1 // RUN: %clang_cc1 -analyze -analyzer-checker=core -analyzer-config suppress-null-return-paths=false -verify %s
2 // RUN: %clang_cc1 -analyze -analyzer-checker=core -verify -DSUPPRESSED=1 %s
3 // RUN: %clang_cc1 -analyze -analyzer-checker=core -analyzer-config avoid-suppressing-null-argument-paths=true -DSUPPRESSED=1 -DNULL_ARGS=1 -verify %s
4 
5 int opaquePropertyCheck(void *object);
6 int coin();
7 
8 int *getNull() {
9   return 0;
10 }
11 
12 int* getPtr();
13 
14 int *dynCastToInt(void *ptr) {
15   if (opaquePropertyCheck(ptr))
16     return (int *)ptr;
17   return 0;
18 }
19 
20 int *dynCastOrNull(void *ptr) {
21   if (!ptr)
22     return 0;
23   if (opaquePropertyCheck(ptr))
24     return (int *)ptr;
25   return 0;
26 }
27 
28 
29 void testDynCast(void *p) {
30   int *casted = dynCastToInt(p);
31   *casted = 1;
32 #ifndef SUPPRESSED
33   // expected-warning@-2 {{Dereference of null pointer}}
34 #endif
35 }
36 
37 void testDynCastOrNull(void *p) {
38   int *casted = dynCastOrNull(p);
39   *casted = 1;
40 #ifndef SUPPRESSED
41   // expected-warning@-2 {{Dereference of null pointer}}
42 #endif
43 }
44 
45 
46 void testBranch(void *p) {
47   int *casted;
48 
49   // Although the report will be suppressed on one branch, it should still be
50   // valid on the other.
51   if (coin()) {
52     casted = dynCastToInt(p);
53   } else {
54     if (p)
55       return;
56     casted = (int *)p;
57   }
58 
59   *casted = 1; // expected-warning {{Dereference of null pointer}}
60 }
61 
62 void testBranchReversed(void *p) {
63   int *casted;
64 
65   // Although the report will be suppressed on one branch, it should still be
66   // valid on the other.
67   if (coin()) {
68     if (p)
69       return;
70     casted = (int *)p;
71   } else {
72     casted = dynCastToInt(p);
73   }
74 
75   *casted = 1; // expected-warning {{Dereference of null pointer}}
76 }
77 
78 void testMultipleStore(void *p) {
79   int *casted = 0;
80   casted = dynCastToInt(p);
81   *casted = 1;
82 #ifndef SUPPRESSED
83   // expected-warning@-2 {{Dereference of null pointer}}
84 #endif
85 }
86 
87 // Test that div by zero does not get suppressed. This is a policy choice.
88 int retZero() {
89   return 0;
90 }
91 int triggerDivZero () {
92   int y = retZero();
93   return 5/y; // expected-warning {{Division by zero}}
94 }
95 
96 // --------------------------
97 // "Suppression suppression"
98 // --------------------------
99 
100 void testDynCastOrNullOfNull() {
101   // Don't suppress when one of the arguments is NULL.
102   int *casted = dynCastOrNull(0);
103   *casted = 1;
104 #if !SUPPRESSED || NULL_ARGS
105   // expected-warning@-2 {{Dereference of null pointer}}
106 #endif
107 }
108 
109 void testDynCastOfNull() {
110   // Don't suppress when one of the arguments is NULL.
111   int *casted = dynCastToInt(0);
112   *casted = 1;
113 #if !SUPPRESSED || NULL_ARGS
114   // expected-warning@-2 {{Dereference of null pointer}}
115 #endif
116 }
117 
118 int *lookUpInt(int unused) {
119   if (coin())
120     return 0;
121   static int x;
122   return &x;
123 }
124 
125 void testZeroIsNotNull() {
126   // /Do/ suppress when the argument is 0 (an integer).
127   int *casted = lookUpInt(0);
128   *casted = 1;
129 #ifndef SUPPRESSED
130   // expected-warning@-2 {{Dereference of null pointer}}
131 #endif
132 }
133 
134 void testTrackNull() {
135   // /Do/ suppress if the null argument came from another call returning null.
136   int *casted = dynCastOrNull(getNull());
137   *casted = 1;
138 #ifndef SUPPRESSED
139   // expected-warning@-2 {{Dereference of null pointer}}
140 #endif
141 }
142 
143 void testTrackNullVariable() {
144   // /Do/ suppress if the null argument came from another call returning null.
145   int *ptr;
146   ptr = getNull();
147   int *casted = dynCastOrNull(ptr);
148   *casted = 1;
149 #ifndef SUPPRESSED
150   // expected-warning@-2 {{Dereference of null pointer}}
151 #endif
152 }
153 
154 void inlinedIsDifferent(int inlined) {
155   int i;
156 
157   // We were erroneously picking up the inner stack frame's initialization,
158   // even though the error occurs in the outer stack frame!
159   int *p = inlined ? &i : getNull();
160 
161   if (!inlined)
162     inlinedIsDifferent(1);
163 
164   *p = 1;
165 #ifndef SUPPRESSED
166   // expected-warning@-2 {{Dereference of null pointer}}
167 #endif
168 }
169 
170 void testInlinedIsDifferent() {
171   // <rdar://problem/13787723>
172   inlinedIsDifferent(0);
173 }
174 
175 
176 // ---------------------------------------
177 // FALSE NEGATIVES (over-suppression)
178 // ---------------------------------------
179 
180 void testNoArguments() {
181   // In this case the function has no branches, and MUST return null.
182   int *casted = getNull();
183   *casted = 1;
184 #ifndef SUPPRESSED
185   // expected-warning@-2 {{Dereference of null pointer}}
186 #endif
187 }
188 
189 int *getNullIfNonNull(void *input) {
190   if (input)
191     return 0;
192   static int x;
193   return &x;
194 }
195 
196 void testKnownPath(void *input) {
197   if (!input)
198     return;
199 
200   // In this case we have a known value for the argument, and thus the path
201   // through the function doesn't ever split.
202   int *casted = getNullIfNonNull(input);
203   *casted = 1;
204 #ifndef SUPPRESSED
205   // expected-warning@-2 {{Dereference of null pointer}}
206 #endif
207 }
208 
209 int *alwaysReturnNull(void *input) {
210   if (opaquePropertyCheck(input))
211     return 0;
212   return 0;
213 }
214 
215 void testAlwaysReturnNull(void *input) {
216   // In this case all paths out of the function return 0, but they are all
217   // dominated by a branch whose condition we don't know!
218   int *casted = alwaysReturnNull(input);
219   *casted = 1;
220 #ifndef SUPPRESSED
221   // expected-warning@-2 {{Dereference of null pointer}}
222 #endif
223 }
224 
225 int derefArg(int *p) {
226 	return *p;
227 #ifndef SUPPRESSED
228   // expected-warning@-2 {{Dereference of null pointer}}
229 #endif
230 }
231 void ternaryArg(char cond) {
232 	static int x;
233 	derefArg(cond ? &x : getNull());
234 }
235 
236 int derefArgCast(char *p) {
237 	return *p;
238 #ifndef SUPPRESSED
239   // expected-warning@-2 {{Dereference of null pointer}}
240 #endif
241 }
242 void ternaryArgCast(char cond) {
243 	static int x;
244 	derefArgCast((char*)((unsigned)cond ? &x : getNull()));
245 }
246 
247 int derefAssignment(int *p) {
248 	return *p;
249 #ifndef SUPPRESSED
250   // expected-warning@-2 {{Dereference of null pointer}}
251 #endif
252 }
253 
254 void ternaryAssignment(char cond) {
255   static int x;
256   int *p = cond ? getNull() : getPtr();
257   derefAssignment(p);
258 }
259 
260 int *retNull(char cond) {
261   static int x;
262   return cond ? &x : getNull();
263 }
264 int ternaryRetNull(char cond) {
265   int *p = retNull(cond);
266   return *p;
267 #ifndef SUPPRESSED
268   // expected-warning@-2 {{Dereference of null pointer}}
269 #endif
270 }
271 
272 // Test suppression of nested conditional operators.
273 int testConditionalOperatorSuppress(int x) {
274   return *(x ? getNull() : getPtr());
275 #ifndef SUPPRESSED
276   // expected-warning@-2 {{Dereference of null pointer}}
277 #endif
278 }
279 int testNestedConditionalOperatorSuppress(int x) {
280   return *(x ? (x ? getNull() : getPtr()) : getPtr());
281 #ifndef SUPPRESSED
282   // expected-warning@-2 {{Dereference of null pointer}}
283 #endif
284 }
285 int testConditionalOperator(int x) {
286   return *(x ? 0 : getPtr()); // expected-warning {{Dereference of null pointer}}
287 }
288 int testNestedConditionalOperator(int x) {
289   return *(x ? (x ? 0 : getPtr()) : getPtr()); // expected-warning {{Dereference of null pointer}}
290 }
291 
292 int testConditionalOperatorSuppressFloatCond(float x) {
293   return *(x ? getNull() : getPtr());
294 #ifndef SUPPRESSED
295   // expected-warning@-2 {{Dereference of null pointer}}
296 #endif
297 }
298 
299