File tree Expand file tree Collapse file tree 3 files changed +21
-34
lines changed
lib/StaticAnalyzer/Checkers Expand file tree Collapse file tree 3 files changed +21
-34
lines changed Original file line number Diff line number Diff line change @@ -1096,13 +1096,15 @@ static bool isStandardNewDelete(const FunctionDecl *FD) {
10961096 Kind != OO_Array_Delete)
10971097 return false ;
10981098
1099+ bool HasBody = FD->hasBody (); // Prefer using the definition.
1100+
10991101 // This is standard if and only if it's not defined in a user file.
11001102 SourceLocation L = FD->getLocation ();
1103+
11011104 // If the header for operator delete is not included, it's still defined
11021105 // in an invalid source location. Check to make sure we don't crash.
1103- return !L.isValid () ||
1104- (!FD->hasBody () && // FIXME: Still a false alarm after CTU inlining.
1105- FD->getASTContext ().getSourceManager ().isInSystemHeader (L));
1106+ const auto &SM = FD->getASTContext ().getSourceManager ();
1107+ return L.isInvalid () || (!HasBody && SM.isInSystemHeader (L));
11061108}
11071109
11081110// ===----------------------------------------------------------------------===//
Original file line number Diff line number Diff line change 11#ifndef OVERLOADED_DELETE_IN_HEADER
22#define OVERLOADED_DELETE_IN_HEADER
33
4- void clang_analyzer_printState ();
5-
64struct DeleteInHeader {
7- inline void operator delete (void * ptr ) {
8- // No matter whether this header file is included as a system header file
9- // with -isystem or a user header file with -I, ptr should not be marked as
10- // released.
11- clang_analyzer_printState ();
12-
13- ::operator delete (ptr ); // The first place where ptr is marked as released.
14- }
5+ int data ;
6+ static void operator delete (void * ptr );
157};
168
9+ void DeleteInHeader ::operator delete (void * ptr ) {
10+ DeleteInHeader * self = (DeleteInHeader * )ptr ;
11+ self -> data = 1 ; // no-warning: Still alive.
12+
13+ ::operator delete (ptr );
14+
15+ self -> data = 2 ; // expected-warning {{Use of memory after it is freed [cplusplus.NewDelete]}}
16+ }
17+
1718#endif // OVERLOADED_DELETE_IN_SYSTEM_HEADER
Original file line number Diff line number Diff line change 1- // issue 62985
2- // When 3rd-party header files are included as system headers, their overloaded
3- // new and delete operators are also considered as the std ones. However, those
4- // overloaded operator functions will also be inlined. This makes the same
5- // symbolic memory marked as released twice, which leads to a false uaf alarm.
6- //
7- // The first run, include as system header. False uaf report before fix.
8- //
9- // RUN: %clang_analyze_cc1 %s \
10- // RUN: -analyzer-checker=core,cplusplus.NewDelete,debug.ExprInspection \
11- // RUN: -isystem %S/Inputs/ 2>&1 | \
12- // RUN: FileCheck %s
13- //
14- // The second run, include as user header. Should always silent.
15- //
16- // RUN: %clang_analyze_cc1 %s \
17- // RUN: -analyzer-checker=core,cplusplus.NewDelete,debug.ExprInspection \
18- // RUN: -I %S/Inputs/ 2>&1 | \
19- // RUN: FileCheck %s
1+ // RUN: %clang_analyze_cc1 -isystem %S/Inputs/ -verify %s \
2+ // RUN: -analyzer-checker=core,unix.Malloc,cplusplus.NewDelete
3+
4+ // RUN: %clang_analyze_cc1 -I %S/Inputs/ -verify %s \
5+ // RUN: -analyzer-checker=core,unix.Malloc,cplusplus.NewDelete
206
217#include " overloaded-delete-in-header.h"
228
239void deleteInHeader (DeleteInHeader *p) { delete p; }
24-
25- // CHECK-NOT: Released
You can’t perform that action at this time.
0 commit comments