[analyzer][MallocChecker] Improve warning messages on double-delete errors
Differential Revision: https://reviews.llvm.org/D54834
diff --git a/clang/lib/StaticAnalyzer/Checkers/MallocChecker.cpp b/clang/lib/StaticAnalyzer/Checkers/MallocChecker.cpp
index a5b774f..fb770eb 100644
--- a/clang/lib/StaticAnalyzer/Checkers/MallocChecker.cpp
+++ b/clang/lib/StaticAnalyzer/Checkers/MallocChecker.cpp
@@ -1431,7 +1431,8 @@
void MallocChecker::checkPreStmt(const CXXDeleteExpr *DE,
CheckerContext &C) const {
-
+ // This will regard deleting freed() regions as a use-after-free, rather then
+ // a double-free or double-delete error.
if (!ChecksEnabled[CK_NewDeleteChecker])
if (SymbolRef Sym = C.getSVal(DE->getArgument()).getAsSymbol())
checkUseAfterFree(Sym, C, DE->getArgument());
@@ -1628,7 +1629,8 @@
}
/// Checks if the previous call to free on the given symbol failed - if free
-/// failed, returns true. Also, returns the corresponding return value symbol.
+/// failed, returns true. Also, stores the corresponding return value symbol in
+/// \p RetStatusSymbol.
static bool didPreviousFreeFail(ProgramStateRef State,
SymbolRef Sym, SymbolRef &RetStatusSymbol) {
const SymbolRef *Ret = State->get<FreeReturnValue>(Sym);
@@ -2289,6 +2291,12 @@
if (!CheckKind.hasValue())
return;
+ // If this is a double delete error, print the appropiate warning message.
+ if (CheckKind == CK_NewDeleteChecker) {
+ ReportDoubleDelete(C, Sym);
+ return;
+ }
+
if (ExplodedNode *N = C.generateErrorNode()) {
if (!BT_DoubleFree[*CheckKind])
BT_DoubleFree[*CheckKind].reset(new BugType(
diff --git a/clang/test/Analysis/Inputs/expected-plists/NewDelete-path-notes.cpp.plist b/clang/test/Analysis/Inputs/expected-plists/NewDelete-path-notes.cpp.plist
index d74d9fc..6a3a3d3 100644
--- a/clang/test/Analysis/Inputs/expected-plists/NewDelete-path-notes.cpp.plist
+++ b/clang/test/Analysis/Inputs/expected-plists/NewDelete-path-notes.cpp.plist
@@ -194,17 +194,17 @@
</array>
<key>depth</key><integer>0</integer>
<key>extended_message</key>
- <string>Attempt to free released memory</string>
+ <string>Attempt to delete released memory</string>
<key>message</key>
- <string>Attempt to free released memory</string>
+ <string>Attempt to delete released memory</string>
</dict>
</array>
- <key>description</key><string>Attempt to free released memory</string>
+ <key>description</key><string>Attempt to delete released memory</string>
<key>category</key><string>Memory error</string>
- <key>type</key><string>Double free</string>
+ <key>type</key><string>Double delete</string>
<key>check_name</key><string>cplusplus.NewDelete</string>
<!-- This hash is experimental and going to change! -->
- <key>issue_hash_content_of_line_in_context</key><string>bd8e324d09c70b9e2be6f824a4942e5a</string>
+ <key>issue_hash_content_of_line_in_context</key><string>593b185245106bed5175ccf2753039b2</string>
<key>issue_context_kind</key><string>function</string>
<key>issue_context</key><string>test</string>
<key>issue_hash_function_offset</key><string>8</string>
@@ -423,17 +423,17 @@
</array>
<key>depth</key><integer>0</integer>
<key>extended_message</key>
- <string>Attempt to free released memory</string>
+ <string>Attempt to delete released memory</string>
<key>message</key>
- <string>Attempt to free released memory</string>
+ <string>Attempt to delete released memory</string>
</dict>
</array>
- <key>description</key><string>Attempt to free released memory</string>
+ <key>description</key><string>Attempt to delete released memory</string>
<key>category</key><string>Memory error</string>
- <key>type</key><string>Double free</string>
+ <key>type</key><string>Double delete</string>
<key>check_name</key><string>cplusplus.NewDelete</string>
<!-- This hash is experimental and going to change! -->
- <key>issue_hash_content_of_line_in_context</key><string>8bf1a5b9fdae9d86780aa6c4cdce2605</string>
+ <key>issue_hash_content_of_line_in_context</key><string>6484e9b006ede7362edef2187ba6eb37</string>
<key>issue_context_kind</key><string>function</string>
<key>issue_context</key><string>test</string>
<key>issue_hash_function_offset</key><string>3</string>
diff --git a/clang/test/Analysis/Malloc+MismatchedDeallocator+NewDelete.cpp b/clang/test/Analysis/Malloc+MismatchedDeallocator+NewDelete.cpp
index b5e47b3..e5176eb 100644
--- a/clang/test/Analysis/Malloc+MismatchedDeallocator+NewDelete.cpp
+++ b/clang/test/Analysis/Malloc+MismatchedDeallocator+NewDelete.cpp
@@ -46,7 +46,7 @@
void testNewDoubleFree() {
int *p = new int;
delete p;
- delete p; // expected-warning{{Attempt to free released memory}}
+ delete p; // expected-warning{{Attempt to delete released memory}}
}
void testNewLeak() {
diff --git a/clang/test/Analysis/NewDelete-checker-test.cpp b/clang/test/Analysis/NewDelete-checker-test.cpp
index 620237c..fcbe2c7 100644
--- a/clang/test/Analysis/NewDelete-checker-test.cpp
+++ b/clang/test/Analysis/NewDelete-checker-test.cpp
@@ -182,7 +182,7 @@
void testDoubleDelete() {
int *p = new int;
delete p;
- delete p; // expected-warning{{Attempt to free released memory}}
+ delete p; // expected-warning{{Attempt to delete released memory}}
}
void testExprDeleteArg() {
diff --git a/clang/test/Analysis/NewDelete-path-notes.cpp b/clang/test/Analysis/NewDelete-path-notes.cpp
index d9fe197..9465836 100644
--- a/clang/test/Analysis/NewDelete-path-notes.cpp
+++ b/clang/test/Analysis/NewDelete-path-notes.cpp
@@ -11,8 +11,8 @@
delete p;
// expected-note@-1 {{Memory is released}}
- delete p; // expected-warning {{Attempt to free released memory}}
- // expected-note@-1 {{Attempt to free released memory}}
+ delete p; // expected-warning {{Attempt to delete released memory}}
+ // expected-note@-1 {{Attempt to delete released memory}}
}
struct Odd {
@@ -24,7 +24,7 @@
void test(Odd *odd) {
odd->kill(); // expected-note{{Calling 'Odd::kill'}}
// expected-note@-1 {{Returning; memory was released}}
- delete odd; // expected-warning {{Attempt to free released memory}}
- // expected-note@-1 {{Attempt to free released memory}}
+ delete odd; // expected-warning {{Attempt to delete released memory}}
+ // expected-note@-1 {{Attempt to delete released memory}}
}
diff --git a/clang/test/Analysis/dtor.cpp b/clang/test/Analysis/dtor.cpp
index d843f03..2ea38e9 100644
--- a/clang/test/Analysis/dtor.cpp
+++ b/clang/test/Analysis/dtor.cpp
@@ -528,7 +528,7 @@
return *this;
}
~NonTrivial() {
- delete[] p; // expected-warning {{free released memory}}
+ delete[] p; // expected-warning {{delete released memory}}
}
};
