functionDecl(anyOf(hasName("::calloc"), hasName("std::calloc"),
hasName("::realloc"), hasName("std::realloc")));
- Finder->addMatcher(
- callExpr(callee(Alloc0Func), hasArgument(0, BadArg)).bind("Alloc"), this);
- Finder->addMatcher(
- callExpr(callee(Alloc1Func), hasArgument(1, BadArg)).bind("Alloc"), this);
+ const auto Alloc0FuncPtr =
+ varDecl(hasType(isConstQualified()),
+ hasInitializer(ignoringParenImpCasts(
+ declRefExpr(hasDeclaration(Alloc0Func)))));
+ const auto Alloc1FuncPtr =
+ varDecl(hasType(isConstQualified()),
+ hasInitializer(ignoringParenImpCasts(
+ declRefExpr(hasDeclaration(Alloc1Func)))));
+
+ Finder->addMatcher(callExpr(callee(decl(anyOf(Alloc0Func, Alloc0FuncPtr))),
+ hasArgument(0, BadArg))
+ .bind("Alloc"),
+ this);
+ Finder->addMatcher(callExpr(callee(decl(anyOf(Alloc1Func, Alloc1FuncPtr))),
+ hasArgument(1, BadArg))
+ .bind("Alloc"),
+ this);
Finder->addMatcher(
cxxNewExpr(isArray(), hasArraySize(BadArg)).bind("Alloc"), this);
}
``strnlen()``, ``strnlen_s()``, ``wcslen()``, ``wcsnlen()``, and ``wcsnlen_s()``
instead of the result and the value is used as an argument to a memory
allocation function (``malloc()``, ``calloc()``, ``realloc()``, ``alloca()``) or
-the ``new[]`` operator in `C++`. Cases where ``1`` is added both to the
-parameter and the result of the ``strlen()``-like function are ignored, as are
-cases where the whole addition is surrounded by extra parentheses.
+the ``new[]`` operator in `C++`. The check detects error cases even if one of
+these functions (except the ``new[]`` operator) is called by a constant function
+pointer. Cases where ``1`` is added both to the parameter and the result of the
+``strlen()``-like function are ignored, as are cases where the whole addition is
+surrounded by extra parentheses.
`C` example code:
// CHECK-MESSAGES-NOT: :[[@LINE-1]]:28: warning: addition operator is applied to the argument of strlen
// If expression is in extra parentheses, consider it as intentional
}
+
+void (*(*const alloc_ptr)(size_t)) = malloc;
+
+void bad_indirect_alloc(char *name) {
+ char *new_name = (char *)alloc_ptr(strlen(name + 1));
+ // CHECK-MESSAGES: :[[@LINE-1]]:28: warning: addition operator is applied to the argument of strlen
+ // CHECK-FIXES: {{^ char \*new_name = \(char \*\)alloc_ptr\(}}strlen(name) + 1{{\);$}}
+}