1 // Given code 'struct aa { char s1[4]; char * s2;} a; memcpy(a.s1, ...);',
2 // this test checks that the CStringChecker only invalidates the destination buffer array a.s1 (instead of a.s1 and a.s2).
3 // At the moment the whole of the destination array content is invalidated.
4 // If a.s1 region has a symbolic offset, the whole region of 'a' is invalidated.
5 // Specific triple set to test structures of size 0.
6 // RUN: %clang_cc1 -triple x86_64-pc-linux-gnu -analyze -analyzer-checker=core,unix.Malloc,debug.ExprInspection -analyzer-store=region -verify %s
7
8 typedef __typeof(sizeof(int)) size_t;
9
10 char *strdup(const char *s);
11 void free(void *);
12 void *memcpy(void *dst, const void *src, size_t n); // expected-note{{passing argument to parameter 'dst' here}}
13 void *malloc(size_t n);
14
15 void clang_analyzer_eval(int);
16
17 struct aa {
18 char s1[4];
19 char *s2;
20 };
21
22 // Test different types of structure initialisation.
f0()23 int f0() {
24 struct aa a0 = {{1, 2, 3, 4}, 0};
25 a0.s2 = strdup("hello");
26 char input[] = {'a', 'b', 'c', 'd'};
27 memcpy(a0.s1, input, 4);
28 clang_analyzer_eval(a0.s1[0] == 'a'); // expected-warning{{UNKNOWN}}
29 clang_analyzer_eval(a0.s1[1] == 'b'); // expected-warning{{UNKNOWN}}
30 clang_analyzer_eval(a0.s1[2] == 'c'); // expected-warning{{UNKNOWN}}
31 clang_analyzer_eval(a0.s1[3] == 'd'); // expected-warning{{UNKNOWN}}
32 clang_analyzer_eval(a0.s2 == 0); // expected-warning{{UNKNOWN}}
33 free(a0.s2); // no warning
34 return 0;
35 }
36
f1()37 int f1() {
38 struct aa a1;
39 a1.s2 = strdup("hello");
40 char input[] = {'a', 'b', 'c', 'd'};
41 memcpy(a1.s1, input, 4);
42 clang_analyzer_eval(a1.s1[0] == 'a'); // expected-warning{{UNKNOWN}}
43 clang_analyzer_eval(a1.s1[1] == 'b'); // expected-warning{{UNKNOWN}}
44 clang_analyzer_eval(a1.s1[2] == 'c'); // expected-warning{{UNKNOWN}}
45 clang_analyzer_eval(a1.s1[3] == 'd'); // expected-warning{{UNKNOWN}}
46 clang_analyzer_eval(a1.s2 == 0); // expected-warning{{UNKNOWN}}
47 free(a1.s2); // no warning
48 return 0;
49 }
50
f2()51 int f2() {
52 struct aa a2 = {{1, 2}};
53 a2.s2 = strdup("hello");
54 char input[] = {'a', 'b', 'c', 'd'};
55 memcpy(a2.s1, input, 4);
56 clang_analyzer_eval(a2.s1[0] == 'a'); // expected-warning{{UNKNOWN}}
57 clang_analyzer_eval(a2.s1[1] == 'b'); // expected-warning{{UNKNOWN}}
58 clang_analyzer_eval(a2.s1[2] == 'c'); // expected-warning{{UNKNOWN}}
59 clang_analyzer_eval(a2.s1[3] == 'd'); // expected-warning{{UNKNOWN}}
60 clang_analyzer_eval(a2.s2 == 0); // expected-warning{{UNKNOWN}}
61 free(a2.s2); // no warning
62 return 0;
63 }
64
f3()65 int f3() {
66 struct aa a3 = {{1, 2, 3, 4}, 0};
67 a3.s2 = strdup("hello");
68 char input[] = {'a', 'b', 'c', 'd'};
69 int * dest = (int*)a3.s1;
70 memcpy(dest, input, 4);
71 clang_analyzer_eval(a3.s1[0] == 'a'); // expected-warning{{UNKNOWN}}
72 clang_analyzer_eval(dest[0] == 'a'); // expected-warning{{UNKNOWN}}
73 clang_analyzer_eval(a3.s1[1] == 'b'); // expected-warning{{UNKNOWN}}
74 clang_analyzer_eval(dest[1] == 'b'); // expected-warning{{UNKNOWN}}
75 clang_analyzer_eval(a3.s1[2] == 'c'); // expected-warning{{UNKNOWN}}
76 clang_analyzer_eval(dest[2] == 'c'); // expected-warning{{UNKNOWN}}
77 clang_analyzer_eval(a3.s1[3] == 'd'); // expected-warning{{UNKNOWN}}
78 clang_analyzer_eval(dest[3] == 'd'); // expected-warning{{UNKNOWN}}
79 clang_analyzer_eval(a3.s2 == 0); // expected-warning{{UNKNOWN}}
80 free(a3.s2); // no warning
81 return 0;
82 }
83
84 struct bb {
85 struct aa a;
86 char * s2;
87 };
88
f4()89 int f4() {
90 struct bb b0 = {{1, 2, 3, 4}, 0};
91 b0.s2 = strdup("hello");
92 b0.a.s2 = strdup("hola");
93 char input[] = {'a', 'b', 'c', 'd'};
94 char * dest = (char*)(b0.a.s1);
95 memcpy(dest, input, 4);
96 clang_analyzer_eval(b0.a.s1[0] == 'a'); // expected-warning{{UNKNOWN}}
97 clang_analyzer_eval(dest[0] == 'a'); // expected-warning{{UNKNOWN}}
98 clang_analyzer_eval(b0.a.s1[1] == 'b'); // expected-warning{{UNKNOWN}}
99 clang_analyzer_eval(dest[1] == 'b'); // expected-warning{{UNKNOWN}}
100 clang_analyzer_eval(b0.a.s1[2] == 'c'); // expected-warning{{UNKNOWN}}
101 clang_analyzer_eval(dest[2] == 'c'); // expected-warning{{UNKNOWN}}
102 clang_analyzer_eval(b0.a.s1[3] == 'd'); // expected-warning{{UNKNOWN}}
103 clang_analyzer_eval(dest[3] == 'd'); // expected-warning{{UNKNOWN}}
104 clang_analyzer_eval(b0.s2 == 0); // expected-warning{{UNKNOWN}}
105 free(b0.a.s2); // no warning
106 free(b0.s2); // no warning
107 return 0;
108 }
109
110 // Test that memory leaks are caught.
f5()111 int f5() {
112 struct aa a0 = {{1, 2, 3, 4}, 0};
113 a0.s2 = strdup("hello");
114 char input[] = {'a', 'b', 'c', 'd'};
115 memcpy(a0.s1, input, 4);
116 return 0; // expected-warning{{Potential leak of memory pointed to by 'a0.s2'}}
117 }
118
f6()119 int f6() {
120 struct aa a1;
121 a1.s2 = strdup("hello");
122 char input[] = {'a', 'b', 'c', 'd'};
123 memcpy(a1.s1, input, 4);
124 return 0; // expected-warning{{Potential leak of memory pointed to by 'a1.s2'}}
125 }
126
f7()127 int f7() {
128 struct aa a2 = {{1, 2}};
129 a2.s2 = strdup("hello");
130 char input[] = {'a', 'b', 'c', 'd'};
131 memcpy(a2.s1, input, 4);
132 return 0; // expected-warning{{Potential leak of memory pointed to by 'a2.s2'}}
133 }
134
f8()135 int f8() {
136 struct aa a3 = {{1, 2, 3, 4}, 0};
137 a3.s2 = strdup("hello");
138 char input[] = {'a', 'b', 'c', 'd'};
139 int * dest = (int*)a3.s1;
140 memcpy(dest, input, 4);
141 return 0; // expected-warning{{Potential leak of memory pointed to by 'a3.s2'}}
142 }
143
f9()144 int f9() {
145 struct bb b0 = {{1, 2, 3, 4}, 0};
146 b0.s2 = strdup("hello");
147 b0.a.s2 = strdup("hola");
148 char input[] = {'a', 'b', 'c', 'd'};
149 char * dest = (char*)(b0.a.s1);
150 memcpy(dest, input, 4);
151 free(b0.a.s2); // expected-warning{{Potential leak of memory pointed to by 'b0.s2'}}
152 return 0;
153 }
154
f10()155 int f10() {
156 struct bb b0 = {{1, 2, 3, 4}, 0};
157 b0.s2 = strdup("hello");
158 b0.a.s2 = strdup("hola");
159 char input[] = {'a', 'b', 'c', 'd'};
160 char * dest = (char*)(b0.a.s1);
161 memcpy(dest, input, 4);
162 free(b0.s2); // expected-warning{{Potential leak of memory pointed to by 'b0.a.s2'}}
163 return 0;
164 }
165
166 // Test invalidating fields being addresses of array.
167 struct cc {
168 char * s1;
169 char * s2;
170 };
171
f11()172 int f11() {
173 char x[4] = {1, 2};
174 x[0] = 1;
175 x[1] = 2;
176 struct cc c0;
177 c0.s2 = strdup("hello");
178 c0.s1 = &x[0];
179 char input[] = {'a', 'b', 'c', 'd'};
180 memcpy(c0.s1, input, 4);
181 clang_analyzer_eval(x[0] == 1); // expected-warning{{UNKNOWN}}
182 clang_analyzer_eval(x[1] == 2); // expected-warning{{UNKNOWN}}
183 clang_analyzer_eval(c0.s1[0] == 'a'); // expected-warning{{UNKNOWN}}
184 clang_analyzer_eval(c0.s1[1] == 'b'); // expected-warning{{UNKNOWN}}
185 clang_analyzer_eval(c0.s1[2] == 'c'); // expected-warning{{UNKNOWN}}
186 clang_analyzer_eval(c0.s1[3] == 'd'); // expected-warning{{UNKNOWN}}
187 free(c0.s2); // no-warning
188 return 0;
189 }
190
191 // Test inverting field position between s1 and s2.
192 struct dd {
193 char *s2;
194 char s1[4];
195 };
196
f12()197 int f12() {
198 struct dd d0 = {0, {1, 2, 3, 4}};
199 d0.s2 = strdup("hello");
200 char input[] = {'a', 'b', 'c', 'd'};
201 memcpy(d0.s1, input, 4);
202 clang_analyzer_eval(d0.s1[0] == 'a'); // expected-warning{{UNKNOWN}}
203 clang_analyzer_eval(d0.s1[1] == 'b'); // expected-warning{{UNKNOWN}}
204 clang_analyzer_eval(d0.s1[2] == 'c'); // expected-warning{{UNKNOWN}}
205 clang_analyzer_eval(d0.s1[3] == 'd'); // expected-warning{{UNKNOWN}}
206 clang_analyzer_eval(d0.s2 == 0); // expected-warning{{UNKNOWN}}
207 free(d0.s2); // no warning
208 return 0;
209 }
210
211 // Test arrays of structs.
212 struct ee {
213 int a;
214 char b;
215 };
216
217 struct EE {
218 struct ee s1[2];
219 char * s2;
220 };
221
f13()222 int f13() {
223 struct EE E0 = {{{1, 2}, {3, 4}}, 0};
224 E0.s2 = strdup("hello");
225 char input[] = {'a', 'b', 'c', 'd'};
226 memcpy(E0.s1, input, 4);
227 clang_analyzer_eval(E0.s1[0].a == 'a'); // expected-warning{{UNKNOWN}}
228 clang_analyzer_eval(E0.s1[0].b == 'b'); // expected-warning{{UNKNOWN}}
229 clang_analyzer_eval(E0.s1[1].a == 'c'); // expected-warning{{UNKNOWN}}
230 clang_analyzer_eval(E0.s1[1].b == 'd'); // expected-warning{{UNKNOWN}}
231 clang_analyzer_eval(E0.s2 == 0); // expected-warning{{UNKNOWN}}
232 free(E0.s2); // no warning
233 return 0;
234 }
235
236 // Test global parameters.
237 struct aa a15 = {{1, 2, 3, 4}, 0};
238
f15()239 int f15() {
240 a15.s2 = strdup("hello");
241 char input[] = {'a', 'b', 'c', 'd'};
242 memcpy(a15.s1, input, 4);
243 clang_analyzer_eval(a15.s1[0] == 'a'); // expected-warning{{UNKNOWN}}
244 clang_analyzer_eval(a15.s1[1] == 'b'); // expected-warning{{UNKNOWN}}
245 clang_analyzer_eval(a15.s1[2] == 'c'); // expected-warning{{UNKNOWN}}
246 clang_analyzer_eval(a15.s1[3] == 'd'); // expected-warning{{UNKNOWN}}
247 clang_analyzer_eval(a15.s2 == 0); // expected-warning{{UNKNOWN}}
248 free(a15.s2); // no warning
249 return 0;
250 }
251
252 // Test array of 0 sized elements.
253 struct empty {};
254 struct gg {
255 struct empty s1[4];
256 char * s2;
257 };
258
f16()259 int f16() {
260 struct gg g0 = {{}, 0};
261 g0.s2 = strdup("hello");
262 char input[] = {'a', 'b', 'c', 'd'};
263 memcpy(g0.s1, input, 4);
264 clang_analyzer_eval(*(int*)(&g0.s1[0]) == 'a'); // expected-warning{{UNKNOWN}}\
265 expected-warning{{Potential leak of memory pointed to by 'g0.s2'}}
266 clang_analyzer_eval(*(int*)(&g0.s1[1]) == 'b'); // expected-warning{{UNKNOWN}}
267 clang_analyzer_eval(*(int*)(&g0.s1[2]) == 'c'); // expected-warning{{UNKNOWN}}
268 clang_analyzer_eval(*(int*)(&g0.s1[3]) == 'd'); // expected-warning{{UNKNOWN}}
269 clang_analyzer_eval(g0.s2 == 0); // expected-warning{{UNKNOWN}}
270 free(g0.s2); // no warning
271 return 0;
272 }
273
274 // Test array of 0 elements.
275 struct hh {
276 char s1[0];
277 char * s2;
278 };
279
f17()280 int f17() {
281 struct hh h0;
282 h0.s2 = strdup("hello");
283 char input[] = {'a', 'b', 'c', 'd'};
284 memcpy(h0.s1, input, 4);
285 clang_analyzer_eval(h0.s1[0] == 'a'); // expected-warning{{UNKNOWN}}\
286 expected-warning{{Potential leak of memory pointed to by 'h0.s2'}}
287 clang_analyzer_eval(h0.s2 == 0); // expected-warning{{UNKNOWN}}
288 free(h0.s2); // no warning
289 return 0;
290 }
291
292 // Test writing past the array.
293 struct ii {
294 char s1[4];
295 int i;
296 int j;
297 char * s2;
298 };
299
f18()300 int f18() {
301 struct ii i18 = {{1, 2, 3, 4}, 5, 6};
302 i18.i = 10;
303 i18.j = 11;
304 i18.s2 = strdup("hello");
305 char input[100] = {3};
306 memcpy(i18.s1, input, 100);
307 clang_analyzer_eval(i18.s1[0] == 1); // expected-warning{{UNKNOWN}}\
308 expected-warning{{Potential leak of memory pointed to by 'i18.s2'}}
309 clang_analyzer_eval(i18.s1[1] == 2); // expected-warning{{UNKNOWN}}
310 clang_analyzer_eval(i18.s1[2] == 3); // expected-warning{{UNKNOWN}}
311 clang_analyzer_eval(i18.s1[3] == 4); // expected-warning{{UNKNOWN}}
312 clang_analyzer_eval(i18.i == 10); // expected-warning{{UNKNOWN}}
313 clang_analyzer_eval(i18.j == 11); // expected-warning{{UNKNOWN}}
314 return 0;
315 }
316
f181()317 int f181() {
318 struct ii i181 = {{1, 2, 3, 4}, 5, 6};
319 i181.i = 10;
320 i181.j = 11;
321 i181.s2 = strdup("hello");
322 char input[100] = {3};
323 memcpy(i181.s1, input, 5); // invalidate the whole region of i181
324 clang_analyzer_eval(i181.s1[0] == 1); // expected-warning{{UNKNOWN}}\
325 expected-warning{{Potential leak of memory pointed to by 'i181.s2'}}
326 clang_analyzer_eval(i181.s1[1] == 2); // expected-warning{{UNKNOWN}}
327 clang_analyzer_eval(i181.s1[2] == 3); // expected-warning{{UNKNOWN}}
328 clang_analyzer_eval(i181.s1[3] == 4); // expected-warning{{UNKNOWN}}
329 clang_analyzer_eval(i181.i == 10); // expected-warning{{UNKNOWN}}
330 clang_analyzer_eval(i181.j == 11); // expected-warning{{UNKNOWN}}
331 return 0;
332 }
333
334 // Test array with a symbolic offset.
335 struct jj {
336 char s1[2];
337 char * s2;
338 };
339
340 struct JJ {
341 struct jj s1[3];
342 char * s2;
343 };
344
f19(int i)345 int f19(int i) {
346 struct JJ J0 = {{{1, 2, 0}, {3, 4, 0}, {5, 6, 0}}, 0};
347 J0.s2 = strdup("hello");
348 J0.s1[0].s2 = strdup("hello");
349 J0.s1[1].s2 = strdup("hi");
350 J0.s1[2].s2 = strdup("world");
351 char input[2] = {'a', 'b'};
352 memcpy(J0.s1[i].s1, input, 2);
353 clang_analyzer_eval(J0.s1[0].s1[0] == 1); // expected-warning{{UNKNOWN}}\
354 expected-warning{{Potential leak of memory pointed to by field 's2'}}\
355 expected-warning{{Potential leak of memory pointed to by 'J0.s2'}}
356 clang_analyzer_eval(J0.s1[0].s1[1] == 2); // expected-warning{{UNKNOWN}}
357 clang_analyzer_eval(J0.s1[1].s1[0] == 3); // expected-warning{{UNKNOWN}}
358 clang_analyzer_eval(J0.s1[1].s1[1] == 4); // expected-warning{{UNKNOWN}}
359 clang_analyzer_eval(J0.s1[2].s1[0] == 5); // expected-warning{{UNKNOWN}}
360 clang_analyzer_eval(J0.s1[2].s1[1] == 6); // expected-warning{{UNKNOWN}}
361 clang_analyzer_eval(J0.s1[i].s1[0] == 5); // expected-warning{{UNKNOWN}}
362 clang_analyzer_eval(J0.s1[i].s1[1] == 6); // expected-warning{{UNKNOWN}}
363 // FIXME: memory leak warning for J0.s2 should be emitted here instead of after memcpy call.
364 return 0; // no warning
365 }
366
367 // Test array with its super region having symbolic offseted regions.
f20(int i)368 int f20(int i) {
369 struct aa * a20 = malloc(sizeof(struct aa) * 2);
370 a20[0].s1[0] = 1;
371 a20[0].s1[1] = 2;
372 a20[0].s1[2] = 3;
373 a20[0].s1[3] = 4;
374 a20[0].s2 = strdup("hello");
375 a20[1].s1[0] = 5;
376 a20[1].s1[1] = 6;
377 a20[1].s1[2] = 7;
378 a20[1].s1[3] = 8;
379 a20[1].s2 = strdup("world");
380 a20[i].s2 = strdup("hola");
381 char input[] = {'a', 'b', 'c', 'd'};
382 memcpy(a20[0].s1, input, 4);
383 clang_analyzer_eval(a20[0].s1[0] == 1); // expected-warning{{UNKNOWN}}
384 clang_analyzer_eval(a20[0].s1[1] == 1); // expected-warning{{UNKNOWN}}
385 clang_analyzer_eval(a20[0].s1[2] == 1); // expected-warning{{UNKNOWN}}
386 clang_analyzer_eval(a20[0].s1[3] == 1); // expected-warning{{UNKNOWN}}
387 clang_analyzer_eval(a20[0].s2 == 0); // expected-warning{{UNKNOWN}}
388 clang_analyzer_eval(a20[1].s1[0] == 1); // expected-warning{{UNKNOWN}}
389 clang_analyzer_eval(a20[1].s1[1] == 1); // expected-warning{{UNKNOWN}}
390 clang_analyzer_eval(a20[1].s1[2] == 1); // expected-warning{{UNKNOWN}}
391 clang_analyzer_eval(a20[1].s1[3] == 1); // expected-warning{{UNKNOWN}}
392 clang_analyzer_eval(a20[1].s2 == 0); // expected-warning{{UNKNOWN}}
393 clang_analyzer_eval(a20[i].s1[0] == 1); // expected-warning{{UNKNOWN}}
394 clang_analyzer_eval(a20[i].s1[1] == 1); // expected-warning{{UNKNOWN}}
395 clang_analyzer_eval(a20[i].s1[2] == 1); // expected-warning{{UNKNOWN}}
396 clang_analyzer_eval(a20[i].s1[3] == 1); // expected-warning{{UNKNOWN}}
397 clang_analyzer_eval(a20[i].s2 == 0); // expected-warning{{UNKNOWN}}\
398 expected-warning{{Potential leak of memory pointed to by 'a20'}}
399
400 return 0;
401 }
402
403 // Test array's region and super region both having symbolic offsets.
f21(int i)404 int f21(int i) {
405 struct aa * a21 = malloc(sizeof(struct aa) * 2);
406 a21[0].s1[0] = 1;
407 a21[0].s1[1] = 2;
408 a21[0].s1[2] = 3;
409 a21[0].s1[3] = 4;
410 a21[0].s2 = 0;
411 a21[1].s1[0] = 5;
412 a21[1].s1[1] = 6;
413 a21[1].s1[2] = 7;
414 a21[1].s1[3] = 8;
415 a21[1].s2 = 0;
416 a21[i].s2 = strdup("hello");
417 a21[i].s1[0] = 1;
418 a21[i].s1[1] = 2;
419 a21[i].s1[2] = 3;
420 a21[i].s1[3] = 4;
421 char input[] = {'a', 'b', 'c', 'd'};
422 memcpy(a21[i].s1, input, 4);
423 clang_analyzer_eval(a21[0].s1[0] == 1); // expected-warning{{UNKNOWN}}
424 clang_analyzer_eval(a21[0].s1[1] == 1); // expected-warning{{UNKNOWN}}
425 clang_analyzer_eval(a21[0].s1[2] == 1); // expected-warning{{UNKNOWN}}
426 clang_analyzer_eval(a21[0].s1[3] == 1); // expected-warning{{UNKNOWN}}
427 clang_analyzer_eval(a21[0].s2 == 0); // expected-warning{{UNKNOWN}}
428 clang_analyzer_eval(a21[1].s1[0] == 1); // expected-warning{{UNKNOWN}}
429 clang_analyzer_eval(a21[1].s1[1] == 1); // expected-warning{{UNKNOWN}}
430 clang_analyzer_eval(a21[1].s1[2] == 1); // expected-warning{{UNKNOWN}}
431 clang_analyzer_eval(a21[1].s1[3] == 1); // expected-warning{{UNKNOWN}}
432 clang_analyzer_eval(a21[1].s2 == 0); // expected-warning{{UNKNOWN}}
433 clang_analyzer_eval(a21[i].s1[0] == 1); // expected-warning{{UNKNOWN}}
434 clang_analyzer_eval(a21[i].s1[1] == 1); // expected-warning{{UNKNOWN}}
435 clang_analyzer_eval(a21[i].s1[2] == 1); // expected-warning{{UNKNOWN}}
436 clang_analyzer_eval(a21[i].s1[3] == 1); // expected-warning{{UNKNOWN}}
437 clang_analyzer_eval(a21[i].s2 == 0); // expected-warning{{UNKNOWN}}\
438 expected-warning{{Potential leak of memory pointed to by 'a21'}}
439
440 return 0;
441 }
442
443 // Test regions aliasing other regions.
444 struct ll {
445 char s1[4];
446 char * s2;
447 };
448
449 struct mm {
450 char s3[4];
451 char * s4;
452 };
453
f24()454 int f24() {
455 struct ll l24 = {{1, 2, 3, 4}, 0};
456 struct mm * m24 = (struct mm *)&l24;
457 m24->s4 = strdup("hello");
458 char input[] = {1, 2, 3, 4};
459 memcpy(m24->s3, input, 4);
460 clang_analyzer_eval(m24->s3[0] == 1); // expected-warning{{UNKNOWN}}
461 clang_analyzer_eval(m24->s3[1] == 1); // expected-warning{{UNKNOWN}}
462 clang_analyzer_eval(m24->s3[2] == 1); // expected-warning{{UNKNOWN}}
463 clang_analyzer_eval(m24->s3[3] == 1); // expected-warning{{UNKNOWN}}
464 clang_analyzer_eval(l24.s1[0] == 1); // expected-warning{{UNKNOWN}}
465 clang_analyzer_eval(l24.s1[1] == 1); // expected-warning{{UNKNOWN}}
466 clang_analyzer_eval(l24.s1[2] == 1); // expected-warning{{UNKNOWN}}
467 clang_analyzer_eval(l24.s1[3] == 1); // expected-warning{{UNKNOWN}}\
468 expected-warning{{Potential leak of memory pointed to by field 's4'}}
469 return 0;
470 }
471
472 // Test region with potential aliasing and symbolic offsets.
473 // Store assumes no aliasing.
f25(int i,int j,struct ll * l,struct mm * m)474 int f25(int i, int j, struct ll * l, struct mm * m) {
475 m->s4 = strdup("hola"); // m->s4 not tracked
476 m->s3[0] = 1;
477 m->s3[1] = 2;
478 m->s3[2] = 3;
479 m->s3[3] = 4;
480 m->s3[j] = 5; // invalidates m->s3
481 l->s2 = strdup("hello"); // l->s2 not tracked
482 l->s1[0] = 6;
483 l->s1[1] = 7;
484 l->s1[2] = 8;
485 l->s1[3] = 9;
486 l->s1[i] = 10; // invalidates l->s1
487 char input[] = {1, 2, 3, 4};
488 memcpy(m->s3, input, 4); // does not invalidate l->s1[i]
489 clang_analyzer_eval(m->s3[0] == 1); // expected-warning{{UNKNOWN}}
490 clang_analyzer_eval(m->s3[1] == 1); // expected-warning{{UNKNOWN}}
491 clang_analyzer_eval(m->s3[2] == 1); // expected-warning{{UNKNOWN}}
492 clang_analyzer_eval(m->s3[3] == 1); // expected-warning{{UNKNOWN}}
493 clang_analyzer_eval(m->s3[i] == 1); // expected-warning{{UNKNOWN}}
494 clang_analyzer_eval(m->s3[j] == 1); // expected-warning{{UNKNOWN}}
495 clang_analyzer_eval(l->s1[0] == 1); // expected-warning{{UNKNOWN}}
496 clang_analyzer_eval(l->s1[1] == 1); // expected-warning{{UNKNOWN}}
497 clang_analyzer_eval(l->s1[2] == 1); // expected-warning{{UNKNOWN}}
498 clang_analyzer_eval(l->s1[3] == 1); // expected-warning{{UNKNOWN}}
499 clang_analyzer_eval(l->s1[i] == 1); // expected-warning{{FALSE}}
500 clang_analyzer_eval(l->s1[j] == 1); // expected-warning{{UNKNOWN}}
501 return 0;
502 }
503
504 // Test size with symbolic size argument.
f26(int i)505 int f26(int i) {
506 struct aa a26 = {{1, 2, 3, 4}, 0};
507 a26.s2 = strdup("hello");
508 char input[] = {'a', 'b', 'c', 'd'};
509 memcpy(a26.s1, input, i); // i assumed in bound
510 clang_analyzer_eval(a26.s1[0] == 1); // expected-warning{{UNKNOWN}}
511 clang_analyzer_eval(a26.s1[1] == 1); // expected-warning{{UNKNOWN}}
512 clang_analyzer_eval(a26.s1[2] == 1); // expected-warning{{UNKNOWN}}
513 clang_analyzer_eval(a26.s1[3] == 1); // expected-warning{{UNKNOWN}}\
514 expected-warning{{Potential leak of memory pointed to by 'a26.s2'}}
515 return 0;
516 }
517
518 // Test sizeof as a size argument.
f261()519 int f261() {
520 struct aa a261 = {{1, 2, 3, 4}, 0};
521 a261.s2 = strdup("hello");
522 char input[] = {'a', 'b', 'c', 'd'};
523 memcpy(a261.s1, input, sizeof(a261.s1));
524 clang_analyzer_eval(a261.s1[0] == 1); // expected-warning{{UNKNOWN}}
525 clang_analyzer_eval(a261.s1[1] == 1); // expected-warning{{UNKNOWN}}
526 clang_analyzer_eval(a261.s1[2] == 1); // expected-warning{{UNKNOWN}}
527 clang_analyzer_eval(a261.s1[3] == 1); // expected-warning{{UNKNOWN}}\
528 expected-warning{{Potential leak of memory pointed to by 'a261.s2'}}
529 return 0;
530 }
531
532 // Test negative size argument.
f262()533 int f262() {
534 struct aa a262 = {{1, 2, 3, 4}, 0};
535 a262.s2 = strdup("hello");
536 char input[] = {'a', 'b', 'c', 'd'};
537 memcpy(a262.s1, input, -1);
538 clang_analyzer_eval(a262.s1[0] == 1); // expected-warning{{UNKNOWN}}\
539 expected-warning{{Potential leak of memory pointed to by 'a262.s2'}}
540 clang_analyzer_eval(a262.s1[1] == 1); // expected-warning{{UNKNOWN}}
541 clang_analyzer_eval(a262.s1[2] == 1); // expected-warning{{UNKNOWN}}
542 clang_analyzer_eval(a262.s1[3] == 1); // expected-warning{{UNKNOWN}}
543 return 0;
544 }
545
546 // Test size argument being an unknown value.
547 struct xx {
548 char s1[4];
549 char * s2;
550 };
551
f263(int n,char * len)552 int f263(int n, char * len) {
553 struct xx x263 = {0};
554 x263.s2 = strdup("hello");
555 char input[] = {'a', 'b', 'c', 'd'};
556 memcpy(x263.s1, input, *(len + n));
557 clang_analyzer_eval(x263.s1[0] == 0); // expected-warning{{UNKNOWN}}
558 clang_analyzer_eval(x263.s1[1] == 0); // expected-warning{{UNKNOWN}}
559 clang_analyzer_eval(x263.s1[2] == 0); // expected-warning{{UNKNOWN}}
560 clang_analyzer_eval(x263.s1[3] == 0); // expected-warning{{UNKNOWN}}
561 clang_analyzer_eval(x263.s2 == 0); // expected-warning{{UNKNOWN}}
562 return 0; // expected-warning{{Potential leak of memory pointed to by 'x263.s2'}}
563 }
564
565
566 // Test casting regions with symbolic offseted sub regions.
f27(int i)567 int f27(int i) {
568 struct mm m27 = {{1, 2, 3, 4}, 0};
569 m27.s4 = strdup("hello");
570 m27.s3[i] = 5;
571 char input[] = {'a', 'b', 'c', 'd'};
572 memcpy(((struct ll*)(&m27))->s1, input, 4);
573 clang_analyzer_eval(m27.s3[0] == 1); // expected-warning{{UNKNOWN}}
574 clang_analyzer_eval(m27.s3[1] == 1); // expected-warning{{UNKNOWN}}
575 clang_analyzer_eval(m27.s3[2] == 1); // expected-warning{{UNKNOWN}}
576 clang_analyzer_eval(m27.s3[3] == 1); // expected-warning{{UNKNOWN}}
577 clang_analyzer_eval(m27.s3[i] == 1); // expected-warning{{UNKNOWN}}\
578 expected-warning{{Potential leak of memory pointed to by 'm27.s4'}}
579 return 0;
580 }
581
f28(int i,int j,int k,int l)582 int f28(int i, int j, int k, int l) {
583 struct mm m28[2];
584 m28[i].s4 = strdup("hello");
585 m28[j].s3[k] = 1;
586 struct ll * l28 = (struct ll*)(&m28[1]);
587 l28->s1[l] = 2;
588 char input[] = {'a', 'b', 'c', 'd'};
589 memcpy(l28->s1, input, 4);
590 clang_analyzer_eval(m28[0].s3[0] == 1); // expected-warning{{UNKNOWN}}
591 clang_analyzer_eval(m28[0].s3[1] == 1); // expected-warning{{UNKNOWN}}
592 clang_analyzer_eval(m28[0].s3[2] == 1); // expected-warning{{UNKNOWN}}
593 clang_analyzer_eval(m28[0].s3[3] == 1); // expected-warning{{UNKNOWN}}
594 clang_analyzer_eval(m28[1].s3[0] == 1); // expected-warning{{UNKNOWN}}
595 clang_analyzer_eval(m28[1].s3[1] == 1); // expected-warning{{UNKNOWN}}
596 clang_analyzer_eval(m28[1].s3[2] == 1); // expected-warning{{UNKNOWN}}
597 clang_analyzer_eval(m28[1].s3[3] == 1); // expected-warning{{UNKNOWN}}
598 clang_analyzer_eval(m28[i].s3[0] == 1); // expected-warning{{UNKNOWN}}
599 clang_analyzer_eval(m28[i].s3[1] == 1); // expected-warning{{UNKNOWN}}
600 clang_analyzer_eval(m28[i].s3[2] == 1); // expected-warning{{UNKNOWN}}
601 clang_analyzer_eval(m28[i].s3[3] == 1); // expected-warning{{UNKNOWN}}
602 clang_analyzer_eval(m28[j].s3[k] == 1); // expected-warning{{UNKNOWN}}
603 clang_analyzer_eval(l28->s1[l] == 2); // expected-warning{{UNKNOWN}}
604 return 0;
605 }
606
f29(int i,int j,int k,int l,int m)607 int f29(int i, int j, int k, int l, int m) {
608 struct mm m29[2];
609 m29[i].s4 = strdup("hello");
610 m29[j].s3[k] = 1;
611 struct ll * l29 = (struct ll*)(&m29[l]);
612 l29->s1[m] = 2;
613 char input[] = {'a', 'b', 'c', 'd'};
614 memcpy(l29->s1, input, 4);
615 clang_analyzer_eval(m29[0].s3[0] == 1); // expected-warning{{UNKNOWN}}
616 clang_analyzer_eval(m29[0].s3[1] == 1); // expected-warning{{UNKNOWN}}
617 clang_analyzer_eval(m29[0].s3[2] == 1); // expected-warning{{UNKNOWN}}
618 clang_analyzer_eval(m29[0].s3[3] == 1); // expected-warning{{UNKNOWN}}
619 clang_analyzer_eval(m29[1].s3[0] == 1); // expected-warning{{UNKNOWN}}
620 clang_analyzer_eval(m29[1].s3[1] == 1); // expected-warning{{UNKNOWN}}
621 clang_analyzer_eval(m29[1].s3[2] == 1); // expected-warning{{UNKNOWN}}
622 clang_analyzer_eval(m29[1].s3[3] == 1); // expected-warning{{UNKNOWN}}
623 clang_analyzer_eval(m29[i].s3[0] == 1); // expected-warning{{UNKNOWN}}
624 clang_analyzer_eval(m29[i].s3[1] == 1); // expected-warning{{UNKNOWN}}
625 clang_analyzer_eval(m29[i].s3[2] == 1); // expected-warning{{UNKNOWN}}
626 clang_analyzer_eval(m29[i].s3[3] == 1); // expected-warning{{UNKNOWN}}
627 clang_analyzer_eval(m29[j].s3[k] == 1); // expected-warning{{TRUE}}\
628 expected-warning{{Potential leak of memory pointed to by field 's4'}}
629 clang_analyzer_eval(l29->s1[m] == 2); // expected-warning{{UNKNOWN}}
630 return 0;
631 }
632
633 // Test unions' fields.
634 union uu {
635 char x;
636 char s1[4];
637 };
638
f30()639 int f30() {
640 union uu u30 = { .s1 = {1, 2, 3, 4}};
641 char input[] = {1, 2, 3, 4};
642 memcpy(u30.s1, input, 4);
643 clang_analyzer_eval(u30.s1[0] == 1); // expected-warning{{UNKNOWN}}
644 clang_analyzer_eval(u30.s1[1] == 1); // expected-warning{{UNKNOWN}}
645 clang_analyzer_eval(u30.s1[2] == 1); // expected-warning{{UNKNOWN}}
646 clang_analyzer_eval(u30.s1[3] == 1); // expected-warning{{UNKNOWN}}
647 clang_analyzer_eval(u30.x == 1); // expected-warning{{UNKNOWN}}
648 return 0;
649 }
650
651 struct kk {
652 union uu u;
653 char * s2;
654 };
655
f31()656 int f31() {
657 struct kk k31;
658 k31.s2 = strdup("hello");
659 k31.u.x = 1;
660 char input[] = {'a', 'b', 'c', 'd'};
661 memcpy(k31.u.s1, input, 4);
662 clang_analyzer_eval(k31.u.s1[0] == 1); // expected-warning{{UNKNOWN}}\
663 expected-warning{{Potential leak of memory pointed to by 'k31.s2'}}
664 clang_analyzer_eval(k31.u.s1[1] == 1); // expected-warning{{UNKNOWN}}
665 clang_analyzer_eval(k31.u.s1[2] == 1); // expected-warning{{UNKNOWN}}
666 clang_analyzer_eval(k31.u.s1[3] == 1); // expected-warning{{UNKNOWN}}
667 clang_analyzer_eval(k31.u.x == 1); // expected-warning{{UNKNOWN}}
668 // FIXME: memory leak warning for k31.s2 should be emitted here.
669 return 0;
670 }
671
672 union vv {
673 int x;
674 char * s2;
675 };
676
f32()677 int f32() {
678 union vv v32;
679 v32.s2 = strdup("hello");
680 char input[] = {'a', 'b', 'c', 'd'};
681 memcpy(v32.s2, input, 4);
682 clang_analyzer_eval(v32.s2[0] == 1); // expected-warning{{UNKNOWN}}
683 clang_analyzer_eval(v32.s2[1] == 1); // expected-warning{{UNKNOWN}}
684 clang_analyzer_eval(v32.s2[2] == 1); // expected-warning{{UNKNOWN}}
685 clang_analyzer_eval(v32.s2[3] == 1); // expected-warning{{UNKNOWN}}\
686 expected-warning{{Potential leak of memory pointed to by 'v32.s2'}}
687 return 0;
688 }
689
690 struct nn {
691 int s1;
692 int i;
693 int j;
694 int k;
695 char * s2;
696 };
697
698 // Test bad types to dest buffer.
f33()699 int f33() {
700 struct nn n33 = {1, 2, 3, 4, 0};
701 n33.s2 = strdup("hello");
702 char input[] = {'a', 'b', 'c', 'd'};
703 memcpy(n33.s1, input, 4); // expected-warning{{incompatible integer to pointer conversion passing 'int' to parameter of type 'void *'}}
704 clang_analyzer_eval(n33.i == 2); // expected-warning{{TRUE}}
705 clang_analyzer_eval(n33.j == 3); // expected-warning{{TRUE}}
706 clang_analyzer_eval(n33.k == 4); // expected-warning{{TRUE}}
707 clang_analyzer_eval(((char*)(n33.s1))[0] == 1); // expected-warning{{UNKNOWN}}\
708 expected-warning{{cast to 'char *' from smaller integer type 'int'}}
709 clang_analyzer_eval(((char*)(n33.s1))[1] == 1); // expected-warning{{UNKNOWN}}\
710 expected-warning{{cast to 'char *' from smaller integer type 'int'}}
711 clang_analyzer_eval(((char*)(n33.s1))[2] == 1); // expected-warning{{UNKNOWN}}\
712 expected-warning{{cast to 'char *' from smaller integer type 'int'}}
713 clang_analyzer_eval(((char*)(n33.s1))[3] == 1); // expected-warning{{UNKNOWN}}\
714 expected-warning{{cast to 'char *' from smaller integer type 'int'}}
715 clang_analyzer_eval(n33.s2 == 0); //expected-warning{{UNKNOWN}}
716 return 0; // expected-warning{{Potential leak of memory pointed to by 'n33.s2'}}
717 }
718
719 // Test destination buffer being an unknown value.
720 struct ww {
721 int s1[4];
722 char s2;
723 };
724
f34(struct ww * w34,int n)725 int f34(struct ww * w34, int n) {
726 w34->s2 = 3;
727 char input[] = {'a', 'b', 'c', 'd'};
728 memcpy(w34->s1 + n, input , 4);
729 clang_analyzer_eval(w34->s1[0] == 0); // expected-warning{{UNKNOWN}}
730 clang_analyzer_eval(w34->s1[1] == 0); // expected-warning{{UNKNOWN}}
731 clang_analyzer_eval(w34->s1[2] == 0); // expected-warning{{UNKNOWN}}
732 clang_analyzer_eval(w34->s1[3] == 0); // expected-warning{{UNKNOWN}}
733 clang_analyzer_eval(w34->s1[n] == 0); // expected-warning{{UNKNOWN}}
734 clang_analyzer_eval(w34->s2 == 3); // expected-warning{{TRUE}}
735 return 0;
736 }
737
738 // Test dest buffer as an element region with a symbolic index and size parameter as a symbolic value.
739 struct yy {
740 char s1[4];
741 char * s2;
742 };
743
f35(int i,int n)744 int f35(int i, int n) {
745 struct yy y35 = {{1, 2, 3, 4}, 0};
746 y35.s2 = strdup("hello");
747 char input[] = {'a', 'b', 'c', 'd'};
748 memcpy(&(y35.s1[i]), input, n);
749 clang_analyzer_eval(y35.s1[0] == 0); // expected-warning{{UNKNOWN}}
750 clang_analyzer_eval(y35.s1[1] == 0); // expected-warning{{UNKNOWN}}
751 clang_analyzer_eval(y35.s1[2] == 0); // expected-warning{{UNKNOWN}}
752 clang_analyzer_eval(y35.s1[3] == 0); // expected-warning{{UNKNOWN}}
753 clang_analyzer_eval(y35.s1[i] == 0); // expected-warning{{UNKNOWN}}
754 clang_analyzer_eval(y35.s2 == 0); // expected-warning{{UNKNOWN}}
755 return 0; // expected-warning{{Potential leak of memory pointed to by 'y35.s2'}}
756 }
757
758 // Test regions with negative offsets.
759 struct zz {
760 char s1[4];
761 int s2;
762 };
763
f36(struct zz * z36)764 int f36(struct zz * z36) {
765
766 char input[] = {'a', 'b', 'c', 'd'};
767 z36->s1[0] = 0;
768 z36->s1[1] = 1;
769 z36->s1[2] = 2;
770 z36->s1[3] = 3;
771 z36->s2 = 10;
772
773 z36 = z36 - 1; // Decrement by 8 bytes (struct zz is 8 bytes).
774
775 z36->s1[0] = 4;
776 z36->s1[1] = 5;
777 z36->s1[2] = 6;
778 z36->s1[3] = 7;
779 z36->s2 = 11;
780
781 memcpy(z36->s1, input, 4);
782
783 clang_analyzer_eval(z36->s1[0] == 1); // expected-warning{{UNKNOWN}}
784 clang_analyzer_eval(z36->s1[1] == 1); // expected-warning{{UNKNOWN}}
785 clang_analyzer_eval(z36->s1[2] == 1); // expected-warning{{UNKNOWN}}
786 clang_analyzer_eval(z36->s1[3] == 1); // expected-warning{{UNKNOWN}}
787 clang_analyzer_eval(z36->s2 == 11); // expected-warning{{TRUE}}
788
789 z36 = z36 + 1; // Increment back.
790
791 clang_analyzer_eval(z36->s1[0] == 0); // expected-warning{{TRUE}}
792 clang_analyzer_eval(z36->s1[1] == 1); // expected-warning{{TRUE}}
793 clang_analyzer_eval(z36->s1[2] == 2); // expected-warning{{TRUE}}
794 clang_analyzer_eval(z36->s1[3] == 3); // expected-warning{{TRUE}}
795 clang_analyzer_eval(z36->s2 == 10); // expected-warning{{TRUE}}
796
797 return 0;
798 }
799
f37(struct zz * z37)800 int f37(struct zz * z37) {
801
802 char input[] = {'a', 'b', 'c', 'd'};
803 z37->s1[0] = 0;
804 z37->s1[1] = 1;
805 z37->s1[2] = 2;
806 z37->s1[3] = 3;
807 z37->s2 = 10;
808
809 z37 = (struct zz *)((char*)(z37) - 4); // Decrement by 4 bytes (struct zz is 8 bytes).
810
811 z37->s1[0] = 4;
812 z37->s1[1] = 5;
813 z37->s1[2] = 6;
814 z37->s1[3] = 7;
815 z37->s2 = 11;
816
817 memcpy(z37->s1, input, 4);
818
819 clang_analyzer_eval(z37->s1[0] == 1); // expected-warning{{UNKNOWN}}
820 clang_analyzer_eval(z37->s1[1] == 1); // expected-warning{{UNKNOWN}}
821 clang_analyzer_eval(z37->s1[2] == 1); // expected-warning{{UNKNOWN}}
822 clang_analyzer_eval(z37->s1[3] == 1); // expected-warning{{UNKNOWN}}
823 clang_analyzer_eval(z37->s2 == 11); // expected-warning{{TRUE}}
824
825 z37 = (struct zz *)((char*)(z37) + 4); // Increment back.
826
827 clang_analyzer_eval(z37->s1[0] == 11); // expected-warning{{TRUE}}
828 clang_analyzer_eval(z37->s1[1] == 1); // expected-warning{{UNKNOWN}}
829 clang_analyzer_eval(z37->s1[2] == 1); // expected-warning{{UNKNOWN}}
830 clang_analyzer_eval(z37->s1[3] == 1); // expected-warning{{UNKNOWN}}
831 clang_analyzer_eval(z37->s2 == 10); // expected-warning{{TRUE}}
832
833 return 0;
834 }
835
f38(struct zz * z38)836 int f38(struct zz * z38) {
837
838 char input[] = {'a', 'b', 'c', 'd'};
839 z38->s1[0] = 0;
840 z38->s1[1] = 1;
841 z38->s1[2] = 2;
842 z38->s1[3] = 3;
843 z38->s2 = 10;
844
845 z38 = (struct zz *)((char*)(z38) - 2); // Decrement by 2 bytes (struct zz is 8 bytes).
846
847 z38->s1[0] = 4;
848 z38->s1[1] = 5;
849 z38->s1[2] = 6;
850 z38->s1[3] = 7;
851 z38->s2 = 11;
852
853 memcpy(z38->s1, input, 4);
854
855 clang_analyzer_eval(z38->s1[0] == 1); // expected-warning{{UNKNOWN}}
856 clang_analyzer_eval(z38->s1[1] == 1); // expected-warning{{UNKNOWN}}
857 clang_analyzer_eval(z38->s1[2] == 1); // expected-warning{{UNKNOWN}}
858 clang_analyzer_eval(z38->s1[3] == 1); // expected-warning{{UNKNOWN}}
859 clang_analyzer_eval(z38->s2 == 11); // expected-warning{{TRUE}}
860
861 z38 = (struct zz *)((char*)(z38) + 2); // Increment back.
862
863 clang_analyzer_eval(z38->s1[0] == 1); // expected-warning{{UNKNOWN}}
864 clang_analyzer_eval(z38->s1[1] == 1); // expected-warning{{UNKNOWN}}
865 clang_analyzer_eval(z38->s1[2] == 11); // expected-warning{{TRUE}}
866 clang_analyzer_eval(z38->s1[3] == 1); // expected-warning{{UNKNOWN}}
867 clang_analyzer_eval(z38->s2 == 10); // expected-warning{{UNKNOWN}}
868
869 return 0;
870 }
871
872 // Test negative offsets with a different structure layout.
873 struct z0 {
874 int s2;
875 char s1[4];
876 };
877
f39(struct z0 * d39)878 int f39(struct z0 * d39) {
879
880 char input[] = {'a', 'b', 'c', 'd'};
881 d39->s1[0] = 0;
882 d39->s1[1] = 1;
883 d39->s1[2] = 2;
884 d39->s1[3] = 3;
885 d39->s2 = 10;
886
887 d39 = (struct z0 *)((char*)(d39) - 2); // Decrement by 2 bytes (struct z0 is 8 bytes).
888
889 d39->s1[0] = 4;
890 d39->s1[1] = 5;
891 d39->s1[2] = 6;
892 d39->s1[3] = 7;
893 d39->s2 = 11;
894
895 memcpy(d39->s1, input, 4);
896
897 clang_analyzer_eval(d39->s1[0] == 1); // expected-warning{{UNKNOWN}}
898 clang_analyzer_eval(d39->s1[1] == 1); // expected-warning{{UNKNOWN}}
899 clang_analyzer_eval(d39->s1[2] == 1); // expected-warning{{UNKNOWN}}
900 clang_analyzer_eval(d39->s1[3] == 1); // expected-warning{{UNKNOWN}}
901 clang_analyzer_eval(d39->s2 == 11); // expected-warning{{TRUE}}
902
903 d39 = (struct z0 *)((char*)(d39) + 2); // Increment back.
904
905 clang_analyzer_eval(d39->s1[0] == 1); // expected-warning{{UNKNOWN}}
906 clang_analyzer_eval(d39->s1[1] == 1); // expected-warning{{UNKNOWN}}
907 clang_analyzer_eval(d39->s1[2] == 2); // expected-warning{{TRUE}}
908 clang_analyzer_eval(d39->s1[3] == 3); // expected-warning{{TRUE}}
909 // FIXME: d39->s2 should evaluate to at least UNKNOWN or FALSE,
910 // 'collectSubRegionBindings(...)' in RegionStore.cpp will need to
911 // handle a regions' upper boundary overflowing.
912 clang_analyzer_eval(d39->s2 == 10); // expected-warning{{TRUE}}
913
914 return 0;
915 }
916
917