From ae034b9106fbdd855ec22ce221bb61a1a9a532c3 Mon Sep 17 00:00:00 2001 From: David Malcolm Date: Thu, 14 Dec 2023 16:53:50 -0500 Subject: testsuite: move more analyzer test cases to c-c++-common (3) [PR96395] Move a further 268 tests from gcc.dg/analyzer to c-c++-common/analyzer. gcc/testsuite/ChangeLog: PR analyzer/96395 * c-c++-common/analyzer/analyzer-decls.h: New header. * gcc.dg/analyzer/20020129-1.c: Move to... * c-c++-common/analyzer/20020129-1.c: ...here. * gcc.dg/analyzer/SARD-tc117-basic-00001-min.c: Move to... * c-c++-common/analyzer/SARD-tc117-basic-00001-min.c: ...here. * gcc.dg/analyzer/SARD-tc249-basic-00034-min.c: Move to... * c-c++-common/analyzer/SARD-tc249-basic-00034-min.c: ...here. * gcc.dg/analyzer/abort.c: Move to... * c-c++-common/analyzer/abort.c: ...here. * gcc.dg/analyzer/aliasing-1.c: Move to... * c-c++-common/analyzer/aliasing-1.c: ...here. * gcc.dg/analyzer/aliasing-2.c: Move to... * c-c++-common/analyzer/aliasing-2.c: ...here. * gcc.dg/analyzer/alloca-leak.c: Move to... * c-c++-common/analyzer/alloca-leak.c: ...here. * gcc.dg/analyzer/analyzer-debugging-fns-1.c: Move to... * c-c++-common/analyzer/analyzer-debugging-fns-1.c: ...here. * gcc.dg/analyzer/analyzer-verbosity-2a.c: Move to... * c-c++-common/analyzer/analyzer-verbosity-2a.c: ...here. * gcc.dg/analyzer/analyzer-verbosity-3a.c: Move to... * c-c++-common/analyzer/analyzer-verbosity-3a.c: ...here. * gcc.dg/analyzer/asm-x86-1.c: Move to... * c-c++-common/analyzer/asm-x86-1.c: ...here. * gcc.dg/analyzer/attr-alloc_size-3.c: Move to... * c-c++-common/analyzer/attr-alloc_size-3.c: ...here. * gcc.dg/analyzer/attr-const-1.c: Move to... * c-c++-common/analyzer/attr-const-1.c: ...here. * gcc.dg/analyzer/attr-const-2.c: Move to... * c-c++-common/analyzer/attr-const-2.c: ...here. * gcc.dg/analyzer/attr-const-3.c: Move to... * c-c++-common/analyzer/attr-const-3.c: ...here. * gcc.dg/analyzer/attr-malloc-2.c: Move to... * c-c++-common/analyzer/attr-malloc-2.c: ...here. * gcc.dg/analyzer/attr-malloc-4.c: Move to... * c-c++-common/analyzer/attr-malloc-4.c: ...here. * gcc.dg/analyzer/attr-malloc-5.c: Move to... * c-c++-common/analyzer/attr-malloc-5.c: ...here. * gcc.dg/analyzer/attr-malloc-misuses.c: Move to... * c-c++-common/analyzer/attr-malloc-misuses.c: ...here. * gcc.dg/analyzer/attr-tainted_args-misuses.c: Move to... * c-c++-common/analyzer/attr-tainted_args-misuses.c: ...here. * gcc.dg/analyzer/bzip2-arg-parse-1.c: Move to... * c-c++-common/analyzer/bzip2-arg-parse-1.c: ...here. * gcc.dg/analyzer/call-summaries-1.c: Move to... * c-c++-common/analyzer/call-summaries-1.c: ...here. * gcc.dg/analyzer/call-summaries-3.c: Move to... * c-c++-common/analyzer/call-summaries-3.c: ...here. * gcc.dg/analyzer/call-summaries-asm-x86.c: Move to... * c-c++-common/analyzer/call-summaries-asm-x86.c: ...here. * gcc.dg/analyzer/callbacks-1.c: Move to... * c-c++-common/analyzer/callbacks-1.c: ...here. * gcc.dg/analyzer/callbacks-2.c: Move to... * c-c++-common/analyzer/callbacks-2.c: ...here. * gcc.dg/analyzer/callbacks-3.c: Move to... * c-c++-common/analyzer/callbacks-3.c: ...here. * gcc.dg/analyzer/capacity-2.c: Move to... * c-c++-common/analyzer/capacity-2.c: ...here. * gcc.dg/analyzer/capacity-3.c: Move to... * c-c++-common/analyzer/capacity-3.c: ...here. * gcc.dg/analyzer/casts-1.c: Move to... * c-c++-common/analyzer/casts-1.c: ...here. * gcc.dg/analyzer/casts-2.c: Move to... * c-c++-common/analyzer/casts-2.c: ...here. * gcc.dg/analyzer/clobbers-1.c: Move to... * c-c++-common/analyzer/clobbers-1.c: ...here. * gcc.dg/analyzer/compound-assignment-4.c: Move to... * c-c++-common/analyzer/compound-assignment-4.c: ...here. * gcc.dg/analyzer/data-model-12.c: Move to... * c-c++-common/analyzer/data-model-12.c: ...here. * gcc.dg/analyzer/data-model-14.c: Move to... * c-c++-common/analyzer/data-model-14.c: ...here. * gcc.dg/analyzer/data-model-18.c: Move to... * c-c++-common/analyzer/data-model-18.c: ...here. * gcc.dg/analyzer/data-model-2.c: Move to... * c-c++-common/analyzer/data-model-2.c: ...here. * gcc.dg/analyzer/data-model-20.c: Move to... * c-c++-common/analyzer/data-model-20.c: ...here. * gcc.dg/analyzer/data-model-21.c: Move to... * c-c++-common/analyzer/data-model-21.c: ...here. * gcc.dg/analyzer/data-model-22.c: Move to... * c-c++-common/analyzer/data-model-22.c: ...here. * gcc.dg/analyzer/data-model-4.c: Move to... * c-c++-common/analyzer/data-model-4.c: ...here. * gcc.dg/analyzer/data-model-5d.c: Move to... * c-c++-common/analyzer/data-model-5d.c: ...here. * gcc.dg/analyzer/data-model-8.c: Move to... * c-c++-common/analyzer/data-model-8.c: ...here. * gcc.dg/analyzer/data-model-path-1.c: Move to... * c-c++-common/analyzer/data-model-path-1.c: ...here. * gcc.dg/analyzer/deref-before-check-2.c: Move to... * c-c++-common/analyzer/deref-before-check-2.c: ...here. * gcc.dg/analyzer/deref-before-check-macro-pr108745.c: Move to... * c-c++-common/analyzer/deref-before-check-macro-pr108745.c: ...here. * gcc.dg/analyzer/deref-before-check-qemu-qtest_rsp_args.c: Move to... * c-c++-common/analyzer/deref-before-check-qemu-qtest_rsp_args.c: ...here. * gcc.dg/analyzer/disabling.c: Move to... * c-c++-common/analyzer/disabling.c: ...here. * gcc.dg/analyzer/dump-state.c: Move to... * c-c++-common/analyzer/dump-state.c: ...here. * gcc.dg/analyzer/edges-2.c: Move to... * c-c++-common/analyzer/edges-2.c: ...here. * gcc.dg/analyzer/equivalence.c: Move to... * c-c++-common/analyzer/equivalence.c: ...here. * gcc.dg/analyzer/errno-1.c: Move to... * c-c++-common/analyzer/errno-1.c: ...here. * gcc.dg/analyzer/errno-___errno.c: Move to... * c-c++-common/analyzer/errno-___errno.c: ...here. * gcc.dg/analyzer/errno-__error.c: Move to... * c-c++-common/analyzer/errno-__error.c: ...here. * gcc.dg/analyzer/errno-global-var.c: Move to... * c-c++-common/analyzer/errno-global-var.c: ...here. * gcc.dg/analyzer/errno-pr107777.c: Move to... * c-c++-common/analyzer/errno-pr107777.c: ...here. * gcc.dg/analyzer/error-3.c: Move to... * c-c++-common/analyzer/error-3.c: ...here. * gcc.dg/analyzer/error-uninit.c: Move to... * c-c++-common/analyzer/error-uninit.c: ...here. * gcc.dg/analyzer/factorial.c: Move to... * c-c++-common/analyzer/factorial.c: ...here. * gcc.dg/analyzer/fd-1.c: Move to... * c-c++-common/analyzer/fd-1.c: ...here. * gcc.dg/analyzer/fd-2.c: Move to... * c-c++-common/analyzer/fd-2.c: ...here. * gcc.dg/analyzer/fd-3.c: Move to... * c-c++-common/analyzer/fd-3.c: ...here. * gcc.dg/analyzer/fd-bind-pr107928.c: Move to... * c-c++-common/analyzer/fd-bind-pr107928.c: ...here. * gcc.dg/analyzer/fd-connect-pr107928.c: Move to... * c-c++-common/analyzer/fd-connect-pr107928.c: ...here. * gcc.dg/analyzer/fd-glibc-byte-stream-socket.c: Move to... * c-c++-common/analyzer/fd-glibc-byte-stream-socket.c: ...here. * gcc.dg/analyzer/fd-manpage-getaddrinfo-client.c: Move to... * c-c++-common/analyzer/fd-manpage-getaddrinfo-client.c: ...here. * gcc.dg/analyzer/fd-mappage-getaddrinfo-server.c: Move to... * c-c++-common/analyzer/fd-mappage-getaddrinfo-server.c: ...here. * gcc.dg/analyzer/fd-meaning.c: Move to... * c-c++-common/analyzer/fd-meaning.c: ...here. * gcc.dg/analyzer/fd-socket-meaning.c: Move to... * c-c++-common/analyzer/fd-socket-meaning.c: ...here. * gcc.dg/analyzer/fd-symbolic-socket.c: Move to... * c-c++-common/analyzer/fd-symbolic-socket.c: ...here. * gcc.dg/analyzer/fd-uninit-1.c: Move to... * c-c++-common/analyzer/fd-uninit-1.c: ...here. * gcc.dg/analyzer/feasibility-1.c: Move to... * c-c++-common/analyzer/feasibility-1.c: ...here. * gcc.dg/analyzer/feasibility-2.c: Move to... * c-c++-common/analyzer/feasibility-2.c: ...here. * gcc.dg/analyzer/feasibility-4.c: Move to... * c-c++-common/analyzer/feasibility-4.c: ...here. * gcc.dg/analyzer/feasibility-pr107948.c: Move to... * c-c++-common/analyzer/feasibility-pr107948.c: ...here. * gcc.dg/analyzer/ferror-1.c: Move to... * c-c++-common/analyzer/ferror-1.c: ...here. * gcc.dg/analyzer/fibonacci.c: Move to... * c-c++-common/analyzer/fibonacci.c: ...here. * gcc.dg/analyzer/file-1.c: Move to... * c-c++-common/analyzer/file-1.c: ...here. * gcc.dg/analyzer/file-3.c: Move to... * c-c++-common/analyzer/file-3.c: ...here. * gcc.dg/analyzer/file-meaning-1.c: Move to... * c-c++-common/analyzer/file-meaning-1.c: ...here. * gcc.dg/analyzer/malloc-ipa-10.c: Move to... * c-c++-common/analyzer/malloc-ipa-10.c: ...here. * gcc.dg/analyzer/malloc-ipa-12.c: Move to... * c-c++-common/analyzer/malloc-ipa-12.c: ...here. * gcc.dg/analyzer/malloc-ipa-13a.c: Move to... * c-c++-common/analyzer/malloc-ipa-13a.c: ...here. * gcc.dg/analyzer/malloc-ipa-9.c: Move to... * c-c++-common/analyzer/malloc-ipa-9.c: ...here. * gcc.dg/analyzer/malloc-many-paths-1.c: Move to... * c-c++-common/analyzer/malloc-many-paths-1.c: ...here. * gcc.dg/analyzer/malloc-many-paths-3.c: Move to... * c-c++-common/analyzer/malloc-many-paths-3.c: ...here. * gcc.dg/analyzer/malloc-meaning-1.c: Move to... * c-c++-common/analyzer/malloc-meaning-1.c: ...here. * gcc.dg/analyzer/malloc-paths-1.c: Move to... * c-c++-common/analyzer/malloc-paths-1.c: ...here. * gcc.dg/analyzer/malloc-paths-2.c: Move to... * c-c++-common/analyzer/malloc-paths-2.c: ...here. * gcc.dg/analyzer/malloc-paths-3.c: Move to... * c-c++-common/analyzer/malloc-paths-3.c: ...here. * gcc.dg/analyzer/malloc-paths-4.c: Move to... * c-c++-common/analyzer/malloc-paths-4.c: ...here. * gcc.dg/analyzer/malloc-paths-5.c: Move to... * c-c++-common/analyzer/malloc-paths-5.c: ...here. * gcc.dg/analyzer/malloc-paths-6.c: Move to... * c-c++-common/analyzer/malloc-paths-6.c: ...here. * gcc.dg/analyzer/malloc-paths-7.c: Move to... * c-c++-common/analyzer/malloc-paths-7.c: ...here. * gcc.dg/analyzer/malloc-paths-8.c: Move to... * c-c++-common/analyzer/malloc-paths-8.c: ...here. * gcc.dg/analyzer/malloc-sarif-1.c: Move to... * c-c++-common/analyzer/malloc-sarif-1.c: ...here. * gcc.dg/analyzer/malloc-vs-local-1a.c: Move to... * c-c++-common/analyzer/malloc-vs-local-1a.c: ...here. * gcc.dg/analyzer/malloc-vs-local-1b.c: Move to... * c-c++-common/analyzer/malloc-vs-local-1b.c: ...here. * gcc.dg/analyzer/malloc-vs-local-2.c: Move to... * c-c++-common/analyzer/malloc-vs-local-2.c: ...here. * gcc.dg/analyzer/malloc-vs-local-3.c: Move to... * c-c++-common/analyzer/malloc-vs-local-3.c: ...here. * gcc.dg/analyzer/many-disabled-diagnostics.c: Move to... * c-c++-common/analyzer/many-disabled-diagnostics.c: ...here. * gcc.dg/analyzer/many-unused-locals.c: Move to... * c-c++-common/analyzer/many-unused-locals.c: ...here. * gcc.dg/analyzer/memcpy-pr107882.c: Move to... * c-c++-common/analyzer/memcpy-pr107882.c: ...here. * gcc.dg/analyzer/memset-1.c: Move to... * c-c++-common/analyzer/memset-1.c: ...here. * gcc.dg/analyzer/memset-2.c: Move to... * c-c++-common/analyzer/memset-2.c: ...here. * gcc.dg/analyzer/named-constants-via-macros-2.c: Move to... * c-c++-common/analyzer/named-constants-via-macros-2.c: ...here. * gcc.dg/analyzer/named-constants-via-macros-3.c: Move to... * c-c++-common/analyzer/named-constants-via-macros-3.c: ...here. * gcc.dg/analyzer/named-constants-via-macros-4.c: Move to... * c-c++-common/analyzer/named-constants-via-macros-4.c: ...here. * gcc.dg/analyzer/named-constants-via-macros-empty.c: Move to... * c-c++-common/analyzer/named-constants-via-macros-empty.c: ...here. * gcc.dg/analyzer/named-constants-via-macros-traditional.c: Move to... * c-c++-common/analyzer/named-constants-via-macros-traditional.c: ...here. * gcc.dg/analyzer/named-constants-via-macros-undef.c: Move to... * c-c++-common/analyzer/named-constants-via-macros-undef.c: ...here. * gcc.dg/analyzer/omp-parallel-for-1.c: Move to... * c-c++-common/analyzer/omp-parallel-for-1.c: ...here. * gcc.dg/analyzer/omp-parallel-for-get-min.c: Move to... * c-c++-common/analyzer/omp-parallel-for-get-min.c: ...here. * gcc.dg/analyzer/out-of-bounds-3.c: Move to... * c-c++-common/analyzer/out-of-bounds-3.c: ...here. * gcc.dg/analyzer/out-of-bounds-coreutils.c: Move to... * c-c++-common/analyzer/out-of-bounds-coreutils.c: ...here. * gcc.dg/analyzer/out-of-bounds-curl.c: Move to... * c-c++-common/analyzer/out-of-bounds-curl.c: ...here. * gcc.dg/analyzer/out-of-bounds-diagram-1-json.c: Move to... * c-c++-common/analyzer/out-of-bounds-diagram-1-json.c: ...here. * gcc.dg/analyzer/out-of-bounds-diagram-1-sarif.c: Move to... * c-c++-common/analyzer/out-of-bounds-diagram-1-sarif.c: ...here. * gcc.dg/analyzer/out-of-bounds-pr110387.c: Move to... * c-c++-common/analyzer/out-of-bounds-pr110387.c: ...here. * gcc.dg/analyzer/out-of-bounds-read-char-arr.c: Move to... * c-c++-common/analyzer/out-of-bounds-read-char-arr.c: ...here. * gcc.dg/analyzer/out-of-bounds-read-int-arr.c: Move to... * c-c++-common/analyzer/out-of-bounds-read-int-arr.c: ...here. * gcc.dg/analyzer/out-of-bounds-read-struct-arr.c: Move to... * c-c++-common/analyzer/out-of-bounds-read-struct-arr.c: ...here. * gcc.dg/analyzer/out-of-bounds-write-char-arr.c: Move to... * c-c++-common/analyzer/out-of-bounds-write-char-arr.c: ...here. * gcc.dg/analyzer/out-of-bounds-write-int-arr.c: Move to... * c-c++-common/analyzer/out-of-bounds-write-int-arr.c: ...here. * gcc.dg/analyzer/out-of-bounds-write-struct-arr.c: Move to... * c-c++-common/analyzer/out-of-bounds-write-struct-arr.c: ...here. * gcc.dg/analyzer/params-2.c: Move to... * c-c++-common/analyzer/params-2.c: ...here. * gcc.dg/analyzer/paths-1.c: Move to... * c-c++-common/analyzer/paths-1.c: ...here. * gcc.dg/analyzer/paths-1a.c: Move to... * c-c++-common/analyzer/paths-1a.c: ...here. * gcc.dg/analyzer/paths-2.c: Move to... * c-c++-common/analyzer/paths-2.c: ...here. * gcc.dg/analyzer/paths-3.c: Move to... * c-c++-common/analyzer/paths-3.c: ...here. * gcc.dg/analyzer/paths-4.c: Move to... * c-c++-common/analyzer/paths-4.c: ...here. * gcc.dg/analyzer/paths-5.c: Move to... * c-c++-common/analyzer/paths-5.c: ...here. * gcc.dg/analyzer/paths-6.c: Move to... * c-c++-common/analyzer/paths-6.c: ...here. * gcc.dg/analyzer/paths-7.c: Move to... * c-c++-common/analyzer/paths-7.c: ...here. * gcc.dg/analyzer/paths-8.c: Move to... * c-c++-common/analyzer/paths-8.c: ...here. * gcc.dg/analyzer/pattern-test-1.c: Move to... * c-c++-common/analyzer/pattern-test-1.c: ...here. * gcc.dg/analyzer/pipe-pr107486.c: Move to... * c-c++-common/analyzer/pipe-pr107486.c: ...here. * gcc.dg/analyzer/pointer-merging.c: Move to... * c-c++-common/analyzer/pointer-merging.c: ...here. * gcc.dg/analyzer/pr100546.c: Move to... * c-c++-common/analyzer/pr100546.c: ...here. * gcc.dg/analyzer/pr101503.c: Move to... * c-c++-common/analyzer/pr101503.c: ...here. * gcc.dg/analyzer/pr101570.c: Move to... * c-c++-common/analyzer/pr101570.c: ...here. * gcc.dg/analyzer/pr101721.c: Move to... * c-c++-common/analyzer/pr101721.c: ...here. * gcc.dg/analyzer/pr102692-2.c: Move to... * c-c++-common/analyzer/pr102692-2.c: ...here. * gcc.dg/analyzer/pr102695.c: Move to... * c-c++-common/analyzer/pr102695.c: ...here. * gcc.dg/analyzer/pr103217-3.c: Move to... * c-c++-common/analyzer/pr103217-3.c: ...here. * gcc.dg/analyzer/pr103217-4.c: Move to... * c-c++-common/analyzer/pr103217-4.c: ...here. * gcc.dg/analyzer/pr103217-5.c: Move to... * c-c++-common/analyzer/pr103217-5.c: ...here. * gcc.dg/analyzer/pr104089.c: Move to... * c-c++-common/analyzer/pr104089.c: ...here. * gcc.dg/analyzer/pr104308.c: Move to... * c-c++-common/analyzer/pr104308.c: ...here. * gcc.dg/analyzer/pr104452.c: Move to... * c-c++-common/analyzer/pr104452.c: ...here. * gcc.dg/analyzer/pr104524.c: Move to... * c-c++-common/analyzer/pr104524.c: ...here. * gcc.dg/analyzer/pr104560-2.c: Move to... * c-c++-common/analyzer/pr104560-2.c: ...here. * gcc.dg/analyzer/pr105087-1.c: Move to... * c-c++-common/analyzer/pr105087-1.c: ...here. * gcc.dg/analyzer/pr105087-2.c: Move to... * c-c++-common/analyzer/pr105087-2.c: ...here. * gcc.dg/analyzer/pr105252.c: Move to... * c-c++-common/analyzer/pr105252.c: ...here. * gcc.dg/analyzer/pr106394.c: Move to... * c-c++-common/analyzer/pr106394.c: ...here. * gcc.dg/analyzer/pr106539.c: Move to... * c-c++-common/analyzer/pr106539.c: ...here. * gcc.dg/analyzer/pr106845.c: Move to... * c-c++-common/analyzer/pr106845.c: ...here. * gcc.dg/analyzer/pr109439.c: Move to... * c-c++-common/analyzer/pr109439.c: ...here. * gcc.dg/analyzer/pr110455.c: Move to... * c-c++-common/analyzer/pr110455.c: ...here. * gcc.dg/analyzer/pr93032-mztools-simplified.c: Move to... * c-c++-common/analyzer/pr93032-mztools-simplified.c: ...here. * gcc.dg/analyzer/pr93290.c: Move to... * c-c++-common/analyzer/pr93290.c: ...here. * gcc.dg/analyzer/pr93352.c: Move to... * c-c++-common/analyzer/pr93352.c: ...here. * gcc.dg/analyzer/pr93355-localealias-feasibility-3.c: Move to... * c-c++-common/analyzer/pr93355-localealias-feasibility-3.c: ...here. * gcc.dg/analyzer/pr93355-localealias-simplified.c: Move to... * c-c++-common/analyzer/pr93355-localealias-simplified.c: ...here. * gcc.dg/analyzer/pr93546.c: Move to... * c-c++-common/analyzer/pr93546.c: ...here. * gcc.dg/analyzer/pr93547.c: Move to... * c-c++-common/analyzer/pr93547.c: ...here. * gcc.dg/analyzer/pr93669.c: Move to... * c-c++-common/analyzer/pr93669.c: ...here. * gcc.dg/analyzer/pr93938.c: Move to... * c-c++-common/analyzer/pr93938.c: ...here. * gcc.dg/analyzer/pr94047.c: Move to... * c-c++-common/analyzer/pr94047.c: ...here. * gcc.dg/analyzer/pr94099.c: Move to... * c-c++-common/analyzer/pr94099.c: ...here. * gcc.dg/analyzer/pr94105.c: Move to... * c-c++-common/analyzer/pr94105.c: ...here. * gcc.dg/analyzer/pr94362-2.c: Move to... * c-c++-common/analyzer/pr94362-2.c: ...here. * gcc.dg/analyzer/pr94399.c: Move to... * c-c++-common/analyzer/pr94399.c: ...here. * gcc.dg/analyzer/pr94447.c: Move to... * c-c++-common/analyzer/pr94447.c: ...here. * gcc.dg/analyzer/pr94639.c: Move to... * c-c++-common/analyzer/pr94639.c: ...here. * gcc.dg/analyzer/pr94640.c: Move to... * c-c++-common/analyzer/pr94640.c: ...here. * gcc.dg/analyzer/pr94732.c: Move to... * c-c++-common/analyzer/pr94732.c: ...here. * gcc.dg/analyzer/pr94851-1.c: Move to... * c-c++-common/analyzer/pr94851-1.c: ...here. * gcc.dg/analyzer/pr94851-2.c: Move to... * c-c++-common/analyzer/pr94851-2.c: ...here. * gcc.dg/analyzer/pr94851-3.c: Move to... * c-c++-common/analyzer/pr94851-3.c: ...here. * gcc.dg/analyzer/pr94851-4.c: Move to... * c-c++-common/analyzer/pr94851-4.c: ...here. * gcc.dg/analyzer/pr95026.c: Move to... * c-c++-common/analyzer/pr95026.c: ...here. * gcc.dg/analyzer/pr96598.c: Move to... * c-c++-common/analyzer/pr96598.c: ...here. * gcc.dg/analyzer/pr96611.c: Move to... * c-c++-common/analyzer/pr96611.c: ...here. * gcc.dg/analyzer/pr96644.c: Move to... * c-c++-common/analyzer/pr96644.c: ...here. * gcc.dg/analyzer/pr96646.c: Move to... * c-c++-common/analyzer/pr96646.c: ...here. * gcc.dg/analyzer/pr96648.c: Move to... * c-c++-common/analyzer/pr96648.c: ...here. * gcc.dg/analyzer/pr96650-1-notrans.c: Move to... * c-c++-common/analyzer/pr96650-1-notrans.c: ...here. * gcc.dg/analyzer/pr96650-1-trans.c: Move to... * c-c++-common/analyzer/pr96650-1-trans.c: ...here. * gcc.dg/analyzer/pr96650-2-notrans.c: Move to... * c-c++-common/analyzer/pr96650-2-notrans.c: ...here. * gcc.dg/analyzer/pr96650-2-trans.c: Move to... * c-c++-common/analyzer/pr96650-2-trans.c: ...here. * gcc.dg/analyzer/pr96651-1.c: Move to... * c-c++-common/analyzer/pr96651-1.c: ...here. * gcc.dg/analyzer/pr96699.c: Move to... * c-c++-common/analyzer/pr96699.c: ...here. * gcc.dg/analyzer/pr96705.c: Move to... * c-c++-common/analyzer/pr96705.c: ...here. * gcc.dg/analyzer/pr96713.c: Move to... * c-c++-common/analyzer/pr96713.c: ...here. * gcc.dg/analyzer/pr96764.c: Move to... * c-c++-common/analyzer/pr96764.c: ...here. * gcc.dg/analyzer/pr96777.c: Move to... * c-c++-common/analyzer/pr96777.c: ...here. * gcc.dg/analyzer/pr96860-2.c: Move to... * c-c++-common/analyzer/pr96860-2.c: ...here. * gcc.dg/analyzer/pr97029.c: Move to... * c-c++-common/analyzer/pr97029.c: ...here. * gcc.dg/analyzer/pr97072.c: Move to... * c-c++-common/analyzer/pr97072.c: ...here. * gcc.dg/analyzer/pr97130.c: Move to... * c-c++-common/analyzer/pr97130.c: ...here. * gcc.dg/analyzer/pr97233.c: Move to... * c-c++-common/analyzer/pr97233.c: ...here. * gcc.dg/analyzer/pr97514.c: Move to... * c-c++-common/analyzer/pr97514.c: ...here. * gcc.dg/analyzer/pr97608.c: Move to... * c-c++-common/analyzer/pr97608.c: ...here. * gcc.dg/analyzer/pr97668.c: Move to... * c-c++-common/analyzer/pr97668.c: ...here. * gcc.dg/analyzer/pr98073.c: Move to... * c-c++-common/analyzer/pr98073.c: ...here. * gcc.dg/analyzer/pr98575-1.c: Move to... * c-c++-common/analyzer/pr98575-1.c: ...here. * gcc.dg/analyzer/pr98580-a.c: Move to... * c-c++-common/analyzer/pr98580-a.c: ...here. * gcc.dg/analyzer/pr98580-b.c: Move to... * c-c++-common/analyzer/pr98580-b.c: ...here. * gcc.dg/analyzer/pr98918.c: Move to... * c-c++-common/analyzer/pr98918.c: ...here. * gcc.dg/analyzer/pr99044-2.c: Move to... * c-c++-common/analyzer/pr99044-2.c: ...here. * gcc.dg/analyzer/pr99716-2.c: Move to... * c-c++-common/analyzer/pr99716-2.c: ...here. * gcc.dg/analyzer/pr99716-3.c: Move to... * c-c++-common/analyzer/pr99716-3.c: ...here. * gcc.dg/analyzer/pr99906.c: Move to... * c-c++-common/analyzer/pr99906.c: ...here. * gcc.dg/analyzer/pragma-1.c: Move to... * c-c++-common/analyzer/pragma-1.c: ...here. * gcc.dg/analyzer/pragma-2.c: Move to... * c-c++-common/analyzer/pragma-2.c: ...here. * gcc.dg/analyzer/refcounting-1.c: Move to... * c-c++-common/analyzer/refcounting-1.c: ...here. * gcc.dg/analyzer/rhbz1878600.c: Move to... * c-c++-common/analyzer/rhbz1878600.c: ...here. * gcc.dg/analyzer/sarif-pr107366.c: Move to... * c-c++-common/analyzer/sarif-pr107366.c: ...here. * gcc.dg/analyzer/setjmp-pr109094.c: Move to... * c-c++-common/analyzer/setjmp-pr109094.c: ...here. * gcc.dg/analyzer/sock-2.c: Move to... * c-c++-common/analyzer/sock-2.c: ...here. * gcc.dg/analyzer/stale-frame-1.c: Move to... * c-c++-common/analyzer/stale-frame-1.c: ...here. * gcc.dg/analyzer/stdarg-sentinel-1.c: Move to... * c-c++-common/analyzer/stdarg-sentinel-1.c: ...here. * gcc.dg/analyzer/stdarg-types-2.c: Move to... * c-c++-common/analyzer/stdarg-types-2.c: ...here. * gcc.dg/analyzer/stdarg-types-3.c: Move to... * c-c++-common/analyzer/stdarg-types-3.c: ...here. * gcc.dg/analyzer/stdarg-types-4.c: Move to... * c-c++-common/analyzer/stdarg-types-4.c: ...here. * gcc.dg/analyzer/strcpy-2.c: Move to... * c-c++-common/analyzer/strcpy-2.c: ...here. * gcc.dg/analyzer/strndup-1.c: Move to... * c-c++-common/analyzer/strndup-1.c: ...here. * gcc.dg/analyzer/switch-wrong-enum.c: Move to... * c-c++-common/analyzer/switch-wrong-enum.c: ...here. * gcc.dg/analyzer/symbolic-1.c: Move to... * c-c++-common/analyzer/symbolic-1.c: ...here. * gcc.dg/analyzer/symbolic-2.c: Move to... * c-c++-common/analyzer/symbolic-2.c: ...here. * gcc.dg/analyzer/symbolic-3.c: Move to... * c-c++-common/analyzer/symbolic-3.c: ...here. * gcc.dg/analyzer/symbolic-4.c: Move to... * c-c++-common/analyzer/symbolic-4.c: ...here. * gcc.dg/analyzer/symbolic-5.c: Move to... * c-c++-common/analyzer/symbolic-5.c: ...here. * gcc.dg/analyzer/symbolic-6.c: Move to... * c-c++-common/analyzer/symbolic-6.c: ...here. * gcc.dg/analyzer/symbolic-7.c: Move to... * c-c++-common/analyzer/symbolic-7.c: ...here. * gcc.dg/analyzer/symbolic-8.c: Move to... * c-c++-common/analyzer/symbolic-8.c: ...here. * gcc.dg/analyzer/symbolic-gt-1.c: Move to... * c-c++-common/analyzer/symbolic-gt-1.c: ...here. * gcc.dg/analyzer/taint-alloc-3.c: Move to... * c-c++-common/analyzer/taint-alloc-3.c: ...here. * gcc.dg/analyzer/taint-assert-BUG_ON.c: Move to... * c-c++-common/analyzer/taint-assert-BUG_ON.c: ...here. * gcc.dg/analyzer/taint-divisor-2.c: Move to... * c-c++-common/analyzer/taint-divisor-2.c: ...here. * gcc.dg/analyzer/taint-merger.c: Move to... * c-c++-common/analyzer/taint-merger.c: ...here. * gcc.dg/analyzer/taint-realloc.c: Move to... * c-c++-common/analyzer/taint-realloc.c: ...here. * gcc.dg/analyzer/uninit-1.c: Move to... * c-c++-common/analyzer/uninit-1.c: ...here. * gcc.dg/analyzer/uninit-2.c: Move to... * c-c++-common/analyzer/uninit-2.c: ...here. * gcc.dg/analyzer/uninit-3.c: Move to... * c-c++-common/analyzer/uninit-3.c: ...here. * gcc.dg/analyzer/uninit-6.c: Move to... * c-c++-common/analyzer/uninit-6.c: ...here. * gcc.dg/analyzer/uninit-6b.c: Move to... * c-c++-common/analyzer/uninit-6b.c: ...here. * gcc.dg/analyzer/uninit-8.c: Move to... * c-c++-common/analyzer/uninit-8.c: ...here. * gcc.dg/analyzer/uninit-pr104576.c: Move to... * c-c++-common/analyzer/uninit-pr104576.c: ...here. * gcc.dg/analyzer/uninit-pr106204.c: Move to... * c-c++-common/analyzer/uninit-pr106204.c: ...here. * gcc.dg/analyzer/uninit-pr108704.c: Move to... * c-c++-common/analyzer/uninit-pr108704.c: ...here. * gcc.dg/analyzer/uninit-pr108806-qemu.c: Move to... * c-c++-common/analyzer/uninit-pr108806-qemu.c: ...here. * gcc.dg/analyzer/uninit-pr108968-register.c: Move to... * c-c++-common/analyzer/uninit-pr108968-register.c: ...here. * gcc.dg/analyzer/uninit-pr94713.c: Move to... * c-c++-common/analyzer/uninit-pr94713.c: ...here. * gcc.dg/analyzer/uninit-pr94714.c: Move to... * c-c++-common/analyzer/uninit-pr94714.c: ...here. * gcc.dg/analyzer/unknown-fns-2.c: Move to... * c-c++-common/analyzer/unknown-fns-2.c: ...here. * gcc.dg/analyzer/unknown-fns-3.c: Move to... * c-c++-common/analyzer/unknown-fns-3.c: ...here. * gcc.dg/analyzer/unknown-fns-4.c: Move to... * c-c++-common/analyzer/unknown-fns-4.c: ...here. * gcc.dg/analyzer/unused-local-1.c: Move to... * c-c++-common/analyzer/unused-local-1.c: ...here. * gcc.dg/analyzer/use-after-free-2.c: Move to... * c-c++-common/analyzer/use-after-free-2.c: ...here. * gcc.dg/analyzer/use-after-free-3.c: Move to... * c-c++-common/analyzer/use-after-free-3.c: ...here. * gcc.dg/analyzer/vsnprintf-1.c: Move to... * c-c++-common/analyzer/vsnprintf-1.c: ...here. * gcc.dg/analyzer/zlib-1.c: Move to... * c-c++-common/analyzer/zlib-1.c: ...here. * gcc.dg/analyzer/zlib-2.c: Move to... * c-c++-common/analyzer/zlib-2.c: ...here. * gcc.dg/analyzer/zlib-4.c: Move to... * c-c++-common/analyzer/zlib-4.c: ...here. * gcc.dg/analyzer/zlib-5.c: Move to... * c-c++-common/analyzer/zlib-5.c: ...here. Signed-off-by: David Malcolm --- gcc/testsuite/c-c++-common/analyzer/20020129-1.c | 2 + .../analyzer/SARD-tc117-basic-00001-min.c | 67 ++++++ .../analyzer/SARD-tc249-basic-00034-min.c | 67 ++++++ gcc/testsuite/c-c++-common/analyzer/abort.c | 80 +++++++ gcc/testsuite/c-c++-common/analyzer/aliasing-1.c | 25 +++ gcc/testsuite/c-c++-common/analyzer/aliasing-2.c | 32 +++ gcc/testsuite/c-c++-common/analyzer/alloca-leak.c | 8 + .../analyzer/analyzer-debugging-fns-1.c | 11 + .../c-c++-common/analyzer/analyzer-decls.h | 1 + .../c-c++-common/analyzer/analyzer-verbosity-2a.c | 23 ++ .../c-c++-common/analyzer/analyzer-verbosity-3a.c | 23 ++ gcc/testsuite/c-c++-common/analyzer/asm-x86-1.c | 69 ++++++ .../c-c++-common/analyzer/attr-alloc_size-3.c | 14 ++ gcc/testsuite/c-c++-common/analyzer/attr-const-1.c | 152 +++++++++++++ gcc/testsuite/c-c++-common/analyzer/attr-const-2.c | 16 ++ gcc/testsuite/c-c++-common/analyzer/attr-const-3.c | 26 +++ .../c-c++-common/analyzer/attr-malloc-2.c | 24 +++ .../c-c++-common/analyzer/attr-malloc-4.c | 21 ++ .../c-c++-common/analyzer/attr-malloc-5.c | 12 ++ .../c-c++-common/analyzer/attr-malloc-misuses.c | 18 ++ .../analyzer/attr-tainted_args-misuses.c | 6 + .../c-c++-common/analyzer/bzip2-arg-parse-1.c | 95 ++++++++ .../c-c++-common/analyzer/call-summaries-1.c | 14 ++ .../c-c++-common/analyzer/call-summaries-3.c | 29 +++ .../c-c++-common/analyzer/call-summaries-asm-x86.c | 20 ++ gcc/testsuite/c-c++-common/analyzer/callbacks-1.c | 25 +++ gcc/testsuite/c-c++-common/analyzer/callbacks-2.c | 22 ++ gcc/testsuite/c-c++-common/analyzer/callbacks-3.c | 19 ++ gcc/testsuite/c-c++-common/analyzer/capacity-2.c | 55 +++++ gcc/testsuite/c-c++-common/analyzer/capacity-3.c | 84 ++++++++ gcc/testsuite/c-c++-common/analyzer/casts-1.c | 78 +++++++ gcc/testsuite/c-c++-common/analyzer/casts-2.c | 15 ++ gcc/testsuite/c-c++-common/analyzer/clobbers-1.c | 97 +++++++++ .../c-c++-common/analyzer/compound-assignment-4.c | 28 +++ .../c-c++-common/analyzer/data-model-12.c | 13 ++ .../c-c++-common/analyzer/data-model-14.c | 19 ++ .../c-c++-common/analyzer/data-model-18.c | 20 ++ gcc/testsuite/c-c++-common/analyzer/data-model-2.c | 13 ++ .../c-c++-common/analyzer/data-model-20.c | 29 +++ .../c-c++-common/analyzer/data-model-21.c | 8 + .../c-c++-common/analyzer/data-model-22.c | 101 +++++++++ gcc/testsuite/c-c++-common/analyzer/data-model-4.c | 18 ++ .../c-c++-common/analyzer/data-model-5d.c | 71 ++++++ gcc/testsuite/c-c++-common/analyzer/data-model-8.c | 25 +++ .../c-c++-common/analyzer/data-model-path-1.c | 13 ++ .../c-c++-common/analyzer/deref-before-check-2.c | 130 +++++++++++ .../analyzer/deref-before-check-macro-pr108745.c | 54 +++++ .../deref-before-check-qemu-qtest_rsp_args.c | 73 +++++++ gcc/testsuite/c-c++-common/analyzer/disabling.c | 10 + gcc/testsuite/c-c++-common/analyzer/dump-state.c | 14 ++ gcc/testsuite/c-c++-common/analyzer/edges-2.c | 20 ++ gcc/testsuite/c-c++-common/analyzer/equivalence.c | 31 +++ gcc/testsuite/c-c++-common/analyzer/errno-1.c | 23 ++ .../c-c++-common/analyzer/errno-___errno.c | 29 +++ .../c-c++-common/analyzer/errno-__error.c | 28 +++ .../c-c++-common/analyzer/errno-global-var.c | 26 +++ .../c-c++-common/analyzer/errno-pr107777.c | 20 ++ gcc/testsuite/c-c++-common/analyzer/error-3.c | 11 + gcc/testsuite/c-c++-common/analyzer/error-uninit.c | 29 +++ gcc/testsuite/c-c++-common/analyzer/factorial.c | 7 + gcc/testsuite/c-c++-common/analyzer/fd-1.c | 60 ++++++ gcc/testsuite/c-c++-common/analyzer/fd-2.c | 64 ++++++ gcc/testsuite/c-c++-common/analyzer/fd-3.c | 97 +++++++++ .../c-c++-common/analyzer/fd-bind-pr107928.c | 10 + .../c-c++-common/analyzer/fd-connect-pr107928.c | 10 + .../analyzer/fd-glibc-byte-stream-socket.c | 63 ++++++ .../analyzer/fd-manpage-getaddrinfo-client.c | 123 +++++++++++ .../analyzer/fd-mappage-getaddrinfo-server.c | 121 +++++++++++ gcc/testsuite/c-c++-common/analyzer/fd-meaning.c | 37 ++++ .../c-c++-common/analyzer/fd-socket-meaning.c | 22 ++ .../c-c++-common/analyzer/fd-symbolic-socket.c | 102 +++++++++ gcc/testsuite/c-c++-common/analyzer/fd-uninit-1.c | 19 ++ .../c-c++-common/analyzer/feasibility-1.c | 100 +++++++++ .../c-c++-common/analyzer/feasibility-2.c | 20 ++ .../c-c++-common/analyzer/feasibility-4.c | 42 ++++ .../c-c++-common/analyzer/feasibility-pr107948.c | 49 +++++ gcc/testsuite/c-c++-common/analyzer/ferror-1.c | 6 + gcc/testsuite/c-c++-common/analyzer/fibonacci.c | 9 + gcc/testsuite/c-c++-common/analyzer/file-1.c | 64 ++++++ gcc/testsuite/c-c++-common/analyzer/file-3.c | 18 ++ .../c-c++-common/analyzer/file-meaning-1.c | 15 ++ .../c-c++-common/analyzer/malloc-ipa-10.c | 32 +++ .../c-c++-common/analyzer/malloc-ipa-12.c | 7 + .../c-c++-common/analyzer/malloc-ipa-13a.c | 38 ++++ gcc/testsuite/c-c++-common/analyzer/malloc-ipa-9.c | 18 ++ .../c-c++-common/analyzer/malloc-many-paths-1.c | 14 ++ .../c-c++-common/analyzer/malloc-many-paths-3.c | 36 ++++ .../c-c++-common/analyzer/malloc-meaning-1.c | 10 + .../c-c++-common/analyzer/malloc-paths-1.c | 15 ++ .../c-c++-common/analyzer/malloc-paths-2.c | 13 ++ .../c-c++-common/analyzer/malloc-paths-3.c | 14 ++ .../c-c++-common/analyzer/malloc-paths-4.c | 20 ++ .../c-c++-common/analyzer/malloc-paths-5.c | 43 ++++ .../c-c++-common/analyzer/malloc-paths-6.c | 11 + .../c-c++-common/analyzer/malloc-paths-7.c | 21 ++ .../c-c++-common/analyzer/malloc-paths-8.c | 55 +++++ .../c-c++-common/analyzer/malloc-sarif-1.c | 22 ++ .../c-c++-common/analyzer/malloc-vs-local-1a.c | 179 ++++++++++++++++ .../c-c++-common/analyzer/malloc-vs-local-1b.c | 173 +++++++++++++++ .../c-c++-common/analyzer/malloc-vs-local-2.c | 175 +++++++++++++++ .../c-c++-common/analyzer/malloc-vs-local-3.c | 64 ++++++ .../analyzer/many-disabled-diagnostics.c | 55 +++++ .../c-c++-common/analyzer/many-unused-locals.c | 69 ++++++ .../c-c++-common/analyzer/memcpy-pr107882.c | 8 + gcc/testsuite/c-c++-common/analyzer/memset-1.c | 203 ++++++++++++++++++ gcc/testsuite/c-c++-common/analyzer/memset-2.c | 27 +++ .../analyzer/named-constants-via-macros-2.c | 15 ++ .../analyzer/named-constants-via-macros-3.c | 15 ++ .../analyzer/named-constants-via-macros-4.c | 15 ++ .../analyzer/named-constants-via-macros-empty.c | 14 ++ .../named-constants-via-macros-traditional.c | 16 ++ .../analyzer/named-constants-via-macros-undef.c | 18 ++ .../c-c++-common/analyzer/omp-parallel-for-1.c | 22 ++ .../analyzer/omp-parallel-for-get-min.c | 25 +++ .../c-c++-common/analyzer/out-of-bounds-3.c | 96 +++++++++ .../analyzer/out-of-bounds-coreutils.c | 29 +++ .../c-c++-common/analyzer/out-of-bounds-curl.c | 41 ++++ .../analyzer/out-of-bounds-diagram-1-json.c | 13 ++ .../analyzer/out-of-bounds-diagram-1-sarif.c | 24 +++ .../c-c++-common/analyzer/out-of-bounds-pr110387.c | 19 ++ .../analyzer/out-of-bounds-read-char-arr.c | 56 +++++ .../analyzer/out-of-bounds-read-int-arr.c | 58 +++++ .../analyzer/out-of-bounds-read-struct-arr.c | 65 ++++++ .../analyzer/out-of-bounds-write-char-arr.c | 56 +++++ .../analyzer/out-of-bounds-write-int-arr.c | 58 +++++ .../analyzer/out-of-bounds-write-struct-arr.c | 65 ++++++ gcc/testsuite/c-c++-common/analyzer/params-2.c | 17 ++ gcc/testsuite/c-c++-common/analyzer/paths-1.c | 17 ++ gcc/testsuite/c-c++-common/analyzer/paths-1a.c | 17 ++ gcc/testsuite/c-c++-common/analyzer/paths-2.c | 23 ++ gcc/testsuite/c-c++-common/analyzer/paths-3.c | 47 ++++ gcc/testsuite/c-c++-common/analyzer/paths-4.c | 54 +++++ gcc/testsuite/c-c++-common/analyzer/paths-5.c | 12 ++ gcc/testsuite/c-c++-common/analyzer/paths-6.c | 114 ++++++++++ gcc/testsuite/c-c++-common/analyzer/paths-7.c | 57 +++++ gcc/testsuite/c-c++-common/analyzer/paths-8.c | 17 ++ .../c-c++-common/analyzer/pattern-test-1.c | 28 +++ .../c-c++-common/analyzer/pipe-pr107486.c | 5 + .../c-c++-common/analyzer/pointer-merging.c | 16 ++ gcc/testsuite/c-c++-common/analyzer/pr100546.c | 17 ++ gcc/testsuite/c-c++-common/analyzer/pr101503.c | 11 + gcc/testsuite/c-c++-common/analyzer/pr101570.c | 5 + gcc/testsuite/c-c++-common/analyzer/pr101721.c | 8 + gcc/testsuite/c-c++-common/analyzer/pr102692-2.c | 22 ++ gcc/testsuite/c-c++-common/analyzer/pr102695.c | 44 ++++ gcc/testsuite/c-c++-common/analyzer/pr103217-3.c | 54 +++++ gcc/testsuite/c-c++-common/analyzer/pr103217-4.c | 52 +++++ gcc/testsuite/c-c++-common/analyzer/pr103217-5.c | 47 ++++ gcc/testsuite/c-c++-common/analyzer/pr104089.c | 11 + gcc/testsuite/c-c++-common/analyzer/pr104308.c | 19 ++ gcc/testsuite/c-c++-common/analyzer/pr104452.c | 10 + gcc/testsuite/c-c++-common/analyzer/pr104524.c | 9 + gcc/testsuite/c-c++-common/analyzer/pr104560-2.c | 26 +++ gcc/testsuite/c-c++-common/analyzer/pr105087-1.c | 18 ++ gcc/testsuite/c-c++-common/analyzer/pr105087-2.c | 20 ++ gcc/testsuite/c-c++-common/analyzer/pr105252.c | 20 ++ gcc/testsuite/c-c++-common/analyzer/pr106394.c | 19 ++ gcc/testsuite/c-c++-common/analyzer/pr106539.c | 15 ++ gcc/testsuite/c-c++-common/analyzer/pr106845.c | 11 + gcc/testsuite/c-c++-common/analyzer/pr109439.c | 12 ++ gcc/testsuite/c-c++-common/analyzer/pr110455.c | 7 + .../analyzer/pr93032-mztools-simplified.c | 22 ++ gcc/testsuite/c-c++-common/analyzer/pr93290.c | 9 + gcc/testsuite/c-c++-common/analyzer/pr93352.c | 12 ++ .../analyzer/pr93355-localealias-feasibility-3.c | 60 ++++++ .../analyzer/pr93355-localealias-simplified.c | 45 ++++ gcc/testsuite/c-c++-common/analyzer/pr93546.c | 11 + gcc/testsuite/c-c++-common/analyzer/pr93547.c | 14 ++ gcc/testsuite/c-c++-common/analyzer/pr93669.c | 25 +++ gcc/testsuite/c-c++-common/analyzer/pr93938.c | 13 ++ gcc/testsuite/c-c++-common/analyzer/pr94047.c | 19 ++ gcc/testsuite/c-c++-common/analyzer/pr94099.c | 28 +++ gcc/testsuite/c-c++-common/analyzer/pr94105.c | 3 + gcc/testsuite/c-c++-common/analyzer/pr94362-2.c | 42 ++++ gcc/testsuite/c-c++-common/analyzer/pr94399.c | 13 ++ gcc/testsuite/c-c++-common/analyzer/pr94447.c | 10 + gcc/testsuite/c-c++-common/analyzer/pr94639.c | 14 ++ gcc/testsuite/c-c++-common/analyzer/pr94640.c | 17 ++ gcc/testsuite/c-c++-common/analyzer/pr94732.c | 13 ++ gcc/testsuite/c-c++-common/analyzer/pr94851-1.c | 47 ++++ gcc/testsuite/c-c++-common/analyzer/pr94851-2.c | 54 +++++ gcc/testsuite/c-c++-common/analyzer/pr94851-3.c | 20 ++ gcc/testsuite/c-c++-common/analyzer/pr94851-4.c | 24 +++ gcc/testsuite/c-c++-common/analyzer/pr95026.c | 17 ++ gcc/testsuite/c-c++-common/analyzer/pr96598.c | 26 +++ gcc/testsuite/c-c++-common/analyzer/pr96611.c | 14 ++ gcc/testsuite/c-c++-common/analyzer/pr96644.c | 24 +++ gcc/testsuite/c-c++-common/analyzer/pr96646.c | 24 +++ gcc/testsuite/c-c++-common/analyzer/pr96648.c | 36 ++++ .../c-c++-common/analyzer/pr96650-1-notrans.c | 30 +++ .../c-c++-common/analyzer/pr96650-1-trans.c | 30 +++ .../c-c++-common/analyzer/pr96650-2-notrans.c | 30 +++ .../c-c++-common/analyzer/pr96650-2-trans.c | 30 +++ gcc/testsuite/c-c++-common/analyzer/pr96651-1.c | 22 ++ gcc/testsuite/c-c++-common/analyzer/pr96699.c | 13 ++ gcc/testsuite/c-c++-common/analyzer/pr96705.c | 9 + gcc/testsuite/c-c++-common/analyzer/pr96713.c | 9 + gcc/testsuite/c-c++-common/analyzer/pr96764.c | 8 + gcc/testsuite/c-c++-common/analyzer/pr96777.c | 12 ++ gcc/testsuite/c-c++-common/analyzer/pr96860-2.c | 8 + gcc/testsuite/c-c++-common/analyzer/pr97029.c | 9 + gcc/testsuite/c-c++-common/analyzer/pr97072.c | 9 + gcc/testsuite/c-c++-common/analyzer/pr97130.c | 10 + gcc/testsuite/c-c++-common/analyzer/pr97233.c | 8 + gcc/testsuite/c-c++-common/analyzer/pr97514.c | 18 ++ gcc/testsuite/c-c++-common/analyzer/pr97608.c | 17 ++ gcc/testsuite/c-c++-common/analyzer/pr97668.c | 27 +++ gcc/testsuite/c-c++-common/analyzer/pr98073.c | 13 ++ gcc/testsuite/c-c++-common/analyzer/pr98575-1.c | 46 ++++ gcc/testsuite/c-c++-common/analyzer/pr98580-a.c | 9 + gcc/testsuite/c-c++-common/analyzer/pr98580-b.c | 2 + gcc/testsuite/c-c++-common/analyzer/pr98918.c | 24 +++ gcc/testsuite/c-c++-common/analyzer/pr99044-2.c | 44 ++++ gcc/testsuite/c-c++-common/analyzer/pr99716-2.c | 34 +++ gcc/testsuite/c-c++-common/analyzer/pr99716-3.c | 16 ++ gcc/testsuite/c-c++-common/analyzer/pr99906.c | 3 + gcc/testsuite/c-c++-common/analyzer/pragma-1.c | 26 +++ gcc/testsuite/c-c++-common/analyzer/pragma-2.c | 58 +++++ .../c-c++-common/analyzer/refcounting-1.c | 31 +++ gcc/testsuite/c-c++-common/analyzer/rhbz1878600.c | 34 +++ .../c-c++-common/analyzer/sarif-pr107366.c | 21 ++ .../c-c++-common/analyzer/setjmp-pr109094.c | 38 ++++ gcc/testsuite/c-c++-common/analyzer/sock-2.c | 20 ++ .../c-c++-common/analyzer/stale-frame-1.c | 44 ++++ .../c-c++-common/analyzer/stdarg-sentinel-1.c | 25 +++ .../c-c++-common/analyzer/stdarg-types-2.c | 55 +++++ .../c-c++-common/analyzer/stdarg-types-3.c | 67 ++++++ .../c-c++-common/analyzer/stdarg-types-4.c | 22 ++ gcc/testsuite/c-c++-common/analyzer/strcpy-2.c | 27 +++ gcc/testsuite/c-c++-common/analyzer/strndup-1.c | 23 ++ .../c-c++-common/analyzer/switch-wrong-enum.c | 27 +++ gcc/testsuite/c-c++-common/analyzer/symbolic-1.c | 47 ++++ gcc/testsuite/c-c++-common/analyzer/symbolic-2.c | 32 +++ gcc/testsuite/c-c++-common/analyzer/symbolic-3.c | 12 ++ gcc/testsuite/c-c++-common/analyzer/symbolic-4.c | 20 ++ gcc/testsuite/c-c++-common/analyzer/symbolic-5.c | 29 +++ gcc/testsuite/c-c++-common/analyzer/symbolic-6.c | 24 +++ gcc/testsuite/c-c++-common/analyzer/symbolic-7.c | 50 +++++ gcc/testsuite/c-c++-common/analyzer/symbolic-8.c | 11 + .../c-c++-common/analyzer/symbolic-gt-1.c | 76 +++++++ .../c-c++-common/analyzer/taint-alloc-3.c | 18 ++ .../c-c++-common/analyzer/taint-assert-BUG_ON.c | 73 +++++++ .../c-c++-common/analyzer/taint-divisor-2.c | 10 + gcc/testsuite/c-c++-common/analyzer/taint-merger.c | 54 +++++ .../c-c++-common/analyzer/taint-realloc.c | 18 ++ gcc/testsuite/c-c++-common/analyzer/uninit-1.c | 148 +++++++++++++ gcc/testsuite/c-c++-common/analyzer/uninit-2.c | 14 ++ gcc/testsuite/c-c++-common/analyzer/uninit-3.c | 36 ++++ gcc/testsuite/c-c++-common/analyzer/uninit-6.c | 29 +++ gcc/testsuite/c-c++-common/analyzer/uninit-6b.c | 29 +++ gcc/testsuite/c-c++-common/analyzer/uninit-8.c | 73 +++++++ .../c-c++-common/analyzer/uninit-pr104576.c | 16 ++ .../c-c++-common/analyzer/uninit-pr106204.c | 17 ++ .../c-c++-common/analyzer/uninit-pr108704.c | 29 +++ .../c-c++-common/analyzer/uninit-pr108806-qemu.c | 110 ++++++++++ .../analyzer/uninit-pr108968-register.c | 9 + .../c-c++-common/analyzer/uninit-pr94713.c | 19 ++ .../c-c++-common/analyzer/uninit-pr94714.c | 12 ++ .../c-c++-common/analyzer/unknown-fns-2.c | 238 +++++++++++++++++++++ .../c-c++-common/analyzer/unknown-fns-3.c | 67 ++++++ .../c-c++-common/analyzer/unknown-fns-4.c | 15 ++ .../c-c++-common/analyzer/unused-local-1.c | 22 ++ .../c-c++-common/analyzer/use-after-free-2.c | 8 + .../c-c++-common/analyzer/use-after-free-3.c | 12 ++ gcc/testsuite/c-c++-common/analyzer/vsnprintf-1.c | 11 + gcc/testsuite/c-c++-common/analyzer/zlib-1.c | 64 ++++++ gcc/testsuite/c-c++-common/analyzer/zlib-2.c | 49 +++++ gcc/testsuite/c-c++-common/analyzer/zlib-4.c | 24 +++ gcc/testsuite/c-c++-common/analyzer/zlib-5.c | 51 +++++ gcc/testsuite/gcc.dg/analyzer/20020129-1.c | 2 - .../gcc.dg/analyzer/SARD-tc117-basic-00001-min.c | 67 ------ .../gcc.dg/analyzer/SARD-tc249-basic-00034-min.c | 67 ------ gcc/testsuite/gcc.dg/analyzer/abort.c | 80 ------- gcc/testsuite/gcc.dg/analyzer/aliasing-1.c | 25 --- gcc/testsuite/gcc.dg/analyzer/aliasing-2.c | 32 --- gcc/testsuite/gcc.dg/analyzer/alloca-leak.c | 8 - .../gcc.dg/analyzer/analyzer-debugging-fns-1.c | 11 - .../gcc.dg/analyzer/analyzer-verbosity-2a.c | 23 -- .../gcc.dg/analyzer/analyzer-verbosity-3a.c | 23 -- gcc/testsuite/gcc.dg/analyzer/asm-x86-1.c | 69 ------ gcc/testsuite/gcc.dg/analyzer/attr-alloc_size-3.c | 14 -- gcc/testsuite/gcc.dg/analyzer/attr-const-1.c | 152 ------------- gcc/testsuite/gcc.dg/analyzer/attr-const-2.c | 16 -- gcc/testsuite/gcc.dg/analyzer/attr-const-3.c | 26 --- gcc/testsuite/gcc.dg/analyzer/attr-malloc-2.c | 24 --- gcc/testsuite/gcc.dg/analyzer/attr-malloc-4.c | 21 -- gcc/testsuite/gcc.dg/analyzer/attr-malloc-5.c | 12 -- .../gcc.dg/analyzer/attr-malloc-misuses.c | 18 -- .../gcc.dg/analyzer/attr-tainted_args-misuses.c | 6 - gcc/testsuite/gcc.dg/analyzer/bzip2-arg-parse-1.c | 95 -------- gcc/testsuite/gcc.dg/analyzer/call-summaries-1.c | 14 -- gcc/testsuite/gcc.dg/analyzer/call-summaries-3.c | 29 --- .../gcc.dg/analyzer/call-summaries-asm-x86.c | 20 -- gcc/testsuite/gcc.dg/analyzer/callbacks-1.c | 25 --- gcc/testsuite/gcc.dg/analyzer/callbacks-2.c | 22 -- gcc/testsuite/gcc.dg/analyzer/callbacks-3.c | 19 -- gcc/testsuite/gcc.dg/analyzer/capacity-2.c | 55 ----- gcc/testsuite/gcc.dg/analyzer/capacity-3.c | 84 -------- gcc/testsuite/gcc.dg/analyzer/casts-1.c | 78 ------- gcc/testsuite/gcc.dg/analyzer/casts-2.c | 15 -- gcc/testsuite/gcc.dg/analyzer/clobbers-1.c | 97 --------- .../gcc.dg/analyzer/compound-assignment-4.c | 28 --- gcc/testsuite/gcc.dg/analyzer/data-model-12.c | 13 -- gcc/testsuite/gcc.dg/analyzer/data-model-14.c | 19 -- gcc/testsuite/gcc.dg/analyzer/data-model-18.c | 20 -- gcc/testsuite/gcc.dg/analyzer/data-model-2.c | 13 -- gcc/testsuite/gcc.dg/analyzer/data-model-20.c | 29 --- gcc/testsuite/gcc.dg/analyzer/data-model-21.c | 8 - gcc/testsuite/gcc.dg/analyzer/data-model-22.c | 101 --------- gcc/testsuite/gcc.dg/analyzer/data-model-4.c | 18 -- gcc/testsuite/gcc.dg/analyzer/data-model-5d.c | 71 ------ gcc/testsuite/gcc.dg/analyzer/data-model-8.c | 25 --- gcc/testsuite/gcc.dg/analyzer/data-model-path-1.c | 13 -- .../gcc.dg/analyzer/deref-before-check-2.c | 130 ----------- .../analyzer/deref-before-check-macro-pr108745.c | 54 ----- .../deref-before-check-qemu-qtest_rsp_args.c | 73 ------- gcc/testsuite/gcc.dg/analyzer/disabling.c | 10 - gcc/testsuite/gcc.dg/analyzer/dump-state.c | 14 -- gcc/testsuite/gcc.dg/analyzer/edges-2.c | 20 -- gcc/testsuite/gcc.dg/analyzer/equivalence.c | 31 --- gcc/testsuite/gcc.dg/analyzer/errno-1.c | 23 -- gcc/testsuite/gcc.dg/analyzer/errno-___errno.c | 29 --- gcc/testsuite/gcc.dg/analyzer/errno-__error.c | 28 --- gcc/testsuite/gcc.dg/analyzer/errno-global-var.c | 26 --- gcc/testsuite/gcc.dg/analyzer/errno-pr107777.c | 20 -- gcc/testsuite/gcc.dg/analyzer/error-3.c | 11 - gcc/testsuite/gcc.dg/analyzer/error-uninit.c | 29 --- gcc/testsuite/gcc.dg/analyzer/factorial.c | 7 - gcc/testsuite/gcc.dg/analyzer/fd-1.c | 60 ------ gcc/testsuite/gcc.dg/analyzer/fd-2.c | 64 ------ gcc/testsuite/gcc.dg/analyzer/fd-3.c | 97 --------- gcc/testsuite/gcc.dg/analyzer/fd-bind-pr107928.c | 10 - .../gcc.dg/analyzer/fd-connect-pr107928.c | 10 - .../gcc.dg/analyzer/fd-glibc-byte-stream-socket.c | 63 ------ .../analyzer/fd-manpage-getaddrinfo-client.c | 123 ----------- .../analyzer/fd-mappage-getaddrinfo-server.c | 121 ----------- gcc/testsuite/gcc.dg/analyzer/fd-meaning.c | 37 ---- gcc/testsuite/gcc.dg/analyzer/fd-socket-meaning.c | 22 -- gcc/testsuite/gcc.dg/analyzer/fd-symbolic-socket.c | 102 --------- gcc/testsuite/gcc.dg/analyzer/fd-uninit-1.c | 19 -- gcc/testsuite/gcc.dg/analyzer/feasibility-1.c | 100 --------- gcc/testsuite/gcc.dg/analyzer/feasibility-2.c | 20 -- gcc/testsuite/gcc.dg/analyzer/feasibility-4.c | 42 ---- .../gcc.dg/analyzer/feasibility-pr107948.c | 49 ----- gcc/testsuite/gcc.dg/analyzer/ferror-1.c | 6 - gcc/testsuite/gcc.dg/analyzer/fibonacci.c | 9 - gcc/testsuite/gcc.dg/analyzer/file-1.c | 64 ------ gcc/testsuite/gcc.dg/analyzer/file-3.c | 18 -- gcc/testsuite/gcc.dg/analyzer/file-meaning-1.c | 15 -- gcc/testsuite/gcc.dg/analyzer/malloc-ipa-10.c | 32 --- gcc/testsuite/gcc.dg/analyzer/malloc-ipa-12.c | 7 - gcc/testsuite/gcc.dg/analyzer/malloc-ipa-13a.c | 38 ---- gcc/testsuite/gcc.dg/analyzer/malloc-ipa-9.c | 18 -- .../gcc.dg/analyzer/malloc-many-paths-1.c | 14 -- .../gcc.dg/analyzer/malloc-many-paths-3.c | 36 ---- gcc/testsuite/gcc.dg/analyzer/malloc-meaning-1.c | 10 - gcc/testsuite/gcc.dg/analyzer/malloc-paths-1.c | 15 -- gcc/testsuite/gcc.dg/analyzer/malloc-paths-2.c | 13 -- gcc/testsuite/gcc.dg/analyzer/malloc-paths-3.c | 14 -- gcc/testsuite/gcc.dg/analyzer/malloc-paths-4.c | 20 -- gcc/testsuite/gcc.dg/analyzer/malloc-paths-5.c | 43 ---- gcc/testsuite/gcc.dg/analyzer/malloc-paths-6.c | 11 - gcc/testsuite/gcc.dg/analyzer/malloc-paths-7.c | 21 -- gcc/testsuite/gcc.dg/analyzer/malloc-paths-8.c | 55 ----- gcc/testsuite/gcc.dg/analyzer/malloc-sarif-1.c | 22 -- gcc/testsuite/gcc.dg/analyzer/malloc-vs-local-1a.c | 179 ---------------- gcc/testsuite/gcc.dg/analyzer/malloc-vs-local-1b.c | 173 --------------- gcc/testsuite/gcc.dg/analyzer/malloc-vs-local-2.c | 175 --------------- gcc/testsuite/gcc.dg/analyzer/malloc-vs-local-3.c | 64 ------ .../gcc.dg/analyzer/many-disabled-diagnostics.c | 55 ----- gcc/testsuite/gcc.dg/analyzer/many-unused-locals.c | 69 ------ gcc/testsuite/gcc.dg/analyzer/memcpy-pr107882.c | 8 - gcc/testsuite/gcc.dg/analyzer/memset-1.c | 203 ------------------ gcc/testsuite/gcc.dg/analyzer/memset-2.c | 27 --- .../gcc.dg/analyzer/named-constants-via-macros-2.c | 15 -- .../gcc.dg/analyzer/named-constants-via-macros-3.c | 15 -- .../gcc.dg/analyzer/named-constants-via-macros-4.c | 15 -- .../analyzer/named-constants-via-macros-empty.c | 14 -- .../named-constants-via-macros-traditional.c | 16 -- .../analyzer/named-constants-via-macros-undef.c | 18 -- gcc/testsuite/gcc.dg/analyzer/omp-parallel-for-1.c | 22 -- .../gcc.dg/analyzer/omp-parallel-for-get-min.c | 25 --- gcc/testsuite/gcc.dg/analyzer/out-of-bounds-3.c | 96 --------- .../gcc.dg/analyzer/out-of-bounds-coreutils.c | 29 --- gcc/testsuite/gcc.dg/analyzer/out-of-bounds-curl.c | 41 ---- .../gcc.dg/analyzer/out-of-bounds-diagram-1-json.c | 13 -- .../analyzer/out-of-bounds-diagram-1-sarif.c | 24 --- .../gcc.dg/analyzer/out-of-bounds-pr110387.c | 19 -- .../gcc.dg/analyzer/out-of-bounds-read-char-arr.c | 56 ----- .../gcc.dg/analyzer/out-of-bounds-read-int-arr.c | 58 ----- .../analyzer/out-of-bounds-read-struct-arr.c | 65 ------ .../gcc.dg/analyzer/out-of-bounds-write-char-arr.c | 56 ----- .../gcc.dg/analyzer/out-of-bounds-write-int-arr.c | 58 ----- .../analyzer/out-of-bounds-write-struct-arr.c | 65 ------ gcc/testsuite/gcc.dg/analyzer/params-2.c | 17 -- gcc/testsuite/gcc.dg/analyzer/paths-1.c | 17 -- gcc/testsuite/gcc.dg/analyzer/paths-1a.c | 17 -- gcc/testsuite/gcc.dg/analyzer/paths-2.c | 23 -- gcc/testsuite/gcc.dg/analyzer/paths-3.c | 47 ---- gcc/testsuite/gcc.dg/analyzer/paths-4.c | 54 ----- gcc/testsuite/gcc.dg/analyzer/paths-5.c | 12 -- gcc/testsuite/gcc.dg/analyzer/paths-6.c | 114 ---------- gcc/testsuite/gcc.dg/analyzer/paths-7.c | 57 ----- gcc/testsuite/gcc.dg/analyzer/paths-8.c | 17 -- gcc/testsuite/gcc.dg/analyzer/pattern-test-1.c | 28 --- gcc/testsuite/gcc.dg/analyzer/pipe-pr107486.c | 5 - gcc/testsuite/gcc.dg/analyzer/pointer-merging.c | 16 -- gcc/testsuite/gcc.dg/analyzer/pr100546.c | 17 -- gcc/testsuite/gcc.dg/analyzer/pr101503.c | 11 - gcc/testsuite/gcc.dg/analyzer/pr101570.c | 5 - gcc/testsuite/gcc.dg/analyzer/pr101721.c | 8 - gcc/testsuite/gcc.dg/analyzer/pr102692-2.c | 22 -- gcc/testsuite/gcc.dg/analyzer/pr102695.c | 44 ---- gcc/testsuite/gcc.dg/analyzer/pr103217-3.c | 54 ----- gcc/testsuite/gcc.dg/analyzer/pr103217-4.c | 52 ----- gcc/testsuite/gcc.dg/analyzer/pr103217-5.c | 47 ---- gcc/testsuite/gcc.dg/analyzer/pr104089.c | 11 - gcc/testsuite/gcc.dg/analyzer/pr104308.c | 19 -- gcc/testsuite/gcc.dg/analyzer/pr104452.c | 10 - gcc/testsuite/gcc.dg/analyzer/pr104524.c | 9 - gcc/testsuite/gcc.dg/analyzer/pr104560-2.c | 26 --- gcc/testsuite/gcc.dg/analyzer/pr105087-1.c | 18 -- gcc/testsuite/gcc.dg/analyzer/pr105087-2.c | 20 -- gcc/testsuite/gcc.dg/analyzer/pr105252.c | 20 -- gcc/testsuite/gcc.dg/analyzer/pr106394.c | 19 -- gcc/testsuite/gcc.dg/analyzer/pr106539.c | 15 -- gcc/testsuite/gcc.dg/analyzer/pr106845.c | 11 - gcc/testsuite/gcc.dg/analyzer/pr109439.c | 12 -- gcc/testsuite/gcc.dg/analyzer/pr110455.c | 7 - .../gcc.dg/analyzer/pr93032-mztools-simplified.c | 22 -- gcc/testsuite/gcc.dg/analyzer/pr93290.c | 9 - gcc/testsuite/gcc.dg/analyzer/pr93352.c | 12 -- .../analyzer/pr93355-localealias-feasibility-3.c | 60 ------ .../analyzer/pr93355-localealias-simplified.c | 45 ---- gcc/testsuite/gcc.dg/analyzer/pr93546.c | 11 - gcc/testsuite/gcc.dg/analyzer/pr93547.c | 14 -- gcc/testsuite/gcc.dg/analyzer/pr93669.c | 25 --- gcc/testsuite/gcc.dg/analyzer/pr93938.c | 13 -- gcc/testsuite/gcc.dg/analyzer/pr94047.c | 19 -- gcc/testsuite/gcc.dg/analyzer/pr94099.c | 28 --- gcc/testsuite/gcc.dg/analyzer/pr94105.c | 3 - gcc/testsuite/gcc.dg/analyzer/pr94362-2.c | 42 ---- gcc/testsuite/gcc.dg/analyzer/pr94399.c | 13 -- gcc/testsuite/gcc.dg/analyzer/pr94447.c | 10 - gcc/testsuite/gcc.dg/analyzer/pr94639.c | 14 -- gcc/testsuite/gcc.dg/analyzer/pr94640.c | 17 -- gcc/testsuite/gcc.dg/analyzer/pr94732.c | 13 -- gcc/testsuite/gcc.dg/analyzer/pr94851-1.c | 47 ---- gcc/testsuite/gcc.dg/analyzer/pr94851-2.c | 54 ----- gcc/testsuite/gcc.dg/analyzer/pr94851-3.c | 20 -- gcc/testsuite/gcc.dg/analyzer/pr94851-4.c | 24 --- gcc/testsuite/gcc.dg/analyzer/pr95026.c | 17 -- gcc/testsuite/gcc.dg/analyzer/pr96598.c | 26 --- gcc/testsuite/gcc.dg/analyzer/pr96611.c | 14 -- gcc/testsuite/gcc.dg/analyzer/pr96644.c | 24 --- gcc/testsuite/gcc.dg/analyzer/pr96646.c | 24 --- gcc/testsuite/gcc.dg/analyzer/pr96648.c | 36 ---- gcc/testsuite/gcc.dg/analyzer/pr96650-1-notrans.c | 30 --- gcc/testsuite/gcc.dg/analyzer/pr96650-1-trans.c | 30 --- gcc/testsuite/gcc.dg/analyzer/pr96650-2-notrans.c | 30 --- gcc/testsuite/gcc.dg/analyzer/pr96650-2-trans.c | 30 --- gcc/testsuite/gcc.dg/analyzer/pr96651-1.c | 22 -- gcc/testsuite/gcc.dg/analyzer/pr96699.c | 13 -- gcc/testsuite/gcc.dg/analyzer/pr96705.c | 9 - gcc/testsuite/gcc.dg/analyzer/pr96713.c | 9 - gcc/testsuite/gcc.dg/analyzer/pr96764.c | 8 - gcc/testsuite/gcc.dg/analyzer/pr96777.c | 12 -- gcc/testsuite/gcc.dg/analyzer/pr96860-2.c | 8 - gcc/testsuite/gcc.dg/analyzer/pr97029.c | 9 - gcc/testsuite/gcc.dg/analyzer/pr97072.c | 9 - gcc/testsuite/gcc.dg/analyzer/pr97130.c | 10 - gcc/testsuite/gcc.dg/analyzer/pr97233.c | 8 - gcc/testsuite/gcc.dg/analyzer/pr97514.c | 18 -- gcc/testsuite/gcc.dg/analyzer/pr97608.c | 17 -- gcc/testsuite/gcc.dg/analyzer/pr97668.c | 27 --- gcc/testsuite/gcc.dg/analyzer/pr98073.c | 13 -- gcc/testsuite/gcc.dg/analyzer/pr98575-1.c | 46 ---- gcc/testsuite/gcc.dg/analyzer/pr98580-a.c | 9 - gcc/testsuite/gcc.dg/analyzer/pr98580-b.c | 2 - gcc/testsuite/gcc.dg/analyzer/pr98918.c | 24 --- gcc/testsuite/gcc.dg/analyzer/pr99044-2.c | 44 ---- gcc/testsuite/gcc.dg/analyzer/pr99716-2.c | 34 --- gcc/testsuite/gcc.dg/analyzer/pr99716-3.c | 16 -- gcc/testsuite/gcc.dg/analyzer/pr99906.c | 3 - gcc/testsuite/gcc.dg/analyzer/pragma-1.c | 26 --- gcc/testsuite/gcc.dg/analyzer/pragma-2.c | 58 ----- gcc/testsuite/gcc.dg/analyzer/refcounting-1.c | 31 --- gcc/testsuite/gcc.dg/analyzer/rhbz1878600.c | 34 --- gcc/testsuite/gcc.dg/analyzer/sarif-pr107366.c | 21 -- gcc/testsuite/gcc.dg/analyzer/setjmp-pr109094.c | 38 ---- gcc/testsuite/gcc.dg/analyzer/sock-2.c | 20 -- gcc/testsuite/gcc.dg/analyzer/stale-frame-1.c | 44 ---- gcc/testsuite/gcc.dg/analyzer/stdarg-sentinel-1.c | 25 --- gcc/testsuite/gcc.dg/analyzer/stdarg-types-2.c | 55 ----- gcc/testsuite/gcc.dg/analyzer/stdarg-types-3.c | 67 ------ gcc/testsuite/gcc.dg/analyzer/stdarg-types-4.c | 22 -- gcc/testsuite/gcc.dg/analyzer/strcpy-2.c | 27 --- gcc/testsuite/gcc.dg/analyzer/strndup-1.c | 23 -- gcc/testsuite/gcc.dg/analyzer/switch-wrong-enum.c | 27 --- gcc/testsuite/gcc.dg/analyzer/symbolic-1.c | 47 ---- gcc/testsuite/gcc.dg/analyzer/symbolic-2.c | 32 --- gcc/testsuite/gcc.dg/analyzer/symbolic-3.c | 12 -- gcc/testsuite/gcc.dg/analyzer/symbolic-4.c | 20 -- gcc/testsuite/gcc.dg/analyzer/symbolic-5.c | 29 --- gcc/testsuite/gcc.dg/analyzer/symbolic-6.c | 24 --- gcc/testsuite/gcc.dg/analyzer/symbolic-7.c | 50 ----- gcc/testsuite/gcc.dg/analyzer/symbolic-8.c | 11 - gcc/testsuite/gcc.dg/analyzer/symbolic-gt-1.c | 76 ------- gcc/testsuite/gcc.dg/analyzer/taint-alloc-3.c | 18 -- .../gcc.dg/analyzer/taint-assert-BUG_ON.c | 73 ------- gcc/testsuite/gcc.dg/analyzer/taint-divisor-2.c | 10 - gcc/testsuite/gcc.dg/analyzer/taint-merger.c | 54 ----- gcc/testsuite/gcc.dg/analyzer/taint-realloc.c | 18 -- gcc/testsuite/gcc.dg/analyzer/uninit-1.c | 148 ------------- gcc/testsuite/gcc.dg/analyzer/uninit-2.c | 14 -- gcc/testsuite/gcc.dg/analyzer/uninit-3.c | 36 ---- gcc/testsuite/gcc.dg/analyzer/uninit-6.c | 29 --- gcc/testsuite/gcc.dg/analyzer/uninit-6b.c | 29 --- gcc/testsuite/gcc.dg/analyzer/uninit-8.c | 73 ------- gcc/testsuite/gcc.dg/analyzer/uninit-pr104576.c | 16 -- gcc/testsuite/gcc.dg/analyzer/uninit-pr106204.c | 17 -- gcc/testsuite/gcc.dg/analyzer/uninit-pr108704.c | 29 --- .../gcc.dg/analyzer/uninit-pr108806-qemu.c | 110 ---------- .../gcc.dg/analyzer/uninit-pr108968-register.c | 9 - gcc/testsuite/gcc.dg/analyzer/uninit-pr94713.c | 19 -- gcc/testsuite/gcc.dg/analyzer/uninit-pr94714.c | 12 -- gcc/testsuite/gcc.dg/analyzer/unknown-fns-2.c | 238 --------------------- gcc/testsuite/gcc.dg/analyzer/unknown-fns-3.c | 67 ------ gcc/testsuite/gcc.dg/analyzer/unknown-fns-4.c | 15 -- gcc/testsuite/gcc.dg/analyzer/unused-local-1.c | 22 -- gcc/testsuite/gcc.dg/analyzer/use-after-free-2.c | 8 - gcc/testsuite/gcc.dg/analyzer/use-after-free-3.c | 12 -- gcc/testsuite/gcc.dg/analyzer/vsnprintf-1.c | 11 - gcc/testsuite/gcc.dg/analyzer/zlib-1.c | 64 ------ gcc/testsuite/gcc.dg/analyzer/zlib-2.c | 49 ----- gcc/testsuite/gcc.dg/analyzer/zlib-4.c | 24 --- gcc/testsuite/gcc.dg/analyzer/zlib-5.c | 51 ----- 537 files changed, 9327 insertions(+), 9326 deletions(-) create mode 100644 gcc/testsuite/c-c++-common/analyzer/20020129-1.c create mode 100644 gcc/testsuite/c-c++-common/analyzer/SARD-tc117-basic-00001-min.c create mode 100644 gcc/testsuite/c-c++-common/analyzer/SARD-tc249-basic-00034-min.c create mode 100644 gcc/testsuite/c-c++-common/analyzer/abort.c create mode 100644 gcc/testsuite/c-c++-common/analyzer/aliasing-1.c create mode 100644 gcc/testsuite/c-c++-common/analyzer/aliasing-2.c create mode 100644 gcc/testsuite/c-c++-common/analyzer/alloca-leak.c create mode 100644 gcc/testsuite/c-c++-common/analyzer/analyzer-debugging-fns-1.c create mode 100644 gcc/testsuite/c-c++-common/analyzer/analyzer-decls.h create mode 100644 gcc/testsuite/c-c++-common/analyzer/analyzer-verbosity-2a.c create mode 100644 gcc/testsuite/c-c++-common/analyzer/analyzer-verbosity-3a.c create mode 100644 gcc/testsuite/c-c++-common/analyzer/asm-x86-1.c create mode 100644 gcc/testsuite/c-c++-common/analyzer/attr-alloc_size-3.c create mode 100644 gcc/testsuite/c-c++-common/analyzer/attr-const-1.c create mode 100644 gcc/testsuite/c-c++-common/analyzer/attr-const-2.c create mode 100644 gcc/testsuite/c-c++-common/analyzer/attr-const-3.c create mode 100644 gcc/testsuite/c-c++-common/analyzer/attr-malloc-2.c create mode 100644 gcc/testsuite/c-c++-common/analyzer/attr-malloc-4.c create mode 100644 gcc/testsuite/c-c++-common/analyzer/attr-malloc-5.c create mode 100644 gcc/testsuite/c-c++-common/analyzer/attr-malloc-misuses.c create mode 100644 gcc/testsuite/c-c++-common/analyzer/attr-tainted_args-misuses.c create mode 100644 gcc/testsuite/c-c++-common/analyzer/bzip2-arg-parse-1.c create mode 100644 gcc/testsuite/c-c++-common/analyzer/call-summaries-1.c create mode 100644 gcc/testsuite/c-c++-common/analyzer/call-summaries-3.c create mode 100644 gcc/testsuite/c-c++-common/analyzer/call-summaries-asm-x86.c create mode 100644 gcc/testsuite/c-c++-common/analyzer/callbacks-1.c create mode 100644 gcc/testsuite/c-c++-common/analyzer/callbacks-2.c create mode 100644 gcc/testsuite/c-c++-common/analyzer/callbacks-3.c create mode 100644 gcc/testsuite/c-c++-common/analyzer/capacity-2.c create mode 100644 gcc/testsuite/c-c++-common/analyzer/capacity-3.c create mode 100644 gcc/testsuite/c-c++-common/analyzer/casts-1.c create mode 100644 gcc/testsuite/c-c++-common/analyzer/casts-2.c create mode 100644 gcc/testsuite/c-c++-common/analyzer/clobbers-1.c create mode 100644 gcc/testsuite/c-c++-common/analyzer/compound-assignment-4.c create mode 100644 gcc/testsuite/c-c++-common/analyzer/data-model-12.c create mode 100644 gcc/testsuite/c-c++-common/analyzer/data-model-14.c create mode 100644 gcc/testsuite/c-c++-common/analyzer/data-model-18.c create mode 100644 gcc/testsuite/c-c++-common/analyzer/data-model-2.c create mode 100644 gcc/testsuite/c-c++-common/analyzer/data-model-20.c create mode 100644 gcc/testsuite/c-c++-common/analyzer/data-model-21.c create mode 100644 gcc/testsuite/c-c++-common/analyzer/data-model-22.c create mode 100644 gcc/testsuite/c-c++-common/analyzer/data-model-4.c create mode 100644 gcc/testsuite/c-c++-common/analyzer/data-model-5d.c create mode 100644 gcc/testsuite/c-c++-common/analyzer/data-model-8.c create mode 100644 gcc/testsuite/c-c++-common/analyzer/data-model-path-1.c create mode 100644 gcc/testsuite/c-c++-common/analyzer/deref-before-check-2.c create mode 100644 gcc/testsuite/c-c++-common/analyzer/deref-before-check-macro-pr108745.c create mode 100644 gcc/testsuite/c-c++-common/analyzer/deref-before-check-qemu-qtest_rsp_args.c create mode 100644 gcc/testsuite/c-c++-common/analyzer/disabling.c create mode 100644 gcc/testsuite/c-c++-common/analyzer/dump-state.c create mode 100644 gcc/testsuite/c-c++-common/analyzer/edges-2.c create mode 100644 gcc/testsuite/c-c++-common/analyzer/equivalence.c create mode 100644 gcc/testsuite/c-c++-common/analyzer/errno-1.c create mode 100644 gcc/testsuite/c-c++-common/analyzer/errno-___errno.c create mode 100644 gcc/testsuite/c-c++-common/analyzer/errno-__error.c create mode 100644 gcc/testsuite/c-c++-common/analyzer/errno-global-var.c create mode 100644 gcc/testsuite/c-c++-common/analyzer/errno-pr107777.c create mode 100644 gcc/testsuite/c-c++-common/analyzer/error-3.c create mode 100644 gcc/testsuite/c-c++-common/analyzer/error-uninit.c create mode 100644 gcc/testsuite/c-c++-common/analyzer/factorial.c create mode 100644 gcc/testsuite/c-c++-common/analyzer/fd-1.c create mode 100644 gcc/testsuite/c-c++-common/analyzer/fd-2.c create mode 100644 gcc/testsuite/c-c++-common/analyzer/fd-3.c create mode 100644 gcc/testsuite/c-c++-common/analyzer/fd-bind-pr107928.c create mode 100644 gcc/testsuite/c-c++-common/analyzer/fd-connect-pr107928.c create mode 100644 gcc/testsuite/c-c++-common/analyzer/fd-glibc-byte-stream-socket.c create mode 100644 gcc/testsuite/c-c++-common/analyzer/fd-manpage-getaddrinfo-client.c create mode 100644 gcc/testsuite/c-c++-common/analyzer/fd-mappage-getaddrinfo-server.c create mode 100644 gcc/testsuite/c-c++-common/analyzer/fd-meaning.c create mode 100644 gcc/testsuite/c-c++-common/analyzer/fd-socket-meaning.c create mode 100644 gcc/testsuite/c-c++-common/analyzer/fd-symbolic-socket.c create mode 100644 gcc/testsuite/c-c++-common/analyzer/fd-uninit-1.c create mode 100644 gcc/testsuite/c-c++-common/analyzer/feasibility-1.c create mode 100644 gcc/testsuite/c-c++-common/analyzer/feasibility-2.c create mode 100644 gcc/testsuite/c-c++-common/analyzer/feasibility-4.c create mode 100644 gcc/testsuite/c-c++-common/analyzer/feasibility-pr107948.c create mode 100644 gcc/testsuite/c-c++-common/analyzer/ferror-1.c create mode 100644 gcc/testsuite/c-c++-common/analyzer/fibonacci.c create mode 100644 gcc/testsuite/c-c++-common/analyzer/file-1.c create mode 100644 gcc/testsuite/c-c++-common/analyzer/file-3.c create mode 100644 gcc/testsuite/c-c++-common/analyzer/file-meaning-1.c create mode 100644 gcc/testsuite/c-c++-common/analyzer/malloc-ipa-10.c create mode 100644 gcc/testsuite/c-c++-common/analyzer/malloc-ipa-12.c create mode 100644 gcc/testsuite/c-c++-common/analyzer/malloc-ipa-13a.c create mode 100644 gcc/testsuite/c-c++-common/analyzer/malloc-ipa-9.c create mode 100644 gcc/testsuite/c-c++-common/analyzer/malloc-many-paths-1.c create mode 100644 gcc/testsuite/c-c++-common/analyzer/malloc-many-paths-3.c create mode 100644 gcc/testsuite/c-c++-common/analyzer/malloc-meaning-1.c create mode 100644 gcc/testsuite/c-c++-common/analyzer/malloc-paths-1.c create mode 100644 gcc/testsuite/c-c++-common/analyzer/malloc-paths-2.c create mode 100644 gcc/testsuite/c-c++-common/analyzer/malloc-paths-3.c create mode 100644 gcc/testsuite/c-c++-common/analyzer/malloc-paths-4.c create mode 100644 gcc/testsuite/c-c++-common/analyzer/malloc-paths-5.c create mode 100644 gcc/testsuite/c-c++-common/analyzer/malloc-paths-6.c create mode 100644 gcc/testsuite/c-c++-common/analyzer/malloc-paths-7.c create mode 100644 gcc/testsuite/c-c++-common/analyzer/malloc-paths-8.c create mode 100644 gcc/testsuite/c-c++-common/analyzer/malloc-sarif-1.c create mode 100644 gcc/testsuite/c-c++-common/analyzer/malloc-vs-local-1a.c create mode 100644 gcc/testsuite/c-c++-common/analyzer/malloc-vs-local-1b.c create mode 100644 gcc/testsuite/c-c++-common/analyzer/malloc-vs-local-2.c create mode 100644 gcc/testsuite/c-c++-common/analyzer/malloc-vs-local-3.c create mode 100644 gcc/testsuite/c-c++-common/analyzer/many-disabled-diagnostics.c create mode 100644 gcc/testsuite/c-c++-common/analyzer/many-unused-locals.c create mode 100644 gcc/testsuite/c-c++-common/analyzer/memcpy-pr107882.c create mode 100644 gcc/testsuite/c-c++-common/analyzer/memset-1.c create mode 100644 gcc/testsuite/c-c++-common/analyzer/memset-2.c create mode 100644 gcc/testsuite/c-c++-common/analyzer/named-constants-via-macros-2.c create mode 100644 gcc/testsuite/c-c++-common/analyzer/named-constants-via-macros-3.c create mode 100644 gcc/testsuite/c-c++-common/analyzer/named-constants-via-macros-4.c create mode 100644 gcc/testsuite/c-c++-common/analyzer/named-constants-via-macros-empty.c create mode 100644 gcc/testsuite/c-c++-common/analyzer/named-constants-via-macros-traditional.c create mode 100644 gcc/testsuite/c-c++-common/analyzer/named-constants-via-macros-undef.c create mode 100644 gcc/testsuite/c-c++-common/analyzer/omp-parallel-for-1.c create mode 100644 gcc/testsuite/c-c++-common/analyzer/omp-parallel-for-get-min.c create mode 100644 gcc/testsuite/c-c++-common/analyzer/out-of-bounds-3.c create mode 100644 gcc/testsuite/c-c++-common/analyzer/out-of-bounds-coreutils.c create mode 100644 gcc/testsuite/c-c++-common/analyzer/out-of-bounds-curl.c create mode 100644 gcc/testsuite/c-c++-common/analyzer/out-of-bounds-diagram-1-json.c create mode 100644 gcc/testsuite/c-c++-common/analyzer/out-of-bounds-diagram-1-sarif.c create mode 100644 gcc/testsuite/c-c++-common/analyzer/out-of-bounds-pr110387.c create mode 100644 gcc/testsuite/c-c++-common/analyzer/out-of-bounds-read-char-arr.c create mode 100644 gcc/testsuite/c-c++-common/analyzer/out-of-bounds-read-int-arr.c create mode 100644 gcc/testsuite/c-c++-common/analyzer/out-of-bounds-read-struct-arr.c create mode 100644 gcc/testsuite/c-c++-common/analyzer/out-of-bounds-write-char-arr.c create mode 100644 gcc/testsuite/c-c++-common/analyzer/out-of-bounds-write-int-arr.c create mode 100644 gcc/testsuite/c-c++-common/analyzer/out-of-bounds-write-struct-arr.c create mode 100644 gcc/testsuite/c-c++-common/analyzer/params-2.c create mode 100644 gcc/testsuite/c-c++-common/analyzer/paths-1.c create mode 100644 gcc/testsuite/c-c++-common/analyzer/paths-1a.c create mode 100644 gcc/testsuite/c-c++-common/analyzer/paths-2.c create mode 100644 gcc/testsuite/c-c++-common/analyzer/paths-3.c create mode 100644 gcc/testsuite/c-c++-common/analyzer/paths-4.c create mode 100644 gcc/testsuite/c-c++-common/analyzer/paths-5.c create mode 100644 gcc/testsuite/c-c++-common/analyzer/paths-6.c create mode 100644 gcc/testsuite/c-c++-common/analyzer/paths-7.c create mode 100644 gcc/testsuite/c-c++-common/analyzer/paths-8.c create mode 100644 gcc/testsuite/c-c++-common/analyzer/pattern-test-1.c create mode 100644 gcc/testsuite/c-c++-common/analyzer/pipe-pr107486.c create mode 100644 gcc/testsuite/c-c++-common/analyzer/pointer-merging.c create mode 100644 gcc/testsuite/c-c++-common/analyzer/pr100546.c create mode 100644 gcc/testsuite/c-c++-common/analyzer/pr101503.c create mode 100644 gcc/testsuite/c-c++-common/analyzer/pr101570.c create mode 100644 gcc/testsuite/c-c++-common/analyzer/pr101721.c create mode 100644 gcc/testsuite/c-c++-common/analyzer/pr102692-2.c create mode 100644 gcc/testsuite/c-c++-common/analyzer/pr102695.c create mode 100644 gcc/testsuite/c-c++-common/analyzer/pr103217-3.c create mode 100644 gcc/testsuite/c-c++-common/analyzer/pr103217-4.c create mode 100644 gcc/testsuite/c-c++-common/analyzer/pr103217-5.c create mode 100644 gcc/testsuite/c-c++-common/analyzer/pr104089.c create mode 100644 gcc/testsuite/c-c++-common/analyzer/pr104308.c create mode 100644 gcc/testsuite/c-c++-common/analyzer/pr104452.c create mode 100644 gcc/testsuite/c-c++-common/analyzer/pr104524.c create mode 100644 gcc/testsuite/c-c++-common/analyzer/pr104560-2.c create mode 100644 gcc/testsuite/c-c++-common/analyzer/pr105087-1.c create mode 100644 gcc/testsuite/c-c++-common/analyzer/pr105087-2.c create mode 100644 gcc/testsuite/c-c++-common/analyzer/pr105252.c create mode 100644 gcc/testsuite/c-c++-common/analyzer/pr106394.c create mode 100644 gcc/testsuite/c-c++-common/analyzer/pr106539.c create mode 100644 gcc/testsuite/c-c++-common/analyzer/pr106845.c create mode 100644 gcc/testsuite/c-c++-common/analyzer/pr109439.c create mode 100644 gcc/testsuite/c-c++-common/analyzer/pr110455.c create mode 100644 gcc/testsuite/c-c++-common/analyzer/pr93032-mztools-simplified.c create mode 100644 gcc/testsuite/c-c++-common/analyzer/pr93290.c create mode 100644 gcc/testsuite/c-c++-common/analyzer/pr93352.c create mode 100644 gcc/testsuite/c-c++-common/analyzer/pr93355-localealias-feasibility-3.c create mode 100644 gcc/testsuite/c-c++-common/analyzer/pr93355-localealias-simplified.c create mode 100644 gcc/testsuite/c-c++-common/analyzer/pr93546.c create mode 100644 gcc/testsuite/c-c++-common/analyzer/pr93547.c create mode 100644 gcc/testsuite/c-c++-common/analyzer/pr93669.c create mode 100644 gcc/testsuite/c-c++-common/analyzer/pr93938.c create mode 100644 gcc/testsuite/c-c++-common/analyzer/pr94047.c create mode 100644 gcc/testsuite/c-c++-common/analyzer/pr94099.c create mode 100644 gcc/testsuite/c-c++-common/analyzer/pr94105.c create mode 100644 gcc/testsuite/c-c++-common/analyzer/pr94362-2.c create mode 100644 gcc/testsuite/c-c++-common/analyzer/pr94399.c create mode 100644 gcc/testsuite/c-c++-common/analyzer/pr94447.c create mode 100644 gcc/testsuite/c-c++-common/analyzer/pr94639.c create mode 100644 gcc/testsuite/c-c++-common/analyzer/pr94640.c create mode 100644 gcc/testsuite/c-c++-common/analyzer/pr94732.c create mode 100644 gcc/testsuite/c-c++-common/analyzer/pr94851-1.c create mode 100644 gcc/testsuite/c-c++-common/analyzer/pr94851-2.c create mode 100644 gcc/testsuite/c-c++-common/analyzer/pr94851-3.c create mode 100644 gcc/testsuite/c-c++-common/analyzer/pr94851-4.c create mode 100644 gcc/testsuite/c-c++-common/analyzer/pr95026.c create mode 100644 gcc/testsuite/c-c++-common/analyzer/pr96598.c create mode 100644 gcc/testsuite/c-c++-common/analyzer/pr96611.c create mode 100644 gcc/testsuite/c-c++-common/analyzer/pr96644.c create mode 100644 gcc/testsuite/c-c++-common/analyzer/pr96646.c create mode 100644 gcc/testsuite/c-c++-common/analyzer/pr96648.c create mode 100644 gcc/testsuite/c-c++-common/analyzer/pr96650-1-notrans.c create mode 100644 gcc/testsuite/c-c++-common/analyzer/pr96650-1-trans.c create mode 100644 gcc/testsuite/c-c++-common/analyzer/pr96650-2-notrans.c create mode 100644 gcc/testsuite/c-c++-common/analyzer/pr96650-2-trans.c create mode 100644 gcc/testsuite/c-c++-common/analyzer/pr96651-1.c create mode 100644 gcc/testsuite/c-c++-common/analyzer/pr96699.c create mode 100644 gcc/testsuite/c-c++-common/analyzer/pr96705.c create mode 100644 gcc/testsuite/c-c++-common/analyzer/pr96713.c create mode 100644 gcc/testsuite/c-c++-common/analyzer/pr96764.c create mode 100644 gcc/testsuite/c-c++-common/analyzer/pr96777.c create mode 100644 gcc/testsuite/c-c++-common/analyzer/pr96860-2.c create mode 100644 gcc/testsuite/c-c++-common/analyzer/pr97029.c create mode 100644 gcc/testsuite/c-c++-common/analyzer/pr97072.c create mode 100644 gcc/testsuite/c-c++-common/analyzer/pr97130.c create mode 100644 gcc/testsuite/c-c++-common/analyzer/pr97233.c create mode 100644 gcc/testsuite/c-c++-common/analyzer/pr97514.c create mode 100644 gcc/testsuite/c-c++-common/analyzer/pr97608.c create mode 100644 gcc/testsuite/c-c++-common/analyzer/pr97668.c create mode 100644 gcc/testsuite/c-c++-common/analyzer/pr98073.c create mode 100644 gcc/testsuite/c-c++-common/analyzer/pr98575-1.c create mode 100644 gcc/testsuite/c-c++-common/analyzer/pr98580-a.c create mode 100644 gcc/testsuite/c-c++-common/analyzer/pr98580-b.c create mode 100644 gcc/testsuite/c-c++-common/analyzer/pr98918.c create mode 100644 gcc/testsuite/c-c++-common/analyzer/pr99044-2.c create mode 100644 gcc/testsuite/c-c++-common/analyzer/pr99716-2.c create mode 100644 gcc/testsuite/c-c++-common/analyzer/pr99716-3.c create mode 100644 gcc/testsuite/c-c++-common/analyzer/pr99906.c create mode 100644 gcc/testsuite/c-c++-common/analyzer/pragma-1.c create mode 100644 gcc/testsuite/c-c++-common/analyzer/pragma-2.c create mode 100644 gcc/testsuite/c-c++-common/analyzer/refcounting-1.c create mode 100644 gcc/testsuite/c-c++-common/analyzer/rhbz1878600.c create mode 100644 gcc/testsuite/c-c++-common/analyzer/sarif-pr107366.c create mode 100644 gcc/testsuite/c-c++-common/analyzer/setjmp-pr109094.c create mode 100644 gcc/testsuite/c-c++-common/analyzer/sock-2.c create mode 100644 gcc/testsuite/c-c++-common/analyzer/stale-frame-1.c create mode 100644 gcc/testsuite/c-c++-common/analyzer/stdarg-sentinel-1.c create mode 100644 gcc/testsuite/c-c++-common/analyzer/stdarg-types-2.c create mode 100644 gcc/testsuite/c-c++-common/analyzer/stdarg-types-3.c create mode 100644 gcc/testsuite/c-c++-common/analyzer/stdarg-types-4.c create mode 100644 gcc/testsuite/c-c++-common/analyzer/strcpy-2.c create mode 100644 gcc/testsuite/c-c++-common/analyzer/strndup-1.c create mode 100644 gcc/testsuite/c-c++-common/analyzer/switch-wrong-enum.c create mode 100644 gcc/testsuite/c-c++-common/analyzer/symbolic-1.c create mode 100644 gcc/testsuite/c-c++-common/analyzer/symbolic-2.c create mode 100644 gcc/testsuite/c-c++-common/analyzer/symbolic-3.c create mode 100644 gcc/testsuite/c-c++-common/analyzer/symbolic-4.c create mode 100644 gcc/testsuite/c-c++-common/analyzer/symbolic-5.c create mode 100644 gcc/testsuite/c-c++-common/analyzer/symbolic-6.c create mode 100644 gcc/testsuite/c-c++-common/analyzer/symbolic-7.c create mode 100644 gcc/testsuite/c-c++-common/analyzer/symbolic-8.c create mode 100644 gcc/testsuite/c-c++-common/analyzer/symbolic-gt-1.c create mode 100644 gcc/testsuite/c-c++-common/analyzer/taint-alloc-3.c create mode 100644 gcc/testsuite/c-c++-common/analyzer/taint-assert-BUG_ON.c create mode 100644 gcc/testsuite/c-c++-common/analyzer/taint-divisor-2.c create mode 100644 gcc/testsuite/c-c++-common/analyzer/taint-merger.c create mode 100644 gcc/testsuite/c-c++-common/analyzer/taint-realloc.c create mode 100644 gcc/testsuite/c-c++-common/analyzer/uninit-1.c create mode 100644 gcc/testsuite/c-c++-common/analyzer/uninit-2.c create mode 100644 gcc/testsuite/c-c++-common/analyzer/uninit-3.c create mode 100644 gcc/testsuite/c-c++-common/analyzer/uninit-6.c create mode 100644 gcc/testsuite/c-c++-common/analyzer/uninit-6b.c create mode 100644 gcc/testsuite/c-c++-common/analyzer/uninit-8.c create mode 100644 gcc/testsuite/c-c++-common/analyzer/uninit-pr104576.c create mode 100644 gcc/testsuite/c-c++-common/analyzer/uninit-pr106204.c create mode 100644 gcc/testsuite/c-c++-common/analyzer/uninit-pr108704.c create mode 100644 gcc/testsuite/c-c++-common/analyzer/uninit-pr108806-qemu.c create mode 100644 gcc/testsuite/c-c++-common/analyzer/uninit-pr108968-register.c create mode 100644 gcc/testsuite/c-c++-common/analyzer/uninit-pr94713.c create mode 100644 gcc/testsuite/c-c++-common/analyzer/uninit-pr94714.c create mode 100644 gcc/testsuite/c-c++-common/analyzer/unknown-fns-2.c create mode 100644 gcc/testsuite/c-c++-common/analyzer/unknown-fns-3.c create mode 100644 gcc/testsuite/c-c++-common/analyzer/unknown-fns-4.c create mode 100644 gcc/testsuite/c-c++-common/analyzer/unused-local-1.c create mode 100644 gcc/testsuite/c-c++-common/analyzer/use-after-free-2.c create mode 100644 gcc/testsuite/c-c++-common/analyzer/use-after-free-3.c create mode 100644 gcc/testsuite/c-c++-common/analyzer/vsnprintf-1.c create mode 100644 gcc/testsuite/c-c++-common/analyzer/zlib-1.c create mode 100644 gcc/testsuite/c-c++-common/analyzer/zlib-2.c create mode 100644 gcc/testsuite/c-c++-common/analyzer/zlib-4.c create mode 100644 gcc/testsuite/c-c++-common/analyzer/zlib-5.c delete mode 100644 gcc/testsuite/gcc.dg/analyzer/20020129-1.c delete mode 100644 gcc/testsuite/gcc.dg/analyzer/SARD-tc117-basic-00001-min.c delete mode 100644 gcc/testsuite/gcc.dg/analyzer/SARD-tc249-basic-00034-min.c delete mode 100644 gcc/testsuite/gcc.dg/analyzer/abort.c delete mode 100644 gcc/testsuite/gcc.dg/analyzer/aliasing-1.c delete mode 100644 gcc/testsuite/gcc.dg/analyzer/aliasing-2.c delete mode 100644 gcc/testsuite/gcc.dg/analyzer/alloca-leak.c delete mode 100644 gcc/testsuite/gcc.dg/analyzer/analyzer-debugging-fns-1.c delete mode 100644 gcc/testsuite/gcc.dg/analyzer/analyzer-verbosity-2a.c delete mode 100644 gcc/testsuite/gcc.dg/analyzer/analyzer-verbosity-3a.c delete mode 100644 gcc/testsuite/gcc.dg/analyzer/asm-x86-1.c delete mode 100644 gcc/testsuite/gcc.dg/analyzer/attr-alloc_size-3.c delete mode 100644 gcc/testsuite/gcc.dg/analyzer/attr-const-1.c delete mode 100644 gcc/testsuite/gcc.dg/analyzer/attr-const-2.c delete mode 100644 gcc/testsuite/gcc.dg/analyzer/attr-const-3.c delete mode 100644 gcc/testsuite/gcc.dg/analyzer/attr-malloc-2.c delete mode 100644 gcc/testsuite/gcc.dg/analyzer/attr-malloc-4.c delete mode 100644 gcc/testsuite/gcc.dg/analyzer/attr-malloc-5.c delete mode 100644 gcc/testsuite/gcc.dg/analyzer/attr-malloc-misuses.c delete mode 100644 gcc/testsuite/gcc.dg/analyzer/attr-tainted_args-misuses.c delete mode 100644 gcc/testsuite/gcc.dg/analyzer/bzip2-arg-parse-1.c delete mode 100644 gcc/testsuite/gcc.dg/analyzer/call-summaries-1.c delete mode 100644 gcc/testsuite/gcc.dg/analyzer/call-summaries-3.c delete mode 100644 gcc/testsuite/gcc.dg/analyzer/call-summaries-asm-x86.c delete mode 100644 gcc/testsuite/gcc.dg/analyzer/callbacks-1.c delete mode 100644 gcc/testsuite/gcc.dg/analyzer/callbacks-2.c delete mode 100644 gcc/testsuite/gcc.dg/analyzer/callbacks-3.c delete mode 100644 gcc/testsuite/gcc.dg/analyzer/capacity-2.c delete mode 100644 gcc/testsuite/gcc.dg/analyzer/capacity-3.c delete mode 100644 gcc/testsuite/gcc.dg/analyzer/casts-1.c delete mode 100644 gcc/testsuite/gcc.dg/analyzer/casts-2.c delete mode 100644 gcc/testsuite/gcc.dg/analyzer/clobbers-1.c delete mode 100644 gcc/testsuite/gcc.dg/analyzer/compound-assignment-4.c delete mode 100644 gcc/testsuite/gcc.dg/analyzer/data-model-12.c delete mode 100644 gcc/testsuite/gcc.dg/analyzer/data-model-14.c delete mode 100644 gcc/testsuite/gcc.dg/analyzer/data-model-18.c delete mode 100644 gcc/testsuite/gcc.dg/analyzer/data-model-2.c delete mode 100644 gcc/testsuite/gcc.dg/analyzer/data-model-20.c delete mode 100644 gcc/testsuite/gcc.dg/analyzer/data-model-21.c delete mode 100644 gcc/testsuite/gcc.dg/analyzer/data-model-22.c delete mode 100644 gcc/testsuite/gcc.dg/analyzer/data-model-4.c delete mode 100644 gcc/testsuite/gcc.dg/analyzer/data-model-5d.c delete mode 100644 gcc/testsuite/gcc.dg/analyzer/data-model-8.c delete mode 100644 gcc/testsuite/gcc.dg/analyzer/data-model-path-1.c delete mode 100644 gcc/testsuite/gcc.dg/analyzer/deref-before-check-2.c delete mode 100644 gcc/testsuite/gcc.dg/analyzer/deref-before-check-macro-pr108745.c delete mode 100644 gcc/testsuite/gcc.dg/analyzer/deref-before-check-qemu-qtest_rsp_args.c delete mode 100644 gcc/testsuite/gcc.dg/analyzer/disabling.c delete mode 100644 gcc/testsuite/gcc.dg/analyzer/dump-state.c delete mode 100644 gcc/testsuite/gcc.dg/analyzer/edges-2.c delete mode 100644 gcc/testsuite/gcc.dg/analyzer/equivalence.c delete mode 100644 gcc/testsuite/gcc.dg/analyzer/errno-1.c delete mode 100644 gcc/testsuite/gcc.dg/analyzer/errno-___errno.c delete mode 100644 gcc/testsuite/gcc.dg/analyzer/errno-__error.c delete mode 100644 gcc/testsuite/gcc.dg/analyzer/errno-global-var.c delete mode 100644 gcc/testsuite/gcc.dg/analyzer/errno-pr107777.c delete mode 100644 gcc/testsuite/gcc.dg/analyzer/error-3.c delete mode 100644 gcc/testsuite/gcc.dg/analyzer/error-uninit.c delete mode 100644 gcc/testsuite/gcc.dg/analyzer/factorial.c delete mode 100644 gcc/testsuite/gcc.dg/analyzer/fd-1.c delete mode 100644 gcc/testsuite/gcc.dg/analyzer/fd-2.c delete mode 100644 gcc/testsuite/gcc.dg/analyzer/fd-3.c delete mode 100644 gcc/testsuite/gcc.dg/analyzer/fd-bind-pr107928.c delete mode 100644 gcc/testsuite/gcc.dg/analyzer/fd-connect-pr107928.c delete mode 100644 gcc/testsuite/gcc.dg/analyzer/fd-glibc-byte-stream-socket.c delete mode 100644 gcc/testsuite/gcc.dg/analyzer/fd-manpage-getaddrinfo-client.c delete mode 100644 gcc/testsuite/gcc.dg/analyzer/fd-mappage-getaddrinfo-server.c delete mode 100644 gcc/testsuite/gcc.dg/analyzer/fd-meaning.c delete mode 100644 gcc/testsuite/gcc.dg/analyzer/fd-socket-meaning.c delete mode 100644 gcc/testsuite/gcc.dg/analyzer/fd-symbolic-socket.c delete mode 100644 gcc/testsuite/gcc.dg/analyzer/fd-uninit-1.c delete mode 100644 gcc/testsuite/gcc.dg/analyzer/feasibility-1.c delete mode 100644 gcc/testsuite/gcc.dg/analyzer/feasibility-2.c delete mode 100644 gcc/testsuite/gcc.dg/analyzer/feasibility-4.c delete mode 100644 gcc/testsuite/gcc.dg/analyzer/feasibility-pr107948.c delete mode 100644 gcc/testsuite/gcc.dg/analyzer/ferror-1.c delete mode 100644 gcc/testsuite/gcc.dg/analyzer/fibonacci.c delete mode 100644 gcc/testsuite/gcc.dg/analyzer/file-1.c delete mode 100644 gcc/testsuite/gcc.dg/analyzer/file-3.c delete mode 100644 gcc/testsuite/gcc.dg/analyzer/file-meaning-1.c delete mode 100644 gcc/testsuite/gcc.dg/analyzer/malloc-ipa-10.c delete mode 100644 gcc/testsuite/gcc.dg/analyzer/malloc-ipa-12.c delete mode 100644 gcc/testsuite/gcc.dg/analyzer/malloc-ipa-13a.c delete mode 100644 gcc/testsuite/gcc.dg/analyzer/malloc-ipa-9.c delete mode 100644 gcc/testsuite/gcc.dg/analyzer/malloc-many-paths-1.c delete mode 100644 gcc/testsuite/gcc.dg/analyzer/malloc-many-paths-3.c delete mode 100644 gcc/testsuite/gcc.dg/analyzer/malloc-meaning-1.c delete mode 100644 gcc/testsuite/gcc.dg/analyzer/malloc-paths-1.c delete mode 100644 gcc/testsuite/gcc.dg/analyzer/malloc-paths-2.c delete mode 100644 gcc/testsuite/gcc.dg/analyzer/malloc-paths-3.c delete mode 100644 gcc/testsuite/gcc.dg/analyzer/malloc-paths-4.c delete mode 100644 gcc/testsuite/gcc.dg/analyzer/malloc-paths-5.c delete mode 100644 gcc/testsuite/gcc.dg/analyzer/malloc-paths-6.c delete mode 100644 gcc/testsuite/gcc.dg/analyzer/malloc-paths-7.c delete mode 100644 gcc/testsuite/gcc.dg/analyzer/malloc-paths-8.c delete mode 100644 gcc/testsuite/gcc.dg/analyzer/malloc-sarif-1.c delete mode 100644 gcc/testsuite/gcc.dg/analyzer/malloc-vs-local-1a.c delete mode 100644 gcc/testsuite/gcc.dg/analyzer/malloc-vs-local-1b.c delete mode 100644 gcc/testsuite/gcc.dg/analyzer/malloc-vs-local-2.c delete mode 100644 gcc/testsuite/gcc.dg/analyzer/malloc-vs-local-3.c delete mode 100644 gcc/testsuite/gcc.dg/analyzer/many-disabled-diagnostics.c delete mode 100644 gcc/testsuite/gcc.dg/analyzer/many-unused-locals.c delete mode 100644 gcc/testsuite/gcc.dg/analyzer/memcpy-pr107882.c delete mode 100644 gcc/testsuite/gcc.dg/analyzer/memset-1.c delete mode 100644 gcc/testsuite/gcc.dg/analyzer/memset-2.c delete mode 100644 gcc/testsuite/gcc.dg/analyzer/named-constants-via-macros-2.c delete mode 100644 gcc/testsuite/gcc.dg/analyzer/named-constants-via-macros-3.c delete mode 100644 gcc/testsuite/gcc.dg/analyzer/named-constants-via-macros-4.c delete mode 100644 gcc/testsuite/gcc.dg/analyzer/named-constants-via-macros-empty.c delete mode 100644 gcc/testsuite/gcc.dg/analyzer/named-constants-via-macros-traditional.c delete mode 100644 gcc/testsuite/gcc.dg/analyzer/named-constants-via-macros-undef.c delete mode 100644 gcc/testsuite/gcc.dg/analyzer/omp-parallel-for-1.c delete mode 100644 gcc/testsuite/gcc.dg/analyzer/omp-parallel-for-get-min.c delete mode 100644 gcc/testsuite/gcc.dg/analyzer/out-of-bounds-3.c delete mode 100644 gcc/testsuite/gcc.dg/analyzer/out-of-bounds-coreutils.c delete mode 100644 gcc/testsuite/gcc.dg/analyzer/out-of-bounds-curl.c delete mode 100644 gcc/testsuite/gcc.dg/analyzer/out-of-bounds-diagram-1-json.c delete mode 100644 gcc/testsuite/gcc.dg/analyzer/out-of-bounds-diagram-1-sarif.c delete mode 100644 gcc/testsuite/gcc.dg/analyzer/out-of-bounds-pr110387.c delete mode 100644 gcc/testsuite/gcc.dg/analyzer/out-of-bounds-read-char-arr.c delete mode 100644 gcc/testsuite/gcc.dg/analyzer/out-of-bounds-read-int-arr.c delete mode 100644 gcc/testsuite/gcc.dg/analyzer/out-of-bounds-read-struct-arr.c delete mode 100644 gcc/testsuite/gcc.dg/analyzer/out-of-bounds-write-char-arr.c delete mode 100644 gcc/testsuite/gcc.dg/analyzer/out-of-bounds-write-int-arr.c delete mode 100644 gcc/testsuite/gcc.dg/analyzer/out-of-bounds-write-struct-arr.c delete mode 100644 gcc/testsuite/gcc.dg/analyzer/params-2.c delete mode 100644 gcc/testsuite/gcc.dg/analyzer/paths-1.c delete mode 100644 gcc/testsuite/gcc.dg/analyzer/paths-1a.c delete mode 100644 gcc/testsuite/gcc.dg/analyzer/paths-2.c delete mode 100644 gcc/testsuite/gcc.dg/analyzer/paths-3.c delete mode 100644 gcc/testsuite/gcc.dg/analyzer/paths-4.c delete mode 100644 gcc/testsuite/gcc.dg/analyzer/paths-5.c delete mode 100644 gcc/testsuite/gcc.dg/analyzer/paths-6.c delete mode 100644 gcc/testsuite/gcc.dg/analyzer/paths-7.c delete mode 100644 gcc/testsuite/gcc.dg/analyzer/paths-8.c delete mode 100644 gcc/testsuite/gcc.dg/analyzer/pattern-test-1.c delete mode 100644 gcc/testsuite/gcc.dg/analyzer/pipe-pr107486.c delete mode 100644 gcc/testsuite/gcc.dg/analyzer/pointer-merging.c delete mode 100644 gcc/testsuite/gcc.dg/analyzer/pr100546.c delete mode 100644 gcc/testsuite/gcc.dg/analyzer/pr101503.c delete mode 100644 gcc/testsuite/gcc.dg/analyzer/pr101570.c delete mode 100644 gcc/testsuite/gcc.dg/analyzer/pr101721.c delete mode 100644 gcc/testsuite/gcc.dg/analyzer/pr102692-2.c delete mode 100644 gcc/testsuite/gcc.dg/analyzer/pr102695.c delete mode 100644 gcc/testsuite/gcc.dg/analyzer/pr103217-3.c delete mode 100644 gcc/testsuite/gcc.dg/analyzer/pr103217-4.c delete mode 100644 gcc/testsuite/gcc.dg/analyzer/pr103217-5.c delete mode 100644 gcc/testsuite/gcc.dg/analyzer/pr104089.c delete mode 100644 gcc/testsuite/gcc.dg/analyzer/pr104308.c delete mode 100644 gcc/testsuite/gcc.dg/analyzer/pr104452.c delete mode 100644 gcc/testsuite/gcc.dg/analyzer/pr104524.c delete mode 100644 gcc/testsuite/gcc.dg/analyzer/pr104560-2.c delete mode 100644 gcc/testsuite/gcc.dg/analyzer/pr105087-1.c delete mode 100644 gcc/testsuite/gcc.dg/analyzer/pr105087-2.c delete mode 100644 gcc/testsuite/gcc.dg/analyzer/pr105252.c delete mode 100644 gcc/testsuite/gcc.dg/analyzer/pr106394.c delete mode 100644 gcc/testsuite/gcc.dg/analyzer/pr106539.c delete mode 100644 gcc/testsuite/gcc.dg/analyzer/pr106845.c delete mode 100644 gcc/testsuite/gcc.dg/analyzer/pr109439.c delete mode 100644 gcc/testsuite/gcc.dg/analyzer/pr110455.c delete mode 100644 gcc/testsuite/gcc.dg/analyzer/pr93032-mztools-simplified.c delete mode 100644 gcc/testsuite/gcc.dg/analyzer/pr93290.c delete mode 100644 gcc/testsuite/gcc.dg/analyzer/pr93352.c delete mode 100644 gcc/testsuite/gcc.dg/analyzer/pr93355-localealias-feasibility-3.c delete mode 100644 gcc/testsuite/gcc.dg/analyzer/pr93355-localealias-simplified.c delete mode 100644 gcc/testsuite/gcc.dg/analyzer/pr93546.c delete mode 100644 gcc/testsuite/gcc.dg/analyzer/pr93547.c delete mode 100644 gcc/testsuite/gcc.dg/analyzer/pr93669.c delete mode 100644 gcc/testsuite/gcc.dg/analyzer/pr93938.c delete mode 100644 gcc/testsuite/gcc.dg/analyzer/pr94047.c delete mode 100644 gcc/testsuite/gcc.dg/analyzer/pr94099.c delete mode 100644 gcc/testsuite/gcc.dg/analyzer/pr94105.c delete mode 100644 gcc/testsuite/gcc.dg/analyzer/pr94362-2.c delete mode 100644 gcc/testsuite/gcc.dg/analyzer/pr94399.c delete mode 100644 gcc/testsuite/gcc.dg/analyzer/pr94447.c delete mode 100644 gcc/testsuite/gcc.dg/analyzer/pr94639.c delete mode 100644 gcc/testsuite/gcc.dg/analyzer/pr94640.c delete mode 100644 gcc/testsuite/gcc.dg/analyzer/pr94732.c delete mode 100644 gcc/testsuite/gcc.dg/analyzer/pr94851-1.c delete mode 100644 gcc/testsuite/gcc.dg/analyzer/pr94851-2.c delete mode 100644 gcc/testsuite/gcc.dg/analyzer/pr94851-3.c delete mode 100644 gcc/testsuite/gcc.dg/analyzer/pr94851-4.c delete mode 100644 gcc/testsuite/gcc.dg/analyzer/pr95026.c delete mode 100644 gcc/testsuite/gcc.dg/analyzer/pr96598.c delete mode 100644 gcc/testsuite/gcc.dg/analyzer/pr96611.c delete mode 100644 gcc/testsuite/gcc.dg/analyzer/pr96644.c delete mode 100644 gcc/testsuite/gcc.dg/analyzer/pr96646.c delete mode 100644 gcc/testsuite/gcc.dg/analyzer/pr96648.c delete mode 100644 gcc/testsuite/gcc.dg/analyzer/pr96650-1-notrans.c delete mode 100644 gcc/testsuite/gcc.dg/analyzer/pr96650-1-trans.c delete mode 100644 gcc/testsuite/gcc.dg/analyzer/pr96650-2-notrans.c delete mode 100644 gcc/testsuite/gcc.dg/analyzer/pr96650-2-trans.c delete mode 100644 gcc/testsuite/gcc.dg/analyzer/pr96651-1.c delete mode 100644 gcc/testsuite/gcc.dg/analyzer/pr96699.c delete mode 100644 gcc/testsuite/gcc.dg/analyzer/pr96705.c delete mode 100644 gcc/testsuite/gcc.dg/analyzer/pr96713.c delete mode 100644 gcc/testsuite/gcc.dg/analyzer/pr96764.c delete mode 100644 gcc/testsuite/gcc.dg/analyzer/pr96777.c delete mode 100644 gcc/testsuite/gcc.dg/analyzer/pr96860-2.c delete mode 100644 gcc/testsuite/gcc.dg/analyzer/pr97029.c delete mode 100644 gcc/testsuite/gcc.dg/analyzer/pr97072.c delete mode 100644 gcc/testsuite/gcc.dg/analyzer/pr97130.c delete mode 100644 gcc/testsuite/gcc.dg/analyzer/pr97233.c delete mode 100644 gcc/testsuite/gcc.dg/analyzer/pr97514.c delete mode 100644 gcc/testsuite/gcc.dg/analyzer/pr97608.c delete mode 100644 gcc/testsuite/gcc.dg/analyzer/pr97668.c delete mode 100644 gcc/testsuite/gcc.dg/analyzer/pr98073.c delete mode 100644 gcc/testsuite/gcc.dg/analyzer/pr98575-1.c delete mode 100644 gcc/testsuite/gcc.dg/analyzer/pr98580-a.c delete mode 100644 gcc/testsuite/gcc.dg/analyzer/pr98580-b.c delete mode 100644 gcc/testsuite/gcc.dg/analyzer/pr98918.c delete mode 100644 gcc/testsuite/gcc.dg/analyzer/pr99044-2.c delete mode 100644 gcc/testsuite/gcc.dg/analyzer/pr99716-2.c delete mode 100644 gcc/testsuite/gcc.dg/analyzer/pr99716-3.c delete mode 100644 gcc/testsuite/gcc.dg/analyzer/pr99906.c delete mode 100644 gcc/testsuite/gcc.dg/analyzer/pragma-1.c delete mode 100644 gcc/testsuite/gcc.dg/analyzer/pragma-2.c delete mode 100644 gcc/testsuite/gcc.dg/analyzer/refcounting-1.c delete mode 100644 gcc/testsuite/gcc.dg/analyzer/rhbz1878600.c delete mode 100644 gcc/testsuite/gcc.dg/analyzer/sarif-pr107366.c delete mode 100644 gcc/testsuite/gcc.dg/analyzer/setjmp-pr109094.c delete mode 100644 gcc/testsuite/gcc.dg/analyzer/sock-2.c delete mode 100644 gcc/testsuite/gcc.dg/analyzer/stale-frame-1.c delete mode 100644 gcc/testsuite/gcc.dg/analyzer/stdarg-sentinel-1.c delete mode 100644 gcc/testsuite/gcc.dg/analyzer/stdarg-types-2.c delete mode 100644 gcc/testsuite/gcc.dg/analyzer/stdarg-types-3.c delete mode 100644 gcc/testsuite/gcc.dg/analyzer/stdarg-types-4.c delete mode 100644 gcc/testsuite/gcc.dg/analyzer/strcpy-2.c delete mode 100644 gcc/testsuite/gcc.dg/analyzer/strndup-1.c delete mode 100644 gcc/testsuite/gcc.dg/analyzer/switch-wrong-enum.c delete mode 100644 gcc/testsuite/gcc.dg/analyzer/symbolic-1.c delete mode 100644 gcc/testsuite/gcc.dg/analyzer/symbolic-2.c delete mode 100644 gcc/testsuite/gcc.dg/analyzer/symbolic-3.c delete mode 100644 gcc/testsuite/gcc.dg/analyzer/symbolic-4.c delete mode 100644 gcc/testsuite/gcc.dg/analyzer/symbolic-5.c delete mode 100644 gcc/testsuite/gcc.dg/analyzer/symbolic-6.c delete mode 100644 gcc/testsuite/gcc.dg/analyzer/symbolic-7.c delete mode 100644 gcc/testsuite/gcc.dg/analyzer/symbolic-8.c delete mode 100644 gcc/testsuite/gcc.dg/analyzer/symbolic-gt-1.c delete mode 100644 gcc/testsuite/gcc.dg/analyzer/taint-alloc-3.c delete mode 100644 gcc/testsuite/gcc.dg/analyzer/taint-assert-BUG_ON.c delete mode 100644 gcc/testsuite/gcc.dg/analyzer/taint-divisor-2.c delete mode 100644 gcc/testsuite/gcc.dg/analyzer/taint-merger.c delete mode 100644 gcc/testsuite/gcc.dg/analyzer/taint-realloc.c delete mode 100644 gcc/testsuite/gcc.dg/analyzer/uninit-1.c delete mode 100644 gcc/testsuite/gcc.dg/analyzer/uninit-2.c delete mode 100644 gcc/testsuite/gcc.dg/analyzer/uninit-3.c delete mode 100644 gcc/testsuite/gcc.dg/analyzer/uninit-6.c delete mode 100644 gcc/testsuite/gcc.dg/analyzer/uninit-6b.c delete mode 100644 gcc/testsuite/gcc.dg/analyzer/uninit-8.c delete mode 100644 gcc/testsuite/gcc.dg/analyzer/uninit-pr104576.c delete mode 100644 gcc/testsuite/gcc.dg/analyzer/uninit-pr106204.c delete mode 100644 gcc/testsuite/gcc.dg/analyzer/uninit-pr108704.c delete mode 100644 gcc/testsuite/gcc.dg/analyzer/uninit-pr108806-qemu.c delete mode 100644 gcc/testsuite/gcc.dg/analyzer/uninit-pr108968-register.c delete mode 100644 gcc/testsuite/gcc.dg/analyzer/uninit-pr94713.c delete mode 100644 gcc/testsuite/gcc.dg/analyzer/uninit-pr94714.c delete mode 100644 gcc/testsuite/gcc.dg/analyzer/unknown-fns-2.c delete mode 100644 gcc/testsuite/gcc.dg/analyzer/unknown-fns-3.c delete mode 100644 gcc/testsuite/gcc.dg/analyzer/unknown-fns-4.c delete mode 100644 gcc/testsuite/gcc.dg/analyzer/unused-local-1.c delete mode 100644 gcc/testsuite/gcc.dg/analyzer/use-after-free-2.c delete mode 100644 gcc/testsuite/gcc.dg/analyzer/use-after-free-3.c delete mode 100644 gcc/testsuite/gcc.dg/analyzer/vsnprintf-1.c delete mode 100644 gcc/testsuite/gcc.dg/analyzer/zlib-1.c delete mode 100644 gcc/testsuite/gcc.dg/analyzer/zlib-2.c delete mode 100644 gcc/testsuite/gcc.dg/analyzer/zlib-4.c delete mode 100644 gcc/testsuite/gcc.dg/analyzer/zlib-5.c (limited to 'gcc') diff --git a/gcc/testsuite/c-c++-common/analyzer/20020129-1.c b/gcc/testsuite/c-c++-common/analyzer/20020129-1.c new file mode 100644 index 0000000..7d49519 --- /dev/null +++ b/gcc/testsuite/c-c++-common/analyzer/20020129-1.c @@ -0,0 +1,2 @@ +/* { dg-require-effective-target indirect_calls } */ +#include "../../gcc.c-torture/compile/20020129-1.c" diff --git a/gcc/testsuite/c-c++-common/analyzer/SARD-tc117-basic-00001-min.c b/gcc/testsuite/c-c++-common/analyzer/SARD-tc117-basic-00001-min.c new file mode 100644 index 0000000..e1ce195 --- /dev/null +++ b/gcc/testsuite/c-c++-common/analyzer/SARD-tc117-basic-00001-min.c @@ -0,0 +1,67 @@ +/* Adapted from https://samate.nist.gov/SARD/test-cases/117/versions/1.0.0 + Part of https://samate.nist.gov/SARD/test-suites/81 + See: + Black, P. , Koo, H. and Irish, T. (2013), A Basic CWE-121 Buffer Overflow Effectiveness Test Suite, Proc. 6th Latin-American Symposium on Dependable Computing, Rio de Janeiro, -1, [online], https://tsapps.nist.gov/publication/get_pdf.cfm?pub_id=913117 (Accessed January 17, 2023) +*/ + +/* Taxonomy Classification: 0000000000000000000100 */ + +/* + * WRITE/READ 0 write + * WHICH BOUND 0 upper + * DATA TYPE 0 char + * MEMORY LOCATION 0 stack + * SCOPE 0 same + * CONTAINER 0 no + * POINTER 0 no + * INDEX COMPLEXITY 0 constant + * ADDRESS COMPLEXITY 0 constant + * LENGTH COMPLEXITY 0 N/A + * ADDRESS ALIAS 0 none + * INDEX ALIAS 0 none + * LOCAL CONTROL FLOW 0 none + * SECONDARY CONTROL FLOW 0 none + * LOOP STRUCTURE 0 no + * LOOP COMPLEXITY 0 N/A + * ASYNCHRONY 0 no + * TAINT 0 no + * RUNTIME ENV. DEPENDENCE 0 no + * MAGNITUDE 1 1 byte + * CONTINUOUS/DISCRETE 0 discrete + * SIGNEDNESS 0 no + */ + +/* +Copyright 2004 M.I.T. + +Permission is hereby granted, without written agreement or royalty fee, to use, +copy, modify, and distribute this software and its documentation for any +purpose, provided that the above copyright notice and the following three +paragraphs appear in all copies of this software. + +IN NO EVENT SHALL M.I.T. BE LIABLE TO ANY PARTY FOR DIRECT, INDIRECT, SPECIAL, +INCIDENTAL, OR CONSEQUENTIAL DAMAGES ARISING OUT OF THE USE OF THIS SOFTWARE +AND ITS DOCUMENTATION, EVEN IF M.I.T. HAS BEEN ADVISED OF THE POSSIBILITY OF +SUCH DAMANGE. + +M.I.T. SPECIFICALLY DISCLAIMS ANY WARRANTIES INCLUDING, BUT NOT LIMITED TO +THE IMPLIED WARRANTIES OF MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE, +AND NON-INFRINGEMENT. + +THE SOFTWARE IS PROVIDED ON AN "AS-IS" BASIS AND M.I.T. HAS NO OBLIGATION TO +PROVIDE MAINTENANCE, SUPPORT, UPDATES, ENHANCEMENTS, OR MODIFICATIONS. +*/ + + +int main(int argc, char *argv[]) +{ + char buf[10]; + + + /* BAD */ + buf[10] = 'A'; /* { dg-warning "stack-based buffer overflow" } */ + /* { dg-message "write of 1 byte to beyond the end of 'buf'" "note" { target *-*-* } .-1 } */ + + + return 0; +} diff --git a/gcc/testsuite/c-c++-common/analyzer/SARD-tc249-basic-00034-min.c b/gcc/testsuite/c-c++-common/analyzer/SARD-tc249-basic-00034-min.c new file mode 100644 index 0000000..4031e6d --- /dev/null +++ b/gcc/testsuite/c-c++-common/analyzer/SARD-tc249-basic-00034-min.c @@ -0,0 +1,67 @@ +/* Adapted from https://samate.nist.gov/SARD/test-cases/249/versions/1.0.0 + Part of https://samate.nist.gov/SARD/test-suites/81 + See: + Black, P. , Koo, H. and Irish, T. (2013), A Basic CWE-121 Buffer Overflow Effectiveness Test Suite, Proc. 6th Latin-American Symposium on Dependable Computing, Rio de Janeiro, -1, [online], https://tsapps.nist.gov/publication/get_pdf.cfm?pub_id=913117 (Accessed January 17, 2023) +*/ + +/* Taxonomy Classification: 0000001600030000000100 */ + +/* + * WRITE/READ 0 write + * WHICH BOUND 0 upper + * DATA TYPE 0 char + * MEMORY LOCATION 0 stack + * SCOPE 0 same + * CONTAINER 0 no + * POINTER 1 yes + * INDEX COMPLEXITY 6 N/A + * ADDRESS COMPLEXITY 0 constant + * LENGTH COMPLEXITY 0 N/A + * ADDRESS ALIAS 0 none + * INDEX ALIAS 3 N/A + * LOCAL CONTROL FLOW 0 none + * SECONDARY CONTROL FLOW 0 none + * LOOP STRUCTURE 0 no + * LOOP COMPLEXITY 0 N/A + * ASYNCHRONY 0 no + * TAINT 0 no + * RUNTIME ENV. DEPENDENCE 0 no + * MAGNITUDE 1 1 byte + * CONTINUOUS/DISCRETE 0 discrete + * SIGNEDNESS 0 no + */ + +/* +Copyright 2004 M.I.T. + +Permission is hereby granted, without written agreement or royalty fee, to use, +copy, modify, and distribute this software and its documentation for any +purpose, provided that the above copyright notice and the following three +paragraphs appear in all copies of this software. + +IN NO EVENT SHALL M.I.T. BE LIABLE TO ANY PARTY FOR DIRECT, INDIRECT, SPECIAL, +INCIDENTAL, OR CONSEQUENTIAL DAMAGES ARISING OUT OF THE USE OF THIS SOFTWARE +AND ITS DOCUMENTATION, EVEN IF M.I.T. HAS BEEN ADVISED OF THE POSSIBILITY OF +SUCH DAMANGE. + +M.I.T. SPECIFICALLY DISCLAIMS ANY WARRANTIES INCLUDING, BUT NOT LIMITED TO +THE IMPLIED WARRANTIES OF MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE, +AND NON-INFRINGEMENT. + +THE SOFTWARE IS PROVIDED ON AN "AS-IS" BASIS AND M.I.T. HAS NO OBLIGATION TO +PROVIDE MAINTENANCE, SUPPORT, UPDATES, ENHANCEMENTS, OR MODIFICATIONS. +*/ + + +int main(int argc, char *argv[]) +{ + char buf[10]; + + + /* BAD */ + *(buf + 10) = 'A'; /* { dg-warning "stack-based buffer overflow" } */ + /* { dg-message "write of 1 byte to beyond the end of 'buf'" "note" { target *-*-* } .-1 } */ + + + return 0; +} diff --git a/gcc/testsuite/c-c++-common/analyzer/abort.c b/gcc/testsuite/c-c++-common/analyzer/abort.c new file mode 100644 index 0000000..9497ae3 --- /dev/null +++ b/gcc/testsuite/c-c++-common/analyzer/abort.c @@ -0,0 +1,80 @@ +#include +#include +#include "analyzer-decls.h" + +extern void foo (); +extern void bar (); + +void test_1 (int i) +{ + if (i == 42) + abort (); + + __analyzer_eval (i != 42); /* { dg-warning "TRUE" } */ +} + +void test_2 (int i) +{ + if (i) + foo (); + else + bar (); + + foo (); + + if (i) + foo (); + else + abort (); + + __analyzer_eval (i != 0); /* { dg-warning "TRUE" } */ +} + +/**************************************************************************/ + +void calls_abort (const char *msg) +{ + fprintf (stderr, "%s", msg); + abort (); +} + +void test_3 (void *ptr) +{ + if (!ptr) + calls_abort ("ptr was NULL"); + + __analyzer_eval (ptr != 0); /* { dg-warning "TRUE" } */ +} + +/**************************************************************************/ + +extern void marked_noreturn (const char *msg) + __attribute__ ((__noreturn__)); + +void test_4 (void *ptr) +{ + if (!ptr) + marked_noreturn ("ptr was NULL"); + + __analyzer_eval (ptr != 0); /* { dg-warning "TRUE" } */ +} + +/**************************************************************************/ + +/* Verify that we discover conditions from assertions if the assert macro + isn't disabled, and that it has its failure-handler labelled with + __attribute__ ((__noreturn__)). + This attribute isn't present for all implementations of , so + we have to test the idea using our own assert macro. */ + +extern void my_assert_fail (const char *expr, const char *file, int line) + __attribute__ ((__noreturn__)); + +#define MY_ASSERT(EXPR) \ + do { if (!(EXPR)) my_assert_fail (#EXPR, __FILE__, __LINE__); } while (0) + +void test_5 (int i) +{ + MY_ASSERT (i < 10); + __analyzer_eval (i < 10); /* { dg-warning "TRUE" } */ +} diff --git a/gcc/testsuite/c-c++-common/analyzer/aliasing-1.c b/gcc/testsuite/c-c++-common/analyzer/aliasing-1.c new file mode 100644 index 0000000..26050f1 --- /dev/null +++ b/gcc/testsuite/c-c++-common/analyzer/aliasing-1.c @@ -0,0 +1,25 @@ +#include "analyzer-decls.h" + +int a; +void test (int *p, int x) +{ + int y; + + a = 17; + x = 42; + y = 13; + + __analyzer_eval (a == 17); /* { dg-warning "TRUE" } */ + __analyzer_eval (x == 42); /* { dg-warning "TRUE" } */ + __analyzer_eval (y == 13); /* { dg-warning "TRUE" } */ + + __analyzer_eval (p == &a); /* { dg-warning "UNKNOWN" } */ + __analyzer_eval (p == &x); /* { dg-warning "FALSE" } */ + __analyzer_eval (p == &y); /* { dg-warning "FALSE" } */ + + *p = 73; + + __analyzer_eval (a == 17); /* { dg-warning "UNKNOWN" } */ + __analyzer_eval (x == 42); /* { dg-warning "TRUE" } */ + __analyzer_eval (y == 13); /* { dg-warning "TRUE" } */ +} diff --git a/gcc/testsuite/c-c++-common/analyzer/aliasing-2.c b/gcc/testsuite/c-c++-common/analyzer/aliasing-2.c new file mode 100644 index 0000000..38ceeff --- /dev/null +++ b/gcc/testsuite/c-c++-common/analyzer/aliasing-2.c @@ -0,0 +1,32 @@ +#include "analyzer-decls.h" + +extern void escape (int *p); + +int a; +void test (int *p, int x) +{ + int y; + + a = 17; + x = 42; + y = 13; + + __analyzer_eval (a == 17); /* { dg-warning "TRUE" } */ + __analyzer_eval (x == 42); /* { dg-warning "TRUE" } */ + __analyzer_eval (y == 13); /* { dg-warning "TRUE" } */ + + escape (&x); + __analyzer_eval (a == 17); /* { dg-warning "UNKNOWN" } */ + __analyzer_eval (x == 42); /* { dg-warning "UNKNOWN" } */ + __analyzer_eval (y == 13); /* { dg-warning "TRUE" } */ + + __analyzer_eval (p == &a); /* { dg-warning "UNKNOWN" } */ + __analyzer_eval (p == &x); /* { dg-warning "FALSE" } */ + __analyzer_eval (p == &y); /* { dg-warning "FALSE" } */ + + *p = 73; + + __analyzer_eval (a == 17); /* { dg-warning "UNKNOWN" } */ + __analyzer_eval (x == 42); /* { dg-warning "UNKNOWN" } */ + __analyzer_eval (y == 13); /* { dg-warning "TRUE" } */ +} diff --git a/gcc/testsuite/c-c++-common/analyzer/alloca-leak.c b/gcc/testsuite/c-c++-common/analyzer/alloca-leak.c new file mode 100644 index 0000000..073f97e --- /dev/null +++ b/gcc/testsuite/c-c++-common/analyzer/alloca-leak.c @@ -0,0 +1,8 @@ +/* { dg-require-effective-target alloca } */ + +void *test (void) +{ + void *ptr = __builtin_alloca (64); + return ptr; +} +/* TODO: warn about escaping alloca. */ diff --git a/gcc/testsuite/c-c++-common/analyzer/analyzer-debugging-fns-1.c b/gcc/testsuite/c-c++-common/analyzer/analyzer-debugging-fns-1.c new file mode 100644 index 0000000..6a23344 --- /dev/null +++ b/gcc/testsuite/c-c++-common/analyzer/analyzer-debugging-fns-1.c @@ -0,0 +1,11 @@ +/* Various wrong declarations for the decls + in analyzer-decls.h. + + Make sure we don't ICE on these. */ + +extern void __analyzer_dump_capacity (int); + +void wrong_analyzer_dump_capacity (void) +{ + __analyzer_dump_capacity (42); +} diff --git a/gcc/testsuite/c-c++-common/analyzer/analyzer-decls.h b/gcc/testsuite/c-c++-common/analyzer/analyzer-decls.h new file mode 100644 index 0000000..1442067 --- /dev/null +++ b/gcc/testsuite/c-c++-common/analyzer/analyzer-decls.h @@ -0,0 +1 @@ +#include "../../gcc.dg/analyzer/analyzer-decls.h" diff --git a/gcc/testsuite/c-c++-common/analyzer/analyzer-verbosity-2a.c b/gcc/testsuite/c-c++-common/analyzer/analyzer-verbosity-2a.c new file mode 100644 index 0000000..cf014b0 --- /dev/null +++ b/gcc/testsuite/c-c++-common/analyzer/analyzer-verbosity-2a.c @@ -0,0 +1,23 @@ +/* { dg-additional-options "-fanalyzer-verbosity=2" } */ + +typedef struct FILE FILE; + +FILE* fopen (const char*, const char*); +int fclose (FILE*); + +extern int foo (); +extern void bar (); + +void test (const char *path, int flag) +{ + FILE *fp = fopen (path, "r"); /* { dg-message "opened here" } */ + + /* We shouldn't report this control flow at -fanalyzer-verbosity=2. */ + if (foo ()) /* { dg-bogus "" } */ + bar (); + else + bar (); + + if (flag) /* { dg-message "when 'flag == 0'" } */ + fclose (fp); +} /* { dg-warning "leak of FILE 'fp'" } */ diff --git a/gcc/testsuite/c-c++-common/analyzer/analyzer-verbosity-3a.c b/gcc/testsuite/c-c++-common/analyzer/analyzer-verbosity-3a.c new file mode 100644 index 0000000..b0ece20 --- /dev/null +++ b/gcc/testsuite/c-c++-common/analyzer/analyzer-verbosity-3a.c @@ -0,0 +1,23 @@ +/* { dg-additional-options "-fanalyzer-verbosity=3" } */ + +typedef struct FILE FILE; + +FILE* fopen (const char*, const char*); +int fclose (FILE*); + +extern int foo (); +extern void bar (); + +void test (const char *path, int flag) +{ + FILE *fp = fopen (path, "r"); /* { dg-message "opened here" } */ + + /* We should report this control flow at -fanalyzer-verbosity=3. */ + if (foo ()) /* { dg-message "branch" } */ + bar (); + else + bar (); + + if (flag) /* { dg-message "when 'flag == 0'" } */ + fclose (fp); +} /* { dg-warning "leak of FILE 'fp'" } */ diff --git a/gcc/testsuite/c-c++-common/analyzer/asm-x86-1.c b/gcc/testsuite/c-c++-common/analyzer/asm-x86-1.c new file mode 100644 index 0000000..a3f86e4 --- /dev/null +++ b/gcc/testsuite/c-c++-common/analyzer/asm-x86-1.c @@ -0,0 +1,69 @@ +/* { dg-do compile { target x86_64-*-* } } */ + +#include "analyzer-decls.h" + +int test_out (void) +{ + int dst_a, dst_b; + asm ("mov 42, %0" + : "=r" (dst_a)); + asm ("mov 42, %0" + : "=r" (dst_b)); + __analyzer_eval (dst_a == dst_b); /* { dg-warning "TRUE" } */ + return dst_a; +} + +int test_out_in (int src_a) +{ + int dst_a, dst_b; + asm ("mov %1, %0" + : "=r" (dst_a) + : "r" (src_a)); + asm ("mov %1, %0" + : "=r" (dst_b) + : "r" (src_a)); + __analyzer_eval (dst_a == dst_b); /* { dg-warning "TRUE" } */ + return dst_a; +} + +int test_out_in_in (int src_a, int src_b) +{ + int dst_a, dst_b; + asm ("mov %1, %0;\n" + "add %2, %0" + : "=r" (dst_a) + : "r" (src_a), + "r" (src_b)); + asm ("mov %1, %0;\n" + "add %2, %0" + : "=r" (dst_b) + : "r" (src_a), + "r" (src_b)); + __analyzer_eval (dst_a == dst_b); /* { dg-warning "TRUE" } */ + return dst_a; +} + +void test_inout_1 (int v) +{ + int saved = v; + int result_a, result_b; + asm ("dec %0" + : "+r" (v)); + result_a = v; + + asm ("dec %0" + : "+r" (v)); + result_b = v; + + __analyzer_eval (v == saved); /* { dg-warning "UNKNOWN" } */ + __analyzer_eval (v == result_a); /* { dg-warning "UNKNOWN" } */ + __analyzer_eval (v == result_b); /* { dg-warning "TRUE" } */ +} + +void test_inout_2 (void) +{ + int v; + int result_a, result_b; + asm ("dec %0" /* { dg-warning "use of uninitialized value 'v'" } */ + : "+r" (v)); +} diff --git a/gcc/testsuite/c-c++-common/analyzer/attr-alloc_size-3.c b/gcc/testsuite/c-c++-common/analyzer/attr-alloc_size-3.c new file mode 100644 index 0000000..9a33922 --- /dev/null +++ b/gcc/testsuite/c-c++-common/analyzer/attr-alloc_size-3.c @@ -0,0 +1,14 @@ +typedef long int idx_t; +extern void rpl_free (void *ptr); + +void *xicalloc (idx_t n, idx_t s) + __attribute__ ((__malloc__)) + __attribute__ ((__malloc__ (rpl_free, 1))) + __attribute__ ((__alloc_size__ (1, 2))) + __attribute__ ((__returns_nonnull__)); + +void * +xizalloc (idx_t s) +{ + return xicalloc (s, 1); +} diff --git a/gcc/testsuite/c-c++-common/analyzer/attr-const-1.c b/gcc/testsuite/c-c++-common/analyzer/attr-const-1.c new file mode 100644 index 0000000..39e813f --- /dev/null +++ b/gcc/testsuite/c-c++-common/analyzer/attr-const-1.c @@ -0,0 +1,152 @@ +/* Verify that we handle functions with __attribute__ ((const)) correctly. */ + +#include "analyzer-decls.h" + +extern int nonconst_fn (int); + +extern int const_fn_0 () __attribute__ ((const)); +extern int const_fn_1 (int) __attribute__ ((const)); +extern int const_fn_2 (int, int) __attribute__ ((const)); +extern int const_fn_3 (int, int, int) __attribute__ ((const)); +extern int const_fn_variadic (int, ...) __attribute__ ((const)); + +/* Verify that functions without __attribute__ ((const)) have a different + result each time. */ + +void test_nonconst_fn (int x, int y) +{ + int x_1 = nonconst_fn (x); + int x_2 = nonconst_fn (x); + int y_1 = nonconst_fn (y); + int y_2 = nonconst_fn (y); + __analyzer_eval (x_1 == x_2); /* { dg-warning "UNKNOWN" } */ + __analyzer_eval (y_1 == y_2); /* { dg-warning "UNKNOWN" } */ + __analyzer_eval (x_1 == y_1); /* { dg-warning "UNKNOWN" } */ +} + +/* Verify functions with __attribute__ ((const)) have the same result + for the same arguments. */ + + /* 0 args. */ + +extern int other_const_fn_0 () __attribute__ ((const)); + +void test_const_fn_0 (void) +{ + int a = const_fn_0 (); + int b = const_fn_0 (); + int c = other_const_fn_0 (); + int d = other_const_fn_0 (); + __analyzer_eval (a == b); /* { dg-warning "TRUE" } */ + __analyzer_eval (c == d); /* { dg-warning "TRUE" } */ + __analyzer_eval (a == c); /* { dg-warning "UNKNOWN" } */ +} + +/* 1 arg. */ + +void test_const_fn_1 (int x, int y) +{ + int x_1 = const_fn_1 (x); + int x_2 = const_fn_1 (x); + int y_1 = const_fn_1 (y); + int y_2 = const_fn_1 (y); + __analyzer_eval (x_1 == x_2); /* { dg-warning "TRUE" } */ + __analyzer_eval (y_1 == y_2); /* { dg-warning "TRUE" } */ + __analyzer_eval (x_1 == y_1); /* { dg-warning "UNKNOWN" } */ +} + +/* 2 args. */ + +void test_const_fn_2 (int x, int y, int p, int q) +{ + int xy_1 = const_fn_2 (x, y); + int xy_2 = const_fn_2 (x, y); + int pq_1 = const_fn_2 (p, q); + int pq_2 = const_fn_2 (p, q); + __analyzer_eval (xy_1 == xy_2); /* { dg-warning "TRUE" } */ + __analyzer_eval (pq_1 == pq_2); /* { dg-warning "TRUE" } */ + __analyzer_eval (xy_1 == pq_1); /* { dg-warning "UNKNOWN" } */ +} + +/* We don't handle above 2 args. */ + +void test_const_fn_3 (int x, int y, int z, int p, int q, int r) +{ + int xyz_1 = const_fn_3 (x, y, z); + int xyz_2 = const_fn_3 (x, y, z); + int pqr_1 = const_fn_3 (p, q, r); + int pqr_2 = const_fn_3 (p, q, r); + __analyzer_eval (xyz_1 == xyz_2); /* { dg-warning "UNKNOWN" } */ + __analyzer_eval (pqr_1 == pqr_2); /* { dg-warning "UNKNOWN" } */ + __analyzer_eval (xyz_1 == pqr_1); /* { dg-warning "UNKNOWN" } */ +} + +/* Variadic fn, with various numbers of extra args. */ + +void test_const_fn_variadic (int x, int y, int z, int p, int q, int r) +{ + /* 0 extra args, for 1 arg in total. */ + int x_1 = const_fn_variadic (x); + int x_2 = const_fn_variadic (x); + int p_1 = const_fn_variadic (p); + int p_2 = const_fn_variadic (p); + __analyzer_eval (x_1 == x_2); /* { dg-warning "TRUE" } */ + __analyzer_eval (p_1 == p_2); /* { dg-warning "TRUE" } */ + __analyzer_eval (x_1 == p_1); /* { dg-warning "UNKNOWN" } */ + + /* 1 extra arg, for 2 args in total. */ + int xy_1 = const_fn_variadic (x, y); + int xy_2 = const_fn_variadic (x, y); + int pq_1 = const_fn_variadic (p, q); + int pq_2 = const_fn_variadic (p, q); + __analyzer_eval (xy_1 == xy_2); /* { dg-warning "TRUE" } */ + __analyzer_eval (pq_1 == pq_2); /* { dg-warning "TRUE" } */ + __analyzer_eval (xy_1 == pq_1); /* { dg-warning "UNKNOWN" } */ + __analyzer_eval (x_1 == xy_1); /* { dg-warning "UNKNOWN" } */ + __analyzer_eval (p_1 == pq_1); /* { dg-warning "UNKNOWN" } */ + + /* Above that, we don't track results. */ + int xyz_1 = const_fn_variadic (x, y, z); + int xyz_2 = const_fn_variadic (x, y, z); + int pqr_1 = const_fn_variadic (p, q, r); + int pqr_2 = const_fn_variadic (p, q, r); + __analyzer_eval (xyz_1 == xyz_2); /* { dg-warning "UNKNOWN" } */ + __analyzer_eval (pqr_1 == pqr_2); /* { dg-warning "UNKNOWN" } */ + __analyzer_eval (xyz_1 == x_1); /* { dg-warning "UNKNOWN" } */ + __analyzer_eval (xyz_1 == xy_1); /* { dg-warning "UNKNOWN" } */ + __analyzer_eval (xyz_1 == pqr_1); /* { dg-warning "UNKNOWN" } */ +} + +/* Builtins with __attribute__ ((const)). */ + +void test_builtin_isascii (int x, int y) +{ + int x_1 = __builtin_isascii (x); + int x_2 = __builtin_isascii (x); + int y_1 = __builtin_isascii (y); + int y_2 = __builtin_isascii (y); + __analyzer_eval (x_1 == x_2); /* { dg-warning "TRUE" } */ + __analyzer_eval (y_1 == y_2); /* { dg-warning "TRUE" } */ + __analyzer_eval (x_1 == y_1); /* { dg-warning "UNKNOWN" } */ +} + +void test_builtin_popcount (unsigned x, unsigned y) +{ + unsigned x_1 = __builtin_popcount (x); + unsigned x_2 = __builtin_popcount (x); + unsigned y_1 = __builtin_popcount (y); + unsigned y_2 = __builtin_popcount (y); + __analyzer_eval (x_1 == x_2); /* { dg-warning "TRUE" } */ + __analyzer_eval (y_1 == y_2); /* { dg-warning "TRUE" } */ + __analyzer_eval (x_1 == y_1); /* { dg-warning "UNKNOWN" } */ +} + +void test_loop (void) +{ + for (int i = 0; i < 100; i++) + { + int iter_val_a = const_fn_1 (i); + int iter_val_b = const_fn_1 (i); + __analyzer_eval (iter_val_a == iter_val_b); /* { dg-warning "TRUE" } */ + } +} diff --git a/gcc/testsuite/c-c++-common/analyzer/attr-const-2.c b/gcc/testsuite/c-c++-common/analyzer/attr-const-2.c new file mode 100644 index 0000000..ab79514 --- /dev/null +++ b/gcc/testsuite/c-c++-common/analyzer/attr-const-2.c @@ -0,0 +1,16 @@ +extern int const_p (int) __attribute__((const)); +extern void do_stuff (void); + +void test (int a) +{ + void *p; + if (const_p (a)) + { + p = __builtin_malloc (1024); + if (!p) + return; + } + do_stuff (); + if (const_p (a)) + __builtin_free (p); /* { dg-bogus "uninit" } */ +} diff --git a/gcc/testsuite/c-c++-common/analyzer/attr-const-3.c b/gcc/testsuite/c-c++-common/analyzer/attr-const-3.c new file mode 100644 index 0000000..11238a7 --- /dev/null +++ b/gcc/testsuite/c-c++-common/analyzer/attr-const-3.c @@ -0,0 +1,26 @@ +/* Verify that we handle unknown values passed to __attribute__ ((const)) + (by imposing a complexity limit). */ + +/* { dg-additional-options "--param analyzer-max-svalue-depth=4 -Wno-analyzer-symbol-too-complex" } */ + +#include "analyzer-decls.h" + +extern int const_fn_1 (int) __attribute__ ((const)); + +void test_const_fn_1 (int x, int y) +{ + int x_1 = const_fn_1 (x); + int x_2 = const_fn_1 (x); + int y_1 = const_fn_1 (y); + int y_2 = const_fn_1 (y); + __analyzer_eval (x_1 == x_2); /* { dg-warning "UNKNOWN" } */ + __analyzer_eval (y_1 == y_2); /* { dg-warning "UNKNOWN" } */ + __analyzer_eval (x_1 == y_1); /* { dg-warning "UNKNOWN" } */ +} + +void test_2 (int x) +{ + int once = const_fn_1 (x); + int again = const_fn_1 (once); + __analyzer_eval (once == again); /* { dg-warning "UNKNOWN" } */ +} diff --git a/gcc/testsuite/c-c++-common/analyzer/attr-malloc-2.c b/gcc/testsuite/c-c++-common/analyzer/attr-malloc-2.c new file mode 100644 index 0000000..09d941f --- /dev/null +++ b/gcc/testsuite/c-c++-common/analyzer/attr-malloc-2.c @@ -0,0 +1,24 @@ +extern void free (void *); +char *xstrdup (const char *) + __attribute__((malloc (free), returns_nonnull)); + +void test_1 (const char *s) +{ + char *p = xstrdup (s); + free (p); +} + +/* Verify that we don't issue -Wanalyzer-possible-null-dereference + when the allocator has __attribute__((returns_nonnull)). */ + +char *test_2 (const char *s) +{ + char *p = xstrdup (s); + p[0] = 'a'; /* { dg-bogus "possibly-NULL" } */ + return p; +} + +void test_3 (const char *s) +{ + char *p = xstrdup (s); /* { dg-message "allocated here" } */ +} /* { dg-warning "leak of 'p'" } */ diff --git a/gcc/testsuite/c-c++-common/analyzer/attr-malloc-4.c b/gcc/testsuite/c-c++-common/analyzer/attr-malloc-4.c new file mode 100644 index 0000000..1517667 --- /dev/null +++ b/gcc/testsuite/c-c++-common/analyzer/attr-malloc-4.c @@ -0,0 +1,21 @@ +/* An example where the deallocator requires non-NULL. */ + +struct foo; +extern void foo_release (struct foo *) + __attribute__((nonnull)); +extern struct foo *foo_acquire (void) + __attribute__ ((malloc (foo_release))); + +void test_1 (void) +{ + struct foo *p = foo_acquire (); /* { dg-message "this call could return NULL" } */ + foo_release (p); /* { dg-warning "use of possibly-NULL 'p' where non-null" } */ +} + +void test_2 (void) +{ + struct foo *p = foo_acquire (); + if (!p) + return; + foo_release (p); +} diff --git a/gcc/testsuite/c-c++-common/analyzer/attr-malloc-5.c b/gcc/testsuite/c-c++-common/analyzer/attr-malloc-5.c new file mode 100644 index 0000000..7ff4e57 --- /dev/null +++ b/gcc/testsuite/c-c++-common/analyzer/attr-malloc-5.c @@ -0,0 +1,12 @@ +/* Example of extra argument to "malloc" attribute. */ + +struct foo; +extern void foo_release (int, struct foo *); +extern struct foo *foo_acquire (void) + __attribute__ ((malloc (foo_release, 2))); + +void test_1 (void) +{ + struct foo *p = foo_acquire (); + foo_release (0, p); +} diff --git a/gcc/testsuite/c-c++-common/analyzer/attr-malloc-misuses.c b/gcc/testsuite/c-c++-common/analyzer/attr-malloc-misuses.c new file mode 100644 index 0000000..3c6c17b --- /dev/null +++ b/gcc/testsuite/c-c++-common/analyzer/attr-malloc-misuses.c @@ -0,0 +1,18 @@ +extern void free (void *); + +int not_a_fn __attribute__ ((malloc (free))); /* { dg-warning "'malloc' attribute ignored; valid only for functions" } */ + +void void_return (void) __attribute__ ((malloc(free))); /* { dg-warning "'malloc' attribute ignored on functions returning 'void'" } */ + +void test_void_return (void) +{ + void_return (); +} + +extern void void_args (void); /* { dg-message "declared here" } */ +void *has_malloc_with_void_args (void) + __attribute__ ((malloc(void_args))); /* { dg-error "'malloc' attribute argument 1 must take a pointer type as its first argument; have 'void'" } */ + +extern void no_args (); /* { dg-message "declared here" } */ +void *has_malloc_with_no_args (void) + __attribute__ ((malloc(no_args))); /* { dg-error "'malloc' attribute argument 1 must take a pointer type as its first argument" } */ diff --git a/gcc/testsuite/c-c++-common/analyzer/attr-tainted_args-misuses.c b/gcc/testsuite/c-c++-common/analyzer/attr-tainted_args-misuses.c new file mode 100644 index 0000000..4b0dc91 --- /dev/null +++ b/gcc/testsuite/c-c++-common/analyzer/attr-tainted_args-misuses.c @@ -0,0 +1,6 @@ +int not_a_fn __attribute__ ((tainted_args)); /* { dg-warning "'tainted_args' attribute ignored; valid only for functions and function pointer fields" } */ + +struct s +{ + int f __attribute__ ((tainted_args)); /* { dg-warning "'tainted_args' attribute ignored; field must be a function pointer" } */ +}; diff --git a/gcc/testsuite/c-c++-common/analyzer/bzip2-arg-parse-1.c b/gcc/testsuite/c-c++-common/analyzer/bzip2-arg-parse-1.c new file mode 100644 index 0000000..1f1d829 --- /dev/null +++ b/gcc/testsuite/c-c++-common/analyzer/bzip2-arg-parse-1.c @@ -0,0 +1,95 @@ +/* Integration test to verify that we don't explode in this + argument-parsing logic. + Adapted from part of bzip2-1.0.8: bzip2.c: main. */ + +#include +#include +#include "analyzer-decls.h" + +/* This test file has been heavily modified from the bzip2.c original, + which has the following license boilerplate. */ +/* ------------------------------------------------------------------ + This file is part of bzip2/libbzip2, a program and library for + lossless, block-sorting data compression. + + bzip2/libbzip2 version 1.0.8 of 13 July 2019 + Copyright (C) 1996-2019 Julian Seward + + Please read the WARNING, DISCLAIMER and PATENTS sections in the + README file. + + This program is released under the terms of the license contained + in the file LICENSE. + ------------------------------------------------------------------ */ + +typedef char Char; +typedef unsigned char Bool; +typedef int Int32; + +#define True ((Bool)1) +#define False ((Bool)0) + +typedef + struct zzzz { + Char *name; + struct zzzz *link; + } + Cell; + +Int32 verbosity; +Bool keepInputFiles, smallMode; +Bool forceOverwrite, noisy; +Int32 blockSize100k; +Int32 opMode; +Int32 srcMode; +Char *progName; + +extern void license ( void ); +extern void usage ( Char *fullProgName ); + +void test (Cell *argList) +{ + Cell *aa; + Int32 i, j; + + for (aa = argList; aa != NULL; aa = aa->link) { + if (aa->name[0] == '-' && aa->name[1] != '-') { + for (j = 1; aa->name[j] != '\0'; j++) { + switch (aa->name[j]) { + case 'c': srcMode = 2; break; + case 'd': opMode = 2; break; + case 'z': opMode = 1; break; + case 'f': forceOverwrite = True; break; + case 't': opMode = 3; break; + case 'k': keepInputFiles = True; break; + case 's': smallMode = True; break; + case 'q': noisy = False; break; + case '1': blockSize100k = 1; break; + case '2': blockSize100k = 2; break; + case '3': blockSize100k = 3; break; + case '4': blockSize100k = 4; break; + case '5': blockSize100k = 5; break; + case '6': blockSize100k = 6; break; + case '7': blockSize100k = 7; break; + case '8': blockSize100k = 8; break; + case '9': blockSize100k = 9; break; + case 'V': + case 'L': license(); break; + case 'v': verbosity++; break; + case 'h': usage ( progName ); + exit ( 0 ); + break; + default: fprintf ( stderr, "%s: Bad flag `%s'\n", + progName, aa->name ); + usage ( progName ); + exit ( 1 ); + break; + } + } + } + } + + /* The analyzer ought to be able to successfully merge all of the + above changes that can reach here into a single state. */ + __analyzer_dump_exploded_nodes (0); /* { dg-warning "1 processed enode" } */ +} diff --git a/gcc/testsuite/c-c++-common/analyzer/call-summaries-1.c b/gcc/testsuite/c-c++-common/analyzer/call-summaries-1.c new file mode 100644 index 0000000..a64b230 --- /dev/null +++ b/gcc/testsuite/c-c++-common/analyzer/call-summaries-1.c @@ -0,0 +1,14 @@ +/* { dg-additional-options "-fanalyzer-call-summaries" } */ + +#include + +void calls_free (void *p) +{ + free (p); /* { dg-warning "double-'free' of 'p'" } */ +} + +void test (void *q) +{ + calls_free (q); + calls_free (q); +} diff --git a/gcc/testsuite/c-c++-common/analyzer/call-summaries-3.c b/gcc/testsuite/c-c++-common/analyzer/call-summaries-3.c new file mode 100644 index 0000000..d63eb0c --- /dev/null +++ b/gcc/testsuite/c-c++-common/analyzer/call-summaries-3.c @@ -0,0 +1,29 @@ +/* { dg-additional-options "-fanalyzer-call-summaries --param analyzer-min-snodes-for-call-summary=0 -fno-analyzer-state-merge" } */ + +/* There need to be at least two calls to a function for the + call-summarization code to be used. + TODO: add some kind of test that summarization *was* used. */ + +#include "analyzer-decls.h" + +/* With state merging disabled, we get two summaries here. */ + +int two_outcomes (int flag, int x, int y) +{ + if (flag) + return x; + else + return y; +} + +void test_two_outcomes (int outer_flag, int a, int b) +{ + int r; + __analyzer_eval (two_outcomes (1, a, b) == a); /* { dg-warning "TRUE" } */ + __analyzer_eval (two_outcomes (0, a, b) == b); /* { dg-warning "TRUE" } */ + r = two_outcomes (outer_flag, a, b); + if (outer_flag) + __analyzer_eval (r == a); /* { dg-warning "TRUE" } */ + else + __analyzer_eval (r == b); /* { dg-warning "TRUE" } */ +} diff --git a/gcc/testsuite/c-c++-common/analyzer/call-summaries-asm-x86.c b/gcc/testsuite/c-c++-common/analyzer/call-summaries-asm-x86.c new file mode 100644 index 0000000..cc23283 --- /dev/null +++ b/gcc/testsuite/c-c++-common/analyzer/call-summaries-asm-x86.c @@ -0,0 +1,20 @@ +/* { dg-do compile { target x86_64-*-* } } */ +/* { dg-additional-options "-fanalyzer-call-summaries --param analyzer-min-snodes-for-call-summary=0" } */ + +#include "analyzer-decls.h" + +int returns_asm_value (void) +{ + int dst; + asm ("mov 42, %0" + : "=r" (dst)); + return dst; +} + +void test_returns_asm_value (void) +{ + int a, b; + a = returns_asm_value (); + b = returns_asm_value (); + __analyzer_eval (a == b); /* { dg-warning "TRUE" } */ +} diff --git a/gcc/testsuite/c-c++-common/analyzer/callbacks-1.c b/gcc/testsuite/c-c++-common/analyzer/callbacks-1.c new file mode 100644 index 0000000..52c8fde --- /dev/null +++ b/gcc/testsuite/c-c++-common/analyzer/callbacks-1.c @@ -0,0 +1,25 @@ +/* Reproducer for PR analyzer/97258: we should report the double-free + inside a static callback if the callback escapes. */ + +#include + +static void callback_1 (void *p) +{ + free (p); + free (p); /* { dg-warning "double-'free' of 'p'" } */ +} + +struct ops { + void (*cb) (void *); +}; + +static const struct ops ops_1 = { + .cb = callback_1 +}; + +extern void registration (const void *); + +void register_1 (void) +{ + registration (&ops_1); +} diff --git a/gcc/testsuite/c-c++-common/analyzer/callbacks-2.c b/gcc/testsuite/c-c++-common/analyzer/callbacks-2.c new file mode 100644 index 0000000..98915ee --- /dev/null +++ b/gcc/testsuite/c-c++-common/analyzer/callbacks-2.c @@ -0,0 +1,22 @@ +/* Reproducer for PR analyzer/97258: we should report the double-free + inside a static callback if the callback is accessible via a global + initializer. */ + +#include + +static void callback_1 (void *p) +{ + free (p); + free (p); /* { dg-warning "double-'free' of 'p'" } */ +} + +struct ops { + void (*cb) (void *); +}; + +/* Callback struct is not static, and so could be accessed via + another TU. */ + +const struct ops ops_1 = { + .cb = callback_1 +}; diff --git a/gcc/testsuite/c-c++-common/analyzer/callbacks-3.c b/gcc/testsuite/c-c++-common/analyzer/callbacks-3.c new file mode 100644 index 0000000..5f12c2a --- /dev/null +++ b/gcc/testsuite/c-c++-common/analyzer/callbacks-3.c @@ -0,0 +1,19 @@ +#include "analyzer-decls.h" + +typedef __SIZE_TYPE__ size_t; +typedef int (*__compar_fn_t)(const void *, const void *); +extern void qsort(void *__base, size_t __nmemb, size_t __size, + __compar_fn_t __compar) + __attribute__((__nonnull__(1, 4))); + +static int +test_1_callback (const void *p1, const void *p2) +{ + __analyzer_dump_path (); /* { dg-message "here" } */ + return 0; +} + +void test_1_caller (int *arr, size_t n) +{ + qsort (arr, n, sizeof (int), test_1_callback); +} diff --git a/gcc/testsuite/c-c++-common/analyzer/capacity-2.c b/gcc/testsuite/c-c++-common/analyzer/capacity-2.c new file mode 100644 index 0000000..2db1b3f --- /dev/null +++ b/gcc/testsuite/c-c++-common/analyzer/capacity-2.c @@ -0,0 +1,55 @@ +#include +#include "analyzer-decls.h" + +extern void might_realloc (void *); +extern void cant_realloc (const void *); + +void * +test_realloc_1 (void *p, size_t new_sz) +{ + void *q = realloc (p, new_sz); + __analyzer_dump_capacity (q); /* { dg-warning "capacity: 'UNKNOWN\\(sizetype\\)'" "failure" } */ + /* { dg-warning "capacity: 'INIT_VAL\\(new_sz\[^\n\r\]*\\)'" "success" { target *-*-* } .-1 } */ + return q; +} + +void * +test_realloc_2 (size_t sz_a, size_t sz_b) +{ + void *p = malloc (sz_a); + __analyzer_dump_capacity (p); /* { dg-warning "capacity: 'INIT_VAL\\(sz_a_\[^\n\r\]*\\)'" } */ + void *q = realloc (p, sz_b); + __analyzer_dump_capacity (q); /* { dg-warning "capacity: 'UNKNOWN\\(sizetype\\)'" "failure" } */ + /* { dg-warning "capacity: 'INIT_VAL\\(sz_b\[^\n\r\]*\\)'" "success" { target *-*-* } .-1 } */ + return q; /* { dg-warning "leak of 'p'" } */ +} + +void * +test_might_realloc (void) +{ + void *p = malloc (1024); + + __analyzer_dump_capacity (p); /* { dg-warning "capacity: '\\(size_t\\)1024'" } */ + + might_realloc (p); + + __analyzer_dump_capacity (p); /* { dg-warning "capacity: 'UNKNOWN\\(sizetype\\)'" } */ + + return p; +} + +void * +test_cant_realloc (void) +{ + void *p = malloc (1024); + + __analyzer_dump_capacity (p); /* { dg-warning "capacity: '\\(size_t\\)1024'" } */ + + cant_realloc (p); + + __analyzer_dump_capacity (p); /* { dg-warning "capacity: '\\(size_t\\)1024'" } */ + + return p; +} + + diff --git a/gcc/testsuite/c-c++-common/analyzer/capacity-3.c b/gcc/testsuite/c-c++-common/analyzer/capacity-3.c new file mode 100644 index 0000000..c099ff5 --- /dev/null +++ b/gcc/testsuite/c-c++-common/analyzer/capacity-3.c @@ -0,0 +1,84 @@ +/* { dg-require-effective-target alloca } */ + +#include +#include "analyzer-decls.h" + +static void __attribute__((noinline)) +__analyzer_callee_1 (size_t inner_sz) +{ + void *p = __builtin_alloca (inner_sz); + __analyzer_dump_capacity (p); /* { dg-warning "capacity: 'INIT_VAL\\(outer_sz_\[^\n\r\]*\\)'" } */ +} + +void +test_1 (int flag, size_t outer_sz) +{ + if (flag) + __analyzer_callee_1 (outer_sz); + + /* Verify that we merge state; in particular, the dynamic size of "p" + in the called frame should have been purged. */ + __analyzer_dump_exploded_nodes (0); /* { dg-warning "1 processed enode" } */ +} + +void +test_2 (int flag, size_t sz) +{ + if (flag) + { + void *p = malloc (sz); + __analyzer_dump_capacity (p); /* { dg-warning "capacity: 'INIT_VAL\\(sz_\[^\n\r\]*\\)'" } */ + free (p); + /* The dynamic size of "p" should have been purged. */ + __analyzer_dump_capacity (p); /* { dg-warning "capacity: 'UNKNOWN\\(sizetype\\)'" } */ + } + + /* Verify that we merge state. */ + __analyzer_dump_exploded_nodes (0); /* { dg-warning "1 processed enode" } */ +} +/* Verify that we purge state on the NULL branch when a malloc result is + tested against NULL. */ + +void +test_3 (size_t sz) +{ + void *p = malloc (sz); + + if (p) + { + __analyzer_dump_capacity (p); /* { dg-warning "capacity: 'INIT_VAL\\(sz_\[^\n\r\]*\\)'" } */ + } + else + { + /* The dynamic size of "p" should have been purged + due to "p" being equal to NULL. */ + __analyzer_dump_capacity (p); /* { dg-warning "capacity: 'UNKNOWN\\(sizetype\\)'" } */ + } + + free (p); + + /* The dynamic size of "p" should have been purged. */ + __analyzer_dump_capacity (p); /* { dg-warning "capacity: 'UNKNOWN\\(sizetype\\)'" } */ + + /* Verify that we merge state. */ + __analyzer_dump_exploded_nodes (0); /* { dg-warning "1 processed enode" } */ +} + +/* Verify that we purge dynamic extent of a pointer when it leaks. */ + +static void __attribute__((noinline)) +__analyzer_callee_4 (size_t inner_sz) +{ + void *p = malloc (inner_sz); + __analyzer_dump_capacity (p); /* { dg-warning "capacity: 'INIT_VAL\\(outer_sz_\[^\n\r\]*\\)'" } */ +} /* { dg-warning "leak of 'p'" } */ + +void +test_4 (int flag, size_t outer_sz) +{ + if (flag) + __analyzer_callee_4 (outer_sz); + + /* Verify that we merge state. */ + __analyzer_dump_exploded_nodes (0); /* { dg-warning "1 processed enode" } */ +} diff --git a/gcc/testsuite/c-c++-common/analyzer/casts-1.c b/gcc/testsuite/c-c++-common/analyzer/casts-1.c new file mode 100644 index 0000000..7e4af38 --- /dev/null +++ b/gcc/testsuite/c-c++-common/analyzer/casts-1.c @@ -0,0 +1,78 @@ +#include "analyzer-decls.h" + +struct s1 +{ + char a; + char b; + char c; + char d; +}; + +struct s2 +{ + char arr[4]; +}; + +struct s3 +{ + struct inner { + char a; + char b; + } arr[2]; +}; + +void test_1 () +{ + struct s1 x = {'A', 'B', 'C', 'D'}; + __analyzer_eval (x.a == 'A'); /* { dg-warning "TRUE" } */ + __analyzer_eval (x.b == 'B'); /* { dg-warning "TRUE" } */ + __analyzer_eval (x.c == 'C'); /* { dg-warning "TRUE" } */ + __analyzer_eval (x.d == 'D'); /* { dg-warning "TRUE" } */ + __analyzer_eval (((struct s2 *)&x)->arr[0] == 'A'); /* { dg-warning "TRUE" } */ + __analyzer_eval (((struct s2 *)&x)->arr[1] == 'B'); /* { dg-warning "TRUE" } */ + __analyzer_eval (((struct s2 *)&x)->arr[2] == 'C'); /* { dg-warning "TRUE" } */ + __analyzer_eval (((struct s2 *)&x)->arr[3] == 'D'); /* { dg-warning "TRUE" } */ + struct s3 *p3 = (struct s3 *)&x; + __analyzer_eval (p3->arr[0].a == 'A'); /* { dg-warning "TRUE" } */ + __analyzer_eval (p3->arr[0].b == 'B'); /* { dg-warning "TRUE" } */ + __analyzer_eval (p3->arr[1].a == 'C'); /* { dg-warning "TRUE" } */ + __analyzer_eval (p3->arr[1].b == 'D'); /* { dg-warning "TRUE" } */ + + ((struct s2 *)&x)->arr[1] = '#'; + __analyzer_eval (((struct s2 *)&x)->arr[1] == '#'); /* { dg-warning "TRUE" } */ + __analyzer_eval (x.b == '#'); /* { dg-warning "TRUE" } */ + __analyzer_eval (p3->arr[0].b == '#'); /* { dg-warning "TRUE" } */ +} + +void test_2 () +{ + struct s2 x = {{'A', 'B', 'C', 'D'}}; + __analyzer_eval (x.arr[0] == 'A'); /* { dg-warning "TRUE" } */ + __analyzer_eval (x.arr[1] == 'B'); /* { dg-warning "TRUE" } */ + __analyzer_eval (x.arr[2] == 'C'); /* { dg-warning "TRUE" } */ + __analyzer_eval (x.arr[3] == 'D'); /* { dg-warning "TRUE" } */ + struct s1 *p = (struct s1 *)&x; + __analyzer_eval (p->a == 'A'); /* { dg-warning "TRUE" } */ + __analyzer_eval (p->b == 'B'); /* { dg-warning "TRUE" } */ + __analyzer_eval (p->c == 'C'); /* { dg-warning "TRUE" } */ + __analyzer_eval (p->d == 'D'); /* { dg-warning "TRUE" } */ +} + +void test_3 () +{ + struct s3 x = {'A', 'B', 'C', 'D'}; + __analyzer_eval (x.arr[0].a == 'A'); /* { dg-warning "TRUE" } */ + __analyzer_eval (x.arr[0].b == 'B'); /* { dg-warning "TRUE" } */ + __analyzer_eval (x.arr[1].a == 'C'); /* { dg-warning "TRUE" } */ + __analyzer_eval (x.arr[1].b == 'D'); /* { dg-warning "TRUE" } */ + struct s1 *p1 = (struct s1 *)&x; + __analyzer_eval (p1->a == 'A'); /* { dg-warning "TRUE" } */ + __analyzer_eval (p1->b == 'B'); /* { dg-warning "TRUE" } */ + __analyzer_eval (p1->c == 'C'); /* { dg-warning "TRUE" } */ + __analyzer_eval (p1->d == 'D'); /* { dg-warning "TRUE" } */ + struct s2 *p2 = (struct s2 *)&x; + __analyzer_eval (p2->arr[0] == 'A'); /* { dg-warning "TRUE" } */ + __analyzer_eval (p2->arr[1] == 'B'); /* { dg-warning "TRUE" } */ + __analyzer_eval (p2->arr[2] == 'C'); /* { dg-warning "TRUE" } */ + __analyzer_eval (p2->arr[3] == 'D'); /* { dg-warning "TRUE" } */ +} diff --git a/gcc/testsuite/c-c++-common/analyzer/casts-2.c b/gcc/testsuite/c-c++-common/analyzer/casts-2.c new file mode 100644 index 0000000..3eef717 --- /dev/null +++ b/gcc/testsuite/c-c++-common/analyzer/casts-2.c @@ -0,0 +1,15 @@ +#include "analyzer-decls.h" + +void test_1 (int i) +{ + char c1 = i; + char c2 = i; + __analyzer_eval (c1 == i); /* { dg-warning "UNKNOWN" } */ + __analyzer_eval (c1 == c2); /* { dg-warning "TRUE" } */ +} + +void test_2 (char c) +{ + int i = c; + __analyzer_eval (i == c); /* { dg-warning "TRUE" } */ +} diff --git a/gcc/testsuite/c-c++-common/analyzer/clobbers-1.c b/gcc/testsuite/c-c++-common/analyzer/clobbers-1.c new file mode 100644 index 0000000..6400f84 --- /dev/null +++ b/gcc/testsuite/c-c++-common/analyzer/clobbers-1.c @@ -0,0 +1,97 @@ +#include "analyzer-decls.h" + +struct foo +{ + int i; + int j; +}; + +struct coord +{ + int x; + int y; + int z; +}; + +struct foo g; + +void test_1 (void) +{ + g.i = 42; + if (g.j) + __analyzer_eval (g.j); /* { dg-warning "TRUE" } */ + else + __analyzer_eval (g.j); /* { dg-warning "FALSE" } */ + __analyzer_dump_exploded_nodes (0); /* { dg-warning "1 processed enode" } */ +} + +void test_2 (struct foo f) +{ + f.i = 42; + if (f.j) + __analyzer_eval (f.j); /* { dg-warning "TRUE" } */ + else + __analyzer_eval (f.j); /* { dg-warning "FALSE" } */ + __analyzer_dump_exploded_nodes (0); /* { dg-warning "1 processed enode" } */ +} + +void test_3 (struct foo *p) +{ + struct foo f = *p; + f.i = 42; + if (f.j) + __analyzer_eval (f.j); /* { dg-warning "TRUE" } */ + else + __analyzer_eval (f.j); /* { dg-warning "FALSE" } */ + __analyzer_dump_exploded_nodes (0); /* { dg-warning "1 processed enode" } */ +} + +void test_4 (struct coord *p) +{ + struct coord f = *p; + f.x = 42; + __analyzer_eval (f.y == p->y); /* { dg-warning "TRUE" } */ + __analyzer_eval (f.z == p->z); /* { dg-warning "TRUE" } */ +} + +struct s5 +{ + char arr[8]; +}; + +void test_5 (struct s5 *p) +{ + struct s5 f = *p; + f.arr[3] = 42; + __analyzer_eval (f.arr[0] == p->arr[0]); /* { dg-warning "TRUE" } */ + __analyzer_eval (f.arr[1] == p->arr[1]); /* { dg-warning "TRUE" } */ + __analyzer_eval (f.arr[2] == p->arr[2]); /* { dg-warning "TRUE" } */ + __analyzer_eval (f.arr[3] == 42); /* { dg-warning "TRUE" } */ + __analyzer_eval (f.arr[4] == p->arr[4]); /* { dg-warning "TRUE" } */ + __analyzer_eval (f.arr[5] == p->arr[5]); /* { dg-warning "TRUE" } */ + __analyzer_eval (f.arr[6] == p->arr[6]); /* { dg-warning "TRUE" } */ + __analyzer_eval (f.arr[7] == p->arr[7]); /* { dg-warning "TRUE" } */ +} + +struct s6 +{ + int before; /* Give "arr" a nonzero offset. */ + struct foo arr[4]; + int after; +}; + +void test_6 (struct s6 *p, struct foo *q) +{ + struct s6 f = *p; + f.arr[1] = *q; + __analyzer_eval (f.before == p->before); /* { dg-warning "TRUE" } */ + __analyzer_eval (f.arr[0].i == p->arr[0].i); /* { dg-warning "TRUE" } */ + __analyzer_eval (f.arr[0].j == p->arr[0].j); /* { dg-warning "TRUE" } */ + __analyzer_eval (f.arr[1].i == q->i); /* { dg-warning "TRUE" } */ + __analyzer_eval (f.arr[1].j == q->j); /* { dg-warning "TRUE" } */ + __analyzer_eval (f.arr[2].i == p->arr[2].i); /* { dg-warning "TRUE" } */ + __analyzer_eval (f.arr[2].j == p->arr[2].j); /* { dg-warning "TRUE" } */ + __analyzer_eval (f.arr[3].i == p->arr[3].i); /* { dg-warning "TRUE" } */ + __analyzer_eval (f.arr[3].j == p->arr[3].j); /* { dg-warning "TRUE" } */ + __analyzer_eval (f.after == p->after); /* { dg-warning "TRUE" } */ +} diff --git a/gcc/testsuite/c-c++-common/analyzer/compound-assignment-4.c b/gcc/testsuite/c-c++-common/analyzer/compound-assignment-4.c new file mode 100644 index 0000000..5c0a5f9 --- /dev/null +++ b/gcc/testsuite/c-c++-common/analyzer/compound-assignment-4.c @@ -0,0 +1,28 @@ +#include "analyzer-decls.h" + +struct coord +{ + int x; + int y; +}; + +void test_1 (void) +{ + struct coord arr[16]; + + arr[2].y = 4; + arr[3].x = 5; + arr[3].y = 6; + arr[4].x = 7; + arr[6].y = 8; + arr[8].x = 9; + + arr[7] = arr[3]; + + __analyzer_eval (arr[7].x == 5); /* { dg-warning "TRUE" } */ + __analyzer_eval (arr[7].y == 6); /* { dg-warning "TRUE" } */ + + /* Make sure we don't touch the neighbors. */ + __analyzer_eval (arr[6].y == 8); /* { dg-warning "TRUE" } */ + __analyzer_eval (arr[8].x == 9); /* { dg-warning "TRUE" } */ +} diff --git a/gcc/testsuite/c-c++-common/analyzer/data-model-12.c b/gcc/testsuite/c-c++-common/analyzer/data-model-12.c new file mode 100644 index 0000000..653b7ad --- /dev/null +++ b/gcc/testsuite/c-c++-common/analyzer/data-model-12.c @@ -0,0 +1,13 @@ +/* Mismatching decl of foo. */ + +int foo (); + +int bar (void) +{ + return foo() + 1; +} + +int foo (int x, int y) +{ + return x * y; +} diff --git a/gcc/testsuite/c-c++-common/analyzer/data-model-14.c b/gcc/testsuite/c-c++-common/analyzer/data-model-14.c new file mode 100644 index 0000000..1dbcb70 --- /dev/null +++ b/gcc/testsuite/c-c++-common/analyzer/data-model-14.c @@ -0,0 +1,19 @@ +#include + +void *global_ptr; + +void test_1 (int i) +{ + global_ptr = malloc (1024); /* { dg-message "allocated here" } */ + *(int *)&global_ptr = i; /* { dg-warning "leak of 'global_ptr'" } */ +} + +void test_2 (int i) +{ + void *p = malloc (1024); /* { dg-message "allocated here" } */ + global_ptr = p; + *(int *)&p = i; + p = global_ptr; + free (p); + free (global_ptr); /* { dg-warning "double-'free' of 'p'" } */ +} diff --git a/gcc/testsuite/c-c++-common/analyzer/data-model-18.c b/gcc/testsuite/c-c++-common/analyzer/data-model-18.c new file mode 100644 index 0000000..86e8110 --- /dev/null +++ b/gcc/testsuite/c-c++-common/analyzer/data-model-18.c @@ -0,0 +1,20 @@ +#include "analyzer-decls.h" + +void test (int *p, int i, int j) +{ + p[3] = 42; + __analyzer_eval (p[3] == 42); /* { dg-warning "TRUE" } */ + __analyzer_eval (*(p + 3) == 42); /* { dg-warning "TRUE" } */ + __analyzer_eval (p[i] == 42); /* { dg-warning "UNKNOWN" } */ + __analyzer_eval (p[j] == 42); /* { dg-warning "UNKNOWN" } */ + + //__analyzer_dump (); + + p[i] = 17; + + //__analyzer_dump (); + + __analyzer_eval (p[3] == 42); /* { dg-warning "UNKNOWN" } */ + __analyzer_eval (p[i] == 17); /* { dg-warning "TRUE" } */ + __analyzer_eval (p[j] == 17); /* { dg-warning "UNKNOWN" } */ +} diff --git a/gcc/testsuite/c-c++-common/analyzer/data-model-2.c b/gcc/testsuite/c-c++-common/analyzer/data-model-2.c new file mode 100644 index 0000000..d5be03b --- /dev/null +++ b/gcc/testsuite/c-c++-common/analyzer/data-model-2.c @@ -0,0 +1,13 @@ +/* { dg-additional-options "-O2" } */ +/* TODO:is there a way to automatically run the tests on various + optimizations levels, and with/without debuginfo, rather than + hardcoding options? Adapt from torture .exp, presumably. */ + + +#include +#include + +int test_1 (void) +{ + return 0; +} diff --git a/gcc/testsuite/c-c++-common/analyzer/data-model-20.c b/gcc/testsuite/c-c++-common/analyzer/data-model-20.c new file mode 100644 index 0000000..59f6285 --- /dev/null +++ b/gcc/testsuite/c-c++-common/analyzer/data-model-20.c @@ -0,0 +1,29 @@ +/* { dg-additional-options "-Wno-analyzer-too-complex" } */ + +#include + +struct foo { int dummy; }; + +struct foo ** +test (int n) { + struct foo **arr; + int i; + + if ((arr = (struct foo **)malloc(n * sizeof(struct foo *))) == NULL) + return NULL; + + for (i = 0; i < n; i++) { + if ((arr[i] = (struct foo *)malloc(sizeof(struct foo))) == NULL) { + for (; i >= 0; i++) { /* { dg-warning "infinite loop" } */ + /* This loop is in the wrong direction, so not technically an + infinite loop ("i" will eventually wrap around), but the + analyzer's condition handling treats the overflow as such. + In any case, the code is suspect and warrants a warning. */ + free(arr[i]); /* { dg-bogus "double-'free'" } */ + } + free(arr); /* { dg-warning "leak" } */ + return NULL; + } + } + return arr; +} diff --git a/gcc/testsuite/c-c++-common/analyzer/data-model-21.c b/gcc/testsuite/c-c++-common/analyzer/data-model-21.c new file mode 100644 index 0000000..b952bcb --- /dev/null +++ b/gcc/testsuite/c-c++-common/analyzer/data-model-21.c @@ -0,0 +1,8 @@ +extern const char XtStrings[]; + +void unknown_fn (void *); + +void test (void) +{ + unknown_fn ((char*)&XtStrings[429]); +} diff --git a/gcc/testsuite/c-c++-common/analyzer/data-model-22.c b/gcc/testsuite/c-c++-common/analyzer/data-model-22.c new file mode 100644 index 0000000..8429b2f --- /dev/null +++ b/gcc/testsuite/c-c++-common/analyzer/data-model-22.c @@ -0,0 +1,101 @@ +#include +#include "analyzer-decls.h" + +extern void check_init_char (char v); +extern void check_init_int (int v); + +void test_1 (void) +{ + union + { + char c[16]; + int i[4]; + } v; + memset (&v, 0, sizeof (v)); + v.c[5] = 42; + check_init_int (v.c[0]); + check_init_int (v.c[4]); + check_init_int (v.c[6]); + check_init_int (v.i[1]); +} + +void test_2 (void) +{ + /* Intersection of byte ranges within "v". */ + union + { + struct { + int a; + char b; + char c; + } __attribute__((packed)) icc; + struct { + char a; + int b; + char c; + } __attribute__((packed)) cic; + struct { + char a; + char b; + int c; + } __attribute__((packed)) cci; + } v; + + v.icc.a = 1066; + v.icc.b = 42; + v.icc.c = 17; + + __analyzer_eval (v.icc.a == 1066); /* { dg-warning "TRUE" } */ + __analyzer_eval (v.icc.b == 42); /* { dg-warning "TRUE" } */ + __analyzer_eval (v.icc.c == 17); /* { dg-warning "TRUE" } */ + check_init_int (v.icc.a); + check_init_char (v.icc.b); + check_init_char (v.icc.c); + + check_init_char (v.cic.a); + check_init_int (v.cic.b); + check_init_char (v.cic.c); + + check_init_char (v.cci.a); + check_init_char (v.cci.b); + check_init_int (v.cci.c); + + v.cic.a = 42; + v.cic.b = 1066; + v.cic.c = 17; + + __analyzer_eval (v.cic.a == 42); /* { dg-warning "TRUE" } */ + __analyzer_eval (v.cic.b == 1066); /* { dg-warning "TRUE" } */ + __analyzer_eval (v.cic.c == 17); /* { dg-warning "TRUE" } */ + check_init_int (v.icc.a); + check_init_char (v.icc.b); + check_init_char (v.icc.c); + + check_init_char (v.cic.a); + check_init_int (v.cic.b); + check_init_char (v.cic.c); + + check_init_char (v.cci.a); + check_init_char (v.cci.b); + check_init_int (v.cci.c); + + v.cci.a = 42; + v.cci.b = 17; + v.cci.c = 1066; + + __analyzer_eval (v.cci.a == 42); /* { dg-warning "TRUE" } */ + __analyzer_eval (v.cci.b == 17); /* { dg-warning "TRUE" } */ + __analyzer_eval (v.cci.c == 1066); /* { dg-warning "TRUE" } */ + check_init_int (v.icc.a); + check_init_char (v.icc.b); + check_init_char (v.icc.c); + + check_init_char (v.cic.a); + check_init_int (v.cic.b); + check_init_char (v.cic.c); + + check_init_char (v.cci.a); + check_init_char (v.cci.b); + check_init_int (v.cci.c); + +} diff --git a/gcc/testsuite/c-c++-common/analyzer/data-model-4.c b/gcc/testsuite/c-c++-common/analyzer/data-model-4.c new file mode 100644 index 0000000..d41868d --- /dev/null +++ b/gcc/testsuite/c-c++-common/analyzer/data-model-4.c @@ -0,0 +1,18 @@ +/* { dg-additional-options "-fexceptions" } */ +/* TODO:is there a way to automatically run the tests on various + optimizations levels, and with/without debuginfo, rather than + hardcoding options? Adapt from torture .exp, presumably. */ + +#include +int +main () +{ + FILE *f = fopen ("conftest.out", "w"); + if (f == NULL) + return 1; + return ferror (f) || fclose (f) != 0; + + ; + return 0; +} + diff --git a/gcc/testsuite/c-c++-common/analyzer/data-model-5d.c b/gcc/testsuite/c-c++-common/analyzer/data-model-5d.c new file mode 100644 index 0000000..b4d77a9 --- /dev/null +++ b/gcc/testsuite/c-c++-common/analyzer/data-model-5d.c @@ -0,0 +1,71 @@ +/* A toy re-implementation of CPython's object model. */ + +#include +#include +#include +#include "analyzer-decls.h" + +typedef struct base_obj +{ + struct type_obj *ob_type; + int ob_refcnt; +} base_obj; + +typedef struct type_obj +{ + base_obj tp_base; + void (*tp_dealloc) (base_obj *); +} type_obj; + +typedef struct boxed_int_obj +{ + base_obj int_base; + int int_val; +} boxed_int_obj; + +extern void int_del (base_obj *); + +type_obj type_type = { + { &type_type, 1} +}; + +type_obj boxed_int_type = { + { &type_type, 1}, + int_del +}; + +base_obj *alloc_obj (type_obj *ob_type, size_t sz) +{ + base_obj *obj = (base_obj *)malloc (sz); + if (!obj) + return NULL; + obj->ob_type = ob_type; + obj->ob_refcnt = 1; + return obj; +} + +base_obj *new_int_obj (int val) +{ + boxed_int_obj *int_obj + = (boxed_int_obj *)alloc_obj (&boxed_int_type, sizeof (boxed_int_obj)); + if (!int_obj) + return NULL; + int_obj->int_val = val; + return (base_obj *)int_obj; +} + +void unref (base_obj *obj) +{ + if (--obj->ob_refcnt == 0) + obj->ob_type->tp_dealloc (obj); +} + +void test_1 (const char *str) +{ + base_obj *obj = new_int_obj (42); + if (!obj) + return; + __analyzer_eval (((boxed_int_obj *)obj)->int_val == 42); /* { dg-warning "TRUE" } */ + __analyzer_eval (obj->ob_refcnt == 1); /* { dg-warning "TRUE" } */ + unref (obj); +} /* { dg-bogus "leak" "" } */ diff --git a/gcc/testsuite/c-c++-common/analyzer/data-model-8.c b/gcc/testsuite/c-c++-common/analyzer/data-model-8.c new file mode 100644 index 0000000..3e69d0f --- /dev/null +++ b/gcc/testsuite/c-c++-common/analyzer/data-model-8.c @@ -0,0 +1,25 @@ +#include "analyzer-decls.h" + +struct base +{ + int i; +}; + +struct sub +{ + struct base b; + int j; +}; + +void test (void) +{ + struct sub s; + s.b.i = 3; + s.j = 4; + __analyzer_eval (s.b.i == 3); /* { dg-warning "TRUE" } */ + __analyzer_eval (s.j == 4); /* { dg-warning "TRUE" } */ + + struct base *bp = (struct base *)&s; + + __analyzer_eval (bp->i == 3); /* { dg-warning "TRUE" } */ +} diff --git a/gcc/testsuite/c-c++-common/analyzer/data-model-path-1.c b/gcc/testsuite/c-c++-common/analyzer/data-model-path-1.c new file mode 100644 index 0000000..d7058ea --- /dev/null +++ b/gcc/testsuite/c-c++-common/analyzer/data-model-path-1.c @@ -0,0 +1,13 @@ +#include + +static int *__attribute__((noinline)) +callee (void) +{ + return NULL; +} + +void test_1 (void) +{ + int *p = callee (); /* { dg-message "return of NULL to 'test_1' from 'callee'" } */ + *p = 42; /* { dg-warning "dereference of NULL 'p'" } */ +} diff --git a/gcc/testsuite/c-c++-common/analyzer/deref-before-check-2.c b/gcc/testsuite/c-c++-common/analyzer/deref-before-check-2.c new file mode 100644 index 0000000..c0409c4 --- /dev/null +++ b/gcc/testsuite/c-c++-common/analyzer/deref-before-check-2.c @@ -0,0 +1,130 @@ +#include + +struct st +{ + char *str; + int i; +}; + +int test_1 (struct st *p) +{ + fprintf (stderr, "str: %s\n", p->str); /* { dg-message "pointer 'p' is dereferenced here" } */ + if (!p) /* { dg-warning "check of 'p' for NULL after already dereferencing it" } */ + return -1; + return p->i; +} + +int test_2 (int flag_a, int flag_b, struct st *p) +{ + if (flag_a) + { + int j = p->i; /* { dg-message "pointer 'p' is dereferenced here" } */ + if (flag_b && p) /* { dg-warning "check of 'p' for NULL after already dereferencing it" } */ + return 1; + return j; + } + return 2; +} + +int test_3 (struct st *a, struct st *b) +{ + if (!a) + return b->i; + if (!b) + return a->i; + return 0; +} + +int test_4 (struct st *p) +{ + int *q = &p->i; + if (!p) + return -1; + return *q; +} + +void test_check_after_strlen (const char *str) +{ + size_t len_a = __builtin_strlen (str); /* { dg-message "pointer 'str' is dereferenced here" } */ + size_t len_b = str ? __builtin_strlen (str) : 0; /* { dg-warning "check of 'str' for NULL after already dereferencing it" } */ +} + +void test_6 (struct st *a, struct st *b) +{ + int diff = a->i - b->i; /* { dg-message "pointer 'b' is dereferenced here" } */ + + /* ... */ + + if (b) /* { dg-warning "check of 'b' for NULL after already dereferencing it" } */ + fprintf (stderr, "str: %s\n", b->str); +} + +void test_check_after_strcmp (const char *s1, const char *s2) +{ + if (!__builtin_strcmp (s1, s2)) /* { dg-message "pointer 's1' is dereferenced here" } */ + return; + + /* ... */ + + if (s1) /* { dg-warning "check of 's1' for NULL after already dereferencing it" } */ + return; +} + +void test_more_than_one_deref (struct st *p) +{ + char *str = p->str; /* { dg-message "pointer 'p' is dereferenced here" } */ + int i = p->i; + + /* ... */ + + if (p) /* { dg-warning "check of 'p' for NULL after already dereferencing it" } */ + return; + + /* ... */ +} + +void test_deref_under_another_name (struct st *p) +{ + struct st *q = p; + int i = q->i; /* { dg-message "pointer 'p' is dereferenced here" } */ + + /* ... */ + + if (p) /* { dg-warning "check of 'p' for NULL after already dereferencing it" } */ + return; + + /* ... */ +} + +void test_check_after_memcpy_src (struct st *dst, struct st *src) +{ + __builtin_memcpy (dst, src, sizeof (struct st)); /* { dg-message "pointer 'src' is dereferenced here" } */ + + /* ... */ + + if (!src) /* { dg-warning "check of 'src' for NULL after already dereferencing it" } */ + return; + + /* ... */ +} + +void test_check_after_memcpy_dst (struct st *dst, struct st *src) +{ + __builtin_memcpy (dst, src, sizeof (struct st)); /* { dg-message "pointer 'dst' is dereferenced here" } */ + + /* ... */ + + if (!dst) /* { dg-warning "check of 'dst' for NULL after already dereferencing it" } */ + return; + + /* ... */ +} + +void test_merger (int *p, int flag) +{ + int x = *p; + if (flag) + __builtin_free (p); + if (!flag) + __builtin_free (p); /* { dg-bogus "double-'free'" } */ +} diff --git a/gcc/testsuite/c-c++-common/analyzer/deref-before-check-macro-pr108745.c b/gcc/testsuite/c-c++-common/analyzer/deref-before-check-macro-pr108745.c new file mode 100644 index 0000000..92f5a02 --- /dev/null +++ b/gcc/testsuite/c-c++-common/analyzer/deref-before-check-macro-pr108745.c @@ -0,0 +1,54 @@ +/* Reduced from ImageMagick-7.1.0-57. */ + +#define NULL ((void *)0) + +typedef __builtin_va_list va_list; +typedef __SIZE_TYPE__ size_t; + +typedef struct _ExceptionInfo ExceptionInfo; + +void +ThrowMagickException(ExceptionInfo*, + const char*, + const char*, + ...) __attribute__((__format__(__printf__, 3, 4))); + +typedef struct _Image +{ + /* [...snip...] */ + size_t columns, rows, depth, colors; + /* [...snip...] */ +} Image; + +typedef struct _ImageInfo +{ + /* [...snip...] */ + char filename[4096]; + /* [...snip...] */ +} ImageInfo; + +extern Image *AcquireImage(const ImageInfo*, ExceptionInfo*); +extern void CloseBlob(Image*); +extern Image *DestroyImageList(Image*); + +#define ThrowReaderException(tag) \ +{ \ + (void) ThrowMagickException(exception, tag, \ + "`%s'",image_info->filename); \ + if ((image) != (Image *) NULL) \ + { \ + (void) CloseBlob(image); \ + image=DestroyImageList(image); \ + } \ + return((Image *) NULL); \ +} + +Image* +ReadMAPImage(const ImageInfo* image_info, ExceptionInfo* exception) +{ + Image* image; + image = AcquireImage(image_info, exception); + if ((image->columns == 0) || (image->rows == 0)) + ThrowReaderException("MustSpecifyImageSize"); + return image; +} diff --git a/gcc/testsuite/c-c++-common/analyzer/deref-before-check-qemu-qtest_rsp_args.c b/gcc/testsuite/c-c++-common/analyzer/deref-before-check-qemu-qtest_rsp_args.c new file mode 100644 index 0000000..2b3ad8c --- /dev/null +++ b/gcc/testsuite/c-c++-common/analyzer/deref-before-check-qemu-qtest_rsp_args.c @@ -0,0 +1,73 @@ +/* Reduced from qemu-7.2.0's tests/qtest/libqtest.c. */ + +#define TRUE 1 +#define NULL ((void *)0) + +#define g_assert(expr) \ + do { \ + if (expr) ; else /* { dg-warning "check of '\\*words' for NULL after already dereferencing it" } */ \ + g_assertion_message_expr (#expr); \ +} while (0) + +void g_assertion_message_expr (const char *expr) __attribute__((noreturn)); + +extern int strcmp (const char *__s1, const char *__s2) + __attribute__ ((__nothrow__ , __leaf__, __pure__, __nonnull__ (1, 2))); +typedef char gchar; +typedef int gint; +typedef gint gboolean; +typedef struct _GString GString; + +struct _GString +{ + gchar *str; + /* [...snip...] */ +}; + +extern +gchar* g_string_free (GString *string, + gboolean free_segment); +extern +gchar** g_strsplit (const gchar *string, + const gchar *delimiter, + gint max_tokens); +extern +void g_strfreev (gchar **str_array); + +typedef struct QTestState QTestState; +typedef GString* (*QTestRecvFn)(QTestState *); + +typedef struct QTestClientTransportOps { + /* [...snip...] */ + QTestRecvFn recv_line; +} QTestTransportOps; + +struct QTestState +{ + /* [...snip...] */ + QTestTransportOps ops; + /* [...snip...] */ +}; + +gchar **qtest_rsp_args(QTestState *s, int expected_args) +{ + GString *line; + gchar **words; + /* [...snip...] */ + +redo: + line = s->ops.recv_line(s); + words = g_strsplit(line->str, " ", 0); + g_string_free(line, TRUE); + + if (strcmp(words[0], "IRQ") == 0) { /* { dg-message "pointer '\\*words' is dereferenced here" } */ + /* [...snip...] */ + g_strfreev(words); + goto redo; + } + + g_assert(words[0] != NULL); /* { dg-message "in expansion of macro 'g_assert'" } */ + /* [...snip...] */ + + return words; +} diff --git a/gcc/testsuite/c-c++-common/analyzer/disabling.c b/gcc/testsuite/c-c++-common/analyzer/disabling.c new file mode 100644 index 0000000..a696d1e --- /dev/null +++ b/gcc/testsuite/c-c++-common/analyzer/disabling.c @@ -0,0 +1,10 @@ +/* Verify that we can override -fanalyzer with -fno-analyzer. */ +/* { dg-additional-options "-fno-analyzer" } */ + +#include + +void test (void *ptr) +{ + free (ptr); + free (ptr); /* { dg-bogus "free" } */ +} diff --git a/gcc/testsuite/c-c++-common/analyzer/dump-state.c b/gcc/testsuite/c-c++-common/analyzer/dump-state.c new file mode 100644 index 0000000..618a5a9 --- /dev/null +++ b/gcc/testsuite/c-c++-common/analyzer/dump-state.c @@ -0,0 +1,14 @@ +/* Verify that __analyzer_dump_state works as expected. */ + +#include +#include "analyzer-decls.h" + +void test_1 (void) +{ + void *p = malloc (1024); + __analyzer_dump_state ("malloc", p); /* { dg-warning "state: 'unchecked'" } */ + free (p); + __analyzer_dump_state ("malloc", p); /* { dg-warning "state: 'freed'" } */ + __analyzer_dump_state (NULL, p); /* { dg-error "cannot determine state machine" } */ + __analyzer_dump_state ("not a state machine", p); /* { dg-error "unrecognized state machine 'not a state machine'" } */ +} diff --git a/gcc/testsuite/c-c++-common/analyzer/edges-2.c b/gcc/testsuite/c-c++-common/analyzer/edges-2.c new file mode 100644 index 0000000..847a708 --- /dev/null +++ b/gcc/testsuite/c-c++-common/analyzer/edges-2.c @@ -0,0 +1,20 @@ +#include + +int foo (); +int bar (); + +/* Verify that only significant edges are reported. */ + +void test (int a, int b, int c) +{ + void *p = malloc (1024); /* { dg-message "allocated here" } */ + while (a) /* { dg-bogus "" } */ + foo (); + if (b) /* { dg-bogus "" } */ + foo (); + else + bar (); + if (c) /* { dg-message "following 'true' branch" } */ + free (p); /* { dg-message "first 'free' here" } */ + free (p); /* { dg-warning "double-'free' of 'p'" } */ +} diff --git a/gcc/testsuite/c-c++-common/analyzer/equivalence.c b/gcc/testsuite/c-c++-common/analyzer/equivalence.c new file mode 100644 index 0000000..609b6fd --- /dev/null +++ b/gcc/testsuite/c-c++-common/analyzer/equivalence.c @@ -0,0 +1,31 @@ +#include "analyzer-decls.h" + +void test (int p, int q, int r) +{ + if (p == 42) + { + __analyzer_eval (p == 42); /* { dg-warning "TRUE" } */ + __analyzer_eval (p != 42); /* { dg-warning "FALSE" } */ + if (q == 42) + { + __analyzer_eval (p == q); /* { dg-warning "TRUE" } */ + } + else + { + __analyzer_eval (p != q); /* { dg-warning "TRUE" } */ + } + } + else + { + __analyzer_eval (p == 42); /* { dg-warning "FALSE" } */ + __analyzer_eval (p != 42); /* { dg-warning "TRUE" } */ + if (q == 42) + { + __analyzer_eval (p == q); /* { dg-warning "FALSE" } */ + } + else + { + __analyzer_eval (p == q); /* { dg-warning "UNKNOWN" } */ + } + } +} diff --git a/gcc/testsuite/c-c++-common/analyzer/errno-1.c b/gcc/testsuite/c-c++-common/analyzer/errno-1.c new file mode 100644 index 0000000..6b9d28c --- /dev/null +++ b/gcc/testsuite/c-c++-common/analyzer/errno-1.c @@ -0,0 +1,23 @@ +#include +#include "analyzer-decls.h" + +extern void external_fn (void); + +int test_reading_errno (void) +{ + return errno; +} + +void test_setting_errno (int val) +{ + errno = val; +} + +void test_storing_to_errno (int val) +{ + __analyzer_eval (errno == val); /* { dg-warning "UNKNOWN" } */ + errno = val; + __analyzer_eval (errno == val); /* { dg-warning "TRUE" } */ + external_fn (); + __analyzer_eval (errno == val); /* { dg-warning "UNKNOWN" } */ +} diff --git a/gcc/testsuite/c-c++-common/analyzer/errno-___errno.c b/gcc/testsuite/c-c++-common/analyzer/errno-___errno.c new file mode 100644 index 0000000..17ff8b7 --- /dev/null +++ b/gcc/testsuite/c-c++-common/analyzer/errno-___errno.c @@ -0,0 +1,29 @@ +#include "analyzer-decls.h" + +/* According to PR 107807 comment #2, Solaris implements "errno" + like this: */ + +extern int *___errno(void) __attribute__((__const__)); +#define errno (*(___errno())) + + +extern void external_fn (void); + +int test_reading_errno (void) +{ + return errno; +} + +void test_setting_errno (int val) +{ + errno = val; +} + +void test_storing_to_errno (int val) +{ + __analyzer_eval (errno == val); /* { dg-warning "UNKNOWN" } */ + errno = val; + __analyzer_eval (errno == val); /* { dg-warning "TRUE" } */ + external_fn (); + __analyzer_eval (errno == val); /* { dg-warning "UNKNOWN" } */ +} diff --git a/gcc/testsuite/c-c++-common/analyzer/errno-__error.c b/gcc/testsuite/c-c++-common/analyzer/errno-__error.c new file mode 100644 index 0000000..19bc4f9 --- /dev/null +++ b/gcc/testsuite/c-c++-common/analyzer/errno-__error.c @@ -0,0 +1,28 @@ +#include "analyzer-decls.h" + +/* According to PR 107807 comment #2, OS X implements "errno" + like this: */ + +extern int * __error(void); +#define errno (*__error()) + +extern void external_fn (void); + +int test_reading_errno (void) +{ + return errno; +} + +void test_setting_errno (int val) +{ + errno = val; +} + +void test_storing_to_errno (int val) +{ + __analyzer_eval (errno == val); /* { dg-warning "UNKNOWN" } */ + errno = val; + __analyzer_eval (errno == val); /* { dg-warning "TRUE" } */ + external_fn (); + __analyzer_eval (errno == val); /* { dg-warning "UNKNOWN" } */ +} diff --git a/gcc/testsuite/c-c++-common/analyzer/errno-global-var.c b/gcc/testsuite/c-c++-common/analyzer/errno-global-var.c new file mode 100644 index 0000000..fdf1b17 --- /dev/null +++ b/gcc/testsuite/c-c++-common/analyzer/errno-global-var.c @@ -0,0 +1,26 @@ +#include "analyzer-decls.h" + +/* "errno" declared as a global var. */ + +extern int errno; + +extern void external_fn (void); + +int test_reading_errno (void) +{ + return errno; +} + +void test_setting_errno (int val) +{ + errno = val; +} + +void test_storing_to_errno (int val) +{ + __analyzer_eval (errno == val); /* { dg-warning "UNKNOWN" } */ + errno = val; + __analyzer_eval (errno == val); /* { dg-warning "TRUE" } */ + external_fn (); + __analyzer_eval (errno == val); /* { dg-warning "UNKNOWN" } */ +} diff --git a/gcc/testsuite/c-c++-common/analyzer/errno-pr107777.c b/gcc/testsuite/c-c++-common/analyzer/errno-pr107777.c new file mode 100644 index 0000000..6568739 --- /dev/null +++ b/gcc/testsuite/c-c++-common/analyzer/errno-pr107777.c @@ -0,0 +1,20 @@ +int * +__errno_location (void); + +long int +read (int, void *, unsigned long int); + +struct IOBUF { + int fd; +}; + +void +do_getline_end_data (struct IOBUF *iop, int tree) +{ + char end_data; + + if (tree) + *__errno_location () = 0; + + read (iop->fd, &end_data, sizeof end_data); +} diff --git a/gcc/testsuite/c-c++-common/analyzer/error-3.c b/gcc/testsuite/c-c++-common/analyzer/error-3.c new file mode 100644 index 0000000..b6ab6c8 --- /dev/null +++ b/gcc/testsuite/c-c++-common/analyzer/error-3.c @@ -0,0 +1,11 @@ +/* Verify that we gracefully handle error functions that don't match + the signature of GNU's . */ + +extern void error (void); +extern void error_at_line (void); + +void test_1 (void) +{ + error (); + error_at_line (); +} diff --git a/gcc/testsuite/c-c++-common/analyzer/error-uninit.c b/gcc/testsuite/c-c++-common/analyzer/error-uninit.c new file mode 100644 index 0000000..8d52a17 --- /dev/null +++ b/gcc/testsuite/c-c++-common/analyzer/error-uninit.c @@ -0,0 +1,29 @@ +/* Verify that we check for uninitialized values passed to functions + that we have special-cased region-model handling for. */ + +extern void error (int __status, int __errnum, const char *__format, ...) + __attribute__ ((__format__ (__printf__, 3, 4))); + +void test_uninit_status (int arg) +{ + int st; + error (st, 42, "test: %s", arg); /* { dg-warning "use of uninitialized value 'st'" } */ +} + +void test_uninit_errnum (int st) +{ + int num; + error (st, num, "test"); /* { dg-warning "use of uninitialized value 'num'" } */ +} + +void test_uninit_fmt (int st) +{ + const char *fmt; + error (st, 42, fmt); /* { dg-warning "use of uninitialized value 'fmt'" } */ +} + +void test_uninit_vargs (int st) +{ + int arg; + error (st, 42, "test: %s", arg); /* { dg-warning "use of uninitialized value 'arg'" } */ +} diff --git a/gcc/testsuite/c-c++-common/analyzer/factorial.c b/gcc/testsuite/c-c++-common/analyzer/factorial.c new file mode 100644 index 0000000..384713a --- /dev/null +++ b/gcc/testsuite/c-c++-common/analyzer/factorial.c @@ -0,0 +1,7 @@ +int factorial (int n) +{ + if (n > 1) + return n * factorial (n - 1); + else + return 1; +} diff --git a/gcc/testsuite/c-c++-common/analyzer/fd-1.c b/gcc/testsuite/c-c++-common/analyzer/fd-1.c new file mode 100644 index 0000000..5b85a33 --- /dev/null +++ b/gcc/testsuite/c-c++-common/analyzer/fd-1.c @@ -0,0 +1,60 @@ +int open(const char *, int mode); +#define O_RDONLY 0 +#define O_WRONLY 1 +#define O_RDWR 2 + +typedef enum { + S_IRWXU + // etc +} mode_t; + +int creat (const char *, mode_t mode); + +void +test_1 (const char *path) +{ + int fd = open (path, O_RDONLY); /* { dg-message "\\(1\\) opened here" } */ + return; /* { dg-warning "leak of file descriptor 'fd' \\\[CWE-775\\\]" "warning" } */ + /* { dg-message "\\(2\\) 'fd' leaks here; was opened at \\(1\\)" "event" { target *-*-* } .-1 } */ +} + +void +test_2 (const char *path) +{ + int fd = open (path, O_RDWR); /* { dg-message "\\(1\\) opened here" } */ + if (fd >= 0) /* { dg-message "\\(2\\) assuming 'fd' is a valid file descriptor" "event1" } */ + /* { dg-message "\\(3\\) following 'true' branch \\(when 'fd >= 0'\\)..." "event2" { target *-*-* } .-1 } */ + { + return; /* { dg-warning "leak of file descriptor 'fd' \\\[CWE-775\\\]" "warning" } */ + /* { dg-message "\\(4\\) ...to here" "event1" { target *-*-* } .-1 } */ + /* { dg-message "\\(5\\) 'fd' leaks here; was opened at \\(1\\)" "event2" { target *-*-* } .-2 } */ + } +} + +void +test_3 (const char *path) +{ + int fd = open (path, O_WRONLY); /* { dg-message "\\(1\\) opened here" } */ + return; /* { dg-warning "leak of file descriptor 'fd' \\\[CWE-775\\\]" "warning" } */ +} + +void test_4 (const char *path) +{ + open(path, O_RDONLY); /* { dg-warning "leak of file descriptor \\\[CWE-775\\\]" } */ + /* { dg-message "\\(1\\) leaks here" "" { target *-*-* } .-1 } */ +} + +void +test_5 (const char *path, mode_t mode) +{ + creat (path, mode); /* { dg-warning "leak of file descriptor \\\[CWE-775\\\]" } */ +} + +void +test_6 (const char *path, mode_t mode) +{ + int fd = creat (path, mode); + return; /* { dg-warning "leak of file descriptor 'fd' \\\[CWE-775\\\]" } */ +} + + diff --git a/gcc/testsuite/c-c++-common/analyzer/fd-2.c b/gcc/testsuite/c-c++-common/analyzer/fd-2.c new file mode 100644 index 0000000..10c9ecd --- /dev/null +++ b/gcc/testsuite/c-c++-common/analyzer/fd-2.c @@ -0,0 +1,64 @@ +int open(const char *, int mode); +void close(int fd); +#define O_RDONLY 0 +#define O_WRONLY 1 +#define O_RDWR 2 +#define STDIN 0 + +typedef enum { + S_IRWXU + // etc +} mode_t; + +int creat (const char *, mode_t mode); + +void +test_1 (const char *path) +{ + int fd = open (path, O_RDWR); /* { dg-message "\\(1\\) opened here" } */ + close (fd); /* { dg-message "\\(2\\) first 'close' here" "event1" } */ + close (fd); /* { dg-warning "double 'close' of file descriptor 'fd' \\\[CWE-1341\\\]" "warning" } */ + /* { dg-message "\\(3\\) second 'close' here; first 'close' was at \\(2\\)" "event2" { target *-*-* } .-1 } */ +} + +void +test_2 (const char *path) +{ + int fd = open (path, O_RDWR); /* { dg-message "\\(1\\) opened here" } */ + if (fd < 0) /* { dg-message "\\(2\\) assuming 'fd' is a valid file descriptor \\(>= 0\\)" "event1" } */ + /* { dg-message "\\(3\\) following 'false' branch \\(when 'fd >= 0'\\)..." "event2" { target *-*-* } .-1 } */ + return; + close (fd); /* { dg-message "\\(4\\) ...to here" "event1" } */ + /* { dg-message "\\(5\\) first 'close' here" "event2" { target *-*-* } .-1 } */ + close (fd); /* { dg-warning "double 'close' of file descriptor 'fd' \\\[CWE-1341\\\]" "warning" } */ + /* {dg-message "\\(6\\) second 'close' here; first was at \\(5\\)" "" { target *-*-* } .-1 } */ +} + +void +test_3 () +{ + /* FD 0 is stdin at the entry to "main" and thus read-only, but we have no + guarantees here that it hasn't been closed and then reopened for + writing, so we can't issue a warning */ + + int fd = STDIN; + close(fd); /* { dg-message "\\(1\\) first 'close' here" } */ + close(fd); /* { dg-warning "double 'close' of file descriptor 'fd' \\\[CWE-1341\\\]" "warning" } */ + /* { dg-message "\\(2\\) second 'close' here; first 'close' was at \\(1\\)" "event2" { target *-*-* } .-1 } */ +} + +void +test_4 () +{ + int fd = -1; + close(fd); + close(fd); +} + +void +test_5 (const char *path, mode_t mode) +{ + int fd = creat (path, mode); + close(fd); + close(fd); /* { dg-warning "double 'close' of file descriptor 'fd' \\\[CWE-1341\\\]" "warning" } */ +} \ No newline at end of file diff --git a/gcc/testsuite/c-c++-common/analyzer/fd-3.c b/gcc/testsuite/c-c++-common/analyzer/fd-3.c new file mode 100644 index 0000000..8e71b14 --- /dev/null +++ b/gcc/testsuite/c-c++-common/analyzer/fd-3.c @@ -0,0 +1,97 @@ +int open(const char *, int mode); +void close(int fd); +int write (int fd, void *buf, int nbytes); +int read (int fd, void *buf, int nbytes); +int some_condition(); + +#define O_RDONLY 0 +#define O_WRONLY 1 +#define O_RDWR 2 +#define STDIN 0 +#define O_NOATIME 262144 + +void +test_1 (const char *path, void *buf) +{ + int fd = open (path, O_RDWR); /* { dg-message "\\(1\\) opened here" } */ + write (fd, buf, 1); /* { dg-message "\\(2\\) 'fd' could be invalid: unchecked value from \\(1\\)" } */ + /* { dg-warning "'write' on possibly invalid file descriptor 'fd'" "warning" { target *-*-* } .-1 } */ + close(fd); +} + +void +test_2 (const char *path, void *buf) +{ + int fd = open (path, O_RDWR); /* { dg-message "\\(1\\) opened here" } */ + read (fd, buf, 1); /* { dg-message "\\(2\\) 'fd' could be invalid: unchecked value from \\(1\\)" } */ + /* { dg-warning "'read' on possibly invalid file descriptor 'fd'" "warning" { target *-*-* } .-1 } */ + close (fd); +} + +void +test_3 (void *buf) +{ + int fd = -1; + read (fd, buf, 1); /* { dg-warning "'read' on possibly invalid file descriptor 'fd'" } */ + /* { dg-message "\\(1\\) 'fd' could be invalid" "" { target *-*-* } .-1 } */ +} + +void +test_4 (void *buf) +{ + int fd = STDIN; + read (fd, buf, 1); + close(fd); +} + +void +test_5 (char *path, void *buf) +{ + int flags = O_RDONLY; + if (some_condition()) + flags |= O_NOATIME; + int fd = open (path, flags); /* { dg-message "\\(1\\) opened here" } */ + read (fd, buf, 1); /* { dg-warning "'read' on possibly invalid file descriptor 'fd'" } */ + /* { dg-message "\\(2\\) 'fd' could be invalid" "" { target *-*-* } .-1 } */ + close (fd); +} + + +void +test_6 (char *path, void *buf) +{ + int fd = open (path, O_RDONLY); + if (fd != -1) + { + read (fd, buf, 1); + } + close (fd); +} + + +void +test_7 (char *path, void *buf) +{ + int fd = open (path, O_RDWR); /* { dg-message "\\(1\\) opened here" } */ + if (fd != -1) /* { dg-message "\\(2\\) assuming 'fd' is an invalid file descriptor \\(< 0\\)" } */ + { + read (fd, buf, 1); + } else + { + write (fd, buf, 1); /* { dg-warning "'write' on possibly invalid file descriptor 'fd'" } */ + + } + close(fd); +} + +void +test_read_from_symbolic_fd (int fd, void *buf) +{ + read (fd, buf, 1); +} + +void +test_write_to_symbolic_fd (int fd, void *buf) +{ + write (fd, buf, 1); +} diff --git a/gcc/testsuite/c-c++-common/analyzer/fd-bind-pr107928.c b/gcc/testsuite/c-c++-common/analyzer/fd-bind-pr107928.c new file mode 100644 index 0000000..acc1a1d --- /dev/null +++ b/gcc/testsuite/c-c++-common/analyzer/fd-bind-pr107928.c @@ -0,0 +1,10 @@ +struct sa {}; + +int +bind (int, struct sa *, int); + +int +foo (struct sa sa) +{ + return bind (1, &sa, sizeof sa); +} diff --git a/gcc/testsuite/c-c++-common/analyzer/fd-connect-pr107928.c b/gcc/testsuite/c-c++-common/analyzer/fd-connect-pr107928.c new file mode 100644 index 0000000..f3bdc87 --- /dev/null +++ b/gcc/testsuite/c-c++-common/analyzer/fd-connect-pr107928.c @@ -0,0 +1,10 @@ +struct sa {}; + +int +connect (int, struct sa *, int); + +int +foo (struct sa sa) +{ + return connect (1, &sa, sizeof sa); +} diff --git a/gcc/testsuite/c-c++-common/analyzer/fd-glibc-byte-stream-socket.c b/gcc/testsuite/c-c++-common/analyzer/fd-glibc-byte-stream-socket.c new file mode 100644 index 0000000..806bb24 --- /dev/null +++ b/gcc/testsuite/c-c++-common/analyzer/fd-glibc-byte-stream-socket.c @@ -0,0 +1,63 @@ +/* Example from glibc manual (16.9.6). */ +/* { dg-require-effective-target sockets } */ + +#include +#include +#include +#include +#include +#include +#include +#include +#include + +#define PORT 5555 +#define MESSAGE "Yow!!! Are we having fun yet?!?" +#define SERVERHOST "www.gnu.org" + +void +write_to_server (int filedes) +{ + int nbytes; + + nbytes = write (filedes, MESSAGE, strlen (MESSAGE) + 1); + if (nbytes < 0) + { + perror ("write"); + exit (EXIT_FAILURE); + } +} + + +int +main (void) +{ + extern void init_sockaddr (struct sockaddr_in *name, + const char *hostname, + uint16_t port); + int sock; + struct sockaddr_in servername; + + /* Create the socket. */ + sock = socket (PF_INET, SOCK_STREAM, 0); + if (sock < 0) + { + perror ("socket (client)"); + exit (EXIT_FAILURE); + } + + /* Connect to the server. */ + init_sockaddr (&servername, SERVERHOST, PORT); + if (0 > connect (sock, + (struct sockaddr *) &servername, + sizeof (servername))) + { + perror ("connect (client)"); + exit (EXIT_FAILURE); + } + + /* Send data to the server. */ + write_to_server (sock); + close (sock); + exit (EXIT_SUCCESS); +} diff --git a/gcc/testsuite/c-c++-common/analyzer/fd-manpage-getaddrinfo-client.c b/gcc/testsuite/c-c++-common/analyzer/fd-manpage-getaddrinfo-client.c new file mode 100644 index 0000000..ee627de --- /dev/null +++ b/gcc/testsuite/c-c++-common/analyzer/fd-manpage-getaddrinfo-client.c @@ -0,0 +1,123 @@ +/* Example from getaddrinfo.3 manpage, which has this license: + +Copyright (c) 2007, 2008 Michael Kerrisk +and Copyright (c) 2006 Ulrich Drepper +A few pieces of an earlier version remain: +Copyright 2000, Sam Varshavchik + +Permission is granted to make and distribute verbatim copies of this +manual provided the copyright notice and this permission notice are +preserved on all copies. + +Permission is granted to copy and distribute modified versions of this +manual under the conditions for verbatim copying, provided that the +entire resulting derived work is distributed under the terms of a +permission notice identical to this one. + +Since the Linux kernel and libraries are constantly changing, this +manual page may be incorrect or out-of-date. The author(s) assume no +responsibility for errors or omissions, or for damages resulting from +the use of the information contained herein. The author(s) may not +have taken the same level of care in the production of this manual, +which is licensed free of charge, as they might when working +professionally. + +Formatted or processed versions of this manual, if unaccompanied by +the source, must acknowledge the copyright and authors of this work. +*/ + +/* { dg-require-effective-target sockets } */ +/* { dg-additional-options "-Wno-analyzer-too-complex" } */ + +#include +#include +#include +#include +#include +#include +#include + +#define BUF_SIZE 500 + +int +main(int argc, char *argv[]) +{ + struct addrinfo hints; + struct addrinfo *result, *rp; + int sfd, s; + size_t len; + ssize_t nread; + char buf[BUF_SIZE]; + + if (argc < 3) { + fprintf(stderr, "Usage: %s host port msg...\n", argv[0]); + exit(EXIT_FAILURE); + } + + /* Obtain address(es) matching host/port. */ + + memset(&hints, 0, sizeof(hints)); + hints.ai_family = AF_UNSPEC; /* Allow IPv4 or IPv6 */ + hints.ai_socktype = SOCK_DGRAM; /* Datagram socket */ + hints.ai_flags = 0; + hints.ai_protocol = 0; /* Any protocol */ + + s = getaddrinfo(argv[1], argv[2], &hints, &result); + if (s != 0) { + fprintf(stderr, "getaddrinfo: %s\n", gai_strerror(s)); + exit(EXIT_FAILURE); + } + + /* getaddrinfo() returns a list of address structures. + Try each address until we successfully connect(2). + If socket(2) (or connect(2)) fails, we (close the socket + and) try the next address. */ + + for (rp = result; rp != NULL; rp = rp->ai_next) { + sfd = socket(rp->ai_family, rp->ai_socktype, + rp->ai_protocol); + if (sfd == -1) + continue; + + if (connect(sfd, rp->ai_addr, rp->ai_addrlen) != -1) + break; /* Success */ + + close(sfd); + } + + freeaddrinfo(result); /* No longer needed */ + + if (rp == NULL) { /* No address succeeded */ + fprintf(stderr, "Could not connect\n"); + exit(EXIT_FAILURE); + } + + /* Send remaining command-line arguments as separate + datagrams, and read responses from server. */ + + for (int j = 3; j < argc; j++) { + len = strlen(argv[j]) + 1; + /* +1 for terminating null byte */ + + if (len > BUF_SIZE) { + fprintf(stderr, + "Ignoring long message in argument %d\n", j); + continue; + } + + if (write(sfd, argv[j], len) != len) { + fprintf(stderr, "partial/failed write\n"); + exit(EXIT_FAILURE); + } + + nread = read(sfd, buf, BUF_SIZE); + if (nread == -1) { + perror("read"); + exit(EXIT_FAILURE); + } + + printf("Received %zd bytes: %s\n", nread, buf); + } + + exit(EXIT_SUCCESS); +} diff --git a/gcc/testsuite/c-c++-common/analyzer/fd-mappage-getaddrinfo-server.c b/gcc/testsuite/c-c++-common/analyzer/fd-mappage-getaddrinfo-server.c new file mode 100644 index 0000000..d2e39eb --- /dev/null +++ b/gcc/testsuite/c-c++-common/analyzer/fd-mappage-getaddrinfo-server.c @@ -0,0 +1,121 @@ +/* Example from getaddrinfo.3 manpage, which has this license: + +Copyright (c) 2007, 2008 Michael Kerrisk +and Copyright (c) 2006 Ulrich Drepper +A few pieces of an earlier version remain: +Copyright 2000, Sam Varshavchik + +Permission is granted to make and distribute verbatim copies of this +manual provided the copyright notice and this permission notice are +preserved on all copies. + +Permission is granted to copy and distribute modified versions of this +manual under the conditions for verbatim copying, provided that the +entire resulting derived work is distributed under the terms of a +permission notice identical to this one. + +Since the Linux kernel and libraries are constantly changing, this +manual page may be incorrect or out-of-date. The author(s) assume no +responsibility for errors or omissions, or for damages resulting from +the use of the information contained herein. The author(s) may not +have taken the same level of care in the production of this manual, +which is licensed free of charge, as they might when working +professionally. + +Formatted or processed versions of this manual, if unaccompanied by +the source, must acknowledge the copyright and authors of this work. +*/ + +/* { dg-require-effective-target sockets } */ + +#include +#include +#include +#include +#include +#include +#include + +#define BUF_SIZE 500 + +int +main(int argc, char *argv[]) +{ + struct addrinfo hints; + struct addrinfo *result, *rp; + int sfd, s; + struct sockaddr_storage peer_addr; + socklen_t peer_addr_len; + ssize_t nread; + char buf[BUF_SIZE]; + + if (argc != 2) { + fprintf(stderr, "Usage: %s port\n", argv[0]); + exit(EXIT_FAILURE); + } + + memset(&hints, 0, sizeof(hints)); + hints.ai_family = AF_UNSPEC; /* Allow IPv4 or IPv6 */ + hints.ai_socktype = SOCK_DGRAM; /* Datagram socket */ + hints.ai_flags = AI_PASSIVE; /* For wildcard IP address */ + hints.ai_protocol = 0; /* Any protocol */ + hints.ai_canonname = NULL; + hints.ai_addr = NULL; + hints.ai_next = NULL; + + s = getaddrinfo(NULL, argv[1], &hints, &result); + if (s != 0) { + fprintf(stderr, "getaddrinfo: %s\n", gai_strerror(s)); + exit(EXIT_FAILURE); + } + + /* getaddrinfo() returns a list of address structures. + Try each address until we successfully bind(2). + If socket(2) (or bind(2)) fails, we (close the socket + and) try the next address. */ + + for (rp = result; rp != NULL; rp = rp->ai_next) { + sfd = socket(rp->ai_family, rp->ai_socktype, + rp->ai_protocol); + if (sfd == -1) + continue; + + if (bind(sfd, rp->ai_addr, rp->ai_addrlen) == 0) + break; /* Success */ + + close(sfd); + } + + freeaddrinfo(result); /* No longer needed */ + + if (rp == NULL) { /* No address succeeded */ + fprintf(stderr, "Could not bind\n"); + exit(EXIT_FAILURE); + } + + /* Read datagrams and echo them back to sender. */ + + for (;;) { + peer_addr_len = sizeof(peer_addr); + nread = recvfrom(sfd, buf, BUF_SIZE, 0, + (struct sockaddr *) &peer_addr, &peer_addr_len); + if (nread == -1) + continue; /* Ignore failed request */ + + char host[NI_MAXHOST], service[NI_MAXSERV]; + + s = getnameinfo((struct sockaddr *) &peer_addr, + peer_addr_len, host, NI_MAXHOST, + service, NI_MAXSERV, NI_NUMERICSERV); + if (s == 0) + printf("Received %zd bytes from %s:%s\n", + nread, host, service); + else + fprintf(stderr, "getnameinfo: %s\n", gai_strerror(s)); + + if (sendto(sfd, buf, nread, 0, + (struct sockaddr *) &peer_addr, + peer_addr_len) != nread) + fprintf(stderr, "Error sending response\n"); + } +} diff --git a/gcc/testsuite/c-c++-common/analyzer/fd-meaning.c b/gcc/testsuite/c-c++-common/analyzer/fd-meaning.c new file mode 100644 index 0000000..6a9ec92 --- /dev/null +++ b/gcc/testsuite/c-c++-common/analyzer/fd-meaning.c @@ -0,0 +1,37 @@ + /* { dg-additional-options "-fanalyzer-verbose-state-changes" } */ +int open(const char *, int mode); +void close(int fd); + +#define O_RDONLY 0 +#define O_WRONLY 1 +#define O_RDWR 2 + +void test_1 (const char* path) +{ + int fd = open (path, O_RDWR); /* { dg-message "meaning: \\{verb: 'acquire', noun: 'resource'\\}" } */ + if (fd != -1) + { + close(fd); /* { dg-message "meaning: \\{verb: 'release', noun: 'resource'\\}" } */ + close(fd); /* { dg-warning "double 'close' of file descriptor 'fd' \\\[CWE-1341\\\]" } */ + } +} + +void test_2 (const char* path) +{ + int fd = open (path, O_RDONLY); /* { dg-message "meaning: \\{verb: 'acquire', noun: 'resource'\\}" } */ + if (fd != -1) + { + close(fd); /* { dg-message "meaning: \\{verb: 'release', noun: 'resource'\\}" } */ + close(fd); /* { dg-warning "double 'close' of file descriptor 'fd' \\\[CWE-1341\\\]" } */ + } +} + +void test_3 (const char* path) +{ + int fd = open (path, O_WRONLY); /* { dg-message "meaning: \\{verb: 'acquire', noun: 'resource'\\}" } */ + if (fd != -1) + { + close(fd); /* { dg-message "meaning: \\{verb: 'release', noun: 'resource'\\}" } */ + close(fd); /* { dg-warning "double 'close' of file descriptor 'fd' \\\[CWE-1341\\\]" } */ + } +} \ No newline at end of file diff --git a/gcc/testsuite/c-c++-common/analyzer/fd-socket-meaning.c b/gcc/testsuite/c-c++-common/analyzer/fd-socket-meaning.c new file mode 100644 index 0000000..82a199f --- /dev/null +++ b/gcc/testsuite/c-c++-common/analyzer/fd-socket-meaning.c @@ -0,0 +1,22 @@ +/* { dg-require-effective-target sockets } */ +/* { dg-additional-options "-fanalyzer-verbose-state-changes" } */ + +#include +#include +#include +#include + +void test_leak_unchecked_stream_socket (void) +{ + int fd = socket (AF_UNIX, SOCK_STREAM, 0); /* { dg-message "meaning: \\{verb: 'acquire', noun: 'resource'\\}" } */ +} /* { dg-warning "leak of file descriptor 'fd'" } */ + +void test_leak_unchecked_datagram_socket (void) +{ + int fd = socket (AF_UNIX, SOCK_DGRAM, 0); /* { dg-message "meaning: \\{verb: 'acquire', noun: 'resource'\\}" } */ +} /* { dg-warning "leak of file descriptor 'fd'" } */ + +void test_leak_unchecked_socket (int type) +{ + int fd = socket (AF_UNIX, type, 0); /* { dg-message "meaning: \\{verb: 'acquire', noun: 'resource'\\}" } */ +} /* { dg-warning "leak of file descriptor 'fd'" } */ diff --git a/gcc/testsuite/c-c++-common/analyzer/fd-symbolic-socket.c b/gcc/testsuite/c-c++-common/analyzer/fd-symbolic-socket.c new file mode 100644 index 0000000..d7dc46a --- /dev/null +++ b/gcc/testsuite/c-c++-common/analyzer/fd-symbolic-socket.c @@ -0,0 +1,102 @@ +/* { dg-require-effective-target sockets } */ +/* { dg-skip-if "" { powerpc*-*-aix* } } */ + +#include +#include +#include +#include +#include +#include "analyzer-decls.h" + +void test_leak_socket (int type) +{ + int fd = socket (AF_UNIX, type, 0); /* { dg-message "socket created here" } */ +} /* { dg-warning "leak of file descriptor 'fd'" } */ + +void test_leak_socket_no_lhs (int type) +{ + socket (AF_UNIX, type, 0); /* { dg-warning "leak of file descriptor" } */ +} + +void test_close_unchecked_socket (int type) +{ + int fd = socket (AF_UNIX, type, 0); + close (fd); +} + +void test_close_checked_socket (int type) +{ + int fd = socket (AF_UNIX, type, 0); + if (fd == -1) + return; + close (fd); +} + +void test_leak_checked_socket (int type) +{ + int fd = socket (AF_UNIX, type, 0); /* { dg-message "socket created here" } */ + if (fd == -1) /* { dg-warning "leak of file descriptor 'fd'" } */ + return; + // TODO: strange location for leak message +} + +void test_bind_on_checked_socket (int type, const char *sockname) +{ + struct sockaddr_un addr; + int fd = socket (AF_UNIX, type, 0); + if (fd == -1) + return; + memset (&addr, 0, sizeof (addr)); + addr.sun_family = AF_UNIX; + strncpy (addr.sun_path, sockname, sizeof(addr.sun_path) - 1); + bind (fd, (struct sockaddr *)&addr, sizeof (addr)); + close (fd); +} + +void test_bind_on_unchecked_socket (int type, const char *sockname) +{ + struct sockaddr_un addr; + int fd = socket (AF_UNIX, type, 0); /* { dg-message "when 'socket' fails" } */ + memset (&addr, 0, sizeof (addr)); + addr.sun_family = AF_UNIX; + strncpy (addr.sun_path, sockname, sizeof(addr.sun_path) - 1); + bind (fd, (struct sockaddr *)&addr, sizeof (addr)); /* { dg-warning "'bind' on possibly invalid file descriptor 'fd'" } */ + close (fd); +} + +void test_leak_of_bound_socket (int type, const char *sockname) +{ + struct sockaddr_un addr; + int fd = socket (AF_UNIX, type, 0); /* { dg-message "socket created here" } */ + if (fd == -1) + return; + memset (&addr, 0, sizeof (addr)); + addr.sun_family = AF_UNIX; + strncpy (addr.sun_path, sockname, sizeof(addr.sun_path) - 1); + bind (fd, (struct sockaddr *)&addr, sizeof (addr)); /* { dg-warning "leak of file descriptor 'fd'" } */ +} + +void test_listen_without_bind (int type) +{ + int fd = socket (AF_UNIX, type, 0); + if (fd == -1) + return; + listen (fd, 5); /* { dg-warning "'listen' on file descriptor 'fd' in wrong phase" } */ + /* { dg-message "'listen' expects a bound stream socket file descriptor but 'fd' has not yet been bound" "msg" { target *-*-* } .-1 } */ + close (fd); +} + +void test_listen_on_unchecked_bind (int type, const char *sockname) +{ + struct sockaddr_un addr; + int fd = socket (AF_UNIX, type, 0); + if (fd == -1) + return; + memset (&addr, 0, sizeof (addr)); + addr.sun_family = AF_UNIX; + strncpy (addr.sun_path, sockname, sizeof(addr.sun_path) - 1); + bind (fd, (struct sockaddr *)&addr, sizeof (addr)); /* { dg-message "when 'bind' fails" } */ + listen (fd, 5); /* { dg-warning "'listen' on file descriptor 'fd' in wrong phase" "warning" } */ + /* { dg-message "'listen' expects a bound stream socket file descriptor but 'fd' has not yet been bound" "msg" { target *-*-* } .-1 } */ + close (fd); +} diff --git a/gcc/testsuite/c-c++-common/analyzer/fd-uninit-1.c b/gcc/testsuite/c-c++-common/analyzer/fd-uninit-1.c new file mode 100644 index 0000000..1084d1b --- /dev/null +++ b/gcc/testsuite/c-c++-common/analyzer/fd-uninit-1.c @@ -0,0 +1,19 @@ +/* Verify that we check for uninitialized values passed to functions + that we have special-cased state-machine handling for. */ + +int dup (int old_fd); +int not_dup (int old_fd); + +int +test_1 () +{ + int m; + return dup (m); /* { dg-warning "use of uninitialized value 'm'" "uninit" } */ +} + +int +test_2 () +{ + int m; + return not_dup (m); /* { dg-warning "use of uninitialized value 'm'" } */ +} diff --git a/gcc/testsuite/c-c++-common/analyzer/feasibility-1.c b/gcc/testsuite/c-c++-common/analyzer/feasibility-1.c new file mode 100644 index 0000000..83ec1ca --- /dev/null +++ b/gcc/testsuite/c-c++-common/analyzer/feasibility-1.c @@ -0,0 +1,100 @@ +#include "analyzer-decls.h" + +void test_1 (void) +{ + __analyzer_dump_path (); /* { dg-message "path" } */ +} + +void test_2 (int flag) +{ + if (flag) + __analyzer_dump_path (); /* { dg-message "path" } */ +} + +void test_3 (int flag) +{ + if (flag) + if (!flag) + __analyzer_dump_path (); /* { dg-bogus "path" } */ +} + +int global_for_test_4; +static void __attribute__((noinline)) called_by_test_4 () {} +void test_4 (void) +{ + /* Verify that a state change that happens in a stmt that + isn't the first within its BB can affect path feasibility. */ + global_for_test_4 = 0; + global_for_test_4 = 1; + /* Thwart the optimizer. */ + called_by_test_4 (); + if (global_for_test_4) + __analyzer_dump_path (); /* { dg-message "path" } */ +} + +/* Verify that loops don't confuse the feasibility checker. */ + +void test_5 (void) +{ + for (int i = 0; i < 1024; i++) + { + } + __analyzer_dump_path (); /* { dg-message "path" } */ +} + +/* Reproducer for an issue seen with CVE-2005-1689 (PR analyzer/96374): if we + take the shortest path and update state and check feasibility per-edge, we + can erroneously reject valid diagnostics. */ + +int test_6 (int a, int b) +{ + int problem = 0; + if (a) + problem = 1; + if (b) + { + if (!problem) + problem = 2; + __analyzer_dump_path (); /* { dg-message "path" } */ + } + return problem; +} + +/* As above, but call a static function. + Even if the path to the call of called_by_test_6a is falsely rejected + as infeasible, it still makes sense to complain about errors within + the called function. */ + +static void __attribute__((noinline)) +called_by_test_6a (void *ptr) +{ + __builtin_free (ptr); + __builtin_free (ptr); /* { dg-message "double-'free'" } */ +} + +int test_6a (int a, int b, void *ptr) +{ + int problem = 0; + if (a) + problem = 1; + if (b) + { + if (!problem) + problem = 2; + called_by_test_6a (ptr); + } + return problem; +} + +/* After state-merging, the shortest path skips the loop, + but the shortest feasible path enters it. */ + +void test_7 (int n) +{ + int entered_loop = 0; + int i; + for (i = 0; i < n; i++) + entered_loop = 1; + if (entered_loop) + __analyzer_dump_path (); /* { dg-message "path" } */ +} diff --git a/gcc/testsuite/c-c++-common/analyzer/feasibility-2.c b/gcc/testsuite/c-c++-common/analyzer/feasibility-2.c new file mode 100644 index 0000000..9fe62d2 --- /dev/null +++ b/gcc/testsuite/c-c++-common/analyzer/feasibility-2.c @@ -0,0 +1,20 @@ +/* Verify that -fno-analyzer-feasibility works. */ +/* { dg-additional-options "-fno-analyzer-feasibility" } */ + +#include "analyzer-decls.h" + +void test_1 (int flag) +{ + int a; + if (flag) + a = 1; + else + a = 2; + + if (a == 1) /* (can only be the case when "flag" was true above). */ + if (!flag) + { + __analyzer_dump_path (); /* { dg-message "note: path" "path diag" } */ + /* { dg-message "infeasible" "infeasibility event" { target *-*-* } .-1 } */ + } +} diff --git a/gcc/testsuite/c-c++-common/analyzer/feasibility-4.c b/gcc/testsuite/c-c++-common/analyzer/feasibility-4.c new file mode 100644 index 0000000..1a11280 --- /dev/null +++ b/gcc/testsuite/c-c++-common/analyzer/feasibility-4.c @@ -0,0 +1,42 @@ +#include "analyzer-decls.h" + +extern int rand (void); + +void test_1 (void) +{ + int ret = 0; + while (ret != 42) + ret = rand() % 1000; + + if (ret != 42) + __analyzer_dump_path (); /* { dg-bogus "path" } */ +} + +static void empty_local_fn (void) {} +extern void external_fn (void); + +void test_2 (void) +{ + void (*callback) () = empty_local_fn; + int ret = 0; + while (ret != 42) + ret = rand() % 1000; + + (*callback) (); + + if (ret != 42) + __analyzer_dump_path (); /* { dg-bogus "path" } */ +} + +void test_3 (void) +{ + void (*callback) () = external_fn; + int ret = 0; + while (ret != 42) + ret = rand() % 1000; + + (*callback) (); + + if (ret != 42) + __analyzer_dump_path (); /* { dg-bogus "path" } */ +} diff --git a/gcc/testsuite/c-c++-common/analyzer/feasibility-pr107948.c b/gcc/testsuite/c-c++-common/analyzer/feasibility-pr107948.c new file mode 100644 index 0000000..5eb8b0a --- /dev/null +++ b/gcc/testsuite/c-c++-common/analyzer/feasibility-pr107948.c @@ -0,0 +1,49 @@ +#include "analyzer-decls.h" + +void foo(int width) { + int i = 0; + int base; + if (width > 0){ + __analyzer_eval(i == 0); /* { dg-warning "TRUE" } */ + __analyzer_eval(width > 0); /* { dg-warning "TRUE" } */ + __analyzer_eval(width - i > 0); /* { dg-warning "TRUE" } */ + __analyzer_eval(i - width <= 0); /* { dg-warning "TRUE" } */ + if (i - width <= 0) { + base = 512; + } + else { + __analyzer_dump_path (); /* { dg-bogus "path" } */ + } + base+=1; /* { dg-bogus "uninit" } */ + } +} + +void test_ge_zero (int x) +{ + if (x >= 0) + { + __analyzer_eval(x >= 0); /* { dg-warning "TRUE" } */ + __analyzer_eval(x > 0); /* { dg-warning "UNKNOWN" } */ + __analyzer_eval(x <= 0); /* { dg-warning "UNKNOWN" } */ + __analyzer_eval(x < 0); /* { dg-warning "FALSE" } */ + __analyzer_eval(-x <= 0); /* { dg-warning "TRUE" } */ + __analyzer_eval(-x < 0); /* { dg-warning "UNKNOWN" } */ + __analyzer_eval(-x >= 0); /* { dg-warning "UNKNOWN" } */ + __analyzer_eval(-x > 0); /* { dg-warning "FALSE" } */ + } +} + +void test_gt_zero (int x) +{ + if (x > 0) + { + __analyzer_eval(x >= 0); /* { dg-warning "TRUE" } */ + __analyzer_eval(x > 0); /* { dg-warning "TRUE" } */ + __analyzer_eval(x <= 0); /* { dg-warning "FALSE" } */ + __analyzer_eval(x < 0); /* { dg-warning "FALSE" } */ + __analyzer_eval(-x <= 0); /* { dg-warning "TRUE" } */ + __analyzer_eval(-x < 0); /* { dg-warning "TRUE" } */ + __analyzer_eval(-x >= 0); /* { dg-warning "FALSE" } */ + __analyzer_eval(-x > 0); /* { dg-warning "FALSE" } */ + } +} diff --git a/gcc/testsuite/c-c++-common/analyzer/ferror-1.c b/gcc/testsuite/c-c++-common/analyzer/ferror-1.c new file mode 100644 index 0000000..2570f08 --- /dev/null +++ b/gcc/testsuite/c-c++-common/analyzer/ferror-1.c @@ -0,0 +1,6 @@ +#include + +int test_pass_through (FILE *stream) +{ + return ferror (stream); +} diff --git a/gcc/testsuite/c-c++-common/analyzer/fibonacci.c b/gcc/testsuite/c-c++-common/analyzer/fibonacci.c new file mode 100644 index 0000000..5d4a4e0 --- /dev/null +++ b/gcc/testsuite/c-c++-common/analyzer/fibonacci.c @@ -0,0 +1,9 @@ +int fib (int n) +{ + if (n > 1) + return fib (n - 1) + fib (n - 2); + else + return n; +} + +/* { dg-regexp "\[^\n\r\]+: warning: analysis bailed out early \\(\[0-9\]+ 'after-snode' enodes; \[0-9\]+ enodes\\) \[^\n\r\]*" } */ diff --git a/gcc/testsuite/c-c++-common/analyzer/file-1.c b/gcc/testsuite/c-c++-common/analyzer/file-1.c new file mode 100644 index 0000000..316cbb3 --- /dev/null +++ b/gcc/testsuite/c-c++-common/analyzer/file-1.c @@ -0,0 +1,64 @@ +typedef struct FILE FILE; + +FILE* fopen (const char*, const char*); +int fclose (FILE*); +#define SEEK_SET 0 +int fseek (FILE *, long int, int); + +void +test_1 (const char *path) +{ + FILE *f = fopen (path, "r"); /* { dg-message "opened here" } */ + if (!f) + return; + + fclose (f); /* { dg-message "\\(4\\) \\.\\.\\.to here" "to here" } */ + /* { dg-message "\\(5\\) first 'fclose' here" "first fclose" { target *-*-* } .-1 } */ + fclose (f); /* { dg-warning "double 'fclose' of FILE 'f' \\\[CWE-1341\\\]" "warning" } */ + /* { dg-message "second 'fclose' here; first 'fclose' was at \\(5\\)" "second fclose" { target *-*-* } .-1 } */ +} + +/* Swallow -Wuse-after-free issued for the same problem + { dg-prune-output "-Wuse-after-free" } */ + +void +test_2 (const char *src, const char *dst) +{ + FILE *f_in = fopen (src, "r"); /* { dg-message "\\(1\\) opened here" } */ + if (!f_in) + return; + + FILE *f_out = fopen (src, "w"); + if (!f_out) + return; /* { dg-warning "leak of FILE 'f_in'" "warning" } */ + /* { dg-message "\\(7\\) 'f_in' leaks here; was opened at \\(1\\)" "event" { target *-*-* } .-1 } */ + + fclose (f_out); + fclose (f_in); +} + +void +test_3 (const char *path) +{ + FILE *f = fopen (path, "r"); /* { dg-message "opened here" } */ + return; /* { dg-warning "leak of FILE 'f'" } */ +} + +void +test_4 (const char *path) +{ + FILE *f = fopen (path, "r"); /* { dg-message "opened here" } */ + + /* Ensure we know about common fns that are known to not close the + file (e.g. "fseek"). */ + fseek (f, 1024, SEEK_SET); + + return; /* { dg-warning "leak of FILE 'f'" } */ +} + +void +test_5 (const char *path) +{ + FILE *f = fopen (path, "r"); /* { dg-message "opened here" } */ + return; /* { dg-warning "leak of FILE 'f'" } */ +} diff --git a/gcc/testsuite/c-c++-common/analyzer/file-3.c b/gcc/testsuite/c-c++-common/analyzer/file-3.c new file mode 100644 index 0000000..8f93a98 --- /dev/null +++ b/gcc/testsuite/c-c++-common/analyzer/file-3.c @@ -0,0 +1,18 @@ +typedef struct _IO_FILE FILE; +extern struct _IO_FILE *stderr; + +extern FILE *fopen (const char *__restrict __filename, + const char *__restrict __modes); +extern int _IO_getc (FILE *stream); + +void +test_1 (const char *path) +{ + FILE *f = fopen (path, "r"); /* { dg-message "opened here" } */ + + /* Implementation of getc in glibc < 2.28. + Verify that we know that this doesn't close the file. */ + _IO_getc (f); + + return; /* { dg-warning "leak of FILE 'f'" } */ +} diff --git a/gcc/testsuite/c-c++-common/analyzer/file-meaning-1.c b/gcc/testsuite/c-c++-common/analyzer/file-meaning-1.c new file mode 100644 index 0000000..66b72a7 --- /dev/null +++ b/gcc/testsuite/c-c++-common/analyzer/file-meaning-1.c @@ -0,0 +1,15 @@ +/* { dg-additional-options "-fanalyzer-verbose-state-changes" } */ + +typedef struct FILE FILE; +FILE* fopen (const char*, const char*); +int fclose (FILE*); + +void test_1 (const char *path) +{ + FILE *f = fopen (path, "r"); /* { dg-message "meaning: \\{verb: 'acquire', noun: 'resource'\\}" } */ + if (!f) + return; + + fclose (f); /* { dg-message "meaning: \\{verb: 'release', noun: 'resource'\\}" } */ + fclose (f); /* { dg-warning "double 'fclose' of FILE 'f'" "warning" } */ +} diff --git a/gcc/testsuite/c-c++-common/analyzer/malloc-ipa-10.c b/gcc/testsuite/c-c++-common/analyzer/malloc-ipa-10.c new file mode 100644 index 0000000..f3a5be5 --- /dev/null +++ b/gcc/testsuite/c-c++-common/analyzer/malloc-ipa-10.c @@ -0,0 +1,32 @@ +#include + +void +calls_free (void *victim) /* { dg-message "\\(3\\) entry to 'calls_free'" "event 3" } */ +/* { dg-message "\\(7\\) entry to 'calls_free'" "event 7" { target *-*-* } .-1 } */ +{ + free (victim); /* { dg-warning "double-'free' of 'victim'" "warning" } */ + /* { dg-message "\\(4\\) first 'free' here" "event 4" { target *-*-* } .-1 } */ + /* { dg-message "\\(8\\) second 'free' here; first 'free' was at \\(4\\)" "event 8" { target *-*-* } .-2 } */ + + /* TODO: would this be better emitted at the callsite, + for such a simple wrapper? */ +} + +void do_stuff (void) +{ + /* Empty. Irrelevant, and thus should not be expanded into in paths. */ +} + +void test (void *ptr) /* { dg-message "\\(1\\) entry to 'test'" } */ +{ + do_stuff (); + + calls_free (ptr); /* { dg-message "\\(2\\) calling 'calls_free' from 'test'" "event 2" } */ + /* { dg-message "\\(5\\) returning to 'test' from 'calls_free'" "event 5" { target *-*-* } .-1 } */ + + do_stuff (); + + calls_free (ptr); /* { dg-message "\\(6\\) passing freed pointer 'ptr' in call to 'calls_free' from 'test'" } */ + + do_stuff (); +} diff --git a/gcc/testsuite/c-c++-common/analyzer/malloc-ipa-12.c b/gcc/testsuite/c-c++-common/analyzer/malloc-ipa-12.c new file mode 100644 index 0000000..3813c9a --- /dev/null +++ b/gcc/testsuite/c-c++-common/analyzer/malloc-ipa-12.c @@ -0,0 +1,7 @@ +#include + +void recursive_free (void *ptr) +{ + free (ptr); /* { dg-warning "double-'free' of 'ptr'" } */ + recursive_free (ptr); /* { dg-warning "infinite recursion" } */ +} diff --git a/gcc/testsuite/c-c++-common/analyzer/malloc-ipa-13a.c b/gcc/testsuite/c-c++-common/analyzer/malloc-ipa-13a.c new file mode 100644 index 0000000..d74ef59 --- /dev/null +++ b/gcc/testsuite/c-c++-common/analyzer/malloc-ipa-13a.c @@ -0,0 +1,38 @@ +/* { dg-additional-options "-fanalyzer-verbosity=1" } */ + +#include + +void +calls_free (void *victim) +{ + free (victim); /* { dg-warning "double-'free' of 'victim'" } */ +} + +extern void do_stuff (void); + +struct foo +{ + void *m_p; +}; + +static void * __attribute__((noinline)) +test_a (struct foo f) +{ + do_stuff (); + + calls_free (f.m_p); + + do_stuff (); + + return f.m_p; +} + +void test_b (void *p) +{ + void *q; + struct foo f; + f.m_p = p; + q = test_a (f); + calls_free (q); /* { dg-message "passing freed pointer 'q' in call to 'calls_free' from 'test_b'" } */ + do_stuff (); +} diff --git a/gcc/testsuite/c-c++-common/analyzer/malloc-ipa-9.c b/gcc/testsuite/c-c++-common/analyzer/malloc-ipa-9.c new file mode 100644 index 0000000..a0c78fd --- /dev/null +++ b/gcc/testsuite/c-c++-common/analyzer/malloc-ipa-9.c @@ -0,0 +1,18 @@ +/* { dg-additional-options "-fdiagnostics-path-format=none -fanalyzer-verbosity=1" } */ + +#include + +void +two_frees (void *p, void *q) +{ + free (p); + free (q); /* { dg-warning "double-'free' of 'q'" } */ + /* TODO: could be useful to identify that p == q when called from 'test'. */ +} + +extern void do_stuff (void); + +void test (void *ptr) +{ + two_frees (ptr, ptr); +} diff --git a/gcc/testsuite/c-c++-common/analyzer/malloc-many-paths-1.c b/gcc/testsuite/c-c++-common/analyzer/malloc-many-paths-1.c new file mode 100644 index 0000000..82ad547 --- /dev/null +++ b/gcc/testsuite/c-c++-common/analyzer/malloc-many-paths-1.c @@ -0,0 +1,14 @@ +#include + +/* Ensure that we don't need to laboriously walk every path to get + to the end of the function. */ + +int test_1 (int n) +{ + int i, j, k; + k = 0; + for (int i = 0; i < n; i++) + for (int j = 0; j < 1000; j++) + k++; + return k; +} diff --git a/gcc/testsuite/c-c++-common/analyzer/malloc-many-paths-3.c b/gcc/testsuite/c-c++-common/analyzer/malloc-many-paths-3.c new file mode 100644 index 0000000..e5d27a4 --- /dev/null +++ b/gcc/testsuite/c-c++-common/analyzer/malloc-many-paths-3.c @@ -0,0 +1,36 @@ +#include + +extern int foo (void); + +int successes; +int failures; + +#define ONE_DIAMOND \ + do { \ + void *ptr = malloc (128); \ + if (foo ()) \ + successes++; \ + else \ + failures++; \ + free (ptr); \ + } while (0) + +#define TEN_DIAMONDS \ + do { \ + ONE_DIAMOND; ONE_DIAMOND; ONE_DIAMOND; ONE_DIAMOND; ONE_DIAMOND; \ + ONE_DIAMOND; ONE_DIAMOND; ONE_DIAMOND; ONE_DIAMOND; ONE_DIAMOND; \ + } while (0) + +void test_3 (void *ptr) +{ + free (ptr); +#if 1 + ONE_DIAMOND; +#else + /* TODO: enabling this leads to numerous duplicated reports, + all of them detailing all the extraneous info about the malloc/free + within the diamonds. */ + TEN_DIAMONDS; +#endif + free (ptr); /* { dg-warning "double-'free' of 'ptr'" } */ +} diff --git a/gcc/testsuite/c-c++-common/analyzer/malloc-meaning-1.c b/gcc/testsuite/c-c++-common/analyzer/malloc-meaning-1.c new file mode 100644 index 0000000..4964e25 --- /dev/null +++ b/gcc/testsuite/c-c++-common/analyzer/malloc-meaning-1.c @@ -0,0 +1,10 @@ +/* { dg-additional-options "-fanalyzer-verbose-state-changes" } */ + +#include + +void test_1 (void) +{ + void *ptr = malloc (1024); /* { dg-message "meaning: \\{verb: 'acquire', noun: 'memory'\\}" } */ + free (ptr); /* { dg-message "meaning: \\{verb: 'release', noun: 'memory'\\}" } */ + free (ptr); /* { dg-warning "double-'free' of 'ptr'" } */ +} diff --git a/gcc/testsuite/c-c++-common/analyzer/malloc-paths-1.c b/gcc/testsuite/c-c++-common/analyzer/malloc-paths-1.c new file mode 100644 index 0000000..0436928 --- /dev/null +++ b/gcc/testsuite/c-c++-common/analyzer/malloc-paths-1.c @@ -0,0 +1,15 @@ +/* Verify that we emit sane paths for state machine errors. */ + +#include + +void test_1 (void) +{ + void *ptr = malloc (1024); /* { dg-line malloc } */ + free (ptr); /* { dg-line first_free } */ + free (ptr); /* { dg-line second_free } */ + + /* { dg-warning "double-'free' of 'ptr'" "warning" { target *-*-* } second_free } */ + /* { dg-message "\\(1\\) allocated here" "event 1" { target *-*-* } malloc } */ + /* { dg-message "\\(2\\) first 'free' here" "event 2" { target *-*-* } first_free } */ + /* { dg-message "\\(3\\) second 'free' here; first 'free' was at \\(2\\)" "event 3" { target *-*-* } second_free } */ +} diff --git a/gcc/testsuite/c-c++-common/analyzer/malloc-paths-2.c b/gcc/testsuite/c-c++-common/analyzer/malloc-paths-2.c new file mode 100644 index 0000000..27098da --- /dev/null +++ b/gcc/testsuite/c-c++-common/analyzer/malloc-paths-2.c @@ -0,0 +1,13 @@ +/* Verify that we emit sane paths for state machine errors. */ + +#include + +void test_2 (void *ptr) +{ + free (ptr); /* { dg-line first_free } */ + free (ptr); /* { dg-line second_free } */ + + /* { dg-warning "double-'free' of 'ptr'" "warning" { target *-*-* } second_free } */ + /* { dg-message "\\(1\\) first 'free' here" "event 1" { target *-*-* } first_free } */ + /* { dg-message "\\(2\\) second 'free' here; first 'free' was at \\(1\\)" "event 2" { target *-*-* } second_free } */ +} diff --git a/gcc/testsuite/c-c++-common/analyzer/malloc-paths-3.c b/gcc/testsuite/c-c++-common/analyzer/malloc-paths-3.c new file mode 100644 index 0000000..8f9e4cf --- /dev/null +++ b/gcc/testsuite/c-c++-common/analyzer/malloc-paths-3.c @@ -0,0 +1,14 @@ +/* Verify that we emit sane paths for state machine errors. */ + +#include + +int *test_3 (void) +{ + int *ptr = (int *)malloc (sizeof (int)); /* { dg-line malloc } */ + *ptr = 42; /* { dg-line unchecked_deref } */ + return ptr; + + /* { dg-warning "dereference of possibly-NULL 'ptr'" "warning" { target *-*-* } unchecked_deref } */ + /* { dg-message "\\(1\\) this call could return NULL" "event 1" { target *-*-* } malloc } */ + /* { dg-message "\\(2\\) 'ptr' could be NULL" "event 2" { target *-*-* } unchecked_deref } */ +} diff --git a/gcc/testsuite/c-c++-common/analyzer/malloc-paths-4.c b/gcc/testsuite/c-c++-common/analyzer/malloc-paths-4.c new file mode 100644 index 0000000..7b7803e --- /dev/null +++ b/gcc/testsuite/c-c++-common/analyzer/malloc-paths-4.c @@ -0,0 +1,20 @@ +/* Verify that we emit sane paths for state machine errors. */ + +#include + +int *test_4 (void) +{ + int *ptr = (int *)malloc (sizeof (int)); /* { dg-line malloc } */ + if (ptr) /* { dg-line cond } */ + *ptr = 42; + else + *ptr = 43; /* { dg-line on_null_ptr } */ + return ptr; + + /* { dg-warning "dereference of NULL 'ptr'" "warning" { target *-*-* } on_null_ptr } */ + /* { dg-message "\\(1\\) allocated here" "event 1" { target *-*-* } malloc } */ + /* { dg-message "\\(2\\) assuming 'ptr' is NULL" "event 2" { target *-*-* } cond } */ + /* { dg-message "\\(3\\) following 'false' branch \\(when 'ptr' is NULL\\)\\.\\.\\." "event 3" { target *-*-* } cond } */ + /* { dg-message "\\(4\\) \\.\\.\\.to here" "event 4" { target *-*-* } on_null_ptr } */ + /* { dg-message "\\(5\\) dereference of NULL 'ptr'" "event 5" { target *-*-* } on_null_ptr } */ +} diff --git a/gcc/testsuite/c-c++-common/analyzer/malloc-paths-5.c b/gcc/testsuite/c-c++-common/analyzer/malloc-paths-5.c new file mode 100644 index 0000000..ca8d22b --- /dev/null +++ b/gcc/testsuite/c-c++-common/analyzer/malloc-paths-5.c @@ -0,0 +1,43 @@ +#include +#include + +extern void do_stuff (void); + +int test (const char *filename, int flag) +{ + FILE *f; + int *p, *q; + int i; + + p = (int *)malloc (sizeof (int)); /* { dg-line malloc_of_p } */ + if (!p) /* { dg-line test_of_p } */ + { + free (p); + return -1; + } + + q = (int *)malloc (sizeof (int)); /* { dg-line malloc_of_q } */ + if (!q) /* { dg-line test_of_q } */ + { + free (p); /* { dg-line first_free_of_p } */ + /* oops: forgot the "return" here, so it falls through. */ + } + + do_stuff (); + + free (p); /* { dg-line second_free_of_p } */ + free (q); + return 0; + + /* { dg-warning "double-'free' of 'p'" "warning" { target *-*-* } second_free_of_p } */ + /* { dg-message "\\(1\\) allocated here" "event 1" { target *-*-* } malloc_of_p } */ + /* { dg-message "\\(2\\) assuming 'p' is non-NULL" "event 2" { target *-*-* } test_of_p } */ + /* { dg-message "\\(3\\) following 'false' branch \\(when 'p' is non-NULL\\)\\.\\.\\." "event 3" { target *-*-* } test_of_p } */ + /* { dg-message "\\(4\\) \\.\\.\\.to here" "event 4" { target *-*-* } malloc_of_q } */ + /* { dg-message "\\(5\\) following 'true' branch \\(when 'q' is NULL\\)\\.\\.\\." "event 5" { target *-*-* } test_of_q } */ + /* { dg-message "\\(6\\) \\.\\.\\.to here" "event 6" { target *-*-* } first_free_of_p } */ + /* { dg-message "\\(7\\) first 'free' here" "event 7" { target *-*-* } first_free_of_p } */ + /* { dg-message "\\(8\\) second 'free' here; first 'free' was at \\(7\\)" "event 8" { target *-*-* } second_free_of_p } */ + + /* We don't care about the state changes to q. */ +} diff --git a/gcc/testsuite/c-c++-common/analyzer/malloc-paths-6.c b/gcc/testsuite/c-c++-common/analyzer/malloc-paths-6.c new file mode 100644 index 0000000..1df6964 --- /dev/null +++ b/gcc/testsuite/c-c++-common/analyzer/malloc-paths-6.c @@ -0,0 +1,11 @@ +#include + +void test (void *ptr) +{ + void *q; + q = ptr; + free (ptr); + free (q); /* { dg-warning "double-'free' of 'q'" } */ + /* The above case requires us to handle equivalence classes in + state transitions. */ +} diff --git a/gcc/testsuite/c-c++-common/analyzer/malloc-paths-7.c b/gcc/testsuite/c-c++-common/analyzer/malloc-paths-7.c new file mode 100644 index 0000000..f6b99e3 --- /dev/null +++ b/gcc/testsuite/c-c++-common/analyzer/malloc-paths-7.c @@ -0,0 +1,21 @@ +#include + +extern int foo (void); +extern int bar (void); + +void test (void) +{ + void *p = malloc (1024); /* { dg-message "\\(1\\) allocated here" } */ + void *q = malloc (1024); + + foo (); + if (!q) /* { dg-message "\\(2\\) following 'true' branch \\(when 'q' is NULL\\)\\.\\.\\." } */ + { + free (q); /* { dg-message "\\(3\\) \\.\\.\\.to here" } */ + return; /* { dg-warning "leak of 'p'" "warning" } */ + /* { dg-message "\\(4\\) 'p' leaks here; was allocated at \\(1\\)" "event" { target *-*-* } .-1 } */ + } + bar (); + free (q); + free (p); +} diff --git a/gcc/testsuite/c-c++-common/analyzer/malloc-paths-8.c b/gcc/testsuite/c-c++-common/analyzer/malloc-paths-8.c new file mode 100644 index 0000000..4988f53 --- /dev/null +++ b/gcc/testsuite/c-c++-common/analyzer/malloc-paths-8.c @@ -0,0 +1,55 @@ +/* { dg-additional-options "-fanalyzer-transitivity" } */ +/* { dg-require-effective-target alloca } */ + +#include +#include + +extern void do_stuff (const void *); + +#define LIMIT 1024 + +void test_1 (size_t sz) +{ + void *ptr; + if (sz >= LIMIT) + ptr = malloc (sz); + else + ptr = __builtin_alloca (sz); + + do_stuff (ptr); + + if (sz >= LIMIT) + free (ptr); +} + +void test_2 (size_t sz) +{ + void *ptr; + if (sz < LIMIT) + ptr = __builtin_alloca (sz); + else + ptr = malloc (sz); + + do_stuff (ptr); + + if (sz >= LIMIT) + free (ptr); +} + +void test_3 (size_t sz) +{ + void *ptr; + if (sz <= LIMIT) + ptr = __builtin_alloca (sz); /* { dg-message "region created on stack here" } */ + else + ptr = malloc (sz); + + do_stuff (ptr); + + /* Bug: the "sz <= LIMIT" above should have been "sz < LIMIT", + so there's a free-of-alloca when sz == LIMIT. */ + if (sz >= LIMIT) + free (ptr); /* { dg-warning "'free' of 'ptr' which points to memory on the stack" } */ +} +/* { dg-bogus "leak of 'ptr'" } */ +/* This can't happen, as "sz > 1024" && "sz <= 1023" is impossible. */ diff --git a/gcc/testsuite/c-c++-common/analyzer/malloc-sarif-1.c b/gcc/testsuite/c-c++-common/analyzer/malloc-sarif-1.c new file mode 100644 index 0000000..19ac89f --- /dev/null +++ b/gcc/testsuite/c-c++-common/analyzer/malloc-sarif-1.c @@ -0,0 +1,22 @@ +/* { dg-do compile } */ +/* { dg-additional-options " -fno-diagnostics-json-formatting -fdiagnostics-format=sarif-file" } */ + +#include + +void test_1 (void) +{ + void *ptr = malloc (1024); + free (ptr); + free (ptr); +} + +/* Verify SARIF output. + + { dg-final { verify-sarif-file } } + + The threadFlowLocation objects should have "kinds" properties + reflecting the meanings of the events: + { dg-final { scan-sarif-file "\"kinds\": \\\[\"acquire\", \"memory\"\\\]" } } + { dg-final { scan-sarif-file "\"kinds\": \\\[\"release\", \"memory\"\\\]" } } + { dg-final { scan-sarif-file "\"kinds\": \\\[\"danger\"\\\]" } } +*/ diff --git a/gcc/testsuite/c-c++-common/analyzer/malloc-vs-local-1a.c b/gcc/testsuite/c-c++-common/analyzer/malloc-vs-local-1a.c new file mode 100644 index 0000000..bf77862 --- /dev/null +++ b/gcc/testsuite/c-c++-common/analyzer/malloc-vs-local-1a.c @@ -0,0 +1,179 @@ +/* { dg-additional-options "-fno-analyzer-call-summaries -fanalyzer-transitivity" } */ + +#include +#include "analyzer-decls.h" + +extern int foo (int); + +static int __attribute__((noinline)) +do_stuff (int *p, int n) +{ + int sum = 0; + int i; + for (i = 0; i < n; i++) + p[i] = i; /* { dg-warning "dereference of possibly-NULL 'p'" } */ + for (i = 0; i < n; i++) + sum += foo (p[i]); /* { dg-bogus "uninitialized" } */ + return sum; +} + +static int __attribute__((noinline)) +do_stuff_2 (int *p, int n) +{ + return 0; +} + +/* Various examples of functions that use either a malloc buffer + or a local buffer, do something, then conditionally free the + buffer, tracking whether "free" is necessary in various + ways. + + In each case, there ought to be only two paths through the function, + not four. */ + +/* Repeated (n > 10) predicate. */ + +int test_repeated_predicate_1 (int n) +{ + int buf[10]; + int *ptr; + int result; + + if (n > 10) + ptr = (int *)malloc (sizeof (int) * n); + else + ptr = buf; + + __analyzer_dump_exploded_nodes (0); /* { dg-warning "2 processed enodes" } */ + + result = do_stuff (ptr, n); + + __analyzer_dump_exploded_nodes (0); /* { dg-warning "2 processed enodes" } */ + + __analyzer_dump_exploded_nodes (0); /* { dg-warning "2 processed enodes" } */ + + + if (n > 10) + free (ptr); /* { dg-bogus "not on the heap" } */ + + return result; /* { dg-bogus "leak" } */ +} + +/* A simpler version of the above. */ + +int test_repeated_predicate_2 (int n) +{ + int buf[10]; + int *ptr; + int result; + + if (n > 10) + ptr = (int *)malloc (sizeof (int) * n); + else + ptr = buf; + + __analyzer_dump_exploded_nodes (0); /* { dg-warning "2 processed enodes" } */ + + result = do_stuff_2 (ptr, n); + + __analyzer_dump_exploded_nodes (0); /* { dg-warning "2 processed enodes" } */ + + if (n > 10) + free (ptr); /* { dg-bogus "not on the heap" } */ + + return result; /* { dg-bogus "leak" } */ +} + +/* A predicate that sets a flag for the 2nd test. */ + +int test_explicit_flag (int n) +{ + int buf[10]; + int *ptr; + int result; + int need_to_free = 0; + + if (n > 10) + { + ptr = (int *)malloc (sizeof (int) * n); + need_to_free = 1; + } + else + ptr = buf; + + __analyzer_dump_exploded_nodes (0); /* { dg-warning "2 processed enodes" } */ + + result = do_stuff (ptr, n); + + __analyzer_dump_exploded_nodes (0); /* { dg-warning "2 processed enodes" } */ + + + if (need_to_free) + free (ptr); /* { dg-bogus "not on the heap" } */ + + return result; /* { dg-bogus "leak" } */ +} + +/* Pointer comparison. */ + +int test_pointer_comparison (int n) +{ + int buf[10]; + int *ptr; + int result; + + if (n > 10) + ptr = (int *)malloc (sizeof (int) * n); + else + ptr = buf; + + __analyzer_dump_exploded_nodes (0); /* { dg-warning "2 processed enodes" } */ + + result = do_stuff (ptr, n); + + __analyzer_dump_exploded_nodes (0); /* { dg-warning "2 processed enodes" } */ + + + if (ptr != buf) + free (ptr); /* { dg-bogus "not on the heap" } */ + + return result; /* { dg-bogus "leak" } */ +} + +/* Set a flag based on a conditional, then use it, then reuse the + conditional. */ + +int test_initial_flag (int n) +{ + int buf[10]; + int *ptr; + int result; + int on_heap = 0; + + if (n > 10) + on_heap = 1; + else + on_heap = 0; + + /* Due to state-merging, we lose the relationship between 'n > 10' + and 'on_heap' here; we have to rely on feasibility-checking + in the diagnostic_manager to reject the false warnings. */ + __analyzer_dump_exploded_nodes (0); /* { dg-warning "1 processed enode" } */ + + if (on_heap) + ptr = (int *)malloc (sizeof (int) * n); + else + ptr = buf; + + __analyzer_dump_exploded_nodes (0); /* { dg-warning "2 processed enodes" } */ + + result = do_stuff (ptr, n); + + __analyzer_dump_exploded_nodes (0); /* { dg-warning "3 processed enodes" } */ + // FIXME: why 3 here? + + if (n > 10) + free (ptr); /* { dg-bogus "not on the heap" } */ + + return result; /* { dg-bogus "leak" } */ +} diff --git a/gcc/testsuite/c-c++-common/analyzer/malloc-vs-local-1b.c b/gcc/testsuite/c-c++-common/analyzer/malloc-vs-local-1b.c new file mode 100644 index 0000000..a30b8c0 --- /dev/null +++ b/gcc/testsuite/c-c++-common/analyzer/malloc-vs-local-1b.c @@ -0,0 +1,173 @@ +/* { dg-additional-options "-fanalyzer-call-summaries" } */ + +#include +#include "analyzer-decls.h" + +extern int foo (int); + +static int __attribute__((noinline)) +do_stuff (int *p, int n) +{ + int sum = 0; + int i; + for (i = 0; i < n; i++) + p[i] = i; + for (i = 0; i < n; i++) + sum += foo (p[i]); /* { dg-bogus "uninitialized" } */ + return sum; +} + +static int __attribute__((noinline)) +do_stuff_2 (int *p, int n) +{ + return 0; +} + +/* Various examples of functions that use either a malloc buffer + or a local buffer, do something, then conditionally free the + buffer, tracking whether "free" is necessary in various + ways. + + In each case, there ought to be only two paths through the function, + not four. */ + +/* Repeated (n > 10) predicate. */ + +int test_repeated_predicate_1 (int n) +{ + int buf[10]; + int *ptr; + int result; + + if (n > 10) + ptr = (int *)malloc (sizeof (int) * n); + else + ptr = buf; + + __analyzer_dump_exploded_nodes (0); /* { dg-warning "2 processed enodes" } */ + + result = do_stuff (ptr, n); + + __analyzer_dump_exploded_nodes (0); /* { dg-warning "2 processed enodes" } */ + + if (n > 10) + free (ptr); /* { dg-bogus "not on the heap" } */ + + return result; /* { dg-bogus "leak" } */ +} + +/* A simpler version of the above. */ + +int test_repeated_predicate_2 (int n) +{ + int buf[10]; + int *ptr; + int result; + + if (n > 10) + ptr = (int *)malloc (sizeof (int) * n); + else + ptr = buf; + + __analyzer_dump_exploded_nodes (0); /* { dg-warning "2 processed enodes" } */ + + result = do_stuff_2 (ptr, n); + + __analyzer_dump_exploded_nodes (0); /* { dg-warning "2 processed enodes" } */ + + if (n > 10) + free (ptr); /* { dg-bogus "not on the heap" } */ + + return result; /* { dg-bogus "leak" } */ +} + +/* A predicate that sets a flag for the 2nd test. */ + +int test_explicit_flag (int n) +{ + int buf[10]; + int *ptr; + int result; + int need_to_free = 0; + + if (n > 10) + { + ptr = (int *)malloc (sizeof (int) * n); + need_to_free = 1; + } + else + ptr = buf; + + __analyzer_dump_exploded_nodes (0); /* { dg-warning "2 processed enodes" } */ + + result = do_stuff (ptr, n); + + __analyzer_dump_exploded_nodes (0); /* { dg-warning "2 processed enodes" } */ + + if (need_to_free) + free (ptr); /* { dg-bogus "not on the heap" } */ + + return result; /* { dg-bogus "leak" } */ +} + +/* Pointer comparison. */ + +int test_pointer_comparison (int n) +{ + int buf[10]; + int *ptr; + int result; + + if (n > 10) + ptr = (int *)malloc (sizeof (int) * n); + else + ptr = buf; + + __analyzer_dump_exploded_nodes (0); /* { dg-warning "2 processed enodes" } */ + + result = do_stuff (ptr, n); + + __analyzer_dump_exploded_nodes (0); /* { dg-warning "2 processed enodes" } */ + + if (ptr != buf) + free (ptr); /* { dg-bogus "not on the heap" } */ + + return result; /* { dg-bogus "leak" } */ +} + +/* Set a flag based on a conditional, then use it, then reuse the + conditional. */ + +int test_initial_flag (int n) +{ + int buf[10]; + int *ptr; + int result; + int on_heap = 0; + + if (n > 10) + on_heap = 1; + else + on_heap = 0; + + /* Due to state-merging, we lose the relationship between 'n > 10' + and 'on_heap' here; we have to rely on feasibility-checking + in the diagnostic_manager to reject the false warnings. */ + __analyzer_dump_exploded_nodes (0); /* { dg-warning "1 processed enode" } */ + + if (on_heap) + ptr = (int *)malloc (sizeof (int) * n); + else + ptr = buf; + + __analyzer_dump_exploded_nodes (0); /* { dg-warning "2 processed enodes" } */ + + result = do_stuff (ptr, n); + + __analyzer_dump_exploded_nodes (0); /* { dg-warning "2 processed enodes" } */ + + if (n > 10) + free (ptr); /* { dg-bogus "not on the heap" } */ + + return result; /* { dg-bogus "leak" } */ +} diff --git a/gcc/testsuite/c-c++-common/analyzer/malloc-vs-local-2.c b/gcc/testsuite/c-c++-common/analyzer/malloc-vs-local-2.c new file mode 100644 index 0000000..9001fe6 --- /dev/null +++ b/gcc/testsuite/c-c++-common/analyzer/malloc-vs-local-2.c @@ -0,0 +1,175 @@ +#include +#include "analyzer-decls.h" + +extern int foo (int); + +static int __attribute__((noinline)) +do_stuff_2 (int *p, int n) +{ + return 0; +} + +/* As malloc-vs-local.c, but hand-inlining the logic. */ + +/* Repeated (n > 10) predicate. */ + +int test_repeated_predicate_1 (int n) +{ + int buf[10]; + int *ptr; + int result; + + if (n > 10) + ptr = (int *)malloc (sizeof (int) * n); + else + ptr = buf; + + __analyzer_dump_exploded_nodes (0); /* { dg-warning "2 processed enodes" } */ + + { + int *p = ptr; + int sum = 0; + int i; + for (i = 0; i < n; i++) + p[i] = i; /* { dg-warning "dereference of possibly-NULL" } */ + for (i = 0; i < n; i++) + sum += foo (p[i]); /* { dg-bogus "uninitialized" } */ + result = sum; + } + + __analyzer_dump_exploded_nodes (0); /* { dg-warning "2 processed enodes" } */ + + if (n > 10) + free (ptr); /* { dg-bogus "not on the heap" } */ + + return result; /* { dg-bogus "leak" } */ +} + +/* As above, but with just one loop. */ + +int test_repeated_predicate_1a (int n) +{ + int buf[10]; + int *ptr; + int result; + + if (n > 10) + ptr = (int *)malloc (sizeof (int) * n); + else + ptr = buf; + + __analyzer_dump_exploded_nodes (0); /* { dg-warning "2 processed enodes" } */ + + { + int *p = ptr; + int sum = 0; + int i; + for (i = 0; i < n; i++) + p[i] = i; /* { dg-warning "dereference of possibly-NULL" } */ + result = sum; + } + + __analyzer_dump_exploded_nodes (0); /* { dg-warning "2 processed enodes" } */ + + if (n > 10) + free (ptr); /* { dg-bogus "not on the heap" } */ + + return result; /* { dg-bogus "leak" } */ +} + +/* A simpler version of the above. */ + +int test_repeated_predicate_2 (int n) +{ + int buf[10]; + int *ptr; + int result; + + if (n > 10) + ptr = (int *)malloc (sizeof (int) * n); + else + ptr = buf; + + __analyzer_dump_exploded_nodes (0); /* { dg-warning "2 processed enodes" } */ + + result = do_stuff_2 (ptr, n); + + __analyzer_dump_exploded_nodes (0); /* { dg-warning "2 processed enodes" } */ + + if (n > 10) + free (ptr); /* { dg-bogus "not on the heap" } */ + + return result; /* { dg-bogus "leak" } */ +} + +/* A predicate that sets a flag for the 2nd test. */ + +int test_explicit_flag (int n) +{ + int buf[10]; + int *ptr; + int result; + int need_to_free = 0; + + if (n > 10) + { + ptr = (int *)malloc (sizeof (int) * n); + need_to_free = 1; + } + else + ptr = buf; + + __analyzer_dump_exploded_nodes (0); /* { dg-warning "2 processed enodes" } */ + + { + int *p = ptr; + int sum = 0; + int i; + for (i = 0; i < n; i++) + p[i] = i; /* { dg-warning "dereference of possibly-NULL" } */ + for (i = 0; i < n; i++) + sum += foo (p[i]); /* { dg-bogus "uninitialized" } */ + result = sum; + } + + __analyzer_dump_exploded_nodes (0); /* { dg-warning "2 processed enodes" } */ + + if (need_to_free) + free (ptr); /* { dg-bogus "not on the heap" } */ + + return result; /* { dg-bogus "leak" } */ +} + +/* Pointer comparison. */ + +int test_pointer_comparison (int n) +{ + int buf[10]; + int *ptr; + int result; + + if (n > 10) + ptr = (int *)malloc (sizeof (int) * n); + else + ptr = buf; + + __analyzer_dump_exploded_nodes (0); /* { dg-warning "2 processed enodes" } */ + + { + int *p = ptr; + int sum = 0; + int i; + for (i = 0; i < n; i++) + p[i] = i; /* { dg-warning "dereference of possibly-NULL" } */ + for (i = 0; i < n; i++) + sum += foo (p[i]); /* { dg-bogus "uninitialized" } */ + result = sum; + } + + __analyzer_dump_exploded_nodes (0); /* { dg-warning "2 processed enodes" } */ + + if (ptr != buf) + free (ptr); /* { dg-bogus "not on the heap" } */ + + return result; /* { dg-bogus "leak" } */ +} diff --git a/gcc/testsuite/c-c++-common/analyzer/malloc-vs-local-3.c b/gcc/testsuite/c-c++-common/analyzer/malloc-vs-local-3.c new file mode 100644 index 0000000..0196389 --- /dev/null +++ b/gcc/testsuite/c-c++-common/analyzer/malloc-vs-local-3.c @@ -0,0 +1,64 @@ +#include +#include "analyzer-decls.h" + +extern int foo (int); + +static int __attribute__((noinline)) +do_stuff_2 (int *p, int n) +{ + return 0; +} + +/* As malloc-vs-local-2.c, but with a memory leak for the "on the heap case" + by not attempting to free at the end. */ + +int test_1 (int n) +{ + int buf[10]; + int *ptr; + int result; + + if (n > 10) + ptr = (int *)malloc (sizeof (int) * n); + else + ptr = buf; + + __analyzer_dump_exploded_nodes (0); /* { dg-warning "2 processed enodes" } */ + + { + int *p = ptr; + int sum = 0; + int i; + for (i = 0; i < n; i++) + p[i] = i; /* { dg-warning "dereference of possibly-NULL" } */ + for (i = 0; i < n; i++) + sum += foo (p[i]); /* { dg-bogus "uninitialized" } */ + result = sum; + } + + __analyzer_dump_exploded_nodes (0); /* { dg-warning "2 processed enodes" } */ + + return result; /* { dg-message "leak of 'p'|leak of 'ptr'" } */ +} + +/* A simpler version of the above. */ + +int test_2 (int n) +{ + int buf[10]; + int *ptr; + int result; + + if (n > 10) + ptr = (int *)malloc (sizeof (int) * n); + else + ptr = buf; + + __analyzer_dump_exploded_nodes (0); /* { dg-warning "2 processed enodes" } */ + + result = do_stuff_2 (ptr, n); + + __analyzer_dump_exploded_nodes (0); /* { dg-warning "2 processed enodes" } */ + + return result; /* { dg-message "leak of 'ptr'" } */ +} diff --git a/gcc/testsuite/c-c++-common/analyzer/many-disabled-diagnostics.c b/gcc/testsuite/c-c++-common/analyzer/many-disabled-diagnostics.c new file mode 100644 index 0000000..48d4023 --- /dev/null +++ b/gcc/testsuite/c-c++-common/analyzer/many-disabled-diagnostics.c @@ -0,0 +1,55 @@ +/* { dg-additional-options "-Wno-analyzer-double-free" } */ + +#define DOUBLE_FREE() \ + do { \ + void *p = __builtin_malloc (1024); \ + __builtin_free (p); \ + __builtin_free (p); \ + } while (0) + +#define DOUBLE_FREE_x_10() \ + do { \ + DOUBLE_FREE(); \ + DOUBLE_FREE(); \ + DOUBLE_FREE(); \ + DOUBLE_FREE(); \ + DOUBLE_FREE(); \ + DOUBLE_FREE(); \ + DOUBLE_FREE(); \ + DOUBLE_FREE(); \ + DOUBLE_FREE(); \ + DOUBLE_FREE(); \ + } while (0) + +#define DOUBLE_FREE_x_100() \ + do { \ + DOUBLE_FREE_x_10(); \ + DOUBLE_FREE_x_10(); \ + DOUBLE_FREE_x_10(); \ + DOUBLE_FREE_x_10(); \ + DOUBLE_FREE_x_10(); \ + DOUBLE_FREE_x_10(); \ + DOUBLE_FREE_x_10(); \ + DOUBLE_FREE_x_10(); \ + DOUBLE_FREE_x_10(); \ + DOUBLE_FREE_x_10(); \ + } while (0) + +#define DOUBLE_FREE_x_1000() \ + do { \ + DOUBLE_FREE_x_100(); \ + DOUBLE_FREE_x_100(); \ + DOUBLE_FREE_x_100(); \ + DOUBLE_FREE_x_100(); \ + DOUBLE_FREE_x_100(); \ + DOUBLE_FREE_x_100(); \ + DOUBLE_FREE_x_100(); \ + DOUBLE_FREE_x_100(); \ + DOUBLE_FREE_x_100(); \ + DOUBLE_FREE_x_100(); \ + } while (0) + +void test_1 (void) +{ + DOUBLE_FREE_x_1000 (); +} diff --git a/gcc/testsuite/c-c++-common/analyzer/many-unused-locals.c b/gcc/testsuite/c-c++-common/analyzer/many-unused-locals.c new file mode 100644 index 0000000..6b5c855 --- /dev/null +++ b/gcc/testsuite/c-c++-common/analyzer/many-unused-locals.c @@ -0,0 +1,69 @@ +struct st +{ + const char *m_filename; + int m_line; + const char *m_function; +}; + +extern void debug (struct st *); + +#define TEST_x_1(NAME) \ + do \ + { \ + static struct st NAME = { __FILE__, __LINE__, __func__ }; \ + debug (&NAME); \ + } \ + while (0) + +#define TEST_x_10(PREFIX) \ + do \ + { \ + TEST_x_1(PREFIX ## _1); \ + TEST_x_1(PREFIX ## _2); \ + TEST_x_1(PREFIX ## _3); \ + TEST_x_1(PREFIX ## _4); \ + TEST_x_1(PREFIX ## _5); \ + TEST_x_1(PREFIX ## _6); \ + TEST_x_1(PREFIX ## _7); \ + TEST_x_1(PREFIX ## _8); \ + TEST_x_1(PREFIX ## _9); \ + TEST_x_1(PREFIX ## _10); \ + } \ + while(0) + +#define TEST_x_100(PREFIX) \ + do \ + { \ + TEST_x_10(PREFIX ## _1); \ + TEST_x_10(PREFIX ## _2); \ + TEST_x_10(PREFIX ## _3); \ + TEST_x_10(PREFIX ## _4); \ + TEST_x_10(PREFIX ## _5); \ + TEST_x_10(PREFIX ## _6); \ + TEST_x_10(PREFIX ## _7); \ + TEST_x_10(PREFIX ## _8); \ + TEST_x_10(PREFIX ## _9); \ + TEST_x_10(PREFIX ## _10); \ + } \ + while(0) + +#define TEST_x_1000(PREFIX) \ + do \ + { \ + TEST_x_100(PREFIX ## _1); \ + TEST_x_100(PREFIX ## _2); \ + TEST_x_100(PREFIX ## _3); \ + TEST_x_100(PREFIX ## _4); \ + TEST_x_100(PREFIX ## _5); \ + TEST_x_100(PREFIX ## _6); \ + TEST_x_100(PREFIX ## _7); \ + TEST_x_100(PREFIX ## _8); \ + TEST_x_100(PREFIX ## _9); \ + TEST_x_100(PREFIX ## _10); \ + } \ + while(0) + +void test_many (void) +{ + TEST_x_1000(s); +} diff --git a/gcc/testsuite/c-c++-common/analyzer/memcpy-pr107882.c b/gcc/testsuite/c-c++-common/analyzer/memcpy-pr107882.c new file mode 100644 index 0000000..4ecb0fd --- /dev/null +++ b/gcc/testsuite/c-c++-common/analyzer/memcpy-pr107882.c @@ -0,0 +1,8 @@ +void +foo (int *x, int y) +{ + int *a = x, *b = (int *) &a; + + __builtin_memcpy (b + 1, x, y); + foo (a, 0); +} diff --git a/gcc/testsuite/c-c++-common/analyzer/memset-1.c b/gcc/testsuite/c-c++-common/analyzer/memset-1.c new file mode 100644 index 0000000..75aef53 --- /dev/null +++ b/gcc/testsuite/c-c++-common/analyzer/memset-1.c @@ -0,0 +1,203 @@ +#include +#include "analyzer-decls.h" + +/* Zero-fill of uninitialized buffer. */ + +void test_1 (void) +{ + char buf[256]; + void *p = memset (buf, 0, 256); + __analyzer_eval (buf[42] == 0); /* { dg-warning "TRUE" } */ + __analyzer_eval (p == buf); /* { dg-warning "TRUE" } */ +} + +/* As above, but with __builtin_memset. */ + +void test_1a (void) +{ + char buf[256]; + __builtin_memset (buf, 0, 256); + __analyzer_eval (buf[42] == 0); /* { dg-warning "TRUE" } */ +} + +/* Zero-fill of partially initialized buffer. */ + +void test_2 (void) +{ + char buf[256]; + buf[42] = 'A'; + __analyzer_eval (buf[42] == 'A'); /* { dg-warning "TRUE" } */ + memset (buf, 0, 256); + __analyzer_eval (buf[42] == '\0'); /* { dg-warning "TRUE" } */ +} + +/* A "memset" with known non-zero value. */ + +void test_3 (int val) +{ + char buf[256]; + memset (buf, 'A', 256); + __analyzer_eval (buf[42] == 'A'); /* { dg-warning "TRUE" } */ +} + +/* A "memset" with unknown value. */ + +void test_4 (char val) +{ + char buf[256]; + memset (buf, val, 256); + __analyzer_eval (buf[42] == (char)val); /* { dg-warning "TRUE" } */ +} + +/* A "memset" with unknown num bytes. */ + +void test_5 (int n) +{ + char buf[256]; + buf[42] = 'A'; + __analyzer_eval (buf[42] == 'A'); /* { dg-warning "TRUE" } */ + memset (buf, 0, n); + + /* We can't know if buf[42] was written to or not. */ + __analyzer_eval (buf[42] == 'A'); /* { dg-warning "UNKNOWN" } */ + __analyzer_eval (buf[42] == '\0'); /* { dg-warning "UNKNOWN" } */ +} + +/* As test_5, but with "__builtin___memset_chk". */ + +void test_5a (int n) +{ + char buf[256]; + buf[42] = 'A'; + __analyzer_eval (buf[42] == 'A'); /* { dg-warning "TRUE" } */ + __builtin___memset_chk (buf, 0, n, __builtin_object_size (buf, 0)); + + /* We can't know if buf[42] was written to or not. */ + __analyzer_eval (buf[42] == 'A'); /* { dg-warning "UNKNOWN" } */ + __analyzer_eval (buf[42] == '\0'); /* { dg-warning "UNKNOWN" } */ +} + +/* A "memset" with unknown value, but with zero size. */ + +static size_t __attribute__((noinline)) +get_zero (void) +{ + return 0; +} + +void test_6 (int val) +{ + char buf[256]; + buf[42] = 'A'; + memset (buf, 'B', get_zero ()); + __analyzer_eval (buf[42] == 'A'); /* { dg-warning "TRUE" } */ +} + +void test_6b (int val) +{ + char buf[256]; + memset (buf, 'A', sizeof (buf)); + memset (buf, 'B', get_zero ()); + __analyzer_eval (buf[42] == 'A'); /* { dg-warning "TRUE" } */ +} + +/* A "memset" of known size that's not the full buffer. */ + +void test_7 (void) +{ + char buf[256]; + buf[128] = 'A'; + memset (buf, 0, 128); + __analyzer_eval (buf[0] == '\0'); /* { dg-warning "TRUE" } */ + __analyzer_eval (buf[127] == '\0'); /* { dg-warning "TRUE" } */ + __analyzer_eval (buf[128] == 'A'); /* { dg-warning "TRUE" } */ +} + +void test_8 (void) +{ + char buf[20]; + memset (buf + 0, 0, 1); + memset (buf + 1, 1, 1); + memset (buf + 2, 2, 1); + memset (buf + 3, 3, 1); + memset (buf + 4, 4, 2); + memset (buf + 6, 6, 2); + memset (buf + 8, 8, 4); + memset (buf + 12, 12, 8); + __analyzer_eval (buf[0] == 0); /* { dg-warning "TRUE" } */ + __analyzer_eval (buf[1] == 1); /* { dg-warning "TRUE" } */ + __analyzer_eval (buf[2] == 2); /* { dg-warning "TRUE" } */ + __analyzer_eval (buf[3] == 3); /* { dg-warning "TRUE" } */ + __analyzer_eval (buf[4] == 4); /* { dg-warning "TRUE" } */ + __analyzer_eval (buf[5] == 4); /* { dg-warning "TRUE" } */ + __analyzer_eval (buf[6] == 6); /* { dg-warning "TRUE" } */ + __analyzer_eval (buf[7] == 6); /* { dg-warning "TRUE" } */ + __analyzer_eval (buf[8] == 8); /* { dg-warning "TRUE" } */ + __analyzer_eval (buf[9] == 8); /* { dg-warning "TRUE" } */ + __analyzer_eval (buf[10] == 8); /* { dg-warning "TRUE" } */ + __analyzer_eval (buf[11] == 8); /* { dg-warning "TRUE" } */ + __analyzer_eval (buf[12] == 12); /* { dg-warning "TRUE" } */ + __analyzer_eval (buf[13] == 12); /* { dg-warning "TRUE" } */ + __analyzer_eval (buf[14] == 12); /* { dg-warning "TRUE" } */ + __analyzer_eval (buf[15] == 12); /* { dg-warning "TRUE" } */ + __analyzer_eval (buf[16] == 12); /* { dg-warning "TRUE" } */ + __analyzer_eval (buf[17] == 12); /* { dg-warning "TRUE" } */ + __analyzer_eval (buf[18] == 12); /* { dg-warning "TRUE" } */ + __analyzer_eval (buf[19] == 12); /* { dg-warning "TRUE" } */ +} + +/* Various overlapping memset calls with different sizes and values. */ + +void test_9 (void) +{ + char buf[8]; + memset (buf, 0, 8); + __analyzer_eval (buf[0] == 0); /* { dg-warning "TRUE" } */ + __analyzer_eval (buf[1] == 0); /* { dg-warning "TRUE" } */ + __analyzer_eval (buf[2] == 0); /* { dg-warning "TRUE" } */ + __analyzer_eval (buf[3] == 0); /* { dg-warning "TRUE" } */ + __analyzer_eval (buf[4] == 0); /* { dg-warning "TRUE" } */ + __analyzer_eval (buf[5] == 0); /* { dg-warning "TRUE" } */ + __analyzer_eval (buf[6] == 0); /* { dg-warning "TRUE" } */ + __analyzer_eval (buf[7] == 0); /* { dg-warning "TRUE" } */ + + memset (buf + 1, 1, 4); + __analyzer_eval (buf[0] == 0); /* { dg-warning "TRUE" } */ + __analyzer_eval (buf[1] == 1); /* { dg-warning "TRUE" } */ + __analyzer_eval (buf[2] == 1); /* { dg-warning "TRUE" } */ + __analyzer_eval (buf[3] == 1); /* { dg-warning "TRUE" } */ + __analyzer_eval (buf[4] == 1); /* { dg-warning "TRUE" } */ + __analyzer_eval (buf[5] == 0); /* { dg-warning "TRUE" } */ + __analyzer_eval (buf[6] == 0); /* { dg-warning "TRUE" } */ + __analyzer_eval (buf[7] == 0); /* { dg-warning "TRUE" } */ + + memset (buf + 2, 2, 4); + __analyzer_eval (buf[0] == 0); /* { dg-warning "TRUE" } */ + __analyzer_eval (buf[1] == 1); /* { dg-warning "TRUE" } */ + __analyzer_eval (buf[2] == 2); /* { dg-warning "TRUE" } */ + __analyzer_eval (buf[3] == 2); /* { dg-warning "TRUE" } */ + __analyzer_eval (buf[4] == 2); /* { dg-warning "TRUE" } */ + __analyzer_eval (buf[5] == 2); /* { dg-warning "TRUE" } */ + __analyzer_eval (buf[6] == 0); /* { dg-warning "TRUE" } */ + __analyzer_eval (buf[7] == 0); /* { dg-warning "TRUE" } */ + + memset (buf + 4, 3, 3); + __analyzer_eval (buf[0] == 0); /* { dg-warning "TRUE" } */ + __analyzer_eval (buf[1] == 1); /* { dg-warning "TRUE" } */ + __analyzer_eval (buf[2] == 2); /* { dg-warning "TRUE" } */ + __analyzer_eval (buf[3] == 2); /* { dg-warning "TRUE" } */ + __analyzer_eval (buf[4] == 3); /* { dg-warning "TRUE" } */ + __analyzer_eval (buf[5] == 3); /* { dg-warning "TRUE" } */ + __analyzer_eval (buf[6] == 3); /* { dg-warning "TRUE" } */ + __analyzer_eval (buf[7] == 0); /* { dg-warning "TRUE" } */ + + memset (buf + 0, 4, 3); + __analyzer_eval (buf[0] == 4); /* { dg-warning "TRUE" } */ + __analyzer_eval (buf[1] == 4); /* { dg-warning "TRUE" } */ + __analyzer_eval (buf[2] == 4); /* { dg-warning "TRUE" } */ + __analyzer_eval (buf[3] == 2); /* { dg-warning "TRUE" } */ + __analyzer_eval (buf[4] == 3); /* { dg-warning "TRUE" } */ + __analyzer_eval (buf[5] == 3); /* { dg-warning "TRUE" } */ + __analyzer_eval (buf[6] == 3); /* { dg-warning "TRUE" } */ + __analyzer_eval (buf[7] == 0); /* { dg-warning "TRUE" } */ +} diff --git a/gcc/testsuite/c-c++-common/analyzer/memset-2.c b/gcc/testsuite/c-c++-common/analyzer/memset-2.c new file mode 100644 index 0000000..de7c973 --- /dev/null +++ b/gcc/testsuite/c-c++-common/analyzer/memset-2.c @@ -0,0 +1,27 @@ +/* { dg-additional-options "-fdump-analyzer-untracked" } */ + +#include "analyzer-decls.h" + +struct S +{ + int i; +}; + +/* memset of a static struct that never gets used. */ + +void +test_1 (void) +{ + static struct S s; /* { dg-warning "track 's': no" } */ + __builtin_memset (&s, 0, sizeof (s)); +} + +/* memset of a static struct that later gets used. */ + +void +test_2 (void) +{ + static struct S s; /* { dg-warning "track 's': yes" } */ + __builtin_memset (&s, 0, sizeof (s)); + __analyzer_eval (s.i == 0); /* { dg-warning "TRUE" } */ +} diff --git a/gcc/testsuite/c-c++-common/analyzer/named-constants-via-macros-2.c b/gcc/testsuite/c-c++-common/analyzer/named-constants-via-macros-2.c new file mode 100644 index 0000000..9c019e7 --- /dev/null +++ b/gcc/testsuite/c-c++-common/analyzer/named-constants-via-macros-2.c @@ -0,0 +1,15 @@ +#include "analyzer-decls.h" + +/* Various constants used by the fd state machine, as macros + that can't be handled. */ + +#define O_ACCMODE ( +#define O_RDONLY "foo" +#define O_WRONLY int + +void test_sm_fd_constants (void) +{ + __analyzer_dump_named_constant ("O_ACCMODE"); /* { dg-warning "named constant 'O_ACCMODE' has unknown value" } */ + __analyzer_dump_named_constant ("O_RDONLY"); /* { dg-warning "named constant 'O_RDONLY' has unknown value" } */ + __analyzer_dump_named_constant ("O_WRONLY"); /* { dg-warning "named constant 'O_WRONLY' has unknown value" } */ +} diff --git a/gcc/testsuite/c-c++-common/analyzer/named-constants-via-macros-3.c b/gcc/testsuite/c-c++-common/analyzer/named-constants-via-macros-3.c new file mode 100644 index 0000000..2a3f2b0 --- /dev/null +++ b/gcc/testsuite/c-c++-common/analyzer/named-constants-via-macros-3.c @@ -0,0 +1,15 @@ +#include "analyzer-decls.h" + +/* Various constants used by the fd state machine, as macros + that can't be handled. */ + +#define O_RDONLY (1 << 0) +#define O_WRONLY (1 << 1) +#define O_ACCMODE (O_RDONLY | O_WRONLY) + +void test_sm_fd_constants (void) +{ + __analyzer_dump_named_constant ("O_ACCMODE"); /* { dg-warning "named constant 'O_ACCMODE' has unknown value" } */ + __analyzer_dump_named_constant ("O_RDONLY"); /* { dg-warning "named constant 'O_RDONLY' has unknown value" } */ + __analyzer_dump_named_constant ("O_WRONLY"); /* { dg-warning "named constant 'O_WRONLY' has unknown value" } */ +} diff --git a/gcc/testsuite/c-c++-common/analyzer/named-constants-via-macros-4.c b/gcc/testsuite/c-c++-common/analyzer/named-constants-via-macros-4.c new file mode 100644 index 0000000..16eef96 --- /dev/null +++ b/gcc/testsuite/c-c++-common/analyzer/named-constants-via-macros-4.c @@ -0,0 +1,15 @@ +#include "analyzer-decls.h" + +/* Various constants used by the fd state machine, as macros + that can't be handled. */ + +#define O_ACCMODE(X) 42 +#define O_RDONLY(X) 0x1 +#define O_WRONLY(X) 010 + +void test_sm_fd_constants (void) +{ + __analyzer_dump_named_constant ("O_ACCMODE"); /* { dg-warning "named constant 'O_ACCMODE' has unknown value" } */ + __analyzer_dump_named_constant ("O_RDONLY"); /* { dg-warning "named constant 'O_RDONLY' has unknown value" } */ + __analyzer_dump_named_constant ("O_WRONLY"); /* { dg-warning "named constant 'O_WRONLY' has unknown value" } */ +} diff --git a/gcc/testsuite/c-c++-common/analyzer/named-constants-via-macros-empty.c b/gcc/testsuite/c-c++-common/analyzer/named-constants-via-macros-empty.c new file mode 100644 index 0000000..3d347e2 --- /dev/null +++ b/gcc/testsuite/c-c++-common/analyzer/named-constants-via-macros-empty.c @@ -0,0 +1,14 @@ +#include "analyzer-decls.h" + +/* Various constants used by the fd state machine. */ + +#define O_ACCMODE +#define O_RDONLY +#define O_WRONLY + +void test_sm_fd_constants (void) +{ + __analyzer_dump_named_constant ("O_ACCMODE"); /* { dg-warning "named constant 'O_ACCMODE' has unknown value" } */ + __analyzer_dump_named_constant ("O_RDONLY"); /* { dg-warning "named constant 'O_RDONLY' has unknown value" } */ + __analyzer_dump_named_constant ("O_WRONLY"); /* { dg-warning "named constant 'O_WRONLY' has unknown value" } */ +} diff --git a/gcc/testsuite/c-c++-common/analyzer/named-constants-via-macros-traditional.c b/gcc/testsuite/c-c++-common/analyzer/named-constants-via-macros-traditional.c new file mode 100644 index 0000000..64acaad --- /dev/null +++ b/gcc/testsuite/c-c++-common/analyzer/named-constants-via-macros-traditional.c @@ -0,0 +1,16 @@ +/* { dg-additional-options "-traditional-cpp" } */ + +#include "analyzer-decls.h" + +/* Various constants used by the fd state machine. */ + +#define O_ACCMODE 42 +#define O_RDONLY 0x1 +#define O_WRONLY 010 + +void test_sm_fd_constants (void) +{ + __analyzer_dump_named_constant ("O_ACCMODE"); /* { dg-warning "named constant 'O_ACCMODE' has unknown value" } */ + __analyzer_dump_named_constant ("O_RDONLY"); /* { dg-warning "named constant 'O_RDONLY' has unknown value" } */ + __analyzer_dump_named_constant ("O_WRONLY"); /* { dg-warning "named constant 'O_WRONLY' has unknown value" } */ +} diff --git a/gcc/testsuite/c-c++-common/analyzer/named-constants-via-macros-undef.c b/gcc/testsuite/c-c++-common/analyzer/named-constants-via-macros-undef.c new file mode 100644 index 0000000..46c0322 --- /dev/null +++ b/gcc/testsuite/c-c++-common/analyzer/named-constants-via-macros-undef.c @@ -0,0 +1,18 @@ +#include "analyzer-decls.h" + +/* Various constants used by the fd state machine. */ + +#define O_ACCMODE 42 +#define O_RDONLY 0x1 +#define O_WRONLY 010 + +#undef O_ACCMODE +#undef O_RDONLY +#undef O_WRONLY + +void test_sm_fd_constants (void) +{ + __analyzer_dump_named_constant ("O_ACCMODE"); /* { dg-warning "named constant 'O_ACCMODE' has unknown value" } */ + __analyzer_dump_named_constant ("O_RDONLY"); /* { dg-warning "named constant 'O_RDONLY' has unknown value" } */ + __analyzer_dump_named_constant ("O_WRONLY"); /* { dg-warning "named constant 'O_WRONLY' has unknown value" } */ +} diff --git a/gcc/testsuite/c-c++-common/analyzer/omp-parallel-for-1.c b/gcc/testsuite/c-c++-common/analyzer/omp-parallel-for-1.c new file mode 100644 index 0000000..cadacc8 --- /dev/null +++ b/gcc/testsuite/c-c++-common/analyzer/omp-parallel-for-1.c @@ -0,0 +1,22 @@ +/* { dg-require-effective-target fopenmp } */ +/* { dg-additional-options "-fopenmp -Wall" } */ + +typedef struct _Image +{ + int columns, rows; +} Image; + +extern int get_num_threads(void); + +void +test (Image* image) +{ + int y; + +#pragma omp parallel for schedule(static) \ + num_threads(get_num_threads ()) + + for (y = 0; y < image->rows; y++) { + /* [...snip...] */ + } +} diff --git a/gcc/testsuite/c-c++-common/analyzer/omp-parallel-for-get-min.c b/gcc/testsuite/c-c++-common/analyzer/omp-parallel-for-get-min.c new file mode 100644 index 0000000..ba9f634 --- /dev/null +++ b/gcc/testsuite/c-c++-common/analyzer/omp-parallel-for-get-min.c @@ -0,0 +1,25 @@ +/* Reduced from ImageMagick-7.1.0-57's MagickCore/attribute.c: GetEdgeBackgroundColor */ + +/* { dg-require-effective-target fopenmp } */ +/* { dg-additional-options "-fopenmp -Wall" } */ + +extern double get_census (void); + +double +test() +{ + double census[4], edge_census; + int i; + +#pragma omp parallel for schedule(static) + + for (i = 0; i < 4; i++) { + census[i] = get_census (); + } + edge_census = (-1.0); + for (i = 0; i < 4; i++) + if (census[i] > edge_census) { /* { dg-bogus "use of uninitialized value" } */ + edge_census = census[i]; + } + return edge_census; +} diff --git a/gcc/testsuite/c-c++-common/analyzer/out-of-bounds-3.c b/gcc/testsuite/c-c++-common/analyzer/out-of-bounds-3.c new file mode 100644 index 0000000..5fd9cc3 --- /dev/null +++ b/gcc/testsuite/c-c++-common/analyzer/out-of-bounds-3.c @@ -0,0 +1,96 @@ +#include +#include +#include + +/* Wanalyzer-out-of-bounds tests for buffer under-reads and underwrites. */ + +/* Avoid folding of memcpy. */ +typedef void * (*memcpy_t) (void *dst, const void *src, size_t n); +static memcpy_t __attribute__((noinline)) +get_memcpy (void) +{ + return memcpy; +} + + +void test1 (void) +{ + int buf[4]; + int *e = buf - 1; + *e = 42; /* { dg-line test1 } */ + + /* { dg-warning "stack-based buffer underwrite" "warning" { target *-*-* } test1 } */ + /* { dg-message "out-of-bounds write from byte -4 till byte -1 but 'buf' starts at byte 0" "final event" { target *-*-* } test1 } */ + /* { dg-message "valid subscripts for 'buf' are '\\\[0\\\]' to '\\\[3\\\]'" "valid subscript note" { target *-*-* } test1 } */ +} + +void test2 (void) +{ + int buf[4]; + int *e = buf + 1; + *e = 123; + *(e - 1) = 321; +} + +void test3 (void) +{ + int buf[4]; + int *e = buf + 1; + *e = 123; + *(e - 2) = 321; /* { dg-line test3 } */ + + /* { dg-warning "stack-based buffer underwrite" "warning" { target *-*-* } test3 } */ + /* { dg-message "out-of-bounds write from byte -4 till byte -1 but 'buf' starts at byte 0" "final event" { target *-*-* } test3 } */ + /* { dg-message "valid subscripts for 'buf' are '\\\[0\\\]' to '\\\[3\\\]'" "valid subscript note" { target *-*-* } test3 } */ +} + +void test4 (void) +{ + memcpy_t fn = get_memcpy (); + int buf[4]; + memset (buf, 1, 4 * sizeof (int)); + int n = -4; + fn (&(buf[n]), buf, sizeof (int)); /* { dg-line test4 } */ + + /* { dg-warning "stack-based buffer underwrite" "warning" { target *-*-* } test4 } */ + /* { dg-message "out-of-bounds write from byte -16 till byte -13 but 'buf' starts at byte 0" "final event" { target *-*-* } test4 } */ + /* { dg-message "valid subscripts for 'buf' are '\\\[0\\\]' to '\\\[3\\\]'" "valid subscript note" { target *-*-* } test4 } */ +} + +void test5 (void) +{ + int buf[4]; + memset (buf, 1, 4 * sizeof (int)); + + int sum = 0; + for (int i = 4; i >= 0; i++) + sum += *(buf - i); /* { dg-line test5 } */ + + /* { dg-warning "stack-based buffer under-read" "warning" { target *-*-* } test5 } */ + /* { dg-message "out-of-bounds read from byte -16 till byte -13 but 'buf' starts at byte 0" "final event" { target *-*-* } test5 } */ + /* { dg-message "valid subscripts for 'buf' are '\\\[0\\\]' to '\\\[3\\\]'" "valid subscript note" { target *-*-* } test5 } */ +} + +void test6 (void) +{ + int buf[4]; + memset (buf, 1, 4 * sizeof (int)); + + int *view = buf + 1; + int sum = 0; + for (int i = 0; i < 4; i++) + sum += *(view++); +} + +void test8 (void) +{ + memcpy_t fn = get_memcpy (); + int buf[4]; + memset (buf, 1, 4 * sizeof (int)); + int n = -4; + fn (buf, &(buf[n]), sizeof (int)); /* { dg-line test8 } */ + + /* { dg-warning "stack-based buffer under-read" "warning" { target *-*-* } test8 } */ + /* { dg-message "out-of-bounds read from byte -16 till byte -13 but 'buf' starts at byte 0" "note" { target *-*-* } test8 } */ + /* { dg-message "valid subscripts for 'buf' are '\\\[0\\\]' to '\\\[3\\\]'" "valid subscript note" { target *-*-* } test8 } */ +} diff --git a/gcc/testsuite/c-c++-common/analyzer/out-of-bounds-coreutils.c b/gcc/testsuite/c-c++-common/analyzer/out-of-bounds-coreutils.c new file mode 100644 index 0000000..7af4c37 --- /dev/null +++ b/gcc/testsuite/c-c++-common/analyzer/out-of-bounds-coreutils.c @@ -0,0 +1,29 @@ +/* Reduced from coreutils/ls.c attach. */ + +void add_zero_terminator (char *buf) +{ + char *end = buf; + while (end++); /* TODO: arguably we should report this. */ + if (buf < end) + end[-1] = '\0'; +} + +/* Reduced from coreutils/cat.c. */ + +#define LINE_COUNTER_BUF_LEN 20 +static char line_buf[LINE_COUNTER_BUF_LEN] = + { + ' ', ' ', ' ', ' ', ' ', ' ', ' ', ' ', ' ', + ' ', ' ', ' ', ' ', ' ', ' ', ' ', ' ', '0', + '\t', '\0' + }; + +/* Position of the first digit in 'line_buf'. */ +static char *line_num_start = line_buf + LINE_COUNTER_BUF_LEN - 3; + +static void +next_line_num (void) +{ + if (line_num_start > line_buf) + *--line_num_start = '1'; +} diff --git a/gcc/testsuite/c-c++-common/analyzer/out-of-bounds-curl.c b/gcc/testsuite/c-c++-common/analyzer/out-of-bounds-curl.c new file mode 100644 index 0000000..d14661c --- /dev/null +++ b/gcc/testsuite/c-c++-common/analyzer/out-of-bounds-curl.c @@ -0,0 +1,41 @@ +/* { dg-additional-options "-O2 -Wno-analyzer-symbol-too-complex" } */ +#include + +/* Reduced from curl lib/smb.c. */ +typedef int CURLcode; + +struct smb_conn { + // [...] + char *user; +}; + +struct smb_setup { + // [...] + char bytes[48]; +} __attribute__((packed)); + +struct connectdata { + // [...] + struct smb_conn *smbc; +}; + +CURLcode smb_send_setup (struct connectdata *conn) +{ + struct smb_conn *smbc = conn->smbc; + struct smb_setup msg; + char *p = msg.bytes; + unsigned char lm[24]; + + /* Init to prevent uninit warning. */ + memset(&msg, 0, sizeof(msg)); + memset (&lm, 0, sizeof(lm)); + + memcpy(p, lm, sizeof(lm)); + p += sizeof(lm); + /* Had a false-positive overflow at p. Checker had a number of bytes copied + relative to the start but offset points in the middle the field. */ + strcpy(p, (smbc->user)); + p += strlen(smbc->user) + 1; + + return 1; +} diff --git a/gcc/testsuite/c-c++-common/analyzer/out-of-bounds-diagram-1-json.c b/gcc/testsuite/c-c++-common/analyzer/out-of-bounds-diagram-1-json.c new file mode 100644 index 0000000..0a2cc34 --- /dev/null +++ b/gcc/testsuite/c-c++-common/analyzer/out-of-bounds-diagram-1-json.c @@ -0,0 +1,13 @@ +/* { dg-additional-options "-fdiagnostics-format=json-file" } */ + +/* The custom JSON format doesn't support text art, so this is just a simple + smoketext. */ + +#include + +int32_t arr[10]; + +void int_arr_write_element_after_end_off_by_one(int32_t x) +{ + arr[10] = x; +} diff --git a/gcc/testsuite/c-c++-common/analyzer/out-of-bounds-diagram-1-sarif.c b/gcc/testsuite/c-c++-common/analyzer/out-of-bounds-diagram-1-sarif.c new file mode 100644 index 0000000..051a1ce --- /dev/null +++ b/gcc/testsuite/c-c++-common/analyzer/out-of-bounds-diagram-1-sarif.c @@ -0,0 +1,24 @@ +/* We require -fdiagnostics-text-art-charset= to get any text art here + because of the test suite using -fdiagnostics-plain-output. */ + +/* { dg-additional-options "-fdiagnostics-format=sarif-file -fdiagnostics-text-art-charset=ascii" } */ + +#include + +int32_t arr[10]; + +void int_arr_write_element_after_end_off_by_one(int32_t x) +{ + arr[10] = x; +} + +/* Verify that some JSON was written to a file with the expected name. + + { dg-final { verify-sarif-file } } + + Expect the "alt-text" to be captured. + { dg-final { scan-sarif-file "\"text\": \"Diagram visualizing the predicted out-of-bounds access\"," } } + + Expect the diagram to have 4 leading spaces (to indicate a code block), + and that at least part of the diagram was written out. + { dg-final { scan-sarif-file "\"markdown\": \" .*capacity: 40 bytes.*\"" } } */ diff --git a/gcc/testsuite/c-c++-common/analyzer/out-of-bounds-pr110387.c b/gcc/testsuite/c-c++-common/analyzer/out-of-bounds-pr110387.c new file mode 100644 index 0000000..a046659 --- /dev/null +++ b/gcc/testsuite/c-c++-common/analyzer/out-of-bounds-pr110387.c @@ -0,0 +1,19 @@ +char a, b, c, d; +long x; + +void +_S_copy (long __n) +{ + __builtin_memcpy (&a, &d, __n); /* { dg-prune-output "-Wanalyzer-out-of-bounds" } */ + /* This only warns on some targets; the purpose of the test is to verify that + we don't ICE. */ +} + +void +_M_construct () +{ + x = &c - &b; + unsigned long __dnew = x; + if (__dnew > 1) + _S_copy (&c - &b); +} diff --git a/gcc/testsuite/c-c++-common/analyzer/out-of-bounds-read-char-arr.c b/gcc/testsuite/c-c++-common/analyzer/out-of-bounds-read-char-arr.c new file mode 100644 index 0000000..fa4b613 --- /dev/null +++ b/gcc/testsuite/c-c++-common/analyzer/out-of-bounds-read-char-arr.c @@ -0,0 +1,56 @@ +char arr[10]; /* { dg-message "capacity: 10 bytes" } */ + +char char_arr_read_element_before_start_far(void) +{ + return arr[-100]; /* { dg-warning "buffer under-read" "warning" } */ + /* { dg-message "out-of-bounds read at byte -100 but 'arr' starts at byte 0" "final event" { target *-*-* } .-1 } */ + /* { dg-message "valid subscripts for 'arr' are '\\\[0\\\]' to '\\\[9\\\]'" "valid subscript note" { target *-*-* } .-2 } */ +} + +char char_arr_read_element_before_start_near(void) +{ + return arr[-2]; /* { dg-warning "buffer under-read" "warning" } */ + /* { dg-message "out-of-bounds read at byte -2 but 'arr' starts at byte 0" "final event" { target *-*-* } .-1 } */ + /* { dg-message "valid subscripts for 'arr' are '\\\[0\\\]' to '\\\[9\\\]'" "valid subscript note" { target *-*-* } .-2 } */ +} + +char char_arr_read_element_before_start_off_by_one(void) +{ + return arr[-1]; /* { dg-warning "buffer under-read" "warning" } */ + /* { dg-message "out-of-bounds read at byte -1 but 'arr' starts at byte 0" "final event" { target *-*-* } .-1 } */ + /* { dg-message "valid subscripts for 'arr' are '\\\[0\\\]' to '\\\[9\\\]'" "valid subscript note" { target *-*-* } .-2 } */ +} + +char char_arr_read_element_at_start(void) +{ + return arr[0]; +} + +char char_arr_read_element_at_end(void) +{ + return arr[9]; +} + +char char_arr_read_element_after_end_off_by_one(void) +{ + return arr[10]; /* { dg-warning "buffer over-read" "warning" } */ + /* { dg-message "out-of-bounds read at byte 10 but 'arr' ends at byte 10" "final event" { target *-*-* } .-1 } */ + /* { dg-message "read of 1 byte from after the end of 'arr'" "num bad bytes note" { target *-*-* } .-2 } */ + /* { dg-message "valid subscripts for 'arr' are '\\\[0\\\]' to '\\\[9\\\]'" "valid subscript note" { target *-*-* } .-3 } */ +} + +char char_arr_read_element_after_end_near(void) +{ + return arr[11]; /* { dg-warning "buffer over-read" "warning" } */ + /* { dg-message "out-of-bounds read at byte 11 but 'arr' ends at byte 10" "final event" { target *-*-* } .-1 } */ + /* { dg-message "read of 1 byte from after the end of 'arr'" "num bad bytes note" { target *-*-* } .-2 } */ + /* { dg-message "valid subscripts for 'arr' are '\\\[0\\\]' to '\\\[9\\\]'" "valid subscript note" { target *-*-* } .-3 } */ +} + +char char_arr_read_element_after_end_far(void) +{ + return arr[100]; /* { dg-warning "buffer over-read" "warning" } */ + /* { dg-message "out-of-bounds read at byte 100 but 'arr' ends at byte 10" "final event" { target *-*-* } .-1 } */ + /* { dg-message "read of 1 byte from after the end of 'arr'" "num bad bytes note" { target *-*-* } .-2 } */ + /* { dg-message "valid subscripts for 'arr' are '\\\[0\\\]' to '\\\[9\\\]'" "valid subscript note" { target *-*-* } .-3 } */ +} diff --git a/gcc/testsuite/c-c++-common/analyzer/out-of-bounds-read-int-arr.c b/gcc/testsuite/c-c++-common/analyzer/out-of-bounds-read-int-arr.c new file mode 100644 index 0000000..c04cc19 --- /dev/null +++ b/gcc/testsuite/c-c++-common/analyzer/out-of-bounds-read-int-arr.c @@ -0,0 +1,58 @@ +#include + +int32_t arr[10]; /* { dg-message "capacity: 40 bytes" } */ + +int32_t int_arr_read_element_before_start_far(void) +{ + return arr[-100]; /* { dg-warning "buffer under-read" "warning" } */ + /* { dg-message "out-of-bounds read from byte -400 till byte -397 but 'arr' starts at byte 0" "final event" { target *-*-* } .-1 } */ + /* { dg-message "valid subscripts for 'arr' are '\\\[0\\\]' to '\\\[9\\\]'" "valid subscript note" { target *-*-* } .-2 } */ +} + +int32_t int_arr_read_element_before_start_near(void) +{ + return arr[-2]; /* { dg-warning "buffer under-read" "warning" } */ + /* { dg-message "out-of-bounds read from byte -8 till byte -5 but 'arr' starts at byte 0" "final event" { target *-*-* } .-1 } */ + /* { dg-message "valid subscripts for 'arr' are '\\\[0\\\]' to '\\\[9\\\]'" "valid subscript note" { target *-*-* } .-2 } */ +} + +int32_t int_arr_read_element_before_start_off_by_one(void) +{ + return arr[-1]; /* { dg-warning "buffer under-read" "warning" } */ + /* { dg-message "out-of-bounds read from byte -4 till byte -1 but 'arr' starts at byte 0" "final event" { target *-*-* } .-1 } */ + /* { dg-message "valid subscripts for 'arr' are '\\\[0\\\]' to '\\\[9\\\]'" "valid subscript note" { target *-*-* } .-2 } */ +} + +int32_t int_arr_read_element_at_start(void) +{ + return arr[0]; +} + +int32_t int_arr_read_element_at_end(void) +{ + return arr[9]; +} + +int32_t int_arr_read_element_after_end_off_by_one(void) +{ + return arr[10]; /* { dg-warning "buffer over-read" "warning" } */ + /* { dg-message "out-of-bounds read from byte 40 till byte 43 but 'arr' ends at byte 40" "final event" { target *-*-* } .-1 } */ + /* { dg-message "read of 4 bytes from after the end of 'arr'" "num bad bytes note" { target *-*-* } .-2 } */ + /* { dg-message "valid subscripts for 'arr' are '\\\[0\\\]' to '\\\[9\\\]'" "valid subscript note" { target *-*-* } .-3 } */ +} + +int32_t int_arr_read_element_after_end_near(void) +{ + return arr[11]; /* { dg-warning "buffer over-read" "warning" } */ + /* { dg-message "out-of-bounds read from byte 44 till byte 47 but 'arr' ends at byte 40" "final event" { target *-*-* } .-1 } */ + /* { dg-message "read of 4 bytes from after the end of 'arr'" "num bad bytes note" { target *-*-* } .-2 } */ + /* { dg-message "valid subscripts for 'arr' are '\\\[0\\\]' to '\\\[9\\\]'" "valid subscript note" { target *-*-* } .-3 } */ +} + +int32_t int_arr_read_element_after_end_far(void) +{ + return arr[100]; /* { dg-warning "buffer over-read" "warning" } */ + /* { dg-message "out-of-bounds read from byte 400 till byte 403 but 'arr' ends at byte 40" "final event" { target *-*-* } .-1 } */ + /* { dg-message "read of 4 bytes from after the end of 'arr'" "num bad bytes note" { target *-*-* } .-2 } */ + /* { dg-message "valid subscripts for 'arr' are '\\\[0\\\]' to '\\\[9\\\]'" "valid subscript note" { target *-*-* } .-3 } */ +} diff --git a/gcc/testsuite/c-c++-common/analyzer/out-of-bounds-read-struct-arr.c b/gcc/testsuite/c-c++-common/analyzer/out-of-bounds-read-struct-arr.c new file mode 100644 index 0000000..0f50bb9 --- /dev/null +++ b/gcc/testsuite/c-c++-common/analyzer/out-of-bounds-read-struct-arr.c @@ -0,0 +1,65 @@ +#include + +struct st +{ + char buf[16]; + int32_t x; + int32_t y; +}; + +struct st arr[10]; + +int32_t struct_arr_read_x_element_before_start_far(void) +{ + return arr[-100].x; /* { dg-warning "buffer under-read" "warning" } */ + /* { dg-message "out-of-bounds read from byte -2384 till byte -2381 but 'arr' starts at byte 0" "final event" { target *-*-* } .-1 } */ + /* { dg-message "valid subscripts for 'arr' are '\\\[0\\\]' to '\\\[9\\\]'" "valid subscript note" { target *-*-* } .-2 } */ +} + +int32_t struct_arr_read_x_element_before_start_near(void) +{ + return arr[-2].x; /* { dg-warning "buffer under-read" "warning" } */ + /* { dg-message "out-of-bounds read from byte -32 till byte -29 but 'arr' starts at byte 0" "final event" { target *-*-* } .-1 } */ + /* { dg-message "valid subscripts for 'arr' are '\\\[0\\\]' to '\\\[9\\\]'" "valid subscript note" { target *-*-* } .-2 } */ +} + +int32_t struct_arr_read_x_element_before_start_off_by_one(void) +{ + return arr[-1].x; /* { dg-warning "buffer under-read" "warning" } */ + /* { dg-message "out-of-bounds read from byte -8 till byte -5 but 'arr' starts at byte 0" "final event" { target *-*-* } .-1 } */ + /* { dg-message "valid subscripts for 'arr' are '\\\[0\\\]' to '\\\[9\\\]'" "valid subscript note" { target *-*-* } .-2 } */ +} + +int32_t struct_arr_read_x_element_at_start(void) +{ + return arr[0].x; +} + +int32_t struct_arr_read_x_element_at_end(void) +{ + return arr[9].x; +} + +int32_t struct_arr_read_x_element_after_end_off_by_one(void) +{ + return arr[10].x; /* { dg-warning "buffer over-read" "warning" } */ + /* { dg-message "out-of-bounds read from byte 256 till byte 259 but 'arr' ends at byte 240" "final event" { target *-*-* } .-1 } */ + /* { dg-message "read of 4 bytes from after the end of 'arr'" "num bad bytes note" { target *-*-* } .-2 } */ + /* { dg-message "valid subscripts for 'arr' are '\\\[0\\\]' to '\\\[9\\\]'" "valid subscript note" { target *-*-* } .-3 } */ +} + +int32_t struct_arr_read_x_element_after_end_near(void) +{ + return arr[11].x; /* { dg-warning "buffer over-read" "warning" } */ + /* { dg-message "out-of-bounds read from byte 280 till byte 283 but 'arr' ends at byte 240" "final event" { target *-*-* } .-1 } */ + /* { dg-message "read of 4 bytes from after the end of 'arr'" "num bad bytes note" { target *-*-* } .-2 } */ + /* { dg-message "valid subscripts for 'arr' are '\\\[0\\\]' to '\\\[9\\\]'" "valid subscript note" { target *-*-* } .-3 } */ +} + +int32_t struct_arr_read_x_element_after_end_far(void) +{ + return arr[100].x; /* { dg-warning "buffer over-read" "warning" } */ + /* { dg-message "out-of-bounds read from byte 2416 till byte 2419 but 'arr' ends at byte 240" "final event" { target *-*-* } .-1 } */ + /* { dg-message "read of 4 bytes from after the end of 'arr'" "num bad bytes note" { target *-*-* } .-2 } */ + /* { dg-message "valid subscripts for 'arr' are '\\\[0\\\]' to '\\\[9\\\]'" "valid subscript note" { target *-*-* } .-3 } */ +} diff --git a/gcc/testsuite/c-c++-common/analyzer/out-of-bounds-write-char-arr.c b/gcc/testsuite/c-c++-common/analyzer/out-of-bounds-write-char-arr.c new file mode 100644 index 0000000..2bc707c --- /dev/null +++ b/gcc/testsuite/c-c++-common/analyzer/out-of-bounds-write-char-arr.c @@ -0,0 +1,56 @@ +char arr[10]; /* { dg-message "capacity: 10 bytes" } */ + +void char_arr_write_element_before_start_far(char x) +{ + arr[-100] = x; /* { dg-warning "buffer underwrite" "warning" } */ + /* { dg-message "out-of-bounds write at byte -100 but 'arr' starts at byte 0" "final event" { target *-*-* } .-1 } */ + /* { dg-message "valid subscripts for 'arr' are '\\\[0\\\]' to '\\\[9\\\]'" "valid subscript note" { target *-*-* } .-2 } */ +} + +void char_arr_write_element_before_start_near(char x) +{ + arr[-2] = x; /* { dg-warning "buffer underwrite" "warning" } */ + /* { dg-message "out-of-bounds write at byte -2 but 'arr' starts at byte 0" "final event" { target *-*-* } .-1 } */ + /* { dg-message "valid subscripts for 'arr' are '\\\[0\\\]' to '\\\[9\\\]'" "valid subscript note" { target *-*-* } .-2 } */ +} + +void char_arr_write_element_before_start_off_by_one(char x) +{ + arr[-1] = x; /* { dg-warning "buffer underwrite" "warning" } */ + /* { dg-message "out-of-bounds write at byte -1 but 'arr' starts at byte 0" "final event" { target *-*-* } .-1 } */ + /* { dg-message "valid subscripts for 'arr' are '\\\[0\\\]' to '\\\[9\\\]'" "valid subscript note" { target *-*-* } .-2 } */ +} + +void char_arr_write_element_at_start(char x) +{ + arr[0] = x; +} + +void char_arr_write_element_at_end(char x) +{ + arr[9] = x; +} + +void char_arr_write_element_after_end_off_by_one(char x) +{ + arr[10] = x; /* { dg-warning "buffer overflow" "warning" } */ + /* { dg-message "out-of-bounds write at byte 10 but 'arr' ends at byte 10" "final event" { target *-*-* } .-1 } */ + /* { dg-message "write of 1 byte to beyond the end of 'arr'" "num bad bytes note" { target *-*-* } .-2 } */ + /* { dg-message "valid subscripts for 'arr' are '\\\[0\\\]' to '\\\[9\\\]'" "valid subscript note" { target *-*-* } .-3 } */ +} + +void char_arr_write_element_after_end_near(char x) +{ + arr[11] = x; /* { dg-warning "buffer overflow" "warning" } */ + /* { dg-message "out-of-bounds write at byte 11 but 'arr' ends at byte 10" "final event" { target *-*-* } .-1 } */ + /* { dg-message "write of 1 byte to beyond the end of 'arr'" "num bad bytes note" { target *-*-* } .-2 } */ + /* { dg-message "valid subscripts for 'arr' are '\\\[0\\\]' to '\\\[9\\\]'" "valid subscript note" { target *-*-* } .-3 } */ +} + +void char_arr_write_element_after_end_far(char x) +{ + arr[100] = x; /* { dg-warning "buffer overflow" "warning" } */ + /* { dg-message "out-of-bounds write at byte 100 but 'arr' ends at byte 10" "final event" { target *-*-* } .-1 } */ + /* { dg-message "write of 1 byte to beyond the end of 'arr'" "num bad bytes note" { target *-*-* } .-2 } */ + /* { dg-message "valid subscripts for 'arr' are '\\\[0\\\]' to '\\\[9\\\]'" "valid subscript note" { target *-*-* } .-3 } */ +} diff --git a/gcc/testsuite/c-c++-common/analyzer/out-of-bounds-write-int-arr.c b/gcc/testsuite/c-c++-common/analyzer/out-of-bounds-write-int-arr.c new file mode 100644 index 0000000..c6c0435 --- /dev/null +++ b/gcc/testsuite/c-c++-common/analyzer/out-of-bounds-write-int-arr.c @@ -0,0 +1,58 @@ +#include + +int32_t arr[10]; /* { dg-message "capacity: 40 bytes" } */ + +void int_arr_write_element_before_start_far(int32_t x) +{ + arr[-100] = x; /* { dg-warning "buffer underwrite" "warning" } */ + /* { dg-message "out-of-bounds write from byte -400 till byte -397 but 'arr' starts at byte 0" "final event" { target *-*-* } .-1 } */ + /* { dg-message "valid subscripts for 'arr' are '\\\[0\\\]' to '\\\[9\\\]'" "valid subscript note" { target *-*-* } .-2 } */ +} + +void int_arr_write_element_before_start_near(int32_t x) +{ + arr[-2] = x; /* { dg-warning "buffer underwrite" "warning" } */ + /* { dg-message "out-of-bounds write from byte -8 till byte -5 but 'arr' starts at byte 0" "final event" { target *-*-* } .-1 } */ + /* { dg-message "valid subscripts for 'arr' are '\\\[0\\\]' to '\\\[9\\\]'" "valid subscript note" { target *-*-* } .-2 } */ +} + +void int_arr_write_element_before_start_off_by_one(int32_t x) +{ + arr[-1] = x; /* { dg-warning "buffer underwrite" "warning" } */ + /* { dg-message "out-of-bounds write from byte -4 till byte -1 but 'arr' starts at byte 0" "final event" { target *-*-* } .-1 } */ + /* { dg-message "valid subscripts for 'arr' are '\\\[0\\\]' to '\\\[9\\\]'" "valid subscript note" { target *-*-* } .-2 } */ +} + +void int_arr_write_element_at_start(int32_t x) +{ + arr[0] = x; +} + +void int_arr_write_element_at_end(int32_t x) +{ + arr[9] = x; +} + +void int_arr_write_element_after_end_off_by_one(int32_t x) +{ + arr[10] = x; /* { dg-warning "buffer overflow" "warning" } */ + /* { dg-message "out-of-bounds write from byte 40 till byte 43 but 'arr' ends at byte 40" "final event" { target *-*-* } .-1 } */ + /* { dg-message "write of 4 bytes to beyond the end of 'arr'" "num bad bytes note" { target *-*-* } .-2 } */ + /* { dg-message "valid subscripts for 'arr' are '\\\[0\\\]' to '\\\[9\\\]'" "valid subscript note" { target *-*-* } .-3 } */ +} + +void int_arr_write_element_after_end_near(int32_t x) +{ + arr[11] = x; /* { dg-warning "buffer overflow" "warning" } */ + /* { dg-message "out-of-bounds write from byte 44 till byte 47 but 'arr' ends at byte 40" "final event" { target *-*-* } .-1 } */ + /* { dg-message "write of 4 bytes to beyond the end of 'arr'" "num bad bytes note" { target *-*-* } .-2 } */ + /* { dg-message "valid subscripts for 'arr' are '\\\[0\\\]' to '\\\[9\\\]'" "valid subscript note" { target *-*-* } .-3 } */ +} + +void int_arr_write_element_after_end_far(int32_t x) +{ + arr[100] = x; /* { dg-warning "buffer overflow" "warning" } */ + /* { dg-message "out-of-bounds write from byte 400 till byte 403 but 'arr' ends at byte 40" "final event" { target *-*-* } .-1 } */ + /* { dg-message "write of 4 bytes to beyond the end of 'arr'" "num bad bytes note" { target *-*-* } .-2 } */ + /* { dg-message "valid subscripts for 'arr' are '\\\[0\\\]' to '\\\[9\\\]'" "valid subscript note" { target *-*-* } .-3 } */ +} diff --git a/gcc/testsuite/c-c++-common/analyzer/out-of-bounds-write-struct-arr.c b/gcc/testsuite/c-c++-common/analyzer/out-of-bounds-write-struct-arr.c new file mode 100644 index 0000000..cf6b458 --- /dev/null +++ b/gcc/testsuite/c-c++-common/analyzer/out-of-bounds-write-struct-arr.c @@ -0,0 +1,65 @@ +#include + +struct st +{ + char buf[16]; + int32_t x; + int32_t y; +}; + +struct st arr[10]; + +void struct_arr_write_x_element_before_start_far(int32_t x) +{ + arr[-100].x = x; /* { dg-warning "buffer underwrite" "warning" } */ + /* { dg-message "out-of-bounds write from byte -2384 till byte -2381 but 'arr' starts at byte 0" "final event" { target *-*-* } .-1 } */ + /* { dg-message "valid subscripts for 'arr' are '\\\[0\\\]' to '\\\[9\\\]'" "valid subscript note" { target *-*-* } .-2 } */ +} + +void struct_arr_write_x_element_before_start_near(int32_t x) +{ + arr[-2].x = x; /* { dg-warning "buffer underwrite" "warning" } */ + /* { dg-message "out-of-bounds write from byte -32 till byte -29 but 'arr' starts at byte 0" "final event" { target *-*-* } .-1 } */ + /* { dg-message "valid subscripts for 'arr' are '\\\[0\\\]' to '\\\[9\\\]'" "valid subscript note" { target *-*-* } .-2 } */ +} + +void struct_arr_write_x_element_before_start_off_by_one(int32_t x) +{ + arr[-1].x = x; /* { dg-warning "buffer underwrite" "warning" } */ + /* { dg-message "out-of-bounds write from byte -8 till byte -5 but 'arr' starts at byte 0" "final event" { target *-*-* } .-1 } */ + /* { dg-message "valid subscripts for 'arr' are '\\\[0\\\]' to '\\\[9\\\]'" "valid subscript note" { target *-*-* } .-2 } */ +} + +void struct_arr_write_x_element_at_start(int32_t x) +{ + arr[0].x = x; +} + +void struct_arr_write_x_element_at_end(int32_t x) +{ + arr[9].x = x; +} + +void struct_arr_write_x_element_after_end_off_by_one(int32_t x) +{ + arr[10].x = x; /* { dg-warning "buffer overflow" "warning" } */ + /* { dg-message "out-of-bounds write from byte 256 till byte 259 but 'arr' ends at byte 240" "final event" { target *-*-* } .-1 } */ + /* { dg-message "write of 4 bytes to beyond the end of 'arr'" "num bad bytes note" { target *-*-* } .-2 } */ + /* { dg-message "valid subscripts for 'arr' are '\\\[0\\\]' to '\\\[9\\\]'" "valid subscript note" { target *-*-* } .-3 } */ +} + +void struct_arr_write_x_element_after_end_near(int32_t x) +{ + arr[11].x = x; /* { dg-warning "buffer overflow" "warning" } */ + /* { dg-message "out-of-bounds write from byte 280 till byte 283 but 'arr' ends at byte 240" "final event" { target *-*-* } .-1 } */ + /* { dg-message "write of 4 bytes to beyond the end of 'arr'" "num bad bytes note" { target *-*-* } .-2 } */ + /* { dg-message "valid subscripts for 'arr' are '\\\[0\\\]' to '\\\[9\\\]'" "valid subscript note" { target *-*-* } .-3 } */ +} + +void struct_arr_write_x_element_after_end_far(int32_t x) +{ + arr[100].x = x; /* { dg-warning "buffer overflow" "warning" } */ + /* { dg-message "out-of-bounds write from byte 2416 till byte 2419 but 'arr' ends at byte 240" "final event" { target *-*-* } .-1 } */ + /* { dg-message "write of 4 bytes to beyond the end of 'arr'" "num bad bytes note" { target *-*-* } .-2 } */ + /* { dg-message "valid subscripts for 'arr' are '\\\[0\\\]' to '\\\[9\\\]'" "valid subscript note" { target *-*-* } .-3 } */ +} diff --git a/gcc/testsuite/c-c++-common/analyzer/params-2.c b/gcc/testsuite/c-c++-common/analyzer/params-2.c new file mode 100644 index 0000000..433c658 --- /dev/null +++ b/gcc/testsuite/c-c++-common/analyzer/params-2.c @@ -0,0 +1,17 @@ +#include +#include "analyzer-decls.h" + +static void ensure_equal (int a, int b) +{ + if (a != b) + abort (); +} + +void test(int i, int j) +{ + __analyzer_eval (i == j); /* { dg-warning "UNKNOWN" } */ + + ensure_equal (i, j); + + __analyzer_eval (i == j); /* { dg-warning "TRUE" } */ +} diff --git a/gcc/testsuite/c-c++-common/analyzer/paths-1.c b/gcc/testsuite/c-c++-common/analyzer/paths-1.c new file mode 100644 index 0000000..df5b3a6 --- /dev/null +++ b/gcc/testsuite/c-c++-common/analyzer/paths-1.c @@ -0,0 +1,17 @@ +#include "analyzer-decls.h" + +struct foo +{ + int m_flag; +}; + +extern void bar (int); + +void test (struct foo *pf) +{ + if (pf->m_flag) + bar (0); + else + bar (1); + __analyzer_dump_exploded_nodes (0); /* { dg-warning "1 processed enode" } */ +} diff --git a/gcc/testsuite/c-c++-common/analyzer/paths-1a.c b/gcc/testsuite/c-c++-common/analyzer/paths-1a.c new file mode 100644 index 0000000..a1b842f --- /dev/null +++ b/gcc/testsuite/c-c++-common/analyzer/paths-1a.c @@ -0,0 +1,17 @@ +#include "analyzer-decls.h" + +union foo +{ + int m_flag; +}; + +extern void bar (int); + +void test (union foo *pf) +{ + if (pf->m_flag) + bar (0); + else + bar (1); + __analyzer_dump_exploded_nodes (0); /* { dg-warning "1 processed enode" } */ +} diff --git a/gcc/testsuite/c-c++-common/analyzer/paths-2.c b/gcc/testsuite/c-c++-common/analyzer/paths-2.c new file mode 100644 index 0000000..3efc053 --- /dev/null +++ b/gcc/testsuite/c-c++-common/analyzer/paths-2.c @@ -0,0 +1,23 @@ +#include "analyzer-decls.h" + +int test (int a) +{ + if (a != 42 && a != 113) { + return (-2); + } + + __analyzer_dump_exploded_nodes (0); /* { dg-warning "1 processed enode" } */ + + return 0; +} + +int test_2 (int a) +{ + if (a != 42 && a != 113 && a != 666) { + return (-2); + } + + __analyzer_dump_exploded_nodes (0); /* { dg-warning "1 processed enode" } */ + + return 0; +} diff --git a/gcc/testsuite/c-c++-common/analyzer/paths-3.c b/gcc/testsuite/c-c++-common/analyzer/paths-3.c new file mode 100644 index 0000000..b5ab810 --- /dev/null +++ b/gcc/testsuite/c-c++-common/analyzer/paths-3.c @@ -0,0 +1,47 @@ +/* { dg-additional-options "-fanalyzer-transitivity" } */ + +#include +#include "analyzer-decls.h" + +int test_1 (int a, int b) +{ + void *p; + + if (a > 5) + if (b) + p = malloc (16); + else + p = malloc (32); + + __analyzer_dump_exploded_nodes (0); /* { dg-warning "3 processed enodes" } */ + + if (a > 5) + { + free (p); + __analyzer_dump_exploded_nodes (0); /* { dg-warning "1 processed enode" } */ + } + + return 0; /* { dg-bogus "leak" } */ +} + +int test_2 (int a, int b) +{ + void *p; + + if (a > 5) + if (b) + p = malloc (16); + else + p = malloc (32); + + __analyzer_dump_exploded_nodes (0); /* { dg-warning "3 processed enodes" } */ + + if (a > 6) /* different condition */ + { + free (p); + __analyzer_dump_exploded_nodes (0); /* { dg-warning "1 processed enode" } */ + } + + return 0; /* { dg-warning "leak of 'p'" } */ + /* leaks when a == 5. */ +} diff --git a/gcc/testsuite/c-c++-common/analyzer/paths-4.c b/gcc/testsuite/c-c++-common/analyzer/paths-4.c new file mode 100644 index 0000000..60b3a0c --- /dev/null +++ b/gcc/testsuite/c-c++-common/analyzer/paths-4.c @@ -0,0 +1,54 @@ +#include "analyzer-decls.h" + +struct state +{ + int mode; + int data; +}; + +extern void do_stuff (struct state *, int); + +int test_1 (struct state *s) +{ + __analyzer_dump_exploded_nodes (0); /* { dg-warning "1 processed enode" } */ + while (1) + { + __analyzer_dump_exploded_nodes (0); /* { dg-warning "2 processed enode" } */ + __analyzer_dump_exploded_nodes (0); /* { dg-warning "2 processed enode" } */ + /* TODO: why does the above need an extra stmt to merge state? */ + do_stuff (s, s->mode); + } +} + +int test_2 (struct state *s) +{ + __analyzer_dump_exploded_nodes (0); /* { dg-warning "1 processed enode" } */ + while (1) + { + __analyzer_dump_exploded_nodes (0); /* { dg-warning "2 processed enode" } */ + /* { dg-warning "infinite loop" "" { target *-*-* } .-1 } */ + __analyzer_dump_exploded_nodes (0); /* { dg-warning "2 processed enode" } */ + /* TODO: why does the above need an extra stmt to merge state? */ + switch (s->mode) /* { dg-message "if it ever follows 'default:' branch, it will always do so\.\.\." } */ + { + case 0: + __analyzer_dump_exploded_nodes (0); /* { dg-warning "2 processed enode" } */ + do_stuff (s, 0); + break; + case 1: + __analyzer_dump_exploded_nodes (0); /* { dg-warning "1 processed enode" } */ + do_stuff (s, 17); + break; + case 2: + __analyzer_dump_exploded_nodes (0); /* { dg-warning "1 processed enode" } */ + do_stuff (s, 5); + break; + case 3: + __analyzer_dump_exploded_nodes (0); /* { dg-warning "1 processed enode" } */ + return 42; + case 4: + __analyzer_dump_exploded_nodes (0); /* { dg-warning "1 processed enode" } */ + return -3; + } + } +} diff --git a/gcc/testsuite/c-c++-common/analyzer/paths-5.c b/gcc/testsuite/c-c++-common/analyzer/paths-5.c new file mode 100644 index 0000000..21aa230 --- /dev/null +++ b/gcc/testsuite/c-c++-common/analyzer/paths-5.c @@ -0,0 +1,12 @@ +#include "analyzer-decls.h" + +void test (int *p, int n) +{ + int i; + __analyzer_dump_exploded_nodes (0); /* { dg-warning "1 processed enode" } */ + for (i = 0; i < n; i++) + { + p[i] = i; /* { dg-bogus "uninitialized" } */ + __analyzer_dump_exploded_nodes (0); /* { dg-warning "2 processed enodes" } */ + } +} diff --git a/gcc/testsuite/c-c++-common/analyzer/paths-6.c b/gcc/testsuite/c-c++-common/analyzer/paths-6.c new file mode 100644 index 0000000..ef1a4e6 --- /dev/null +++ b/gcc/testsuite/c-c++-common/analyzer/paths-6.c @@ -0,0 +1,114 @@ +#include +#include "analyzer-decls.h" + +/* Verify that ordering of writes doesn't matter when merging states. */ + +/* Test with locals. */ + +void test_1 (int flag) +{ + int a, b; + if (flag) + { + a = 3; + b = 4; + } + else + { + b = 4; + a = 3; + } + + __analyzer_dump_exploded_nodes (0); /* { dg-warning "1 processed enode" } */ + __analyzer_eval (a == 3); /* { dg-warning "TRUE" } */ + __analyzer_eval (b == 4); /* { dg-warning "TRUE" } */ +} + +/* Test with globals. */ + +int f, g, h; +void test_2 (int flag) +{ + if (flag) + { + f = 3; + g = 4; + } + else + { + g = 4; + f = 3; + } + + __analyzer_dump_exploded_nodes (0); /* { dg-warning "1 processed enode" } */ + __analyzer_eval (f == 3); /* { dg-warning "TRUE" } */ + __analyzer_eval (g == 4); /* { dg-warning "TRUE" } */ +} + +/* All 6 orderings of writes to 3 globals. */ + +void test_3 (int i) +{ + switch (i) + { + default: + case 0: + f = 3; + g = 4; + h = 5; + break; + + case 1: + f = 3; + h = 5; + g = 4; + break; + + case 2: + g = 4; + f = 3; + h = 5; + break; + + case 3: + g = 4; + h = 5; + f = 3; + break; + + case 4: + h = 5; + f = 3; + g = 4; + break; + + case 5: + h = 5; + g = 4; + f = 3; + break; + } + + __analyzer_dump_exploded_nodes (0); /* { dg-warning "1 processed enode" } */ + __analyzer_eval (f == 3); /* { dg-warning "TRUE" } */ + __analyzer_eval (g == 4); /* { dg-warning "TRUE" } */ + __analyzer_eval (h == 5); /* { dg-warning "TRUE" } */ +} + +void test_4 (int flag) +{ + void *p, *q; + if (flag) + { + p = malloc (256); + q = malloc (256); + } + else + { + q = malloc (256); + p = malloc (256); + } + __analyzer_dump_exploded_nodes (0); /* { dg-warning "2 processed enode" } */ + free (p); + free (q); +} diff --git a/gcc/testsuite/c-c++-common/analyzer/paths-7.c b/gcc/testsuite/c-c++-common/analyzer/paths-7.c new file mode 100644 index 0000000..8caaee8 --- /dev/null +++ b/gcc/testsuite/c-c++-common/analyzer/paths-7.c @@ -0,0 +1,57 @@ +#include +#include "analyzer-decls.h" + +extern int foo (int); + +int test (int flag, void *ptr, int *p, int n) +{ + int result; + int sum = 0; + int i; + + __analyzer_dump_exploded_nodes (0); /* { dg-warning "1 processed enode" } */ + + if (flag) + free (ptr); + + __analyzer_dump_exploded_nodes (0); /* { dg-warning "2 processed enodes" } */ + + for (i = 0; i < n; i++) + p[i] = i; + for (i = 0; i < n; i++) + sum += foo (p[i]); /* { dg-bogus "uninitialized" } */ + result = sum; + + __analyzer_dump_exploded_nodes (0); /* { dg-warning "2 processed enodes" } */ + + if (flag) + free (ptr); /* { dg-warning "double-'free' of 'ptr'" } */ + return result; +} + +int test_2 (int flag, int *p, int n) +{ + int result; + int sum = 0; + int i; + + void *ptr = malloc (16); + + __analyzer_dump_exploded_nodes (0); /* { dg-warning "1 processed enode" } */ + + if (flag) + free (ptr); + + __analyzer_dump_exploded_nodes (0); /* { dg-warning "2 processed enodes" } */ + + for (i = 0; i < n; i++) + p[i] = i; + for (i = 0; i < n; i++) + sum += foo (p[i]); /* { dg-bogus "uninitialized" } */ + result = sum; + + __analyzer_dump_exploded_nodes (0); /* { dg-warning "2 processed enodes" } */ + + free (ptr); /* { dg-warning "double-'free' of 'ptr'" } */ + return result; +} diff --git a/gcc/testsuite/c-c++-common/analyzer/paths-8.c b/gcc/testsuite/c-c++-common/analyzer/paths-8.c new file mode 100644 index 0000000..b350d4d --- /dev/null +++ b/gcc/testsuite/c-c++-common/analyzer/paths-8.c @@ -0,0 +1,17 @@ +#include "analyzer-decls.h" + +static void __attribute__((noinline)) +__analyzer_callee_1 (void) +{ + /* empty. */ +} + +void +test_1 (int flag) +{ + if (flag) + __analyzer_callee_1 (); + + /* Verify that we merge state, whether or not the call happens. */ + __analyzer_dump_exploded_nodes (0); /* { dg-warning "1 processed enode" } */ +} diff --git a/gcc/testsuite/c-c++-common/analyzer/pattern-test-1.c b/gcc/testsuite/c-c++-common/analyzer/pattern-test-1.c new file mode 100644 index 0000000..1306f6d --- /dev/null +++ b/gcc/testsuite/c-c++-common/analyzer/pattern-test-1.c @@ -0,0 +1,28 @@ +/* { dg-additional-options "-fanalyzer-checker=pattern-test" } */ + +#include + +extern void foo(void *); +extern void bar(void *); + +void test1(void *ptr) +{ + if (ptr) { /* { dg-warning "pattern match on 'ptr != 0'" "ptr != 0" } */ + /* { dg-warning "pattern match on 'ptr == 0'" "ptr == 0" { target *-*-* } .-1 } */ + foo(ptr); + } else { + bar(ptr); + } +} + +void test_2 (void *p, void *q) +{ + if (p == NULL || q == NULL) /* { dg-line cond_2 } */ + return; + foo(p); + + /* { dg-warning "pattern match on 'p == 0'" "p == 0" { target *-*-* } cond_2 } */ + /* { dg-warning "pattern match on 'q == 0'" "q == 0" { target *-*-* } cond_2 } */ + /* { dg-warning "pattern match on 'p != 0'" "p != 0" { target *-*-* } cond_2 } */ + /* { dg-warning "pattern match on 'q != 0'" "q != 0" { target *-*-* } cond_2 } */ +} diff --git a/gcc/testsuite/c-c++-common/analyzer/pipe-pr107486.c b/gcc/testsuite/c-c++-common/analyzer/pipe-pr107486.c new file mode 100644 index 0000000..e9fc7fb --- /dev/null +++ b/gcc/testsuite/c-c++-common/analyzer/pipe-pr107486.c @@ -0,0 +1,5 @@ +void pipe(int); + +void f1(void) { + pipe(1); +} diff --git a/gcc/testsuite/c-c++-common/analyzer/pointer-merging.c b/gcc/testsuite/c-c++-common/analyzer/pointer-merging.c new file mode 100644 index 0000000..dcf0ff0 --- /dev/null +++ b/gcc/testsuite/c-c++-common/analyzer/pointer-merging.c @@ -0,0 +1,16 @@ +static char * __attribute__((noinline)) +test_1_callee (int flag, char *a, char *b) +{ + char *p; + if (flag) + p = a; + else + p = b; + return p; +} + +char test_1_caller(int flag) { + char a = 42; + char b = 43; + return *test_1_callee(flag, &a, &b); +} diff --git a/gcc/testsuite/c-c++-common/analyzer/pr100546.c b/gcc/testsuite/c-c++-common/analyzer/pr100546.c new file mode 100644 index 0000000..3349d40 --- /dev/null +++ b/gcc/testsuite/c-c++-common/analyzer/pr100546.c @@ -0,0 +1,17 @@ +#include +#include + +static void noReturn(const char *str) __attribute__((noreturn)); +static void noReturn(const char *str) { + printf("%s\n", str); + exit(1); +} + +void (*noReturnPtr)(const char *str) = &noReturn; + +int main(int argc, char **argv) { + char *str = 0; + if (!str) + noReturnPtr(__FILE__); + return printf("%c\n", *str); +} diff --git a/gcc/testsuite/c-c++-common/analyzer/pr101503.c b/gcc/testsuite/c-c++-common/analyzer/pr101503.c new file mode 100644 index 0000000..cc4d801 --- /dev/null +++ b/gcc/testsuite/c-c++-common/analyzer/pr101503.c @@ -0,0 +1,11 @@ +/* { dg-additional-options "--param analyzer-max-svalue-depth=0 -Wno-analyzer-symbol-too-complex" } */ + +int val; + +int +fn (void) +{ + val = fn (); + + return 0; +} diff --git a/gcc/testsuite/c-c++-common/analyzer/pr101570.c b/gcc/testsuite/c-c++-common/analyzer/pr101570.c new file mode 100644 index 0000000..809bad6 --- /dev/null +++ b/gcc/testsuite/c-c++-common/analyzer/pr101570.c @@ -0,0 +1,5 @@ +void +test2 (_Complex double f) +{ + __asm__ ("" : "=r" (__real f)); +} diff --git a/gcc/testsuite/c-c++-common/analyzer/pr101721.c b/gcc/testsuite/c-c++-common/analyzer/pr101721.c new file mode 100644 index 0000000..07ef2d6 --- /dev/null +++ b/gcc/testsuite/c-c++-common/analyzer/pr101721.c @@ -0,0 +1,8 @@ +/* PR analyzer/101721 */ +/* { dg-do compile { target i?86-*-* x86_64-*-* } } */ + +void +foo () +{ + __builtin_ia32_pause (); +} diff --git a/gcc/testsuite/c-c++-common/analyzer/pr102692-2.c b/gcc/testsuite/c-c++-common/analyzer/pr102692-2.c new file mode 100644 index 0000000..c72fde2 --- /dev/null +++ b/gcc/testsuite/c-c++-common/analyzer/pr102692-2.c @@ -0,0 +1,22 @@ +/* { dg-additional-options "-O1" } */ + +struct Lisp_Overlay +{ + struct Lisp_Overlay *next; +}; + +void +test_1 (struct Lisp_Overlay *tail, long prev) +{ + long end; + if (!tail || end < prev || !tail->next) /* { dg-warning "use of uninitialized value 'end'" } */ + return; +} + +void +test_2 (struct Lisp_Overlay *tail, long prev) +{ + long end; + if (tail && end < prev && !tail->next) /* { dg-warning "use of uninitialized value 'end'" } */ + return; +} diff --git a/gcc/testsuite/c-c++-common/analyzer/pr102695.c b/gcc/testsuite/c-c++-common/analyzer/pr102695.c new file mode 100644 index 0000000..2ca9882 --- /dev/null +++ b/gcc/testsuite/c-c++-common/analyzer/pr102695.c @@ -0,0 +1,44 @@ +extern void* malloc (__SIZE_TYPE__); + +const char* write_strchr_literal (int x) +{ + char *p = __builtin_strchr ("123", x); + *p = 0; /* { dg-warning "dereference of NULL 'p'" "null deref" } */ + /* { dg-warning "write to string literal" "string literal" { target *-*-* } .-1 } */ + return p; +} + +const char* write_strchr_const_array (int x) +{ + static const char a[] = "123"; + char *p = __builtin_strchr (a, x); + *p = 0; /* { dg-warning "dereference of NULL 'p'" "null deref" } */ + /* { dg-warning "write to 'const' object 'a'" "write to const" { target *-*-* } .-1 } */ + return a; +} + +char* write_function (void) +{ + char *p = (char*)malloc /* forgot arguments */; + p[1] = 'a'; /* { dg-warning "write to function 'malloc'" } */ + __builtin_strcpy (p, "123"); /* { dg-warning "write to function 'malloc'" } */ + return p; +} + +char* write_label (void) +{ + char *p = (char*)&&L; + *p = 0; /* { dg-warning "write to label 'L'" } */ +L: + return p; +} + +struct A { const int i; }; + +extern /* not const */ struct A a; + +void write_const_member (void) +{ + char *p = (char*)&a.i; + *p = 0; // missing warning +} diff --git a/gcc/testsuite/c-c++-common/analyzer/pr103217-3.c b/gcc/testsuite/c-c++-common/analyzer/pr103217-3.c new file mode 100644 index 0000000..e5f1e4b --- /dev/null +++ b/gcc/testsuite/c-c++-common/analyzer/pr103217-3.c @@ -0,0 +1,54 @@ +/* { dg-additional-options "-Wno-analyzer-too-complex" } */ + +extern char *strdup (const char *__s) + __attribute__ ((__nothrow__ , __leaf__, __malloc__, __nonnull__ (1))); + +extern void abort (void) + __attribute__ ((__nothrow__ , __leaf__, __noreturn__)); + +extern int getopt (int ___argc, char *const *___argv, const char *__shortopts) + __attribute__ ((__nothrow__ , __leaf__, __nonnull__ (2, 3))); +extern char *optarg; + +extern void free (void *__ptr) + __attribute__ ((__nothrow__ , __leaf__)); + +struct state { + const char *confpath; + const char *host; + const char *port; + const char *state_dir_prefix; +}; + +static inline char *xstrdup(const char *s) { + char *val = strdup(s); + if (!val) + abort(); + return val; +} + +int config_init(struct state *config); + +int main(int argc, char *argv[]) { + int rc; + struct state state = { 0 }; + + config_init(&state); + + while ((rc = getopt(argc, argv, "H:p:")) != -1) { + switch (rc) { + case 'H': + free((void*)state.host); + state.host = xstrdup(optarg); + break; + case 'p': + free((void*)state.port); + state.port = xstrdup(optarg); + break; + } + } + + free((void*)state.host); + free((void*)state.port); + return rc; +} diff --git a/gcc/testsuite/c-c++-common/analyzer/pr103217-4.c b/gcc/testsuite/c-c++-common/analyzer/pr103217-4.c new file mode 100644 index 0000000..516e1f4 --- /dev/null +++ b/gcc/testsuite/c-c++-common/analyzer/pr103217-4.c @@ -0,0 +1,52 @@ +extern char *strdup (const char *__s) + __attribute__ ((__nothrow__ , __leaf__, __malloc__, __nonnull__ (1))); + +extern void abort (void) + __attribute__ ((__nothrow__ , __leaf__, __noreturn__)); + +extern int getopt (int ___argc, char *const *___argv, const char *__shortopts) + __attribute__ ((__nothrow__ , __leaf__, __nonnull__ (2, 3))); +extern char *optarg; + +extern void free (void *__ptr) + __attribute__ ((__nothrow__ , __leaf__)); + +struct state { + const char *confpath; + const char *host; + const char *port; + const char *state_dir_prefix; +}; + +static inline char *xstrdup(const char *s) { + char *val = strdup(s); + if (!val) + abort(); + return val; +} + +int config_init(struct state *config); + +int main(int argc, char *argv[]) { + int rc; + struct state state = { 0 }; + + config_init(&state); + + if ((rc = getopt(argc, argv, "H:p:")) != -1) { + switch (rc) { + case 'H': + free((void*)state.host); + state.host = xstrdup(optarg); + break; + case 'p': + free((void*)state.port); + state.port = xstrdup(optarg); + break; + } + } + + free((void*)state.host); + free((void*)state.port); + return rc; +} diff --git a/gcc/testsuite/c-c++-common/analyzer/pr103217-5.c b/gcc/testsuite/c-c++-common/analyzer/pr103217-5.c new file mode 100644 index 0000000..d916d92 --- /dev/null +++ b/gcc/testsuite/c-c++-common/analyzer/pr103217-5.c @@ -0,0 +1,47 @@ +extern char *strdup (const char *__s) + __attribute__ ((__nothrow__ , __leaf__, __malloc__, __nonnull__ (1))); + +extern void abort (void) + __attribute__ ((__nothrow__ , __leaf__, __noreturn__)); + +extern int getopt (int ___argc, char *const *___argv, const char *__shortopts) + __attribute__ ((__nothrow__ , __leaf__, __nonnull__ (2, 3))); +extern char *optarg; + +extern void free (void *__ptr) + __attribute__ ((__nothrow__ , __leaf__)); + +struct state { + const char *confpath; + const char *host; + const char *port; + const char *state_dir_prefix; +}; + +static inline char *xstrdup(const char *s) { + char *val = strdup(s); + if (!val) + abort(); + return val; +} + +int config_init(struct state *config); + +int main(int argc, char *argv[]) { + struct state state; + + config_init(&state); + + switch (getopt(argc, argv, "H:p:")) { + case 'H': + state.host = xstrdup(optarg); + break; + case 'p': + state.port = xstrdup(optarg); + break; + } + + free((void*)state.host); + free((void*)state.port); + return 0; +} diff --git a/gcc/testsuite/c-c++-common/analyzer/pr104089.c b/gcc/testsuite/c-c++-common/analyzer/pr104089.c new file mode 100644 index 0000000..3bf637e --- /dev/null +++ b/gcc/testsuite/c-c++-common/analyzer/pr104089.c @@ -0,0 +1,11 @@ +/* { dg-add-options float16 } */ +/* { dg-require-effective-target float16 } */ +/* { dg-additional-options "-frounding-math" } */ + +volatile _Float16 true_min = 5.96046447753906250000000000000000000e-8F16; + +int +main (void) +{ + return __builtin_fpclassify (0, 1, 4, 3, 2, true_min); +} diff --git a/gcc/testsuite/c-c++-common/analyzer/pr104308.c b/gcc/testsuite/c-c++-common/analyzer/pr104308.c new file mode 100644 index 0000000..a3a0cbb --- /dev/null +++ b/gcc/testsuite/c-c++-common/analyzer/pr104308.c @@ -0,0 +1,19 @@ +/* Verify that we have source locations for + -Wanalyzer-use-of-uninitialized-value warnings involving folded + memory ops. */ + +#include + +int test_memmove_within_uninit (void) +{ + char s[5]; /* { dg-message "region created on stack here" } */ + memmove(s, s + 1, 2); /* { dg-warning "use of uninitialized value" } */ + return 0; +} + +int test_memcpy_from_uninit (void) +{ + char a1[5]; + char a2[5]; /* { dg-message "region created on stack here" } */ + return (memcpy(a1, a2, 5) == a1); /* { dg-warning "use of uninitialized value" } */ +} diff --git a/gcc/testsuite/c-c++-common/analyzer/pr104452.c b/gcc/testsuite/c-c++-common/analyzer/pr104452.c new file mode 100644 index 0000000..85eb82d --- /dev/null +++ b/gcc/testsuite/c-c++-common/analyzer/pr104452.c @@ -0,0 +1,10 @@ +/* { dg-additional-options "-O" } */ + +void +test_1 (void) +{ + int __attribute__((__vector_size__ (16))) x; + for (unsigned i = 0; i < 4;) + if (x[i]) /* { dg-warning "use of uninitialized value" } */ + __builtin_abort (); +} diff --git a/gcc/testsuite/c-c++-common/analyzer/pr104524.c b/gcc/testsuite/c-c++-common/analyzer/pr104524.c new file mode 100644 index 0000000..875098c --- /dev/null +++ b/gcc/testsuite/c-c++-common/analyzer/pr104524.c @@ -0,0 +1,9 @@ +int src[1]; + +int +main (int c, char **a) +{ + __builtin_memcpy (*a, src, c); + + return 0; +} diff --git a/gcc/testsuite/c-c++-common/analyzer/pr104560-2.c b/gcc/testsuite/c-c++-common/analyzer/pr104560-2.c new file mode 100644 index 0000000..f968a58 --- /dev/null +++ b/gcc/testsuite/c-c++-common/analyzer/pr104560-2.c @@ -0,0 +1,26 @@ +struct ibv_device { + /* [...snip...] */ + int placeholder; +}; + +struct verbs_device { + struct ibv_device device; /* Must be first */ + /* [...snip...] */ + int placeholder; +}; + +struct mlx5_device { + struct verbs_device verbs_dev; + int placeholder; +}; + +static inline struct mlx5_device *to_mdev(struct ibv_device *ibdev) +{ + return (struct mlx5_device *)ibdev; +} + +static void mlx5_uninit_device(struct verbs_device *verbs_device) +{ + struct mlx5_device *dev = to_mdev(&verbs_device->device); + __builtin_free(dev); /* { dg-bogus "not on the heap" } */ +} diff --git a/gcc/testsuite/c-c++-common/analyzer/pr105087-1.c b/gcc/testsuite/c-c++-common/analyzer/pr105087-1.c new file mode 100644 index 0000000..c4acf42 --- /dev/null +++ b/gcc/testsuite/c-c++-common/analyzer/pr105087-1.c @@ -0,0 +1,18 @@ +#include "analyzer-decls.h" + +extern void *inner_alloc (void); + +void * __attribute__((noinline)) +outer_alloc (void) +{ + return inner_alloc (); +} + +void test_1 (void) +{ + void *p, *q; + + p = outer_alloc (); + q = outer_alloc (); + __analyzer_eval (p == q); /* { dg-warning "UNKNOWN" } */ +} diff --git a/gcc/testsuite/c-c++-common/analyzer/pr105087-2.c b/gcc/testsuite/c-c++-common/analyzer/pr105087-2.c new file mode 100644 index 0000000..7cd6591 --- /dev/null +++ b/gcc/testsuite/c-c++-common/analyzer/pr105087-2.c @@ -0,0 +1,20 @@ +#include "analyzer-decls.h" + +extern void inner_alloc (void **); + +void * __attribute__((noinline)) +outer_alloc (void) +{ + void *result; + inner_alloc (&result); + return result; +} + +void test_1 (void) +{ + void *p, *q; + + p = outer_alloc (); + q = outer_alloc (); + __analyzer_eval (p == q); /* { dg-warning "UNKNOWN" } */ +} diff --git a/gcc/testsuite/c-c++-common/analyzer/pr105252.c b/gcc/testsuite/c-c++-common/analyzer/pr105252.c new file mode 100644 index 0000000..a093eab --- /dev/null +++ b/gcc/testsuite/c-c++-common/analyzer/pr105252.c @@ -0,0 +1,20 @@ +/* { dg-additional-options "-fnon-call-exceptions -O" } */ + +typedef unsigned char C; +typedef unsigned char __attribute__((__vector_size__ (4))) V; + +C m; + +static inline void +bar (C c, V v, V *r) +{ + v %= (c | v) % m; + *r = v; +} + +void +foo (void) +{ + V x; + bar (0, (V){2}, &x); +} diff --git a/gcc/testsuite/c-c++-common/analyzer/pr106394.c b/gcc/testsuite/c-c++-common/analyzer/pr106394.c new file mode 100644 index 0000000..96bb175 --- /dev/null +++ b/gcc/testsuite/c-c++-common/analyzer/pr106394.c @@ -0,0 +1,19 @@ +struct msm_gpu { + // [...snip...] + const struct msm_gpu_perfcntr *perfcntrs; + // [...snip...] +}; + +struct msm_gpu_perfcntr { + // [...snip...] + const char *name; +}; + +static const struct msm_gpu_perfcntr perfcntrs[] = {}; + +struct msm_gpu *test(struct msm_gpu *gpu) { + // [...snip...] + gpu->perfcntrs = perfcntrs; + // [...snip...] + return gpu; +} diff --git a/gcc/testsuite/c-c++-common/analyzer/pr106539.c b/gcc/testsuite/c-c++-common/analyzer/pr106539.c new file mode 100644 index 0000000..fd27086 --- /dev/null +++ b/gcc/testsuite/c-c++-common/analyzer/pr106539.c @@ -0,0 +1,15 @@ +#include + +void *test (void) +{ + void **p = (void **)malloc (sizeof (void *) * 2); + if (!p) + return NULL; + p[0] = malloc(10); + p[1] = malloc(20); /* { dg-message "allocated here" } */ + void *q = realloc (p, sizeof (void *)); /* { dg-message "when 'realloc' succeeds, moving buffer" } */ + if (!q) + /* { dg-warning "leak of ''" "leak of unknown" { target *-*-* } .-1 } */ + return p; + return q; +} diff --git a/gcc/testsuite/c-c++-common/analyzer/pr106845.c b/gcc/testsuite/c-c++-common/analyzer/pr106845.c new file mode 100644 index 0000000..528c7b3 --- /dev/null +++ b/gcc/testsuite/c-c++-common/analyzer/pr106845.c @@ -0,0 +1,11 @@ +int buf_size; + +int +main (void) +{ + char buf[buf_size]; + + __builtin_memset (&buf[1], 0, buf_size); + + return 0; +} diff --git a/gcc/testsuite/c-c++-common/analyzer/pr109439.c b/gcc/testsuite/c-c++-common/analyzer/pr109439.c new file mode 100644 index 0000000..01c87cf --- /dev/null +++ b/gcc/testsuite/c-c++-common/analyzer/pr109439.c @@ -0,0 +1,12 @@ +int would_like_only_oob (int i) +{ + int arr[] = {1,2,3,4,5,6,7}; + arr[10] = 9; /* { dg-warning "stack-based buffer overflow" } */ + arr[11] = 15; /* { dg-warning "stack-based buffer overflow" } */ + int y1 = arr[9]; /* { dg-warning "stack-based buffer over-read" } */ + /* { dg-bogus "use of uninitialized value" "" { target *-*-* } .-1 } */ + + arr[18] = 15; /* { dg-warning "stack-based buffer overflow" } */ + + return y1; +} diff --git a/gcc/testsuite/c-c++-common/analyzer/pr110455.c b/gcc/testsuite/c-c++-common/analyzer/pr110455.c new file mode 100644 index 0000000..7f97943 --- /dev/null +++ b/gcc/testsuite/c-c++-common/analyzer/pr110455.c @@ -0,0 +1,7 @@ +int __attribute__((__vector_size__ (4))) v; + +void +foo (void) +{ + v | v << 1; +} diff --git a/gcc/testsuite/c-c++-common/analyzer/pr93032-mztools-simplified.c b/gcc/testsuite/c-c++-common/analyzer/pr93032-mztools-simplified.c new file mode 100644 index 0000000..4a08f0f1 --- /dev/null +++ b/gcc/testsuite/c-c++-common/analyzer/pr93032-mztools-simplified.c @@ -0,0 +1,22 @@ +/* { dg-do "compile" } */ + +/* Minimal replacement of system headers. */ +#define NULL ((void *) 0) +typedef struct _IO_FILE FILE; +extern FILE *fopen(const char *__restrict __filename, + const char *__restrict __modes); +extern int fclose (FILE *__stream); + +extern void unzRepair(const char* file, const char* fileOut, const char* fileOutTmp) +{ + FILE* fpZip = fopen(file, "rb"); + FILE* fpOut = fopen(fileOut, "wb"); + FILE* fpOutCD = fopen(fileOutTmp, "wb"); + if (fpZip != NULL && fpOut != NULL) { + fclose(fpOutCD); + fclose(fpZip); + fclose(fpOut); + } +} /* { dg-warning "leak of FILE 'fpZip'" "leak of fpZip" } */ + /* { dg-warning "leak of FILE 'fpOut'" "leak of fpOut" { target *-*-* } .-1 } */ + /* { dg-warning "leak of FILE 'fpOutCD'" "leak of fpOutCD" { target *-*-* } .-2 } */ diff --git a/gcc/testsuite/c-c++-common/analyzer/pr93290.c b/gcc/testsuite/c-c++-common/analyzer/pr93290.c new file mode 100644 index 0000000..fa35629 --- /dev/null +++ b/gcc/testsuite/c-c++-common/analyzer/pr93290.c @@ -0,0 +1,9 @@ +#include + +int test_1 (void) +{ + float foo = 42.; + if (isnan (foo)) + return 1; + return 0; +} diff --git a/gcc/testsuite/c-c++-common/analyzer/pr93352.c b/gcc/testsuite/c-c++-common/analyzer/pr93352.c new file mode 100644 index 0000000..ccb96d0 --- /dev/null +++ b/gcc/testsuite/c-c++-common/analyzer/pr93352.c @@ -0,0 +1,12 @@ +/* { dg-additional-options "-Wno-overflow" } */ + +struct yc { + int c0; + char di[]; +}; + +void +qt (struct yc *ab) +{ + ab->di[0x7fffffff + 1] = ab->di[0]; +} diff --git a/gcc/testsuite/c-c++-common/analyzer/pr93355-localealias-feasibility-3.c b/gcc/testsuite/c-c++-common/analyzer/pr93355-localealias-feasibility-3.c new file mode 100644 index 0000000..50d3388 --- /dev/null +++ b/gcc/testsuite/c-c++-common/analyzer/pr93355-localealias-feasibility-3.c @@ -0,0 +1,60 @@ +/* Simplified version of test to ensure we issue a FILE * leak diagnostic, + reproducing a feasibility issue. + Adapted from intl/localealias.c, with all #includes removed. */ + +/* { dg-do "compile" } */ + +/* Handle aliases for locale names. + Copyright (C) 1995-1999, 2000-2001, 2003 Free Software Foundation, Inc. + + This program is free software; you can redistribute it and/or modify it + under the terms of the GNU Library General Public License as published + by the Free Software Foundation; either version 2, or (at your option) + any later version. + + This program is distributed in the hope that it will be useful, + but WITHOUT ANY WARRANTY; without even the implied warranty of + MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU + Library General Public License for more details. + + You should have received a copy of the GNU Library General Public + License along with this program; if not, write to the Free Software + Foundation, Inc., 51 Franklin Street - Fifth Floor, Boston, MA 02110-1301, + USA. */ + +/* Minimal version of system headers. */ + +typedef __SIZE_TYPE__ size_t; +#define NULL ((void *)0) + +typedef struct _IO_FILE FILE; +extern FILE *fopen (const char *__restrict __filename, + const char *__restrict __modes); +extern int fclose (FILE *__stream); + +extern int isspace (int) __attribute__((__nothrow__, __leaf__)); + +/* Cleaned-up body of localealias.c follows. */ + +size_t +read_alias_file (const char *fname, char *cp) +{ + FILE *fp; + + fp = fopen (fname, "r"); /* { dg-message "opened here" } */ + if (fp == NULL) + return 0; + + if (cp[0] != '\0') + *cp++ = '\0'; + + while (isspace ((unsigned char)cp[0])) + ++cp; + + if (cp[0] != '\0') + return 42; /* { dg-warning "leak of FILE 'fp'" } */ + + fclose(fp); + + return 0; +} diff --git a/gcc/testsuite/c-c++-common/analyzer/pr93355-localealias-simplified.c b/gcc/testsuite/c-c++-common/analyzer/pr93355-localealias-simplified.c new file mode 100644 index 0000000..6f65add --- /dev/null +++ b/gcc/testsuite/c-c++-common/analyzer/pr93355-localealias-simplified.c @@ -0,0 +1,45 @@ +/* Simplified version of test for ensuring we issue a FILE * leak diagnostic, + made trivial. + Adapted from intl/localealias.c, with all #includes removed. */ + +/* { dg-do "compile" } */ + +/* Handle aliases for locale names. + Copyright (C) 1995-1999, 2000-2001, 2003 Free Software Foundation, Inc. + + This program is free software; you can redistribute it and/or modify it + under the terms of the GNU Library General Public License as published + by the Free Software Foundation; either version 2, or (at your option) + any later version. + + This program is distributed in the hope that it will be useful, + but WITHOUT ANY WARRANTY; without even the implied warranty of + MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU + Library General Public License for more details. + + You should have received a copy of the GNU Library General Public + License along with this program; if not, write to the Free Software + Foundation, Inc., 51 Franklin Street - Fifth Floor, Boston, MA 02110-1301, + USA. */ + +/* Minimal version of system headers. */ +#define NULL ((void *) 0) +typedef struct _IO_FILE FILE; +extern FILE *fopen(const char *__restrict __filename, + const char *__restrict __modes); +extern int fclose(FILE *__stream); + +void +read_alias_file (int flag) +{ + FILE *fp; + + fp = fopen ("name", "r"); /* { dg-message "opened here" } */ + if (fp == NULL) + return; + + if (flag) + return; /* { dg-warning "leak of FILE 'fp'" } */ + + fclose (fp); +} diff --git a/gcc/testsuite/c-c++-common/analyzer/pr93546.c b/gcc/testsuite/c-c++-common/analyzer/pr93546.c new file mode 100644 index 0000000..07898e9 --- /dev/null +++ b/gcc/testsuite/c-c++-common/analyzer/pr93546.c @@ -0,0 +1,11 @@ +/* { dg-do compile } */ +/* { dg-require-effective-target label_values } */ + +void +ch (int x1) +{ + ({ bx: &&bx; }); + while (x1 == 0) /* { dg-warning "infinite loop" } */ + { + } +} diff --git a/gcc/testsuite/c-c++-common/analyzer/pr93547.c b/gcc/testsuite/c-c++-common/analyzer/pr93547.c new file mode 100644 index 0000000..1518904 --- /dev/null +++ b/gcc/testsuite/c-c++-common/analyzer/pr93547.c @@ -0,0 +1,14 @@ +/* { dg-do compile } */ + +void +wy (int); + +int +f9 (void) +{ + int p5 = __builtin_ilogb (__builtin_inf ()); + + wy (0); + + return p5; +} diff --git a/gcc/testsuite/c-c++-common/analyzer/pr93669.c b/gcc/testsuite/c-c++-common/analyzer/pr93669.c new file mode 100644 index 0000000..01e266d --- /dev/null +++ b/gcc/testsuite/c-c++-common/analyzer/pr93669.c @@ -0,0 +1,25 @@ +/* { dg-additional-options "--param analyzer-max-enodes-per-program-point=2 -Wno-analyzer-too-complex" } */ + +#include "analyzer-decls.h" + +int test (int a) +{ + if (a != 42 && a != 113) { + return (-2); + } + + __analyzer_dump_exploded_nodes (0); /* { dg-warning "1 processed enode" } */ + + return 0; +} + +int test_2 (int a) +{ + if (a != 42 && a != 113 && a != 666) { + return (-2); + } + + __analyzer_dump_exploded_nodes (0); /* { dg-warning "1 processed enode" } */ + + return 0; +} diff --git a/gcc/testsuite/c-c++-common/analyzer/pr93938.c b/gcc/testsuite/c-c++-common/analyzer/pr93938.c new file mode 100644 index 0000000..81d9983 --- /dev/null +++ b/gcc/testsuite/c-c++-common/analyzer/pr93938.c @@ -0,0 +1,13 @@ +/* Taken from gcc.dg/pr70022.c, adding -O1 to the options + (and -fanalyzer, implicitly). */ + +/* { dg-do compile } */ +/* { dg-options "-w -Wno-psabi -O1" } */ + +typedef int v4si __attribute__ ((vector_size (16))); + +int +foo (v4si v) +{ + return v[~0UL]; +} diff --git a/gcc/testsuite/c-c++-common/analyzer/pr94047.c b/gcc/testsuite/c-c++-common/analyzer/pr94047.c new file mode 100644 index 0000000..a579673 --- /dev/null +++ b/gcc/testsuite/c-c++-common/analyzer/pr94047.c @@ -0,0 +1,19 @@ +typedef struct list +{ + struct list *next; +} tlist; + +void +bar (struct list *l) +{ + l->next = l->next->next; +} + +void +foo (void) +{ + struct list l; /* { dg-message "region created on stack here" } */ + tlist t = l; /* { dg-warning "use of uninitialized value 'l'" } */ + for (;;) + bar (&t); +} diff --git a/gcc/testsuite/c-c++-common/analyzer/pr94099.c b/gcc/testsuite/c-c++-common/analyzer/pr94099.c new file mode 100644 index 0000000..1d7a5d7 --- /dev/null +++ b/gcc/testsuite/c-c++-common/analyzer/pr94099.c @@ -0,0 +1,28 @@ +/* { dg-additional-options "-O1" } */ + +struct cg { + int hk; + int *bg; +}; + +union vb { + struct cg gk; +}; + +void +l3 (union vb *); + +void +pl (void) +{ + union vb th = { 0, }; + int sc; + + for (sc = 0; sc < 1; ++sc) + { + th.gk.hk = 0; + th.gk.bg[sc] = 0; /* { dg-warning "dereference of NULL '0'" } */ + // TODO: above message could be improved + l3 (&th); + } +} diff --git a/gcc/testsuite/c-c++-common/analyzer/pr94105.c b/gcc/testsuite/c-c++-common/analyzer/pr94105.c new file mode 100644 index 0000000..8220723 --- /dev/null +++ b/gcc/testsuite/c-c++-common/analyzer/pr94105.c @@ -0,0 +1,3 @@ +/* { dg-do compile } */ + +#include "../../c-c++-common/torture/pr58794-1.c" diff --git a/gcc/testsuite/c-c++-common/analyzer/pr94362-2.c b/gcc/testsuite/c-c++-common/analyzer/pr94362-2.c new file mode 100644 index 0000000..301d2ed --- /dev/null +++ b/gcc/testsuite/c-c++-common/analyzer/pr94362-2.c @@ -0,0 +1,42 @@ +/* Verify that we consider various paths to be impossible, + using functions to thwart early optimizations. */ + +#include "analyzer-decls.h" + +void test_1 (int idx) +{ + if (idx > 0) + if (idx - 1 < 0) + __analyzer_dump_path (); /* { dg-bogus "" } */ +} + +static int called_by_test_1a (int idx) +{ + return idx - 1; +} + +void test_1a (int idx) +{ + if (idx > 0) + if (called_by_test_1a (idx) < 0) + __analyzer_dump_path (); /* { dg-bogus "" } */ +} + +void test_2 (int idx) +{ + if (idx + 1 > 0) + if (idx < 0) + __analyzer_dump_path (); /* { dg-bogus "" } */ +} + +static int called_by_test_2a (int idx) +{ + return idx + 1; +} + +void test_2a (int idx) +{ + if (called_by_test_2a (idx) > 0) + if (idx < 0) + __analyzer_dump_path (); /* { dg-bogus "" } */ +} diff --git a/gcc/testsuite/c-c++-common/analyzer/pr94399.c b/gcc/testsuite/c-c++-common/analyzer/pr94399.c new file mode 100644 index 0000000..e897c04 --- /dev/null +++ b/gcc/testsuite/c-c++-common/analyzer/pr94399.c @@ -0,0 +1,13 @@ +#include + +#define _cleanup_(f) __attribute__((cleanup(f))) + +static inline void freep(void **p) { + free(*p); +} + +void test(void) { + _cleanup_(freep) void *ptr; + + ptr = malloc(3); +} /* { dg-bogus "leak" } */ diff --git a/gcc/testsuite/c-c++-common/analyzer/pr94447.c b/gcc/testsuite/c-c++-common/analyzer/pr94447.c new file mode 100644 index 0000000..7c61a20 --- /dev/null +++ b/gcc/testsuite/c-c++-common/analyzer/pr94447.c @@ -0,0 +1,10 @@ +struct foo +{ + int *v; +}; + +int test (void) +{ + struct foo f = {}; + return *f.v; /* { dg-warning "dereference of NULL" } */ +} diff --git a/gcc/testsuite/c-c++-common/analyzer/pr94639.c b/gcc/testsuite/c-c++-common/analyzer/pr94639.c new file mode 100644 index 0000000..2dbb57e --- /dev/null +++ b/gcc/testsuite/c-c++-common/analyzer/pr94639.c @@ -0,0 +1,14 @@ +#include + +void validatedatetime(const char *str) +{ + const char *templates[] = {"dddd-dd-dd dd:dd", "dddd-dd-dd"}; + + size_t len = strlen(str); + + for (unsigned t = 0; t < 2; t++) { + if (len != strlen(templates[t])) { + continue; + } + } +} diff --git a/gcc/testsuite/c-c++-common/analyzer/pr94640.c b/gcc/testsuite/c-c++-common/analyzer/pr94640.c new file mode 100644 index 0000000..9722a17 --- /dev/null +++ b/gcc/testsuite/c-c++-common/analyzer/pr94640.c @@ -0,0 +1,17 @@ +#include + +int debug; + +int opencfgfile(const char *cfgfile, FILE **fd) +{ + if (cfgfile[0] != '\0') { + + if ((*fd = fopen(cfgfile, "r")) != NULL) { + if (debug) + printf("Config file: --config\n"); + } + + } + + return 2; +} diff --git a/gcc/testsuite/c-c++-common/analyzer/pr94732.c b/gcc/testsuite/c-c++-common/analyzer/pr94732.c new file mode 100644 index 0000000..1aa154f --- /dev/null +++ b/gcc/testsuite/c-c++-common/analyzer/pr94732.c @@ -0,0 +1,13 @@ +typedef struct { int *a; } S; +int *f (void); +static void g (S *x) +{ + int *p = x->a; + p[0] = 0; +} +void h (void) +{ + S x[1]; + x->a = f (); + g (x); +} diff --git a/gcc/testsuite/c-c++-common/analyzer/pr94851-1.c b/gcc/testsuite/c-c++-common/analyzer/pr94851-1.c new file mode 100644 index 0000000..7407efa --- /dev/null +++ b/gcc/testsuite/c-c++-common/analyzer/pr94851-1.c @@ -0,0 +1,47 @@ +/* { dg-skip-if "" { powerpc*-*-aix* } } */ +/* { dg-additional-options "-O2" } */ + +#include +#include + +typedef struct AMARK { + struct AMARK *m_next; + char m_name; +} AMARK; + +struct buf { + AMARK *b_amark; +}; + +struct buf *curbp; + +int pamark(void) { + int c; + AMARK *p = curbp->b_amark; + AMARK *last = curbp->b_amark; + + c = getchar(); + + while (p != (AMARK *)NULL && p->m_name != (char)c) { + last = p; + p = p->m_next; + } + + if (p != (AMARK *)NULL) { + printf("over writing mark %c\n", c); + } else { + if ((p = (AMARK *)malloc(sizeof(AMARK))) == (AMARK *)NULL) + return 0; + + p->m_next = (AMARK *)NULL; + + if (curbp->b_amark == (AMARK *)NULL) + curbp->b_amark = p; + else + last->m_next = p; + } + + p->m_name = (char)c; /* { dg-bogus "leak of 'p'" "bogus leak" } */ + + return 1; +} diff --git a/gcc/testsuite/c-c++-common/analyzer/pr94851-2.c b/gcc/testsuite/c-c++-common/analyzer/pr94851-2.c new file mode 100644 index 0000000..62176bd --- /dev/null +++ b/gcc/testsuite/c-c++-common/analyzer/pr94851-2.c @@ -0,0 +1,54 @@ +/* As pr94851-1.c, but verify that we don't get confused by a call to + an unknown function (PR analyzer/98575). */ + +/* { dg-additional-options "-O2" } */ + +#include +#include + +typedef struct AMARK { + struct AMARK *m_next; + char m_name; +} AMARK; + +struct buf { + AMARK *b_amark; +}; + +struct buf *curbp; + +extern void unknown_fn (void); + +int pamark(void) { + int c; + + AMARK *p = curbp->b_amark; + AMARK *last = curbp->b_amark; + + unknown_fn (); + + c = getchar (); + + while (p != (AMARK *)NULL && p->m_name != (char)c) { + last = p; + p = p->m_next; + } + + if (p != (AMARK *)NULL) { + printf("over writing mark %c\n", c); + } else { + if ((p = (AMARK *)malloc(sizeof(AMARK))) == (AMARK *)NULL) + return 0; + + p->m_next = (AMARK *)NULL; + + if (curbp->b_amark == (AMARK *)NULL) + curbp->b_amark = p; + else + last->m_next = p; /* { dg-warning "dereference of NULL 'last'" "deref" } */ + } + + p->m_name = (char)c; /* { dg-bogus "leak of 'p'" "bogus leak" } */ + + return 1; +} diff --git a/gcc/testsuite/c-c++-common/analyzer/pr94851-3.c b/gcc/testsuite/c-c++-common/analyzer/pr94851-3.c new file mode 100644 index 0000000..0f95397 --- /dev/null +++ b/gcc/testsuite/c-c++-common/analyzer/pr94851-3.c @@ -0,0 +1,20 @@ +/* { dg-additional-options "-O1" } */ + +struct List { + struct List *next; +}; + +void foo(struct List *p, struct List *q) +{ + while (p && p != q){ + p = p->next; + } +} + +int main() +{ + struct List x = {0}; + foo(0, &x); + return 0; +} + diff --git a/gcc/testsuite/c-c++-common/analyzer/pr94851-4.c b/gcc/testsuite/c-c++-common/analyzer/pr94851-4.c new file mode 100644 index 0000000..a5130c5 --- /dev/null +++ b/gcc/testsuite/c-c++-common/analyzer/pr94851-4.c @@ -0,0 +1,24 @@ +/* { dg-additional-options "-O2 -Wno-analyzer-symbol-too-complex" } */ + +#include + +struct List { + struct List *next; +}; + +void foo(struct List *p, struct List *q) +{ + while (p && p != q){ + struct List *next = p->next; + free(p); + p = next; + } +} + +int main() +{ + struct List x = {0}; + foo(NULL, &x); + return 0; +} + diff --git a/gcc/testsuite/c-c++-common/analyzer/pr95026.c b/gcc/testsuite/c-c++-common/analyzer/pr95026.c new file mode 100644 index 0000000..1845f15 --- /dev/null +++ b/gcc/testsuite/c-c++-common/analyzer/pr95026.c @@ -0,0 +1,17 @@ +struct _IO_FILE; +typedef struct _IO_FILE FILE; +typedef struct _message +{ + FILE *fp; +} MESSAGE; +extern FILE *fopen (const char *__restrict __filename, + const char *__restrict __modes); +FILE *f (void); +int imap_fetch_message (int i, MESSAGE *msg, char *p) +{ + if ((msg->fp = i ? 0 : f ())) + return 0; + if (p) + msg->fp = fopen (p, "r"); + return -1; +} diff --git a/gcc/testsuite/c-c++-common/analyzer/pr96598.c b/gcc/testsuite/c-c++-common/analyzer/pr96598.c new file mode 100644 index 0000000..b4354cd --- /dev/null +++ b/gcc/testsuite/c-c++-common/analyzer/pr96598.c @@ -0,0 +1,26 @@ +/* { dg-additional-options "-O0 -fsanitize=undefined" } */ + +extern char *foo (char *dest, const char *src) + __attribute__ ((__nonnull__ (1, 2))); + +unsigned bar(const char *str) + __attribute__ ((__nonnull__ ())); + +unsigned test(const char *str, unsigned **pv) + __attribute__ ((__nonnull__ ())); + +unsigned test(const char* str, unsigned **pv) +{ + char buffer[130]; + + *pv = 0; + + foo(buffer, str); + if (bar(buffer)) + { + const char *ptr = 0; + foo(buffer, str); + return bar(buffer); + } + return 0; +} diff --git a/gcc/testsuite/c-c++-common/analyzer/pr96611.c b/gcc/testsuite/c-c++-common/analyzer/pr96611.c new file mode 100644 index 0000000..4f75023 --- /dev/null +++ b/gcc/testsuite/c-c++-common/analyzer/pr96611.c @@ -0,0 +1,14 @@ +struct s { int a; } *ptr; +void unknown_int_ptr (int *); +void unknown_void (void); + +void test_1 () +{ + unknown_int_ptr (&ptr->a); +} + +void test_2 () +{ + unknown_void (); + unknown_int_ptr (&ptr->a); +} diff --git a/gcc/testsuite/c-c++-common/analyzer/pr96644.c b/gcc/testsuite/c-c++-common/analyzer/pr96644.c new file mode 100644 index 0000000..3953c8d --- /dev/null +++ b/gcc/testsuite/c-c++-common/analyzer/pr96644.c @@ -0,0 +1,24 @@ +/* { dg-additional-options "-O1" } */ + +int oh[1]; +int *x3; + +int * +cm (char *m0) +{ + return oh; +} + +void +ek (void) +{ + for (;;) + { + char *b2 = 0; + + if (*b2 != 0) /* { dg-warning "dereference of NULL" } */ + ++b2; + + x3 = cm (b2); + } +} diff --git a/gcc/testsuite/c-c++-common/analyzer/pr96646.c b/gcc/testsuite/c-c++-common/analyzer/pr96646.c new file mode 100644 index 0000000..2ac5a03 --- /dev/null +++ b/gcc/testsuite/c-c++-common/analyzer/pr96646.c @@ -0,0 +1,24 @@ +/* { dg-additional-options "-O1" } */ + +struct zx { + struct zx *b4, *g0; +}; + +struct oo { + void *ph; + struct zx el; +}; + +inline void +k7 (struct zx *xj) +{ + xj->b4->g0 = 0; /* { dg-warning "dereference of NULL" } */ + xj->b4 = 0; +} + +void +n8 (struct oo *yx) +{ + k7 (&yx->el); + n8 (yx); +} diff --git a/gcc/testsuite/c-c++-common/analyzer/pr96648.c b/gcc/testsuite/c-c++-common/analyzer/pr96648.c new file mode 100644 index 0000000..a6b0c72 --- /dev/null +++ b/gcc/testsuite/c-c++-common/analyzer/pr96648.c @@ -0,0 +1,36 @@ +/* { dg-additional-options "-O1" } */ + +struct vd { + struct vd *rs; +}; + +struct fh { + struct vd cl; +}; + +struct i3 { + struct fh *h4; +}; + +struct fh * +gm (void); + +void +j7 (struct vd *); + +inline void +mb (struct vd *e7) +{ + j7 (e7->rs); +} + +void +po (struct i3 *d2) +{ + struct i3 *s2; + + d2->h4 = gm (); + mb (&d2->h4->cl); + s2 = ({ d2 - 1; }); + po (s2); +} diff --git a/gcc/testsuite/c-c++-common/analyzer/pr96650-1-notrans.c b/gcc/testsuite/c-c++-common/analyzer/pr96650-1-notrans.c new file mode 100644 index 0000000..94c7555 --- /dev/null +++ b/gcc/testsuite/c-c++-common/analyzer/pr96650-1-notrans.c @@ -0,0 +1,30 @@ +/* { dg-additional-options "-O2 -fno-analyzer-transitivity" } */ + +int *wf; + +void +yd (void); + +int +cy (void); + +int * +ee (int hp) +{ + if (hp != 0) + yd (); + + return 0; +} + +void +z0 (int co) +{ + int l4 = sizeof (int); + + aq: + wf = ee (l4); + if (l4 < co) + l4 = cy () + sizeof (int); + goto aq; +} diff --git a/gcc/testsuite/c-c++-common/analyzer/pr96650-1-trans.c b/gcc/testsuite/c-c++-common/analyzer/pr96650-1-trans.c new file mode 100644 index 0000000..b20630b --- /dev/null +++ b/gcc/testsuite/c-c++-common/analyzer/pr96650-1-trans.c @@ -0,0 +1,30 @@ +/* { dg-additional-options "-O2 -fanalyzer-transitivity" } */ + +int *wf; + +void +yd (void); + +int +cy (void); + +int * +ee (int hp) +{ + if (hp != 0) + yd (); + + return 0; +} + +void +z0 (int co) +{ + int l4 = sizeof (int); + + aq: + wf = ee (l4); + if (l4 < co) + l4 = cy () + sizeof (int); + goto aq; +} diff --git a/gcc/testsuite/c-c++-common/analyzer/pr96650-2-notrans.c b/gcc/testsuite/c-c++-common/analyzer/pr96650-2-notrans.c new file mode 100644 index 0000000..fc7c045 --- /dev/null +++ b/gcc/testsuite/c-c++-common/analyzer/pr96650-2-notrans.c @@ -0,0 +1,30 @@ +/* { dg-additional-options "-fno-analyzer-transitivity" } */ + +#include "analyzer-decls.h" + +int foo (void); + +/* Infeasible path, requiring transitivity to find. */ + +void test_1 (int co, int y) +{ + if (4 < co) + if (co < y) + if (y == 0) + __analyzer_dump_path (); /* { dg-message "path" } */ +} + +/* Infeasible path, requiring transitivity to find, with a merger. */ + +void test_2 (int co, int y, int z) +{ + if (4 < co) + if (co < y) + if (y == 0) + { + while (foo ()) + { + } + __analyzer_dump_path (); /* { dg-message "path" } */ + } +} diff --git a/gcc/testsuite/c-c++-common/analyzer/pr96650-2-trans.c b/gcc/testsuite/c-c++-common/analyzer/pr96650-2-trans.c new file mode 100644 index 0000000..8d0c295 --- /dev/null +++ b/gcc/testsuite/c-c++-common/analyzer/pr96650-2-trans.c @@ -0,0 +1,30 @@ +/* { dg-additional-options "-fanalyzer-transitivity" } */ + +#include "analyzer-decls.h" + +int foo (void); + +/* Infeasible path, requiring transitivity to find. */ + +void test_1 (int co, int y) +{ + if (4 < co) + if (co < y) + if (y == 0) + __analyzer_dump_path (); /* { dg-bogus "path" } */ +} + +/* Infeasible path, requiring transitivity to find, with a merger. */ + +void test_2 (int co, int y, int z) +{ + if (4 < co) + if (co < y) + if (y == 0) + { + while (foo ()) + { + } + __analyzer_dump_path (); /* { dg-bogus "path" } */ + } +} diff --git a/gcc/testsuite/c-c++-common/analyzer/pr96651-1.c b/gcc/testsuite/c-c++-common/analyzer/pr96651-1.c new file mode 100644 index 0000000..2f3a9b4 --- /dev/null +++ b/gcc/testsuite/c-c++-common/analyzer/pr96651-1.c @@ -0,0 +1,22 @@ +#include +#include +#include + +static int a; + +int main(void) +{ + char *src = NULL; + char buf[128]; + + /* "a" can't have been touched yet, and thus + is implicitly zero. */ + switch (a) { + case 1: + strcpy(buf, src); /* { dg-bogus "NULL" } */ + break; + case 0: + strcpy(buf, "hello"); + } + printf("%s\n", buf); +} diff --git a/gcc/testsuite/c-c++-common/analyzer/pr96699.c b/gcc/testsuite/c-c++-common/analyzer/pr96699.c new file mode 100644 index 0000000..c68e45a --- /dev/null +++ b/gcc/testsuite/c-c++-common/analyzer/pr96699.c @@ -0,0 +1,13 @@ +struct qi { + union { + int hj; + float sl; + }; +}; + +void +i2 (struct qi *la) +{ + if (la->hj == 0) + la->sl = 0.0f; +} diff --git a/gcc/testsuite/c-c++-common/analyzer/pr96705.c b/gcc/testsuite/c-c++-common/analyzer/pr96705.c new file mode 100644 index 0000000..d7856d2 --- /dev/null +++ b/gcc/testsuite/c-c++-common/analyzer/pr96705.c @@ -0,0 +1,9 @@ +int __attribute__ ((vector_size (8))) v; +int i; + +void +test (void) +{ + v &= 0; + v *= i; +} diff --git a/gcc/testsuite/c-c++-common/analyzer/pr96713.c b/gcc/testsuite/c-c++-common/analyzer/pr96713.c new file mode 100644 index 0000000..12170bd --- /dev/null +++ b/gcc/testsuite/c-c++-common/analyzer/pr96713.c @@ -0,0 +1,9 @@ +/* { dg-options "-Wno-psabi" } */ +typedef int __attribute__ ((vector_size (8))) V; + +void +foo (V d, V e) +{ + d <= e; + foo ((V){}, (V){}); +} diff --git a/gcc/testsuite/c-c++-common/analyzer/pr96764.c b/gcc/testsuite/c-c++-common/analyzer/pr96764.c new file mode 100644 index 0000000..6024eba --- /dev/null +++ b/gcc/testsuite/c-c++-common/analyzer/pr96764.c @@ -0,0 +1,8 @@ +/* { dg-additional-options "-Wno-analyzer-out-of-bounds" } */ + +void +ar (int *hd) +{ + int **zv = &hd; + *(double *) zv = 0.0; +} diff --git a/gcc/testsuite/c-c++-common/analyzer/pr96777.c b/gcc/testsuite/c-c++-common/analyzer/pr96777.c new file mode 100644 index 0000000..2bb2a4e --- /dev/null +++ b/gcc/testsuite/c-c++-common/analyzer/pr96777.c @@ -0,0 +1,12 @@ +struct ge { + char au; + char pz[]; +}; + +struct ge tr = { 'X', 'X', }; + +int +main (void) +{ + return tr.pz[0] == 'X'; +} diff --git a/gcc/testsuite/c-c++-common/analyzer/pr96860-2.c b/gcc/testsuite/c-c++-common/analyzer/pr96860-2.c new file mode 100644 index 0000000..d12b9a1 --- /dev/null +++ b/gcc/testsuite/c-c++-common/analyzer/pr96860-2.c @@ -0,0 +1,8 @@ +/* { dg-additional-options "--param analyzer-max-svalue-depth=0 -Wno-analyzer-symbol-too-complex" } */ + +void x7 (void) +{ + long z5[] = { + 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 1, 0, 1, 0, 1, 0, 1, + }; +} diff --git a/gcc/testsuite/c-c++-common/analyzer/pr97029.c b/gcc/testsuite/c-c++-common/analyzer/pr97029.c new file mode 100644 index 0000000..2ab2d41 --- /dev/null +++ b/gcc/testsuite/c-c++-common/analyzer/pr97029.c @@ -0,0 +1,9 @@ +struct vj { + char buf[1]; +}; + +void +setjmp (struct vj pl) +{ + setjmp (pl); /* { dg-warning "infinite recursion" } */ +} diff --git a/gcc/testsuite/c-c++-common/analyzer/pr97072.c b/gcc/testsuite/c-c++-common/analyzer/pr97072.c new file mode 100644 index 0000000..4024124 --- /dev/null +++ b/gcc/testsuite/c-c++-common/analyzer/pr97072.c @@ -0,0 +1,9 @@ +void unknown_fn_1 (void *); + +void test_1 (int co, int y) +{ + void *p = __builtin_malloc (1024); + void **q; + unknown_fn_1 (&q); + *q = p; +} diff --git a/gcc/testsuite/c-c++-common/analyzer/pr97130.c b/gcc/testsuite/c-c++-common/analyzer/pr97130.c new file mode 100644 index 0000000..f437b76 --- /dev/null +++ b/gcc/testsuite/c-c++-common/analyzer/pr97130.c @@ -0,0 +1,10 @@ +/* { dg-additional-options "-Wno-builtin-declaration-mismatch" } */ + +void * +memset (int, int, __SIZE_TYPE__); + +void +mp (int xl) +{ + memset (xl, 0, sizeof xl); +} diff --git a/gcc/testsuite/c-c++-common/analyzer/pr97233.c b/gcc/testsuite/c-c++-common/analyzer/pr97233.c new file mode 100644 index 0000000..86930aa --- /dev/null +++ b/gcc/testsuite/c-c++-common/analyzer/pr97233.c @@ -0,0 +1,8 @@ +void +longjmp (__SIZE_TYPE__, int); + +void +e7 (__SIZE_TYPE__ gr) +{ + longjmp (gr, 1); +} diff --git a/gcc/testsuite/c-c++-common/analyzer/pr97514.c b/gcc/testsuite/c-c++-common/analyzer/pr97514.c new file mode 100644 index 0000000..27245f4 --- /dev/null +++ b/gcc/testsuite/c-c++-common/analyzer/pr97514.c @@ -0,0 +1,18 @@ +/* { dg-additional-options "--param analyzer-max-enodes-per-program-point=0 -Wno-analyzer-too-complex" } */ + +typedef void (*sighandler_t) (int); + +void +signal (int, sighandler_t); + +static void +kw (int signum) +{ + (void) signum; +} + +void +gk (int ot) +{ + signal (ot, kw); +} diff --git a/gcc/testsuite/c-c++-common/analyzer/pr97608.c b/gcc/testsuite/c-c++-common/analyzer/pr97608.c new file mode 100644 index 0000000..a2bc130 --- /dev/null +++ b/gcc/testsuite/c-c++-common/analyzer/pr97608.c @@ -0,0 +1,17 @@ +#include + +void *f (void) +{ + void *p = malloc (8); + if (p == NULL) + abort (); + return (void *) ((char *) p + 0); +} + +void *g (void) +{ + void *p = malloc (8); + if (p == NULL) + abort (); + return (void *) ((char *) p + 1); +} diff --git a/gcc/testsuite/c-c++-common/analyzer/pr97668.c b/gcc/testsuite/c-c++-common/analyzer/pr97668.c new file mode 100644 index 0000000..6ec8164 --- /dev/null +++ b/gcc/testsuite/c-c++-common/analyzer/pr97668.c @@ -0,0 +1,27 @@ +/* { dg-additional-options "-O1" } */ + +void +wb (_Complex double jh) +{ + _Complex double af = 0.0; + + do + { + af += jh; + } + while (af != 0.0); +} + +_Complex double +o6 (void) +{ + _Complex double ba = 0.0; + + for (;;) + { + wb (ba); + ba = 1.0; + } + + return ba; +} diff --git a/gcc/testsuite/c-c++-common/analyzer/pr98073.c b/gcc/testsuite/c-c++-common/analyzer/pr98073.c new file mode 100644 index 0000000..abbda09 --- /dev/null +++ b/gcc/testsuite/c-c++-common/analyzer/pr98073.c @@ -0,0 +1,13 @@ +struct ist { + char ptr; + long len; +} __trans_tmp_1, http_update_host_authority; +int http_update_host_sl_0_0_0; +void http_update_host(const struct ist uri) { + uri.len || uri.ptr; + if (http_update_host_sl_0_0_0) { + http_update_host_authority = __trans_tmp_1; + !http_update_host_authority.len; + } else + http_update_host_authority = uri; +} diff --git a/gcc/testsuite/c-c++-common/analyzer/pr98575-1.c b/gcc/testsuite/c-c++-common/analyzer/pr98575-1.c new file mode 100644 index 0000000..6472e76 --- /dev/null +++ b/gcc/testsuite/c-c++-common/analyzer/pr98575-1.c @@ -0,0 +1,46 @@ +/* A malloced pointer that's written to a global pointer shouldn't be + reported as leaking, even if an unknown function has been called + (PR analyzer/98575). */ + +void **g; + +extern void unknown_fn (void); + +/* Without a call to unknown_fn. */ + +int test_1 (void) +{ + void *p; + p = __builtin_malloc(1024); + *g = p; + return 0; +} + +/* With a call to unknown_fn in various places. */ + +int test_2 (void) +{ + void *p; + unknown_fn (); + p = __builtin_malloc(1024); + *g = p; + return 0; +} + +int test_3 (void) +{ + void *p; + p = __builtin_malloc(1024); + unknown_fn (); + *g = p; + return 0; +} + +int test_4 (void) +{ + void *p; + p = __builtin_malloc(1024); + *g = p; + unknown_fn (); + return 0; +} diff --git a/gcc/testsuite/c-c++-common/analyzer/pr98580-a.c b/gcc/testsuite/c-c++-common/analyzer/pr98580-a.c new file mode 100644 index 0000000..d2b10d6 --- /dev/null +++ b/gcc/testsuite/c-c++-common/analyzer/pr98580-a.c @@ -0,0 +1,9 @@ +/* { dg-do link } */ +/* { dg-require-effective-target lto } */ +/* { dg-additional-options "-flto" } */ +/* { dg-additional-sources pr98580-b.c } */ + +int a; +int *p = &a; +int foo(); +int main() { return foo(); } diff --git a/gcc/testsuite/c-c++-common/analyzer/pr98580-b.c b/gcc/testsuite/c-c++-common/analyzer/pr98580-b.c new file mode 100644 index 0000000..629ebce --- /dev/null +++ b/gcc/testsuite/c-c++-common/analyzer/pr98580-b.c @@ -0,0 +1,2 @@ +extern int *p; +int foo() { return *p; } diff --git a/gcc/testsuite/c-c++-common/analyzer/pr98918.c b/gcc/testsuite/c-c++-common/analyzer/pr98918.c new file mode 100644 index 0000000..c3bbce3 --- /dev/null +++ b/gcc/testsuite/c-c++-common/analyzer/pr98918.c @@ -0,0 +1,24 @@ +/* { dg-additional-options "-Wno-analyzer-symbol-too-complex" } */ + +#include + +struct marker { + struct marker *next; + void *ref; +}; +struct data { + struct marker *marker; +}; + +void data_free(struct data d) +{ + struct marker *nm, *m; + + m = d.marker; + while (m) { + nm = m->next; + free(m->ref); + free(m); + m = nm; + } +} diff --git a/gcc/testsuite/c-c++-common/analyzer/pr99044-2.c b/gcc/testsuite/c-c++-common/analyzer/pr99044-2.c new file mode 100644 index 0000000..f7badb9 --- /dev/null +++ b/gcc/testsuite/c-c++-common/analyzer/pr99044-2.c @@ -0,0 +1,44 @@ +/* { dg-additional-options "-Wno-analyzer-symbol-too-complex" } */ + +struct node +{ + struct node *next; +}; + +void test_1 (struct node *n) +{ + while (n) + { + struct node *next = n->next; + __builtin_free (n); + n = next; + } +} + +extern void *get_ptr (void); + +void test_2 (void) +{ + void *p; + while (p = get_ptr ()) + __builtin_free (p); /* { dg-bogus "double-'free' of 'p'" } */ +} + +extern void **get_ptr_ptr (void); + +void test_3 (void) +{ + void **p; + while (p = get_ptr_ptr ()) + __builtin_free (*p); /* { dg-bogus "double-'free'" } */ +} + +void test_4 (void) +{ + void *p = (void *)0; + while (1) + { + __builtin_free (p); /* { dg-bogus "double-'free' of 'p'" } */ + p = get_ptr (); + } +} diff --git a/gcc/testsuite/c-c++-common/analyzer/pr99716-2.c b/gcc/testsuite/c-c++-common/analyzer/pr99716-2.c new file mode 100644 index 0000000..adc9819 --- /dev/null +++ b/gcc/testsuite/c-c++-common/analyzer/pr99716-2.c @@ -0,0 +1,34 @@ +/* Reduced from + https://github.com/libguestfs/libguestfs/blob/e0a11061035d47b118c95706240bcc17fd576edc/tests/mount-local/test-parallel-mount-local.c#L299-L335 + which is GPLv2 or later. */ + +#include +#include + +extern int foo (void); + +void +test_mountpoint (const char *mp) +{ + const int nr_passes = 5 + (rand () & 31); + int pass; + int ret = 1; + FILE *fp; + + for (pass = 0; pass < nr_passes; ++pass) { + if (foo ()) { + goto error; + } + fp = fopen ("file", "w"); + if (fp == NULL) { + goto error; + } + fprintf (fp, "hello world\n"); + fclose (fp); /* { dg-bogus "double 'fclose'" } */ + } + + ret = 0; + + error: + exit (ret); +} diff --git a/gcc/testsuite/c-c++-common/analyzer/pr99716-3.c b/gcc/testsuite/c-c++-common/analyzer/pr99716-3.c new file mode 100644 index 0000000..77d450e --- /dev/null +++ b/gcc/testsuite/c-c++-common/analyzer/pr99716-3.c @@ -0,0 +1,16 @@ +#include + +extern void foo (void *); + +void +test_1 (int nr_passes) +{ + int pass; + void *p; + + for (pass = 0; pass < nr_passes; ++pass) { + p = malloc (1024); + foo (p); + free (p); + } +} diff --git a/gcc/testsuite/c-c++-common/analyzer/pr99906.c b/gcc/testsuite/c-c++-common/analyzer/pr99906.c new file mode 100644 index 0000000..bb399a3 --- /dev/null +++ b/gcc/testsuite/c-c++-common/analyzer/pr99906.c @@ -0,0 +1,3 @@ +void bar(void *) __attribute__((__nonnull__)); +void *baz(void); +void foo(void) { bar(baz()); } diff --git a/gcc/testsuite/c-c++-common/analyzer/pragma-1.c b/gcc/testsuite/c-c++-common/analyzer/pragma-1.c new file mode 100644 index 0000000..2e53348 --- /dev/null +++ b/gcc/testsuite/c-c++-common/analyzer/pragma-1.c @@ -0,0 +1,26 @@ +/* Verify that we can disable analyzer warnings via pragmas. */ + +#include + +void test_1 (void *ptr) +{ + free (ptr); + free (ptr); /* { dg-warning "double-'free'" } */ +} + +void test_2 (void *ptr) +{ + _Pragma("GCC diagnostic push") + _Pragma("GCC diagnostic ignored \"-Wanalyzer-double-free\"") + + free (ptr); + free (ptr); /* { dg-bogus "double-'free'" } */ + + _Pragma("GCC diagnostic pop") +} + +void test_3 (void *ptr) +{ + free (ptr); + free (ptr); /* { dg-warning "double-'free'" } */ +} diff --git a/gcc/testsuite/c-c++-common/analyzer/pragma-2.c b/gcc/testsuite/c-c++-common/analyzer/pragma-2.c new file mode 100644 index 0000000..2453223 --- /dev/null +++ b/gcc/testsuite/c-c++-common/analyzer/pragma-2.c @@ -0,0 +1,58 @@ +/* { dg-skip-if "" { powerpc*-*-aix* } } */ +/* Verify that we can disable -Wanalyzer-too-complex via pragmas. */ +/* { dg-additional-options "-Wanalyzer-too-complex -Werror=analyzer-too-complex -fno-analyzer-state-merge -g" } */ + +#include + +extern int get (void); + +/* In theory each of p0...p4 can be in various malloc states, + independently, so the total combined number of states + at any program point within the loop is NUM_VARS * NUM_STATES. */ + +#pragma GCC diagnostic push +#pragma GCC diagnostic ignored "-Wanalyzer-too-complex" + +void test (void) +{ + void *p0 = NULL, *p1 = NULL, *p2 = NULL, *p3 = NULL, *p4 = NULL; + void **pp = NULL; + while (get ()) + { + switch (get ()) + { + default: + case 0: + pp = &p0; + break; + case 1: + pp = &p1; + break; + case 2: + pp = &p2; + break; + case 3: + pp = &p3; + break; + case 4: + pp = &p4; + break; + } + + switch (get ()) + { + default: + case 0: + *pp = malloc (16); /* { dg-warning "leak" } */ + break; + case 1: + free (*pp); + break; + case 2: + /* no-op. */ + break; + } + } +} + +#pragma GCC diagnostic pop diff --git a/gcc/testsuite/c-c++-common/analyzer/refcounting-1.c b/gcc/testsuite/c-c++-common/analyzer/refcounting-1.c new file mode 100644 index 0000000..4eb3a3e --- /dev/null +++ b/gcc/testsuite/c-c++-common/analyzer/refcounting-1.c @@ -0,0 +1,31 @@ +#include "analyzer-decls.h" + +typedef struct obj { + int ob_refcnt; +} PyObject; + +extern void Py_Dealloc (PyObject *op); + +#define Py_INCREF(op) \ + do { \ + ((PyObject*)(op))->ob_refcnt++; \ + } while (0) + +#define Py_DECREF(op) \ + do { \ + if (--((PyObject*)(op))->ob_refcnt == 0) \ + { \ + /*Py_Dealloc((PyObject *)(op));*/ \ + } \ + } while (0) + +void test_1 (PyObject *obj) +{ + int orig_refcnt = obj->ob_refcnt; + Py_INCREF (obj); + Py_INCREF (obj); + Py_DECREF (obj); + Py_INCREF (obj); + __analyzer_eval (obj->ob_refcnt == orig_refcnt + 2); /* { dg-warning "TRUE" } */ +} +/* TODO: uncomment the Py_Dealloc, which leads to two paths. */ diff --git a/gcc/testsuite/c-c++-common/analyzer/rhbz1878600.c b/gcc/testsuite/c-c++-common/analyzer/rhbz1878600.c new file mode 100644 index 0000000..9f6ccb6 --- /dev/null +++ b/gcc/testsuite/c-c++-common/analyzer/rhbz1878600.c @@ -0,0 +1,34 @@ +#include + +#define INI_MAX_LINE 200 + +typedef char* (*ini_reader)(char* str, int num, void* stream); + +int ini_parse(const char* filename); + +static int ini_parse_stream(ini_reader reader, void* stream) +{ + char line[INI_MAX_LINE]; + int max_line = INI_MAX_LINE; + while (reader(line, max_line, stream) != NULL) + ; + return 0; +} + +static int ini_parse_file(FILE* file) +{ + return ini_parse_stream((ini_reader)fgets, file); +} + +int ini_parse(const char* filename) +{ + FILE* file; + int error; + + file = fopen(filename, "r"); + if (!file) + return -1; + error = ini_parse_file(file); + fclose(file); + return error; +} diff --git a/gcc/testsuite/c-c++-common/analyzer/sarif-pr107366.c b/gcc/testsuite/c-c++-common/analyzer/sarif-pr107366.c new file mode 100644 index 0000000..ee156d4 --- /dev/null +++ b/gcc/testsuite/c-c++-common/analyzer/sarif-pr107366.c @@ -0,0 +1,21 @@ +/* { dg-do compile } */ +/* { dg-additional-options "-fdiagnostics-format=sarif-file" } */ + +typedef enum { + HWLOC_TOPOLOGY_DIFF_OBJ_ATTR_INFO +} hwloc_topology_diff_obj_attr_type_t; +enum { HWLOC_TOPOLOGY_DIFF_OBJ_ATTR } hwloc_apply_diff_one_diff_0_0; + +void +hwloc_apply_diff_one() { + switch (hwloc_apply_diff_one_diff_0_0) + case HWLOC_TOPOLOGY_DIFF_OBJ_ATTR: { + hwloc_topology_diff_obj_attr_type_t obj_attr_2_0_0; + switch (obj_attr_2_0_0) + case HWLOC_TOPOLOGY_DIFF_OBJ_ATTR_INFO: { + unsigned ii = 0; + } + } +} + +/* { dg-final { verify-sarif-file } } */ diff --git a/gcc/testsuite/c-c++-common/analyzer/setjmp-pr109094.c b/gcc/testsuite/c-c++-common/analyzer/setjmp-pr109094.c new file mode 100644 index 0000000..10591ce --- /dev/null +++ b/gcc/testsuite/c-c++-common/analyzer/setjmp-pr109094.c @@ -0,0 +1,38 @@ +/* Reduced from an ICE seen in qemu's target/i386/tcg/translate.c */ + +typedef long int __jmp_buf[8]; +struct __jmp_buf_tag { + __jmp_buf __jmpbuf; +}; +typedef struct __jmp_buf_tag sigjmp_buf[1]; + +extern int __sigsetjmp(sigjmp_buf env, int savesigs); +extern void siglongjmp(sigjmp_buf env, int val); + +typedef struct DisasContextBase { + int num_insns; +} DisasContextBase; + +typedef struct DisasContext { + DisasContextBase base; + sigjmp_buf jmpbuf; +} DisasContext; + +extern int translator_ldub(DisasContextBase *base, int); + +int advance_pc(DisasContext *s, int num_bytes) { + if (s->base.num_insns > 1) { + siglongjmp(s->jmpbuf, 2); + } + return 0; +} + +static inline int x86_ldub_code(DisasContext *s) { + return translator_ldub(&s->base, advance_pc(s, 1)); +} + +static void disas_insn(DisasContext *s) { + int b; + __sigsetjmp(s->jmpbuf, 0); + b = x86_ldub_code(s); +} diff --git a/gcc/testsuite/c-c++-common/analyzer/sock-2.c b/gcc/testsuite/c-c++-common/analyzer/sock-2.c new file mode 100644 index 0000000..237e0cb --- /dev/null +++ b/gcc/testsuite/c-c++-common/analyzer/sock-2.c @@ -0,0 +1,20 @@ +__extension__ typedef __signed__ long long __s64; +typedef __s64 time64_t; +struct timespec64 { + time64_t tv_sec; + long tv_nsec; +}; + +extern struct timespec64 ns_to_timespec64(void); + +int sock_gettstamp() +{ + struct timespec64 ts; + + /* [...snip...] */ + ts = ns_to_timespec64(); + if (ts.tv_sec == -1) + return -2; + /* [...snip...] */ + return 0; +} diff --git a/gcc/testsuite/c-c++-common/analyzer/stale-frame-1.c b/gcc/testsuite/c-c++-common/analyzer/stale-frame-1.c new file mode 100644 index 0000000..c3b7186 --- /dev/null +++ b/gcc/testsuite/c-c++-common/analyzer/stale-frame-1.c @@ -0,0 +1,44 @@ + +int *global_ptr; + +static void __attribute__((noinline)) +called_by_test_1 (void) +{ + int i = 42; + global_ptr = &i; +} + +int test_1 (void) +{ + called_by_test_1 (); + return *global_ptr; /* { dg-warning "dereferencing pointer 'global_ptr' to within stale stack frame" } */ +} + +static void __attribute__((noinline)) +called_by_test_2 (int **out) +{ + int i = 42; + *out = &i; +} + +int test_2 (void) +{ + int *ptr; + called_by_test_2 (&ptr); + return *ptr; /* { dg-warning "dereferencing pointer 'ptr' to within stale stack frame" } */ +} + +static int __attribute__((noinline)) +called_by_test_3 (int **out) +{ + int i = 42; + *out = &i; + return i; +} + +int test_3 (void) +{ + int *lhs_ptr; + *lhs_ptr = called_by_test_3 (&lhs_ptr); /* { dg-warning "use of uninitialized value 'lhs_ptr'" } */ + return *lhs_ptr; +} diff --git a/gcc/testsuite/c-c++-common/analyzer/stdarg-sentinel-1.c b/gcc/testsuite/c-c++-common/analyzer/stdarg-sentinel-1.c new file mode 100644 index 0000000..f8c1f0e --- /dev/null +++ b/gcc/testsuite/c-c++-common/analyzer/stdarg-sentinel-1.c @@ -0,0 +1,25 @@ +/* { dg-additional-options "-Wno-analyzer-too-complex" } */ + +#define NULL ((void *)0) + +void test_sentinel (int arg, ...) +{ + const char *s; + __builtin_va_list ap; + __builtin_va_start (ap, arg); + while (s = __builtin_va_arg (ap, char *)) /* { dg-warning "'ap' has no more arguments \\(2 consumed\\)" } */ + { + (void)s; + } + __builtin_va_end (ap); +} + +void test_caller (void) +{ + test_sentinel (42, "foo", "bar", NULL); +} + +void missing_sentinel (void) +{ + test_sentinel (42, "foo", "bar"); +} diff --git a/gcc/testsuite/c-c++-common/analyzer/stdarg-types-2.c b/gcc/testsuite/c-c++-common/analyzer/stdarg-types-2.c new file mode 100644 index 0000000..39d5c6e --- /dev/null +++ b/gcc/testsuite/c-c++-common/analyzer/stdarg-types-2.c @@ -0,0 +1,55 @@ +/* Should be OK to add a "const" qualifier to a ptr. */ + +static void __attribute__((noinline)) +__analyzer_consume_const_char_ptr (int placeholder, ...) +{ + const char *v; + __builtin_va_list ap; + __builtin_va_start (ap, placeholder); + v = __builtin_va_arg (ap, const char *); + __builtin_va_end (ap); +} + +void test_char_ptr_to_const_char_ptr (char *p) +{ + __analyzer_consume_const_char_ptr (42, p); /* { dg-bogus "" } */ +} + +/* What about casting away const-ness? + Currently we don't complain. */ + +static void __attribute__((noinline)) +__analyzer_consume_char_ptr (int placeholder, ...) +{ + char *v; + __builtin_va_list ap; + __builtin_va_start (ap, placeholder); + v = __builtin_va_arg (ap, char *); + __builtin_va_end (ap); +} + +void test_const_char_ptr_to_char_ptr (const char *p) +{ + __analyzer_consume_const_char_ptr (42, p); +} + +/* What about casting ptrs? + Currently we don't complain. */ + +struct foo; +struct bar; + +static void __attribute__((noinline)) +__analyzer_consume_bar_ptr (int placeholder, ...) +{ + struct bar *v; + __builtin_va_list ap; + __builtin_va_start (ap, placeholder); + v = __builtin_va_arg (ap, struct bar *); + __builtin_va_end (ap); +} + +void test_foo_ptr_to_bar_ptr (struct foo *p) +{ + __analyzer_consume_bar_ptr (42, p); +} diff --git a/gcc/testsuite/c-c++-common/analyzer/stdarg-types-3.c b/gcc/testsuite/c-c++-common/analyzer/stdarg-types-3.c new file mode 100644 index 0000000..7351261 --- /dev/null +++ b/gcc/testsuite/c-c++-common/analyzer/stdarg-types-3.c @@ -0,0 +1,67 @@ +static void __attribute__((noinline)) +__analyzer_consume_n_ints (int num, ...) +{ + __builtin_va_list ap; + __builtin_va_start (ap, num); + + int i, v; + for (i = 0; i < num; i++) + v = __builtin_va_arg (ap, int); + + __builtin_va_end (ap); +} + +void test_int (int x) +{ + __analyzer_consume_n_ints (1, x); +} + +void test_3_ints (int x, int y, int z) +{ + __analyzer_consume_n_ints (3, x, y, z); +} + +/* Verify that we don't complain about types that get promoted to int + at the variadic call. */ + +void test_short (short s) +{ + __analyzer_consume_n_ints (1, s); +} + +void test_ushort (unsigned short s) +{ + __analyzer_consume_n_ints (1, s); +} + +void test_schar (signed char ch) +{ + __analyzer_consume_n_ints (1, ch); +} + +void test_uchar (unsigned char ch) +{ + __analyzer_consume_n_ints (1, ch); +} + +struct ust +{ + int b0123 : 4; + int b4567 : 4; +}; + +void test_signed_bitfield (struct ust s) +{ + __analyzer_consume_n_ints (2, s.b0123, s.b4567); +} + +struct sst +{ + unsigned int b0123 : 4; + unsigned int b4567 : 4; +}; + +void test_unsigned_bitfield (struct sst s) +{ + __analyzer_consume_n_ints (2, s.b0123, s.b4567); +} diff --git a/gcc/testsuite/c-c++-common/analyzer/stdarg-types-4.c b/gcc/testsuite/c-c++-common/analyzer/stdarg-types-4.c new file mode 100644 index 0000000..920ecce --- /dev/null +++ b/gcc/testsuite/c-c++-common/analyzer/stdarg-types-4.c @@ -0,0 +1,22 @@ +static void __attribute__((noinline)) +__analyzer_consume_n_uints (int num, ...) +{ + __builtin_va_list ap; + __builtin_va_start (ap, num); + + int i, v; + for (i = 0; i < num; i++) + v = __builtin_va_arg (ap, unsigned int); + + __builtin_va_end (ap); +} + +void test_uint (unsigned int x) +{ + __analyzer_consume_n_uints (1, x); +} + +void test_3_uints (unsigned int x, unsigned int y, unsigned int z) +{ + __analyzer_consume_n_uints (3, x, y, z); +} diff --git a/gcc/testsuite/c-c++-common/analyzer/strcpy-2.c b/gcc/testsuite/c-c++-common/analyzer/strcpy-2.c new file mode 100644 index 0000000..e4e6c97 --- /dev/null +++ b/gcc/testsuite/c-c++-common/analyzer/strcpy-2.c @@ -0,0 +1,27 @@ +/* { dg-additional-options "-fdump-analyzer-untracked" } */ + +#include "analyzer-decls.h" + +struct S +{ + char buf[10]; +}; + +/* strcpy to a static struct that never gets used. */ + +void +test_1 (const char *src) +{ + static struct S s; /* { dg-warning "track 's': no" } */ + __builtin_strcpy (s.buf, src); +} + +/* strcpy to a static struct that later gets used. */ + +const char * +test_2 (const char *src) +{ + static struct S s; /* { dg-warning "track 's': yes" } */ + __builtin_strcpy (s.buf, src); + return s.buf; +} diff --git a/gcc/testsuite/c-c++-common/analyzer/strndup-1.c b/gcc/testsuite/c-c++-common/analyzer/strndup-1.c new file mode 100644 index 0000000..85ccae8 --- /dev/null +++ b/gcc/testsuite/c-c++-common/analyzer/strndup-1.c @@ -0,0 +1,23 @@ +/* { dg-skip-if "no strndup in libc" { *-*-darwin[789]* *-*-darwin10* hppa*-*-hpux* *-*-mingw* *-*-vxworks* } } */ + +#include +#include + +extern void requires_nonnull (void *ptr) + __attribute__((nonnull)); + +void test_1 (const char *s) +{ + char *p = strndup (s, 42); /* { dg-message "allocated here" } */ +} /* { dg-warning "leak of 'p'" } */ + +void test_2 (const char *s) +{ + char *p = strndup (s, 42); + free (p); +} +void test_3 (const char *s) +{ + char *p = strndup (s, 42); /* { dg-message "this call could return NULL" } */ + requires_nonnull (p); /* { dg-warning "use of possibly-NULL 'p'" } */ +} diff --git a/gcc/testsuite/c-c++-common/analyzer/switch-wrong-enum.c b/gcc/testsuite/c-c++-common/analyzer/switch-wrong-enum.c new file mode 100644 index 0000000..0de2516 --- /dev/null +++ b/gcc/testsuite/c-c++-common/analyzer/switch-wrong-enum.c @@ -0,0 +1,27 @@ +#include "analyzer-decls.h" + +enum color +{ + RED, + GREEN, + BLUE +}; + +enum fruit +{ + APPLE, + BANANA +}; + +int test_wrong_enum (enum color x) +{ + switch (x) + { + case APPLE: + return 1066; + case BANANA: + return 1776; + } + __analyzer_dump_path (); /* { dg-message "path" } */ + return 0; +} diff --git a/gcc/testsuite/c-c++-common/analyzer/symbolic-1.c b/gcc/testsuite/c-c++-common/analyzer/symbolic-1.c new file mode 100644 index 0000000..0d78242 --- /dev/null +++ b/gcc/testsuite/c-c++-common/analyzer/symbolic-1.c @@ -0,0 +1,47 @@ +/* { dg-additional-options "-fno-analyzer-suppress-followups" } */ + +#include "analyzer-decls.h" + +/* The example from store.h */ + +void test_1 (char a, char b, char c, char d, char e, char f, + int i, int j) +{ + char arr[1024]; /* { dg-message "region created on stack here" } */ + arr[2] = a; /* (1) */ + arr[3] = b; /* (2) */ + + __analyzer_eval (arr[2] == a); /* { dg-warning "TRUE" } */ + __analyzer_eval (arr[3] == b); /* { dg-warning "TRUE" } */ + __analyzer_eval (arr[4]); /* { dg-warning "UNKNOWN" "unknown" } */ + /* { dg-warning "use of uninitialized value 'arr\\\[4\\\]'" "uninit" { target *-*-* } .-1 } */ + + /* Replace one concrete binding's value with a different value. */ + arr[3] = c; /* (3) */ + __analyzer_eval (arr[2] == a); /* { dg-warning "TRUE" } */ + __analyzer_eval (arr[3] == c); /* { dg-warning "TRUE" } */ + __analyzer_eval (arr[3] == b); /* { dg-warning "UNKNOWN" } */ + __analyzer_eval (arr[4]); /* { dg-warning "UNKNOWN" "unknown" } */ + /* { dg-warning "use of uninitialized value 'arr\\\[4\\\]'" "uninit" { target *-*-* } .-1 } */ + + /* Symbolic binding. */ + arr[i] = d; /* (4) */ + __analyzer_eval (arr[i] == d); /* { dg-warning "TRUE" } */ + __analyzer_eval (arr[2] == a); /* { dg-warning "UNKNOWN" } */ + __analyzer_eval (arr[3] == c); /* { dg-warning "UNKNOWN" } */ + __analyzer_eval (arr[4]); /* { dg-warning "UNKNOWN" } */ /* Don't report uninit. */ + + /* Replace symbolic binding with a different one. */ + arr[j] = e; /* (5) */ + __analyzer_eval (arr[j] == e); /* { dg-warning "TRUE" } */ + __analyzer_eval (arr[i] == d); /* { dg-warning "UNKNOWN" } */ + __analyzer_eval (arr[4]); /* { dg-warning "UNKNOWN" } */ /* Don't report uninit. */ + + /* Add a concrete binding. */ + arr[3] = f; /* (6) */ + __analyzer_eval (arr[3] == f); /* { dg-warning "TRUE" } */ + __analyzer_eval (arr[j] == e); /* { dg-warning "UNKNOWN" } */ + __analyzer_eval (arr[4]); /* { dg-warning "UNKNOWN" } */ /* Don't report uninit. */ +} + +// TODO: as above, but with int rather than char so there's a cast diff --git a/gcc/testsuite/c-c++-common/analyzer/symbolic-2.c b/gcc/testsuite/c-c++-common/analyzer/symbolic-2.c new file mode 100644 index 0000000..70c00ce --- /dev/null +++ b/gcc/testsuite/c-c++-common/analyzer/symbolic-2.c @@ -0,0 +1,32 @@ +#include "analyzer-decls.h" + +struct foo +{ + int ival; + int iarr[10]; +}; + +void test_1 (int i, int j) +{ + struct foo fooarr[4]; + fooarr[1].ival = 42; + fooarr[1].iarr[3] = 27; + fooarr[2].iarr[1] = 17; + __analyzer_eval (fooarr[1].ival == 42); /* { dg-warning "TRUE" } */ + __analyzer_eval (fooarr[1].iarr[3] == 27); /* { dg-warning "TRUE" } */ + __analyzer_eval (fooarr[2].iarr[1] == 17); /* { dg-warning "TRUE" } */ + + /* Symbolic binding. */ + fooarr[2].iarr[i] = j; + __analyzer_eval (fooarr[2].iarr[i] == j); /* { dg-warning "TRUE" } */ + + /* We should have lost our knowledge about fooarr[2]. + It's not clear to me if we should also lose our knowledge about + fooarr[1] (for the case where i is negative). For now, we do. */ + __analyzer_eval (fooarr[1].ival == 42); /* { dg-warning "UNKNOWN" } */ + __analyzer_eval (fooarr[1].iarr[3] == 27); /* { dg-warning "UNKNOWN" } */ + __analyzer_eval (fooarr[2].iarr[1] == 17); /* { dg-warning "UNKNOWN" } */ + /* Should also be safe to read from fooarr[2]; + it isn't known to be uninit anymore. */ + __analyzer_eval (fooarr[2].iarr[10] == 17); /* { dg-warning "UNKNOWN" } */ +} diff --git a/gcc/testsuite/c-c++-common/analyzer/symbolic-3.c b/gcc/testsuite/c-c++-common/analyzer/symbolic-3.c new file mode 100644 index 0000000..da4cdbb --- /dev/null +++ b/gcc/testsuite/c-c++-common/analyzer/symbolic-3.c @@ -0,0 +1,12 @@ +#include "analyzer-decls.h" + +int iarr[16]; + +void test_1 (int i, int j) +{ + int init_el_8 = iarr[8]; + __analyzer_eval (init_el_8 == iarr[8]); /* { dg-warning "TRUE" } */ + + iarr[i] = j; + __analyzer_eval (init_el_8 == iarr[8]); /* { dg-warning "UNKNOWN" } */ +} diff --git a/gcc/testsuite/c-c++-common/analyzer/symbolic-4.c b/gcc/testsuite/c-c++-common/analyzer/symbolic-4.c new file mode 100644 index 0000000..a466f91 --- /dev/null +++ b/gcc/testsuite/c-c++-common/analyzer/symbolic-4.c @@ -0,0 +1,20 @@ +#include +#include "analyzer-decls.h" + +void test_1 (int i, int j, int k) +{ + int iarr[16]; + iarr[i] = j; + __analyzer_eval (iarr[i] == j); /* { dg-warning "TRUE" } */ + __analyzer_eval (iarr[k] == j); /* { dg-warning "UNKNOWN" } */ + + memset (iarr, 0, sizeof (iarr)); + __analyzer_eval (iarr[0] == 0); /* { dg-warning "TRUE" } */ + __analyzer_eval (iarr[i] == 0); /* { dg-warning "TRUE" } */ + __analyzer_eval (iarr[i] == j); /* { dg-warning "UNKNOWN" } */ + + iarr[i] = j; + __analyzer_eval (iarr[i] == j); /* { dg-warning "TRUE" } */ + __analyzer_eval (iarr[0] == 0); /* { dg-warning "UNKNOWN" } */ + __analyzer_eval (iarr[i] == 0); /* { dg-warning "UNKNOWN" } */ +} diff --git a/gcc/testsuite/c-c++-common/analyzer/symbolic-5.c b/gcc/testsuite/c-c++-common/analyzer/symbolic-5.c new file mode 100644 index 0000000..3f69650 --- /dev/null +++ b/gcc/testsuite/c-c++-common/analyzer/symbolic-5.c @@ -0,0 +1,29 @@ +#include "analyzer-decls.h" + +int a[1024]; +int b[1024]; + +extern void escape (void *ptr); + +void test_1 (int *p) +{ + int c, d; + escape (&c); + a[16] = 42; + b[16] = 17; + c = 33; + d = 44; + __analyzer_eval (a[16] == 42); /* { dg-warning "TRUE" } */ + __analyzer_eval (b[16] == 17); /* { dg-warning "TRUE" } */ + __analyzer_eval (c == 33); /* { dg-warning "TRUE" } */ + __analyzer_eval (d == 44); /* { dg-warning "TRUE" } */ + + /* Write through an externally-provided pointer. */ + *p = 100; + /* It could clobber our writes to the global arrays... */ + __analyzer_eval (a[16] == 42); /* { dg-warning "UNKNOWN" } */ + __analyzer_eval (b[16] == 17); /* { dg-warning "UNKNOWN" } */ + /* ...but can't clobber locals, even ones like "c" that have escaped. */ + __analyzer_eval (c == 33); /* { dg-warning "TRUE" } */ + __analyzer_eval (d == 44); /* { dg-warning "TRUE" } */ +} diff --git a/gcc/testsuite/c-c++-common/analyzer/symbolic-6.c b/gcc/testsuite/c-c++-common/analyzer/symbolic-6.c new file mode 100644 index 0000000..10d4e97 --- /dev/null +++ b/gcc/testsuite/c-c++-common/analyzer/symbolic-6.c @@ -0,0 +1,24 @@ +#include "analyzer-decls.h" + +int a[1024]; +int b[1024]; + +extern void escape (void *ptr); + +void test_1 (int *p) +{ + int c, d; + escape (&c); + + *p = 42; + __analyzer_eval (*p == 42); /* { dg-warning "TRUE" } */ + + /* These writes shouldn't affect *p. */ + c = 33; + d = 44; + __analyzer_eval (*p == 42); /* { dg-warning "TRUE" } */ + + /* This write could affect *p. */ + a[16] = 55; + __analyzer_eval (*p == 42); /* { dg-warning "UNKNOWN" } */ +} diff --git a/gcc/testsuite/c-c++-common/analyzer/symbolic-7.c b/gcc/testsuite/c-c++-common/analyzer/symbolic-7.c new file mode 100644 index 0000000..c146455 --- /dev/null +++ b/gcc/testsuite/c-c++-common/analyzer/symbolic-7.c @@ -0,0 +1,50 @@ +#include "analyzer-decls.h" + +extern void maybe_write (int *); + +void test_1 (int i) +{ + /* An array with purely concrete bindings. */ + int arr[2]; + arr[0] = 1066; + arr[1] = 1776; + + /* Concrete reads. */ + __analyzer_eval (arr[0] == 1066); /* { dg-warning "TRUE" } */ + __analyzer_eval (arr[1] == 1776); /* { dg-warning "TRUE" } */ + + /* Symbolic read. */ + __analyzer_describe (0, arr[i]); /* { dg-warning "svalue: 'UNKNOWN\\(int\\)'" } */ + __analyzer_eval (arr[i] == 1776); /* { dg-warning "UNKNOWN" } */ +} + +void test_2 (int i) +{ + /* An array that could have been touched. */ + int arr[2]; + maybe_write (arr); + + /* Concrete reads. */ + __analyzer_eval (arr[0] == 42); /* { dg-warning "UNKNOWN" } */ + + /* Symbolic read. */ + __analyzer_eval (arr[i] == 42); /* { dg-warning "UNKNOWN" } */ +} + +void test_3_concrete_read (int i) +{ + /* An array that can't have been touched. */ + int arr[2]; + + /* Concrete reads. */ + __analyzer_eval (arr[0] == 42); /* { dg-warning "use of uninitialized value 'arr\\\[0\\\]'" } */ +} + +void test_3_symbolic_read (int i) +{ + /* An array that can't have been touched. */ + int arr[2]; + + /* Symbolic read. */ + __analyzer_eval (arr[i] == 42); /* { dg-warning "use of uninitialized value 'arr\\\[i\\\]'" } */ +} diff --git a/gcc/testsuite/c-c++-common/analyzer/symbolic-8.c b/gcc/testsuite/c-c++-common/analyzer/symbolic-8.c new file mode 100644 index 0000000..f9c3596 --- /dev/null +++ b/gcc/testsuite/c-c++-common/analyzer/symbolic-8.c @@ -0,0 +1,11 @@ +/* Merger where "arr" has two different symbolic bindings. */ + +void test (int i, int j, int flag) +{ + int arr[16]; + + if (flag) + arr[i] = 42; + else + arr[j] = 17; +} diff --git a/gcc/testsuite/c-c++-common/analyzer/symbolic-gt-1.c b/gcc/testsuite/c-c++-common/analyzer/symbolic-gt-1.c new file mode 100644 index 0000000..140abce --- /dev/null +++ b/gcc/testsuite/c-c++-common/analyzer/symbolic-gt-1.c @@ -0,0 +1,76 @@ +#include +#include "analyzer-decls.h" + +/* Test GT_EXPR comparison of symbolic values. */ + +void test1 (size_t size) +{ + size_t a = 4 * size + 1; + size_t b = 4 * size; + __analyzer_eval (a > b); /* { dg-warning "TRUE" } */ +} + +void test2 (size_t size, size_t offset) +{ + size_t a = size + offset; + size_t b = size; + __analyzer_eval (a > b); /* { dg-warning "TRUE" } */ +} + +void test3 (size_t size, size_t offset) +{ + size_t a = size * offset; + size_t b = size; + __analyzer_eval (a > b); /* { dg-warning "TRUE" } */ +} + +void test4 (size_t size) +{ + size_t op = -1; + size_t a = size + op; + size_t b = size; + __analyzer_eval (a > b); /* { dg-warning "UNKNOWN" } */ +} + +void test5 (size_t size) +{ + size_t a = size - 1; + size_t b = size; + __analyzer_eval (a > b); /* { dg-warning "UNKNOWN" } */ +} + +void test6 (size_t size, int offset) +{ + /* OFFSET is a symbolic integer, thus could be negative. */ + size_t a = size + offset; + size_t b = size; + __analyzer_eval (a > b); /* { dg-warning "UNKNOWN" } */ +} + +void test7 (size_t size, size_t mul) +{ + size_t a = mul * size + 1; + size_t b = mul * size; + __analyzer_eval (a > b); /* { dg-warning "TRUE" } */ +} + +void test8 (size_t size) +{ + size_t a = size - 5; + size_t b = size - 1; + __analyzer_eval (a > b); /* { dg-warning "UNKNOWN" } */ +} + +void test9 (size_t size) +{ + size_t a = size + 1; + size_t b = size + 2; + __analyzer_eval (a > b); /* { dg-warning "UNKNOWN" } */ +} + +void test10 (size_t size) +{ + size_t a = size + 2; + size_t b = size + 1; + __analyzer_eval (a > b); /* { dg-warning "TRUE" } */ +} diff --git a/gcc/testsuite/c-c++-common/analyzer/taint-alloc-3.c b/gcc/testsuite/c-c++-common/analyzer/taint-alloc-3.c new file mode 100644 index 0000000..ce6a327 --- /dev/null +++ b/gcc/testsuite/c-c++-common/analyzer/taint-alloc-3.c @@ -0,0 +1,18 @@ +#include "analyzer-decls.h" +#include +#include +#include + +/* malloc with tainted size from a syscall. */ + +void *p; + +void __attribute__((tainted_args)) +test_1 (size_t sz) /* { dg-message "\\(1\\) function 'test_1' marked with '__attribute__\\(\\(tainted_args\\)\\)'" } */ +{ + /* TODO: should have a message saying why "sz" is tainted, e.g. + "treating 'sz' as attacker-controlled because 'test_1' is marked with '__attribute__((tainted_args))'" */ + + p = malloc (sz); /* { dg-warning "use of attacker-controlled value 'sz' as allocation size without upper-bounds checking" "warning" } */ + /* { dg-message "\\(\[0-9\]+\\) use of attacker-controlled value 'sz' as allocation size without upper-bounds checking" "final event" { target *-*-* } .-1 } */ +} diff --git a/gcc/testsuite/c-c++-common/analyzer/taint-assert-BUG_ON.c b/gcc/testsuite/c-c++-common/analyzer/taint-assert-BUG_ON.c new file mode 100644 index 0000000..328940d --- /dev/null +++ b/gcc/testsuite/c-c++-common/analyzer/taint-assert-BUG_ON.c @@ -0,0 +1,73 @@ +/* We need this, otherwise the warnings are emitted inside the macros, which + makes it hard to write the DejaGnu directives. */ +/* { dg-additional-options " -ftrack-macro-expansion=0" } */ + +/* Adapted from code in the Linux kernel, which has this: */ +/* SPDX-License-Identifier: GPL-2.0 */ + +#define __noreturn __attribute__ ((__noreturn__)) + +void panic(const char *fmt, ...) __noreturn; + +int _printk(const char *fmt, ...); +#define __printk_index_emit(...) do {} while (0) +#define printk_index_wrap(_p_func, _fmt, ...) \ + ({ \ + __printk_index_emit(_fmt, NULL, NULL); \ + _p_func(_fmt, ##__VA_ARGS__); \ + }) +#define printk(fmt, ...) printk_index_wrap(_printk, fmt, ##__VA_ARGS__) +#define barrier_before_unreachable() do { } while (0) + +#define BUG() do { \ + printk("BUG: failure at %s:%d/%s()!\n", __FILE__, __LINE__, __func__); \ + barrier_before_unreachable(); \ + panic("BUG!"); \ +} while (0) + +#define BUG_ON(condition) do { if (condition) BUG(); } while (0) + +void __attribute__((tainted_args)) +test_BUG(int n) +{ + if (n > 100) /* { dg-message "use of attacker-controlled value for control flow" } */ + BUG(); /* { dg-warning "-Wanalyzer-tainted-assertion" "warning" } */ + /* { dg-message "treating 'panic' as an assertion failure handler due to '__attribute__\\(\\(__noreturn__\\)\\)'" "final event" { target *-*-* } .-1 } */ +} + +void __attribute__((tainted_args)) +test_BUG_ON(int n) +{ + BUG_ON(n > 100); /* { dg-warning "-Wanalyzer-tainted-assertion" "warning" } */ + /* { dg-message "treating 'panic' as an assertion failure handler due to '__attribute__\\(\\(__noreturn__\\)\\)'" "final event" { target *-*-* } .-1 } */ +} + +int __attribute__((tainted_args)) +test_switch_BUG_1(int n) +{ + switch (n) { /* { dg-message "use of attacker-controlled value for control flow" } */ + default: + case 0: + return 5; + case 1: + return 22; + case 2: + return -1; + case 42: + BUG (); /* { dg-warning "-Wanalyzer-tainted-assertion" } */ + } +} + +int __attribute__((tainted_args)) +test_switch_BUG(int n) +{ + switch (n) { /* { dg-message "use of attacker-controlled value for control flow" } */ + case 0: + return 5; + case 1: + return 22; + case 2: + return -1; + } + BUG (); /* { dg-warning "-Wanalyzer-tainted-assertion" } */ +} diff --git a/gcc/testsuite/c-c++-common/analyzer/taint-divisor-2.c b/gcc/testsuite/c-c++-common/analyzer/taint-divisor-2.c new file mode 100644 index 0000000..7702584 --- /dev/null +++ b/gcc/testsuite/c-c++-common/analyzer/taint-divisor-2.c @@ -0,0 +1,10 @@ +#include "analyzer-decls.h" + +__attribute__ ((tainted_args)) +double pr110700 (double x, double y) +{ + /* Ideally we'd complain here with -Wanalyzer-tainted-divisor, but + until we track conditions on floating point values, we can't check to + see if they've been checked against zero. */ + return x / y; +} diff --git a/gcc/testsuite/c-c++-common/analyzer/taint-merger.c b/gcc/testsuite/c-c++-common/analyzer/taint-merger.c new file mode 100644 index 0000000..b7d562b --- /dev/null +++ b/gcc/testsuite/c-c++-common/analyzer/taint-merger.c @@ -0,0 +1,54 @@ +#include "analyzer-decls.h" + +int v_start; + +__attribute__((tainted_args)) +void test (int v_tainted, int v_has_lb, int v_has_ub, int v_stop) +{ + /* Get each var into the 5 different taintedness states. */ + if (v_has_lb < 10) + return; + if (v_has_ub > 100) + return; + if (v_stop < 0 || v_stop > 100) + return; + + /* Verify that we have the taintedness states we expect. */ + + __analyzer_dump_state ("taint", v_start); /* { dg-warning "state: 'start'" } */ + __analyzer_dump_state ("taint", v_tainted); /* { dg-warning "state: 'tainted'" } */ + __analyzer_dump_state ("taint", v_has_lb); /* { dg-warning "state: 'has_lb'" } */ + __analyzer_dump_state ("taint", v_has_ub); /* { dg-warning "state: 'has_ub'" } */ + __analyzer_dump_state ("taint", v_stop); /* { dg-warning "state: 'stop'" } */ + + /* Check all combinations of taintedness state. */ + __analyzer_dump_state ("taint", v_start + v_start); /* { dg-warning "state: 'start'" } */ + __analyzer_dump_state ("taint", v_start + v_tainted); /* { dg-warning "state: 'tainted'" } */ + __analyzer_dump_state ("taint", v_start + v_has_lb); /* { dg-warning "state: 'has_lb'" } */ + __analyzer_dump_state ("taint", v_start + v_has_ub); /* { dg-warning "state: 'has_ub'" } */ + __analyzer_dump_state ("taint", v_start + v_stop); /* { dg-warning "state: 'stop'" } */ + + __analyzer_dump_state ("taint", v_tainted + v_start); /* { dg-warning "state: 'tainted'" } */ + __analyzer_dump_state ("taint", v_tainted + v_tainted); /* { dg-warning "state: 'tainted'" } */ + __analyzer_dump_state ("taint", v_tainted + v_has_lb); /* { dg-warning "state: 'tainted'" } */ + __analyzer_dump_state ("taint", v_tainted + v_has_ub); /* { dg-warning "state: 'tainted'" } */ + __analyzer_dump_state ("taint", v_tainted + v_stop); /* { dg-warning "state: 'tainted'" } */ + + __analyzer_dump_state ("taint", v_has_lb + v_start); /* { dg-warning "state: 'has_lb'" } */ + __analyzer_dump_state ("taint", v_has_lb + v_tainted); /* { dg-warning "state: 'tainted'" } */ + __analyzer_dump_state ("taint", v_has_lb + v_has_lb); /* { dg-warning "state: 'has_lb'" } */ + __analyzer_dump_state ("taint", v_has_lb + v_has_ub); /* { dg-warning "state: 'tainted'" } */ + __analyzer_dump_state ("taint", v_has_lb + v_stop); /* { dg-warning "state: 'has_lb'" } */ + + __analyzer_dump_state ("taint", v_has_ub + v_start); /* { dg-warning "state: 'has_ub'" } */ + __analyzer_dump_state ("taint", v_has_ub + v_tainted); /* { dg-warning "state: 'tainted'" } */ + __analyzer_dump_state ("taint", v_has_ub + v_has_lb); /* { dg-warning "state: 'tainted'" } */ + __analyzer_dump_state ("taint", v_has_ub + v_has_ub); /* { dg-warning "state: 'has_ub'" } */ + __analyzer_dump_state ("taint", v_has_ub + v_stop); /* { dg-warning "state: 'has_ub'" } */ + + __analyzer_dump_state ("taint", v_stop + v_start); /* { dg-warning "state: 'stop'" } */ + __analyzer_dump_state ("taint", v_stop + v_tainted); /* { dg-warning "state: 'tainted'" } */ + __analyzer_dump_state ("taint", v_stop + v_has_lb); /* { dg-warning "state: 'has_lb'" } */ + __analyzer_dump_state ("taint", v_stop + v_has_ub); /* { dg-warning "state: 'has_ub'" } */ + __analyzer_dump_state ("taint", v_stop + v_stop); /* { dg-warning "state: 'stop'" } */ +} diff --git a/gcc/testsuite/c-c++-common/analyzer/taint-realloc.c b/gcc/testsuite/c-c++-common/analyzer/taint-realloc.c new file mode 100644 index 0000000..aeefb7d --- /dev/null +++ b/gcc/testsuite/c-c++-common/analyzer/taint-realloc.c @@ -0,0 +1,18 @@ +#include "analyzer-decls.h" +#include +#include +#include + +/* realloc with tainted size. */ + +void *p; + +void __attribute__((tainted_args)) +test_1 (size_t sz) /* { dg-message "\\(1\\) function 'test_1' marked with '__attribute__\\(\\(tainted_args\\)\\)'" } */ +{ + void *q; + + __analyzer_dump_state ("taint", sz); /* { dg-warning "state: 'tainted'" } */ + + q = realloc (p, sz); /* { dg-warning "use of attacker-controlled value 'sz' as allocation size without upper-bounds checking" } */ +} /* { dg-warning "leak of 'q'" } */ diff --git a/gcc/testsuite/c-c++-common/analyzer/uninit-1.c b/gcc/testsuite/c-c++-common/analyzer/uninit-1.c new file mode 100644 index 0000000..3d10216 --- /dev/null +++ b/gcc/testsuite/c-c++-common/analyzer/uninit-1.c @@ -0,0 +1,148 @@ +#include "analyzer-decls.h" +typedef __SIZE_TYPE__ size_t; + +int test_1 (void) +{ + int i; /* { dg-message "region created on stack here" } */ + return i; /* { dg-warning "use of uninitialized value 'i'" } */ +} + +int test_2 (void) +{ + int i; /* { dg-message "region created on stack here" } */ + return i * 2; /* { dg-warning "use of uninitialized value 'i'" } */ +} + +int test_3 (void) +{ + static int i; + return i; +} + +int test_4 (void) +{ + int *p; /* { dg-message "region created on stack here" } */ + return *p; /* { dg-warning "use of uninitialized value 'p'" } */ +} + +int test_5 (int flag, int *q) +{ + int *p; /* { dg-message "region created on stack here" } */ + if (flag) /* { dg-message "following 'false' branch" } */ + p = q; + + /* There should be two enodes here, + i.e. not merging the init vs non-init states. */ + __analyzer_dump_exploded_nodes (0); /* { dg-warning "2 processed enodes" } */ + + return *p; /* { dg-warning "use of uninitialized value 'p'" } */ +} + +int test_6 (int i) +{ + int arr[10]; /* { dg-message "region created on stack here" } */ + return arr[i]; /* { dg-warning "use of uninitialized value 'arr\\\[i\\\]'" } */ +} + +int test_rshift_rhs (int i) +{ + int j; /* { dg-message "region created on stack here" } */ + return i >> j; /* { dg-warning "use of uninitialized value 'j'" } */ +} + +int test_lshift_rhs (int i) +{ + int j; /* { dg-message "region created on stack here" } */ + return i << j; /* { dg-warning "use of uninitialized value 'j'" } */ +} + +int test_rshift_lhs (int i) +{ + int j; /* { dg-message "region created on stack here" } */ + return j >> i; /* { dg-warning "use of uninitialized value 'j'" } */ +} + +int test_lshift_lhs (int i) +{ + int j; /* { dg-message "region created on stack here" } */ + return j << i; /* { dg-warning "use of uninitialized value 'j'" } */ +} + +int test_cmp (int i) +{ + int j; /* { dg-message "region created on stack here" } */ + return i < j; /* { dg-warning "use of uninitialized value 'j'" } */ +} + +float test_plus_rhs (float x) +{ + float y; /* { dg-message "region created on stack here" } */ + return x + y; /* { dg-warning "use of uninitialized value 'y'" } */ +} + +float test_plus_lhs (float x) +{ + float y; /* { dg-message "region created on stack here" } */ + return y + x; /* { dg-warning "use of uninitialized value 'y'" } */ +} + +float test_minus_rhs (float x) +{ + float y; /* { dg-message "region created on stack here" } */ + return x - y; /* { dg-warning "use of uninitialized value 'y'" } */ +} + +float test_minus_lhs (float x) +{ + float y; /* { dg-message "region created on stack here" } */ + return y - x; /* { dg-warning "use of uninitialized value 'y'" } */ +} + +float test_times_rhs (float x) +{ + float y; /* { dg-message "region created on stack here" } */ + return x * y; /* { dg-warning "use of uninitialized value 'y'" } */ +} + +float test_times_lhs (float x) +{ + float y; /* { dg-message "region created on stack here" } */ + return y * x; /* { dg-warning "use of uninitialized value 'y'" } */ +} + +float test_divide_rhs (float x) +{ + float y; /* { dg-message "region created on stack here" } */ + return x / y; /* { dg-warning "use of uninitialized value 'y'" } */ +} + +float test_divide_lhs (float x) +{ + float y; /* { dg-message "region created on stack here" } */ + return y / x; /* { dg-warning "use of uninitialized value 'y'" } */ +} + +size_t test_builtin_strlen (void) +{ + const char *ptr; /* { dg-message "region created on stack here" } */ + return __builtin_strlen (ptr); /* { dg-warning "use of uninitialized value 'ptr'" } */ +} + +void test_calling_uninit_fn_ptr_1 (void) +{ + void (*fn_ptr) (void); /* { dg-message "region created on stack here" } */ + fn_ptr (); /* { dg-warning "use of uninitialized value 'fn_ptr'" } */ +} + +int test_calling_uninit_fn_ptr_2 (void) +{ + int (*fn_ptr) (void); /* { dg-message "region created on stack here" } */ + return fn_ptr (); /* { dg-warning "use of uninitialized value 'fn_ptr'" } */ +} + +extern void called_by_uninit_arg (int); +void test_passing_uninit_arg (void) +{ + int i; /* { dg-message "region created on stack here" } */ + called_by_uninit_arg (i); /* { dg-warning "use of uninitialized value 'i'" } */ +} diff --git a/gcc/testsuite/c-c++-common/analyzer/uninit-2.c b/gcc/testsuite/c-c++-common/analyzer/uninit-2.c new file mode 100644 index 0000000..0b0b8b6 --- /dev/null +++ b/gcc/testsuite/c-c++-common/analyzer/uninit-2.c @@ -0,0 +1,14 @@ +typedef __SIZE_TYPE__ size_t; + +extern size_t strlen (const char *__s) + __attribute__ ((__nothrow__ , __leaf__)) + __attribute__ ((__pure__)) + __attribute__ ((__nonnull__ (1))); + +extern char *read_file (const char *file); + +size_t test_1 (const char *file) +{ + char *str = read_file (file); + return strlen (str); +} diff --git a/gcc/testsuite/c-c++-common/analyzer/uninit-3.c b/gcc/testsuite/c-c++-common/analyzer/uninit-3.c new file mode 100644 index 0000000..fa33e0a --- /dev/null +++ b/gcc/testsuite/c-c++-common/analyzer/uninit-3.c @@ -0,0 +1,36 @@ +/* Reduced from linux 5.3.11: drivers/net/wireless/ath/ath10k/usb.c */ + +/* The original file has this licence header. */ + +// SPDX-License-Identifier: ISC +/* + * Copyright (c) 2007-2011 Atheros Communications Inc. + * Copyright (c) 2011-2012,2017 Qualcomm Atheros, Inc. + * Copyright (c) 2016-2017 Erik Stromdahl + */ + +/* Adapted from include/linux/compiler_attributes.h. */ +#define __printf(a, b) __attribute__((__format__(printf, a, b))) + +/* From drivers/net/wireless/ath/ath10k/core.h. */ + +struct ath10k; + +/* From drivers/net/wireless/ath/ath10k/debug.h. */ + +enum ath10k_debug_mask { + /* [...other values removed...] */ + ATH10K_DBG_USB_BULK = 0x00080000, +}; + +extern unsigned int ath10k_debug_mask; + +__printf(3, 4) void __ath10k_dbg(struct ath10k *ar, + enum ath10k_debug_mask mask, + const char *fmt, ...); + +static void ath10k_usb_hif_tx_sg(struct ath10k *ar) +{ + if (ath10k_debug_mask & ATH10K_DBG_USB_BULK) + __ath10k_dbg(ar, ATH10K_DBG_USB_BULK, "usb bulk transmit failed: %d\n", 42); +} diff --git a/gcc/testsuite/c-c++-common/analyzer/uninit-6.c b/gcc/testsuite/c-c++-common/analyzer/uninit-6.c new file mode 100644 index 0000000..75a99ad --- /dev/null +++ b/gcc/testsuite/c-c++-common/analyzer/uninit-6.c @@ -0,0 +1,29 @@ +/* Reduced from uninit false positive seen on Linux kernel with + net/ethtool/ioctl.c */ + +typedef signed char s8; +typedef unsigned int u32; +typedef __SIZE_TYPE__ size_t; + +void *memset(void *s, int c, size_t n); + +struct ethtool_link_settings { + u32 cmd; + s8 link_mode_masks_nwords; +}; + +struct ethtool_link_ksettings { + struct ethtool_link_settings base; + u32 lanes; +}; + +struct ethtool_link_settings +ethtool_get_link_ksettings(void) { + struct ethtool_link_ksettings link_ksettings; + + memset(&link_ksettings, 0, sizeof(link_ksettings)); + link_ksettings.base.cmd = 0x0000004c; + link_ksettings.base.link_mode_masks_nwords = -3; + + return link_ksettings.base; +} diff --git a/gcc/testsuite/c-c++-common/analyzer/uninit-6b.c b/gcc/testsuite/c-c++-common/analyzer/uninit-6b.c new file mode 100644 index 0000000..32ba30f --- /dev/null +++ b/gcc/testsuite/c-c++-common/analyzer/uninit-6b.c @@ -0,0 +1,29 @@ +/* Reduced from uninit false positive seen on Linux kernel with + net/ethtool/ioctl.c */ + +typedef signed char s8; +typedef unsigned int u32; +typedef __SIZE_TYPE__ size_t; + +void *memset(void *s, int c, size_t n); + +struct ethtool_link_settings { + u32 cmd; + s8 link_mode_masks_nwords; +}; + +struct ethtool_link_ksettings { + u32 lanes; + struct ethtool_link_settings base; +}; + +struct ethtool_link_settings +ethtool_get_link_ksettings(void) { + struct ethtool_link_ksettings link_ksettings; + + memset(&link_ksettings, 0, sizeof(link_ksettings)); + link_ksettings.base.cmd = 0x0000004c; + link_ksettings.base.link_mode_masks_nwords = -3; + + return link_ksettings.base; +} diff --git a/gcc/testsuite/c-c++-common/analyzer/uninit-8.c b/gcc/testsuite/c-c++-common/analyzer/uninit-8.c new file mode 100644 index 0000000..2fa1052 --- /dev/null +++ b/gcc/testsuite/c-c++-common/analyzer/uninit-8.c @@ -0,0 +1,73 @@ +struct st +{ + int a, b, c, d, e; +}; + +int +test_1 (int flag, struct st *p) +{ + struct st *q; + int result = 0; + if (flag) + q = p; + /* We should only warn about the first use of uninit for 'q': */ + result += q->a; /* { dg-warning "use of uninitialized value 'q'" } */ + /* ...and not for these: */ + result += q->b; /* { dg-bogus "use of uninitialized value 'q'" } */ + result += q->c; /* { dg-bogus "use of uninitialized value 'q'" } */ + result += q->d; /* { dg-bogus "use of uninitialized value 'q'" } */ + result += q->e; /* { dg-bogus "use of uninitialized value 'q'" } */ + return result; +} + +int +test_2 (int flag, struct st *p, struct st *r) +{ + struct st *q; + int result = 0; + if (flag) + q = p; + /* We should only warn about the first use of uninit for 'q': */ + if (q == r) /* { dg-warning "use of uninitialized value 'q'" } */ + result += 1; + /* ...and not for these, after a conditional: */ + result += q->b; /* { dg-bogus "use of uninitialized value 'q'" } */ + result += q->c; /* { dg-bogus "use of uninitialized value 'q'" } */ + result += q->d; /* { dg-bogus "use of uninitialized value 'q'" } */ + result += q->e; /* { dg-bogus "use of uninitialized value 'q'" } */ + return result; +} + +int +test_3 (int flag, int val) +{ + int result = 0; + int idx; + if (flag) + idx = val; + switch (idx) /* { dg-warning "use of uninitialized value 'idx'" } */ + { + case 0: + result = 3; + break; + case 1: + result = 4; + break; + default: + result = 5; + break; + } + switch (idx) /* { dg-bogus "use of uninitialized value 'idx'" } */ + { + case 0: + result += 3; + break; + case 1: + result += 4; + break; + default: + result += 5; + break; + } + return result; +} diff --git a/gcc/testsuite/c-c++-common/analyzer/uninit-pr104576.c b/gcc/testsuite/c-c++-common/analyzer/uninit-pr104576.c new file mode 100644 index 0000000..0b59acd --- /dev/null +++ b/gcc/testsuite/c-c++-common/analyzer/uninit-pr104576.c @@ -0,0 +1,16 @@ +float +test_1 (int *flag, float theta) +{ + float t; + float f; + + if (*flag) + t = 2.0f; + + f = __builtin_sinf (theta); + + if (*flag) + f *= t; + + return f; +} diff --git a/gcc/testsuite/c-c++-common/analyzer/uninit-pr106204.c b/gcc/testsuite/c-c++-common/analyzer/uninit-pr106204.c new file mode 100644 index 0000000..7d7cf7b --- /dev/null +++ b/gcc/testsuite/c-c++-common/analyzer/uninit-pr106204.c @@ -0,0 +1,17 @@ +/* { dg-additional-options "-ftrivial-auto-var-init=zero" } */ + +int foo(unsigned *len); + +/* Modified version of reproducer that does use "len" before init. */ + +int test_2() +{ + unsigned len; + int rc; + + rc = len; /* { dg-warning "use of uninitialized value 'len'" } */ + rc = foo(&len); + if (!rc) + rc = len; + return rc; +} diff --git a/gcc/testsuite/c-c++-common/analyzer/uninit-pr108704.c b/gcc/testsuite/c-c++-common/analyzer/uninit-pr108704.c new file mode 100644 index 0000000..ebf8151 --- /dev/null +++ b/gcc/testsuite/c-c++-common/analyzer/uninit-pr108704.c @@ -0,0 +1,29 @@ +typedef unsigned short int __uint16_t; +typedef unsigned int __uint32_t; +typedef unsigned long int __uint64_t; +typedef __uint16_t uint16_t; +typedef __uint32_t uint32_t; +typedef __uint64_t uint64_t; + +typedef uint32_t float32; +typedef struct +{ + uint64_t low; + uint16_t high; +} floatx80; + +extern floatx80 +float32_to_floatx80(float32); + +extern floatx80 +floatx80_add(floatx80, floatx80); + +floatx80 +test (floatx80 a) +{ + floatx80 fp0; + + fp0 = a; + fp0 = floatx80_add(fp0, float32_to_floatx80((0x3F800000))); /* { dg-bogus "use of uninitialized value 'fp0'" } */ + return fp0; +} diff --git a/gcc/testsuite/c-c++-common/analyzer/uninit-pr108806-qemu.c b/gcc/testsuite/c-c++-common/analyzer/uninit-pr108806-qemu.c new file mode 100644 index 0000000..0927201 --- /dev/null +++ b/gcc/testsuite/c-c++-common/analyzer/uninit-pr108806-qemu.c @@ -0,0 +1,110 @@ +/* Reduced from qemu-7.2.0's hw/intc/omap_intc.c as per + null-deref-pr108806.c, but with the: + struct omap_intr_handler_bank_s* bank = NULL; + converted to: + struct omap_intr_handler_bank_s* bank; + */ + +/* { dg-additional-options "-Wno-analyzer-symbol-too-complex" } */ + +typedef unsigned char __uint8_t; +typedef unsigned int __uint32_t; +typedef unsigned long int __uint64_t; +typedef __uint8_t uint8_t; +typedef __uint32_t uint32_t; +typedef __uint64_t uint64_t; +typedef uint64_t hwaddr; +typedef struct omap_intr_handler_s omap_intr_handler; + +struct omap_intr_handler_bank_s +{ + uint32_t irqs; + uint32_t inputs; + uint32_t mask; + uint32_t fiq; + uint32_t sens_edge; + uint32_t swi; + unsigned char priority[32]; +}; + +struct omap_intr_handler_s +{ + /* [...snip...] */ + unsigned char nbanks; + /* [...snip...] */ + int sir_intr[2]; + int autoidle; + uint32_t mask; + struct omap_intr_handler_bank_s bank[3]; +}; + +uint64_t +omap2_inth_read(struct omap_intr_handler_s* s, int offset) +{ + int bank_no, line_no; + struct omap_intr_handler_bank_s* bank; + + if ((offset & 0xf80) == 0x80) { + bank_no = (offset & 0x60) >> 5; + if (bank_no < s->nbanks) { + offset &= ~0x60; + bank = &s->bank[bank_no]; + } else { + return 0; + } + } + + switch (offset) { + case 0x10: + return (s->autoidle >> 2) & 1; + + case 0x14: + return 1; + + case 0x40: + return s->sir_intr[0]; + + case 0x44: + return s->sir_intr[1]; + + case 0x48: + return (!s->mask) << 2; + + case 0x4c: + return 0; + + case 0x50: + return s->autoidle & 3; + + case 0x80: + return bank->inputs; /* { dg-bogus "use of uninitialized value 'bank'" "PR analyzer/108806" } */ + + case 0x84: + return bank->mask; /* { dg-bogus "use of uninitialized value 'bank'" "PR analyzer/108806" } */ + + case 0x88: + case 0x8c: + return 0; + + case 0x90: + return bank->swi; /* { dg-bogus "use of uninitialized value 'bank'" "PR analyzer/108806" } */ + + case 0x94: + return 0; + + case 0x98: + return bank->irqs & ~bank->mask & ~bank->fiq; /* { dg-bogus "use of uninitialized value 'bank'" "PR analyzer/108806" } */ + + case 0x9c: + return bank->irqs & ~bank->mask & bank->fiq; /* { dg-bogus "use of uninitialized value 'bank'" "PR analyzer/108806" } */ + + case 0x100 ... 0x300: + bank_no = (offset - 0x100) >> 7; + if (bank_no > s->nbanks) + break; + bank = &s->bank[bank_no]; + line_no = (offset & 0x7f) >> 2; + return (bank->priority[line_no] << 2) | ((bank->fiq >> line_no) & 1); + } + return 0; +} diff --git a/gcc/testsuite/c-c++-common/analyzer/uninit-pr108968-register.c b/gcc/testsuite/c-c++-common/analyzer/uninit-pr108968-register.c new file mode 100644 index 0000000..a76c09e --- /dev/null +++ b/gcc/testsuite/c-c++-common/analyzer/uninit-pr108968-register.c @@ -0,0 +1,9 @@ +/* { dg-do compile { target x86_64-*-* } } */ + +#define STACK_SIZE 4096 +struct cpu_info {}; +struct cpu_info *get_cpu_info(void) +{ + register unsigned long sp asm("rsp"); + return (struct cpu_info *)((sp | (STACK_SIZE - 1)) + 1) - 1; /* { dg-bogus "use of uninitialized value 'sp'" } */ +} diff --git a/gcc/testsuite/c-c++-common/analyzer/uninit-pr94713.c b/gcc/testsuite/c-c++-common/analyzer/uninit-pr94713.c new file mode 100644 index 0000000..cb91462 --- /dev/null +++ b/gcc/testsuite/c-c++-common/analyzer/uninit-pr94713.c @@ -0,0 +1,19 @@ +void f1 (int *); +void f2 (int); + +int test_1 (void) +{ + int *p; /* { dg-message "region created on stack here" } */ + + f1 (p); /* { dg-warning "use of uninitialized value 'p'" } */ + f1 (p); /* { dg-bogus "use of uninitialized value 'p'" "no followup warnings" } */ + return 0; +} + +int test_2 (void) +{ + int *p; /* { dg-message "region created on stack here" } */ + + f2 (p[0]); /* { dg-warning "use of uninitialized value 'p'" } */ + return 0; +} diff --git a/gcc/testsuite/c-c++-common/analyzer/uninit-pr94714.c b/gcc/testsuite/c-c++-common/analyzer/uninit-pr94714.c new file mode 100644 index 0000000..f120901 --- /dev/null +++ b/gcc/testsuite/c-c++-common/analyzer/uninit-pr94714.c @@ -0,0 +1,12 @@ +#include + +int main (void) +{ + int *p; + int i; /* { dg-message "region created on stack here" } */ + + p = &i; /* { dg-bogus "uninitialized" } */ + printf ("%d\n", p[0]); /* { dg-warning "use of uninitialized value '\\*p'" } */ + + return 0; +} diff --git a/gcc/testsuite/c-c++-common/analyzer/unknown-fns-2.c b/gcc/testsuite/c-c++-common/analyzer/unknown-fns-2.c new file mode 100644 index 0000000..1c4bdd6 --- /dev/null +++ b/gcc/testsuite/c-c++-common/analyzer/unknown-fns-2.c @@ -0,0 +1,238 @@ +/* Tests for data model handling of unknown fns. */ + +#include +#include "analyzer-decls.h" + +void unknown_fn (void *); + +void test_1 (void) +{ + int i; + + i = 42; + __analyzer_eval (i == 42); /* { dg-warning "TRUE" } */ + + unknown_fn (NULL); + __analyzer_eval (i == 42); /* { dg-warning "TRUE" } */ + + unknown_fn (&i); + __analyzer_eval (i == 42); /* { dg-warning "UNKNOWN" } */ + + i = 17; + __analyzer_eval (i == 17); /* { dg-warning "TRUE" } */ + + /* Even though we're not passing &i to unknown_fn, it escaped + above, so unknown_fn could write to it. */ + unknown_fn (NULL); + __analyzer_eval (i == 17); /* { dg-warning "UNKNOWN" } */ +} + +/* As test_1, but with an unknown fn_ptr. */ + +void test_1a (void (*fn_ptr) (void *)) +{ + int i; + + i = 42; + __analyzer_eval (i == 42); /* { dg-warning "TRUE" } */ + + fn_ptr (NULL); + __analyzer_eval (i == 42); /* { dg-warning "TRUE" } */ + + fn_ptr (&i); + __analyzer_eval (i == 42); /* { dg-warning "UNKNOWN" } */ + + i = 17; + __analyzer_eval (i == 17); /* { dg-warning "TRUE" } */ + + /* Even though we're not passing &i to unknown_fn, it escaped + above, so fn_ptr (NULL) could write to it. */ + fn_ptr (NULL); + __analyzer_eval (i == 17); /* { dg-warning "UNKNOWN" } */ +} + +int *global_for_test_2; + +void test_2 (void) +{ + int i; + + i = 42; + __analyzer_eval (i == 42); /* { dg-warning "TRUE" } */ + + global_for_test_2 = &i; + unknown_fn (NULL); + __analyzer_eval (i == 42); /* { dg-warning "UNKNOWN" } */ + + global_for_test_2 = NULL; + + i = 17; + __analyzer_eval (i == 17); /* { dg-warning "TRUE" } */ + + /* Even though the global no longer points to i, it escaped + above, so unknown_fn could write to it. */ + unknown_fn (NULL); + __analyzer_eval (i == 17); /* { dg-warning "UNKNOWN" } */ +} + +struct used_by_test_3 +{ + int *int_ptr; +}; + +void test_3 (void) +{ + int i; + + struct used_by_test_3 s; + s.int_ptr = &i; + + i = 42; + __analyzer_eval (i == 42); /* { dg-warning "TRUE" } */ + + unknown_fn (NULL); + __analyzer_eval (i == 42); /* { dg-warning "TRUE" } */ + __analyzer_eval (s.int_ptr == &i); /* { dg-warning "TRUE" } */ + + /* i should escape here. */ + unknown_fn (&s); + __analyzer_eval (i == 42); /* { dg-warning "UNKNOWN" } */ + __analyzer_eval (s.int_ptr == &i); /* { dg-warning "UNKNOWN" } */ + + s.int_ptr = NULL; + __analyzer_eval (s.int_ptr == NULL); /* { dg-warning "TRUE" } */ + + i = 17; + __analyzer_eval (i == 17); /* { dg-warning "TRUE" } */ + + /* Even though nothing we know about points to i, it escaped + above, so unknown_fn could write to it. */ + unknown_fn (NULL); + __analyzer_eval (i == 17); /* { dg-warning "UNKNOWN" } */ +} + +struct used_by_test_4 +{ + int *int_ptr; +}; + +void test_4 (struct used_by_test_4 *st4_ptr) +{ + /* Something unknown called "test_4", and hence *st4_ptr has + effectively already escaped. */ + + int i = 42; + __analyzer_eval (i == 42); /* { dg-warning "TRUE" } */ + + unknown_fn (NULL); + __analyzer_eval (i == 42); /* { dg-warning "TRUE" } */ + + /* Given that *st4_ptr has effectively already escaped, calling + an unknown fn should invalidate our knowledge of i". */ + st4_ptr->int_ptr = &i; + unknown_fn (NULL); + __analyzer_eval (i == 42); /* { dg-warning "UNKNOWN" } */ + + /* ...and "&i" should now be treated as having escaped. */ + i = 17; + __analyzer_eval (i == 17); /* { dg-warning "TRUE" } */ + st4_ptr->int_ptr = NULL; + unknown_fn (NULL); + __analyzer_eval (i == 17); /* { dg-warning "UNKNOWN" } */ +} + +static void __attribute__((noinline)) +known_fn (void *ptr) +{ + /* Empty. */ +} + +void test_5 (void) +{ + int i; + + i = 42; + __analyzer_eval (i == 42); /* { dg-warning "TRUE" } */ + + known_fn (&i); + __analyzer_eval (i == 42); /* { dg-warning "TRUE" } */ + + i = 17; + __analyzer_eval (i == 17); /* { dg-warning "TRUE" } */ + + /* Ensure that we don't consider &i to have escaped. */ + unknown_fn (NULL); + __analyzer_eval (i == 17); /* { dg-warning "TRUE" } */ +} + +extern int __attribute__ ((__pure__)) +unknown_pure_fn (void *); + +void test_6 (void) +{ + int i; + + i = 42; + __analyzer_eval (i == 42); /* { dg-warning "TRUE" } */ + + unknown_pure_fn (&i); + __analyzer_eval (i == 42); /* { dg-warning "TRUE" } */ + + i = 17; + __analyzer_eval (i == 17); /* { dg-warning "TRUE" } */ + + /* Ensure that we don't consider &i to have escaped. */ + unknown_fn (NULL); + __analyzer_eval (i == 17); /* { dg-warning "TRUE" } */ +} + +extern void unknown_const_fn (const void *); + +void test_7 (void) +{ + int i; + + i = 42; + __analyzer_eval (i == 42); /* { dg-warning "TRUE" } */ + + /* &i is passed as a const void *, so i shouldn't be clobbered by + the call. */ + unknown_const_fn (&i); + __analyzer_eval (i == 42); /* { dg-warning "TRUE" } */ + + i = 17; + __analyzer_eval (i == 17); /* { dg-warning "TRUE" } */ + + /* Ensure that we don't consider &i to have escaped. */ + unknown_fn (NULL); + __analyzer_eval (i == 17); /* { dg-warning "TRUE" } */ +} + +struct used_by_test_8 +{ + int *int_ptr; +}; + +void test_8 (void) +{ + int i; + + i = 42; + __analyzer_eval (i == 42); /* { dg-warning "TRUE" } */ + + struct used_by_test_8 st8; + st8.int_ptr = &i; + + /* Although unknown_const_fn takes a const void *, the + int_ptr is a non-const int *, and so &i should be considered + writable. */ + unknown_const_fn (&st8); + __analyzer_eval (i == 42); /* { dg-warning "UNKNOWN" } */ + + i = 17; + __analyzer_eval (i == 17); /* { dg-warning "TRUE" } */ + + /* &i should be considered to have escaped. */ + unknown_fn (NULL); + __analyzer_eval (i == 17); /* { dg-warning "UNKNOWN" } */ +} diff --git a/gcc/testsuite/c-c++-common/analyzer/unknown-fns-3.c b/gcc/testsuite/c-c++-common/analyzer/unknown-fns-3.c new file mode 100644 index 0000000..095df5e --- /dev/null +++ b/gcc/testsuite/c-c++-common/analyzer/unknown-fns-3.c @@ -0,0 +1,67 @@ +/* Tests for handling constraints on results of unknown fns. */ + +#include +#include "analyzer-decls.h" + +void unknown_fn (void *); + +void test_1 (void) +{ + int i; + unknown_fn (&i); + if (i) + __analyzer_eval (i); /* { dg-warning "TRUE" } */ + else + __analyzer_eval (i); /* { dg-warning "FALSE" } */ + __analyzer_dump_exploded_nodes (0); /* { dg-warning "1 processed enode" } */ +} + +struct foo +{ + int i; + int j; +}; + +void test_2 (void) +{ + struct foo f; + unknown_fn (&f); + if (f.j) + __analyzer_eval (f.j); /* { dg-warning "TRUE" } */ + else + __analyzer_eval (f.j); /* { dg-warning "FALSE" } */ + __analyzer_dump_exploded_nodes (0); /* { dg-warning "1 processed enode" } */ +} + +void test_3 (int flag) +{ + int i; + unknown_fn (&i); + if (i) + { + __analyzer_eval (i); /* { dg-warning "TRUE" } */ + if (flag) + __analyzer_eval (flag); /* { dg-warning "TRUE" } */ + else + __analyzer_eval (flag); /* { dg-warning "FALSE" } */ + } + else + __analyzer_eval (i); /* { dg-warning "FALSE" } */ + if (flag) + __analyzer_eval (flag); /* { dg-warning "TRUE" } */ + else + __analyzer_eval (flag); /* { dg-warning "FALSE" } */ + __analyzer_dump_exploded_nodes (0); /* { dg-warning "1 processed enode" } */ +} + +void test_4 (int y) +{ + int x; + unknown_fn (&x); + if (x) + { + __analyzer_eval (x); /* { dg-warning "TRUE" } */ + x = 0; + } + __analyzer_dump_exploded_nodes (0); /* { dg-warning "1 processed enode" } */ +} diff --git a/gcc/testsuite/c-c++-common/analyzer/unknown-fns-4.c b/gcc/testsuite/c-c++-common/analyzer/unknown-fns-4.c new file mode 100644 index 0000000..bd1ab1e --- /dev/null +++ b/gcc/testsuite/c-c++-common/analyzer/unknown-fns-4.c @@ -0,0 +1,15 @@ +#include "analyzer-decls.h" + +int get(void); +void test (void) +{ + int got = 0; + while (1) + { + if (get ()) + got = 1; + else + if (got) + __analyzer_dump_path (); /* { dg-message "path" } */ + } +} diff --git a/gcc/testsuite/c-c++-common/analyzer/unused-local-1.c b/gcc/testsuite/c-c++-common/analyzer/unused-local-1.c new file mode 100644 index 0000000..361cdce --- /dev/null +++ b/gcc/testsuite/c-c++-common/analyzer/unused-local-1.c @@ -0,0 +1,22 @@ +/* { dg-additional-options "-fdump-analyzer-untracked" } */ + +struct st +{ + const char *m_filename; + int m_line; + const char *m_function; +}; + +extern void debug (struct st *); + +void test (void) +{ + { + static struct st s1 = { __FILE__, __LINE__, __func__ }; /* { dg-warning "track 's1': no" } */ + debug (&s1); + } + { + static struct st s2 = { __FILE__, __LINE__, __func__ }; /* { dg-warning "track 's2': no" } */ + debug (&s2); + } +} diff --git a/gcc/testsuite/c-c++-common/analyzer/use-after-free-2.c b/gcc/testsuite/c-c++-common/analyzer/use-after-free-2.c new file mode 100644 index 0000000..fc138ee --- /dev/null +++ b/gcc/testsuite/c-c++-common/analyzer/use-after-free-2.c @@ -0,0 +1,8 @@ +int test (void) +{ + int *ptr = (int *)__builtin_malloc (sizeof (int)); + *ptr = 42; /* { dg-warning "dereference of possibly-NULL 'ptr'" } */ + __builtin_free (ptr); + + return *ptr; /* { dg-warning "use after 'free' of 'ptr'" "use-after-free" } */ +} diff --git a/gcc/testsuite/c-c++-common/analyzer/use-after-free-3.c b/gcc/testsuite/c-c++-common/analyzer/use-after-free-3.c new file mode 100644 index 0000000..b19fd3d --- /dev/null +++ b/gcc/testsuite/c-c++-common/analyzer/use-after-free-3.c @@ -0,0 +1,12 @@ +#include + +void test_1 (int x, int y, int *out) +{ + int *ptr = (int *)malloc (sizeof (int)); + if (!ptr) + return; + *ptr = 19; + + free (ptr); + *out = *ptr; /* { dg-warning "use after 'free' of 'ptr'" } */ +} diff --git a/gcc/testsuite/c-c++-common/analyzer/vsnprintf-1.c b/gcc/testsuite/c-c++-common/analyzer/vsnprintf-1.c new file mode 100644 index 0000000..209c4b6 --- /dev/null +++ b/gcc/testsuite/c-c++-common/analyzer/vsnprintf-1.c @@ -0,0 +1,11 @@ +typedef __SIZE_TYPE__ size_t; + +int +my_snprintf(char *pos, size_t left, const char *fmt, ...) +{ + __builtin_va_list ap; + __builtin_va_start(ap, fmt); + const int len = __builtin_vsnprintf(pos, left, fmt, ap); + __builtin_va_end(ap); + return len; +} diff --git a/gcc/testsuite/c-c++-common/analyzer/zlib-1.c b/gcc/testsuite/c-c++-common/analyzer/zlib-1.c new file mode 100644 index 0000000..171af3d --- /dev/null +++ b/gcc/testsuite/c-c++-common/analyzer/zlib-1.c @@ -0,0 +1,64 @@ +#include "analyzer-decls.h" + +typedef void (*free_func)(void *opaque, void *address); + +typedef struct z_stream_s { + struct internal_state *state; + free_func zfree; + void *opaque; +} z_stream; + +struct internal_state { + z_stream *strm; + int status; + unsigned char *pending_buf; + unsigned char *window; + unsigned short *prev; + unsigned short *head; +}; + +int deflateEnd(z_stream *strm) +{ + int status; + + __analyzer_dump_exploded_nodes (0); /* { dg-warning "1 processed enode" } */ + + if (strm == 0 || strm->state == 0) + return (-2); + + __analyzer_dump_exploded_nodes (0); /* { dg-warning "1 processed enode" } */ + + status = strm->state->status; + if (status != 42 && status != 113 && status != 666) { + return (-2); + } + + __analyzer_dump_exploded_nodes (0); /* { dg-warning "1 processed enode" } */ + + if (strm->state->pending_buf) + (*(strm->zfree))(strm->opaque, (void *)(strm->state->pending_buf)); + + __analyzer_dump_exploded_nodes (0); /* { dg-warning "1 processed enode" } */ + + if (strm->state->head) + (*(strm->zfree))(strm->opaque, (void *)(strm->state->head)); + + __analyzer_dump_exploded_nodes (0); /* { dg-warning "1 processed enode" } */ + + if (strm->state->prev) + (*(strm->zfree))(strm->opaque, (void *)(strm->state->prev)); + + __analyzer_dump_exploded_nodes (0); /* { dg-warning "1 processed enode" } */ + + if (strm->state->window) + (*(strm->zfree))(strm->opaque, (void *)(strm->state->window)); + + __analyzer_dump_exploded_nodes (0); /* { dg-warning "1 processed enode" } */ + + (*(strm->zfree))(strm->opaque, (void *)(strm->state)); + strm->state = 0; + + __analyzer_dump_exploded_nodes (0); /* { dg-warning "1 processed enode" } */ + + return status == 113 ? (-3) : 0; +} diff --git a/gcc/testsuite/c-c++-common/analyzer/zlib-2.c b/gcc/testsuite/c-c++-common/analyzer/zlib-2.c new file mode 100644 index 0000000..62163a0 --- /dev/null +++ b/gcc/testsuite/c-c++-common/analyzer/zlib-2.c @@ -0,0 +1,49 @@ +typedef void * (*alloc_func)(void * opaque, unsigned items, unsigned size); +typedef void (*free_func)(void * opaque, void * address); + +typedef struct z_stream_s { + char *msg; + alloc_func zalloc; + free_func zfree; + void * opaque; +} z_stream; + +void * zcalloc(void * opaque, unsigned items, unsigned size); +void zcfree(void * opaque, void * ptr); + +int deflateInit2_(z_stream *strm, int level, int method, int windowBits, + int memLevel, int strategy, const char *version, + int stream_size) { + int noheader = 0; + static const char *my_version = "1.1.3"; + + if (version == 0 || version[0] != my_version[0] || + stream_size != sizeof(z_stream)) { + return (-6); + } + if (strm == 0) + return (-2); + + strm->msg = 0; + if (strm->zalloc == 0) { + strm->zalloc = zcalloc; + strm->opaque = (void *)0; + } + if (strm->zfree == 0) + strm->zfree = zcfree; + + if (level == (-1)) + level = 6; + + if (windowBits < 0) { + noheader = 1; + windowBits = -windowBits; + } + if (memLevel < 1 || memLevel > 9 || method != 8 || windowBits < 8 || + windowBits > 15 || level < 0 || level > 9 || strategy < 0 || + strategy > 2) { + return (-2); + } + (*((strm)->zalloc))((strm)->opaque, (1), 112); + return 0; +} diff --git a/gcc/testsuite/c-c++-common/analyzer/zlib-4.c b/gcc/testsuite/c-c++-common/analyzer/zlib-4.c new file mode 100644 index 0000000..ae2f6c9 --- /dev/null +++ b/gcc/testsuite/c-c++-common/analyzer/zlib-4.c @@ -0,0 +1,24 @@ +#include +#include + +typedef unsigned char Byte; +typedef unsigned int uInt; +typedef unsigned long uLong; + +#define Z_NULL 0 + +int test () +{ + uLong comprLen = 10000*sizeof(int); + uLong uncomprLen = comprLen; + Byte *compr = (Byte*)calloc((uInt)comprLen, 1); + Byte *uncompr = (Byte*)calloc((uInt)uncomprLen, 1); + if (compr == Z_NULL || uncompr == Z_NULL) + { + return 1; /* { dg-warning "leak of 'uncompr'" "uncompr leak" } */ + /* { dg-warning "leak of 'compr'" "compr leak" { target *-*-* } .-1 } */ + } + strcpy((char*)uncompr, "garbage"); + return 0; /* { dg-warning "leak of 'uncompr'" "uncompr leak" } */ + /* { dg-warning "leak of 'compr'" "compr leak" { target *-*-* } .-1 } */ +} diff --git a/gcc/testsuite/c-c++-common/analyzer/zlib-5.c b/gcc/testsuite/c-c++-common/analyzer/zlib-5.c new file mode 100644 index 0000000..1e3746d --- /dev/null +++ b/gcc/testsuite/c-c++-common/analyzer/zlib-5.c @@ -0,0 +1,51 @@ +/* { dg-additional-options "-O3" } */ + +#include "analyzer-decls.h" + +typedef __SIZE_TYPE__ size_t; +typedef unsigned char Byte; +typedef unsigned int uInt; +typedef unsigned long uLong; + +extern size_t strlen(const char *__s) __attribute__((__nothrow__, __leaf__)) + __attribute__((__pure__)) __attribute__((__nonnull__(1))); +extern void exit(int __status) __attribute__((__nothrow__, __leaf__)) + __attribute__((__noreturn__)); +extern char *strcpy(char *__restrict __dest, const char *__restrict __src) + __attribute__((__nothrow__, __leaf__)) __attribute__((__nonnull__(1, 2))); +extern void *calloc(size_t __nmemb, size_t __size) + __attribute__((__nothrow__, __leaf__)) __attribute__((__malloc__)); + +extern int compress(Byte *dest, uLong *destLen, const Byte *source, + uLong sourceLen); + +const char hello[] = "hello, hello!"; + +void test_compress(Byte *compr, uLong comprLen, Byte *uncompr, + uLong uncomprLen) { + int err; + uLong len = strlen(hello) + 1; + + err = compress(compr, &comprLen, (const Byte *)hello, len); + if (err != 0) + exit(1); + strcpy((char *)uncompr, "garbage"); /* { dg-bogus "NULL" } */ +} + +int main(int argc, char *argv[]) { + Byte *compr, *uncompr; + uLong comprLen = 10000 * sizeof(int); + uLong uncomprLen = comprLen; + + compr = (Byte *)calloc((uInt)comprLen, 1); + uncompr = (Byte *)calloc((uInt)uncomprLen, 1); + if (compr == 0 || uncompr == 0) + exit(1); + + __analyzer_dump_exploded_nodes (0); /* { dg-warning "1 processed enode" } */ + + test_compress(compr, comprLen, uncompr, uncomprLen); + + exit(0); + return 0; +} diff --git a/gcc/testsuite/gcc.dg/analyzer/20020129-1.c b/gcc/testsuite/gcc.dg/analyzer/20020129-1.c deleted file mode 100644 index 7d49519..0000000 --- a/gcc/testsuite/gcc.dg/analyzer/20020129-1.c +++ /dev/null @@ -1,2 +0,0 @@ -/* { dg-require-effective-target indirect_calls } */ -#include "../../gcc.c-torture/compile/20020129-1.c" diff --git a/gcc/testsuite/gcc.dg/analyzer/SARD-tc117-basic-00001-min.c b/gcc/testsuite/gcc.dg/analyzer/SARD-tc117-basic-00001-min.c deleted file mode 100644 index e1ce195..0000000 --- a/gcc/testsuite/gcc.dg/analyzer/SARD-tc117-basic-00001-min.c +++ /dev/null @@ -1,67 +0,0 @@ -/* Adapted from https://samate.nist.gov/SARD/test-cases/117/versions/1.0.0 - Part of https://samate.nist.gov/SARD/test-suites/81 - See: - Black, P. , Koo, H. and Irish, T. (2013), A Basic CWE-121 Buffer Overflow Effectiveness Test Suite, Proc. 6th Latin-American Symposium on Dependable Computing, Rio de Janeiro, -1, [online], https://tsapps.nist.gov/publication/get_pdf.cfm?pub_id=913117 (Accessed January 17, 2023) -*/ - -/* Taxonomy Classification: 0000000000000000000100 */ - -/* - * WRITE/READ 0 write - * WHICH BOUND 0 upper - * DATA TYPE 0 char - * MEMORY LOCATION 0 stack - * SCOPE 0 same - * CONTAINER 0 no - * POINTER 0 no - * INDEX COMPLEXITY 0 constant - * ADDRESS COMPLEXITY 0 constant - * LENGTH COMPLEXITY 0 N/A - * ADDRESS ALIAS 0 none - * INDEX ALIAS 0 none - * LOCAL CONTROL FLOW 0 none - * SECONDARY CONTROL FLOW 0 none - * LOOP STRUCTURE 0 no - * LOOP COMPLEXITY 0 N/A - * ASYNCHRONY 0 no - * TAINT 0 no - * RUNTIME ENV. DEPENDENCE 0 no - * MAGNITUDE 1 1 byte - * CONTINUOUS/DISCRETE 0 discrete - * SIGNEDNESS 0 no - */ - -/* -Copyright 2004 M.I.T. - -Permission is hereby granted, without written agreement or royalty fee, to use, -copy, modify, and distribute this software and its documentation for any -purpose, provided that the above copyright notice and the following three -paragraphs appear in all copies of this software. - -IN NO EVENT SHALL M.I.T. BE LIABLE TO ANY PARTY FOR DIRECT, INDIRECT, SPECIAL, -INCIDENTAL, OR CONSEQUENTIAL DAMAGES ARISING OUT OF THE USE OF THIS SOFTWARE -AND ITS DOCUMENTATION, EVEN IF M.I.T. HAS BEEN ADVISED OF THE POSSIBILITY OF -SUCH DAMANGE. - -M.I.T. SPECIFICALLY DISCLAIMS ANY WARRANTIES INCLUDING, BUT NOT LIMITED TO -THE IMPLIED WARRANTIES OF MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE, -AND NON-INFRINGEMENT. - -THE SOFTWARE IS PROVIDED ON AN "AS-IS" BASIS AND M.I.T. HAS NO OBLIGATION TO -PROVIDE MAINTENANCE, SUPPORT, UPDATES, ENHANCEMENTS, OR MODIFICATIONS. -*/ - - -int main(int argc, char *argv[]) -{ - char buf[10]; - - - /* BAD */ - buf[10] = 'A'; /* { dg-warning "stack-based buffer overflow" } */ - /* { dg-message "write of 1 byte to beyond the end of 'buf'" "note" { target *-*-* } .-1 } */ - - - return 0; -} diff --git a/gcc/testsuite/gcc.dg/analyzer/SARD-tc249-basic-00034-min.c b/gcc/testsuite/gcc.dg/analyzer/SARD-tc249-basic-00034-min.c deleted file mode 100644 index 4031e6d..0000000 --- a/gcc/testsuite/gcc.dg/analyzer/SARD-tc249-basic-00034-min.c +++ /dev/null @@ -1,67 +0,0 @@ -/* Adapted from https://samate.nist.gov/SARD/test-cases/249/versions/1.0.0 - Part of https://samate.nist.gov/SARD/test-suites/81 - See: - Black, P. , Koo, H. and Irish, T. (2013), A Basic CWE-121 Buffer Overflow Effectiveness Test Suite, Proc. 6th Latin-American Symposium on Dependable Computing, Rio de Janeiro, -1, [online], https://tsapps.nist.gov/publication/get_pdf.cfm?pub_id=913117 (Accessed January 17, 2023) -*/ - -/* Taxonomy Classification: 0000001600030000000100 */ - -/* - * WRITE/READ 0 write - * WHICH BOUND 0 upper - * DATA TYPE 0 char - * MEMORY LOCATION 0 stack - * SCOPE 0 same - * CONTAINER 0 no - * POINTER 1 yes - * INDEX COMPLEXITY 6 N/A - * ADDRESS COMPLEXITY 0 constant - * LENGTH COMPLEXITY 0 N/A - * ADDRESS ALIAS 0 none - * INDEX ALIAS 3 N/A - * LOCAL CONTROL FLOW 0 none - * SECONDARY CONTROL FLOW 0 none - * LOOP STRUCTURE 0 no - * LOOP COMPLEXITY 0 N/A - * ASYNCHRONY 0 no - * TAINT 0 no - * RUNTIME ENV. DEPENDENCE 0 no - * MAGNITUDE 1 1 byte - * CONTINUOUS/DISCRETE 0 discrete - * SIGNEDNESS 0 no - */ - -/* -Copyright 2004 M.I.T. - -Permission is hereby granted, without written agreement or royalty fee, to use, -copy, modify, and distribute this software and its documentation for any -purpose, provided that the above copyright notice and the following three -paragraphs appear in all copies of this software. - -IN NO EVENT SHALL M.I.T. BE LIABLE TO ANY PARTY FOR DIRECT, INDIRECT, SPECIAL, -INCIDENTAL, OR CONSEQUENTIAL DAMAGES ARISING OUT OF THE USE OF THIS SOFTWARE -AND ITS DOCUMENTATION, EVEN IF M.I.T. HAS BEEN ADVISED OF THE POSSIBILITY OF -SUCH DAMANGE. - -M.I.T. SPECIFICALLY DISCLAIMS ANY WARRANTIES INCLUDING, BUT NOT LIMITED TO -THE IMPLIED WARRANTIES OF MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE, -AND NON-INFRINGEMENT. - -THE SOFTWARE IS PROVIDED ON AN "AS-IS" BASIS AND M.I.T. HAS NO OBLIGATION TO -PROVIDE MAINTENANCE, SUPPORT, UPDATES, ENHANCEMENTS, OR MODIFICATIONS. -*/ - - -int main(int argc, char *argv[]) -{ - char buf[10]; - - - /* BAD */ - *(buf + 10) = 'A'; /* { dg-warning "stack-based buffer overflow" } */ - /* { dg-message "write of 1 byte to beyond the end of 'buf'" "note" { target *-*-* } .-1 } */ - - - return 0; -} diff --git a/gcc/testsuite/gcc.dg/analyzer/abort.c b/gcc/testsuite/gcc.dg/analyzer/abort.c deleted file mode 100644 index 9497ae3..0000000 --- a/gcc/testsuite/gcc.dg/analyzer/abort.c +++ /dev/null @@ -1,80 +0,0 @@ -#include -#include -#include "analyzer-decls.h" - -extern void foo (); -extern void bar (); - -void test_1 (int i) -{ - if (i == 42) - abort (); - - __analyzer_eval (i != 42); /* { dg-warning "TRUE" } */ -} - -void test_2 (int i) -{ - if (i) - foo (); - else - bar (); - - foo (); - - if (i) - foo (); - else - abort (); - - __analyzer_eval (i != 0); /* { dg-warning "TRUE" } */ -} - -/**************************************************************************/ - -void calls_abort (const char *msg) -{ - fprintf (stderr, "%s", msg); - abort (); -} - -void test_3 (void *ptr) -{ - if (!ptr) - calls_abort ("ptr was NULL"); - - __analyzer_eval (ptr != 0); /* { dg-warning "TRUE" } */ -} - -/**************************************************************************/ - -extern void marked_noreturn (const char *msg) - __attribute__ ((__noreturn__)); - -void test_4 (void *ptr) -{ - if (!ptr) - marked_noreturn ("ptr was NULL"); - - __analyzer_eval (ptr != 0); /* { dg-warning "TRUE" } */ -} - -/**************************************************************************/ - -/* Verify that we discover conditions from assertions if the assert macro - isn't disabled, and that it has its failure-handler labelled with - __attribute__ ((__noreturn__)). - This attribute isn't present for all implementations of , so - we have to test the idea using our own assert macro. */ - -extern void my_assert_fail (const char *expr, const char *file, int line) - __attribute__ ((__noreturn__)); - -#define MY_ASSERT(EXPR) \ - do { if (!(EXPR)) my_assert_fail (#EXPR, __FILE__, __LINE__); } while (0) - -void test_5 (int i) -{ - MY_ASSERT (i < 10); - __analyzer_eval (i < 10); /* { dg-warning "TRUE" } */ -} diff --git a/gcc/testsuite/gcc.dg/analyzer/aliasing-1.c b/gcc/testsuite/gcc.dg/analyzer/aliasing-1.c deleted file mode 100644 index 26050f1..0000000 --- a/gcc/testsuite/gcc.dg/analyzer/aliasing-1.c +++ /dev/null @@ -1,25 +0,0 @@ -#include "analyzer-decls.h" - -int a; -void test (int *p, int x) -{ - int y; - - a = 17; - x = 42; - y = 13; - - __analyzer_eval (a == 17); /* { dg-warning "TRUE" } */ - __analyzer_eval (x == 42); /* { dg-warning "TRUE" } */ - __analyzer_eval (y == 13); /* { dg-warning "TRUE" } */ - - __analyzer_eval (p == &a); /* { dg-warning "UNKNOWN" } */ - __analyzer_eval (p == &x); /* { dg-warning "FALSE" } */ - __analyzer_eval (p == &y); /* { dg-warning "FALSE" } */ - - *p = 73; - - __analyzer_eval (a == 17); /* { dg-warning "UNKNOWN" } */ - __analyzer_eval (x == 42); /* { dg-warning "TRUE" } */ - __analyzer_eval (y == 13); /* { dg-warning "TRUE" } */ -} diff --git a/gcc/testsuite/gcc.dg/analyzer/aliasing-2.c b/gcc/testsuite/gcc.dg/analyzer/aliasing-2.c deleted file mode 100644 index 38ceeff..0000000 --- a/gcc/testsuite/gcc.dg/analyzer/aliasing-2.c +++ /dev/null @@ -1,32 +0,0 @@ -#include "analyzer-decls.h" - -extern void escape (int *p); - -int a; -void test (int *p, int x) -{ - int y; - - a = 17; - x = 42; - y = 13; - - __analyzer_eval (a == 17); /* { dg-warning "TRUE" } */ - __analyzer_eval (x == 42); /* { dg-warning "TRUE" } */ - __analyzer_eval (y == 13); /* { dg-warning "TRUE" } */ - - escape (&x); - __analyzer_eval (a == 17); /* { dg-warning "UNKNOWN" } */ - __analyzer_eval (x == 42); /* { dg-warning "UNKNOWN" } */ - __analyzer_eval (y == 13); /* { dg-warning "TRUE" } */ - - __analyzer_eval (p == &a); /* { dg-warning "UNKNOWN" } */ - __analyzer_eval (p == &x); /* { dg-warning "FALSE" } */ - __analyzer_eval (p == &y); /* { dg-warning "FALSE" } */ - - *p = 73; - - __analyzer_eval (a == 17); /* { dg-warning "UNKNOWN" } */ - __analyzer_eval (x == 42); /* { dg-warning "UNKNOWN" } */ - __analyzer_eval (y == 13); /* { dg-warning "TRUE" } */ -} diff --git a/gcc/testsuite/gcc.dg/analyzer/alloca-leak.c b/gcc/testsuite/gcc.dg/analyzer/alloca-leak.c deleted file mode 100644 index 073f97e..0000000 --- a/gcc/testsuite/gcc.dg/analyzer/alloca-leak.c +++ /dev/null @@ -1,8 +0,0 @@ -/* { dg-require-effective-target alloca } */ - -void *test (void) -{ - void *ptr = __builtin_alloca (64); - return ptr; -} -/* TODO: warn about escaping alloca. */ diff --git a/gcc/testsuite/gcc.dg/analyzer/analyzer-debugging-fns-1.c b/gcc/testsuite/gcc.dg/analyzer/analyzer-debugging-fns-1.c deleted file mode 100644 index 6a23344..0000000 --- a/gcc/testsuite/gcc.dg/analyzer/analyzer-debugging-fns-1.c +++ /dev/null @@ -1,11 +0,0 @@ -/* Various wrong declarations for the decls - in analyzer-decls.h. - - Make sure we don't ICE on these. */ - -extern void __analyzer_dump_capacity (int); - -void wrong_analyzer_dump_capacity (void) -{ - __analyzer_dump_capacity (42); -} diff --git a/gcc/testsuite/gcc.dg/analyzer/analyzer-verbosity-2a.c b/gcc/testsuite/gcc.dg/analyzer/analyzer-verbosity-2a.c deleted file mode 100644 index cf014b0..0000000 --- a/gcc/testsuite/gcc.dg/analyzer/analyzer-verbosity-2a.c +++ /dev/null @@ -1,23 +0,0 @@ -/* { dg-additional-options "-fanalyzer-verbosity=2" } */ - -typedef struct FILE FILE; - -FILE* fopen (const char*, const char*); -int fclose (FILE*); - -extern int foo (); -extern void bar (); - -void test (const char *path, int flag) -{ - FILE *fp = fopen (path, "r"); /* { dg-message "opened here" } */ - - /* We shouldn't report this control flow at -fanalyzer-verbosity=2. */ - if (foo ()) /* { dg-bogus "" } */ - bar (); - else - bar (); - - if (flag) /* { dg-message "when 'flag == 0'" } */ - fclose (fp); -} /* { dg-warning "leak of FILE 'fp'" } */ diff --git a/gcc/testsuite/gcc.dg/analyzer/analyzer-verbosity-3a.c b/gcc/testsuite/gcc.dg/analyzer/analyzer-verbosity-3a.c deleted file mode 100644 index b0ece20..0000000 --- a/gcc/testsuite/gcc.dg/analyzer/analyzer-verbosity-3a.c +++ /dev/null @@ -1,23 +0,0 @@ -/* { dg-additional-options "-fanalyzer-verbosity=3" } */ - -typedef struct FILE FILE; - -FILE* fopen (const char*, const char*); -int fclose (FILE*); - -extern int foo (); -extern void bar (); - -void test (const char *path, int flag) -{ - FILE *fp = fopen (path, "r"); /* { dg-message "opened here" } */ - - /* We should report this control flow at -fanalyzer-verbosity=3. */ - if (foo ()) /* { dg-message "branch" } */ - bar (); - else - bar (); - - if (flag) /* { dg-message "when 'flag == 0'" } */ - fclose (fp); -} /* { dg-warning "leak of FILE 'fp'" } */ diff --git a/gcc/testsuite/gcc.dg/analyzer/asm-x86-1.c b/gcc/testsuite/gcc.dg/analyzer/asm-x86-1.c deleted file mode 100644 index a3f86e4..0000000 --- a/gcc/testsuite/gcc.dg/analyzer/asm-x86-1.c +++ /dev/null @@ -1,69 +0,0 @@ -/* { dg-do compile { target x86_64-*-* } } */ - -#include "analyzer-decls.h" - -int test_out (void) -{ - int dst_a, dst_b; - asm ("mov 42, %0" - : "=r" (dst_a)); - asm ("mov 42, %0" - : "=r" (dst_b)); - __analyzer_eval (dst_a == dst_b); /* { dg-warning "TRUE" } */ - return dst_a; -} - -int test_out_in (int src_a) -{ - int dst_a, dst_b; - asm ("mov %1, %0" - : "=r" (dst_a) - : "r" (src_a)); - asm ("mov %1, %0" - : "=r" (dst_b) - : "r" (src_a)); - __analyzer_eval (dst_a == dst_b); /* { dg-warning "TRUE" } */ - return dst_a; -} - -int test_out_in_in (int src_a, int src_b) -{ - int dst_a, dst_b; - asm ("mov %1, %0;\n" - "add %2, %0" - : "=r" (dst_a) - : "r" (src_a), - "r" (src_b)); - asm ("mov %1, %0;\n" - "add %2, %0" - : "=r" (dst_b) - : "r" (src_a), - "r" (src_b)); - __analyzer_eval (dst_a == dst_b); /* { dg-warning "TRUE" } */ - return dst_a; -} - -void test_inout_1 (int v) -{ - int saved = v; - int result_a, result_b; - asm ("dec %0" - : "+r" (v)); - result_a = v; - - asm ("dec %0" - : "+r" (v)); - result_b = v; - - __analyzer_eval (v == saved); /* { dg-warning "UNKNOWN" } */ - __analyzer_eval (v == result_a); /* { dg-warning "UNKNOWN" } */ - __analyzer_eval (v == result_b); /* { dg-warning "TRUE" } */ -} - -void test_inout_2 (void) -{ - int v; - int result_a, result_b; - asm ("dec %0" /* { dg-warning "use of uninitialized value 'v'" } */ - : "+r" (v)); -} diff --git a/gcc/testsuite/gcc.dg/analyzer/attr-alloc_size-3.c b/gcc/testsuite/gcc.dg/analyzer/attr-alloc_size-3.c deleted file mode 100644 index 9a33922..0000000 --- a/gcc/testsuite/gcc.dg/analyzer/attr-alloc_size-3.c +++ /dev/null @@ -1,14 +0,0 @@ -typedef long int idx_t; -extern void rpl_free (void *ptr); - -void *xicalloc (idx_t n, idx_t s) - __attribute__ ((__malloc__)) - __attribute__ ((__malloc__ (rpl_free, 1))) - __attribute__ ((__alloc_size__ (1, 2))) - __attribute__ ((__returns_nonnull__)); - -void * -xizalloc (idx_t s) -{ - return xicalloc (s, 1); -} diff --git a/gcc/testsuite/gcc.dg/analyzer/attr-const-1.c b/gcc/testsuite/gcc.dg/analyzer/attr-const-1.c deleted file mode 100644 index 39e813f..0000000 --- a/gcc/testsuite/gcc.dg/analyzer/attr-const-1.c +++ /dev/null @@ -1,152 +0,0 @@ -/* Verify that we handle functions with __attribute__ ((const)) correctly. */ - -#include "analyzer-decls.h" - -extern int nonconst_fn (int); - -extern int const_fn_0 () __attribute__ ((const)); -extern int const_fn_1 (int) __attribute__ ((const)); -extern int const_fn_2 (int, int) __attribute__ ((const)); -extern int const_fn_3 (int, int, int) __attribute__ ((const)); -extern int const_fn_variadic (int, ...) __attribute__ ((const)); - -/* Verify that functions without __attribute__ ((const)) have a different - result each time. */ - -void test_nonconst_fn (int x, int y) -{ - int x_1 = nonconst_fn (x); - int x_2 = nonconst_fn (x); - int y_1 = nonconst_fn (y); - int y_2 = nonconst_fn (y); - __analyzer_eval (x_1 == x_2); /* { dg-warning "UNKNOWN" } */ - __analyzer_eval (y_1 == y_2); /* { dg-warning "UNKNOWN" } */ - __analyzer_eval (x_1 == y_1); /* { dg-warning "UNKNOWN" } */ -} - -/* Verify functions with __attribute__ ((const)) have the same result - for the same arguments. */ - - /* 0 args. */ - -extern int other_const_fn_0 () __attribute__ ((const)); - -void test_const_fn_0 (void) -{ - int a = const_fn_0 (); - int b = const_fn_0 (); - int c = other_const_fn_0 (); - int d = other_const_fn_0 (); - __analyzer_eval (a == b); /* { dg-warning "TRUE" } */ - __analyzer_eval (c == d); /* { dg-warning "TRUE" } */ - __analyzer_eval (a == c); /* { dg-warning "UNKNOWN" } */ -} - -/* 1 arg. */ - -void test_const_fn_1 (int x, int y) -{ - int x_1 = const_fn_1 (x); - int x_2 = const_fn_1 (x); - int y_1 = const_fn_1 (y); - int y_2 = const_fn_1 (y); - __analyzer_eval (x_1 == x_2); /* { dg-warning "TRUE" } */ - __analyzer_eval (y_1 == y_2); /* { dg-warning "TRUE" } */ - __analyzer_eval (x_1 == y_1); /* { dg-warning "UNKNOWN" } */ -} - -/* 2 args. */ - -void test_const_fn_2 (int x, int y, int p, int q) -{ - int xy_1 = const_fn_2 (x, y); - int xy_2 = const_fn_2 (x, y); - int pq_1 = const_fn_2 (p, q); - int pq_2 = const_fn_2 (p, q); - __analyzer_eval (xy_1 == xy_2); /* { dg-warning "TRUE" } */ - __analyzer_eval (pq_1 == pq_2); /* { dg-warning "TRUE" } */ - __analyzer_eval (xy_1 == pq_1); /* { dg-warning "UNKNOWN" } */ -} - -/* We don't handle above 2 args. */ - -void test_const_fn_3 (int x, int y, int z, int p, int q, int r) -{ - int xyz_1 = const_fn_3 (x, y, z); - int xyz_2 = const_fn_3 (x, y, z); - int pqr_1 = const_fn_3 (p, q, r); - int pqr_2 = const_fn_3 (p, q, r); - __analyzer_eval (xyz_1 == xyz_2); /* { dg-warning "UNKNOWN" } */ - __analyzer_eval (pqr_1 == pqr_2); /* { dg-warning "UNKNOWN" } */ - __analyzer_eval (xyz_1 == pqr_1); /* { dg-warning "UNKNOWN" } */ -} - -/* Variadic fn, with various numbers of extra args. */ - -void test_const_fn_variadic (int x, int y, int z, int p, int q, int r) -{ - /* 0 extra args, for 1 arg in total. */ - int x_1 = const_fn_variadic (x); - int x_2 = const_fn_variadic (x); - int p_1 = const_fn_variadic (p); - int p_2 = const_fn_variadic (p); - __analyzer_eval (x_1 == x_2); /* { dg-warning "TRUE" } */ - __analyzer_eval (p_1 == p_2); /* { dg-warning "TRUE" } */ - __analyzer_eval (x_1 == p_1); /* { dg-warning "UNKNOWN" } */ - - /* 1 extra arg, for 2 args in total. */ - int xy_1 = const_fn_variadic (x, y); - int xy_2 = const_fn_variadic (x, y); - int pq_1 = const_fn_variadic (p, q); - int pq_2 = const_fn_variadic (p, q); - __analyzer_eval (xy_1 == xy_2); /* { dg-warning "TRUE" } */ - __analyzer_eval (pq_1 == pq_2); /* { dg-warning "TRUE" } */ - __analyzer_eval (xy_1 == pq_1); /* { dg-warning "UNKNOWN" } */ - __analyzer_eval (x_1 == xy_1); /* { dg-warning "UNKNOWN" } */ - __analyzer_eval (p_1 == pq_1); /* { dg-warning "UNKNOWN" } */ - - /* Above that, we don't track results. */ - int xyz_1 = const_fn_variadic (x, y, z); - int xyz_2 = const_fn_variadic (x, y, z); - int pqr_1 = const_fn_variadic (p, q, r); - int pqr_2 = const_fn_variadic (p, q, r); - __analyzer_eval (xyz_1 == xyz_2); /* { dg-warning "UNKNOWN" } */ - __analyzer_eval (pqr_1 == pqr_2); /* { dg-warning "UNKNOWN" } */ - __analyzer_eval (xyz_1 == x_1); /* { dg-warning "UNKNOWN" } */ - __analyzer_eval (xyz_1 == xy_1); /* { dg-warning "UNKNOWN" } */ - __analyzer_eval (xyz_1 == pqr_1); /* { dg-warning "UNKNOWN" } */ -} - -/* Builtins with __attribute__ ((const)). */ - -void test_builtin_isascii (int x, int y) -{ - int x_1 = __builtin_isascii (x); - int x_2 = __builtin_isascii (x); - int y_1 = __builtin_isascii (y); - int y_2 = __builtin_isascii (y); - __analyzer_eval (x_1 == x_2); /* { dg-warning "TRUE" } */ - __analyzer_eval (y_1 == y_2); /* { dg-warning "TRUE" } */ - __analyzer_eval (x_1 == y_1); /* { dg-warning "UNKNOWN" } */ -} - -void test_builtin_popcount (unsigned x, unsigned y) -{ - unsigned x_1 = __builtin_popcount (x); - unsigned x_2 = __builtin_popcount (x); - unsigned y_1 = __builtin_popcount (y); - unsigned y_2 = __builtin_popcount (y); - __analyzer_eval (x_1 == x_2); /* { dg-warning "TRUE" } */ - __analyzer_eval (y_1 == y_2); /* { dg-warning "TRUE" } */ - __analyzer_eval (x_1 == y_1); /* { dg-warning "UNKNOWN" } */ -} - -void test_loop (void) -{ - for (int i = 0; i < 100; i++) - { - int iter_val_a = const_fn_1 (i); - int iter_val_b = const_fn_1 (i); - __analyzer_eval (iter_val_a == iter_val_b); /* { dg-warning "TRUE" } */ - } -} diff --git a/gcc/testsuite/gcc.dg/analyzer/attr-const-2.c b/gcc/testsuite/gcc.dg/analyzer/attr-const-2.c deleted file mode 100644 index ab79514..0000000 --- a/gcc/testsuite/gcc.dg/analyzer/attr-const-2.c +++ /dev/null @@ -1,16 +0,0 @@ -extern int const_p (int) __attribute__((const)); -extern void do_stuff (void); - -void test (int a) -{ - void *p; - if (const_p (a)) - { - p = __builtin_malloc (1024); - if (!p) - return; - } - do_stuff (); - if (const_p (a)) - __builtin_free (p); /* { dg-bogus "uninit" } */ -} diff --git a/gcc/testsuite/gcc.dg/analyzer/attr-const-3.c b/gcc/testsuite/gcc.dg/analyzer/attr-const-3.c deleted file mode 100644 index 11238a7..0000000 --- a/gcc/testsuite/gcc.dg/analyzer/attr-const-3.c +++ /dev/null @@ -1,26 +0,0 @@ -/* Verify that we handle unknown values passed to __attribute__ ((const)) - (by imposing a complexity limit). */ - -/* { dg-additional-options "--param analyzer-max-svalue-depth=4 -Wno-analyzer-symbol-too-complex" } */ - -#include "analyzer-decls.h" - -extern int const_fn_1 (int) __attribute__ ((const)); - -void test_const_fn_1 (int x, int y) -{ - int x_1 = const_fn_1 (x); - int x_2 = const_fn_1 (x); - int y_1 = const_fn_1 (y); - int y_2 = const_fn_1 (y); - __analyzer_eval (x_1 == x_2); /* { dg-warning "UNKNOWN" } */ - __analyzer_eval (y_1 == y_2); /* { dg-warning "UNKNOWN" } */ - __analyzer_eval (x_1 == y_1); /* { dg-warning "UNKNOWN" } */ -} - -void test_2 (int x) -{ - int once = const_fn_1 (x); - int again = const_fn_1 (once); - __analyzer_eval (once == again); /* { dg-warning "UNKNOWN" } */ -} diff --git a/gcc/testsuite/gcc.dg/analyzer/attr-malloc-2.c b/gcc/testsuite/gcc.dg/analyzer/attr-malloc-2.c deleted file mode 100644 index 09d941f..0000000 --- a/gcc/testsuite/gcc.dg/analyzer/attr-malloc-2.c +++ /dev/null @@ -1,24 +0,0 @@ -extern void free (void *); -char *xstrdup (const char *) - __attribute__((malloc (free), returns_nonnull)); - -void test_1 (const char *s) -{ - char *p = xstrdup (s); - free (p); -} - -/* Verify that we don't issue -Wanalyzer-possible-null-dereference - when the allocator has __attribute__((returns_nonnull)). */ - -char *test_2 (const char *s) -{ - char *p = xstrdup (s); - p[0] = 'a'; /* { dg-bogus "possibly-NULL" } */ - return p; -} - -void test_3 (const char *s) -{ - char *p = xstrdup (s); /* { dg-message "allocated here" } */ -} /* { dg-warning "leak of 'p'" } */ diff --git a/gcc/testsuite/gcc.dg/analyzer/attr-malloc-4.c b/gcc/testsuite/gcc.dg/analyzer/attr-malloc-4.c deleted file mode 100644 index 1517667..0000000 --- a/gcc/testsuite/gcc.dg/analyzer/attr-malloc-4.c +++ /dev/null @@ -1,21 +0,0 @@ -/* An example where the deallocator requires non-NULL. */ - -struct foo; -extern void foo_release (struct foo *) - __attribute__((nonnull)); -extern struct foo *foo_acquire (void) - __attribute__ ((malloc (foo_release))); - -void test_1 (void) -{ - struct foo *p = foo_acquire (); /* { dg-message "this call could return NULL" } */ - foo_release (p); /* { dg-warning "use of possibly-NULL 'p' where non-null" } */ -} - -void test_2 (void) -{ - struct foo *p = foo_acquire (); - if (!p) - return; - foo_release (p); -} diff --git a/gcc/testsuite/gcc.dg/analyzer/attr-malloc-5.c b/gcc/testsuite/gcc.dg/analyzer/attr-malloc-5.c deleted file mode 100644 index 7ff4e57..0000000 --- a/gcc/testsuite/gcc.dg/analyzer/attr-malloc-5.c +++ /dev/null @@ -1,12 +0,0 @@ -/* Example of extra argument to "malloc" attribute. */ - -struct foo; -extern void foo_release (int, struct foo *); -extern struct foo *foo_acquire (void) - __attribute__ ((malloc (foo_release, 2))); - -void test_1 (void) -{ - struct foo *p = foo_acquire (); - foo_release (0, p); -} diff --git a/gcc/testsuite/gcc.dg/analyzer/attr-malloc-misuses.c b/gcc/testsuite/gcc.dg/analyzer/attr-malloc-misuses.c deleted file mode 100644 index 3c6c17b..0000000 --- a/gcc/testsuite/gcc.dg/analyzer/attr-malloc-misuses.c +++ /dev/null @@ -1,18 +0,0 @@ -extern void free (void *); - -int not_a_fn __attribute__ ((malloc (free))); /* { dg-warning "'malloc' attribute ignored; valid only for functions" } */ - -void void_return (void) __attribute__ ((malloc(free))); /* { dg-warning "'malloc' attribute ignored on functions returning 'void'" } */ - -void test_void_return (void) -{ - void_return (); -} - -extern void void_args (void); /* { dg-message "declared here" } */ -void *has_malloc_with_void_args (void) - __attribute__ ((malloc(void_args))); /* { dg-error "'malloc' attribute argument 1 must take a pointer type as its first argument; have 'void'" } */ - -extern void no_args (); /* { dg-message "declared here" } */ -void *has_malloc_with_no_args (void) - __attribute__ ((malloc(no_args))); /* { dg-error "'malloc' attribute argument 1 must take a pointer type as its first argument" } */ diff --git a/gcc/testsuite/gcc.dg/analyzer/attr-tainted_args-misuses.c b/gcc/testsuite/gcc.dg/analyzer/attr-tainted_args-misuses.c deleted file mode 100644 index 4b0dc91..0000000 --- a/gcc/testsuite/gcc.dg/analyzer/attr-tainted_args-misuses.c +++ /dev/null @@ -1,6 +0,0 @@ -int not_a_fn __attribute__ ((tainted_args)); /* { dg-warning "'tainted_args' attribute ignored; valid only for functions and function pointer fields" } */ - -struct s -{ - int f __attribute__ ((tainted_args)); /* { dg-warning "'tainted_args' attribute ignored; field must be a function pointer" } */ -}; diff --git a/gcc/testsuite/gcc.dg/analyzer/bzip2-arg-parse-1.c b/gcc/testsuite/gcc.dg/analyzer/bzip2-arg-parse-1.c deleted file mode 100644 index 1f1d829..0000000 --- a/gcc/testsuite/gcc.dg/analyzer/bzip2-arg-parse-1.c +++ /dev/null @@ -1,95 +0,0 @@ -/* Integration test to verify that we don't explode in this - argument-parsing logic. - Adapted from part of bzip2-1.0.8: bzip2.c: main. */ - -#include -#include -#include "analyzer-decls.h" - -/* This test file has been heavily modified from the bzip2.c original, - which has the following license boilerplate. */ -/* ------------------------------------------------------------------ - This file is part of bzip2/libbzip2, a program and library for - lossless, block-sorting data compression. - - bzip2/libbzip2 version 1.0.8 of 13 July 2019 - Copyright (C) 1996-2019 Julian Seward - - Please read the WARNING, DISCLAIMER and PATENTS sections in the - README file. - - This program is released under the terms of the license contained - in the file LICENSE. - ------------------------------------------------------------------ */ - -typedef char Char; -typedef unsigned char Bool; -typedef int Int32; - -#define True ((Bool)1) -#define False ((Bool)0) - -typedef - struct zzzz { - Char *name; - struct zzzz *link; - } - Cell; - -Int32 verbosity; -Bool keepInputFiles, smallMode; -Bool forceOverwrite, noisy; -Int32 blockSize100k; -Int32 opMode; -Int32 srcMode; -Char *progName; - -extern void license ( void ); -extern void usage ( Char *fullProgName ); - -void test (Cell *argList) -{ - Cell *aa; - Int32 i, j; - - for (aa = argList; aa != NULL; aa = aa->link) { - if (aa->name[0] == '-' && aa->name[1] != '-') { - for (j = 1; aa->name[j] != '\0'; j++) { - switch (aa->name[j]) { - case 'c': srcMode = 2; break; - case 'd': opMode = 2; break; - case 'z': opMode = 1; break; - case 'f': forceOverwrite = True; break; - case 't': opMode = 3; break; - case 'k': keepInputFiles = True; break; - case 's': smallMode = True; break; - case 'q': noisy = False; break; - case '1': blockSize100k = 1; break; - case '2': blockSize100k = 2; break; - case '3': blockSize100k = 3; break; - case '4': blockSize100k = 4; break; - case '5': blockSize100k = 5; break; - case '6': blockSize100k = 6; break; - case '7': blockSize100k = 7; break; - case '8': blockSize100k = 8; break; - case '9': blockSize100k = 9; break; - case 'V': - case 'L': license(); break; - case 'v': verbosity++; break; - case 'h': usage ( progName ); - exit ( 0 ); - break; - default: fprintf ( stderr, "%s: Bad flag `%s'\n", - progName, aa->name ); - usage ( progName ); - exit ( 1 ); - break; - } - } - } - } - - /* The analyzer ought to be able to successfully merge all of the - above changes that can reach here into a single state. */ - __analyzer_dump_exploded_nodes (0); /* { dg-warning "1 processed enode" } */ -} diff --git a/gcc/testsuite/gcc.dg/analyzer/call-summaries-1.c b/gcc/testsuite/gcc.dg/analyzer/call-summaries-1.c deleted file mode 100644 index a64b230..0000000 --- a/gcc/testsuite/gcc.dg/analyzer/call-summaries-1.c +++ /dev/null @@ -1,14 +0,0 @@ -/* { dg-additional-options "-fanalyzer-call-summaries" } */ - -#include - -void calls_free (void *p) -{ - free (p); /* { dg-warning "double-'free' of 'p'" } */ -} - -void test (void *q) -{ - calls_free (q); - calls_free (q); -} diff --git a/gcc/testsuite/gcc.dg/analyzer/call-summaries-3.c b/gcc/testsuite/gcc.dg/analyzer/call-summaries-3.c deleted file mode 100644 index d63eb0c..0000000 --- a/gcc/testsuite/gcc.dg/analyzer/call-summaries-3.c +++ /dev/null @@ -1,29 +0,0 @@ -/* { dg-additional-options "-fanalyzer-call-summaries --param analyzer-min-snodes-for-call-summary=0 -fno-analyzer-state-merge" } */ - -/* There need to be at least two calls to a function for the - call-summarization code to be used. - TODO: add some kind of test that summarization *was* used. */ - -#include "analyzer-decls.h" - -/* With state merging disabled, we get two summaries here. */ - -int two_outcomes (int flag, int x, int y) -{ - if (flag) - return x; - else - return y; -} - -void test_two_outcomes (int outer_flag, int a, int b) -{ - int r; - __analyzer_eval (two_outcomes (1, a, b) == a); /* { dg-warning "TRUE" } */ - __analyzer_eval (two_outcomes (0, a, b) == b); /* { dg-warning "TRUE" } */ - r = two_outcomes (outer_flag, a, b); - if (outer_flag) - __analyzer_eval (r == a); /* { dg-warning "TRUE" } */ - else - __analyzer_eval (r == b); /* { dg-warning "TRUE" } */ -} diff --git a/gcc/testsuite/gcc.dg/analyzer/call-summaries-asm-x86.c b/gcc/testsuite/gcc.dg/analyzer/call-summaries-asm-x86.c deleted file mode 100644 index cc23283..0000000 --- a/gcc/testsuite/gcc.dg/analyzer/call-summaries-asm-x86.c +++ /dev/null @@ -1,20 +0,0 @@ -/* { dg-do compile { target x86_64-*-* } } */ -/* { dg-additional-options "-fanalyzer-call-summaries --param analyzer-min-snodes-for-call-summary=0" } */ - -#include "analyzer-decls.h" - -int returns_asm_value (void) -{ - int dst; - asm ("mov 42, %0" - : "=r" (dst)); - return dst; -} - -void test_returns_asm_value (void) -{ - int a, b; - a = returns_asm_value (); - b = returns_asm_value (); - __analyzer_eval (a == b); /* { dg-warning "TRUE" } */ -} diff --git a/gcc/testsuite/gcc.dg/analyzer/callbacks-1.c b/gcc/testsuite/gcc.dg/analyzer/callbacks-1.c deleted file mode 100644 index 52c8fde..0000000 --- a/gcc/testsuite/gcc.dg/analyzer/callbacks-1.c +++ /dev/null @@ -1,25 +0,0 @@ -/* Reproducer for PR analyzer/97258: we should report the double-free - inside a static callback if the callback escapes. */ - -#include - -static void callback_1 (void *p) -{ - free (p); - free (p); /* { dg-warning "double-'free' of 'p'" } */ -} - -struct ops { - void (*cb) (void *); -}; - -static const struct ops ops_1 = { - .cb = callback_1 -}; - -extern void registration (const void *); - -void register_1 (void) -{ - registration (&ops_1); -} diff --git a/gcc/testsuite/gcc.dg/analyzer/callbacks-2.c b/gcc/testsuite/gcc.dg/analyzer/callbacks-2.c deleted file mode 100644 index 98915ee..0000000 --- a/gcc/testsuite/gcc.dg/analyzer/callbacks-2.c +++ /dev/null @@ -1,22 +0,0 @@ -/* Reproducer for PR analyzer/97258: we should report the double-free - inside a static callback if the callback is accessible via a global - initializer. */ - -#include - -static void callback_1 (void *p) -{ - free (p); - free (p); /* { dg-warning "double-'free' of 'p'" } */ -} - -struct ops { - void (*cb) (void *); -}; - -/* Callback struct is not static, and so could be accessed via - another TU. */ - -const struct ops ops_1 = { - .cb = callback_1 -}; diff --git a/gcc/testsuite/gcc.dg/analyzer/callbacks-3.c b/gcc/testsuite/gcc.dg/analyzer/callbacks-3.c deleted file mode 100644 index 5f12c2a..0000000 --- a/gcc/testsuite/gcc.dg/analyzer/callbacks-3.c +++ /dev/null @@ -1,19 +0,0 @@ -#include "analyzer-decls.h" - -typedef __SIZE_TYPE__ size_t; -typedef int (*__compar_fn_t)(const void *, const void *); -extern void qsort(void *__base, size_t __nmemb, size_t __size, - __compar_fn_t __compar) - __attribute__((__nonnull__(1, 4))); - -static int -test_1_callback (const void *p1, const void *p2) -{ - __analyzer_dump_path (); /* { dg-message "here" } */ - return 0; -} - -void test_1_caller (int *arr, size_t n) -{ - qsort (arr, n, sizeof (int), test_1_callback); -} diff --git a/gcc/testsuite/gcc.dg/analyzer/capacity-2.c b/gcc/testsuite/gcc.dg/analyzer/capacity-2.c deleted file mode 100644 index 2db1b3f..0000000 --- a/gcc/testsuite/gcc.dg/analyzer/capacity-2.c +++ /dev/null @@ -1,55 +0,0 @@ -#include -#include "analyzer-decls.h" - -extern void might_realloc (void *); -extern void cant_realloc (const void *); - -void * -test_realloc_1 (void *p, size_t new_sz) -{ - void *q = realloc (p, new_sz); - __analyzer_dump_capacity (q); /* { dg-warning "capacity: 'UNKNOWN\\(sizetype\\)'" "failure" } */ - /* { dg-warning "capacity: 'INIT_VAL\\(new_sz\[^\n\r\]*\\)'" "success" { target *-*-* } .-1 } */ - return q; -} - -void * -test_realloc_2 (size_t sz_a, size_t sz_b) -{ - void *p = malloc (sz_a); - __analyzer_dump_capacity (p); /* { dg-warning "capacity: 'INIT_VAL\\(sz_a_\[^\n\r\]*\\)'" } */ - void *q = realloc (p, sz_b); - __analyzer_dump_capacity (q); /* { dg-warning "capacity: 'UNKNOWN\\(sizetype\\)'" "failure" } */ - /* { dg-warning "capacity: 'INIT_VAL\\(sz_b\[^\n\r\]*\\)'" "success" { target *-*-* } .-1 } */ - return q; /* { dg-warning "leak of 'p'" } */ -} - -void * -test_might_realloc (void) -{ - void *p = malloc (1024); - - __analyzer_dump_capacity (p); /* { dg-warning "capacity: '\\(size_t\\)1024'" } */ - - might_realloc (p); - - __analyzer_dump_capacity (p); /* { dg-warning "capacity: 'UNKNOWN\\(sizetype\\)'" } */ - - return p; -} - -void * -test_cant_realloc (void) -{ - void *p = malloc (1024); - - __analyzer_dump_capacity (p); /* { dg-warning "capacity: '\\(size_t\\)1024'" } */ - - cant_realloc (p); - - __analyzer_dump_capacity (p); /* { dg-warning "capacity: '\\(size_t\\)1024'" } */ - - return p; -} - - diff --git a/gcc/testsuite/gcc.dg/analyzer/capacity-3.c b/gcc/testsuite/gcc.dg/analyzer/capacity-3.c deleted file mode 100644 index c099ff5..0000000 --- a/gcc/testsuite/gcc.dg/analyzer/capacity-3.c +++ /dev/null @@ -1,84 +0,0 @@ -/* { dg-require-effective-target alloca } */ - -#include -#include "analyzer-decls.h" - -static void __attribute__((noinline)) -__analyzer_callee_1 (size_t inner_sz) -{ - void *p = __builtin_alloca (inner_sz); - __analyzer_dump_capacity (p); /* { dg-warning "capacity: 'INIT_VAL\\(outer_sz_\[^\n\r\]*\\)'" } */ -} - -void -test_1 (int flag, size_t outer_sz) -{ - if (flag) - __analyzer_callee_1 (outer_sz); - - /* Verify that we merge state; in particular, the dynamic size of "p" - in the called frame should have been purged. */ - __analyzer_dump_exploded_nodes (0); /* { dg-warning "1 processed enode" } */ -} - -void -test_2 (int flag, size_t sz) -{ - if (flag) - { - void *p = malloc (sz); - __analyzer_dump_capacity (p); /* { dg-warning "capacity: 'INIT_VAL\\(sz_\[^\n\r\]*\\)'" } */ - free (p); - /* The dynamic size of "p" should have been purged. */ - __analyzer_dump_capacity (p); /* { dg-warning "capacity: 'UNKNOWN\\(sizetype\\)'" } */ - } - - /* Verify that we merge state. */ - __analyzer_dump_exploded_nodes (0); /* { dg-warning "1 processed enode" } */ -} -/* Verify that we purge state on the NULL branch when a malloc result is - tested against NULL. */ - -void -test_3 (size_t sz) -{ - void *p = malloc (sz); - - if (p) - { - __analyzer_dump_capacity (p); /* { dg-warning "capacity: 'INIT_VAL\\(sz_\[^\n\r\]*\\)'" } */ - } - else - { - /* The dynamic size of "p" should have been purged - due to "p" being equal to NULL. */ - __analyzer_dump_capacity (p); /* { dg-warning "capacity: 'UNKNOWN\\(sizetype\\)'" } */ - } - - free (p); - - /* The dynamic size of "p" should have been purged. */ - __analyzer_dump_capacity (p); /* { dg-warning "capacity: 'UNKNOWN\\(sizetype\\)'" } */ - - /* Verify that we merge state. */ - __analyzer_dump_exploded_nodes (0); /* { dg-warning "1 processed enode" } */ -} - -/* Verify that we purge dynamic extent of a pointer when it leaks. */ - -static void __attribute__((noinline)) -__analyzer_callee_4 (size_t inner_sz) -{ - void *p = malloc (inner_sz); - __analyzer_dump_capacity (p); /* { dg-warning "capacity: 'INIT_VAL\\(outer_sz_\[^\n\r\]*\\)'" } */ -} /* { dg-warning "leak of 'p'" } */ - -void -test_4 (int flag, size_t outer_sz) -{ - if (flag) - __analyzer_callee_4 (outer_sz); - - /* Verify that we merge state. */ - __analyzer_dump_exploded_nodes (0); /* { dg-warning "1 processed enode" } */ -} diff --git a/gcc/testsuite/gcc.dg/analyzer/casts-1.c b/gcc/testsuite/gcc.dg/analyzer/casts-1.c deleted file mode 100644 index 7e4af38..0000000 --- a/gcc/testsuite/gcc.dg/analyzer/casts-1.c +++ /dev/null @@ -1,78 +0,0 @@ -#include "analyzer-decls.h" - -struct s1 -{ - char a; - char b; - char c; - char d; -}; - -struct s2 -{ - char arr[4]; -}; - -struct s3 -{ - struct inner { - char a; - char b; - } arr[2]; -}; - -void test_1 () -{ - struct s1 x = {'A', 'B', 'C', 'D'}; - __analyzer_eval (x.a == 'A'); /* { dg-warning "TRUE" } */ - __analyzer_eval (x.b == 'B'); /* { dg-warning "TRUE" } */ - __analyzer_eval (x.c == 'C'); /* { dg-warning "TRUE" } */ - __analyzer_eval (x.d == 'D'); /* { dg-warning "TRUE" } */ - __analyzer_eval (((struct s2 *)&x)->arr[0] == 'A'); /* { dg-warning "TRUE" } */ - __analyzer_eval (((struct s2 *)&x)->arr[1] == 'B'); /* { dg-warning "TRUE" } */ - __analyzer_eval (((struct s2 *)&x)->arr[2] == 'C'); /* { dg-warning "TRUE" } */ - __analyzer_eval (((struct s2 *)&x)->arr[3] == 'D'); /* { dg-warning "TRUE" } */ - struct s3 *p3 = (struct s3 *)&x; - __analyzer_eval (p3->arr[0].a == 'A'); /* { dg-warning "TRUE" } */ - __analyzer_eval (p3->arr[0].b == 'B'); /* { dg-warning "TRUE" } */ - __analyzer_eval (p3->arr[1].a == 'C'); /* { dg-warning "TRUE" } */ - __analyzer_eval (p3->arr[1].b == 'D'); /* { dg-warning "TRUE" } */ - - ((struct s2 *)&x)->arr[1] = '#'; - __analyzer_eval (((struct s2 *)&x)->arr[1] == '#'); /* { dg-warning "TRUE" } */ - __analyzer_eval (x.b == '#'); /* { dg-warning "TRUE" } */ - __analyzer_eval (p3->arr[0].b == '#'); /* { dg-warning "TRUE" } */ -} - -void test_2 () -{ - struct s2 x = {{'A', 'B', 'C', 'D'}}; - __analyzer_eval (x.arr[0] == 'A'); /* { dg-warning "TRUE" } */ - __analyzer_eval (x.arr[1] == 'B'); /* { dg-warning "TRUE" } */ - __analyzer_eval (x.arr[2] == 'C'); /* { dg-warning "TRUE" } */ - __analyzer_eval (x.arr[3] == 'D'); /* { dg-warning "TRUE" } */ - struct s1 *p = (struct s1 *)&x; - __analyzer_eval (p->a == 'A'); /* { dg-warning "TRUE" } */ - __analyzer_eval (p->b == 'B'); /* { dg-warning "TRUE" } */ - __analyzer_eval (p->c == 'C'); /* { dg-warning "TRUE" } */ - __analyzer_eval (p->d == 'D'); /* { dg-warning "TRUE" } */ -} - -void test_3 () -{ - struct s3 x = {'A', 'B', 'C', 'D'}; - __analyzer_eval (x.arr[0].a == 'A'); /* { dg-warning "TRUE" } */ - __analyzer_eval (x.arr[0].b == 'B'); /* { dg-warning "TRUE" } */ - __analyzer_eval (x.arr[1].a == 'C'); /* { dg-warning "TRUE" } */ - __analyzer_eval (x.arr[1].b == 'D'); /* { dg-warning "TRUE" } */ - struct s1 *p1 = (struct s1 *)&x; - __analyzer_eval (p1->a == 'A'); /* { dg-warning "TRUE" } */ - __analyzer_eval (p1->b == 'B'); /* { dg-warning "TRUE" } */ - __analyzer_eval (p1->c == 'C'); /* { dg-warning "TRUE" } */ - __analyzer_eval (p1->d == 'D'); /* { dg-warning "TRUE" } */ - struct s2 *p2 = (struct s2 *)&x; - __analyzer_eval (p2->arr[0] == 'A'); /* { dg-warning "TRUE" } */ - __analyzer_eval (p2->arr[1] == 'B'); /* { dg-warning "TRUE" } */ - __analyzer_eval (p2->arr[2] == 'C'); /* { dg-warning "TRUE" } */ - __analyzer_eval (p2->arr[3] == 'D'); /* { dg-warning "TRUE" } */ -} diff --git a/gcc/testsuite/gcc.dg/analyzer/casts-2.c b/gcc/testsuite/gcc.dg/analyzer/casts-2.c deleted file mode 100644 index 3eef717..0000000 --- a/gcc/testsuite/gcc.dg/analyzer/casts-2.c +++ /dev/null @@ -1,15 +0,0 @@ -#include "analyzer-decls.h" - -void test_1 (int i) -{ - char c1 = i; - char c2 = i; - __analyzer_eval (c1 == i); /* { dg-warning "UNKNOWN" } */ - __analyzer_eval (c1 == c2); /* { dg-warning "TRUE" } */ -} - -void test_2 (char c) -{ - int i = c; - __analyzer_eval (i == c); /* { dg-warning "TRUE" } */ -} diff --git a/gcc/testsuite/gcc.dg/analyzer/clobbers-1.c b/gcc/testsuite/gcc.dg/analyzer/clobbers-1.c deleted file mode 100644 index 6400f84..0000000 --- a/gcc/testsuite/gcc.dg/analyzer/clobbers-1.c +++ /dev/null @@ -1,97 +0,0 @@ -#include "analyzer-decls.h" - -struct foo -{ - int i; - int j; -}; - -struct coord -{ - int x; - int y; - int z; -}; - -struct foo g; - -void test_1 (void) -{ - g.i = 42; - if (g.j) - __analyzer_eval (g.j); /* { dg-warning "TRUE" } */ - else - __analyzer_eval (g.j); /* { dg-warning "FALSE" } */ - __analyzer_dump_exploded_nodes (0); /* { dg-warning "1 processed enode" } */ -} - -void test_2 (struct foo f) -{ - f.i = 42; - if (f.j) - __analyzer_eval (f.j); /* { dg-warning "TRUE" } */ - else - __analyzer_eval (f.j); /* { dg-warning "FALSE" } */ - __analyzer_dump_exploded_nodes (0); /* { dg-warning "1 processed enode" } */ -} - -void test_3 (struct foo *p) -{ - struct foo f = *p; - f.i = 42; - if (f.j) - __analyzer_eval (f.j); /* { dg-warning "TRUE" } */ - else - __analyzer_eval (f.j); /* { dg-warning "FALSE" } */ - __analyzer_dump_exploded_nodes (0); /* { dg-warning "1 processed enode" } */ -} - -void test_4 (struct coord *p) -{ - struct coord f = *p; - f.x = 42; - __analyzer_eval (f.y == p->y); /* { dg-warning "TRUE" } */ - __analyzer_eval (f.z == p->z); /* { dg-warning "TRUE" } */ -} - -struct s5 -{ - char arr[8]; -}; - -void test_5 (struct s5 *p) -{ - struct s5 f = *p; - f.arr[3] = 42; - __analyzer_eval (f.arr[0] == p->arr[0]); /* { dg-warning "TRUE" } */ - __analyzer_eval (f.arr[1] == p->arr[1]); /* { dg-warning "TRUE" } */ - __analyzer_eval (f.arr[2] == p->arr[2]); /* { dg-warning "TRUE" } */ - __analyzer_eval (f.arr[3] == 42); /* { dg-warning "TRUE" } */ - __analyzer_eval (f.arr[4] == p->arr[4]); /* { dg-warning "TRUE" } */ - __analyzer_eval (f.arr[5] == p->arr[5]); /* { dg-warning "TRUE" } */ - __analyzer_eval (f.arr[6] == p->arr[6]); /* { dg-warning "TRUE" } */ - __analyzer_eval (f.arr[7] == p->arr[7]); /* { dg-warning "TRUE" } */ -} - -struct s6 -{ - int before; /* Give "arr" a nonzero offset. */ - struct foo arr[4]; - int after; -}; - -void test_6 (struct s6 *p, struct foo *q) -{ - struct s6 f = *p; - f.arr[1] = *q; - __analyzer_eval (f.before == p->before); /* { dg-warning "TRUE" } */ - __analyzer_eval (f.arr[0].i == p->arr[0].i); /* { dg-warning "TRUE" } */ - __analyzer_eval (f.arr[0].j == p->arr[0].j); /* { dg-warning "TRUE" } */ - __analyzer_eval (f.arr[1].i == q->i); /* { dg-warning "TRUE" } */ - __analyzer_eval (f.arr[1].j == q->j); /* { dg-warning "TRUE" } */ - __analyzer_eval (f.arr[2].i == p->arr[2].i); /* { dg-warning "TRUE" } */ - __analyzer_eval (f.arr[2].j == p->arr[2].j); /* { dg-warning "TRUE" } */ - __analyzer_eval (f.arr[3].i == p->arr[3].i); /* { dg-warning "TRUE" } */ - __analyzer_eval (f.arr[3].j == p->arr[3].j); /* { dg-warning "TRUE" } */ - __analyzer_eval (f.after == p->after); /* { dg-warning "TRUE" } */ -} diff --git a/gcc/testsuite/gcc.dg/analyzer/compound-assignment-4.c b/gcc/testsuite/gcc.dg/analyzer/compound-assignment-4.c deleted file mode 100644 index 5c0a5f9..0000000 --- a/gcc/testsuite/gcc.dg/analyzer/compound-assignment-4.c +++ /dev/null @@ -1,28 +0,0 @@ -#include "analyzer-decls.h" - -struct coord -{ - int x; - int y; -}; - -void test_1 (void) -{ - struct coord arr[16]; - - arr[2].y = 4; - arr[3].x = 5; - arr[3].y = 6; - arr[4].x = 7; - arr[6].y = 8; - arr[8].x = 9; - - arr[7] = arr[3]; - - __analyzer_eval (arr[7].x == 5); /* { dg-warning "TRUE" } */ - __analyzer_eval (arr[7].y == 6); /* { dg-warning "TRUE" } */ - - /* Make sure we don't touch the neighbors. */ - __analyzer_eval (arr[6].y == 8); /* { dg-warning "TRUE" } */ - __analyzer_eval (arr[8].x == 9); /* { dg-warning "TRUE" } */ -} diff --git a/gcc/testsuite/gcc.dg/analyzer/data-model-12.c b/gcc/testsuite/gcc.dg/analyzer/data-model-12.c deleted file mode 100644 index 653b7ad..0000000 --- a/gcc/testsuite/gcc.dg/analyzer/data-model-12.c +++ /dev/null @@ -1,13 +0,0 @@ -/* Mismatching decl of foo. */ - -int foo (); - -int bar (void) -{ - return foo() + 1; -} - -int foo (int x, int y) -{ - return x * y; -} diff --git a/gcc/testsuite/gcc.dg/analyzer/data-model-14.c b/gcc/testsuite/gcc.dg/analyzer/data-model-14.c deleted file mode 100644 index 1dbcb70..0000000 --- a/gcc/testsuite/gcc.dg/analyzer/data-model-14.c +++ /dev/null @@ -1,19 +0,0 @@ -#include - -void *global_ptr; - -void test_1 (int i) -{ - global_ptr = malloc (1024); /* { dg-message "allocated here" } */ - *(int *)&global_ptr = i; /* { dg-warning "leak of 'global_ptr'" } */ -} - -void test_2 (int i) -{ - void *p = malloc (1024); /* { dg-message "allocated here" } */ - global_ptr = p; - *(int *)&p = i; - p = global_ptr; - free (p); - free (global_ptr); /* { dg-warning "double-'free' of 'p'" } */ -} diff --git a/gcc/testsuite/gcc.dg/analyzer/data-model-18.c b/gcc/testsuite/gcc.dg/analyzer/data-model-18.c deleted file mode 100644 index 86e8110..0000000 --- a/gcc/testsuite/gcc.dg/analyzer/data-model-18.c +++ /dev/null @@ -1,20 +0,0 @@ -#include "analyzer-decls.h" - -void test (int *p, int i, int j) -{ - p[3] = 42; - __analyzer_eval (p[3] == 42); /* { dg-warning "TRUE" } */ - __analyzer_eval (*(p + 3) == 42); /* { dg-warning "TRUE" } */ - __analyzer_eval (p[i] == 42); /* { dg-warning "UNKNOWN" } */ - __analyzer_eval (p[j] == 42); /* { dg-warning "UNKNOWN" } */ - - //__analyzer_dump (); - - p[i] = 17; - - //__analyzer_dump (); - - __analyzer_eval (p[3] == 42); /* { dg-warning "UNKNOWN" } */ - __analyzer_eval (p[i] == 17); /* { dg-warning "TRUE" } */ - __analyzer_eval (p[j] == 17); /* { dg-warning "UNKNOWN" } */ -} diff --git a/gcc/testsuite/gcc.dg/analyzer/data-model-2.c b/gcc/testsuite/gcc.dg/analyzer/data-model-2.c deleted file mode 100644 index d5be03b..0000000 --- a/gcc/testsuite/gcc.dg/analyzer/data-model-2.c +++ /dev/null @@ -1,13 +0,0 @@ -/* { dg-additional-options "-O2" } */ -/* TODO:is there a way to automatically run the tests on various - optimizations levels, and with/without debuginfo, rather than - hardcoding options? Adapt from torture .exp, presumably. */ - - -#include -#include - -int test_1 (void) -{ - return 0; -} diff --git a/gcc/testsuite/gcc.dg/analyzer/data-model-20.c b/gcc/testsuite/gcc.dg/analyzer/data-model-20.c deleted file mode 100644 index 59f6285..0000000 --- a/gcc/testsuite/gcc.dg/analyzer/data-model-20.c +++ /dev/null @@ -1,29 +0,0 @@ -/* { dg-additional-options "-Wno-analyzer-too-complex" } */ - -#include - -struct foo { int dummy; }; - -struct foo ** -test (int n) { - struct foo **arr; - int i; - - if ((arr = (struct foo **)malloc(n * sizeof(struct foo *))) == NULL) - return NULL; - - for (i = 0; i < n; i++) { - if ((arr[i] = (struct foo *)malloc(sizeof(struct foo))) == NULL) { - for (; i >= 0; i++) { /* { dg-warning "infinite loop" } */ - /* This loop is in the wrong direction, so not technically an - infinite loop ("i" will eventually wrap around), but the - analyzer's condition handling treats the overflow as such. - In any case, the code is suspect and warrants a warning. */ - free(arr[i]); /* { dg-bogus "double-'free'" } */ - } - free(arr); /* { dg-warning "leak" } */ - return NULL; - } - } - return arr; -} diff --git a/gcc/testsuite/gcc.dg/analyzer/data-model-21.c b/gcc/testsuite/gcc.dg/analyzer/data-model-21.c deleted file mode 100644 index b952bcb..0000000 --- a/gcc/testsuite/gcc.dg/analyzer/data-model-21.c +++ /dev/null @@ -1,8 +0,0 @@ -extern const char XtStrings[]; - -void unknown_fn (void *); - -void test (void) -{ - unknown_fn ((char*)&XtStrings[429]); -} diff --git a/gcc/testsuite/gcc.dg/analyzer/data-model-22.c b/gcc/testsuite/gcc.dg/analyzer/data-model-22.c deleted file mode 100644 index 8429b2f..0000000 --- a/gcc/testsuite/gcc.dg/analyzer/data-model-22.c +++ /dev/null @@ -1,101 +0,0 @@ -#include -#include "analyzer-decls.h" - -extern void check_init_char (char v); -extern void check_init_int (int v); - -void test_1 (void) -{ - union - { - char c[16]; - int i[4]; - } v; - memset (&v, 0, sizeof (v)); - v.c[5] = 42; - check_init_int (v.c[0]); - check_init_int (v.c[4]); - check_init_int (v.c[6]); - check_init_int (v.i[1]); -} - -void test_2 (void) -{ - /* Intersection of byte ranges within "v". */ - union - { - struct { - int a; - char b; - char c; - } __attribute__((packed)) icc; - struct { - char a; - int b; - char c; - } __attribute__((packed)) cic; - struct { - char a; - char b; - int c; - } __attribute__((packed)) cci; - } v; - - v.icc.a = 1066; - v.icc.b = 42; - v.icc.c = 17; - - __analyzer_eval (v.icc.a == 1066); /* { dg-warning "TRUE" } */ - __analyzer_eval (v.icc.b == 42); /* { dg-warning "TRUE" } */ - __analyzer_eval (v.icc.c == 17); /* { dg-warning "TRUE" } */ - check_init_int (v.icc.a); - check_init_char (v.icc.b); - check_init_char (v.icc.c); - - check_init_char (v.cic.a); - check_init_int (v.cic.b); - check_init_char (v.cic.c); - - check_init_char (v.cci.a); - check_init_char (v.cci.b); - check_init_int (v.cci.c); - - v.cic.a = 42; - v.cic.b = 1066; - v.cic.c = 17; - - __analyzer_eval (v.cic.a == 42); /* { dg-warning "TRUE" } */ - __analyzer_eval (v.cic.b == 1066); /* { dg-warning "TRUE" } */ - __analyzer_eval (v.cic.c == 17); /* { dg-warning "TRUE" } */ - check_init_int (v.icc.a); - check_init_char (v.icc.b); - check_init_char (v.icc.c); - - check_init_char (v.cic.a); - check_init_int (v.cic.b); - check_init_char (v.cic.c); - - check_init_char (v.cci.a); - check_init_char (v.cci.b); - check_init_int (v.cci.c); - - v.cci.a = 42; - v.cci.b = 17; - v.cci.c = 1066; - - __analyzer_eval (v.cci.a == 42); /* { dg-warning "TRUE" } */ - __analyzer_eval (v.cci.b == 17); /* { dg-warning "TRUE" } */ - __analyzer_eval (v.cci.c == 1066); /* { dg-warning "TRUE" } */ - check_init_int (v.icc.a); - check_init_char (v.icc.b); - check_init_char (v.icc.c); - - check_init_char (v.cic.a); - check_init_int (v.cic.b); - check_init_char (v.cic.c); - - check_init_char (v.cci.a); - check_init_char (v.cci.b); - check_init_int (v.cci.c); - -} diff --git a/gcc/testsuite/gcc.dg/analyzer/data-model-4.c b/gcc/testsuite/gcc.dg/analyzer/data-model-4.c deleted file mode 100644 index d41868d..0000000 --- a/gcc/testsuite/gcc.dg/analyzer/data-model-4.c +++ /dev/null @@ -1,18 +0,0 @@ -/* { dg-additional-options "-fexceptions" } */ -/* TODO:is there a way to automatically run the tests on various - optimizations levels, and with/without debuginfo, rather than - hardcoding options? Adapt from torture .exp, presumably. */ - -#include -int -main () -{ - FILE *f = fopen ("conftest.out", "w"); - if (f == NULL) - return 1; - return ferror (f) || fclose (f) != 0; - - ; - return 0; -} - diff --git a/gcc/testsuite/gcc.dg/analyzer/data-model-5d.c b/gcc/testsuite/gcc.dg/analyzer/data-model-5d.c deleted file mode 100644 index b4d77a9..0000000 --- a/gcc/testsuite/gcc.dg/analyzer/data-model-5d.c +++ /dev/null @@ -1,71 +0,0 @@ -/* A toy re-implementation of CPython's object model. */ - -#include -#include -#include -#include "analyzer-decls.h" - -typedef struct base_obj -{ - struct type_obj *ob_type; - int ob_refcnt; -} base_obj; - -typedef struct type_obj -{ - base_obj tp_base; - void (*tp_dealloc) (base_obj *); -} type_obj; - -typedef struct boxed_int_obj -{ - base_obj int_base; - int int_val; -} boxed_int_obj; - -extern void int_del (base_obj *); - -type_obj type_type = { - { &type_type, 1} -}; - -type_obj boxed_int_type = { - { &type_type, 1}, - int_del -}; - -base_obj *alloc_obj (type_obj *ob_type, size_t sz) -{ - base_obj *obj = (base_obj *)malloc (sz); - if (!obj) - return NULL; - obj->ob_type = ob_type; - obj->ob_refcnt = 1; - return obj; -} - -base_obj *new_int_obj (int val) -{ - boxed_int_obj *int_obj - = (boxed_int_obj *)alloc_obj (&boxed_int_type, sizeof (boxed_int_obj)); - if (!int_obj) - return NULL; - int_obj->int_val = val; - return (base_obj *)int_obj; -} - -void unref (base_obj *obj) -{ - if (--obj->ob_refcnt == 0) - obj->ob_type->tp_dealloc (obj); -} - -void test_1 (const char *str) -{ - base_obj *obj = new_int_obj (42); - if (!obj) - return; - __analyzer_eval (((boxed_int_obj *)obj)->int_val == 42); /* { dg-warning "TRUE" } */ - __analyzer_eval (obj->ob_refcnt == 1); /* { dg-warning "TRUE" } */ - unref (obj); -} /* { dg-bogus "leak" "" } */ diff --git a/gcc/testsuite/gcc.dg/analyzer/data-model-8.c b/gcc/testsuite/gcc.dg/analyzer/data-model-8.c deleted file mode 100644 index 3e69d0f..0000000 --- a/gcc/testsuite/gcc.dg/analyzer/data-model-8.c +++ /dev/null @@ -1,25 +0,0 @@ -#include "analyzer-decls.h" - -struct base -{ - int i; -}; - -struct sub -{ - struct base b; - int j; -}; - -void test (void) -{ - struct sub s; - s.b.i = 3; - s.j = 4; - __analyzer_eval (s.b.i == 3); /* { dg-warning "TRUE" } */ - __analyzer_eval (s.j == 4); /* { dg-warning "TRUE" } */ - - struct base *bp = (struct base *)&s; - - __analyzer_eval (bp->i == 3); /* { dg-warning "TRUE" } */ -} diff --git a/gcc/testsuite/gcc.dg/analyzer/data-model-path-1.c b/gcc/testsuite/gcc.dg/analyzer/data-model-path-1.c deleted file mode 100644 index d7058ea..0000000 --- a/gcc/testsuite/gcc.dg/analyzer/data-model-path-1.c +++ /dev/null @@ -1,13 +0,0 @@ -#include - -static int *__attribute__((noinline)) -callee (void) -{ - return NULL; -} - -void test_1 (void) -{ - int *p = callee (); /* { dg-message "return of NULL to 'test_1' from 'callee'" } */ - *p = 42; /* { dg-warning "dereference of NULL 'p'" } */ -} diff --git a/gcc/testsuite/gcc.dg/analyzer/deref-before-check-2.c b/gcc/testsuite/gcc.dg/analyzer/deref-before-check-2.c deleted file mode 100644 index c0409c4..0000000 --- a/gcc/testsuite/gcc.dg/analyzer/deref-before-check-2.c +++ /dev/null @@ -1,130 +0,0 @@ -#include - -struct st -{ - char *str; - int i; -}; - -int test_1 (struct st *p) -{ - fprintf (stderr, "str: %s\n", p->str); /* { dg-message "pointer 'p' is dereferenced here" } */ - if (!p) /* { dg-warning "check of 'p' for NULL after already dereferencing it" } */ - return -1; - return p->i; -} - -int test_2 (int flag_a, int flag_b, struct st *p) -{ - if (flag_a) - { - int j = p->i; /* { dg-message "pointer 'p' is dereferenced here" } */ - if (flag_b && p) /* { dg-warning "check of 'p' for NULL after already dereferencing it" } */ - return 1; - return j; - } - return 2; -} - -int test_3 (struct st *a, struct st *b) -{ - if (!a) - return b->i; - if (!b) - return a->i; - return 0; -} - -int test_4 (struct st *p) -{ - int *q = &p->i; - if (!p) - return -1; - return *q; -} - -void test_check_after_strlen (const char *str) -{ - size_t len_a = __builtin_strlen (str); /* { dg-message "pointer 'str' is dereferenced here" } */ - size_t len_b = str ? __builtin_strlen (str) : 0; /* { dg-warning "check of 'str' for NULL after already dereferencing it" } */ -} - -void test_6 (struct st *a, struct st *b) -{ - int diff = a->i - b->i; /* { dg-message "pointer 'b' is dereferenced here" } */ - - /* ... */ - - if (b) /* { dg-warning "check of 'b' for NULL after already dereferencing it" } */ - fprintf (stderr, "str: %s\n", b->str); -} - -void test_check_after_strcmp (const char *s1, const char *s2) -{ - if (!__builtin_strcmp (s1, s2)) /* { dg-message "pointer 's1' is dereferenced here" } */ - return; - - /* ... */ - - if (s1) /* { dg-warning "check of 's1' for NULL after already dereferencing it" } */ - return; -} - -void test_more_than_one_deref (struct st *p) -{ - char *str = p->str; /* { dg-message "pointer 'p' is dereferenced here" } */ - int i = p->i; - - /* ... */ - - if (p) /* { dg-warning "check of 'p' for NULL after already dereferencing it" } */ - return; - - /* ... */ -} - -void test_deref_under_another_name (struct st *p) -{ - struct st *q = p; - int i = q->i; /* { dg-message "pointer 'p' is dereferenced here" } */ - - /* ... */ - - if (p) /* { dg-warning "check of 'p' for NULL after already dereferencing it" } */ - return; - - /* ... */ -} - -void test_check_after_memcpy_src (struct st *dst, struct st *src) -{ - __builtin_memcpy (dst, src, sizeof (struct st)); /* { dg-message "pointer 'src' is dereferenced here" } */ - - /* ... */ - - if (!src) /* { dg-warning "check of 'src' for NULL after already dereferencing it" } */ - return; - - /* ... */ -} - -void test_check_after_memcpy_dst (struct st *dst, struct st *src) -{ - __builtin_memcpy (dst, src, sizeof (struct st)); /* { dg-message "pointer 'dst' is dereferenced here" } */ - - /* ... */ - - if (!dst) /* { dg-warning "check of 'dst' for NULL after already dereferencing it" } */ - return; - - /* ... */ -} - -void test_merger (int *p, int flag) -{ - int x = *p; - if (flag) - __builtin_free (p); - if (!flag) - __builtin_free (p); /* { dg-bogus "double-'free'" } */ -} diff --git a/gcc/testsuite/gcc.dg/analyzer/deref-before-check-macro-pr108745.c b/gcc/testsuite/gcc.dg/analyzer/deref-before-check-macro-pr108745.c deleted file mode 100644 index 92f5a02..0000000 --- a/gcc/testsuite/gcc.dg/analyzer/deref-before-check-macro-pr108745.c +++ /dev/null @@ -1,54 +0,0 @@ -/* Reduced from ImageMagick-7.1.0-57. */ - -#define NULL ((void *)0) - -typedef __builtin_va_list va_list; -typedef __SIZE_TYPE__ size_t; - -typedef struct _ExceptionInfo ExceptionInfo; - -void -ThrowMagickException(ExceptionInfo*, - const char*, - const char*, - ...) __attribute__((__format__(__printf__, 3, 4))); - -typedef struct _Image -{ - /* [...snip...] */ - size_t columns, rows, depth, colors; - /* [...snip...] */ -} Image; - -typedef struct _ImageInfo -{ - /* [...snip...] */ - char filename[4096]; - /* [...snip...] */ -} ImageInfo; - -extern Image *AcquireImage(const ImageInfo*, ExceptionInfo*); -extern void CloseBlob(Image*); -extern Image *DestroyImageList(Image*); - -#define ThrowReaderException(tag) \ -{ \ - (void) ThrowMagickException(exception, tag, \ - "`%s'",image_info->filename); \ - if ((image) != (Image *) NULL) \ - { \ - (void) CloseBlob(image); \ - image=DestroyImageList(image); \ - } \ - return((Image *) NULL); \ -} - -Image* -ReadMAPImage(const ImageInfo* image_info, ExceptionInfo* exception) -{ - Image* image; - image = AcquireImage(image_info, exception); - if ((image->columns == 0) || (image->rows == 0)) - ThrowReaderException("MustSpecifyImageSize"); - return image; -} diff --git a/gcc/testsuite/gcc.dg/analyzer/deref-before-check-qemu-qtest_rsp_args.c b/gcc/testsuite/gcc.dg/analyzer/deref-before-check-qemu-qtest_rsp_args.c deleted file mode 100644 index 2b3ad8c..0000000 --- a/gcc/testsuite/gcc.dg/analyzer/deref-before-check-qemu-qtest_rsp_args.c +++ /dev/null @@ -1,73 +0,0 @@ -/* Reduced from qemu-7.2.0's tests/qtest/libqtest.c. */ - -#define TRUE 1 -#define NULL ((void *)0) - -#define g_assert(expr) \ - do { \ - if (expr) ; else /* { dg-warning "check of '\\*words' for NULL after already dereferencing it" } */ \ - g_assertion_message_expr (#expr); \ -} while (0) - -void g_assertion_message_expr (const char *expr) __attribute__((noreturn)); - -extern int strcmp (const char *__s1, const char *__s2) - __attribute__ ((__nothrow__ , __leaf__, __pure__, __nonnull__ (1, 2))); -typedef char gchar; -typedef int gint; -typedef gint gboolean; -typedef struct _GString GString; - -struct _GString -{ - gchar *str; - /* [...snip...] */ -}; - -extern -gchar* g_string_free (GString *string, - gboolean free_segment); -extern -gchar** g_strsplit (const gchar *string, - const gchar *delimiter, - gint max_tokens); -extern -void g_strfreev (gchar **str_array); - -typedef struct QTestState QTestState; -typedef GString* (*QTestRecvFn)(QTestState *); - -typedef struct QTestClientTransportOps { - /* [...snip...] */ - QTestRecvFn recv_line; -} QTestTransportOps; - -struct QTestState -{ - /* [...snip...] */ - QTestTransportOps ops; - /* [...snip...] */ -}; - -gchar **qtest_rsp_args(QTestState *s, int expected_args) -{ - GString *line; - gchar **words; - /* [...snip...] */ - -redo: - line = s->ops.recv_line(s); - words = g_strsplit(line->str, " ", 0); - g_string_free(line, TRUE); - - if (strcmp(words[0], "IRQ") == 0) { /* { dg-message "pointer '\\*words' is dereferenced here" } */ - /* [...snip...] */ - g_strfreev(words); - goto redo; - } - - g_assert(words[0] != NULL); /* { dg-message "in expansion of macro 'g_assert'" } */ - /* [...snip...] */ - - return words; -} diff --git a/gcc/testsuite/gcc.dg/analyzer/disabling.c b/gcc/testsuite/gcc.dg/analyzer/disabling.c deleted file mode 100644 index a696d1e..0000000 --- a/gcc/testsuite/gcc.dg/analyzer/disabling.c +++ /dev/null @@ -1,10 +0,0 @@ -/* Verify that we can override -fanalyzer with -fno-analyzer. */ -/* { dg-additional-options "-fno-analyzer" } */ - -#include - -void test (void *ptr) -{ - free (ptr); - free (ptr); /* { dg-bogus "free" } */ -} diff --git a/gcc/testsuite/gcc.dg/analyzer/dump-state.c b/gcc/testsuite/gcc.dg/analyzer/dump-state.c deleted file mode 100644 index 618a5a9..0000000 --- a/gcc/testsuite/gcc.dg/analyzer/dump-state.c +++ /dev/null @@ -1,14 +0,0 @@ -/* Verify that __analyzer_dump_state works as expected. */ - -#include -#include "analyzer-decls.h" - -void test_1 (void) -{ - void *p = malloc (1024); - __analyzer_dump_state ("malloc", p); /* { dg-warning "state: 'unchecked'" } */ - free (p); - __analyzer_dump_state ("malloc", p); /* { dg-warning "state: 'freed'" } */ - __analyzer_dump_state (NULL, p); /* { dg-error "cannot determine state machine" } */ - __analyzer_dump_state ("not a state machine", p); /* { dg-error "unrecognized state machine 'not a state machine'" } */ -} diff --git a/gcc/testsuite/gcc.dg/analyzer/edges-2.c b/gcc/testsuite/gcc.dg/analyzer/edges-2.c deleted file mode 100644 index 847a708..0000000 --- a/gcc/testsuite/gcc.dg/analyzer/edges-2.c +++ /dev/null @@ -1,20 +0,0 @@ -#include - -int foo (); -int bar (); - -/* Verify that only significant edges are reported. */ - -void test (int a, int b, int c) -{ - void *p = malloc (1024); /* { dg-message "allocated here" } */ - while (a) /* { dg-bogus "" } */ - foo (); - if (b) /* { dg-bogus "" } */ - foo (); - else - bar (); - if (c) /* { dg-message "following 'true' branch" } */ - free (p); /* { dg-message "first 'free' here" } */ - free (p); /* { dg-warning "double-'free' of 'p'" } */ -} diff --git a/gcc/testsuite/gcc.dg/analyzer/equivalence.c b/gcc/testsuite/gcc.dg/analyzer/equivalence.c deleted file mode 100644 index 609b6fd..0000000 --- a/gcc/testsuite/gcc.dg/analyzer/equivalence.c +++ /dev/null @@ -1,31 +0,0 @@ -#include "analyzer-decls.h" - -void test (int p, int q, int r) -{ - if (p == 42) - { - __analyzer_eval (p == 42); /* { dg-warning "TRUE" } */ - __analyzer_eval (p != 42); /* { dg-warning "FALSE" } */ - if (q == 42) - { - __analyzer_eval (p == q); /* { dg-warning "TRUE" } */ - } - else - { - __analyzer_eval (p != q); /* { dg-warning "TRUE" } */ - } - } - else - { - __analyzer_eval (p == 42); /* { dg-warning "FALSE" } */ - __analyzer_eval (p != 42); /* { dg-warning "TRUE" } */ - if (q == 42) - { - __analyzer_eval (p == q); /* { dg-warning "FALSE" } */ - } - else - { - __analyzer_eval (p == q); /* { dg-warning "UNKNOWN" } */ - } - } -} diff --git a/gcc/testsuite/gcc.dg/analyzer/errno-1.c b/gcc/testsuite/gcc.dg/analyzer/errno-1.c deleted file mode 100644 index 6b9d28c..0000000 --- a/gcc/testsuite/gcc.dg/analyzer/errno-1.c +++ /dev/null @@ -1,23 +0,0 @@ -#include -#include "analyzer-decls.h" - -extern void external_fn (void); - -int test_reading_errno (void) -{ - return errno; -} - -void test_setting_errno (int val) -{ - errno = val; -} - -void test_storing_to_errno (int val) -{ - __analyzer_eval (errno == val); /* { dg-warning "UNKNOWN" } */ - errno = val; - __analyzer_eval (errno == val); /* { dg-warning "TRUE" } */ - external_fn (); - __analyzer_eval (errno == val); /* { dg-warning "UNKNOWN" } */ -} diff --git a/gcc/testsuite/gcc.dg/analyzer/errno-___errno.c b/gcc/testsuite/gcc.dg/analyzer/errno-___errno.c deleted file mode 100644 index 17ff8b7..0000000 --- a/gcc/testsuite/gcc.dg/analyzer/errno-___errno.c +++ /dev/null @@ -1,29 +0,0 @@ -#include "analyzer-decls.h" - -/* According to PR 107807 comment #2, Solaris implements "errno" - like this: */ - -extern int *___errno(void) __attribute__((__const__)); -#define errno (*(___errno())) - - -extern void external_fn (void); - -int test_reading_errno (void) -{ - return errno; -} - -void test_setting_errno (int val) -{ - errno = val; -} - -void test_storing_to_errno (int val) -{ - __analyzer_eval (errno == val); /* { dg-warning "UNKNOWN" } */ - errno = val; - __analyzer_eval (errno == val); /* { dg-warning "TRUE" } */ - external_fn (); - __analyzer_eval (errno == val); /* { dg-warning "UNKNOWN" } */ -} diff --git a/gcc/testsuite/gcc.dg/analyzer/errno-__error.c b/gcc/testsuite/gcc.dg/analyzer/errno-__error.c deleted file mode 100644 index 19bc4f9..0000000 --- a/gcc/testsuite/gcc.dg/analyzer/errno-__error.c +++ /dev/null @@ -1,28 +0,0 @@ -#include "analyzer-decls.h" - -/* According to PR 107807 comment #2, OS X implements "errno" - like this: */ - -extern int * __error(void); -#define errno (*__error()) - -extern void external_fn (void); - -int test_reading_errno (void) -{ - return errno; -} - -void test_setting_errno (int val) -{ - errno = val; -} - -void test_storing_to_errno (int val) -{ - __analyzer_eval (errno == val); /* { dg-warning "UNKNOWN" } */ - errno = val; - __analyzer_eval (errno == val); /* { dg-warning "TRUE" } */ - external_fn (); - __analyzer_eval (errno == val); /* { dg-warning "UNKNOWN" } */ -} diff --git a/gcc/testsuite/gcc.dg/analyzer/errno-global-var.c b/gcc/testsuite/gcc.dg/analyzer/errno-global-var.c deleted file mode 100644 index fdf1b17..0000000 --- a/gcc/testsuite/gcc.dg/analyzer/errno-global-var.c +++ /dev/null @@ -1,26 +0,0 @@ -#include "analyzer-decls.h" - -/* "errno" declared as a global var. */ - -extern int errno; - -extern void external_fn (void); - -int test_reading_errno (void) -{ - return errno; -} - -void test_setting_errno (int val) -{ - errno = val; -} - -void test_storing_to_errno (int val) -{ - __analyzer_eval (errno == val); /* { dg-warning "UNKNOWN" } */ - errno = val; - __analyzer_eval (errno == val); /* { dg-warning "TRUE" } */ - external_fn (); - __analyzer_eval (errno == val); /* { dg-warning "UNKNOWN" } */ -} diff --git a/gcc/testsuite/gcc.dg/analyzer/errno-pr107777.c b/gcc/testsuite/gcc.dg/analyzer/errno-pr107777.c deleted file mode 100644 index 6568739..0000000 --- a/gcc/testsuite/gcc.dg/analyzer/errno-pr107777.c +++ /dev/null @@ -1,20 +0,0 @@ -int * -__errno_location (void); - -long int -read (int, void *, unsigned long int); - -struct IOBUF { - int fd; -}; - -void -do_getline_end_data (struct IOBUF *iop, int tree) -{ - char end_data; - - if (tree) - *__errno_location () = 0; - - read (iop->fd, &end_data, sizeof end_data); -} diff --git a/gcc/testsuite/gcc.dg/analyzer/error-3.c b/gcc/testsuite/gcc.dg/analyzer/error-3.c deleted file mode 100644 index b6ab6c8..0000000 --- a/gcc/testsuite/gcc.dg/analyzer/error-3.c +++ /dev/null @@ -1,11 +0,0 @@ -/* Verify that we gracefully handle error functions that don't match - the signature of GNU's . */ - -extern void error (void); -extern void error_at_line (void); - -void test_1 (void) -{ - error (); - error_at_line (); -} diff --git a/gcc/testsuite/gcc.dg/analyzer/error-uninit.c b/gcc/testsuite/gcc.dg/analyzer/error-uninit.c deleted file mode 100644 index 8d52a17..0000000 --- a/gcc/testsuite/gcc.dg/analyzer/error-uninit.c +++ /dev/null @@ -1,29 +0,0 @@ -/* Verify that we check for uninitialized values passed to functions - that we have special-cased region-model handling for. */ - -extern void error (int __status, int __errnum, const char *__format, ...) - __attribute__ ((__format__ (__printf__, 3, 4))); - -void test_uninit_status (int arg) -{ - int st; - error (st, 42, "test: %s", arg); /* { dg-warning "use of uninitialized value 'st'" } */ -} - -void test_uninit_errnum (int st) -{ - int num; - error (st, num, "test"); /* { dg-warning "use of uninitialized value 'num'" } */ -} - -void test_uninit_fmt (int st) -{ - const char *fmt; - error (st, 42, fmt); /* { dg-warning "use of uninitialized value 'fmt'" } */ -} - -void test_uninit_vargs (int st) -{ - int arg; - error (st, 42, "test: %s", arg); /* { dg-warning "use of uninitialized value 'arg'" } */ -} diff --git a/gcc/testsuite/gcc.dg/analyzer/factorial.c b/gcc/testsuite/gcc.dg/analyzer/factorial.c deleted file mode 100644 index 384713a..0000000 --- a/gcc/testsuite/gcc.dg/analyzer/factorial.c +++ /dev/null @@ -1,7 +0,0 @@ -int factorial (int n) -{ - if (n > 1) - return n * factorial (n - 1); - else - return 1; -} diff --git a/gcc/testsuite/gcc.dg/analyzer/fd-1.c b/gcc/testsuite/gcc.dg/analyzer/fd-1.c deleted file mode 100644 index 5b85a33..0000000 --- a/gcc/testsuite/gcc.dg/analyzer/fd-1.c +++ /dev/null @@ -1,60 +0,0 @@ -int open(const char *, int mode); -#define O_RDONLY 0 -#define O_WRONLY 1 -#define O_RDWR 2 - -typedef enum { - S_IRWXU - // etc -} mode_t; - -int creat (const char *, mode_t mode); - -void -test_1 (const char *path) -{ - int fd = open (path, O_RDONLY); /* { dg-message "\\(1\\) opened here" } */ - return; /* { dg-warning "leak of file descriptor 'fd' \\\[CWE-775\\\]" "warning" } */ - /* { dg-message "\\(2\\) 'fd' leaks here; was opened at \\(1\\)" "event" { target *-*-* } .-1 } */ -} - -void -test_2 (const char *path) -{ - int fd = open (path, O_RDWR); /* { dg-message "\\(1\\) opened here" } */ - if (fd >= 0) /* { dg-message "\\(2\\) assuming 'fd' is a valid file descriptor" "event1" } */ - /* { dg-message "\\(3\\) following 'true' branch \\(when 'fd >= 0'\\)..." "event2" { target *-*-* } .-1 } */ - { - return; /* { dg-warning "leak of file descriptor 'fd' \\\[CWE-775\\\]" "warning" } */ - /* { dg-message "\\(4\\) ...to here" "event1" { target *-*-* } .-1 } */ - /* { dg-message "\\(5\\) 'fd' leaks here; was opened at \\(1\\)" "event2" { target *-*-* } .-2 } */ - } -} - -void -test_3 (const char *path) -{ - int fd = open (path, O_WRONLY); /* { dg-message "\\(1\\) opened here" } */ - return; /* { dg-warning "leak of file descriptor 'fd' \\\[CWE-775\\\]" "warning" } */ -} - -void test_4 (const char *path) -{ - open(path, O_RDONLY); /* { dg-warning "leak of file descriptor \\\[CWE-775\\\]" } */ - /* { dg-message "\\(1\\) leaks here" "" { target *-*-* } .-1 } */ -} - -void -test_5 (const char *path, mode_t mode) -{ - creat (path, mode); /* { dg-warning "leak of file descriptor \\\[CWE-775\\\]" } */ -} - -void -test_6 (const char *path, mode_t mode) -{ - int fd = creat (path, mode); - return; /* { dg-warning "leak of file descriptor 'fd' \\\[CWE-775\\\]" } */ -} - - diff --git a/gcc/testsuite/gcc.dg/analyzer/fd-2.c b/gcc/testsuite/gcc.dg/analyzer/fd-2.c deleted file mode 100644 index 10c9ecd..0000000 --- a/gcc/testsuite/gcc.dg/analyzer/fd-2.c +++ /dev/null @@ -1,64 +0,0 @@ -int open(const char *, int mode); -void close(int fd); -#define O_RDONLY 0 -#define O_WRONLY 1 -#define O_RDWR 2 -#define STDIN 0 - -typedef enum { - S_IRWXU - // etc -} mode_t; - -int creat (const char *, mode_t mode); - -void -test_1 (const char *path) -{ - int fd = open (path, O_RDWR); /* { dg-message "\\(1\\) opened here" } */ - close (fd); /* { dg-message "\\(2\\) first 'close' here" "event1" } */ - close (fd); /* { dg-warning "double 'close' of file descriptor 'fd' \\\[CWE-1341\\\]" "warning" } */ - /* { dg-message "\\(3\\) second 'close' here; first 'close' was at \\(2\\)" "event2" { target *-*-* } .-1 } */ -} - -void -test_2 (const char *path) -{ - int fd = open (path, O_RDWR); /* { dg-message "\\(1\\) opened here" } */ - if (fd < 0) /* { dg-message "\\(2\\) assuming 'fd' is a valid file descriptor \\(>= 0\\)" "event1" } */ - /* { dg-message "\\(3\\) following 'false' branch \\(when 'fd >= 0'\\)..." "event2" { target *-*-* } .-1 } */ - return; - close (fd); /* { dg-message "\\(4\\) ...to here" "event1" } */ - /* { dg-message "\\(5\\) first 'close' here" "event2" { target *-*-* } .-1 } */ - close (fd); /* { dg-warning "double 'close' of file descriptor 'fd' \\\[CWE-1341\\\]" "warning" } */ - /* {dg-message "\\(6\\) second 'close' here; first was at \\(5\\)" "" { target *-*-* } .-1 } */ -} - -void -test_3 () -{ - /* FD 0 is stdin at the entry to "main" and thus read-only, but we have no - guarantees here that it hasn't been closed and then reopened for - writing, so we can't issue a warning */ - - int fd = STDIN; - close(fd); /* { dg-message "\\(1\\) first 'close' here" } */ - close(fd); /* { dg-warning "double 'close' of file descriptor 'fd' \\\[CWE-1341\\\]" "warning" } */ - /* { dg-message "\\(2\\) second 'close' here; first 'close' was at \\(1\\)" "event2" { target *-*-* } .-1 } */ -} - -void -test_4 () -{ - int fd = -1; - close(fd); - close(fd); -} - -void -test_5 (const char *path, mode_t mode) -{ - int fd = creat (path, mode); - close(fd); - close(fd); /* { dg-warning "double 'close' of file descriptor 'fd' \\\[CWE-1341\\\]" "warning" } */ -} \ No newline at end of file diff --git a/gcc/testsuite/gcc.dg/analyzer/fd-3.c b/gcc/testsuite/gcc.dg/analyzer/fd-3.c deleted file mode 100644 index 8e71b14..0000000 --- a/gcc/testsuite/gcc.dg/analyzer/fd-3.c +++ /dev/null @@ -1,97 +0,0 @@ -int open(const char *, int mode); -void close(int fd); -int write (int fd, void *buf, int nbytes); -int read (int fd, void *buf, int nbytes); -int some_condition(); - -#define O_RDONLY 0 -#define O_WRONLY 1 -#define O_RDWR 2 -#define STDIN 0 -#define O_NOATIME 262144 - -void -test_1 (const char *path, void *buf) -{ - int fd = open (path, O_RDWR); /* { dg-message "\\(1\\) opened here" } */ - write (fd, buf, 1); /* { dg-message "\\(2\\) 'fd' could be invalid: unchecked value from \\(1\\)" } */ - /* { dg-warning "'write' on possibly invalid file descriptor 'fd'" "warning" { target *-*-* } .-1 } */ - close(fd); -} - -void -test_2 (const char *path, void *buf) -{ - int fd = open (path, O_RDWR); /* { dg-message "\\(1\\) opened here" } */ - read (fd, buf, 1); /* { dg-message "\\(2\\) 'fd' could be invalid: unchecked value from \\(1\\)" } */ - /* { dg-warning "'read' on possibly invalid file descriptor 'fd'" "warning" { target *-*-* } .-1 } */ - close (fd); -} - -void -test_3 (void *buf) -{ - int fd = -1; - read (fd, buf, 1); /* { dg-warning "'read' on possibly invalid file descriptor 'fd'" } */ - /* { dg-message "\\(1\\) 'fd' could be invalid" "" { target *-*-* } .-1 } */ -} - -void -test_4 (void *buf) -{ - int fd = STDIN; - read (fd, buf, 1); - close(fd); -} - -void -test_5 (char *path, void *buf) -{ - int flags = O_RDONLY; - if (some_condition()) - flags |= O_NOATIME; - int fd = open (path, flags); /* { dg-message "\\(1\\) opened here" } */ - read (fd, buf, 1); /* { dg-warning "'read' on possibly invalid file descriptor 'fd'" } */ - /* { dg-message "\\(2\\) 'fd' could be invalid" "" { target *-*-* } .-1 } */ - close (fd); -} - - -void -test_6 (char *path, void *buf) -{ - int fd = open (path, O_RDONLY); - if (fd != -1) - { - read (fd, buf, 1); - } - close (fd); -} - - -void -test_7 (char *path, void *buf) -{ - int fd = open (path, O_RDWR); /* { dg-message "\\(1\\) opened here" } */ - if (fd != -1) /* { dg-message "\\(2\\) assuming 'fd' is an invalid file descriptor \\(< 0\\)" } */ - { - read (fd, buf, 1); - } else - { - write (fd, buf, 1); /* { dg-warning "'write' on possibly invalid file descriptor 'fd'" } */ - - } - close(fd); -} - -void -test_read_from_symbolic_fd (int fd, void *buf) -{ - read (fd, buf, 1); -} - -void -test_write_to_symbolic_fd (int fd, void *buf) -{ - write (fd, buf, 1); -} diff --git a/gcc/testsuite/gcc.dg/analyzer/fd-bind-pr107928.c b/gcc/testsuite/gcc.dg/analyzer/fd-bind-pr107928.c deleted file mode 100644 index acc1a1d..0000000 --- a/gcc/testsuite/gcc.dg/analyzer/fd-bind-pr107928.c +++ /dev/null @@ -1,10 +0,0 @@ -struct sa {}; - -int -bind (int, struct sa *, int); - -int -foo (struct sa sa) -{ - return bind (1, &sa, sizeof sa); -} diff --git a/gcc/testsuite/gcc.dg/analyzer/fd-connect-pr107928.c b/gcc/testsuite/gcc.dg/analyzer/fd-connect-pr107928.c deleted file mode 100644 index f3bdc87..0000000 --- a/gcc/testsuite/gcc.dg/analyzer/fd-connect-pr107928.c +++ /dev/null @@ -1,10 +0,0 @@ -struct sa {}; - -int -connect (int, struct sa *, int); - -int -foo (struct sa sa) -{ - return connect (1, &sa, sizeof sa); -} diff --git a/gcc/testsuite/gcc.dg/analyzer/fd-glibc-byte-stream-socket.c b/gcc/testsuite/gcc.dg/analyzer/fd-glibc-byte-stream-socket.c deleted file mode 100644 index 806bb24..0000000 --- a/gcc/testsuite/gcc.dg/analyzer/fd-glibc-byte-stream-socket.c +++ /dev/null @@ -1,63 +0,0 @@ -/* Example from glibc manual (16.9.6). */ -/* { dg-require-effective-target sockets } */ - -#include -#include -#include -#include -#include -#include -#include -#include -#include - -#define PORT 5555 -#define MESSAGE "Yow!!! Are we having fun yet?!?" -#define SERVERHOST "www.gnu.org" - -void -write_to_server (int filedes) -{ - int nbytes; - - nbytes = write (filedes, MESSAGE, strlen (MESSAGE) + 1); - if (nbytes < 0) - { - perror ("write"); - exit (EXIT_FAILURE); - } -} - - -int -main (void) -{ - extern void init_sockaddr (struct sockaddr_in *name, - const char *hostname, - uint16_t port); - int sock; - struct sockaddr_in servername; - - /* Create the socket. */ - sock = socket (PF_INET, SOCK_STREAM, 0); - if (sock < 0) - { - perror ("socket (client)"); - exit (EXIT_FAILURE); - } - - /* Connect to the server. */ - init_sockaddr (&servername, SERVERHOST, PORT); - if (0 > connect (sock, - (struct sockaddr *) &servername, - sizeof (servername))) - { - perror ("connect (client)"); - exit (EXIT_FAILURE); - } - - /* Send data to the server. */ - write_to_server (sock); - close (sock); - exit (EXIT_SUCCESS); -} diff --git a/gcc/testsuite/gcc.dg/analyzer/fd-manpage-getaddrinfo-client.c b/gcc/testsuite/gcc.dg/analyzer/fd-manpage-getaddrinfo-client.c deleted file mode 100644 index ee627de..0000000 --- a/gcc/testsuite/gcc.dg/analyzer/fd-manpage-getaddrinfo-client.c +++ /dev/null @@ -1,123 +0,0 @@ -/* Example from getaddrinfo.3 manpage, which has this license: - -Copyright (c) 2007, 2008 Michael Kerrisk -and Copyright (c) 2006 Ulrich Drepper -A few pieces of an earlier version remain: -Copyright 2000, Sam Varshavchik - -Permission is granted to make and distribute verbatim copies of this -manual provided the copyright notice and this permission notice are -preserved on all copies. - -Permission is granted to copy and distribute modified versions of this -manual under the conditions for verbatim copying, provided that the -entire resulting derived work is distributed under the terms of a -permission notice identical to this one. - -Since the Linux kernel and libraries are constantly changing, this -manual page may be incorrect or out-of-date. The author(s) assume no -responsibility for errors or omissions, or for damages resulting from -the use of the information contained herein. The author(s) may not -have taken the same level of care in the production of this manual, -which is licensed free of charge, as they might when working -professionally. - -Formatted or processed versions of this manual, if unaccompanied by -the source, must acknowledge the copyright and authors of this work. -*/ - -/* { dg-require-effective-target sockets } */ -/* { dg-additional-options "-Wno-analyzer-too-complex" } */ - -#include -#include -#include -#include -#include -#include -#include - -#define BUF_SIZE 500 - -int -main(int argc, char *argv[]) -{ - struct addrinfo hints; - struct addrinfo *result, *rp; - int sfd, s; - size_t len; - ssize_t nread; - char buf[BUF_SIZE]; - - if (argc < 3) { - fprintf(stderr, "Usage: %s host port msg...\n", argv[0]); - exit(EXIT_FAILURE); - } - - /* Obtain address(es) matching host/port. */ - - memset(&hints, 0, sizeof(hints)); - hints.ai_family = AF_UNSPEC; /* Allow IPv4 or IPv6 */ - hints.ai_socktype = SOCK_DGRAM; /* Datagram socket */ - hints.ai_flags = 0; - hints.ai_protocol = 0; /* Any protocol */ - - s = getaddrinfo(argv[1], argv[2], &hints, &result); - if (s != 0) { - fprintf(stderr, "getaddrinfo: %s\n", gai_strerror(s)); - exit(EXIT_FAILURE); - } - - /* getaddrinfo() returns a list of address structures. - Try each address until we successfully connect(2). - If socket(2) (or connect(2)) fails, we (close the socket - and) try the next address. */ - - for (rp = result; rp != NULL; rp = rp->ai_next) { - sfd = socket(rp->ai_family, rp->ai_socktype, - rp->ai_protocol); - if (sfd == -1) - continue; - - if (connect(sfd, rp->ai_addr, rp->ai_addrlen) != -1) - break; /* Success */ - - close(sfd); - } - - freeaddrinfo(result); /* No longer needed */ - - if (rp == NULL) { /* No address succeeded */ - fprintf(stderr, "Could not connect\n"); - exit(EXIT_FAILURE); - } - - /* Send remaining command-line arguments as separate - datagrams, and read responses from server. */ - - for (int j = 3; j < argc; j++) { - len = strlen(argv[j]) + 1; - /* +1 for terminating null byte */ - - if (len > BUF_SIZE) { - fprintf(stderr, - "Ignoring long message in argument %d\n", j); - continue; - } - - if (write(sfd, argv[j], len) != len) { - fprintf(stderr, "partial/failed write\n"); - exit(EXIT_FAILURE); - } - - nread = read(sfd, buf, BUF_SIZE); - if (nread == -1) { - perror("read"); - exit(EXIT_FAILURE); - } - - printf("Received %zd bytes: %s\n", nread, buf); - } - - exit(EXIT_SUCCESS); -} diff --git a/gcc/testsuite/gcc.dg/analyzer/fd-mappage-getaddrinfo-server.c b/gcc/testsuite/gcc.dg/analyzer/fd-mappage-getaddrinfo-server.c deleted file mode 100644 index d2e39eb..0000000 --- a/gcc/testsuite/gcc.dg/analyzer/fd-mappage-getaddrinfo-server.c +++ /dev/null @@ -1,121 +0,0 @@ -/* Example from getaddrinfo.3 manpage, which has this license: - -Copyright (c) 2007, 2008 Michael Kerrisk -and Copyright (c) 2006 Ulrich Drepper -A few pieces of an earlier version remain: -Copyright 2000, Sam Varshavchik - -Permission is granted to make and distribute verbatim copies of this -manual provided the copyright notice and this permission notice are -preserved on all copies. - -Permission is granted to copy and distribute modified versions of this -manual under the conditions for verbatim copying, provided that the -entire resulting derived work is distributed under the terms of a -permission notice identical to this one. - -Since the Linux kernel and libraries are constantly changing, this -manual page may be incorrect or out-of-date. The author(s) assume no -responsibility for errors or omissions, or for damages resulting from -the use of the information contained herein. The author(s) may not -have taken the same level of care in the production of this manual, -which is licensed free of charge, as they might when working -professionally. - -Formatted or processed versions of this manual, if unaccompanied by -the source, must acknowledge the copyright and authors of this work. -*/ - -/* { dg-require-effective-target sockets } */ - -#include -#include -#include -#include -#include -#include -#include - -#define BUF_SIZE 500 - -int -main(int argc, char *argv[]) -{ - struct addrinfo hints; - struct addrinfo *result, *rp; - int sfd, s; - struct sockaddr_storage peer_addr; - socklen_t peer_addr_len; - ssize_t nread; - char buf[BUF_SIZE]; - - if (argc != 2) { - fprintf(stderr, "Usage: %s port\n", argv[0]); - exit(EXIT_FAILURE); - } - - memset(&hints, 0, sizeof(hints)); - hints.ai_family = AF_UNSPEC; /* Allow IPv4 or IPv6 */ - hints.ai_socktype = SOCK_DGRAM; /* Datagram socket */ - hints.ai_flags = AI_PASSIVE; /* For wildcard IP address */ - hints.ai_protocol = 0; /* Any protocol */ - hints.ai_canonname = NULL; - hints.ai_addr = NULL; - hints.ai_next = NULL; - - s = getaddrinfo(NULL, argv[1], &hints, &result); - if (s != 0) { - fprintf(stderr, "getaddrinfo: %s\n", gai_strerror(s)); - exit(EXIT_FAILURE); - } - - /* getaddrinfo() returns a list of address structures. - Try each address until we successfully bind(2). - If socket(2) (or bind(2)) fails, we (close the socket - and) try the next address. */ - - for (rp = result; rp != NULL; rp = rp->ai_next) { - sfd = socket(rp->ai_family, rp->ai_socktype, - rp->ai_protocol); - if (sfd == -1) - continue; - - if (bind(sfd, rp->ai_addr, rp->ai_addrlen) == 0) - break; /* Success */ - - close(sfd); - } - - freeaddrinfo(result); /* No longer needed */ - - if (rp == NULL) { /* No address succeeded */ - fprintf(stderr, "Could not bind\n"); - exit(EXIT_FAILURE); - } - - /* Read datagrams and echo them back to sender. */ - - for (;;) { - peer_addr_len = sizeof(peer_addr); - nread = recvfrom(sfd, buf, BUF_SIZE, 0, - (struct sockaddr *) &peer_addr, &peer_addr_len); - if (nread == -1) - continue; /* Ignore failed request */ - - char host[NI_MAXHOST], service[NI_MAXSERV]; - - s = getnameinfo((struct sockaddr *) &peer_addr, - peer_addr_len, host, NI_MAXHOST, - service, NI_MAXSERV, NI_NUMERICSERV); - if (s == 0) - printf("Received %zd bytes from %s:%s\n", - nread, host, service); - else - fprintf(stderr, "getnameinfo: %s\n", gai_strerror(s)); - - if (sendto(sfd, buf, nread, 0, - (struct sockaddr *) &peer_addr, - peer_addr_len) != nread) - fprintf(stderr, "Error sending response\n"); - } -} diff --git a/gcc/testsuite/gcc.dg/analyzer/fd-meaning.c b/gcc/testsuite/gcc.dg/analyzer/fd-meaning.c deleted file mode 100644 index 6a9ec92..0000000 --- a/gcc/testsuite/gcc.dg/analyzer/fd-meaning.c +++ /dev/null @@ -1,37 +0,0 @@ - /* { dg-additional-options "-fanalyzer-verbose-state-changes" } */ -int open(const char *, int mode); -void close(int fd); - -#define O_RDONLY 0 -#define O_WRONLY 1 -#define O_RDWR 2 - -void test_1 (const char* path) -{ - int fd = open (path, O_RDWR); /* { dg-message "meaning: \\{verb: 'acquire', noun: 'resource'\\}" } */ - if (fd != -1) - { - close(fd); /* { dg-message "meaning: \\{verb: 'release', noun: 'resource'\\}" } */ - close(fd); /* { dg-warning "double 'close' of file descriptor 'fd' \\\[CWE-1341\\\]" } */ - } -} - -void test_2 (const char* path) -{ - int fd = open (path, O_RDONLY); /* { dg-message "meaning: \\{verb: 'acquire', noun: 'resource'\\}" } */ - if (fd != -1) - { - close(fd); /* { dg-message "meaning: \\{verb: 'release', noun: 'resource'\\}" } */ - close(fd); /* { dg-warning "double 'close' of file descriptor 'fd' \\\[CWE-1341\\\]" } */ - } -} - -void test_3 (const char* path) -{ - int fd = open (path, O_WRONLY); /* { dg-message "meaning: \\{verb: 'acquire', noun: 'resource'\\}" } */ - if (fd != -1) - { - close(fd); /* { dg-message "meaning: \\{verb: 'release', noun: 'resource'\\}" } */ - close(fd); /* { dg-warning "double 'close' of file descriptor 'fd' \\\[CWE-1341\\\]" } */ - } -} \ No newline at end of file diff --git a/gcc/testsuite/gcc.dg/analyzer/fd-socket-meaning.c b/gcc/testsuite/gcc.dg/analyzer/fd-socket-meaning.c deleted file mode 100644 index 82a199f..0000000 --- a/gcc/testsuite/gcc.dg/analyzer/fd-socket-meaning.c +++ /dev/null @@ -1,22 +0,0 @@ -/* { dg-require-effective-target sockets } */ -/* { dg-additional-options "-fanalyzer-verbose-state-changes" } */ - -#include -#include -#include -#include - -void test_leak_unchecked_stream_socket (void) -{ - int fd = socket (AF_UNIX, SOCK_STREAM, 0); /* { dg-message "meaning: \\{verb: 'acquire', noun: 'resource'\\}" } */ -} /* { dg-warning "leak of file descriptor 'fd'" } */ - -void test_leak_unchecked_datagram_socket (void) -{ - int fd = socket (AF_UNIX, SOCK_DGRAM, 0); /* { dg-message "meaning: \\{verb: 'acquire', noun: 'resource'\\}" } */ -} /* { dg-warning "leak of file descriptor 'fd'" } */ - -void test_leak_unchecked_socket (int type) -{ - int fd = socket (AF_UNIX, type, 0); /* { dg-message "meaning: \\{verb: 'acquire', noun: 'resource'\\}" } */ -} /* { dg-warning "leak of file descriptor 'fd'" } */ diff --git a/gcc/testsuite/gcc.dg/analyzer/fd-symbolic-socket.c b/gcc/testsuite/gcc.dg/analyzer/fd-symbolic-socket.c deleted file mode 100644 index d7dc46a..0000000 --- a/gcc/testsuite/gcc.dg/analyzer/fd-symbolic-socket.c +++ /dev/null @@ -1,102 +0,0 @@ -/* { dg-require-effective-target sockets } */ -/* { dg-skip-if "" { powerpc*-*-aix* } } */ - -#include -#include -#include -#include -#include -#include "analyzer-decls.h" - -void test_leak_socket (int type) -{ - int fd = socket (AF_UNIX, type, 0); /* { dg-message "socket created here" } */ -} /* { dg-warning "leak of file descriptor 'fd'" } */ - -void test_leak_socket_no_lhs (int type) -{ - socket (AF_UNIX, type, 0); /* { dg-warning "leak of file descriptor" } */ -} - -void test_close_unchecked_socket (int type) -{ - int fd = socket (AF_UNIX, type, 0); - close (fd); -} - -void test_close_checked_socket (int type) -{ - int fd = socket (AF_UNIX, type, 0); - if (fd == -1) - return; - close (fd); -} - -void test_leak_checked_socket (int type) -{ - int fd = socket (AF_UNIX, type, 0); /* { dg-message "socket created here" } */ - if (fd == -1) /* { dg-warning "leak of file descriptor 'fd'" } */ - return; - // TODO: strange location for leak message -} - -void test_bind_on_checked_socket (int type, const char *sockname) -{ - struct sockaddr_un addr; - int fd = socket (AF_UNIX, type, 0); - if (fd == -1) - return; - memset (&addr, 0, sizeof (addr)); - addr.sun_family = AF_UNIX; - strncpy (addr.sun_path, sockname, sizeof(addr.sun_path) - 1); - bind (fd, (struct sockaddr *)&addr, sizeof (addr)); - close (fd); -} - -void test_bind_on_unchecked_socket (int type, const char *sockname) -{ - struct sockaddr_un addr; - int fd = socket (AF_UNIX, type, 0); /* { dg-message "when 'socket' fails" } */ - memset (&addr, 0, sizeof (addr)); - addr.sun_family = AF_UNIX; - strncpy (addr.sun_path, sockname, sizeof(addr.sun_path) - 1); - bind (fd, (struct sockaddr *)&addr, sizeof (addr)); /* { dg-warning "'bind' on possibly invalid file descriptor 'fd'" } */ - close (fd); -} - -void test_leak_of_bound_socket (int type, const char *sockname) -{ - struct sockaddr_un addr; - int fd = socket (AF_UNIX, type, 0); /* { dg-message "socket created here" } */ - if (fd == -1) - return; - memset (&addr, 0, sizeof (addr)); - addr.sun_family = AF_UNIX; - strncpy (addr.sun_path, sockname, sizeof(addr.sun_path) - 1); - bind (fd, (struct sockaddr *)&addr, sizeof (addr)); /* { dg-warning "leak of file descriptor 'fd'" } */ -} - -void test_listen_without_bind (int type) -{ - int fd = socket (AF_UNIX, type, 0); - if (fd == -1) - return; - listen (fd, 5); /* { dg-warning "'listen' on file descriptor 'fd' in wrong phase" } */ - /* { dg-message "'listen' expects a bound stream socket file descriptor but 'fd' has not yet been bound" "msg" { target *-*-* } .-1 } */ - close (fd); -} - -void test_listen_on_unchecked_bind (int type, const char *sockname) -{ - struct sockaddr_un addr; - int fd = socket (AF_UNIX, type, 0); - if (fd == -1) - return; - memset (&addr, 0, sizeof (addr)); - addr.sun_family = AF_UNIX; - strncpy (addr.sun_path, sockname, sizeof(addr.sun_path) - 1); - bind (fd, (struct sockaddr *)&addr, sizeof (addr)); /* { dg-message "when 'bind' fails" } */ - listen (fd, 5); /* { dg-warning "'listen' on file descriptor 'fd' in wrong phase" "warning" } */ - /* { dg-message "'listen' expects a bound stream socket file descriptor but 'fd' has not yet been bound" "msg" { target *-*-* } .-1 } */ - close (fd); -} diff --git a/gcc/testsuite/gcc.dg/analyzer/fd-uninit-1.c b/gcc/testsuite/gcc.dg/analyzer/fd-uninit-1.c deleted file mode 100644 index 1084d1b..0000000 --- a/gcc/testsuite/gcc.dg/analyzer/fd-uninit-1.c +++ /dev/null @@ -1,19 +0,0 @@ -/* Verify that we check for uninitialized values passed to functions - that we have special-cased state-machine handling for. */ - -int dup (int old_fd); -int not_dup (int old_fd); - -int -test_1 () -{ - int m; - return dup (m); /* { dg-warning "use of uninitialized value 'm'" "uninit" } */ -} - -int -test_2 () -{ - int m; - return not_dup (m); /* { dg-warning "use of uninitialized value 'm'" } */ -} diff --git a/gcc/testsuite/gcc.dg/analyzer/feasibility-1.c b/gcc/testsuite/gcc.dg/analyzer/feasibility-1.c deleted file mode 100644 index 83ec1ca..0000000 --- a/gcc/testsuite/gcc.dg/analyzer/feasibility-1.c +++ /dev/null @@ -1,100 +0,0 @@ -#include "analyzer-decls.h" - -void test_1 (void) -{ - __analyzer_dump_path (); /* { dg-message "path" } */ -} - -void test_2 (int flag) -{ - if (flag) - __analyzer_dump_path (); /* { dg-message "path" } */ -} - -void test_3 (int flag) -{ - if (flag) - if (!flag) - __analyzer_dump_path (); /* { dg-bogus "path" } */ -} - -int global_for_test_4; -static void __attribute__((noinline)) called_by_test_4 () {} -void test_4 (void) -{ - /* Verify that a state change that happens in a stmt that - isn't the first within its BB can affect path feasibility. */ - global_for_test_4 = 0; - global_for_test_4 = 1; - /* Thwart the optimizer. */ - called_by_test_4 (); - if (global_for_test_4) - __analyzer_dump_path (); /* { dg-message "path" } */ -} - -/* Verify that loops don't confuse the feasibility checker. */ - -void test_5 (void) -{ - for (int i = 0; i < 1024; i++) - { - } - __analyzer_dump_path (); /* { dg-message "path" } */ -} - -/* Reproducer for an issue seen with CVE-2005-1689 (PR analyzer/96374): if we - take the shortest path and update state and check feasibility per-edge, we - can erroneously reject valid diagnostics. */ - -int test_6 (int a, int b) -{ - int problem = 0; - if (a) - problem = 1; - if (b) - { - if (!problem) - problem = 2; - __analyzer_dump_path (); /* { dg-message "path" } */ - } - return problem; -} - -/* As above, but call a static function. - Even if the path to the call of called_by_test_6a is falsely rejected - as infeasible, it still makes sense to complain about errors within - the called function. */ - -static void __attribute__((noinline)) -called_by_test_6a (void *ptr) -{ - __builtin_free (ptr); - __builtin_free (ptr); /* { dg-message "double-'free'" } */ -} - -int test_6a (int a, int b, void *ptr) -{ - int problem = 0; - if (a) - problem = 1; - if (b) - { - if (!problem) - problem = 2; - called_by_test_6a (ptr); - } - return problem; -} - -/* After state-merging, the shortest path skips the loop, - but the shortest feasible path enters it. */ - -void test_7 (int n) -{ - int entered_loop = 0; - int i; - for (i = 0; i < n; i++) - entered_loop = 1; - if (entered_loop) - __analyzer_dump_path (); /* { dg-message "path" } */ -} diff --git a/gcc/testsuite/gcc.dg/analyzer/feasibility-2.c b/gcc/testsuite/gcc.dg/analyzer/feasibility-2.c deleted file mode 100644 index 9fe62d2..0000000 --- a/gcc/testsuite/gcc.dg/analyzer/feasibility-2.c +++ /dev/null @@ -1,20 +0,0 @@ -/* Verify that -fno-analyzer-feasibility works. */ -/* { dg-additional-options "-fno-analyzer-feasibility" } */ - -#include "analyzer-decls.h" - -void test_1 (int flag) -{ - int a; - if (flag) - a = 1; - else - a = 2; - - if (a == 1) /* (can only be the case when "flag" was true above). */ - if (!flag) - { - __analyzer_dump_path (); /* { dg-message "note: path" "path diag" } */ - /* { dg-message "infeasible" "infeasibility event" { target *-*-* } .-1 } */ - } -} diff --git a/gcc/testsuite/gcc.dg/analyzer/feasibility-4.c b/gcc/testsuite/gcc.dg/analyzer/feasibility-4.c deleted file mode 100644 index 1a11280..0000000 --- a/gcc/testsuite/gcc.dg/analyzer/feasibility-4.c +++ /dev/null @@ -1,42 +0,0 @@ -#include "analyzer-decls.h" - -extern int rand (void); - -void test_1 (void) -{ - int ret = 0; - while (ret != 42) - ret = rand() % 1000; - - if (ret != 42) - __analyzer_dump_path (); /* { dg-bogus "path" } */ -} - -static void empty_local_fn (void) {} -extern void external_fn (void); - -void test_2 (void) -{ - void (*callback) () = empty_local_fn; - int ret = 0; - while (ret != 42) - ret = rand() % 1000; - - (*callback) (); - - if (ret != 42) - __analyzer_dump_path (); /* { dg-bogus "path" } */ -} - -void test_3 (void) -{ - void (*callback) () = external_fn; - int ret = 0; - while (ret != 42) - ret = rand() % 1000; - - (*callback) (); - - if (ret != 42) - __analyzer_dump_path (); /* { dg-bogus "path" } */ -} diff --git a/gcc/testsuite/gcc.dg/analyzer/feasibility-pr107948.c b/gcc/testsuite/gcc.dg/analyzer/feasibility-pr107948.c deleted file mode 100644 index 5eb8b0a..0000000 --- a/gcc/testsuite/gcc.dg/analyzer/feasibility-pr107948.c +++ /dev/null @@ -1,49 +0,0 @@ -#include "analyzer-decls.h" - -void foo(int width) { - int i = 0; - int base; - if (width > 0){ - __analyzer_eval(i == 0); /* { dg-warning "TRUE" } */ - __analyzer_eval(width > 0); /* { dg-warning "TRUE" } */ - __analyzer_eval(width - i > 0); /* { dg-warning "TRUE" } */ - __analyzer_eval(i - width <= 0); /* { dg-warning "TRUE" } */ - if (i - width <= 0) { - base = 512; - } - else { - __analyzer_dump_path (); /* { dg-bogus "path" } */ - } - base+=1; /* { dg-bogus "uninit" } */ - } -} - -void test_ge_zero (int x) -{ - if (x >= 0) - { - __analyzer_eval(x >= 0); /* { dg-warning "TRUE" } */ - __analyzer_eval(x > 0); /* { dg-warning "UNKNOWN" } */ - __analyzer_eval(x <= 0); /* { dg-warning "UNKNOWN" } */ - __analyzer_eval(x < 0); /* { dg-warning "FALSE" } */ - __analyzer_eval(-x <= 0); /* { dg-warning "TRUE" } */ - __analyzer_eval(-x < 0); /* { dg-warning "UNKNOWN" } */ - __analyzer_eval(-x >= 0); /* { dg-warning "UNKNOWN" } */ - __analyzer_eval(-x > 0); /* { dg-warning "FALSE" } */ - } -} - -void test_gt_zero (int x) -{ - if (x > 0) - { - __analyzer_eval(x >= 0); /* { dg-warning "TRUE" } */ - __analyzer_eval(x > 0); /* { dg-warning "TRUE" } */ - __analyzer_eval(x <= 0); /* { dg-warning "FALSE" } */ - __analyzer_eval(x < 0); /* { dg-warning "FALSE" } */ - __analyzer_eval(-x <= 0); /* { dg-warning "TRUE" } */ - __analyzer_eval(-x < 0); /* { dg-warning "TRUE" } */ - __analyzer_eval(-x >= 0); /* { dg-warning "FALSE" } */ - __analyzer_eval(-x > 0); /* { dg-warning "FALSE" } */ - } -} diff --git a/gcc/testsuite/gcc.dg/analyzer/ferror-1.c b/gcc/testsuite/gcc.dg/analyzer/ferror-1.c deleted file mode 100644 index 2570f08..0000000 --- a/gcc/testsuite/gcc.dg/analyzer/ferror-1.c +++ /dev/null @@ -1,6 +0,0 @@ -#include - -int test_pass_through (FILE *stream) -{ - return ferror (stream); -} diff --git a/gcc/testsuite/gcc.dg/analyzer/fibonacci.c b/gcc/testsuite/gcc.dg/analyzer/fibonacci.c deleted file mode 100644 index 5d4a4e0..0000000 --- a/gcc/testsuite/gcc.dg/analyzer/fibonacci.c +++ /dev/null @@ -1,9 +0,0 @@ -int fib (int n) -{ - if (n > 1) - return fib (n - 1) + fib (n - 2); - else - return n; -} - -/* { dg-regexp "\[^\n\r\]+: warning: analysis bailed out early \\(\[0-9\]+ 'after-snode' enodes; \[0-9\]+ enodes\\) \[^\n\r\]*" } */ diff --git a/gcc/testsuite/gcc.dg/analyzer/file-1.c b/gcc/testsuite/gcc.dg/analyzer/file-1.c deleted file mode 100644 index 316cbb3..0000000 --- a/gcc/testsuite/gcc.dg/analyzer/file-1.c +++ /dev/null @@ -1,64 +0,0 @@ -typedef struct FILE FILE; - -FILE* fopen (const char*, const char*); -int fclose (FILE*); -#define SEEK_SET 0 -int fseek (FILE *, long int, int); - -void -test_1 (const char *path) -{ - FILE *f = fopen (path, "r"); /* { dg-message "opened here" } */ - if (!f) - return; - - fclose (f); /* { dg-message "\\(4\\) \\.\\.\\.to here" "to here" } */ - /* { dg-message "\\(5\\) first 'fclose' here" "first fclose" { target *-*-* } .-1 } */ - fclose (f); /* { dg-warning "double 'fclose' of FILE 'f' \\\[CWE-1341\\\]" "warning" } */ - /* { dg-message "second 'fclose' here; first 'fclose' was at \\(5\\)" "second fclose" { target *-*-* } .-1 } */ -} - -/* Swallow -Wuse-after-free issued for the same problem - { dg-prune-output "-Wuse-after-free" } */ - -void -test_2 (const char *src, const char *dst) -{ - FILE *f_in = fopen (src, "r"); /* { dg-message "\\(1\\) opened here" } */ - if (!f_in) - return; - - FILE *f_out = fopen (src, "w"); - if (!f_out) - return; /* { dg-warning "leak of FILE 'f_in'" "warning" } */ - /* { dg-message "\\(7\\) 'f_in' leaks here; was opened at \\(1\\)" "event" { target *-*-* } .-1 } */ - - fclose (f_out); - fclose (f_in); -} - -void -test_3 (const char *path) -{ - FILE *f = fopen (path, "r"); /* { dg-message "opened here" } */ - return; /* { dg-warning "leak of FILE 'f'" } */ -} - -void -test_4 (const char *path) -{ - FILE *f = fopen (path, "r"); /* { dg-message "opened here" } */ - - /* Ensure we know about common fns that are known to not close the - file (e.g. "fseek"). */ - fseek (f, 1024, SEEK_SET); - - return; /* { dg-warning "leak of FILE 'f'" } */ -} - -void -test_5 (const char *path) -{ - FILE *f = fopen (path, "r"); /* { dg-message "opened here" } */ - return; /* { dg-warning "leak of FILE 'f'" } */ -} diff --git a/gcc/testsuite/gcc.dg/analyzer/file-3.c b/gcc/testsuite/gcc.dg/analyzer/file-3.c deleted file mode 100644 index 8f93a98..0000000 --- a/gcc/testsuite/gcc.dg/analyzer/file-3.c +++ /dev/null @@ -1,18 +0,0 @@ -typedef struct _IO_FILE FILE; -extern struct _IO_FILE *stderr; - -extern FILE *fopen (const char *__restrict __filename, - const char *__restrict __modes); -extern int _IO_getc (FILE *stream); - -void -test_1 (const char *path) -{ - FILE *f = fopen (path, "r"); /* { dg-message "opened here" } */ - - /* Implementation of getc in glibc < 2.28. - Verify that we know that this doesn't close the file. */ - _IO_getc (f); - - return; /* { dg-warning "leak of FILE 'f'" } */ -} diff --git a/gcc/testsuite/gcc.dg/analyzer/file-meaning-1.c b/gcc/testsuite/gcc.dg/analyzer/file-meaning-1.c deleted file mode 100644 index 66b72a7..0000000 --- a/gcc/testsuite/gcc.dg/analyzer/file-meaning-1.c +++ /dev/null @@ -1,15 +0,0 @@ -/* { dg-additional-options "-fanalyzer-verbose-state-changes" } */ - -typedef struct FILE FILE; -FILE* fopen (const char*, const char*); -int fclose (FILE*); - -void test_1 (const char *path) -{ - FILE *f = fopen (path, "r"); /* { dg-message "meaning: \\{verb: 'acquire', noun: 'resource'\\}" } */ - if (!f) - return; - - fclose (f); /* { dg-message "meaning: \\{verb: 'release', noun: 'resource'\\}" } */ - fclose (f); /* { dg-warning "double 'fclose' of FILE 'f'" "warning" } */ -} diff --git a/gcc/testsuite/gcc.dg/analyzer/malloc-ipa-10.c b/gcc/testsuite/gcc.dg/analyzer/malloc-ipa-10.c deleted file mode 100644 index f3a5be5..0000000 --- a/gcc/testsuite/gcc.dg/analyzer/malloc-ipa-10.c +++ /dev/null @@ -1,32 +0,0 @@ -#include - -void -calls_free (void *victim) /* { dg-message "\\(3\\) entry to 'calls_free'" "event 3" } */ -/* { dg-message "\\(7\\) entry to 'calls_free'" "event 7" { target *-*-* } .-1 } */ -{ - free (victim); /* { dg-warning "double-'free' of 'victim'" "warning" } */ - /* { dg-message "\\(4\\) first 'free' here" "event 4" { target *-*-* } .-1 } */ - /* { dg-message "\\(8\\) second 'free' here; first 'free' was at \\(4\\)" "event 8" { target *-*-* } .-2 } */ - - /* TODO: would this be better emitted at the callsite, - for such a simple wrapper? */ -} - -void do_stuff (void) -{ - /* Empty. Irrelevant, and thus should not be expanded into in paths. */ -} - -void test (void *ptr) /* { dg-message "\\(1\\) entry to 'test'" } */ -{ - do_stuff (); - - calls_free (ptr); /* { dg-message "\\(2\\) calling 'calls_free' from 'test'" "event 2" } */ - /* { dg-message "\\(5\\) returning to 'test' from 'calls_free'" "event 5" { target *-*-* } .-1 } */ - - do_stuff (); - - calls_free (ptr); /* { dg-message "\\(6\\) passing freed pointer 'ptr' in call to 'calls_free' from 'test'" } */ - - do_stuff (); -} diff --git a/gcc/testsuite/gcc.dg/analyzer/malloc-ipa-12.c b/gcc/testsuite/gcc.dg/analyzer/malloc-ipa-12.c deleted file mode 100644 index 3813c9a..0000000 --- a/gcc/testsuite/gcc.dg/analyzer/malloc-ipa-12.c +++ /dev/null @@ -1,7 +0,0 @@ -#include - -void recursive_free (void *ptr) -{ - free (ptr); /* { dg-warning "double-'free' of 'ptr'" } */ - recursive_free (ptr); /* { dg-warning "infinite recursion" } */ -} diff --git a/gcc/testsuite/gcc.dg/analyzer/malloc-ipa-13a.c b/gcc/testsuite/gcc.dg/analyzer/malloc-ipa-13a.c deleted file mode 100644 index d74ef59..0000000 --- a/gcc/testsuite/gcc.dg/analyzer/malloc-ipa-13a.c +++ /dev/null @@ -1,38 +0,0 @@ -/* { dg-additional-options "-fanalyzer-verbosity=1" } */ - -#include - -void -calls_free (void *victim) -{ - free (victim); /* { dg-warning "double-'free' of 'victim'" } */ -} - -extern void do_stuff (void); - -struct foo -{ - void *m_p; -}; - -static void * __attribute__((noinline)) -test_a (struct foo f) -{ - do_stuff (); - - calls_free (f.m_p); - - do_stuff (); - - return f.m_p; -} - -void test_b (void *p) -{ - void *q; - struct foo f; - f.m_p = p; - q = test_a (f); - calls_free (q); /* { dg-message "passing freed pointer 'q' in call to 'calls_free' from 'test_b'" } */ - do_stuff (); -} diff --git a/gcc/testsuite/gcc.dg/analyzer/malloc-ipa-9.c b/gcc/testsuite/gcc.dg/analyzer/malloc-ipa-9.c deleted file mode 100644 index a0c78fd..0000000 --- a/gcc/testsuite/gcc.dg/analyzer/malloc-ipa-9.c +++ /dev/null @@ -1,18 +0,0 @@ -/* { dg-additional-options "-fdiagnostics-path-format=none -fanalyzer-verbosity=1" } */ - -#include - -void -two_frees (void *p, void *q) -{ - free (p); - free (q); /* { dg-warning "double-'free' of 'q'" } */ - /* TODO: could be useful to identify that p == q when called from 'test'. */ -} - -extern void do_stuff (void); - -void test (void *ptr) -{ - two_frees (ptr, ptr); -} diff --git a/gcc/testsuite/gcc.dg/analyzer/malloc-many-paths-1.c b/gcc/testsuite/gcc.dg/analyzer/malloc-many-paths-1.c deleted file mode 100644 index 82ad547..0000000 --- a/gcc/testsuite/gcc.dg/analyzer/malloc-many-paths-1.c +++ /dev/null @@ -1,14 +0,0 @@ -#include - -/* Ensure that we don't need to laboriously walk every path to get - to the end of the function. */ - -int test_1 (int n) -{ - int i, j, k; - k = 0; - for (int i = 0; i < n; i++) - for (int j = 0; j < 1000; j++) - k++; - return k; -} diff --git a/gcc/testsuite/gcc.dg/analyzer/malloc-many-paths-3.c b/gcc/testsuite/gcc.dg/analyzer/malloc-many-paths-3.c deleted file mode 100644 index e5d27a4..0000000 --- a/gcc/testsuite/gcc.dg/analyzer/malloc-many-paths-3.c +++ /dev/null @@ -1,36 +0,0 @@ -#include - -extern int foo (void); - -int successes; -int failures; - -#define ONE_DIAMOND \ - do { \ - void *ptr = malloc (128); \ - if (foo ()) \ - successes++; \ - else \ - failures++; \ - free (ptr); \ - } while (0) - -#define TEN_DIAMONDS \ - do { \ - ONE_DIAMOND; ONE_DIAMOND; ONE_DIAMOND; ONE_DIAMOND; ONE_DIAMOND; \ - ONE_DIAMOND; ONE_DIAMOND; ONE_DIAMOND; ONE_DIAMOND; ONE_DIAMOND; \ - } while (0) - -void test_3 (void *ptr) -{ - free (ptr); -#if 1 - ONE_DIAMOND; -#else - /* TODO: enabling this leads to numerous duplicated reports, - all of them detailing all the extraneous info about the malloc/free - within the diamonds. */ - TEN_DIAMONDS; -#endif - free (ptr); /* { dg-warning "double-'free' of 'ptr'" } */ -} diff --git a/gcc/testsuite/gcc.dg/analyzer/malloc-meaning-1.c b/gcc/testsuite/gcc.dg/analyzer/malloc-meaning-1.c deleted file mode 100644 index 4964e25..0000000 --- a/gcc/testsuite/gcc.dg/analyzer/malloc-meaning-1.c +++ /dev/null @@ -1,10 +0,0 @@ -/* { dg-additional-options "-fanalyzer-verbose-state-changes" } */ - -#include - -void test_1 (void) -{ - void *ptr = malloc (1024); /* { dg-message "meaning: \\{verb: 'acquire', noun: 'memory'\\}" } */ - free (ptr); /* { dg-message "meaning: \\{verb: 'release', noun: 'memory'\\}" } */ - free (ptr); /* { dg-warning "double-'free' of 'ptr'" } */ -} diff --git a/gcc/testsuite/gcc.dg/analyzer/malloc-paths-1.c b/gcc/testsuite/gcc.dg/analyzer/malloc-paths-1.c deleted file mode 100644 index 0436928..0000000 --- a/gcc/testsuite/gcc.dg/analyzer/malloc-paths-1.c +++ /dev/null @@ -1,15 +0,0 @@ -/* Verify that we emit sane paths for state machine errors. */ - -#include - -void test_1 (void) -{ - void *ptr = malloc (1024); /* { dg-line malloc } */ - free (ptr); /* { dg-line first_free } */ - free (ptr); /* { dg-line second_free } */ - - /* { dg-warning "double-'free' of 'ptr'" "warning" { target *-*-* } second_free } */ - /* { dg-message "\\(1\\) allocated here" "event 1" { target *-*-* } malloc } */ - /* { dg-message "\\(2\\) first 'free' here" "event 2" { target *-*-* } first_free } */ - /* { dg-message "\\(3\\) second 'free' here; first 'free' was at \\(2\\)" "event 3" { target *-*-* } second_free } */ -} diff --git a/gcc/testsuite/gcc.dg/analyzer/malloc-paths-2.c b/gcc/testsuite/gcc.dg/analyzer/malloc-paths-2.c deleted file mode 100644 index 27098da..0000000 --- a/gcc/testsuite/gcc.dg/analyzer/malloc-paths-2.c +++ /dev/null @@ -1,13 +0,0 @@ -/* Verify that we emit sane paths for state machine errors. */ - -#include - -void test_2 (void *ptr) -{ - free (ptr); /* { dg-line first_free } */ - free (ptr); /* { dg-line second_free } */ - - /* { dg-warning "double-'free' of 'ptr'" "warning" { target *-*-* } second_free } */ - /* { dg-message "\\(1\\) first 'free' here" "event 1" { target *-*-* } first_free } */ - /* { dg-message "\\(2\\) second 'free' here; first 'free' was at \\(1\\)" "event 2" { target *-*-* } second_free } */ -} diff --git a/gcc/testsuite/gcc.dg/analyzer/malloc-paths-3.c b/gcc/testsuite/gcc.dg/analyzer/malloc-paths-3.c deleted file mode 100644 index 8f9e4cf..0000000 --- a/gcc/testsuite/gcc.dg/analyzer/malloc-paths-3.c +++ /dev/null @@ -1,14 +0,0 @@ -/* Verify that we emit sane paths for state machine errors. */ - -#include - -int *test_3 (void) -{ - int *ptr = (int *)malloc (sizeof (int)); /* { dg-line malloc } */ - *ptr = 42; /* { dg-line unchecked_deref } */ - return ptr; - - /* { dg-warning "dereference of possibly-NULL 'ptr'" "warning" { target *-*-* } unchecked_deref } */ - /* { dg-message "\\(1\\) this call could return NULL" "event 1" { target *-*-* } malloc } */ - /* { dg-message "\\(2\\) 'ptr' could be NULL" "event 2" { target *-*-* } unchecked_deref } */ -} diff --git a/gcc/testsuite/gcc.dg/analyzer/malloc-paths-4.c b/gcc/testsuite/gcc.dg/analyzer/malloc-paths-4.c deleted file mode 100644 index 7b7803e..0000000 --- a/gcc/testsuite/gcc.dg/analyzer/malloc-paths-4.c +++ /dev/null @@ -1,20 +0,0 @@ -/* Verify that we emit sane paths for state machine errors. */ - -#include - -int *test_4 (void) -{ - int *ptr = (int *)malloc (sizeof (int)); /* { dg-line malloc } */ - if (ptr) /* { dg-line cond } */ - *ptr = 42; - else - *ptr = 43; /* { dg-line on_null_ptr } */ - return ptr; - - /* { dg-warning "dereference of NULL 'ptr'" "warning" { target *-*-* } on_null_ptr } */ - /* { dg-message "\\(1\\) allocated here" "event 1" { target *-*-* } malloc } */ - /* { dg-message "\\(2\\) assuming 'ptr' is NULL" "event 2" { target *-*-* } cond } */ - /* { dg-message "\\(3\\) following 'false' branch \\(when 'ptr' is NULL\\)\\.\\.\\." "event 3" { target *-*-* } cond } */ - /* { dg-message "\\(4\\) \\.\\.\\.to here" "event 4" { target *-*-* } on_null_ptr } */ - /* { dg-message "\\(5\\) dereference of NULL 'ptr'" "event 5" { target *-*-* } on_null_ptr } */ -} diff --git a/gcc/testsuite/gcc.dg/analyzer/malloc-paths-5.c b/gcc/testsuite/gcc.dg/analyzer/malloc-paths-5.c deleted file mode 100644 index ca8d22b..0000000 --- a/gcc/testsuite/gcc.dg/analyzer/malloc-paths-5.c +++ /dev/null @@ -1,43 +0,0 @@ -#include -#include - -extern void do_stuff (void); - -int test (const char *filename, int flag) -{ - FILE *f; - int *p, *q; - int i; - - p = (int *)malloc (sizeof (int)); /* { dg-line malloc_of_p } */ - if (!p) /* { dg-line test_of_p } */ - { - free (p); - return -1; - } - - q = (int *)malloc (sizeof (int)); /* { dg-line malloc_of_q } */ - if (!q) /* { dg-line test_of_q } */ - { - free (p); /* { dg-line first_free_of_p } */ - /* oops: forgot the "return" here, so it falls through. */ - } - - do_stuff (); - - free (p); /* { dg-line second_free_of_p } */ - free (q); - return 0; - - /* { dg-warning "double-'free' of 'p'" "warning" { target *-*-* } second_free_of_p } */ - /* { dg-message "\\(1\\) allocated here" "event 1" { target *-*-* } malloc_of_p } */ - /* { dg-message "\\(2\\) assuming 'p' is non-NULL" "event 2" { target *-*-* } test_of_p } */ - /* { dg-message "\\(3\\) following 'false' branch \\(when 'p' is non-NULL\\)\\.\\.\\." "event 3" { target *-*-* } test_of_p } */ - /* { dg-message "\\(4\\) \\.\\.\\.to here" "event 4" { target *-*-* } malloc_of_q } */ - /* { dg-message "\\(5\\) following 'true' branch \\(when 'q' is NULL\\)\\.\\.\\." "event 5" { target *-*-* } test_of_q } */ - /* { dg-message "\\(6\\) \\.\\.\\.to here" "event 6" { target *-*-* } first_free_of_p } */ - /* { dg-message "\\(7\\) first 'free' here" "event 7" { target *-*-* } first_free_of_p } */ - /* { dg-message "\\(8\\) second 'free' here; first 'free' was at \\(7\\)" "event 8" { target *-*-* } second_free_of_p } */ - - /* We don't care about the state changes to q. */ -} diff --git a/gcc/testsuite/gcc.dg/analyzer/malloc-paths-6.c b/gcc/testsuite/gcc.dg/analyzer/malloc-paths-6.c deleted file mode 100644 index 1df6964..0000000 --- a/gcc/testsuite/gcc.dg/analyzer/malloc-paths-6.c +++ /dev/null @@ -1,11 +0,0 @@ -#include - -void test (void *ptr) -{ - void *q; - q = ptr; - free (ptr); - free (q); /* { dg-warning "double-'free' of 'q'" } */ - /* The above case requires us to handle equivalence classes in - state transitions. */ -} diff --git a/gcc/testsuite/gcc.dg/analyzer/malloc-paths-7.c b/gcc/testsuite/gcc.dg/analyzer/malloc-paths-7.c deleted file mode 100644 index f6b99e3..0000000 --- a/gcc/testsuite/gcc.dg/analyzer/malloc-paths-7.c +++ /dev/null @@ -1,21 +0,0 @@ -#include - -extern int foo (void); -extern int bar (void); - -void test (void) -{ - void *p = malloc (1024); /* { dg-message "\\(1\\) allocated here" } */ - void *q = malloc (1024); - - foo (); - if (!q) /* { dg-message "\\(2\\) following 'true' branch \\(when 'q' is NULL\\)\\.\\.\\." } */ - { - free (q); /* { dg-message "\\(3\\) \\.\\.\\.to here" } */ - return; /* { dg-warning "leak of 'p'" "warning" } */ - /* { dg-message "\\(4\\) 'p' leaks here; was allocated at \\(1\\)" "event" { target *-*-* } .-1 } */ - } - bar (); - free (q); - free (p); -} diff --git a/gcc/testsuite/gcc.dg/analyzer/malloc-paths-8.c b/gcc/testsuite/gcc.dg/analyzer/malloc-paths-8.c deleted file mode 100644 index 4988f53..0000000 --- a/gcc/testsuite/gcc.dg/analyzer/malloc-paths-8.c +++ /dev/null @@ -1,55 +0,0 @@ -/* { dg-additional-options "-fanalyzer-transitivity" } */ -/* { dg-require-effective-target alloca } */ - -#include -#include - -extern void do_stuff (const void *); - -#define LIMIT 1024 - -void test_1 (size_t sz) -{ - void *ptr; - if (sz >= LIMIT) - ptr = malloc (sz); - else - ptr = __builtin_alloca (sz); - - do_stuff (ptr); - - if (sz >= LIMIT) - free (ptr); -} - -void test_2 (size_t sz) -{ - void *ptr; - if (sz < LIMIT) - ptr = __builtin_alloca (sz); - else - ptr = malloc (sz); - - do_stuff (ptr); - - if (sz >= LIMIT) - free (ptr); -} - -void test_3 (size_t sz) -{ - void *ptr; - if (sz <= LIMIT) - ptr = __builtin_alloca (sz); /* { dg-message "region created on stack here" } */ - else - ptr = malloc (sz); - - do_stuff (ptr); - - /* Bug: the "sz <= LIMIT" above should have been "sz < LIMIT", - so there's a free-of-alloca when sz == LIMIT. */ - if (sz >= LIMIT) - free (ptr); /* { dg-warning "'free' of 'ptr' which points to memory on the stack" } */ -} -/* { dg-bogus "leak of 'ptr'" } */ -/* This can't happen, as "sz > 1024" && "sz <= 1023" is impossible. */ diff --git a/gcc/testsuite/gcc.dg/analyzer/malloc-sarif-1.c b/gcc/testsuite/gcc.dg/analyzer/malloc-sarif-1.c deleted file mode 100644 index 19ac89f..0000000 --- a/gcc/testsuite/gcc.dg/analyzer/malloc-sarif-1.c +++ /dev/null @@ -1,22 +0,0 @@ -/* { dg-do compile } */ -/* { dg-additional-options " -fno-diagnostics-json-formatting -fdiagnostics-format=sarif-file" } */ - -#include - -void test_1 (void) -{ - void *ptr = malloc (1024); - free (ptr); - free (ptr); -} - -/* Verify SARIF output. - - { dg-final { verify-sarif-file } } - - The threadFlowLocation objects should have "kinds" properties - reflecting the meanings of the events: - { dg-final { scan-sarif-file "\"kinds\": \\\[\"acquire\", \"memory\"\\\]" } } - { dg-final { scan-sarif-file "\"kinds\": \\\[\"release\", \"memory\"\\\]" } } - { dg-final { scan-sarif-file "\"kinds\": \\\[\"danger\"\\\]" } } -*/ diff --git a/gcc/testsuite/gcc.dg/analyzer/malloc-vs-local-1a.c b/gcc/testsuite/gcc.dg/analyzer/malloc-vs-local-1a.c deleted file mode 100644 index bf77862..0000000 --- a/gcc/testsuite/gcc.dg/analyzer/malloc-vs-local-1a.c +++ /dev/null @@ -1,179 +0,0 @@ -/* { dg-additional-options "-fno-analyzer-call-summaries -fanalyzer-transitivity" } */ - -#include -#include "analyzer-decls.h" - -extern int foo (int); - -static int __attribute__((noinline)) -do_stuff (int *p, int n) -{ - int sum = 0; - int i; - for (i = 0; i < n; i++) - p[i] = i; /* { dg-warning "dereference of possibly-NULL 'p'" } */ - for (i = 0; i < n; i++) - sum += foo (p[i]); /* { dg-bogus "uninitialized" } */ - return sum; -} - -static int __attribute__((noinline)) -do_stuff_2 (int *p, int n) -{ - return 0; -} - -/* Various examples of functions that use either a malloc buffer - or a local buffer, do something, then conditionally free the - buffer, tracking whether "free" is necessary in various - ways. - - In each case, there ought to be only two paths through the function, - not four. */ - -/* Repeated (n > 10) predicate. */ - -int test_repeated_predicate_1 (int n) -{ - int buf[10]; - int *ptr; - int result; - - if (n > 10) - ptr = (int *)malloc (sizeof (int) * n); - else - ptr = buf; - - __analyzer_dump_exploded_nodes (0); /* { dg-warning "2 processed enodes" } */ - - result = do_stuff (ptr, n); - - __analyzer_dump_exploded_nodes (0); /* { dg-warning "2 processed enodes" } */ - - __analyzer_dump_exploded_nodes (0); /* { dg-warning "2 processed enodes" } */ - - - if (n > 10) - free (ptr); /* { dg-bogus "not on the heap" } */ - - return result; /* { dg-bogus "leak" } */ -} - -/* A simpler version of the above. */ - -int test_repeated_predicate_2 (int n) -{ - int buf[10]; - int *ptr; - int result; - - if (n > 10) - ptr = (int *)malloc (sizeof (int) * n); - else - ptr = buf; - - __analyzer_dump_exploded_nodes (0); /* { dg-warning "2 processed enodes" } */ - - result = do_stuff_2 (ptr, n); - - __analyzer_dump_exploded_nodes (0); /* { dg-warning "2 processed enodes" } */ - - if (n > 10) - free (ptr); /* { dg-bogus "not on the heap" } */ - - return result; /* { dg-bogus "leak" } */ -} - -/* A predicate that sets a flag for the 2nd test. */ - -int test_explicit_flag (int n) -{ - int buf[10]; - int *ptr; - int result; - int need_to_free = 0; - - if (n > 10) - { - ptr = (int *)malloc (sizeof (int) * n); - need_to_free = 1; - } - else - ptr = buf; - - __analyzer_dump_exploded_nodes (0); /* { dg-warning "2 processed enodes" } */ - - result = do_stuff (ptr, n); - - __analyzer_dump_exploded_nodes (0); /* { dg-warning "2 processed enodes" } */ - - - if (need_to_free) - free (ptr); /* { dg-bogus "not on the heap" } */ - - return result; /* { dg-bogus "leak" } */ -} - -/* Pointer comparison. */ - -int test_pointer_comparison (int n) -{ - int buf[10]; - int *ptr; - int result; - - if (n > 10) - ptr = (int *)malloc (sizeof (int) * n); - else - ptr = buf; - - __analyzer_dump_exploded_nodes (0); /* { dg-warning "2 processed enodes" } */ - - result = do_stuff (ptr, n); - - __analyzer_dump_exploded_nodes (0); /* { dg-warning "2 processed enodes" } */ - - - if (ptr != buf) - free (ptr); /* { dg-bogus "not on the heap" } */ - - return result; /* { dg-bogus "leak" } */ -} - -/* Set a flag based on a conditional, then use it, then reuse the - conditional. */ - -int test_initial_flag (int n) -{ - int buf[10]; - int *ptr; - int result; - int on_heap = 0; - - if (n > 10) - on_heap = 1; - else - on_heap = 0; - - /* Due to state-merging, we lose the relationship between 'n > 10' - and 'on_heap' here; we have to rely on feasibility-checking - in the diagnostic_manager to reject the false warnings. */ - __analyzer_dump_exploded_nodes (0); /* { dg-warning "1 processed enode" } */ - - if (on_heap) - ptr = (int *)malloc (sizeof (int) * n); - else - ptr = buf; - - __analyzer_dump_exploded_nodes (0); /* { dg-warning "2 processed enodes" } */ - - result = do_stuff (ptr, n); - - __analyzer_dump_exploded_nodes (0); /* { dg-warning "3 processed enodes" } */ - // FIXME: why 3 here? - - if (n > 10) - free (ptr); /* { dg-bogus "not on the heap" } */ - - return result; /* { dg-bogus "leak" } */ -} diff --git a/gcc/testsuite/gcc.dg/analyzer/malloc-vs-local-1b.c b/gcc/testsuite/gcc.dg/analyzer/malloc-vs-local-1b.c deleted file mode 100644 index a30b8c0..0000000 --- a/gcc/testsuite/gcc.dg/analyzer/malloc-vs-local-1b.c +++ /dev/null @@ -1,173 +0,0 @@ -/* { dg-additional-options "-fanalyzer-call-summaries" } */ - -#include -#include "analyzer-decls.h" - -extern int foo (int); - -static int __attribute__((noinline)) -do_stuff (int *p, int n) -{ - int sum = 0; - int i; - for (i = 0; i < n; i++) - p[i] = i; - for (i = 0; i < n; i++) - sum += foo (p[i]); /* { dg-bogus "uninitialized" } */ - return sum; -} - -static int __attribute__((noinline)) -do_stuff_2 (int *p, int n) -{ - return 0; -} - -/* Various examples of functions that use either a malloc buffer - or a local buffer, do something, then conditionally free the - buffer, tracking whether "free" is necessary in various - ways. - - In each case, there ought to be only two paths through the function, - not four. */ - -/* Repeated (n > 10) predicate. */ - -int test_repeated_predicate_1 (int n) -{ - int buf[10]; - int *ptr; - int result; - - if (n > 10) - ptr = (int *)malloc (sizeof (int) * n); - else - ptr = buf; - - __analyzer_dump_exploded_nodes (0); /* { dg-warning "2 processed enodes" } */ - - result = do_stuff (ptr, n); - - __analyzer_dump_exploded_nodes (0); /* { dg-warning "2 processed enodes" } */ - - if (n > 10) - free (ptr); /* { dg-bogus "not on the heap" } */ - - return result; /* { dg-bogus "leak" } */ -} - -/* A simpler version of the above. */ - -int test_repeated_predicate_2 (int n) -{ - int buf[10]; - int *ptr; - int result; - - if (n > 10) - ptr = (int *)malloc (sizeof (int) * n); - else - ptr = buf; - - __analyzer_dump_exploded_nodes (0); /* { dg-warning "2 processed enodes" } */ - - result = do_stuff_2 (ptr, n); - - __analyzer_dump_exploded_nodes (0); /* { dg-warning "2 processed enodes" } */ - - if (n > 10) - free (ptr); /* { dg-bogus "not on the heap" } */ - - return result; /* { dg-bogus "leak" } */ -} - -/* A predicate that sets a flag for the 2nd test. */ - -int test_explicit_flag (int n) -{ - int buf[10]; - int *ptr; - int result; - int need_to_free = 0; - - if (n > 10) - { - ptr = (int *)malloc (sizeof (int) * n); - need_to_free = 1; - } - else - ptr = buf; - - __analyzer_dump_exploded_nodes (0); /* { dg-warning "2 processed enodes" } */ - - result = do_stuff (ptr, n); - - __analyzer_dump_exploded_nodes (0); /* { dg-warning "2 processed enodes" } */ - - if (need_to_free) - free (ptr); /* { dg-bogus "not on the heap" } */ - - return result; /* { dg-bogus "leak" } */ -} - -/* Pointer comparison. */ - -int test_pointer_comparison (int n) -{ - int buf[10]; - int *ptr; - int result; - - if (n > 10) - ptr = (int *)malloc (sizeof (int) * n); - else - ptr = buf; - - __analyzer_dump_exploded_nodes (0); /* { dg-warning "2 processed enodes" } */ - - result = do_stuff (ptr, n); - - __analyzer_dump_exploded_nodes (0); /* { dg-warning "2 processed enodes" } */ - - if (ptr != buf) - free (ptr); /* { dg-bogus "not on the heap" } */ - - return result; /* { dg-bogus "leak" } */ -} - -/* Set a flag based on a conditional, then use it, then reuse the - conditional. */ - -int test_initial_flag (int n) -{ - int buf[10]; - int *ptr; - int result; - int on_heap = 0; - - if (n > 10) - on_heap = 1; - else - on_heap = 0; - - /* Due to state-merging, we lose the relationship between 'n > 10' - and 'on_heap' here; we have to rely on feasibility-checking - in the diagnostic_manager to reject the false warnings. */ - __analyzer_dump_exploded_nodes (0); /* { dg-warning "1 processed enode" } */ - - if (on_heap) - ptr = (int *)malloc (sizeof (int) * n); - else - ptr = buf; - - __analyzer_dump_exploded_nodes (0); /* { dg-warning "2 processed enodes" } */ - - result = do_stuff (ptr, n); - - __analyzer_dump_exploded_nodes (0); /* { dg-warning "2 processed enodes" } */ - - if (n > 10) - free (ptr); /* { dg-bogus "not on the heap" } */ - - return result; /* { dg-bogus "leak" } */ -} diff --git a/gcc/testsuite/gcc.dg/analyzer/malloc-vs-local-2.c b/gcc/testsuite/gcc.dg/analyzer/malloc-vs-local-2.c deleted file mode 100644 index 9001fe6..0000000 --- a/gcc/testsuite/gcc.dg/analyzer/malloc-vs-local-2.c +++ /dev/null @@ -1,175 +0,0 @@ -#include -#include "analyzer-decls.h" - -extern int foo (int); - -static int __attribute__((noinline)) -do_stuff_2 (int *p, int n) -{ - return 0; -} - -/* As malloc-vs-local.c, but hand-inlining the logic. */ - -/* Repeated (n > 10) predicate. */ - -int test_repeated_predicate_1 (int n) -{ - int buf[10]; - int *ptr; - int result; - - if (n > 10) - ptr = (int *)malloc (sizeof (int) * n); - else - ptr = buf; - - __analyzer_dump_exploded_nodes (0); /* { dg-warning "2 processed enodes" } */ - - { - int *p = ptr; - int sum = 0; - int i; - for (i = 0; i < n; i++) - p[i] = i; /* { dg-warning "dereference of possibly-NULL" } */ - for (i = 0; i < n; i++) - sum += foo (p[i]); /* { dg-bogus "uninitialized" } */ - result = sum; - } - - __analyzer_dump_exploded_nodes (0); /* { dg-warning "2 processed enodes" } */ - - if (n > 10) - free (ptr); /* { dg-bogus "not on the heap" } */ - - return result; /* { dg-bogus "leak" } */ -} - -/* As above, but with just one loop. */ - -int test_repeated_predicate_1a (int n) -{ - int buf[10]; - int *ptr; - int result; - - if (n > 10) - ptr = (int *)malloc (sizeof (int) * n); - else - ptr = buf; - - __analyzer_dump_exploded_nodes (0); /* { dg-warning "2 processed enodes" } */ - - { - int *p = ptr; - int sum = 0; - int i; - for (i = 0; i < n; i++) - p[i] = i; /* { dg-warning "dereference of possibly-NULL" } */ - result = sum; - } - - __analyzer_dump_exploded_nodes (0); /* { dg-warning "2 processed enodes" } */ - - if (n > 10) - free (ptr); /* { dg-bogus "not on the heap" } */ - - return result; /* { dg-bogus "leak" } */ -} - -/* A simpler version of the above. */ - -int test_repeated_predicate_2 (int n) -{ - int buf[10]; - int *ptr; - int result; - - if (n > 10) - ptr = (int *)malloc (sizeof (int) * n); - else - ptr = buf; - - __analyzer_dump_exploded_nodes (0); /* { dg-warning "2 processed enodes" } */ - - result = do_stuff_2 (ptr, n); - - __analyzer_dump_exploded_nodes (0); /* { dg-warning "2 processed enodes" } */ - - if (n > 10) - free (ptr); /* { dg-bogus "not on the heap" } */ - - return result; /* { dg-bogus "leak" } */ -} - -/* A predicate that sets a flag for the 2nd test. */ - -int test_explicit_flag (int n) -{ - int buf[10]; - int *ptr; - int result; - int need_to_free = 0; - - if (n > 10) - { - ptr = (int *)malloc (sizeof (int) * n); - need_to_free = 1; - } - else - ptr = buf; - - __analyzer_dump_exploded_nodes (0); /* { dg-warning "2 processed enodes" } */ - - { - int *p = ptr; - int sum = 0; - int i; - for (i = 0; i < n; i++) - p[i] = i; /* { dg-warning "dereference of possibly-NULL" } */ - for (i = 0; i < n; i++) - sum += foo (p[i]); /* { dg-bogus "uninitialized" } */ - result = sum; - } - - __analyzer_dump_exploded_nodes (0); /* { dg-warning "2 processed enodes" } */ - - if (need_to_free) - free (ptr); /* { dg-bogus "not on the heap" } */ - - return result; /* { dg-bogus "leak" } */ -} - -/* Pointer comparison. */ - -int test_pointer_comparison (int n) -{ - int buf[10]; - int *ptr; - int result; - - if (n > 10) - ptr = (int *)malloc (sizeof (int) * n); - else - ptr = buf; - - __analyzer_dump_exploded_nodes (0); /* { dg-warning "2 processed enodes" } */ - - { - int *p = ptr; - int sum = 0; - int i; - for (i = 0; i < n; i++) - p[i] = i; /* { dg-warning "dereference of possibly-NULL" } */ - for (i = 0; i < n; i++) - sum += foo (p[i]); /* { dg-bogus "uninitialized" } */ - result = sum; - } - - __analyzer_dump_exploded_nodes (0); /* { dg-warning "2 processed enodes" } */ - - if (ptr != buf) - free (ptr); /* { dg-bogus "not on the heap" } */ - - return result; /* { dg-bogus "leak" } */ -} diff --git a/gcc/testsuite/gcc.dg/analyzer/malloc-vs-local-3.c b/gcc/testsuite/gcc.dg/analyzer/malloc-vs-local-3.c deleted file mode 100644 index 0196389..0000000 --- a/gcc/testsuite/gcc.dg/analyzer/malloc-vs-local-3.c +++ /dev/null @@ -1,64 +0,0 @@ -#include -#include "analyzer-decls.h" - -extern int foo (int); - -static int __attribute__((noinline)) -do_stuff_2 (int *p, int n) -{ - return 0; -} - -/* As malloc-vs-local-2.c, but with a memory leak for the "on the heap case" - by not attempting to free at the end. */ - -int test_1 (int n) -{ - int buf[10]; - int *ptr; - int result; - - if (n > 10) - ptr = (int *)malloc (sizeof (int) * n); - else - ptr = buf; - - __analyzer_dump_exploded_nodes (0); /* { dg-warning "2 processed enodes" } */ - - { - int *p = ptr; - int sum = 0; - int i; - for (i = 0; i < n; i++) - p[i] = i; /* { dg-warning "dereference of possibly-NULL" } */ - for (i = 0; i < n; i++) - sum += foo (p[i]); /* { dg-bogus "uninitialized" } */ - result = sum; - } - - __analyzer_dump_exploded_nodes (0); /* { dg-warning "2 processed enodes" } */ - - return result; /* { dg-message "leak of 'p'|leak of 'ptr'" } */ -} - -/* A simpler version of the above. */ - -int test_2 (int n) -{ - int buf[10]; - int *ptr; - int result; - - if (n > 10) - ptr = (int *)malloc (sizeof (int) * n); - else - ptr = buf; - - __analyzer_dump_exploded_nodes (0); /* { dg-warning "2 processed enodes" } */ - - result = do_stuff_2 (ptr, n); - - __analyzer_dump_exploded_nodes (0); /* { dg-warning "2 processed enodes" } */ - - return result; /* { dg-message "leak of 'ptr'" } */ -} diff --git a/gcc/testsuite/gcc.dg/analyzer/many-disabled-diagnostics.c b/gcc/testsuite/gcc.dg/analyzer/many-disabled-diagnostics.c deleted file mode 100644 index 48d4023..0000000 --- a/gcc/testsuite/gcc.dg/analyzer/many-disabled-diagnostics.c +++ /dev/null @@ -1,55 +0,0 @@ -/* { dg-additional-options "-Wno-analyzer-double-free" } */ - -#define DOUBLE_FREE() \ - do { \ - void *p = __builtin_malloc (1024); \ - __builtin_free (p); \ - __builtin_free (p); \ - } while (0) - -#define DOUBLE_FREE_x_10() \ - do { \ - DOUBLE_FREE(); \ - DOUBLE_FREE(); \ - DOUBLE_FREE(); \ - DOUBLE_FREE(); \ - DOUBLE_FREE(); \ - DOUBLE_FREE(); \ - DOUBLE_FREE(); \ - DOUBLE_FREE(); \ - DOUBLE_FREE(); \ - DOUBLE_FREE(); \ - } while (0) - -#define DOUBLE_FREE_x_100() \ - do { \ - DOUBLE_FREE_x_10(); \ - DOUBLE_FREE_x_10(); \ - DOUBLE_FREE_x_10(); \ - DOUBLE_FREE_x_10(); \ - DOUBLE_FREE_x_10(); \ - DOUBLE_FREE_x_10(); \ - DOUBLE_FREE_x_10(); \ - DOUBLE_FREE_x_10(); \ - DOUBLE_FREE_x_10(); \ - DOUBLE_FREE_x_10(); \ - } while (0) - -#define DOUBLE_FREE_x_1000() \ - do { \ - DOUBLE_FREE_x_100(); \ - DOUBLE_FREE_x_100(); \ - DOUBLE_FREE_x_100(); \ - DOUBLE_FREE_x_100(); \ - DOUBLE_FREE_x_100(); \ - DOUBLE_FREE_x_100(); \ - DOUBLE_FREE_x_100(); \ - DOUBLE_FREE_x_100(); \ - DOUBLE_FREE_x_100(); \ - DOUBLE_FREE_x_100(); \ - } while (0) - -void test_1 (void) -{ - DOUBLE_FREE_x_1000 (); -} diff --git a/gcc/testsuite/gcc.dg/analyzer/many-unused-locals.c b/gcc/testsuite/gcc.dg/analyzer/many-unused-locals.c deleted file mode 100644 index 6b5c855..0000000 --- a/gcc/testsuite/gcc.dg/analyzer/many-unused-locals.c +++ /dev/null @@ -1,69 +0,0 @@ -struct st -{ - const char *m_filename; - int m_line; - const char *m_function; -}; - -extern void debug (struct st *); - -#define TEST_x_1(NAME) \ - do \ - { \ - static struct st NAME = { __FILE__, __LINE__, __func__ }; \ - debug (&NAME); \ - } \ - while (0) - -#define TEST_x_10(PREFIX) \ - do \ - { \ - TEST_x_1(PREFIX ## _1); \ - TEST_x_1(PREFIX ## _2); \ - TEST_x_1(PREFIX ## _3); \ - TEST_x_1(PREFIX ## _4); \ - TEST_x_1(PREFIX ## _5); \ - TEST_x_1(PREFIX ## _6); \ - TEST_x_1(PREFIX ## _7); \ - TEST_x_1(PREFIX ## _8); \ - TEST_x_1(PREFIX ## _9); \ - TEST_x_1(PREFIX ## _10); \ - } \ - while(0) - -#define TEST_x_100(PREFIX) \ - do \ - { \ - TEST_x_10(PREFIX ## _1); \ - TEST_x_10(PREFIX ## _2); \ - TEST_x_10(PREFIX ## _3); \ - TEST_x_10(PREFIX ## _4); \ - TEST_x_10(PREFIX ## _5); \ - TEST_x_10(PREFIX ## _6); \ - TEST_x_10(PREFIX ## _7); \ - TEST_x_10(PREFIX ## _8); \ - TEST_x_10(PREFIX ## _9); \ - TEST_x_10(PREFIX ## _10); \ - } \ - while(0) - -#define TEST_x_1000(PREFIX) \ - do \ - { \ - TEST_x_100(PREFIX ## _1); \ - TEST_x_100(PREFIX ## _2); \ - TEST_x_100(PREFIX ## _3); \ - TEST_x_100(PREFIX ## _4); \ - TEST_x_100(PREFIX ## _5); \ - TEST_x_100(PREFIX ## _6); \ - TEST_x_100(PREFIX ## _7); \ - TEST_x_100(PREFIX ## _8); \ - TEST_x_100(PREFIX ## _9); \ - TEST_x_100(PREFIX ## _10); \ - } \ - while(0) - -void test_many (void) -{ - TEST_x_1000(s); -} diff --git a/gcc/testsuite/gcc.dg/analyzer/memcpy-pr107882.c b/gcc/testsuite/gcc.dg/analyzer/memcpy-pr107882.c deleted file mode 100644 index 4ecb0fd..0000000 --- a/gcc/testsuite/gcc.dg/analyzer/memcpy-pr107882.c +++ /dev/null @@ -1,8 +0,0 @@ -void -foo (int *x, int y) -{ - int *a = x, *b = (int *) &a; - - __builtin_memcpy (b + 1, x, y); - foo (a, 0); -} diff --git a/gcc/testsuite/gcc.dg/analyzer/memset-1.c b/gcc/testsuite/gcc.dg/analyzer/memset-1.c deleted file mode 100644 index 75aef53..0000000 --- a/gcc/testsuite/gcc.dg/analyzer/memset-1.c +++ /dev/null @@ -1,203 +0,0 @@ -#include -#include "analyzer-decls.h" - -/* Zero-fill of uninitialized buffer. */ - -void test_1 (void) -{ - char buf[256]; - void *p = memset (buf, 0, 256); - __analyzer_eval (buf[42] == 0); /* { dg-warning "TRUE" } */ - __analyzer_eval (p == buf); /* { dg-warning "TRUE" } */ -} - -/* As above, but with __builtin_memset. */ - -void test_1a (void) -{ - char buf[256]; - __builtin_memset (buf, 0, 256); - __analyzer_eval (buf[42] == 0); /* { dg-warning "TRUE" } */ -} - -/* Zero-fill of partially initialized buffer. */ - -void test_2 (void) -{ - char buf[256]; - buf[42] = 'A'; - __analyzer_eval (buf[42] == 'A'); /* { dg-warning "TRUE" } */ - memset (buf, 0, 256); - __analyzer_eval (buf[42] == '\0'); /* { dg-warning "TRUE" } */ -} - -/* A "memset" with known non-zero value. */ - -void test_3 (int val) -{ - char buf[256]; - memset (buf, 'A', 256); - __analyzer_eval (buf[42] == 'A'); /* { dg-warning "TRUE" } */ -} - -/* A "memset" with unknown value. */ - -void test_4 (char val) -{ - char buf[256]; - memset (buf, val, 256); - __analyzer_eval (buf[42] == (char)val); /* { dg-warning "TRUE" } */ -} - -/* A "memset" with unknown num bytes. */ - -void test_5 (int n) -{ - char buf[256]; - buf[42] = 'A'; - __analyzer_eval (buf[42] == 'A'); /* { dg-warning "TRUE" } */ - memset (buf, 0, n); - - /* We can't know if buf[42] was written to or not. */ - __analyzer_eval (buf[42] == 'A'); /* { dg-warning "UNKNOWN" } */ - __analyzer_eval (buf[42] == '\0'); /* { dg-warning "UNKNOWN" } */ -} - -/* As test_5, but with "__builtin___memset_chk". */ - -void test_5a (int n) -{ - char buf[256]; - buf[42] = 'A'; - __analyzer_eval (buf[42] == 'A'); /* { dg-warning "TRUE" } */ - __builtin___memset_chk (buf, 0, n, __builtin_object_size (buf, 0)); - - /* We can't know if buf[42] was written to or not. */ - __analyzer_eval (buf[42] == 'A'); /* { dg-warning "UNKNOWN" } */ - __analyzer_eval (buf[42] == '\0'); /* { dg-warning "UNKNOWN" } */ -} - -/* A "memset" with unknown value, but with zero size. */ - -static size_t __attribute__((noinline)) -get_zero (void) -{ - return 0; -} - -void test_6 (int val) -{ - char buf[256]; - buf[42] = 'A'; - memset (buf, 'B', get_zero ()); - __analyzer_eval (buf[42] == 'A'); /* { dg-warning "TRUE" } */ -} - -void test_6b (int val) -{ - char buf[256]; - memset (buf, 'A', sizeof (buf)); - memset (buf, 'B', get_zero ()); - __analyzer_eval (buf[42] == 'A'); /* { dg-warning "TRUE" } */ -} - -/* A "memset" of known size that's not the full buffer. */ - -void test_7 (void) -{ - char buf[256]; - buf[128] = 'A'; - memset (buf, 0, 128); - __analyzer_eval (buf[0] == '\0'); /* { dg-warning "TRUE" } */ - __analyzer_eval (buf[127] == '\0'); /* { dg-warning "TRUE" } */ - __analyzer_eval (buf[128] == 'A'); /* { dg-warning "TRUE" } */ -} - -void test_8 (void) -{ - char buf[20]; - memset (buf + 0, 0, 1); - memset (buf + 1, 1, 1); - memset (buf + 2, 2, 1); - memset (buf + 3, 3, 1); - memset (buf + 4, 4, 2); - memset (buf + 6, 6, 2); - memset (buf + 8, 8, 4); - memset (buf + 12, 12, 8); - __analyzer_eval (buf[0] == 0); /* { dg-warning "TRUE" } */ - __analyzer_eval (buf[1] == 1); /* { dg-warning "TRUE" } */ - __analyzer_eval (buf[2] == 2); /* { dg-warning "TRUE" } */ - __analyzer_eval (buf[3] == 3); /* { dg-warning "TRUE" } */ - __analyzer_eval (buf[4] == 4); /* { dg-warning "TRUE" } */ - __analyzer_eval (buf[5] == 4); /* { dg-warning "TRUE" } */ - __analyzer_eval (buf[6] == 6); /* { dg-warning "TRUE" } */ - __analyzer_eval (buf[7] == 6); /* { dg-warning "TRUE" } */ - __analyzer_eval (buf[8] == 8); /* { dg-warning "TRUE" } */ - __analyzer_eval (buf[9] == 8); /* { dg-warning "TRUE" } */ - __analyzer_eval (buf[10] == 8); /* { dg-warning "TRUE" } */ - __analyzer_eval (buf[11] == 8); /* { dg-warning "TRUE" } */ - __analyzer_eval (buf[12] == 12); /* { dg-warning "TRUE" } */ - __analyzer_eval (buf[13] == 12); /* { dg-warning "TRUE" } */ - __analyzer_eval (buf[14] == 12); /* { dg-warning "TRUE" } */ - __analyzer_eval (buf[15] == 12); /* { dg-warning "TRUE" } */ - __analyzer_eval (buf[16] == 12); /* { dg-warning "TRUE" } */ - __analyzer_eval (buf[17] == 12); /* { dg-warning "TRUE" } */ - __analyzer_eval (buf[18] == 12); /* { dg-warning "TRUE" } */ - __analyzer_eval (buf[19] == 12); /* { dg-warning "TRUE" } */ -} - -/* Various overlapping memset calls with different sizes and values. */ - -void test_9 (void) -{ - char buf[8]; - memset (buf, 0, 8); - __analyzer_eval (buf[0] == 0); /* { dg-warning "TRUE" } */ - __analyzer_eval (buf[1] == 0); /* { dg-warning "TRUE" } */ - __analyzer_eval (buf[2] == 0); /* { dg-warning "TRUE" } */ - __analyzer_eval (buf[3] == 0); /* { dg-warning "TRUE" } */ - __analyzer_eval (buf[4] == 0); /* { dg-warning "TRUE" } */ - __analyzer_eval (buf[5] == 0); /* { dg-warning "TRUE" } */ - __analyzer_eval (buf[6] == 0); /* { dg-warning "TRUE" } */ - __analyzer_eval (buf[7] == 0); /* { dg-warning "TRUE" } */ - - memset (buf + 1, 1, 4); - __analyzer_eval (buf[0] == 0); /* { dg-warning "TRUE" } */ - __analyzer_eval (buf[1] == 1); /* { dg-warning "TRUE" } */ - __analyzer_eval (buf[2] == 1); /* { dg-warning "TRUE" } */ - __analyzer_eval (buf[3] == 1); /* { dg-warning "TRUE" } */ - __analyzer_eval (buf[4] == 1); /* { dg-warning "TRUE" } */ - __analyzer_eval (buf[5] == 0); /* { dg-warning "TRUE" } */ - __analyzer_eval (buf[6] == 0); /* { dg-warning "TRUE" } */ - __analyzer_eval (buf[7] == 0); /* { dg-warning "TRUE" } */ - - memset (buf + 2, 2, 4); - __analyzer_eval (buf[0] == 0); /* { dg-warning "TRUE" } */ - __analyzer_eval (buf[1] == 1); /* { dg-warning "TRUE" } */ - __analyzer_eval (buf[2] == 2); /* { dg-warning "TRUE" } */ - __analyzer_eval (buf[3] == 2); /* { dg-warning "TRUE" } */ - __analyzer_eval (buf[4] == 2); /* { dg-warning "TRUE" } */ - __analyzer_eval (buf[5] == 2); /* { dg-warning "TRUE" } */ - __analyzer_eval (buf[6] == 0); /* { dg-warning "TRUE" } */ - __analyzer_eval (buf[7] == 0); /* { dg-warning "TRUE" } */ - - memset (buf + 4, 3, 3); - __analyzer_eval (buf[0] == 0); /* { dg-warning "TRUE" } */ - __analyzer_eval (buf[1] == 1); /* { dg-warning "TRUE" } */ - __analyzer_eval (buf[2] == 2); /* { dg-warning "TRUE" } */ - __analyzer_eval (buf[3] == 2); /* { dg-warning "TRUE" } */ - __analyzer_eval (buf[4] == 3); /* { dg-warning "TRUE" } */ - __analyzer_eval (buf[5] == 3); /* { dg-warning "TRUE" } */ - __analyzer_eval (buf[6] == 3); /* { dg-warning "TRUE" } */ - __analyzer_eval (buf[7] == 0); /* { dg-warning "TRUE" } */ - - memset (buf + 0, 4, 3); - __analyzer_eval (buf[0] == 4); /* { dg-warning "TRUE" } */ - __analyzer_eval (buf[1] == 4); /* { dg-warning "TRUE" } */ - __analyzer_eval (buf[2] == 4); /* { dg-warning "TRUE" } */ - __analyzer_eval (buf[3] == 2); /* { dg-warning "TRUE" } */ - __analyzer_eval (buf[4] == 3); /* { dg-warning "TRUE" } */ - __analyzer_eval (buf[5] == 3); /* { dg-warning "TRUE" } */ - __analyzer_eval (buf[6] == 3); /* { dg-warning "TRUE" } */ - __analyzer_eval (buf[7] == 0); /* { dg-warning "TRUE" } */ -} diff --git a/gcc/testsuite/gcc.dg/analyzer/memset-2.c b/gcc/testsuite/gcc.dg/analyzer/memset-2.c deleted file mode 100644 index de7c973..0000000 --- a/gcc/testsuite/gcc.dg/analyzer/memset-2.c +++ /dev/null @@ -1,27 +0,0 @@ -/* { dg-additional-options "-fdump-analyzer-untracked" } */ - -#include "analyzer-decls.h" - -struct S -{ - int i; -}; - -/* memset of a static struct that never gets used. */ - -void -test_1 (void) -{ - static struct S s; /* { dg-warning "track 's': no" } */ - __builtin_memset (&s, 0, sizeof (s)); -} - -/* memset of a static struct that later gets used. */ - -void -test_2 (void) -{ - static struct S s; /* { dg-warning "track 's': yes" } */ - __builtin_memset (&s, 0, sizeof (s)); - __analyzer_eval (s.i == 0); /* { dg-warning "TRUE" } */ -} diff --git a/gcc/testsuite/gcc.dg/analyzer/named-constants-via-macros-2.c b/gcc/testsuite/gcc.dg/analyzer/named-constants-via-macros-2.c deleted file mode 100644 index 9c019e7..0000000 --- a/gcc/testsuite/gcc.dg/analyzer/named-constants-via-macros-2.c +++ /dev/null @@ -1,15 +0,0 @@ -#include "analyzer-decls.h" - -/* Various constants used by the fd state machine, as macros - that can't be handled. */ - -#define O_ACCMODE ( -#define O_RDONLY "foo" -#define O_WRONLY int - -void test_sm_fd_constants (void) -{ - __analyzer_dump_named_constant ("O_ACCMODE"); /* { dg-warning "named constant 'O_ACCMODE' has unknown value" } */ - __analyzer_dump_named_constant ("O_RDONLY"); /* { dg-warning "named constant 'O_RDONLY' has unknown value" } */ - __analyzer_dump_named_constant ("O_WRONLY"); /* { dg-warning "named constant 'O_WRONLY' has unknown value" } */ -} diff --git a/gcc/testsuite/gcc.dg/analyzer/named-constants-via-macros-3.c b/gcc/testsuite/gcc.dg/analyzer/named-constants-via-macros-3.c deleted file mode 100644 index 2a3f2b0..0000000 --- a/gcc/testsuite/gcc.dg/analyzer/named-constants-via-macros-3.c +++ /dev/null @@ -1,15 +0,0 @@ -#include "analyzer-decls.h" - -/* Various constants used by the fd state machine, as macros - that can't be handled. */ - -#define O_RDONLY (1 << 0) -#define O_WRONLY (1 << 1) -#define O_ACCMODE (O_RDONLY | O_WRONLY) - -void test_sm_fd_constants (void) -{ - __analyzer_dump_named_constant ("O_ACCMODE"); /* { dg-warning "named constant 'O_ACCMODE' has unknown value" } */ - __analyzer_dump_named_constant ("O_RDONLY"); /* { dg-warning "named constant 'O_RDONLY' has unknown value" } */ - __analyzer_dump_named_constant ("O_WRONLY"); /* { dg-warning "named constant 'O_WRONLY' has unknown value" } */ -} diff --git a/gcc/testsuite/gcc.dg/analyzer/named-constants-via-macros-4.c b/gcc/testsuite/gcc.dg/analyzer/named-constants-via-macros-4.c deleted file mode 100644 index 16eef96..0000000 --- a/gcc/testsuite/gcc.dg/analyzer/named-constants-via-macros-4.c +++ /dev/null @@ -1,15 +0,0 @@ -#include "analyzer-decls.h" - -/* Various constants used by the fd state machine, as macros - that can't be handled. */ - -#define O_ACCMODE(X) 42 -#define O_RDONLY(X) 0x1 -#define O_WRONLY(X) 010 - -void test_sm_fd_constants (void) -{ - __analyzer_dump_named_constant ("O_ACCMODE"); /* { dg-warning "named constant 'O_ACCMODE' has unknown value" } */ - __analyzer_dump_named_constant ("O_RDONLY"); /* { dg-warning "named constant 'O_RDONLY' has unknown value" } */ - __analyzer_dump_named_constant ("O_WRONLY"); /* { dg-warning "named constant 'O_WRONLY' has unknown value" } */ -} diff --git a/gcc/testsuite/gcc.dg/analyzer/named-constants-via-macros-empty.c b/gcc/testsuite/gcc.dg/analyzer/named-constants-via-macros-empty.c deleted file mode 100644 index 3d347e2..0000000 --- a/gcc/testsuite/gcc.dg/analyzer/named-constants-via-macros-empty.c +++ /dev/null @@ -1,14 +0,0 @@ -#include "analyzer-decls.h" - -/* Various constants used by the fd state machine. */ - -#define O_ACCMODE -#define O_RDONLY -#define O_WRONLY - -void test_sm_fd_constants (void) -{ - __analyzer_dump_named_constant ("O_ACCMODE"); /* { dg-warning "named constant 'O_ACCMODE' has unknown value" } */ - __analyzer_dump_named_constant ("O_RDONLY"); /* { dg-warning "named constant 'O_RDONLY' has unknown value" } */ - __analyzer_dump_named_constant ("O_WRONLY"); /* { dg-warning "named constant 'O_WRONLY' has unknown value" } */ -} diff --git a/gcc/testsuite/gcc.dg/analyzer/named-constants-via-macros-traditional.c b/gcc/testsuite/gcc.dg/analyzer/named-constants-via-macros-traditional.c deleted file mode 100644 index 64acaad..0000000 --- a/gcc/testsuite/gcc.dg/analyzer/named-constants-via-macros-traditional.c +++ /dev/null @@ -1,16 +0,0 @@ -/* { dg-additional-options "-traditional-cpp" } */ - -#include "analyzer-decls.h" - -/* Various constants used by the fd state machine. */ - -#define O_ACCMODE 42 -#define O_RDONLY 0x1 -#define O_WRONLY 010 - -void test_sm_fd_constants (void) -{ - __analyzer_dump_named_constant ("O_ACCMODE"); /* { dg-warning "named constant 'O_ACCMODE' has unknown value" } */ - __analyzer_dump_named_constant ("O_RDONLY"); /* { dg-warning "named constant 'O_RDONLY' has unknown value" } */ - __analyzer_dump_named_constant ("O_WRONLY"); /* { dg-warning "named constant 'O_WRONLY' has unknown value" } */ -} diff --git a/gcc/testsuite/gcc.dg/analyzer/named-constants-via-macros-undef.c b/gcc/testsuite/gcc.dg/analyzer/named-constants-via-macros-undef.c deleted file mode 100644 index 46c0322..0000000 --- a/gcc/testsuite/gcc.dg/analyzer/named-constants-via-macros-undef.c +++ /dev/null @@ -1,18 +0,0 @@ -#include "analyzer-decls.h" - -/* Various constants used by the fd state machine. */ - -#define O_ACCMODE 42 -#define O_RDONLY 0x1 -#define O_WRONLY 010 - -#undef O_ACCMODE -#undef O_RDONLY -#undef O_WRONLY - -void test_sm_fd_constants (void) -{ - __analyzer_dump_named_constant ("O_ACCMODE"); /* { dg-warning "named constant 'O_ACCMODE' has unknown value" } */ - __analyzer_dump_named_constant ("O_RDONLY"); /* { dg-warning "named constant 'O_RDONLY' has unknown value" } */ - __analyzer_dump_named_constant ("O_WRONLY"); /* { dg-warning "named constant 'O_WRONLY' has unknown value" } */ -} diff --git a/gcc/testsuite/gcc.dg/analyzer/omp-parallel-for-1.c b/gcc/testsuite/gcc.dg/analyzer/omp-parallel-for-1.c deleted file mode 100644 index cadacc8..0000000 --- a/gcc/testsuite/gcc.dg/analyzer/omp-parallel-for-1.c +++ /dev/null @@ -1,22 +0,0 @@ -/* { dg-require-effective-target fopenmp } */ -/* { dg-additional-options "-fopenmp -Wall" } */ - -typedef struct _Image -{ - int columns, rows; -} Image; - -extern int get_num_threads(void); - -void -test (Image* image) -{ - int y; - -#pragma omp parallel for schedule(static) \ - num_threads(get_num_threads ()) - - for (y = 0; y < image->rows; y++) { - /* [...snip...] */ - } -} diff --git a/gcc/testsuite/gcc.dg/analyzer/omp-parallel-for-get-min.c b/gcc/testsuite/gcc.dg/analyzer/omp-parallel-for-get-min.c deleted file mode 100644 index ba9f634..0000000 --- a/gcc/testsuite/gcc.dg/analyzer/omp-parallel-for-get-min.c +++ /dev/null @@ -1,25 +0,0 @@ -/* Reduced from ImageMagick-7.1.0-57's MagickCore/attribute.c: GetEdgeBackgroundColor */ - -/* { dg-require-effective-target fopenmp } */ -/* { dg-additional-options "-fopenmp -Wall" } */ - -extern double get_census (void); - -double -test() -{ - double census[4], edge_census; - int i; - -#pragma omp parallel for schedule(static) - - for (i = 0; i < 4; i++) { - census[i] = get_census (); - } - edge_census = (-1.0); - for (i = 0; i < 4; i++) - if (census[i] > edge_census) { /* { dg-bogus "use of uninitialized value" } */ - edge_census = census[i]; - } - return edge_census; -} diff --git a/gcc/testsuite/gcc.dg/analyzer/out-of-bounds-3.c b/gcc/testsuite/gcc.dg/analyzer/out-of-bounds-3.c deleted file mode 100644 index 5fd9cc3..0000000 --- a/gcc/testsuite/gcc.dg/analyzer/out-of-bounds-3.c +++ /dev/null @@ -1,96 +0,0 @@ -#include -#include -#include - -/* Wanalyzer-out-of-bounds tests for buffer under-reads and underwrites. */ - -/* Avoid folding of memcpy. */ -typedef void * (*memcpy_t) (void *dst, const void *src, size_t n); -static memcpy_t __attribute__((noinline)) -get_memcpy (void) -{ - return memcpy; -} - - -void test1 (void) -{ - int buf[4]; - int *e = buf - 1; - *e = 42; /* { dg-line test1 } */ - - /* { dg-warning "stack-based buffer underwrite" "warning" { target *-*-* } test1 } */ - /* { dg-message "out-of-bounds write from byte -4 till byte -1 but 'buf' starts at byte 0" "final event" { target *-*-* } test1 } */ - /* { dg-message "valid subscripts for 'buf' are '\\\[0\\\]' to '\\\[3\\\]'" "valid subscript note" { target *-*-* } test1 } */ -} - -void test2 (void) -{ - int buf[4]; - int *e = buf + 1; - *e = 123; - *(e - 1) = 321; -} - -void test3 (void) -{ - int buf[4]; - int *e = buf + 1; - *e = 123; - *(e - 2) = 321; /* { dg-line test3 } */ - - /* { dg-warning "stack-based buffer underwrite" "warning" { target *-*-* } test3 } */ - /* { dg-message "out-of-bounds write from byte -4 till byte -1 but 'buf' starts at byte 0" "final event" { target *-*-* } test3 } */ - /* { dg-message "valid subscripts for 'buf' are '\\\[0\\\]' to '\\\[3\\\]'" "valid subscript note" { target *-*-* } test3 } */ -} - -void test4 (void) -{ - memcpy_t fn = get_memcpy (); - int buf[4]; - memset (buf, 1, 4 * sizeof (int)); - int n = -4; - fn (&(buf[n]), buf, sizeof (int)); /* { dg-line test4 } */ - - /* { dg-warning "stack-based buffer underwrite" "warning" { target *-*-* } test4 } */ - /* { dg-message "out-of-bounds write from byte -16 till byte -13 but 'buf' starts at byte 0" "final event" { target *-*-* } test4 } */ - /* { dg-message "valid subscripts for 'buf' are '\\\[0\\\]' to '\\\[3\\\]'" "valid subscript note" { target *-*-* } test4 } */ -} - -void test5 (void) -{ - int buf[4]; - memset (buf, 1, 4 * sizeof (int)); - - int sum = 0; - for (int i = 4; i >= 0; i++) - sum += *(buf - i); /* { dg-line test5 } */ - - /* { dg-warning "stack-based buffer under-read" "warning" { target *-*-* } test5 } */ - /* { dg-message "out-of-bounds read from byte -16 till byte -13 but 'buf' starts at byte 0" "final event" { target *-*-* } test5 } */ - /* { dg-message "valid subscripts for 'buf' are '\\\[0\\\]' to '\\\[3\\\]'" "valid subscript note" { target *-*-* } test5 } */ -} - -void test6 (void) -{ - int buf[4]; - memset (buf, 1, 4 * sizeof (int)); - - int *view = buf + 1; - int sum = 0; - for (int i = 0; i < 4; i++) - sum += *(view++); -} - -void test8 (void) -{ - memcpy_t fn = get_memcpy (); - int buf[4]; - memset (buf, 1, 4 * sizeof (int)); - int n = -4; - fn (buf, &(buf[n]), sizeof (int)); /* { dg-line test8 } */ - - /* { dg-warning "stack-based buffer under-read" "warning" { target *-*-* } test8 } */ - /* { dg-message "out-of-bounds read from byte -16 till byte -13 but 'buf' starts at byte 0" "note" { target *-*-* } test8 } */ - /* { dg-message "valid subscripts for 'buf' are '\\\[0\\\]' to '\\\[3\\\]'" "valid subscript note" { target *-*-* } test8 } */ -} diff --git a/gcc/testsuite/gcc.dg/analyzer/out-of-bounds-coreutils.c b/gcc/testsuite/gcc.dg/analyzer/out-of-bounds-coreutils.c deleted file mode 100644 index 7af4c37..0000000 --- a/gcc/testsuite/gcc.dg/analyzer/out-of-bounds-coreutils.c +++ /dev/null @@ -1,29 +0,0 @@ -/* Reduced from coreutils/ls.c attach. */ - -void add_zero_terminator (char *buf) -{ - char *end = buf; - while (end++); /* TODO: arguably we should report this. */ - if (buf < end) - end[-1] = '\0'; -} - -/* Reduced from coreutils/cat.c. */ - -#define LINE_COUNTER_BUF_LEN 20 -static char line_buf[LINE_COUNTER_BUF_LEN] = - { - ' ', ' ', ' ', ' ', ' ', ' ', ' ', ' ', ' ', - ' ', ' ', ' ', ' ', ' ', ' ', ' ', ' ', '0', - '\t', '\0' - }; - -/* Position of the first digit in 'line_buf'. */ -static char *line_num_start = line_buf + LINE_COUNTER_BUF_LEN - 3; - -static void -next_line_num (void) -{ - if (line_num_start > line_buf) - *--line_num_start = '1'; -} diff --git a/gcc/testsuite/gcc.dg/analyzer/out-of-bounds-curl.c b/gcc/testsuite/gcc.dg/analyzer/out-of-bounds-curl.c deleted file mode 100644 index d14661c..0000000 --- a/gcc/testsuite/gcc.dg/analyzer/out-of-bounds-curl.c +++ /dev/null @@ -1,41 +0,0 @@ -/* { dg-additional-options "-O2 -Wno-analyzer-symbol-too-complex" } */ -#include - -/* Reduced from curl lib/smb.c. */ -typedef int CURLcode; - -struct smb_conn { - // [...] - char *user; -}; - -struct smb_setup { - // [...] - char bytes[48]; -} __attribute__((packed)); - -struct connectdata { - // [...] - struct smb_conn *smbc; -}; - -CURLcode smb_send_setup (struct connectdata *conn) -{ - struct smb_conn *smbc = conn->smbc; - struct smb_setup msg; - char *p = msg.bytes; - unsigned char lm[24]; - - /* Init to prevent uninit warning. */ - memset(&msg, 0, sizeof(msg)); - memset (&lm, 0, sizeof(lm)); - - memcpy(p, lm, sizeof(lm)); - p += sizeof(lm); - /* Had a false-positive overflow at p. Checker had a number of bytes copied - relative to the start but offset points in the middle the field. */ - strcpy(p, (smbc->user)); - p += strlen(smbc->user) + 1; - - return 1; -} diff --git a/gcc/testsuite/gcc.dg/analyzer/out-of-bounds-diagram-1-json.c b/gcc/testsuite/gcc.dg/analyzer/out-of-bounds-diagram-1-json.c deleted file mode 100644 index 0a2cc34..0000000 --- a/gcc/testsuite/gcc.dg/analyzer/out-of-bounds-diagram-1-json.c +++ /dev/null @@ -1,13 +0,0 @@ -/* { dg-additional-options "-fdiagnostics-format=json-file" } */ - -/* The custom JSON format doesn't support text art, so this is just a simple - smoketext. */ - -#include - -int32_t arr[10]; - -void int_arr_write_element_after_end_off_by_one(int32_t x) -{ - arr[10] = x; -} diff --git a/gcc/testsuite/gcc.dg/analyzer/out-of-bounds-diagram-1-sarif.c b/gcc/testsuite/gcc.dg/analyzer/out-of-bounds-diagram-1-sarif.c deleted file mode 100644 index 051a1ce..0000000 --- a/gcc/testsuite/gcc.dg/analyzer/out-of-bounds-diagram-1-sarif.c +++ /dev/null @@ -1,24 +0,0 @@ -/* We require -fdiagnostics-text-art-charset= to get any text art here - because of the test suite using -fdiagnostics-plain-output. */ - -/* { dg-additional-options "-fdiagnostics-format=sarif-file -fdiagnostics-text-art-charset=ascii" } */ - -#include - -int32_t arr[10]; - -void int_arr_write_element_after_end_off_by_one(int32_t x) -{ - arr[10] = x; -} - -/* Verify that some JSON was written to a file with the expected name. - - { dg-final { verify-sarif-file } } - - Expect the "alt-text" to be captured. - { dg-final { scan-sarif-file "\"text\": \"Diagram visualizing the predicted out-of-bounds access\"," } } - - Expect the diagram to have 4 leading spaces (to indicate a code block), - and that at least part of the diagram was written out. - { dg-final { scan-sarif-file "\"markdown\": \" .*capacity: 40 bytes.*\"" } } */ diff --git a/gcc/testsuite/gcc.dg/analyzer/out-of-bounds-pr110387.c b/gcc/testsuite/gcc.dg/analyzer/out-of-bounds-pr110387.c deleted file mode 100644 index a046659..0000000 --- a/gcc/testsuite/gcc.dg/analyzer/out-of-bounds-pr110387.c +++ /dev/null @@ -1,19 +0,0 @@ -char a, b, c, d; -long x; - -void -_S_copy (long __n) -{ - __builtin_memcpy (&a, &d, __n); /* { dg-prune-output "-Wanalyzer-out-of-bounds" } */ - /* This only warns on some targets; the purpose of the test is to verify that - we don't ICE. */ -} - -void -_M_construct () -{ - x = &c - &b; - unsigned long __dnew = x; - if (__dnew > 1) - _S_copy (&c - &b); -} diff --git a/gcc/testsuite/gcc.dg/analyzer/out-of-bounds-read-char-arr.c b/gcc/testsuite/gcc.dg/analyzer/out-of-bounds-read-char-arr.c deleted file mode 100644 index fa4b613..0000000 --- a/gcc/testsuite/gcc.dg/analyzer/out-of-bounds-read-char-arr.c +++ /dev/null @@ -1,56 +0,0 @@ -char arr[10]; /* { dg-message "capacity: 10 bytes" } */ - -char char_arr_read_element_before_start_far(void) -{ - return arr[-100]; /* { dg-warning "buffer under-read" "warning" } */ - /* { dg-message "out-of-bounds read at byte -100 but 'arr' starts at byte 0" "final event" { target *-*-* } .-1 } */ - /* { dg-message "valid subscripts for 'arr' are '\\\[0\\\]' to '\\\[9\\\]'" "valid subscript note" { target *-*-* } .-2 } */ -} - -char char_arr_read_element_before_start_near(void) -{ - return arr[-2]; /* { dg-warning "buffer under-read" "warning" } */ - /* { dg-message "out-of-bounds read at byte -2 but 'arr' starts at byte 0" "final event" { target *-*-* } .-1 } */ - /* { dg-message "valid subscripts for 'arr' are '\\\[0\\\]' to '\\\[9\\\]'" "valid subscript note" { target *-*-* } .-2 } */ -} - -char char_arr_read_element_before_start_off_by_one(void) -{ - return arr[-1]; /* { dg-warning "buffer under-read" "warning" } */ - /* { dg-message "out-of-bounds read at byte -1 but 'arr' starts at byte 0" "final event" { target *-*-* } .-1 } */ - /* { dg-message "valid subscripts for 'arr' are '\\\[0\\\]' to '\\\[9\\\]'" "valid subscript note" { target *-*-* } .-2 } */ -} - -char char_arr_read_element_at_start(void) -{ - return arr[0]; -} - -char char_arr_read_element_at_end(void) -{ - return arr[9]; -} - -char char_arr_read_element_after_end_off_by_one(void) -{ - return arr[10]; /* { dg-warning "buffer over-read" "warning" } */ - /* { dg-message "out-of-bounds read at byte 10 but 'arr' ends at byte 10" "final event" { target *-*-* } .-1 } */ - /* { dg-message "read of 1 byte from after the end of 'arr'" "num bad bytes note" { target *-*-* } .-2 } */ - /* { dg-message "valid subscripts for 'arr' are '\\\[0\\\]' to '\\\[9\\\]'" "valid subscript note" { target *-*-* } .-3 } */ -} - -char char_arr_read_element_after_end_near(void) -{ - return arr[11]; /* { dg-warning "buffer over-read" "warning" } */ - /* { dg-message "out-of-bounds read at byte 11 but 'arr' ends at byte 10" "final event" { target *-*-* } .-1 } */ - /* { dg-message "read of 1 byte from after the end of 'arr'" "num bad bytes note" { target *-*-* } .-2 } */ - /* { dg-message "valid subscripts for 'arr' are '\\\[0\\\]' to '\\\[9\\\]'" "valid subscript note" { target *-*-* } .-3 } */ -} - -char char_arr_read_element_after_end_far(void) -{ - return arr[100]; /* { dg-warning "buffer over-read" "warning" } */ - /* { dg-message "out-of-bounds read at byte 100 but 'arr' ends at byte 10" "final event" { target *-*-* } .-1 } */ - /* { dg-message "read of 1 byte from after the end of 'arr'" "num bad bytes note" { target *-*-* } .-2 } */ - /* { dg-message "valid subscripts for 'arr' are '\\\[0\\\]' to '\\\[9\\\]'" "valid subscript note" { target *-*-* } .-3 } */ -} diff --git a/gcc/testsuite/gcc.dg/analyzer/out-of-bounds-read-int-arr.c b/gcc/testsuite/gcc.dg/analyzer/out-of-bounds-read-int-arr.c deleted file mode 100644 index c04cc19..0000000 --- a/gcc/testsuite/gcc.dg/analyzer/out-of-bounds-read-int-arr.c +++ /dev/null @@ -1,58 +0,0 @@ -#include - -int32_t arr[10]; /* { dg-message "capacity: 40 bytes" } */ - -int32_t int_arr_read_element_before_start_far(void) -{ - return arr[-100]; /* { dg-warning "buffer under-read" "warning" } */ - /* { dg-message "out-of-bounds read from byte -400 till byte -397 but 'arr' starts at byte 0" "final event" { target *-*-* } .-1 } */ - /* { dg-message "valid subscripts for 'arr' are '\\\[0\\\]' to '\\\[9\\\]'" "valid subscript note" { target *-*-* } .-2 } */ -} - -int32_t int_arr_read_element_before_start_near(void) -{ - return arr[-2]; /* { dg-warning "buffer under-read" "warning" } */ - /* { dg-message "out-of-bounds read from byte -8 till byte -5 but 'arr' starts at byte 0" "final event" { target *-*-* } .-1 } */ - /* { dg-message "valid subscripts for 'arr' are '\\\[0\\\]' to '\\\[9\\\]'" "valid subscript note" { target *-*-* } .-2 } */ -} - -int32_t int_arr_read_element_before_start_off_by_one(void) -{ - return arr[-1]; /* { dg-warning "buffer under-read" "warning" } */ - /* { dg-message "out-of-bounds read from byte -4 till byte -1 but 'arr' starts at byte 0" "final event" { target *-*-* } .-1 } */ - /* { dg-message "valid subscripts for 'arr' are '\\\[0\\\]' to '\\\[9\\\]'" "valid subscript note" { target *-*-* } .-2 } */ -} - -int32_t int_arr_read_element_at_start(void) -{ - return arr[0]; -} - -int32_t int_arr_read_element_at_end(void) -{ - return arr[9]; -} - -int32_t int_arr_read_element_after_end_off_by_one(void) -{ - return arr[10]; /* { dg-warning "buffer over-read" "warning" } */ - /* { dg-message "out-of-bounds read from byte 40 till byte 43 but 'arr' ends at byte 40" "final event" { target *-*-* } .-1 } */ - /* { dg-message "read of 4 bytes from after the end of 'arr'" "num bad bytes note" { target *-*-* } .-2 } */ - /* { dg-message "valid subscripts for 'arr' are '\\\[0\\\]' to '\\\[9\\\]'" "valid subscript note" { target *-*-* } .-3 } */ -} - -int32_t int_arr_read_element_after_end_near(void) -{ - return arr[11]; /* { dg-warning "buffer over-read" "warning" } */ - /* { dg-message "out-of-bounds read from byte 44 till byte 47 but 'arr' ends at byte 40" "final event" { target *-*-* } .-1 } */ - /* { dg-message "read of 4 bytes from after the end of 'arr'" "num bad bytes note" { target *-*-* } .-2 } */ - /* { dg-message "valid subscripts for 'arr' are '\\\[0\\\]' to '\\\[9\\\]'" "valid subscript note" { target *-*-* } .-3 } */ -} - -int32_t int_arr_read_element_after_end_far(void) -{ - return arr[100]; /* { dg-warning "buffer over-read" "warning" } */ - /* { dg-message "out-of-bounds read from byte 400 till byte 403 but 'arr' ends at byte 40" "final event" { target *-*-* } .-1 } */ - /* { dg-message "read of 4 bytes from after the end of 'arr'" "num bad bytes note" { target *-*-* } .-2 } */ - /* { dg-message "valid subscripts for 'arr' are '\\\[0\\\]' to '\\\[9\\\]'" "valid subscript note" { target *-*-* } .-3 } */ -} diff --git a/gcc/testsuite/gcc.dg/analyzer/out-of-bounds-read-struct-arr.c b/gcc/testsuite/gcc.dg/analyzer/out-of-bounds-read-struct-arr.c deleted file mode 100644 index 0f50bb9..0000000 --- a/gcc/testsuite/gcc.dg/analyzer/out-of-bounds-read-struct-arr.c +++ /dev/null @@ -1,65 +0,0 @@ -#include - -struct st -{ - char buf[16]; - int32_t x; - int32_t y; -}; - -struct st arr[10]; - -int32_t struct_arr_read_x_element_before_start_far(void) -{ - return arr[-100].x; /* { dg-warning "buffer under-read" "warning" } */ - /* { dg-message "out-of-bounds read from byte -2384 till byte -2381 but 'arr' starts at byte 0" "final event" { target *-*-* } .-1 } */ - /* { dg-message "valid subscripts for 'arr' are '\\\[0\\\]' to '\\\[9\\\]'" "valid subscript note" { target *-*-* } .-2 } */ -} - -int32_t struct_arr_read_x_element_before_start_near(void) -{ - return arr[-2].x; /* { dg-warning "buffer under-read" "warning" } */ - /* { dg-message "out-of-bounds read from byte -32 till byte -29 but 'arr' starts at byte 0" "final event" { target *-*-* } .-1 } */ - /* { dg-message "valid subscripts for 'arr' are '\\\[0\\\]' to '\\\[9\\\]'" "valid subscript note" { target *-*-* } .-2 } */ -} - -int32_t struct_arr_read_x_element_before_start_off_by_one(void) -{ - return arr[-1].x; /* { dg-warning "buffer under-read" "warning" } */ - /* { dg-message "out-of-bounds read from byte -8 till byte -5 but 'arr' starts at byte 0" "final event" { target *-*-* } .-1 } */ - /* { dg-message "valid subscripts for 'arr' are '\\\[0\\\]' to '\\\[9\\\]'" "valid subscript note" { target *-*-* } .-2 } */ -} - -int32_t struct_arr_read_x_element_at_start(void) -{ - return arr[0].x; -} - -int32_t struct_arr_read_x_element_at_end(void) -{ - return arr[9].x; -} - -int32_t struct_arr_read_x_element_after_end_off_by_one(void) -{ - return arr[10].x; /* { dg-warning "buffer over-read" "warning" } */ - /* { dg-message "out-of-bounds read from byte 256 till byte 259 but 'arr' ends at byte 240" "final event" { target *-*-* } .-1 } */ - /* { dg-message "read of 4 bytes from after the end of 'arr'" "num bad bytes note" { target *-*-* } .-2 } */ - /* { dg-message "valid subscripts for 'arr' are '\\\[0\\\]' to '\\\[9\\\]'" "valid subscript note" { target *-*-* } .-3 } */ -} - -int32_t struct_arr_read_x_element_after_end_near(void) -{ - return arr[11].x; /* { dg-warning "buffer over-read" "warning" } */ - /* { dg-message "out-of-bounds read from byte 280 till byte 283 but 'arr' ends at byte 240" "final event" { target *-*-* } .-1 } */ - /* { dg-message "read of 4 bytes from after the end of 'arr'" "num bad bytes note" { target *-*-* } .-2 } */ - /* { dg-message "valid subscripts for 'arr' are '\\\[0\\\]' to '\\\[9\\\]'" "valid subscript note" { target *-*-* } .-3 } */ -} - -int32_t struct_arr_read_x_element_after_end_far(void) -{ - return arr[100].x; /* { dg-warning "buffer over-read" "warning" } */ - /* { dg-message "out-of-bounds read from byte 2416 till byte 2419 but 'arr' ends at byte 240" "final event" { target *-*-* } .-1 } */ - /* { dg-message "read of 4 bytes from after the end of 'arr'" "num bad bytes note" { target *-*-* } .-2 } */ - /* { dg-message "valid subscripts for 'arr' are '\\\[0\\\]' to '\\\[9\\\]'" "valid subscript note" { target *-*-* } .-3 } */ -} diff --git a/gcc/testsuite/gcc.dg/analyzer/out-of-bounds-write-char-arr.c b/gcc/testsuite/gcc.dg/analyzer/out-of-bounds-write-char-arr.c deleted file mode 100644 index 2bc707c..0000000 --- a/gcc/testsuite/gcc.dg/analyzer/out-of-bounds-write-char-arr.c +++ /dev/null @@ -1,56 +0,0 @@ -char arr[10]; /* { dg-message "capacity: 10 bytes" } */ - -void char_arr_write_element_before_start_far(char x) -{ - arr[-100] = x; /* { dg-warning "buffer underwrite" "warning" } */ - /* { dg-message "out-of-bounds write at byte -100 but 'arr' starts at byte 0" "final event" { target *-*-* } .-1 } */ - /* { dg-message "valid subscripts for 'arr' are '\\\[0\\\]' to '\\\[9\\\]'" "valid subscript note" { target *-*-* } .-2 } */ -} - -void char_arr_write_element_before_start_near(char x) -{ - arr[-2] = x; /* { dg-warning "buffer underwrite" "warning" } */ - /* { dg-message "out-of-bounds write at byte -2 but 'arr' starts at byte 0" "final event" { target *-*-* } .-1 } */ - /* { dg-message "valid subscripts for 'arr' are '\\\[0\\\]' to '\\\[9\\\]'" "valid subscript note" { target *-*-* } .-2 } */ -} - -void char_arr_write_element_before_start_off_by_one(char x) -{ - arr[-1] = x; /* { dg-warning "buffer underwrite" "warning" } */ - /* { dg-message "out-of-bounds write at byte -1 but 'arr' starts at byte 0" "final event" { target *-*-* } .-1 } */ - /* { dg-message "valid subscripts for 'arr' are '\\\[0\\\]' to '\\\[9\\\]'" "valid subscript note" { target *-*-* } .-2 } */ -} - -void char_arr_write_element_at_start(char x) -{ - arr[0] = x; -} - -void char_arr_write_element_at_end(char x) -{ - arr[9] = x; -} - -void char_arr_write_element_after_end_off_by_one(char x) -{ - arr[10] = x; /* { dg-warning "buffer overflow" "warning" } */ - /* { dg-message "out-of-bounds write at byte 10 but 'arr' ends at byte 10" "final event" { target *-*-* } .-1 } */ - /* { dg-message "write of 1 byte to beyond the end of 'arr'" "num bad bytes note" { target *-*-* } .-2 } */ - /* { dg-message "valid subscripts for 'arr' are '\\\[0\\\]' to '\\\[9\\\]'" "valid subscript note" { target *-*-* } .-3 } */ -} - -void char_arr_write_element_after_end_near(char x) -{ - arr[11] = x; /* { dg-warning "buffer overflow" "warning" } */ - /* { dg-message "out-of-bounds write at byte 11 but 'arr' ends at byte 10" "final event" { target *-*-* } .-1 } */ - /* { dg-message "write of 1 byte to beyond the end of 'arr'" "num bad bytes note" { target *-*-* } .-2 } */ - /* { dg-message "valid subscripts for 'arr' are '\\\[0\\\]' to '\\\[9\\\]'" "valid subscript note" { target *-*-* } .-3 } */ -} - -void char_arr_write_element_after_end_far(char x) -{ - arr[100] = x; /* { dg-warning "buffer overflow" "warning" } */ - /* { dg-message "out-of-bounds write at byte 100 but 'arr' ends at byte 10" "final event" { target *-*-* } .-1 } */ - /* { dg-message "write of 1 byte to beyond the end of 'arr'" "num bad bytes note" { target *-*-* } .-2 } */ - /* { dg-message "valid subscripts for 'arr' are '\\\[0\\\]' to '\\\[9\\\]'" "valid subscript note" { target *-*-* } .-3 } */ -} diff --git a/gcc/testsuite/gcc.dg/analyzer/out-of-bounds-write-int-arr.c b/gcc/testsuite/gcc.dg/analyzer/out-of-bounds-write-int-arr.c deleted file mode 100644 index c6c0435..0000000 --- a/gcc/testsuite/gcc.dg/analyzer/out-of-bounds-write-int-arr.c +++ /dev/null @@ -1,58 +0,0 @@ -#include - -int32_t arr[10]; /* { dg-message "capacity: 40 bytes" } */ - -void int_arr_write_element_before_start_far(int32_t x) -{ - arr[-100] = x; /* { dg-warning "buffer underwrite" "warning" } */ - /* { dg-message "out-of-bounds write from byte -400 till byte -397 but 'arr' starts at byte 0" "final event" { target *-*-* } .-1 } */ - /* { dg-message "valid subscripts for 'arr' are '\\\[0\\\]' to '\\\[9\\\]'" "valid subscript note" { target *-*-* } .-2 } */ -} - -void int_arr_write_element_before_start_near(int32_t x) -{ - arr[-2] = x; /* { dg-warning "buffer underwrite" "warning" } */ - /* { dg-message "out-of-bounds write from byte -8 till byte -5 but 'arr' starts at byte 0" "final event" { target *-*-* } .-1 } */ - /* { dg-message "valid subscripts for 'arr' are '\\\[0\\\]' to '\\\[9\\\]'" "valid subscript note" { target *-*-* } .-2 } */ -} - -void int_arr_write_element_before_start_off_by_one(int32_t x) -{ - arr[-1] = x; /* { dg-warning "buffer underwrite" "warning" } */ - /* { dg-message "out-of-bounds write from byte -4 till byte -1 but 'arr' starts at byte 0" "final event" { target *-*-* } .-1 } */ - /* { dg-message "valid subscripts for 'arr' are '\\\[0\\\]' to '\\\[9\\\]'" "valid subscript note" { target *-*-* } .-2 } */ -} - -void int_arr_write_element_at_start(int32_t x) -{ - arr[0] = x; -} - -void int_arr_write_element_at_end(int32_t x) -{ - arr[9] = x; -} - -void int_arr_write_element_after_end_off_by_one(int32_t x) -{ - arr[10] = x; /* { dg-warning "buffer overflow" "warning" } */ - /* { dg-message "out-of-bounds write from byte 40 till byte 43 but 'arr' ends at byte 40" "final event" { target *-*-* } .-1 } */ - /* { dg-message "write of 4 bytes to beyond the end of 'arr'" "num bad bytes note" { target *-*-* } .-2 } */ - /* { dg-message "valid subscripts for 'arr' are '\\\[0\\\]' to '\\\[9\\\]'" "valid subscript note" { target *-*-* } .-3 } */ -} - -void int_arr_write_element_after_end_near(int32_t x) -{ - arr[11] = x; /* { dg-warning "buffer overflow" "warning" } */ - /* { dg-message "out-of-bounds write from byte 44 till byte 47 but 'arr' ends at byte 40" "final event" { target *-*-* } .-1 } */ - /* { dg-message "write of 4 bytes to beyond the end of 'arr'" "num bad bytes note" { target *-*-* } .-2 } */ - /* { dg-message "valid subscripts for 'arr' are '\\\[0\\\]' to '\\\[9\\\]'" "valid subscript note" { target *-*-* } .-3 } */ -} - -void int_arr_write_element_after_end_far(int32_t x) -{ - arr[100] = x; /* { dg-warning "buffer overflow" "warning" } */ - /* { dg-message "out-of-bounds write from byte 400 till byte 403 but 'arr' ends at byte 40" "final event" { target *-*-* } .-1 } */ - /* { dg-message "write of 4 bytes to beyond the end of 'arr'" "num bad bytes note" { target *-*-* } .-2 } */ - /* { dg-message "valid subscripts for 'arr' are '\\\[0\\\]' to '\\\[9\\\]'" "valid subscript note" { target *-*-* } .-3 } */ -} diff --git a/gcc/testsuite/gcc.dg/analyzer/out-of-bounds-write-struct-arr.c b/gcc/testsuite/gcc.dg/analyzer/out-of-bounds-write-struct-arr.c deleted file mode 100644 index cf6b458..0000000 --- a/gcc/testsuite/gcc.dg/analyzer/out-of-bounds-write-struct-arr.c +++ /dev/null @@ -1,65 +0,0 @@ -#include - -struct st -{ - char buf[16]; - int32_t x; - int32_t y; -}; - -struct st arr[10]; - -void struct_arr_write_x_element_before_start_far(int32_t x) -{ - arr[-100].x = x; /* { dg-warning "buffer underwrite" "warning" } */ - /* { dg-message "out-of-bounds write from byte -2384 till byte -2381 but 'arr' starts at byte 0" "final event" { target *-*-* } .-1 } */ - /* { dg-message "valid subscripts for 'arr' are '\\\[0\\\]' to '\\\[9\\\]'" "valid subscript note" { target *-*-* } .-2 } */ -} - -void struct_arr_write_x_element_before_start_near(int32_t x) -{ - arr[-2].x = x; /* { dg-warning "buffer underwrite" "warning" } */ - /* { dg-message "out-of-bounds write from byte -32 till byte -29 but 'arr' starts at byte 0" "final event" { target *-*-* } .-1 } */ - /* { dg-message "valid subscripts for 'arr' are '\\\[0\\\]' to '\\\[9\\\]'" "valid subscript note" { target *-*-* } .-2 } */ -} - -void struct_arr_write_x_element_before_start_off_by_one(int32_t x) -{ - arr[-1].x = x; /* { dg-warning "buffer underwrite" "warning" } */ - /* { dg-message "out-of-bounds write from byte -8 till byte -5 but 'arr' starts at byte 0" "final event" { target *-*-* } .-1 } */ - /* { dg-message "valid subscripts for 'arr' are '\\\[0\\\]' to '\\\[9\\\]'" "valid subscript note" { target *-*-* } .-2 } */ -} - -void struct_arr_write_x_element_at_start(int32_t x) -{ - arr[0].x = x; -} - -void struct_arr_write_x_element_at_end(int32_t x) -{ - arr[9].x = x; -} - -void struct_arr_write_x_element_after_end_off_by_one(int32_t x) -{ - arr[10].x = x; /* { dg-warning "buffer overflow" "warning" } */ - /* { dg-message "out-of-bounds write from byte 256 till byte 259 but 'arr' ends at byte 240" "final event" { target *-*-* } .-1 } */ - /* { dg-message "write of 4 bytes to beyond the end of 'arr'" "num bad bytes note" { target *-*-* } .-2 } */ - /* { dg-message "valid subscripts for 'arr' are '\\\[0\\\]' to '\\\[9\\\]'" "valid subscript note" { target *-*-* } .-3 } */ -} - -void struct_arr_write_x_element_after_end_near(int32_t x) -{ - arr[11].x = x; /* { dg-warning "buffer overflow" "warning" } */ - /* { dg-message "out-of-bounds write from byte 280 till byte 283 but 'arr' ends at byte 240" "final event" { target *-*-* } .-1 } */ - /* { dg-message "write of 4 bytes to beyond the end of 'arr'" "num bad bytes note" { target *-*-* } .-2 } */ - /* { dg-message "valid subscripts for 'arr' are '\\\[0\\\]' to '\\\[9\\\]'" "valid subscript note" { target *-*-* } .-3 } */ -} - -void struct_arr_write_x_element_after_end_far(int32_t x) -{ - arr[100].x = x; /* { dg-warning "buffer overflow" "warning" } */ - /* { dg-message "out-of-bounds write from byte 2416 till byte 2419 but 'arr' ends at byte 240" "final event" { target *-*-* } .-1 } */ - /* { dg-message "write of 4 bytes to beyond the end of 'arr'" "num bad bytes note" { target *-*-* } .-2 } */ - /* { dg-message "valid subscripts for 'arr' are '\\\[0\\\]' to '\\\[9\\\]'" "valid subscript note" { target *-*-* } .-3 } */ -} diff --git a/gcc/testsuite/gcc.dg/analyzer/params-2.c b/gcc/testsuite/gcc.dg/analyzer/params-2.c deleted file mode 100644 index 433c658..0000000 --- a/gcc/testsuite/gcc.dg/analyzer/params-2.c +++ /dev/null @@ -1,17 +0,0 @@ -#include -#include "analyzer-decls.h" - -static void ensure_equal (int a, int b) -{ - if (a != b) - abort (); -} - -void test(int i, int j) -{ - __analyzer_eval (i == j); /* { dg-warning "UNKNOWN" } */ - - ensure_equal (i, j); - - __analyzer_eval (i == j); /* { dg-warning "TRUE" } */ -} diff --git a/gcc/testsuite/gcc.dg/analyzer/paths-1.c b/gcc/testsuite/gcc.dg/analyzer/paths-1.c deleted file mode 100644 index df5b3a6..0000000 --- a/gcc/testsuite/gcc.dg/analyzer/paths-1.c +++ /dev/null @@ -1,17 +0,0 @@ -#include "analyzer-decls.h" - -struct foo -{ - int m_flag; -}; - -extern void bar (int); - -void test (struct foo *pf) -{ - if (pf->m_flag) - bar (0); - else - bar (1); - __analyzer_dump_exploded_nodes (0); /* { dg-warning "1 processed enode" } */ -} diff --git a/gcc/testsuite/gcc.dg/analyzer/paths-1a.c b/gcc/testsuite/gcc.dg/analyzer/paths-1a.c deleted file mode 100644 index a1b842f..0000000 --- a/gcc/testsuite/gcc.dg/analyzer/paths-1a.c +++ /dev/null @@ -1,17 +0,0 @@ -#include "analyzer-decls.h" - -union foo -{ - int m_flag; -}; - -extern void bar (int); - -void test (union foo *pf) -{ - if (pf->m_flag) - bar (0); - else - bar (1); - __analyzer_dump_exploded_nodes (0); /* { dg-warning "1 processed enode" } */ -} diff --git a/gcc/testsuite/gcc.dg/analyzer/paths-2.c b/gcc/testsuite/gcc.dg/analyzer/paths-2.c deleted file mode 100644 index 3efc053..0000000 --- a/gcc/testsuite/gcc.dg/analyzer/paths-2.c +++ /dev/null @@ -1,23 +0,0 @@ -#include "analyzer-decls.h" - -int test (int a) -{ - if (a != 42 && a != 113) { - return (-2); - } - - __analyzer_dump_exploded_nodes (0); /* { dg-warning "1 processed enode" } */ - - return 0; -} - -int test_2 (int a) -{ - if (a != 42 && a != 113 && a != 666) { - return (-2); - } - - __analyzer_dump_exploded_nodes (0); /* { dg-warning "1 processed enode" } */ - - return 0; -} diff --git a/gcc/testsuite/gcc.dg/analyzer/paths-3.c b/gcc/testsuite/gcc.dg/analyzer/paths-3.c deleted file mode 100644 index b5ab810..0000000 --- a/gcc/testsuite/gcc.dg/analyzer/paths-3.c +++ /dev/null @@ -1,47 +0,0 @@ -/* { dg-additional-options "-fanalyzer-transitivity" } */ - -#include -#include "analyzer-decls.h" - -int test_1 (int a, int b) -{ - void *p; - - if (a > 5) - if (b) - p = malloc (16); - else - p = malloc (32); - - __analyzer_dump_exploded_nodes (0); /* { dg-warning "3 processed enodes" } */ - - if (a > 5) - { - free (p); - __analyzer_dump_exploded_nodes (0); /* { dg-warning "1 processed enode" } */ - } - - return 0; /* { dg-bogus "leak" } */ -} - -int test_2 (int a, int b) -{ - void *p; - - if (a > 5) - if (b) - p = malloc (16); - else - p = malloc (32); - - __analyzer_dump_exploded_nodes (0); /* { dg-warning "3 processed enodes" } */ - - if (a > 6) /* different condition */ - { - free (p); - __analyzer_dump_exploded_nodes (0); /* { dg-warning "1 processed enode" } */ - } - - return 0; /* { dg-warning "leak of 'p'" } */ - /* leaks when a == 5. */ -} diff --git a/gcc/testsuite/gcc.dg/analyzer/paths-4.c b/gcc/testsuite/gcc.dg/analyzer/paths-4.c deleted file mode 100644 index 60b3a0c..0000000 --- a/gcc/testsuite/gcc.dg/analyzer/paths-4.c +++ /dev/null @@ -1,54 +0,0 @@ -#include "analyzer-decls.h" - -struct state -{ - int mode; - int data; -}; - -extern void do_stuff (struct state *, int); - -int test_1 (struct state *s) -{ - __analyzer_dump_exploded_nodes (0); /* { dg-warning "1 processed enode" } */ - while (1) - { - __analyzer_dump_exploded_nodes (0); /* { dg-warning "2 processed enode" } */ - __analyzer_dump_exploded_nodes (0); /* { dg-warning "2 processed enode" } */ - /* TODO: why does the above need an extra stmt to merge state? */ - do_stuff (s, s->mode); - } -} - -int test_2 (struct state *s) -{ - __analyzer_dump_exploded_nodes (0); /* { dg-warning "1 processed enode" } */ - while (1) - { - __analyzer_dump_exploded_nodes (0); /* { dg-warning "2 processed enode" } */ - /* { dg-warning "infinite loop" "" { target *-*-* } .-1 } */ - __analyzer_dump_exploded_nodes (0); /* { dg-warning "2 processed enode" } */ - /* TODO: why does the above need an extra stmt to merge state? */ - switch (s->mode) /* { dg-message "if it ever follows 'default:' branch, it will always do so\.\.\." } */ - { - case 0: - __analyzer_dump_exploded_nodes (0); /* { dg-warning "2 processed enode" } */ - do_stuff (s, 0); - break; - case 1: - __analyzer_dump_exploded_nodes (0); /* { dg-warning "1 processed enode" } */ - do_stuff (s, 17); - break; - case 2: - __analyzer_dump_exploded_nodes (0); /* { dg-warning "1 processed enode" } */ - do_stuff (s, 5); - break; - case 3: - __analyzer_dump_exploded_nodes (0); /* { dg-warning "1 processed enode" } */ - return 42; - case 4: - __analyzer_dump_exploded_nodes (0); /* { dg-warning "1 processed enode" } */ - return -3; - } - } -} diff --git a/gcc/testsuite/gcc.dg/analyzer/paths-5.c b/gcc/testsuite/gcc.dg/analyzer/paths-5.c deleted file mode 100644 index 21aa230..0000000 --- a/gcc/testsuite/gcc.dg/analyzer/paths-5.c +++ /dev/null @@ -1,12 +0,0 @@ -#include "analyzer-decls.h" - -void test (int *p, int n) -{ - int i; - __analyzer_dump_exploded_nodes (0); /* { dg-warning "1 processed enode" } */ - for (i = 0; i < n; i++) - { - p[i] = i; /* { dg-bogus "uninitialized" } */ - __analyzer_dump_exploded_nodes (0); /* { dg-warning "2 processed enodes" } */ - } -} diff --git a/gcc/testsuite/gcc.dg/analyzer/paths-6.c b/gcc/testsuite/gcc.dg/analyzer/paths-6.c deleted file mode 100644 index ef1a4e6..0000000 --- a/gcc/testsuite/gcc.dg/analyzer/paths-6.c +++ /dev/null @@ -1,114 +0,0 @@ -#include -#include "analyzer-decls.h" - -/* Verify that ordering of writes doesn't matter when merging states. */ - -/* Test with locals. */ - -void test_1 (int flag) -{ - int a, b; - if (flag) - { - a = 3; - b = 4; - } - else - { - b = 4; - a = 3; - } - - __analyzer_dump_exploded_nodes (0); /* { dg-warning "1 processed enode" } */ - __analyzer_eval (a == 3); /* { dg-warning "TRUE" } */ - __analyzer_eval (b == 4); /* { dg-warning "TRUE" } */ -} - -/* Test with globals. */ - -int f, g, h; -void test_2 (int flag) -{ - if (flag) - { - f = 3; - g = 4; - } - else - { - g = 4; - f = 3; - } - - __analyzer_dump_exploded_nodes (0); /* { dg-warning "1 processed enode" } */ - __analyzer_eval (f == 3); /* { dg-warning "TRUE" } */ - __analyzer_eval (g == 4); /* { dg-warning "TRUE" } */ -} - -/* All 6 orderings of writes to 3 globals. */ - -void test_3 (int i) -{ - switch (i) - { - default: - case 0: - f = 3; - g = 4; - h = 5; - break; - - case 1: - f = 3; - h = 5; - g = 4; - break; - - case 2: - g = 4; - f = 3; - h = 5; - break; - - case 3: - g = 4; - h = 5; - f = 3; - break; - - case 4: - h = 5; - f = 3; - g = 4; - break; - - case 5: - h = 5; - g = 4; - f = 3; - break; - } - - __analyzer_dump_exploded_nodes (0); /* { dg-warning "1 processed enode" } */ - __analyzer_eval (f == 3); /* { dg-warning "TRUE" } */ - __analyzer_eval (g == 4); /* { dg-warning "TRUE" } */ - __analyzer_eval (h == 5); /* { dg-warning "TRUE" } */ -} - -void test_4 (int flag) -{ - void *p, *q; - if (flag) - { - p = malloc (256); - q = malloc (256); - } - else - { - q = malloc (256); - p = malloc (256); - } - __analyzer_dump_exploded_nodes (0); /* { dg-warning "2 processed enode" } */ - free (p); - free (q); -} diff --git a/gcc/testsuite/gcc.dg/analyzer/paths-7.c b/gcc/testsuite/gcc.dg/analyzer/paths-7.c deleted file mode 100644 index 8caaee8..0000000 --- a/gcc/testsuite/gcc.dg/analyzer/paths-7.c +++ /dev/null @@ -1,57 +0,0 @@ -#include -#include "analyzer-decls.h" - -extern int foo (int); - -int test (int flag, void *ptr, int *p, int n) -{ - int result; - int sum = 0; - int i; - - __analyzer_dump_exploded_nodes (0); /* { dg-warning "1 processed enode" } */ - - if (flag) - free (ptr); - - __analyzer_dump_exploded_nodes (0); /* { dg-warning "2 processed enodes" } */ - - for (i = 0; i < n; i++) - p[i] = i; - for (i = 0; i < n; i++) - sum += foo (p[i]); /* { dg-bogus "uninitialized" } */ - result = sum; - - __analyzer_dump_exploded_nodes (0); /* { dg-warning "2 processed enodes" } */ - - if (flag) - free (ptr); /* { dg-warning "double-'free' of 'ptr'" } */ - return result; -} - -int test_2 (int flag, int *p, int n) -{ - int result; - int sum = 0; - int i; - - void *ptr = malloc (16); - - __analyzer_dump_exploded_nodes (0); /* { dg-warning "1 processed enode" } */ - - if (flag) - free (ptr); - - __analyzer_dump_exploded_nodes (0); /* { dg-warning "2 processed enodes" } */ - - for (i = 0; i < n; i++) - p[i] = i; - for (i = 0; i < n; i++) - sum += foo (p[i]); /* { dg-bogus "uninitialized" } */ - result = sum; - - __analyzer_dump_exploded_nodes (0); /* { dg-warning "2 processed enodes" } */ - - free (ptr); /* { dg-warning "double-'free' of 'ptr'" } */ - return result; -} diff --git a/gcc/testsuite/gcc.dg/analyzer/paths-8.c b/gcc/testsuite/gcc.dg/analyzer/paths-8.c deleted file mode 100644 index b350d4d..0000000 --- a/gcc/testsuite/gcc.dg/analyzer/paths-8.c +++ /dev/null @@ -1,17 +0,0 @@ -#include "analyzer-decls.h" - -static void __attribute__((noinline)) -__analyzer_callee_1 (void) -{ - /* empty. */ -} - -void -test_1 (int flag) -{ - if (flag) - __analyzer_callee_1 (); - - /* Verify that we merge state, whether or not the call happens. */ - __analyzer_dump_exploded_nodes (0); /* { dg-warning "1 processed enode" } */ -} diff --git a/gcc/testsuite/gcc.dg/analyzer/pattern-test-1.c b/gcc/testsuite/gcc.dg/analyzer/pattern-test-1.c deleted file mode 100644 index 1306f6d..0000000 --- a/gcc/testsuite/gcc.dg/analyzer/pattern-test-1.c +++ /dev/null @@ -1,28 +0,0 @@ -/* { dg-additional-options "-fanalyzer-checker=pattern-test" } */ - -#include - -extern void foo(void *); -extern void bar(void *); - -void test1(void *ptr) -{ - if (ptr) { /* { dg-warning "pattern match on 'ptr != 0'" "ptr != 0" } */ - /* { dg-warning "pattern match on 'ptr == 0'" "ptr == 0" { target *-*-* } .-1 } */ - foo(ptr); - } else { - bar(ptr); - } -} - -void test_2 (void *p, void *q) -{ - if (p == NULL || q == NULL) /* { dg-line cond_2 } */ - return; - foo(p); - - /* { dg-warning "pattern match on 'p == 0'" "p == 0" { target *-*-* } cond_2 } */ - /* { dg-warning "pattern match on 'q == 0'" "q == 0" { target *-*-* } cond_2 } */ - /* { dg-warning "pattern match on 'p != 0'" "p != 0" { target *-*-* } cond_2 } */ - /* { dg-warning "pattern match on 'q != 0'" "q != 0" { target *-*-* } cond_2 } */ -} diff --git a/gcc/testsuite/gcc.dg/analyzer/pipe-pr107486.c b/gcc/testsuite/gcc.dg/analyzer/pipe-pr107486.c deleted file mode 100644 index e9fc7fb..0000000 --- a/gcc/testsuite/gcc.dg/analyzer/pipe-pr107486.c +++ /dev/null @@ -1,5 +0,0 @@ -void pipe(int); - -void f1(void) { - pipe(1); -} diff --git a/gcc/testsuite/gcc.dg/analyzer/pointer-merging.c b/gcc/testsuite/gcc.dg/analyzer/pointer-merging.c deleted file mode 100644 index dcf0ff0..0000000 --- a/gcc/testsuite/gcc.dg/analyzer/pointer-merging.c +++ /dev/null @@ -1,16 +0,0 @@ -static char * __attribute__((noinline)) -test_1_callee (int flag, char *a, char *b) -{ - char *p; - if (flag) - p = a; - else - p = b; - return p; -} - -char test_1_caller(int flag) { - char a = 42; - char b = 43; - return *test_1_callee(flag, &a, &b); -} diff --git a/gcc/testsuite/gcc.dg/analyzer/pr100546.c b/gcc/testsuite/gcc.dg/analyzer/pr100546.c deleted file mode 100644 index 3349d40..0000000 --- a/gcc/testsuite/gcc.dg/analyzer/pr100546.c +++ /dev/null @@ -1,17 +0,0 @@ -#include -#include - -static void noReturn(const char *str) __attribute__((noreturn)); -static void noReturn(const char *str) { - printf("%s\n", str); - exit(1); -} - -void (*noReturnPtr)(const char *str) = &noReturn; - -int main(int argc, char **argv) { - char *str = 0; - if (!str) - noReturnPtr(__FILE__); - return printf("%c\n", *str); -} diff --git a/gcc/testsuite/gcc.dg/analyzer/pr101503.c b/gcc/testsuite/gcc.dg/analyzer/pr101503.c deleted file mode 100644 index cc4d801..0000000 --- a/gcc/testsuite/gcc.dg/analyzer/pr101503.c +++ /dev/null @@ -1,11 +0,0 @@ -/* { dg-additional-options "--param analyzer-max-svalue-depth=0 -Wno-analyzer-symbol-too-complex" } */ - -int val; - -int -fn (void) -{ - val = fn (); - - return 0; -} diff --git a/gcc/testsuite/gcc.dg/analyzer/pr101570.c b/gcc/testsuite/gcc.dg/analyzer/pr101570.c deleted file mode 100644 index 809bad6..0000000 --- a/gcc/testsuite/gcc.dg/analyzer/pr101570.c +++ /dev/null @@ -1,5 +0,0 @@ -void -test2 (_Complex double f) -{ - __asm__ ("" : "=r" (__real f)); -} diff --git a/gcc/testsuite/gcc.dg/analyzer/pr101721.c b/gcc/testsuite/gcc.dg/analyzer/pr101721.c deleted file mode 100644 index 07ef2d6..0000000 --- a/gcc/testsuite/gcc.dg/analyzer/pr101721.c +++ /dev/null @@ -1,8 +0,0 @@ -/* PR analyzer/101721 */ -/* { dg-do compile { target i?86-*-* x86_64-*-* } } */ - -void -foo () -{ - __builtin_ia32_pause (); -} diff --git a/gcc/testsuite/gcc.dg/analyzer/pr102692-2.c b/gcc/testsuite/gcc.dg/analyzer/pr102692-2.c deleted file mode 100644 index c72fde2..0000000 --- a/gcc/testsuite/gcc.dg/analyzer/pr102692-2.c +++ /dev/null @@ -1,22 +0,0 @@ -/* { dg-additional-options "-O1" } */ - -struct Lisp_Overlay -{ - struct Lisp_Overlay *next; -}; - -void -test_1 (struct Lisp_Overlay *tail, long prev) -{ - long end; - if (!tail || end < prev || !tail->next) /* { dg-warning "use of uninitialized value 'end'" } */ - return; -} - -void -test_2 (struct Lisp_Overlay *tail, long prev) -{ - long end; - if (tail && end < prev && !tail->next) /* { dg-warning "use of uninitialized value 'end'" } */ - return; -} diff --git a/gcc/testsuite/gcc.dg/analyzer/pr102695.c b/gcc/testsuite/gcc.dg/analyzer/pr102695.c deleted file mode 100644 index 2ca9882..0000000 --- a/gcc/testsuite/gcc.dg/analyzer/pr102695.c +++ /dev/null @@ -1,44 +0,0 @@ -extern void* malloc (__SIZE_TYPE__); - -const char* write_strchr_literal (int x) -{ - char *p = __builtin_strchr ("123", x); - *p = 0; /* { dg-warning "dereference of NULL 'p'" "null deref" } */ - /* { dg-warning "write to string literal" "string literal" { target *-*-* } .-1 } */ - return p; -} - -const char* write_strchr_const_array (int x) -{ - static const char a[] = "123"; - char *p = __builtin_strchr (a, x); - *p = 0; /* { dg-warning "dereference of NULL 'p'" "null deref" } */ - /* { dg-warning "write to 'const' object 'a'" "write to const" { target *-*-* } .-1 } */ - return a; -} - -char* write_function (void) -{ - char *p = (char*)malloc /* forgot arguments */; - p[1] = 'a'; /* { dg-warning "write to function 'malloc'" } */ - __builtin_strcpy (p, "123"); /* { dg-warning "write to function 'malloc'" } */ - return p; -} - -char* write_label (void) -{ - char *p = (char*)&&L; - *p = 0; /* { dg-warning "write to label 'L'" } */ -L: - return p; -} - -struct A { const int i; }; - -extern /* not const */ struct A a; - -void write_const_member (void) -{ - char *p = (char*)&a.i; - *p = 0; // missing warning -} diff --git a/gcc/testsuite/gcc.dg/analyzer/pr103217-3.c b/gcc/testsuite/gcc.dg/analyzer/pr103217-3.c deleted file mode 100644 index e5f1e4b..0000000 --- a/gcc/testsuite/gcc.dg/analyzer/pr103217-3.c +++ /dev/null @@ -1,54 +0,0 @@ -/* { dg-additional-options "-Wno-analyzer-too-complex" } */ - -extern char *strdup (const char *__s) - __attribute__ ((__nothrow__ , __leaf__, __malloc__, __nonnull__ (1))); - -extern void abort (void) - __attribute__ ((__nothrow__ , __leaf__, __noreturn__)); - -extern int getopt (int ___argc, char *const *___argv, const char *__shortopts) - __attribute__ ((__nothrow__ , __leaf__, __nonnull__ (2, 3))); -extern char *optarg; - -extern void free (void *__ptr) - __attribute__ ((__nothrow__ , __leaf__)); - -struct state { - const char *confpath; - const char *host; - const char *port; - const char *state_dir_prefix; -}; - -static inline char *xstrdup(const char *s) { - char *val = strdup(s); - if (!val) - abort(); - return val; -} - -int config_init(struct state *config); - -int main(int argc, char *argv[]) { - int rc; - struct state state = { 0 }; - - config_init(&state); - - while ((rc = getopt(argc, argv, "H:p:")) != -1) { - switch (rc) { - case 'H': - free((void*)state.host); - state.host = xstrdup(optarg); - break; - case 'p': - free((void*)state.port); - state.port = xstrdup(optarg); - break; - } - } - - free((void*)state.host); - free((void*)state.port); - return rc; -} diff --git a/gcc/testsuite/gcc.dg/analyzer/pr103217-4.c b/gcc/testsuite/gcc.dg/analyzer/pr103217-4.c deleted file mode 100644 index 516e1f4..0000000 --- a/gcc/testsuite/gcc.dg/analyzer/pr103217-4.c +++ /dev/null @@ -1,52 +0,0 @@ -extern char *strdup (const char *__s) - __attribute__ ((__nothrow__ , __leaf__, __malloc__, __nonnull__ (1))); - -extern void abort (void) - __attribute__ ((__nothrow__ , __leaf__, __noreturn__)); - -extern int getopt (int ___argc, char *const *___argv, const char *__shortopts) - __attribute__ ((__nothrow__ , __leaf__, __nonnull__ (2, 3))); -extern char *optarg; - -extern void free (void *__ptr) - __attribute__ ((__nothrow__ , __leaf__)); - -struct state { - const char *confpath; - const char *host; - const char *port; - const char *state_dir_prefix; -}; - -static inline char *xstrdup(const char *s) { - char *val = strdup(s); - if (!val) - abort(); - return val; -} - -int config_init(struct state *config); - -int main(int argc, char *argv[]) { - int rc; - struct state state = { 0 }; - - config_init(&state); - - if ((rc = getopt(argc, argv, "H:p:")) != -1) { - switch (rc) { - case 'H': - free((void*)state.host); - state.host = xstrdup(optarg); - break; - case 'p': - free((void*)state.port); - state.port = xstrdup(optarg); - break; - } - } - - free((void*)state.host); - free((void*)state.port); - return rc; -} diff --git a/gcc/testsuite/gcc.dg/analyzer/pr103217-5.c b/gcc/testsuite/gcc.dg/analyzer/pr103217-5.c deleted file mode 100644 index d916d92..0000000 --- a/gcc/testsuite/gcc.dg/analyzer/pr103217-5.c +++ /dev/null @@ -1,47 +0,0 @@ -extern char *strdup (const char *__s) - __attribute__ ((__nothrow__ , __leaf__, __malloc__, __nonnull__ (1))); - -extern void abort (void) - __attribute__ ((__nothrow__ , __leaf__, __noreturn__)); - -extern int getopt (int ___argc, char *const *___argv, const char *__shortopts) - __attribute__ ((__nothrow__ , __leaf__, __nonnull__ (2, 3))); -extern char *optarg; - -extern void free (void *__ptr) - __attribute__ ((__nothrow__ , __leaf__)); - -struct state { - const char *confpath; - const char *host; - const char *port; - const char *state_dir_prefix; -}; - -static inline char *xstrdup(const char *s) { - char *val = strdup(s); - if (!val) - abort(); - return val; -} - -int config_init(struct state *config); - -int main(int argc, char *argv[]) { - struct state state; - - config_init(&state); - - switch (getopt(argc, argv, "H:p:")) { - case 'H': - state.host = xstrdup(optarg); - break; - case 'p': - state.port = xstrdup(optarg); - break; - } - - free((void*)state.host); - free((void*)state.port); - return 0; -} diff --git a/gcc/testsuite/gcc.dg/analyzer/pr104089.c b/gcc/testsuite/gcc.dg/analyzer/pr104089.c deleted file mode 100644 index 3bf637e..0000000 --- a/gcc/testsuite/gcc.dg/analyzer/pr104089.c +++ /dev/null @@ -1,11 +0,0 @@ -/* { dg-add-options float16 } */ -/* { dg-require-effective-target float16 } */ -/* { dg-additional-options "-frounding-math" } */ - -volatile _Float16 true_min = 5.96046447753906250000000000000000000e-8F16; - -int -main (void) -{ - return __builtin_fpclassify (0, 1, 4, 3, 2, true_min); -} diff --git a/gcc/testsuite/gcc.dg/analyzer/pr104308.c b/gcc/testsuite/gcc.dg/analyzer/pr104308.c deleted file mode 100644 index a3a0cbb..0000000 --- a/gcc/testsuite/gcc.dg/analyzer/pr104308.c +++ /dev/null @@ -1,19 +0,0 @@ -/* Verify that we have source locations for - -Wanalyzer-use-of-uninitialized-value warnings involving folded - memory ops. */ - -#include - -int test_memmove_within_uninit (void) -{ - char s[5]; /* { dg-message "region created on stack here" } */ - memmove(s, s + 1, 2); /* { dg-warning "use of uninitialized value" } */ - return 0; -} - -int test_memcpy_from_uninit (void) -{ - char a1[5]; - char a2[5]; /* { dg-message "region created on stack here" } */ - return (memcpy(a1, a2, 5) == a1); /* { dg-warning "use of uninitialized value" } */ -} diff --git a/gcc/testsuite/gcc.dg/analyzer/pr104452.c b/gcc/testsuite/gcc.dg/analyzer/pr104452.c deleted file mode 100644 index 85eb82d..0000000 --- a/gcc/testsuite/gcc.dg/analyzer/pr104452.c +++ /dev/null @@ -1,10 +0,0 @@ -/* { dg-additional-options "-O" } */ - -void -test_1 (void) -{ - int __attribute__((__vector_size__ (16))) x; - for (unsigned i = 0; i < 4;) - if (x[i]) /* { dg-warning "use of uninitialized value" } */ - __builtin_abort (); -} diff --git a/gcc/testsuite/gcc.dg/analyzer/pr104524.c b/gcc/testsuite/gcc.dg/analyzer/pr104524.c deleted file mode 100644 index 875098c..0000000 --- a/gcc/testsuite/gcc.dg/analyzer/pr104524.c +++ /dev/null @@ -1,9 +0,0 @@ -int src[1]; - -int -main (int c, char **a) -{ - __builtin_memcpy (*a, src, c); - - return 0; -} diff --git a/gcc/testsuite/gcc.dg/analyzer/pr104560-2.c b/gcc/testsuite/gcc.dg/analyzer/pr104560-2.c deleted file mode 100644 index f968a58..0000000 --- a/gcc/testsuite/gcc.dg/analyzer/pr104560-2.c +++ /dev/null @@ -1,26 +0,0 @@ -struct ibv_device { - /* [...snip...] */ - int placeholder; -}; - -struct verbs_device { - struct ibv_device device; /* Must be first */ - /* [...snip...] */ - int placeholder; -}; - -struct mlx5_device { - struct verbs_device verbs_dev; - int placeholder; -}; - -static inline struct mlx5_device *to_mdev(struct ibv_device *ibdev) -{ - return (struct mlx5_device *)ibdev; -} - -static void mlx5_uninit_device(struct verbs_device *verbs_device) -{ - struct mlx5_device *dev = to_mdev(&verbs_device->device); - __builtin_free(dev); /* { dg-bogus "not on the heap" } */ -} diff --git a/gcc/testsuite/gcc.dg/analyzer/pr105087-1.c b/gcc/testsuite/gcc.dg/analyzer/pr105087-1.c deleted file mode 100644 index c4acf42..0000000 --- a/gcc/testsuite/gcc.dg/analyzer/pr105087-1.c +++ /dev/null @@ -1,18 +0,0 @@ -#include "analyzer-decls.h" - -extern void *inner_alloc (void); - -void * __attribute__((noinline)) -outer_alloc (void) -{ - return inner_alloc (); -} - -void test_1 (void) -{ - void *p, *q; - - p = outer_alloc (); - q = outer_alloc (); - __analyzer_eval (p == q); /* { dg-warning "UNKNOWN" } */ -} diff --git a/gcc/testsuite/gcc.dg/analyzer/pr105087-2.c b/gcc/testsuite/gcc.dg/analyzer/pr105087-2.c deleted file mode 100644 index 7cd6591..0000000 --- a/gcc/testsuite/gcc.dg/analyzer/pr105087-2.c +++ /dev/null @@ -1,20 +0,0 @@ -#include "analyzer-decls.h" - -extern void inner_alloc (void **); - -void * __attribute__((noinline)) -outer_alloc (void) -{ - void *result; - inner_alloc (&result); - return result; -} - -void test_1 (void) -{ - void *p, *q; - - p = outer_alloc (); - q = outer_alloc (); - __analyzer_eval (p == q); /* { dg-warning "UNKNOWN" } */ -} diff --git a/gcc/testsuite/gcc.dg/analyzer/pr105252.c b/gcc/testsuite/gcc.dg/analyzer/pr105252.c deleted file mode 100644 index a093eab..0000000 --- a/gcc/testsuite/gcc.dg/analyzer/pr105252.c +++ /dev/null @@ -1,20 +0,0 @@ -/* { dg-additional-options "-fnon-call-exceptions -O" } */ - -typedef unsigned char C; -typedef unsigned char __attribute__((__vector_size__ (4))) V; - -C m; - -static inline void -bar (C c, V v, V *r) -{ - v %= (c | v) % m; - *r = v; -} - -void -foo (void) -{ - V x; - bar (0, (V){2}, &x); -} diff --git a/gcc/testsuite/gcc.dg/analyzer/pr106394.c b/gcc/testsuite/gcc.dg/analyzer/pr106394.c deleted file mode 100644 index 96bb175..0000000 --- a/gcc/testsuite/gcc.dg/analyzer/pr106394.c +++ /dev/null @@ -1,19 +0,0 @@ -struct msm_gpu { - // [...snip...] - const struct msm_gpu_perfcntr *perfcntrs; - // [...snip...] -}; - -struct msm_gpu_perfcntr { - // [...snip...] - const char *name; -}; - -static const struct msm_gpu_perfcntr perfcntrs[] = {}; - -struct msm_gpu *test(struct msm_gpu *gpu) { - // [...snip...] - gpu->perfcntrs = perfcntrs; - // [...snip...] - return gpu; -} diff --git a/gcc/testsuite/gcc.dg/analyzer/pr106539.c b/gcc/testsuite/gcc.dg/analyzer/pr106539.c deleted file mode 100644 index fd27086..0000000 --- a/gcc/testsuite/gcc.dg/analyzer/pr106539.c +++ /dev/null @@ -1,15 +0,0 @@ -#include - -void *test (void) -{ - void **p = (void **)malloc (sizeof (void *) * 2); - if (!p) - return NULL; - p[0] = malloc(10); - p[1] = malloc(20); /* { dg-message "allocated here" } */ - void *q = realloc (p, sizeof (void *)); /* { dg-message "when 'realloc' succeeds, moving buffer" } */ - if (!q) - /* { dg-warning "leak of ''" "leak of unknown" { target *-*-* } .-1 } */ - return p; - return q; -} diff --git a/gcc/testsuite/gcc.dg/analyzer/pr106845.c b/gcc/testsuite/gcc.dg/analyzer/pr106845.c deleted file mode 100644 index 528c7b3..0000000 --- a/gcc/testsuite/gcc.dg/analyzer/pr106845.c +++ /dev/null @@ -1,11 +0,0 @@ -int buf_size; - -int -main (void) -{ - char buf[buf_size]; - - __builtin_memset (&buf[1], 0, buf_size); - - return 0; -} diff --git a/gcc/testsuite/gcc.dg/analyzer/pr109439.c b/gcc/testsuite/gcc.dg/analyzer/pr109439.c deleted file mode 100644 index 01c87cf..0000000 --- a/gcc/testsuite/gcc.dg/analyzer/pr109439.c +++ /dev/null @@ -1,12 +0,0 @@ -int would_like_only_oob (int i) -{ - int arr[] = {1,2,3,4,5,6,7}; - arr[10] = 9; /* { dg-warning "stack-based buffer overflow" } */ - arr[11] = 15; /* { dg-warning "stack-based buffer overflow" } */ - int y1 = arr[9]; /* { dg-warning "stack-based buffer over-read" } */ - /* { dg-bogus "use of uninitialized value" "" { target *-*-* } .-1 } */ - - arr[18] = 15; /* { dg-warning "stack-based buffer overflow" } */ - - return y1; -} diff --git a/gcc/testsuite/gcc.dg/analyzer/pr110455.c b/gcc/testsuite/gcc.dg/analyzer/pr110455.c deleted file mode 100644 index 7f97943..0000000 --- a/gcc/testsuite/gcc.dg/analyzer/pr110455.c +++ /dev/null @@ -1,7 +0,0 @@ -int __attribute__((__vector_size__ (4))) v; - -void -foo (void) -{ - v | v << 1; -} diff --git a/gcc/testsuite/gcc.dg/analyzer/pr93032-mztools-simplified.c b/gcc/testsuite/gcc.dg/analyzer/pr93032-mztools-simplified.c deleted file mode 100644 index 4a08f0f1..0000000 --- a/gcc/testsuite/gcc.dg/analyzer/pr93032-mztools-simplified.c +++ /dev/null @@ -1,22 +0,0 @@ -/* { dg-do "compile" } */ - -/* Minimal replacement of system headers. */ -#define NULL ((void *) 0) -typedef struct _IO_FILE FILE; -extern FILE *fopen(const char *__restrict __filename, - const char *__restrict __modes); -extern int fclose (FILE *__stream); - -extern void unzRepair(const char* file, const char* fileOut, const char* fileOutTmp) -{ - FILE* fpZip = fopen(file, "rb"); - FILE* fpOut = fopen(fileOut, "wb"); - FILE* fpOutCD = fopen(fileOutTmp, "wb"); - if (fpZip != NULL && fpOut != NULL) { - fclose(fpOutCD); - fclose(fpZip); - fclose(fpOut); - } -} /* { dg-warning "leak of FILE 'fpZip'" "leak of fpZip" } */ - /* { dg-warning "leak of FILE 'fpOut'" "leak of fpOut" { target *-*-* } .-1 } */ - /* { dg-warning "leak of FILE 'fpOutCD'" "leak of fpOutCD" { target *-*-* } .-2 } */ diff --git a/gcc/testsuite/gcc.dg/analyzer/pr93290.c b/gcc/testsuite/gcc.dg/analyzer/pr93290.c deleted file mode 100644 index fa35629..0000000 --- a/gcc/testsuite/gcc.dg/analyzer/pr93290.c +++ /dev/null @@ -1,9 +0,0 @@ -#include - -int test_1 (void) -{ - float foo = 42.; - if (isnan (foo)) - return 1; - return 0; -} diff --git a/gcc/testsuite/gcc.dg/analyzer/pr93352.c b/gcc/testsuite/gcc.dg/analyzer/pr93352.c deleted file mode 100644 index ccb96d0..0000000 --- a/gcc/testsuite/gcc.dg/analyzer/pr93352.c +++ /dev/null @@ -1,12 +0,0 @@ -/* { dg-additional-options "-Wno-overflow" } */ - -struct yc { - int c0; - char di[]; -}; - -void -qt (struct yc *ab) -{ - ab->di[0x7fffffff + 1] = ab->di[0]; -} diff --git a/gcc/testsuite/gcc.dg/analyzer/pr93355-localealias-feasibility-3.c b/gcc/testsuite/gcc.dg/analyzer/pr93355-localealias-feasibility-3.c deleted file mode 100644 index 50d3388..0000000 --- a/gcc/testsuite/gcc.dg/analyzer/pr93355-localealias-feasibility-3.c +++ /dev/null @@ -1,60 +0,0 @@ -/* Simplified version of test to ensure we issue a FILE * leak diagnostic, - reproducing a feasibility issue. - Adapted from intl/localealias.c, with all #includes removed. */ - -/* { dg-do "compile" } */ - -/* Handle aliases for locale names. - Copyright (C) 1995-1999, 2000-2001, 2003 Free Software Foundation, Inc. - - This program is free software; you can redistribute it and/or modify it - under the terms of the GNU Library General Public License as published - by the Free Software Foundation; either version 2, or (at your option) - any later version. - - This program is distributed in the hope that it will be useful, - but WITHOUT ANY WARRANTY; without even the implied warranty of - MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU - Library General Public License for more details. - - You should have received a copy of the GNU Library General Public - License along with this program; if not, write to the Free Software - Foundation, Inc., 51 Franklin Street - Fifth Floor, Boston, MA 02110-1301, - USA. */ - -/* Minimal version of system headers. */ - -typedef __SIZE_TYPE__ size_t; -#define NULL ((void *)0) - -typedef struct _IO_FILE FILE; -extern FILE *fopen (const char *__restrict __filename, - const char *__restrict __modes); -extern int fclose (FILE *__stream); - -extern int isspace (int) __attribute__((__nothrow__, __leaf__)); - -/* Cleaned-up body of localealias.c follows. */ - -size_t -read_alias_file (const char *fname, char *cp) -{ - FILE *fp; - - fp = fopen (fname, "r"); /* { dg-message "opened here" } */ - if (fp == NULL) - return 0; - - if (cp[0] != '\0') - *cp++ = '\0'; - - while (isspace ((unsigned char)cp[0])) - ++cp; - - if (cp[0] != '\0') - return 42; /* { dg-warning "leak of FILE 'fp'" } */ - - fclose(fp); - - return 0; -} diff --git a/gcc/testsuite/gcc.dg/analyzer/pr93355-localealias-simplified.c b/gcc/testsuite/gcc.dg/analyzer/pr93355-localealias-simplified.c deleted file mode 100644 index 6f65add..0000000 --- a/gcc/testsuite/gcc.dg/analyzer/pr93355-localealias-simplified.c +++ /dev/null @@ -1,45 +0,0 @@ -/* Simplified version of test for ensuring we issue a FILE * leak diagnostic, - made trivial. - Adapted from intl/localealias.c, with all #includes removed. */ - -/* { dg-do "compile" } */ - -/* Handle aliases for locale names. - Copyright (C) 1995-1999, 2000-2001, 2003 Free Software Foundation, Inc. - - This program is free software; you can redistribute it and/or modify it - under the terms of the GNU Library General Public License as published - by the Free Software Foundation; either version 2, or (at your option) - any later version. - - This program is distributed in the hope that it will be useful, - but WITHOUT ANY WARRANTY; without even the implied warranty of - MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU - Library General Public License for more details. - - You should have received a copy of the GNU Library General Public - License along with this program; if not, write to the Free Software - Foundation, Inc., 51 Franklin Street - Fifth Floor, Boston, MA 02110-1301, - USA. */ - -/* Minimal version of system headers. */ -#define NULL ((void *) 0) -typedef struct _IO_FILE FILE; -extern FILE *fopen(const char *__restrict __filename, - const char *__restrict __modes); -extern int fclose(FILE *__stream); - -void -read_alias_file (int flag) -{ - FILE *fp; - - fp = fopen ("name", "r"); /* { dg-message "opened here" } */ - if (fp == NULL) - return; - - if (flag) - return; /* { dg-warning "leak of FILE 'fp'" } */ - - fclose (fp); -} diff --git a/gcc/testsuite/gcc.dg/analyzer/pr93546.c b/gcc/testsuite/gcc.dg/analyzer/pr93546.c deleted file mode 100644 index 07898e9..0000000 --- a/gcc/testsuite/gcc.dg/analyzer/pr93546.c +++ /dev/null @@ -1,11 +0,0 @@ -/* { dg-do compile } */ -/* { dg-require-effective-target label_values } */ - -void -ch (int x1) -{ - ({ bx: &&bx; }); - while (x1 == 0) /* { dg-warning "infinite loop" } */ - { - } -} diff --git a/gcc/testsuite/gcc.dg/analyzer/pr93547.c b/gcc/testsuite/gcc.dg/analyzer/pr93547.c deleted file mode 100644 index 1518904..0000000 --- a/gcc/testsuite/gcc.dg/analyzer/pr93547.c +++ /dev/null @@ -1,14 +0,0 @@ -/* { dg-do compile } */ - -void -wy (int); - -int -f9 (void) -{ - int p5 = __builtin_ilogb (__builtin_inf ()); - - wy (0); - - return p5; -} diff --git a/gcc/testsuite/gcc.dg/analyzer/pr93669.c b/gcc/testsuite/gcc.dg/analyzer/pr93669.c deleted file mode 100644 index 01e266d..0000000 --- a/gcc/testsuite/gcc.dg/analyzer/pr93669.c +++ /dev/null @@ -1,25 +0,0 @@ -/* { dg-additional-options "--param analyzer-max-enodes-per-program-point=2 -Wno-analyzer-too-complex" } */ - -#include "analyzer-decls.h" - -int test (int a) -{ - if (a != 42 && a != 113) { - return (-2); - } - - __analyzer_dump_exploded_nodes (0); /* { dg-warning "1 processed enode" } */ - - return 0; -} - -int test_2 (int a) -{ - if (a != 42 && a != 113 && a != 666) { - return (-2); - } - - __analyzer_dump_exploded_nodes (0); /* { dg-warning "1 processed enode" } */ - - return 0; -} diff --git a/gcc/testsuite/gcc.dg/analyzer/pr93938.c b/gcc/testsuite/gcc.dg/analyzer/pr93938.c deleted file mode 100644 index 81d9983..0000000 --- a/gcc/testsuite/gcc.dg/analyzer/pr93938.c +++ /dev/null @@ -1,13 +0,0 @@ -/* Taken from gcc.dg/pr70022.c, adding -O1 to the options - (and -fanalyzer, implicitly). */ - -/* { dg-do compile } */ -/* { dg-options "-w -Wno-psabi -O1" } */ - -typedef int v4si __attribute__ ((vector_size (16))); - -int -foo (v4si v) -{ - return v[~0UL]; -} diff --git a/gcc/testsuite/gcc.dg/analyzer/pr94047.c b/gcc/testsuite/gcc.dg/analyzer/pr94047.c deleted file mode 100644 index a579673..0000000 --- a/gcc/testsuite/gcc.dg/analyzer/pr94047.c +++ /dev/null @@ -1,19 +0,0 @@ -typedef struct list -{ - struct list *next; -} tlist; - -void -bar (struct list *l) -{ - l->next = l->next->next; -} - -void -foo (void) -{ - struct list l; /* { dg-message "region created on stack here" } */ - tlist t = l; /* { dg-warning "use of uninitialized value 'l'" } */ - for (;;) - bar (&t); -} diff --git a/gcc/testsuite/gcc.dg/analyzer/pr94099.c b/gcc/testsuite/gcc.dg/analyzer/pr94099.c deleted file mode 100644 index 1d7a5d7..0000000 --- a/gcc/testsuite/gcc.dg/analyzer/pr94099.c +++ /dev/null @@ -1,28 +0,0 @@ -/* { dg-additional-options "-O1" } */ - -struct cg { - int hk; - int *bg; -}; - -union vb { - struct cg gk; -}; - -void -l3 (union vb *); - -void -pl (void) -{ - union vb th = { 0, }; - int sc; - - for (sc = 0; sc < 1; ++sc) - { - th.gk.hk = 0; - th.gk.bg[sc] = 0; /* { dg-warning "dereference of NULL '0'" } */ - // TODO: above message could be improved - l3 (&th); - } -} diff --git a/gcc/testsuite/gcc.dg/analyzer/pr94105.c b/gcc/testsuite/gcc.dg/analyzer/pr94105.c deleted file mode 100644 index 8220723..0000000 --- a/gcc/testsuite/gcc.dg/analyzer/pr94105.c +++ /dev/null @@ -1,3 +0,0 @@ -/* { dg-do compile } */ - -#include "../../c-c++-common/torture/pr58794-1.c" diff --git a/gcc/testsuite/gcc.dg/analyzer/pr94362-2.c b/gcc/testsuite/gcc.dg/analyzer/pr94362-2.c deleted file mode 100644 index 301d2ed..0000000 --- a/gcc/testsuite/gcc.dg/analyzer/pr94362-2.c +++ /dev/null @@ -1,42 +0,0 @@ -/* Verify that we consider various paths to be impossible, - using functions to thwart early optimizations. */ - -#include "analyzer-decls.h" - -void test_1 (int idx) -{ - if (idx > 0) - if (idx - 1 < 0) - __analyzer_dump_path (); /* { dg-bogus "" } */ -} - -static int called_by_test_1a (int idx) -{ - return idx - 1; -} - -void test_1a (int idx) -{ - if (idx > 0) - if (called_by_test_1a (idx) < 0) - __analyzer_dump_path (); /* { dg-bogus "" } */ -} - -void test_2 (int idx) -{ - if (idx + 1 > 0) - if (idx < 0) - __analyzer_dump_path (); /* { dg-bogus "" } */ -} - -static int called_by_test_2a (int idx) -{ - return idx + 1; -} - -void test_2a (int idx) -{ - if (called_by_test_2a (idx) > 0) - if (idx < 0) - __analyzer_dump_path (); /* { dg-bogus "" } */ -} diff --git a/gcc/testsuite/gcc.dg/analyzer/pr94399.c b/gcc/testsuite/gcc.dg/analyzer/pr94399.c deleted file mode 100644 index e897c04..0000000 --- a/gcc/testsuite/gcc.dg/analyzer/pr94399.c +++ /dev/null @@ -1,13 +0,0 @@ -#include - -#define _cleanup_(f) __attribute__((cleanup(f))) - -static inline void freep(void **p) { - free(*p); -} - -void test(void) { - _cleanup_(freep) void *ptr; - - ptr = malloc(3); -} /* { dg-bogus "leak" } */ diff --git a/gcc/testsuite/gcc.dg/analyzer/pr94447.c b/gcc/testsuite/gcc.dg/analyzer/pr94447.c deleted file mode 100644 index 7c61a20..0000000 --- a/gcc/testsuite/gcc.dg/analyzer/pr94447.c +++ /dev/null @@ -1,10 +0,0 @@ -struct foo -{ - int *v; -}; - -int test (void) -{ - struct foo f = {}; - return *f.v; /* { dg-warning "dereference of NULL" } */ -} diff --git a/gcc/testsuite/gcc.dg/analyzer/pr94639.c b/gcc/testsuite/gcc.dg/analyzer/pr94639.c deleted file mode 100644 index 2dbb57e..0000000 --- a/gcc/testsuite/gcc.dg/analyzer/pr94639.c +++ /dev/null @@ -1,14 +0,0 @@ -#include - -void validatedatetime(const char *str) -{ - const char *templates[] = {"dddd-dd-dd dd:dd", "dddd-dd-dd"}; - - size_t len = strlen(str); - - for (unsigned t = 0; t < 2; t++) { - if (len != strlen(templates[t])) { - continue; - } - } -} diff --git a/gcc/testsuite/gcc.dg/analyzer/pr94640.c b/gcc/testsuite/gcc.dg/analyzer/pr94640.c deleted file mode 100644 index 9722a17..0000000 --- a/gcc/testsuite/gcc.dg/analyzer/pr94640.c +++ /dev/null @@ -1,17 +0,0 @@ -#include - -int debug; - -int opencfgfile(const char *cfgfile, FILE **fd) -{ - if (cfgfile[0] != '\0') { - - if ((*fd = fopen(cfgfile, "r")) != NULL) { - if (debug) - printf("Config file: --config\n"); - } - - } - - return 2; -} diff --git a/gcc/testsuite/gcc.dg/analyzer/pr94732.c b/gcc/testsuite/gcc.dg/analyzer/pr94732.c deleted file mode 100644 index 1aa154f..0000000 --- a/gcc/testsuite/gcc.dg/analyzer/pr94732.c +++ /dev/null @@ -1,13 +0,0 @@ -typedef struct { int *a; } S; -int *f (void); -static void g (S *x) -{ - int *p = x->a; - p[0] = 0; -} -void h (void) -{ - S x[1]; - x->a = f (); - g (x); -} diff --git a/gcc/testsuite/gcc.dg/analyzer/pr94851-1.c b/gcc/testsuite/gcc.dg/analyzer/pr94851-1.c deleted file mode 100644 index 7407efa..0000000 --- a/gcc/testsuite/gcc.dg/analyzer/pr94851-1.c +++ /dev/null @@ -1,47 +0,0 @@ -/* { dg-skip-if "" { powerpc*-*-aix* } } */ -/* { dg-additional-options "-O2" } */ - -#include -#include - -typedef struct AMARK { - struct AMARK *m_next; - char m_name; -} AMARK; - -struct buf { - AMARK *b_amark; -}; - -struct buf *curbp; - -int pamark(void) { - int c; - AMARK *p = curbp->b_amark; - AMARK *last = curbp->b_amark; - - c = getchar(); - - while (p != (AMARK *)NULL && p->m_name != (char)c) { - last = p; - p = p->m_next; - } - - if (p != (AMARK *)NULL) { - printf("over writing mark %c\n", c); - } else { - if ((p = (AMARK *)malloc(sizeof(AMARK))) == (AMARK *)NULL) - return 0; - - p->m_next = (AMARK *)NULL; - - if (curbp->b_amark == (AMARK *)NULL) - curbp->b_amark = p; - else - last->m_next = p; - } - - p->m_name = (char)c; /* { dg-bogus "leak of 'p'" "bogus leak" } */ - - return 1; -} diff --git a/gcc/testsuite/gcc.dg/analyzer/pr94851-2.c b/gcc/testsuite/gcc.dg/analyzer/pr94851-2.c deleted file mode 100644 index 62176bd..0000000 --- a/gcc/testsuite/gcc.dg/analyzer/pr94851-2.c +++ /dev/null @@ -1,54 +0,0 @@ -/* As pr94851-1.c, but verify that we don't get confused by a call to - an unknown function (PR analyzer/98575). */ - -/* { dg-additional-options "-O2" } */ - -#include -#include - -typedef struct AMARK { - struct AMARK *m_next; - char m_name; -} AMARK; - -struct buf { - AMARK *b_amark; -}; - -struct buf *curbp; - -extern void unknown_fn (void); - -int pamark(void) { - int c; - - AMARK *p = curbp->b_amark; - AMARK *last = curbp->b_amark; - - unknown_fn (); - - c = getchar (); - - while (p != (AMARK *)NULL && p->m_name != (char)c) { - last = p; - p = p->m_next; - } - - if (p != (AMARK *)NULL) { - printf("over writing mark %c\n", c); - } else { - if ((p = (AMARK *)malloc(sizeof(AMARK))) == (AMARK *)NULL) - return 0; - - p->m_next = (AMARK *)NULL; - - if (curbp->b_amark == (AMARK *)NULL) - curbp->b_amark = p; - else - last->m_next = p; /* { dg-warning "dereference of NULL 'last'" "deref" } */ - } - - p->m_name = (char)c; /* { dg-bogus "leak of 'p'" "bogus leak" } */ - - return 1; -} diff --git a/gcc/testsuite/gcc.dg/analyzer/pr94851-3.c b/gcc/testsuite/gcc.dg/analyzer/pr94851-3.c deleted file mode 100644 index 0f95397..0000000 --- a/gcc/testsuite/gcc.dg/analyzer/pr94851-3.c +++ /dev/null @@ -1,20 +0,0 @@ -/* { dg-additional-options "-O1" } */ - -struct List { - struct List *next; -}; - -void foo(struct List *p, struct List *q) -{ - while (p && p != q){ - p = p->next; - } -} - -int main() -{ - struct List x = {0}; - foo(0, &x); - return 0; -} - diff --git a/gcc/testsuite/gcc.dg/analyzer/pr94851-4.c b/gcc/testsuite/gcc.dg/analyzer/pr94851-4.c deleted file mode 100644 index a5130c5..0000000 --- a/gcc/testsuite/gcc.dg/analyzer/pr94851-4.c +++ /dev/null @@ -1,24 +0,0 @@ -/* { dg-additional-options "-O2 -Wno-analyzer-symbol-too-complex" } */ - -#include - -struct List { - struct List *next; -}; - -void foo(struct List *p, struct List *q) -{ - while (p && p != q){ - struct List *next = p->next; - free(p); - p = next; - } -} - -int main() -{ - struct List x = {0}; - foo(NULL, &x); - return 0; -} - diff --git a/gcc/testsuite/gcc.dg/analyzer/pr95026.c b/gcc/testsuite/gcc.dg/analyzer/pr95026.c deleted file mode 100644 index 1845f15..0000000 --- a/gcc/testsuite/gcc.dg/analyzer/pr95026.c +++ /dev/null @@ -1,17 +0,0 @@ -struct _IO_FILE; -typedef struct _IO_FILE FILE; -typedef struct _message -{ - FILE *fp; -} MESSAGE; -extern FILE *fopen (const char *__restrict __filename, - const char *__restrict __modes); -FILE *f (void); -int imap_fetch_message (int i, MESSAGE *msg, char *p) -{ - if ((msg->fp = i ? 0 : f ())) - return 0; - if (p) - msg->fp = fopen (p, "r"); - return -1; -} diff --git a/gcc/testsuite/gcc.dg/analyzer/pr96598.c b/gcc/testsuite/gcc.dg/analyzer/pr96598.c deleted file mode 100644 index b4354cd..0000000 --- a/gcc/testsuite/gcc.dg/analyzer/pr96598.c +++ /dev/null @@ -1,26 +0,0 @@ -/* { dg-additional-options "-O0 -fsanitize=undefined" } */ - -extern char *foo (char *dest, const char *src) - __attribute__ ((__nonnull__ (1, 2))); - -unsigned bar(const char *str) - __attribute__ ((__nonnull__ ())); - -unsigned test(const char *str, unsigned **pv) - __attribute__ ((__nonnull__ ())); - -unsigned test(const char* str, unsigned **pv) -{ - char buffer[130]; - - *pv = 0; - - foo(buffer, str); - if (bar(buffer)) - { - const char *ptr = 0; - foo(buffer, str); - return bar(buffer); - } - return 0; -} diff --git a/gcc/testsuite/gcc.dg/analyzer/pr96611.c b/gcc/testsuite/gcc.dg/analyzer/pr96611.c deleted file mode 100644 index 4f75023..0000000 --- a/gcc/testsuite/gcc.dg/analyzer/pr96611.c +++ /dev/null @@ -1,14 +0,0 @@ -struct s { int a; } *ptr; -void unknown_int_ptr (int *); -void unknown_void (void); - -void test_1 () -{ - unknown_int_ptr (&ptr->a); -} - -void test_2 () -{ - unknown_void (); - unknown_int_ptr (&ptr->a); -} diff --git a/gcc/testsuite/gcc.dg/analyzer/pr96644.c b/gcc/testsuite/gcc.dg/analyzer/pr96644.c deleted file mode 100644 index 3953c8d..0000000 --- a/gcc/testsuite/gcc.dg/analyzer/pr96644.c +++ /dev/null @@ -1,24 +0,0 @@ -/* { dg-additional-options "-O1" } */ - -int oh[1]; -int *x3; - -int * -cm (char *m0) -{ - return oh; -} - -void -ek (void) -{ - for (;;) - { - char *b2 = 0; - - if (*b2 != 0) /* { dg-warning "dereference of NULL" } */ - ++b2; - - x3 = cm (b2); - } -} diff --git a/gcc/testsuite/gcc.dg/analyzer/pr96646.c b/gcc/testsuite/gcc.dg/analyzer/pr96646.c deleted file mode 100644 index 2ac5a03..0000000 --- a/gcc/testsuite/gcc.dg/analyzer/pr96646.c +++ /dev/null @@ -1,24 +0,0 @@ -/* { dg-additional-options "-O1" } */ - -struct zx { - struct zx *b4, *g0; -}; - -struct oo { - void *ph; - struct zx el; -}; - -inline void -k7 (struct zx *xj) -{ - xj->b4->g0 = 0; /* { dg-warning "dereference of NULL" } */ - xj->b4 = 0; -} - -void -n8 (struct oo *yx) -{ - k7 (&yx->el); - n8 (yx); -} diff --git a/gcc/testsuite/gcc.dg/analyzer/pr96648.c b/gcc/testsuite/gcc.dg/analyzer/pr96648.c deleted file mode 100644 index a6b0c72..0000000 --- a/gcc/testsuite/gcc.dg/analyzer/pr96648.c +++ /dev/null @@ -1,36 +0,0 @@ -/* { dg-additional-options "-O1" } */ - -struct vd { - struct vd *rs; -}; - -struct fh { - struct vd cl; -}; - -struct i3 { - struct fh *h4; -}; - -struct fh * -gm (void); - -void -j7 (struct vd *); - -inline void -mb (struct vd *e7) -{ - j7 (e7->rs); -} - -void -po (struct i3 *d2) -{ - struct i3 *s2; - - d2->h4 = gm (); - mb (&d2->h4->cl); - s2 = ({ d2 - 1; }); - po (s2); -} diff --git a/gcc/testsuite/gcc.dg/analyzer/pr96650-1-notrans.c b/gcc/testsuite/gcc.dg/analyzer/pr96650-1-notrans.c deleted file mode 100644 index 94c7555..0000000 --- a/gcc/testsuite/gcc.dg/analyzer/pr96650-1-notrans.c +++ /dev/null @@ -1,30 +0,0 @@ -/* { dg-additional-options "-O2 -fno-analyzer-transitivity" } */ - -int *wf; - -void -yd (void); - -int -cy (void); - -int * -ee (int hp) -{ - if (hp != 0) - yd (); - - return 0; -} - -void -z0 (int co) -{ - int l4 = sizeof (int); - - aq: - wf = ee (l4); - if (l4 < co) - l4 = cy () + sizeof (int); - goto aq; -} diff --git a/gcc/testsuite/gcc.dg/analyzer/pr96650-1-trans.c b/gcc/testsuite/gcc.dg/analyzer/pr96650-1-trans.c deleted file mode 100644 index b20630b..0000000 --- a/gcc/testsuite/gcc.dg/analyzer/pr96650-1-trans.c +++ /dev/null @@ -1,30 +0,0 @@ -/* { dg-additional-options "-O2 -fanalyzer-transitivity" } */ - -int *wf; - -void -yd (void); - -int -cy (void); - -int * -ee (int hp) -{ - if (hp != 0) - yd (); - - return 0; -} - -void -z0 (int co) -{ - int l4 = sizeof (int); - - aq: - wf = ee (l4); - if (l4 < co) - l4 = cy () + sizeof (int); - goto aq; -} diff --git a/gcc/testsuite/gcc.dg/analyzer/pr96650-2-notrans.c b/gcc/testsuite/gcc.dg/analyzer/pr96650-2-notrans.c deleted file mode 100644 index fc7c045..0000000 --- a/gcc/testsuite/gcc.dg/analyzer/pr96650-2-notrans.c +++ /dev/null @@ -1,30 +0,0 @@ -/* { dg-additional-options "-fno-analyzer-transitivity" } */ - -#include "analyzer-decls.h" - -int foo (void); - -/* Infeasible path, requiring transitivity to find. */ - -void test_1 (int co, int y) -{ - if (4 < co) - if (co < y) - if (y == 0) - __analyzer_dump_path (); /* { dg-message "path" } */ -} - -/* Infeasible path, requiring transitivity to find, with a merger. */ - -void test_2 (int co, int y, int z) -{ - if (4 < co) - if (co < y) - if (y == 0) - { - while (foo ()) - { - } - __analyzer_dump_path (); /* { dg-message "path" } */ - } -} diff --git a/gcc/testsuite/gcc.dg/analyzer/pr96650-2-trans.c b/gcc/testsuite/gcc.dg/analyzer/pr96650-2-trans.c deleted file mode 100644 index 8d0c295..0000000 --- a/gcc/testsuite/gcc.dg/analyzer/pr96650-2-trans.c +++ /dev/null @@ -1,30 +0,0 @@ -/* { dg-additional-options "-fanalyzer-transitivity" } */ - -#include "analyzer-decls.h" - -int foo (void); - -/* Infeasible path, requiring transitivity to find. */ - -void test_1 (int co, int y) -{ - if (4 < co) - if (co < y) - if (y == 0) - __analyzer_dump_path (); /* { dg-bogus "path" } */ -} - -/* Infeasible path, requiring transitivity to find, with a merger. */ - -void test_2 (int co, int y, int z) -{ - if (4 < co) - if (co < y) - if (y == 0) - { - while (foo ()) - { - } - __analyzer_dump_path (); /* { dg-bogus "path" } */ - } -} diff --git a/gcc/testsuite/gcc.dg/analyzer/pr96651-1.c b/gcc/testsuite/gcc.dg/analyzer/pr96651-1.c deleted file mode 100644 index 2f3a9b4..0000000 --- a/gcc/testsuite/gcc.dg/analyzer/pr96651-1.c +++ /dev/null @@ -1,22 +0,0 @@ -#include -#include -#include - -static int a; - -int main(void) -{ - char *src = NULL; - char buf[128]; - - /* "a" can't have been touched yet, and thus - is implicitly zero. */ - switch (a) { - case 1: - strcpy(buf, src); /* { dg-bogus "NULL" } */ - break; - case 0: - strcpy(buf, "hello"); - } - printf("%s\n", buf); -} diff --git a/gcc/testsuite/gcc.dg/analyzer/pr96699.c b/gcc/testsuite/gcc.dg/analyzer/pr96699.c deleted file mode 100644 index c68e45a..0000000 --- a/gcc/testsuite/gcc.dg/analyzer/pr96699.c +++ /dev/null @@ -1,13 +0,0 @@ -struct qi { - union { - int hj; - float sl; - }; -}; - -void -i2 (struct qi *la) -{ - if (la->hj == 0) - la->sl = 0.0f; -} diff --git a/gcc/testsuite/gcc.dg/analyzer/pr96705.c b/gcc/testsuite/gcc.dg/analyzer/pr96705.c deleted file mode 100644 index d7856d2..0000000 --- a/gcc/testsuite/gcc.dg/analyzer/pr96705.c +++ /dev/null @@ -1,9 +0,0 @@ -int __attribute__ ((vector_size (8))) v; -int i; - -void -test (void) -{ - v &= 0; - v *= i; -} diff --git a/gcc/testsuite/gcc.dg/analyzer/pr96713.c b/gcc/testsuite/gcc.dg/analyzer/pr96713.c deleted file mode 100644 index 12170bd..0000000 --- a/gcc/testsuite/gcc.dg/analyzer/pr96713.c +++ /dev/null @@ -1,9 +0,0 @@ -/* { dg-options "-Wno-psabi" } */ -typedef int __attribute__ ((vector_size (8))) V; - -void -foo (V d, V e) -{ - d <= e; - foo ((V){}, (V){}); -} diff --git a/gcc/testsuite/gcc.dg/analyzer/pr96764.c b/gcc/testsuite/gcc.dg/analyzer/pr96764.c deleted file mode 100644 index 6024eba..0000000 --- a/gcc/testsuite/gcc.dg/analyzer/pr96764.c +++ /dev/null @@ -1,8 +0,0 @@ -/* { dg-additional-options "-Wno-analyzer-out-of-bounds" } */ - -void -ar (int *hd) -{ - int **zv = &hd; - *(double *) zv = 0.0; -} diff --git a/gcc/testsuite/gcc.dg/analyzer/pr96777.c b/gcc/testsuite/gcc.dg/analyzer/pr96777.c deleted file mode 100644 index 2bb2a4e..0000000 --- a/gcc/testsuite/gcc.dg/analyzer/pr96777.c +++ /dev/null @@ -1,12 +0,0 @@ -struct ge { - char au; - char pz[]; -}; - -struct ge tr = { 'X', 'X', }; - -int -main (void) -{ - return tr.pz[0] == 'X'; -} diff --git a/gcc/testsuite/gcc.dg/analyzer/pr96860-2.c b/gcc/testsuite/gcc.dg/analyzer/pr96860-2.c deleted file mode 100644 index d12b9a1..0000000 --- a/gcc/testsuite/gcc.dg/analyzer/pr96860-2.c +++ /dev/null @@ -1,8 +0,0 @@ -/* { dg-additional-options "--param analyzer-max-svalue-depth=0 -Wno-analyzer-symbol-too-complex" } */ - -void x7 (void) -{ - long z5[] = { - 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 1, 0, 1, 0, 1, 0, 1, - }; -} diff --git a/gcc/testsuite/gcc.dg/analyzer/pr97029.c b/gcc/testsuite/gcc.dg/analyzer/pr97029.c deleted file mode 100644 index 2ab2d41..0000000 --- a/gcc/testsuite/gcc.dg/analyzer/pr97029.c +++ /dev/null @@ -1,9 +0,0 @@ -struct vj { - char buf[1]; -}; - -void -setjmp (struct vj pl) -{ - setjmp (pl); /* { dg-warning "infinite recursion" } */ -} diff --git a/gcc/testsuite/gcc.dg/analyzer/pr97072.c b/gcc/testsuite/gcc.dg/analyzer/pr97072.c deleted file mode 100644 index 4024124..0000000 --- a/gcc/testsuite/gcc.dg/analyzer/pr97072.c +++ /dev/null @@ -1,9 +0,0 @@ -void unknown_fn_1 (void *); - -void test_1 (int co, int y) -{ - void *p = __builtin_malloc (1024); - void **q; - unknown_fn_1 (&q); - *q = p; -} diff --git a/gcc/testsuite/gcc.dg/analyzer/pr97130.c b/gcc/testsuite/gcc.dg/analyzer/pr97130.c deleted file mode 100644 index f437b76..0000000 --- a/gcc/testsuite/gcc.dg/analyzer/pr97130.c +++ /dev/null @@ -1,10 +0,0 @@ -/* { dg-additional-options "-Wno-builtin-declaration-mismatch" } */ - -void * -memset (int, int, __SIZE_TYPE__); - -void -mp (int xl) -{ - memset (xl, 0, sizeof xl); -} diff --git a/gcc/testsuite/gcc.dg/analyzer/pr97233.c b/gcc/testsuite/gcc.dg/analyzer/pr97233.c deleted file mode 100644 index 86930aa..0000000 --- a/gcc/testsuite/gcc.dg/analyzer/pr97233.c +++ /dev/null @@ -1,8 +0,0 @@ -void -longjmp (__SIZE_TYPE__, int); - -void -e7 (__SIZE_TYPE__ gr) -{ - longjmp (gr, 1); -} diff --git a/gcc/testsuite/gcc.dg/analyzer/pr97514.c b/gcc/testsuite/gcc.dg/analyzer/pr97514.c deleted file mode 100644 index 27245f4..0000000 --- a/gcc/testsuite/gcc.dg/analyzer/pr97514.c +++ /dev/null @@ -1,18 +0,0 @@ -/* { dg-additional-options "--param analyzer-max-enodes-per-program-point=0 -Wno-analyzer-too-complex" } */ - -typedef void (*sighandler_t) (int); - -void -signal (int, sighandler_t); - -static void -kw (int signum) -{ - (void) signum; -} - -void -gk (int ot) -{ - signal (ot, kw); -} diff --git a/gcc/testsuite/gcc.dg/analyzer/pr97608.c b/gcc/testsuite/gcc.dg/analyzer/pr97608.c deleted file mode 100644 index a2bc130..0000000 --- a/gcc/testsuite/gcc.dg/analyzer/pr97608.c +++ /dev/null @@ -1,17 +0,0 @@ -#include - -void *f (void) -{ - void *p = malloc (8); - if (p == NULL) - abort (); - return (void *) ((char *) p + 0); -} - -void *g (void) -{ - void *p = malloc (8); - if (p == NULL) - abort (); - return (void *) ((char *) p + 1); -} diff --git a/gcc/testsuite/gcc.dg/analyzer/pr97668.c b/gcc/testsuite/gcc.dg/analyzer/pr97668.c deleted file mode 100644 index 6ec8164..0000000 --- a/gcc/testsuite/gcc.dg/analyzer/pr97668.c +++ /dev/null @@ -1,27 +0,0 @@ -/* { dg-additional-options "-O1" } */ - -void -wb (_Complex double jh) -{ - _Complex double af = 0.0; - - do - { - af += jh; - } - while (af != 0.0); -} - -_Complex double -o6 (void) -{ - _Complex double ba = 0.0; - - for (;;) - { - wb (ba); - ba = 1.0; - } - - return ba; -} diff --git a/gcc/testsuite/gcc.dg/analyzer/pr98073.c b/gcc/testsuite/gcc.dg/analyzer/pr98073.c deleted file mode 100644 index abbda09..0000000 --- a/gcc/testsuite/gcc.dg/analyzer/pr98073.c +++ /dev/null @@ -1,13 +0,0 @@ -struct ist { - char ptr; - long len; -} __trans_tmp_1, http_update_host_authority; -int http_update_host_sl_0_0_0; -void http_update_host(const struct ist uri) { - uri.len || uri.ptr; - if (http_update_host_sl_0_0_0) { - http_update_host_authority = __trans_tmp_1; - !http_update_host_authority.len; - } else - http_update_host_authority = uri; -} diff --git a/gcc/testsuite/gcc.dg/analyzer/pr98575-1.c b/gcc/testsuite/gcc.dg/analyzer/pr98575-1.c deleted file mode 100644 index 6472e76..0000000 --- a/gcc/testsuite/gcc.dg/analyzer/pr98575-1.c +++ /dev/null @@ -1,46 +0,0 @@ -/* A malloced pointer that's written to a global pointer shouldn't be - reported as leaking, even if an unknown function has been called - (PR analyzer/98575). */ - -void **g; - -extern void unknown_fn (void); - -/* Without a call to unknown_fn. */ - -int test_1 (void) -{ - void *p; - p = __builtin_malloc(1024); - *g = p; - return 0; -} - -/* With a call to unknown_fn in various places. */ - -int test_2 (void) -{ - void *p; - unknown_fn (); - p = __builtin_malloc(1024); - *g = p; - return 0; -} - -int test_3 (void) -{ - void *p; - p = __builtin_malloc(1024); - unknown_fn (); - *g = p; - return 0; -} - -int test_4 (void) -{ - void *p; - p = __builtin_malloc(1024); - *g = p; - unknown_fn (); - return 0; -} diff --git a/gcc/testsuite/gcc.dg/analyzer/pr98580-a.c b/gcc/testsuite/gcc.dg/analyzer/pr98580-a.c deleted file mode 100644 index d2b10d6..0000000 --- a/gcc/testsuite/gcc.dg/analyzer/pr98580-a.c +++ /dev/null @@ -1,9 +0,0 @@ -/* { dg-do link } */ -/* { dg-require-effective-target lto } */ -/* { dg-additional-options "-flto" } */ -/* { dg-additional-sources pr98580-b.c } */ - -int a; -int *p = &a; -int foo(); -int main() { return foo(); } diff --git a/gcc/testsuite/gcc.dg/analyzer/pr98580-b.c b/gcc/testsuite/gcc.dg/analyzer/pr98580-b.c deleted file mode 100644 index 629ebce..0000000 --- a/gcc/testsuite/gcc.dg/analyzer/pr98580-b.c +++ /dev/null @@ -1,2 +0,0 @@ -extern int *p; -int foo() { return *p; } diff --git a/gcc/testsuite/gcc.dg/analyzer/pr98918.c b/gcc/testsuite/gcc.dg/analyzer/pr98918.c deleted file mode 100644 index c3bbce3..0000000 --- a/gcc/testsuite/gcc.dg/analyzer/pr98918.c +++ /dev/null @@ -1,24 +0,0 @@ -/* { dg-additional-options "-Wno-analyzer-symbol-too-complex" } */ - -#include - -struct marker { - struct marker *next; - void *ref; -}; -struct data { - struct marker *marker; -}; - -void data_free(struct data d) -{ - struct marker *nm, *m; - - m = d.marker; - while (m) { - nm = m->next; - free(m->ref); - free(m); - m = nm; - } -} diff --git a/gcc/testsuite/gcc.dg/analyzer/pr99044-2.c b/gcc/testsuite/gcc.dg/analyzer/pr99044-2.c deleted file mode 100644 index f7badb9..0000000 --- a/gcc/testsuite/gcc.dg/analyzer/pr99044-2.c +++ /dev/null @@ -1,44 +0,0 @@ -/* { dg-additional-options "-Wno-analyzer-symbol-too-complex" } */ - -struct node -{ - struct node *next; -}; - -void test_1 (struct node *n) -{ - while (n) - { - struct node *next = n->next; - __builtin_free (n); - n = next; - } -} - -extern void *get_ptr (void); - -void test_2 (void) -{ - void *p; - while (p = get_ptr ()) - __builtin_free (p); /* { dg-bogus "double-'free' of 'p'" } */ -} - -extern void **get_ptr_ptr (void); - -void test_3 (void) -{ - void **p; - while (p = get_ptr_ptr ()) - __builtin_free (*p); /* { dg-bogus "double-'free'" } */ -} - -void test_4 (void) -{ - void *p = (void *)0; - while (1) - { - __builtin_free (p); /* { dg-bogus "double-'free' of 'p'" } */ - p = get_ptr (); - } -} diff --git a/gcc/testsuite/gcc.dg/analyzer/pr99716-2.c b/gcc/testsuite/gcc.dg/analyzer/pr99716-2.c deleted file mode 100644 index adc9819..0000000 --- a/gcc/testsuite/gcc.dg/analyzer/pr99716-2.c +++ /dev/null @@ -1,34 +0,0 @@ -/* Reduced from - https://github.com/libguestfs/libguestfs/blob/e0a11061035d47b118c95706240bcc17fd576edc/tests/mount-local/test-parallel-mount-local.c#L299-L335 - which is GPLv2 or later. */ - -#include -#include - -extern int foo (void); - -void -test_mountpoint (const char *mp) -{ - const int nr_passes = 5 + (rand () & 31); - int pass; - int ret = 1; - FILE *fp; - - for (pass = 0; pass < nr_passes; ++pass) { - if (foo ()) { - goto error; - } - fp = fopen ("file", "w"); - if (fp == NULL) { - goto error; - } - fprintf (fp, "hello world\n"); - fclose (fp); /* { dg-bogus "double 'fclose'" } */ - } - - ret = 0; - - error: - exit (ret); -} diff --git a/gcc/testsuite/gcc.dg/analyzer/pr99716-3.c b/gcc/testsuite/gcc.dg/analyzer/pr99716-3.c deleted file mode 100644 index 77d450e..0000000 --- a/gcc/testsuite/gcc.dg/analyzer/pr99716-3.c +++ /dev/null @@ -1,16 +0,0 @@ -#include - -extern void foo (void *); - -void -test_1 (int nr_passes) -{ - int pass; - void *p; - - for (pass = 0; pass < nr_passes; ++pass) { - p = malloc (1024); - foo (p); - free (p); - } -} diff --git a/gcc/testsuite/gcc.dg/analyzer/pr99906.c b/gcc/testsuite/gcc.dg/analyzer/pr99906.c deleted file mode 100644 index bb399a3..0000000 --- a/gcc/testsuite/gcc.dg/analyzer/pr99906.c +++ /dev/null @@ -1,3 +0,0 @@ -void bar(void *) __attribute__((__nonnull__)); -void *baz(void); -void foo(void) { bar(baz()); } diff --git a/gcc/testsuite/gcc.dg/analyzer/pragma-1.c b/gcc/testsuite/gcc.dg/analyzer/pragma-1.c deleted file mode 100644 index 2e53348..0000000 --- a/gcc/testsuite/gcc.dg/analyzer/pragma-1.c +++ /dev/null @@ -1,26 +0,0 @@ -/* Verify that we can disable analyzer warnings via pragmas. */ - -#include - -void test_1 (void *ptr) -{ - free (ptr); - free (ptr); /* { dg-warning "double-'free'" } */ -} - -void test_2 (void *ptr) -{ - _Pragma("GCC diagnostic push") - _Pragma("GCC diagnostic ignored \"-Wanalyzer-double-free\"") - - free (ptr); - free (ptr); /* { dg-bogus "double-'free'" } */ - - _Pragma("GCC diagnostic pop") -} - -void test_3 (void *ptr) -{ - free (ptr); - free (ptr); /* { dg-warning "double-'free'" } */ -} diff --git a/gcc/testsuite/gcc.dg/analyzer/pragma-2.c b/gcc/testsuite/gcc.dg/analyzer/pragma-2.c deleted file mode 100644 index 2453223..0000000 --- a/gcc/testsuite/gcc.dg/analyzer/pragma-2.c +++ /dev/null @@ -1,58 +0,0 @@ -/* { dg-skip-if "" { powerpc*-*-aix* } } */ -/* Verify that we can disable -Wanalyzer-too-complex via pragmas. */ -/* { dg-additional-options "-Wanalyzer-too-complex -Werror=analyzer-too-complex -fno-analyzer-state-merge -g" } */ - -#include - -extern int get (void); - -/* In theory each of p0...p4 can be in various malloc states, - independently, so the total combined number of states - at any program point within the loop is NUM_VARS * NUM_STATES. */ - -#pragma GCC diagnostic push -#pragma GCC diagnostic ignored "-Wanalyzer-too-complex" - -void test (void) -{ - void *p0 = NULL, *p1 = NULL, *p2 = NULL, *p3 = NULL, *p4 = NULL; - void **pp = NULL; - while (get ()) - { - switch (get ()) - { - default: - case 0: - pp = &p0; - break; - case 1: - pp = &p1; - break; - case 2: - pp = &p2; - break; - case 3: - pp = &p3; - break; - case 4: - pp = &p4; - break; - } - - switch (get ()) - { - default: - case 0: - *pp = malloc (16); /* { dg-warning "leak" } */ - break; - case 1: - free (*pp); - break; - case 2: - /* no-op. */ - break; - } - } -} - -#pragma GCC diagnostic pop diff --git a/gcc/testsuite/gcc.dg/analyzer/refcounting-1.c b/gcc/testsuite/gcc.dg/analyzer/refcounting-1.c deleted file mode 100644 index 4eb3a3e..0000000 --- a/gcc/testsuite/gcc.dg/analyzer/refcounting-1.c +++ /dev/null @@ -1,31 +0,0 @@ -#include "analyzer-decls.h" - -typedef struct obj { - int ob_refcnt; -} PyObject; - -extern void Py_Dealloc (PyObject *op); - -#define Py_INCREF(op) \ - do { \ - ((PyObject*)(op))->ob_refcnt++; \ - } while (0) - -#define Py_DECREF(op) \ - do { \ - if (--((PyObject*)(op))->ob_refcnt == 0) \ - { \ - /*Py_Dealloc((PyObject *)(op));*/ \ - } \ - } while (0) - -void test_1 (PyObject *obj) -{ - int orig_refcnt = obj->ob_refcnt; - Py_INCREF (obj); - Py_INCREF (obj); - Py_DECREF (obj); - Py_INCREF (obj); - __analyzer_eval (obj->ob_refcnt == orig_refcnt + 2); /* { dg-warning "TRUE" } */ -} -/* TODO: uncomment the Py_Dealloc, which leads to two paths. */ diff --git a/gcc/testsuite/gcc.dg/analyzer/rhbz1878600.c b/gcc/testsuite/gcc.dg/analyzer/rhbz1878600.c deleted file mode 100644 index 9f6ccb6..0000000 --- a/gcc/testsuite/gcc.dg/analyzer/rhbz1878600.c +++ /dev/null @@ -1,34 +0,0 @@ -#include - -#define INI_MAX_LINE 200 - -typedef char* (*ini_reader)(char* str, int num, void* stream); - -int ini_parse(const char* filename); - -static int ini_parse_stream(ini_reader reader, void* stream) -{ - char line[INI_MAX_LINE]; - int max_line = INI_MAX_LINE; - while (reader(line, max_line, stream) != NULL) - ; - return 0; -} - -static int ini_parse_file(FILE* file) -{ - return ini_parse_stream((ini_reader)fgets, file); -} - -int ini_parse(const char* filename) -{ - FILE* file; - int error; - - file = fopen(filename, "r"); - if (!file) - return -1; - error = ini_parse_file(file); - fclose(file); - return error; -} diff --git a/gcc/testsuite/gcc.dg/analyzer/sarif-pr107366.c b/gcc/testsuite/gcc.dg/analyzer/sarif-pr107366.c deleted file mode 100644 index ee156d4..0000000 --- a/gcc/testsuite/gcc.dg/analyzer/sarif-pr107366.c +++ /dev/null @@ -1,21 +0,0 @@ -/* { dg-do compile } */ -/* { dg-additional-options "-fdiagnostics-format=sarif-file" } */ - -typedef enum { - HWLOC_TOPOLOGY_DIFF_OBJ_ATTR_INFO -} hwloc_topology_diff_obj_attr_type_t; -enum { HWLOC_TOPOLOGY_DIFF_OBJ_ATTR } hwloc_apply_diff_one_diff_0_0; - -void -hwloc_apply_diff_one() { - switch (hwloc_apply_diff_one_diff_0_0) - case HWLOC_TOPOLOGY_DIFF_OBJ_ATTR: { - hwloc_topology_diff_obj_attr_type_t obj_attr_2_0_0; - switch (obj_attr_2_0_0) - case HWLOC_TOPOLOGY_DIFF_OBJ_ATTR_INFO: { - unsigned ii = 0; - } - } -} - -/* { dg-final { verify-sarif-file } } */ diff --git a/gcc/testsuite/gcc.dg/analyzer/setjmp-pr109094.c b/gcc/testsuite/gcc.dg/analyzer/setjmp-pr109094.c deleted file mode 100644 index 10591ce..0000000 --- a/gcc/testsuite/gcc.dg/analyzer/setjmp-pr109094.c +++ /dev/null @@ -1,38 +0,0 @@ -/* Reduced from an ICE seen in qemu's target/i386/tcg/translate.c */ - -typedef long int __jmp_buf[8]; -struct __jmp_buf_tag { - __jmp_buf __jmpbuf; -}; -typedef struct __jmp_buf_tag sigjmp_buf[1]; - -extern int __sigsetjmp(sigjmp_buf env, int savesigs); -extern void siglongjmp(sigjmp_buf env, int val); - -typedef struct DisasContextBase { - int num_insns; -} DisasContextBase; - -typedef struct DisasContext { - DisasContextBase base; - sigjmp_buf jmpbuf; -} DisasContext; - -extern int translator_ldub(DisasContextBase *base, int); - -int advance_pc(DisasContext *s, int num_bytes) { - if (s->base.num_insns > 1) { - siglongjmp(s->jmpbuf, 2); - } - return 0; -} - -static inline int x86_ldub_code(DisasContext *s) { - return translator_ldub(&s->base, advance_pc(s, 1)); -} - -static void disas_insn(DisasContext *s) { - int b; - __sigsetjmp(s->jmpbuf, 0); - b = x86_ldub_code(s); -} diff --git a/gcc/testsuite/gcc.dg/analyzer/sock-2.c b/gcc/testsuite/gcc.dg/analyzer/sock-2.c deleted file mode 100644 index 237e0cb..0000000 --- a/gcc/testsuite/gcc.dg/analyzer/sock-2.c +++ /dev/null @@ -1,20 +0,0 @@ -__extension__ typedef __signed__ long long __s64; -typedef __s64 time64_t; -struct timespec64 { - time64_t tv_sec; - long tv_nsec; -}; - -extern struct timespec64 ns_to_timespec64(void); - -int sock_gettstamp() -{ - struct timespec64 ts; - - /* [...snip...] */ - ts = ns_to_timespec64(); - if (ts.tv_sec == -1) - return -2; - /* [...snip...] */ - return 0; -} diff --git a/gcc/testsuite/gcc.dg/analyzer/stale-frame-1.c b/gcc/testsuite/gcc.dg/analyzer/stale-frame-1.c deleted file mode 100644 index c3b7186..0000000 --- a/gcc/testsuite/gcc.dg/analyzer/stale-frame-1.c +++ /dev/null @@ -1,44 +0,0 @@ - -int *global_ptr; - -static void __attribute__((noinline)) -called_by_test_1 (void) -{ - int i = 42; - global_ptr = &i; -} - -int test_1 (void) -{ - called_by_test_1 (); - return *global_ptr; /* { dg-warning "dereferencing pointer 'global_ptr' to within stale stack frame" } */ -} - -static void __attribute__((noinline)) -called_by_test_2 (int **out) -{ - int i = 42; - *out = &i; -} - -int test_2 (void) -{ - int *ptr; - called_by_test_2 (&ptr); - return *ptr; /* { dg-warning "dereferencing pointer 'ptr' to within stale stack frame" } */ -} - -static int __attribute__((noinline)) -called_by_test_3 (int **out) -{ - int i = 42; - *out = &i; - return i; -} - -int test_3 (void) -{ - int *lhs_ptr; - *lhs_ptr = called_by_test_3 (&lhs_ptr); /* { dg-warning "use of uninitialized value 'lhs_ptr'" } */ - return *lhs_ptr; -} diff --git a/gcc/testsuite/gcc.dg/analyzer/stdarg-sentinel-1.c b/gcc/testsuite/gcc.dg/analyzer/stdarg-sentinel-1.c deleted file mode 100644 index f8c1f0e..0000000 --- a/gcc/testsuite/gcc.dg/analyzer/stdarg-sentinel-1.c +++ /dev/null @@ -1,25 +0,0 @@ -/* { dg-additional-options "-Wno-analyzer-too-complex" } */ - -#define NULL ((void *)0) - -void test_sentinel (int arg, ...) -{ - const char *s; - __builtin_va_list ap; - __builtin_va_start (ap, arg); - while (s = __builtin_va_arg (ap, char *)) /* { dg-warning "'ap' has no more arguments \\(2 consumed\\)" } */ - { - (void)s; - } - __builtin_va_end (ap); -} - -void test_caller (void) -{ - test_sentinel (42, "foo", "bar", NULL); -} - -void missing_sentinel (void) -{ - test_sentinel (42, "foo", "bar"); -} diff --git a/gcc/testsuite/gcc.dg/analyzer/stdarg-types-2.c b/gcc/testsuite/gcc.dg/analyzer/stdarg-types-2.c deleted file mode 100644 index 39d5c6e..0000000 --- a/gcc/testsuite/gcc.dg/analyzer/stdarg-types-2.c +++ /dev/null @@ -1,55 +0,0 @@ -/* Should be OK to add a "const" qualifier to a ptr. */ - -static void __attribute__((noinline)) -__analyzer_consume_const_char_ptr (int placeholder, ...) -{ - const char *v; - __builtin_va_list ap; - __builtin_va_start (ap, placeholder); - v = __builtin_va_arg (ap, const char *); - __builtin_va_end (ap); -} - -void test_char_ptr_to_const_char_ptr (char *p) -{ - __analyzer_consume_const_char_ptr (42, p); /* { dg-bogus "" } */ -} - -/* What about casting away const-ness? - Currently we don't complain. */ - -static void __attribute__((noinline)) -__analyzer_consume_char_ptr (int placeholder, ...) -{ - char *v; - __builtin_va_list ap; - __builtin_va_start (ap, placeholder); - v = __builtin_va_arg (ap, char *); - __builtin_va_end (ap); -} - -void test_const_char_ptr_to_char_ptr (const char *p) -{ - __analyzer_consume_const_char_ptr (42, p); -} - -/* What about casting ptrs? - Currently we don't complain. */ - -struct foo; -struct bar; - -static void __attribute__((noinline)) -__analyzer_consume_bar_ptr (int placeholder, ...) -{ - struct bar *v; - __builtin_va_list ap; - __builtin_va_start (ap, placeholder); - v = __builtin_va_arg (ap, struct bar *); - __builtin_va_end (ap); -} - -void test_foo_ptr_to_bar_ptr (struct foo *p) -{ - __analyzer_consume_bar_ptr (42, p); -} diff --git a/gcc/testsuite/gcc.dg/analyzer/stdarg-types-3.c b/gcc/testsuite/gcc.dg/analyzer/stdarg-types-3.c deleted file mode 100644 index 7351261..0000000 --- a/gcc/testsuite/gcc.dg/analyzer/stdarg-types-3.c +++ /dev/null @@ -1,67 +0,0 @@ -static void __attribute__((noinline)) -__analyzer_consume_n_ints (int num, ...) -{ - __builtin_va_list ap; - __builtin_va_start (ap, num); - - int i, v; - for (i = 0; i < num; i++) - v = __builtin_va_arg (ap, int); - - __builtin_va_end (ap); -} - -void test_int (int x) -{ - __analyzer_consume_n_ints (1, x); -} - -void test_3_ints (int x, int y, int z) -{ - __analyzer_consume_n_ints (3, x, y, z); -} - -/* Verify that we don't complain about types that get promoted to int - at the variadic call. */ - -void test_short (short s) -{ - __analyzer_consume_n_ints (1, s); -} - -void test_ushort (unsigned short s) -{ - __analyzer_consume_n_ints (1, s); -} - -void test_schar (signed char ch) -{ - __analyzer_consume_n_ints (1, ch); -} - -void test_uchar (unsigned char ch) -{ - __analyzer_consume_n_ints (1, ch); -} - -struct ust -{ - int b0123 : 4; - int b4567 : 4; -}; - -void test_signed_bitfield (struct ust s) -{ - __analyzer_consume_n_ints (2, s.b0123, s.b4567); -} - -struct sst -{ - unsigned int b0123 : 4; - unsigned int b4567 : 4; -}; - -void test_unsigned_bitfield (struct sst s) -{ - __analyzer_consume_n_ints (2, s.b0123, s.b4567); -} diff --git a/gcc/testsuite/gcc.dg/analyzer/stdarg-types-4.c b/gcc/testsuite/gcc.dg/analyzer/stdarg-types-4.c deleted file mode 100644 index 920ecce..0000000 --- a/gcc/testsuite/gcc.dg/analyzer/stdarg-types-4.c +++ /dev/null @@ -1,22 +0,0 @@ -static void __attribute__((noinline)) -__analyzer_consume_n_uints (int num, ...) -{ - __builtin_va_list ap; - __builtin_va_start (ap, num); - - int i, v; - for (i = 0; i < num; i++) - v = __builtin_va_arg (ap, unsigned int); - - __builtin_va_end (ap); -} - -void test_uint (unsigned int x) -{ - __analyzer_consume_n_uints (1, x); -} - -void test_3_uints (unsigned int x, unsigned int y, unsigned int z) -{ - __analyzer_consume_n_uints (3, x, y, z); -} diff --git a/gcc/testsuite/gcc.dg/analyzer/strcpy-2.c b/gcc/testsuite/gcc.dg/analyzer/strcpy-2.c deleted file mode 100644 index e4e6c97..0000000 --- a/gcc/testsuite/gcc.dg/analyzer/strcpy-2.c +++ /dev/null @@ -1,27 +0,0 @@ -/* { dg-additional-options "-fdump-analyzer-untracked" } */ - -#include "analyzer-decls.h" - -struct S -{ - char buf[10]; -}; - -/* strcpy to a static struct that never gets used. */ - -void -test_1 (const char *src) -{ - static struct S s; /* { dg-warning "track 's': no" } */ - __builtin_strcpy (s.buf, src); -} - -/* strcpy to a static struct that later gets used. */ - -const char * -test_2 (const char *src) -{ - static struct S s; /* { dg-warning "track 's': yes" } */ - __builtin_strcpy (s.buf, src); - return s.buf; -} diff --git a/gcc/testsuite/gcc.dg/analyzer/strndup-1.c b/gcc/testsuite/gcc.dg/analyzer/strndup-1.c deleted file mode 100644 index 85ccae8..0000000 --- a/gcc/testsuite/gcc.dg/analyzer/strndup-1.c +++ /dev/null @@ -1,23 +0,0 @@ -/* { dg-skip-if "no strndup in libc" { *-*-darwin[789]* *-*-darwin10* hppa*-*-hpux* *-*-mingw* *-*-vxworks* } } */ - -#include -#include - -extern void requires_nonnull (void *ptr) - __attribute__((nonnull)); - -void test_1 (const char *s) -{ - char *p = strndup (s, 42); /* { dg-message "allocated here" } */ -} /* { dg-warning "leak of 'p'" } */ - -void test_2 (const char *s) -{ - char *p = strndup (s, 42); - free (p); -} -void test_3 (const char *s) -{ - char *p = strndup (s, 42); /* { dg-message "this call could return NULL" } */ - requires_nonnull (p); /* { dg-warning "use of possibly-NULL 'p'" } */ -} diff --git a/gcc/testsuite/gcc.dg/analyzer/switch-wrong-enum.c b/gcc/testsuite/gcc.dg/analyzer/switch-wrong-enum.c deleted file mode 100644 index 0de2516..0000000 --- a/gcc/testsuite/gcc.dg/analyzer/switch-wrong-enum.c +++ /dev/null @@ -1,27 +0,0 @@ -#include "analyzer-decls.h" - -enum color -{ - RED, - GREEN, - BLUE -}; - -enum fruit -{ - APPLE, - BANANA -}; - -int test_wrong_enum (enum color x) -{ - switch (x) - { - case APPLE: - return 1066; - case BANANA: - return 1776; - } - __analyzer_dump_path (); /* { dg-message "path" } */ - return 0; -} diff --git a/gcc/testsuite/gcc.dg/analyzer/symbolic-1.c b/gcc/testsuite/gcc.dg/analyzer/symbolic-1.c deleted file mode 100644 index 0d78242..0000000 --- a/gcc/testsuite/gcc.dg/analyzer/symbolic-1.c +++ /dev/null @@ -1,47 +0,0 @@ -/* { dg-additional-options "-fno-analyzer-suppress-followups" } */ - -#include "analyzer-decls.h" - -/* The example from store.h */ - -void test_1 (char a, char b, char c, char d, char e, char f, - int i, int j) -{ - char arr[1024]; /* { dg-message "region created on stack here" } */ - arr[2] = a; /* (1) */ - arr[3] = b; /* (2) */ - - __analyzer_eval (arr[2] == a); /* { dg-warning "TRUE" } */ - __analyzer_eval (arr[3] == b); /* { dg-warning "TRUE" } */ - __analyzer_eval (arr[4]); /* { dg-warning "UNKNOWN" "unknown" } */ - /* { dg-warning "use of uninitialized value 'arr\\\[4\\\]'" "uninit" { target *-*-* } .-1 } */ - - /* Replace one concrete binding's value with a different value. */ - arr[3] = c; /* (3) */ - __analyzer_eval (arr[2] == a); /* { dg-warning "TRUE" } */ - __analyzer_eval (arr[3] == c); /* { dg-warning "TRUE" } */ - __analyzer_eval (arr[3] == b); /* { dg-warning "UNKNOWN" } */ - __analyzer_eval (arr[4]); /* { dg-warning "UNKNOWN" "unknown" } */ - /* { dg-warning "use of uninitialized value 'arr\\\[4\\\]'" "uninit" { target *-*-* } .-1 } */ - - /* Symbolic binding. */ - arr[i] = d; /* (4) */ - __analyzer_eval (arr[i] == d); /* { dg-warning "TRUE" } */ - __analyzer_eval (arr[2] == a); /* { dg-warning "UNKNOWN" } */ - __analyzer_eval (arr[3] == c); /* { dg-warning "UNKNOWN" } */ - __analyzer_eval (arr[4]); /* { dg-warning "UNKNOWN" } */ /* Don't report uninit. */ - - /* Replace symbolic binding with a different one. */ - arr[j] = e; /* (5) */ - __analyzer_eval (arr[j] == e); /* { dg-warning "TRUE" } */ - __analyzer_eval (arr[i] == d); /* { dg-warning "UNKNOWN" } */ - __analyzer_eval (arr[4]); /* { dg-warning "UNKNOWN" } */ /* Don't report uninit. */ - - /* Add a concrete binding. */ - arr[3] = f; /* (6) */ - __analyzer_eval (arr[3] == f); /* { dg-warning "TRUE" } */ - __analyzer_eval (arr[j] == e); /* { dg-warning "UNKNOWN" } */ - __analyzer_eval (arr[4]); /* { dg-warning "UNKNOWN" } */ /* Don't report uninit. */ -} - -// TODO: as above, but with int rather than char so there's a cast diff --git a/gcc/testsuite/gcc.dg/analyzer/symbolic-2.c b/gcc/testsuite/gcc.dg/analyzer/symbolic-2.c deleted file mode 100644 index 70c00ce..0000000 --- a/gcc/testsuite/gcc.dg/analyzer/symbolic-2.c +++ /dev/null @@ -1,32 +0,0 @@ -#include "analyzer-decls.h" - -struct foo -{ - int ival; - int iarr[10]; -}; - -void test_1 (int i, int j) -{ - struct foo fooarr[4]; - fooarr[1].ival = 42; - fooarr[1].iarr[3] = 27; - fooarr[2].iarr[1] = 17; - __analyzer_eval (fooarr[1].ival == 42); /* { dg-warning "TRUE" } */ - __analyzer_eval (fooarr[1].iarr[3] == 27); /* { dg-warning "TRUE" } */ - __analyzer_eval (fooarr[2].iarr[1] == 17); /* { dg-warning "TRUE" } */ - - /* Symbolic binding. */ - fooarr[2].iarr[i] = j; - __analyzer_eval (fooarr[2].iarr[i] == j); /* { dg-warning "TRUE" } */ - - /* We should have lost our knowledge about fooarr[2]. - It's not clear to me if we should also lose our knowledge about - fooarr[1] (for the case where i is negative). For now, we do. */ - __analyzer_eval (fooarr[1].ival == 42); /* { dg-warning "UNKNOWN" } */ - __analyzer_eval (fooarr[1].iarr[3] == 27); /* { dg-warning "UNKNOWN" } */ - __analyzer_eval (fooarr[2].iarr[1] == 17); /* { dg-warning "UNKNOWN" } */ - /* Should also be safe to read from fooarr[2]; - it isn't known to be uninit anymore. */ - __analyzer_eval (fooarr[2].iarr[10] == 17); /* { dg-warning "UNKNOWN" } */ -} diff --git a/gcc/testsuite/gcc.dg/analyzer/symbolic-3.c b/gcc/testsuite/gcc.dg/analyzer/symbolic-3.c deleted file mode 100644 index da4cdbb..0000000 --- a/gcc/testsuite/gcc.dg/analyzer/symbolic-3.c +++ /dev/null @@ -1,12 +0,0 @@ -#include "analyzer-decls.h" - -int iarr[16]; - -void test_1 (int i, int j) -{ - int init_el_8 = iarr[8]; - __analyzer_eval (init_el_8 == iarr[8]); /* { dg-warning "TRUE" } */ - - iarr[i] = j; - __analyzer_eval (init_el_8 == iarr[8]); /* { dg-warning "UNKNOWN" } */ -} diff --git a/gcc/testsuite/gcc.dg/analyzer/symbolic-4.c b/gcc/testsuite/gcc.dg/analyzer/symbolic-4.c deleted file mode 100644 index a466f91..0000000 --- a/gcc/testsuite/gcc.dg/analyzer/symbolic-4.c +++ /dev/null @@ -1,20 +0,0 @@ -#include -#include "analyzer-decls.h" - -void test_1 (int i, int j, int k) -{ - int iarr[16]; - iarr[i] = j; - __analyzer_eval (iarr[i] == j); /* { dg-warning "TRUE" } */ - __analyzer_eval (iarr[k] == j); /* { dg-warning "UNKNOWN" } */ - - memset (iarr, 0, sizeof (iarr)); - __analyzer_eval (iarr[0] == 0); /* { dg-warning "TRUE" } */ - __analyzer_eval (iarr[i] == 0); /* { dg-warning "TRUE" } */ - __analyzer_eval (iarr[i] == j); /* { dg-warning "UNKNOWN" } */ - - iarr[i] = j; - __analyzer_eval (iarr[i] == j); /* { dg-warning "TRUE" } */ - __analyzer_eval (iarr[0] == 0); /* { dg-warning "UNKNOWN" } */ - __analyzer_eval (iarr[i] == 0); /* { dg-warning "UNKNOWN" } */ -} diff --git a/gcc/testsuite/gcc.dg/analyzer/symbolic-5.c b/gcc/testsuite/gcc.dg/analyzer/symbolic-5.c deleted file mode 100644 index 3f69650..0000000 --- a/gcc/testsuite/gcc.dg/analyzer/symbolic-5.c +++ /dev/null @@ -1,29 +0,0 @@ -#include "analyzer-decls.h" - -int a[1024]; -int b[1024]; - -extern void escape (void *ptr); - -void test_1 (int *p) -{ - int c, d; - escape (&c); - a[16] = 42; - b[16] = 17; - c = 33; - d = 44; - __analyzer_eval (a[16] == 42); /* { dg-warning "TRUE" } */ - __analyzer_eval (b[16] == 17); /* { dg-warning "TRUE" } */ - __analyzer_eval (c == 33); /* { dg-warning "TRUE" } */ - __analyzer_eval (d == 44); /* { dg-warning "TRUE" } */ - - /* Write through an externally-provided pointer. */ - *p = 100; - /* It could clobber our writes to the global arrays... */ - __analyzer_eval (a[16] == 42); /* { dg-warning "UNKNOWN" } */ - __analyzer_eval (b[16] == 17); /* { dg-warning "UNKNOWN" } */ - /* ...but can't clobber locals, even ones like "c" that have escaped. */ - __analyzer_eval (c == 33); /* { dg-warning "TRUE" } */ - __analyzer_eval (d == 44); /* { dg-warning "TRUE" } */ -} diff --git a/gcc/testsuite/gcc.dg/analyzer/symbolic-6.c b/gcc/testsuite/gcc.dg/analyzer/symbolic-6.c deleted file mode 100644 index 10d4e97..0000000 --- a/gcc/testsuite/gcc.dg/analyzer/symbolic-6.c +++ /dev/null @@ -1,24 +0,0 @@ -#include "analyzer-decls.h" - -int a[1024]; -int b[1024]; - -extern void escape (void *ptr); - -void test_1 (int *p) -{ - int c, d; - escape (&c); - - *p = 42; - __analyzer_eval (*p == 42); /* { dg-warning "TRUE" } */ - - /* These writes shouldn't affect *p. */ - c = 33; - d = 44; - __analyzer_eval (*p == 42); /* { dg-warning "TRUE" } */ - - /* This write could affect *p. */ - a[16] = 55; - __analyzer_eval (*p == 42); /* { dg-warning "UNKNOWN" } */ -} diff --git a/gcc/testsuite/gcc.dg/analyzer/symbolic-7.c b/gcc/testsuite/gcc.dg/analyzer/symbolic-7.c deleted file mode 100644 index c146455..0000000 --- a/gcc/testsuite/gcc.dg/analyzer/symbolic-7.c +++ /dev/null @@ -1,50 +0,0 @@ -#include "analyzer-decls.h" - -extern void maybe_write (int *); - -void test_1 (int i) -{ - /* An array with purely concrete bindings. */ - int arr[2]; - arr[0] = 1066; - arr[1] = 1776; - - /* Concrete reads. */ - __analyzer_eval (arr[0] == 1066); /* { dg-warning "TRUE" } */ - __analyzer_eval (arr[1] == 1776); /* { dg-warning "TRUE" } */ - - /* Symbolic read. */ - __analyzer_describe (0, arr[i]); /* { dg-warning "svalue: 'UNKNOWN\\(int\\)'" } */ - __analyzer_eval (arr[i] == 1776); /* { dg-warning "UNKNOWN" } */ -} - -void test_2 (int i) -{ - /* An array that could have been touched. */ - int arr[2]; - maybe_write (arr); - - /* Concrete reads. */ - __analyzer_eval (arr[0] == 42); /* { dg-warning "UNKNOWN" } */ - - /* Symbolic read. */ - __analyzer_eval (arr[i] == 42); /* { dg-warning "UNKNOWN" } */ -} - -void test_3_concrete_read (int i) -{ - /* An array that can't have been touched. */ - int arr[2]; - - /* Concrete reads. */ - __analyzer_eval (arr[0] == 42); /* { dg-warning "use of uninitialized value 'arr\\\[0\\\]'" } */ -} - -void test_3_symbolic_read (int i) -{ - /* An array that can't have been touched. */ - int arr[2]; - - /* Symbolic read. */ - __analyzer_eval (arr[i] == 42); /* { dg-warning "use of uninitialized value 'arr\\\[i\\\]'" } */ -} diff --git a/gcc/testsuite/gcc.dg/analyzer/symbolic-8.c b/gcc/testsuite/gcc.dg/analyzer/symbolic-8.c deleted file mode 100644 index f9c3596..0000000 --- a/gcc/testsuite/gcc.dg/analyzer/symbolic-8.c +++ /dev/null @@ -1,11 +0,0 @@ -/* Merger where "arr" has two different symbolic bindings. */ - -void test (int i, int j, int flag) -{ - int arr[16]; - - if (flag) - arr[i] = 42; - else - arr[j] = 17; -} diff --git a/gcc/testsuite/gcc.dg/analyzer/symbolic-gt-1.c b/gcc/testsuite/gcc.dg/analyzer/symbolic-gt-1.c deleted file mode 100644 index 140abce..0000000 --- a/gcc/testsuite/gcc.dg/analyzer/symbolic-gt-1.c +++ /dev/null @@ -1,76 +0,0 @@ -#include -#include "analyzer-decls.h" - -/* Test GT_EXPR comparison of symbolic values. */ - -void test1 (size_t size) -{ - size_t a = 4 * size + 1; - size_t b = 4 * size; - __analyzer_eval (a > b); /* { dg-warning "TRUE" } */ -} - -void test2 (size_t size, size_t offset) -{ - size_t a = size + offset; - size_t b = size; - __analyzer_eval (a > b); /* { dg-warning "TRUE" } */ -} - -void test3 (size_t size, size_t offset) -{ - size_t a = size * offset; - size_t b = size; - __analyzer_eval (a > b); /* { dg-warning "TRUE" } */ -} - -void test4 (size_t size) -{ - size_t op = -1; - size_t a = size + op; - size_t b = size; - __analyzer_eval (a > b); /* { dg-warning "UNKNOWN" } */ -} - -void test5 (size_t size) -{ - size_t a = size - 1; - size_t b = size; - __analyzer_eval (a > b); /* { dg-warning "UNKNOWN" } */ -} - -void test6 (size_t size, int offset) -{ - /* OFFSET is a symbolic integer, thus could be negative. */ - size_t a = size + offset; - size_t b = size; - __analyzer_eval (a > b); /* { dg-warning "UNKNOWN" } */ -} - -void test7 (size_t size, size_t mul) -{ - size_t a = mul * size + 1; - size_t b = mul * size; - __analyzer_eval (a > b); /* { dg-warning "TRUE" } */ -} - -void test8 (size_t size) -{ - size_t a = size - 5; - size_t b = size - 1; - __analyzer_eval (a > b); /* { dg-warning "UNKNOWN" } */ -} - -void test9 (size_t size) -{ - size_t a = size + 1; - size_t b = size + 2; - __analyzer_eval (a > b); /* { dg-warning "UNKNOWN" } */ -} - -void test10 (size_t size) -{ - size_t a = size + 2; - size_t b = size + 1; - __analyzer_eval (a > b); /* { dg-warning "TRUE" } */ -} diff --git a/gcc/testsuite/gcc.dg/analyzer/taint-alloc-3.c b/gcc/testsuite/gcc.dg/analyzer/taint-alloc-3.c deleted file mode 100644 index ce6a327..0000000 --- a/gcc/testsuite/gcc.dg/analyzer/taint-alloc-3.c +++ /dev/null @@ -1,18 +0,0 @@ -#include "analyzer-decls.h" -#include -#include -#include - -/* malloc with tainted size from a syscall. */ - -void *p; - -void __attribute__((tainted_args)) -test_1 (size_t sz) /* { dg-message "\\(1\\) function 'test_1' marked with '__attribute__\\(\\(tainted_args\\)\\)'" } */ -{ - /* TODO: should have a message saying why "sz" is tainted, e.g. - "treating 'sz' as attacker-controlled because 'test_1' is marked with '__attribute__((tainted_args))'" */ - - p = malloc (sz); /* { dg-warning "use of attacker-controlled value 'sz' as allocation size without upper-bounds checking" "warning" } */ - /* { dg-message "\\(\[0-9\]+\\) use of attacker-controlled value 'sz' as allocation size without upper-bounds checking" "final event" { target *-*-* } .-1 } */ -} diff --git a/gcc/testsuite/gcc.dg/analyzer/taint-assert-BUG_ON.c b/gcc/testsuite/gcc.dg/analyzer/taint-assert-BUG_ON.c deleted file mode 100644 index 328940d..0000000 --- a/gcc/testsuite/gcc.dg/analyzer/taint-assert-BUG_ON.c +++ /dev/null @@ -1,73 +0,0 @@ -/* We need this, otherwise the warnings are emitted inside the macros, which - makes it hard to write the DejaGnu directives. */ -/* { dg-additional-options " -ftrack-macro-expansion=0" } */ - -/* Adapted from code in the Linux kernel, which has this: */ -/* SPDX-License-Identifier: GPL-2.0 */ - -#define __noreturn __attribute__ ((__noreturn__)) - -void panic(const char *fmt, ...) __noreturn; - -int _printk(const char *fmt, ...); -#define __printk_index_emit(...) do {} while (0) -#define printk_index_wrap(_p_func, _fmt, ...) \ - ({ \ - __printk_index_emit(_fmt, NULL, NULL); \ - _p_func(_fmt, ##__VA_ARGS__); \ - }) -#define printk(fmt, ...) printk_index_wrap(_printk, fmt, ##__VA_ARGS__) -#define barrier_before_unreachable() do { } while (0) - -#define BUG() do { \ - printk("BUG: failure at %s:%d/%s()!\n", __FILE__, __LINE__, __func__); \ - barrier_before_unreachable(); \ - panic("BUG!"); \ -} while (0) - -#define BUG_ON(condition) do { if (condition) BUG(); } while (0) - -void __attribute__((tainted_args)) -test_BUG(int n) -{ - if (n > 100) /* { dg-message "use of attacker-controlled value for control flow" } */ - BUG(); /* { dg-warning "-Wanalyzer-tainted-assertion" "warning" } */ - /* { dg-message "treating 'panic' as an assertion failure handler due to '__attribute__\\(\\(__noreturn__\\)\\)'" "final event" { target *-*-* } .-1 } */ -} - -void __attribute__((tainted_args)) -test_BUG_ON(int n) -{ - BUG_ON(n > 100); /* { dg-warning "-Wanalyzer-tainted-assertion" "warning" } */ - /* { dg-message "treating 'panic' as an assertion failure handler due to '__attribute__\\(\\(__noreturn__\\)\\)'" "final event" { target *-*-* } .-1 } */ -} - -int __attribute__((tainted_args)) -test_switch_BUG_1(int n) -{ - switch (n) { /* { dg-message "use of attacker-controlled value for control flow" } */ - default: - case 0: - return 5; - case 1: - return 22; - case 2: - return -1; - case 42: - BUG (); /* { dg-warning "-Wanalyzer-tainted-assertion" } */ - } -} - -int __attribute__((tainted_args)) -test_switch_BUG(int n) -{ - switch (n) { /* { dg-message "use of attacker-controlled value for control flow" } */ - case 0: - return 5; - case 1: - return 22; - case 2: - return -1; - } - BUG (); /* { dg-warning "-Wanalyzer-tainted-assertion" } */ -} diff --git a/gcc/testsuite/gcc.dg/analyzer/taint-divisor-2.c b/gcc/testsuite/gcc.dg/analyzer/taint-divisor-2.c deleted file mode 100644 index 7702584..0000000 --- a/gcc/testsuite/gcc.dg/analyzer/taint-divisor-2.c +++ /dev/null @@ -1,10 +0,0 @@ -#include "analyzer-decls.h" - -__attribute__ ((tainted_args)) -double pr110700 (double x, double y) -{ - /* Ideally we'd complain here with -Wanalyzer-tainted-divisor, but - until we track conditions on floating point values, we can't check to - see if they've been checked against zero. */ - return x / y; -} diff --git a/gcc/testsuite/gcc.dg/analyzer/taint-merger.c b/gcc/testsuite/gcc.dg/analyzer/taint-merger.c deleted file mode 100644 index b7d562b..0000000 --- a/gcc/testsuite/gcc.dg/analyzer/taint-merger.c +++ /dev/null @@ -1,54 +0,0 @@ -#include "analyzer-decls.h" - -int v_start; - -__attribute__((tainted_args)) -void test (int v_tainted, int v_has_lb, int v_has_ub, int v_stop) -{ - /* Get each var into the 5 different taintedness states. */ - if (v_has_lb < 10) - return; - if (v_has_ub > 100) - return; - if (v_stop < 0 || v_stop > 100) - return; - - /* Verify that we have the taintedness states we expect. */ - - __analyzer_dump_state ("taint", v_start); /* { dg-warning "state: 'start'" } */ - __analyzer_dump_state ("taint", v_tainted); /* { dg-warning "state: 'tainted'" } */ - __analyzer_dump_state ("taint", v_has_lb); /* { dg-warning "state: 'has_lb'" } */ - __analyzer_dump_state ("taint", v_has_ub); /* { dg-warning "state: 'has_ub'" } */ - __analyzer_dump_state ("taint", v_stop); /* { dg-warning "state: 'stop'" } */ - - /* Check all combinations of taintedness state. */ - __analyzer_dump_state ("taint", v_start + v_start); /* { dg-warning "state: 'start'" } */ - __analyzer_dump_state ("taint", v_start + v_tainted); /* { dg-warning "state: 'tainted'" } */ - __analyzer_dump_state ("taint", v_start + v_has_lb); /* { dg-warning "state: 'has_lb'" } */ - __analyzer_dump_state ("taint", v_start + v_has_ub); /* { dg-warning "state: 'has_ub'" } */ - __analyzer_dump_state ("taint", v_start + v_stop); /* { dg-warning "state: 'stop'" } */ - - __analyzer_dump_state ("taint", v_tainted + v_start); /* { dg-warning "state: 'tainted'" } */ - __analyzer_dump_state ("taint", v_tainted + v_tainted); /* { dg-warning "state: 'tainted'" } */ - __analyzer_dump_state ("taint", v_tainted + v_has_lb); /* { dg-warning "state: 'tainted'" } */ - __analyzer_dump_state ("taint", v_tainted + v_has_ub); /* { dg-warning "state: 'tainted'" } */ - __analyzer_dump_state ("taint", v_tainted + v_stop); /* { dg-warning "state: 'tainted'" } */ - - __analyzer_dump_state ("taint", v_has_lb + v_start); /* { dg-warning "state: 'has_lb'" } */ - __analyzer_dump_state ("taint", v_has_lb + v_tainted); /* { dg-warning "state: 'tainted'" } */ - __analyzer_dump_state ("taint", v_has_lb + v_has_lb); /* { dg-warning "state: 'has_lb'" } */ - __analyzer_dump_state ("taint", v_has_lb + v_has_ub); /* { dg-warning "state: 'tainted'" } */ - __analyzer_dump_state ("taint", v_has_lb + v_stop); /* { dg-warning "state: 'has_lb'" } */ - - __analyzer_dump_state ("taint", v_has_ub + v_start); /* { dg-warning "state: 'has_ub'" } */ - __analyzer_dump_state ("taint", v_has_ub + v_tainted); /* { dg-warning "state: 'tainted'" } */ - __analyzer_dump_state ("taint", v_has_ub + v_has_lb); /* { dg-warning "state: 'tainted'" } */ - __analyzer_dump_state ("taint", v_has_ub + v_has_ub); /* { dg-warning "state: 'has_ub'" } */ - __analyzer_dump_state ("taint", v_has_ub + v_stop); /* { dg-warning "state: 'has_ub'" } */ - - __analyzer_dump_state ("taint", v_stop + v_start); /* { dg-warning "state: 'stop'" } */ - __analyzer_dump_state ("taint", v_stop + v_tainted); /* { dg-warning "state: 'tainted'" } */ - __analyzer_dump_state ("taint", v_stop + v_has_lb); /* { dg-warning "state: 'has_lb'" } */ - __analyzer_dump_state ("taint", v_stop + v_has_ub); /* { dg-warning "state: 'has_ub'" } */ - __analyzer_dump_state ("taint", v_stop + v_stop); /* { dg-warning "state: 'stop'" } */ -} diff --git a/gcc/testsuite/gcc.dg/analyzer/taint-realloc.c b/gcc/testsuite/gcc.dg/analyzer/taint-realloc.c deleted file mode 100644 index aeefb7d..0000000 --- a/gcc/testsuite/gcc.dg/analyzer/taint-realloc.c +++ /dev/null @@ -1,18 +0,0 @@ -#include "analyzer-decls.h" -#include -#include -#include - -/* realloc with tainted size. */ - -void *p; - -void __attribute__((tainted_args)) -test_1 (size_t sz) /* { dg-message "\\(1\\) function 'test_1' marked with '__attribute__\\(\\(tainted_args\\)\\)'" } */ -{ - void *q; - - __analyzer_dump_state ("taint", sz); /* { dg-warning "state: 'tainted'" } */ - - q = realloc (p, sz); /* { dg-warning "use of attacker-controlled value 'sz' as allocation size without upper-bounds checking" } */ -} /* { dg-warning "leak of 'q'" } */ diff --git a/gcc/testsuite/gcc.dg/analyzer/uninit-1.c b/gcc/testsuite/gcc.dg/analyzer/uninit-1.c deleted file mode 100644 index 3d10216..0000000 --- a/gcc/testsuite/gcc.dg/analyzer/uninit-1.c +++ /dev/null @@ -1,148 +0,0 @@ -#include "analyzer-decls.h" -typedef __SIZE_TYPE__ size_t; - -int test_1 (void) -{ - int i; /* { dg-message "region created on stack here" } */ - return i; /* { dg-warning "use of uninitialized value 'i'" } */ -} - -int test_2 (void) -{ - int i; /* { dg-message "region created on stack here" } */ - return i * 2; /* { dg-warning "use of uninitialized value 'i'" } */ -} - -int test_3 (void) -{ - static int i; - return i; -} - -int test_4 (void) -{ - int *p; /* { dg-message "region created on stack here" } */ - return *p; /* { dg-warning "use of uninitialized value 'p'" } */ -} - -int test_5 (int flag, int *q) -{ - int *p; /* { dg-message "region created on stack here" } */ - if (flag) /* { dg-message "following 'false' branch" } */ - p = q; - - /* There should be two enodes here, - i.e. not merging the init vs non-init states. */ - __analyzer_dump_exploded_nodes (0); /* { dg-warning "2 processed enodes" } */ - - return *p; /* { dg-warning "use of uninitialized value 'p'" } */ -} - -int test_6 (int i) -{ - int arr[10]; /* { dg-message "region created on stack here" } */ - return arr[i]; /* { dg-warning "use of uninitialized value 'arr\\\[i\\\]'" } */ -} - -int test_rshift_rhs (int i) -{ - int j; /* { dg-message "region created on stack here" } */ - return i >> j; /* { dg-warning "use of uninitialized value 'j'" } */ -} - -int test_lshift_rhs (int i) -{ - int j; /* { dg-message "region created on stack here" } */ - return i << j; /* { dg-warning "use of uninitialized value 'j'" } */ -} - -int test_rshift_lhs (int i) -{ - int j; /* { dg-message "region created on stack here" } */ - return j >> i; /* { dg-warning "use of uninitialized value 'j'" } */ -} - -int test_lshift_lhs (int i) -{ - int j; /* { dg-message "region created on stack here" } */ - return j << i; /* { dg-warning "use of uninitialized value 'j'" } */ -} - -int test_cmp (int i) -{ - int j; /* { dg-message "region created on stack here" } */ - return i < j; /* { dg-warning "use of uninitialized value 'j'" } */ -} - -float test_plus_rhs (float x) -{ - float y; /* { dg-message "region created on stack here" } */ - return x + y; /* { dg-warning "use of uninitialized value 'y'" } */ -} - -float test_plus_lhs (float x) -{ - float y; /* { dg-message "region created on stack here" } */ - return y + x; /* { dg-warning "use of uninitialized value 'y'" } */ -} - -float test_minus_rhs (float x) -{ - float y; /* { dg-message "region created on stack here" } */ - return x - y; /* { dg-warning "use of uninitialized value 'y'" } */ -} - -float test_minus_lhs (float x) -{ - float y; /* { dg-message "region created on stack here" } */ - return y - x; /* { dg-warning "use of uninitialized value 'y'" } */ -} - -float test_times_rhs (float x) -{ - float y; /* { dg-message "region created on stack here" } */ - return x * y; /* { dg-warning "use of uninitialized value 'y'" } */ -} - -float test_times_lhs (float x) -{ - float y; /* { dg-message "region created on stack here" } */ - return y * x; /* { dg-warning "use of uninitialized value 'y'" } */ -} - -float test_divide_rhs (float x) -{ - float y; /* { dg-message "region created on stack here" } */ - return x / y; /* { dg-warning "use of uninitialized value 'y'" } */ -} - -float test_divide_lhs (float x) -{ - float y; /* { dg-message "region created on stack here" } */ - return y / x; /* { dg-warning "use of uninitialized value 'y'" } */ -} - -size_t test_builtin_strlen (void) -{ - const char *ptr; /* { dg-message "region created on stack here" } */ - return __builtin_strlen (ptr); /* { dg-warning "use of uninitialized value 'ptr'" } */ -} - -void test_calling_uninit_fn_ptr_1 (void) -{ - void (*fn_ptr) (void); /* { dg-message "region created on stack here" } */ - fn_ptr (); /* { dg-warning "use of uninitialized value 'fn_ptr'" } */ -} - -int test_calling_uninit_fn_ptr_2 (void) -{ - int (*fn_ptr) (void); /* { dg-message "region created on stack here" } */ - return fn_ptr (); /* { dg-warning "use of uninitialized value 'fn_ptr'" } */ -} - -extern void called_by_uninit_arg (int); -void test_passing_uninit_arg (void) -{ - int i; /* { dg-message "region created on stack here" } */ - called_by_uninit_arg (i); /* { dg-warning "use of uninitialized value 'i'" } */ -} diff --git a/gcc/testsuite/gcc.dg/analyzer/uninit-2.c b/gcc/testsuite/gcc.dg/analyzer/uninit-2.c deleted file mode 100644 index 0b0b8b6..0000000 --- a/gcc/testsuite/gcc.dg/analyzer/uninit-2.c +++ /dev/null @@ -1,14 +0,0 @@ -typedef __SIZE_TYPE__ size_t; - -extern size_t strlen (const char *__s) - __attribute__ ((__nothrow__ , __leaf__)) - __attribute__ ((__pure__)) - __attribute__ ((__nonnull__ (1))); - -extern char *read_file (const char *file); - -size_t test_1 (const char *file) -{ - char *str = read_file (file); - return strlen (str); -} diff --git a/gcc/testsuite/gcc.dg/analyzer/uninit-3.c b/gcc/testsuite/gcc.dg/analyzer/uninit-3.c deleted file mode 100644 index fa33e0a..0000000 --- a/gcc/testsuite/gcc.dg/analyzer/uninit-3.c +++ /dev/null @@ -1,36 +0,0 @@ -/* Reduced from linux 5.3.11: drivers/net/wireless/ath/ath10k/usb.c */ - -/* The original file has this licence header. */ - -// SPDX-License-Identifier: ISC -/* - * Copyright (c) 2007-2011 Atheros Communications Inc. - * Copyright (c) 2011-2012,2017 Qualcomm Atheros, Inc. - * Copyright (c) 2016-2017 Erik Stromdahl - */ - -/* Adapted from include/linux/compiler_attributes.h. */ -#define __printf(a, b) __attribute__((__format__(printf, a, b))) - -/* From drivers/net/wireless/ath/ath10k/core.h. */ - -struct ath10k; - -/* From drivers/net/wireless/ath/ath10k/debug.h. */ - -enum ath10k_debug_mask { - /* [...other values removed...] */ - ATH10K_DBG_USB_BULK = 0x00080000, -}; - -extern unsigned int ath10k_debug_mask; - -__printf(3, 4) void __ath10k_dbg(struct ath10k *ar, - enum ath10k_debug_mask mask, - const char *fmt, ...); - -static void ath10k_usb_hif_tx_sg(struct ath10k *ar) -{ - if (ath10k_debug_mask & ATH10K_DBG_USB_BULK) - __ath10k_dbg(ar, ATH10K_DBG_USB_BULK, "usb bulk transmit failed: %d\n", 42); -} diff --git a/gcc/testsuite/gcc.dg/analyzer/uninit-6.c b/gcc/testsuite/gcc.dg/analyzer/uninit-6.c deleted file mode 100644 index 75a99ad..0000000 --- a/gcc/testsuite/gcc.dg/analyzer/uninit-6.c +++ /dev/null @@ -1,29 +0,0 @@ -/* Reduced from uninit false positive seen on Linux kernel with - net/ethtool/ioctl.c */ - -typedef signed char s8; -typedef unsigned int u32; -typedef __SIZE_TYPE__ size_t; - -void *memset(void *s, int c, size_t n); - -struct ethtool_link_settings { - u32 cmd; - s8 link_mode_masks_nwords; -}; - -struct ethtool_link_ksettings { - struct ethtool_link_settings base; - u32 lanes; -}; - -struct ethtool_link_settings -ethtool_get_link_ksettings(void) { - struct ethtool_link_ksettings link_ksettings; - - memset(&link_ksettings, 0, sizeof(link_ksettings)); - link_ksettings.base.cmd = 0x0000004c; - link_ksettings.base.link_mode_masks_nwords = -3; - - return link_ksettings.base; -} diff --git a/gcc/testsuite/gcc.dg/analyzer/uninit-6b.c b/gcc/testsuite/gcc.dg/analyzer/uninit-6b.c deleted file mode 100644 index 32ba30f..0000000 --- a/gcc/testsuite/gcc.dg/analyzer/uninit-6b.c +++ /dev/null @@ -1,29 +0,0 @@ -/* Reduced from uninit false positive seen on Linux kernel with - net/ethtool/ioctl.c */ - -typedef signed char s8; -typedef unsigned int u32; -typedef __SIZE_TYPE__ size_t; - -void *memset(void *s, int c, size_t n); - -struct ethtool_link_settings { - u32 cmd; - s8 link_mode_masks_nwords; -}; - -struct ethtool_link_ksettings { - u32 lanes; - struct ethtool_link_settings base; -}; - -struct ethtool_link_settings -ethtool_get_link_ksettings(void) { - struct ethtool_link_ksettings link_ksettings; - - memset(&link_ksettings, 0, sizeof(link_ksettings)); - link_ksettings.base.cmd = 0x0000004c; - link_ksettings.base.link_mode_masks_nwords = -3; - - return link_ksettings.base; -} diff --git a/gcc/testsuite/gcc.dg/analyzer/uninit-8.c b/gcc/testsuite/gcc.dg/analyzer/uninit-8.c deleted file mode 100644 index 2fa1052..0000000 --- a/gcc/testsuite/gcc.dg/analyzer/uninit-8.c +++ /dev/null @@ -1,73 +0,0 @@ -struct st -{ - int a, b, c, d, e; -}; - -int -test_1 (int flag, struct st *p) -{ - struct st *q; - int result = 0; - if (flag) - q = p; - /* We should only warn about the first use of uninit for 'q': */ - result += q->a; /* { dg-warning "use of uninitialized value 'q'" } */ - /* ...and not for these: */ - result += q->b; /* { dg-bogus "use of uninitialized value 'q'" } */ - result += q->c; /* { dg-bogus "use of uninitialized value 'q'" } */ - result += q->d; /* { dg-bogus "use of uninitialized value 'q'" } */ - result += q->e; /* { dg-bogus "use of uninitialized value 'q'" } */ - return result; -} - -int -test_2 (int flag, struct st *p, struct st *r) -{ - struct st *q; - int result = 0; - if (flag) - q = p; - /* We should only warn about the first use of uninit for 'q': */ - if (q == r) /* { dg-warning "use of uninitialized value 'q'" } */ - result += 1; - /* ...and not for these, after a conditional: */ - result += q->b; /* { dg-bogus "use of uninitialized value 'q'" } */ - result += q->c; /* { dg-bogus "use of uninitialized value 'q'" } */ - result += q->d; /* { dg-bogus "use of uninitialized value 'q'" } */ - result += q->e; /* { dg-bogus "use of uninitialized value 'q'" } */ - return result; -} - -int -test_3 (int flag, int val) -{ - int result = 0; - int idx; - if (flag) - idx = val; - switch (idx) /* { dg-warning "use of uninitialized value 'idx'" } */ - { - case 0: - result = 3; - break; - case 1: - result = 4; - break; - default: - result = 5; - break; - } - switch (idx) /* { dg-bogus "use of uninitialized value 'idx'" } */ - { - case 0: - result += 3; - break; - case 1: - result += 4; - break; - default: - result += 5; - break; - } - return result; -} diff --git a/gcc/testsuite/gcc.dg/analyzer/uninit-pr104576.c b/gcc/testsuite/gcc.dg/analyzer/uninit-pr104576.c deleted file mode 100644 index 0b59acd..0000000 --- a/gcc/testsuite/gcc.dg/analyzer/uninit-pr104576.c +++ /dev/null @@ -1,16 +0,0 @@ -float -test_1 (int *flag, float theta) -{ - float t; - float f; - - if (*flag) - t = 2.0f; - - f = __builtin_sinf (theta); - - if (*flag) - f *= t; - - return f; -} diff --git a/gcc/testsuite/gcc.dg/analyzer/uninit-pr106204.c b/gcc/testsuite/gcc.dg/analyzer/uninit-pr106204.c deleted file mode 100644 index 7d7cf7b..0000000 --- a/gcc/testsuite/gcc.dg/analyzer/uninit-pr106204.c +++ /dev/null @@ -1,17 +0,0 @@ -/* { dg-additional-options "-ftrivial-auto-var-init=zero" } */ - -int foo(unsigned *len); - -/* Modified version of reproducer that does use "len" before init. */ - -int test_2() -{ - unsigned len; - int rc; - - rc = len; /* { dg-warning "use of uninitialized value 'len'" } */ - rc = foo(&len); - if (!rc) - rc = len; - return rc; -} diff --git a/gcc/testsuite/gcc.dg/analyzer/uninit-pr108704.c b/gcc/testsuite/gcc.dg/analyzer/uninit-pr108704.c deleted file mode 100644 index ebf8151..0000000 --- a/gcc/testsuite/gcc.dg/analyzer/uninit-pr108704.c +++ /dev/null @@ -1,29 +0,0 @@ -typedef unsigned short int __uint16_t; -typedef unsigned int __uint32_t; -typedef unsigned long int __uint64_t; -typedef __uint16_t uint16_t; -typedef __uint32_t uint32_t; -typedef __uint64_t uint64_t; - -typedef uint32_t float32; -typedef struct -{ - uint64_t low; - uint16_t high; -} floatx80; - -extern floatx80 -float32_to_floatx80(float32); - -extern floatx80 -floatx80_add(floatx80, floatx80); - -floatx80 -test (floatx80 a) -{ - floatx80 fp0; - - fp0 = a; - fp0 = floatx80_add(fp0, float32_to_floatx80((0x3F800000))); /* { dg-bogus "use of uninitialized value 'fp0'" } */ - return fp0; -} diff --git a/gcc/testsuite/gcc.dg/analyzer/uninit-pr108806-qemu.c b/gcc/testsuite/gcc.dg/analyzer/uninit-pr108806-qemu.c deleted file mode 100644 index 0927201..0000000 --- a/gcc/testsuite/gcc.dg/analyzer/uninit-pr108806-qemu.c +++ /dev/null @@ -1,110 +0,0 @@ -/* Reduced from qemu-7.2.0's hw/intc/omap_intc.c as per - null-deref-pr108806.c, but with the: - struct omap_intr_handler_bank_s* bank = NULL; - converted to: - struct omap_intr_handler_bank_s* bank; - */ - -/* { dg-additional-options "-Wno-analyzer-symbol-too-complex" } */ - -typedef unsigned char __uint8_t; -typedef unsigned int __uint32_t; -typedef unsigned long int __uint64_t; -typedef __uint8_t uint8_t; -typedef __uint32_t uint32_t; -typedef __uint64_t uint64_t; -typedef uint64_t hwaddr; -typedef struct omap_intr_handler_s omap_intr_handler; - -struct omap_intr_handler_bank_s -{ - uint32_t irqs; - uint32_t inputs; - uint32_t mask; - uint32_t fiq; - uint32_t sens_edge; - uint32_t swi; - unsigned char priority[32]; -}; - -struct omap_intr_handler_s -{ - /* [...snip...] */ - unsigned char nbanks; - /* [...snip...] */ - int sir_intr[2]; - int autoidle; - uint32_t mask; - struct omap_intr_handler_bank_s bank[3]; -}; - -uint64_t -omap2_inth_read(struct omap_intr_handler_s* s, int offset) -{ - int bank_no, line_no; - struct omap_intr_handler_bank_s* bank; - - if ((offset & 0xf80) == 0x80) { - bank_no = (offset & 0x60) >> 5; - if (bank_no < s->nbanks) { - offset &= ~0x60; - bank = &s->bank[bank_no]; - } else { - return 0; - } - } - - switch (offset) { - case 0x10: - return (s->autoidle >> 2) & 1; - - case 0x14: - return 1; - - case 0x40: - return s->sir_intr[0]; - - case 0x44: - return s->sir_intr[1]; - - case 0x48: - return (!s->mask) << 2; - - case 0x4c: - return 0; - - case 0x50: - return s->autoidle & 3; - - case 0x80: - return bank->inputs; /* { dg-bogus "use of uninitialized value 'bank'" "PR analyzer/108806" } */ - - case 0x84: - return bank->mask; /* { dg-bogus "use of uninitialized value 'bank'" "PR analyzer/108806" } */ - - case 0x88: - case 0x8c: - return 0; - - case 0x90: - return bank->swi; /* { dg-bogus "use of uninitialized value 'bank'" "PR analyzer/108806" } */ - - case 0x94: - return 0; - - case 0x98: - return bank->irqs & ~bank->mask & ~bank->fiq; /* { dg-bogus "use of uninitialized value 'bank'" "PR analyzer/108806" } */ - - case 0x9c: - return bank->irqs & ~bank->mask & bank->fiq; /* { dg-bogus "use of uninitialized value 'bank'" "PR analyzer/108806" } */ - - case 0x100 ... 0x300: - bank_no = (offset - 0x100) >> 7; - if (bank_no > s->nbanks) - break; - bank = &s->bank[bank_no]; - line_no = (offset & 0x7f) >> 2; - return (bank->priority[line_no] << 2) | ((bank->fiq >> line_no) & 1); - } - return 0; -} diff --git a/gcc/testsuite/gcc.dg/analyzer/uninit-pr108968-register.c b/gcc/testsuite/gcc.dg/analyzer/uninit-pr108968-register.c deleted file mode 100644 index a76c09e..0000000 --- a/gcc/testsuite/gcc.dg/analyzer/uninit-pr108968-register.c +++ /dev/null @@ -1,9 +0,0 @@ -/* { dg-do compile { target x86_64-*-* } } */ - -#define STACK_SIZE 4096 -struct cpu_info {}; -struct cpu_info *get_cpu_info(void) -{ - register unsigned long sp asm("rsp"); - return (struct cpu_info *)((sp | (STACK_SIZE - 1)) + 1) - 1; /* { dg-bogus "use of uninitialized value 'sp'" } */ -} diff --git a/gcc/testsuite/gcc.dg/analyzer/uninit-pr94713.c b/gcc/testsuite/gcc.dg/analyzer/uninit-pr94713.c deleted file mode 100644 index cb91462..0000000 --- a/gcc/testsuite/gcc.dg/analyzer/uninit-pr94713.c +++ /dev/null @@ -1,19 +0,0 @@ -void f1 (int *); -void f2 (int); - -int test_1 (void) -{ - int *p; /* { dg-message "region created on stack here" } */ - - f1 (p); /* { dg-warning "use of uninitialized value 'p'" } */ - f1 (p); /* { dg-bogus "use of uninitialized value 'p'" "no followup warnings" } */ - return 0; -} - -int test_2 (void) -{ - int *p; /* { dg-message "region created on stack here" } */ - - f2 (p[0]); /* { dg-warning "use of uninitialized value 'p'" } */ - return 0; -} diff --git a/gcc/testsuite/gcc.dg/analyzer/uninit-pr94714.c b/gcc/testsuite/gcc.dg/analyzer/uninit-pr94714.c deleted file mode 100644 index f120901..0000000 --- a/gcc/testsuite/gcc.dg/analyzer/uninit-pr94714.c +++ /dev/null @@ -1,12 +0,0 @@ -#include - -int main (void) -{ - int *p; - int i; /* { dg-message "region created on stack here" } */ - - p = &i; /* { dg-bogus "uninitialized" } */ - printf ("%d\n", p[0]); /* { dg-warning "use of uninitialized value '\\*p'" } */ - - return 0; -} diff --git a/gcc/testsuite/gcc.dg/analyzer/unknown-fns-2.c b/gcc/testsuite/gcc.dg/analyzer/unknown-fns-2.c deleted file mode 100644 index 1c4bdd6..0000000 --- a/gcc/testsuite/gcc.dg/analyzer/unknown-fns-2.c +++ /dev/null @@ -1,238 +0,0 @@ -/* Tests for data model handling of unknown fns. */ - -#include -#include "analyzer-decls.h" - -void unknown_fn (void *); - -void test_1 (void) -{ - int i; - - i = 42; - __analyzer_eval (i == 42); /* { dg-warning "TRUE" } */ - - unknown_fn (NULL); - __analyzer_eval (i == 42); /* { dg-warning "TRUE" } */ - - unknown_fn (&i); - __analyzer_eval (i == 42); /* { dg-warning "UNKNOWN" } */ - - i = 17; - __analyzer_eval (i == 17); /* { dg-warning "TRUE" } */ - - /* Even though we're not passing &i to unknown_fn, it escaped - above, so unknown_fn could write to it. */ - unknown_fn (NULL); - __analyzer_eval (i == 17); /* { dg-warning "UNKNOWN" } */ -} - -/* As test_1, but with an unknown fn_ptr. */ - -void test_1a (void (*fn_ptr) (void *)) -{ - int i; - - i = 42; - __analyzer_eval (i == 42); /* { dg-warning "TRUE" } */ - - fn_ptr (NULL); - __analyzer_eval (i == 42); /* { dg-warning "TRUE" } */ - - fn_ptr (&i); - __analyzer_eval (i == 42); /* { dg-warning "UNKNOWN" } */ - - i = 17; - __analyzer_eval (i == 17); /* { dg-warning "TRUE" } */ - - /* Even though we're not passing &i to unknown_fn, it escaped - above, so fn_ptr (NULL) could write to it. */ - fn_ptr (NULL); - __analyzer_eval (i == 17); /* { dg-warning "UNKNOWN" } */ -} - -int *global_for_test_2; - -void test_2 (void) -{ - int i; - - i = 42; - __analyzer_eval (i == 42); /* { dg-warning "TRUE" } */ - - global_for_test_2 = &i; - unknown_fn (NULL); - __analyzer_eval (i == 42); /* { dg-warning "UNKNOWN" } */ - - global_for_test_2 = NULL; - - i = 17; - __analyzer_eval (i == 17); /* { dg-warning "TRUE" } */ - - /* Even though the global no longer points to i, it escaped - above, so unknown_fn could write to it. */ - unknown_fn (NULL); - __analyzer_eval (i == 17); /* { dg-warning "UNKNOWN" } */ -} - -struct used_by_test_3 -{ - int *int_ptr; -}; - -void test_3 (void) -{ - int i; - - struct used_by_test_3 s; - s.int_ptr = &i; - - i = 42; - __analyzer_eval (i == 42); /* { dg-warning "TRUE" } */ - - unknown_fn (NULL); - __analyzer_eval (i == 42); /* { dg-warning "TRUE" } */ - __analyzer_eval (s.int_ptr == &i); /* { dg-warning "TRUE" } */ - - /* i should escape here. */ - unknown_fn (&s); - __analyzer_eval (i == 42); /* { dg-warning "UNKNOWN" } */ - __analyzer_eval (s.int_ptr == &i); /* { dg-warning "UNKNOWN" } */ - - s.int_ptr = NULL; - __analyzer_eval (s.int_ptr == NULL); /* { dg-warning "TRUE" } */ - - i = 17; - __analyzer_eval (i == 17); /* { dg-warning "TRUE" } */ - - /* Even though nothing we know about points to i, it escaped - above, so unknown_fn could write to it. */ - unknown_fn (NULL); - __analyzer_eval (i == 17); /* { dg-warning "UNKNOWN" } */ -} - -struct used_by_test_4 -{ - int *int_ptr; -}; - -void test_4 (struct used_by_test_4 *st4_ptr) -{ - /* Something unknown called "test_4", and hence *st4_ptr has - effectively already escaped. */ - - int i = 42; - __analyzer_eval (i == 42); /* { dg-warning "TRUE" } */ - - unknown_fn (NULL); - __analyzer_eval (i == 42); /* { dg-warning "TRUE" } */ - - /* Given that *st4_ptr has effectively already escaped, calling - an unknown fn should invalidate our knowledge of i". */ - st4_ptr->int_ptr = &i; - unknown_fn (NULL); - __analyzer_eval (i == 42); /* { dg-warning "UNKNOWN" } */ - - /* ...and "&i" should now be treated as having escaped. */ - i = 17; - __analyzer_eval (i == 17); /* { dg-warning "TRUE" } */ - st4_ptr->int_ptr = NULL; - unknown_fn (NULL); - __analyzer_eval (i == 17); /* { dg-warning "UNKNOWN" } */ -} - -static void __attribute__((noinline)) -known_fn (void *ptr) -{ - /* Empty. */ -} - -void test_5 (void) -{ - int i; - - i = 42; - __analyzer_eval (i == 42); /* { dg-warning "TRUE" } */ - - known_fn (&i); - __analyzer_eval (i == 42); /* { dg-warning "TRUE" } */ - - i = 17; - __analyzer_eval (i == 17); /* { dg-warning "TRUE" } */ - - /* Ensure that we don't consider &i to have escaped. */ - unknown_fn (NULL); - __analyzer_eval (i == 17); /* { dg-warning "TRUE" } */ -} - -extern int __attribute__ ((__pure__)) -unknown_pure_fn (void *); - -void test_6 (void) -{ - int i; - - i = 42; - __analyzer_eval (i == 42); /* { dg-warning "TRUE" } */ - - unknown_pure_fn (&i); - __analyzer_eval (i == 42); /* { dg-warning "TRUE" } */ - - i = 17; - __analyzer_eval (i == 17); /* { dg-warning "TRUE" } */ - - /* Ensure that we don't consider &i to have escaped. */ - unknown_fn (NULL); - __analyzer_eval (i == 17); /* { dg-warning "TRUE" } */ -} - -extern void unknown_const_fn (const void *); - -void test_7 (void) -{ - int i; - - i = 42; - __analyzer_eval (i == 42); /* { dg-warning "TRUE" } */ - - /* &i is passed as a const void *, so i shouldn't be clobbered by - the call. */ - unknown_const_fn (&i); - __analyzer_eval (i == 42); /* { dg-warning "TRUE" } */ - - i = 17; - __analyzer_eval (i == 17); /* { dg-warning "TRUE" } */ - - /* Ensure that we don't consider &i to have escaped. */ - unknown_fn (NULL); - __analyzer_eval (i == 17); /* { dg-warning "TRUE" } */ -} - -struct used_by_test_8 -{ - int *int_ptr; -}; - -void test_8 (void) -{ - int i; - - i = 42; - __analyzer_eval (i == 42); /* { dg-warning "TRUE" } */ - - struct used_by_test_8 st8; - st8.int_ptr = &i; - - /* Although unknown_const_fn takes a const void *, the - int_ptr is a non-const int *, and so &i should be considered - writable. */ - unknown_const_fn (&st8); - __analyzer_eval (i == 42); /* { dg-warning "UNKNOWN" } */ - - i = 17; - __analyzer_eval (i == 17); /* { dg-warning "TRUE" } */ - - /* &i should be considered to have escaped. */ - unknown_fn (NULL); - __analyzer_eval (i == 17); /* { dg-warning "UNKNOWN" } */ -} diff --git a/gcc/testsuite/gcc.dg/analyzer/unknown-fns-3.c b/gcc/testsuite/gcc.dg/analyzer/unknown-fns-3.c deleted file mode 100644 index 095df5e..0000000 --- a/gcc/testsuite/gcc.dg/analyzer/unknown-fns-3.c +++ /dev/null @@ -1,67 +0,0 @@ -/* Tests for handling constraints on results of unknown fns. */ - -#include -#include "analyzer-decls.h" - -void unknown_fn (void *); - -void test_1 (void) -{ - int i; - unknown_fn (&i); - if (i) - __analyzer_eval (i); /* { dg-warning "TRUE" } */ - else - __analyzer_eval (i); /* { dg-warning "FALSE" } */ - __analyzer_dump_exploded_nodes (0); /* { dg-warning "1 processed enode" } */ -} - -struct foo -{ - int i; - int j; -}; - -void test_2 (void) -{ - struct foo f; - unknown_fn (&f); - if (f.j) - __analyzer_eval (f.j); /* { dg-warning "TRUE" } */ - else - __analyzer_eval (f.j); /* { dg-warning "FALSE" } */ - __analyzer_dump_exploded_nodes (0); /* { dg-warning "1 processed enode" } */ -} - -void test_3 (int flag) -{ - int i; - unknown_fn (&i); - if (i) - { - __analyzer_eval (i); /* { dg-warning "TRUE" } */ - if (flag) - __analyzer_eval (flag); /* { dg-warning "TRUE" } */ - else - __analyzer_eval (flag); /* { dg-warning "FALSE" } */ - } - else - __analyzer_eval (i); /* { dg-warning "FALSE" } */ - if (flag) - __analyzer_eval (flag); /* { dg-warning "TRUE" } */ - else - __analyzer_eval (flag); /* { dg-warning "FALSE" } */ - __analyzer_dump_exploded_nodes (0); /* { dg-warning "1 processed enode" } */ -} - -void test_4 (int y) -{ - int x; - unknown_fn (&x); - if (x) - { - __analyzer_eval (x); /* { dg-warning "TRUE" } */ - x = 0; - } - __analyzer_dump_exploded_nodes (0); /* { dg-warning "1 processed enode" } */ -} diff --git a/gcc/testsuite/gcc.dg/analyzer/unknown-fns-4.c b/gcc/testsuite/gcc.dg/analyzer/unknown-fns-4.c deleted file mode 100644 index bd1ab1e..0000000 --- a/gcc/testsuite/gcc.dg/analyzer/unknown-fns-4.c +++ /dev/null @@ -1,15 +0,0 @@ -#include "analyzer-decls.h" - -int get(void); -void test (void) -{ - int got = 0; - while (1) - { - if (get ()) - got = 1; - else - if (got) - __analyzer_dump_path (); /* { dg-message "path" } */ - } -} diff --git a/gcc/testsuite/gcc.dg/analyzer/unused-local-1.c b/gcc/testsuite/gcc.dg/analyzer/unused-local-1.c deleted file mode 100644 index 361cdce..0000000 --- a/gcc/testsuite/gcc.dg/analyzer/unused-local-1.c +++ /dev/null @@ -1,22 +0,0 @@ -/* { dg-additional-options "-fdump-analyzer-untracked" } */ - -struct st -{ - const char *m_filename; - int m_line; - const char *m_function; -}; - -extern void debug (struct st *); - -void test (void) -{ - { - static struct st s1 = { __FILE__, __LINE__, __func__ }; /* { dg-warning "track 's1': no" } */ - debug (&s1); - } - { - static struct st s2 = { __FILE__, __LINE__, __func__ }; /* { dg-warning "track 's2': no" } */ - debug (&s2); - } -} diff --git a/gcc/testsuite/gcc.dg/analyzer/use-after-free-2.c b/gcc/testsuite/gcc.dg/analyzer/use-after-free-2.c deleted file mode 100644 index fc138ee..0000000 --- a/gcc/testsuite/gcc.dg/analyzer/use-after-free-2.c +++ /dev/null @@ -1,8 +0,0 @@ -int test (void) -{ - int *ptr = (int *)__builtin_malloc (sizeof (int)); - *ptr = 42; /* { dg-warning "dereference of possibly-NULL 'ptr'" } */ - __builtin_free (ptr); - - return *ptr; /* { dg-warning "use after 'free' of 'ptr'" "use-after-free" } */ -} diff --git a/gcc/testsuite/gcc.dg/analyzer/use-after-free-3.c b/gcc/testsuite/gcc.dg/analyzer/use-after-free-3.c deleted file mode 100644 index b19fd3d..0000000 --- a/gcc/testsuite/gcc.dg/analyzer/use-after-free-3.c +++ /dev/null @@ -1,12 +0,0 @@ -#include - -void test_1 (int x, int y, int *out) -{ - int *ptr = (int *)malloc (sizeof (int)); - if (!ptr) - return; - *ptr = 19; - - free (ptr); - *out = *ptr; /* { dg-warning "use after 'free' of 'ptr'" } */ -} diff --git a/gcc/testsuite/gcc.dg/analyzer/vsnprintf-1.c b/gcc/testsuite/gcc.dg/analyzer/vsnprintf-1.c deleted file mode 100644 index 209c4b6..0000000 --- a/gcc/testsuite/gcc.dg/analyzer/vsnprintf-1.c +++ /dev/null @@ -1,11 +0,0 @@ -typedef __SIZE_TYPE__ size_t; - -int -my_snprintf(char *pos, size_t left, const char *fmt, ...) -{ - __builtin_va_list ap; - __builtin_va_start(ap, fmt); - const int len = __builtin_vsnprintf(pos, left, fmt, ap); - __builtin_va_end(ap); - return len; -} diff --git a/gcc/testsuite/gcc.dg/analyzer/zlib-1.c b/gcc/testsuite/gcc.dg/analyzer/zlib-1.c deleted file mode 100644 index 171af3d..0000000 --- a/gcc/testsuite/gcc.dg/analyzer/zlib-1.c +++ /dev/null @@ -1,64 +0,0 @@ -#include "analyzer-decls.h" - -typedef void (*free_func)(void *opaque, void *address); - -typedef struct z_stream_s { - struct internal_state *state; - free_func zfree; - void *opaque; -} z_stream; - -struct internal_state { - z_stream *strm; - int status; - unsigned char *pending_buf; - unsigned char *window; - unsigned short *prev; - unsigned short *head; -}; - -int deflateEnd(z_stream *strm) -{ - int status; - - __analyzer_dump_exploded_nodes (0); /* { dg-warning "1 processed enode" } */ - - if (strm == 0 || strm->state == 0) - return (-2); - - __analyzer_dump_exploded_nodes (0); /* { dg-warning "1 processed enode" } */ - - status = strm->state->status; - if (status != 42 && status != 113 && status != 666) { - return (-2); - } - - __analyzer_dump_exploded_nodes (0); /* { dg-warning "1 processed enode" } */ - - if (strm->state->pending_buf) - (*(strm->zfree))(strm->opaque, (void *)(strm->state->pending_buf)); - - __analyzer_dump_exploded_nodes (0); /* { dg-warning "1 processed enode" } */ - - if (strm->state->head) - (*(strm->zfree))(strm->opaque, (void *)(strm->state->head)); - - __analyzer_dump_exploded_nodes (0); /* { dg-warning "1 processed enode" } */ - - if (strm->state->prev) - (*(strm->zfree))(strm->opaque, (void *)(strm->state->prev)); - - __analyzer_dump_exploded_nodes (0); /* { dg-warning "1 processed enode" } */ - - if (strm->state->window) - (*(strm->zfree))(strm->opaque, (void *)(strm->state->window)); - - __analyzer_dump_exploded_nodes (0); /* { dg-warning "1 processed enode" } */ - - (*(strm->zfree))(strm->opaque, (void *)(strm->state)); - strm->state = 0; - - __analyzer_dump_exploded_nodes (0); /* { dg-warning "1 processed enode" } */ - - return status == 113 ? (-3) : 0; -} diff --git a/gcc/testsuite/gcc.dg/analyzer/zlib-2.c b/gcc/testsuite/gcc.dg/analyzer/zlib-2.c deleted file mode 100644 index 62163a0..0000000 --- a/gcc/testsuite/gcc.dg/analyzer/zlib-2.c +++ /dev/null @@ -1,49 +0,0 @@ -typedef void * (*alloc_func)(void * opaque, unsigned items, unsigned size); -typedef void (*free_func)(void * opaque, void * address); - -typedef struct z_stream_s { - char *msg; - alloc_func zalloc; - free_func zfree; - void * opaque; -} z_stream; - -void * zcalloc(void * opaque, unsigned items, unsigned size); -void zcfree(void * opaque, void * ptr); - -int deflateInit2_(z_stream *strm, int level, int method, int windowBits, - int memLevel, int strategy, const char *version, - int stream_size) { - int noheader = 0; - static const char *my_version = "1.1.3"; - - if (version == 0 || version[0] != my_version[0] || - stream_size != sizeof(z_stream)) { - return (-6); - } - if (strm == 0) - return (-2); - - strm->msg = 0; - if (strm->zalloc == 0) { - strm->zalloc = zcalloc; - strm->opaque = (void *)0; - } - if (strm->zfree == 0) - strm->zfree = zcfree; - - if (level == (-1)) - level = 6; - - if (windowBits < 0) { - noheader = 1; - windowBits = -windowBits; - } - if (memLevel < 1 || memLevel > 9 || method != 8 || windowBits < 8 || - windowBits > 15 || level < 0 || level > 9 || strategy < 0 || - strategy > 2) { - return (-2); - } - (*((strm)->zalloc))((strm)->opaque, (1), 112); - return 0; -} diff --git a/gcc/testsuite/gcc.dg/analyzer/zlib-4.c b/gcc/testsuite/gcc.dg/analyzer/zlib-4.c deleted file mode 100644 index ae2f6c9..0000000 --- a/gcc/testsuite/gcc.dg/analyzer/zlib-4.c +++ /dev/null @@ -1,24 +0,0 @@ -#include -#include - -typedef unsigned char Byte; -typedef unsigned int uInt; -typedef unsigned long uLong; - -#define Z_NULL 0 - -int test () -{ - uLong comprLen = 10000*sizeof(int); - uLong uncomprLen = comprLen; - Byte *compr = (Byte*)calloc((uInt)comprLen, 1); - Byte *uncompr = (Byte*)calloc((uInt)uncomprLen, 1); - if (compr == Z_NULL || uncompr == Z_NULL) - { - return 1; /* { dg-warning "leak of 'uncompr'" "uncompr leak" } */ - /* { dg-warning "leak of 'compr'" "compr leak" { target *-*-* } .-1 } */ - } - strcpy((char*)uncompr, "garbage"); - return 0; /* { dg-warning "leak of 'uncompr'" "uncompr leak" } */ - /* { dg-warning "leak of 'compr'" "compr leak" { target *-*-* } .-1 } */ -} diff --git a/gcc/testsuite/gcc.dg/analyzer/zlib-5.c b/gcc/testsuite/gcc.dg/analyzer/zlib-5.c deleted file mode 100644 index 1e3746d..0000000 --- a/gcc/testsuite/gcc.dg/analyzer/zlib-5.c +++ /dev/null @@ -1,51 +0,0 @@ -/* { dg-additional-options "-O3" } */ - -#include "analyzer-decls.h" - -typedef __SIZE_TYPE__ size_t; -typedef unsigned char Byte; -typedef unsigned int uInt; -typedef unsigned long uLong; - -extern size_t strlen(const char *__s) __attribute__((__nothrow__, __leaf__)) - __attribute__((__pure__)) __attribute__((__nonnull__(1))); -extern void exit(int __status) __attribute__((__nothrow__, __leaf__)) - __attribute__((__noreturn__)); -extern char *strcpy(char *__restrict __dest, const char *__restrict __src) - __attribute__((__nothrow__, __leaf__)) __attribute__((__nonnull__(1, 2))); -extern void *calloc(size_t __nmemb, size_t __size) - __attribute__((__nothrow__, __leaf__)) __attribute__((__malloc__)); - -extern int compress(Byte *dest, uLong *destLen, const Byte *source, - uLong sourceLen); - -const char hello[] = "hello, hello!"; - -void test_compress(Byte *compr, uLong comprLen, Byte *uncompr, - uLong uncomprLen) { - int err; - uLong len = strlen(hello) + 1; - - err = compress(compr, &comprLen, (const Byte *)hello, len); - if (err != 0) - exit(1); - strcpy((char *)uncompr, "garbage"); /* { dg-bogus "NULL" } */ -} - -int main(int argc, char *argv[]) { - Byte *compr, *uncompr; - uLong comprLen = 10000 * sizeof(int); - uLong uncomprLen = comprLen; - - compr = (Byte *)calloc((uInt)comprLen, 1); - uncompr = (Byte *)calloc((uInt)uncomprLen, 1); - if (compr == 0 || uncompr == 0) - exit(1); - - __analyzer_dump_exploded_nodes (0); /* { dg-warning "1 processed enode" } */ - - test_compress(compr, comprLen, uncompr, uncomprLen); - - exit(0); - return 0; -} -- cgit v1.1