1*67e74705SXin Li // RUN: %clang_cc1 -analyze -analyzer-checker=core -analyzer-config suppress-inlined-defensive-checks=true -verify %s
2*67e74705SXin Li
3*67e74705SXin Li // Perform inline defensive checks.
idc(int * p)4*67e74705SXin Li void idc(int *p) {
5*67e74705SXin Li if (p)
6*67e74705SXin Li ;
7*67e74705SXin Li }
8*67e74705SXin Li
test01(int * p)9*67e74705SXin Li int test01(int *p) {
10*67e74705SXin Li if (p)
11*67e74705SXin Li ;
12*67e74705SXin Li return *p; // expected-warning {{Dereference of null pointer}}
13*67e74705SXin Li }
14*67e74705SXin Li
test02(int * p,int * x)15*67e74705SXin Li int test02(int *p, int *x) {
16*67e74705SXin Li if (p)
17*67e74705SXin Li ;
18*67e74705SXin Li idc(p);
19*67e74705SXin Li if (x)
20*67e74705SXin Li ;
21*67e74705SXin Li return *p; // expected-warning {{Dereference of null pointer}}
22*67e74705SXin Li }
23*67e74705SXin Li
test03(int * p,int * x)24*67e74705SXin Li int test03(int *p, int *x) {
25*67e74705SXin Li idc(p);
26*67e74705SXin Li if (p)
27*67e74705SXin Li ;
28*67e74705SXin Li return *p; // False negative
29*67e74705SXin Li }
30*67e74705SXin Li
deref04(int * p)31*67e74705SXin Li int deref04(int *p) {
32*67e74705SXin Li return *p; // expected-warning {{Dereference of null pointer}}
33*67e74705SXin Li }
34*67e74705SXin Li
test04(int * p)35*67e74705SXin Li int test04(int *p) {
36*67e74705SXin Li if (p)
37*67e74705SXin Li ;
38*67e74705SXin Li idc(p);
39*67e74705SXin Li return deref04(p);
40*67e74705SXin Li }
41*67e74705SXin Li
test11(int * q,int * x)42*67e74705SXin Li int test11(int *q, int *x) {
43*67e74705SXin Li int *p = q;
44*67e74705SXin Li if (q)
45*67e74705SXin Li ;
46*67e74705SXin Li if (x)
47*67e74705SXin Li ;
48*67e74705SXin Li return *p; // expected-warning{{Dereference of null pointer}}
49*67e74705SXin Li }
50*67e74705SXin Li
test12(int * q)51*67e74705SXin Li int test12(int *q) {
52*67e74705SXin Li int *p = q;
53*67e74705SXin Li idc(q);
54*67e74705SXin Li return *p;
55*67e74705SXin Li }
56*67e74705SXin Li
test13(int * q)57*67e74705SXin Li int test13(int *q) {
58*67e74705SXin Li int *p = q;
59*67e74705SXin Li idc(p);
60*67e74705SXin Li return *p;
61*67e74705SXin Li }
62*67e74705SXin Li
test21(int * q,int * x)63*67e74705SXin Li int test21(int *q, int *x) {
64*67e74705SXin Li if (q)
65*67e74705SXin Li ;
66*67e74705SXin Li if (x)
67*67e74705SXin Li ;
68*67e74705SXin Li int *p = q;
69*67e74705SXin Li return *p; // expected-warning{{Dereference of null pointer}}
70*67e74705SXin Li }
71*67e74705SXin Li
test22(int * q,int * x)72*67e74705SXin Li int test22(int *q, int *x) {
73*67e74705SXin Li idc(q);
74*67e74705SXin Li if (x)
75*67e74705SXin Li ;
76*67e74705SXin Li int *p = q;
77*67e74705SXin Li return *p;
78*67e74705SXin Li }
79*67e74705SXin Li
test23(int * q,int * x)80*67e74705SXin Li int test23(int *q, int *x) {
81*67e74705SXin Li idc(q);
82*67e74705SXin Li if (x)
83*67e74705SXin Li ;
84*67e74705SXin Li int *p = q;
85*67e74705SXin Li if (!p)
86*67e74705SXin Li ;
87*67e74705SXin Li return *p; // False negative
88*67e74705SXin Li }
89*67e74705SXin Li
use(char * p)90*67e74705SXin Li void use(char *p) {
91*67e74705SXin Li if (!p)
92*67e74705SXin Li return;
93*67e74705SXin Li p[0] = 'a';
94*67e74705SXin Li }
95*67e74705SXin Li
test24(char * buffer)96*67e74705SXin Li void test24(char *buffer) {
97*67e74705SXin Li use(buffer);
98*67e74705SXin Li buffer[1] = 'b';
99*67e74705SXin Li }
100*67e74705SXin Li
101*67e74705SXin Li // Ensure idc works on pointers with constant offset.
idcchar(const char * s2)102*67e74705SXin Li void idcchar(const char *s2) {
103*67e74705SXin Li if(s2)
104*67e74705SXin Li ;
105*67e74705SXin Li }
testConstantOffset(char * value)106*67e74705SXin Li void testConstantOffset(char *value) {
107*67e74705SXin Li char *cursor = value + 5;
108*67e74705SXin Li idcchar(cursor);
109*67e74705SXin Li if (*cursor) {
110*67e74705SXin Li cursor++;
111*67e74705SXin Li }
112*67e74705SXin Li }
113*67e74705SXin Li
114*67e74705SXin Li // Ensure idc works for integer zero values (ex: suppressed div by zero).
idcZero(int assume)115*67e74705SXin Li void idcZero(int assume) {
116*67e74705SXin Li if (assume)
117*67e74705SXin Li ;
118*67e74705SXin Li }
119*67e74705SXin Li
idcTriggerZeroValue(int m)120*67e74705SXin Li int idcTriggerZeroValue(int m) {
121*67e74705SXin Li idcZero(m);
122*67e74705SXin Li return 5/m; // no-warning
123*67e74705SXin Li }
124*67e74705SXin Li
idcTriggerZeroValueThroughCall(int i)125*67e74705SXin Li int idcTriggerZeroValueThroughCall(int i) {
126*67e74705SXin Li return 5/i; // no-warning
127*67e74705SXin Li }
idcTrackZeroValueThroughCall(int x)128*67e74705SXin Li void idcTrackZeroValueThroughCall(int x) {
129*67e74705SXin Li idcZero(x);
130*67e74705SXin Li idcTriggerZeroValueThroughCall(x);
131*67e74705SXin Li }
132*67e74705SXin Li
idcTriggerZeroThroughDoubleAssignemnt(int i)133*67e74705SXin Li int idcTriggerZeroThroughDoubleAssignemnt(int i) {
134*67e74705SXin Li return 5/i; // no-warning
135*67e74705SXin Li }
idcTrackZeroThroughDoubleAssignemnt(int x)136*67e74705SXin Li void idcTrackZeroThroughDoubleAssignemnt(int x) {
137*67e74705SXin Li idcZero(x);
138*67e74705SXin Li int y = x;
139*67e74705SXin Li int z = y;
140*67e74705SXin Li idcTriggerZeroValueThroughCall(z);
141*67e74705SXin Li }
142