[analyzer] Detect use-after-free for field address (e.g., &ptr->field)

clang/lib/StaticAnalyzer/Checkers/MallocChecker.cpp

@@ -3156,8 +3156,14 @@ void MallocChecker::checkPreCall(const CallEvent &Call,
   for (unsigned I = 0, E = Call.getNumArgs(); I != E; ++I) {
     SVal ArgSVal = Call.getArgSVal(I);
     if (isa<Loc>(ArgSVal)) {
-      SymbolRef Sym = ArgSVal.getAsSymbol();
-      if (!Sym)
+      const MemRegion *MR = ArgSVal.getAsRegion();
+      if (!MR)
+        continue;
+      const MemRegion *BaseRegion = MR->getBaseRegion();
+      SymbolRef Sym = nullptr;
+      if (const auto *SR = dyn_cast<SymbolicRegion>(BaseRegion))
+        Sym = SR->getSymbol();
+      if (!Sym) 
         continue;
       if (checkUseAfterFree(Sym, C, Call.getArgExpr(I)))
         return;

clang/test/Analysis/malloc-checker-arg-uaf.c

@@ -0,0 +1,44 @@
+// RUN: %clang_analyze_cc1 -analyzer-checker=unix.Malloc -verify %s
+
+#include "Inputs/system-header-simulator-for-malloc.h"
+
+struct Obj {
+  int field;
+};
+
+void use(void *ptr);
+
+void test_direct_param_uaf() {
+  int *p = (int *)malloc(sizeof(int));
+  free(p);
+  use(p); // expected-warning{{Use of memory after it is freed}}
+}
+
+void test_struct_field_uaf() {
+  struct Obj *o = (struct Obj *)malloc(sizeof(struct Obj));
+  free(o);
+  use(&o->field); // expected-warning{{Use of memory after it is freed}}
+}
+
+void test_no_warning_const_int() {
+  use((void *)0x1234); // no-warning
+}
+
+void test_no_warning_stack() {
+  int x = 42;
+  use(&x); // no-warning
+}
+
+void test_nested_alloc() {
+  struct Obj *o = (struct Obj *)malloc(sizeof(struct Obj));
+  use(o);   // no-warning
+  free(o);
+  use(o);   // expected-warning{{Use of memory after it is freed}}
+}
+
+void test_nested_field() {
+    struct Obj *o = malloc(sizeof(struct Obj));
+    int *f = &o->field;
+    free(o);
+    use(f); // expected-warning{{Use of memory after it is freed}}
+}