You can not select more than 25 topics Topics must start with a letter or number, can include dashes ('-') and can be up to 35 characters long.

279 lines
6.1 KiB

/*
* Copyright (c) 2017-present, Facebook, Inc.
*
* This source code is licensed under the MIT license found in the
* LICENSE file in the root directory of this source tree.
*/
class my_class {
int idx;
int arr[10];
void set_a(int n) { idx = n; }
int id(int n) { return n; }
public:
int access_Bad() {
set_a(10);
return arr[idx];
}
int access2_Bad() {
int n = 10;
return arr[id(n)];
}
int access_nth(int n) { return arr[n]; }
};
void access_after_new_Good() {
my_class* x = new my_class();
x->access_nth(5);
}
void access_after_new_Bad() {
my_class* x = new my_class();
x->access_nth(15);
}
#include <stdlib.h>
class my_class2 {
public:
int a[5];
};
void array_member_malloc_Good() {
my_class2* x = (my_class2*)malloc(sizeof(my_class2));
x->a[0] = 0;
}
void array_member_malloc_Bad() {
my_class2* x = (my_class2*)malloc(sizeof(my_class2));
x->a[10] = 0;
}
class my_class3 {
public:
my_class2 b;
};
void array_member_malloc2_Bad() {
my_class3* x = (my_class3*)malloc(sizeof(my_class3));
x->b.a[10] = 0;
}
#include <new>
void new_nothrow_Good() {
my_class2* x = new (std::nothrow) my_class2();
x->a[0] = 0;
}
void new_nothrow_Bad() {
my_class2* x = new (std::nothrow) my_class2();
x->a[10] = 0;
}
void placement_new_Good() {
char* mem = (char*)malloc(sizeof(my_class2));
my_class2* x = new (mem) my_class2();
x->a[0] = 0;
}
void placement_new_Bad() {
char* mem = (char*)malloc(sizeof(my_class2));
my_class2* x = new (mem) my_class2();
x->a[10] = 0;
}
enum class DummyClass {};
inline void* operator new(std::size_t, DummyClass, void* p) { return p; }
inline void* operator new(std::size_t, void* p, DummyClass) { return p; }
void placement_new_overload1_Good() {
char* mem = (char*)malloc(sizeof(my_class2));
my_class2* x = new (DummyClass{}, mem) my_class2();
x->a[0] = 0;
}
void placement_new_overload1_Bad() {
char* mem = (char*)malloc(sizeof(my_class2));
my_class2* x = new (DummyClass{}, mem) my_class2();
x->a[10] = 0;
}
void placement_new_overload2_Good() {
char* mem = (char*)malloc(sizeof(my_class2));
my_class2* x = new (mem, DummyClass{}) my_class2();
x->a[0] = 0;
}
void placement_new_overload2_Bad() {
char* mem = (char*)malloc(sizeof(my_class2));
my_class2* x = new (mem, DummyClass{}) my_class2();
x->a[10] = 0;
}
struct DummyStruct {};
inline void* operator new(std::size_t, DummyStruct, void* p) { return p; }
inline void* operator new(std::size_t, void* p, DummyStruct) { return p; }
void placement_new_overload3_Good() {
char* mem = (char*)malloc(sizeof(my_class2));
my_class2* x = new (DummyStruct{}, mem) my_class2();
x->a[0] = 0;
}
void placement_new_overload4_Good() {
char* mem = (char*)malloc(sizeof(my_class2));
my_class2* x = new (mem, DummyStruct{}) my_class2();
x->a[0] = 0;
}
struct Allocator {
void* allocate(std::size_t size) { return malloc(size); }
};
void* operator new(std::size_t size, Allocator& allocator) {
return allocator.allocate(size);
}
void user_defined_new_Bad_FN() {
Allocator allocator;
my_class2* x = new (allocator) my_class2();
x->a[10] = 0;
}
class my_class4 {
public:
int a[3];
int c[3];
int b[1];
};
void flexible_array1_Good() {
char* mem = (char*)malloc(sizeof(my_class4) + 4 * sizeof(int));
my_class4* x = new (mem) my_class4();
x->b[4] = 0;
}
void flexible_array1_Bad() {
char* mem = (char*)malloc(sizeof(my_class4) + 4 * sizeof(int));
my_class4* x = new (mem) my_class4();
x->b[5] = 0;
}
void flexible_array2_Bad_FN() {
char* mem = (char*)malloc(4 * sizeof(int) + sizeof(my_class4));
my_class4* x = new (mem) my_class4();
x->b[5] = 0;
}
void flexible_array3_Bad_FN() {
char* mem = (char*)malloc(sizeof(my_class4) + sizeof(int) * 4);
my_class4* x = new (mem) my_class4();
x->b[5] = 0;
}
void* operator new(std::size_t s1, std::size_t s2) { return malloc(s1 + s2); }
void* operator new(std::size_t s1, std::size_t s2, bool) {
return malloc(s1 + s2);
}
void flexible_array_new_overload1_Good() {
my_class4* x = new (5 * sizeof(int)) my_class4();
x->b[5] = 0;
}
void flexible_array_new_overload1_Bad() {
my_class4* x = new (5 * sizeof(int)) my_class4();
x->b[10] = 0;
}
void flexible_array_new_overload2_Good() {
my_class4* x = new (5 * sizeof(int), true) my_class4();
x->b[5] = 0;
}
void flexible_array_new_overload2_Bad() {
my_class4* x = new (5 * sizeof(int), true) my_class4();
x->b[10] = 0;
}
class my_class5 {
public:
int d[3];
int f[3];
my_class4 e;
};
void flexible_array4_Good() {
char* mem = (char*)malloc(sizeof(my_class5) + 4 * sizeof(int));
my_class5* x = new (mem) my_class5();
x->e.b[4] = 0;
}
void flexible_array4_Bad() {
char* mem = (char*)malloc(sizeof(my_class5) + 4 * sizeof(int));
my_class5* x = new (mem) my_class5();
x->e.b[5] = 0;
}
class Tree {
private:
unsigned int children_num;
Tree(unsigned int children_num) : children_num(children_num) {}
public:
void set_child(Tree* child, unsigned int nth) { children[nth] = child; }
static Tree* NewNode(unsigned int children_num) {
char* mem =
(char*)malloc(sizeof(Tree) + (children_num - 1) * sizeof(Tree*));
return new (mem) Tree(children_num);
}
static Tree* NewLeaf() { return new Tree(0); }
private:
Tree* children[1];
};
void flexible_array5_Good() {
Tree* t = Tree::NewNode(3);
t->set_child(Tree::NewLeaf(), 0);
t->set_child(Tree::NewLeaf(), 1);
t->set_child(Tree::NewLeaf(), 2);
}
void flexible_array5_Bad() {
Tree* t = Tree::NewNode(3);
t->set_child(Tree::NewLeaf(), 5);
}
void flexible_array_param_access(my_class4* x) { x->b[3] = 0; }
void flexible_array_param_Good() {
my_class4* x = (my_class4*)malloc(sizeof(my_class4) + 4 * sizeof(int));
flexible_array_param_access(x);
}
void flexible_array_param_Bad() {
my_class4* x = (my_class4*)malloc(sizeof(my_class4) + 2 * sizeof(int));
flexible_array_param_access(x);
}
char* my_malloc() { return (char*)malloc(sizeof(my_class4) + 4 * sizeof(int)); }
void return_class_Good() {
my_class4* x = (my_class4*)my_malloc();
x->b[3] = 0;
}
void return_class_Bad() {
my_class4* x = (my_class4*)my_malloc();
x->b[5] = 0;
}