leak of ‘tmp.m_ptr’ [CWE-401] [-Wanalyzer-malloc-leak]
358 } /* { dg-warning "leak of 'tmp.m_ptr'" } */
^
test_30
test_30: events 1-2
357 tmp.m_ptr = (struct link *)malloc (sizeof (struct link)); /* { dg-message "allocated here" } */
^~~~~~~~~~~~~~~~~~~~~~~~~~~~~
|
(1) allocated here
358 } /* { dg-warning "leak of 'tmp.m_ptr'" } */
~
|
(2) ⚠️ ‘tmp.m_ptr’ leaks here; was allocated at (1)
double-‘free’ of ‘ptr’ [CWE-415] [-Wanalyzer-double-free]
12 free (ptr); /* { dg-warning "double-'free' of 'ptr'" } */
^~~~~~~~~~
test_1
test_1: events 1-3
10 void *ptr = malloc (1024);
^~~~~~~~~~~~~
|
(1) allocated here
11 free (ptr);
~~~~~~~~~~
|
(2) first ‘free’ here
12 free (ptr); /* { dg-warning "double-'free' of 'ptr'" } */
~~~~~~~~~~
|
(3) ⚠️ second ‘free’ here; first ‘free’ was at (2)
double-‘free’ of ‘ptr’ [CWE-415] [-Wanalyzer-double-free]
18 free (ptr); /* { dg-warning "double-'free' of 'ptr'" } */
^~~~~~~~~~
test_2
test_2: events 1-2
17 free (ptr);
^~~~~~~~~~
|
(1) first ‘free’ here
18 free (ptr); /* { dg-warning "double-'free' of 'ptr'" } */
~~~~~~~~~~
|
(2) ⚠️ second ‘free’ here; first ‘free’ was at (1)
double-‘free’ of ‘ptr’ [CWE-415] [-Wanalyzer-double-free]
24 __builtin_free (ptr); /* { dg-warning "double-'free' of 'ptr'" } */
^~~~~~~~~~~~~~~~~~~~
test_2a
test_2a: events 1-2
23 __builtin_free (ptr);
^~~~~~~~~~~~~~~~~~~~
|
(1) first ‘free’ here
24 __builtin_free (ptr); /* { dg-warning "double-'free' of 'ptr'" } */
~~~~~~~~~~~~~~~~~~~~
|
(2) ⚠️ second ‘free’ here; first ‘free’ was at (1)
dereference of possibly-NULL ‘ptr’ [CWE-690] [-Wanalyzer-possible-null-dereference]
30 *ptr = 42; /* { dg-warning "dereference of possibly-NULL 'ptr' \\\[CWE-690\\\]" } */
~~~~~^~~~
test_3
test_3: events 1-2
29 int *ptr = (int *)malloc (sizeof (int));
^~~~~~~~~~~~~~~~~~~~~
|
(1) this call could return NULL
30 *ptr = 42; /* { dg-warning "dereference of possibly-NULL 'ptr' \\\[CWE-690\\\]" } */
~~~~~~~~~
|
(2) ⚠️ ‘ptr’ could be NULL: unchecked value from (1)
dereference of possibly-NULL ‘ptr’ [CWE-690] [-Wanalyzer-possible-null-dereference]
37 *ptr = 42; /* { dg-warning "dereference of possibly-NULL 'ptr' \\\[CWE-690\\\]" } */
~~~~~^~~~
test_3a
test_3a: events 1-2
36 int *ptr = (int *)__builtin_malloc (sizeof (int));
^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
|
(1) this call could return NULL
37 *ptr = 42; /* { dg-warning "dereference of possibly-NULL 'ptr' \\\[CWE-690\\\]" } */
~~~~~~~~~
|
(2) ⚠️ ‘ptr’ could be NULL: unchecked value from (1)
dereference of NULL ‘ptr’ [CWE-476] [-Wanalyzer-null-dereference]
47 *ptr = 43; /* { dg-warning "dereference of NULL 'ptr' \\\[CWE-476\\\]" } */
~~~~~^~~~
test_4
test_4: events 1-5
43 int *ptr = (int *)malloc (sizeof (int));
^~~~~~~~~~~~~~~~~~~~~
|
(1) allocated here
44 if (ptr)
~
|
(2) assuming ‘ptr’ is NULL
(3) following ‘false’ branch (when ‘ptr’ is NULL)... ─>─┐
│
[...]
│
┌─────────────────────────────────────────────────────────────┘
47│ *ptr = 43; /* { dg-warning "dereference of NULL 'ptr' \\\[CWE-476\\\]" } */
│ ~~~~~~~~~
│ |
└────────>(4) ...to here
(5) ⚠️ dereference of NULL ‘ptr’
use after ‘free’ of ‘ptr’ [CWE-416] [-Wanalyzer-use-after-free]
54 return *ptr; /* { dg-warning "use after 'free' of 'ptr'" } */
^~~~
test_5
test_5: events 1-2
53 free (ptr);
^~~~~~~~~~
|
(1) freed here
54 return *ptr; /* { dg-warning "use after 'free' of 'ptr'" } */
~~~~
|
(2) ⚠️ use after ‘free’ of ‘ptr’; freed at (1)
double-‘free’ of ‘q’ [CWE-415] [-Wanalyzer-double-free]
62 free (q); /* { dg-warning "double-'free' of 'q'" } */
^~~~~~~~
test_6
test_6: events 1-2
61 free (ptr);
^~~~~~~~~~
|
(1) first ‘free’ here
62 free (q); /* { dg-warning "double-'free' of 'q'" } */
~~~~~~~~
|
(2) ⚠️ second ‘free’ here; first ‘free’ was at (1)
double-‘free’ of ‘ptr’ [CWE-415] [-Wanalyzer-double-free]
93 free (ptr); /* { dg-warning "double-'free' of 'ptr'" } */
^~~~~~~~~~
test_9
test_9: events 1-4
89 void *ptr = malloc (1024);
^~~~~~~~~~~~~
|
(1) allocated here
[...]
92 for (i = 0; i < 1024; i++)
~~~~~~~~
|
(2) following ‘true’ branch (when ‘i <= 1023’)... ─>─┐
│
│
┌─────────────────────────────────────────────────────────────────────┘
93│ free (ptr); /* { dg-warning "double-'free' of 'ptr'" } */
│ ~~~~~~~~~~
│ |
└───>(3) ...to here
(4) first ‘free’ here
test_9: events 5-7
92 for (i = 0; i < 1024; i++)
~~^~~~~~
|
(5) following ‘true’ branch (when ‘i <= 1023’)... ─>─┐
│
│
┌─────────────────────────────────────────────────────────────────────┘
93│ free (ptr); /* { dg-warning "double-'free' of 'ptr'" } */
│ ~~~~~~~~~~
│ |
└───>(6) ...to here
(7) ⚠️ second ‘free’ here; first ‘free’ was at (4)
double-‘free’ of ‘ptr’ [CWE-415] [-Wanalyzer-double-free]
105 free (ptr); /* { dg-warning "double-'free' of 'ptr'" } */
^~~~~~~~~~
test_10
test_10: events 1-5
98 void *ptr = malloc (1024);
^~~~~~~~~~~~~
|
(1) allocated here
[...]
101 for (i = 0; i < 1024; i++)
~~~~~~~~
|
(2) following ‘true’ branch (when ‘i <= 1023’)... ─>─┐
│
│
┌─────────────────────────────────────────────────────────────────────┘
102│ foo ();
│ ~~~~~~
│ |
└───>(3) ...to here
103
104 free (ptr);
~~~~~~~~~~
|
(4) first ‘free’ here
105 free (ptr); /* { dg-warning "double-'free' of 'ptr'" } */
~~~~~~~~~~
|
(5) ⚠️ second ‘free’ here; first ‘free’ was at (4)
double-‘free’ of ‘ptr’ [CWE-415] [-Wanalyzer-double-free]
116 free (ptr); /* { dg-warning "double-'free' of 'ptr'" } */
^~~~~~~~~~
test_11
test_11: events 1-3
110 void *ptr = malloc (1024);
^~~~~~~~~~~~~
|
(1) allocated here
[...]
115 free (ptr);
~~~~~~~~~~
|
(2) first ‘free’ here
116 free (ptr); /* { dg-warning "double-'free' of 'ptr'" } */
~~~~~~~~~~
|
(3) ⚠️ second ‘free’ here; first ‘free’ was at (2)
infinite loop [CWE-835] [-Wanalyzer-infinite-loop]
125 free (ptr); /* { dg-warning "infinite loop" } */
^~~~~~~~~~
test_12
test_12: events 1-2
125 free (ptr); /* { dg-warning "infinite loop" } */
^~~~~~~~~~
|
(1) ⚠️ infinite loop here
126 free (ptr); /* { dg-warning "double-'free' of 'ptr'" } */
~~~~~~~~~~
|
(2) looping back... ─>─┐
│
test_12: event 3
│
┌─────────────────────────────┘
125│ free (ptr); /* { dg-warning "infinite loop" } */
│ ^~~~~~~~~~
│ |
└─────>(3) ...to here
double-‘free’ of ‘ptr’ [CWE-415] [-Wanalyzer-double-free]
126 free (ptr); /* { dg-warning "double-'free' of 'ptr'" } */
^~~~~~~~~~
test_12
test_12: events 1-3
121 void *ptr = malloc (1024);
^~~~~~~~~~~~~
|
(1) allocated here
[...]
125 free (ptr); /* { dg-warning "infinite loop" } */
~~~~~~~~~~
|
(2) first ‘free’ here
126 free (ptr); /* { dg-warning "double-'free' of 'ptr'" } */
~~~~~~~~~~
|
(3) ⚠️ second ‘free’ here; first ‘free’ was at (2)
leak of ‘p’ [CWE-401] [-Wanalyzer-malloc-leak]
139 return; /* { dg-warning "leak of 'p'" } */
^~~~~~
test_13
test_13: events 1-4
132 void *p = malloc (1024); /* { dg-message "allocated here" } */
^~~~~~~~~~~~~
|
(1) allocated here
[...]
136 if (!q)
~
|
(2) following ‘true’ branch (when ‘q’ is NULL)... ─>─┐
│
│
┌──────────────────────────────────────────────────────────┘
137│ {
138│ free (q);
│ ~~~~~~~~
│ |
└─────>(3) ...to here
139 return; /* { dg-warning "leak of 'p'" } */
~~~~~~
|
(4) ⚠️ ‘p’ leaks here; was allocated at (1)
double-‘free’ of ‘p’ [CWE-415] [-Wanalyzer-double-free]
164 free (p); /* { dg-warning "double-'free' of 'p'" } */
^~~~~~~~
test_14
test_14: events 1-8
149 p = malloc (1024);
^~~~~~~~~~~~~
|
(1) allocated here
150 if (!p)
~
|
(2) assuming ‘p’ is non-NULL
(3) following ‘false’ branch (when ‘p’ is non-NULL)... ─>─┐
│
[...]
│
┌───────────────────────────────────────────────────────────────┘
153│ q = malloc (1024);
│ ~~~~~~~~~~~~~
│ |
└─────>(4) ...to here
154 if (!q)
~
|
(5) following ‘true’ branch (when ‘q’ is NULL)... ─>─┐
│
│
┌──────────────────────────────────────────────────────────┘
155│ {
156│ free (p);
│ ~~~~~~~~
│ |
└─────>(6) ...to here
(7) first ‘free’ here
[...]
164 free (p); /* { dg-warning "double-'free' of 'p'" } */
~~~~~~~~
|
(8) ⚠️ second ‘free’ here; first ‘free’ was at (7)
use of uninitialized value ‘q’ [CWE-457] [-Wanalyzer-use-of-uninitialized-value]
205 free (q); /* { dg-warning "use of uninitialized value 'q'" } */
^~~~~~~~
test_16
test_16: events 1-5
190 void *p, *q; /* { dg-message "region created on stack here" } */
^
|
(1) region created on stack here
(2) capacity: 8 bytes
[...]
193 if (!p)
~
|
(3) following ‘true’ branch (when ‘p’ is NULL)... ─>─┐
│
│
┌──────────────────────────────────────────────────────────┘
194│ goto fail;
│ ~~~~
│ |
└───>(4) ...to here
[...]
205 free (q); /* { dg-warning "use of uninitialized value 'q'" } */
~~~~~~~~
|
(5) ⚠️ use of uninitialized value ‘q’ here
leak of ‘ptr’ [CWE-401] [-Wanalyzer-malloc-leak]
212 } /* { dg-warning "leak of 'ptr'" } */
^
test_17
test_17: events 1-2
211 void *ptr = malloc (1024); /* { dg-message "allocated here" } */
^~~~~~~~~~~~~
|
(1) allocated here
212 } /* { dg-warning "leak of 'ptr'" } */
~
|
(2) ⚠️ ‘ptr’ leaks here; was allocated at (1)
leak of ‘ptr’ [CWE-401] [-Wanalyzer-malloc-leak]
217 ptr = NULL; /* { dg-warning "leak of 'ptr'" } */
^
test_18
test_18: event 1
216 void *ptr = malloc (64); /* { dg-message "allocated here" } */
^~~~~~~~~~~
|
(1) allocated here
test_18: event 2
217 ptr = NULL; /* { dg-warning "leak of 'ptr'" } */
^
|
(2) ⚠️ ‘ptr’ leaks here; was allocated at (1)
double-‘free’ of ‘ptr’ [CWE-415] [-Wanalyzer-double-free]
253 free (ptr); /* { dg-warning "double-'free' of 'ptr'" } */
^~~~~~~~~~
test_22
test_22: events 1-5
246 void *ptr = malloc (1024);
^~~~~~~~~~~~~
|
(1) allocated here
[...]
249 for (i = 5; i < 10; i++)
~~~~~~
|
(2) following ‘true’ branch (when ‘i <= 9’)... ─>─┐
│
│
┌──────────────────────────────────────────────────────────────────┘
250│ foo ();
│ ~~~~~~
│ |
└───>(3) ...to here
251
252 free (ptr);
~~~~~~~~~~
|
(4) first ‘free’ here
253 free (ptr); /* { dg-warning "double-'free' of 'ptr'" } */
~~~~~~~~~~
|
(5) ⚠️ second ‘free’ here; first ‘free’ was at (4)
dereference of possibly-NULL ‘ptr’ [CWE-690] [-Wanalyzer-possible-null-dereference]
259 ptr[0] = 42; /* { dg-warning "dereference of possibly-NULL 'ptr' \\\[CWE-690\\\]" } */
~~~~~~~^~~~
test_23
test_23: events 1-2
258 int *ptr = (int *)calloc (n, sizeof (int));
^~~~~~~~~~~~~~~~~~~~~~~~
|
(1) this call could return NULL
259 ptr[0] = 42; /* { dg-warning "dereference of possibly-NULL 'ptr' \\\[CWE-690\\\]" } */
~~~~~~~~~~~
|
(2) ⚠️ ‘ptr’ could be NULL: unchecked value from (1)
dereference of possibly-NULL ‘ptr’ [CWE-690] [-Wanalyzer-possible-null-dereference]
266 ptr[0] = 42; /* { dg-warning "dereference of possibly-NULL 'ptr' \\\[CWE-690\\\]" } */
~~~~~~~^~~~
test_23a
test_23a: events 1-2
265 int *ptr = (int *)__builtin_calloc (n, sizeof (int));
^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
|
(1) this call could return NULL
266 ptr[0] = 42; /* { dg-warning "dereference of possibly-NULL 'ptr' \\\[CWE-690\\\]" } */
~~~~~~~~~~~
|
(2) ⚠️ ‘ptr’ could be NULL: unchecked value from (1)
‘free’ of ‘ptr’ which points to memory on the stack [CWE-590] [-Wanalyzer-free-of-non-heap]
273 free (ptr); /* { dg-warning "'free' of 'ptr' which points to memory on the stack \\\[CWE-590\\\]" } */
^~~~~~~~~~
test_24
test_24: events 1-3
272 void *ptr = __builtin_alloca (sizeof (int)); /* { dg-message "region created on stack here" } */
^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
|
(1) region created on stack here
(2) capacity: 4 bytes
273 free (ptr); /* { dg-warning "'free' of 'ptr' which points to memory on the stack \\\[CWE-590\\\]" } */
~~~~~~~~~~
|
(3) ⚠️ call to ‘free’ here
‘free’ of ‘p’ which points to memory on the stack [CWE-590] [-Wanalyzer-free-of-non-heap]
280 free (p); /* { dg-warning "'free' of 'p' which points to memory on the stack \\\[CWE-590\\\]" } */
^~~~~~~~
test_25
test_25: events 1-3
278 char tmp[100]; /* { dg-message "region created on stack here" } */
^~~
|
(1) region created on stack here
(2) capacity: 100 bytes
279 void *p = tmp;
280 free (p); /* { dg-warning "'free' of 'p' which points to memory on the stack \\\[CWE-590\\\]" } */
~~~~~~~~
|
(3) ⚠️ call to ‘free’ here
‘free’ of ‘p’ which points to memory not on the heap [CWE-590] [-Wanalyzer-free-of-non-heap]
289 free (p); /* { dg-warning "'free' of 'p' which points to memory not on the heap \\\[CWE-590\\\]" } */
^~~~~~~~
event 1
284 char global_buffer[100]; /* { dg-message "region created here" } */
^~~~~~~~~~~~~
|
(1) region created here
test_26
test_26: event 2
289 free (p); /* { dg-warning "'free' of 'p' which points to memory not on the heap \\\[CWE-590\\\]" } */
^~~~~~~~
|
(2) ⚠️ call to ‘free’ here
dereference of possibly-NULL ‘p’ [CWE-690] [-Wanalyzer-possible-null-dereference]
301 p->x = 0.f; /* { dg-warning "dereference of possibly-NULL 'p' \\\[CWE-690\\\]" } */
~~~~~^~~~~
test_27
test_27: events 1-2
300 struct coord *p = (struct coord *) malloc (sizeof (struct coord)); /* { dg-message "this call could return NULL" } */
^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
|
(1) this call could return NULL
301 p->x = 0.f; /* { dg-warning "dereference of possibly-NULL 'p' \\\[CWE-690\\\]" } */
~~~~~~~~~~
|
(2) ⚠️ ‘p’ could be NULL: unchecked value from (1)
dereference of NULL ‘p’ [CWE-476] [-Wanalyzer-null-dereference]
312 p->x = 0.f; /* { dg-warning "dereference of NULL 'p' \\\[CWE-476\\\]" } */
~~~~~^~~~~
test_28
test_28: events 1-3
311 struct coord *p = NULL;
^
|
(1) ‘p’ is NULL
312 p->x = 0.f; /* { dg-warning "dereference of NULL 'p' \\\[CWE-476\\\]" } */
~~~~~~~~~~
|
(3) ⚠️ dereference of NULL ‘p’
[...]
317 return p;
~
|
(2) ‘p’ is NULL
leak of ‘ptr’ [CWE-401] [-Wanalyzer-malloc-leak]
366 } /* { dg-warning "leak of 'ptr'" } */
^
test_31
test_31: events 1-2
364 void *ptr = malloc (sizeof (struct link)); /* { dg-message "allocated here" } */
^~~~~~~~~~~~~~~~~~~~~~~~~~~~~
|
(1) allocated here
365 tmp.m_ptr = (struct link *)ptr;
366 } /* { dg-warning "leak of 'ptr'" } */
~
|
(2) ⚠️ ‘ptr’ leaks here; was allocated at (1)
leak of ‘ptr’ [CWE-401] [-Wanalyzer-malloc-leak]
379 } /* { dg-warning "leak of 'ptr'" } */
^
test_33
test_33: events 1-2
377 void *ptr = malloc (1024); /* { dg-message "allocated here" } */
^~~~~~~~~~~~~
|
(1) allocated here
378 cant_free (ptr);
379 } /* { dg-warning "leak of 'ptr'" } */
~
|
(2) ⚠️ ‘ptr’ leaks here; was allocated at (1)
use after ‘free’ of ‘q’ [CWE-416] [-Wanalyzer-use-after-free]
390 *q = 1.0f; /* { dg-warning "use after 'free' of 'q'" } */
~~~^~~~~~
test_34
test_34: events 1-3
385 if (!p)
^
|
(1) following ‘false’ branch (when ‘p’ is non-NULL)... ─>─┐
│
│
┌───────────────────────────────────────────────────────────────┘
386│ return;
387│ p->x = 0.0f;
│ ~~~~~~~~~~~
│ |
└──────>(2) ...to here
[...]
390 *q = 1.0f; /* { dg-warning "use after 'free' of 'q'" } */
~~~~~~~~~
|
(3) ⚠️ use after ‘free’ of ‘q’ here
use of possibly-NULL ‘ptr’ where non-null expected [CWE-690] [-Wanalyzer-possible-null-argument]
415 __builtin_memset(ptr, 0, 4096); /* { dg-warning "use of possibly-NULL 'ptr' where non-null expected \\\[CWE-690\\\]" } */
^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
test_37a
test_37a: events 1-2
414 void *ptr = malloc(4096); /* { dg-message "this call could return NULL" } */
^~~~~~~~~~~~
|
(1) this call could return NULL
415 __builtin_memset(ptr, 0, 4096); /* { dg-warning "use of possibly-NULL 'ptr' where non-null expected \\\[CWE-690\\\]" } */
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
|
(2) ⚠️ argument 1 (‘ptr’) from (1) could be NULL where non-null expected
argument 1 of ‘__builtin_memset’ must be non-null
use of possibly-NULL ‘q’ where non-null expected [CWE-690] [-Wanalyzer-possible-null-argument]
426 __builtin_memset(q, 0, 4096); /* { dg-warning "use of possibly-NULL 'q' where non-null expected \\\[CWE-690\\\]" } */
^~~~~~~~~~~~~~~~~~~~~~~~~~~~
test_37b
test_37b: events 1-4
422 void *q = malloc(4096); /* { dg-message "this call could return NULL" } */
^~~~~~~~~~~~
|
(1) this call could return NULL
423 if (p) {
~
|
(2) following ‘false’ branch (when ‘p’ is NULL)... ─>─┐
│
[...]
│
┌───────────────────────────────────────────────────────────┘
426│ __builtin_memset(q, 0, 4096); /* { dg-warning "use of possibly-NULL 'q' where non-null expected \\\[CWE-690\\\]" } */
│ ~~~~~~~~~~~~~~~~~~~~~~~~~~~~
│ |
└───>(3) ...to here
(4) ⚠️ argument 1 (‘q’) from (1) could be NULL where non-null expected
argument 1 of ‘__builtin_memset’ must be non-null
dereference of possibly-NULL ‘p’ [CWE-690] [-Wanalyzer-possible-null-dereference]
451 *p = i; /* { dg-warning "dereference of possibly-NULL 'p' \\\[CWE-690\\\]" } */
~~~^~~
test_39
test_39: events 1-2
450 int *p = (int*)malloc(sizeof(int*)); /* { dg-message "this call could return NULL" } */
^~~~~~~~~~~~~~~~~~~~
|
(1) this call could return NULL
451 *p = i; /* { dg-warning "dereference of possibly-NULL 'p' \\\[CWE-690\\\]" } */
~~~~~~
|
(2) ⚠️ ‘p’ could be NULL: unchecked value from (1)
use of uninitialized value ‘*p’ [CWE-457] [-Wanalyzer-use-of-uninitialized-value]
459 i = *p; /* { dg-warning "dereference of possibly-NULL 'p' \\\[CWE-690\\\]" "possibly-null" } */
~~^~~~
test_40
test_40: events 1-2
458 int *p = (int*)malloc(sizeof(int*)); /* { dg-message "region created on heap here" } */
^~~~~~~~~~~~~~~~~~~~
|
(1) region created on heap here
459 i = *p; /* { dg-warning "dereference of possibly-NULL 'p' \\\[CWE-690\\\]" "possibly-null" } */
~~~~~~
|
(2) ⚠️ use of uninitialized value ‘*p’ here
dereference of possibly-NULL ‘p’ [CWE-690] [-Wanalyzer-possible-null-dereference]
459 i = *p; /* { dg-warning "dereference of possibly-NULL 'p' \\\[CWE-690\\\]" "possibly-null" } */
~~^~~~
test_40
test_40: events 1-2
458 int *p = (int*)malloc(sizeof(int*)); /* { dg-message "region created on heap here" } */
^~~~~~~~~~~~~~~~~~~~
|
(1) this call could return NULL
459 i = *p; /* { dg-warning "dereference of possibly-NULL 'p' \\\[CWE-690\\\]" "possibly-null" } */
~~~~~~
|
(2) ⚠️ ‘p’ could be NULL: unchecked value from (1)
dereference of NULL ‘buffer’ [CWE-476] [-Wanalyzer-null-dereference]
475 buffer[0] = 'a'; /* { dg-warning "dereference of possibly-NULL 'buffer' \\\[CWE-690\\\]" "possibly-NULL" } */
~~~~~~~~~~^~~~~
test_41
test_41: event 1
469 if (flag) {
^
|
(1) following ‘false’ branch (when ‘flag == 0’)... ─>─┐
│
test_41: event 2
│
┌───────────────────────────────────────────────────────────┘
472│ buffer = NULL;
│ ^
│ |
└──────────>(2) ...to here
test_41: events 3-5
472 buffer = NULL;
^
|
(3) ‘buffer’ is NULL
[...]
475 buffer[0] = 'a'; /* { dg-warning "dereference of possibly-NULL 'buffer' \\\[CWE-690\\\]" "possibly-NULL" } */
~~~~~~~~~~~~~~~
|
(5) ⚠️ dereference of NULL ‘buffer’
[...]
478 return buffer;
~~~~~~
|
(4) ‘buffer’ is NULL
dereference of possibly-NULL ‘buffer’ [CWE-690] [-Wanalyzer-possible-null-dereference]
475 buffer[0] = 'a'; /* { dg-warning "dereference of possibly-NULL 'buffer' \\\[CWE-690\\\]" "possibly-NULL" } */
~~~~~~~~~~^~~~~
test_41
test_41: events 1-4
469 if (flag) {
^
|
(1) following ‘true’ branch (when ‘flag != 0’)... ─>─┐
│
│
┌──────────────────────────────────────────────────────────┘
470│ buffer = (char*)malloc(4096);
│ ~~~~~~~~~~~~
│ |
└───────────────────>(2) ...to here
(3) this call could return NULL
[...]
475 buffer[0] = 'a'; /* { dg-warning "dereference of possibly-NULL 'buffer' \\\[CWE-690\\\]" "possibly-NULL" } */
~~~~~~~~~~~~~~~
|
(4) ⚠️ ‘buffer’ could be NULL: unchecked value from (3)
leak of ‘p’ [CWE-401] [-Wanalyzer-malloc-leak]
486 } /* { dg-warning "leak of 'p'" } */
^
test_42a
test_42a: events 1-2
483 void *p = malloc (1024); /* { dg-message "allocated here" } */
^~~~~~~~~~~~~
|
(1) allocated here
[...]
486 } /* { dg-warning "leak of 'p'" } */
~
|
(2) ⚠️ ‘p’ leaks here; was allocated at (1)
leak of ‘p’ [CWE-401] [-Wanalyzer-malloc-leak]
496 } /* { dg-warning "leak of 'p'" } */
^
test_42b
test_42b: events 1-2
493 void *p = malloc (1024); /* { dg-message "allocated here" } */
^~~~~~~~~~~~~
|
(1) allocated here
[...]
496 } /* { dg-warning "leak of 'p'" } */
~
|
(2) ⚠️ ‘p’ leaks here; was allocated at (1)
leak of ‘global_link.m_ptr’ [CWE-401] [-Wanalyzer-malloc-leak]
537 global_link.m_ptr = NULL; /* { dg-warning "leak of 'global_link.m_ptr'" } */
^
test_43
test_43: event 1
536 global_link.m_ptr = malloc (sizeof (struct link)); /* { dg-message "allocated here" } */
^~~~~~~~~~~~~~~~~~~~~~~~~~~~~
|
(1) allocated here
test_43: event 2
537 global_link.m_ptr = NULL; /* { dg-warning "leak of 'global_link.m_ptr'" } */
^
|
(2) ⚠️ ‘global_link.m_ptr’ leaks here; was allocated at (1)
leak of ‘<unknown>’ [CWE-401] [-Wanalyzer-malloc-leak]
548 free (global_ptr); /* { dg-warning "leak of '<unknown>'" } */
^~~~~~~~~~~~~~~~~
test_44
test_44: events 1-4
545 if (!global_ptr)
^
|
(1) following ‘false’ branch... ─>─┐
│
│
┌────────────────────────────────────────┘
546│ return;
547│ global_ptr->m_ptr = malloc (sizeof (struct link)); /* { dg-message "allocated here" } */
│ ~~ ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
│ | |
│ | (3) allocated here
└───────────>(2) ...to here
548 free (global_ptr); /* { dg-warning "leak of '<unknown>'" } */
~~~~~~~~~~~~~~~~~
|
(4) ⚠️ ‘<unknown>’ leaks here; was allocated at (3)
dereference of NULL ‘p’ [CWE-476] [-Wanalyzer-null-dereference]
593 *p = 1; /* { dg-warning "dereference of NULL 'p' \\\[CWE-476\\\]" } */
~~~^~~
test_48
test_48: events 1-2
592 int *p = NULL; /* { dg-message "'p' is NULL" } */
^
|
(1) ‘p’ is NULL
593 *p = 1; /* { dg-warning "dereference of NULL 'p' \\\[CWE-476\\\]" } */
~~~~~~
|
(2) ⚠️ dereference of NULL ‘p’
dereference of NULL ‘p’ [CWE-476] [-Wanalyzer-null-dereference]
605 *p = 1; /* { dg-warning "dereference of NULL 'p' \\\[CWE-476\\\]" } */
~~~^~~
test_49
test_49: events 1-2
604 p = NULL; /* { dg-message "'p' is NULL" } */
^
|
(1) ‘p’ is NULL
605 *p = 1; /* { dg-warning "dereference of NULL 'p' \\\[CWE-476\\\]" } */
~~~~~~
|
(2) ⚠️ dereference of NULL ‘p’
‘free’ of ‘&test_50a’ which points to memory not on the heap [CWE-590] [-Wanalyzer-free-of-non-heap]
617 free (test_50a); /* { dg-warning "'free' of '&test_50a' which points to memory not on the heap \\\[CWE-590\\\]" } */
^~~~~~~~~~~~~~~
test_50b
test_50b: event 1
617 free (test_50a); /* { dg-warning "'free' of '&test_50a' which points to memory not on the heap \\\[CWE-590\\\]" } */
^~~~~~~~~~~~~~~
|
(1) ⚠️ call to ‘free’ here
‘free’ of ‘&my_label’ which points to memory not on the heap [CWE-590] [-Wanalyzer-free-of-non-heap]
623 free (&&my_label); /* { dg-warning "'free' of '&my_label' which points to memory not on the heap \\\[CWE-590\\\]" } */
^~~~~~~~~~~~~~~~~
test_50c
test_50c: event 1
623 free (&&my_label); /* { dg-warning "'free' of '&my_label' which points to memory not on the heap \\\[CWE-590\\\]" } */
^~~~~~~~~~~~~~~~~
|
(1) ⚠️ call to ‘free’ here
double-‘free’ of ‘p’ [CWE-415] [-Wanalyzer-double-free]
632 free (p); /* { dg-warning "double-'free' of 'p'" } */
^~~~~~~~
test_51
test_51: events 1-3
630 int result = *p;
^~~~~~
|
(1) state of ‘INIT_VAL(p_2(D))’: ‘start’ -> ‘assumed-non-null’ (NULL origin)
631 free (p); /* { dg-message "first 'free' here" } */
~~~~~~~~
|
(2) first ‘free’ here
632 free (p); /* { dg-warning "double-'free' of 'p'" } */
~~~~~~~~
|
(3) ⚠️ second ‘free’ here; first ‘free’ was at (2)
‘free’ called on pointer to an unallocated object [-Wfree-nonheap-object]
273 free (ptr); /* { dg-warning "'free' of 'ptr' which points to memory on the stack \\\[CWE-590\\\]" } */
^~~~~~~~~~
returned from ‘__builtin_alloca’
272 void *ptr = __builtin_alloca (sizeof (int)); /* { dg-message "region created on stack here" } */
^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
‘free’ called on unallocated object ‘tmp’ [-Wfree-nonheap-object]
280 free (p); /* { dg-warning "'free' of 'p' which points to memory on the stack \\\[CWE-590\\\]" } */
^~~~~~~~
declared here
278 char tmp[100]; /* { dg-message "region created on stack here" } */
^~~
‘free’ called on unallocated object ‘global_buffer’ [-Wfree-nonheap-object]
289 free (p); /* { dg-warning "'free' of 'p' which points to memory not on the heap \\\[CWE-590\\\]" } */
^~~~~~~~
declared here
284 char global_buffer[100]; /* { dg-message "region created here" } */
^~~~~~~~~~~~~
‘free’ called on pointer ‘p’ with nonzero offset 64 [-Wfree-nonheap-object]
484 free (p + 64); /* this could well corrupt the heap. */
^~~~~~~~~~~~~
returned from ‘malloc’
483 void *p = malloc (1024); /* { dg-message "allocated here" } */
^~~~~~~~~~~~~
‘free’ called on unallocated object ‘test_50a’ [-Wfree-nonheap-object]
617 free (test_50a); /* { dg-warning "'free' of '&test_50a' which points to memory not on the heap \\\[CWE-590\\\]" } */
^~~~~~~~~~~~~~~
declared here
611 void test_50a (void)
^~~~~~~~
‘free’ called on unallocated object ‘my_label’ [-Wfree-nonheap-object]
623 free (&&my_label); /* { dg-warning "'free' of '&my_label' which points to memory not on the heap \\\[CWE-590\\\]" } */
^~~~~~~~~~~~~~~~~
declared here
622 my_label:
^~~~~~~~