Skip to content

Commit d7e9b88

Browse files
committed
Cleanup test and impl
I'd prefer using the definition of FD to check the beginning brace location.
1 parent 89ca329 commit d7e9b88

File tree

3 files changed

+21
-34
lines changed

3 files changed

+21
-34
lines changed

clang/lib/StaticAnalyzer/Checkers/MallocChecker.cpp

Lines changed: 5 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -1096,13 +1096,15 @@ static bool isStandardNewDelete(const FunctionDecl *FD) {
10961096
Kind != OO_Array_Delete)
10971097
return false;
10981098

1099+
bool HasBody = FD->hasBody(); // Prefer using the definition.
1100+
10991101
// This is standard if and only if it's not defined in a user file.
11001102
SourceLocation L = FD->getLocation();
1103+
11011104
// If the header for operator delete is not included, it's still defined
11021105
// in an invalid source location. Check to make sure we don't crash.
1103-
return !L.isValid() ||
1104-
(!FD->hasBody() && // FIXME: Still a false alarm after CTU inlining.
1105-
FD->getASTContext().getSourceManager().isInSystemHeader(L));
1106+
const auto &SM = FD->getASTContext().getSourceManager();
1107+
return L.isInvalid() || (!HasBody && SM.isInSystemHeader(L));
11061108
}
11071109

11081110
//===----------------------------------------------------------------------===//
Lines changed: 11 additions & 10 deletions
Original file line numberDiff line numberDiff line change
@@ -1,17 +1,18 @@
11
#ifndef OVERLOADED_DELETE_IN_HEADER
22
#define OVERLOADED_DELETE_IN_HEADER
33

4-
void clang_analyzer_printState();
5-
64
struct DeleteInHeader {
7-
inline void operator delete(void *ptr) {
8-
// No matter whether this header file is included as a system header file
9-
// with -isystem or a user header file with -I, ptr should not be marked as
10-
// released.
11-
clang_analyzer_printState();
12-
13-
::operator delete(ptr); // The first place where ptr is marked as released.
14-
}
5+
int data;
6+
static void operator delete(void *ptr);
157
};
168

9+
void DeleteInHeader::operator delete(void *ptr) {
10+
DeleteInHeader *self = (DeleteInHeader *)ptr;
11+
self->data = 1; // no-warning: Still alive.
12+
13+
::operator delete(ptr);
14+
15+
self->data = 2; // expected-warning {{Use of memory after it is freed [cplusplus.NewDelete]}}
16+
}
17+
1718
#endif // OVERLOADED_DELETE_IN_SYSTEM_HEADER
Lines changed: 5 additions & 21 deletions
Original file line numberDiff line numberDiff line change
@@ -1,25 +1,9 @@
1-
// issue 62985
2-
// When 3rd-party header files are included as system headers, their overloaded
3-
// new and delete operators are also considered as the std ones. However, those
4-
// overloaded operator functions will also be inlined. This makes the same
5-
// symbolic memory marked as released twice, which leads to a false uaf alarm.
6-
//
7-
// The first run, include as system header. False uaf report before fix.
8-
//
9-
// RUN: %clang_analyze_cc1 %s \
10-
// RUN: -analyzer-checker=core,cplusplus.NewDelete,debug.ExprInspection \
11-
// RUN: -isystem %S/Inputs/ 2>&1 | \
12-
// RUN: FileCheck %s
13-
//
14-
// The second run, include as user header. Should always silent.
15-
//
16-
// RUN: %clang_analyze_cc1 %s \
17-
// RUN: -analyzer-checker=core,cplusplus.NewDelete,debug.ExprInspection \
18-
// RUN: -I %S/Inputs/ 2>&1 | \
19-
// RUN: FileCheck %s
1+
// RUN: %clang_analyze_cc1 -isystem %S/Inputs/ -verify %s \
2+
// RUN: -analyzer-checker=core,unix.Malloc,cplusplus.NewDelete
3+
4+
// RUN: %clang_analyze_cc1 -I %S/Inputs/ -verify %s \
5+
// RUN: -analyzer-checker=core,unix.Malloc,cplusplus.NewDelete
206

217
#include "overloaded-delete-in-header.h"
228

239
void deleteInHeader(DeleteInHeader *p) { delete p; }
24-
25-
// CHECK-NOT: Released

0 commit comments

Comments
 (0)