Alpha Checkers

void log();

int max(int a, int b) { // warn
  log();
  if (a > b)
    return a;
  return b;
}

int maxClone(int x, int y) { // similar code here
  log();
  if (x > y)
    return x;
  return y;
}

void test() {
  BOOL b = -1; // warn
}

void test() {
  int *x = (int *)malloc(11); // warn
}

// C
struct s {};

void test(int *p) {
  struct s *ps = (struct s *) p; // warn
}

// C++
class c {};

void test(int *p) {
  c *pc = (c *) p; // warn
}

void test(unsigned U, signed S) {
  if (S > 10) {
    if (U < S) {
    }
  }
  if (S < -10) {
    if (U < S) { // warn (loss of sign)
    }
  }
}

void test() {
  long long A = 1LL << 60;
  short X = A; // warn (loss of precision)
}

id date = [NSDate date];

// Warning: Object has a dynamic type 'NSDate *' which is
// incompatible with static type 'NSNumber *'"
NSNumber *number = date;
[number doubleValue];

void test() {
  int *p;
  p = (int *) 0x10000; // warn
}

// C
void test() {
  int a = 5;
  int b = a | 4 | a; // warn: identical expr on both sides
}

// C++
bool f(void);

void test(bool b) {
  int i = 10;
  if (f()) { // warn: true and false branches are identical
    do {
      i--;
    } while (f());
  } else {
    do {
      i--;
    } while (f());
  }
}

void test() {
  int x;
  int *p;
  p = &x + 1; // warn
}

void test() {
  int x, y;
  int d = &y - &x; // warn
}

struct s {};

int test(struct s *p) {
  return sizeof(p);
    // warn: sizeof(ptr) can produce an unexpected result
}

dispatch_block_t test_block_inside_block_async_leak() {
  int x = 123;
  void (^inner)(void) = ^void(void) {
    int y = x;
    ++y;
  };
  void (^outer)(void) = ^void(void) {
    int z = x;
    ++z;
    inner();
  };
  return outer; // warn: address of stack-allocated block is captured by a
                //       returned block
}

void test(int x) {
  var = 77 / x;
  if (x == 0) { } // warn
}

NonVirtual *create() {
  NonVirtual *x = new NVDerived(); // note: Casting from 'NVDerived' to
                                   //       'NonVirtual' here
  return x;
}

void sink(NonVirtual *x) {
  delete x; // warn: destruction of a polymorphic object with no virtual
            //       destructor
}

void bad_copy_assign_operator_list1(std::list &L1,
                                    const std::list &L2) {
  auto i0 = L1.cbegin();
  L1 = L2;
  *i0; // warn: invalidated iterator accessed
}

void simple_bad_end(const std::vector &v) {
  auto i = v.end();
  *i; // warn: iterator accessed outside of its range
}

void bad_insert3(std::vector &v1, std::vector &v2) {
  v2.insert(v1.cbegin(), v2.cbegin(), v2.cend()); // warn: container accessed
                                                  //       using foreign
                                                  //       iterator argument
  v1.insert(v1.cbegin(), v1.cbegin(), v2.cend()); // warn: iterators of
                                                  //       different containers
                                                  //       used where the same
                                                  //       container is
                                                  //       expected
  v1.insert(v1.cbegin(), v2.cbegin(), v1.cend()); // warn: iterators of
                                                  //       different containers
                                                  //       used where the same
                                                  //       container is
                                                  //       expected
}

struct A {
  void foo() {}
};

void f() {
  A a;
  A b = std::move(a); // note: 'a' became 'moved-from' here
  a.foo();            // warn: method call on a 'moved-from' object 'a'
}

// C
int test() {
  int x = 1;
  while(x);
  return x; // warn
}

// C++
void test() {
  int a = 2;

  while (a > 1)
    a--;

  if (a > 1)
    a++; // warn
}

// Objective-C
void test(id x) {
  return;
  [x retain]; // warn
}

@interface MyClass : NSObject {}
@property (readonly) id A;
- (void) foo;
@end

@implementation MyClass
- (void) foo {
  _A = 0; // warn
}
@end

@interface MyClass : NSObject {}
@property (readonly) id A;
- (void) fAnnotated __attribute__((
    annotate("objc_no_direct_instance_variable_assignment")));
- (void) fNotAnnotated;
@end

@implementation MyClass
- (void) fAnnotated {
  _A = 0; // warn
}
- (void) fNotAnnotated {
  _A = 0; // no warn
}
@end

@protocol Invalidation <NSObject>
- (void) invalidate
  __attribute__((annotate("objc_instance_variable_invalidator")));
@end

@interface InvalidationImpObj : NSObject <Invalidation>
@end

@interface SubclassInvalidationImpObj : InvalidationImpObj {
  InvalidationImpObj *var;
}
- (void)invalidate;
@end

@implementation SubclassInvalidationImpObj
- (void) invalidate {}
@end
// warn: var needs to be invalidated or set to nil

@protocol Invalidation <NSObject>
- (void)invalidate
  __attribute__((annotate("objc_instance_variable_invalidator")));
@end

@interface NeedInvalidation : NSObject <Invalidation>
@end

@interface MissingInvalidationMethodDecl : NSObject {
  NeedInvalidation *Var; // warn
}
@end

@implementation MissingInvalidationMethodDecl
@end

NSString *reminderText =
  NSLocalizedString(@"None", @"Indicates no reminders");
if (reminderCount == 1) {
  // Warning: Plural cases are not supported across all languages.
  // Use a .stringsdict file instead
  reminderText =
    NSLocalizedString(@"1 Reminder", @"Indicates single reminder");
} else if (reminderCount >= 2) {
  // Warning: Plural cases are not supported across all languages.
  // Use a .stringsdict file instead
  reminderText =
    [NSString stringWithFormat:
      NSLocalizedString(@"%@ Reminders", @"Indicates multiple reminders"),
        reminderCount];
}

void test() {
  char *s = "";
  char c = s[1]; // warn
}

struct seven_words {
  int c[7];
};

void test() {
  struct seven_words a, *p;
  p = &a;
  p[0] = a;
  p[1] = a;
  p[2] = a; // warn
}

// note: requires unix.Malloc or
// alpha.unix.MallocWithAnnotations checks enabled.
void test() {
  int *p = malloc(12);
  p[3] = 4; // warn
}

void test() {
  char a[2];
  int *b = (int*)a;
  b[1] = 3; // warn
}

void test() {
  char *s = "";
  char c = s[1]; // warn
}

void test() {
  int buf[100];
  int *p = buf;
  p = p + 99;
  p[1] = 1; // warn
}

// note: compiler has internal check for this.
// Use -Wno-array-bounds to suppress compiler warning.
void test() {
  int buf[100][100];
  buf[0][-1] = 1; // warn
}

// note: requires alpha.security.taint check turned on.
void test() {
  char s[] = "abc";
  int x = getchar();
  char c = s[x]; // warn: index is tainted
}

void test(int n) {
  void *p = malloc(n * sizeof(int)); // warn
}

void test(int n) {
  void *c = mmap(NULL, 32, PROT_READ | PROT_WRITE | PROT_EXEC,
                 MAP_PRIVATE | MAP_ANON, -1, 0);
  // warn: Both PROT_WRITE and PROT_EXEC flags are set. This can lead to
  //       exploitable memory regions, which could be overwritten with malicious
  //       code
}

static int A[10];

int *test() {
  int *p = A + 10;
  return p; // warn
}

int test(void) {
  int x;
  return x; // warn: undefined or garbage returned
}

void test() {
  char x = getchar(); // 'x' marked as tainted
  system(&x); // warn: untrusted data is passed to a system call
}

// note: compiler internally checks if the second param to
// sprintf is a string literal or not.
// Use -Wno-format-security to suppress compiler warning.
void test() {
  char s[10], buf[10];
  fscanf(stdin, "%s", s); // 's' marked as tainted

  sprintf(buf, s); // warn: untrusted data as a format string
}

void test() {
  size_t ts;
  scanf("%zd", &ts); // 'ts' marked as tainted
  int *p = (int *)malloc(ts * sizeof(int));
    // warn: untrusted data as buffer size
}

void test() {
  std::mutex m;
  m.lock();
  sleep(3); // warn: a blocking function sleep is called inside a critical
            //       section
  m.unlock();
}

void f();

void test() {
  chroot("/usr/local");
  f(); // warn: no call of chdir("/") immediately after chroot
}

pthread_mutex_t mtx;

void test() {
  pthread_mutex_lock(&mtx);
  pthread_mutex_lock(&mtx);
    // warn: this lock has already been acquired
}

lck_mtx_t lck1, lck2;

void test() {
  lck_mtx_lock(&lck1);
  lck_mtx_lock(&lck2);
  lck_mtx_unlock(&lck1);
    // warn: this was not the most recently acquired lock
}

lck_mtx_t lck1, lck2;

void test() {
  if (lck_mtx_try_lock(&lck1) == 0)
    return;

  lck_mtx_lock(&lck2);
  lck_mtx_unlock(&lck1);
    // warn: this was not the most recently acquired lock
}

void test() {
  FILE *F = fopen("myfile.txt", "w");
} // warn: opened file is never closed

void test() {
  FILE *F = fopen("myfile.txt", "w");

  if (F)
    fclose(F);

  fclose(F); // warn: closing a previously closed file stream
}

void test() {
  FILE *p = fopen("foo", "r");
} // warn: opened file is never closed

void test() {
  FILE *p = fopen("foo", "r");
  fseek(p, 1, SEEK_SET); // warn: stream pointer might be NULL
  fclose(p);
}

void test() {
  FILE *p = fopen("foo", "r");

  if (p)
    fseek(p, 1, 3);
     // warn: third arg should be SEEK_SET, SEEK_END, or SEEK_CUR

  fclose(p);
}

void test() {
  FILE *p = fopen("foo", "r");
  fclose(p);
  fclose(p); // warn: already closed
}

void test() {
  FILE *p = tmpfile();
  ftell(p); // warn: stream pointer might be NULL
  fclose(p);
}

void test() {
  int a[4] = {0};
  memcpy(a + 2, a + 1, 8); // warn
}

void test() {
  int y = strlen((char *)&test); // warn
}

void test(char *y) {
  char x[4];
  if (strlen(y) == 4)
    strncpy(x, y, 5); // warn
}

// C++
void test() {
 int a = 1, b = 2;
 std::unordered_set UnorderedPtrSet = {&a, &b};

 for (auto i : UnorderedPtrSet) // warn
   f(i);
}

// C++
void test() {
 int a = 1, b = 2;
 std::vector V = {&a, &b};
 std::sort(V.begin(), V.end()); // warn
}