forked from OSchip/llvm-project
118 lines
4.5 KiB
C++
118 lines
4.5 KiB
C++
// RUN: %clang_analyze_cc1 -analyzer-checker=core,alpha.security.ReturnPtrRange -analyzer-output text -verify %s
|
|
|
|
int conjure_index();
|
|
|
|
namespace test_element_index_lifetime {
|
|
|
|
int arr[10]; // expected-note{{Original object declared here}} expected-note{{Original object declared here}}
|
|
int *ptr;
|
|
|
|
int *test_global_ptr() {
|
|
do { // expected-note{{Loop condition is false. Exiting loop}}
|
|
int x = conjure_index();
|
|
ptr = arr + x; // expected-note{{Value assigned to 'ptr'}}
|
|
if (x != 20) // expected-note{{Assuming 'x' is equal to 20}}
|
|
// expected-note@-1{{Taking false branch}}
|
|
return arr; // no-warning
|
|
} while(0);
|
|
return ptr; // expected-warning{{Returned pointer value points outside the original object (potential buffer overflow) [alpha.security.ReturnPtrRange]}}
|
|
// expected-note@-1{{Returned pointer value points outside the original object (potential buffer overflow)}}
|
|
// expected-note@-2{{Original object 'arr' is an array of 10 'int' objects}}
|
|
}
|
|
|
|
int *test_local_ptr() {
|
|
int *local_ptr;
|
|
do { // expected-note{{Loop condition is false. Exiting loop}}
|
|
int x = conjure_index();
|
|
local_ptr = arr + x; // expected-note{{Value assigned to 'local_ptr'}}
|
|
if (x != 20) // expected-note{{Assuming 'x' is equal to 20}}
|
|
// expected-note@-1{{Taking false branch}}
|
|
return arr; // no-warning
|
|
} while(0);
|
|
return local_ptr; // expected-warning{{Returned pointer value points outside the original object (potential buffer overflow) [alpha.security.ReturnPtrRange]}}
|
|
// expected-note@-1{{Returned pointer value points outside the original object (potential buffer overflow)}}
|
|
// expected-note@-2{{Original object 'arr' is an array of 10 'int' objects}}
|
|
}
|
|
|
|
}
|
|
|
|
template <typename T, int N>
|
|
T* end(T (&arr)[N]) {
|
|
return arr + N; // no-warning, because we want to avoid false positives on returning the end() iterator of a container.
|
|
}
|
|
|
|
void get_end_of_array() {
|
|
static int arr[10];
|
|
end(arr);
|
|
}
|
|
|
|
template <int N>
|
|
class Iterable {
|
|
int buffer[N];
|
|
int *start, *finish;
|
|
|
|
public:
|
|
Iterable() : start(buffer), finish(buffer + N) {}
|
|
|
|
int* begin() { return start; }
|
|
int* end() { return finish; }
|
|
};
|
|
|
|
void use_iterable_object() {
|
|
Iterable<20> iter;
|
|
iter.end();
|
|
}
|
|
|
|
template <int N>
|
|
class BadIterable {
|
|
int buffer[N]; // expected-note{{Original object declared here}}
|
|
int *start, *finish;
|
|
|
|
public:
|
|
BadIterable() : start(buffer), finish(buffer + N) {} // expected-note{{Value assigned to 'iter.finish'}}
|
|
|
|
int* begin() { return start; }
|
|
int* end() { return finish + 1; } // expected-warning{{Returned pointer value points outside the original object}}
|
|
// expected-note@-1{{Returned pointer value points outside the original object}}
|
|
// expected-note@-2{{Original object 'buffer' is an array of 20 'int' objects, returned pointer points at index 21}}
|
|
};
|
|
|
|
void use_bad_iterable_object() {
|
|
BadIterable<20> iter; // expected-note{{Calling default constructor for 'BadIterable<20>'}}
|
|
// expected-note@-1{{Returning from default constructor for 'BadIterable<20>'}}
|
|
iter.end(); // expected-note{{Calling 'BadIterable::end'}}
|
|
}
|
|
|
|
int *test_idx_sym(int I) {
|
|
static int arr[10]; // expected-note{{Original object declared here}} expected-note{{'arr' initialized here}}
|
|
|
|
if (I != 11) // expected-note{{Assuming 'I' is equal to 11}}
|
|
// expected-note@-1{{Taking false branch}}
|
|
return arr;
|
|
return arr + I; // expected-warning{{Returned pointer value points outside the original object}}
|
|
// expected-note@-1{{Returned pointer value points outside the original object}}
|
|
// expected-note@-2{{Original object 'arr' is an array of 10 'int' objects, returned pointer points at index 11}}
|
|
}
|
|
|
|
namespace test_array_of_struct {
|
|
|
|
struct Data {
|
|
int A;
|
|
char *B;
|
|
};
|
|
|
|
Data DataArr[10]; // expected-note{{Original object declared here}}
|
|
|
|
Data *test_struct_array() {
|
|
int I = conjure_index();
|
|
if (I != 11) // expected-note{{Assuming 'I' is equal to 11}}
|
|
// expected-note@-1{{Taking false branch}}
|
|
return DataArr;
|
|
return DataArr + I; // expected-warning{{Returned pointer value points outside the original object}}
|
|
// expected-note@-1{{Returned pointer value points outside the original object}}
|
|
// expected-note@-2{{Original object 'DataArr' is an array of 10 'test_array_of_struct::Data' objects, returned pointer points at index 11}}
|
|
}
|
|
|
|
}
|
|
|