[PATCH] D27599: [analyzer] Teach the analyzer that pointers can escape into __cxa_demangle

[Anna Zaks via Phabricator via cfe-commits]

zaks.anna created this revision.
zaks.anna added a reviewer: dergachev.a.
zaks.anna added subscribers: dcoughlin, cfe-commits.

This fixes a reported false positive in the malloc checker.


https://reviews.llvm.org/D27599

Files:
  lib/StaticAnalyzer/Core/CallEvent.cpp
  test/Analysis/Inputs/system-header-simulator-cxx.h
  test/Analysis/malloc.cpp


Index: test/Analysis/malloc.cpp
===================================================================
--- test/Analysis/malloc.cpp
+++ test/Analysis/malloc.cpp
@@ -1,5 +1,7 @@
 // RUN: %clang_cc1 -analyze -analyzer-checker=core,alpha.deadcode.UnreachableCode,alpha.core.CastSize,unix.Malloc -analyzer-store=region -verify %s
 
+#include "Inputs/system-header-simulator-cxx.h"
+
 typedef __typeof(sizeof(int)) size_t;
 void *malloc(size_t);
 void free(void *);
@@ -105,4 +107,16 @@
 void fooNested(const char* name) {
   char* getterName = strdup(name);
   appendWrapperNested(getterName); // no-warning
-}
\ No newline at end of file
+}
+
+// Allow __cxa_demangle to escape.
+char* test_cxa_demangle(const char* sym) {
+  size_t funcnamesize = 256;
+  char* funcname = (char*)malloc(funcnamesize);
+  int status;
+  char* ret = abi::__cxa_demangle(sym, funcname, &funcnamesize, &status);
+  if (status == 0) {
+    funcname = ret;
+  }
+  return funcname; // no-warning
+}
Index: test/Analysis/Inputs/system-header-simulator-cxx.h
===================================================================
--- test/Analysis/Inputs/system-header-simulator-cxx.h
+++ test/Analysis/Inputs/system-header-simulator-cxx.h
@@ -240,3 +240,12 @@
 void* operator new[] (std::size_t size, void* ptr) throw() { return ptr; };
 void operator delete (void* ptr, void*) throw() {};
 void operator delete[] (void* ptr, void*) throw() {};
+
+namespace __cxxabiv1 {
+extern "C" {
+extern char *__cxa_demangle(const char *mangled_name,
+                            char *output_buffer,
+                            size_t *length,
+                            int *status);
+}}
+namespace abi = __cxxabiv1;
Index: lib/StaticAnalyzer/Core/CallEvent.cpp
===================================================================
--- lib/StaticAnalyzer/Core/CallEvent.cpp
+++ lib/StaticAnalyzer/Core/CallEvent.cpp
@@ -382,6 +382,11 @@
   if (II->isStr("funopen"))
     return true;
 
+  // - __cxa_demangle - can reallocate memory and can return the pointer to
+  // the input buffer.
+  if (II->isStr("__cxa_demangle"))
+    return true;
+
   StringRef FName = II->getName();
 
   // - CoreFoundation functions that end with "NoCopy" can free a passed-in


-------------- next part --------------
A non-text attachment was scrubbed...
Name: D27599.80842.patch
Type: text/x-patch
Size: 2218 bytes
Desc: not available
URL: <http://lists.llvm.org/pipermail/cfe-commits/attachments/20161209/439fb831/attachment-0001.bin>