================
@@ -112,3 +112,105 @@ void inlined_callee_single_report() {
// expected-note@-1 {{Calling 'deref_param'}}
(void)r;
}
+
+struct MyBuffer {
+ char buffer[8];
+};
+struct MyStruct { int x; };
+struct Inner { int x; };
+struct Outer { struct Inner inner; };
+
+char member_subregion_dangling_deref() {
+ const char *p = nullptr;
+ {
+ struct MyBuffer tmp_buffer = {};
+ p = tmp_buffer.buffer;
+ }
+ // expected-note@-1 {{'tmp_buffer.buffer[0]' is destroyed here}}
+ return *p;
+ // expected-warning@-1 {{Use of 'tmp_buffer.buffer[0]' after its lifetime
ended}}
+ // expected-note@-2 {{Use of 'tmp_buffer.buffer[0]' after its lifetime
ended}}
+}
+
+void opaque(const char *);
+
+void passing_dangling_to_call() {
+ const char *p = nullptr;
+ {
+ struct MyBuffer tmp_buffer = {};
+ p = tmp_buffer.buffer;
+ }
+ // expected-note@-1 {{'tmp_buffer.buffer[0]' is destroyed here}}
+ opaque(p);
+ // expected-warning@-1 {{Use of 'tmp_buffer.buffer[0]' after its lifetime
ended}}
+ // expected-note@-2 {{Use of 'tmp_buffer.buffer[0]' after its lifetime
ended}}
+}
+
+char member_subregion_alive_deref() {
+ {
+ struct MyBuffer tmp_buffer = {};
+ const char *p = tmp_buffer.buffer;
+ opaque(p); // no-warning
+ return *p; // no-warning
+ }
+}
+
+void arr_elem_subreg_dangling_deref() {
+ int *ptr = nullptr;
+ {
+ int local_arr[5];
----------------
isuckatcs wrote:
IIRC the magic number in the CSA is 4 by default, as that is the amount of
times we allow the analyzer to execute the same statement in a row. After that
it falls back to conservative evaluation.
It shouldn't cause an issue in this case, but with structured binding of arrays
you might se different results. In general I recommend testing for `< 4` and
`>= 4` cases.
https://github.com/llvm/llvm-project/pull/211552
_______________________________________________
cfe-commits mailing list
[email protected]
https://lists.llvm.org/cgi-bin/mailman/listinfo/cfe-commits
