1 // RUN: %clang_analyze_cc1 -analyzer-store=region -verify %s \
2 // RUN:   -analyzer-checker=core \
3 // RUN:   -analyzer-checker=unix \
4 // RUN:   -analyzer-checker=core.uninitialized \
5 // RUN:   -analyzer-config unix.DynamicMemoryModeling:Optimistic=true
6 
7 typedef __typeof(sizeof(int)) size_t;
8 void *malloc(size_t);
9 void free(void *);
10 
stackBased1()11 char stackBased1 () {
12   char buf[2];
13   buf[0] = 'a';
14   return buf[1]; // expected-warning{{Undefined}}
15 }
16 
stackBased2()17 char stackBased2 () {
18   char buf[2];
19   buf[1] = 'a';
20   return buf[0]; // expected-warning{{Undefined}}
21 }
22 
23 // Exercise the conditional visitor. Radar://10105448
stackBased3(int * x)24 char stackBased3 (int *x) {
25   char buf[2];
26   int *y;
27   buf[0] = 'a';
28   if (!(y = x)) {
29     return buf[1]; // expected-warning{{Undefined}}
30   }
31   return buf[0];
32 }
33 
heapBased1()34 char heapBased1 () {
35   char *buf = malloc(2);
36   buf[0] = 'a';
37   char result = buf[1]; // expected-warning{{undefined}}
38   free(buf);
39   return result;
40 }
41 
heapBased2()42 char heapBased2 () {
43   char *buf = malloc(2);
44   buf[1] = 'a';
45   char result = buf[0]; // expected-warning{{undefined}}
46   free(buf);
47   return result;
48 }
49