Hi Jordan,
On Wed, 2014-09-03 at 19:18 -0700, Jordan Rose wrote:
> This seems like a reasonable approach. It's not wonderful, but it's
> more a sanity check than anything else, right?
Yes this is only a sanity check. If someone redefines malloc to
something strange there isn't much we can do.
> Feel free to remove the check from a few lines down. Please add a test
> case as well.
Attached is a new patch with two test cases.
Cheers,
Daniel Fahlgren
Index: test/Analysis/malloc-protoype.c
===================================================================
--- test/Analysis/malloc-protoype.c (revision 0)
+++ test/Analysis/malloc-protoype.c (revision 0)
@@ -0,0 +1,17 @@
+// RUN: %clang_cc1 -w -analyze -analyzer-checker=core,unix.Malloc -verify %s
+// expected-no-diagnostics
+
+// Test that strange prototypes doesn't crash the analyzer
+
+void malloc(int i);
+void valloc(int i);
+
+void test1()
+{
+ malloc(1);
+}
+
+void test2()
+{
+ valloc(1);
+}
Index: lib/StaticAnalyzer/Checkers/MallocChecker.cpp
===================================================================
--- lib/StaticAnalyzer/Checkers/MallocChecker.cpp (revision 217142)
+++ lib/StaticAnalyzer/Checkers/MallocChecker.cpp (working copy)
@@ -901,6 +901,10 @@ ProgramStateRef MallocChecker::MallocMem
ProgramStateRef State,
AllocationFamily Family) {
+ // We expect the malloc functions to return a pointer.
+ if (!Loc::isLocType(CE->getType()))
+ return nullptr;
+
// Bind the return value to the symbolic value from the heap region.
// TODO: We could rewrite post visit to eval call; 'malloc' does not have
// side effects other than what we model here.
@@ -911,10 +915,6 @@ ProgramStateRef MallocChecker::MallocMem
.castAs<DefinedSVal>();
State = State->BindExpr(CE, C.getLocationContext(), RetVal);
- // We expect the malloc functions to return a pointer.
- if (!RetVal.getAs<Loc>())
- return nullptr;
-
// Fill the region with the initialization value.
State = State->bindDefault(RetVal, Init);
_______________________________________________
cfe-commits mailing list
[email protected]
http://lists.cs.uiuc.edu/mailman/listinfo/cfe-commits
