llvm-project/clang/test/Analysis/simple-stream-checks.c

92 lines
2.2 KiB
C
Raw Normal View History

// RUN: %clang_analyze_cc1 -analyzer-checker=core,alpha.unix.SimpleStream -verify %s
#include "Inputs/system-header-simulator-for-simple-stream.h"
void checkDoubleFClose(int *Data) {
FILE *F = fopen("myfile.txt", "w");
if (F != 0) {
fputs ("fopen example", F);
if (!Data)
fclose(F);
else
fputc(*Data, F);
fclose(F); // expected-warning {{Closing a previously closed file stream}}
}
}
int checkLeak(int *Data) {
FILE *F = fopen("myfile.txt", "w");
if (F != 0) {
fputs ("fopen example", F);
}
if (Data) // expected-warning {{Opened file is never closed; potential resource leak}}
return *Data;
else
return 0;
}
void checkLeakFollowedByAssert(int *Data) {
FILE *F = fopen("myfile.txt", "w");
if (F != 0) {
fputs ("fopen example", F);
if (!Data)
exit(0);
fclose(F);
}
}
void CloseOnlyOnValidFileHandle() {
FILE *F = fopen("myfile.txt", "w");
if (F)
fclose(F);
int x = 0; // no warning
}
void leakOnEnfOfPath1(int *Data) {
FILE *F = fopen("myfile.txt", "w");
} // expected-warning {{Opened file is never closed; potential resource leak}}
void leakOnEnfOfPath2(int *Data) {
FILE *F = fopen("myfile.txt", "w");
return; // expected-warning {{Opened file is never closed; potential resource leak}}
}
FILE *leakOnEnfOfPath3(int *Data) {
FILE *F = fopen("myfile.txt", "w");
return F;
}
void myfclose(FILE *F);
void SymbolEscapedThroughFunctionCall() {
FILE *F = fopen("myfile.txt", "w");
myfclose(F);
return; // no warning
}
FILE *GlobalF;
void SymbolEscapedThroughAssignmentToGlobal() {
FILE *F = fopen("myfile.txt", "w");
GlobalF = F;
return; // no warning
}
void SymbolDoesNotEscapeThoughStringAPIs(char *Data) {
FILE *F = fopen("myfile.txt", "w");
fputc(*Data, F);
return; // expected-warning {{Opened file is never closed; potential resource leak}}
}
void passConstPointer(const FILE * F);
void testPassConstPointer() {
FILE *F = fopen("myfile.txt", "w");
passConstPointer(F);
return; // expected-warning {{Opened file is never closed; potential resource leak}}
}
void testPassToSystemHeaderFunctionIndirectly() {
FileStruct fs;
fs.p = fopen("myfile.txt", "w");
[analyzer] Indirect invalidation counts as an escape for leak checkers. Consider this example: char *p = malloc(sizeof(char)); systemFunction(&p); free(p); In this case, when we call systemFunction, we know (because it's a system function) that it won't free 'p'. However, we /don't/ know whether or not it will /change/ 'p', so the analyzer is forced to invalidate 'p', wiping out any bindings it contains. But now the malloc'd region looks like a leak, since there are no more bindings pointing to it, and we'll get a spurious leak warning. The fix for this is to notice when something is becoming inaccessible due to invalidation (i.e. an imperfect model, as opposed to being explicitly overwritten) and stop tracking it at that point. Currently, the best way to determine this for a call is the "indirect escape" pointer-escape kind. In practice, all the patch does is take the "system functions don't free memory" special case and limit it to direct parameters, i.e. just the arguments to a call and not other regions accessible to them. This is a conservative change that should only cause us to escape regions more eagerly, which means fewer leak warnings. This isn't perfect for several reasons, the main one being that this example is treated the same as the one above: char **p = malloc(sizeof(char *)); systemFunction(p + 1); // leak Currently, "addresses accessible by offsets of the starting region" and "addresses accessible through bindings of the starting region" are both considered "indirect" regions, hence this uniform treatment. Another issue is our longstanding problem of not distinguishing const and non-const bindings; if in the first example systemFunction's parameter were a char * const *, we should know that the function will not overwrite 'p', and thus we can safely report the leak. <rdar://problem/13758386> llvm-svn: 181607
2013-05-11 01:07:16 +08:00
fakeSystemHeaderCall(&fs); // invalidates fs, making fs.p unreachable
} // no-warning