[cfe-dev] Clang static analyzer checker seems to stop after seeing "typeid()"

[Torry Chen via cfe-dev]

Hi all,

I've been using the unix.Malloc checker to detect memory management issues
in our code base. But we found the checker seems to stop exploring after
seeing a call to typeid(). Below is a bad code example and unix.Malloc
should warn about a double-free. But if I uncomment the line calling
typeid(), the checker doesn't report any bug.

This prevents it from checking some of our templated functions that call
typeid(). Could someone please let me know why this happens and how do I
make the checker continue to work after seeing typeid()?

Thank you!
Torry

void double_free(int size) {
  char *data = (char *)malloc(size);

  for (int i = 0; i < size; i++)
    data[i] = i;

  // auto tname = typeid(uint64_t).name(); // typeid() seems to stop
analyzer
  // printf("Type name is %s\n", tname);

  free(data);
  free(data); // Should warn: Attempt to free released memory
}

int main(int argc, char** argv) {
  double_free(argc);

  return 0;
}
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://lists.llvm.org/pipermail/cfe-dev/attachments/20190610/f842b36a/attachment.html>