]> granicus.if.org Git - clang/commitdiff
[analyzer][MallocChecker] Improve warning messages on double-delete errors
authorKristof Umann <dkszelethus@gmail.com>
Sat, 15 Dec 2018 18:41:37 +0000 (18:41 +0000)
committerKristof Umann <dkszelethus@gmail.com>
Sat, 15 Dec 2018 18:41:37 +0000 (18:41 +0000)
Differential Revision: https://reviews.llvm.org/D54834

git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@349283 91177308-0d34-0410-b5e6-96231b3b80d8

lib/StaticAnalyzer/Checkers/MallocChecker.cpp
test/Analysis/Inputs/expected-plists/NewDelete-path-notes.cpp.plist
test/Analysis/Malloc+MismatchedDeallocator+NewDelete.cpp
test/Analysis/NewDelete-checker-test.cpp
test/Analysis/NewDelete-path-notes.cpp
test/Analysis/dtor.cpp

index a5b774fe248d8ceb9a1f68920da0764941427fe6..fb770eb9ee4dec3ac58ed5672ac33167a4ea9a4b 100644 (file)
@@ -1431,7 +1431,8 @@ ProgramStateRef MallocChecker::addExtentSize(CheckerContext &C,
 
 void MallocChecker::checkPreStmt(const CXXDeleteExpr *DE,
                                  CheckerContext &C) const {
-
+  // This will regard deleting freed() regions as a use-after-free, rather then
+  // a double-free or double-delete error.
   if (!ChecksEnabled[CK_NewDeleteChecker])
     if (SymbolRef Sym = C.getSVal(DE->getArgument()).getAsSymbol())
       checkUseAfterFree(Sym, C, DE->getArgument());
@@ -1628,7 +1629,8 @@ ProgramStateRef MallocChecker::FreeMemAux(CheckerContext &C,
 }
 
 /// Checks if the previous call to free on the given symbol failed - if free
-/// failed, returns true. Also, returns the corresponding return value symbol.
+/// failed, returns true. Also, stores the corresponding return value symbol in
+/// \p RetStatusSymbol.
 static bool didPreviousFreeFail(ProgramStateRef State,
                                 SymbolRef Sym, SymbolRef &RetStatusSymbol) {
   const SymbolRef *Ret = State->get<FreeReturnValue>(Sym);
@@ -2289,6 +2291,12 @@ void MallocChecker::ReportDoubleFree(CheckerContext &C, SourceRange Range,
   if (!CheckKind.hasValue())
     return;
 
+  // If this is a double delete error, print the appropiate warning message.
+  if (CheckKind == CK_NewDeleteChecker) {
+    ReportDoubleDelete(C, Sym);
+    return;
+  }
+
   if (ExplodedNode *N = C.generateErrorNode()) {
     if (!BT_DoubleFree[*CheckKind])
       BT_DoubleFree[*CheckKind].reset(new BugType(
index d74d9fc7c677a406d85dccaf47988e0bafc89e71..6a3a3d30c4e107d9bd72e1ffb8662b05a04ce403 100644 (file)
      </array>
      <key>depth</key><integer>0</integer>
      <key>extended_message</key>
-     <string>Attempt to free released memory</string>
+     <string>Attempt to delete released memory</string>
      <key>message</key>
-     <string>Attempt to free released memory</string>
+     <string>Attempt to delete released memory</string>
     </dict>
    </array>
-   <key>description</key><string>Attempt to free released memory</string>
+   <key>description</key><string>Attempt to delete released memory</string>
    <key>category</key><string>Memory error</string>
-   <key>type</key><string>Double free</string>
+   <key>type</key><string>Double delete</string>
    <key>check_name</key><string>cplusplus.NewDelete</string>
    <!-- This hash is experimental and going to change! -->
-   <key>issue_hash_content_of_line_in_context</key><string>bd8e324d09c70b9e2be6f824a4942e5a</string>
+   <key>issue_hash_content_of_line_in_context</key><string>593b185245106bed5175ccf2753039b2</string>
   <key>issue_context_kind</key><string>function</string>
   <key>issue_context</key><string>test</string>
   <key>issue_hash_function_offset</key><string>8</string>
      </array>
      <key>depth</key><integer>0</integer>
      <key>extended_message</key>
-     <string>Attempt to free released memory</string>
+     <string>Attempt to delete released memory</string>
      <key>message</key>
-     <string>Attempt to free released memory</string>
+     <string>Attempt to delete released memory</string>
     </dict>
    </array>
-   <key>description</key><string>Attempt to free released memory</string>
+   <key>description</key><string>Attempt to delete released memory</string>
    <key>category</key><string>Memory error</string>
-   <key>type</key><string>Double free</string>
+   <key>type</key><string>Double delete</string>
    <key>check_name</key><string>cplusplus.NewDelete</string>
    <!-- This hash is experimental and going to change! -->
-   <key>issue_hash_content_of_line_in_context</key><string>8bf1a5b9fdae9d86780aa6c4cdce2605</string>
+   <key>issue_hash_content_of_line_in_context</key><string>6484e9b006ede7362edef2187ba6eb37</string>
   <key>issue_context_kind</key><string>function</string>
   <key>issue_context</key><string>test</string>
   <key>issue_hash_function_offset</key><string>3</string>
index b5e47b3355da3d9e8ccb6b2f7ba395a3e3aade93..e5176eb50fffe4c3f24e5eb953ab6ae93f43ce55 100644 (file)
@@ -46,7 +46,7 @@ void testMismatchedDeallocator() {
 void testNewDoubleFree() {
   int *p = new int;
   delete p;
-  delete p; // expected-warning{{Attempt to free released memory}}
+  delete p; // expected-warning{{Attempt to delete released memory}}
 }
 
 void testNewLeak() {
index 620237cd6edeb5b6016ffaa66095933d6661d8f7..fcbe2c740239291e057cec828b7f8c2d16d0b8fa 100644 (file)
@@ -182,7 +182,7 @@ void testUseThisAfterDelete() {
 void testDoubleDelete() {
   int *p = new int;
   delete p;
-  delete p; // expected-warning{{Attempt to free released memory}}
+  delete p; // expected-warning{{Attempt to delete released memory}}
 }
 
 void testExprDeleteArg() {
index d9fe1976b82647ad8f385698b88136aa27160b3e..94658360fbcb9541ed2c68ec22968b0ebf97815e 100644 (file)
@@ -11,8 +11,8 @@ void test() {
     delete p;
     // expected-note@-1 {{Memory is released}}
 
-  delete p; // expected-warning {{Attempt to free released memory}}
-  // expected-note@-1 {{Attempt to free released memory}}
+  delete p; // expected-warning {{Attempt to delete released memory}}
+  // expected-note@-1 {{Attempt to delete released memory}}
 }
 
 struct Odd {
@@ -24,7 +24,7 @@ struct Odd {
 void test(Odd *odd) {
        odd->kill(); // expected-note{{Calling 'Odd::kill'}}
                // expected-note@-1 {{Returning; memory was released}}
-       delete odd; // expected-warning {{Attempt to free released memory}}
-              // expected-note@-1 {{Attempt to free released memory}}
+       delete odd; // expected-warning {{Attempt to delete released memory}}
+              // expected-note@-1 {{Attempt to delete released memory}}
 }
 
index d843f03aada7eb079bf0b5b3d48a983c5c4f6292..2ea38e95c87b86be18c1f77e1022c91cab467026 100644 (file)
@@ -528,7 +528,7 @@ struct NonTrivial {
     return *this;
   }
   ~NonTrivial() {
-    delete[] p; // expected-warning {{free released memory}}
+    delete[] p; // expected-warning {{delete released memory}}
   }
 };