733e71b73b
SymbolReaper was destroying the symbol too early when it was referenced only from an index SVal of a live ElementRegion. In order to test certain aspects of this patch, extend the debug.ExprInspection checker to allow testing SymbolReaper in a direct manner. Differential Revision: http://reviews.llvm.org/D12726 llvm-svn: 255236
28 lines
742 B
C++
28 lines
742 B
C++
// RUN: %clang_cc1 -analyze -analyzer-checker=alpha.security.ReturnPtrRange -verify %s
|
|
|
|
int arr[10];
|
|
int *ptr;
|
|
|
|
int conjure_index();
|
|
|
|
int *test_element_index_lifetime() {
|
|
do {
|
|
int x = conjure_index();
|
|
ptr = arr + x;
|
|
if (x != 20)
|
|
return arr; // no-warning
|
|
} while (0);
|
|
return ptr; // expected-warning{{Returned pointer value points outside the original object (potential buffer overflow)}}
|
|
}
|
|
|
|
int *test_element_index_lifetime_with_local_ptr() {
|
|
int *local_ptr;
|
|
do {
|
|
int x = conjure_index();
|
|
local_ptr = arr + x;
|
|
if (x != 20)
|
|
return arr; // no-warning
|
|
} while (0);
|
|
return local_ptr; // expected-warning{{Returned pointer value points outside the original object (potential buffer overflow)}}
|
|
}
|