1 // RUN: %clang_cc1 -analyze -analyzer-store=region -analyzer-checker=core,unix.Malloc -fblocks -verify %s
2 // RUN: %clang_cc1 -analyze -analyzer-store=region -analyzer-checker=core,unix.Malloc -fblocks -verify -analyzer-config unix.Malloc:Optimistic=true %s
3 typedef __typeof(sizeof(int)) size_t;
4 void free(void *);
5 void *alloca(size_t);
6
t1()7 void t1 () {
8 int a[] = { 1 };
9 free(a); // expected-warning {{Argument to free() is the address of the local variable 'a', which is not memory allocated by malloc()}}
10 }
11
t2()12 void t2 () {
13 int a = 1;
14 free(&a); // expected-warning {{Argument to free() is the address of the local variable 'a', which is not memory allocated by malloc()}}
15 }
16
t3()17 void t3 () {
18 static int a[] = { 1 };
19 free(a); // expected-warning {{Argument to free() is the address of the static variable 'a', which is not memory allocated by malloc()}}
20 }
21
t4(char * x)22 void t4 (char *x) {
23 free(x); // no-warning
24 }
25
t5()26 void t5 () {
27 extern char *ptr();
28 free(ptr()); // no-warning
29 }
30
t6()31 void t6 () {
32 free((void*)1000); // expected-warning {{Argument to free() is a constant address (1000), which is not memory allocated by malloc()}}
33 }
34
t7(char ** x)35 void t7 (char **x) {
36 free(*x); // no-warning
37 }
38
t8(char ** x)39 void t8 (char **x) {
40 // ugh
41 free((*x)+8); // no-warning
42 }
43
t9()44 void t9 () {
45 label:
46 free(&&label); // expected-warning {{Argument to free() is the address of the label 'label', which is not memory allocated by malloc()}}
47 }
48
t10()49 void t10 () {
50 free((void*)&t10); // expected-warning {{Argument to free() is the address of the function 't10', which is not memory allocated by malloc()}}
51 }
52
t11()53 void t11 () {
54 char *p = (char*)alloca(2);
55 free(p); // expected-warning {{Memory allocated by alloca() should not be deallocated}}
56 }
57
t12()58 void t12 () {
59 char *p = (char*)__builtin_alloca(2);
60 free(p); // expected-warning {{Memory allocated by alloca() should not be deallocated}}
61 }
62
t13()63 void t13 () {
64 free(^{return;}); // expected-warning {{Argument to free() is a block, which is not memory allocated by malloc()}}
65 }
66
t14(char a)67 void t14 (char a) {
68 free(&a); // expected-warning {{Argument to free() is the address of the parameter 'a', which is not memory allocated by malloc()}}
69 }
70
71 static int someGlobal[2];
t15()72 void t15 () {
73 free(someGlobal); // expected-warning {{Argument to free() is the address of the global variable 'someGlobal', which is not memory allocated by malloc()}}
74 }
75
t16(char ** x,int offset)76 void t16 (char **x, int offset) {
77 // Unknown value
78 free(x[offset]); // no-warning
79 }
80