casts.c
7.02 KB
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
169
170
171
172
173
174
175
176
177
178
179
180
181
182
183
184
185
186
187
188
189
190
191
192
193
194
195
196
197
198
199
200
201
202
203
204
205
206
207
208
209
210
211
212
213
214
215
216
217
218
219
220
221
222
223
224
225
226
227
228
229
230
231
232
233
234
235
236
237
238
239
240
241
242
243
244
245
246
247
// RUN: %clang_analyze_cc1 -triple x86_64-apple-darwin9 -analyzer-checker=core,alpha.core,debug.ExprInspection -analyzer-store=region -verify -analyzer-config eagerly-assume=false %s
// RUN: %clang_analyze_cc1 -triple i386-apple-darwin9 -analyzer-checker=core,alpha.core,debug.ExprInspection -analyzer-store=region -verify -analyzer-config eagerly-assume=false %s
// RUN: %clang_analyze_cc1 -triple x86_64-apple-darwin9 -analyzer-checker=core,alpha.core,debug.ExprInspection -verify -DEAGERLY_ASSUME=1 -w %s
// RUN: %clang_analyze_cc1 -triple i386-apple-darwin9 -analyzer-checker=core,alpha.core,debug.ExprInspection -verify -DEAGERLY_ASSUME=1 -DBIT32=1 -w %s
extern void clang_analyzer_eval(_Bool);
// Test if the 'storage' region gets properly initialized after it is cast to
// 'struct sockaddr *'.
typedef unsigned char __uint8_t;
typedef unsigned int __uint32_t;
typedef __uint32_t __darwin_socklen_t;
typedef __uint8_t sa_family_t;
typedef __darwin_socklen_t socklen_t;
struct sockaddr { sa_family_t sa_family; };
struct sockaddr_storage {};
void getsockname();
#ifndef EAGERLY_ASSUME
void f(int sock) {
struct sockaddr_storage storage;
struct sockaddr* sockaddr = (struct sockaddr*)&storage; // expected-warning{{Casting data to a larger structure type and accessing a field can lead to memory access errors or data corruption}}
socklen_t addrlen = sizeof(storage);
getsockname(sock, sockaddr, &addrlen);
switch (sockaddr->sa_family) { // no-warning
default:
;
}
}
struct s {
struct s *value;
};
void f1(struct s **pval) {
int *tbool = ((void*)0);
struct s *t = *pval;
pval = &(t->value);
tbool = (int *)pval; // use the cast-to type 'int *' to create element region.
char c = (unsigned char) *tbool; // Should use cast-to type to create symbol.
if (*tbool == -1) // here load the element region with the correct type 'int'
(void)3;
}
void f2(const char *str) {
unsigned char ch, cl, *p;
p = (unsigned char *)str;
ch = *p++; // use cast-to type 'unsigned char' to create element region.
cl = *p++;
if(!cl)
cl = 'a';
}
// Test cast VariableSizeArray to pointer does not crash.
void *memcpy(void *, void const *, unsigned long);
typedef unsigned char Byte;
void doit(char *data, int len) {
if (len) {
Byte buf[len];
memcpy(buf, data, len);
}
}
// PR 6013 and 6035 - Test that a cast of a pointer to long and then to int does not crash SValuator.
void pr6013_6035_test(void *p) {
unsigned int foo;
foo = ((long)(p));
(void) foo;
}
// PR12511 and radar://11215362 - Test that we support SymCastExpr, which represents symbolic int to float cast.
char ttt(int intSeconds) {
double seconds = intSeconds;
if (seconds)
return 0;
return 0;
}
int foo (int* p) {
int y = 0;
if (p == 0) {
if ((*((void**)&p)) == (void*)0) // Test that the cast to void preserves the symbolic region.
return 0;
else
return 5/y; // This code should be unreachable: no-warning.
}
return 0;
}
void castsToBool() {
clang_analyzer_eval(0); // expected-warning{{FALSE}}
clang_analyzer_eval(0U); // expected-warning{{FALSE}}
clang_analyzer_eval((void *)0); // expected-warning{{FALSE}}
clang_analyzer_eval(1); // expected-warning{{TRUE}}
clang_analyzer_eval(1U); // expected-warning{{TRUE}}
clang_analyzer_eval(-1); // expected-warning{{TRUE}}
clang_analyzer_eval(0x100); // expected-warning{{TRUE}}
clang_analyzer_eval(0x100U); // expected-warning{{TRUE}}
clang_analyzer_eval((void *)0x100); // expected-warning{{TRUE}}
extern int symbolicInt;
clang_analyzer_eval(symbolicInt); // expected-warning{{UNKNOWN}}
if (symbolicInt)
clang_analyzer_eval(symbolicInt); // expected-warning{{TRUE}}
extern void *symbolicPointer;
clang_analyzer_eval(symbolicPointer); // expected-warning{{UNKNOWN}}
if (symbolicPointer)
clang_analyzer_eval(symbolicPointer); // expected-warning{{TRUE}}
int localInt;
int* ptr = &localInt;
clang_analyzer_eval(ptr); // expected-warning{{TRUE}}
clang_analyzer_eval(&castsToBool); // expected-warning{{TRUE}}
clang_analyzer_eval("abc"); // expected-warning{{TRUE}}
extern float globalFloat;
clang_analyzer_eval(globalFloat); // expected-warning{{UNKNOWN}}
}
void locAsIntegerCasts(void *p) {
int x = (int) p;
clang_analyzer_eval(++x < 10); // no-crash // expected-warning{{UNKNOWN}}
}
void multiDimensionalArrayPointerCasts() {
static int x[10][10];
int *y1 = &(x[3][5]);
char *z = ((char *) y1) + 2;
int *y2 = (int *)(z - 2);
int *y3 = ((int *)x) + 35; // This is offset for [3][5].
clang_analyzer_eval(y1 == y2); // expected-warning{{TRUE}}
// FIXME: should be FALSE (i.e. equal pointers).
clang_analyzer_eval(y1 - y2); // expected-warning{{UNKNOWN}}
// FIXME: should be TRUE (i.e. same symbol).
clang_analyzer_eval(*y1 == *y2); // expected-warning{{UNKNOWN}}
clang_analyzer_eval(*((char *)y1) == *((char *) y2)); // expected-warning{{TRUE}}
clang_analyzer_eval(y1 == y3); // expected-warning{{TRUE}}
// FIXME: should be FALSE (i.e. equal pointers).
clang_analyzer_eval(y1 - y3); // expected-warning{{UNKNOWN}}
// FIXME: should be TRUE (i.e. same symbol).
clang_analyzer_eval(*y1 == *y3); // expected-warning{{UNKNOWN}}
clang_analyzer_eval(*((char *)y1) == *((char *) y3)); // expected-warning{{TRUE}}
}
void *getVoidPtr();
void testCastVoidPtrToIntPtrThroughIntTypedAssignment() {
int *x;
(*((int *)(&x))) = (int)getVoidPtr();
*x = 1; // no-crash
}
void testCastUIntPtrToIntPtrThroughIntTypedAssignment() {
unsigned u;
int *x;
(*((int *)(&x))) = (int)&u;
*x = 1;
clang_analyzer_eval(u == 1); // expected-warning{{TRUE}}
}
void testCastVoidPtrToIntPtrThroughUIntTypedAssignment() {
int *x;
(*((int *)(&x))) = (int)(unsigned *)getVoidPtr();
*x = 1; // no-crash
}
void testLocNonLocSymbolAssume(int a, int *b) {
if ((int)b < a) {} // no-crash
}
void testLocNonLocSymbolRemainder(int a, int *b) {
int c = ((int)b) % a;
if (a == 1) {
c += 1;
}
}
void testSwitchWithSizeofs() {
switch (sizeof(char) == 1) { // expected-warning{{switch condition has boolean value}}
case sizeof(char):; // no-crash
}
}
#endif
#ifdef EAGERLY_ASSUME
int globalA;
extern int globalFunc();
void no_crash_on_symsym_cast_to_long() {
char c = globalFunc() - 5;
c == 0;
globalA -= c;
globalA == 3;
(long)globalA << 48;
#ifdef BIT32
// expected-warning@-2{{The result of the left shift is undefined due to shifting by '48', which is greater or equal to the width of type 'long'}}
#else
// expected-no-diagnostics
#endif
}
#endif
char no_crash_SymbolCast_of_float_type_aux(int *p) {
*p += 1;
return *p;
}
void no_crash_SymbolCast_of_float_type() {
extern float x;
char (*f)() = no_crash_SymbolCast_of_float_type_aux;
f(&x);
}
double no_crash_reinterpret_double_as_int(double a) {
*(int *)&a = 1;
return a * a;
}
double no_crash_reinterpret_double_as_ptr(double a) {
*(void **)&a = 0;
return a * a;
}
double no_crash_reinterpret_double_as_sym_int(double a, int b) {
*(int *)&a = b;
return a * a;
}
double no_crash_reinterpret_double_as_sym_ptr(double a, void * b) {
*(void **)&a = b;
return a * a;
}