1 // RUN: %clang_cc1 -analyze -analyzer-store=region -analyzer-checker=core,unix.Malloc -fblocks -verify %s 2 // RUN: %clang_cc1 -analyze -analyzer-store=region -analyzer-checker=core,unix.Malloc -fblocks -verify -analyzer-config unix.Malloc:Optimistic=true %s 3 typedef __typeof(sizeof(int)) size_t; 4 void free(void *); 5 void *alloca(size_t); 6 7 void t1 () { 8 int a[] = { 1 }; 9 free(a); // expected-warning {{Argument to free() is the address of the local variable 'a', which is not memory allocated by malloc()}} 10 } 11 12 void t2 () { 13 int a = 1; 14 free(&a); // expected-warning {{Argument to free() is the address of the local variable 'a', which is not memory allocated by malloc()}} 15 } 16 17 void t3 () { 18 static int a[] = { 1 }; 19 free(a); // expected-warning {{Argument to free() is the address of the static variable 'a', which is not memory allocated by malloc()}} 20 } 21 22 void t4 (char *x) { 23 free(x); // no-warning 24 } 25 26 void t5 () { 27 extern char *ptr(); 28 free(ptr()); // no-warning 29 } 30 31 void t6 () { 32 free((void*)1000); // expected-warning {{Argument to free() is a constant address (1000), which is not memory allocated by malloc()}} 33 } 34 35 void t7 (char **x) { 36 free(*x); // no-warning 37 } 38 39 void t8 (char **x) { 40 // ugh 41 free((*x)+8); // no-warning 42 } 43 44 void t9 () { 45 label: 46 free(&&label); // expected-warning {{Argument to free() is the address of the label 'label', which is not memory allocated by malloc()}} 47 } 48 49 void t10 () { 50 free((void*)&t10); // expected-warning {{Argument to free() is the address of the function 't10', which is not memory allocated by malloc()}} 51 } 52 53 void t11 () { 54 char *p = (char*)alloca(2); 55 free(p); // expected-warning {{Memory allocated by alloca() should not be deallocated}} 56 } 57 58 void t12 () { 59 char *p = (char*)__builtin_alloca(2); 60 free(p); // expected-warning {{Memory allocated by alloca() should not be deallocated}} 61 } 62 63 void t13 () { 64 free(^{return;}); // expected-warning {{Argument to free() is a block, which is not memory allocated by malloc()}} 65 } 66 67 void t14 (char a) { 68 free(&a); // expected-warning {{Argument to free() is the address of the parameter 'a', which is not memory allocated by malloc()}} 69 } 70 71 static int someGlobal[2]; 72 void t15 () { 73 free(someGlobal); // expected-warning {{Argument to free() is the address of the global variable 'someGlobal', which is not memory allocated by malloc()}} 74 } 75 76 void t16 (char **x, int offset) { 77 // Unknown value 78 free(x[offset]); // no-warning 79 } 80
