1*67e74705SXin Li // RUN: %clang_cc1 -analyze -analyzer-store=region -analyzer-checker=core,unix.Malloc -fblocks -verify %s
2*67e74705SXin Li // RUN: %clang_cc1 -analyze -analyzer-store=region -analyzer-checker=core,unix.Malloc -fblocks -verify -analyzer-config unix.Malloc:Optimistic=true %s
3*67e74705SXin Li typedef __typeof(sizeof(int)) size_t;
4*67e74705SXin Li void free(void *);
5*67e74705SXin Li void *alloca(size_t);
6*67e74705SXin Li
t1()7*67e74705SXin Li void t1 () {
8*67e74705SXin Li int a[] = { 1 };
9*67e74705SXin Li free(a); // expected-warning {{Argument to free() is the address of the local variable 'a', which is not memory allocated by malloc()}}
10*67e74705SXin Li }
11*67e74705SXin Li
t2()12*67e74705SXin Li void t2 () {
13*67e74705SXin Li int a = 1;
14*67e74705SXin Li free(&a); // expected-warning {{Argument to free() is the address of the local variable 'a', which is not memory allocated by malloc()}}
15*67e74705SXin Li }
16*67e74705SXin Li
t3()17*67e74705SXin Li void t3 () {
18*67e74705SXin Li static int a[] = { 1 };
19*67e74705SXin Li free(a); // expected-warning {{Argument to free() is the address of the static variable 'a', which is not memory allocated by malloc()}}
20*67e74705SXin Li }
21*67e74705SXin Li
t4(char * x)22*67e74705SXin Li void t4 (char *x) {
23*67e74705SXin Li free(x); // no-warning
24*67e74705SXin Li }
25*67e74705SXin Li
t5()26*67e74705SXin Li void t5 () {
27*67e74705SXin Li extern char *ptr();
28*67e74705SXin Li free(ptr()); // no-warning
29*67e74705SXin Li }
30*67e74705SXin Li
t6()31*67e74705SXin Li void t6 () {
32*67e74705SXin Li free((void*)1000); // expected-warning {{Argument to free() is a constant address (1000), which is not memory allocated by malloc()}}
33*67e74705SXin Li }
34*67e74705SXin Li
t7(char ** x)35*67e74705SXin Li void t7 (char **x) {
36*67e74705SXin Li free(*x); // no-warning
37*67e74705SXin Li }
38*67e74705SXin Li
t8(char ** x)39*67e74705SXin Li void t8 (char **x) {
40*67e74705SXin Li // ugh
41*67e74705SXin Li free((*x)+8); // no-warning
42*67e74705SXin Li }
43*67e74705SXin Li
t9()44*67e74705SXin Li void t9 () {
45*67e74705SXin Li label:
46*67e74705SXin Li free(&&label); // expected-warning {{Argument to free() is the address of the label 'label', which is not memory allocated by malloc()}}
47*67e74705SXin Li }
48*67e74705SXin Li
t10()49*67e74705SXin Li void t10 () {
50*67e74705SXin Li free((void*)&t10); // expected-warning {{Argument to free() is the address of the function 't10', which is not memory allocated by malloc()}}
51*67e74705SXin Li }
52*67e74705SXin Li
t11()53*67e74705SXin Li void t11 () {
54*67e74705SXin Li char *p = (char*)alloca(2);
55*67e74705SXin Li free(p); // expected-warning {{Memory allocated by alloca() should not be deallocated}}
56*67e74705SXin Li }
57*67e74705SXin Li
t12()58*67e74705SXin Li void t12 () {
59*67e74705SXin Li char *p = (char*)__builtin_alloca(2);
60*67e74705SXin Li free(p); // expected-warning {{Memory allocated by alloca() should not be deallocated}}
61*67e74705SXin Li }
62*67e74705SXin Li
t13()63*67e74705SXin Li void t13 () {
64*67e74705SXin Li free(^{return;}); // expected-warning {{Argument to free() is a block, which is not memory allocated by malloc()}}
65*67e74705SXin Li }
66*67e74705SXin Li
t14(char a)67*67e74705SXin Li void t14 (char a) {
68*67e74705SXin Li free(&a); // expected-warning {{Argument to free() is the address of the parameter 'a', which is not memory allocated by malloc()}}
69*67e74705SXin Li }
70*67e74705SXin Li
71*67e74705SXin Li static int someGlobal[2];
t15()72*67e74705SXin Li void t15 () {
73*67e74705SXin Li free(someGlobal); // expected-warning {{Argument to free() is the address of the global variable 'someGlobal', which is not memory allocated by malloc()}}
74*67e74705SXin Li }
75*67e74705SXin Li
t16(char ** x,int offset)76*67e74705SXin Li void t16 (char **x, int offset) {
77*67e74705SXin Li // Unknown value
78*67e74705SXin Li free(x[offset]); // no-warning
79*67e74705SXin Li }
80