1  /* { dg-additional-options "-fanalyzer-fine-grained" }
       2     -fanalyzer-fine-grained is currently required; see PR analyzer/107851.  */
       3  
       4  /* { dg-additional-options -Wno-analyzer-out-of-bounds } */
       5  
       6  #include <stdlib.h>
       7  #include <stdio.h>
       8  #include <stdint.h>
       9  
      10  /* CWE-131 example 5 */
      11  void test_1 (void) 
      12  {
      13    int32_t *id_sequence = (int32_t *) malloc (3); /* { dg-line malloc1 } */
      14    if (id_sequence == NULL) exit (1);
      15  
      16    id_sequence[0] = 13579;
      17    id_sequence[1] = 24680;
      18    id_sequence[2] = 97531;
      19  
      20    free (id_sequence);
      21  
      22    /* { dg-warning "allocated buffer size is not a multiple of the pointee's size \\\[CWE-131\\\]" "warning" { target *-*-* } malloc1 } */
      23    /* { dg-message "3 bytes" "note" { target *-*-* } malloc1 } */
      24    /* { dg-message "'int32_t \\*' (\\\{aka '(long )?int \\*'\\\})? here; 'sizeof \\(int32_t (\\\{aka (long )?int\\\})?\\)' is '4'" "note" { target *-*-* } malloc1 } */
      25  }
      26  
      27  void test_2 (void)
      28  {
      29    int32_t *ptr = malloc (10 + sizeof(int32_t)); /* { dg-line malloc2 } */
      30    free (ptr);
      31  
      32    /* { dg-warning "allocated buffer size is not a multiple of the pointee's size \\\[CWE-131\\\]" "warning" { target *-*-* } malloc2 } */
      33    /* { dg-message "14 bytes" "note" { target *-*-* } malloc2 } */
      34    /* { dg-message "'int32_t \\*' (\\\{aka '(long )?int \\*'\\\})? here; 'sizeof \\(int32_t (\\\{aka (long )?int\\\})?\\)' is '4'" "note" { target *-*-* } malloc2 } */
      35  }
      36  
      37  void test_3 (int32_t n)
      38  {
      39    int32_t *ptr = malloc (n + sizeof (int32_t)); /* { dg-line malloc3 } */
      40    free (ptr);
      41  
      42    /* { dg-warning "allocated buffer size is not a multiple of the pointee's size \\\[CWE-131\\\]" "warning" { target *-*-* } malloc3 } */
      43    /* { dg-message "'\[a-z0-9\\+\\(\\)\\s\]*' bytes" "note" { target *-*-* } malloc3 } */
      44    /* { dg-message "'int32_t \\*' (\\\{aka '(long )?int \\*'\\\})? here; 'sizeof \\(int32_t (\\\{aka (long )?int\\\})?\\)' is '4'" "note" { target *-*-* } malloc3 } */
      45  }
      46  
      47  void test_4 (int32_t n, int32_t m)
      48  {
      49    int32_t *ptr = malloc ((n + m) * sizeof (int32_t));
      50    free (ptr);
      51  }