1 // Given code 'struct aa { char s1[4]; char * s2;} a; memcpy(a.s1, ...);',
2 // this test checks that the CStringChecker only invalidates the destination buffer array a.s1 (instead of a.s1 and a.s2).
3 // At the moment the whole of the destination array content is invalidated.
4 // If a.s1 region has a symbolic offset, the whole region of 'a' is invalidated.
5 // Specific triple set to test structures of size 0.
6 // RUN: %clang_analyze_cc1 -triple x86_64-pc-linux-gnu -analyzer-checker=core,unix.Malloc,debug.ExprInspection -analyzer-store=region -verify -analyzer-config eagerly-assume=false %s
7 
8 typedef __typeof(sizeof(int)) size_t;
9 
10 char *strdup(const char *s);
11 void free(void *);
12 void *memcpy(void *dst, const void *src, size_t n); // expected-note{{passing argument to parameter 'dst' here}}
13 void *malloc(size_t n);
14 
15 void clang_analyzer_eval(int);
16 
17 struct aa {
18     char s1[4];
19     char *s2;
20 };
21 
22 // Test different types of structure initialisation.
f0()23 int f0() {
24   struct aa a0 = {{1, 2, 3, 4}, 0};
25   a0.s2 = strdup("hello");
26   char input[] = {'a', 'b', 'c', 'd'};
27   memcpy(a0.s1, input, 4);
28   clang_analyzer_eval(a0.s1[0] == 'a'); // expected-warning{{UNKNOWN}}
29   clang_analyzer_eval(a0.s1[1] == 'b'); // expected-warning{{UNKNOWN}}
30   clang_analyzer_eval(a0.s1[2] == 'c'); // expected-warning{{UNKNOWN}}
31   clang_analyzer_eval(a0.s1[3] == 'd'); // expected-warning{{UNKNOWN}}
32   clang_analyzer_eval(a0.s2 == 0); // expected-warning{{UNKNOWN}}
33   free(a0.s2); // no warning
34   return 0;
35 }
36 
f1()37 int f1() {
38   struct aa a1;
39   a1.s2 = strdup("hello");
40   char input[] = {'a', 'b', 'c', 'd'};
41   memcpy(a1.s1, input, 4);
42   clang_analyzer_eval(a1.s1[0] == 'a'); // expected-warning{{UNKNOWN}}
43   clang_analyzer_eval(a1.s1[1] == 'b'); // expected-warning{{UNKNOWN}}
44   clang_analyzer_eval(a1.s1[2] == 'c'); // expected-warning{{UNKNOWN}}
45   clang_analyzer_eval(a1.s1[3] == 'd'); // expected-warning{{UNKNOWN}}
46   clang_analyzer_eval(a1.s2 == 0); // expected-warning{{UNKNOWN}}
47   free(a1.s2); // no warning
48   return 0;
49 }
50 
f2()51 int f2() {
52   struct aa a2 = {{1, 2}};
53   a2.s2 = strdup("hello");
54   char input[] = {'a', 'b', 'c', 'd'};
55   memcpy(a2.s1, input, 4);
56   clang_analyzer_eval(a2.s1[0] == 'a'); // expected-warning{{UNKNOWN}}
57   clang_analyzer_eval(a2.s1[1] == 'b'); // expected-warning{{UNKNOWN}}
58   clang_analyzer_eval(a2.s1[2] == 'c'); // expected-warning{{UNKNOWN}}
59   clang_analyzer_eval(a2.s1[3] == 'd'); // expected-warning{{UNKNOWN}}
60   clang_analyzer_eval(a2.s2 == 0); // expected-warning{{UNKNOWN}}
61   free(a2.s2); // no warning
62   return 0;
63 }
64 
f3()65 int f3() {
66   struct aa a3 = {{1, 2, 3, 4}, 0};
67   a3.s2 = strdup("hello");
68   char input[] = {'a', 'b', 'c', 'd'};
69   int * dest = (int*)a3.s1;
70   memcpy(dest, input, 4);
71   clang_analyzer_eval(a3.s1[0] == 'a'); // expected-warning{{UNKNOWN}}
72   clang_analyzer_eval(dest[0] == 'a'); // expected-warning{{UNKNOWN}}
73   clang_analyzer_eval(a3.s1[1] == 'b'); // expected-warning{{UNKNOWN}}
74   clang_analyzer_eval(dest[1] == 'b'); // expected-warning{{UNKNOWN}}
75   clang_analyzer_eval(a3.s1[2] == 'c'); // expected-warning{{UNKNOWN}}
76   clang_analyzer_eval(dest[2] == 'c'); // expected-warning{{UNKNOWN}}
77   clang_analyzer_eval(a3.s1[3] == 'd'); // expected-warning{{UNKNOWN}}
78   clang_analyzer_eval(dest[3] == 'd'); // expected-warning{{UNKNOWN}}
79   clang_analyzer_eval(a3.s2 == 0); // expected-warning{{UNKNOWN}}
80   free(a3.s2); // no warning
81   return 0;
82 }
83 
84 struct bb {
85   struct aa a;
86   char * s2;
87 };
88 
f4()89 int f4() {
90   struct bb b0 = {{1, 2, 3, 4}, 0};
91   b0.s2 = strdup("hello");
92   b0.a.s2 = strdup("hola");
93   char input[] = {'a', 'b', 'c', 'd'};
94   char * dest = (char*)(b0.a.s1);
95   memcpy(dest, input, 4);
96   clang_analyzer_eval(b0.a.s1[0] == 'a'); // expected-warning{{UNKNOWN}}
97   clang_analyzer_eval(dest[0] == 'a'); // expected-warning{{UNKNOWN}}
98   clang_analyzer_eval(b0.a.s1[1] == 'b'); // expected-warning{{UNKNOWN}}
99   clang_analyzer_eval(dest[1] == 'b'); // expected-warning{{UNKNOWN}}
100   clang_analyzer_eval(b0.a.s1[2] == 'c'); // expected-warning{{UNKNOWN}}
101   clang_analyzer_eval(dest[2] == 'c'); // expected-warning{{UNKNOWN}}
102   clang_analyzer_eval(b0.a.s1[3] == 'd'); // expected-warning{{UNKNOWN}}
103   clang_analyzer_eval(dest[3] == 'd'); // expected-warning{{UNKNOWN}}
104   clang_analyzer_eval(b0.s2 == 0); // expected-warning{{UNKNOWN}}
105   free(b0.a.s2); // no warning
106   free(b0.s2); // no warning
107   return 0;
108 }
109 
110 // Test that memory leaks are caught.
f5()111 int f5() {
112   struct aa a0 = {{1, 2, 3, 4}, 0};
113   a0.s2 = strdup("hello");
114   char input[] = {'a', 'b', 'c', 'd'};
115   memcpy(a0.s1, input, 4);
116   return 0; // expected-warning{{Potential leak of memory pointed to by 'a0.s2'}}
117 }
118 
f6()119 int f6() {
120   struct aa a1;
121   a1.s2 = strdup("hello");
122   char input[] = {'a', 'b', 'c', 'd'};
123   memcpy(a1.s1, input, 4);
124   return 0; // expected-warning{{Potential leak of memory pointed to by 'a1.s2'}}
125 }
126 
f7()127 int f7() {
128   struct aa a2 = {{1, 2}};
129   a2.s2 = strdup("hello");
130   char input[] = {'a', 'b', 'c', 'd'};
131   memcpy(a2.s1, input, 4);
132   return 0; // expected-warning{{Potential leak of memory pointed to by 'a2.s2'}}
133 }
134 
f8()135 int f8() {
136   struct aa a3 = {{1, 2, 3, 4}, 0};
137   a3.s2 = strdup("hello");
138   char input[] = {'a', 'b', 'c', 'd'};
139   int * dest = (int*)a3.s1;
140   memcpy(dest, input, 4);
141   return 0; // expected-warning{{Potential leak of memory pointed to by 'a3.s2'}}
142 }
143 
f9()144 int f9() {
145   struct bb b0 = {{1, 2, 3, 4}, 0};
146   b0.s2 = strdup("hello");
147   b0.a.s2 = strdup("hola");
148   char input[] = {'a', 'b', 'c', 'd'};
149   char * dest = (char*)(b0.a.s1);
150   memcpy(dest, input, 4);
151   free(b0.a.s2); // expected-warning{{Potential leak of memory pointed to by 'b0.s2'}}
152   return 0;
153 }
154 
f10()155 int f10() {
156   struct bb b0 = {{1, 2, 3, 4}, 0};
157   b0.s2 = strdup("hello");
158   b0.a.s2 = strdup("hola");
159   char input[] = {'a', 'b', 'c', 'd'};
160   char * dest = (char*)(b0.a.s1);
161   memcpy(dest, input, 4);
162   free(b0.s2); // expected-warning{{Potential leak of memory pointed to by 'b0.a.s2'}}
163   return 0;
164 }
165 
166 // Test invalidating fields being addresses of array.
167 struct cc {
168   char * s1;
169   char * s2;
170 };
171 
f11()172 int f11() {
173   char x[4] = {1, 2};
174   x[0] = 1;
175   x[1] = 2;
176   struct cc c0;
177   c0.s2 = strdup("hello");
178   c0.s1 = &x[0];
179   char input[] = {'a', 'b', 'c', 'd'};
180   memcpy(c0.s1, input, 4);
181   clang_analyzer_eval(x[0] == 1); // expected-warning{{UNKNOWN}}
182   clang_analyzer_eval(x[1] == 2); // expected-warning{{UNKNOWN}}
183   clang_analyzer_eval(c0.s1[0] == 'a'); // expected-warning{{UNKNOWN}}
184   clang_analyzer_eval(c0.s1[1] == 'b'); // expected-warning{{UNKNOWN}}
185   clang_analyzer_eval(c0.s1[2] == 'c'); // expected-warning{{UNKNOWN}}
186   clang_analyzer_eval(c0.s1[3] == 'd'); // expected-warning{{UNKNOWN}}
187   free(c0.s2); // no-warning
188   return 0;
189 }
190 
191 // Test inverting field position between s1 and s2.
192 struct dd {
193   char *s2;
194   char s1[4];
195 };
196 
f12()197 int f12() {
198   struct dd d0 = {0, {1, 2, 3, 4}};
199   d0.s2 = strdup("hello");
200   char input[] = {'a', 'b', 'c', 'd'};
201   memcpy(d0.s1, input, 4);
202   clang_analyzer_eval(d0.s1[0] == 'a'); // expected-warning{{UNKNOWN}}
203   clang_analyzer_eval(d0.s1[1] == 'b'); // expected-warning{{UNKNOWN}}
204   clang_analyzer_eval(d0.s1[2] == 'c'); // expected-warning{{UNKNOWN}}
205   clang_analyzer_eval(d0.s1[3] == 'd'); // expected-warning{{UNKNOWN}}
206   clang_analyzer_eval(d0.s2 == 0); // expected-warning{{UNKNOWN}}
207   free(d0.s2); // no warning
208   return 0;
209 }
210 
211 // Test arrays of structs.
212 struct ee {
213   int a;
214   char b;
215 };
216 
217 struct EE {
218   struct ee s1[2];
219   char * s2;
220 };
221 
f13()222 int f13() {
223   struct EE E0 = {{{1, 2}, {3, 4}}, 0};
224   E0.s2 = strdup("hello");
225   char input[] = {'a', 'b', 'c', 'd'};
226   memcpy(E0.s1, input, 4);
227   clang_analyzer_eval(E0.s1[0].a == 'a'); // expected-warning{{UNKNOWN}}
228   clang_analyzer_eval(E0.s1[0].b == 'b'); // expected-warning{{UNKNOWN}}
229   clang_analyzer_eval(E0.s1[1].a == 'c'); // expected-warning{{UNKNOWN}}
230   clang_analyzer_eval(E0.s1[1].b == 'd'); // expected-warning{{UNKNOWN}}
231   clang_analyzer_eval(E0.s2 == 0); // expected-warning{{UNKNOWN}}
232   free(E0.s2); // no warning
233   return 0;
234 }
235 
236 // Test global parameters.
237 struct aa a15 = {{1, 2, 3, 4}, 0};
238 
f15()239 int f15() {
240   a15.s2 = strdup("hello");
241   char input[] = {'a', 'b', 'c', 'd'};
242   memcpy(a15.s1, input, 4);
243   clang_analyzer_eval(a15.s1[0] == 'a'); // expected-warning{{UNKNOWN}}
244   clang_analyzer_eval(a15.s1[1] == 'b'); // expected-warning{{UNKNOWN}}
245   clang_analyzer_eval(a15.s1[2] == 'c'); // expected-warning{{UNKNOWN}}
246   clang_analyzer_eval(a15.s1[3] == 'd'); // expected-warning{{UNKNOWN}}
247   clang_analyzer_eval(a15.s2 == 0); // expected-warning{{UNKNOWN}}
248   free(a15.s2); // no warning
249   return 0;
250 }
251 
252 // Test array of 0 sized elements.
253 struct empty {};
254 struct gg {
255   struct empty s1[4];
256   char * s2;
257 };
258 
f16()259 int f16() {
260   struct gg g0 = {{}, 0};
261   g0.s2 = strdup("hello");
262   char input[] = {'a', 'b', 'c', 'd'};
263   memcpy(g0.s1, input, 4);
264   clang_analyzer_eval(*(int*)(&g0.s1[0]) == 'a'); // expected-warning{{UNKNOWN}}\
265   expected-warning{{Potential leak of memory pointed to by 'g0.s2'}}
266   clang_analyzer_eval(*(int*)(&g0.s1[1]) == 'b'); // expected-warning{{UNKNOWN}}
267   clang_analyzer_eval(*(int*)(&g0.s1[2]) == 'c'); // expected-warning{{UNKNOWN}}
268   clang_analyzer_eval(*(int*)(&g0.s1[3]) == 'd'); // expected-warning{{UNKNOWN}}
269   clang_analyzer_eval(g0.s2 == 0); // expected-warning{{UNKNOWN}}
270   free(g0.s2); // no warning
271   return 0;
272 }
273 
274 // Test array of 0 elements.
275 struct hh {
276   char s1[0];
277   char * s2;
278 };
279 
f17()280 int f17() {
281   struct hh h0;
282   h0.s2 = strdup("hello");
283   char input[] = {'a', 'b', 'c', 'd'};
284   memcpy(h0.s1, input, 4);
285   clang_analyzer_eval(h0.s1[0] == 'a'); // expected-warning{{UNKNOWN}}\
286   expected-warning{{Potential leak of memory pointed to by 'h0.s2'}}
287   clang_analyzer_eval(h0.s2 == 0); // expected-warning{{UNKNOWN}}
288   free(h0.s2); // no warning
289   return 0;
290 }
291 
292 // Test writing past the array.
293 struct ii {
294   char s1[4];
295   int i;
296   int j;
297   char * s2;
298 };
299 
f18()300 int f18() {
301   struct ii i18 = {{1, 2, 3, 4}, 5, 6};
302   i18.i = 10;
303   i18.j = 11;
304   i18.s2 = strdup("hello");
305   char input[100] = {3};
306   memcpy(i18.s1, input, 100); // expected-warning {{'memcpy' will always overflow; destination buffer has size 24, but size argument is 100}}
307   clang_analyzer_eval(i18.s1[0] == 1); // expected-warning{{UNKNOWN}}\
308   expected-warning{{Potential leak of memory pointed to by 'i18.s2'}}
309   clang_analyzer_eval(i18.s1[1] == 2); // expected-warning{{UNKNOWN}}
310   clang_analyzer_eval(i18.s1[2] == 3); // expected-warning{{UNKNOWN}}
311   clang_analyzer_eval(i18.s1[3] == 4); // expected-warning{{UNKNOWN}}
312   clang_analyzer_eval(i18.i == 10); // expected-warning{{UNKNOWN}}
313   clang_analyzer_eval(i18.j == 11); // expected-warning{{UNKNOWN}}
314   return 0;
315 }
316 
f181()317 int f181() {
318   struct ii i181 = {{1, 2, 3, 4}, 5, 6};
319   i181.i = 10;
320   i181.j = 11;
321   i181.s2 = strdup("hello");
322   char input[100] = {3};
323   memcpy(i181.s1, input, 5); // invalidate the whole region of i181
324   clang_analyzer_eval(i181.s1[0] == 1); // expected-warning{{UNKNOWN}}\
325   expected-warning{{Potential leak of memory pointed to by 'i181.s2'}}
326   clang_analyzer_eval(i181.s1[1] == 2); // expected-warning{{UNKNOWN}}
327   clang_analyzer_eval(i181.s1[2] == 3); // expected-warning{{UNKNOWN}}
328   clang_analyzer_eval(i181.s1[3] == 4); // expected-warning{{UNKNOWN}}
329   clang_analyzer_eval(i181.i == 10); // expected-warning{{UNKNOWN}}
330   clang_analyzer_eval(i181.j == 11); // expected-warning{{UNKNOWN}}
331   return 0;
332 }
333 
334 // Test array with a symbolic offset.
335 struct jj {
336   char s1[2];
337   char * s2;
338 };
339 
340 struct JJ {
341   struct jj s1[3];
342   char * s2;
343 };
344 
f19(int i)345 int f19(int i) {
346   struct JJ J0 = {{{1, 2, 0}, {3, 4, 0}, {5, 6, 0}}, 0};
347   J0.s2 = strdup("hello");
348   J0.s1[0].s2 = strdup("hello");
349   J0.s1[1].s2 = strdup("hi");
350   J0.s1[2].s2 = strdup("world");
351   char input[2] = {'a', 'b'};
352   memcpy(J0.s1[i].s1, input, 2);
353   clang_analyzer_eval(J0.s1[0].s1[0] == 1); // expected-warning{{UNKNOWN}}\
354   expected-warning{{Potential leak of memory pointed to by field 's2'}}\
355   expected-warning{{Potential leak of memory pointed to by field 's2'}}\
356   expected-warning{{Potential leak of memory pointed to by field 's2'}}\
357   expected-warning{{Potential leak of memory pointed to by 'J0.s2'}}
358   clang_analyzer_eval(J0.s1[0].s1[1] == 2); // expected-warning{{UNKNOWN}}
359   clang_analyzer_eval(J0.s1[1].s1[0] == 3); // expected-warning{{UNKNOWN}}
360   clang_analyzer_eval(J0.s1[1].s1[1] == 4); // expected-warning{{UNKNOWN}}
361   clang_analyzer_eval(J0.s1[2].s1[0] == 5); // expected-warning{{UNKNOWN}}
362   clang_analyzer_eval(J0.s1[2].s1[1] == 6); // expected-warning{{UNKNOWN}}
363   clang_analyzer_eval(J0.s1[i].s1[0] == 5); // expected-warning{{UNKNOWN}}
364   clang_analyzer_eval(J0.s1[i].s1[1] == 6); // expected-warning{{UNKNOWN}}
365   // FIXME: memory leak warning for J0.s2 should be emitted here instead of after memcpy call.
366   return 0; // no warning
367 }
368 
369 // Test array with its super region having symbolic offseted regions.
f20(int i)370 int f20(int i) {
371   struct aa * a20 = malloc(sizeof(struct aa) * 2);
372   a20[0].s1[0] = 1;
373   a20[0].s1[1] = 2;
374   a20[0].s1[2] = 3;
375   a20[0].s1[3] = 4;
376   a20[0].s2 = strdup("hello");
377   a20[1].s1[0] = 5;
378   a20[1].s1[1] = 6;
379   a20[1].s1[2] = 7;
380   a20[1].s1[3] = 8;
381   a20[1].s2 = strdup("world");
382   a20[i].s2 = strdup("hola");
383   char input[] = {'a', 'b', 'c', 'd'};
384   memcpy(a20[0].s1, input, 4);
385   clang_analyzer_eval(a20[0].s1[0] == 1); // expected-warning{{UNKNOWN}}
386   clang_analyzer_eval(a20[0].s1[1] == 1); // expected-warning{{UNKNOWN}}
387   clang_analyzer_eval(a20[0].s1[2] == 1); // expected-warning{{UNKNOWN}}
388   clang_analyzer_eval(a20[0].s1[3] == 1); // expected-warning{{UNKNOWN}}
389   clang_analyzer_eval(a20[0].s2 == 0); // expected-warning{{UNKNOWN}}
390   clang_analyzer_eval(a20[1].s1[0] == 1); // expected-warning{{UNKNOWN}}
391   clang_analyzer_eval(a20[1].s1[1] == 1); // expected-warning{{UNKNOWN}}
392   clang_analyzer_eval(a20[1].s1[2] == 1); // expected-warning{{UNKNOWN}}
393   clang_analyzer_eval(a20[1].s1[3] == 1); // expected-warning{{UNKNOWN}}
394   clang_analyzer_eval(a20[1].s2 == 0); // expected-warning{{UNKNOWN}}
395   clang_analyzer_eval(a20[i].s1[0] == 1); // expected-warning{{UNKNOWN}}
396   clang_analyzer_eval(a20[i].s1[1] == 1); // expected-warning{{UNKNOWN}}
397   clang_analyzer_eval(a20[i].s1[2] == 1); // expected-warning{{UNKNOWN}}
398   clang_analyzer_eval(a20[i].s1[3] == 1); // expected-warning{{UNKNOWN}}
399   clang_analyzer_eval(a20[i].s2 == 0); // expected-warning{{UNKNOWN}}\
400   expected-warning{{Potential leak of memory pointed to by 'a20'}}
401 
402   return 0;
403 }
404 
405 // Test array's region and super region both having symbolic offsets.
f21(int i)406 int f21(int i) {
407   struct aa * a21 = malloc(sizeof(struct aa) * 2);
408   a21[0].s1[0] = 1;
409   a21[0].s1[1] = 2;
410   a21[0].s1[2] = 3;
411   a21[0].s1[3] = 4;
412   a21[0].s2 = 0;
413   a21[1].s1[0] = 5;
414   a21[1].s1[1] = 6;
415   a21[1].s1[2] = 7;
416   a21[1].s1[3] = 8;
417   a21[1].s2 = 0;
418   a21[i].s2 = strdup("hello");
419   a21[i].s1[0] = 1;
420   a21[i].s1[1] = 2;
421   a21[i].s1[2] = 3;
422   a21[i].s1[3] = 4;
423   char input[] = {'a', 'b', 'c', 'd'};
424   memcpy(a21[i].s1, input, 4);
425   clang_analyzer_eval(a21[0].s1[0] == 1); // expected-warning{{UNKNOWN}}
426   clang_analyzer_eval(a21[0].s1[1] == 1); // expected-warning{{UNKNOWN}}
427   clang_analyzer_eval(a21[0].s1[2] == 1); // expected-warning{{UNKNOWN}}
428   clang_analyzer_eval(a21[0].s1[3] == 1); // expected-warning{{UNKNOWN}}
429   clang_analyzer_eval(a21[0].s2 == 0); // expected-warning{{UNKNOWN}}
430   clang_analyzer_eval(a21[1].s1[0] == 1); // expected-warning{{UNKNOWN}}
431   clang_analyzer_eval(a21[1].s1[1] == 1); // expected-warning{{UNKNOWN}}
432   clang_analyzer_eval(a21[1].s1[2] == 1); // expected-warning{{UNKNOWN}}
433   clang_analyzer_eval(a21[1].s1[3] == 1); // expected-warning{{UNKNOWN}}
434   clang_analyzer_eval(a21[1].s2 == 0); // expected-warning{{UNKNOWN}}
435   clang_analyzer_eval(a21[i].s1[0] == 1); // expected-warning{{UNKNOWN}}
436   clang_analyzer_eval(a21[i].s1[1] == 1); // expected-warning{{UNKNOWN}}
437   clang_analyzer_eval(a21[i].s1[2] == 1); // expected-warning{{UNKNOWN}}
438   clang_analyzer_eval(a21[i].s1[3] == 1); // expected-warning{{UNKNOWN}}
439   clang_analyzer_eval(a21[i].s2 == 0); // expected-warning{{UNKNOWN}}\
440   expected-warning{{Potential leak of memory pointed to by 'a21'}}
441 
442   return 0;
443 }
444 
445 // Test regions aliasing other regions.
446 struct ll {
447   char s1[4];
448   char * s2;
449 };
450 
451 struct mm {
452   char s3[4];
453   char * s4;
454 };
455 
f24()456 int f24() {
457   struct ll l24 = {{1, 2, 3, 4}, 0};
458   struct mm * m24 = (struct mm *)&l24;
459   m24->s4 = strdup("hello");
460   char input[] = {1, 2, 3, 4};
461   memcpy(m24->s3, input, 4);
462   clang_analyzer_eval(m24->s3[0] == 1); // expected-warning{{UNKNOWN}}
463   clang_analyzer_eval(m24->s3[1] == 1); // expected-warning{{UNKNOWN}}
464   clang_analyzer_eval(m24->s3[2] == 1); // expected-warning{{UNKNOWN}}
465   clang_analyzer_eval(m24->s3[3] == 1); // expected-warning{{UNKNOWN}}
466   clang_analyzer_eval(l24.s1[0] == 1); // expected-warning{{UNKNOWN}}
467   clang_analyzer_eval(l24.s1[1] == 1); // expected-warning{{UNKNOWN}}
468   clang_analyzer_eval(l24.s1[2] == 1); // expected-warning{{UNKNOWN}}
469   clang_analyzer_eval(l24.s1[3] == 1); // expected-warning{{UNKNOWN}}\
470   expected-warning{{Potential leak of memory pointed to by field 's4'}}
471   return 0;
472 }
473 
474 // Test region with potential aliasing and symbolic offsets.
475 // Store assumes no aliasing.
f25(int i,int j,struct ll * l,struct mm * m)476 int f25(int i, int j, struct ll * l, struct mm * m) {
477   m->s4 = strdup("hola"); // m->s4 not tracked
478   m->s3[0] = 1;
479   m->s3[1] = 2;
480   m->s3[2] = 3;
481   m->s3[3] = 4;
482   m->s3[j] = 5; // invalidates m->s3
483   l->s2 = strdup("hello"); // l->s2 not tracked
484   l->s1[0] = 6;
485   l->s1[1] = 7;
486   l->s1[2] = 8;
487   l->s1[3] = 9;
488   l->s1[i] = 10; // invalidates l->s1
489   char input[] = {1, 2, 3, 4};
490   memcpy(m->s3, input, 4); // does not invalidate l->s1[i]
491   clang_analyzer_eval(m->s3[0] == 1); // expected-warning{{UNKNOWN}}
492   clang_analyzer_eval(m->s3[1] == 1); // expected-warning{{UNKNOWN}}
493   clang_analyzer_eval(m->s3[2] == 1); // expected-warning{{UNKNOWN}}
494   clang_analyzer_eval(m->s3[3] == 1); // expected-warning{{UNKNOWN}}
495   clang_analyzer_eval(m->s3[i] == 1); // expected-warning{{UNKNOWN}}
496   clang_analyzer_eval(m->s3[j] == 1); // expected-warning{{UNKNOWN}}
497   clang_analyzer_eval(l->s1[0] == 1); // expected-warning{{UNKNOWN}}
498   clang_analyzer_eval(l->s1[1] == 1); // expected-warning{{UNKNOWN}}
499   clang_analyzer_eval(l->s1[2] == 1); // expected-warning{{UNKNOWN}}
500   clang_analyzer_eval(l->s1[3] == 1); // expected-warning{{UNKNOWN}}
501   clang_analyzer_eval(l->s1[i] == 1); // expected-warning{{FALSE}}
502   clang_analyzer_eval(l->s1[j] == 1); // expected-warning{{UNKNOWN}}
503   return 0;
504 }
505 
506 // Test size with symbolic size argument.
f26(int i)507 int f26(int i) {
508   struct aa a26 = {{1, 2, 3, 4}, 0};
509   a26.s2 = strdup("hello");
510   char input[] = {'a', 'b', 'c', 'd'};
511   memcpy(a26.s1, input, i); // i assumed in bound
512   clang_analyzer_eval(a26.s1[0] == 1); // expected-warning{{UNKNOWN}}
513   clang_analyzer_eval(a26.s1[1] == 1); // expected-warning{{UNKNOWN}}
514   clang_analyzer_eval(a26.s1[2] == 1); // expected-warning{{UNKNOWN}}
515   clang_analyzer_eval(a26.s1[3] == 1); // expected-warning{{UNKNOWN}}\
516   expected-warning{{Potential leak of memory pointed to by 'a26.s2'}}
517   return 0;
518 }
519 
520 // Test sizeof as a size argument.
f261()521 int f261() {
522   struct aa a261 = {{1, 2, 3, 4}, 0};
523   a261.s2 = strdup("hello");
524   char input[] = {'a', 'b', 'c', 'd'};
525   memcpy(a261.s1, input, sizeof(a261.s1));
526   clang_analyzer_eval(a261.s1[0] == 1); // expected-warning{{UNKNOWN}}
527   clang_analyzer_eval(a261.s1[1] == 1); // expected-warning{{UNKNOWN}}
528   clang_analyzer_eval(a261.s1[2] == 1); // expected-warning{{UNKNOWN}}
529   clang_analyzer_eval(a261.s1[3] == 1); // expected-warning{{UNKNOWN}}\
530   expected-warning{{Potential leak of memory pointed to by 'a261.s2'}}
531   return 0;
532 }
533 
534 // Test negative size argument.
f262()535 int f262() {
536   struct aa a262 = {{1, 2, 3, 4}, 0};
537   a262.s2 = strdup("hello");
538   char input[] = {'a', 'b', 'c', 'd'};
539   memcpy(a262.s1, input, -1); // expected-warning{{'memcpy' will always overflow; destination buffer has size 16, but size argument is 18446744073709551615}}
540   clang_analyzer_eval(a262.s1[0] == 1); // expected-warning{{UNKNOWN}}\
541   expected-warning{{Potential leak of memory pointed to by 'a262.s2'}}
542   clang_analyzer_eval(a262.s1[1] == 1); // expected-warning{{UNKNOWN}}
543   clang_analyzer_eval(a262.s1[2] == 1); // expected-warning{{UNKNOWN}}
544   clang_analyzer_eval(a262.s1[3] == 1); // expected-warning{{UNKNOWN}}
545   return 0;
546 }
547 
548 // Test size argument being an unknown value.
549 struct xx {
550   char s1[4];
551   char * s2;
552 };
553 
f263(int n,char * len)554 int f263(int n, char * len) {
555   struct xx x263 = {0};
556   x263.s2 = strdup("hello");
557   char input[] = {'a', 'b', 'c', 'd'};
558   memcpy(x263.s1, input, *(len + n));
559   clang_analyzer_eval(x263.s1[0] == 0); // expected-warning{{UNKNOWN}}
560   clang_analyzer_eval(x263.s1[1] == 0); // expected-warning{{UNKNOWN}}
561   clang_analyzer_eval(x263.s1[2] == 0); // expected-warning{{UNKNOWN}}
562   clang_analyzer_eval(x263.s1[3] == 0); // expected-warning{{UNKNOWN}}
563   clang_analyzer_eval(x263.s2 == 0); // expected-warning{{UNKNOWN}}
564   return 0; // expected-warning{{Potential leak of memory pointed to by 'x263.s2'}}
565 }
566 
567 
568 // Test casting regions with symbolic offseted sub regions.
f27(int i)569 int f27(int i) {
570   struct mm m27 = {{1, 2, 3, 4}, 0};
571   m27.s4 = strdup("hello");
572   m27.s3[i] = 5;
573   char input[] = {'a', 'b', 'c', 'd'};
574   memcpy(((struct ll*)(&m27))->s1, input, 4);
575   clang_analyzer_eval(m27.s3[0] == 1); // expected-warning{{UNKNOWN}}
576   clang_analyzer_eval(m27.s3[1] == 1); // expected-warning{{UNKNOWN}}
577   clang_analyzer_eval(m27.s3[2] == 1); // expected-warning{{UNKNOWN}}
578   clang_analyzer_eval(m27.s3[3] == 1); // expected-warning{{UNKNOWN}}
579   clang_analyzer_eval(m27.s3[i] == 1); // expected-warning{{UNKNOWN}}\
580   expected-warning{{Potential leak of memory pointed to by 'm27.s4'}}
581   return 0;
582 }
583 
f28(int i,int j,int k,int l)584 int f28(int i, int j, int k, int l) {
585   struct mm m28[2];
586   m28[i].s4 = strdup("hello");
587   m28[j].s3[k] = 1;
588   struct ll * l28 = (struct ll*)(&m28[1]);
589   l28->s1[l] = 2;
590   char input[] = {'a', 'b', 'c', 'd'}; // expected-warning{{Potential leak of memory pointed to by field 's4'}}
591   memcpy(l28->s1, input, 4);
592   clang_analyzer_eval(m28[0].s3[0] == 1); // expected-warning{{UNKNOWN}}
593   clang_analyzer_eval(m28[0].s3[1] == 1); // expected-warning{{UNKNOWN}}
594   clang_analyzer_eval(m28[0].s3[2] == 1); // expected-warning{{UNKNOWN}}
595   clang_analyzer_eval(m28[0].s3[3] == 1); // expected-warning{{UNKNOWN}}
596   clang_analyzer_eval(m28[1].s3[0] == 1); // expected-warning{{UNKNOWN}}
597   clang_analyzer_eval(m28[1].s3[1] == 1); // expected-warning{{UNKNOWN}}
598   clang_analyzer_eval(m28[1].s3[2] == 1); // expected-warning{{UNKNOWN}}
599   clang_analyzer_eval(m28[1].s3[3] == 1); // expected-warning{{UNKNOWN}}
600   clang_analyzer_eval(m28[i].s3[0] == 1); // expected-warning{{UNKNOWN}}
601   clang_analyzer_eval(m28[i].s3[1] == 1); // expected-warning{{UNKNOWN}}
602   clang_analyzer_eval(m28[i].s3[2] == 1); // expected-warning{{UNKNOWN}}
603   clang_analyzer_eval(m28[i].s3[3] == 1); // expected-warning{{UNKNOWN}}
604   clang_analyzer_eval(m28[j].s3[k] == 1); // expected-warning{{UNKNOWN}}
605   clang_analyzer_eval(l28->s1[l] == 2); // expected-warning{{UNKNOWN}}
606   return 0;
607 }
608 
f29(int i,int j,int k,int l,int m)609 int f29(int i, int j, int k, int l, int m) {
610   struct mm m29[2];
611   m29[i].s4 = strdup("hello");
612   m29[j].s3[k] = 1;
613   struct ll * l29 = (struct ll*)(&m29[l]);
614   l29->s1[m] = 2;
615   char input[] = {'a', 'b', 'c', 'd'};
616   memcpy(l29->s1, input, 4);
617   clang_analyzer_eval(m29[0].s3[0] == 1); // expected-warning{{UNKNOWN}}
618   clang_analyzer_eval(m29[0].s3[1] == 1); // expected-warning{{UNKNOWN}}
619   clang_analyzer_eval(m29[0].s3[2] == 1); // expected-warning{{UNKNOWN}}
620   clang_analyzer_eval(m29[0].s3[3] == 1); // expected-warning{{UNKNOWN}}
621   clang_analyzer_eval(m29[1].s3[0] == 1); // expected-warning{{UNKNOWN}}
622   clang_analyzer_eval(m29[1].s3[1] == 1); // expected-warning{{UNKNOWN}}
623   clang_analyzer_eval(m29[1].s3[2] == 1); // expected-warning{{UNKNOWN}}
624   clang_analyzer_eval(m29[1].s3[3] == 1); // expected-warning{{UNKNOWN}}
625   clang_analyzer_eval(m29[i].s3[0] == 1); // expected-warning{{UNKNOWN}}
626   clang_analyzer_eval(m29[i].s3[1] == 1); // expected-warning{{UNKNOWN}}
627   clang_analyzer_eval(m29[i].s3[2] == 1); // expected-warning{{UNKNOWN}}
628   clang_analyzer_eval(m29[i].s3[3] == 1); // expected-warning{{UNKNOWN}}
629   clang_analyzer_eval(m29[j].s3[k] == 1); // expected-warning{{TRUE}}
630   clang_analyzer_eval(l29->s1[m] == 2); // expected-warning{{UNKNOWN}}
631   // FIXME: Should warn that m29[i].s4 leaks. But not on the previous line,
632   // because l29 and m29 alias.
633   return 0;
634 }
635 
636 // Test unions' fields.
637 union uu {
638   char x;
639   char s1[4];
640 };
641 
f30()642 int f30() {
643   union uu u30 = { .s1 = {1, 2, 3, 4}};
644   char input[] = {1, 2, 3, 4};
645   memcpy(u30.s1, input, 4);
646   clang_analyzer_eval(u30.s1[0] == 1); // expected-warning{{UNKNOWN}}
647   clang_analyzer_eval(u30.s1[1] == 1); // expected-warning{{UNKNOWN}}
648   clang_analyzer_eval(u30.s1[2] == 1); // expected-warning{{UNKNOWN}}
649   clang_analyzer_eval(u30.s1[3] == 1); // expected-warning{{UNKNOWN}}
650   clang_analyzer_eval(u30.x == 1); // expected-warning{{UNKNOWN}}
651   return 0;
652 }
653 
654 struct kk {
655   union uu u;
656   char * s2;
657 };
658 
f31()659 int f31() {
660   struct kk k31;
661   k31.s2 = strdup("hello");
662   k31.u.x = 1;
663   char input[] = {'a', 'b', 'c', 'd'};
664   memcpy(k31.u.s1, input, 4);
665   clang_analyzer_eval(k31.u.s1[0] == 1); // expected-warning{{UNKNOWN}}\
666   expected-warning{{Potential leak of memory pointed to by 'k31.s2'}}
667   clang_analyzer_eval(k31.u.s1[1] == 1); // expected-warning{{UNKNOWN}}
668   clang_analyzer_eval(k31.u.s1[2] == 1); // expected-warning{{UNKNOWN}}
669   clang_analyzer_eval(k31.u.s1[3] == 1); // expected-warning{{UNKNOWN}}
670   clang_analyzer_eval(k31.u.x == 1); // expected-warning{{UNKNOWN}}
671   // FIXME: memory leak warning for k31.s2 should be emitted here.
672   return 0;
673 }
674 
675 union vv {
676   int x;
677   char * s2;
678 };
679 
f32()680 int f32() {
681   union vv v32;
682   v32.s2 = strdup("hello");
683   char input[] = {'a', 'b', 'c', 'd'};
684   memcpy(v32.s2, input, 4);
685   clang_analyzer_eval(v32.s2[0] == 1); // expected-warning{{UNKNOWN}}
686   clang_analyzer_eval(v32.s2[1] == 1); // expected-warning{{UNKNOWN}}
687   clang_analyzer_eval(v32.s2[2] == 1); // expected-warning{{UNKNOWN}}
688   clang_analyzer_eval(v32.s2[3] == 1); // expected-warning{{UNKNOWN}}\
689   expected-warning{{Potential leak of memory pointed to by 'v32.s2'}}
690   return 0;
691 }
692 
693 struct nn {
694   int s1;
695   int i;
696   int j;
697   int k;
698   char * s2;
699 };
700 
701 // Test bad types to dest buffer.
f33()702 int f33() {
703   struct nn n33 = {1, 2, 3, 4, 0};
704   n33.s2 = strdup("hello");
705   char input[] = {'a', 'b', 'c', 'd'};
706   memcpy(n33.s1, input, 4); // expected-warning{{incompatible integer to pointer conversion passing 'int' to parameter of type 'void *'}}
707   clang_analyzer_eval(n33.i == 2); // expected-warning{{TRUE}}
708   clang_analyzer_eval(n33.j == 3); // expected-warning{{TRUE}}
709   clang_analyzer_eval(n33.k == 4); // expected-warning{{TRUE}}
710   clang_analyzer_eval(((char*)(n33.s1))[0] == 1); // expected-warning{{UNKNOWN}}\
711   expected-warning{{cast to 'char *' from smaller integer type 'int'}}
712   clang_analyzer_eval(((char*)(n33.s1))[1] == 1); // expected-warning{{UNKNOWN}}\
713   expected-warning{{cast to 'char *' from smaller integer type 'int'}}
714   clang_analyzer_eval(((char*)(n33.s1))[2] == 1); // expected-warning{{UNKNOWN}}\
715   expected-warning{{cast to 'char *' from smaller integer type 'int'}}
716   clang_analyzer_eval(((char*)(n33.s1))[3] == 1); // expected-warning{{UNKNOWN}}\
717   expected-warning{{cast to 'char *' from smaller integer type 'int'}}
718   clang_analyzer_eval(n33.s2 == 0); //expected-warning{{UNKNOWN}}
719   return 0; // expected-warning{{Potential leak of memory pointed to by 'n33.s2'}}
720 }
721 
722 // Test destination buffer being an unknown value.
723 struct ww {
724   int s1[4];
725   char s2;
726 };
727 
f34(struct ww * w34,int n)728 int f34(struct ww * w34, int n) {
729   w34->s2 = 3;
730   char input[] = {'a', 'b', 'c', 'd'};
731   memcpy(w34->s1 + n, input , 4);
732   clang_analyzer_eval(w34->s1[0] == 0); // expected-warning{{UNKNOWN}}
733   clang_analyzer_eval(w34->s1[1] == 0); // expected-warning{{UNKNOWN}}
734   clang_analyzer_eval(w34->s1[2] == 0); // expected-warning{{UNKNOWN}}
735   clang_analyzer_eval(w34->s1[3] == 0); // expected-warning{{UNKNOWN}}
736   clang_analyzer_eval(w34->s1[n] == 0); // expected-warning{{UNKNOWN}}
737   clang_analyzer_eval(w34->s2 == 3); // expected-warning{{TRUE}}
738   return 0;
739 }
740 
741 // Test dest buffer as an element region with a symbolic index and size parameter as a symbolic value.
742 struct yy {
743   char s1[4];
744   char * s2;
745 };
746 
f35(int i,int n)747 int f35(int i, int n) {
748   struct yy y35 = {{1, 2, 3, 4}, 0};
749   y35.s2 = strdup("hello");
750   char input[] = {'a', 'b', 'c', 'd'};
751   memcpy(&(y35.s1[i]), input, n);
752   clang_analyzer_eval(y35.s1[0] == 0); // expected-warning{{UNKNOWN}}
753   clang_analyzer_eval(y35.s1[1] == 0); // expected-warning{{UNKNOWN}}
754   clang_analyzer_eval(y35.s1[2] == 0); // expected-warning{{UNKNOWN}}
755   clang_analyzer_eval(y35.s1[3] == 0); // expected-warning{{UNKNOWN}}
756   clang_analyzer_eval(y35.s1[i] == 0); // expected-warning{{UNKNOWN}}
757   clang_analyzer_eval(y35.s2 == 0); // expected-warning{{UNKNOWN}}
758   return 0; // expected-warning{{Potential leak of memory pointed to by 'y35.s2'}}
759 }
760 
761 // Test regions with negative offsets.
762 struct zz {
763   char s1[4];
764   int s2;
765 };
766 
f36(struct zz * z36)767 int f36(struct zz * z36) {
768 
769   char input[] = {'a', 'b', 'c', 'd'};
770   z36->s1[0] = 0;
771   z36->s1[1] = 1;
772   z36->s1[2] = 2;
773   z36->s1[3] = 3;
774   z36->s2 = 10;
775 
776   z36 = z36 - 1; // Decrement by 8 bytes (struct zz is 8 bytes).
777 
778   z36->s1[0] = 4;
779   z36->s1[1] = 5;
780   z36->s1[2] = 6;
781   z36->s1[3] = 7;
782   z36->s2 = 11;
783 
784   memcpy(z36->s1, input, 4);
785 
786   clang_analyzer_eval(z36->s1[0] == 1); // expected-warning{{UNKNOWN}}
787   clang_analyzer_eval(z36->s1[1] == 1); // expected-warning{{UNKNOWN}}
788   clang_analyzer_eval(z36->s1[2] == 1); // expected-warning{{UNKNOWN}}
789   clang_analyzer_eval(z36->s1[3] == 1); // expected-warning{{UNKNOWN}}
790   clang_analyzer_eval(z36->s2 == 11); // expected-warning{{TRUE}}
791 
792   z36 = z36 + 1; // Increment back.
793 
794   clang_analyzer_eval(z36->s1[0] == 0); // expected-warning{{TRUE}}
795   clang_analyzer_eval(z36->s1[1] == 1); // expected-warning{{TRUE}}
796   clang_analyzer_eval(z36->s1[2] == 2); // expected-warning{{TRUE}}
797   clang_analyzer_eval(z36->s1[3] == 3); // expected-warning{{TRUE}}
798   clang_analyzer_eval(z36->s2 == 10); // expected-warning{{TRUE}}
799 
800   return 0;
801 }
802 
f37(struct zz * z37)803 int f37(struct zz * z37) {
804 
805   char input[] = {'a', 'b', 'c', 'd'};
806   z37->s1[0] = 0;
807   z37->s1[1] = 1;
808   z37->s1[2] = 2;
809   z37->s1[3] = 3;
810   z37->s2 = 10;
811 
812   z37 = (struct zz *)((char*)(z37) - 4); // Decrement by 4 bytes (struct zz is 8 bytes).
813 
814   z37->s1[0] = 4;
815   z37->s1[1] = 5;
816   z37->s1[2] = 6;
817   z37->s1[3] = 7;
818   z37->s2 = 11;
819 
820   memcpy(z37->s1, input, 4);
821 
822   clang_analyzer_eval(z37->s1[0] == 1); // expected-warning{{UNKNOWN}}
823   clang_analyzer_eval(z37->s1[1] == 1); // expected-warning{{UNKNOWN}}
824   clang_analyzer_eval(z37->s1[2] == 1); // expected-warning{{UNKNOWN}}
825   clang_analyzer_eval(z37->s1[3] == 1); // expected-warning{{UNKNOWN}}
826   clang_analyzer_eval(z37->s2 == 11); // expected-warning{{TRUE}}
827 
828   z37 = (struct zz *)((char*)(z37) + 4); // Increment back.
829 
830   clang_analyzer_eval(z37->s1[0] == 11); // expected-warning{{TRUE}}
831   clang_analyzer_eval(z37->s1[1] == 1); // expected-warning{{UNKNOWN}}
832   clang_analyzer_eval(z37->s1[2] == 1); // expected-warning{{UNKNOWN}}
833   clang_analyzer_eval(z37->s1[3] == 1); // expected-warning{{UNKNOWN}}
834   clang_analyzer_eval(z37->s2 == 10); // expected-warning{{TRUE}}
835 
836   return 0;
837 }
838 
f38(struct zz * z38)839 int f38(struct zz * z38) {
840 
841   char input[] = {'a', 'b', 'c', 'd'};
842   z38->s1[0] = 0;
843   z38->s1[1] = 1;
844   z38->s1[2] = 2;
845   z38->s1[3] = 3;
846   z38->s2 = 10;
847 
848   z38 = (struct zz *)((char*)(z38) - 2); // Decrement by 2 bytes (struct zz is 8 bytes).
849 
850   z38->s1[0] = 4;
851   z38->s1[1] = 5;
852   z38->s1[2] = 6;
853   z38->s1[3] = 7;
854   z38->s2 = 11;
855 
856   memcpy(z38->s1, input, 4);
857 
858   clang_analyzer_eval(z38->s1[0] == 1); // expected-warning{{UNKNOWN}}
859   clang_analyzer_eval(z38->s1[1] == 1); // expected-warning{{UNKNOWN}}
860   clang_analyzer_eval(z38->s1[2] == 1); // expected-warning{{UNKNOWN}}
861   clang_analyzer_eval(z38->s1[3] == 1); // expected-warning{{UNKNOWN}}
862   clang_analyzer_eval(z38->s2 == 11); // expected-warning{{TRUE}}
863 
864   z38 = (struct zz *)((char*)(z38) + 2); // Increment back.
865 
866   clang_analyzer_eval(z38->s1[0] == 1); // expected-warning{{UNKNOWN}}
867   clang_analyzer_eval(z38->s1[1] == 1); // expected-warning{{UNKNOWN}}
868   clang_analyzer_eval(z38->s1[2] == 11); // expected-warning{{TRUE}}
869   clang_analyzer_eval(z38->s1[3] == 1); // expected-warning{{UNKNOWN}}
870   clang_analyzer_eval(z38->s2 == 10); // expected-warning{{UNKNOWN}}
871 
872   return 0;
873 }
874 
875 // Test negative offsets with a different structure layout.
876 struct z0 {
877   int s2;
878   char s1[4];
879 };
880 
f39(struct z0 * d39)881 int f39(struct z0 * d39) {
882 
883   char input[] = {'a', 'b', 'c', 'd'};
884   d39->s1[0] = 0;
885   d39->s1[1] = 1;
886   d39->s1[2] = 2;
887   d39->s1[3] = 3;
888   d39->s2 = 10;
889 
890   d39 = (struct z0 *)((char*)(d39) - 2); // Decrement by 2 bytes (struct z0 is 8 bytes).
891 
892   d39->s1[0] = 4;
893   d39->s1[1] = 5;
894   d39->s1[2] = 6;
895   d39->s1[3] = 7;
896   d39->s2 = 11;
897 
898   memcpy(d39->s1, input, 4);
899 
900   clang_analyzer_eval(d39->s1[0] == 1); // expected-warning{{UNKNOWN}}
901   clang_analyzer_eval(d39->s1[1] == 1); // expected-warning{{UNKNOWN}}
902   clang_analyzer_eval(d39->s1[2] == 1); // expected-warning{{UNKNOWN}}
903   clang_analyzer_eval(d39->s1[3] == 1); // expected-warning{{UNKNOWN}}
904   clang_analyzer_eval(d39->s2 == 11); // expected-warning{{TRUE}}
905 
906   d39 = (struct z0 *)((char*)(d39) + 2); // Increment back.
907 
908   clang_analyzer_eval(d39->s1[0] == 1); // expected-warning{{UNKNOWN}}
909   clang_analyzer_eval(d39->s1[1] == 1); // expected-warning{{UNKNOWN}}
910   clang_analyzer_eval(d39->s1[2] == 2); // expected-warning{{TRUE}}
911   clang_analyzer_eval(d39->s1[3] == 3); // expected-warning{{TRUE}}
912   // FIXME: d39->s2 should evaluate to at least UNKNOWN or FALSE,
913   // 'collectSubRegionBindings(...)' in RegionStore.cpp will need to
914   // handle a regions' upper boundary overflowing.
915   clang_analyzer_eval(d39->s2 == 10); // expected-warning{{TRUE}}
916 
917   return 0;
918 }
919 
920