| 1 | // RUN: %clang_analyze_cc1 -triple x86_64-apple-darwin10 -analyzer-checker=core,alpha.security.ArrayBoundV2 -Wno-implicit-function-declaration -verify %s |
|---|
| 2 | // RUN: %clang_analyze_cc1 -triple i386-apple-darwin10 -analyzer-checker=core,alpha.security.ArrayBoundV2 -Wno-implicit-function-declaration -DM32 -verify %s |
|---|
| 3 | // expected-no-diagnostics |
|---|
| 4 | |
|---|
| 5 | #define UINT_MAX (~0u) |
|---|
| 6 | |
|---|
| 7 | #ifdef M32 |
|---|
| 8 | |
|---|
| 9 | #define X86_ARRAY_SIZE (UINT_MAX/2 + 4) |
|---|
| 10 | |
|---|
| 11 | void testIndexTooBig() { |
|---|
| 12 | char arr[X86_ARRAY_SIZE]; |
|---|
| 13 | char *ptr = arr + UINT_MAX/2; |
|---|
| 14 | ptr += 2; // index shouldn't overflow |
|---|
| 15 | *ptr = 42; // no-warning |
|---|
| 16 | } |
|---|
| 17 | |
|---|
| 18 | #else // 64-bit tests |
|---|
| 19 | |
|---|
| 20 | #define ARRAY_SIZE 0x100000000 |
|---|
| 21 | |
|---|
| 22 | void testIndexOverflow64() { |
|---|
| 23 | char arr[ARRAY_SIZE]; |
|---|
| 24 | char *ptr = arr + UINT_MAX/2; |
|---|
| 25 | ptr += 2; // don't overflow 64-bit index |
|---|
| 26 | *ptr = 42; // no-warning |
|---|
| 27 | } |
|---|
| 28 | |
|---|
| 29 | #define ULONG_MAX (~0ul) |
|---|
| 30 | #define BIG_INDEX (ULONG_MAX/16) |
|---|
| 31 | |
|---|
| 32 | void testIndexTooBig64() { |
|---|
| 33 | char arr[ULONG_MAX/8-1]; |
|---|
| 34 | char *ptr = arr + BIG_INDEX; |
|---|
| 35 | ptr += 2; // don't overflow 64-bit index |
|---|
| 36 | *ptr = 42; // no-warning |
|---|
| 37 | } |
|---|
| 38 | |
|---|
| 39 | #define SIZE 4294967296 |
|---|
| 40 | |
|---|
| 41 | static unsigned size; |
|---|
| 42 | static void * addr; |
|---|
| 43 | static unsigned buf[SIZE]; |
|---|
| 44 | |
|---|
| 45 | void testOutOfBounds() { |
|---|
| 46 | // Not out of bounds. |
|---|
| 47 | buf[SIZE-1] = 1; // no-warning |
|---|
| 48 | } |
|---|
| 49 | |
|---|
| 50 | void testOutOfBoundsCopy1() { |
|---|
| 51 | memcpy(buf, addr, size); // no-warning |
|---|
| 52 | } |
|---|
| 53 | |
|---|
| 54 | void testOutOfBoundsCopy2() { |
|---|
| 55 | memcpy(addr, buf, size); // no-warning |
|---|
| 56 | } |
|---|
| 57 | |
|---|
| 58 | #endif |
|---|
| 59 | |
|---|