[analyzer] non-obvious analyzer warning: Use of zero-allocated memory

[chrisdangelo]

Summary

This change clarifies the message provided when the analyzer catches the use of memory that is allocated with size zero.

[NoQ]

LGTM! Can confirm, people were confused.

I'll commit.

[• Quuxplusone]

clang/lib/StaticAnalyzer/Checkers/MallocChecker.cpp

2474–2475

Peanut gallery says:
(1) Might want to fix the typo in "Zerro" at the same time, or in a followup commit.
(2) I would naively have expected all the test cases below to give something simple like "Read/write beyond end of allocated space," because they allocate N bytes and then try to read/write into byte number N. This is never allowed in C or C++, regardless of the value of N; there's nothing special about N=0. So I don't see why it needs any special diagnostic (confusing or otherwise).

[NoQ]

Yuck I forgot to forge commit author. Sorry!!

clang/lib/StaticAnalyzer/Checkers/MallocChecker.cpp

2474–2475

The only thing special about N=0 is that the static analyzer is currently better at catching it. It's much easier to catch correctly and avoid false positives when *any* use is disallowed than when some uses are allowed but some aren't.

Speaking of typos, it probably also makes sense to fix the bug type message ("Use of zero allocated") to include a subject.

clang/lib/StaticAnalyzer/Checkers/MallocChecker.cpp

void MallocChecker::HandleUseZeroAlloc(CheckerContext &C, SourceRange Range,
 
   if (ExplodedNode *N = C.generateErrorNode()) {
     if (!BT_UseZerroAllocated[*CheckKind])
       BT_UseZerroAllocated[*CheckKind].reset(
           new BugType(CheckNames[*CheckKind], "Use of zero allocated",
                       categories::MemoryError));
 
     auto R = std::make_unique<PathSensitiveBugReport>(
-        *BT_UseZerroAllocated[*CheckKind], "Use of zero-allocated memory", N);
+        *BT_UseZerroAllocated[*CheckKind],
+        "Use of memory allocated with size zero", N);
 
     R->addRange(Range);
     if (Sym) {
       R->markInteresting(Sym);
       R->addVisitor<MallocBugVisitor>(Sym);
     }
     C.emitReport(std::move(R));
   }

clang/test/Analysis/NewDelete-checker-test.cpp

 }
 
 //-----------------------------------------
 // check for usage of zero-allocated memory
 //-----------------------------------------
 
 void testUseZeroAlloc1() {
   int *p = (int *)operator new(0);
-  *p = 1; // newdelete-warning {{Use of zero-allocated memory}}
+  *p = 1; // newdelete-warning {{Use of memory allocated with size zero}}
   delete p;
 }
 
 int testUseZeroAlloc2() {
   int *p = (int *)operator new[](0);
-  return p[0]; // newdelete-warning {{Use of zero-allocated memory}}
+  return p[0]; // newdelete-warning {{Use of memory allocated with size zero}}
   delete[] p;
 }
 
 void f(int);
 
 void testUseZeroAlloc3() {
   int *p = new int[0];
-  f(*p); // newdelete-warning {{Use of zero-allocated memory}}
+  f(*p); // newdelete-warning {{Use of memory allocated with size zero}}
   delete[] p;
 }
 
 //---------------
 // other checks
 //---------------
 
 class SomeClass {

clang/test/Analysis/malloc.c

 void CheckUseZeroAllocatedNoWarn4() {
   int *p = realloc(0, 8);
   *p = 1; // no warning
   free(p);
 }
 
 void CheckUseZeroAllocated1() {
   int *p = malloc(0);
-  *p = 1; // expected-warning {{Use of zero-allocated memory}}
+  *p = 1; // expected-warning {{Use of memory allocated with size zero}}
   free(p);
 }
 
 char CheckUseZeroAllocated2() {
   char *p = alloca(0);
-  return *p; // expected-warning {{Use of zero-allocated memory}}
+  return *p; // expected-warning {{Use of memory allocated with size zero}}
 }
 
 char CheckUseZeroWinAllocated2() {
   char *p = _alloca(0);
-  return *p; // expected-warning {{Use of zero-allocated memory}}
+  return *p; // expected-warning {{Use of memory allocated with size zero}}
 }
 
 void UseZeroAllocated(int *p) {
   if (p)
-    *p = 7; // expected-warning {{Use of zero-allocated memory}}
+    *p = 7; // expected-warning {{Use of memory allocated with size zero}}
 }
 void CheckUseZeroAllocated3() {
   int *p = malloc(0);
   UseZeroAllocated(p);
 }
 
 void f(char);
 void CheckUseZeroAllocated4() {
   char *p = valloc(0);
-  f(*p); // expected-warning {{Use of zero-allocated memory}}
+  f(*p); // expected-warning {{Use of memory allocated with size zero}}
   free(p);
 }
 
 void CheckUseZeroAllocated5() {
   int *p = calloc(0, 2);
-  *p = 1; // expected-warning {{Use of zero-allocated memory}}
+  *p = 1; // expected-warning {{Use of memory allocated with size zero}}
   free(p);
 }
 
 void CheckUseZeroAllocated6() {
   int *p = calloc(2, 0);
-  *p = 1; // expected-warning {{Use of zero-allocated memory}}
+  *p = 1; // expected-warning {{Use of memory allocated with size zero}}
   free(p);
 }
 
 void CheckUseZeroAllocated7() {
   int *p = realloc(0, 0);
-  *p = 1; // expected-warning {{Use of zero-allocated memory}}
+  *p = 1; // expected-warning {{Use of memory allocated with size zero}}
   free(p);
 }
 
 void CheckUseZeroAllocated8() {
   int *p = malloc(8);
   int *q = realloc(p, 0);
-  *q = 1; // expected-warning {{Use of zero-allocated memory}}
+  *q = 1; // expected-warning {{Use of memory allocated with size zero}}
   free(q);
 }
 
 void CheckUseZeroAllocated9() {
   int *p = realloc(0, 0);
   int *q = realloc(p, 0);
-  *q = 1; // expected-warning {{Use of zero-allocated memory}}
+  *q = 1; // expected-warning {{Use of memory allocated with size zero}}
   free(q);
 }
 
 void CheckUseZeroAllocatedPathNoWarn(_Bool b) {
   int s = 0;
   if (b)
     s= 10;
 
   char *p = malloc(s);
 
   if (b)
     *p = 1; // no warning
 
   free(p);
 }
 
 void CheckUseZeroAllocatedPathWarn(_Bool b) {
   int s = 10;
   if (b)
     s= 0;
 
   char *p = malloc(s);
 
   if (b)
-    *p = 1; // expected-warning {{Use of zero-allocated memory}}
+    *p = 1; // expected-warning {{Use of memory allocated with size zero}}
 
   free(p);
 }
 
 void CheckUseZeroReallocatedPathNoWarn(_Bool b) {
   int s = 0;
   if (b)
     s= 10;
void CheckUseZeroReallocatedPathWarn(_Bool b) {
   int s = 10;
   if (b)
     s= 0;
 
   char *p = malloc(8);
   char *q = realloc(p, s);
 
   if (b)
-    *q = 1; // expected-warning {{Use of zero-allocated memory}}
+    *q = 1; // expected-warning {{Use of memory allocated with size zero}}
 
   free(q);
 }
 
 // This case tests that storing malloc'ed memory to a static variable which is
 // then returned is not leaked.  In the absence of known contracts for functions
 // or inter-procedural analysis, this is a conservative answer.
 int *f3() {