// RUN: %clang_analyze_cc1 -triple x86_64-apple-darwin9 -fenable-matrix -analyzer-checker=core,alpha.core,debug.ExprInspection -analyzer-store=region -Wno-pointer-to-int-cast -verify -analyzer-config eagerly-assume=false %s // RUN: %clang_analyze_cc1 -triple i386-apple-darwin9 -fenable-matrix -analyzer-checker=core,alpha.core,debug.ExprInspection -analyzer-store=region -Wno-pointer-to-int-cast -verify -analyzer-config eagerly-assume=false %s // RUN: %clang_analyze_cc1 -triple x86_64-apple-darwin9 -fenable-matrix -analyzer-checker=core,alpha.core,debug.ExprInspection -Wno-pointer-to-int-cast -verify -DEAGERLY_ASSUME=1 -w %s // RUN: %clang_analyze_cc1 -triple i386-apple-darwin9 -fenable-matrix -analyzer-checker=core,alpha.core,debug.ExprInspection -Wno-pointer-to-int-cast -verify -DEAGERLY_ASSUME=1 -DBIT32=1 -w %s extern void clang_analyzer_eval(_Bool); // Test if the 'storage' region gets properly initialized after it is cast to // 'struct sockaddr *'. typedef unsigned char __uint8_t; typedef unsigned int __uint32_t; typedef __uint32_t __darwin_socklen_t; typedef __uint8_t sa_family_t; typedef __darwin_socklen_t socklen_t; struct sockaddr { sa_family_t sa_family; }; struct sockaddr_storage {}; void getsockname(); #ifndef EAGERLY_ASSUME void f(int sock) { struct sockaddr_storage storage; struct sockaddr* sockaddr = (struct sockaddr*)&storage; // expected-warning{{Casting data to a larger structure type and accessing a field can lead to memory access errors or data corruption}} socklen_t addrlen = sizeof(storage); getsockname(sock, sockaddr, &addrlen); switch (sockaddr->sa_family) { // no-warning default: ; } } struct s { struct s *value; }; void f1(struct s **pval) { int *tbool = ((void*)0); struct s *t = *pval; pval = &(t->value); tbool = (int *)pval; // use the cast-to type 'int *' to create element region. char c = (unsigned char) *tbool; // Should use cast-to type to create symbol. if (*tbool == -1) // here load the element region with the correct type 'int' (void)3; } void f2(const char *str) { unsigned char ch, cl, *p; p = (unsigned char *)str; ch = *p++; // use cast-to type 'unsigned char' to create element region. cl = *p++; if(!cl) cl = 'a'; } // Test cast VariableSizeArray to pointer does not crash. void *memcpy(void *, void const *, unsigned long); typedef unsigned char Byte; void doit(char *data, int len) { if (len) { Byte buf[len]; memcpy(buf, data, len); } } // PR 6013 and 6035 - Test that a cast of a pointer to long and then to int does not crash SValuator. void pr6013_6035_test(void *p) { unsigned int foo; foo = ((long)(p)); (void) foo; } // PR12511 and radar://11215362 - Test that we support SymCastExpr, which represents symbolic int to float cast. char ttt(int intSeconds) { double seconds = intSeconds; if (seconds) return 0; return 0; } int foo (int* p) { int y = 0; if (p == 0) { if ((*((void**)&p)) == (void*)0) // Test that the cast to void preserves the symbolic region. return 0; else return 5/y; // This code should be unreachable: no-warning. } return 0; } void castsToBool() { clang_analyzer_eval(0); // expected-warning{{FALSE}} clang_analyzer_eval(0U); // expected-warning{{FALSE}} clang_analyzer_eval((void *)0); // expected-warning{{FALSE}} clang_analyzer_eval(1); // expected-warning{{TRUE}} clang_analyzer_eval(1U); // expected-warning{{TRUE}} clang_analyzer_eval(-1); // expected-warning{{TRUE}} clang_analyzer_eval(0x100); // expected-warning{{TRUE}} clang_analyzer_eval(0x100U); // expected-warning{{TRUE}} clang_analyzer_eval((void *)0x100); // expected-warning{{TRUE}} extern int symbolicInt; clang_analyzer_eval(symbolicInt); // expected-warning{{UNKNOWN}} if (symbolicInt) clang_analyzer_eval(symbolicInt); // expected-warning{{TRUE}} extern void *symbolicPointer; clang_analyzer_eval(symbolicPointer); // expected-warning{{UNKNOWN}} if (symbolicPointer) clang_analyzer_eval(symbolicPointer); // expected-warning{{TRUE}} int localInt; int* ptr = &localInt; clang_analyzer_eval(ptr); // expected-warning{{TRUE}} clang_analyzer_eval(&castsToBool); // expected-warning{{TRUE}} clang_analyzer_eval("abc"); // expected-warning{{TRUE}} extern float globalFloat; clang_analyzer_eval(globalFloat); // expected-warning{{UNKNOWN}} } void locAsIntegerCasts(void *p) { int x = (int) p; clang_analyzer_eval(++x < 10); // no-crash // expected-warning{{UNKNOWN}} } void multiDimensionalArrayPointerCasts() { static int x[10][10]; int *y1 = &(x[3][5]); char *z = ((char *) y1) + 2; int *y2 = (int *)(z - 2); int *y3 = ((int *)x) + 35; // This is offset for [3][5]. clang_analyzer_eval(y1 == y2); // expected-warning{{TRUE}} // FIXME: should be FALSE (i.e. equal pointers). clang_analyzer_eval(y1 - y2); // expected-warning{{UNKNOWN}} // FIXME: should be TRUE (i.e. same symbol). clang_analyzer_eval(*y1 == *y2); // expected-warning{{UNKNOWN}} clang_analyzer_eval(*((char *)y1) == *((char *) y2)); // expected-warning{{TRUE}} clang_analyzer_eval(y1 == y3); // expected-warning{{TRUE}} // FIXME: should be FALSE (i.e. equal pointers). clang_analyzer_eval(y1 - y3); // expected-warning{{UNKNOWN}} // FIXME: should be TRUE (i.e. same symbol). clang_analyzer_eval(*y1 == *y3); // expected-warning{{UNKNOWN}} clang_analyzer_eval(*((char *)y1) == *((char *) y3)); // expected-warning{{TRUE}} } void *getVoidPtr(); void testCastVoidPtrToIntPtrThroughIntTypedAssignment() { int *x; (*((int *)(&x))) = (int)getVoidPtr(); *x = 1; // no-crash } void testCastUIntPtrToIntPtrThroughIntTypedAssignment() { unsigned u; int *x; (*((int *)(&x))) = (int)&u; *x = 1; clang_analyzer_eval(u == 1); // expected-warning{{TRUE}} } void testCastVoidPtrToIntPtrThroughUIntTypedAssignment() { int *x; (*((int *)(&x))) = (int)(unsigned *)getVoidPtr(); *x = 1; // no-crash } void testLocNonLocSymbolAssume(int a, int *b) { if ((int)b < a) {} // no-crash } void testLocNonLocSymbolRemainder(int a, int *b) { int c = ((int)b) % a; if (a == 1) { c += 1; } } void testSwitchWithSizeofs() { switch (sizeof(char) == 1) { // expected-warning{{switch condition has boolean value}} case sizeof(char):; // no-crash } } void test_ToUnion_cast(unsigned long long x) { union Key { unsigned long long data; }; void clang_analyzer_dump_union(union Key); clang_analyzer_dump_union((union Key)x); // expected-warning {{Unknown}} } typedef char cx5x5 __attribute__((matrix_type(5, 5))); typedef int ix5x5 __attribute__((matrix_type(5, 5))); void test_MatrixCast_cast(cx5x5 c) { void clang_analyzer_dump_ix5x5(ix5x5); clang_analyzer_dump_ix5x5((ix5x5)c); // expected-warning {{Unknown}} } void test_VectorSplat_cast(long x) { typedef int __attribute__((ext_vector_type(2))) V; void clang_analyzer_dump_V(V); clang_analyzer_dump_V((V)x); // expected-warning {{Unknown}} } #endif #ifdef EAGERLY_ASSUME int globalA; extern int globalFunc(); void no_crash_on_symsym_cast_to_long() { char c = globalFunc() - 5; c == 0; globalA -= c; globalA == 3; (long)globalA << 48; #ifdef BIT32 // expected-warning@-2{{The result of the left shift is undefined due to shifting by '48', which is greater or equal to the width of type 'long'}} #else // expected-no-diagnostics #endif } #endif char no_crash_SymbolCast_of_float_type_aux(int *p) { *p += 1; return *p; } void no_crash_SymbolCast_of_float_type() { extern float x; char (*f)() = no_crash_SymbolCast_of_float_type_aux; f(&x); } double no_crash_reinterpret_double_as_int(double a) { *(int *)&a = 1; return a * a; } double no_crash_reinterpret_double_as_ptr(double a) { *(void **)&a = 0; return a * a; } double no_crash_reinterpret_double_as_sym_int(double a, int b) { *(int *)&a = b; return a * a; } double no_crash_reinterpret_double_as_sym_ptr(double a, void * b) { *(void **)&a = b; return a * a; } void no_crash_reinterpret_char_as_uchar(char ***a, int *b) { *(unsigned char **)a = (unsigned char *)b; if (**a == 0) // no-crash ; } // PR50179. struct S {}; void symbolic_offset(struct S *ptr, int i) { const struct S *pS = ptr + i; struct S s = *pS; // no-crash }