gcc/testsuite/c-c++-common/analyzer/malloc-ipa-8-unchecked.c

   1 /* Example of a multilevel wrapper around malloc, with an unchecked write.  */
   2
   3 /* { dg-additional-options "-fdiagnostics-show-line-numbers -fdiagnostics-path-format=inline-events -fanalyzer-checker=malloc -fdiagnostics-show-caret" } */
   4 /* { dg-enable-nn-line-numbers "" } */
   5
   6 #include <stdlib.h>
   7
   8 void *wrapped_malloc (size_t size)
   9 {
  10   return malloc (size);
  11 }
  12
  13 typedef struct boxed_int
  14 {
  15   int i;
  16 } boxed_int;
  17
  18 boxed_int *
  19 make_boxed_int (int i)
  20 {
  21   boxed_int *result = (boxed_int *)wrapped_malloc (sizeof (boxed_int));
  22   result->i = i; /* { dg-warning "dereference of possibly-NULL 'result'" } */
  23   return result;
  24 }
  25
  26 /* "dereference of possibly-NULL 'result' [CWE-690]".  */
  27 /* { dg-begin-multiline-output "" }
  28    NN |   result->i = i;
  29       |   ~~~~~~~~~~^~~
  30   'make_boxed_int': events 1-2
  31     |
  32     |   NN | make_boxed_int (int i)
  33     |      | ^~~~~~~~~~~~~~
  34     |      | |
  35     |      | (1) entry to 'make_boxed_int'
  36     |   NN | {
  37     |   NN |   boxed_int *result = (boxed_int *)wrapped_malloc (sizeof (boxed_int));
  38     |      |                                    ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
  39     |      |                                    |
  40     |      |                                    (2) calling 'wrapped_malloc' from 'make_boxed_int'
  41     |
  42     +--> 'wrapped_malloc': events 3-4
  43            |
  44            |   NN | void *wrapped_malloc (size_t size)
  45            |      |       ^~~~~~~~~~~~~~
  46            |      |       |
  47            |      |       (3) entry to 'wrapped_malloc'
  48            |   NN | {
  49            |   NN |   return malloc (size);
  50            |      |          ~~~~~~~~~~~~~
  51            |      |          |
  52            |      |          (4) this call could return NULL
  53            |
  54     <------+
  55     |
  56   'make_boxed_int': events 5-6
  57     |
  58     |   NN |   boxed_int *result = (boxed_int *)wrapped_malloc (sizeof (boxed_int));
  59     |      |                                    ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
  60     |      |                                    |
  61     |      |                                    (5) possible return of NULL to 'make_boxed_int' from 'wrapped_malloc'
  62     |   NN |   result->i = i;
  63     |      |   ~~~~~~~~~~~~~
  64     |      |             |
  65     |      |             (6) 'result' could be NULL: unchecked value from (4)
  66     |
  67   { dg-end-multiline-output "" { target c } } */
  68 /* { dg-begin-multiline-output "" }
  69    NN |   result->i = i;
  70       |   ~~~~~~~~~~^~~
  71   'boxed_int* make_boxed_int(int)': events 1-2
  72     |
  73     |   NN | make_boxed_int (int i)
  74     |      | ^~~~~~~~~~~~~~
  75     |      | |
  76     |      | (1) entry to 'make_boxed_int'
  77     |   NN | {
  78     |   NN |   boxed_int *result = (boxed_int *)wrapped_malloc (sizeof (boxed_int));
  79     |      |                                    ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
  80     |      |                                                   |
  81     |      |                                                   (2) calling 'wrapped_malloc' from 'make_boxed_int'
  82     |
  83     +--> 'void* wrapped_malloc(size_t)': events 3-4
  84            |
  85            |   NN | void *wrapped_malloc (size_t size)
  86            |      |       ^~~~~~~~~~~~~~
  87            |      |       |
  88            |      |       (3) entry to 'wrapped_malloc'
  89            |   NN | {
  90            |   NN |   return malloc (size);
  91            |      |          ~~~~~~~~~~~~~
  92            |      |                 |
  93            |      |                 (4) this call could return NULL
  94            |
  95     <------+
  96     |
  97   'boxed_int* make_boxed_int(int)': events 5-6
  98     |
  99     |   NN |   boxed_int *result = (boxed_int *)wrapped_malloc (sizeof (boxed_int));
 100     |      |                                    ~~~~~~~~~~~~~~~^~~~~~~~~~~~~~~~~~~~
 101     |      |                                                   |
 102     |      |                                                   (5) possible return of NULL to 'make_boxed_int' from 'wrapped_malloc'
 103     |   NN |   result->i = i;
 104     |      |   ~~~~~~~~~~~~~
 105     |      |             |
 106     |      |             (6) 'result' could be NULL: unchecked value from (4)
 107     |
 108   { dg-end-multiline-output "" { target c++ } } */