[inferbo] Add new operator model

Reviewed By: jvillard

Differential Revision: D6960369

fbshipit-source-id: 55d74f5

infer/src/bufferoverrun/bufferOverrunModels.ml

@@ -283,6 +283,7 @@ module Make (BoUtils : BufferOverrunUtils.S) = struct
         ; -"fgetc" <>--> by_value Dom.Val.Itv.m1_255
         ; -"infer_print" <>$ capt_exp $!--> infer_print
         ; -"malloc" <>$ capt_exp $+...$--> malloc
+        ; -"__new" <>$ capt_exp $+...$--> malloc
         ; -"__new_array" <>$ capt_exp $+...$--> malloc
         ; -"realloc" <>$ any_arg $+ capt_exp $+...$--> realloc
         ; -"__set_array_length" <>$ capt_arg $+ capt_exp $!--> set_array_length

infer/tests/codetoanalyze/cpp/bufferoverrun/class.cpp

@@ -24,4 +24,16 @@ class my_class {
     int n = 10;
     return arr[id(n)];
   }
+
+  int access_nth(int n) { return arr[n]; }
 };
+
+void access_after_new_Good() {
+  my_class* x = new my_class();
+  x->access_nth(5);
+}
+
+void access_after_new_Bad() {
+  my_class* x = new my_class();
+  x->access_nth(15);
+}

infer/tests/codetoanalyze/cpp/bufferoverrun/issues.exp

@@ -1,3 +1,4 @@
+codetoanalyze/cpp/bufferoverrun/class.cpp, access_after_new_Bad, 2, BUFFER_OVERRUN_L1, [Call,ArrayAccess: Offset: [15, 15] Size: [10, 10] @ codetoanalyze/cpp/bufferoverrun/class.cpp:28:34 by call `my_class_access_nth()` ]
 codetoanalyze/cpp/bufferoverrun/class.cpp, my_class_access2_Bad, 2, BUFFER_OVERRUN_L1, [Call,Assignment,Call,Assignment,Return,ArrayAccess: Offset: [10, 10] Size: [10, 10]]
 codetoanalyze/cpp/bufferoverrun/class.cpp, my_class_access_Bad, 2, BUFFER_OVERRUN_L1, [Call,Call,Assignment,ArrayAccess: Offset: [10, 10] Size: [10, 10]]
 codetoanalyze/cpp/bufferoverrun/external.cpp, extern_bad, 5, BUFFER_OVERRUN_L5, [Assignment,ArrayAccess: Offset: [-oo, +oo] Size: [0, +oo]]