[analyzer] MallocSizeofChecker false positive: when sizeof is argument

to addition.

We should not to warn in case the malloc size argument is an
addition containing 'sizeof' operator - it is common to use the pattern
to pack values of different sizes into a buffer. 

Ex:

uint8_t *buffer = (uint8_t*)malloc(dataSize + sizeof(length));

llvm-svn: 158219

2 files changed, 3 insertions, 7 deletions

diff --git a/clang/lib/StaticAnalyzer/Checkers/MallocSizeofChecker.cpp b/clang/lib/StaticAnalyzer/Checkers/MallocSizeofChecker.cpp
index 46b3500fb08..6292a472512 100644
--- a/clang/lib/StaticAnalyzer/Checkers/MallocSizeofChecker.cpp
+++ b/clang/lib/StaticAnalyzer/Checkers/MallocSizeofChecker.cpp
@@ -118,11 +118,6 @@ public:
     Visit(E->getRHS());
   }
 
-  void VisitBinAdd(const BinaryOperator *E) {
-    Visit(E->getLHS());
-    Visit(E->getRHS());
-  }
-
   void VisitImplicitCastExpr(const ImplicitCastExpr *E) {
     return Visit(E->getSubExpr());
   }
diff --git a/clang/test/Analysis/malloc-sizeof.c b/clang/test/Analysis/malloc-sizeof.c
index af8600abe5a..6eb466ac6a1 100644
--- a/clang/test/Analysis/malloc-sizeof.c
+++ b/clang/test/Analysis/malloc-sizeof.c
@@ -10,13 +10,14 @@ void free(void *ptr);
 struct A {};
 struct B {};
 
-void foo() {
+void foo(unsigned int unsignedInt, unsigned int readSize) {
   int *ip1 = malloc(sizeof(1));
   int *ip2 = malloc(4 * sizeof(int));
 
   long *lp1 = malloc(sizeof(short)); // expected-warning {{Result of 'malloc' is converted to a pointer of type 'long', which is incompatible with sizeof operand type 'short'}}
   long *lp2 = malloc(5 * sizeof(double)); // expected-warning {{Result of 'malloc' is converted to a pointer of type 'long', which is incompatible with sizeof operand type 'double'}}
-  long *lp3 = malloc(5 * sizeof(char) + 2); // expected-warning {{Result of 'malloc' is converted to a pointer of type 'long', which is incompatible with sizeof operand type 'char'}}
+  char *cp3 = malloc(5 * sizeof(char) + 2); // no warning
+  unsigned char *buf = malloc(readSize + sizeof(unsignedInt)); // no warning
 
   struct A *ap1 = calloc(1, sizeof(struct A));
   struct A *ap2 = calloc(2, sizeof(*ap1));