[cfe-commits] r151368 - in /cfe/trunk: lib/StaticAnalyzer/Core/ExprEngineCallAndReturn.cpp test/Analysis/malloc-interprocedural.c

[Anna Zaks]

Author: zaks
Date: Fri Feb 24 10:49:41 2012
New Revision: 151368

URL: http://llvm.org/viewvc/llvm-project?rev=151368&view=rev
Log:
[analyzer] We were silently stopping exploring the path after
visiting 'return;' statement!

This most likely caused us to skip a bunch of code when analyzing with
inlining.

Modified:
    cfe/trunk/lib/StaticAnalyzer/Core/ExprEngineCallAndReturn.cpp
    cfe/trunk/test/Analysis/malloc-interprocedural.c

Modified: cfe/trunk/lib/StaticAnalyzer/Core/ExprEngineCallAndReturn.cpp
URL: http://llvm.org/viewvc/llvm-project/cfe/trunk/lib/StaticAnalyzer/Core/ExprEngineCallAndReturn.cpp?rev=151368&r1=151367&r2=151368&view=diff
==============================================================================
--- cfe/trunk/lib/StaticAnalyzer/Core/ExprEngineCallAndReturn.cpp (original)
+++ cfe/trunk/lib/StaticAnalyzer/Core/ExprEngineCallAndReturn.cpp Fri Feb 24 10:49:41 2012
@@ -432,7 +432,4 @@
       B.generateNode(RS, *it, (*it)->getState());
     }
   }
-  else {
-    B.takeNodes(dstPreVisit);
-  }
 }

Modified: cfe/trunk/test/Analysis/malloc-interprocedural.c
URL: http://llvm.org/viewvc/llvm-project/cfe/trunk/test/Analysis/malloc-interprocedural.c?rev=151368&r1=151367&r2=151368&view=diff
==============================================================================
--- cfe/trunk/test/Analysis/malloc-interprocedural.c (original)
+++ cfe/trunk/test/Analysis/malloc-interprocedural.c Fri Feb 24 10:49:41 2012
@@ -69,3 +69,19 @@
   int *data;
   my_free1((int*)data);
 }
+
+// Test that we keep processing after 'return;'
+void fooWithEmptyReturn(int x) {
+  if (x)
+    return;
+  x++;
+  return;
+}
+
+int uafAndCallsFooWithEmptyReturn() {
+  int *x = (int*)malloc(12);
+  free(x);
+  fooWithEmptyReturn(12);
+  return *x; // expected-warning {{Use of memory after it is freed}}
+}
+