gcc/testsuite/c-c++-common/analyzer/null-deref-pr108806-qemu.c

   1 /* Reduced from qemu-7.2.0's hw/intc/omap_intc.c */
   2
   3 /* { dg-additional-options "-Wno-analyzer-symbol-too-complex" } */
   4
   5 #include "../../gcc.dg/analyzer/analyzer-decls.h"
   6
   7 typedef unsigned char __uint8_t;
   8 typedef unsigned int __uint32_t;
   9 typedef unsigned long int __uint64_t;
  10 typedef __uint8_t uint8_t;
  11 typedef __uint32_t uint32_t;
  12 typedef __uint64_t uint64_t;
  13 typedef uint64_t hwaddr;
  14 typedef struct omap_intr_handler_s omap_intr_handler;
  15
  16 struct omap_intr_handler_bank_s
  17 {
  18   uint32_t irqs;
  19   uint32_t inputs;
  20   uint32_t mask;
  21   uint32_t fiq;
  22   uint32_t sens_edge;
  23   uint32_t swi;
  24   unsigned char priority[32];
  25 };
  26
  27 struct omap_intr_handler_s
  28 {
  29   /* [...snip...] */
  30   unsigned char nbanks;
  31   /* [...snip...] */
  32   int sir_intr[2];
  33   int autoidle;
  34   uint32_t mask;
  35   struct omap_intr_handler_bank_s bank[3];
  36 };
  37
  38 uint64_t
  39 omap2_inth_read(struct omap_intr_handler_s* s, int offset)
  40 {
  41   int bank_no, line_no;
  42   struct omap_intr_handler_bank_s* bank = NULL;
  43
  44   if ((offset & 0xf80) == 0x80) {
  45     bank_no = (offset & 0x60) >> 5;
  46     if (bank_no < s->nbanks) {
  47       offset &= ~0x60;
  48       bank = &s->bank[bank_no];
  49     } else {
  50       return 0;
  51     }
  52   }
  53
  54   switch (offset) {
  55     case 0x10:
  56       return (s->autoidle >> 2) & 1;
  57
  58     case 0x14:
  59       return 1;
  60
  61     case 0x40:
  62       return s->sir_intr[0];
  63
  64     case 0x44:
  65       return s->sir_intr[1];
  66
  67     case 0x48:
  68       return (!s->mask) << 2;
  69
  70     case 0x4c:
  71       return 0;
  72
  73     case 0x50:
  74       return s->autoidle & 3;
  75
  76     case 0x80:
  77       return bank->inputs; /* { dg-bogus "dereference of NULL 'bank'" "PR analyzer/108806" } */
  78
  79     case 0x84:
  80       return bank->mask; /* { dg-bogus "dereference of NULL 'bank'" "PR analyzer/108806" } */
  81
  82     case 0x88:
  83     case 0x8c:
  84       return 0;
  85
  86     case 0x90:
  87       return bank->swi; /* { dg-bogus "dereference of NULL 'bank'" "PR analyzer/108806" } */
  88
  89     case 0x94:
  90       return 0;
  91
  92     case 0x98:
  93       return bank->irqs & ~bank->mask & ~bank->fiq; /* { dg-bogus "dereference of NULL 'bank'" "PR analyzer/108806" } */
  94
  95     case 0x9c:
  96       return bank->irqs & ~bank->mask & bank->fiq; /* { dg-bogus "dereference of NULL 'bank'" "PR analyzer/108806" } */
  97
  98     case 0x100 ... 0x300:
  99       bank_no = (offset - 0x100) >> 7;
 100       if (bank_no > s->nbanks)
 101         break;
 102       bank = &s->bank[bank_no];
 103       line_no = (offset & 0x7f) >> 2;
 104       return (bank->priority[line_no] << 2) | ((bank->fiq >> line_no) & 1);
 105   }
 106   return 0;
 107 }