In current versions of GLib, g_new() may expand into g_malloc_n(),
which we don't model. When it does, Coverity can't see the memory
allocation. Similarly for g_new0(), g_renew(), g_try_new(),
g_try_new0(), g_try_renew().
Model g_try_malloc_n(), g_malloc_n(), g_try_malloc0_n(),
g_malloc0_n(), g_try_realloc_n(). To avoid undue duplication, rewrite
the existing memory allocation models on top of them.
In my local testing, this gets rid of false positives. But it also
adds a few, and has a few other effects I can't explain. Posting as
RFC, will follow up with details.
Signed-off-by: Markus Armbruster <arm...@redhat.com>
---
scripts/coverity-model.c | 80 ++++++++++++++++++++++++++++++------------------
1 file changed, 50 insertions(+), 30 deletions(-)
diff --git a/scripts/coverity-model.c b/scripts/coverity-model.c
index 4c99a85..4e5508a 100644
--- a/scripts/coverity-model.c
+++ b/scripts/coverity-model.c
@@ -112,55 +112,75 @@ void *calloc(size_t, size_t);
void *realloc(void *, size_t);
void free(void *);
-void *
-g_malloc(size_t n_bytes)
+void *g_try_malloc_n(size_t nmemb, size_t size)
{
- void *mem;
- __coverity_negative_sink__(n_bytes);
- mem = malloc(n_bytes == 0 ? 1 : n_bytes);
- if (!mem) __coverity_panic__();
- return mem;
+ size_t sz;
+
+ __coverity_negative_sink__(nmemb);
+ __coverity_negative_sink__(size);
+ sz = nmemb * size;
+ return malloc(sz == 0 ? 1 : sz);
}
-void *
-g_malloc0(size_t n_bytes)
+void *g_malloc_n(size_t nmemb, size_t size)
{
- void *mem;
- __coverity_negative_sink__(n_bytes);
- mem = calloc(1, n_bytes == 0 ? 1 : n_bytes);
- if (!mem) __coverity_panic__();
- return mem;
+ void *ptr = g_try_malloc_n(nmemb, size);
+
+ if (!ptr) __coverity_panic__();
+ return ptr;
}
-void g_free(void *mem)
+void *g_try_malloc0_n(size_t nmemb, size_t size)
{
- free(mem);
+ if (nmemb == 0 || size == 0) {
+ return malloc(1);
+ }
+ return calloc(nmemb, size);
}
-void *g_realloc(void * mem, size_t n_bytes)
+void *g_malloc0_n(size_t nmemb, size_t size)
{
- __coverity_negative_sink__(n_bytes);
- mem = realloc(mem, n_bytes == 0 ? 1 : n_bytes);
- if (!mem) __coverity_panic__();
- return mem;
+ void *ptr = g_try_malloc0_n(nmemb, size);
+
+ if (!ptr) __coverity_panic__();
+ return ptr;
+}
+
+void *g_malloc(size_t size)
+{
+ return g_malloc_n(1, size);
+}
+
+void *g_malloc0(size_t size)
+{
+ return g_malloc0_n(1, size);
+}
+
+void *g_try_realloc_n(void *ptr, size_t nmemb, size_t size)
+{
+ size_t sz;
+
+ __coverity_negative_sink__(nmemb);
+ __coverity_negative_sink__(size);
+ sz = nmemb * size;
+ return realloc(ptr, sz == 0 ? 1 : sz);
}
-void *g_try_malloc(size_t n_bytes)
+void *g_try_realloc(void *ptr, size_t size)
{
- __coverity_negative_sink__(n_bytes);
- return malloc(n_bytes == 0 ? 1 : n_bytes);
+ return g_try_realloc_n(ptr, 1, size);
}
-void *g_try_malloc0(size_t n_bytes)
+void *g_realloc(void *ptr, size_t size)
{
- __coverity_negative_sink__(n_bytes);
- return calloc(1, n_bytes == 0 ? 1 : n_bytes);
+ ptr = g_try_realloc(ptr, size);
+ if (!ptr) __coverity_panic__();
+ return ptr;
}
-void *g_try_realloc(void *mem, size_t n_bytes)
+void g_free(void *ptr)
{
- __coverity_negative_sink__(n_bytes);
- return realloc(mem, n_bytes == 0 ? 1 : n_bytes);
+ free(ptr);
}
/* Other glib functions */
--
1.9.3
