[clang][analyzer] Added partial wide character support to CStringChecker

[balazske]

Summary

Support for functions wmemcpy, wcslen, wcsnlen is added to the checker.
Documentation and tests are updated and extended with the new functions.

[martong]

Nice improvement and the tests are meaningful!

clang/test/Analysis/cstring.c

Hadn't we have already a test file for this checker? What about string.c and bstring.c? You might have added redundant test cases in the new test file.

clang/test/Analysis/cstring.c

36

Could you please elaborate why this does not work with str?

68–69

I think, this would deserve a FIXME comment.

[balazske]

Fix in overlap check, replaced test file.

[balazske]

I did not found the existing tests in other files, now all tests for the "non-wide" functions are copied for the "wide" functions. I do not like fully this solution but a single test file with macros for wide and non-wide case is probably not better.

[balazske]

clang/test/Analysis/wstring.c

385 ↗

(On Diff #446385)

The problem may be that the global constant is not encountered as statement when a function is analyzed.

[martong]

Okay, thanks for the update. LGTM!

clang/test/Analysis/wstring.c

385 ↗

(On Diff #446385)

Do we have the same problem in the non-wide case?

[balazske]

clang/test/Analysis/wstring.c

385 ↗

(On Diff #446385)

Yes (the previous "cstring.c" file contained that test). The problem looks fixable if the string length is computed at first use, not at the variable declaration.

clang/docs/analyzer/checkers.rst

strncat(dest, """""""""""""""""""""""""*", sizeof(dest));
      // warn: potential buffer overflow
  }
 
 .. _unix-cstring-NullArg:
 
 unix.cstring.NullArg (C)
 """""""""""""""""""""""""
 Check for null pointers being passed as arguments to C string functions:
-``strlen, strnlen, strcpy, strncpy, strcat, strncat, strcmp, strncmp, strcasecmp, strncasecmp``.
+``strlen, strnlen, strcpy, strncpy, strcat, strncat, strcmp, strncmp, strcasecmp, strncasecmp, wcslen, wcsnlen``.
 
 .. code-block:: c
 
  int test() {
    return strlen(0); // warn
  }
 
 .. _osx-checkers:
void test() {
    fclose(p);
  }
 
 
 .. _alpha-unix-cstring-BufferOverlap:
 
 alpha.unix.cstring.BufferOverlap (C)
 """"""""""""""""""""""""""""""""""""
-Checks for overlap in two buffer arguments. Applies to:  ``memcpy, mempcpy``.
+Checks for overlap in two buffer arguments. Applies to:  ``memcpy, mempcpy, wmemcpy``.
 
 .. code-block:: c
 
  void test() {
    int a[4] = {0};
    memcpy(a + 2, a + 1, 8); // warn
  }
 
 .. _alpha-unix-cstring-NotNullTerminated:
 
 alpha.unix.cstring.NotNullTerminated (C)
 """"""""""""""""""""""""""""""""""""""""
-Check for arguments which are not null-terminated strings; applies to: ``strlen, strnlen, strcpy, strncpy, strcat, strncat``.
+Check for arguments which are not null-terminated strings; applies to: ``strlen, strnlen, strcpy, strncpy, strcat, strncat, wcslen, wcsnlen``.
 
 .. code-block:: c
 
  void test() {
    int y = strlen((char *)&test); // warn
  }
 
 .. _alpha-unix-cstring-OutOfBounds:
 
 alpha.unix.cstring.OutOfBounds (C)
 """"""""""""""""""""""""""""""""""
-Check for out-of-bounds access in string functions; applies to:`` strncopy, strncat``.
+Check for out-of-bounds access in string functions, such as:
+``memcpy, bcopy, strcpy, strncpy, strcat, strncat, memmove, memcmp, memset`` and more.
 
-This check also applies to string literals, except there is a known bug in that
-the analyzer cannot detect embedded NULL characters.
+This check also works with string literals, except there is a known bug in that
+the analyzer cannot detect embedded NULL characters when determining the string length.
 
 .. code-block:: c
 
- void test() {
-   int y = strlen((char *)&test); // warn
+ void test1() {
+   const char str[] = "Hello world";
+   char buffer[] = "Hello world";
+   memcpy(buffer, str, sizeof(str) + 1); // warn
+ }
+
+ void test2() {
+   const char str[] = "Hello world";
+   char buffer[] = "Helloworld";
+   memcpy(buffer, str, sizeof(str)); // warn
  }
 
 .. _alpha-unix-cstring-UninitializedRead:
 
 alpha.unix.cstring.UninitializedRead (C)
 """"""""""""""""""""""""""""""""""""""""
 Check for uninitialized reads from common memory copy/manipulation functions such as:
  ``memcpy, mempcpy, memmove, memcmp, strcmp, strncmp, strcpy, strlen, strsep`` and many more.

clang/lib/StaticAnalyzer/Checkers/CStringChecker.cpp

 #include "clang/StaticAnalyzer/Core/PathSensitive/CallEvent.h"
 #include "clang/StaticAnalyzer/Core/PathSensitive/CheckerContext.h"
 #include "clang/StaticAnalyzer/Core/PathSensitive/DynamicExtent.h"
 #include "clang/StaticAnalyzer/Core/PathSensitive/ProgramStateTrait.h"
 #include "llvm/ADT/STLExtras.h"
 #include "llvm/ADT/SmallString.h"
 #include "llvm/ADT/StringExtras.h"
 #include "llvm/Support/raw_ostream.h"
+#include <functional>
 
 using namespace clang;
 using namespace ento;
+using namespace std::placeholders;
 
 namespace {
 struct AnyArgExpr {
   // FIXME: Remove constructor in C++17 to turn it into an aggregate.
   AnyArgExpr(const Expr *Expression, unsigned ArgumentIndex)
       : Expression{Expression}, ArgumentIndex{ArgumentIndex} {}
   const Expr *Expression;
   unsigned ArgumentIndex;
public:
   ProgramStateRef
     checkRegionChanges(ProgramStateRef state,
                        const InvalidatedSymbols *,
                        ArrayRef<const MemRegion *> ExplicitRegions,
                        ArrayRef<const MemRegion *> Regions,
                        const LocationContext *LCtx,
                        const CallEvent *Call) const;
 
-  typedef void (CStringChecker::*FnCheck)(CheckerContext &,
-                                          const CallExpr *) const;
+  using FnCheck = std::function<void(const CStringChecker *, CheckerContext &,
+                                     const CallExpr *)>;
+
   CallDescriptionMap<FnCheck> Callbacks = {
-      {{CDF_MaybeBuiltin, "memcpy", 3}, &CStringChecker::evalMemcpy},
+      {{CDF_MaybeBuiltin, "memcpy", 3},
+       std::bind(&CStringChecker::evalMemcpy, _1, _2, _3, false)},
+      {{CDF_MaybeBuiltin, "wmemcpy", 3},
+       std::bind(&CStringChecker::evalMemcpy, _1, _2, _3, true)},
       {{CDF_MaybeBuiltin, "mempcpy", 3}, &CStringChecker::evalMempcpy},
       {{CDF_MaybeBuiltin, "memcmp", 3}, &CStringChecker::evalMemcmp},
       {{CDF_MaybeBuiltin, "memmove", 3}, &CStringChecker::evalMemmove},
       {{CDF_MaybeBuiltin, "memset", 3}, &CStringChecker::evalMemset},
       {{CDF_MaybeBuiltin, "explicit_memset", 3}, &CStringChecker::evalMemset},
       {{CDF_MaybeBuiltin, "strcpy", 2}, &CStringChecker::evalStrcpy},
       {{CDF_MaybeBuiltin, "strncpy", 3}, &CStringChecker::evalStrncpy},
       {{CDF_MaybeBuiltin, "stpcpy", 2}, &CStringChecker::evalStpcpy},
       {{CDF_MaybeBuiltin, "strlcpy", 3}, &CStringChecker::evalStrlcpy},
       {{CDF_MaybeBuiltin, "strcat", 2}, &CStringChecker::evalStrcat},
       {{CDF_MaybeBuiltin, "strncat", 3}, &CStringChecker::evalStrncat},
       {{CDF_MaybeBuiltin, "strlcat", 3}, &CStringChecker::evalStrlcat},
       {{CDF_MaybeBuiltin, "strlen", 1}, &CStringChecker::evalstrLength},
+      {{CDF_MaybeBuiltin, "wcslen", 1}, &CStringChecker::evalstrLength},
       {{CDF_MaybeBuiltin, "strnlen", 2}, &CStringChecker::evalstrnLength},
+      {{CDF_MaybeBuiltin, "wcsnlen", 2}, &CStringChecker::evalstrnLength},
       {{CDF_MaybeBuiltin, "strcmp", 2}, &CStringChecker::evalStrcmp},
       {{CDF_MaybeBuiltin, "strncmp", 3}, &CStringChecker::evalStrncmp},
       {{CDF_MaybeBuiltin, "strcasecmp", 2}, &CStringChecker::evalStrcasecmp},
       {{CDF_MaybeBuiltin, "strncasecmp", 3}, &CStringChecker::evalStrncasecmp},
       {{CDF_MaybeBuiltin, "strsep", 2}, &CStringChecker::evalStrsep},
       {{CDF_MaybeBuiltin, "bcopy", 3}, &CStringChecker::evalBcopy},
       {{CDF_MaybeBuiltin, "bcmp", 3}, &CStringChecker::evalMemcmp},
       {{CDF_MaybeBuiltin, "bzero", 2}, &CStringChecker::evalBzero},
       {{CDF_MaybeBuiltin, "explicit_bzero", 2}, &CStringChecker::evalBzero},
   };
 
   // These require a bit of special handling.
   CallDescription StdCopy{{"std", "copy"}, 3},
       StdCopyBackward{{"std", "copy_backward"}, 3};
 
   FnCheck identifyCall(const CallEvent &Call, CheckerContext &C) const;
-  void evalMemcpy(CheckerContext &C, const CallExpr *CE) const;
+  void evalMemcpy(CheckerContext &C, const CallExpr *CE, bool IsWide) const;
   void evalMempcpy(CheckerContext &C, const CallExpr *CE) const;
   void evalMemmove(CheckerContext &C, const CallExpr *CE) const;
   void evalBcopy(CheckerContext &C, const CallExpr *CE) const;
   void evalCopyCommon(CheckerContext &C, const CallExpr *CE,
                       ProgramStateRef state, SizeArgExpr Size,
                       DestinationArgExpr Dest, SourceArgExpr Source,
-                      bool Restricted, bool IsMempcpy) const;
+                      bool Restricted, bool IsMempcpy, bool IsWide) const;
 
   void evalMemcmp(CheckerContext &C, const CallExpr *CE) const;
 
   void evalstrLength(CheckerContext &C, const CallExpr *CE) const;
   void evalstrnLength(CheckerContext &C, const CallExpr *CE) const;
   void evalstrLengthCommon(CheckerContext &C,
                            const CallExpr *CE,
                            bool IsStrnlen = false) const;
static bool memsetAux(const Expr *DstBuffer, SVal CharE,
                         const Expr *Size, CheckerContext &C,
                         ProgramStateRef &State);
 
   // Re-usable checks
   ProgramStateRef checkNonNull(CheckerContext &C, ProgramStateRef State,
                                AnyArgExpr Arg, SVal l) const;
   ProgramStateRef CheckLocation(CheckerContext &C, ProgramStateRef state,
                                 AnyArgExpr Buffer, SVal Element,
-                                AccessKind Access) const;
+                                AccessKind Access, bool IsWide = false) const;
   ProgramStateRef CheckBufferAccess(CheckerContext &C, ProgramStateRef State,
                                     AnyArgExpr Buffer, SizeArgExpr Size,
-                                    AccessKind Access) const;
+                                    AccessKind Access,
+                                    bool IsWide = false) const;
   ProgramStateRef CheckOverlap(CheckerContext &C, ProgramStateRef state,
                                SizeArgExpr Size, AnyArgExpr First,
                                AnyArgExpr Second) const;
   void emitOverlapBug(CheckerContext &C,
                       ProgramStateRef state,
                       const Stmt *First,
                       const Stmt *Second) const;
 
ProgramStateRef CStringChecker::checkNonNull(CheckerContext &C,
   assert(stateNonNull);
   return stateNonNull;
 }
 
 // FIXME: This was originally copied from ArrayBoundChecker.cpp. Refactor?
 ProgramStateRef CStringChecker::CheckLocation(CheckerContext &C,
                                               ProgramStateRef state,
                                               AnyArgExpr Buffer, SVal Element,
-                                              AccessKind Access) const {
+                                              AccessKind Access,
+                                              bool IsWide) const {
 
   // If a previous check has failed, propagate the failure.
   if (!state)
     return nullptr;
 
   // Check for out of bound array element access.
   const MemRegion *R = Element.getAsRegion();
   if (!R)
     return state;
 
   const auto *ER = dyn_cast<ElementRegion>(R);
   if (!ER)
     return state;
 
-  if (ER->getValueType() != C.getASTContext().CharTy)
+  SValBuilder &svalBuilder = C.getSValBuilder();
+  ASTContext &Ctx = svalBuilder.getContext();
+
+  // Get the index of the accessed element.
+  NonLoc Idx = ER->getIndex();
+
+  if (!IsWide) {
+    if (ER->getValueType() != Ctx.CharTy)
+      return state;
+  } else {
+    if (ER->getValueType() != Ctx.WideCharTy)
+      return state;
+
+    QualType SizeTy = Ctx.getSizeType();
+    NonLoc WideSize =
+        svalBuilder
+            .makeIntVal(Ctx.getTypeSizeInChars(Ctx.WideCharTy).getQuantity(),
+                        SizeTy)
+            .castAs<NonLoc>();
+    SVal Offset = svalBuilder.evalBinOpNN(state, BO_Mul, Idx, WideSize, SizeTy);
+    if (Offset.isUnknown())
       return state;
+    Idx = Offset.castAs<NonLoc>();
+  }
 
   // Get the size of the array.
   const auto *superReg = cast<SubRegion>(ER->getSuperRegion());
   DefinedOrUnknownSVal Size =
       getDynamicExtent(state, superReg, C.getSValBuilder());
 
-  // Get the index of the accessed element.
-  DefinedOrUnknownSVal Idx = ER->getIndex().castAs<DefinedOrUnknownSVal>();
-
   ProgramStateRef StInBound, StOutBound;
   std::tie(StInBound, StOutBound) = state->assumeInBoundDual(Idx, Size);
   if (StOutBound && !StInBound) {
     // These checks are either enabled by the CString out-of-bounds checker
     // explicitly or implicitly by the Malloc checker.
     // In the latter case we only do modeling but do not emit warning.
     if (!Filter.CheckCStringOutOfBounds)
       return nullptr;
if (Access == AccessKind::read) {
     }
   }
 
   // Array bound check succeeded.  From this point forward the array bound
   // should always succeed.
   return StInBound;
 }
 
-ProgramStateRef CStringChecker::CheckBufferAccess(CheckerContext &C,
-                                                  ProgramStateRef State,
-                                                  AnyArgExpr Buffer,
-                                                  SizeArgExpr Size,
-                                                  AccessKind Access) const {
+ProgramStateRef
+CStringChecker::CheckBufferAccess(CheckerContext &C, ProgramStateRef State,
+                                  AnyArgExpr Buffer, SizeArgExpr Size,
+                                  AccessKind Access, bool IsWide) const {
   // If a previous check has failed, propagate the failure.
   if (!State)
     return nullptr;
 
   SValBuilder &svalBuilder = C.getSValBuilder();
   ASTContext &Ctx = svalBuilder.getContext();
 
   QualType SizeTy = Size.Expression->getType();
-  QualType PtrTy = Ctx.getPointerType(Ctx.CharTy);
+  QualType PtrTy = Ctx.getPointerType(IsWide ? Ctx.WideCharTy : Ctx.CharTy);
 
   // Check that the first buffer is non-null.
   SVal BufVal = C.getSVal(Buffer.Expression);
   State = checkNonNull(C, State, Buffer, BufVal);
   if (!State)
     return nullptr;
 
   // If out-of-bounds checking is turned off, skip the rest.
CStringChecker::CheckBufferAccess(CheckerContext &C, ProgramStateRef State,
 
   // Check that the first buffer is sufficiently long.
   SVal BufStart =
       svalBuilder.evalCast(BufVal, PtrTy, Buffer.Expression->getType());
   if (Optional<Loc> BufLoc = BufStart.getAs<Loc>()) {
 
     SVal BufEnd =
         svalBuilder.evalBinOpLN(State, BO_Add, *BufLoc, LastOffset, PtrTy);
-    State = CheckLocation(C, State, Buffer, BufEnd, Access);
+    State = CheckLocation(C, State, Buffer, BufEnd, Access, IsWide);
 
     // If the buffer isn't large enough, abort.
     if (!State)
       return nullptr;
   }
 
   // Large enough or not, return this state!
   return State;

 //===----------------------------------------------------------------------===//
 // evaluation of individual function calls.
 //===----------------------------------------------------------------------===//
 
 void CStringChecker::evalCopyCommon(CheckerContext &C, const CallExpr *CE,
                                     ProgramStateRef state, SizeArgExpr Size,
                                     DestinationArgExpr Dest,
                                     SourceArgExpr Source, bool Restricted,
-                                    bool IsMempcpy) const {
+                                    bool IsMempcpy, bool IsWide) const {
   CurrentFunctionDescription = "memory copy function";
 
   // See if the size argument is zero.
   const LocationContext *LCtx = C.getLocationContext();
   SVal sizeVal = state->getSVal(Size.Expression, LCtx);
   QualType sizeTy = Size.Expression->getType();
 
   ProgramStateRef stateZeroSize, stateNonZeroSize;
if (stateNonZeroSize) {
 
     // Ensure the source is not null. If it is NULL there will be a
     // NULL pointer dereference.
     state = checkNonNull(C, state, Source, srcVal);
     if (!state)
       return;
 
     // Ensure the accesses are valid and that the buffers do not overlap.
-    state = CheckBufferAccess(C, state, Dest, Size, AccessKind::write);
-    state = CheckBufferAccess(C, state, Source, Size, AccessKind::read);
+    state = CheckBufferAccess(C, state, Dest, Size, AccessKind::write, IsWide);
+    state = CheckBufferAccess(C, state, Source, Size, AccessKind::read, IsWide);
 
     if (Restricted)
       state = CheckOverlap(C, state, Size, Dest, Source);
 
     if (!state)
       return;
 
     // If this is mempcpy, get the byte after the last byte copied and
if (stateNonZeroSize) {
     state = InvalidateBuffer(C, state, Source.Expression,
                              C.getSVal(Source.Expression),
                              /*IsSourceBuffer*/ true, nullptr);
 
     C.addTransition(state);
   }
 }
 
-void CStringChecker::evalMemcpy(CheckerContext &C, const CallExpr *CE) const {
+void CStringChecker::evalMemcpy(CheckerContext &C, const CallExpr *CE,
+                                bool IsWide) const {
   // void *memcpy(void *restrict dst, const void *restrict src, size_t n);
   // The return value is the address of the destination buffer.
   DestinationArgExpr Dest = {CE->getArg(0), 0};
   SourceArgExpr Src = {CE->getArg(1), 1};
   SizeArgExpr Size = {CE->getArg(2), 2};
 
   ProgramStateRef State = C.getState();
 
   constexpr bool IsRestricted = true;
   constexpr bool IsMempcpy = false;
-  evalCopyCommon(C, CE, State, Size, Dest, Src, IsRestricted, IsMempcpy);
+  evalCopyCommon(C, CE, State, Size, Dest, Src, IsRestricted, IsMempcpy,
+                 IsWide);
 }
 
 void CStringChecker::evalMempcpy(CheckerContext &C, const CallExpr *CE) const {
   // void *mempcpy(void *restrict dst, const void *restrict src, size_t n);
   // The return value is a pointer to the byte following the last written byte.
   DestinationArgExpr Dest = {CE->getArg(0), 0};
   SourceArgExpr Src = {CE->getArg(1), 1};
   SizeArgExpr Size = {CE->getArg(2), 2};
 
   constexpr bool IsRestricted = true;
   constexpr bool IsMempcpy = true;
-  evalCopyCommon(C, CE, C.getState(), Size, Dest, Src, IsRestricted, IsMempcpy);
+  evalCopyCommon(C, CE, C.getState(), Size, Dest, Src, IsRestricted, IsMempcpy,
+                 false);
 }
 
 void CStringChecker::evalMemmove(CheckerContext &C, const CallExpr *CE) const {
   // void *memmove(void *dst, const void *src, size_t n);
   // The return value is the address of the destination buffer.
   DestinationArgExpr Dest = {CE->getArg(0), 0};
   SourceArgExpr Src = {CE->getArg(1), 1};
   SizeArgExpr Size = {CE->getArg(2), 2};
 
   constexpr bool IsRestricted = false;
   constexpr bool IsMempcpy = false;
-  evalCopyCommon(C, CE, C.getState(), Size, Dest, Src, IsRestricted, IsMempcpy);
+  evalCopyCommon(C, CE, C.getState(), Size, Dest, Src, IsRestricted, IsMempcpy,
+                 false);
 }
 
 void CStringChecker::evalBcopy(CheckerContext &C, const CallExpr *CE) const {
   // void bcopy(const void *src, void *dst, size_t n);
   SourceArgExpr Src(CE->getArg(0), 0);
   DestinationArgExpr Dest = {CE->getArg(1), 1};
   SizeArgExpr Size = {CE->getArg(2), 2};
 
   constexpr bool IsRestricted = false;
   constexpr bool IsMempcpy = false;
-  evalCopyCommon(C, CE, C.getState(), Size, Dest, Src, IsRestricted, IsMempcpy);
+  evalCopyCommon(C, CE, C.getState(), Size, Dest, Src, IsRestricted, IsMempcpy,
+                 false);
 }
 
 void CStringChecker::evalMemcmp(CheckerContext &C, const CallExpr *CE) const {
   // int memcmp(const void *s1, const void *s2, size_t n);
   CurrentFunctionDescription = "memory comparison function";
 
   AnyArgExpr Left = {CE->getArg(0), 0};
   AnyArgExpr Right = {CE->getArg(1), 1};
bool CStringChecker::evalCall(const CallEvent &Call, CheckerContext &C) const {
   FnCheck Callback = identifyCall(Call, C);
 
   // If the callee isn't a string function, let another checker handle it.
   if (!Callback)
     return false;
 
   // Check and evaluate the call.
   const auto *CE = cast<CallExpr>(Call.getOriginExpr());
-  (this->*Callback)(C, CE);
+  Callback(this, C, CE);
 
   // If the evaluate call resulted in no change, chain to the next eval call
   // handler.
   // Note, the custom CString evaluation calls assume that basic safety
   // properties are held. However, if the user chooses to turn off some of these
   // checks, we ignore the issues and leave the call evaluation to a generic
   // handler.
   return C.isDifferent();

clang/test/Analysis/cstring.c

+// RUN: %clang_analyze_cc1 -analyzer-checker=unix.cstring \
+// RUN:                    -analyzer-checker=alpha.unix.cstring \
+// RUN:                    -analyzer-checker=debug.ExprInspection \
+// RUN:                    -w -verify %s
+
+typedef __SIZE_TYPE__ size_t;
+typedef __WCHAR_TYPE__ wchar_t;
+void *memcpy(void *dest, const void *src,
+                 size_t count);
+wchar_t *wmemcpy(wchar_t *restrict dest, const wchar_t *restrict src,
+                 size_t count);
+size_t strlen(const char *s);
+size_t wcslen(const wchar_t *s);
+size_t strnlen(const char *s, size_t maxlen);
+size_t wcsnlen(const wchar_t *s, size_t maxlen);
+
+static const char str[] = "Hello world";
+static const wchar_t w_str[] = L"Hello world";
+
+extern void clang_analyzer_eval(int);
+
+void test_sizeof(void) {
+  char buffer[32];
+  memcpy(buffer, str, sizeof(str));
+  memcpy(buffer, str, sizeof(str) + 1); // expected-warning {{Memory copy function accesses out-of-bound array element [alpha.unix.cstring.OutOfBounds]}}
+}
+
+void w_test_sizeof(void) {
+  wchar_t w_buffer[32];
+  wmemcpy(w_buffer, w_str, sizeof(w_str) / sizeof(w_str[0]));
+  wmemcpy(w_buffer, w_str, (sizeof(w_str) / sizeof(w_str[0])) + 1); // expected-warning {{Memory copy function accesses out-of-bound array element}}
+}
+
+void test_strlen(void) {
+  char buffer[32];
+  // FIXME: This should work with 'str' instead of 'str1'
+  const char str1[] = "Hello world";
+  memcpy(buffer, str1, strlen(str1) + 1);
+  memcpy(buffer, str1, strlen(str1) + 2); // expected-warning {{Memory copy function accesses out-of-bound array element}}
+}
+
+void w_test_wcslen(void) {
+  wchar_t w_buffer[32];
+  // FIXME: This should work with 'w_str' instead of 'w_str1'
+  const wchar_t w_str1[] = L"Hello world";
+  wmemcpy(w_buffer, w_str1, wcslen(w_str1) + 1);
+  wmemcpy(w_buffer, w_str1, wcslen(w_str1) + 2); // expected-warning {{Memory copy function accesses out-of-bound array element}}
+}
+
+void test_strnlen(void) {
+  const char str1[] = "0123456789";
+  const char str2[] = "";
+  clang_analyzer_eval(strnlen(str1, 1) == 1); // expected-warning {{TRUE}}
+  clang_analyzer_eval(strnlen(str1, 100) == 10); // expected-warning {{TRUE}}
+  clang_analyzer_eval(strnlen(str2, 10) == 0); // expected-warning {{TRUE}}
+}
+
+void w_test_wcsnlen(void) {
+  const wchar_t str1[] = L"0123456789";
+  const wchar_t str2[] = L"";
+  clang_analyzer_eval(wcsnlen(str1, 1) == 1); // expected-warning {{TRUE}}
+  clang_analyzer_eval(wcsnlen(str1, 100) == 10); // expected-warning {{TRUE}}
+  clang_analyzer_eval(wcsnlen(str2, 10) == 0); // expected-warning {{TRUE}}
+}
+
+void test_strlen_with_zero(void) {
+  char buffer[32];
+  const char str1[] = "Hello\0world";
+  clang_analyzer_eval(strlen(str1) == 11); // expected-warning {{TRUE}}
+}
+
+void test_dst_overflow(void) {
+  char buffer[] = "Helloworld";
+  memcpy(buffer, str, sizeof(str)); // expected-warning {{Memory copy function overflows the destination buffer [alpha.unix.cstring.OutOfBounds]}}
+}
+
+void w_test_dst_overflow(void) {
+  wchar_t buffer[] = L"Helloworld";
+  wmemcpy(buffer, w_str, sizeof(w_str) / sizeof(w_str[0])); // expected-warning {{Memory copy function overflows the destination buffer}}
+}
+
+void test_dst_offset(void) {
+  char buffer[] = "Hello world";
+  memcpy(buffer + 1, str, sizeof(str)); // expected-warning {{Memory copy function overflows the destination buffer}}
+}
+
+void w_test_dst_offset(void) {
+  wchar_t buffer[] = L"Hello world";
+  wmemcpy(buffer + 1, w_str, sizeof(w_str) / sizeof(w_str[0])); // expected-warning {{Memory copy function overflows the destination buffer}}
+}
+
+int test_strlen_null() {
+  return strlen(0); // expected-warning {{Null pointer passed as 1st argument to string length function [unix.cstring.NullArg]}}
+}
+
+int test_wcslen_null() {
+  return wcslen(0); // expected-warning {{Null pointer passed as 1st argument to string length function}}
+}
+
+int test_strnlen_null() {
+  return strnlen(0, 10); // expected-warning {{Null pointer passed as 1st argument to string length function}}
+}
+
+int test_wcsnlen_null() {
+  return wcsnlen(0, 10); // expected-warning {{Null pointer passed as 1st argument to string length function}}
+}
+
+void test_overlap() {
+  int a[4] = {0};
+  memcpy(a + 2, a + 1, sizeof(int));
+  memcpy(a + 2, a + 1, sizeof(int) * 2); // expected-warning {{Arguments must not be overlapping buffers [alpha.unix.cstring.BufferOverlap]}}
+}
+
+void w_test_overlap() {
+  wchar_t a[4] = {0};
+  memcpy(a + 2, a + 1, sizeof(wchar_t));
+  memcpy(a + 2, a + 1, sizeof(wchar_t) * 2); // expected-warning {{Arguments must not be overlapping buffers}}
+}
+
+void test_not_null_terminated() {
+  int y = strlen((char *)&test_not_null_terminated); // expected-warning {{Argument to string length function is the address of the function 'test_not_null_terminated', which is not a null-terminated string [alpha.unix.cstring.NotNullTerminated]}}
+}
+
+void w_test_not_null_terminated() {
+  int y = wcslen((wchar_t *)&w_test_not_null_terminated); // expected-warning {{Argument to string length function is the address of the function 'w_test_not_null_terminated', which is not a null-terminated string}}
+}