diff --git a/clang/lib/StaticAnalyzer/Core/ExprEngineC.cpp b/clang/lib/StaticAnalyzer/Core/ExprEngineC.cpp index cc62cf1048c0..3b5a437e3c15 100644 --- a/clang/lib/StaticAnalyzer/Core/ExprEngineC.cpp +++ b/clang/lib/StaticAnalyzer/Core/ExprEngineC.cpp @@ -100,6 +100,10 @@ void ExprEngine::VisitBinaryOperator(const BinaryOperator* B, SVal Result = evalBinOp(state, Op, LeftV, RightV, B->getType()); if (!Result.isUnknown()) { state = state->BindExpr(B, LCtx, Result); + } else { + // If we cannot evaluate the operation escape the operands. + state = escapeValue(state, LeftV, PSK_EscapeOther); + state = escapeValue(state, RightV, PSK_EscapeOther); } Bldr.generateNode(B, *it, state); diff --git a/clang/test/Analysis/symbol-escape.cpp b/clang/test/Analysis/symbol-escape.cpp new file mode 100644 index 000000000000..be5dfbcd9ef5 --- /dev/null +++ b/clang/test/Analysis/symbol-escape.cpp @@ -0,0 +1,33 @@ +// RUN: %clang_analyze_cc1 \ +// RUN: -analyzer-checker=core,cplusplus.NewDeleteLeaks \ +// RUN: -verify %s + +// expected-no-diagnostics: Whenever we cannot evaluate an operation we escape +// the operands. After the evaluation it would be an +// Unknown value and the tracking would be lost. + +typedef unsigned __INTPTR_TYPE__ uintptr_t; + +class C {}; + +C *simple_escape_in_bitwise_op(C *Foo) { + C *Bar = new C(); + Bar = reinterpret_cast(reinterpret_cast(Bar) & 0x1); + (void)Bar; + // no-warning: "Potential leak of memory pointed to by 'Bar'" was here. + + return Bar; +} + +C **indirect_escape_in_bitwise_op() { + C *Qux = new C(); + C **Baz = &Qux; + Baz = reinterpret_cast(reinterpret_cast(Baz) | 0x1); + Baz = reinterpret_cast(reinterpret_cast(Baz) & + ~static_cast(0x1)); + // no-warning: "Potential leak of memory pointed to by 'Qux'" was here. + + delete *Baz; + return Baz; +} +