From patchwork Fri Mar 3 23:04:59 2023 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: David Malcolm X-Patchwork-Id: 64099 Return-Path: Delivered-To: ouuuleilei@gmail.com Received: by 2002:a5d:5915:0:0:0:0:0 with SMTP id v21csp669935wrd; Fri, 3 Mar 2023 15:05:50 -0800 (PST) X-Google-Smtp-Source: AK7set9t8/xJZs5sszNaejnGHaPTLsvo+P21qqf8dbxIXBZJOx91BwQStaAW1gnHZk10iBat1NsS X-Received: by 2002:a50:ee86:0:b0:4af:6c25:f04f with SMTP id f6-20020a50ee86000000b004af6c25f04fmr3008132edr.36.1677884749941; Fri, 03 Mar 2023 15:05:49 -0800 (PST) ARC-Seal: i=1; a=rsa-sha256; t=1677884749; cv=none; d=google.com; s=arc-20160816; b=TKYDhscwsMI//pR42QJsXCajI4VQMlq2NMLB3i3PWwqcETqAPOeJRW8ot14IilDkcS X+dDbqKfttTGjFTqwYXKyXfhUUyrPFhIUK78y5PxDwjhmoJ1Wa33c0qoKEmmaRtN2XxY YK9HfkcmMHzqp74FqndCrxnEMdJ6ZKTAXweiwvXEUGBrDl0g0vmTKfNwmgLNm/Y6AdhE yDp5FmFHEQaXYt4Wr2x6BQfgzSXmMcaxT1RrSOpzP5FGxKtPTN+a/Bw12yV/eCkqI7zJ sR6Da+XWMsHj1RsuwnblAIx5lkWovh0a8AGS38ruX6OB5ioFsBKBSn2r+VNIP6rNR5F0 iHvA== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=arc-20160816; h=sender:errors-to:reply-to:from:list-subscribe:list-help:list-post :list-archive:list-unsubscribe:list-id:precedence :content-transfer-encoding:mime-version:message-id:date:subject:cc :to:dmarc-filter:delivered-to:dkim-signature:dkim-filter; bh=yhnguHDOQPLvsa4Ibu0AgWh/LT570UztDdqU5YarRSI=; b=NiNRshL3/nBX/mLLj3MKSwp/AC0o8poMvRwSwoN0XAlTOTy9K6QfTSZmZXSW+N92eO Yj84wuPFD85Hn6rTXMu5ZOATEfbG8TcIHE+pFp59tZrlTOmwoBK47Wa2mUjmsRe+lcOW r0izBeGw6PXZPosCoDWFMQSIf5PR7MbqIlrkN+tOiYDS5+0XUpOHjQ7CLcUCh60Ryy5i rNwaZsECUdQ+ZgRsKaIdZP8K3Zskjz1jKPwUZsQVD9ZYHPqjeFffO0qX1qNO6egcV874 tZlAoOm6LePaQkF1exsrJXsAg19gKl+l7XhvV3GSiX633C0+5haxJ4trFn+2IRv+hYt0 mDFQ== ARC-Authentication-Results: i=1; mx.google.com; dkim=pass header.i=@gcc.gnu.org header.s=default header.b=hazXbMdN; spf=pass (google.com: domain of gcc-patches-bounces+ouuuleilei=gmail.com@gcc.gnu.org designates 2620:52:3:1:0:246e:9693:128c as permitted sender) smtp.mailfrom="gcc-patches-bounces+ouuuleilei=gmail.com@gcc.gnu.org"; dmarc=pass (p=NONE sp=NONE dis=NONE) header.from=gnu.org Received: from sourceware.org (server2.sourceware.org. [2620:52:3:1:0:246e:9693:128c]) by mx.google.com with ESMTPS id n16-20020aa7db50000000b004ce1d99975bsi1422164edt.93.2023.03.03.15.05.49 for (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Fri, 03 Mar 2023 15:05:49 -0800 (PST) Received-SPF: pass (google.com: domain of gcc-patches-bounces+ouuuleilei=gmail.com@gcc.gnu.org designates 2620:52:3:1:0:246e:9693:128c as permitted sender) client-ip=2620:52:3:1:0:246e:9693:128c; Authentication-Results: mx.google.com; dkim=pass header.i=@gcc.gnu.org header.s=default header.b=hazXbMdN; spf=pass (google.com: domain of gcc-patches-bounces+ouuuleilei=gmail.com@gcc.gnu.org designates 2620:52:3:1:0:246e:9693:128c as permitted sender) smtp.mailfrom="gcc-patches-bounces+ouuuleilei=gmail.com@gcc.gnu.org"; dmarc=pass (p=NONE sp=NONE dis=NONE) header.from=gnu.org Received: from server2.sourceware.org (localhost [IPv6:::1]) by sourceware.org (Postfix) with ESMTP id 6E2AC3858C74 for ; Fri, 3 Mar 2023 23:05:48 +0000 (GMT) DKIM-Filter: OpenDKIM Filter v2.11.0 sourceware.org 6E2AC3858C74 DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gcc.gnu.org; s=default; t=1677884748; bh=yhnguHDOQPLvsa4Ibu0AgWh/LT570UztDdqU5YarRSI=; h=To:Cc:Subject:Date:List-Id:List-Unsubscribe:List-Archive: List-Post:List-Help:List-Subscribe:From:Reply-To:From; b=hazXbMdNBnP/AJwGmGMtLcJumNTpJ4nyZlR2FRAepK4r0FGh0iNSrjqnpbxbLiBTh 1GPB3wGea5Xt/qzaaPPmiNnkQWJy93YiJJmmF8QayfpM/pYaaWZ46Cwrw/cJEFaxpe eC+wBx8yGjNvve/+z4rn4uuAdAEucWbzax2+XteY= X-Original-To: gcc-patches@gcc.gnu.org Delivered-To: gcc-patches@gcc.gnu.org Received: from us-smtp-delivery-124.mimecast.com (us-smtp-delivery-124.mimecast.com [170.10.133.124]) by sourceware.org (Postfix) with ESMTPS id D16BB3858D28 for ; Fri, 3 Mar 2023 23:05:01 +0000 (GMT) DMARC-Filter: OpenDMARC Filter v1.4.2 sourceware.org D16BB3858D28 Received: from mimecast-mx02.redhat.com (mimecast-mx02.redhat.com [66.187.233.88]) by relay.mimecast.com with ESMTP with STARTTLS (version=TLSv1.2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id us-mta-136-68o0QHrbOTqJGMwfgIhixg-1; Fri, 03 Mar 2023 18:05:00 -0500 X-MC-Unique: 68o0QHrbOTqJGMwfgIhixg-1 Received: from smtp.corp.redhat.com (int-mx01.intmail.prod.int.rdu2.redhat.com [10.11.54.1]) (using TLSv1.2 with cipher AECDH-AES256-SHA (256/256 bits)) (No client certificate requested) by mimecast-mx02.redhat.com (Postfix) with ESMTPS id 3E15C87B2A2 for ; Fri, 3 Mar 2023 23:05:00 +0000 (UTC) Received: from t14s.localdomain.com (unknown [10.2.16.186]) by smtp.corp.redhat.com (Postfix) with ESMTP id 0EB1B40CF8EF; Fri, 3 Mar 2023 23:05:00 +0000 (UTC) To: gcc-patches@gcc.gnu.org Cc: David Malcolm Subject: [committed] analyzer: provide placeholder implementation of sprintf Date: Fri, 3 Mar 2023 18:04:59 -0500 Message-Id: <20230303230459.2730864-1-dmalcolm@redhat.com> MIME-Version: 1.0 X-Scanned-By: MIMEDefang 3.1 on 10.11.54.1 X-Mimecast-Spam-Score: 0 X-Mimecast-Originator: redhat.com X-Spam-Status: No, score=-11.5 required=5.0 tests=BAYES_00, DKIMWL_WL_HIGH, DKIM_SIGNED, DKIM_VALID, DKIM_VALID_AU, DKIM_VALID_EF, GIT_PATCH_0, RCVD_IN_DNSWL_NONE, RCVD_IN_MSPIKE_H2, SPF_HELO_NONE, SPF_NONE, TXREP autolearn=ham autolearn_force=no version=3.4.6 X-Spam-Checker-Version: SpamAssassin 3.4.6 (2021-04-09) on server2.sourceware.org X-BeenThere: gcc-patches@gcc.gnu.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: Gcc-patches mailing list List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-Patchwork-Original-From: David Malcolm via Gcc-patches From: David Malcolm Reply-To: David Malcolm Errors-To: gcc-patches-bounces+ouuuleilei=gmail.com@gcc.gnu.org Sender: "Gcc-patches" X-getmail-retrieved-from-mailbox: =?utf-8?q?INBOX?= X-GMAIL-THRID: =?utf-8?q?1759389679883707465?= X-GMAIL-MSGID: =?utf-8?q?1759389679883707465?= Previously, the analyzer lacked a known_function implementation of sprintf, and thus would handle calls to sprintf with the "anything could happen" fallback. Whilst working on PR analyzer/107565 I noticed that this was preventing a lot of genuine memory leaks from being reported for Doom; fixing thusly. Integration testing of the effect of the patch shows a big increase in true positives due to the case mentioned in Doom, and one new false positive (in pcre2), which I'm tracking as PR analyzer/109014. Comparison: GOOD: 67 -> 123 (+56); 10.91% -> 18.33% BAD: 547 -> 548 (+1) where the affected warnings/projects are: -Wanalyzer-malloc-leak: GOOD: 0 -> 56 (+56); 0.00% -> 41.48% BAD: 79 True positives: 0 -> 56 (+56) (all in Doom) -Wanalyzer-use-of-uninitialized-value: GOOD: 0; 0.00% BAD: 80 -> 81 (+1) False positives: pcre2-10.42: 0 -> 1 (+1) Successfully bootstrapped & regrtested on x86_64-pc-linux-gnu. Pushed to trunk as r13-6466-g56572a08ec4a0f. gcc/analyzer/ChangeLog: * kf.cc (class kf_sprintf): New. (register_known_functions): Register it. gcc/testsuite/ChangeLog: * gcc.dg/analyzer/doom-d_main-IdentifyVersion.c: New test. * gcc.dg/analyzer/sprintf-1.c: New test. * gcc.dg/analyzer/sprintf-concat.c: New test. Signed-off-by: David Malcolm --- gcc/analyzer/kf.cc | 29 ++ .../analyzer/doom-d_main-IdentifyVersion.c | 272 ++++++++++++++++++ gcc/testsuite/gcc.dg/analyzer/sprintf-1.c | 64 +++++ .../gcc.dg/analyzer/sprintf-concat.c | 35 +++ 4 files changed, 400 insertions(+) create mode 100644 gcc/testsuite/gcc.dg/analyzer/doom-d_main-IdentifyVersion.c create mode 100644 gcc/testsuite/gcc.dg/analyzer/sprintf-1.c create mode 100644 gcc/testsuite/gcc.dg/analyzer/sprintf-concat.c diff --git a/gcc/analyzer/kf.cc b/gcc/analyzer/kf.cc index 3a91b6bd6eb..c4485153e1b 100644 --- a/gcc/analyzer/kf.cc +++ b/gcc/analyzer/kf.cc @@ -778,6 +778,34 @@ kf_strchr::impl_call_post (const call_details &cd) const } } +/* Handler for "sprintf". + int sprintf(char *str, const char *format, ...); +*/ + +class kf_sprintf : public known_function +{ +public: + bool matches_call_types_p (const call_details &cd) const final override + { + return (cd.num_args () >= 2 + && cd.arg_is_pointer_p (0) + && cd.arg_is_pointer_p (1)); + } + + void impl_call_pre (const call_details &cd) const final override + { + /* For now, merely assume that the destination buffer gets set to a + new svalue. */ + region_model *model = cd.get_model (); + region_model_context *ctxt = cd.get_ctxt (); + const svalue *dst_ptr = cd.get_arg_svalue (0); + const region *dst_reg + = model->deref_rvalue (dst_ptr, cd.get_arg_tree (0), ctxt); + const svalue *content = cd.get_or_create_conjured_svalue (dst_reg); + model->set_value (dst_reg, content, ctxt); + } +}; + /* Handler for "__builtin_stack_restore". */ class kf_stack_restore : public known_function @@ -990,6 +1018,7 @@ register_known_functions (known_function_manager &kfm) kfm.add (BUILT_IN_MEMSET, make_unique ()); kfm.add (BUILT_IN_MEMSET_CHK, make_unique ()); kfm.add (BUILT_IN_REALLOC, make_unique ()); + kfm.add (BUILT_IN_SPRINTF, make_unique ()); kfm.add (BUILT_IN_STACK_RESTORE, make_unique ()); kfm.add (BUILT_IN_STACK_SAVE, make_unique ()); kfm.add (BUILT_IN_STRCHR, make_unique ()); diff --git a/gcc/testsuite/gcc.dg/analyzer/doom-d_main-IdentifyVersion.c b/gcc/testsuite/gcc.dg/analyzer/doom-d_main-IdentifyVersion.c new file mode 100644 index 00000000000..982b9b74349 --- /dev/null +++ b/gcc/testsuite/gcc.dg/analyzer/doom-d_main-IdentifyVersion.c @@ -0,0 +1,272 @@ +/* Reduced from Doom's d_main.c, which is under the GPLv2 or later. */ + +/* { dg-additional-options "-Wno-analyzer-too-complex" } */ + +typedef __SIZE_TYPE__ size_t; +typedef struct _IO_FILE FILE; + +extern int +printf(const char* __restrict, ...); + +extern int +sprintf(char* __restrict __s, const char* __restrict, ...) + __attribute__((__nothrow__)); + +extern void* +malloc(size_t __size) __attribute__((__nothrow__, __leaf__)) +__attribute__((__malloc__)) __attribute__((__alloc_size__(1))); +extern char* +getenv(const char* __name) __attribute__((__nothrow__, __leaf__)) +__attribute__((__nonnull__(1))); +extern int +access(const char* __name, int __type) __attribute__((__nothrow__, __leaf__)) +__attribute__((__nonnull__(1))); +extern char* +strcpy(char* __restrict __dest, const char* __restrict __src) + __attribute__((__nothrow__, __leaf__)) __attribute__((__nonnull__(1, 2))); +extern size_t +strlen(const char* __s) __attribute__((__nothrow__, __leaf__)) +__attribute__((__pure__)) __attribute__((__nonnull__(1))); + +typedef enum +{ + shareware, + registered, + commercial, + + retail, + indetermined + +} GameMode_t; + +typedef enum +{ + doom, + doom2, + pack_tnt, + pack_plut, + none + +} GameMission_t; + +typedef enum +{ + english, + french, + german, + unknown + +} Language_t; + +typedef enum +{ + false, + true +} boolean; + +extern boolean devparm; +extern GameMode_t gamemode; +extern Language_t language; +extern char basedefault[1024]; +int +M_CheckParm(char* check); +void +I_Error(char* error, ...); + +extern char* wadfiles[20]; + +void +D_AddFile(char* file) +{ + int numwadfiles; + char* newfile; + + for (numwadfiles = 0; wadfiles[numwadfiles]; numwadfiles++) + ; + + newfile = malloc(strlen(file) + 1); + strcpy(newfile, file); /* { dg-warning "use of possibly-NULL 'newfile' where non-null expected" } */ + + wadfiles[numwadfiles] = newfile; +} + +void +IdentifyVersion(void) +{ + + char* doom1wad; + char* doomwad; + char* doomuwad; + char* doom2wad; + + char* doom2fwad; + char* plutoniawad; + char* tntwad; + + char* home; + char* doomwaddir; + doomwaddir = getenv("DOOMWADDIR"); + if (!doomwaddir) + doomwaddir = "."; + + doom2wad = malloc(strlen(doomwaddir) + 1 + 9 + 1); + sprintf(doom2wad, "%s/doom2.wad", doomwaddir); /* { dg-warning "possibly-NULL 'doom2wad'" } */ + + doomuwad = malloc(strlen(doomwaddir) + 1 + 8 + 1); + sprintf(doomuwad, "%s/doomu.wad", doomwaddir); /* { dg-warning "possibly-NULL 'doomuwad'" } */ + + doomwad = malloc(strlen(doomwaddir) + 1 + 8 + 1); + sprintf(doomwad, "%s/doom.wad", doomwaddir); /* { dg-warning "possibly-NULL 'doomwad'" } */ + + doom1wad = malloc(strlen(doomwaddir) + 1 + 9 + 1); + sprintf(doom1wad, "%s/doom1.wad", doomwaddir); /* { dg-warning "possibly-NULL 'doom1wad'" } */ + + plutoniawad = malloc(strlen(doomwaddir) + 1 + 12 + 1); + sprintf(plutoniawad, "%s/plutonia.wad", doomwaddir); /* { dg-warning "possibly-NULL 'plutoniawad'" } */ + + tntwad = malloc(strlen(doomwaddir) + 1 + 9 + 1); + sprintf(tntwad, "%s/tnt.wad", doomwaddir); /* { dg-warning "possibly-NULL 'tntwad'" } */ + + doom2fwad = malloc(strlen(doomwaddir) + 1 + 10 + 1); + sprintf(doom2fwad, "%s/doom2f.wad", doomwaddir); /* { dg-warning "possibly-NULL 'doom2fwad'" } */ + + home = getenv("HOME"); + if (!home) + I_Error("Please set $HOME to your home directory"); + sprintf(basedefault, "%s/.doomrc", home); + + if (M_CheckParm("-shdev")) { + gamemode = shareware; + devparm = true; + D_AddFile("devdata" + "doom1.wad"); + D_AddFile("devmaps" + "data_se/texture1.lmp"); + D_AddFile("devmaps" + "data_se/pnames.lmp"); + strcpy(basedefault, + "devdata" + "default.cfg"); + return; /* { dg-warning "leak of 'doom2wad'" } */ + /* { dg-warning "leak of 'doomuwad'" "leak" { target *-*-* } .-1 } */ + /* { dg-warning "leak of 'doomwad'" "leak" { target *-*-* } .-2 } */ + /* { dg-warning "leak of 'doom1wad'" "leak" { target *-*-* } .-3 } */ + /* { dg-warning "leak of 'plutoniawad'" "leak" { target *-*-* } .-4 } */ + /* { dg-warning "leak of 'tntwad'" "leak" { target *-*-* } .-5 } */ + /* { dg-warning "leak of 'doom2fwad'" "leak" { target *-*-* } .-6 } */ + } + + if (M_CheckParm("-regdev")) { + gamemode = registered; + devparm = true; + D_AddFile("devdata" + "doom.wad"); + D_AddFile("devmaps" + "data_se/texture1.lmp"); + D_AddFile("devmaps" + "data_se/texture2.lmp"); + D_AddFile("devmaps" + "data_se/pnames.lmp"); + strcpy(basedefault, + "devdata" + "default.cfg"); + return; /* { dg-warning "leak of 'doom2wad'" } */ + /* { dg-warning "leak of 'doomuwad'" "leak" { target *-*-* } .-1 } */ + /* { dg-warning "leak of 'doomwad'" "leak" { target *-*-* } .-2 } */ + /* { dg-warning "leak of 'doom1wad'" "leak" { target *-*-* } .-3 } */ + /* { dg-warning "leak of 'plutoniawad'" "leak" { target *-*-* } .-4 } */ + /* { dg-warning "leak of 'tntwad'" "leak" { target *-*-* } .-5 } */ + /* { dg-warning "leak of 'doom2fwad'" "leak" { target *-*-* } .-6 } */ + } + + if (M_CheckParm("-comdev")) { + gamemode = commercial; + devparm = true; + + D_AddFile("devdata" + "doom2.wad"); + + D_AddFile("devmaps" + "cdata/texture1.lmp"); + D_AddFile("devmaps" + "cdata/pnames.lmp"); + strcpy(basedefault, + "devdata" + "default.cfg"); + return; /* { dg-warning "leak of 'doom2wad'" } */ + /* { dg-warning "leak of 'doomuwad'" "leak" { target *-*-* } .-1 } */ + /* { dg-warning "leak of 'doomwad'" "leak" { target *-*-* } .-2 } */ + /* { dg-warning "leak of 'doom1wad'" "leak" { target *-*-* } .-3 } */ + /* { dg-warning "leak of 'plutoniawad'" "leak" { target *-*-* } .-4 } */ + /* { dg-warning "leak of 'tntwad'" "leak" { target *-*-* } .-5 } */ + /* { dg-warning "leak of 'doom2fwad'" "leak" { target *-*-* } .-6 } */ + } + + if (!access(doom2fwad, 4)) { + gamemode = commercial; + + language = french; + printf("French version\n"); + D_AddFile(doom2fwad); + return; /* { dg-warning "leak of 'doom2wad'" } */ + /* { dg-warning "leak of 'doomuwad'" "leak" { target *-*-* } .-1 } */ + /* { dg-warning "leak of 'doomwad'" "leak" { target *-*-* } .-2 } */ + /* { dg-warning "leak of 'doom1wad'" "leak" { target *-*-* } .-3 } */ + /* { dg-warning "leak of 'plutoniawad'" "leak" { target *-*-* } .-4 } */ + /* { dg-warning "leak of 'tntwad'" "leak" { target *-*-* } .-5 } */ + /* { dg-warning "leak of 'doom2fwad'" "leak" { target *-*-* } .-6 } */ + } + + if (!access(doom2wad, 4)) { + gamemode = commercial; + D_AddFile(doom2wad); + return; /* { dg-warning "leak of 'doom2wad'" } */ + /* { dg-warning "leak of 'doomuwad'" "leak" { target *-*-* } .-1 } */ + /* { dg-warning "leak of 'doomwad'" "leak" { target *-*-* } .-2 } */ + /* { dg-warning "leak of 'doom1wad'" "leak" { target *-*-* } .-3 } */ + /* { dg-warning "leak of 'plutoniawad'" "leak" { target *-*-* } .-4 } */ + /* { dg-warning "leak of 'tntwad'" "leak" { target *-*-* } .-5 } */ + /* { dg-warning "leak of 'doom2fwad'" "leak" { target *-*-* } .-6 } */ + } + + if (!access(plutoniawad, 4)) { + gamemode = commercial; + D_AddFile(plutoniawad); + return; /* { dg-warning "leak of 'doom2wad'" } */ + /* { dg-warning "leak of 'doomuwad'" "leak" { target *-*-* } .-1 } */ + /* { dg-warning "leak of 'doomwad'" "leak" { target *-*-* } .-2 } */ + /* { dg-warning "leak of 'doom1wad'" "leak" { target *-*-* } .-3 } */ + /* { dg-warning "leak of 'plutoniawad'" "leak" { target *-*-* } .-4 } */ + /* { dg-warning "leak of 'tntwad'" "leak" { target *-*-* } .-5 } */ + /* { dg-warning "leak of 'doom2fwad'" "leak" { target *-*-* } .-6 } */ + } + + if (!access(tntwad, 4)) { + gamemode = commercial; + D_AddFile(tntwad); + return; /* { dg-warning "leak of 'doom2wad'" } */ + /* { dg-warning "leak of 'doomuwad'" "leak" { target *-*-* } .-1 } */ + /* { dg-warning "leak of 'doomwad'" "leak" { target *-*-* } .-2 } */ + /* { dg-warning "leak of 'doom1wad'" "leak" { target *-*-* } .-3 } */ + /* { dg-warning "leak of 'plutoniawad'" "leak" { target *-*-* } .-4 } */ + /* { dg-warning "leak of 'tntwad'" "leak" { target *-*-* } .-5 } */ + /* { dg-warning "leak of 'doom2fwad'" "leak" { target *-*-* } .-6 } */ + } + + if (!access(doomuwad, 4)) { + gamemode = retail; + D_AddFile(doomuwad); + return; /* { dg-warning "leak of 'doom2wad'" } */ + /* { dg-warning "leak of 'doomuwad'" "leak" { target *-*-* } .-1 } */ + /* { dg-warning "leak of 'doomwad'" "leak" { target *-*-* } .-2 } */ + /* { dg-warning "leak of 'doom1wad'" "leak" { target *-*-* } .-3 } */ + /* { dg-warning "leak of 'plutoniawad'" "leak" { target *-*-* } .-4 } */ + /* { dg-warning "leak of 'tntwad'" "leak" { target *-*-* } .-5 } */ + /* { dg-warning "leak of 'doom2fwad'" "leak" { target *-*-* } .-6 } */ + } + + /* [...snip...] */ + + printf("Game mode indeterminate.\n"); + gamemode = indetermined; +} diff --git a/gcc/testsuite/gcc.dg/analyzer/sprintf-1.c b/gcc/testsuite/gcc.dg/analyzer/sprintf-1.c new file mode 100644 index 00000000000..c79525d912f --- /dev/null +++ b/gcc/testsuite/gcc.dg/analyzer/sprintf-1.c @@ -0,0 +1,64 @@ +/* See e.g. https://en.cppreference.com/w/c/io/fprintf + and https://www.man7.org/linux/man-pages/man3/sprintf.3.html */ + +extern int +sprintf(char* dst, const char* fmt, ...) + __attribute__((__nothrow__)); + +#define NULL ((void *)0) + +int +test_passthrough (char* dst, const char* fmt) +{ + /* This assumes that fmt doesn't have any arguments. */ + return sprintf (dst, fmt); +} + +void +test_known (void) +{ + char buf[10]; + int res = sprintf (buf, "foo"); + /* TODO: ideally we would know the value of "res" is 3, + and known the content and strlen of "buf" after the call */ +} + +int +test_null_dst (void) +{ + return sprintf (NULL, "hello world"); /* { dg-warning "use of NULL where non-null expected" } */ +} + +int +test_null_fmt (char *dst) +{ + return sprintf (dst, NULL); /* { dg-warning "use of NULL where non-null expected" } */ +} + +int +test_uninit_dst (void) +{ + char *dst; + return sprintf (dst, "hello world"); /* { dg-warning "use of uninitialized value 'dst'" } */ +} + +int +test_uninit_fmt_ptr (char *dst) +{ + const char *fmt; + return sprintf (dst, fmt); /* { dg-warning "use of uninitialized value 'fmt'" } */ +} + +int +test_uninit_fmt_buf (char *dst) +{ + const char fmt[10]; + return sprintf (dst, fmt); // TODO (PR analyzer/105899): complain about "fmt" not being initialized +} + +int +test_fmt_not_terminated (char *dst) +{ + const char fmt[3] = "foo"; + return sprintf (dst, fmt); // TODO (PR analyzer/105899): complain about "fmt" not being terminated +} diff --git a/gcc/testsuite/gcc.dg/analyzer/sprintf-concat.c b/gcc/testsuite/gcc.dg/analyzer/sprintf-concat.c new file mode 100644 index 00000000000..0094f3e6449 --- /dev/null +++ b/gcc/testsuite/gcc.dg/analyzer/sprintf-concat.c @@ -0,0 +1,35 @@ +typedef __SIZE_TYPE__ size_t; +#define NULL ((void *)0) + +extern size_t +strlen(const char* __s) __attribute__((__nothrow__, __leaf__)) +__attribute__((__pure__)) __attribute__((__nonnull__(1))); + +extern void* +malloc(size_t __size) __attribute__((__nothrow__, __leaf__)) +__attribute__((__malloc__)) __attribute__((__alloc_size__(1))); + +extern int +sprintf(char* __restrict __s, const char* __restrict, ...) + __attribute__((__nothrow__)); + +char * +test_1 (const char *a, const char *b) +{ + size_t sz = strlen (a) + strlen (b) + 2; + char *p = malloc (sz); + if (!p) + return NULL; + sprintf (p, "%s/%s", a, b); + return p; +} + +void +test_2 (const char *a, const char *b) +{ + size_t sz = strlen (a) + strlen (b) + 2; + char *p = malloc (sz); /* { dg-message "allocated here" } */ + if (!p) + return; + sprintf (p, "%s/%s", a, b); /* { dg-warning "leak of 'p' " } */ +}