1*67e74705SXin Li // RUN: %clang_cc1 -analyze -analyzer-checker=core,unix,core.uninitialized -analyzer-store=region -verify -analyzer-config unix:Optimistic=true %s 2*67e74705SXin Li typedef __typeof(sizeof(int)) size_t; 3*67e74705SXin Li void *malloc(size_t); 4*67e74705SXin Li void free(void *); 5*67e74705SXin Li stackBased1()6*67e74705SXin Lichar stackBased1 () { 7*67e74705SXin Li char buf[2]; 8*67e74705SXin Li buf[0] = 'a'; 9*67e74705SXin Li return buf[1]; // expected-warning{{Undefined}} 10*67e74705SXin Li } 11*67e74705SXin Li stackBased2()12*67e74705SXin Lichar stackBased2 () { 13*67e74705SXin Li char buf[2]; 14*67e74705SXin Li buf[1] = 'a'; 15*67e74705SXin Li return buf[0]; // expected-warning{{Undefined}} 16*67e74705SXin Li } 17*67e74705SXin Li 18*67e74705SXin Li // Exercise the conditional visitor. Radar://10105448 stackBased3(int * x)19*67e74705SXin Lichar stackBased3 (int *x) { 20*67e74705SXin Li char buf[2]; 21*67e74705SXin Li int *y; 22*67e74705SXin Li buf[0] = 'a'; 23*67e74705SXin Li if (!(y = x)) { 24*67e74705SXin Li return buf[1]; // expected-warning{{Undefined}} 25*67e74705SXin Li } 26*67e74705SXin Li return buf[0]; 27*67e74705SXin Li } 28*67e74705SXin Li heapBased1()29*67e74705SXin Lichar heapBased1 () { 30*67e74705SXin Li char *buf = malloc(2); 31*67e74705SXin Li buf[0] = 'a'; 32*67e74705SXin Li char result = buf[1]; // expected-warning{{undefined}} 33*67e74705SXin Li free(buf); 34*67e74705SXin Li return result; 35*67e74705SXin Li } 36*67e74705SXin Li heapBased2()37*67e74705SXin Lichar heapBased2 () { 38*67e74705SXin Li char *buf = malloc(2); 39*67e74705SXin Li buf[1] = 'a'; 40*67e74705SXin Li char result = buf[0]; // expected-warning{{undefined}} 41*67e74705SXin Li free(buf); 42*67e74705SXin Li return result; 43*67e74705SXin Li } 44