Alpha Checkers

void log();

int max(int a, int b) { // warn
  log();
  if (a > b)
    return a;
  return b;
}

int maxClone(int x, int y) { // similar code here
  log();
  if (x > y)
    return x;
  return y;
}

void test() {
  BOOL b = -1; // warn
}

void test(void) {
  int t;
  int &p = t;
  int &s = p;
  int &q = s;
  foo(q); // warn
}

void test(void) {
  int x;
  foo(&x); // warn
}

void test() {
  int *x = (int *)malloc(11); // warn
}

// C
struct s {};

void test(int *p) {
  struct s *ps = (struct s *) p; // warn
}

// C++
class c {};

void test(int *p) {
  c *pc = (c *) p; // warn
}

void test(unsigned U, signed S) {
  if (S > 10) {
    if (U < S) {
    }
  }
  if (S < -10) {
    if (U < S) { // warn (loss of sign)
    }
  }
}

void test() {
  long long A = 1LL << 60;
  short X = A; // warn (loss of precision)
}

id date = [NSDate date];

// Warning: Object has a dynamic type 'NSDate *' which is 
// incompatible with static type 'NSNumber *'"
NSNumber *number = date;
[number doubleValue];

void test() {
  int *p;
  p = (int *) 0x10000; // warn
}

// C
void test() {
  int a = 5;
  int b = a | 4 | a; // warn: identical expr on both sides
}

// C++
bool f(void);

void test(bool b) {
  int i = 10;
  if (f()) { // warn: true and false branches are identical
    do {
      i--;
    } while (f());
  } else {
    do {
      i--;
    } while (f());
  }
}

void test() {
  int x;
  int *p;
  p = &x + 1; // warn
}

void test() {
  int x, y;
  int d = &y - &x; // warn
}

struct s {};

int test(struct s *p) {
  return sizeof(p); 
    // warn: sizeof(ptr) can produce an unexpected result
}

void test(int x) {
  var = 77 / x;
  if (x == 0) { } // warn 
}

class A {
public:
  A() { 
    f(); // warn
  }
  virtual void f();
};

class A {
public:
  ~A() {
    this->f(); // warn
  }
  virtual void f();
};

#include <stdarg.h>

void test(int x, ...) {
  va_list args;
  va_start(args, x);
  va_copy(args, args); // warn
  va_end(args);
}

#include <stdarg.h>

void test(int x, ...) {
  va_list args;
  int y = va_arg(args, int); // warn
}

#include <stdarg.h>

void test(int x, ...) {
  va_list args;
  va_start(args, x);
  va_end(args);
  int z = va_arg(args, int); // warn
}

#include <stdarg.h>

void test(int x, ...) {
  va_list args;
  va_start(args, x);
  int y = x + va_arg(args, int);
} // warn: missing va_end

// C
int test() {
  int x = 1;
  while(x);
  return x; // warn
}

// C++
void test() {
  int a = 2;

  while (a > 1)
    a--;

  if (a > 1)
    a++; // warn
}

// Objective-C
void test(id x) {
  return;
  [x retain]; // warn
}

@interface MyClass : NSObject {}
@property (readonly) id A;
- (void) foo;
@end

@implementation MyClass
- (void) foo {
  _A = 0; // warn
}
@end

@interface MyClass : NSObject {}
@property (readonly) id A;
- (void) fAnnotated __attribute__((
    annotate("objc_no_direct_instance_variable_assignment")));
- (void) fNotAnnotated;
@end

@implementation MyClass
- (void) fAnnotated {
  _A = 0; // warn
}
- (void) fNotAnnotated {
  _A = 0; // no warn
}
@end

@protocol Invalidation <NSObject>
- (void) invalidate 
  __attribute__((annotate("objc_instance_variable_invalidator")));
@end 

@interface InvalidationImpObj : NSObject <Invalidation>
@end

@interface SubclassInvalidationImpObj : InvalidationImpObj {
  InvalidationImpObj *var;
}
- (void)invalidate;
@end

@implementation SubclassInvalidationImpObj
- (void) invalidate {}
@end
// warn: var needs to be invalidated or set to nil

@protocol Invalidation <NSObject>
- (void)invalidate 
  __attribute__((annotate("objc_instance_variable_invalidator")));
@end

@interface NeedInvalidation : NSObject <Invalidation>
@end

@interface MissingInvalidationMethodDecl : NSObject {
  NeedInvalidation *Var; // warn
}
@end

@implementation MissingInvalidationMethodDecl
@end

NSString *reminderText = 
  NSLocalizedString(@"None", @"Indicates no reminders");
if (reminderCount == 1) {
  // Warning: Plural cases are not supported across all languages.
  // Use a .stringsdict file instead
  reminderText = 
    NSLocalizedString(@"1 Reminder", @"Indicates single reminder");
} else if (reminderCount >= 2) {
  // Warning: Plural cases are not supported across all languages.
  // Use a .stringsdict file instead
  reminderText = 
    [NSString stringWithFormat:
      NSLocalizedString(@"%@ Reminders", @"Indicates multiple reminders"),
        reminderCount];
}

void test() {
  char *s = "";
  char c = s[1]; // warn
}

struct seven_words {
  int c[7];
};

void test() {
  struct seven_words a, *p;
  p = &a;
  p[0] = a;
  p[1] = a;
  p[2] = a; // warn
}

// note: requires unix.Malloc or 
// alpha.unix.MallocWithAnnotations checks enabled.
void test() {
  int *p = malloc(12);
  p[3] = 4; // warn
}

void test() {
  char a[2];
  int *b = (int*)a;
  b[1] = 3; // warn
}

void test() {
  char *s = "";
  char c = s[1]; // warn
}

void test() {
  int buf[100];
  int *p = buf;
  p = p + 99;
  p[1] = 1; // warn
}

// note: compiler has internal check for this.
// Use -Wno-array-bounds to suppress compiler warning.
void test() {
  int buf[100][100];
  buf[0][-1] = 1; // warn
}

// note: requires alpha.security.taint check turned on.
void test() {
  char s[] = "abc";
  int x = getchar();
  char c = s[x]; // warn: index is tainted
}

void test(int n) {
  void *p = malloc(n * sizeof(int)); // warn
}

static int A[10];

int *test() {
  int *p = A + 10;
  return p; // warn
}

int test(void) {
  int x;
  return x; // warn: undefined or garbage returned
}

void test() {
  char x = getchar(); // 'x' marked as tainted
  system(&x); // warn: untrusted data is passed to a system call
}

// note: compiler internally checks if the second param to
// sprintf is a string literal or not. 
// Use -Wno-format-security to suppress compiler warning.
void test() {
  char s[10], buf[10];
  fscanf(stdin, "%s", s); // 's' marked as tainted

  sprintf(buf, s); // warn: untrusted data as a format string
}

void test() {
  size_t ts;
  scanf("%zd", &ts); // 'ts' marked as tainted
  int *p = (int *)malloc(ts * sizeof(int)); 
    // warn: untrusted data as buffer size
}

void f();

void test() {
  chroot("/usr/local");
  f(); // warn: no call of chdir("/") immediately after chroot
}

pthread_mutex_t mtx;

void test() {
  pthread_mutex_lock(&mtx);
  pthread_mutex_lock(&mtx); 
    // warn: this lock has already been acquired
}

lck_mtx_t lck1, lck2;

void test() {
  lck_mtx_lock(&lck1);
  lck_mtx_lock(&lck2);
  lck_mtx_unlock(&lck1); 
    // warn: this was not the most recently acquired lock
}

lck_mtx_t lck1, lck2;

void test() {
  if (lck_mtx_try_lock(&lck1) == 0)
    return;

  lck_mtx_lock(&lck2);
  lck_mtx_unlock(&lck1);
    // warn: this was not the most recently acquired lock
}

void test() {
  FILE *F = fopen("myfile.txt", "w");
} // warn: opened file is never closed

void test() {
  FILE *F = fopen("myfile.txt", "w");

  if (F)
    fclose(F);

  fclose(F); // warn: closing a previously closed file stream
}

void test() {
  FILE *p = fopen("foo", "r");
} // warn: opened file is never closed

void test() {
  FILE *p = fopen("foo", "r");
  fseek(p, 1, SEEK_SET); // warn: stream pointer might be NULL
  fclose(p); 
}

void test() {
  FILE *p = fopen("foo", "r");

  if (p)
    fseek(p, 1, 3);
     // warn: third arg should be SEEK_SET, SEEK_END, or SEEK_CUR

  fclose(p); 
}

void test() {
  FILE *p = fopen("foo", "r");
  fclose(p); 
  fclose(p); // warn: already closed
}

void test() {
  FILE *p = tmpfile();
  ftell(p); // warn: stream pointer might be NULL
  fclose(p);
}

void test() {
  int a[4] = {0};
  memcpy(a + 2, a + 1, 8); // warn
}

void test() {
  int y = strlen((char *)&test); // warn
}

void test(char *y) {
  char x[4];
  if (strlen(y) == 4)
    strncpy(x, y, 5); // warn
}