gcc/testsuite/c-c++-common/analyzer/realloc-2.c

   1 /* { dg-additional-options "-fno-analyzer-suppress-followups" } */
   2
   3 #include "../../gcc.dg/analyzer/analyzer-decls.h"
   4
   5 typedef __SIZE_TYPE__ size_t;
   6
   7 extern void *malloc (size_t __size)
   8   __attribute__ ((__nothrow__ , __leaf__))
   9   __attribute__ ((__malloc__))
  10   __attribute__ ((__alloc_size__ (1)));
  11 extern void *realloc (void *__ptr, size_t __size)
  12   __attribute__ ((__nothrow__ , __leaf__))
  13   __attribute__ ((__warn_unused_result__))
  14   __attribute__ ((__alloc_size__ (2)));
  15 extern void free (void *__ptr)
  16   __attribute__ ((__nothrow__ , __leaf__));
  17
  18 char *test_8 (size_t sz)
  19 {
  20   char *p, *q;
  21
  22   p = (char *) malloc (3);
  23   if (!p)
  24     return NULL;
  25
  26   __analyzer_dump_capacity (p); /* { dg-warning "capacity: '\\(size_t\\)3'" } */
  27
  28   p[0] = 'a';
  29   p[1] = 'b';
  30   p[2] = 'c';
  31
  32   __analyzer_eval (p[0] == 'a'); /* { dg-warning "TRUE" } */
  33   __analyzer_eval (p[1] == 'b'); /* { dg-warning "TRUE" } */
  34   __analyzer_eval (p[2] == 'c'); /* { dg-warning "TRUE" } */
  35
  36   q = (char *) realloc (p, 6);
  37
  38   /* We should have 3 nodes, corresponding to "failure",
  39      "success without moving", and "success with moving".  */
  40   __analyzer_dump_exploded_nodes (0); /* { dg-warning "3 processed enodes" } */
  41
  42   if (q)
  43     {
  44       __analyzer_dump_capacity (q); /* { dg-warning "capacity: '\\(size_t\\)6'" } */
  45       q[3] = 'd';
  46       q[4] = 'e';
  47       q[5] = 'f';
  48       if (q == p)
  49         {
  50           /* "realloc" success, growing the buffer in-place.  */
  51           __analyzer_eval (p[0] == 'a'); /* { dg-warning "TRUE" } */
  52           __analyzer_eval (p[1] == 'b'); /* { dg-warning "TRUE" } */
  53           __analyzer_eval (p[2] == 'c'); /* { dg-warning "TRUE" } */
  54           // TODO
  55         }
  56       else
  57         {
  58           /* "realloc" success, moving the buffer (and thus freeing "p").  */
  59           __analyzer_eval (q[0] == 'a'); /* { dg-warning "TRUE" } */
  60           __analyzer_eval (q[1] == 'b'); /* { dg-warning "TRUE" } */
  61           __analyzer_eval (q[2] == 'c'); /* { dg-warning "TRUE" } */
  62           __analyzer_eval (p[0] == 'a'); /* { dg-warning "UNKNOWN" "unknown" } */
  63           /* { dg-warning "use after 'free' of 'p'" "use after free" { target *-*-* } .-1 } */
  64         }
  65       __analyzer_eval (q[3] == 'd'); /* { dg-warning "TRUE" } */
  66       __analyzer_eval (q[4] == 'e'); /* { dg-warning "TRUE" } */
  67       __analyzer_eval (q[5] == 'f'); /* { dg-warning "TRUE" } */
  68     }
  69   else
  70     {
  71       /* "realloc" failure.  p should be unchanged.  */
  72       __analyzer_dump_capacity (p); /* { dg-warning "capacity: '\\(size_t\\)3'" } */
  73       __analyzer_eval (p[0] == 'a'); /* { dg-warning "TRUE" } */
  74       __analyzer_eval (p[1] == 'b'); /* { dg-warning "TRUE" } */
  75       __analyzer_eval (p[2] == 'c'); /* { dg-warning "TRUE" } */
  76       return p;
  77     }
  78
  79   return q;
  80 }