1 // RUN: %clang_analyze_cc1 -fblocks -verify %s -analyzer-store=region \
2 // RUN: -analyzer-checker=core \
3 // RUN: -analyzer-checker=unix.Malloc
4 //
5 // RUN: %clang_analyze_cc1 -fblocks -verify %s -analyzer-store=region \
6 // RUN: -analyzer-checker=core \
7 // RUN: -analyzer-checker=unix.Malloc \
8 // RUN: -analyzer-config unix.DynamicMemoryModeling:Optimistic=true
9 typedef __typeof(sizeof(int)) size_t;
10 void free(void *);
11 void *alloca(size_t);
12
t1()13 void t1 () {
14 int a[] = { 1 };
15 free(a);
16 // expected-warning@-1{{Argument to free() is the address of the local variable 'a', which is not memory allocated by malloc()}}
17 // expected-warning@-2{{attempt to call free on non-heap object 'a'}}
18 }
19
t2()20 void t2 () {
21 int a = 1;
22 free(&a);
23 // expected-warning@-1{{Argument to free() is the address of the local variable 'a', which is not memory allocated by malloc()}}
24 // expected-warning@-2{{attempt to call free on non-heap object 'a'}}
25 }
26
t3()27 void t3 () {
28 static int a[] = { 1 };
29 free(a);
30 // expected-warning@-1{{Argument to free() is the address of the static variable 'a', which is not memory allocated by malloc()}}
31 // expected-warning@-2{{attempt to call free on non-heap object 'a'}}
32 }
33
t4(char * x)34 void t4 (char *x) {
35 free(x); // no-warning
36 }
37
t5()38 void t5 () {
39 extern char *ptr();
40 free(ptr()); // no-warning
41 }
42
t6()43 void t6 () {
44 free((void*)1000); // expected-warning {{Argument to free() is a constant address (1000), which is not memory allocated by malloc()}}
45 }
46
t7(char ** x)47 void t7 (char **x) {
48 free(*x); // no-warning
49 }
50
t8(char ** x)51 void t8 (char **x) {
52 // ugh
53 free((*x)+8); // no-warning
54 }
55
t9()56 void t9 () {
57 label:
58 free(&&label); // expected-warning {{Argument to free() is the address of the label 'label', which is not memory allocated by malloc()}}
59 }
60
t10()61 void t10 () {
62 free((void*)&t10); // expected-warning {{Argument to free() is the address of the function 't10', which is not memory allocated by malloc()}}
63 }
64
t11()65 void t11 () {
66 char *p = (char*)alloca(2);
67 free(p); // expected-warning {{Memory allocated by alloca() should not be deallocated}}
68 }
69
t12()70 void t12 () {
71 char *p = (char*)__builtin_alloca(2);
72 free(p); // expected-warning {{Memory allocated by alloca() should not be deallocated}}
73 }
74
t13()75 void t13 () {
76 free(^{return;}); // expected-warning {{Argument to free() is a block, which is not memory allocated by malloc()}}
77 }
78
t14(char a)79 void t14 (char a) {
80 free(&a);
81 // expected-warning@-1{{Argument to free() is the address of the parameter 'a', which is not memory allocated by malloc()}}
82 // expected-warning@-2{{attempt to call free on non-heap object 'a'}}
83 }
84
85 static int someGlobal[2];
t15()86 void t15 () {
87 free(someGlobal);
88 // expected-warning@-1{{Argument to free() is the address of the global variable 'someGlobal', which is not memory allocated by malloc()}}
89 // expected-warning@-2{{attempt to call free on non-heap object 'someGlobal'}}
90 }
91
t16(char ** x,int offset)92 void t16 (char **x, int offset) {
93 // Unknown value
94 free(x[offset]); // no-warning
95 }
96