mirror of
https://github.com/llvm/llvm-project.git
synced 2025-04-17 00:36:34 +00:00
[NFC][analyzer] OOB test consolidation IV: rename files (#129697)
This commit finishes the reorganization of the tests for the checker `security.ArrayBound`. Previously these tests were all named `out-of-bounds-*` which was only weakly connected to the checker name; this commit moves them to a directory named after the checker (`ArrayBound`). I decided to use a directory instead of the more common filename prefix ("poor man's directory") system because it seems to be a more natural use of the filesystem and there are already a few precedents for it. I also added (or edited) comments at the beginning of each test file to describe their purpose; and I added a single new testcase to highlight that the assumption note tags can be added to reports by any checker. (Previously all tests in the file triggered out-of-bounds reports to reveal the note tags; but that was just for convenience.)
This commit is contained in:
parent
405c28bb10
commit
a7d7db71db
@ -1,6 +1,16 @@
|
||||
// RUN: %clang_analyze_cc1 -Wno-array-bounds -analyzer-output=text \
|
||||
// RUN: -analyzer-checker=core,security.ArrayBound,unix.Malloc,optin.taint -verify %s
|
||||
|
||||
// When the checker security.ArrayBound encounters an array subscript operation
|
||||
// that _may be_ in bounds, it assumes that indexing _is_ in bound. These
|
||||
// assumptions will be reported to the user if the execution path leads to a
|
||||
// bug report (made by any checker) and the symbol which was constrainted by
|
||||
// the assumption is marked as interesting (with `markInteresting` or
|
||||
// indirectly via `trackExpressionValue`) in that bug report.
|
||||
//
|
||||
// This test file validates the content of these note tags which describe the
|
||||
// assumptions for the user.
|
||||
|
||||
int TenElements[10];
|
||||
|
||||
int irrelevantAssumptions(int arg) {
|
||||
@ -197,3 +207,14 @@ int *extentInterestingness(int arg) {
|
||||
// expected-warning@-1 {{Out of bound access to memory after the end of the heap area}}
|
||||
// expected-note@-2 {{Access of 'int' element in the heap area at index 12}}
|
||||
}
|
||||
|
||||
int triggeredByAnyReport(int arg) {
|
||||
// Verify that note tags explaining the assumptions made by ArrayBound are
|
||||
// not limited to ArrayBound reports but will appear on any bug report (that
|
||||
// marks the relevant symbol as interesting).
|
||||
TenElements[arg + 10] = 8;
|
||||
// expected-note@-1 {{Assuming index is non-negative and less than 10, the number of 'int' elements in 'TenElements'}}
|
||||
return 1024 >> arg;
|
||||
// expected-warning@-1 {{Right operand is negative in right shift}}
|
||||
// expected-note@-2 {{The result of right shift is undefined because the right operand is negative}}
|
||||
}
|
@ -1,5 +1,10 @@
|
||||
// RUN: %clang_analyze_cc1 -Wno-array-bounds -analyzer-checker=core,security.ArrayBound,debug.ExprInspection -verify %s
|
||||
|
||||
// Miscellaneous tests for `security.ArrayBound` where we only test the
|
||||
// presence or absence of a bug report. If a test doesn't fit in a more
|
||||
// specific file and doesn't need to verify the details of 'note' diagnostics,
|
||||
// then it should be placed here.
|
||||
|
||||
void clang_analyzer_value(int);
|
||||
|
||||
// Tests doing an out-of-bounds access after the end of an array using:
|
@ -1,5 +1,7 @@
|
||||
// RUN: %clang_analyze_cc1 -std=c++11 -Wno-array-bounds -analyzer-checker=unix,core,security.ArrayBound -verify %s
|
||||
|
||||
// Test the interactions of `security.ArrayBound` with C++ features.
|
||||
|
||||
// Tests doing an out-of-bounds access after the end of an array using:
|
||||
// - constant integer index
|
||||
// - constant integer size for buffer
|
||||
@ -150,15 +152,13 @@ void test_dynamic_size(int s) {
|
||||
}
|
||||
//Tests complex arithmetic
|
||||
//in new expression
|
||||
void test_dynamic_size2(unsigned m,unsigned n){
|
||||
void test_dynamic_size2(unsigned m, unsigned n){
|
||||
unsigned *U = nullptr;
|
||||
U = new unsigned[m + n + 1];
|
||||
}
|
||||
|
||||
//Test creating invalid references, which break the invariant that a reference
|
||||
//is always holding a value, and could lead to nasty runtime errors.
|
||||
//(This is not related to operator new, but placed in this file because the
|
||||
//other test files are not C++.)
|
||||
int array[10] = {0};
|
||||
|
||||
void test_after_the_end_reference() {
|
||||
@ -179,4 +179,3 @@ int test_reference_that_might_be_after_the_end(int idx) {
|
||||
return -1;
|
||||
return ref;
|
||||
}
|
||||
|
@ -1,6 +1,11 @@
|
||||
// RUN: %clang_analyze_cc1 -Wno-array-bounds -analyzer-output=text \
|
||||
// RUN: -analyzer-checker=core,security.ArrayBound,unix.Malloc,optin.taint -verify %s
|
||||
|
||||
// Miscellaneous tests for `security.ArrayBound` where we also verify the
|
||||
// content of the 'note' diagnostics. This makes the tests sensitive to textual
|
||||
// changes in the diagnostics, so prefer adding new tests to `brief-tests.c`
|
||||
// unless they need to verify the correctness of 'note' diagnostics.
|
||||
|
||||
int TenElements[10];
|
||||
|
||||
void arrayUnderflow(void) {
|
Loading…
x
Reference in New Issue
Block a user