gcc/testsuite/c-c++-common/analyzer/allocation-size-3.c

   1 /* { dg-additional-options "-fanalyzer-fine-grained" }
   2    -fanalyzer-fine-grained is currently required; see PR analyzer/107851.  */
   3
   4 /* { dg-additional-options -Wno-analyzer-out-of-bounds } */
   5
   6 #include <stdlib.h>
   7 #include <stdio.h>
   8 #include <stdint.h>
   9
  10 /* CWE-131 example 5 */
  11 void test_1 (void)
  12 {
  13   int32_t *id_sequence = (int32_t *) malloc (3); /* { dg-line malloc1 } */
  14   if (id_sequence == NULL) exit (1);
  15
  16   id_sequence[0] = 13579;
  17   id_sequence[1] = 24680;
  18   id_sequence[2] = 97531;
  19
  20   free (id_sequence);
  21
  22   /* { dg-warning "allocated buffer size is not a multiple of the pointee's size \\\[CWE-131\\\]" "warning" { target *-*-* } malloc1 } */
  23   /* { dg-message "3 bytes" "note" { target *-*-* } malloc1 } */
  24   /* { dg-message "'int32_t \\*' (\\\{aka '(long )?int \\*'\\\})? here; 'sizeof \\(int32_t (\\\{aka (long )?int\\\})?\\)' is '4'" "note" { target c } malloc1 } */
  25   /* { dg-message "'int32_t\\*' (\\\{aka '(long )?int\\*'\\\})? here; 'sizeof \\(int32_t (\\\{aka (long )?int\\\})?\\)' is '4'" "note" { target c++ } malloc1 } */
  26 }
  27
  28 void test_2 (void)
  29 {
  30   int32_t *ptr = (int32_t *) malloc (10 + sizeof(int32_t)); /* { dg-line malloc2 } */
  31   free (ptr);
  32
  33   /* { dg-warning "allocated buffer size is not a multiple of the pointee's size \\\[CWE-131\\\]" "warning" { target *-*-* } malloc2 } */
  34   /* { dg-message "14 bytes" "note" { target *-*-* } malloc2 } */
  35   /* { dg-message "'int32_t \\*' (\\\{aka '(long )?int \\*'\\\})? here; 'sizeof \\(int32_t (\\\{aka (long )?int\\\})?\\)' is '4'" "note" { target c } malloc2 } */
  36   /* { dg-message "'int32_t\\*' (\\\{aka '(long )?int\\*'\\\})? here; 'sizeof \\(int32_t (\\\{aka (long )?int\\\})?\\)' is '4'" "note" { target c++ } malloc2 } */
  37 }
  38
  39 void test_3 (int32_t n)
  40 {
  41   int32_t *ptr = (int32_t *) malloc (n + sizeof (int32_t)); /* { dg-line malloc3 } */
  42   free (ptr);
  43
  44   /* { dg-warning "allocated buffer size is not a multiple of the pointee's size \\\[CWE-131\\\]" "warning" { target *-*-* } malloc3 } */
  45   /* { dg-message "'\[a-z0-9\\+\\(\\)\\s\]*' bytes" "note" { target *-*-* } malloc3 } */
  46   /* { dg-message "'int32_t \\*' (\\\{aka '(long )?int \\*'\\\})? here; 'sizeof \\(int32_t (\\\{aka (long )?int\\\})?\\)' is '4'" "note" { target c } malloc3 } */
  47   /* { dg-message "'int32_t\\*' (\\\{aka '(long )?int\\*'\\\})? here; 'sizeof \\(int32_t (\\\{aka (long )?int\\\})?\\)' is '4'" "note" { target c++ } malloc3 } */
  48 }
  49
  50 void test_4 (int32_t n, int32_t m)
  51 {
  52   int32_t *ptr = (int32_t *) malloc ((n + m) * sizeof (int32_t));
  53   free (ptr);
  54 }