1 // RUN: %clang_cc1 -analyze -analyzer-store=region -analyzer-checker=core,unix.Malloc -fblocks -verify %s
2 // RUN: %clang_cc1 -analyze -analyzer-store=region -analyzer-checker=core,experimental.unix.MallocWithAnnotations -fblocks -verify %s
3 void free(void *);
4
t1()5 void t1 () {
6 int a[] = { 1 };
7 free(a); // expected-warning {{Argument to free() is the address of the local variable 'a', which is not memory allocated by malloc()}}
8 }
9
t2()10 void t2 () {
11 int a = 1;
12 free(&a); // expected-warning {{Argument to free() is the address of the local variable 'a', which is not memory allocated by malloc()}}
13 }
14
t3()15 void t3 () {
16 static int a[] = { 1 };
17 free(a); // expected-warning {{Argument to free() is the address of the static variable 'a', which is not memory allocated by malloc()}}
18 }
19
t4(char * x)20 void t4 (char *x) {
21 free(x); // no-warning
22 }
23
t5()24 void t5 () {
25 extern char *ptr();
26 free(ptr()); // no-warning
27 }
28
t6()29 void t6 () {
30 free((void*)1000); // expected-warning {{Argument to free() is a constant address (1000), which is not memory allocated by malloc()}}
31 }
32
t7(char ** x)33 void t7 (char **x) {
34 free(*x); // no-warning
35 }
36
t8(char ** x)37 void t8 (char **x) {
38 // ugh
39 free((*x)+8); // no-warning
40 }
41
t9()42 void t9 () {
43 label:
44 free(&&label); // expected-warning {{Argument to free() is the address of the label 'label', which is not memory allocated by malloc()}}
45 }
46
t10()47 void t10 () {
48 free((void*)&t10); // expected-warning {{Argument to free() is the address of the function 't10', which is not memory allocated by malloc()}}
49 }
50
t11()51 void t11 () {
52 char *p = (char*)__builtin_alloca(2);
53 free(p); // expected-warning {{Argument to free() was allocated by alloca(), not malloc()}}
54 }
55
t12()56 void t12 () {
57 free(^{return;}); // expected-warning {{Argument to free() is a block, which is not memory allocated by malloc()}}
58 }
59
t13(char a)60 void t13 (char a) {
61 free(&a); // expected-warning {{Argument to free() is the address of the parameter 'a', which is not memory allocated by malloc()}}
62 }
63
64 static int someGlobal[2];
t14()65 void t14 () {
66 free(someGlobal); // expected-warning {{Argument to free() is the address of the global variable 'someGlobal', which is not memory allocated by malloc()}}
67 }
68
t15(char ** x,int offset)69 void t15 (char **x, int offset) {
70 // Unknown value
71 free(x[offset]); // no-warning
72 }
73