Author: Balazs Benics Date: 2021-03-10T12:42:23+01:00 New Revision: 0dc0e2a9ab3cc6be3d4012ea861f54e69854472d
URL: https://github.com/llvm/llvm-project/commit/0dc0e2a9ab3cc6be3d4012ea861f54e69854472d DIFF: https://github.com/llvm/llvm-project/commit/0dc0e2a9ab3cc6be3d4012ea861f54e69854472d.diff LOG: [analyzer][NFC] Add more tests for ArrayBoundCheckerV2 According to a Bugzilla ticket (https://bugs.llvm.org/show_bug.cgi?id=45148), ArrayBoundCheckerV2 produces a false-positive report. This patch adds a test demonstrating the current //flawed// behavior. Also adds several similar test cases just to be on the safe side. Reviewed By: martong Differential Revision: https://reviews.llvm.org/D86870 Added: clang/test/Analysis/out-of-bounds-false-positive.c Modified: Removed: ################################################################################ diff --git a/clang/test/Analysis/out-of-bounds-false-positive.c b/clang/test/Analysis/out-of-bounds-false-positive.c new file mode 100644 index 000000000000..3e8071449250 --- /dev/null +++ b/clang/test/Analysis/out-of-bounds-false-positive.c @@ -0,0 +1,101 @@ +// RUN: %clang_analyze_cc1 -analyzer-checker=core,alpha.security.ArrayBoundV2,debug.ExprInspection \ +// RUN: -analyzer-config eagerly-assume=false -verify %s + +void clang_analyzer_eval(int); +void clang_analyzer_printState(); + +typedef unsigned long long size_t; +const char a[] = "abcd"; // extent: 5 bytes + +void symbolic_size_t_and_int0(size_t len) { + // FIXME: Should not warn for this. + (void)a[len + 1]; // expected-warning {{Out of bound memory access}} + // We infered that the 'len' must be in a specific range to make the previous indexing valid. + // len: [0,3] + clang_analyzer_eval(len <= 3); // expected - warning {{TRUE}} + clang_analyzer_eval(len <= 2); // expected - warning {{UNKNOWN}} +} + +void symbolic_size_t_and_int1(size_t len) { + (void)a[len]; // no-warning + // len: [0,4] + clang_analyzer_eval(len <= 4); // expected-warning {{TRUE}} + clang_analyzer_eval(len <= 3); // expected-warning {{UNKNOWN}} +} + +void symbolic_size_t_and_int2(size_t len) { + (void)a[len - 1]; // no-warning + // len: [1,5] + clang_analyzer_eval(1 <= len && len <= 5); // expected-warning {{TRUE}} + clang_analyzer_eval(2 <= len); // expected-warning {{UNKNOWN}} + clang_analyzer_eval(len <= 4); // expected-warning {{UNKNOWN}} +} + +void symbolic_uint_and_int0(unsigned len) { + (void)a[len + 1]; // no-warning + // len: [0,3] + clang_analyzer_eval(0 <= len && len <= 3); // expected-warning {{TRUE}} + clang_analyzer_eval(1 <= len); // expected-warning {{UNKNOWN}} + clang_analyzer_eval(len <= 2); // expected-warning {{UNKNOWN}} +} + +void symbolic_uint_and_int1(unsigned len) { + (void)a[len]; // no-warning + // len: [0,4] + clang_analyzer_eval(0 <= len && len <= 4); // expected-warning {{TRUE}} + clang_analyzer_eval(1 <= len); // expected-warning {{UNKNOWN}} + clang_analyzer_eval(len <= 3); // expected-warning {{UNKNOWN}} +} +void symbolic_uint_and_int2(unsigned len) { + (void)a[len - 1]; // no-warning + // len: [1,5] + clang_analyzer_eval(1 <= len && len <= 5); // expected-warning {{TRUE}} + clang_analyzer_eval(2 <= len); // expected-warning {{UNKNOWN}} + clang_analyzer_eval(len <= 4); // expected-warning {{UNKNOWN}} +} + +void symbolic_int_and_int0(int len) { + (void)a[len + 1]; // no-warning + // len: [-1,3] + clang_analyzer_eval(-1 <= len && len <= 3); // expected-warning {{TRUE}} + clang_analyzer_eval(0 <= len); // expected-warning {{UNKNOWN}} + clang_analyzer_eval(len <= 2); // expected-warning {{UNKNOWN}} +} +void symbolic_int_and_int1(int len) { + (void)a[len]; // no-warning + // len: [0,4] + clang_analyzer_eval(0 <= len && len <= 4); // expected-warning {{TRUE}} + clang_analyzer_eval(1 <= len); // expected-warning {{UNKNOWN}} + clang_analyzer_eval(len <= 3); // expected-warning {{UNKNOWN}} +} +void symbolic_int_and_int2(int len) { + (void)a[len - 1]; // no-warning + // len: [1,5] + clang_analyzer_eval(1 <= len && len <= 5); // expected-warning {{TRUE}} + clang_analyzer_eval(2 <= len); // expected-warning {{UNKNOWN}} + clang_analyzer_eval(len <= 4); // expected-warning {{UNKNOWN}} +} + +void symbolic_longlong_and_int0(long long len) { + (void)a[len + 1]; // no-warning + // len: [-1,3] + clang_analyzer_eval(-1 <= len && len <= 3); // expected-warning {{TRUE}} + clang_analyzer_eval(0 <= len); // expected-warning {{UNKNOWN}} + clang_analyzer_eval(len <= 2); // expected-warning {{UNKNOWN}} +} + +void symbolic_longlong_and_int1(long long len) { + (void)a[len]; // no-warning + // len: [0,4] + clang_analyzer_eval(0 <= len && len <= 4); // expected-warning {{TRUE}} + clang_analyzer_eval(1 <= len); // expected-warning {{UNKNOWN}} + clang_analyzer_eval(len <= 3); // expected-warning {{UNKNOWN}} +} + +void symbolic_longlong_and_int2(long long len) { + (void)a[len - 1]; // no-warning + // len: [1,5] + clang_analyzer_eval(1 <= len && len <= 5); // expected-warning {{TRUE}} + clang_analyzer_eval(2 <= len); // expected-warning {{UNKNOWN}} + clang_analyzer_eval(len <= 4); // expected-warning {{UNKNOWN}} +} _______________________________________________ cfe-commits mailing list cfe-commits@lists.llvm.org https://lists.llvm.org/cgi-bin/mailman/listinfo/cfe-commits
