[analyzer] MallocSizeofChecker false positive: when sizeof is argument

to addition.

We should not to warn in case the malloc size argument is an
addition containing 'sizeof' operator - it is common to use the pattern
to pack values of different sizes into a buffer.

Ex:

uint8_t *buffer = (uint8_t*)malloc(dataSize + sizeof(length));

git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@158219 91177308-0d34-0410-b5e6-96231b3b80d8

diff --git a/lib/StaticAnalyzer/Checkers/MallocSizeofChecker.cpp b/lib/StaticAnalyzer/Checkers/MallocSizeofChecker.cpp
index 46b3500fb0866e51c0c40bd75315679d594c68c2..6292a4725128a4ff0b3fa7ece3fc5e919b2d99de 100644 (file)
--- a/lib/StaticAnalyzer/Checkers/MallocSizeofChecker.cpp
+++ b/lib/StaticAnalyzer/Checkers/MallocSizeofChecker.cpp
@@ -118,11 +118,6 @@ public:
     Visit(E->getRHS());
   }
 
-  void VisitBinAdd(const BinaryOperator *E) {
-    Visit(E->getLHS());
-    Visit(E->getRHS());
-  }
-
   void VisitImplicitCastExpr(const ImplicitCastExpr *E) {
     return Visit(E->getSubExpr());
   }

diff --git a/test/Analysis/malloc-sizeof.c b/test/Analysis/malloc-sizeof.c
index af8600abe5a05c7f5bb7f4129f43c6743b7e6b43..6eb466ac6a11ad25a2740c46a3cd555efb5f4aaf 100644 (file)
--- a/test/Analysis/malloc-sizeof.c
+++ b/test/Analysis/malloc-sizeof.c
@@ -10,13 +10,14 @@ void free(void *ptr);
 struct A {};
 struct B {};
 
-void foo() {
+void foo(unsigned int unsignedInt, unsigned int readSize) {
   int *ip1 = malloc(sizeof(1));
   int *ip2 = malloc(4 * sizeof(int));
 
   long *lp1 = malloc(sizeof(short)); // expected-warning {{Result of 'malloc' is converted to a pointer of type 'long', which is incompatible with sizeof operand type 'short'}}
   long *lp2 = malloc(5 * sizeof(double)); // expected-warning {{Result of 'malloc' is converted to a pointer of type 'long', which is incompatible with sizeof operand type 'double'}}
-  long *lp3 = malloc(5 * sizeof(char) + 2); // expected-warning {{Result of 'malloc' is converted to a pointer of type 'long', which is incompatible with sizeof operand type 'char'}}
+  char *cp3 = malloc(5 * sizeof(char) + 2); // no warning
+  unsigned char *buf = malloc(readSize + sizeof(unsignedInt)); // no warning
 
   struct A *ap1 = calloc(1, sizeof(struct A));
   struct A *ap2 = calloc(2, sizeof(*ap1));