+ 'test_constant_2': events 1-2
+ |
+ | int32_t *ptr = (int32_t *) __builtin_alloca (2);
+ | ^~~~~~~~~~~~~~~~~~~~
+ | |
+ | (1) allocated 2 bytes here
+ | (2) assigned to 'int32_t *'
+ |
+ { dg-end-multiline-output "" { target c } } */
+/* { dg-begin-multiline-output "" }
+ int32_t *ptr = (int32_t *) __builtin_alloca (2);
+ ~~~~~~~~~~~~~~~~~^~~
+ 'void test_constant_2()': events 1-2
+ |
+ | int32_t *ptr = (int32_t *) __builtin_alloca (2);
+ | ~~~~~~~~~~~~~~~~~^~~
+ | |
+ | (1) allocated 2 bytes here
+ | (2) assigned to 'int32_t*' {aka '{re:long :re?}int*'} here; 'sizeof (int32_t {aka {re:long :re?}int})' is '4'
+ |
+ { dg-end-multiline-output "" { target c++ } } */
+
+void test_symbolic (int n)
+{
+ int32_t *ptr = (int32_t *) __builtin_alloca (n * 2); /* { dg-warning "allocated buffer size is not a multiple of the pointee's size" } */
+}
+
+/* { dg-begin-multiline-output "" }
+ int32_t *ptr = (int32_t *) __builtin_alloca (n * 2);
+ ^~~~~~~~~~~~~~~~~~~~~~~~
+ 'test_symbolic': events 1-2
+ |
+ | int32_t *ptr = (int32_t *) __builtin_alloca (n * 2);
+ | ^~~~~~~~~~~~~~~~~~~~~~~~
+ | |
+ | (1) allocated 'n * 2' bytes here
+ | (2) assigned to 'int32_t *'
+ |
+ { dg-end-multiline-output "" { target c } } */
+/* { dg-begin-multiline-output "" }
+ int32_t *ptr = (int32_t *) __builtin_alloca (n * 2);
+ ~~~~~~~~~~~~~~~~~^~~~~~~
+ 'void test_symbolic(int)': events 1-2
+ |
+ | int32_t *ptr = (int32_t *) __builtin_alloca (n * 2);
+ | ~~~~~~~~~~~~~~~~~^~~~~~~
+ | |
+ | (1) allocated '(n * 2)' bytes here
+ | (2) assigned to 'int32_t*' {aka '{re:long :re?}int*'} here; 'sizeof (int32_t {aka {re:long :re?}int})' is '4'
+ |
+ { dg-end-multiline-output "" { target c++ } } */
+
+/* FIXME: am getting a duplicate warning here for some reason
+ without -fanalyzer-fine-grained (PR PR analyzer/107851). */
+
--- /dev/null
+/* Verify that we warn for incorrect uses of "alloca" (which may be in a
+ macro in a system header), and that the output looks correct. */
+
+/* { dg-additional-options "-fdiagnostics-path-format=inline-events -fdiagnostics-show-caret -fanalyzer-fine-grained" } */
+/* { dg-require-effective-target alloca } */
+
+#include <stdint.h>
+#include "../../gcc.dg/analyzer/test-alloca.h"
+
+void test_constant_99 (void)
+{
+ int32_t *ptr = (int32_t *) alloca (99); /* { dg-warning "allocated buffer size is not a multiple of the pointee's size" } */
+}
+
+/* { dg-begin-multiline-output "" }
+ int32_t *ptr = (int32_t *) alloca (99);
+ ^~~~~~
+ 'test_constant_99': events 1-2
+ |
+ | int32_t *ptr = (int32_t *) alloca (99);
+ | ^~~~~~
+ | |
+ | (1) allocated 99 bytes here
+ | (2) assigned to 'int32_t *' {aka '{re:long :re?}int *'} here; 'sizeof (int32_t {aka {re:long :re?}int})' is '4'
+ |
+ { dg-end-multiline-output "" { target c } } */
+/* { dg-begin-multiline-output "" }
+ int32_t *ptr = (int32_t *) alloca (99);
+ ^~~~~~
+ 'void test_constant_99()': events 1-2
+ |
+ | int32_t *ptr = (int32_t *) alloca (99);
+ | ^~~~~~
+ | |
+ | (1) allocated 99 bytes here
+ | (2) assigned to 'int32_t*' {aka '{re:long :re?}int*'} here; 'sizeof (int32_t {aka {re:long :re?}int})' is '4'
+ |
+ { dg-end-multiline-output "" { target c++ } } */
+
+void test_symbolic (int n)
+{
+ int32_t *ptr = (int32_t *) alloca (n * 2); /* { dg-warning "allocated buffer size is not a multiple of the pointee's size" } */
+}
+
+/* { dg-begin-multiline-output "" }
+ int32_t *ptr = (int32_t *) alloca (n * 2);
+ ^~~~~~
+ 'test_symbolic': events 1-2
+ |
+ | int32_t *ptr = (int32_t *) alloca (n * 2);
+ | ^~~~~~
+ | |
+ | (1) allocated 'n * 2' bytes here
+ | (2) assigned to 'int32_t *' {aka '{re:long :re?}int *'} here; 'sizeof (int32_t {aka {re:long :re?}int})' is '4'
+ |
+ { dg-end-multiline-output "" { target c } } */
+/* { dg-begin-multiline-output "" }
+ int32_t *ptr = (int32_t *) alloca (n * 2);
+ ^~~~~~
+ 'void test_symbolic(int)': events 1-2
+ |
+ | int32_t *ptr = (int32_t *) alloca (n * 2);
+ | ^~~~~~
+ | |
+ | (1) allocated '(n * 2)' bytes here
+ | (2) assigned to 'int32_t*' {aka '{re:long :re?}int*'} here; 'sizeof (int32_t {aka {re:long :re?}int})' is '4'
+ |
+ { dg-end-multiline-output "" { target c++ } } */
/* Adapted from various files in the Linux kernel, all of which have: */
/* SPDX-License-Identifier: GPL-2.0 */
-typedef _Bool bool;
-#define true 1
-#define false 0
+#ifndef __cplusplus
+ typedef _Bool bool;
+ #define true 1
+ #define false 0
+#endif
typedef struct {} atomic_t;
/* Adapted from Linux x86: page_ref_dec_and_test.c (GPL-2.0). */
-typedef _Bool bool;
+#ifndef __cplusplus
+ typedef _Bool bool;
+#endif
typedef struct {
int counter;
/* [...snip...] */
- es = malloc(sizeof(*es));
+ es = (struct error_snapshot *) malloc(sizeof(*es));
if (!es)
return;
void *
test (const char *str)
{
- struct foo *p = __builtin_malloc(sizeof(struct foo));
+ struct foo *p = (struct foo *) __builtin_malloc(sizeof(struct foo));
if (!p)
return p;
{
FILE *q = fdopen (0); // { dg-message "allocated here" }
- q = realloc (q, 7); // { dg-warning "'realloc' called on 'q' returned from a mismatched allocation function" }
+ q = (FILE *) realloc (q, 7); // { dg-warning "'realloc' called on 'q' returned from a mismatched allocation function" }
sink (q);
}
}
{
FILE *q = fdopen (0);
- q = realloc (q, 7); // { dg-warning "'realloc' called on 'q' returned from a mismatched allocation function" }
+ q = (FILE *) realloc (q, 7); // { dg-warning "'realloc' called on 'q' returned from a mismatched allocation function" }
sink (q);
}
}
void warn_malloc (void)
{
{
- FILE *p = malloc (100); // { dg-message "allocated here" }
+ FILE *p = (FILE *) malloc (100); // { dg-message "allocated here" }
fclose (p); // { dg-warning "'p' should have been deallocated with 'free' but was deallocated with 'fclose'" }
}
{
- FILE *p = malloc (100); // { dg-message "allocated here" }
+ FILE *p = (FILE *) malloc (100); // { dg-message "allocated here" }
p = freopen ("1", "r", p);// { dg-warning "'p' should have been deallocated with 'free' but was deallocated with 'freopen'" }
fclose (p);
}
{
- FILE *p = malloc (100); // { dg-message "allocated here" }
+ FILE *p = (FILE *) malloc (100); // { dg-message "allocated here" }
pclose (p); // { dg-warning "'p' should have been deallocated with 'free' but was deallocated with 'pclose'" }
}
}
{
FILE *p = acquire (); // { dg-message "allocated here \\(expects deallocation with 'release'\\)" }
- p = realloc (p, 123); // { dg-warning "'p' should have been deallocated with 'release' but was deallocated with 'realloc'" }
+ p = (FILE *) realloc (p, 123); // { dg-warning "'p' should have been deallocated with 'release' but was deallocated with 'realloc'" }
sink (p);
}
}
typedef unsigned char u8;
typedef unsigned short u16;
-typedef _Bool bool;
+
+#ifndef __cplusplus
+ typedef _Bool bool;
+#endif
#define ENOMEM 12
#define EINVAL 22
goto err;
}
- skb = items[i].transfer_context;
+ skb = (struct sk_buff *) items[i].transfer_context;
urb_context->skb = skb;
urb = usb_alloc_urb(0, GFP_ATOMIC); /* { dg-message "allocated here" } */
/* Simulate code to register the callback. */
extern void callback_registration (const void *);
-int ath10k_usb_probe(void)
+void ath10k_usb_probe(void)
{
callback_registration(&ath10k_usb_hif_ops);
}
// TODO: remove need for this option
/* { dg-additional-options "-fanalyzer-checker=taint" } */
-#include "analyzer-decls.h"
+#include "../../gcc.dg/analyzer/analyzer-decls.h"
struct arg_buf
{
__analyzer_dump_state ("taint", q); /* { dg-warning "state: 'tainted'" } */
__analyzer_dump_state ("taint", *q); /* { dg-warning "state: 'tainted'" } */
- struct arg_buf *args = p;
+ struct arg_buf *args = (struct arg_buf *) p;
__analyzer_dump_state ("taint", args->i); /* { dg-warning "state: 'tainted'" } */
__analyzer_dump_state ("taint", args->j); /* { dg-warning "state: 'tainted'" } */
}
__analyzer_dump_state ("taint", p); /* { dg-warning "state: 'start'" } */
__analyzer_dump_state ("taint", q); /* { dg-warning "state: 'start'" } */
- struct arg_buf *args = p;
+ struct arg_buf *args = (struct arg_buf *) p;
__analyzer_dump_state ("taint", args->i); /* { dg-warning "state: 'start'" } */
__analyzer_dump_state ("taint", args->j); /* { dg-warning "state: 'start'" } */
}
static char *string_dup(const char *string) {
char *buf;
- if ((buf = malloc(strlen(string) + 1)) == ((void *)0))
+ if ((buf = (char *) malloc(strlen(string) + 1)) == ((void *)0))
failed("malloc() failed");
return strcpy(buf, string);
if ((p = (struct mydata *)malloc(sizeof(struct mydata))) == ((void *)0))
failed("malloc() failed");
- p->link = ((void *)0);
+ p->link = (struct mydata *)((void *)0);
p->name = string_dup(name);
p->type = string_dup(type);
-#include "analyzer-decls.h"
-
+#include "../../gcc.dg/analyzer/analyzer-decls.h"
typedef __SIZE_TYPE__ size_t;
-#define NULL ((void *)0)
-
extern void *calloc (size_t __nmemb, size_t __size)
__attribute__ ((__nothrow__ , __leaf__))
__attribute__ ((__malloc__))
{
char *p;
- p = calloc (1, 3);
+ p = (char *) calloc (1, 3);
if (!p)
return NULL;
-#include "analyzer-decls.h"
+#include "../../gcc.dg/analyzer/analyzer-decls.h"
struct coord
{
/* Copying from an on-stack array to a global array. */
-struct coord glob_arr[16];
+struct coord glob_arr2[16];
void test_2 (void)
{
arr[3].x = 5;
arr[3].y = 6;
- glob_arr[7] = arr[3];
+ glob_arr2[7] = arr[3];
- __analyzer_eval (glob_arr[7].x == 5); /* { dg-warning "TRUE" } */
- __analyzer_eval (glob_arr[7].y == 6); /* { dg-warning "TRUE" } */
+ __analyzer_eval (glob_arr2[7].x == 5); /* { dg-warning "TRUE" } */
+ __analyzer_eval (glob_arr2[7].y == 6); /* { dg-warning "TRUE" } */
}
/* Copying from a partially initialized on-stack array to a global array. */
-struct coord glob_arr[16];
+struct coord glob_arr3[16];
void test_3 (void)
{
struct coord arr[16];
arr[3].y = 6;
- glob_arr[7] = arr[3]; // or should the uninit warning be here?
+ glob_arr3[7] = arr[3]; // or should the uninit warning be here?
- __analyzer_eval (glob_arr[7].x); /* { dg-warning "uninitialized" "uninit" { xfail *-*-* } } */
+ __analyzer_eval (glob_arr3[7].x); /* { dg-warning "uninitialized" "uninit" { xfail *-*-* } } */
/* { dg-bogus "UNKNOWN" "unknown" { xfail *-*-* } .-1 } */
- __analyzer_eval (glob_arr[7].y == 6); /* { dg-warning "TRUE" } */
+ __analyzer_eval (glob_arr3[7].y == 6); /* { dg-warning "TRUE" } */
}
/* Symbolic bindings: copying from one array to another. */
-struct coord glob_arr[16];
-
void test_4 (int i)
{
struct coord arr_a[16];
/* Symbolic bindings: copying within an array: symbolic src and dest */
-struct coord glob_arr[16];
-
void test_5a (int i, int j)
{
struct coord arr[16];
/* Symbolic bindings: copying within an array: symbolic src, concrete dest. */
-struct coord glob_arr[16];
-
void test_5b (int i)
{
struct coord arr[16];
/* Symbolic bindings: copying within an array: concrete src, symbolic dest. */
-struct coord glob_arr[16];
-
void test_5c (int i)
{
struct coord arr[16];
/* No info on the subregion being copied, and hence
binding_cluster2::maybe_get_compound_binding should return NULL. */
+struct coord glob_arr6[16];
+
void test_6 (void)
{
struct coord arr[16];
- arr[7] = glob_arr[3];
+ arr[7] = glob_arr6[3];
__analyzer_eval (arr[7].x == 5); /* { dg-warning "UNKNOWN" } */
__analyzer_eval (arr[7].y == 6); /* { dg-warning "UNKNOWN" } */
typedef unsigned int __uint32_t;
typedef unsigned long int __uintmax_t;
typedef struct _IO_FILE FILE;
+
+#ifndef __cplusplus
+ typedef _Bool bool;
+#endif
+
extern size_t
fread_unlocked(void* __restrict __ptr,
size_t __size,
__attribute__((__const__));
extern uint_fast32_t const crctab[8][256];
-static _Bool
+static bool
cksum_slice8(FILE* fp, uint_fast32_t* crc_out, uintmax_t* length_out)
{
uint32_t buf[(1 << 16) / sizeof(uint32_t)];
int checksum = 0;
uintmax_t total_bytes = 0;
static const size_t buffer_length = 32768;
- uint8_t* buffer = malloc(buffer_length);
+ uint8_t* buffer = (uint8_t *) malloc(buffer_length);
if (!buffer)
return -1;
--- /dev/null
+int test (void)
+{
+ const unsigned char *s = (const unsigned char *) "abc";
+ const signed char *t = (const signed char *) "xyz";
+ return s[1] + t[1];
+}
}
data = could_fail_2 (fd);
- hdr = data;
+ hdr = (struct header *) data;
if (hdr->signature != 42) {
ret = -2;
}
data = xmmap(((void *)0), revindex_size, 0x1, 0x02, fd, 0);
- hdr = data;
+ hdr = (struct revindex_header *) data;
if (git_bswap32(hdr->signature) != 0x52494458) {
ret =
/* Reduced from haproxy-2.7.1: src/tcpcheck.c. */
-#define NULL ((void *)0)
+#include "../../gcc.dg/analyzer/analyzer-decls.h"
+
int
test_1 (char **args, int cur_arg)
/* { dg-additional-options "-Wno-analyzer-too-complex" } */
typedef __SIZE_TYPE__ size_t;
-#define NULL ((void *)0)
+
+#include "../../gcc.dg/analyzer/analyzer-decls.h"
+
extern void *calloc(size_t __nmemb, size_t __size)
__attribute__((__nothrow__, __leaf__)) __attribute__((__malloc__))
void free_tcpcheck_http_hdr(struct tcpcheck_http_hdr *hdr);
#define ist(str) ({ \
- char *__x = (void *)(str); \
+ char *__x = (char *) ((void *)(str)); \
(struct ist){ \
.ptr = __x, \
.len = __builtin_constant_p(str) ? \
goto error;
}
- chk = calloc(1, sizeof(*chk));
+ chk = (struct tcpcheck_rule *) calloc(1, sizeof(*chk));
if (!chk) {
/* [...snip...] */
goto error;
else if (strcmp(arg, "even") == 0)
*proc |= (~0UL / 3UL) << 1;
else {
- const char *p, *dash = ((void*)0);
+ const char *p, *dash = (const char *) ((void*)0);
unsigned int low, high;
for (p = arg; *p; p++) {
/* Reduced from linux-5.10.162's drivers-base-bus.c */
/* { dg-additional-options "-fno-delete-null-pointer-checks -O2" } */
-#define NULL ((void*)0)
+#include "../../gcc.dg/analyzer/analyzer-decls.h"
+
typedef unsigned int __kernel_size_t;
typedef int __kernel_ssize_t;
to_kset(struct kobject* kobj)
{
return kobj ? ({
- void* __mptr = (void*)(kobj);
+ char* __mptr = (char*)(kobj);
((struct kset*)(__mptr - __builtin_offsetof(struct kset, kobj)));
}) : NULL;
}
/* Fixed in r7-2945-g61f46d0e6dd568.
Simplified from gcc/ipa-devirt.c. */
-#define NULL ((void *)0)
+#include "../../gcc.dg/analyzer/analyzer-decls.h"
+
+
typedef struct odr_type_d {
/* .... */
int id;
-#define NULL ((void *)0)
+#include "../../gcc.dg/analyzer/analyzer-decls.h"
+
+#ifdef __cplusplus
+ #define CONST_CAST(type) const_cast<type>
+#else
+ #define CONST_CAST(type)
+#endif
extern int execl(const char *pathname, const char *arg, ...);
extern int execlp(const char *file, const char *arg, ...);
int test_execle_ls_al ()
{
- const char *env[3] = {"FOO=BAR", "BAZ", NULL};
+ char * env[3] = {CONST_CAST(char *)("FOO=BAR"), CONST_CAST(char *)("BAZ"), NULL};
return execl ("/usr/bin/ls", "ls", "-al", NULL, env);
}
int test_execv_ls_al ()
{
- char *argv[3] = {"ls", "-al", NULL};
+ char * argv[3] = {CONST_CAST(char *)("ls"), CONST_CAST(char *)("-al"), NULL};
return execv ("/usr/bin/ls", argv);
}
int test_execvp_ls_al ()
{
- char *argv[3] = {"ls", "-al", NULL};
+ char *argv[3] = {CONST_CAST(char *)("ls"), CONST_CAST(char *)("-al"), NULL};
return execvp ("ls", argv);
}
int test_execvpe_ls_al ()
{
- char *env[3] = {"FOO=BAR", "BAZ", NULL};
- char *argv[3] = {"ls", "-al", NULL};
+ char *env[3] = {CONST_CAST(char *)("FOO=BAR"), CONST_CAST(char *)("BAZ"), NULL};
+ char *argv[3] = {CONST_CAST(char *)("ls"), CONST_CAST(char *)("-al"), NULL};
return execvpe ("ls", argv, env);
}
/* Types. */
typedef unsigned char u8;
+#ifndef __cplusplus
typedef _Bool bool;
+#endif
typedef unsigned int gfp_t;
struct file;
static inline struct proc_inode *PROC_I(const struct inode *inode)
{
- void *__mptr = (void *)(inode);
+ char *__mptr = (char *)(inode);
return ((struct proc_inode *)(__mptr - __builtin_offsetof(struct proc_inode, vfs_inode)));
}
{
struct proc_dir_entry *pde = PDE(inode);
int rv = 0;
- typeof(((struct proc_ops*)0)->proc_open) open;
- typeof(((struct proc_ops*)0)->proc_release) release;
+
+
+ int (*open)(struct inode *, struct file *);
+ int (*release)(struct inode *, struct file *);
+
struct pde_opener *pdeo;
if (pde_is_permanent(pde)) {
release = pde->proc_ops->proc_release;
if (release) {
- pdeo = kmem_cache_alloc(pde_opener_cache,
+ pdeo = (struct pde_opener *) kmem_cache_alloc(pde_opener_cache,
((( gfp_t)(0x400u|0x800u))
| (( gfp_t)0x40u)
| (( gfp_t)0x80u)));
krb5_error error;
const char *message = error_message(problem);
error.text.length = strlen(message) + 1;
- if (!(error.text.data = malloc(error.text.length))) {
+ if (!(error.text.data = (char *) malloc(error.text.length))) {
goto cleanup;
}
free(error.text.data);
-#define NULL ((void *)0)
+#include "../../gcc.dg/analyzer/analyzer-decls.h"
void calling_null_fn_ptr_1 (void)
{
/* { dg-additional-options "-fno-analyzer-call-summaries -Wno-analyzer-too-complex" } */
-#define NULL ((void *)0)
+#include "../../gcc.dg/analyzer/analyzer-decls.h"
+
+
typedef __builtin_va_list va_list;
typedef struct _GQueue GQueue;
void test_6 (struct st2 *p)
{
- struct st2 *q = __builtin_malloc (p->i);
+ struct st2 *q = (struct st2 *) __builtin_malloc (p->i);
if (!q)
return;
q->i = p->i;
void test_7 (struct st2 *p)
{
- struct st2 *q = __builtin_malloc (p->i);
+ struct st2 *q = (struct st2 *) __builtin_malloc (p->i);
q->i = p->i; /* { dg-warning "dereference of possibly-NULL 'q'" } */
test_7 (q);
__builtin_free (q);
/* { dg-additional-options "-fno-analyzer-call-summaries -Wno-analyzer-too-complex" } */
-#define NULL ((void *)0)
+#include "../../gcc.dg/analyzer/analyzer-decls.h"
+
+
typedef __builtin_va_list va_list;
typedef __SIZE_TYPE__ size_t;
gimple assign stmts, with just "zero-init everything" CONSTRUCTORs
and "clobber" CONSTRUCTORs. */
-#include "analyzer-decls.h"
+#include "../../gcc.dg/analyzer/analyzer-decls.h"
struct coord
{
void test_10 (void)
{
- struct coord c[2] = {{.y = 4, .x = 3}, {5, 6}};
+ struct coord c[2] = {{.x = 3, .y = 4}, {5, 6}};
__analyzer_eval (c[0].x == 3); /* { dg-warning "TRUE" } */
__analyzer_eval (c[0].y == 4); /* { dg-warning "TRUE" } */
__analyzer_eval (c[1].x == 5); /* { dg-warning "TRUE" } */
/* { dg-additional-options "-O2 -fdiagnostics-show-path-depths" } */
/* { dg-additional-options "-fdiagnostics-path-format=inline-events -fdiagnostics-show-caret" } */
+#include "../../gcc.dg/analyzer/analyzer-decls.h"
typedef __SIZE_TYPE__ size_t;
-#define NULL ((void *)0)
struct input_file_st
{
| (4) ...to here
| (5) argument 1 ('<unknown>') NULL where non-null expected
|
- { dg-end-multiline-output "" } */
+ { dg-end-multiline-output "" { target c } } */
+
+
+/* { dg-begin-multiline-output "" }
+ return __builtin_strlen (f);
+ ~~~~~~~~~~~~~~~~~^~~
+ 'size_t test(const input_file*)': events 1-2 (depth 1)
+ |
+ | test (const input_file *inpf)
+ | ^~~~
+ | |
+ | (1) entry to 'test'
+ |
+ | const char *f = get_input_file_name (inpf);
+ | ~
+ | |
+ | (2) inlined call to 'get_input_file_name' from 'test'
+ |
+ +--> 'const char* get_input_file_name(const input_file*)': event 3 (depth 2)
+ |
+ | if (inpf)
+ | ^~
+ | |
+ | (3) following 'false' branch (when 'inpf' is NULL)...
+ |
+ <------+
+ |
+ 'size_t test(const input_file*)': events 4-5 (depth 1)
+ |
+ | return __builtin_strlen (f);
+ | ~~~~~~~~~~~~~~~~~^~~
+ | |
+ | (4) ...to here
+ | (5) argument 1 ('<unknown>') NULL where non-null expected
+ |
+ { dg-end-multiline-output "" { target c++ } } */
\ No newline at end of file
/* { dg-additional-options "-O2 -fdiagnostics-show-path-depths" } */
+#include "../../gcc.dg/analyzer/analyzer-decls.h"
typedef __SIZE_TYPE__ size_t;
-#define NULL ((void *)0)
+
struct input_file_st
{
static inline const char*
get_input_file_name (const input_file *inpf)
{
- if (inpf) /* { dg-message "following 'false' branch \\(when 'inpf' is NULL\\)\\.\\.\\. \\(fndecl 'get_input_file_name', depth 2\\)" } */
+ if (inpf)
+ /* { dg-message "following 'false' branch \\(when 'inpf' is NULL\\)\\.\\.\\. \\(fndecl 'get_input_file_name', depth 2\\)" "" { target c } .-1 } */
+ /* { dg-message "following 'false' branch \\(when 'inpf' is NULL\\)\\.\\.\\. \\(fndecl 'const char\\* get_input_file_name\\(const input_file\\*\\)', depth 2\\)" "" { target c++ } .-2 } */
return inpf->inpname;
return NULL;
}
{
const char *f = get_input_file_name (inpf);
return __builtin_strlen (f); /* { dg-warning "use of NULL" "warning" } */
- /* { dg-message "NULL where non-null expected \\(fndecl 'test', depth 1\\)" "message" { target *-*-* } .-1 } */
+ /* { dg-message "NULL where non-null expected \\(fndecl 'test', depth 1\\)" "message" { target c } .-1 } */
+ /* { dg-message "NULL where non-null expected \\(fndecl 'size_t test\\(const input_file\\*\\)', depth 1\\)" "message" { target c++ } .-2 } */
}
/* { dg-additional-options "-O2 -fdiagnostics-show-path-depths" } */
/* { dg-additional-options "-fdiagnostics-path-format=inline-events -fdiagnostics-show-caret" } */
-#define NULL ((void *)0)
+#include "../../gcc.dg/analyzer/analyzer-decls.h"
+
static inline const char*
inner (int flag)
| |
| (6) dereference of NULL '<unknown>'
|
- { dg-end-multiline-output "" } */
+ { dg-end-multiline-output "" { target c } } */
+/* { dg-begin-multiline-output "" }
+ return *middle (flag);
+ ^
+ 'char outer(int)': events 1-2 (depth 1)
+ |
+ | outer (int flag)
+ | ^~~~~
+ | |
+ | (1) entry to 'outer'
+ |
+ | return *middle (flag);
+ | ~
+ | |
+ | (2) inlined call to 'middle' from 'outer'
+ |
+ +--> 'const char* middle(int)': event 3 (depth 2)
+ |
+ | return inner (flag);
+ | ^
+ | |
+ | (3) inlined call to 'inner' from 'middle'
+ |
+ +--> 'const char* inner(int)': event 4 (depth 3)
+ |
+ | if (flag)
+ | ^~
+ | |
+ | (4) following 'true' branch (when 'flag != 0')...
+ |
+ <-------------+
+ |
+ 'char outer(int)': event 5 (depth 1)
+ |
+ |cc1plus:
+ | (5): ...to here
+ |
+ 'char outer(int)': event 6 (depth 1)
+ |
+ | return *middle (flag);
+ | ^
+ | |
+ | (6) dereference of NULL '<unknown>'
+ |
+ { dg-end-multiline-output "" { target c++ } } */
/* { dg-additional-options "-O2 -fdiagnostics-show-path-depths" } */
-#define NULL ((void *)0)
+#include "../../gcc.dg/analyzer/analyzer-decls.h"
static inline const char*
inner (int flag)
{
- if (flag) /* { dg-message "following 'true' branch \\(when 'flag != 0'\\)\\.\\.\\. \\(fndecl 'inner', depth 3\\)" } */
+ if (flag)
+ /* { dg-message "following 'true' branch \\(when 'flag != 0'\\)\\.\\.\\. \\(fndecl 'inner', depth 3\\)" "" { target c } .-1 } */
+ /* { dg-message "following 'true' branch \\(when 'flag != 0'\\)\\.\\.\\. \\(fndecl 'const char\\* inner\\(int\\)', depth 3\\)" "" { target c++ } .-2 } */
return NULL;
return "foo";
}
outer (int flag)
{
return *middle (flag); /* { dg-warning "dereference of NULL" "warning" } */
- /* { dg-message "\\(fndecl 'outer', depth 1\\)" "message" { target *-*-* } .-1 } */
+ /* { dg-message "\\(fndecl 'outer', depth 1\\)" "message" { target c } .-1 } */
+ /* { dg-message "\\(fndecl 'char outer\\(int\\)', depth 1\\)" "message" { target c++ } .-2 } */
}
/* { dg-additional-options "-Wno-analyzer-too-complex" } */
-#define NULL ((void *)0)
+#include "../../gcc.dg/analyzer/analyzer-decls.h"
+
#define LEN 64
if (str == NULL || delim == NULL)
return NULL;
- out = __builtin_malloc(LEN * sizeof(char *));
+ out = (char **) __builtin_malloc(LEN * sizeof(char *));
if (out == NULL)
return NULL;
/* { dg-additional-options "-fanalyzer-call-summaries" } */
typedef __SIZE_TYPE__ size_t;
-#define NULL ((void *)0)
+#include "../../gcc.dg/analyzer/analyzer-decls.h"
/* data structures */
{
struct screen_s *result = NULL;
- result = __builtin_calloc(1, sizeof(*result));
+ result = (struct screen_s *) __builtin_calloc(1, sizeof(*result));
if (!result)
return NULL;
result->rows = rows;
/* make one allocation which will be accessed like a 2D array */
- result->data = __builtin_calloc(rows, sizeof(result->data) + sizeof(*result->data) * cols);
+ result->data = (char **) __builtin_calloc(rows, sizeof(result->data) + sizeof(*result->data) * cols);
if (!result->data) {
__builtin_free(result);
return NULL;
int main(void)
{
- ctx = __builtin_calloc(1, sizeof(*ctx));
+ ctx = (struct context_s *) __builtin_calloc(1, sizeof(*ctx));
if (!ctx)
__builtin_abort();
/* { dg-additional-options "-Wno-analyzer-too-complex" } */
typedef __SIZE_TYPE__ size_t;
-#define NULL ((void *)0)
+#include "../../gcc.dg/analyzer/analyzer-decls.h"
/* data structures */
{
struct screen_s *result = NULL;
- result = __builtin_calloc(1, sizeof(*result));
+ result = (struct screen_s *) __builtin_calloc(1, sizeof(*result));
if (!result)
return NULL;
result->rows = rows;
/* make one allocation which will be accessed like a 2D array */
- result->data = __builtin_calloc(rows, sizeof(result->data) + sizeof(*result->data) * cols);
+ result->data = (char **) __builtin_calloc(rows, sizeof(result->data) + sizeof(*result->data) * cols);
if (!result->data) {
__builtin_free(result);
return NULL;
int main(void)
{
- ctx = __builtin_calloc(1, sizeof(*ctx));
+ ctx = (struct context_s *) __builtin_calloc(1, sizeof(*ctx));
if (!ctx)
__builtin_abort();
{
struct cfg_postparser* cp;
- cp = calloc(1, sizeof(*cp));
+ cp = (struct cfg_postparser *) calloc(1, sizeof(*cp));
if (!cp) {
/* [...snip...] */
return 0;
{
struct cfg_postparser* cp;
- cp = calloc(1, sizeof(*cp));
+ cp = (struct cfg_postparser*) calloc(1, sizeof(*cp));
if (!cp) {
/* [...snip...] */
return 0;
int *test_2 (void)
{
- int *i = malloc (sizeof (int)); /* { dg-message "\\(1\\) this call could return NULL" } */
+ int *i = (int *) malloc (sizeof (int)); /* { dg-message "\\(1\\) this call could return NULL" } */
*i = 42; /* { dg-warning "dereference of possibly-NULL 'i'" "warning" } */
/* { dg-message "\\(2\\) 'i' could be NULL: unchecked value from \\(1\\)" "event" { target *-*-* } .-1 } */
return i;
/* { dg-additional-options "-Wno-stringop-overflow -Wno-analyzer-out-of-bounds" } */
-void
-main (int c, void *v)
+int
+test (int c, void *v)
{
static char a[] = "";
__builtin_memcpy (v, a, -1);
+ return 0;
}
}
static inline struct connection *__objt_conn(enum obj_type *t)
{
- return ((struct connection *)(((void *)(t)) - ((long)&((struct connection *)0)->obj_type)));
+ return ((struct connection *)(((char *)(t)) - ((long)&((struct connection *)0)->obj_type)));
}
static inline struct connection *objt_conn(enum obj_type *t)
{
if (!t || *t != OBJ_TYPE_CONN)
- return ((void *)0);
+ return (struct connection *)((void *)0);
return __objt_conn(t);
}
struct session {
/*****************************************************************************/
int
-smp_fetch_ssl_fc_has_early(const struct arg *args, struct sample *smp, const char *kw, void *private)
+smp_fetch_ssl_fc_has_early(const struct arg *args, struct sample *smp, const char *kw, void *Private)
{
SSL *ssl;
struct connection *conn;
}
static inline struct connection *__objt_conn(enum obj_type *t)
{
- return ((struct connection *)(((void *)(t)) - ((long)&((struct connection *)0)->obj_type)));
+ return ((struct connection *)(((char *)(t)) - ((long)&((struct connection *)0)->obj_type)));
}
static inline struct connection *objt_conn(enum obj_type *t)
{
if (!t || *t != OBJ_TYPE_CONN)
- return ((void *)0);
+ return (struct connection *) ((void *)0);
return __objt_conn(t);
}
struct session {
/*****************************************************************************/
int
-smp_fetch_ssl_fc_has_early(const struct arg *args, struct sample *smp, const char *kw, void *private)
+smp_fetch_ssl_fc_has_early(const struct arg *args, struct sample *smp, const char *kw, void *Private)
{
SSL *ssl;
struct connection *conn;
/* Reduced from qemu-7.2.0's hw/intc/omap_intc.c */
-#define NULL ((void*)0)
+#include "../../gcc.dg/analyzer/analyzer-decls.h"
typedef unsigned char __uint8_t;
typedef unsigned int __uint32_t;
/* { dg-additional-options "-Wno-analyzer-too-complex" } */
-#define NULL ((void*)0)
+#include "../../gcc.dg/analyzer/analyzer-decls.h"
typedef __SIZE_TYPE__ size_t;
static apr_hash_entry_t**
alloc_array(apr_hash_t* ht, unsigned int max)
{
- return memset(apr_palloc(ht->pool, sizeof(*ht->array) * (max + 1)),
+ return (apr_hash_entry_t **) memset(apr_palloc(ht->pool, sizeof(*ht->array) * (max + 1)),
0,
sizeof(*ht->array) * (max + 1));
}
apr_hash_entry_t* new_vals = NULL;
apr_hash_entry_t* iter;
unsigned int i, j, k;
- res = apr_palloc(p, sizeof(apr_hash_t));
+ res = (apr_hash_t *) apr_palloc(p, sizeof(apr_hash_t));
res->pool = p;
res->free = NULL;
res->hash_func = base->hash_func;
res->seed = base->seed;
res->array = alloc_array(res, res->max);
if (base->count + overlay->count) {
- new_vals =
+ new_vals = (apr_hash_entry_t *)
apr_palloc(p, sizeof(apr_hash_entry_t) * (base->count + overlay->count));
}
j = 0;
-#include "analyzer-decls.h"
+#include "../../gcc.dg/analyzer/analyzer-decls.h"
-#define NULL ((void *)0)
/* Verify that the analyzer makes the simplifying assumption that we don't
hit NULL when incrementing pointers to non-NULL memory regions. */
return ++ptr;
}
-char
+void
test_s (void)
{
const char *msg = "hello world";
};
int main(int argc, char *argv[]) {
- struct test *options = calloc(1, sizeof(*options));
+ struct test *options = (struct test *) calloc(1, sizeof(*options));
int rc;
if (!options)
abort();
extern void free (void *__ptr)
__attribute__ ((__nothrow__ , __leaf__));
-#define NULL ((void *)0)
+#include "../../gcc.dg/analyzer/analyzer-decls.h"
char *xstrdup(const char *src) {
char *val = strdup(src);
return (-1);
}
- k = my_malloc1(__FILE__, __LINE__, size);
+ k = (char *) my_malloc1(__FILE__, __LINE__, size);
abase = (char *)vbase - size;
void
foo (void)
{
- int *ap5 = calloc (4, sizeof *ap5);
- int *ap7 = realloc (ap5, sizeof *ap5);
+ int *ap5 = (int *) calloc (4, sizeof *ap5);
+ int *ap7 = (int *) realloc (ap5, sizeof *ap5);
} /* { dg-warning "leak of 'ap5'" "leak of ap5" } */
/* { dg-warning "leak of 'ap7'" "leak of ap7" { target *-*-* } .-1 } */
/* { dg-additional-options "-O" } */
+#ifndef __cplusplus
+typedef _Bool bool;
+#endif
+
struct ss_s {
union out_or_counting_u {
char *newstr;
unsigned long long cnt;
} uu;
- _Bool counting;
+ bool counting;
};
struct ss_s ss_init(void) {
int g = 0;
int *h[2][1];
h[1][0] = f;
- if (g == (h[1][0])) { /* { dg-warning "comparison between pointer and integer" } */
+ if (g == (h[1][0])) { /* { dg-warning "comparison between pointer and integer" "" { target c } } */
+ /* { dg-error "ISO C\\+\\+ forbids comparison between pointer and integer" "" { target c++ } .-1 } */
unsigned int *i = 0;
}
printf("NPD_FLAG: %d\n ", *f);
--- /dev/null
+/* { dg-do compile } */
+
+void
+p5 (const void *);
+
+void
+s5 (const void *cl)
+{
+ p5 (&cl[1]); /* { dg-warning "dereferencing 'void \\*' pointer" "" { target c } } */
+ /* { dg-warning "pointer of type 'void \\*' used in arithmetic" "" { target c++ } .-1 } */
+ /* { dg-error "'const void\\*' is not a pointer-to-object type" "" { target c++ } .-2 } */
+}
int i;
for (i = 0; i < ARRAY_SIZE (p); ++i)
- p[i] = __builtin_malloc (sizeof (i));
+ p[i] = (int *) __builtin_malloc (sizeof (i));
for (i = 0; i < ARRAY_SIZE (p); ++i)
__builtin_free (p [i]);
return;
for (i = 0; i < n; ++i)
- p[i] = __builtin_malloc (sizeof (i));
+ p[i] = (int *) __builtin_malloc (sizeof (i));
for (i = 0; i < n; ++i)
__builtin_free (p [i]);
{
int i;
for (i = 0; i < n; ++i)
- p[i] = __builtin_malloc (sizeof (i));
+ p[i] = (int *) __builtin_malloc (sizeof (i));
}
void
* limitations under the License.
*/
+#include "../../gcc.dg/analyzer/analyzer-decls.h"
typedef __SIZE_TYPE__ size_t;
-#define NULL ((void *)0)
+
+#ifndef __cplusplus
#define false 0
+#endif
#define OBJECT_OFFSETOF(OBJECT, MEMBER)\
- __builtin_offsetof(typeof(*(OBJECT)), MEMBER)
+ __builtin_offsetof(struct zone_limit, MEMBER)
#define OBJECT_CONTAINING(POINTER, OBJECT, MEMBER) \
- ((typeof(OBJECT)) (void *) \
+ ((struct zone_limit *) (void *) \
((char *) (POINTER) - OBJECT_OFFSETOF(OBJECT, MEMBER)))
#define ASSIGN_CONTAINER(OBJECT, POINTER, MEMBER) \
bm->min = min;
bm->max = max;
- bm->vec = __builtin_calloc(sz, sizeof(int));
+ bm->vec = (int *) __builtin_calloc(sz, sizeof(int));
if (!bm->vec)
return (-12);
return 0; /* { dg-bogus "leak" } */
int
initActiveTroubleArray ()
{
- activeTroubleArray = calloc (1, 1);
+ activeTroubleArray = (char *) calloc (1, 1);
return activeTroubleArray ? 0 : 1;
}
int
x7 (void)
{
- int **md = calloc (1, sizeof (void *));
+ int **md = (int **) calloc (1, sizeof (void *));
return md[0][0]; /* { dg-warning "possibly-NULL" "unchecked deref" } */
/* { dg-warning "leak of 'md'" "leak" { target *-*-* } .-1 } */
case ((0x00a30000 | 0x900) + 4):
return "MD Region Grid";
default:
- return ((void *)0);
+ return (const char *) ((void *)0);
}
}
*type = V4L2_CTRL_TYPE_U32;
break;
case ((0x00990000 | 0x900) + 250):
- *type = 0x0103;
+ *type = (enum v4l2_ctrl_type) 0x0103;
break;
case ((0x00990000 | 0x900) + 251):
- *type = 0x0104;
+ *type = (enum v4l2_ctrl_type) 0x0104;
break;
case ((0x00990000 | 0x900) + 292):
- *type = 0x0105;
+ *type = (enum v4l2_ctrl_type) 0x0105;
break;
case ((0x00990000 | 0x900) + 1000):
- *type = 0x0110;
+ *type = (enum v4l2_ctrl_type) 0x0110;
break;
case ((0x00990000 | 0x900) + 1001):
- *type = 0x0111;
+ *type = (enum v4l2_ctrl_type) 0x0111;
break;
case ((0x00990000 | 0x900) + 1002):
- *type = 0x0112;
+ *type = (enum v4l2_ctrl_type) 0x0112;
break;
case ((0x00990000 | 0x900) + 1003):
- *type = 0x0113;
+ *type = (enum v4l2_ctrl_type) 0x0113;
break;
case ((0x00990000 | 0x900) + 1004):
- *type = 0x0114;
+ *type = (enum v4l2_ctrl_type) 0x0114;
break;
case ((0x00990000 | 0x900) + 2000):
- *type = 0x301;
+ *type = (enum v4l2_ctrl_type) 0x301;
break;
case ((0x00990000 | 0x900) + 1008):
- *type = 0x0120;
+ *type = (enum v4l2_ctrl_type) 0x0120;
break;
case ((0x00990000 | 0x900) + 1009):
- *type = 0x0121;
+ *type = (enum v4l2_ctrl_type) 0x0121;
break;
case ((0x00990000 | 0x900) + 1010):
- *type = 0x0122;
+ *type = (enum v4l2_ctrl_type) 0x0122;
break;
case ((0x009e0000 | 0x900) + 8):
*type = V4L2_CTRL_TYPE_AREA;
-#define NULL (void *)0
+#include "../../gcc.dg/analyzer/analyzer-decls.h"
struct block
{
-/* { dg-additional-options "-O1 -Wno-builtin-declaration-mismatch" } */
+/* { dg-additional-options "-O1 -Wno-builtin-declaration-mismatch -Wno-analyzer-too-complex" } */
int
l8 (void);
--- /dev/null
+#include "../../gcc.dg/analyzer/analyzer-decls.h"
+
+
+extern int *const p1;
+
+int *const p2 = NULL;
+
+int v3;
+extern int *const p3 = &v3; /* { dg-warning "'p3' initialized and declared 'extern'" "C FE warning" { target c } } */
+
+int v4;
+int *const p4 = &v4;
+
+int main (void)
+{
+ __analyzer_describe (0, p1); /* { dg-message "INIT_VAL\\(p1\\)" "" { target c } } */
+ /* { dg-message "INIT_VAL\\(int\\* const p1\\)" "" { target c++ } .-1 } */
+ __analyzer_eval (p1 == NULL); /* { dg-message "UNKNOWN" } */
+
+ __analyzer_eval (p2 == NULL); /* { dg-message "TRUE" } */
+
+ __analyzer_describe (0, p3); /* { dg-message "&v3" "" { target c } } */
+ /* { dg-message "&int v3" "" { target c++ } .-1 } */
+ __analyzer_eval (p3 == NULL); /* { dg-message "FALSE" } */
+
+ __analyzer_describe (0, p4); /* { dg-message "&v4" "" { target c } } */
+ /* { dg-message "&int v4" "" { target c++ } .-1 } */
+ __analyzer_eval (p4 == NULL); /* { dg-message "FALSE" } */
+
+ return p1[0];
+}
void test_1 (void)
{
- int *p = calloc (0, 1); /* { dg-message "allocated here" } */
+ int *p = (int *) calloc (0, 1); /* { dg-message "allocated here" } */
} /* { dg-warning "leak of 'p'" } */
/* { dg-additional-options "-O1" } */
void foo(void *);
-struct chanset_t help_subst_chan;
-struct chanset_t *help_subst_chan_0_0;
struct chanset_t {
struct chanset_t *next;
char dname[];
};
+struct chanset_t help_subst_chan;
+struct chanset_t *help_subst_chan_0_0;
void help_subst(char *writeidx) {
for (;; help_subst_chan = *help_subst_chan_0_0) {
foo(help_subst_chan.next->dname);
test_1 (__UINTPTR_TYPE__ i)
{
struct foo *f = (struct foo *)i;
- f->expr = __builtin_malloc (1024);
+ f->expr = (char *) __builtin_malloc (1024);
} /* { dg-bogus "leak" } */
void
test_2 (__UINTPTR_TYPE__ i)
{
__builtin_free (((struct foo *)i)->expr);
- __builtin_free (((struct foo *)i)->expr); /* { dg-warning "double-'free' of '\\*\\(\\(struct foo \\*\\)i\\)\\.expr'" } */
+ __builtin_free (((struct foo *)i)->expr); /* { dg-warning "double-'free' of '\\*\\(\\(struct foo \\*\\)i\\)\\.expr'" "" { target c } } */
+ /* { dg-warning "double-'free' of '\\*\\(\\(foo\\*\\)i\\)\\.foo::expr'" "" { target c++ } .-1 } */
}
void
ret = single_drive_display_name (drvs);
len = __builtin_strlen (ret);
- ret = realloc (ret, len + pluses + 1); /* { dg-bogus "'free'" } */
+ ret = (char *) realloc (ret, len + pluses + 1); /* { dg-bogus "'free'" } */
if (ret == NULL)
error (EXIT_FAILURE, errno, "realloc");
for (i = len; i < len + pluses; ++i)
typedef __SIZE_TYPE__ size_t;
typedef __builtin_va_list va_list;
-#define NULL ((void *)0)
+#include "../../gcc.dg/analyzer/analyzer-decls.h"
extern void free (void *);
extern void *realloc (void *__ptr, size_t __size)
len = __builtin_strlen (r);
for (i = 0; cmds[i] != NULL; ++i) {
len += __builtin_strlen (cmds[i]) + 1;
- p = realloc (r, len + 1); /* { dg-bogus "'free'" } */
+ p = (char *) realloc (r, len + 1); /* { dg-bogus "'free'" } */
if (p == NULL) {
free (r);
return NULL;
int fclose (FILE*);
int fprintf (FILE *, const char *, ...);
-#define NULL ((void *)0)
+#include "../../gcc.dg/analyzer/analyzer-decls.h"
+
void
test_1 (void)
int i = 0;
if (vq->inuse) {
- vq->resubmit_list = calloc(vq->inuse, sizeof(VuVirtqInflightDesc));
+ vq->resubmit_list = (VuVirtqInflightDesc *) calloc(vq->inuse, sizeof(VuVirtqInflightDesc));
if (!vq->resubmit_list) {
return -1;
}
return realloc (ptr, 1024);
}
-void *test_2 (void *ptr)
+void test_2 (void *ptr)
{
void *p = malloc (1024); /* { dg-message "allocated here" } */
p = realloc (p, 4096); /* { dg-message "when 'realloc' fails" } */
free (p);
} /* { dg-warning "leak of 'p'" } */ // ideally this would be on the realloc stmt
-void *test_3 (void *ptr)
+void test_3 (void *ptr)
{
void *p = malloc (1024);
void *q = realloc (p, 4096);
int *test_5 (int *p)
{
*p = 42;
- int *q = realloc (p, sizeof(int) * 4); /* { dg-message "when 'realloc' fails" } */
+ int *q = (int *) realloc (p, sizeof(int) * 4); /* { dg-message "when 'realloc' fails" } */
*q = 43; /* { dg-warning "dereference of NULL 'q'" } */
return q;
}
void *test_7 (size_t sz)
{
char buf[100]; /* { dg-message "region created on stack here" } */
- void *p = realloc (&buf, sz); /* { dg-warning "'realloc' of '&buf' which points to memory on the stack" } */
+ void *p = realloc (&buf, sz); /* { dg-warning "'realloc' of '& ?buf' which points to memory on the stack" } */
return p;
}
void test_10 (char *s, int n)
{
- __builtin_realloc(s, n); /* { dg-warning "ignoring return value of '__builtin_realloc' declared with attribute 'warn_unused_result'" } */
+ __builtin_realloc(s, n); /* { dg-warning "ignoring return value of '__builtin_realloc' declared with attribute 'warn_unused_result'" "" { target c } } */
+ /* { dg-warning "ignoring return value of 'void\\* __builtin_realloc\\(void\\*, (long )?unsigned int\\)' declared with attribute 'warn_unused_result'" "" { target c++ } .-1 } */
} /* { dg-warning "leak" } */
/* { dg-additional-options "-fno-analyzer-suppress-followups" } */
-#include "analyzer-decls.h"
+#include "../../gcc.dg/analyzer/analyzer-decls.h"
typedef __SIZE_TYPE__ size_t;
-#define NULL ((void *)0)
-
extern void *malloc (size_t __size)
__attribute__ ((__nothrow__ , __leaf__))
__attribute__ ((__malloc__))
{
char *p, *q;
- p = malloc (3);
+ p = (char *) malloc (3);
if (!p)
return NULL;
__analyzer_eval (p[1] == 'b'); /* { dg-warning "TRUE" } */
__analyzer_eval (p[2] == 'c'); /* { dg-warning "TRUE" } */
- q = realloc (p, 6);
+ q = (char *) realloc (p, 6);
/* We should have 3 nodes, corresponding to "failure",
"success without moving", and "success with moving". */
/* { dg-additional-options "-fno-analyzer-suppress-followups" } */
-#include "analyzer-decls.h"
+#include "../../gcc.dg/analyzer/analyzer-decls.h"
typedef __SIZE_TYPE__ size_t;
-#define NULL ((void *)0)
extern void *calloc (size_t __nmemb, size_t __size)
__attribute__ ((__nothrow__ , __leaf__))
{
char *p, *q;
- p = calloc (1, 3);
+ p = (char *) calloc (1, 3);
if (!p)
return NULL;
__analyzer_eval (p[1] == 0); /* { dg-warning "TRUE" } */
__analyzer_eval (p[2] == 0); /* { dg-warning "TRUE" } */
- q = realloc (p, 6);
+ q = (char *) realloc (p, 6);
/* We should have 3 nodes, corresponding to "failure",
"success without moving", and "success with moving". */
-#include "analyzer-decls.h"
+#include "../../gcc.dg/analyzer/analyzer-decls.h"
typedef __SIZE_TYPE__ size_t;
-#define NULL ((void *)0)
extern void *calloc (size_t __nmemb, size_t __size)
__attribute__ ((__nothrow__ , __leaf__))
__analyzer_eval (p[1] == 'b'); /* { dg-warning "TRUE" } */
__analyzer_eval (p[2] == 'c'); /* { dg-warning "TRUE" } */
- q = realloc (p, 6);
+ q = (char *) realloc (p, 6);
/* We should have 3 nodes, corresponding to "failure",
"success without moving", and "success with moving". */
/* { dg-additional-options "-fno-analyzer-suppress-followups" } */
-#include "analyzer-decls.h"
+#include "../../gcc.dg/analyzer/analyzer-decls.h"
typedef __SIZE_TYPE__ size_t;
-#define NULL ((void *)0)
extern void *malloc (size_t __size)
__attribute__ ((__nothrow__ , __leaf__))
void test_1 ()
{
- char *p = malloc (16);
+ char *p = (char *) malloc (16);
if (!p)
return;
memset (p, 1, 16);
- char *q = realloc (p, 8);
+ char *q = (char *) realloc (p, 8);
if (!q)
{
free (p);
unsigned long cc;
if (!__builtin_add_overflow (file_size - file_size % sizeof (long),
2 * sizeof (long), &cc))
- buffer = realloc (buffer, cc);
+ buffer = (long *) realloc (buffer, cc);
return buffer;
}
long *
slurp1 (long *buffer, unsigned long file_size)
{
- return realloc (buffer, file_size - file_size % sizeof (long));
+ return (long *) realloc (buffer, file_size - file_size % sizeof (long));
}
long *
slurp2 (long *buffer, unsigned long file_size)
{
- return realloc (buffer, (file_size / sizeof (long)) * sizeof (long));
+ return (long *) realloc (buffer, (file_size / sizeof (long)) * sizeof (long));
}
typedef __SIZE_TYPE__ size_t;
-#define NULL ((void *)0)
+#include "../../gcc.dg/analyzer/analyzer-decls.h"
extern size_t
strlen(const char* __s) __attribute__((__nothrow__, __leaf__))
test_1 (const char *a, const char *b)
{
size_t sz = strlen (a) + strlen (b) + 2;
- char *p = malloc (sz);
+ char *p = (char *) malloc (sz);
if (!p)
return NULL;
snprintf (p, sz, "%s/%s", a, b);
test_2 (const char *a, const char *b)
{
size_t sz = strlen (a) + strlen (b) + 2;
- char *p = malloc (sz); /* { dg-message "allocated here" "PR 107017" { xfail *-*-* } } */
+ char *p = (char *) malloc (sz); /* { dg-message "allocated here" "PR 107017" { xfail *-*-* } } */
if (!p)
return;
snprintf (p, sz, "%s/%s", a, b); /* { dg-warning "leak of 'p'" "PR 107017" { xfail *-*-* } } */
typedef __s64 s64;
typedef __u64 u64;
typedef long long __kernel_time64_t;
+#ifndef __cplusplus
typedef _Bool bool;
+#endif
typedef __s64 time64_t;
struct __kernel_timespec {
__kernel_time64_t tv_sec;
static ktime_t sock_read_timestamp(struct sock *sk)
{
- return *(const volatile typeof(sk->sk_stamp) *)&(sk->sk_stamp);
+ return *(const volatile ktime_t *)&(sk->sk_stamp);
}
static void sock_write_timestamp(struct sock *sk, ktime_t kt)
{
- *(volatile typeof(sk->sk_stamp) *)&(sk->sk_stamp) = kt;
+ *(volatile ktime_t *)&(sk->sk_stamp) = kt;
}
/* [...snip...] */
if (time32)
return put_old_timespec32(&ts, userstamp);
- return put_timespec64(&ts, userstamp);
+ return put_timespec64(&ts, (struct __kernel_timespec *) userstamp);
}
--- /dev/null
+/* See e.g. https://en.cppreference.com/w/c/io/fprintf
+ and https://www.man7.org/linux/man-pages/man3/sprintf.3.html */
+
+extern int
+sprintf(char* dst, const char* fmt, ...)
+ __attribute__((__nothrow__));
+
+#include "../../gcc.dg/analyzer/analyzer-decls.h"
+
+int
+test_passthrough (char* dst, const char* fmt)
+{
+ /* This assumes that fmt doesn't have any arguments. */
+ return sprintf (dst, fmt);
+}
+
+void
+test_known (void)
+{
+ char buf[10];
+ int res = sprintf (buf, "foo");
+ /* TODO: ideally we would know the value of "res" is 3,
+ and known the content and strlen of "buf" after the call */
+}
+
+int
+test_null_dst (void)
+{
+ return sprintf (NULL, "hello world"); /* { dg-warning "use of NULL where non-null expected" } */
+}
+
+int
+test_null_fmt (char *dst)
+{
+ return sprintf (dst, NULL); /* { dg-warning "use of NULL where non-null expected" } */
+}
+
+int
+test_uninit_dst (void)
+{
+ char *dst;
+ return sprintf (dst, "hello world"); /* { dg-warning "use of uninitialized value 'dst'" } */
+}
+
+int
+test_uninit_fmt_ptr (char *dst)
+{
+ const char *fmt;
+ return sprintf (dst, fmt); /* { dg-warning "use of uninitialized value 'fmt'" } */
+}
+
+void
+test_strlen_1 (void)
+{
+ char buf[10];
+ sprintf (buf, "msg: %s\n", "abc");
+ __analyzer_eval (__builtin_strlen (buf) == 8); /* { dg-warning "UNKNOWN" } */
+ // TODO: ideally would be TRUE
+}
typedef __SIZE_TYPE__ size_t;
-#define NULL ((void *)0)
+#include "../../gcc.dg/analyzer/analyzer-decls.h"
extern size_t
strlen(const char* __s) __attribute__((__nothrow__, __leaf__))
test_1 (const char *a, const char *b)
{
size_t sz = strlen (a) + strlen (b) + 2;
- char *p = malloc (sz);
+ char *p = (char *) malloc (sz);
if (!p)
return NULL;
sprintf (p, "%s/%s", a, b);
test_2 (const char *a, const char *b)
{
size_t sz = strlen (a) + strlen (b) + 2;
- char *p = malloc (sz); /* { dg-message "allocated here" } */
+ char *p = (char *) malloc (sz); /* { dg-message "allocated here" } */
if (!p)
return;
sprintf (p, "%s/%s", a, b); /* { dg-warning "leak of 'p' " } */
typedef __SIZE_TYPE__ size_t;
-#define NULL ((void *)0)
+#include "../../gcc.dg/analyzer/analyzer-decls.h"
/* Concatenating a pair of strings. */
alloc_dup_of_concatenated_pair_1_correct (const char *x, const char *y)
{
size_t sz = __builtin_strlen (x) + __builtin_strlen (y) + 1;
- char *result = __builtin_malloc (sz);
+ char *result = (char *) __builtin_malloc (sz);
if (!result)
return NULL;
__builtin_memcpy (result, x, __builtin_strlen (x));
{
/* Forgetting to add space for the terminator here. */
size_t sz = __builtin_strlen (x) + __builtin_strlen (y);
- char *result = __builtin_malloc (sz);
+ char *result = (char *) __builtin_malloc (sz);
if (!result)
return NULL;
__builtin_memcpy (result, x, __builtin_strlen (x));
size_t len_x = __builtin_strlen (x);
size_t len_y = __builtin_strlen (y);
size_t sz = len_x + len_y + 1;
- char *result = __builtin_malloc (sz);
+ char *result = (char *) __builtin_malloc (sz);
if (!result)
return NULL;
__builtin_memcpy (result, x, len_x);
size_t len_x = __builtin_strlen (x);
size_t len_y = __builtin_strlen (y);
size_t sz = len_x + len_y; /* Forgetting to add space for the terminator. */
- char *result = __builtin_malloc (sz); /* { dg-message "capacity: 'len_x \\+ len_y' bytes" } */
+ char *result = (char *) __builtin_malloc (sz); /* { dg-message "capacity: 'len_x \\+ len_y' bytes" "" { target c } } */
+ /* { dg-message "capacity: '\\(len_x \\+ len_y\\)' bytes" "" { target c++ } .-1 } */
if (!result)
return NULL;
__builtin_memcpy (result, x, len_x);
typedef __SIZE_TYPE__ size_t;
-#define NULL ((void *)0)
+#include "../../gcc.dg/analyzer/analyzer-decls.h"
/* Duplicating a string. */
alloc_dup_1_correct (const char *x)
{
size_t sz = __builtin_strlen (x) + 1;
- char *result = __builtin_malloc (sz);
+ char *result = (char *) __builtin_malloc (sz);
if (!result)
return NULL;
__builtin_memcpy (result, x, __builtin_strlen (x));
{
/* Forgetting to add space for the terminator here. */
size_t sz = __builtin_strlen (x) + 1;
- char *result = __builtin_malloc (sz);
+ char *result = (char *) __builtin_malloc (sz);
if (!result)
return NULL;
__builtin_memcpy (result, x, __builtin_strlen (x));
{
size_t len_x = __builtin_strlen (x);
size_t sz = len_x + 1;
- char *result = __builtin_malloc (sz);
+ char *result = (char *) __builtin_malloc (sz);
if (!result)
return NULL;
__builtin_memcpy (result, x, len_x);
{
size_t len_x = __builtin_strlen (x);
size_t sz = len_x; /* Forgetting to add space for the terminator. */
- char *result = __builtin_malloc (sz); /* { dg-message "capacity: 'len_x' bytes" } */
+ char *result = (char *) __builtin_malloc (sz); /* { dg-message "capacity: 'len_x' bytes" } */
if (!result)
return NULL;
__builtin_memcpy (result, x, len_x);
int main(void)
{
- __analyzer_vreportf(42);
+ __analyzer_vreportf((enum usage_kind) 42);
return 0;
}
-#include "analyzer-decls.h"
+#include "../../gcc.dg/analyzer/analyzer-decls.h"
void external_fn(void);
void test_1a (void *p, unsigned next_off)
{
- struct st_1 *r = p;
+ struct st_1 *r = (struct st_1 *) p;
external_fn();
void test_1b (void *p, unsigned next_off)
{
- struct st_1 *r = p;
+ struct st_1 *r = (struct st_1 *) p;
if (next_off >= r->size)
return;
void test_1e (void *p, unsigned next_off)
{
- struct st_1 *r = p;
+ struct st_1 *r = (struct st_1 *) p;
while (1)
{
void test_2a (void *p, unsigned next_off)
{
- struct st_2 *r = p;
+ struct st_2 *r = (struct st_2 *) p;
external_fn();
void test_2b (void *p, unsigned next_off, int idx)
{
- struct st_2 *r = p;
+ struct st_2 *r = (struct st_2 *) p;
external_fn();
int test_1 (void)
{
- int *p = __builtin_alloca (sizeof (int)); /* { dg-message "region created on stack here" } */
+ int *p = (int *) __builtin_alloca (sizeof (int)); /* { dg-message "region created on stack here" } */
return *p; /* { dg-warning "use of uninitialized value '\\*p'" } */
}
extern int foo(const u8 *key, unsigned int keylen);
int test (void)
{
- static const u8 default_salt[64];
+ static const u8 default_salt[64] = {};
return foo(default_salt, 64);
}
/* { dg-additional-options "-Wno-analyzer-too-complex" } */
-#define NULL ((void *)0)
+#include "../../gcc.dg/analyzer/analyzer-decls.h"
+
extern int printf (const char *__restrict __format, ...);
extern int vasprintf (char **__restrict __ptr, const char *__restrict __f,
/* Example of writing to a subregion (an element within a const array). */
-const int c2[10]; /* { dg-message "declared here" } */
+const int c2[10] = {}; /* { dg-message "declared here" } */
int test_2 (void)
{
((int*) &c2)[5] = 10; /* { dg-warning "write to 'const' object 'c2'" } */
#include <string.h>
+#ifdef __cplusplus
+#define CONST_CAST(type) const_cast<type>
+#else
+#define CONST_CAST(type)
+#endif
+
/* PR analyzer/95007. */
void test_1 (void)
{
- char *s = "foo";
+ char *s = CONST_CAST(char *)("foo");
s[0] = 'g'; /* { dg-warning "write to string literal" } */
}
void test_2 (void)
{
- memcpy ("abc", "def", 3); /* { dg-warning "write to string literal" } */
+ // Technically irrelevant for C++ as fpermissive will warn about invalid conversion.
+ memcpy (CONST_CAST(char *)("abc"), "def", 3); /* { dg-warning "write to string literal" } */
}
+/* PR c/83347. */
+
static char * __attribute__((noinline))
called_by_test_3 (void)
{
char *buf;
if (flag)
- buf = __builtin_malloc (1024);
+ buf = (char *) __builtin_malloc (1024);
else
buf = (char *)""; /* { dg-bogus "here" } */
--- /dev/null
+typedef __SIZE_TYPE__ size_t;
+
+int getrandom (void *__buffer, size_t __length, /* { dg-line getrandom } */
+ unsigned int __flags)
+ __attribute__ ((access (__write_only__, 1, 2)));
+
+/* { dg-message "parameter 1 of 'getrandom' marked with attribute 'access \\(write_only, 1, 2\\)'" "" { target c} getrandom } */
+/* { dg-message "parameter 1 of 'int getrandom\\(void\\*, size_t, unsigned int\\)' marked with attribute 'access \\(write_only, 1, 2\\)'" "" { target c++ } getrandom } */
+
+#define GRND_RANDOM 0x02
+
+void test (int flag)
+{
+ char *buf;
+
+ if (flag)
+ buf = (char *) __builtin_malloc (1024);
+ else
+ buf = (char *)""; /* { dg-message "here" } */
+
+ if (getrandom(buf, 16, GRND_RANDOM)) /* { dg-warning "write to string literal" } */
+ __builtin_printf("%s\n", buf);
+
+ if (flag)
+ __builtin_free (buf);
+}
/* { dg-additional-options "-fanalyzer-show-duplicate-count" } */
/* { dg-require-effective-target alloca } */
-#include "analyzer-decls.h"
+#include "../../gcc.dg/analyzer/analyzer-decls.h"
typedef __SIZE_TYPE__ size_t;
-int getrandom (void *__buffer, size_t __length, /* { dg-message "parameter 1 of 'getrandom' marked with attribute 'access \\(write_only, 1, 2\\)'" } */
+int getrandom (void *__buffer, size_t __length,
+ /* { dg-message "parameter 1 of 'getrandom' marked with attribute 'access \\(write_only, 1, 2\\)'" "" { target c } .-1 } */
+ /* { dg-message "parameter 1 of 'int getrandom\\(void\\*, size_t, unsigned int\\)' marked with attribute 'access \\(write_only, 1, 2\\)'" "" { target c++ } .-2 } */
unsigned int __flags)
__attribute__ ((access (__write_only__, 1, 2)));
{
char *ptr;
if (flag)
- ptr = __builtin_malloc (1024);
+ ptr = (char *) __builtin_malloc (1024);
else
- ptr = __builtin_alloca (1024);
+ ptr = (char *) __builtin_alloca (1024);
__analyzer_dump_exploded_nodes (0); /* { dg-warning "2 processed enodes" } */
g++-dg-runtest $tests "" $DEFAULT_CXXFLAGS
+g++-dg-runtest [lsort [glob -nocomplain $srcdir/c-c++-common/analyzer/*.\[cS\]]] \
+ "" $DEFAULT_CXXFLAGS
+
# All done.
dg-finish
+++ /dev/null
-/* { dg-additional-options "-fdiagnostics-path-format=inline-events -fdiagnostics-show-caret" } */
-
-#include <stdint.h>
-
-void test_constant_1 (void)
-{
- int32_t *ptr = __builtin_malloc (1); /* { dg-warning "allocated buffer size is not a multiple of the pointee's size" } */
- __builtin_free (ptr);
-}
-
-/* { dg-begin-multiline-output "" }
- int32_t *ptr = __builtin_malloc (1);
- ^~~~~~~~~~~~~~~~~~~~
- 'test_constant_1': events 1-2
- |
- | int32_t *ptr = __builtin_malloc (1);
- | ^~~~~~~~~~~~~~~~~~~~
- | |
- | (1) allocated 1 byte here
- | (2) assigned to 'int32_t *'
- |
- { dg-end-multiline-output "" } */
-
-void test_constant_2 (void)
-{
- int32_t *ptr = __builtin_malloc (2); /* { dg-warning "allocated buffer size is not a multiple of the pointee's size" } */
- __builtin_free (ptr);
-}
-
-/* { dg-begin-multiline-output "" }
- int32_t *ptr = __builtin_malloc (2);
- ^~~~~~~~~~~~~~~~~~~~
- 'test_constant_2': events 1-2
- |
- | int32_t *ptr = __builtin_malloc (2);
- | ^~~~~~~~~~~~~~~~~~~~
- | |
- | (1) allocated 2 bytes here
- | (2) assigned to 'int32_t *'
- |
- { dg-end-multiline-output "" } */
-
-void test_symbolic (int n)
-{
- int32_t *ptr = __builtin_malloc (n * 2); /* { dg-warning "allocated buffer size is not a multiple of the pointee's size" } */
- __builtin_free (ptr);
-}
-
-/* { dg-begin-multiline-output "" }
- int32_t *ptr = __builtin_malloc (n * 2);
- ^~~~~~~~~~~~~~~~~~~~~~~~
- 'test_symbolic': event 1
- |
- | int32_t *ptr = __builtin_malloc (n * 2);
- | ^~~~~~~~~~~~~~~~~~~~~~~~
- | |
- | (1) allocated 'n * 2' bytes and assigned to 'int32_t *'
- |
- { dg-end-multiline-output "" } */
+++ /dev/null
-/* { dg-additional-options "-fdiagnostics-path-format=inline-events -fdiagnostics-show-caret -fanalyzer-fine-grained" } */
-/* { dg-require-effective-target alloca } */
-
-#include <stdint.h>
-
-void test_constant_1 (void)
-{
- int32_t *ptr = __builtin_alloca (1); /* { dg-warning "allocated buffer size is not a multiple of the pointee's size" } */
-}
-
-/* { dg-begin-multiline-output "" }
- int32_t *ptr = __builtin_alloca (1);
- ^~~~~~~~~~~~~~~~~~~~
- 'test_constant_1': events 1-2
- |
- | int32_t *ptr = __builtin_alloca (1);
- | ^~~~~~~~~~~~~~~~~~~~
- | |
- | (1) allocated 1 byte here
- | (2) assigned to 'int32_t *'
- |
- { dg-end-multiline-output "" } */
-
-void test_constant_2 (void)
-{
- int32_t *ptr = __builtin_alloca (2); /* { dg-warning "allocated buffer size is not a multiple of the pointee's size" } */
-}
-
-/* { dg-begin-multiline-output "" }
- int32_t *ptr = __builtin_alloca (2);
- ^~~~~~~~~~~~~~~~~~~~
- 'test_constant_2': events 1-2
- |
- | int32_t *ptr = __builtin_alloca (2);
- | ^~~~~~~~~~~~~~~~~~~~
- | |
- | (1) allocated 2 bytes here
- | (2) assigned to 'int32_t *'
- |
- { dg-end-multiline-output "" } */
-
-void test_symbolic (int n)
-{
- int32_t *ptr = __builtin_alloca (n * 2); /* { dg-warning "allocated buffer size is not a multiple of the pointee's size" } */
-}
-
-/* { dg-begin-multiline-output "" }
- int32_t *ptr = __builtin_alloca (n * 2);
- ^~~~~~~~~~~~~~~~~~~~~~~~
- 'test_symbolic': events 1-2
- |
- | int32_t *ptr = __builtin_alloca (n * 2);
- | ^~~~~~~~~~~~~~~~~~~~~~~~
- | |
- | (1) allocated 'n * 2' bytes here
- | (2) assigned to 'int32_t *'
- |
- { dg-end-multiline-output "" } */
-
-/* FIXME: am getting a duplicate warning here for some reason
- without -fanalyzer-fine-grained (PR PR analyzer/107851). */
-
+++ /dev/null
-/* Verify that we warn for incorrect uses of "alloca" (which may be in a
- macro in a system header), and that the output looks correct. */
-
-/* { dg-additional-options "-fdiagnostics-path-format=inline-events -fdiagnostics-show-caret -fanalyzer-fine-grained" } */
-/* { dg-require-effective-target alloca } */
-
-#include <stdint.h>
-#include "test-alloca.h"
-
-void test_constant_99 (void)
-{
- int32_t *ptr = alloca (99); /* { dg-warning "allocated buffer size is not a multiple of the pointee's size" } */
-}
-
-/* { dg-begin-multiline-output "" }
- int32_t *ptr = alloca (99);
- ^~~~~~
- 'test_constant_99': events 1-2
- |
- | int32_t *ptr = alloca (99);
- | ^~~~~~
- | |
- | (1) allocated 99 bytes here
- | (2) assigned to 'int32_t *' {aka '{re:long :re?}int *'} here; 'sizeof (int32_t {aka {re:long :re?}int})' is '4'
- |
- { dg-end-multiline-output "" } */
-
-void test_symbolic (int n)
-{
- int32_t *ptr = alloca (n * 2); /* { dg-warning "allocated buffer size is not a multiple of the pointee's size" } */
-}
-
-/* { dg-begin-multiline-output "" }
- int32_t *ptr = alloca (n * 2);
- ^~~~~~
- 'test_symbolic': events 1-2
- |
- | int32_t *ptr = alloca (n * 2);
- | ^~~~~~
- | |
- | (1) allocated 'n * 2' bytes here
- | (2) assigned to 'int32_t *' {aka '{re:long :re?}int *'} here; 'sizeof (int32_t {aka {re:long :re?}int})' is '4'
- |
- { dg-end-multiline-output "" } */
#ifndef ANALYZER_DECLS_H
#define ANALYZER_DECLS_H
+#ifndef NULL
+#ifdef __cplusplus
+#if __cplusplus >= 201103L
+#define NULL nullptr
+#else
+#define NULL 0
+#endif
+#else
+#define NULL ((void *)0)
+#endif
+#endif
+
/* Function decls with special meaning to the analyzer.
None of these are actually implemented. */
dg-runtest [lsort [glob -nocomplain $srcdir/$subdir/*.\[cS\]]] \
"" $DEFAULT_CFLAGS
+dg-runtest [lsort [glob -nocomplain $srcdir/c-c++-common/analyzer/*.\[cS\]]] \
+ "" $DEFAULT_CFLAGS
+
# All done.
dg-finish
+++ /dev/null
-int test (void)
-{
- unsigned char *s = "abc";
- char *t = "xyz";
- return s[1] + t[1];
-}
/* { dg-additional-options "-Wno-analyzer-too-complex -Wno-analyzer-fd-leak" } */
// TODO: remove need for these options
+/* C only: C++ does not support transparent_union. */
+
typedef __SIZE_TYPE__ size_t;
#define NULL ((void *)0)
struct sockaddr_un remote;
socklen_t len = sizeof(remote);
- pollfds = calloc(1, sizeof(struct pollfd));
+ pollfds = (struct pollfd *) calloc(1, sizeof(struct pollfd));
if (!pollfds) {
exit(1);
}
if (pollfds[0].revents & POLLIN) {
nsockets++;
- newpollfds = realloc(pollfds, nsockets * sizeof(*pollfds));
+ newpollfds = (struct pollfd *) realloc(pollfds, nsockets * sizeof(*pollfds));
if (!newpollfds) {
exit(1);
}
pollfds = newpollfds;
pollfds[nsockets - 1].fd = accept(pollfds[0].fd, &remote, &len);
+ /* { dg-error "could not convert '& remote' from 'sockaddr_un*' to '__SOCKADDR_ARG'" "G++ doesn't support transparent_union" { target c++ } .-1 } */
}
}
return 0;
/* { dg-additional-options "-Wno-analyzer-fd-leak" } */
// TODO: remove need for this option
+/* C only: C++ does not support transparent_union. */
typedef __SIZE_TYPE__ size_t;
#define NULL ((void *)0)
struct sockaddr_un remote;
socklen_t len = sizeof(remote);
- pollfds = calloc(1, sizeof(struct pollfd));
+ pollfds = (struct pollfd *) calloc(1, sizeof(struct pollfd));
if (!pollfds) {
exit(1);
}
}
nsockets++;
- newpollfds = realloc(pollfds, nsockets * sizeof(*pollfds));
+ newpollfds = (struct pollfd *) realloc(pollfds, nsockets * sizeof(*pollfds));
if (!newpollfds) {
exit(3);
}
pollfds = newpollfds;
pollfds[nsockets - 1].fd = accept(pollfds[0].fd, &remote, &len);
+ /* { dg-error "could not convert '& remote' from 'sockaddr_un*' to '__SOCKADDR_ARG'" "G++ doesn't support transparent_union" { target c++ } .-1 } */
+
exit(4);
}
/* { dg-additional-options "-Wno-int-conversion" } */
-#include "../pr61861.c"
+/* { C only: Wno-int-conversion is not valid for C++. */
+#include "../../gcc.dg/pr61861.c"
#include "analyzer-decls.h"
-#define NULL ((void *) 0)
#define PATH_SEPARATOR ':'
#define LOCALE_ALIAS_PATH "value for LOCALE_ALIAS_PATH"
+++ /dev/null
-/* { dg-do compile } */
-
-void
-p5 (const void *);
-
-void
-s5 (const void *cl)
-{
- p5 (&cl[1]); /* { dg-warning "dereferencing 'void \\*' pointer" } */
-}
/* { dg-additional-options "-Wno-pointer-to-int-cast" } */
+/* { C only: Wno-pointer-to-int-cast is not valid for C++. */
+
extern void my_func (int);
typedef struct {
int var;
extern void *_data_offs;
void test()
{
- info_t *info = ((void *)((void *)1) + ((unsigned int)&_data_offs));
+ info_t *info = (info_t *) ((void *)((void *)1) + ((unsigned int)&_data_offs));
my_func(info->var == 0);
}
/* { dg-additional-options "-Wno-incompatible-pointer-types" } */
+/* { C only: Wno-incompatible-pointer-types' is not valid for C++. */
void foo(void)
{
void (*a[1]) ();
+++ /dev/null
-#include "analyzer-decls.h"
-
-#define NULL ((void *)0)
-
-extern int *const p1;
-
-int *const p2;
-
-int v3;
-extern int *const p3 = &v3; /* { dg-warning "'p3' initialized and declared 'extern'" } */
-
-int v4;
-int *const p4 = &v4;
-
-int main (void)
-{
- __analyzer_describe (0, p1); /* { dg-message "INIT_VAL\\(p1\\)" } */
- __analyzer_eval (p1 == NULL); /* { dg-message "UNKNOWN" } */
-
- __analyzer_eval (p2 == NULL); /* { dg-message "TRUE" } */
-
- __analyzer_describe (0, p3); /* { dg-message "&v3" } */
- __analyzer_eval (p3 == NULL); /* { dg-message "FALSE" } */
-
- __analyzer_describe (0, p4); /* { dg-message "&v4" } */
- __analyzer_eval (p4 == NULL); /* { dg-message "FALSE" } */
-
- return p1[0];
-}
/* See e.g. https://en.cppreference.com/w/c/io/fprintf
and https://www.man7.org/linux/man-pages/man3/sprintf.3.html */
+/* C only: C++ fpermissive already emits errors. */
#include "analyzer-decls.h"
extern int
sprintf(char* dst, const char* fmt, ...)
__attribute__((__nothrow__));
-#define NULL ((void *)0)
-
-int
-test_passthrough (char* dst, const char* fmt)
-{
- /* This assumes that fmt doesn't have any arguments. */
- return sprintf (dst, fmt);
-}
-
-void
-test_known (void)
-{
- char buf[10];
- int res = sprintf (buf, "foo");
- /* TODO: ideally we would know the value of "res" is 3,
- and known the content and strlen of "buf" after the call */
-}
-int
-test_null_dst (void)
-{
- return sprintf (NULL, "hello world"); /* { dg-warning "use of NULL where non-null expected" } */
-}
-
-int
-test_null_fmt (char *dst)
-{
- return sprintf (dst, NULL); /* { dg-warning "use of NULL where non-null expected" } */
-}
-
-int
-test_uninit_dst (void)
-{
- char *dst;
- return sprintf (dst, "hello world"); /* { dg-warning "use of uninitialized value 'dst'" } */
-}
-
-int
-test_uninit_fmt_ptr (char *dst)
-{
- const char *fmt;
- return sprintf (dst, fmt); /* { dg-warning "use of uninitialized value 'fmt'" } */
-}
+#define NULL ((void *)0)
int
test_uninit_fmt_buf (char *dst)
return sprintf (dst, fmt); /* { dg-warning "stack-based buffer over-read" } */
/* { dg-message "while looking for null terminator for argument 2 \\('&fmt'\\) of 'sprintf'..." "event" { target *-*-* } .-1 } */
}
-
-void
-test_strlen_1 (void)
-{
- char buf[10];
- sprintf (buf, "msg: %s\n", "abc");
- __analyzer_eval (__builtin_strlen (buf) == 8); /* { dg-warning "UNKNOWN" } */
- // TODO: ideally would be TRUE
-}
+/* { C only: C++ does not allow for conversion from function pointer to 'void *' */
+
typedef __SIZE_TYPE__ size_t;
int getrandom (void *__buffer, size_t __length, /* { dg-message "parameter 1 of 'getrandom' marked with attribute 'access \\(write_only, 1, 2\\)'" } */
+++ /dev/null
-typedef __SIZE_TYPE__ size_t;
-
-int getrandom (void *__buffer, size_t __length, /* { dg-message "parameter 1 of 'getrandom' marked with attribute 'access \\(write_only, 1, 2\\)'" } */
- unsigned int __flags)
- __attribute__ ((access (__write_only__, 1, 2)));
-
-#define GRND_RANDOM 0x02
-
-void test (int flag)
-{
- char *buf;
-
- if (flag)
- buf = __builtin_malloc (1024);
- else
- buf = (char *)""; /* { dg-message "here" } */
-
- if (getrandom(buf, 16, GRND_RANDOM)) /* { dg-warning "write to string literal" } */
- __builtin_printf("%s\n", buf);
-
- if (flag)
- __builtin_free (buf);
-}
projects / thirdparty / gcc.git / commitdiff
