|
@@ -137,7 +137,7 @@ class RefState {
|
|
const Stmt *S;
|
|
const Stmt *S;
|
|
|
|
|
|
Kind K : 3;
|
|
Kind K : 3;
|
|
- AllocationFamily Family : 29;
|
|
|
|
|
|
+ AllocationFamily Family : 3;
|
|
|
|
|
|
RefState(Kind k, const Stmt *s, AllocationFamily family)
|
|
RefState(Kind k, const Stmt *s, AllocationFamily family)
|
|
: S(s), K(k), Family(family) {
|
|
: S(s), K(k), Family(family) {
|
|
@@ -1431,8 +1431,7 @@ ProgramStateRef MallocChecker::addExtentSize(CheckerContext &C,
|
|
|
|
|
|
void MallocChecker::checkPreStmt(const CXXDeleteExpr *DE,
|
|
void MallocChecker::checkPreStmt(const CXXDeleteExpr *DE,
|
|
CheckerContext &C) const {
|
|
CheckerContext &C) const {
|
|
- // This will regard deleting freed() regions as a use-after-free, rather then
|
|
|
|
- // a double-free or double-delete error.
|
|
|
|
|
|
+
|
|
if (!ChecksEnabled[CK_NewDeleteChecker])
|
|
if (!ChecksEnabled[CK_NewDeleteChecker])
|
|
if (SymbolRef Sym = C.getSVal(DE->getArgument()).getAsSymbol())
|
|
if (SymbolRef Sym = C.getSVal(DE->getArgument()).getAsSymbol())
|
|
checkUseAfterFree(Sym, C, DE->getArgument());
|
|
checkUseAfterFree(Sym, C, DE->getArgument());
|
|
@@ -1629,8 +1628,7 @@ ProgramStateRef MallocChecker::FreeMemAux(CheckerContext &C,
|
|
}
|
|
}
|
|
|
|
|
|
/// Checks if the previous call to free on the given symbol failed - if free
|
|
/// Checks if the previous call to free on the given symbol failed - if free
|
|
-/// failed, returns true. Also, stores the corresponding return value symbol in
|
|
|
|
-/// \p RetStatusSymbol.
|
|
|
|
|
|
+/// failed, returns true. Also, returns the corresponding return value symbol.
|
|
static bool didPreviousFreeFail(ProgramStateRef State,
|
|
static bool didPreviousFreeFail(ProgramStateRef State,
|
|
SymbolRef Sym, SymbolRef &RetStatusSymbol) {
|
|
SymbolRef Sym, SymbolRef &RetStatusSymbol) {
|
|
const SymbolRef *Ret = State->get<FreeReturnValue>(Sym);
|
|
const SymbolRef *Ret = State->get<FreeReturnValue>(Sym);
|
|
@@ -2291,12 +2289,6 @@ void MallocChecker::ReportDoubleFree(CheckerContext &C, SourceRange Range,
|
|
if (!CheckKind.hasValue())
|
|
if (!CheckKind.hasValue())
|
|
return;
|
|
return;
|
|
|
|
|
|
- // If this is a double delete error, print the appropiate warning message.
|
|
|
|
- if (CheckKind == CK_NewDeleteChecker) {
|
|
|
|
- ReportDoubleDelete(C, Sym);
|
|
|
|
- return;
|
|
|
|
- }
|
|
|
|
-
|
|
|
|
if (ExplodedNode *N = C.generateErrorNode()) {
|
|
if (ExplodedNode *N = C.generateErrorNode()) {
|
|
if (!BT_DoubleFree[*CheckKind])
|
|
if (!BT_DoubleFree[*CheckKind])
|
|
BT_DoubleFree[*CheckKind].reset(new BugType(
|
|
BT_DoubleFree[*CheckKind].reset(new BugType(
|