https://github.com/NagyDonat created
https://github.com/llvm/llvm-project/pull/128508
Before commit 6e17ed9 the test files `outofbound.c` and `outofbound-notwork.c`
tested the behavior of the old alpha checker `alpha.security.ArrayBound` (V1);
then that commit converted them into tests for the checker
`security.ArrayBound` which was previously called `alpha.security.ArrayBoundV2`.
This commit removes these test files and migrates their useful content to
`out-of-bounds.c`. The file `outofbound.c` contained lots of testcases that
covered features which are also covered in `out-of-bounds.c` or
`out-of-bounds-diagnostics.c`; those redundant cases are discarded during this
migration process.
This is part of a commit series that reorganizes the tests of
`security.ArrayBound` to system that's easier to understand and maintain.
From 35761c4a7b306316d7d40dec76f49c1f86c1590e Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Don=C3=A1t=20Nagy?= <donat.n...@ericsson.com>
Date: Mon, 24 Feb 2025 13:59:18 +0100
Subject: [PATCH] [NFC][analyzer] OOB test consolidation III: 'outofbound'
tests
Before commit 6e17ed9 the test files `outofbound.c` and
`outofbound-notwork.c` tested the behavior of the old alpha checker
`alpha.security.ArrayBound` (V1); then that commit converted them into
tests for the checker `security.ArrayBound` which was previously called
`alpha.security.ArrayBoundV2`.
This commit removes these test files and migrates their useful content
to `out-of-bounds.c`. The file `outofbound.c` contained lots of
testcases that covered features which are also covered in
`out-of-bounds.c` or `out-of-bounds-diagnostics.c`; those redundant
cases are discarded during this migration process.
This is part of a commit series that reorganizes the tests of
`security.ArrayBound` to system that's easier to understand and
maintain.
---
clang/test/Analysis/out-of-bounds.c | 50 +++++++++
clang/test/Analysis/outofbound-notwork.c | 32 ------
clang/test/Analysis/outofbound.c | 130 -----------------------
3 files changed, 50 insertions(+), 162 deletions(-)
delete mode 100644 clang/test/Analysis/outofbound-notwork.c
delete mode 100644 clang/test/Analysis/outofbound.c
diff --git a/clang/test/Analysis/out-of-bounds.c
b/clang/test/Analysis/out-of-bounds.c
index 7d6cb4ecf1b24..2174dafc0021b 100644
--- a/clang/test/Analysis/out-of-bounds.c
+++ b/clang/test/Analysis/out-of-bounds.c
@@ -217,3 +217,53 @@ int test_negative_offset_with_unsigned_idx(void) {
unsigned idx = 2u;
return p[idx]; // expected-warning {{Out of bound access to memory
preceding}}
}
+
+struct three_words { int c[3]; };
+struct seven_words { int c[7]; };
+void partially_in_bounds(void) {
+ struct seven_words c;
+ struct three_words a, *p = (struct three_words *)&c;
+ p[0] = a; // no-warning
+ p[1] = a; // no-warning
+ p[2] = a; // should warn
+ // FIXME: This is an overflow, but currently security.ArrayBound only checks
+ // that the _beginning_ of the accessed element is within bounds.
+}
+
+void vla(int a) {
+ if (a == 5) {
+ int x[a];
+ x[4] = 4; // no-warning
+ x[5] = 5; // expected-warning{{Out of bound access}}
+ }
+}
+
+void sizeof_vla(int a) {
+ // FIXME: VLA modeling is not good enough to cover this case.
+ if (a == 5) {
+ char x[a];
+ int y[sizeof(x)];
+ y[4] = 4; // no-warning
+ y[5] = 5; // should be {{Out of bounds access}}
+ }
+}
+
+void sizeof_vla_2(int a) {
+ // FIXME: VLA modeling is not good enough to cover this case.
+ if (a == 5) {
+ char x[a];
+ int y[sizeof(x) / sizeof(char)];
+ y[4] = 4; // no-warning
+ y[5] = 5; // should be {{Out of bounds access}}
+ }
+}
+
+void sizeof_vla_3(int a) {
+ // FIXME: VLA modeling is not good enough to cover this case.
+ if (a == 5) {
+ char x[a];
+ int y[sizeof(*&*&*&x)];
+ y[4] = 4; // no-warning
+ y[5] = 5; // should be {{Out of bounds access}}
+ }
+}
diff --git a/clang/test/Analysis/outofbound-notwork.c
b/clang/test/Analysis/outofbound-notwork.c
deleted file mode 100644
index 1318c07bbf2a8..0000000000000
--- a/clang/test/Analysis/outofbound-notwork.c
+++ /dev/null
@@ -1,32 +0,0 @@
-// RUN: %clang_analyze_cc1 -Wno-array-bounds
-analyzer-checker=core,security.ArrayBound -verify %s
-// XFAIL: *
-
-// Once we better handle modeling of sizes of VLAs, we can pull this back
-// into outofbound.c.
-
-void sizeof_vla(int a) {
- if (a == 5) {
- char x[a];
- int y[sizeof(x)];
- y[4] = 4; // no-warning
- y[5] = 5; // expected-warning{{Out of bounds access}}
- }
-}
-
-void sizeof_vla_2(int a) {
- if (a == 5) {
- char x[a];
- int y[sizeof(x) / sizeof(char)];
- y[4] = 4; // no-warning
- y[5] = 5; // expected-warning{{Out of bounds access}}
- }
-}
-
-void sizeof_vla_3(int a) {
- if (a == 5) {
- char x[a];
- int y[sizeof(*&*&*&x)];
- y[4] = 4; // no-warning
- y[5] = 5; // expected-warning{{Out of bounds access}}
- }
-}
diff --git a/clang/test/Analysis/outofbound.c b/clang/test/Analysis/outofbound.c
deleted file mode 100644
index d3d8ff2b2f0ed..0000000000000
--- a/clang/test/Analysis/outofbound.c
+++ /dev/null
@@ -1,130 +0,0 @@
-// RUN: %clang_analyze_cc1 -Wno-array-bounds -verify %s \
-// RUN: -analyzer-checker=core \
-// RUN: -analyzer-checker=unix \
-// RUN: -analyzer-checker=security.ArrayBound \
-// RUN: -analyzer-config unix.DynamicMemoryModeling:Optimistic=true
-
-typedef __typeof(sizeof(int)) size_t;
-void *malloc(size_t);
-void *calloc(size_t, size_t);
-
-char f1(void) {
- char* s = "abcd";
- char c = s[4]; // no-warning
- return s[5] + c; // expected-warning{{Out of bound access to memory after}}
-}
-
-void f2(void) {
- int *p = malloc(12);
- p[3] = 4; // expected-warning{{Out of bound access to memory after}}
-}
-
-struct three_words {
- int c[3];
-};
-
-struct seven_words {
- int c[7];
-};
-
-void f3(void) {
- struct three_words a, *p;
- p = &a;
- p[0] = a; // no-warning
- p[1] = a; // expected-warning{{Out of bound access to memory after}}
-}
-
-void f4(void) {
- struct seven_words c;
- struct three_words a, *p = (struct three_words *)&c;
- p[0] = a; // no-warning
- p[1] = a; // no-warning
- p[2] = a; // should warn
- // FIXME: This is an overflow, but currently security.ArrayBound only checks
- // that the _beginning_ of the accessed element is within bounds.
-}
-
-void f5(void) {
- char *p = calloc(2,2);
- p[3] = '.'; // no-warning
- p[4] = '!'; // expected-warning{{Out of bound access}}
-}
-
-void f6(void) {
- char a[2];
- int *b = (int*)a;
- b[1] = 3; // expected-warning{{Out of bound access}}
-}
-
-void f7(void) {
- struct three_words a;
- a.c[3] = 1; // expected-warning{{Out of bound access}}
-}
-
-void vla(int a) {
- if (a == 5) {
- int x[a];
- x[4] = 4; // no-warning
- x[5] = 5; // expected-warning{{Out of bound access}}
- }
-}
-
-void alloca_region(int a) {
- if (a == 5) {
- char *x = __builtin_alloca(a);
- x[4] = 4; // no-warning
- x[5] = 5; // expected-warning{{Out of bound access}}
- }
-}
-
-int symbolic_index(int a) {
- int x[2] = {1, 2};
- if (a == 2) {
- return x[a]; // expected-warning{{Out of bound access}}
- }
- return 0;
-}
-
-int symbolic_index2(int a) {
- int x[2] = {1, 2};
- if (a < 0) {
- return x[a]; // expected-warning{{Out of bound access}}
- }
- return 0;
-}
-
-int overflow_binary_search(double in) {
- int eee = 16;
- if (in < 1e-8 || in > 1e23) {
- return 0;
- } else {
- static const double ins[] = {1e-8, 1e-7, 1e-6, 1e-5, 1e-4, 1e-3, 1e-2,
1e-1,
- 1e0, 1e1, 1e2, 1e3, 1e4, 1e5, 1e6, 1e7,
- 1e8, 1e9, 1e10, 1e11, 1e12, 1e13, 1e14, 1e15,
- 1e16, 1e17, 1e18, 1e19, 1e20, 1e21, 1e22};
- if (in < ins[eee]) {
- eee -= 8;
- } else {
- eee += 8;
- }
- if (in < ins[eee]) {
- eee -= 4;
- } else {
- eee += 4;
- }
- if (in < ins[eee]) {
- eee -= 2;
- } else {
- eee += 2;
- }
- if (in < ins[eee]) {
- eee -= 1;
- } else {
- eee += 1;
- }
- if (in < ins[eee]) { // expected-warning {{Out of bound access}}
- eee -= 1;
- }
- }
- return eee;
-}
_______________________________________________
cfe-commits mailing list
cfe-commits@lists.llvm.org
https://lists.llvm.org/cgi-bin/mailman/listinfo/cfe-commits
