adlint 3.0.4 → 3.0.8

data/features/code_check/W0422.feature

@@ -0,0 +1,128 @@
+Feature: W0422
+
+  W0422 detects that an inconstant expression may cause NULL pointer
+  dereference.
+
+  Scenario: pointer variable definition with self referring sizeof-expression
+            in the initializer
+    Given a target source named "fixture.c" with:
+      """
+      struct foo { int i; };
+      extern void *malloc(unsigned long);
+
+      static int bar(void)
+      {
+          struct foo * const p = (struct foo *) malloc(sizeof *p);
+          return p->i; /* W0422 */
+      }
+
+      static int baz(void)
+      {
+          struct foo * const p = (struct foo *) malloc(sizeof(struct foo));
+          return p->i; /* W0422 */
+      }
+      """
+    When I successfully run `adlint fixture.c` on noarch
+    Then the output should exactly match with:
+      | mesg  | line | column |
+      | W0118 | 2    | 14     |
+      | W1076 | 4    | 12     |
+      | W0422 | 7    | 13     |
+      | W1076 | 10   | 12     |
+      | W0422 | 13   | 13     |
+      | W0629 | 4    | 12     |
+      | W0629 | 10   | 12     |
+      | W0628 | 4    | 12     |
+      | W0628 | 10   | 12     |
+
+  Scenario: pointer variable as a part of controlling expression
+    Given a target source named "fixture.c" with:
+      """
+      struct node { struct node *prev; };
+
+      void foo(const struct node *list)
+      {
+          if (list != NULL)
+          {
+              while (1)
+              {
+                  list = list->prev; /* OK */
+                  if (list == NULL)
+                  {
+                      break;
+                  }
+              }
+          }
+      }
+      """
+    When I successfully run `adlint fixture.c` on noarch
+    Then the output should exactly match with:
+      | mesg  | line | column |
+      | W0117 | 3    | 6      |
+      | W0114 | 7    | 9      |
+      | W0628 | 3    | 6      |
+
+  Scenario: pointer variable as a part of controlling expression is declared in
+            the iteration body
+    Given a target source named "fixture.c" with:
+      """
+      static int *bar(void);
+
+      void foo(void)
+      {
+          if (1) {
+              int *p1;
+              p1 = bar();
+              while (1) {
+                  int *p2;
+                  p2 = p1;
+                  while (*p2 != 3) { /* W0422 */
+                      p2++;
+                  }
+                  if (*p2 == 4) {
+                      break;
+                  }
+                  else {
+                      p1 = bar();
+                  }
+              }
+          }
+      }
+      """
+    When I successfully run `adlint fixture.c` on noarch
+    Then the output should exactly match with:
+      | mesg  | line | column |
+      | W0117 | 3    | 6      |
+      | W0422 | 11   | 20     |
+      | W0024 | 12   | 19     |
+      | W0114 | 5    | 5      |
+      | W0114 | 8    | 9      |
+      | W0628 | 3    | 6      |
+
+  Scenario: pointer variable has the same name with previously declared
+            function
+    Given a target source named "fixture.c" with:
+      """
+      extern void instr(void);
+
+      void foo(char *instr)
+      {
+          if (instr[0] == '*') { /* W0422 */
+              return;
+          }
+      }
+      """
+    When I successfully run `adlint fixture.c` on noarch
+    Then the output should exactly match with:
+      | mesg  | line | column |
+      | W0118 | 1    | 13     |
+      | W0117 | 3    | 6      |
+      | W0704 | 3    | 16     |
+      | C0001 | 1    | 13     |
+      | W0422 | 5    | 14     |
+      | W0123 | 5    | 14     |
+      | W0104 | 3    | 16     |
+      | W0105 | 3    | 16     |
+      | W1071 | 3    | 6      |
+      | W0948 | 5    | 21     |
+      | W0628 | 3    | 6      |

data/features/code_check/W0491.feature

@@ -0,0 +1,57 @@
+Feature: W0491
+
+  W0491 detects that the same name appears in different namespaces.
+
+  Scenario: hard to parse
+    Given a target source named "fixture.c" with:
+      """
+      typedef struct named_ref {
+          int id;
+      } named_ref; /* W0491 */
+
+      typedef struct code_props {
+          named_ref *named_ref; /* W0492 */
+      } code_props; /* W0491 */
+
+      void func(named_ref *named_ref);
+      void bar(int, named_ref *, named_ref *);
+      """
+    When I successfully run `adlint fixture.c` on noarch
+    Then the output should exactly match with:
+      | mesg  | line | column |
+      | W0491 | 3    | 3      |
+      | C0001 | 1    | 16     |
+      | W0492 | 6    | 16     |
+      | C0001 | 3    | 3      |
+      | C0001 | 1    | 16     |
+      | W0491 | 7    | 3      |
+      | C0001 | 5    | 16     |
+      | W0118 | 9    | 6      |
+      | W0118 | 10   | 6      |
+
+  Scenario: hard to parse
+    Given a target source named "fixture.c" with:
+      """
+      #define RETSIGTYPE void
+
+      typedef int sighandler_t;
+      typedef RETSIGTYPE (*sighandler_t)(int);
+
+      struct sighandler_t {
+          RETSIGTYPE (*ptr)(int);
+      };
+
+      typedef struct sighandler_t *(*sighandler_t)(struct sighandler_t *);
+      """
+    When I successfully run `adlint fixture.c` on noarch
+    Then the output should exactly match with:
+      | mesg  | line | column |
+      | W0491 | 6    | 8      |
+      | C0001 | 3    | 13     |
+      | C0001 | 4    | 22     |
+      | W0491 | 10   | 32     |
+      | C0001 | 6    | 8      |
+      | W0482 | 1    | 1      |
+      | W0586 | 3    | 13     |
+      | W0586 | 4    | 22     |
+      | W0586 | 10   | 32     |

data/features/code_check/W0492.feature

@@ -0,0 +1,80 @@
+Feature: W0492
+
+  W0492 detects that the same name appears in different namespaces.
+
+  Scenario: hard to parse
+    Given a target source named "fixture.c" with:
+      """
+      typedef int foo;
+
+      foo bar(foo baz)
+      {
+          goto foo;
+      foo:
+          return baz;
+      }
+
+      struct foo { foo foo, (*bar)(foo); }; /* W0492 */
+      union bar { foo foo, (*bar)(foo (*baz)(foo)); }; /* W0492 */
+      enum baz { baz };
+
+      struct {
+          foo    :1;
+          foo foo:1; /* W0492 */
+          foo    :1;
+          foo bar:1; /* W0492 */
+          foo    :1;
+      } qux;
+
+      struct qux {
+          foo;
+          union bar bar; /* W0492 */
+      };
+
+      int const long volatile unsigned cv_ulong;
+      const foo volatile cv_foo;
+      """
+    When I successfully run `adlint fixture.c` on noarch
+    Then the output should exactly match with:
+      | mesg  | line | column |
+      | W0117 | 3    | 5      |
+      | W0625 | 1    | 13     |
+      | W0491 | 6    | 1      |
+      | C0001 | 1    | 13     |
+      | W0104 | 3    | 13     |
+      | W0491 | 10   | 8      |
+      | C0001 | 1    | 13     |
+      | W0492 | 10   | 18     |
+      | C0001 | 1    | 13     |
+      | C0001 | 10   | 8      |
+      | W0492 | 11   | 7      |
+      | C0001 | 10   | 25     |
+      | W0492 | 11   | 17     |
+      | C0001 | 1    | 13     |
+      | C0001 | 10   | 8      |
+      | W0492 | 11   | 24     |
+      | C0001 | 11   | 7      |
+      | W0492 | 16   | 9      |
+      | C0001 | 1    | 13     |
+      | C0001 | 10   | 8      |
+      | W0492 | 18   | 9      |
+      | C0001 | 11   | 7      |
+      | W0117 | 20   | 3      |
+      | W0491 | 22   | 8      |
+      | C0001 | 20   | 3      |
+      | W0492 | 24   | 15     |
+      | C0001 | 11   | 7      |
+      | W0080 | 27   | 34     |
+      | W0117 | 27   | 34     |
+      | W0080 | 28   | 20     |
+      | W0117 | 28   | 20     |
+      | W1072 | 5    | 5      |
+      | W0551 | 11   | 7      |
+      | W0525 | 16   | 9      |
+      | W0525 | 18   | 9      |
+      | W0040 | 14   | 1      |
+      | W0425 | 10   | 25     |
+      | W0425 | 11   | 24     |
+      | W0431 | 6    | 1      |
+      | W0432 | 6    | 1      |
+      | W0628 | 3    | 5      |

data/features/code_check/W0542.feature

@@ -0,0 +1,20 @@
+Feature: W0542
+
+  W0542 detects that some of parameters have an identifier.
+
+  Scenario: hard to parse
+    Given a target source named "fixture.c" with:
+      """
+      typedef unsigned int VALUE;
+      typedef void *ANYARGS;
+
+      VALUE foo(VALUE(*p1)(VALUE),VALUE,VALUE(*p2)(ANYARGS),VALUE); /* W0542 */
+      VALUE bar(VALUE(*)(VALUE),VALUE,VALUE(*)(ANYARGS),VALUE);
+      """
+    When I successfully run `adlint fixture.c` on noarch
+    Then the output should exactly match with:
+      | mesg  | line | column |
+      | W0118 | 4    | 7      |
+      | W0625 | 1    | 22     |
+      | W0118 | 5    | 7      |
+      | W0542 | 4    | 7      |

data/features/code_check/W0580.feature

@@ -0,0 +1,25 @@
+Feature: W0580
+
+  W0580 detects that address of the function local static variable is assigned
+  to the global pointer variable declared in wider scope.
+
+  Scenario: assigning address of an array element to the global pointer
+    Given a target source named "fixture.c" with:
+      """
+      extern int *p;
+
+      static void foo(void)
+      {
+          static int a[] = { 1, 2, 3 };
+          p = &a[1]; /* W0580 */
+      }
+      """
+    When I successfully run `adlint fixture.c` on noarch
+    Then the output should exactly match with:
+      | mesg  | line | column |
+      | W0118 | 1    | 13     |
+      | W1076 | 3    | 13     |
+      | W0580 | 6    | 7      |
+      | W0100 | 5    | 16     |
+      | W0629 | 3    | 13     |
+      | W0628 | 3    | 13     |

data/features/code_check/W0610.feature

@@ -0,0 +1,36 @@
+Feature: W0610
+
+  W0610 detects that a logical expression makes always true.
+
+  Scenario: comparison of static storage duration variable
+    Given a target source named "fixture.c" with:
+      """
+      struct { char *p; } foo = { NULL };
+      int *p = NULL;
+
+      static void bar(void)
+      {
+          if (p != NULL) { /* OK */
+              return;
+          }
+
+          if (foo.p != NULL) { /* OK */
+              return;
+          }
+      }
+      """
+    When I successfully run `adlint fixture.c` on noarch
+    Then the output should exactly match with:
+      | mesg  | line | column |
+      | W0117 | 1    | 21     |
+      | W0117 | 2    | 6      |
+      | W0492 | 2    | 6      |
+      | C0001 | 1    | 16     |
+      | W1076 | 4    | 13     |
+      | W1071 | 4    | 13     |
+      | W0629 | 4    | 13     |
+      | W0628 | 4    | 13     |
+      | W0589 | 1    | 21     |
+      | W0593 | 1    | 21     |
+      | W0589 | 2    | 6      |
+      | W0593 | 2    | 6      |

data/features/code_check/W0642.feature

@@ -0,0 +1,67 @@
+Feature: W0642
+
+  W0642 detects that an expression trys to derive address of the array declared
+  as `register'.
+
+  Scenario: register array passed as function parameter
+    Given a target source named "fixture.c" with:
+      """
+      extern void foo(char *);
+
+      static void bar(void)
+      {
+          register char a[3];
+          foo(a); /* W0642 */
+      }
+      """
+    When I successfully run `adlint fixture.c` on noarch
+    Then the output should exactly match with:
+      | mesg  | line | column |
+      | W0118 | 1    | 13     |
+      | W1076 | 3    | 13     |
+      | W0642 | 6    | 9      |
+      | W0100 | 5    | 19     |
+      | W0629 | 3    | 13     |
+      | W0950 | 5    | 21     |
+      | W0628 | 3    | 13     |
+
+  Scenario: register array designated in initializer
+    Given a target source named "fixture.c" with:
+      """
+      static void foo(void)
+      {
+          register char a[3];
+          char *p = a; /* W0642 */
+      }
+      """
+    When I successfully run `adlint fixture.c` on noarch
+    Then the output should exactly match with:
+      | mesg  | line | column |
+      | W1076 | 1    | 13     |
+      | W0642 | 4    | 15     |
+      | W0100 | 3    | 19     |
+      | W0100 | 4    | 11     |
+      | W0629 | 1    | 13     |
+      | W0950 | 3    | 21     |
+      | W0628 | 1    | 13     |
+
+  Scenario: register array designated in assignment
+    Given a target source named "fixture.c" with:
+      """
+      static void foo(void)
+      {
+          register char a[3];
+          char *p;
+          p = a; /* W0642 */
+      }
+      """
+    When I successfully run `adlint fixture.c` on noarch
+    Then the output should exactly match with:
+      | mesg  | line | column |
+      | W1076 | 1    | 13     |
+      | W0642 | 5    | 9      |
+      | W0100 | 3    | 19     |
+      | W0100 | 4    | 11     |
+      | W0629 | 1    | 13     |
+      | W0950 | 3    | 21     |
+      | W0628 | 1    | 13     |

data/features/code_check/W0786.feature

@@ -0,0 +1,39 @@
+Feature: W0786
+
+  W0786 detects that a bit-field whose base type is not in signed or unsigned
+  `int' is declared.
+
+  Scenario: typedefed `unsigned long' bit-field declaration
+    Given a target source named "fixture.c" with:
+      """
+      typedef unsigned long base_t;
+
+      static struct { /* W0786 */
+          base_t    :1; /* bit padding */
+          base_t foo:1;
+          base_t    :1; /* bit padding */
+          base_t bar:1;
+          base_t    :1; /* bit padding */
+      } bf;
+      """
+    When I successfully run `adlint fixture.c` on noarch
+    Then the output should exactly match with:
+      | mesg  | line | column |
+      | W0786 | 3    | 8      |
+
+  Scenario: typedefed `unsigned int' bit-field declaration
+    Given a target source named "fixture.c" with:
+      """
+      typedef unsigned int base_t;
+
+      static struct { /* OK */
+          base_t    :1; /* bit padding */
+          base_t foo:1;
+          base_t    :1; /* bit padding */
+          base_t bar:1;
+          base_t    :1; /* bit padding */
+      } bf;
+      """
+    When I successfully run `adlint fixture.c` on noarch
+    Then the output should exactly match with:
+      | mesg  | line | column |

data/features/code_check/W0830.feature

@@ -61,3 +61,30 @@ Feature: W0830
     Then the output should exactly match with:
       | mesg  | line | column |
       | W0830 | 1    | 36     |
+
+  Scenario: hard to preprocess
+    Given a target source named "fixture.c" with:
+      """
+      #include "config.h"
+      """
+    And a target source named "config.h" with:
+      """
+      typedef enum jid {
+      #define DEFINE_JOB(id, func) JOBID_##id,
+      #include "job_tbl.h"
+      #undef DEFINE_JOB
+      } jid_t;
+      """
+    And a target source named "job_tbl.h" with:
+      """
+      DEFINE_JOB(1id, func1)
+      DEFINE_JOB(id2, func2)
+      """
+    When I successfully run `adlint fixture.c` on noarch
+    Then the output should exactly match with:
+      | mesg  | line | column |
+      | W0442 | 2    | 1      |
+      | W0073 | 1    | 1      |
+      | W0073 | 1    | 1      |
+      | W0830 | 2    | 1      |
+      | W0071 | 3    | 1      |

data/features/code_check/W1047.feature

@@ -159,3 +159,75 @@ Feature: W1047
       | W0100 | 22   | 18     |
       | W0551 | 14   | 5      |
       | W0628 | 20   | 5      |
+
+  Scenario: initializing array with address-constant
+    Given a target source named "fixture.c" with:
+      """
+      extern int foo(void);
+      extern int bar(void);
+      extern int baz(void);
+
+      static int (*fun_tbl[])(void) = { foo, bar, baz }; /* OK */
+      """
+    When I successfully run `adlint fixture.c` on noarch
+    Then the output should exactly match with:
+      | mesg  | line | column |
+      | W0118 | 1    | 12     |
+      | W0118 | 2    | 12     |
+      | W0118 | 3    | 12     |
+
+  Scenario: initializing struct with constant-specifier and address-constant
+    Given a target source named "fixture.c" with:
+      """
+      typedef struct handler {
+          int id;
+          int (*ptr)(void);
+      } handler_t;
+
+      extern int foo(void);
+      extern int bar(void);
+      extern int baz(void);
+
+      static handler_t h = { 1, foo }; /* OK */
+      """
+    When I successfully run `adlint fixture.c` on noarch
+    Then the output should exactly match with:
+      | mesg  | line | column |
+      | W0118 | 6    | 12     |
+      | W0118 | 7    | 12     |
+      | W0118 | 8    | 12     |
+
+  Scenario: initializing struct with inconstant expression and address-constant
+    Given a target source named "fixture.c" with:
+      """
+      typedef struct handler {
+          int id;
+          int (*ptr)(void);
+      } handler_t;
+
+      extern int foo(void);
+      extern int bar;
+      extern int baz;
+
+      static handler_t h = { bar + baz, foo }; /* W1047 */
+      """
+    When I successfully run `adlint fixture.c` on noarch
+    Then the output should exactly match with:
+      | mesg  | line | column |
+      | W0118 | 6    | 12     |
+      | W0118 | 7    | 12     |
+      | W0118 | 8    | 12     |
+      | W0723 | 10   | 28     |
+      | W1047 | 10   | 18     |
+
+  Scenario: initializing array with address-constant
+    Given a target source named "fixture.c" with:
+      """
+      static int i, j, k;
+      static int *var_tbl[] = { &i, &j, &k }; /* OK */
+      """
+    When I successfully run `adlint fixture.c` on noarch
+    Then the output should exactly match with:
+      | mesg  | line | column |
+      | W0425 | 1    | 15     |
+      | W0425 | 1    | 18     |

data/features/code_check/W9003.feature

@@ -269,3 +269,25 @@ Feature: W9003
       | W0105 | 1    | 23     |
       | W0629 | 1    | 13     |
       | W0628 | 1    | 13     |
+
+  Scenario: no implicit convertion of register variable
+    Given a target source named "fixture.c" with:
+      """
+      static void foo(void)
+      {
+          register char a[3];
+          char *p;
+          p = &a[0]; /* OK */
+      }
+      """
+    When I successfully run `adlint fixture.c` on noarch
+    Then the output should exactly match with:
+      | mesg  | line | column |
+      | W1076 | 1    | 13     |
+      | W0459 | 5    | 9      |
+      | W0642 | 5    | 9      |
+      | W0100 | 3    | 19     |
+      | W0100 | 4    | 11     |
+      | W0629 | 1    | 13     |
+      | W0950 | 3    | 21     |
+      | W0628 | 1    | 13     |

data/features/code_extraction/TODO

@@ -0,0 +1 @@
+Must write functional specifications about the code extraction feature.

data/features/metric_measurement/TODO

@@ -0,0 +1 @@
+Must write functional specifications about the metric measurement feature.

data/lib/adlint/analyzer.rb

@@ -199,8 +199,8 @@ module AdLint #:nodoc:
         Ld::MapTypedefPhase,
         Ld::MapFunctionPhase,
         Ld::MapVariablePhase,
-        Ld::LinkFunctionPhase,
-        Ld::LinkVariablePhase,
+        Ld::BuildCallGraphPhase,
+        Ld::BuildXRefGraphPhase,
         Ld::PreparePhase,
         Ld::TypedefReviewPhase,
         Ld::FunctionReviewPhase,

data/lib/adlint/cc1/ctrlexpr.rb

@@ -669,6 +669,27 @@ module Cc1 #:nodoc:
 
     def_delegator :@manipulator, :interpreter
     private :interpreter
+
+    alias :_org_interpret :interpret
+    def interpret(node)
+      case node
+      when ObjectSpecifier
+        if safely_evaluable_object_specifier?(node)
+          _org_interpret(node)
+        else
+          # NOTE: Nothing to do with an undeclared object.
+          create_tmpvar
+        end
+      else
+        _org_interpret(node)
+      end
+    end
+
+    def safely_evaluable_object_specifier?(obj_spec)
+      variable_named(obj_spec.identifier.value) ||
+        function_named(obj_spec.identifier.value) ||
+        enumerator_named(obj_spec.identifier.value)
+    end
   end
 
   class ValueComparison < ValueDomainNarrowing
@@ -682,10 +703,10 @@ module Cc1 #:nodoc:
     private
     def do_narrowing
       @lhs_manip.execute!
-      lhs_var = object_to_variable(@lhs_manip.result)
+      lhs_var = object_to_variable(@lhs_manip.result, @node.lhs_operand)
 
       @rhs_manip.execute!
-      rhs_var = object_to_variable(@rhs_manip.result)
+      rhs_var = object_to_variable(@rhs_manip.result, @node.rhs_operand)
 
       unless lhs_var.type.scalar? && rhs_var.type.scalar?
         return create_tmpvar(int_t)
@@ -754,7 +775,7 @@ module Cc1 #:nodoc:
     def do_narrowing
       @lhs_manip.execute!
       @lhs_manip.ensure_result_equal_to(scalar_value_of_true)
-      lhs_var = object_to_variable(@lhs_manip.result)
+      lhs_var = object_to_variable(@lhs_manip.result, @node.lhs_operand)
 
       # NOTE: The ISO C99 standard says;
       #
@@ -772,7 +793,7 @@ module Cc1 #:nodoc:
       @rhs_manip.load_original_values!(@lhs_manip)
       @rhs_manip.execute!
       @rhs_manip.ensure_result_equal_to(scalar_value_of_true)
-      rhs_var = object_to_variable(@rhs_manip.result)
+      rhs_var = object_to_variable(@rhs_manip.result, @node.rhs_operand)
 
       notify_sequence_point_reached(SequencePoint.new(@node.rhs_operand))
 
@@ -811,7 +832,7 @@ module Cc1 #:nodoc:
     def do_narrowing
       @lhs_manip.execute!
       @lhs_manip.ensure_result_equal_to(scalar_value_of_true)
-      lhs_var = object_to_variable(@lhs_manip.result)
+      lhs_var = object_to_variable(@lhs_manip.result, @node.lhs_operand)
 
       # NOTE: The ISO C99 standard says;
       #
@@ -830,7 +851,7 @@ module Cc1 #:nodoc:
       #        the LHS condition is false.
       @rhs_manip.execute!
       @rhs_manip.ensure_result_equal_to(scalar_value_of_true)
-      rhs_var = object_to_variable(@rhs_manip.result)
+      rhs_var = object_to_variable(@rhs_manip.result, @node.rhs_operand)
 
       notify_sequence_point_reached(SequencePoint.new(@node.rhs_operand))