| 1 | // RUN: %clang_analyze_cc1 -x c -analyzer-checker=core -analyzer-output=text -verify %s |
| 2 | |
| 3 | typedef __typeof(sizeof(int)) size_t; |
| 4 | void *memset(void *__s, int __c, size_t __n); |
| 5 | |
| 6 | int initializer1(int *p, int x) { |
| 7 | if (x) { // expected-note{{Taking false branch}} |
| 8 | *p = 1; |
| 9 | return 0; |
| 10 | } else { |
| 11 | return 1; // expected-note {{Returning without writing to '*p'}} |
| 12 | } |
| 13 | } |
| 14 | |
| 15 | int param_not_initialized_by_func() { |
| 16 | int p; // expected-note {{'p' declared without an initial value}} |
| 17 | int out = initializer1(&p, 0); // expected-note{{Calling 'initializer1'}} |
| 18 | // expected-note@-1{{Returning from 'initializer1'}} |
| 19 | return p; // expected-note{{Undefined or garbage value returned to caller}} |
| 20 | // expected-warning@-1{{Undefined or garbage value returned to caller}} |
| 21 | } |
| 22 | |
| 23 | int param_initialized_properly() { |
| 24 | int p; |
| 25 | int out = initializer1(&p, 1); |
| 26 | return p; //no-warning |
| 27 | } |
| 28 | |
| 29 | static int global; |
| 30 | |
| 31 | int initializer2(int **p, int x) { |
| 32 | if (x) { // expected-note{{Taking false branch}} |
| 33 | *p = &global; |
| 34 | return 0; |
| 35 | } else { |
| 36 | return 1; // expected-note {{Returning without writing to '*p'}} |
| 37 | } |
| 38 | } |
| 39 | |
| 40 | int param_not_written_into_by_func() { |
| 41 | int *p = 0; // expected-note{{'p' initialized to a null pointer value}} |
| 42 | int out = initializer2(&p, 0); // expected-note{{Calling 'initializer2'}} |
| 43 | // expected-note@-1{{Returning from 'initializer2'}} |
| 44 | return *p; // expected-warning{{Dereference of null pointer (loaded from variable 'p')}} |
| 45 | // expected-note@-1{{Dereference of null pointer (loaded from variable 'p')}} |
| 46 | } |
| 47 | |
| 48 | void initializer3(int *p, int param) { |
| 49 | if (param) // expected-note{{Taking false branch}} |
| 50 | *p = 0; |
| 51 | } // expected-note{{Returning without writing to '*p'}} |
| 52 | |
| 53 | int param_written_into_by_void_func() { |
| 54 | int p; // expected-note{{'p' declared without an initial value}} |
| 55 | initializer3(&p, 0); // expected-note{{Calling 'initializer3'}} |
| 56 | // expected-note@-1{{Returning from 'initializer3'}} |
| 57 | return p; // expected-warning{{Undefined or garbage value returned to caller}} |
| 58 | // expected-note@-1{{Undefined or garbage value returned to caller}} |
| 59 | } |
| 60 | |
| 61 | void initializer4(int *p, int param) { |
| 62 | if (param) // expected-note{{Taking false branch}} |
| 63 | *p = 0; |
| 64 | } // expected-note{{Returning without writing to '*p'}} |
| 65 | |
| 66 | void initializer5(int *p, int param) { |
| 67 | if (!param) // expected-note{{Taking false branch}} |
| 68 | *p = 0; |
| 69 | } // expected-note{{Returning without writing to '*p'}} |
| 70 | |
| 71 | int multi_init_tries_func() { |
| 72 | int p; // expected-note{{'p' declared without an initial value}} |
| 73 | initializer4(&p, 0); // expected-note{{Calling 'initializer4'}} |
| 74 | // expected-note@-1{{Returning from 'initializer4'}} |
| 75 | initializer5(&p, 1); // expected-note{{Calling 'initializer5'}} |
| 76 | // expected-note@-1{{Returning from 'initializer5'}} |
| 77 | return p; // expected-warning{{Undefined or garbage value returned to caller}} |
| 78 | // expected-note@-1{{Undefined or garbage value returned to caller}} |
| 79 | } |
| 80 | |
| 81 | int initializer6(const int *p) { |
| 82 | return 0; |
| 83 | } |
| 84 | |
| 85 | int no_msg_on_const() { |
| 86 | int p; // expected-note{{'p' declared without an initial value}} |
| 87 | initializer6(&p); |
| 88 | return p; // expected-warning{{Undefined or garbage value returned to caller}} |
| 89 | // expected-note@-1{{Undefined or garbage value returned to caller}} |
| 90 | } |
| 91 | |
| 92 | typedef struct { |
| 93 | int x; |
| 94 | } S; |
| 95 | |
| 96 | int initializer7(S *s, int param) { |
| 97 | if (param) { // expected-note{{Taking false branch}} |
| 98 | s->x = 0; |
| 99 | return 0; |
| 100 | } |
| 101 | return 1; // expected-note{{Returning without writing to 's->x'}} |
| 102 | } |
| 103 | |
| 104 | int initialize_struct_field() { |
| 105 | S local; |
| 106 | initializer7(&local, 0); // expected-note{{Calling 'initializer7'}} |
| 107 | // expected-note@-1{{Returning from 'initializer7'}} |
| 108 | return local.x; // expected-warning{{Undefined or garbage value returned to caller}} |
| 109 | // expected-note@-1{{Undefined or garbage value returned to caller}} |
| 110 | } |
| 111 | |
| 112 | void nullwriter(int **p) { |
| 113 | *p = 0; // expected-note{{Null pointer value stored to 'p'}} |
| 114 | } // no extra note |
| 115 | |
| 116 | int usage() { |
| 117 | int x = 0; |
| 118 | int *p = &x; |
| 119 | nullwriter(&p); // expected-note{{Calling 'nullwriter'}} |
| 120 | // expected-note@-1{{Returning from 'nullwriter'}} |
| 121 | return *p; // expected-warning{{Dereference of null pointer (loaded from variable 'p')}} |
| 122 | // expected-note@-1{{Dereference of null pointer (loaded from variable 'p')}} |
| 123 | } |
| 124 | |
| 125 | typedef struct { |
| 126 | int x; |
| 127 | int y; |
| 128 | } A; |
| 129 | |
| 130 | void partial_initializer(A *a) { |
| 131 | a->x = 0; |
| 132 | } // expected-note{{Returning without writing to 'a->y'}} |
| 133 | |
| 134 | int use_partial_initializer() { |
| 135 | A a; |
| 136 | partial_initializer(&a); // expected-note{{Calling 'partial_initializer'}} |
| 137 | // expected-note@-1{{Returning from 'partial_initializer'}} |
| 138 | return a.y; // expected-warning{{Undefined or garbage value returned to caller}} |
| 139 | // expected-note@-1{{Undefined or garbage value returned to caller}} |
| 140 | } |
| 141 | |
| 142 | typedef struct { |
| 143 | int x; |
| 144 | int y; |
| 145 | } B; |
| 146 | |
| 147 | typedef struct { |
| 148 | B b; |
| 149 | } C; |
| 150 | |
| 151 | void partial_nested_initializer(C *c) { |
| 152 | c->b.x = 0; |
| 153 | } // expected-note{{Returning without writing to 'c->b.y'}} |
| 154 | |
| 155 | int use_partial_nested_initializer() { |
| 156 | B localB; |
| 157 | C localC; |
| 158 | localC.b = localB; |
| 159 | partial_nested_initializer(&localC); // expected-note{{Calling 'partial_nested_initializer'}} |
| 160 | // expected-note@-1{{Returning from 'partial_nested_initializer'}} |
| 161 | return localC.b.y; // expected-warning{{Undefined or garbage value returned to caller}} |
| 162 | // expected-note@-1{{Undefined or garbage value returned to caller}} |
| 163 | } |
| 164 | |
| 165 | void test_subregion_assignment(C* c) { |
| 166 | B b; |
| 167 | c->b = b; |
| 168 | } |
| 169 | |
| 170 | int use_subregion_assignment() { |
| 171 | C c; |
| 172 | test_subregion_assignment(&c); // expected-note{{Calling 'test_subregion_assignment'}} |
| 173 | // expected-note@-1{{Returning from 'test_subregion_assignment'}} |
| 174 | return c.b.x; // expected-warning{{Undefined or garbage value returned to caller}} |
| 175 | // expected-note@-1{{Undefined or garbage value returned to caller}} |
| 176 | } |
| 177 | |
| 178 | int confusing_signature(int *); |
| 179 | int confusing_signature(int *p) { |
| 180 | return 0; // expected-note{{Returning without writing to '*p'}} |
| 181 | } |
| 182 | |
| 183 | int use_confusing_signature() { |
| 184 | int a; // expected-note {{'a' declared without an initial value}} |
| 185 | confusing_signature(&a); // expected-note{{Calling 'confusing_signature'}} |
| 186 | // expected-note@-1{{Returning from 'confusing_signature'}} |
| 187 | return a; // expected-note{{Undefined or garbage value returned to caller}} |
| 188 | // expected-warning@-1{{Undefined or garbage value returned to caller}} |
| 189 | } |
| 190 | |
| 191 | int coin(); |
| 192 | |
| 193 | int multiindirection(int **p) { |
| 194 | if (coin()) // expected-note{{Assuming the condition is true}} |
| 195 | // expected-note@-1{{Taking true branch}} |
| 196 | return 1; // expected-note{{Returning without writing to '**p'}} |
| 197 | *(*p) = 0; |
| 198 | return 0; |
| 199 | } |
| 200 | |
| 201 | int usemultiindirection() { |
| 202 | int a; // expected-note {{'a' declared without an initial value}} |
| 203 | int *b = &a; |
| 204 | multiindirection(&b); // expected-note{{Calling 'multiindirection'}} |
| 205 | // expected-note@-1{{Returning from 'multiindirection'}} |
| 206 | return a; // expected-note{{Undefined or garbage value returned to caller}} |
| 207 | // expected-warning@-1{{Undefined or garbage value returned to caller}} |
| 208 | } |
| 209 | |
| 210 | int indirectingstruct(S** s) { |
| 211 | if (coin()) // expected-note{{Assuming the condition is true}} |
| 212 | // expected-note@-1{{Taking true branch}} |
| 213 | return 1; // expected-note{{Returning without writing to '(*s)->x'}} |
| 214 | |
| 215 | (*s)->x = 0; |
| 216 | return 0; |
| 217 | } |
| 218 | |
| 219 | int useindirectingstruct() { |
| 220 | S s; |
| 221 | S* p = &s; |
| 222 | indirectingstruct(&p); //expected-note{{Calling 'indirectingstruct'}} |
| 223 | //expected-note@-1{{Returning from 'indirectingstruct'}} |
| 224 | return s.x; // expected-warning{{Undefined or garbage value returned to caller}} |
| 225 | // expected-note@-1{{Undefined or garbage value returned to caller}} |
| 226 | } |
| 227 | |
| 228 | typedef struct { |
| 229 | int *x; |
| 230 | } D; |
| 231 | |
| 232 | void initializeMaybeInStruct(D* pD) { |
| 233 | if (coin()) // expected-note{{Assuming the condition is false}} |
| 234 | // expected-note@-1{{Taking false branch}} |
| 235 | *pD->x = 120; |
| 236 | } // expected-note{{Returning without writing to 'pD->x'}} |
| 237 | |
| 238 | int useInitializeMaybeInStruct() { |
| 239 | int z; // expected-note{{'z' declared without an initial value}} |
| 240 | D d; |
| 241 | d.x = &z; |
| 242 | initializeMaybeInStruct(&d); // expected-note{{Calling 'initializeMaybeInStruct'}} |
| 243 | // expected-note@-1{{Returning from 'initializeMaybeInStruct'}} |
| 244 | return z; // expected-warning{{Undefined or garbage value returned to caller}} |
| 245 | // expected-note@-1{{Undefined or garbage value returned to caller}} |
| 246 | } |
| 247 | |