[clang][analyzer] unix.Malloc false positive after no-op += 0 on uintptr_t
- Dominant language
- LLVM
- Stars
- 40.5k
- Forks
- 18.7k
- PR merge metrics
- PR metrics pending
Description
**Description:**
Analyzer reports a `unix.Malloc` memory leak after an allocation pointer is converted to `uintptr_t`, subjected to the no-op operation `+= 0`, converted back to a pointer, and passed to `free()`. The value is unchanged, so `free()` receives the original allocation pointer.
**Reproducer:**
```c
#include
#include
void clang_analyzer_eval(int);
void test(void)
{
void *allocation = malloc(1);
if (allocation == NULL)
return;
uintptr_t value = (uintptr_t)allocation;
clang_analyzer_eval(value == allocation); // TRUE
value += 0;
clang_analyzer_eval(value == allocation); // UNKNOWN
free((void *)value);
}
```
Removing line: `value += 0;` makes the warning disappear. Compiler explorer link can be found [here](https://compiler-explorer.com/z/nf4Thb99d).
Contributor guide
Research direction
Start with the Clang Static Analyzer handling for the unix.Malloc checker and run the supplied reproducer. Compare the analyzer state before and after `value += 0`; done means the no-op conversion sequence no longer reports a leak while the existing warning behavior remains intact.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- c
- Domain
- compilers
- Issue type
- Bug
- Difficulty
- 4/5
- Estimated time
- 3-5 days
- Activity status
- Active
- Clarity
- Mostly clear
- Newbie friendliness
- 52/100