1  #include <stdlib.h>
       2  #include <stdio.h>
       3  #include <stdint.h>
       4  
       5  /* Tests with constant buffer sizes.  */
       6  
       7  void test_1 (void)
       8  {
       9    int16_t *ptr = malloc (21 * sizeof (int16_t));
      10    free (ptr);
      11  }
      12  
      13  void test_2 (void)
      14  {
      15    int32_t *ptr = malloc (21 * sizeof (int16_t)); /* { dg-line malloc2 } */
      16    free (ptr);
      17  
      18    /* { dg-warning "allocated buffer size is not a multiple of the pointee's size \\\[CWE-131\\\]" "warning" { target *-*-* } malloc2 } */
      19    /* { dg-message "42 bytes" "note" { target *-*-* } malloc2 } */
      20    /* { dg-message "'int32_t \\*' (\\\{aka '(long )?int \\*'\\\})? here; 'sizeof \\(int32_t (\\\{aka (long )?int\\\})?\\)' is '4'" "note" { target *-*-* } malloc2 } */
      21  }
      22  
      23  void test_3 (void)
      24  {
      25    void *ptr = malloc (21 * sizeof (int16_t));
      26    int16_t *sptr = (int16_t *)ptr;
      27    free (sptr);
      28  }
      29  
      30  void test_4 (void)
      31  {
      32    void *ptr = malloc (21 * sizeof (int16_t)); /* { dg-message "42 bytes" } */
      33    int32_t *iptr = (int32_t *)ptr; /* { dg-line assign4 } */
      34    free (iptr);
      35  
      36    /* { dg-warning "allocated buffer size is not a multiple of the pointee's size \\\[CWE-131\\\]" "warning" { target *-*-* } assign4 } */
      37    /* { dg-message "'int32_t \\*' (\\\{aka '(long )?int \\*'\\\})? here; 'sizeof \\(int32_t (\\\{aka (long )?int\\\})?\\)' is '4'" "note" { target *-*-* } assign4 } */
      38  }
      39  
      40  void test_5 (void)
      41  {
      42    int32_t user_input;
      43    scanf("%i", &user_input);
      44    int32_t n;
      45    if (user_input == 0)
      46      n = 21 * sizeof (int16_t);
      47    else
      48      n = 42 * sizeof (int16_t);
      49    void *ptr = malloc (n);
      50    int16_t *sptr = (int16_t *)ptr;
      51    free (sptr);
      52  }
      53  
      54  void test_6 (void)
      55  {
      56    int32_t user_input;
      57    scanf("%i", &user_input);
      58    int32_t n;
      59    if (user_input == 0)
      60      n = 21 * sizeof (int16_t);
      61    else
      62      n = 42 * sizeof (int16_t);
      63    void *ptr = malloc (n); /* { dg-message "" "note" } */
      64                            /* ^^^ on widening_svalues no expr is returned
      65                                   by get_representative_tree at the moment.  */ 
      66    int32_t *iptr = (int32_t *)ptr; /* { dg-line assign6 } */
      67    free (iptr);
      68  
      69    /* { dg-warning "allocated buffer size is not a multiple of the pointee's size \\\[CWE-131\\\]" "warning" { target *-*-* } assign6 } */
      70    /* { dg-message "'int32_t \\*' (\\\{aka '(long )?int \\*'\\\})? here; 'sizeof \\(int32_t (\\\{aka (long )?int\\\})?\\)' is '4'" "note" { target *-*-* } assign6 } */
      71  }
      72  
      73  void test_7 (void)
      74  {
      75    int32_t user_input;
      76    scanf("%i", &user_input);
      77    int32_t n;
      78    if (user_input == 0)
      79      n = 1;
      80    else if (user_input == 2)
      81      n = 5;
      82    else
      83      n = 7;
      84    /* n is an unknown_svalue at this point.  */
      85    void *ptr = malloc (n);
      86    int32_t *iptr = (int32_t *)ptr;
      87    free (iptr);
      88  }
      89  
      90  void *create_buffer (int32_t n)
      91  {
      92    return malloc(n);
      93  }
      94  
      95  void test_8 (void) 
      96  {
      97    int32_t *buf = create_buffer(4 * sizeof (int));
      98    free (buf);
      99  }
     100  
     101  void test_9 (void) 
     102  {
     103    /* FIXME: At the moment, region_model::set_value (lhs, <return_value>)
     104       is called at the src_node of the return edge. This edge has no stmts
     105       associated with it, leading to a rejection of the warning inside
     106       impl_region_model_context::warn. To ensure that the indentation
     107       in the diagnostic is right, the warning has to be emitted on an EN
     108       that is after the return edge.  */
     109    int32_t *buf = create_buffer(42); /* { dg-warning "" "" { xfail *-*-* } } */
     110    free (buf);
     111  }
     112  
     113  void test_10 (int32_t n)
     114  {
     115    char *ptr = malloc (7 * n);
     116    free (ptr);
     117  }
     118  
     119  void test_11 ()
     120  {
     121    /* 3.0 is folded to an int before the analyzer runs.  */
     122    int32_t *ptr = malloc (3.0); /* { dg-line malloc11 } */
     123    free (ptr);
     124  
     125    /* { dg-warning "allocated buffer size is not a multiple of the pointee's size \\\[CWE-131\\\]" "warning" { target *-*-* } malloc11 } */
     126    /* { dg-message "'int32_t \\*' (\\\{aka '(long )?int \\*'\\\})? here; 'sizeof \\(int32_t (\\\{aka (long )?int\\\})?\\)' is '4'" "note" { target *-*-* } malloc11 } */
     127  }