From 4ca45b1d00e97c590bc1bf012bd35b1f73926565 Mon Sep 17 00:00:00 2001 From: Anna Zaks Date: Wed, 22 Feb 2012 02:36:01 +0000 Subject: [analyzer] Malloc: fix another false positive. , when we return a symbol reachable to the malloced one via pointer arithmetic. llvm-svn: 151121 --- clang/lib/StaticAnalyzer/Checkers/MallocChecker.cpp | 12 +++++++++++- 1 file changed, 11 insertions(+), 1 deletion(-) (limited to 'clang/lib/StaticAnalyzer/Checkers/MallocChecker.cpp') diff --git a/clang/lib/StaticAnalyzer/Checkers/MallocChecker.cpp b/clang/lib/StaticAnalyzer/Checkers/MallocChecker.cpp index fed64f1b042..e21dde1f826 100644 --- a/clang/lib/StaticAnalyzer/Checkers/MallocChecker.cpp +++ b/clang/lib/StaticAnalyzer/Checkers/MallocChecker.cpp @@ -881,7 +881,17 @@ void MallocChecker::checkPreStmt(const ReturnStmt *S, CheckerContext &C) const { return; // Check if we are returning a symbol. - SymbolRef Sym = C.getState()->getSVal(E, C.getLocationContext()).getAsSymbol(); + SVal RetVal = C.getState()->getSVal(E, C.getLocationContext()); + SymbolRef Sym = RetVal.getAsSymbol(); + if (!Sym) + // If we are returning a field of the allocated struct or an array element, + // the callee could still free the memory. + // TODO: This logic should be a part of generic symbol escape callback. + if (const MemRegion *MR = RetVal.getAsRegion()) + if (isa(MR) || isa(MR)) + if (const SymbolicRegion *BMR = + dyn_cast(MR->getBaseRegion())) + Sym = BMR->getSymbol(); if (!Sym) return; -- cgit v1.2.3