llvm / llvm/llvm-project

[clang][analyzer] unix.Malloc false positive after no-op += 0 on uintptr_t

Open
#220,972 1 comment 0 reactions 0 assignees View on GitHub
clang:static analyzer false-positive
Dominant language
LLVM
Stars
40.5k
Forks
18.7k
PR merge metrics
PR metrics pending

Description

**Description:**
Analyzer reports a `unix.Malloc` memory leak after an allocation pointer is converted to `uintptr_t`, subjected to the no-op operation `+= 0`, converted back to a pointer, and passed to `free()`. The value is unchanged, so `free()` receives the original allocation pointer.

**Reproducer:**
```c
#include
#include

void clang_analyzer_eval(int);

void test(void)
{
void *allocation = malloc(1);
if (allocation == NULL)
return;

uintptr_t value = (uintptr_t)allocation;

clang_analyzer_eval(value == allocation); // TRUE
value += 0;
clang_analyzer_eval(value == allocation); // UNKNOWN

free((void *)value);
}
```
Removing line: `value += 0;` makes the warning disappear. Compiler explorer link can be found [here](https://compiler-explorer.com/z/nf4Thb99d).

Contributor guide

Open the contributing guide

Research direction

Start with the Clang Static Analyzer handling for the unix.Malloc checker and run the supplied reproducer. Compare the analyzer state before and after `value += 0`; done means the no-op conversion sequence no longer reports a leak while the existing warning behavior remains intact.

Written by the indexing model from the issue text.

Assessment

Tech stack
c
Domain
compilers
Issue type
Bug
Difficulty
4/5
Estimated time
3-5 days
Activity status
Active
Clarity
Mostly clear
Newbie friendliness
52/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.