1// RUN: %clang_cc1 -analyze -analyzer-checker=core,unix.MismatchedDeallocator -fblocks -verify %s 2 3#include "Inputs/system-header-simulator-objc.h" 4#include "Inputs/system-header-simulator-cxx.h" 5 6typedef __typeof__(sizeof(int)) size_t; 7void *malloc(size_t); 8void *realloc(void *ptr, size_t size); 9void *calloc(size_t nmemb, size_t size); 10char *strdup(const char *s); 11void __attribute((ownership_returns(malloc))) *my_malloc(size_t); 12 13void free(void *); 14void __attribute((ownership_takes(malloc, 1))) my_free(void *); 15 16//--------------------------------------------------------------- 17// Test if an allocation function matches deallocation function 18//--------------------------------------------------------------- 19 20//--------------- test malloc family 21void testMalloc1() { 22 int *p = (int *)malloc(sizeof(int)); 23 delete p; // expected-warning{{Memory allocated by malloc() should be deallocated by free(), not 'delete'}} 24} 25 26void testMalloc2() { 27 int *p = (int *)malloc(8); 28 int *q = (int *)realloc(p, 16); 29 delete q; // expected-warning{{Memory allocated by realloc() should be deallocated by free(), not 'delete'}} 30} 31 32void testMalloc3() { 33 int *p = (int *)calloc(1, sizeof(int)); 34 delete p; // expected-warning{{Memory allocated by calloc() should be deallocated by free(), not 'delete'}} 35} 36 37void testMalloc4(const char *s) { 38 char *p = strdup(s); 39 delete p; // expected-warning{{Memory allocated by strdup() should be deallocated by free(), not 'delete'}} 40} 41 42void testMalloc5() { 43 int *p = (int *)my_malloc(sizeof(int)); 44 delete p; // expected-warning{{Memory allocated by my_malloc() should be deallocated by free(), not 'delete'}} 45} 46 47void testMalloc6() { 48 int *p = (int *)malloc(sizeof(int)); 49 operator delete(p); // expected-warning{{Memory allocated by malloc() should be deallocated by free(), not operator delete}} 50} 51 52void testMalloc7() { 53 int *p = (int *)malloc(sizeof(int)); 54 delete[] p; // expected-warning{{Memory allocated by malloc() should be deallocated by free(), not 'delete[]'}} 55} 56 57void testMalloc8() { 58 int *p = (int *)malloc(sizeof(int)); 59 operator delete[](p); // expected-warning{{Memory allocated by malloc() should be deallocated by free(), not operator delete[]}} 60} 61 62//--------------- test new family 63void testNew1() { 64 int *p = new int; 65 free(p); // expected-warning{{Memory allocated by 'new' should be deallocated by 'delete', not free()}} 66} 67 68void testNew2() { 69 int *p = (int *)operator new(0); 70 free(p); // expected-warning{{Memory allocated by operator new should be deallocated by 'delete', not free()}} 71} 72 73void testNew3() { 74 int *p = new int[1]; 75 free(p); // expected-warning{{Memory allocated by 'new[]' should be deallocated by 'delete[]', not free()}} 76} 77 78void testNew4() { 79 int *p = new int; 80 realloc(p, sizeof(long)); // expected-warning{{Memory allocated by 'new' should be deallocated by 'delete', not realloc()}} 81} 82 83void testNew5() { 84 int *p = (int *)operator new(0); 85 realloc(p, sizeof(long)); // expected-warning{{Memory allocated by operator new should be deallocated by 'delete', not realloc()}} 86} 87 88void testNew6() { 89 int *p = new int[1]; 90 realloc(p, sizeof(long)); // expected-warning{{Memory allocated by 'new[]' should be deallocated by 'delete[]', not realloc()}} 91} 92 93void testNew7() { 94 int *p = new int; 95 delete[] p; // expected-warning{{Memory allocated by 'new' should be deallocated by 'delete', not 'delete[]'}} 96} 97 98void testNew8() { 99 int *p = (int *)operator new(0); 100 delete[] p; // expected-warning{{Memory allocated by operator new should be deallocated by 'delete', not 'delete[]'}} 101} 102 103void testNew9() { 104 int *p = new int[1]; 105 delete p; // expected-warning{{Memory allocated by 'new[]' should be deallocated by 'delete[]', not 'delete'}} 106} 107 108void testNew10() { 109 int *p = (int *)operator new[](0); 110 delete p; // expected-warning{{Memory allocated by operator new[] should be deallocated by 'delete[]', not 'delete'}} 111} 112 113void testNew11(NSUInteger dataLength) { 114 int *p = new int; 115 NSData *d = [NSData dataWithBytesNoCopy:p length:sizeof(int) freeWhenDone:1]; // expected-warning{{+dataWithBytesNoCopy:length:freeWhenDone: cannot take ownership of memory allocated by 'new'}} 116} 117 118//------------------------------------------------------- 119// Check for intersection with unix.Malloc bounded with 120// unix.MismatchedDeallocator 121//------------------------------------------------------- 122 123// new/delete oparators are subjects of cplusplus.NewDelete. 124void testNewDeleteNoWarn() { 125 int i; 126 delete &i; // no-warning 127 128 int *p1 = new int; 129 delete ++p1; // no-warning 130 131 int *p2 = new int; 132 delete p2; 133 delete p2; // no-warning 134 135 int *p3 = new int; // no-warning 136} 137 138void testDeleteOpAfterFree() { 139 int *p = (int *)malloc(sizeof(int)); 140 free(p); 141 operator delete(p); // no-warning 142} 143 144void testDeleteAfterFree() { 145 int *p = (int *)malloc(sizeof(int)); 146 free(p); 147 delete p; // no-warning 148} 149 150void testStandardPlacementNewAfterFree() { 151 int *p = (int *)malloc(sizeof(int)); 152 free(p); 153 p = new(p) int; // no-warning 154} 155 156//--------------------------------------------------------------- 157// Check for intersection with cplusplus.NewDelete bounded with 158// unix.MismatchedDeallocator 159//--------------------------------------------------------------- 160 161// malloc()/free() are subjects of unix.Malloc and unix.MallocWithAnnotations 162void testMallocFreeNoWarn() { 163 int i; 164 free(&i); // no-warning 165 166 int *p1 = (int *)malloc(sizeof(int)); 167 free(++p1); // no-warning 168 169 int *p2 = (int *)malloc(sizeof(int)); 170 free(p2); 171 free(p2); // no-warning 172 173 int *p3 = (int *)malloc(sizeof(int)); // no-warning 174} 175 176void testFreeAfterDelete() { 177 int *p = new int; 178 delete p; 179 free(p); // no-warning 180} 181 182void testStandardPlacementNewAfterDelete() { 183 int *p = new int; 184 delete p; 185 p = new(p) int; // no-warning 186} 187 188 189// Smart pointer example 190template <typename T> 191struct SimpleSmartPointer { 192 T *ptr; 193 194 explicit SimpleSmartPointer(T *p = 0) : ptr(p) {} 195 ~SimpleSmartPointer() { 196 delete ptr; 197 // expected-warning@-1 {{Memory allocated by 'new[]' should be deallocated by 'delete[]', not 'delete'}} 198 // expected-warning@-2 {{Memory allocated by malloc() should be deallocated by free(), not 'delete'}} 199 } 200}; 201 202void testSimpleSmartPointerArrayNew() { 203 { 204 SimpleSmartPointer<int> a(new int); 205 } // no-warning 206 207 { 208 SimpleSmartPointer<int> a(new int[4]); 209 } 210} 211 212void testSimpleSmartPointerMalloc() { 213 { 214 SimpleSmartPointer<int> a(new int); 215 } // no-warning 216 217 { 218 SimpleSmartPointer<int> a((int *)malloc(4)); 219 } 220} 221