gcc/testsuite/c-c++-common/analyzer/memset-1.c

   1 #include <string.h>
   2 #include "analyzer-decls.h"
   3
   4 /* Zero-fill of uninitialized buffer.  */
   5
   6 void test_1 (void)
   7 {
   8   char buf[256];
   9   void *p = memset (buf, 0, 256);
  10   __analyzer_eval (buf[42] == 0); /* { dg-warning "TRUE" } */
  11   __analyzer_eval (p == buf); /* { dg-warning "TRUE" } */
  12 }
  13
  14 /* As above, but with __builtin_memset.  */
  15
  16 void test_1a (void)
  17 {
  18   char buf[256];
  19   __builtin_memset (buf, 0, 256);
  20   __analyzer_eval (buf[42] == 0); /* { dg-warning "TRUE" } */
  21 }
  22
  23 /* Zero-fill of partially initialized buffer.  */
  24
  25 void test_2 (void)
  26 {
  27   char buf[256];
  28   buf[42] = 'A';
  29   __analyzer_eval (buf[42] == 'A'); /* { dg-warning "TRUE" } */
  30   memset (buf, 0, 256);
  31   __analyzer_eval (buf[42] == '\0'); /* { dg-warning "TRUE" } */
  32 }
  33
  34 /* A "memset" with known non-zero value.  */
  35
  36 void test_3 (int val)
  37 {
  38   char buf[256];
  39   memset (buf, 'A', 256);
  40   __analyzer_eval (buf[42] == 'A'); /* { dg-warning "TRUE" } */
  41 }
  42
  43 /* A "memset" with unknown value.  */
  44
  45 void test_4 (char val)
  46 {
  47   char buf[256];
  48   memset (buf, val, 256);
  49   __analyzer_eval (buf[42] == (char)val); /* { dg-warning "TRUE" } */
  50 }
  51
  52 /* A "memset" with unknown num bytes.  */
  53
  54 void test_5 (int n)
  55 {
  56   char buf[256];
  57   buf[42] = 'A';
  58   __analyzer_eval (buf[42] == 'A'); /* { dg-warning "TRUE" } */
  59   memset (buf, 0, n);
  60
  61   /* We can't know if buf[42] was overwritten by the memset or not.  */
  62   __analyzer_eval (buf[42] == 'A'); /* { dg-warning "UNKNOWN" } */
  63   __analyzer_eval (buf[42] == '\0'); /* { dg-warning "UNKNOWN" } */
  64 }
  65
  66 /* As test_5, but with "__builtin___memset_chk".  */
  67
  68 void test_5a (int n)
  69 {
  70   char buf[256];
  71   buf[42] = 'A';
  72   __analyzer_eval (buf[42] == 'A'); /* { dg-warning "TRUE" } */
  73   __builtin___memset_chk (buf, 0, n, __builtin_object_size (buf, 0));
  74
  75   /* We can't know if buf[42] was overwritten by the memset or not.  */
  76   __analyzer_eval (buf[42] == 'A'); /* { dg-warning "UNKNOWN" } */
  77   __analyzer_eval (buf[42] == '\0'); /* { dg-warning "UNKNOWN" } */
  78 }
  79
  80 /* A "memset" with unknown value, but with zero size.  */
  81
  82 static size_t __attribute__((noinline))
  83 get_zero (void)
  84 {
  85   return 0;
  86 }
  87
  88 void test_6 (int val)
  89 {
  90   char buf[256];
  91   buf[42] = 'A';
  92   memset (buf, 'B', get_zero ());
  93   __analyzer_eval (buf[42] == 'A'); /* { dg-warning "TRUE" } */
  94 }
  95
  96 void test_6b (int val)
  97 {
  98   char buf[256];
  99   memset (buf, 'A', sizeof (buf));
 100   memset (buf, 'B', get_zero ());
 101   __analyzer_eval (buf[42] == 'A'); /* { dg-warning "TRUE" } */
 102 }
 103
 104 /* A "memset" of known size that's not the full buffer.  */
 105
 106 void test_7 (void)
 107 {
 108   char buf[256];
 109   buf[128] = 'A';
 110   memset (buf, 0, 128);
 111   __analyzer_eval (buf[0] == '\0'); /* { dg-warning "TRUE" } */
 112   __analyzer_eval (buf[127] == '\0'); /* { dg-warning "TRUE" } */
 113   __analyzer_eval (buf[128] == 'A'); /* { dg-warning "TRUE" } */
 114 }
 115
 116 void test_8 (void)
 117 {
 118   char buf[20];
 119   memset (buf + 0, 0, 1);
 120   memset (buf + 1, 1, 1);
 121   memset (buf + 2, 2, 1);
 122   memset (buf + 3, 3, 1);
 123   memset (buf + 4, 4, 2);
 124   memset (buf + 6, 6, 2);
 125   memset (buf + 8, 8, 4);
 126   memset (buf + 12, 12, 8);
 127   __analyzer_eval (buf[0] == 0); /* { dg-warning "TRUE" } */
 128   __analyzer_eval (buf[1] == 1); /* { dg-warning "TRUE" } */
 129   __analyzer_eval (buf[2] == 2); /* { dg-warning "TRUE" } */
 130   __analyzer_eval (buf[3] == 3); /* { dg-warning "TRUE" } */
 131   __analyzer_eval (buf[4] == 4); /* { dg-warning "TRUE" } */
 132   __analyzer_eval (buf[5] == 4); /* { dg-warning "TRUE" } */
 133   __analyzer_eval (buf[6] == 6); /* { dg-warning "TRUE" } */
 134   __analyzer_eval (buf[7] == 6); /* { dg-warning "TRUE" } */
 135   __analyzer_eval (buf[8] == 8); /* { dg-warning "TRUE" } */
 136   __analyzer_eval (buf[9] == 8); /* { dg-warning "TRUE" } */
 137   __analyzer_eval (buf[10] == 8); /* { dg-warning "TRUE" } */
 138   __analyzer_eval (buf[11] == 8); /* { dg-warning "TRUE" } */
 139   __analyzer_eval (buf[12] == 12); /* { dg-warning "TRUE" } */
 140   __analyzer_eval (buf[13] == 12); /* { dg-warning "TRUE" } */
 141   __analyzer_eval (buf[14] == 12); /* { dg-warning "TRUE" } */
 142   __analyzer_eval (buf[15] == 12); /* { dg-warning "TRUE" } */
 143   __analyzer_eval (buf[16] == 12); /* { dg-warning "TRUE" } */
 144   __analyzer_eval (buf[17] == 12); /* { dg-warning "TRUE" } */
 145   __analyzer_eval (buf[18] == 12); /* { dg-warning "TRUE" } */
 146   __analyzer_eval (buf[19] == 12); /* { dg-warning "TRUE" } */
 147 }
 148
 149 /* Various overlapping memset calls with different sizes and values.  */
 150
 151 void test_9 (void)
 152 {
 153   char buf[8];
 154   memset (buf, 0, 8);
 155   __analyzer_eval (buf[0] == 0); /* { dg-warning "TRUE" } */
 156   __analyzer_eval (buf[1] == 0); /* { dg-warning "TRUE" } */
 157   __analyzer_eval (buf[2] == 0); /* { dg-warning "TRUE" } */
 158   __analyzer_eval (buf[3] == 0); /* { dg-warning "TRUE" } */
 159   __analyzer_eval (buf[4] == 0); /* { dg-warning "TRUE" } */
 160   __analyzer_eval (buf[5] == 0); /* { dg-warning "TRUE" } */
 161   __analyzer_eval (buf[6] == 0); /* { dg-warning "TRUE" } */
 162   __analyzer_eval (buf[7] == 0); /* { dg-warning "TRUE" } */
 163
 164   memset (buf + 1, 1, 4);
 165   __analyzer_eval (buf[0] == 0); /* { dg-warning "TRUE" } */
 166   __analyzer_eval (buf[1] == 1); /* { dg-warning "TRUE" } */
 167   __analyzer_eval (buf[2] == 1); /* { dg-warning "TRUE" } */
 168   __analyzer_eval (buf[3] == 1); /* { dg-warning "TRUE" } */
 169   __analyzer_eval (buf[4] == 1); /* { dg-warning "TRUE" } */
 170   __analyzer_eval (buf[5] == 0); /* { dg-warning "TRUE" } */
 171   __analyzer_eval (buf[6] == 0); /* { dg-warning "TRUE" } */
 172   __analyzer_eval (buf[7] == 0); /* { dg-warning "TRUE" } */
 173
 174   memset (buf + 2, 2, 4);
 175   __analyzer_eval (buf[0] == 0); /* { dg-warning "TRUE" } */
 176   __analyzer_eval (buf[1] == 1); /* { dg-warning "TRUE" } */
 177   __analyzer_eval (buf[2] == 2); /* { dg-warning "TRUE" } */
 178   __analyzer_eval (buf[3] == 2); /* { dg-warning "TRUE" } */
 179   __analyzer_eval (buf[4] == 2); /* { dg-warning "TRUE" } */
 180   __analyzer_eval (buf[5] == 2); /* { dg-warning "TRUE" } */
 181   __analyzer_eval (buf[6] == 0); /* { dg-warning "TRUE" } */
 182   __analyzer_eval (buf[7] == 0); /* { dg-warning "TRUE" } */
 183
 184   memset (buf + 4, 3, 3);
 185   __analyzer_eval (buf[0] == 0); /* { dg-warning "TRUE" } */
 186   __analyzer_eval (buf[1] == 1); /* { dg-warning "TRUE" } */
 187   __analyzer_eval (buf[2] == 2); /* { dg-warning "TRUE" } */
 188   __analyzer_eval (buf[3] == 2); /* { dg-warning "TRUE" } */
 189   __analyzer_eval (buf[4] == 3); /* { dg-warning "TRUE" } */
 190   __analyzer_eval (buf[5] == 3); /* { dg-warning "TRUE" } */
 191   __analyzer_eval (buf[6] == 3); /* { dg-warning "TRUE" } */
 192   __analyzer_eval (buf[7] == 0); /* { dg-warning "TRUE" } */
 193
 194   memset (buf + 0, 4, 3);
 195   __analyzer_eval (buf[0] == 4); /* { dg-warning "TRUE" } */
 196   __analyzer_eval (buf[1] == 4); /* { dg-warning "TRUE" } */
 197   __analyzer_eval (buf[2] == 4); /* { dg-warning "TRUE" } */
 198   __analyzer_eval (buf[3] == 2); /* { dg-warning "TRUE" } */
 199   __analyzer_eval (buf[4] == 3); /* { dg-warning "TRUE" } */
 200   __analyzer_eval (buf[5] == 3); /* { dg-warning "TRUE" } */
 201   __analyzer_eval (buf[6] == 3); /* { dg-warning "TRUE" } */
 202   __analyzer_eval (buf[7] == 0); /* { dg-warning "TRUE" } */
 203 }