clang/test/Analysis/return-ptr-range.cpp

// RUN: %clang_analyze_cc1 -analyzer-checker=core,alpha.security.ReturnPtrRange -analyzer-output text -verify %s

int conjure_index();

namespace test_element_index_lifetime {

int arr[10]; // expected-note{{Original object declared here}} expected-note{{Original object declared here}}
int *ptr;

int *test_global_ptr() {
  do { // expected-note{{Loop condition is false.  Exiting loop}}
    int x = conjure_index();
    ptr = arr + x; // expected-note{{Value assigned to 'ptr'}}
    if (x != 20) // expected-note{{Assuming 'x' is equal to 20}}
                 // expected-note@-1{{Taking false branch}}
      return arr; // no-warning
  } while(0);
  return ptr; // expected-warning{{Returned pointer value points outside the original object (potential buffer overflow) [alpha.security.ReturnPtrRange]}}
              // expected-note@-1{{Returned pointer value points outside the original object (potential buffer overflow)}}
              // expected-note@-2{{Original object 'arr' is an array of 10 'int' objects}}
}

int *test_local_ptr() {
  int *local_ptr;
  do { // expected-note{{Loop condition is false.  Exiting loop}}
    int x = conjure_index();
    local_ptr = arr + x; // expected-note{{Value assigned to 'local_ptr'}}
    if (x != 20) // expected-note{{Assuming 'x' is equal to 20}}
                 // expected-note@-1{{Taking false branch}}
      return arr; // no-warning
  } while(0);
  return local_ptr; // expected-warning{{Returned pointer value points outside the original object (potential buffer overflow) [alpha.security.ReturnPtrRange]}}
                    // expected-note@-1{{Returned pointer value points outside the original object (potential buffer overflow)}}
                    // expected-note@-2{{Original object 'arr' is an array of 10 'int' objects}}
}

}

template <typename T, int N>
T* end(T (&arr)[N]) {
  return arr + N; // no-warning, because we want to avoid false positives on returning the end() iterator of a container.
}

void get_end_of_array() {
  static int arr[10];
  end(arr);
}

template <int N>
class Iterable {
  int buffer[N];
  int *start, *finish;

public:
  Iterable() : start(buffer), finish(buffer + N) {}

  int* begin() { return start; }
  int* end() { return finish; }
};

void use_iterable_object() {
  Iterable<20> iter;
  iter.end();
}

template <int N>
class BadIterable {
  int buffer[N]; // expected-note{{Original object declared here}}
  int *start, *finish;

public:
  BadIterable() : start(buffer), finish(buffer + N) {} // expected-note{{Value assigned to 'iter.finish'}}

  int* begin() { return start; }
  int* end() { return finish + 1; } // expected-warning{{Returned pointer value points outside the original object}}
                                    // expected-note@-1{{Returned pointer value points outside the original object}}
                                    // expected-note@-2{{Original object 'buffer' is an array of 20 'int' objects, returned pointer points at index 21}}
};

void use_bad_iterable_object() {
  BadIterable<20> iter; // expected-note{{Calling default constructor for 'BadIterable<20>'}}
                        // expected-note@-1{{Returning from default constructor for 'BadIterable<20>'}}
  iter.end(); // expected-note{{Calling 'BadIterable::end'}}
}

int *test_idx_sym(int I) {
  static int arr[10]; // expected-note{{Original object declared here}} expected-note{{'arr' initialized here}}

  if (I != 11) // expected-note{{Assuming 'I' is equal to 11}}
               // expected-note@-1{{Taking false branch}}
    return arr;
  return arr + I; // expected-warning{{Returned pointer value points outside the original object}}
                  // expected-note@-1{{Returned pointer value points outside the original object}}
                  // expected-note@-2{{Original object 'arr' is an array of 10 'int' objects, returned pointer points at index 11}}
}

namespace test_array_of_struct {

struct Data {
  int A;
  char *B;
};

Data DataArr[10]; // expected-note{{Original object declared here}}

Data *test_struct_array() {
  int I = conjure_index();
  if (I != 11) // expected-note{{Assuming 'I' is equal to 11}}
               // expected-note@-1{{Taking false branch}}
    return DataArr;
  return DataArr + I; // expected-warning{{Returned pointer value points outside the original object}}
                      // expected-note@-1{{Returned pointer value points outside the original object}}
                      // expected-note@-2{{Original object 'DataArr' is an array of 10 'test_array_of_struct::Data' objects, returned pointer points at index 11}}
}

}