[analyzer] Implementation of potential undefbehavior.ZeroAllocDereference checker.

[ayartsev]

Summary

Proposed patch implements undefbehavior.ZeroAllocDereference checker as part of unix.Malloc and cplusplus.NewDelete checkers.
The patch doesn't handle zero-size realloc()s due to specifics of current handling of realloc() by unix.Malloc that need to be discussed.
Please review!

[zaks.anna]

**As a rule of thumb, checkers should be stateless.

http://clang-analyzer.llvm.org/checker_dev_manual.html

When you introduce mutable members you are most likely making a mistake. The state should track properties of symbols; specifically to check with symbol corresponds to a '0' allocation.

The specific example that might break with your patch (depending on the order in which the states are being explored) is something along these lines:
if (b)

s= 10;

else

s = 0;

p = malloc(s);
if (b)
*p = 1;

When the checker explores "malloc(s)" along the "s=0" path, the expression will be added to the set. If "*p = 1" along the "s=10" path is explored later on, we are going to produce a false positive.

Please, provide better testing so the cases like this one are exposed.

[ayartsev]

Aaa, I see, thank you!

[ayartsev]

Updated the patch, made the checker stateless, please review!

[zaks.anna]

lib/StaticAnalyzer/Checkers/MallocChecker.cpp

66

I think you could just fold it into the Kind, by adding AllocatedOfSizeZero or do we think that Relinquished or Escaped should be treated differently if they were zero allocated..?

844

"ProcessZeroAllocation" ? We are not checking anything here.

889

It should not be possible to have non allocated symbol here.. Is it? Maybe we should assert?

1851

I's call this "Use of zero allocated" or "Zero allocation"

2302

this seems unrelated to the patch. Can it be submitted separately with a testcase that it is trying to address?

[ayartsev]

Thanks for review!

lib/StaticAnalyzer/Checkers/MallocChecker.cpp

66

Implemented with a new AllocatedOfSizeZero kind. Theoretically Relinquished may be treated differently if we would like to track usage of zero-allocated memory after relinquish but there are no cases yet.

844

Fixed!

889

Agree, done!

1851

Done!

2302

Cleaned.

[ayartsev]

New patch with comments addressed, please review!

[ayartsev]

.

lib/StaticAnalyzer/Checkers/MallocChecker.cpp

889

Pardon, currently zero-allocated realloc do not attach a RefState so it is still early to assert for now.

[ayartsev]

Ping!

[zaks.anna]

Hi Anton,

Have you tested the patch on anything but the regression tests? If yes,
what are the results? Did this catch any issues? Are there any false
positives? Since this will be a turned on by default new warning, I'd like
make sure we test on real code before committing.

Other than testing, this looks good to me. Thank you!
Anna.

[zaks.anna]

Yes, please, commit!

Thank you,
Anna.

[ayartsev]

Committed as r234889.

lib/StaticAnalyzer/Checkers/MallocChecker.cpp

enum Kind { // Reference to allocated memory.
               // We are no longer guaranteed to have observed all manipulations
               // of this pointer/memory. For example, it could have been
               // passed as a parameter to an opaque function.
               Escaped
   };
 
   const Stmt *S;
   unsigned K : 2; // Kind enum, but stored as a bitfield.
-  unsigned Family : 30; // Rest of 32-bit word, currently just an allocation 
+  unsigned ZeroAllocation : 1; // bool, true in case of a zero-size allocation.
+  unsigned Family : 29; // Rest of 32-bit word, currently just an allocation 
                         // family.
 
-  RefState(Kind k, const Stmt *s, unsigned family) 
-    : S(s), K(k), Family(family) {
+  RefState(Kind k, const Stmt *s, unsigned family,
+           unsigned zeroallocation = false)
+    : S(s), K(k), Family(family), ZeroAllocation(zeroallocation) {
     assert(family != AF_None);
   }
 public:
   bool isAllocated() const { return K == Allocated; }
   bool isReleased() const { return K == Released; }
   bool isRelinquished() const { return K == Relinquished; }
   bool isEscaped() const { return K == Escaped; }
   AllocationFamily getAllocationFamily() const {
     return (AllocationFamily)Family;
   }
   const Stmt *getStmt() const { return S; }
+  bool isZeroAllocation() const { return (bool)ZeroAllocation; }
 
   bool operator==(const RefState &X) const {
-    return K == X.K && S == X.S && Family == X.Family;
+    return K == X.K && S == X.S && Family == X.Family &&
+           ZeroAllocation == X.ZeroAllocation;
   }
 
-  static RefState getAllocated(unsigned family, const Stmt *s) {
-    return RefState(Allocated, s, family);
+  static RefState getAllocated(unsigned family, const Stmt *s,
+                               bool zeroallocation = false) {
+    return RefState(Allocated, s, family, zeroallocation);
   }
   static RefState getReleased(unsigned family, const Stmt *s) { 
     return RefState(Released, s, family);
   }
   static RefState getRelinquished(unsigned family, const Stmt *s) {
     return RefState(Relinquished, s, family);
   }
   static RefState getEscaped(const RefState *RS) {
     return RefState(Escaped, RS->getStmt(), RS->getAllocationFamily());
   }
 
   void Profile(llvm::FoldingSetNodeID &ID) const {
     ID.AddInteger(K);
     ID.AddPointer(S);
+    ID.AddInteger(ZeroAllocation);
     ID.AddInteger(Family);
   }
 
   void dump(raw_ostream &OS) const {
     switch (static_cast<Kind>(K)) {
 #define CASE(ID) case ID: OS << #ID; break;
     CASE(Allocated)
     CASE(Released)
private:
   mutable std::unique_ptr<BugType> BT_DoubleFree[CK_NumCheckKinds];
   mutable std::unique_ptr<BugType> BT_DoubleDelete;
   mutable std::unique_ptr<BugType> BT_Leak[CK_NumCheckKinds];
   mutable std::unique_ptr<BugType> BT_UseFree[CK_NumCheckKinds];
   mutable std::unique_ptr<BugType> BT_BadFree[CK_NumCheckKinds];
   mutable std::unique_ptr<BugType> BT_FreeAlloca[CK_NumCheckKinds];
   mutable std::unique_ptr<BugType> BT_MismatchedDealloc;
   mutable std::unique_ptr<BugType> BT_OffsetFree[CK_NumCheckKinds];
+  mutable std::unique_ptr<BugType> BT_UseZerroAllocated[CK_NumCheckKinds];
   mutable IdentifierInfo *II_alloca, *II_malloc, *II_free, *II_realloc,
                          *II_calloc, *II_valloc, *II_reallocf, *II_strndup,
                          *II_strdup, *II_kmalloc, *II_if_nameindex,
                          *II_if_freenameindex;
   mutable Optional<uint64_t> KernelZeroFlagVal;
 
   void initIdentifierInfo(ASTContext &C) const;
 
private:
   /// pointed to by one of its arguments.
   bool isMemFunction(const FunctionDecl *FD, ASTContext &C) const;
   bool isCMemFunction(const FunctionDecl *FD,
                       ASTContext &C,
                       AllocationFamily Family,
                       MemoryOperationKind MemKind) const;
   bool isStandardNewDelete(const FunctionDecl *FD, ASTContext &C) const;
   ///@}
+
+  /// \brief Perform a zero-allocation check.
+  ProgramStateRef ZeroAllocationCheck(CheckerContext &C, const Expr *E,
+                                      const unsigned AllocationSizeArg,
+                                      ProgramStateRef State) const;
+
   ProgramStateRef MallocMemReturnsAttr(CheckerContext &C,
                                        const CallExpr *CE,
                                        const OwnershipAttr* Att,
                                        ProgramStateRef State) const;
   static ProgramStateRef MallocMemAux(CheckerContext &C, const CallExpr *CE,
                                       const Expr *SizeEx, SVal Init,
                                       ProgramStateRef State,
                                       AllocationFamily Family = AF_Malloc);
private:
   static ProgramStateRef CallocMem(CheckerContext &C, const CallExpr *CE,
                                    ProgramStateRef State);
   
   ///\brief Check if the memory associated with this symbol was released.
   bool isReleased(SymbolRef Sym, CheckerContext &C) const;
 
   bool checkUseAfterFree(SymbolRef Sym, CheckerContext &C, const Stmt *S) const;
 
+  void checkUseZeroAllocated(SymbolRef Sym, CheckerContext &C, 
+                             const Stmt *S) const;
+
   bool checkDoubleDelete(SymbolRef Sym, CheckerContext &C) const;
 
   /// Check if the function is known free memory, or if it is
   /// "interesting" and should be modeled explicitly.
   ///
   /// \param [out] EscapingSymbol A function might not free memory in general, 
   ///   but could be known to free a particular symbol. In this case, false is
   ///   returned and the single escaping symbol is returned through the out
void ReportOffsetFree(CheckerContext &C, SVal ArgVal, SourceRange Range,
                         const Expr *AllocExpr = nullptr) const;
   void ReportUseAfterFree(CheckerContext &C, SourceRange Range,
                           SymbolRef Sym) const;
   void ReportDoubleFree(CheckerContext &C, SourceRange Range, bool Released,
                         SymbolRef Sym, SymbolRef PrevSym) const;
 
   void ReportDoubleDelete(CheckerContext &C, SymbolRef Sym) const;
 
+  void ReportUseZeroAllocated(CheckerContext &C, SourceRange Range,
+                              SymbolRef Sym) const;
+
   /// Find the location of the allocation for Sym on the path leading to the
   /// exploded node N.
   LeakInfo getAllocationSite(const ExplodedNode *N, SymbolRef Sym,
                              CheckerContext &C) const;
 
   void reportLeak(SymbolRef Sym, ExplodedNode *N, CheckerContext &C) const;
 
   /// The bug visitor which allows us to print extra diagnostics along the
if (FD->getKind() == Decl::Function) {
     initIdentifierInfo(C.getASTContext());
     IdentifierInfo *FunI = FD->getIdentifier();
 
     if (FunI == II_malloc) {
       if (CE->getNumArgs() < 1)
         return;
       if (CE->getNumArgs() < 3) {
         State = MallocMemAux(C, CE, CE->getArg(0), UndefinedVal(), State);
+        if (CE->getNumArgs() == 1)
+          State = ZeroAllocationCheck(C, CE, 0, State);
       } else if (CE->getNumArgs() == 3) {
         llvm::Optional<ProgramStateRef> MaybeState =
           performKernelMalloc(CE, C, State);
         if (MaybeState.hasValue())
           State = MaybeState.getValue();
         else
           State = MallocMemAux(C, CE, CE->getArg(0), UndefinedVal(), State);
       }
     } else if (FunI == II_kmalloc) {
       llvm::Optional<ProgramStateRef> MaybeState =
         performKernelMalloc(CE, C, State);
       if (MaybeState.hasValue())
         State = MaybeState.getValue();
       else
         State = MallocMemAux(C, CE, CE->getArg(0), UndefinedVal(), State);
     } else if (FunI == II_valloc) {
       if (CE->getNumArgs() < 1)
         return;
       State = MallocMemAux(C, CE, CE->getArg(0), UndefinedVal(), State);
+      State = ZeroAllocationCheck(C, CE, 0, State);
     } else if (FunI == II_realloc) {
       State = ReallocMem(C, CE, false, State);
+      State = ZeroAllocationCheck(C, CE, 1, State);
     } else if (FunI == II_reallocf) {
       State = ReallocMem(C, CE, true, State);
+      State = ZeroAllocationCheck(C, CE, 1, State);
     } else if (FunI == II_calloc) {
       State = CallocMem(C, CE, State);
+      State = ZeroAllocationCheck(C, CE, 0, State);
+      State = ZeroAllocationCheck(C, CE, 1, State);
     } else if (FunI == II_free) {
       State = FreeMemAux(C, CE, State, 0, false, ReleasedAllocatedMemory);
     } else if (FunI == II_strdup) {
       State = MallocUpdateRefState(C, CE, State);
     } else if (FunI == II_strndup) {
       State = MallocUpdateRefState(C, CE, State);
     } else if (FunI == II_alloca) {
       State = MallocMemAux(C, CE, CE->getArg(0), UndefinedVal(), State,
                            AF_Alloca);
+      State = ZeroAllocationCheck(C, CE, 0, State);
     } else if (isStandardNewDelete(FD, C.getASTContext())) {
       // Process direct calls to operator new/new[]/delete/delete[] functions
       // as distinct from new/new[]/delete/delete[] expressions that are 
       // processed by the checkPostStmt callbacks for CXXNewExpr and 
       // CXXDeleteExpr.
       OverloadedOperatorKind K = FD->getOverloadedOperator();
-      if (K == OO_New)
+      if (K == OO_New) {
         State = MallocMemAux(C, CE, CE->getArg(0), UndefinedVal(), State,
                              AF_CXXNew);
-      else if (K == OO_Array_New)
+        State = ZeroAllocationCheck(C, CE, 0, State);
+      }
+      else if (K == OO_Array_New) {
         State = MallocMemAux(C, CE, CE->getArg(0), UndefinedVal(), State,
                              AF_CXXNewArray);
+        State = ZeroAllocationCheck(C, CE, 0, State);
+      }
       else if (K == OO_Delete || K == OO_Array_Delete)
         State = FreeMemAux(C, CE, State, 0, false, ReleasedAllocatedMemory);
       else
         llvm_unreachable("not a new/delete operator");
     } else if (FunI == II_if_nameindex) {
       // Should we model this differently? We can allocate a fixed number of
       // elements with zeros in the last one.
       State = MallocMemAux(C, CE, UnknownVal(), UnknownVal(), State,
if (FD->hasAttrs())
           State = FreeMemAttr(C, CE, I, State);
           break;
         }
       }
   }
   C.addTransition(State);
 }
 
+// Performs a 0-sized allocations check.
+ProgramStateRef MallocChecker::ZeroAllocationCheck(CheckerContext &C,
+                                               const Expr *E,
+                                               const unsigned AllocationSizeArg,
+                                               ProgramStateRef State) const {
+  if (!State)
+    return nullptr;
+
+  const Expr *Arg = nullptr;
+
+  if (const CallExpr *CE = dyn_cast<CallExpr>(E)) {
+    Arg = CE->getArg(AllocationSizeArg);
+  }
+  else if (const CXXNewExpr *NE = dyn_cast<CXXNewExpr>(E)) {
+    if (NE->isArray())
+      Arg = NE->getArraySize();
+    else
+      return State;
+  }
+  else
+    llvm_unreachable("not a CallExpr or CXXNewExpr");
+
+  assert(Arg);
+
+  Optional<DefinedSVal> DefArgVal = 
+      State->getSVal(Arg, C.getLocationContext()).getAs<DefinedSVal>();
+
+  if (!DefArgVal)
+    return State;
+
+  // Check if the allocation size is 0.
+  ProgramStateRef TrueState, FalseState;
+  SValBuilder &SvalBuilder = C.getSValBuilder();
+  DefinedSVal Zero =
+      SvalBuilder.makeZeroVal(Arg->getType()).castAs<DefinedSVal>();
+
+  std::tie(TrueState, FalseState) = 
+      State->assume(SvalBuilder.evalEQ(State, *DefArgVal, Zero));
+
+  if (TrueState && !FalseState) {
+    SVal retVal = State->getSVal(E, C.getLocationContext());
+    SymbolRef Sym = retVal.getAsLocSymbol();
+    if (!Sym)
+      return State;
+
+    const RefState *RS = State->get<RegionState>(Sym);
+    if (!RS || !RS->isAllocated())
+      return State;
+
+    return TrueState->set<RegionState>(
+                          Sym, RefState::getAllocated(RS->getAllocationFamily(),
+                                                      RS->getStmt(), true));
+  }
+
+  // Assume the value is non-zero going forward.
+  assert(FalseState);
+  return FalseState;
+}
+
 static QualType getDeepPointeeType(QualType T) {
   QualType Result = T, PointeeType = T->getPointeeType();
   while (!PointeeType.isNull()) {
     Result = PointeeType;
     PointeeType = PointeeType->getPointeeType();
   }
   return Result;
 }
void MallocChecker::checkPostStmt(const CXXNewExpr *NE,
 
   ProgramStateRef State = C.getState();
   // The return value from operator new is bound to a specified initialization 
   // value (if any) and we don't want to loose this value. So we call 
   // MallocUpdateRefState() instead of MallocMemAux() which breakes the 
   // existing binding.
   State = MallocUpdateRefState(C, NE, State, NE->isArray() ? AF_CXXNewArray 
                                                            : AF_CXXNew);
+  State = ZeroAllocationCheck(C, NE, 0, State);
   C.addTransition(State);
 }
 
 void MallocChecker::checkPreStmt(const CXXDeleteExpr *DE, 
                                  CheckerContext &C) const {
 
   if (!ChecksEnabled[CK_NewDeleteChecker])
     if (SymbolRef Sym = C.getSVal(DE->getArgument()).getAsSymbol())
BugReport *R = new BugReport(*BT_DoubleDelete,
                                  "Attempt to delete released memory", N);
 
     R->markInteresting(Sym);
     R->addVisitor(llvm::make_unique<MallocBugVisitor>(Sym));
     C.emitReport(R);
   }
 }
 
+void MallocChecker::ReportUseZeroAllocated(CheckerContext &C,
+                                           SourceRange Range,
+                                           SymbolRef Sym) const {
+
+  if (!ChecksEnabled[CK_MallocChecker] &&
+      !ChecksEnabled[CK_NewDeleteChecker])
+    return;
+
+  Optional<MallocChecker::CheckKind> CheckKind = getCheckIfTracked(C, Sym);
+
+  if (!CheckKind.hasValue())
+    return;
+
+  if (ExplodedNode *N = C.generateSink()) {
+    if (!BT_UseZerroAllocated[*CheckKind])
+      BT_UseZerroAllocated[*CheckKind].reset(new BugType(
+          CheckNames[*CheckKind], "Use zero allocated", "Memory Error"));
+
+    BugReport *R = new BugReport(*BT_UseZerroAllocated[*CheckKind],
+                                 "Use of zero-allocated memory", N);
+
+    R->addRange(Range);
+    if (Sym) {
+      R->markInteresting(Sym);
+      R->addVisitor(llvm::make_unique<MallocBugVisitor>(Sym));
+    }
+    C.emitReport(R);
+  }
+}
+
 ProgramStateRef MallocChecker::ReallocMem(CheckerContext &C,
                                           const CallExpr *CE,
                                           bool FreesOnFail,
                                           ProgramStateRef State) const {
   if (!State)
     return nullptr;
 
   if (CE->getNumArgs() < 2)
bool MallocChecker::checkUseAfterFree(SymbolRef Sym, CheckerContext &C,
   if (isReleased(Sym, C)) {
     ReportUseAfterFree(C, S->getSourceRange(), Sym);
     return true;
   }
 
   return false;
 }
 
+void MallocChecker::checkUseZeroAllocated(SymbolRef Sym, CheckerContext &C,
+                                          const Stmt *S) const {
+  assert(Sym);
+  const RefState *RS = C.getState()->get<RegionState>(Sym);
+
+  if (RS && RS->isZeroAllocation())
+    ReportUseZeroAllocated(C, RS->getStmt()->getSourceRange(), Sym);
+}
+
 bool MallocChecker::checkDoubleDelete(SymbolRef Sym, CheckerContext &C) const {
 
   if (isReleased(Sym, C)) {
     ReportDoubleDelete(C, Sym);
     return true;
   }
   return false;
 }
 
 // Check if the location is a freed symbolic region.
 void MallocChecker::checkLocation(SVal l, bool isLoad, const Stmt *S,
                                   CheckerContext &C) const {
   SymbolRef Sym = l.getLocSymbolInBase();
-  if (Sym)
+  const MemRegion *MR = l.getAsRegion()->StripCasts();
+
+  if (Sym) {
     checkUseAfterFree(Sym, C, S);
+    checkUseZeroAllocated(Sym, C, S);
+  }
 }
 
 // If a symbolic region is assumed to NULL (or another constant), stop tracking
 // it - assuming that allocation failed on this path.
 ProgramStateRef MallocChecker::evalAssume(ProgramStateRef state,
                                               SVal Cond,
                                               bool Assumption) const {
   RegionStateTy RS = state->get<RegionState>();

test/Analysis/Malloc+MismatchedDeallocator_intersections.cpp

void testNewDeleteNoWarn() {
   int *p2 = new int;
   delete p2;
   delete p2; // no-warning
 
   int *p3 = new int; // no-warning
 
   int *p4 = new int;
   delete p4;
-  int j = *p4; // no-warning  
+  int j = *p4; // no-warning
 }
+
+void testUseZeroAllocNoWarn() {
+  int *p1 = (int *)operator new(0);
+  *p1 = 1; // no-warning
+
+  int *p2 = (int *)operator new[](0);
+  p2[0] = 1; // no-warning
+
+  int *p3 = new int[0];
+  p3[0] = 1; // no-warning
+}

test/Analysis/NewDelete-checker-test.cpp

struct PtrWrapper {
   PtrWrapper(int *input) : x(input) {}
 };
 
 void testNewInvalidationPlacement(PtrWrapper *w) {
   // Ensure that we don't consider this a leak.
   new (w) PtrWrapper(new int); // no warn
 }
 
+//-----------------------------------------
+// check for usage of zero-allocated memory
+//-----------------------------------------
+
+void testUseZeroAlloc1() {
+  int *p = (int *)operator new(0);
+  *p = 1; // expected-warning {{Use of zero-allocated memory}}
+  delete p;
+}
+
+int testUseZeroAlloc2() {
+  int *p = (int *)operator new[](0);
+  return p[0]; // expected-warning {{Use of zero-allocated memory}}
+  delete[] p;
+}
+
+void f(int);
+
+void testUseZeroAlloc3() {
+  int *p = new int[0];
+  f(*p); // expected-warning {{Use of zero-allocated memory}}
+  delete[] p;
+}
+
 //---------------
 // other checks
 //---------------
 
 class SomeClass {
 public:
   void f(int *p);
 };

test/Analysis/NewDelete-intersections.mm

 void testDeleteMalloced() {
   int *p1 = (int *)malloc(sizeof(int));
   delete p1; // no warn
 
   int *p2 = (int *)__builtin_alloca(sizeof(int));
   delete p2; // no warn
 } 
 
+void testUseZeroAllocatedMalloced() {
+  int *p1 = (int *)malloc(0);
+  *p1 = 1; // no warn
+}
+
 //----- Test free standard new
 void testFreeOpNew() {
   void *p = operator new(0);
   free(p);
 }
 #ifdef LEAKS
 // expected-warning@-2 {{Potential leak of memory pointed to by 'p'}}
 #endif

test/Analysis/malloc.c

void reallocfRadar6337483_3() {
     buf = tmp;
     free(buf);
 }
 
 void reallocfPtrZero1() {
   char *r = reallocf(0, 12);
 } // expected-warning {{Potential leak of memory pointed to by}}
 
+//------------------- Check usage of zero-allocated memory ---------------------
+void CheckUseZeroAllocatedNoWarn1() {
+  int *p = malloc(0);
+  free(p); // no warning
+}
+
+void CheckUseZeroAllocatedNoWarn2() {
+  int *p = alloca(0); // no warning
+}
+
+void CheckUseZeroAllocated1() {
+  int *p = malloc(0);
+  *p = 1; // expected-warning {{Use of zero-allocated memory}}
+  free(p);
+}
+
+char CheckUseZeroAllocated2() {
+  char *p = alloca(0);
+  return *p; // expected-warning {{Use of zero-allocated memory}}
+}
+
+void UseZeroAllocated(int *p) {
+  if (p)
+    *p = 7; // expected-warning {{Use of zero-allocated memory}}
+}
+void CheckUseZeroAllocated3() {
+  int *p = malloc(0);
+  UseZeroAllocated(p);
+}
+
+void f(char);
+void CheckUseZeroAllocated4() {
+  char *p = valloc(0);
+  f(*p); // expected-warning {{Use of zero-allocated memory}}
+  free(p);
+}
+
+void CheckUseZeroAllocated5() {
+  int *p = calloc(0, 2);
+  *p = 1; // expected-warning {{Use of zero-allocated memory}}
+  free(p);
+}
+
+void CheckUseZeroAllocated6() {
+  int *p = calloc(2, 0);
+  *p = 1; // expected-warning {{Use of zero-allocated memory}}
+  free(p);
+}
+
+void CheckUseZeroAllocatedPathNoWarn(_Bool b) {
+  int s = 0;
+  if (b)
+    s= 10;
+
+  char *p = malloc(s);
+
+  if (b)
+    *p = 1; // no warning
+
+  free(p);
+}
+
+void CheckUseZeroAllocatedPathWarn(_Bool b) {
+  int s = 10;
+  if (b)
+    s= 0;
+
+  char *p = malloc(s);
+
+  if (b)
+    *p = 1; // expected-warning {{Use of zero-allocated memory}}
+
+  free(p);
+}
 
 // This case tests that storing malloc'ed memory to a static variable which is
 // then returned is not leaked.  In the absence of known contracts for functions
 // or inter-procedural analysis, this is a conservative answer.
 int *f3() {
   static int *p = 0;
   p = malloc(12); 
   return p; // no-warning