1*67e74705SXin Li // RUN: %clang_cc1 -analyze -analyzer-checker=unix.MallocSizeof -verify %s
2*67e74705SXin Li
3*67e74705SXin Li #include <stddef.h>
4*67e74705SXin Li
5*67e74705SXin Li void *malloc(size_t size);
6*67e74705SXin Li void *calloc(size_t nmemb, size_t size);
7*67e74705SXin Li void *realloc(void *ptr, size_t size);
8*67e74705SXin Li void free(void *ptr);
9*67e74705SXin Li
10*67e74705SXin Li struct A {};
11*67e74705SXin Li struct B {};
12*67e74705SXin Li
foo(unsigned int unsignedInt,unsigned int readSize)13*67e74705SXin Li void foo(unsigned int unsignedInt, unsigned int readSize) {
14*67e74705SXin Li int *ip1 = malloc(sizeof(1));
15*67e74705SXin Li int *ip2 = malloc(4 * sizeof(int));
16*67e74705SXin Li
17*67e74705SXin Li long *lp1 = malloc(sizeof(short)); // expected-warning {{Result of 'malloc' is converted to a pointer of type 'long', which is incompatible with sizeof operand type 'short'}}
18*67e74705SXin Li long *lp2 = malloc(5 * sizeof(double)); // expected-warning {{Result of 'malloc' is converted to a pointer of type 'long', which is incompatible with sizeof operand type 'double'}}
19*67e74705SXin Li char *cp3 = malloc(5 * sizeof(char) + 2); // no warning
20*67e74705SXin Li unsigned char *buf = malloc(readSize + sizeof(unsignedInt)); // no warning
21*67e74705SXin Li
22*67e74705SXin Li struct A *ap1 = calloc(1, sizeof(struct A));
23*67e74705SXin Li struct A *ap2 = calloc(2, sizeof(*ap1));
24*67e74705SXin Li struct A *ap3 = calloc(2, sizeof(ap1)); // expected-warning {{Result of 'calloc' is converted to a pointer of type 'struct A', which is incompatible with sizeof operand type 'struct A *'}}
25*67e74705SXin Li struct A *ap4 = calloc(3, sizeof(struct A*)); // expected-warning {{Result of 'calloc' is converted to a pointer of type 'struct A', which is incompatible with sizeof operand type 'struct A *'}}
26*67e74705SXin Li struct A *ap5 = calloc(4, sizeof(struct B)); // expected-warning {{Result of 'calloc' is converted to a pointer of type 'struct A', which is incompatible with sizeof operand type 'struct B'}}
27*67e74705SXin Li struct A *ap6 = realloc(ap5, sizeof(struct A));
28*67e74705SXin Li struct A *ap7 = realloc(ap5, sizeof(struct B)); // expected-warning {{Result of 'realloc' is converted to a pointer of type 'struct A', which is incompatible with sizeof operand type 'struct B'}}
29*67e74705SXin Li }
30*67e74705SXin Li
31*67e74705SXin Li // Don't warn when the types differ only by constness.
ignore_const()32*67e74705SXin Li void ignore_const() {
33*67e74705SXin Li const char **x = (const char **)malloc(1 * sizeof(char *)); // no-warning
34*67e74705SXin Li const char ***y = (const char ***)malloc(1 * sizeof(char *)); // expected-warning {{Result of 'malloc' is converted to a pointer of type 'const char **', which is incompatible with sizeof operand type 'char *'}}
35*67e74705SXin Li free(x);
36*67e74705SXin Li }
37*67e74705SXin Li
mallocArraySize()38*67e74705SXin Li int *mallocArraySize() {
39*67e74705SXin Li static const int sTable[10];
40*67e74705SXin Li static const int nestedTable[10][2];
41*67e74705SXin Li int *table = malloc(sizeof sTable);
42*67e74705SXin Li int *table1 = malloc(sizeof nestedTable);
43*67e74705SXin Li int (*table2)[2] = malloc(sizeof nestedTable);
44*67e74705SXin Li int (*table3)[10][2] = malloc(sizeof nestedTable);
45*67e74705SXin Li return table;
46*67e74705SXin Li }
47*67e74705SXin Li
mallocWrongArraySize()48*67e74705SXin Li int *mallocWrongArraySize() {
49*67e74705SXin Li static const double sTable[10];
50*67e74705SXin Li int *table = malloc(sizeof sTable); // expected-warning {{Result of 'malloc' is converted to a pointer of type 'int', which is incompatible with sizeof operand type 'const double [10]'}}
51*67e74705SXin Li return table;
52*67e74705SXin Li }
53