1  #include <stdlib.h>
       2  #include "analyzer-decls.h"
       3  
       4  extern int foo (int);
       5  
       6  static int __attribute__((noinline))
       7  do_stuff_2 (int *p, int n)
       8  {
       9    return 0;
      10  }
      11  
      12  /* As malloc-vs-local-2.c, but with a memory leak for the "on the heap case"
      13     by not attempting to free at the end.  */
      14  
      15  int test_1 (int n)
      16  {
      17    int buf[10];
      18    int *ptr;
      19    int result;
      20  
      21    if (n > 10)
      22      ptr = (int *)malloc (sizeof (int) * n);
      23    else
      24      ptr = buf;
      25  
      26    __analyzer_dump_exploded_nodes (0); /* { dg-warning "2 processed enodes" } */
      27  
      28    {
      29      int *p = ptr;
      30      int sum = 0;
      31      int i;
      32      for (i = 0; i < n; i++)
      33        p[i] = i; /* { dg-warning "dereference of possibly-NULL" } */
      34      for (i = 0; i < n; i++)
      35        sum += foo (p[i]); /* { dg-bogus "uninitialized" } */
      36      result = sum;
      37    }
      38  
      39    __analyzer_dump_exploded_nodes (0); /* { dg-warning "2 processed enodes" } */
      40  
      41    return result; /* { dg-message "leak of 'p'|leak of 'ptr'" } */
      42  }
      43  
      44  /* A simpler version of the above.  */
      45  
      46  int test_2 (int n)
      47  {
      48    int buf[10];
      49    int *ptr;
      50    int result;
      51  
      52    if (n > 10)
      53      ptr = (int *)malloc (sizeof (int) * n);
      54    else
      55      ptr = buf;
      56  
      57    __analyzer_dump_exploded_nodes (0); /* { dg-warning "2 processed enodes" } */
      58  
      59    result = do_stuff_2 (ptr, n);
      60  
      61    __analyzer_dump_exploded_nodes (0); /* { dg-warning "2 processed enodes" } */
      62  
      63    return result; /* { dg-message "leak of 'ptr'" } */
      64  }