Testing cpp-reference.com/w/c examples with smatch

[mingodad]

I created a Lua script (see attached with the resulting output) to extract the examples from https://en.cppreference.com/w/c (can be downloaded here https://en.cppreference.com/w/Cppreference:Archives) and here is the sumary:

Total files scanned     :	614
Total files with code   :	434
Total files failed code :	71

I also needed to make small changes to smatch to return non zero when there is errors in the evaluate/tokenizer functions (see diff in the attachment) (also added a bunch of const to char *key parameters).

Also tested sparse see here lucvoo/sparse#4 and smatch pass more tests.

test-c-reference.zip

[mingodad]

I've noticed that smatch somehow takes longer than sparse when it doesn't find a header:

==CHECK==
/usr/bin/time timeout 3s sparse /tmp/cCode.c
/tmp/cCode.c:2:11: error: unable to open 'threads.h'
Command exited with non-zero status 1
0.00user 0.00system 0:00.00elapsed 66%CPU (0avgtext+0avgdata 3040maxresident)k
0inputs+0outputs (0major+465minor)pagefaults 0swaps

-------

==CHECK==
/usr/bin/time timeout 3s ../smatch /tmp/cCode.c
/tmp/cCode.c:2:11: error: unable to open 'threads.h'
Command exited with non-zero status 124
1.03user 1.96system 0:03.00elapsed 99%CPU (0avgtext+0avgdata 19072maxresident)k
0inputs+0outputs (0major+3631minor)pagefaults 0swaps

Also when running under valgrind smatch segfault with one example:

algrind ../smatch test-invalid-read.c
==1475== Memcheck, a memory error detector
==1475== Copyright (C) 2002-2024, and GNU GPL'd, by Julian Seward et al.
==1475== Using Valgrind-3.23.0 and LibVEX; rerun with -h for copyright info
==1475== Command: ../smatch test-invalid-read.c
==1475== 
test-invalid-read.c:4:8: error: no identifier for function argument
test-invalid-read.c:25:5: error: Expected ; at end of statement
test-invalid-read.c:25:5: error: got [
test-invalid-read.c:28:5: error: Expected ; at end of statement
test-invalid-read.c:28:5: error: got [
test-invalid-read.c:31:5: error: Expected ) after expression
test-invalid-read.c:31:5: error: got nullptr_t
test-invalid-read.c:32:5: error: Expected ) after expression
test-invalid-read.c:32:5: error: got nullptr_t
test-invalid-read.c:33:5: error: Expected ) after expression
test-invalid-read.c:33:5: error: got nullptr_t
test-invalid-read.c:34:5: error: Expected ) after expression
test-invalid-read.c:34:5: error: got nullptr_t
==1475== Invalid read of size 1
==1475==    at 0x4C3C752: strlen (vg_replace_strmem.c:505)
==1475==    by 0x5B304A2: vfprintf (vfprintf.c:1643)
==1475==    by 0x5C04FC8: __vsnprintf_chk (vsnprintf_chk.c:63)
==1475==    by 0x5C04EF4: __snprintf_chk (snprintf_chk.c:34)
==1475==    by 0x153773: snprintf (stdio2.h:64)
==1475==    by 0x153773: caller_info_callback (smatch_db.c:1375)
==1475==    by 0x3260A6: sqlite3_exec (sqlite3.c:137117)
==1475==    by 0x154CCF: sql_exec (smatch_db.c:167)
==1475==    by 0x15C7E8: sql_select_caller_info.constprop.0 (smatch_db.c:781)
==1475==    by 0x15CAD2: match_data_from_db (smatch_db.c:1507)
==1475==    by 0x17BAEF: pass_sym_list_to_client (smatch_hooks.c:149)
==1475==    by 0x17BAEF: __pass_to_client (smatch_hooks.c:171)
==1475==    by 0x16C017: start_function_definition (smatch_flow.c:2195)
==1475==    by 0x16FD7C: parse_inline (smatch_flow.c:2399)
==1475==    by 0x16FD7C: split_call (smatch_flow.c:593)
==1475==    by 0x16FD7C: __split_expr (smatch_flow.c:822)
==1475==    by 0x16FD7C: __split_expr (smatch_flow.c:696)
==1475==  Address 0x12 is not stack'd, malloc'd or (recently) free'd
==1475== 
==1475== 
==1475== Process terminating with default action of signal 11 (SIGSEGV)
==1475==  Access not within mapped region at address 0x12
==1475==    at 0x4C3C752: strlen (vg_replace_strmem.c:505)
==1475==    by 0x5B304A2: vfprintf (vfprintf.c:1643)
==1475==    by 0x5C04FC8: __vsnprintf_chk (vsnprintf_chk.c:63)
==1475==    by 0x5C04EF4: __snprintf_chk (snprintf_chk.c:34)
==1475==    by 0x153773: snprintf (stdio2.h:64)
==1475==    by 0x153773: caller_info_callback (smatch_db.c:1375)
==1475==    by 0x3260A6: sqlite3_exec (sqlite3.c:137117)
==1475==    by 0x154CCF: sql_exec (smatch_db.c:167)
==1475==    by 0x15C7E8: sql_select_caller_info.constprop.0 (smatch_db.c:781)
==1475==    by 0x15CAD2: match_data_from_db (smatch_db.c:1507)
==1475==    by 0x17BAEF: pass_sym_list_to_client (smatch_hooks.c:149)
==1475==    by 0x17BAEF: __pass_to_client (smatch_hooks.c:171)
==1475==    by 0x16C017: start_function_definition (smatch_flow.c:2195)
==1475==    by 0x16FD7C: parse_inline (smatch_flow.c:2399)
==1475==    by 0x16FD7C: split_call (smatch_flow.c:593)
==1475==    by 0x16FD7C: __split_expr (smatch_flow.c:822)
==1475==    by 0x16FD7C: __split_expr (smatch_flow.c:696)
==1475==  If you believe this happened as a result of a stack
==1475==  overflow in your program's main thread (unlikely but
==1475==  possible), you can try to increase the size of the
==1475==  main thread stack using the --main-stacksize= flag.
==1475==  The main thread stack size used in this run was 8388608.
==1475== 
==1475== HEAP SUMMARY:
==1475==     in use at exit: 646,841 bytes in 1,963 blocks
==1475==   total heap usage: 5,414 allocs, 3,451 frees, 1,404,634 bytes allocated
==1475== 
==1475== LEAK SUMMARY:
==1475==    definitely lost: 4,092 bytes in 110 blocks
==1475==    indirectly lost: 0 bytes in 0 blocks
==1475==      possibly lost: 244,064 bytes in 56 blocks
==1475==    still reachable: 398,685 bytes in 1,797 blocks
==1475==         suppressed: 0 bytes in 0 blocks
==1475== Rerun with --leak-check=full to see details of leaked memory
==1475== 
==1475== For lists of detected and suppressed errors, rerun with: -s
==1475== ERROR SUMMARY: 1 errors from 1 contexts (suppressed: 0 from 0)
Segmentation fault

test-invalid-read.c :

#include <stddef.h>
#include <stdio.h>

void g(int*)
{
    puts("Function g called");
}

#define DETECT_NULL_POINTER_CONSTANT(e) \
    _Generic(e,                         \
        void* : puts("void*"),          \
        nullptr_t : puts("nullptr_t"),  \
        default : puts("integer")       \
    )

int main()
{
    g(nullptr); // OK
    g(NULL); // OK
    g(0); // OK

    auto cloned_nullptr = nullptr;
    g(cloned_nullptr); // OK

    [[maybe_unused]] auto cloned_NULL = NULL;
//  g(cloned_NULL); // implementation-defined: maybe OK

    [[maybe_unused]] auto cloned_zero = 0;
//  g(cloned_zero); // Error

    DETECT_NULL_POINTER_CONSTANT(((void*)0));
    DETECT_NULL_POINTER_CONSTANT(0);
    DETECT_NULL_POINTER_CONSTANT(nullptr);
    DETECT_NULL_POINTER_CONSTANT(NULL); // implementation-defined
}

[error27]

Thanks for the bug report. I have fixed it now.