[clang] [analyzer] Match dangling subobjects by their base region in DanglingPtrDeref (PR #211552)
via cfe-commits
cfe-commits at lists.llvm.org
Fri Jul 24 05:53:55 PDT 2026
================
@@ -112,3 +112,105 @@ void inlined_callee_single_report() {
// expected-note at -1 {{Calling 'deref_param'}}
(void)r;
}
+
+struct MyBuffer {
+ char buffer[8];
+};
+struct MyStruct { int x; };
+struct Inner { int x; };
+struct Outer { struct Inner inner; };
+
+char member_subregion_dangling_deref() {
+ const char *p = nullptr;
+ {
+ struct MyBuffer tmp_buffer = {};
+ p = tmp_buffer.buffer;
+ }
+ // expected-note at -1 {{'tmp_buffer.buffer[0]' is destroyed here}}
----------------
isuckatcs wrote:
What is going to be spelled if `p` is incremented ( `++p`)? Do we track it properly that it now points to `tmp_buffer.buffer[1]`?
https://github.com/llvm/llvm-project/pull/211552
More information about the cfe-commits
mailing list