Add some synthetic tests

test/synthetic/controlflow.c

@@ -0,0 +1,101 @@
+
+//////////////////////////////
+// path sensitive analysis
+//////////////////////////////
+
+int buf[2];
+int getValue(void); // unknown int value
+
+// arg
+// -------------------------------------
+
+void bug_arg_in_if(int a) {
+  if (a>=__LINE__)
+    buf[a] = 0; // BUG
+}
+
+void bug_arg_before_if(int a) {
+  buf[a] = 0; // BUG
+  if (a==__LINE__) {}
+}
+
+void bug_arg_after_if(int a) {
+  if (a==__LINE__) {}
+  buf[a] = 0; // BUG
+}
+
+// var
+// -------------------------------------
+
+void bug_var(void) {
+  int x = __LINE__;
+  buf[x] = 0; // BUG
+}
+
+void bug_var_in_switch(void) {
+  int x = getValue();
+  switch (x) {
+  case __LINE__:
+    buf[x] = 0; // BUG
+    break;
+  }
+}
+
+void bug_var_after_switch(void) {
+  int x = getValue();
+  switch (x) {
+  case __LINE__:
+    break;
+  }
+  buf[x] = 0; // BUG
+}
+
+void bug_var_after_while(void) {
+  int x = 0;
+  while (x<=__LINE__)
+    x++;
+  buf[x] = 0; // BUG
+}
+
+void bug_var_in_while(void) {
+  int x = 0;
+  while (x<__LINE__) {
+    buf[x] = 0; // BUG
+	x++;
+  }
+}
+
+// arg+var
+// -------------------------------------
+
+void bug_arg_var_assign_in_if(int a) {
+  int x = 0;
+  if (a==0)
+    x = __LINE__;
+  buf[x] = 0; // BUG
+}
+
+void bug_arg_var_second_if(int a) {
+  int x = 0;
+  if (a==0)
+    x = __LINE__;
+  if (a+1==1)
+    buf[x] = 0; // BUG
+}
+
+void bug_arg_var_after_while(int a) {
+  int x = 0;
+  if (a == __LINE__) {}
+  while (x<a)
+    x++;
+  buf[x] = 0; // BUG
+}
+
+void bug_arg_var_in_while(int a) {
+  int x = 0;
+  if (a == __LINE__) {}
+  while (x<a) {
+    buf[x] = 0; // BUG
+	x++;
+  }
+}

test/synthetic/data.c

@@ -0,0 +1,45 @@
+
+int TestData[10];
+#define TEST(DATA)   DATA=1000;TestData[DATA]=0;  DATA=0;TestData[0]=100/(DATA);
+
+int global;
+void test_global() {
+  TEST(global);
+}
+
+int global_array[10];
+void test_global_array() {
+  TEST(global_array[3]);
+}
+
+int *global_pointer;
+void test_global_pointer() {
+  TEST(*global_pointer);
+}
+
+
+void test_local() {
+  int local;
+  TEST(local);
+}
+
+void test_local_array() {
+  int local_array[10];
+  TEST(local_array[3]);
+}
+
+void test_local_pointer() {
+  int local;
+  int *local_pointer = &local;
+  TEST(*local_pointer);
+}
+
+
+struct S {
+  int member;
+};
+void test_struct_member(struct S *s) {
+  TEST(s->member);
+}
+
+

test/synthetic/functions.c

@@ -0,0 +1,22 @@
+
+int TestData[100];
+
+
+void test_function_par(int par) {
+  TestData[par] = 0;
+}
+void test_function_par2(int x, int y) {
+  if (x < 123)
+      TestData[y] = 0;
+}
+void call(int x) {
+  test_function_par1(1000);
+  test_function_par2(x, x < 1000 ? 10 : 1000);
+}
+
+int getLargeIndex() { return 1000; }
+void test_function_return() {
+  TestData[getLargeIndex()] = 0;
+}
+
+

test/synthetic/uninit.c

@@ -0,0 +1,48 @@
+
+// catch uninit variables..
+
+#define AB1(A,B)         A##B
+#define AB2(A,B)         AB1(A,B)
+#define USE_INT_X(STMT)  void AB2(use,__LINE__) (void) { int x; STMT; }
+
+void dostuff(int);
+
+// Bugs
+USE_INT_X(dostuff(x))
+USE_INT_X(dostuff(2+x))
+USE_INT_X(x++)
+USE_INT_X(x--)
+USE_INT_X(++x)
+USE_INT_X(--x)
+USE_INT_X(x=x+1)
+USE_INT_X(x=x-1)
+USE_INT_X(x=x*1)
+USE_INT_X(x=x/1)
+USE_INT_X(x=x%1)
+USE_INT_X(x=x&1)
+USE_INT_X(x=x|1)
+USE_INT_X(x=x^1)
+USE_INT_X(x=x<<1)
+USE_INT_X(x=x>>1)
+USE_INT_X(x+=1)
+USE_INT_X(x-=1)
+USE_INT_X(x*=1)
+USE_INT_X(x/=1)
+USE_INT_X(x%=1)
+USE_INT_X(x&=1)
+USE_INT_X(x|=1)
+USE_INT_X(x^=1)
+USE_INT_X(x<<=1)
+USE_INT_X(x>>=1)
+USE_INT_X(1?x:1)
+USE_INT_X(1&&x)
+USE_INT_X(x=*(&x)+1)
+USE_INT_X(int*p=&x; dostuff(*p))
+
+// No bugs
+USE_INT_X(x=0)
+USE_INT_X(0?x:1)
+USE_INT_X(0&&x)
+USE_INT_X(int*p=&x; *p=0; dostuff(x))
+
+