clang/test/Analysis/stream.c

// RUN: %clang_analyze_cc1 -triple=x86_64-pc-linux-gnu -analyzer-checker=core,unix.Stream,debug.ExprInspection \
// RUN:   -analyzer-config eagerly-assume=false,unix.Stream:Pedantic=true -verify %s
// RUN: %clang_analyze_cc1 -triple=armv8-none-linux-eabi -analyzer-checker=core,unix.Stream,debug.ExprInspection \
// RUN:   -analyzer-config eagerly-assume=false,unix.Stream:Pedantic=true -verify %s
// RUN: %clang_analyze_cc1 -triple=aarch64-linux-gnu -analyzer-checker=core,unix.Stream,debug.ExprInspection \
// RUN:   -analyzer-config eagerly-assume=false,unix.Stream:Pedantic=true -verify %s
// RUN: %clang_analyze_cc1 -triple=hexagon -analyzer-checker=core,unix.Stream,debug.ExprInspection \
// RUN:   -analyzer-config eagerly-assume=false,unix.Stream:Pedantic=true -verify %s

#include "Inputs/system-header-simulator.h"
#include "Inputs/system-header-simulator-for-malloc.h"
#include "Inputs/system-header-simulator-for-valist.h"

void clang_analyzer_eval(int);

void check_fread(void) {
  FILE *fp = tmpfile();
  fread(0, 0, 0, fp); // expected-warning {{Stream pointer might be NULL}}
  fclose(fp);
}

void check_fwrite(void) {
  FILE *fp = tmpfile();
  fwrite(0, 0, 0, fp); // expected-warning {{Stream pointer might be NULL}}
  fclose(fp);
}

void check_fgetc(void) {
  FILE *fp = tmpfile();
  fgetc(fp); // expected-warning {{Stream pointer might be NULL}}
  fclose(fp);
}

void check_fgets(void) {
  FILE *fp = tmpfile();
  char buf[256];
  fgets(buf, sizeof(buf), fp); // expected-warning {{Stream pointer might be NULL}}
  fclose(fp);
}

void check_fputc(void) {
  FILE *fp = tmpfile();
  fputc('A', fp); // expected-warning {{Stream pointer might be NULL}}
  fclose(fp);
}

void check_fputs(void) {
  FILE *fp = tmpfile();
  fputs("ABC", fp); // expected-warning {{Stream pointer might be NULL}}
  fclose(fp);
}

void check_fprintf(void) {
  FILE *fp = tmpfile();
  fprintf(fp, "ABC"); // expected-warning {{Stream pointer might be NULL}}
  fclose(fp);
}

void check_fscanf(void) {
  FILE *fp = tmpfile();
  fscanf(fp, "ABC"); // expected-warning {{Stream pointer might be NULL}}
  fclose(fp);
}

void check_ungetc(void) {
  FILE *fp = tmpfile();
  ungetc('A', fp); // expected-warning {{Stream pointer might be NULL}}
  fclose(fp);
}

void check_fseek(void) {
  FILE *fp = tmpfile();
  fseek(fp, 0, 0); // expected-warning {{Stream pointer might be NULL}}
  fclose(fp);
}

void check_fseeko(void) {
  FILE *fp = tmpfile();
  fseeko(fp, 0, 0); // expected-warning {{Stream pointer might be NULL}}
  fclose(fp);
}

void check_ftell(void) {
  FILE *fp = tmpfile();
  ftell(fp); // expected-warning {{Stream pointer might be NULL}}
  fclose(fp);
}

void check_ftello(void) {
  FILE *fp = tmpfile();
  ftello(fp); // expected-warning {{Stream pointer might be NULL}}
  fclose(fp);
}

void check_rewind(void) {
  FILE *fp = tmpfile();
  rewind(fp); // expected-warning {{Stream pointer might be NULL}}
  fclose(fp);
}

void check_fgetpos(void) {
  FILE *fp = tmpfile();
  fpos_t pos;
  fgetpos(fp, &pos); // expected-warning {{Stream pointer might be NULL}}
  fclose(fp);
}

void check_fsetpos(void) {
  FILE *fp = tmpfile();
  fpos_t pos;
  fsetpos(fp, &pos); // expected-warning {{Stream pointer might be NULL}}
  fclose(fp);
}

void check_clearerr(void) {
  FILE *fp = tmpfile();
  clearerr(fp); // expected-warning {{Stream pointer might be NULL}}
  fclose(fp);
}

void check_feof(void) {
  FILE *fp = tmpfile();
  feof(fp); // expected-warning {{Stream pointer might be NULL}}
  fclose(fp);
}

void check_ferror(void) {
  FILE *fp = tmpfile();
  ferror(fp); // expected-warning {{Stream pointer might be NULL}}
  fclose(fp);
}

void check_fileno(void) {
  FILE *fp = tmpfile();
  fileno(fp); // expected-warning {{Stream pointer might be NULL}}
  fclose(fp);
}

void f_open(void) {
  FILE *p = fopen("foo", "r");
  char buf[1024];
  fread(buf, 1, 1, p); // expected-warning {{Stream pointer might be NULL}}
  fclose(p);
}

void f_dopen(int fd) {
  FILE *F = fdopen(fd, "r");
  char buf[1024];
  fread(buf, 1, 1, F); // expected-warning {{Stream pointer might be NULL}}
  fclose(F);
}

void f_vfprintf(int fd, va_list args) {
  FILE *F = fdopen(fd, "r");
  vfprintf(F, "%d", args); // expected-warning {{Stream pointer might be NULL}}
  fclose(F);
}

void f_vfscanf(int fd, va_list args) {
  FILE *F = fdopen(fd, "r");
  vfscanf(F, "%u", args); // expected-warning {{Stream pointer might be NULL}}
  fclose(F);
}

void f_seek(void) {
  FILE *p = fopen("foo", "r");
  if (!p)
    return;
  fseek(p, 1, SEEK_SET); // no-warning
  fseek(p, 1, 3); // expected-warning {{The whence argument to fseek() should be SEEK_SET, SEEK_END, or SEEK_CUR}}
  fclose(p);
}

void f_seeko(void) {
  FILE *p = fopen("foo", "r");
  if (!p)
    return;
  fseeko(p, 1, SEEK_SET); // no-warning
  fseeko(p, 1, 3); // expected-warning {{The whence argument to fseek() should be SEEK_SET, SEEK_END, or SEEK_CUR}}
  fclose(p);
}

void f_double_close(void) {
  FILE *p = fopen("foo", "r");
  if (!p)
    return;
  fclose(p);
  fclose(p); // expected-warning {{Use of a stream that might be already closed}}
}

void f_double_close_alias(void) {
  FILE *p1 = fopen("foo", "r");
  if (!p1)
    return;
  FILE *p2 = p1;
  fclose(p1);
  fclose(p2); // expected-warning {{Use of a stream that might be already closed}}
}

void f_use_after_close(void) {
  FILE *p = fopen("foo", "r");
  if (!p)
    return;
  fclose(p);
  clearerr(p); // expected-warning {{Use of a stream that might be already closed}}
}

void f_open_after_close(void) {
  FILE *p = fopen("foo", "r");
  if (!p)
    return;
  fclose(p);
  p = fopen("foo", "r");
  if (!p)
    return;
  fclose(p);
}

void f_reopen_after_close(void) {
  FILE *p = fopen("foo", "r");
  if (!p)
    return;
  fclose(p);
  // Allow reopen after close.
  p = freopen("foo", "w", p);
  if (!p)
    return;
  fclose(p);
}

void f_leak(int c) {
  FILE *p = fopen("foo.c", "r");
  if (!p)
    return;
  if(c)
    return; // expected-warning {{Opened stream never closed. Potential resource leak}}
  fclose(p);
}

FILE *f_null_checked(void) {
  FILE *p = fopen("foo.c", "r");
  if (p)
    return p; // no-warning
  else
    return 0;
}

void pr7831(FILE *fp) {
  fclose(fp); // no-warning
}

// PR 8081 - null pointer crash when 'whence' is not an integer constant
void pr8081(FILE *stream, long offset, int whence) {
  fseek(stream, offset, whence);
}

void check_freopen_1(void) {
  FILE *f1 = freopen("foo.c", "r", (FILE *)0); // expected-warning {{Stream pointer might be NULL}}
  f1 = freopen(0, "w", (FILE *)0x123456);      // Do not report this as error.
}

void check_freopen_2(void) {
  FILE *f1 = fopen("foo.c", "r");
  if (f1) {
    FILE *f2 = freopen(0, "w", f1);
    if (f2) {
      // Check if f1 and f2 point to the same stream.
      fclose(f1);
      fclose(f2); // expected-warning {{Use of a stream that might be already closed}}
    } else {
      // Reopen failed.
      // f1 is non-NULL but points to a possibly invalid stream.
      rewind(f1); // expected-warning {{Stream might be invalid}}
      // f2 is NULL but the previous error stops the checker.
      rewind(f2);
    }
  }
}

void check_freopen_3(void) {
  FILE *f1 = fopen("foo.c", "r");
  if (f1) {
    // Unchecked result of freopen.
    // The f1 may be invalid after this call.
    freopen(0, "w", f1);
    rewind(f1); // expected-warning {{Stream might be invalid}}
    fclose(f1);
  }
}

extern FILE *GlobalF;
extern void takeFile(FILE *);

void check_escape1(void) {
  FILE *F = tmpfile();
  if (!F)
    return;
  fwrite("1", 1, 1, F); // may fail
  GlobalF = F;
  fwrite("1", 1, 1, F); // no warning
}

void check_escape2(void) {
  FILE *F = tmpfile();
  if (!F)
    return;
  fwrite("1", 1, 1, F); // may fail
  takeFile(F);
  fwrite("1", 1, 1, F); // no warning
}

void check_escape3(void) {
  FILE *F = tmpfile();
  if (!F)
    return;
  takeFile(F);
  F = freopen(0, "w", F);
  if (!F)
    return;
  fwrite("1", 1, 1, F); // may fail
  fwrite("1", 1, 1, F); // no warning
}

void check_escape4(void) {
  FILE *F = tmpfile();
  if (!F)
    return;
  fwrite("1", 1, 1, F); // may fail

  // no escape at a non-StreamChecker-handled system call
  setbuf(F, "0");

  fwrite("1", 1, 1, F); // expected-warning {{might be 'indeterminate'}}
  fclose(F);
}

int Test;
_Noreturn void handle_error(void);

void check_leak_noreturn_1(void) {
  FILE *F1 = tmpfile();
  if (!F1)
    return;
  if (Test == 1) {
    handle_error(); // no warning
  }
  rewind(F1);
} // expected-warning {{Opened stream never closed. Potential resource leak}}

// Check that "location uniqueing" works.
// This results in reporting only one occurence of resource leak for a stream.
void check_leak_noreturn_2(void) {
  FILE *F1 = tmpfile();
  if (!F1)
    return;
  if (Test == 1) {
    return; // no warning
  }
  rewind(F1);
} // expected-warning {{Opened stream never closed. Potential resource leak}}
// FIXME: This warning should be placed at the `return` above.
// See https://reviews.llvm.org/D83120 about details.

void fflush_after_fclose(void) {
  FILE *F = tmpfile();
  int Ret;
  fflush(NULL);                      // no-warning
  if (!F)
    return;
  if ((Ret = fflush(F)) != 0)
    clang_analyzer_eval(Ret == EOF); // expected-warning {{TRUE}}
  fclose(F);
  fflush(F);                         // expected-warning {{Use of a stream that might be already closed}}
}

void fflush_on_open_failed_stream(void) {
  FILE *F = tmpfile();
  if (!F) {
    fflush(F); // no-warning
    return;
  }
  fclose(F);
}

void getline_null_file() {
  char *buffer = NULL;
  size_t n = 0;
  getline(&buffer, &n, NULL); // expected-warning {{Stream pointer might be NULL}}
}

void getdelim_null_file() {
  char *buffer = NULL;
  size_t n = 0;
  getdelim(&buffer, &n, '\n', NULL); // expected-warning {{Stream pointer might be NULL}}
}

void getline_buffer_on_error() {
  FILE *file = fopen("file.txt", "r");
  if (file == NULL) {
    return;
  }

  char *line = NULL;
  size_t len = 0;
  if (getline(&line, &len, file) == -1) {
    if (line[0] == '\0') {} // expected-warning {{The left operand of '==' is a garbage value}}
  } else {
    if (line[0] == '\0') {} // no warning
  }

  free(line);
  fclose(file);
}

void getline_ret_value() {
  FILE *file = fopen("file.txt", "r");
  if (file == NULL) {
    return;
  }

  size_t n = 0;
  char *buffer = NULL;
  ssize_t r = getline(&buffer, &n, file);

  if (r > -1) {
    // The return value does *not* include the terminating null byte.
    // The buffer must be large enough to include it.
    clang_analyzer_eval(n > r); // expected-warning{{TRUE}}
    clang_analyzer_eval(buffer != NULL);  // expected-warning{{TRUE}}
  }

  fclose(file);
  free(buffer);
}


void getline_buffer_size_negative() {
  FILE *file = fopen("file.txt", "r");
  if (file == NULL) {
    return;
  }

  size_t n = -1;
  clang_analyzer_eval((ssize_t)n >= 0); // expected-warning{{FALSE}}
  char *buffer = NULL;
  ssize_t r = getline(&buffer, &n, file);

  if (r > -1) {
    clang_analyzer_eval((ssize_t)n > r); // expected-warning{{TRUE}}
    clang_analyzer_eval(buffer != NULL);  // expected-warning{{TRUE}}
  }

  free(buffer);
  fclose(file);
}

void gh_93408_regression(void *buffer) {
  FILE *f = fopen("/tmp/foo.txt", "r");
  fread(buffer, 1, 1, f); // expected-warning {{Stream pointer might be NULL}} no-crash
  fclose(f);
}

typedef void VOID;
void gh_93408_regression_typedef(VOID *buffer) {
  FILE *f = fopen("/tmp/foo.txt", "r");
  fread(buffer, 1, 1, f); // expected-warning {{Stream pointer might be NULL}} no-crash
  fclose(f);
}

struct FAM {
  int data;
  int tail[];
};

struct FAM0 {
  int data;
  int tail[0];
};

void gh_93408_regression_FAM(struct FAM *p) {
  FILE *f = fopen("/tmp/foo.txt", "r");
  fread(p->tail, 1, 1, f); // expected-warning {{Stream pointer might be NULL}}
  fclose(f);
}

void gh_93408_regression_FAM0(struct FAM0 *p) {
  FILE *f = fopen("/tmp/foo.txt", "r");
  fread(p->tail, 1, 1, f); // expected-warning {{Stream pointer might be NULL}}
  fclose(f);
}

struct ZeroSized {
    int data[0];
};

void gh_93408_regression_ZeroSized(struct ZeroSized *buffer) {
  FILE *f = fopen("/tmp/foo.txt", "r");
  fread(buffer, 1, 1, f); // expected-warning {{Stream pointer might be NULL}} no-crash
  fclose(f);
}

extern FILE *non_standard_stream_ptr;
void test_fopen_does_not_alias_with_standard_streams(void) {
  FILE *f = fopen("file", "r");
  if (!f) return;
  clang_analyzer_eval(f == stdin);  // expected-warning {{FALSE}} no-TRUE
  clang_analyzer_eval(f == stdout); // expected-warning {{FALSE}} no-TRUE
  clang_analyzer_eval(f == stderr); // expected-warning {{FALSE}} no-TRUE
  clang_analyzer_eval(f == non_standard_stream_ptr); // expected-warning {{UNKNOWN}}
  if (f != stdout) {
    fclose(f);
  }
} // no-leak: 'fclose()' is always called because 'f' cannot be 'stdout'.

void reopen_std_stream(void) {
  FILE *oldStdout = stdout;
  fclose(stdout);
  FILE *fp = fopen("blah", "w");
  if (!fp) return;

  stdout = fp; // Let's make them alias.
  clang_analyzer_eval(fp == oldStdout);     // expected-warning {{UNKNOWN}}
  clang_analyzer_eval(fp == stdout);        // expected-warning {{TRUE}} no-FALSE
  clang_analyzer_eval(oldStdout == stdout); // expected-warning {{UNKNOWN}}
}

void only_success_path_does_not_alias_with_stdout(void) {
  if (stdout) return;
  FILE *f = fopen("/tmp/foof", "r"); // no-crash
  if (!f) return;
  fclose(f);
}