test/Analysis/cast-to-struct.cpp

// RUN: %clang_cc1 -analyze -analyzer-checker=alpha.core.CastToStruct,core -verify %s

struct AB {
  int A;
  int B;
};

struct ABC {
  int A;
  int B;
  int C;
};

struct Base {
  Base() : A(0), B(0) {}
  virtual ~Base() {}

  int A;
  int B;
};

struct Derived : public Base {
  Derived() : Base(), C(0) {}
  int C;
};

void structToStruct(struct AB *P) {
  struct AB Ab;
  struct ABC *Abc;
  Abc = (struct ABC *)&Ab; // expected-warning {{Casting data to a larger structure type and accessing a field can lead to memory access errors or data corruption}}
  Abc = (struct ABC *)P; // No warning; It is not known what data P points at.
  Abc = (struct ABC *)&*P;

  // Don't warn when the cast is not widening.
  P = (struct AB *)&Ab; // struct AB * => struct AB *
  struct ABC Abc2;
  P = (struct AB *)&Abc2; // struct ABC * => struct AB *

  // True negatives when casting from Base to Derived.
  Derived D1, *D2;
  Base &B1 = D1;
  D2 = (Derived *)&B1;
  D2 = dynamic_cast<Derived *>(&B1);
  D2 = static_cast<Derived *>(&B1);

  // True positives when casting from Base to Derived.
  Base B2;
  D2 = (Derived *)&B2;// expected-warning {{Casting data to a larger structure type and accessing a field can lead to memory access errors or data corruption}}
  D2 = dynamic_cast<Derived *>(&B2);// expected-warning {{Casting data to a larger structure type and accessing a field can lead to memory access errors or data corruption}}
  D2 = static_cast<Derived *>(&B2);// expected-warning {{Casting data to a larger structure type and accessing a field can lead to memory access errors or data corruption}}

  // False negatives, cast from Base to Derived. With path sensitive analysis
  // these false negatives could be fixed.
  Base *B3 = &B2;
  D2 = (Derived *)B3;
  D2 = dynamic_cast<Derived *>(B3);
  D2 = static_cast<Derived *>(B3);
}

void intToStruct(int *P) {
  struct ABC *Abc;
  Abc = (struct ABC *)P; // expected-warning {{Casting a non-structure type to a structure type and accessing a field can lead to memory access errors or data corruption}}

  // Cast from void *.
  void *VP = P;
  Abc = (struct ABC *)VP;
}