a7d7db71db
This commit finishes the reorganization of the tests for the checker
`security.ArrayBound`.
Previously these tests were all named `out-of-bounds-*` which was only
weakly connected to the checker name; this commit moves them to a
directory named after the checker (`ArrayBound`). I decided to use a
directory instead of the more common filename prefix ("poor man's
directory") system because it seems to be a more natural use of the
filesystem and there are already a few precedents for it.
I also added (or edited) comments at the beginning of each test file to
describe their purpose; and I added a single new testcase to highlight
that the assumption note tags can be added to reports by any checker.
(Previously all tests in the file triggered out-of-bounds reports to
reveal the note tags; but that was just for convenience.)
164 lines
4.4 KiB
C
164 lines
4.4 KiB
C
// RUN: %clang_analyze_cc1 -analyzer-checker=core,unix.Malloc,security.ArrayBound,debug.ExprInspection \
|
|
// RUN: -analyzer-config eagerly-assume=false -verify %s
|
|
|
|
// When the checker security.ArrayBound encounters an array subscript operation
|
|
// that _may be_ in bounds, it assumes that indexing _is_ in bound. This test
|
|
// file validates these assumptions.
|
|
|
|
void clang_analyzer_value(int);
|
|
|
|
// Simple case: memory area with a static extent.
|
|
|
|
extern int FiveInts[5];
|
|
|
|
void int_plus_one(int len) {
|
|
(void)FiveInts[len + 1]; // no-warning
|
|
clang_analyzer_value(len); // expected-warning {{{ [-1, 3] }}}
|
|
}
|
|
|
|
void int_neutral(int len) {
|
|
(void)FiveInts[len]; // no-warning
|
|
clang_analyzer_value(len); // expected-warning {{{ [0, 4] }}}
|
|
}
|
|
|
|
void int_minus_one(int len) {
|
|
(void)FiveInts[len - 1]; // no-warning
|
|
clang_analyzer_value(len); // expected-warning {{{ [1, 5] }}}
|
|
}
|
|
|
|
void unsigned_plus_one(unsigned len) {
|
|
(void)FiveInts[len + 1]; // no-warning
|
|
clang_analyzer_value(len); // expected-warning {{{ [0, 3] }}}
|
|
}
|
|
|
|
void unsigned_neutral(unsigned len) {
|
|
(void)FiveInts[len]; // no-warning
|
|
clang_analyzer_value(len); // expected-warning {{{ [0, 4] }}}
|
|
}
|
|
|
|
void unsigned_minus_one(unsigned len) {
|
|
(void)FiveInts[len - 1]; // no-warning
|
|
clang_analyzer_value(len); // expected-warning {{{ [1, 5] }}}
|
|
}
|
|
|
|
void ll_plus_one(long long len) {
|
|
(void)FiveInts[len + 1]; // no-warning
|
|
clang_analyzer_value(len); // expected-warning {{{ [-1, 3] }}}
|
|
}
|
|
|
|
void ll_neutral(long long len) {
|
|
(void)FiveInts[len]; // no-warning
|
|
clang_analyzer_value(len); // expected-warning {{{ [0, 4] }}}
|
|
}
|
|
|
|
void ll_minus_one(long long len) {
|
|
(void)FiveInts[len - 1]; // no-warning
|
|
clang_analyzer_value(len); // expected-warning {{{ [1, 5] }}}
|
|
}
|
|
|
|
void ull_plus_one(unsigned long long len) {
|
|
(void)FiveInts[len + 1]; // no-warning
|
|
clang_analyzer_value(len); // expected-warning {{{ [0, 3] }}}
|
|
}
|
|
|
|
void ull_neutral(unsigned long long len) {
|
|
(void)FiveInts[len]; // no-warning
|
|
clang_analyzer_value(len); // expected-warning {{{ [0, 4] }}}
|
|
}
|
|
|
|
void ull_minus_one(unsigned long long len) {
|
|
(void)FiveInts[len - 1]; // no-warning
|
|
clang_analyzer_value(len); // expected-warning {{{ [1, 5] }}}
|
|
}
|
|
|
|
// Also try the same with a dynamically allocated memory block, because in the
|
|
// past there were issues with the type/signedness of dynamic extent symbols.
|
|
|
|
typedef __typeof(sizeof(int)) size_t;
|
|
void *malloc(size_t);
|
|
void free(void *);
|
|
|
|
void dyn_int_plus_one(int len) {
|
|
char *p = malloc(5);
|
|
p[len + 1] = 1; // no-warning
|
|
clang_analyzer_value(len); // expected-warning {{{ [-1, 3] }}}
|
|
free(p);
|
|
}
|
|
|
|
void dyn_int_neutral(int len) {
|
|
char *p = malloc(5);
|
|
p[len] = 1; // no-warning
|
|
clang_analyzer_value(len); // expected-warning {{{ [0, 4] }}}
|
|
free(p);
|
|
}
|
|
|
|
void dyn_int_minus_one(int len) {
|
|
char *p = malloc(5);
|
|
p[len - 1] = 1; // no-warning
|
|
clang_analyzer_value(len); // expected-warning {{{ [1, 5] }}}
|
|
free(p);
|
|
}
|
|
|
|
void dyn_unsigned_plus_one(unsigned len) {
|
|
char *p = malloc(5);
|
|
p[len + 1] = 1; // no-warning
|
|
clang_analyzer_value(len); // expected-warning {{{ [0, 3] }}}
|
|
free(p);
|
|
}
|
|
|
|
void dyn_unsigned_neutral(unsigned len) {
|
|
char *p = malloc(5);
|
|
p[len] = 1; // no-warning
|
|
clang_analyzer_value(len); // expected-warning {{{ [0, 4] }}}
|
|
free(p);
|
|
}
|
|
|
|
void dyn_unsigned_minus_one(unsigned len) {
|
|
char *p = malloc(5);
|
|
p[len - 1] = 1; // no-warning
|
|
clang_analyzer_value(len); // expected-warning {{{ [1, 5] }}}
|
|
free(p);
|
|
}
|
|
|
|
void dyn_ll_plus_one(long long len) {
|
|
char *p = malloc(5);
|
|
p[len + 1] = 1; // no-warning
|
|
clang_analyzer_value(len); // expected-warning {{{ [-1, 3] }}}
|
|
free(p);
|
|
}
|
|
|
|
void dyn_ll_neutral(long long len) {
|
|
char *p = malloc(5);
|
|
p[len] = 1; // no-warning
|
|
clang_analyzer_value(len); // expected-warning {{{ [0, 4] }}}
|
|
free(p);
|
|
}
|
|
|
|
void dyn_ll_minus_one(long long len) {
|
|
char *p = malloc(5);
|
|
p[len - 1] = 1; // no-warning
|
|
clang_analyzer_value(len); // expected-warning {{{ [1, 5] }}}
|
|
free(p);
|
|
}
|
|
|
|
void dyn_ull_plus_one(unsigned long long len) {
|
|
char *p = malloc(5);
|
|
p[len + 1] = 1; // no-warning
|
|
clang_analyzer_value(len); // expected-warning {{{ [0, 3] }}}
|
|
free(p);
|
|
}
|
|
|
|
void dyn_ull_neutral(unsigned long long len) {
|
|
char *p = malloc(5);
|
|
p[len] = 1; // no-warning
|
|
clang_analyzer_value(len); // expected-warning {{{ [0, 4] }}}
|
|
free(p);
|
|
}
|
|
|
|
void dyn_ull_minus_one(unsigned long long len) {
|
|
char *p = malloc(5);
|
|
p[len - 1] = 1; // no-warning
|
|
clang_analyzer_value(len); // expected-warning {{{ [1, 5] }}}
|
|
free(p);
|
|
}
|