void entry_point(void) { int len = 10; struct A18 **array = (struct A18 **)ldv_malloc(sizeof(struct A18*)*len); struct A18 *p; int i=0; if(!array) return; for(; i<len; i++) { p = (struct A18 *)ldv_malloc(sizeof(struct A18)); array[i]=p; }; //unsafe: forgot to free return; }
struct A16 *alloc_16(int condition) { if(condition) { struct A16 *p = (struct A16 *)ldv_malloc(sizeof(struct A16)); return p; } return 0; }
struct ldv_device *alloc_21(void) { struct A21 *p = (struct A21*)ldv_malloc(sizeof(struct A21)); if(p) { return &p->dev; } else { return 0; } }
void entry_point(void) { int i; int len = 10; struct A17 **array = (struct A17 **)ldv_malloc(sizeof(struct A17*)*len); if(!array) return; for(i=0; i<len; i++) { array[i]=0; } alloc_unsafe_17(array, len);//unsafe: buggy alloc free_17(array, len); free(array); }
void entry_point(void) { int len = 10; struct A18 **array = (struct A18 **)ldv_malloc(sizeof(struct A18*)*len); if(array) { struct A18 *p; int i=0; int j; for(; i<len; i++) { p = (struct A18 *)ldv_malloc(sizeof(struct A18)); if(!p) goto err; array[i]=p; }; err: //free all memory for(j=i-1; j>=0; j--) { free(array[j]); } free(array); } return; }
void entry_point(void) { int i; int len = ldv_positive(); __VERIFIER_assume(len<16777216); struct A17 **array = (struct A17 **)ldv_malloc(sizeof(struct A17*)*len); if(array) { for(i=0; i<len; i++) { array[i]=0; } alloc_17(array, len); free_17(array, len); free(array); } }
void entry_point(void) { struct ldv_hid_device *hdev = (struct ldv_hid_device *)ldv_malloc(sizeof(struct ldv_hid_device)); if(!hdev) goto err_hdev; struct ldv_usb_interface *intf = (struct ldv_usb_interface*)ldv_malloc(sizeof(struct ldv_usb_interface)); if(!intf) goto err_intf; intf->cur_altsetting = (struct ldv_usb_host_interface *)ldv_malloc(sizeof(struct ldv_usb_host_interface)); if(!intf->cur_altsetting) goto err_cur_alt; intf->cur_altsetting->desc.bInterfaceProtocol = (char)__VERIFIER_nondet_int(); hdev->dev.parent = &intf->dev; if(ldv_arvo_probe_unsafe(hdev)==0) {//unsafe: buggy probe ldv_arvo_remove(hdev); } err_probe: free(intf->cur_altsetting); err_cur_alt: free(intf); err_intf: free(hdev); err_hdev: return; }
int alloc_unsafe_17(struct A17 **array, int len) { struct A17 *p; int i=0; int j; for(; i<len; i++) { p = (struct A17 *)ldv_malloc(sizeof(struct A17)); if(!p) goto err; array[i]=p; }; err: for(j=i-1; j>=0; j--) { free(array[j]); //unsafe: double free } return -ENOMEM; }
int probe1_6(struct A *a) { int ret = -ENOMEM; int *p = (int *)ldv_malloc(sizeof(int)); if(p==0) return ret; ret = f6(); if(ret<0) goto err; ret = g6(); if(ret<0) goto err; a->p = p; return 0; err: free(p); return ret; }
int *f5(void) { int *p = (int *)ldv_malloc(sizeof(int)); }
void alloc_8(void) { a8 = (int *)ldv_malloc(sizeof(int)); }