@@ -20,8 +20,6 @@ void test_1 (void *ptr, int a, int b)
}
/* { dg-begin-multiline-output "" }
- NN | free (ptr);
- | ^~~~~~~~~~
'test_1': event 1
|
| NN | calls_free_1 (ptr);
@@ -90,8 +88,6 @@ void test_2 (void *ptr, int a, int b)
}
/* { dg-begin-multiline-output "" }
- NN | free (ptr);
- | ^~~~~~~~~~
'test_2': event 1
|
| NN | calls_free_2 (ptr);
@@ -147,16 +143,11 @@ void test_3 (void *ptr)
/* { dg-begin-multiline-output "" }
NN | free (ptr);
| ^~~~~~~~~~
- 'test_3': events 1-2
- |
- | NN | free (ptr);
- | | ^~~~~~~~~~
- | | |
- | | (1) first 'free' here
- | NN | called_by_test_3 ();
- | NN | free (ptr);
- | | ~~~~~~~~~~
- | | |
- | | (2) second 'free' here; first 'free' was at (1)
- |
+ | |
+ | (1) first 'free' here
+ NN | called_by_test_3 ();
+ NN | free (ptr);
+ | ~~~~~~~~~~
+ | |
+ | (2) second 'free' here; first 'free' was at (1)
{ dg-end-multiline-output "" } */
@@ -20,8 +20,6 @@ void test_1 (void *ptr, int a, int b)
}
/* { dg-begin-multiline-output "" }
- NN | free (ptr);
- | ^~~~~~~~~~
'test_1': events 1-2
|
| NN | void test_1 (void *ptr, int a, int b)
@@ -105,8 +103,6 @@ void test_2 (void *ptr, int a, int b)
}
/* { dg-begin-multiline-output "" }
- NN | free (ptr);
- | ^~~~~~~~~~
'test_2': events 1-2
|
| NN | void test_2 (void *ptr, int a, int b)
@@ -175,16 +171,11 @@ void test_3 (void *ptr)
/* { dg-begin-multiline-output "" }
NN | free (ptr);
| ^~~~~~~~~~
- 'test_3': events 1-2
- |
- | NN | free (ptr);
- | | ^~~~~~~~~~
- | | |
- | | (1) first 'free' here
- | NN | called_by_test_3 ();
- | NN | free (ptr);
- | | ~~~~~~~~~~
- | | |
- | | (2) second 'free' here; first 'free' was at (1)
- |
+ | |
+ | (1) first 'free' here
+ NN | called_by_test_3 ();
+ NN | free (ptr);
+ | ~~~~~~~~~~
+ | |
+ | (2) second 'free' here; first 'free' was at (1)
{ dg-end-multiline-output "" } */
@@ -20,8 +20,6 @@ void test_1 (void *ptr, int a, int b)
}
/* { dg-begin-multiline-output "" }
- NN | free (ptr);
- | ^~~~~~~~~~
'test_1': events 1-4
|
| NN | void test_1 (void *ptr, int a, int b)
@@ -116,8 +114,6 @@ void test_2 (void *ptr, int a, int b)
}
/* { dg-begin-multiline-output "" }
- NN | free (ptr);
- | ^~~~~~~~~~
'test_2': events 1-4
|
| NN | void test_2 (void *ptr, int a, int b)
@@ -206,16 +202,11 @@ void test_3 (void *ptr)
/* { dg-begin-multiline-output "" }
NN | free (ptr);
| ^~~~~~~~~~
- 'test_3': events 1-2
- |
- | NN | free (ptr);
- | | ^~~~~~~~~~
- | | |
- | | (1) first 'free' here
- | NN | called_by_test_3 ();
- | NN | free (ptr);
- | | ~~~~~~~~~~
- | | |
- | | (2) second 'free' here; first 'free' was at (1)
- |
+ | |
+ | (1) first 'free' here
+ NN | called_by_test_3 ();
+ NN | free (ptr);
+ | ~~~~~~~~~~
+ | |
+ | (2) second 'free' here; first 'free' was at (1)
{ dg-end-multiline-output "" } */
@@ -28,8 +28,6 @@ void test (void *ptr)
}
/* { dg-begin-multiline-output "" }
- NN | free (victim);
- | ^~~~~~~~~~~~~
'test': events 1-2
|
| NN | void test (void *ptr)
@@ -46,8 +46,6 @@ void test (int i)
/* double-'free'. */
/* { dg-begin-multiline-output "" }
- NN | free (ptr);
- | ^~~~~~~~~~
'test': events 1-2
|
| NN | void test (int i)
@@ -24,8 +24,6 @@ make_boxed_int (int i)
/* "dereference of possibly-NULL 'result' [CWE-690]". */
/* { dg-begin-multiline-output "" }
- NN | result->i = i;
- | ~~~~~~~~~~^~~
'make_boxed_int': events 1-2
|
| NN | make_boxed_int (int i)
@@ -17,29 +17,21 @@ int test (void *ptr)
/* { dg-regexp "\[^|\]+/malloc-macro.h:\[0-9\]+:\[0-9\]+:" } */
/* { dg-begin-multiline-output "" }
+ event 1
+
+ NN | #define WRAPPED_FREE(PTR) free(PTR)
+ | ^~~~~~~~~
+ | |
+ | (1) first 'free' here
+ NN | WRAPPED_FREE (ptr);
+ | ^~~~~~~~~~~~
+ event 2
+
NN | #define WRAPPED_FREE(PTR) free(PTR)
| ^~~~~~~~~
+ | |
+ | (2) second 'free' here; first 'free' was at (1)
NN | WRAPPED_FREE (ptr);
| ^~~~~~~~~~~~
- 'test': event 1
- |
- |
- | NN | #define WRAPPED_FREE(PTR) free(PTR)
- | | ^~~~~~~~~
- | | |
- | | (1) first 'free' here
- | NN | WRAPPED_FREE (ptr);
- | | ^~~~~~~~~~~~
- |
- 'test': event 2
- |
- |
- | NN | #define WRAPPED_FREE(PTR) free(PTR)
- | | ^~~~~~~~~
- | | |
- | | (2) second 'free' here; first 'free' was at (1)
- | NN | WRAPPED_FREE (ptr);
- | | ^~~~~~~~~~~~
- |
{ dg-end-multiline-output "" } */
}
@@ -9,23 +9,18 @@ void test_1 (void)
free (ptr); /* { dg-warning "double-'free' of 'ptr'" } */
}
/* { dg-begin-multiline-output "" }
+ NN | void *ptr = malloc (1024);
+ | ^~~~~~~~~~~~~
+ | |
+ | (1) allocated here
NN | free (ptr);
- | ^~~~~~~~~~
- 'test_1': events 1-3
- |
- | NN | void *ptr = malloc (1024);
- | | ^~~~~~~~~~~~~
- | | |
- | | (1) allocated here
- | NN | free (ptr);
- | | ~~~~~~~~~~
- | | |
- | | (2) first 'free' here
- | NN | free (ptr);
- | | ~~~~~~~~~~
- | | |
- | | (3) second 'free' here; first 'free' was at (2)
- |
+ | ~~~~~~~~~~
+ | |
+ | (2) first 'free' here
+ NN | free (ptr);
+ | ~~~~~~~~~~
+ | |
+ | (3) second 'free' here; first 'free' was at (2)
{ dg-end-multiline-output "" } */
void test_2 (int x, int y)
@@ -39,62 +34,52 @@ void test_2 (int x, int y)
/* "double-'free' of 'ptr'". */
/* { dg-begin-multiline-output "" }
+ NN | void *ptr = malloc (1024);
+ | ^~~~~~~~~~~~~
+ | |
+ | (1) allocated here
+ NN | if (x)
+ | ~
+ | |
+ | (2) following 'true' branch (when 'x != 0')...
+ NN | free (ptr);
+ | ~~~~~~~~~~
+ | |
+ | (3) ...to here
+ | (4) first 'free' here
+ NN | if (y)
+ | ~
+ | |
+ | (5) following 'true' branch (when 'y != 0')...
NN | free (ptr);
- | ^~~~~~~~~~
- 'test_2': events 1-7
- |
- | NN | void *ptr = malloc (1024);
- | | ^~~~~~~~~~~~~
- | | |
- | | (1) allocated here
- | NN | if (x)
- | | ~
- | | |
- | | (2) following 'true' branch (when 'x != 0')...
- | NN | free (ptr);
- | | ~~~~~~~~~~
- | | |
- | | (3) ...to here
- | | (4) first 'free' here
- | NN | if (y)
- | | ~
- | | |
- | | (5) following 'true' branch (when 'y != 0')...
- | NN | free (ptr);
- | | ~~~~~~~~~~
- | | |
- | | (6) ...to here
- | | (7) second 'free' here; first 'free' was at (4)
- |
+ | ~~~~~~~~~~
+ | |
+ | (6) ...to here
+ | (7) second 'free' here; first 'free' was at (4)
{ dg-end-multiline-output "" } */
/* "leak of 'ptr'. */
/* { dg-begin-multiline-output "" }
+ NN | void *ptr = malloc (1024);
+ | ^~~~~~~~~~~~~
+ | |
+ | (1) allocated here
+ NN | if (x)
+ | ~
+ | |
+ | (2) following 'false' branch (when 'x == 0')...
+ NN | free (ptr);
+ NN | if (y)
+ | ~
+ | |
+ | (3) ...to here
+ | (4) following 'false' branch (when 'y == 0')...
+ NN | free (ptr);
NN | }
- | ^
- 'test_2': events 1-6
- |
- | NN | void *ptr = malloc (1024);
- | | ^~~~~~~~~~~~~
- | | |
- | | (1) allocated here
- | NN | if (x)
- | | ~
- | | |
- | | (2) following 'false' branch (when 'x == 0')...
- | NN | free (ptr);
- | NN | if (y)
- | | ~
- | | |
- | | (3) ...to here
- | | (4) following 'false' branch (when 'y == 0')...
- | NN | free (ptr);
- | NN | }
- | | ~
- | | |
- | | (5) ...to here
- | | (6) 'ptr' leaks here; was allocated at (1)
- |
+ | ~
+ | |
+ | (5) ...to here
+ | (6) 'ptr' leaks here; was allocated at (1)
{ dg-end-multiline-output "" } */
int test_3 (int x, int y)
@@ -117,182 +102,152 @@ int test_3 (int x, int y)
/* "dereference of possibly-NULL 'ptr'". */
/* { dg-begin-multiline-output "" }
+ NN | int *ptr = (int *)malloc (sizeof (int));
+ | ^~~~~~~~~~~~~~~~~~~~~
+ | |
+ | (1) this call could return NULL
NN | *ptr = 42;
- | ~~~~~^~~~
- 'test_3': events 1-2
- |
- | NN | int *ptr = (int *)malloc (sizeof (int));
- | | ^~~~~~~~~~~~~~~~~~~~~
- | | |
- | | (1) this call could return NULL
- | NN | *ptr = 42;
- | | ~~~~~~~~~
- | | |
- | | (2) 'ptr' could be NULL: unchecked value from (1)
- |
+ | ~~~~~~~~~
+ | |
+ | (2) 'ptr' could be NULL: unchecked value from (1)
{ dg-end-multiline-output "" } */
/* "use after 'free' of 'ptr'". */
/* { dg-begin-multiline-output "" }
+ NN | int *ptr = (int *)malloc (sizeof (int));
+ | ^~~~~~~~~~~~~~~~~~~~~
+ | |
+ | (1) allocated here
+ NN | *ptr = 42;
+ | ~~~~~~~~~
+ | |
+ | (2) assuming 'ptr' is non-NULL
+ NN | if (x)
+ | ~
+ | |
+ | (3) following 'true' branch (when 'x != 0')...
+ NN | free (ptr);
+ | ~~~~~~~~~~
+ | |
+ | (4) ...to here
+ | (5) freed here
+ NN |
NN | *ptr = 19;
- | ~~~~~^~~~
- 'test_3': events 1-6
- |
- | NN | int *ptr = (int *)malloc (sizeof (int));
- | | ^~~~~~~~~~~~~~~~~~~~~
- | | |
- | | (1) allocated here
- | NN | *ptr = 42;
- | | ~~~~~~~~~
- | | |
- | | (2) assuming 'ptr' is non-NULL
- | NN | if (x)
- | | ~
- | | |
- | | (3) following 'true' branch (when 'x != 0')...
- | NN | free (ptr);
- | | ~~~~~~~~~~
- | | |
- | | (4) ...to here
- | | (5) freed here
- | NN |
- | NN | *ptr = 19;
- | | ~~~~~~~~~
- | | |
- | | (6) use after 'free' of 'ptr'; freed at (5)
- |
+ | ~~~~~~~~~
+ | |
+ | (6) use after 'free' of 'ptr'; freed at (5)
{ dg-end-multiline-output "" } */
/* "use after 'free' of 'ptr'". */
/* { dg-begin-multiline-output "" }
+ NN | int *ptr = (int *)malloc (sizeof (int));
+ | ^~~~~~~~~~~~~~~~~~~~~
+ | |
+ | (1) allocated here
+ NN | *ptr = 42;
+ | ~~~~~~~~~
+ | |
+ | (2) assuming 'ptr' is non-NULL
+ NN | if (x)
+ | ~
+ | |
+ | (3) following 'false' branch (when 'x == 0')...
+......
+ NN | *ptr = 19;
+ | ~~~~~~~~~
+ | |
+ | (4) ...to here
+......
+ NN | if (y)
+ | ~
+ | |
+ | (5) following 'true' branch (when 'y != 0')...
+ NN | free (ptr);
+ | ~~~~~~~~~~
+ | |
+ | (6) ...to here
+ | (7) freed here
+ NN |
NN | return *ptr;
- | ^~~~
- 'test_3': events 1-8
- |
- | NN | int *ptr = (int *)malloc (sizeof (int));
- | | ^~~~~~~~~~~~~~~~~~~~~
- | | |
- | | (1) allocated here
- | NN | *ptr = 42;
- | | ~~~~~~~~~
- | | |
- | | (2) assuming 'ptr' is non-NULL
- | NN | if (x)
- | | ~
- | | |
- | | (3) following 'false' branch (when 'x == 0')...
- |......
- | NN | *ptr = 19;
- | | ~~~~~~~~~
- | | |
- | | (4) ...to here
- |......
- | NN | if (y)
- | | ~
- | | |
- | | (5) following 'true' branch (when 'y != 0')...
- | NN | free (ptr);
- | | ~~~~~~~~~~
- | | |
- | | (6) ...to here
- | | (7) freed here
- | NN |
- | NN | return *ptr;
- | | ~~~~
- | | |
- | | (8) use after 'free' of 'ptr'; freed at (7)
- |
+ | ~~~~
+ | |
+ | (8) use after 'free' of 'ptr'; freed at (7)
{ dg-end-multiline-output "" } */
/* "leak of 'ptr'". */
/* { dg-begin-multiline-output "" }
+ NN | int *ptr = (int *)malloc (sizeof (int));
+ | ^~~~~~~~~~~~~~~~~~~~~
+ | |
+ | (1) allocated here
+ NN | *ptr = 42;
+ | ~~~~~~~~~
+ | |
+ | (2) assuming 'ptr' is non-NULL
+ NN | if (x)
+ | ~
+ | |
+ | (3) following 'false' branch (when 'x == 0')...
+......
+ NN | *ptr = 19;
+ | ~~~~~~~~~
+ | |
+ | (4) ...to here
+......
+ NN | if (y)
+ | ~
+ | |
+ | (5) following 'false' branch (when 'y == 0')...
+......
NN | return *ptr;
- | ^~~~
- 'test_3': events 1-7
- |
- | NN | int *ptr = (int *)malloc (sizeof (int));
- | | ^~~~~~~~~~~~~~~~~~~~~
- | | |
- | | (1) allocated here
- | NN | *ptr = 42;
- | | ~~~~~~~~~
- | | |
- | | (2) assuming 'ptr' is non-NULL
- | NN | if (x)
- | | ~
- | | |
- | | (3) following 'false' branch (when 'x == 0')...
- |......
- | NN | *ptr = 19;
- | | ~~~~~~~~~
- | | |
- | | (4) ...to here
- |......
- | NN | if (y)
- | | ~
- | | |
- | | (5) following 'false' branch (when 'y == 0')...
- |......
- | NN | return *ptr;
- | | ~~~~
- | | |
- | | (6) ...to here
- | | (7) 'ptr' leaks here; was allocated at (1)
- |
+ | ~~~~
+ | |
+ | (6) ...to here
+ | (7) 'ptr' leaks here; was allocated at (1)
{ dg-end-multiline-output "" } */
/* "use after 'free' of 'ptr'". */
/* { dg-begin-multiline-output "" }
+ NN | if (x)
+ | ^
+ | |
+ | (1) following 'true' branch (when 'x != 0')...
+ NN | free (ptr);
+ | ~~~~~~~~~~
+ | |
+ | (2) ...to here
+ NN |
NN | *ptr = 19;
- | ~~~~~^~~~
- 'test_3': events 1-3
- |
- | NN | if (x)
- | | ^
- | | |
- | | (1) following 'true' branch (when 'x != 0')...
- | NN | free (ptr);
- | | ~~~~~~~~~~
- | | |
- | | (2) ...to here
- | NN |
- | NN | *ptr = 19;
- | | ~~~~~~~~~
- | | |
- | | (3) use after 'free' of 'ptr' here
- |
+ | ~~~~~~~~~
+ | |
+ | (3) use after 'free' of 'ptr' here
{ dg-end-multiline-output "" } */
/* "use after 'free' of 'ptr'". */
/* { dg-begin-multiline-output "" }
+ NN | if (x)
+ | ^
+ | |
+ | (1) following 'false' branch (when 'x == 0')...
+......
+ NN | *ptr = 19;
+ | ~~~~~~~~~
+ | |
+ | (2) ...to here
+......
+ NN | if (y)
+ | ~
+ | |
+ | (3) following 'true' branch (when 'y != 0')...
+ NN | free (ptr);
+ | ~~~~~~~~~~
+ | |
+ | (4) ...to here
+ NN | to dereference it above
NN | return *ptr;
- | ^~~~
- 'test_3': events 1-5
- |
- | NN | if (x)
- | | ^
- | | |
- | | (1) following 'false' branch (when 'x == 0')...
- |......
- | NN | *ptr = 19;
- | | ~~~~~~~~~
- | | |
- | | (2) ...to here
- |......
- | NN | if (y)
- | | ~
- | | |
- | | (3) following 'true' branch (when 'y != 0')...
- | NN | free (ptr);
- | | ~~~~~~~~~~
- | | |
- | | (4) ...to here
- | NN | to dereference it above
- | NN | return *ptr;
- | | ~~~~
- | | |
- | | (5) use after 'free' of 'ptr' here
- |
+ | ~~~~
+ | |
+ | (5) use after 'free' of 'ptr' here
{ dg-end-multiline-output "" } */
/* TODO: this is really a duplicate; can we either eliminate it, or
improve the path? */
@@ -34,51 +34,41 @@ void test_2 (void)
}
/* { dg-begin-multiline-output "" }
+ event 1
+ NN | i = setjmp(env);
+ | ^~~~~~
+ | |
+ | (1) 'setjmp' called here
+ events 2-4
+ NN | if (i != 0)
+ | ^
+ | |
+ | (2) following 'false' branch (when 'i == 0')...
+......
+ NN | longjmp (env, 1);
+ | ~~~~~~~~~~~~~~~~
+ | |
+ | (3) ...to here
+ | (4) rewinding within 'test_2' from 'longjmp'...
+ event 5
+ NN | i = setjmp(env);
+ | ^~~~~~
+ | |
+ | (5) ...to 'setjmp' (saved at (1))
+ events 6-8
+ NN | if (i != 0)
+ | ^
+ | |
+ | (6) following 'true' branch (when 'i != 0')...
+ NN | {
+ NN | foo (2);
+ | ~~~~~~~
+ | |
+ | (7) ...to here
NN | __analyzer_dump_path ();
- | ^~~~~~~~~~~~~~~~~~~~~~~
- 'test_2': event 1
- |
- | NN | i = setjmp(env);
- | | ^~~~~~
- | | |
- | | (1) 'setjmp' called here
- |
- 'test_2': events 2-4
- |
- | NN | if (i != 0)
- | | ^
- | | |
- | | (2) following 'false' branch (when 'i == 0')...
- |......
- | NN | longjmp (env, 1);
- | | ~~~~~~~~~~~~~~~~
- | | |
- | | (3) ...to here
- | | (4) rewinding within 'test_2' from 'longjmp'...
- |
- 'test_2': event 5
- |
- | NN | i = setjmp(env);
- | | ^~~~~~
- | | |
- | | (5) ...to 'setjmp' (saved at (1))
- |
- 'test_2': events 6-8
- |
- | NN | if (i != 0)
- | | ^
- | | |
- | | (6) following 'true' branch (when 'i != 0')...
- | NN | {
- | NN | foo (2);
- | | ~~~~~~~
- | | |
- | | (7) ...to here
- | NN | __analyzer_dump_path ();
- | | ~~~~~~~~~~~~~~~~~~~~~~~
- | | |
- | | (8) here
- |
+ | ~~~~~~~~~~~~~~~~~~~~~~~
+ | |
+ | (8) here
{ dg-end-multiline-output "" } */
void test_3 (void)
@@ -35,8 +35,6 @@ void outer (void)
}
/* { dg-begin-multiline-output "" }
- NN | __analyzer_dump_path ();
- | ^~~~~~~~~~~~~~~~~~~~~~~
'outer': event 1
|
| NN | void outer (void)
@@ -30,8 +30,6 @@ int main (void)
}
/* { dg-begin-multiline-output "" }
- NN | __analyzer_dump_path ();
- | ^~~~~~~~~~~~~~~~~~~~~~~
'main': event 1
|
| NN | int main (void)
@@ -21,8 +21,6 @@ void outer (void)
}
/* { dg-begin-multiline-output "" }
- NN | longjmp (env, 42);
- | ^~~~~~~~~~~~~~~~~
'outer': events 1-2
|
| NN | void outer (void)
@@ -37,8 +37,6 @@ void outer (void)
}
/* { dg-begin-multiline-output "" }
- NN | longjmp (env, 1);
- | ^~~~~~~~~~~~~~~~
'outer': event 1
|
| NN | void outer (void)
@@ -36,8 +36,6 @@ void outer (void)
}
/* { dg-begin-multiline-output "" }
- NN | __analyzer_dump_path ();
- | ^~~~~~~~~~~~~~~~~~~~~~~
'outer': event 1
|
| NN | void outer (void)
@@ -38,8 +38,6 @@ void outer (void)
}
/* { dg-begin-multiline-output "" }
- NN | __analyzer_dump_path ();
- | ^~~~~~~~~~~~~~~~~~~~~~~
'outer': event 1
|
| NN | void outer (void)
@@ -28,8 +28,6 @@ void test (void)
/* "call to 'fprintf' from within signal handler [CWE-479]". */
/* { dg-begin-multiline-output "" }
- NN | fprintf(stderr, "LOG: %s", msg);
- | ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
'test': events 1-2
|
| NN | void test (void)
@@ -31,8 +31,6 @@ void test (void)
/* "call to 'fprintf' from within signal handler [CWE-479]". */
/* { dg-begin-multiline-output "" }
- NN | fprintf(stderr, "LOG: %s", msg);
- | ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
'test': events 1-2
|
| NN | void test (void)