From 376640d2445131ac035c839bda3862f841d0333d Mon Sep 17 00:00:00 2001
From: Dario Pinto <dario.pinto@cea.fr>
Date: Fri, 17 Jul 2020 15:34:47 +0200
Subject: [PATCH] [bench-moerman2018] add fixed version of test cases
---
Makefile | 1 +
README.md | 1 +
bench-moerman2018/.frama-c/.gitignore | 7 +
bench-moerman2018/.frama-c/GNUmakefile | 76 ++++
bench-moerman2018/.frama-c/eval_summary.txt | 400 ++++++++++++++++++
bench-moerman2018/.frama-c/evaluate_case.sh | 29 ++
bench-moerman2018/.frama-c/path.mk | 1 +
bench-moerman2018/LICENSE | 21 +
bench-moerman2018/README.md | 13 +
bench-moerman2018/base/files_access_closed.c | 22 +
bench-moerman2018/base/files_double_close.c | 23 +
bench-moerman2018/base/files_resource_leak.c | 20 +
bench-moerman2018/base/general_divide_by_0.c | 16 +
bench-moerman2018/base/general_nullpointer.c | 17 +
.../base/general_uninitialized_pointer.c | 15 +
.../base/general_uninitialized_value.c | 14 +
bench-moerman2018/base/integers_overflow.c | 17 +
bench-moerman2018/base/memory_double_free.c | 24 ++
bench-moerman2018/base/memory_leak.c | 23 +
.../memory_read_uninitialized_malloced_mem.c | 23 +
bench-moerman2018/base/memory_refer_freed.c | 25 ++
bench-moerman2018/base/memory_zero_alloc.c | 27 ++
bench-moerman2018/base/strings_overflow.c | 16 +
.../base/strings_unbounded_copy.c | 17 +
bench-moerman2018/common/common.c | 52 +++
bench-moerman2018/common/common.h | 9 +
bench-moerman2018/common/pointers.c | 24 ++
.../access_closed/01_simple_if.c | 56 +++
.../access_closed/02_simple_if_int1.c | 55 +++
.../access_closed/02_simple_if_int2.c | 61 +++
.../access_closed/03_simple_if_multi_func.c | 55 +++
.../access_closed/04_simple_switch.c | 80 ++++
.../access_closed/05_simple_goto.c | 46 ++
.../06_simple_pass_by_reference.c | 59 +++
.../access_closed/07_cross_file.c | 50 +++
.../access_closed/08_loop_for.c | 56 +++
.../access_closed/09_loop_for_complex.c | 59 +++
.../access_closed/10_loop_while_continue.c | 63 +++
.../access_closed/11_loop_while_do_continue.c | 63 +++
.../12_loop_for_array_branching.c | 50 +++
.../13_loop_for_pointer_arithmetic.c | 71 ++++
.../access_closed/14_loop_recursion.c | 58 +++
.../access_closed/15_loop_recursion_multi.c | 61 +++
.../access_closed/16_misc_pseudo_recursion.c | 65 +++
.../17_complex_function_pointers.c | 59 +++
.../18_complex_struct_multiple_methods.c | 93 ++++
.../access_closed/19_complex_refcount.c | 79 ++++
.../access_closed/access_closed.h | 37 ++
.../double_close/01_simple_if.c | 56 +++
.../double_close/02_simple_if_int1.c | 55 +++
.../double_close/02_simple_if_int2.c | 61 +++
.../double_close/03_simple_if_multi_func.c | 56 +++
.../double_close/04_simple_switch.c | 82 ++++
.../double_close/05_simple_goto.c | 51 +++
.../06_simple_pass_by_reference.c | 59 +++
.../double_close/07_cross_file.c | 52 +++
.../double_close/08_loop_for.c | 61 +++
.../double_close/09_loop_for_complex.c | 64 +++
.../double_close/10_loop_while_continue.c | 68 +++
.../double_close/11_loop_while_do_continue.c | 68 +++
.../12_loop_for_array_branching.c | 58 +++
.../13_loop_for_pointer_arithmetic.c | 80 ++++
.../double_close/14_loop_recursion.c | 65 +++
.../double_close/15_loop_recursion_multi.c | 69 +++
.../double_close/16_misc_pseudo_recursion.c | 65 +++
.../17_complex_function_pointers.c | 59 +++
.../18_complex_struct_multiple_methods.c | 95 +++++
.../double_close/19_complex_refcount.c | 77 ++++
.../double_close/double_close.h | 37 ++
.../resource_leak/01_simple_if.c | 53 +++
.../resource_leak/02_simple_if_int1.c | 54 +++
.../resource_leak/02_simple_if_int2.c | 60 +++
.../resource_leak/03_simple_if_multi_func.c | 55 +++
.../resource_leak/04_simple_switch.c | 84 ++++
.../resource_leak/05_simple_goto.c | 46 ++
.../06_simple_pass_by_reference.c | 56 +++
.../resource_leak/07_cross_file.c | 47 ++
.../resource_leak/08_loop_for.c | 57 +++
.../resource_leak/09_loop_for_complex.c | 60 +++
.../resource_leak/10_loop_while_continue.c | 64 +++
.../resource_leak/11_loop_while_do_continue.c | 64 +++
.../12_loop_for_array_branching.c | 55 +++
.../13_loop_for_pointer_arithmetic.c | 62 +++
.../resource_leak/14_loop_recursion.c | 53 +++
.../resource_leak/15_loop_recursion_multi.c | 61 +++
.../resource_leak/16_misc_pseudo_recursion.c | 66 +++
.../17_complex_function_pointers.c | 56 +++
.../18_complex_struct_multiple_methods.c | 93 ++++
.../resource_leak/19_complex_refcount.c | 76 ++++
.../resource_leak/resource_leak.h | 37 ++
.../general/divide_by_zero/01_simple_if.c | 44 ++
.../divide_by_zero/02_simple_if_int1.c | 43 ++
.../divide_by_zero/02_simple_if_int2.c | 48 +++
.../divide_by_zero/03_simple_if_multi_func.c | 50 +++
.../general/divide_by_zero/04_simple_switch.c | 61 +++
.../general/divide_by_zero/05_simple_goto.c | 42 ++
.../06_simple_pass_by_reference.c | 48 +++
.../divide_by_zero/07_simple_cross_file.c | 40 ++
.../general/divide_by_zero/08_loop_for.c | 40 ++
.../divide_by_zero/09_loop_for_complex.c | 43 ++
.../divide_by_zero/10_loop_while_continue.c | 43 ++
.../11_loop_while_do_continue.c | 43 ++
.../12_loop_for_array_branching.c | 45 ++
.../13_loop_for_pointer_arithmetic.c | 51 +++
.../divide_by_zero/14_loop_recursion.c | 39 ++
.../divide_by_zero/15_loop_recursion_multi.c | 48 +++
.../divide_by_zero/16_misc_pseudo_recursion.c | 52 +++
.../17_complex_function_pointers.c | 48 +++
.../18_complex_struct_multiple_methods.c | 78 ++++
.../divide_by_zero/19_complex_refcount.c | 67 +++
.../general/divide_by_zero/divide_by_zero.h | 35 ++
.../general/nullpointer/01_simple_if.c | 43 ++
.../general/nullpointer/02_simple_if_int1.c | 42 ++
.../general/nullpointer/02_simple_if_int2.c | 47 ++
.../nullpointer/03_simple_if_multi_func.c | 51 +++
.../general/nullpointer/04_simple_switch.c | 60 +++
.../general/nullpointer/05_simple_goto.c | 43 ++
.../nullpointer/06_simple_pass_by_reference.c | 49 +++
.../general/nullpointer/07_cross_file.c | 41 ++
.../general/nullpointer/08_loop_for.c | 41 ++
.../general/nullpointer/09_loop_for_complex.c | 44 ++
.../nullpointer/10_loop_while_continue.c | 44 ++
.../nullpointer/11_loop_while_do_continue.c | 44 ++
.../nullpointer/12_loop_for_array_branching.c | 41 ++
.../13_loop_for_pointer_arithmetic.c | 52 +++
.../general/nullpointer/14_loop_recursion.c | 48 +++
.../nullpointer/15_loop_recursion_multi.c | 53 +++
.../nullpointer/16_misc_pseudo_recursion.c | 60 +++
.../17_complex_function_pointers.c | 49 +++
.../18_complex_struct_multiple_methods.c | 91 ++++
.../general/nullpointer/19_complex_refcount.c | 70 +++
.../general/nullpointer/nullpointer.h | 36 ++
.../uninitialized/pointer/01_simple_if.c | 43 ++
.../uninitialized/pointer/02_simple_if_int1.c | 42 ++
.../uninitialized/pointer/02_simple_if_int2.c | 47 ++
.../pointer/03_simple_if_multi_func.c | 53 +++
.../uninitialized/pointer/04_simple_switch.c | 60 +++
.../uninitialized/pointer/05_simple_goto.c | 45 ++
.../pointer/06_simple_pass_by_reference.c | 51 +++
.../uninitialized/pointer/07_cross_file.c | 43 ++
.../uninitialized/pointer/08_loop_for.c | 41 ++
.../pointer/09_loop_for_complex.c | 44 ++
.../pointer/10_loop_while_continue.c | 44 ++
.../pointer/11_loop_while_do_continue.c | 44 ++
.../pointer/12_loop_for_array_branching.c | 43 ++
.../pointer/13_loop_for_pointer_arithmetic.c | 42 ++
.../uninitialized/pointer/14_loop_recursion.c | 47 ++
.../pointer/15_loop_recursion_multi.c | 56 +++
.../pointer/16_misc_pseudo_recursion.c | 58 +++
.../pointer/17_complex_function_pointers.c | 51 +++
.../18_complex_struct_multiple_methods.c | 92 ++++
.../pointer/19_complex_refcount.c | 72 ++++
.../uninitialized/pointer/uninit_ptr.h | 39 ++
.../uninitialized/value/01_simple_if.c | 42 ++
.../uninitialized/value/02_simple_if_int1.c | 41 ++
.../uninitialized/value/02_simple_if_int2.c | 46 ++
.../value/03_simple_if_multi_func.c | 52 +++
.../uninitialized/value/04_simple_switch.c | 59 +++
.../uninitialized/value/05_simple_goto.c | 44 ++
.../value/06_simple_pass_by_reference.c | 52 +++
.../value/07_simple_cross_file.c | 42 ++
.../general/uninitialized/value/08_loop_for.c | 40 ++
.../uninitialized/value/09_loop_for_complex.c | 43 ++
.../value/10_loop_while_continue.c | 43 ++
.../value/11_loop_while_do_continue.c | 43 ++
.../value/12_loop_for_array_branching.c | 47 ++
.../value/13_loop_for_pointer_arithmetic.c | 51 +++
.../uninitialized/value/14_loop_recursion.c | 45 ++
.../value/15_loop_recursion_multi.c | 52 +++
.../value/16_misc_pseudo_recursion.c | 64 +++
.../value/17_complex_function_pointers.c | 52 +++
.../18_complex_struct_multiple_methods.c | 82 ++++
.../uninitialized/value/19_complex_refcount.c | 71 ++++
.../uninitialized/value/uninitialized_value.h | 38 ++
.../integers/overflow/01_simple_if.c | 44 ++
.../integers/overflow/02_simple_if_int1.c | 43 ++
.../integers/overflow/02_simple_if_int2.c | 48 +++
.../overflow/03_simple_if_multi_func.c | 50 +++
.../integers/overflow/04_simple_switch.c | 62 +++
.../integers/overflow/05_simple_goto.c | 41 ++
.../overflow/06_simple_pass_by_reference.c | 48 +++
.../integers/overflow/07_simple_cross_file.c | 40 ++
.../integers/overflow/08_loop_for.c | 38 ++
.../integers/overflow/09_loop_for_complex.c | 41 ++
.../overflow/10_loop_while_continue.c | 41 ++
.../overflow/11_loop_while_do_continue.c | 41 ++
.../overflow/12_loop_for_array_branching.c | 48 +++
.../overflow/13_loop_for_pointer_arithmetic.c | 54 +++
.../integers/overflow/14_loop_recursion.c | 41 ++
.../overflow/15_loop_recursion_multi.c | 47 ++
.../overflow/16_misc_pseudo_recursion.c | 50 +++
.../overflow/17_complex_function_pointers.c | 46 ++
.../18_complex_struct_multiple_methods.c | 84 ++++
.../integers/overflow/19_complex_refcount.c | 69 +++
.../integers/overflow/integer_overflow.h | 36 ++
.../memory/access_uninit/01_simple_if.c | 51 +++
.../memory/access_uninit/02_simple_if_int1.c | 50 +++
.../memory/access_uninit/02_simple_if_int2.c | 55 +++
.../access_uninit/03_simple_if_multi_func.c | 57 +++
.../memory/access_uninit/04_simple_switch.c | 66 +++
.../memory/access_uninit/05_simple_goto.c | 53 +++
.../06_simple_pass_by_reference.c | 51 +++
.../access_uninit/07_simple_cross_file.c | 50 +++
.../memory/access_uninit/08_loop_for.c | 47 ++
.../access_uninit/09_loop_for_complex.c | 50 +++
.../access_uninit/10_loop_while_continue.c | 50 +++
.../access_uninit/11_loop_while_do_continue.c | 50 +++
.../12_loop_for_array_branching.c | 58 +++
.../13_loop_for_pointer_arithmetic.c | 54 +++
.../memory/access_uninit/14_loop_recursion.c | 66 +++
.../access_uninit/15_loop_recursion_multi.c | 78 ++++
.../access_uninit/16_misc_pseudo_recursion.c | 78 ++++
.../17_complex_function_pointers.c | 51 +++
.../18_complex_struct_multiple_methods.c | 102 +++++
.../access_uninit/19_complex_refcount.c | 87 ++++
.../access_uninit/test_correct/01_simple_if.c | 38 ++
.../test_correct/02_simple_if_int1.c | 37 ++
.../test_correct/02_simple_if_int2.c | 42 ++
.../test_correct/03_simple_if_multi_func.c | 44 ++
.../test_correct/04_simple_switch.c | 52 +++
.../test_correct/05_simple_goto.c | 42 ++
.../06_simple_pass_by_reference.c | 36 ++
.../test_correct/07_simple_cross_file.c | 37 ++
.../access_uninit/test_correct/08_loop_for.c | 36 ++
.../test_correct/09_loop_for_complex.c | 39 ++
.../test_correct/10_loop_while_continue.c | 39 ++
.../test_correct/11_loop_while_do_continue.c | 39 ++
.../12_loop_for_array_branching.c | 47 ++
.../13_loop_for_pointer_arithmetic.c | 43 ++
.../test_correct/14_loop_recursion.c | 55 +++
.../test_correct/15_loop_recursion_multi.c | 63 +++
.../test_correct/16_misc_pseudo_recursion.c | 67 +++
.../17_complex_function_pointers.c | 36 ++
.../18_complex_struct_multiple_methods.c | 91 ++++
.../test_correct/19_complex_refcount.c | 82 ++++
.../test_correct_catch_bad/01_simple_if.c | 41 ++
.../02_simple_if_int1.c | 40 ++
.../02_simple_if_int2.c | 45 ++
.../03_simple_if_multi_func.c | 47 ++
.../test_correct_catch_bad/04_simple_switch.c | 55 +++
.../test_correct_catch_bad/05_simple_goto.c | 45 ++
.../06_simple_pass_by_reference.c | 41 ++
.../07_simple_cross_file.c | 40 ++
.../test_correct_catch_bad/08_loop_for.c | 39 ++
.../09_loop_for_complex.c | 42 ++
.../10_loop_while_continue.c | 42 ++
.../11_loop_while_do_continue.c | 42 ++
.../12_loop_for_array_branching.c | 50 +++
.../13_loop_for_pointer_arithmetic.c | 46 ++
.../14_loop_recursion.c | 58 +++
.../15_loop_recursion_multi.c | 68 +++
.../16_misc_pseudo_recursion.c | 70 +++
.../17_complex_function_pointers.c | 41 ++
.../18_complex_struct_multiple_methods.c | 94 ++++
.../19_complex_refcount.c | 82 ++++
.../test_incorrect/01_simple_if.c | 38 ++
.../test_incorrect/02_simple_if_int1.c | 37 ++
.../test_incorrect/02_simple_if_int2.c | 42 ++
.../test_incorrect/03_simple_if_multi_func.c | 44 ++
.../test_incorrect/04_simple_switch.c | 52 +++
.../test_incorrect/05_simple_goto.c | 42 ++
.../06_simple_pass_by_reference.c | 36 ++
.../test_incorrect/07_simple_cross_file.c | 37 ++
.../test_incorrect/08_loop_for.c | 36 ++
.../test_incorrect/09_loop_for_complex.c | 39 ++
.../test_incorrect/10_loop_while_continue.c | 39 ++
.../11_loop_while_do_continue.c | 39 ++
.../12_loop_for_array_branching.c | 47 ++
.../13_loop_for_pointer_arithmetic.c | 43 ++
.../test_incorrect/14_loop_recursion.c | 50 +++
.../test_incorrect/15_loop_recursion_multi.c | 58 +++
.../test_incorrect/16_misc_pseudo_recursion.c | 61 +++
.../17_complex_function_pointers.c | 36 ++
.../18_complex_struct_multiple_methods.c | 89 ++++
.../test_incorrect/19_complex_refcount.c | 83 ++++
.../test_lib_correct/01_simple_if.c | 34 ++
.../test_lib_correct/02_simple_if_int1.c | 33 ++
.../test_lib_correct/02_simple_if_int2.c | 38 ++
.../03_simple_if_multi_func.c | 41 ++
.../test_lib_correct/04_simple_switch.c | 47 ++
.../test_lib_correct/05_simple_goto.c | 40 ++
.../06_simple_pass_by_reference.c | 34 ++
.../test_lib_correct/07_simple_cross_file.c | 34 ++
.../test_lib_correct/08_loop_for.c | 34 ++
.../test_lib_correct/09_loop_for_complex.c | 37 ++
.../test_lib_correct/10_loop_while_continue.c | 37 ++
.../11_loop_while_do_continue.c | 37 ++
.../12_loop_for_array_branching.c | 45 ++
.../13_loop_for_pointer_arithmetic.c | 41 ++
.../test_lib_correct/14_loop_recursion.c | 48 +++
.../15_loop_recursion_multi.c | 58 +++
.../16_misc_pseudo_recursion.c | 59 +++
.../17_complex_function_pointers.c | 34 ++
.../18_complex_struct_multiple_methods.c | 87 ++++
.../test_lib_correct/19_complex_refcount.c | 59 +++
.../test_lib_incorrect/01_simple_if.c | 31 ++
.../test_lib_incorrect/02_simple_if_int1.c | 30 ++
.../test_lib_incorrect/02_simple_if_int2.c | 35 ++
.../03_simple_if_multi_func.c | 38 ++
.../test_lib_incorrect/04_simple_switch.c | 44 ++
.../test_lib_incorrect/05_simple_goto.c | 37 ++
.../06_simple_pass_by_reference.c | 29 ++
.../test_lib_incorrect/07_simple_cross_file.c | 31 ++
.../test_lib_incorrect/08_loop_for.c | 31 ++
.../test_lib_incorrect/09_loop_for_complex.c | 34 ++
.../10_loop_while_continue.c | 34 ++
.../11_loop_while_do_continue.c | 34 ++
.../12_loop_for_array_branching.c | 42 ++
.../13_loop_for_pointer_arithmetic.c | 38 ++
.../test_lib_incorrect/14_loop_recursion.c | 45 ++
.../15_loop_recursion_multi.c | 53 +++
.../16_misc_pseudo_recursion.c | 56 +++
.../17_complex_function_pointers.c | 29 ++
.../18_complex_struct_multiple_methods.c | 84 ++++
.../test_lib_incorrect/19_complex_refcount.c | 59 +++
.../access_uninit/uninitialized_malloc.h | 37 ++
.../memory/double_free/01_simple_if.c | 48 +++
.../memory/double_free/02_simple_if_int1.c | 49 +++
.../memory/double_free/02_simple_if_int2.c | 55 +++
.../double_free/03_simple_if_multi_func.c | 45 ++
.../memory/double_free/04_simple_switch.c | 62 +++
.../memory/double_free/05_simple_goto.c | 47 ++
.../double_free/06_simple_pass_by_reference.c | 49 +++
.../memory/double_free/07_cross_file.c | 45 ++
.../memory/double_free/08_loop_for.c | 64 +++
.../memory/double_free/09_loop_for_complex.c | 67 +++
.../double_free/10_loop_while_continue.c | 68 +++
.../double_free/11_loop_while_do_continue.c | 68 +++
.../double_free/12_loop_for_array_branching.c | 57 +++
.../13_loop_for_pointer_arithmetic.c | 47 ++
.../memory/double_free/14_loop_recursion.c | 65 +++
.../double_free/14_loop_recursion_alt.c | 59 +++
.../double_free/15_loop_recursion_multi.c | 73 ++++
.../double_free/15_loop_recursion_multi_alt.c | 66 +++
.../double_free/16_misc_pseudo_recursion.c | 60 +++
.../17_complex_function_pointers.c | 50 +++
.../18_complex_struct_multiple_methods.c | 90 ++++
.../memory/double_free/19_complex_refcount.c | 71 ++++
.../memory/double_free/double_free.h | 38 ++
bench-moerman2018/memory/leak/01_simple_if.c | 55 +++
.../memory/leak/02_simple_if_int1.c | 56 +++
.../memory/leak/02_simple_if_int2.c | 62 +++
.../memory/leak/03_simple_if_multi_func.c | 57 +++
.../memory/leak/04_simple_switch.c | 86 ++++
.../memory/leak/05_simple_goto.c | 47 ++
.../memory/leak/06_simple_pass_by_reference.c | 53 +++
bench-moerman2018/memory/leak/07_cross_file.c | 47 ++
bench-moerman2018/memory/leak/08_loop_for.c | 58 +++
.../memory/leak/09_loop_for_complex.c | 61 +++
.../memory/leak/10_loop_while_continue.c | 62 +++
.../memory/leak/11_loop_while_do_continue.c | 62 +++
.../memory/leak/12_loop_for_array_branching.c | 56 +++
.../leak/13_loop_for_pointer_arithmetic.c | 60 +++
.../memory/leak/14_loop_recursion.c | 53 +++
.../memory/leak/15_loop_recursion_multi.c | 61 +++
.../memory/leak/16_misc_pseudo_recursion.c | 78 ++++
.../leak/17_complex_function_pointers.c | 54 +++
.../leak/18_complex_struct_multiple_methods.c | 95 +++++
.../memory/leak/19_complex_refcount.c | 69 +++
bench-moerman2018/memory/leak/memory_leak.h | 36 ++
.../memory/refer_free/01_simple_if.c | 57 +++
.../memory/refer_free/02_simple_if_int1.c | 56 +++
.../memory/refer_free/02_simple_if_int2.c | 61 +++
.../refer_free/03_simple_if_multi_func.c | 57 +++
.../memory/refer_free/04_simple_switch.c | 71 ++++
.../memory/refer_free/05_simple_goto.c | 48 +++
.../refer_free/06_simple_pass_by_reference.c | 58 +++
.../memory/refer_free/07_cross_file.c | 50 +++
.../memory/refer_free/08_loop_for.c | 56 +++
.../memory/refer_free/09_loop_for_complex.c | 57 +++
.../refer_free/10_loop_while_continue.c | 58 +++
.../refer_free/11_loop_while_do_continue.c | 58 +++
.../refer_free/12_loop_for_array_branching.c | 52 +++
.../13_loop_for_pointer_arithmetic.c | 56 +++
.../memory/refer_free/14_loop_recursion.c | 47 ++
.../refer_free/15_loop_recursion_multi.c | 55 +++
.../refer_free/16_misc_pseudo_recursion.c | 56 +++
.../refer_free/17_complex_function_pointers.c | 56 +++
.../18_complex_struct_multiple_methods.c | 93 ++++
.../memory/refer_free/19_complex_refcount.c | 72 ++++
.../memory/refer_free/refer_free.h | 36 ++
.../memory/zero_alloc/01_simple_if.c | 51 +++
.../memory/zero_alloc/02_simple_if_int1.c | 50 +++
.../memory/zero_alloc/02_simple_if_int2.c | 56 +++
.../zero_alloc/03_simple_if_multi_func.c | 54 +++
.../memory/zero_alloc/04_simple_switch.c | 67 +++
.../memory/zero_alloc/05_simple_goto.c | 43 ++
.../zero_alloc/06_simple_pass_by_reference.c | 53 +++
.../memory/zero_alloc/07_cross_file.c | 49 +++
.../memory/zero_alloc/08_loop_for.c | 46 ++
.../memory/zero_alloc/09_loop_for_complex.c | 49 +++
.../zero_alloc/10_loop_while_continue.c | 50 +++
.../zero_alloc/11_loop_while_do_continue.c | 50 +++
.../zero_alloc/12_loop_for_array_branching.c | 49 +++
.../13_loop_for_pointer_arithmetic.c | 65 +++
.../memory/zero_alloc/14_loop_recursion.c | 51 +++
.../zero_alloc/15_loop_recursion_multi.c | 59 +++
.../zero_alloc/16_misc_pseudo_recursion.c | 61 +++
.../zero_alloc/17_complex_function_pointers.c | 53 +++
.../18_complex_struct_multiple_methods.c | 87 ++++
.../memory/zero_alloc/19_complex_refcount.c | 76 ++++
.../memory/zero_alloc/zero_alloc.h | 37 ++
bench-moerman2018/preprocess_files.sh | 47 ++
.../strings/overflow/01_simple_if.c | 46 ++
.../strings/overflow/02_simple_if_int1.c | 45 ++
.../strings/overflow/02_simple_if_int2.c | 51 +++
.../overflow/03_simple_if_multi_func.c | 53 +++
.../strings/overflow/04_simple_switch.c | 64 +++
.../strings/overflow/05_simple_goto.c | 44 ++
.../overflow/06_simple_pass_by_reference.c | 50 +++
.../strings/overflow/07_simple_cross_file.c | 42 ++
.../strings/overflow/08_loop_for.c | 40 ++
.../strings/overflow/09_loop_for_complex.c | 44 ++
.../strings/overflow/10_loop_while_continue.c | 44 ++
.../overflow/11_loop_while_do_continue.c | 44 ++
.../overflow/12_loop_for_array_branching.c | 48 +++
.../overflow/13_loop_for_pointer_arithmetic.c | 53 +++
.../strings/overflow/14_loop_recursion.c | 43 ++
.../overflow/15_loop_recursion_multi.c | 49 +++
.../overflow/16_misc_pseudo_recursion.c | 55 +++
.../overflow/17_complex_function_pointers.c | 51 +++
.../18_complex_struct_multiple_methods.c | 93 ++++
.../strings/overflow/19_complex_refcount.c | 77 ++++
.../strings/overflow/string_overflow.h | 38 ++
.../strings/unbounded_copy/01_simple_if.c | 46 ++
.../unbounded_copy/02_simple_if_int1.c | 45 ++
.../unbounded_copy/02_simple_if_int2.c | 51 +++
.../unbounded_copy/03_simple_if_multi_func.c | 53 +++
.../strings/unbounded_copy/04_simple_switch.c | 66 +++
.../strings/unbounded_copy/05_simple_goto.c | 43 ++
.../06_simple_pass_by_reference.c | 50 +++
.../unbounded_copy/07_simple_cross_file.c | 42 ++
.../strings/unbounded_copy/08_loop_for.c | 40 ++
.../unbounded_copy/09_loop_for_complex.c | 44 ++
.../unbounded_copy/10_loop_while_continue.c | 44 ++
.../11_loop_while_do_continue.c | 44 ++
.../12_loop_for_array_branching.c | 48 +++
.../13_loop_for_pointer_arithmetic.c | 53 +++
.../unbounded_copy/14_loop_recursion.c | 43 ++
.../unbounded_copy/15_loop_recursion_multi.c | 49 +++
.../unbounded_copy/16_misc_pseudo_recursion.c | 55 +++
.../17_complex_function_pointers.c | 53 +++
.../18_complex_struct_multiple_methods.c | 93 ++++
.../unbounded_copy/19_complex_refcount.c | 77 ++++
.../strings/unbounded_copy/string_copy.h | 38 ++
445 files changed, 23029 insertions(+)
create mode 100644 bench-moerman2018/.frama-c/.gitignore
create mode 100644 bench-moerman2018/.frama-c/GNUmakefile
create mode 100644 bench-moerman2018/.frama-c/eval_summary.txt
create mode 100755 bench-moerman2018/.frama-c/evaluate_case.sh
create mode 120000 bench-moerman2018/.frama-c/path.mk
create mode 100644 bench-moerman2018/LICENSE
create mode 100644 bench-moerman2018/README.md
create mode 100644 bench-moerman2018/base/files_access_closed.c
create mode 100644 bench-moerman2018/base/files_double_close.c
create mode 100644 bench-moerman2018/base/files_resource_leak.c
create mode 100644 bench-moerman2018/base/general_divide_by_0.c
create mode 100644 bench-moerman2018/base/general_nullpointer.c
create mode 100644 bench-moerman2018/base/general_uninitialized_pointer.c
create mode 100644 bench-moerman2018/base/general_uninitialized_value.c
create mode 100644 bench-moerman2018/base/integers_overflow.c
create mode 100644 bench-moerman2018/base/memory_double_free.c
create mode 100644 bench-moerman2018/base/memory_leak.c
create mode 100644 bench-moerman2018/base/memory_read_uninitialized_malloced_mem.c
create mode 100644 bench-moerman2018/base/memory_refer_freed.c
create mode 100644 bench-moerman2018/base/memory_zero_alloc.c
create mode 100644 bench-moerman2018/base/strings_overflow.c
create mode 100644 bench-moerman2018/base/strings_unbounded_copy.c
create mode 100644 bench-moerman2018/common/common.c
create mode 100644 bench-moerman2018/common/common.h
create mode 100644 bench-moerman2018/common/pointers.c
create mode 100644 bench-moerman2018/file_operations/access_closed/01_simple_if.c
create mode 100644 bench-moerman2018/file_operations/access_closed/02_simple_if_int1.c
create mode 100644 bench-moerman2018/file_operations/access_closed/02_simple_if_int2.c
create mode 100644 bench-moerman2018/file_operations/access_closed/03_simple_if_multi_func.c
create mode 100644 bench-moerman2018/file_operations/access_closed/04_simple_switch.c
create mode 100644 bench-moerman2018/file_operations/access_closed/05_simple_goto.c
create mode 100644 bench-moerman2018/file_operations/access_closed/06_simple_pass_by_reference.c
create mode 100644 bench-moerman2018/file_operations/access_closed/07_cross_file.c
create mode 100644 bench-moerman2018/file_operations/access_closed/08_loop_for.c
create mode 100644 bench-moerman2018/file_operations/access_closed/09_loop_for_complex.c
create mode 100644 bench-moerman2018/file_operations/access_closed/10_loop_while_continue.c
create mode 100644 bench-moerman2018/file_operations/access_closed/11_loop_while_do_continue.c
create mode 100644 bench-moerman2018/file_operations/access_closed/12_loop_for_array_branching.c
create mode 100644 bench-moerman2018/file_operations/access_closed/13_loop_for_pointer_arithmetic.c
create mode 100644 bench-moerman2018/file_operations/access_closed/14_loop_recursion.c
create mode 100644 bench-moerman2018/file_operations/access_closed/15_loop_recursion_multi.c
create mode 100644 bench-moerman2018/file_operations/access_closed/16_misc_pseudo_recursion.c
create mode 100644 bench-moerman2018/file_operations/access_closed/17_complex_function_pointers.c
create mode 100644 bench-moerman2018/file_operations/access_closed/18_complex_struct_multiple_methods.c
create mode 100644 bench-moerman2018/file_operations/access_closed/19_complex_refcount.c
create mode 100644 bench-moerman2018/file_operations/access_closed/access_closed.h
create mode 100644 bench-moerman2018/file_operations/double_close/01_simple_if.c
create mode 100644 bench-moerman2018/file_operations/double_close/02_simple_if_int1.c
create mode 100644 bench-moerman2018/file_operations/double_close/02_simple_if_int2.c
create mode 100644 bench-moerman2018/file_operations/double_close/03_simple_if_multi_func.c
create mode 100644 bench-moerman2018/file_operations/double_close/04_simple_switch.c
create mode 100644 bench-moerman2018/file_operations/double_close/05_simple_goto.c
create mode 100644 bench-moerman2018/file_operations/double_close/06_simple_pass_by_reference.c
create mode 100644 bench-moerman2018/file_operations/double_close/07_cross_file.c
create mode 100644 bench-moerman2018/file_operations/double_close/08_loop_for.c
create mode 100644 bench-moerman2018/file_operations/double_close/09_loop_for_complex.c
create mode 100644 bench-moerman2018/file_operations/double_close/10_loop_while_continue.c
create mode 100644 bench-moerman2018/file_operations/double_close/11_loop_while_do_continue.c
create mode 100644 bench-moerman2018/file_operations/double_close/12_loop_for_array_branching.c
create mode 100644 bench-moerman2018/file_operations/double_close/13_loop_for_pointer_arithmetic.c
create mode 100644 bench-moerman2018/file_operations/double_close/14_loop_recursion.c
create mode 100644 bench-moerman2018/file_operations/double_close/15_loop_recursion_multi.c
create mode 100644 bench-moerman2018/file_operations/double_close/16_misc_pseudo_recursion.c
create mode 100644 bench-moerman2018/file_operations/double_close/17_complex_function_pointers.c
create mode 100644 bench-moerman2018/file_operations/double_close/18_complex_struct_multiple_methods.c
create mode 100644 bench-moerman2018/file_operations/double_close/19_complex_refcount.c
create mode 100644 bench-moerman2018/file_operations/double_close/double_close.h
create mode 100644 bench-moerman2018/file_operations/resource_leak/01_simple_if.c
create mode 100644 bench-moerman2018/file_operations/resource_leak/02_simple_if_int1.c
create mode 100644 bench-moerman2018/file_operations/resource_leak/02_simple_if_int2.c
create mode 100644 bench-moerman2018/file_operations/resource_leak/03_simple_if_multi_func.c
create mode 100644 bench-moerman2018/file_operations/resource_leak/04_simple_switch.c
create mode 100644 bench-moerman2018/file_operations/resource_leak/05_simple_goto.c
create mode 100644 bench-moerman2018/file_operations/resource_leak/06_simple_pass_by_reference.c
create mode 100644 bench-moerman2018/file_operations/resource_leak/07_cross_file.c
create mode 100644 bench-moerman2018/file_operations/resource_leak/08_loop_for.c
create mode 100644 bench-moerman2018/file_operations/resource_leak/09_loop_for_complex.c
create mode 100644 bench-moerman2018/file_operations/resource_leak/10_loop_while_continue.c
create mode 100644 bench-moerman2018/file_operations/resource_leak/11_loop_while_do_continue.c
create mode 100644 bench-moerman2018/file_operations/resource_leak/12_loop_for_array_branching.c
create mode 100644 bench-moerman2018/file_operations/resource_leak/13_loop_for_pointer_arithmetic.c
create mode 100644 bench-moerman2018/file_operations/resource_leak/14_loop_recursion.c
create mode 100644 bench-moerman2018/file_operations/resource_leak/15_loop_recursion_multi.c
create mode 100644 bench-moerman2018/file_operations/resource_leak/16_misc_pseudo_recursion.c
create mode 100644 bench-moerman2018/file_operations/resource_leak/17_complex_function_pointers.c
create mode 100644 bench-moerman2018/file_operations/resource_leak/18_complex_struct_multiple_methods.c
create mode 100644 bench-moerman2018/file_operations/resource_leak/19_complex_refcount.c
create mode 100644 bench-moerman2018/file_operations/resource_leak/resource_leak.h
create mode 100644 bench-moerman2018/general/divide_by_zero/01_simple_if.c
create mode 100644 bench-moerman2018/general/divide_by_zero/02_simple_if_int1.c
create mode 100644 bench-moerman2018/general/divide_by_zero/02_simple_if_int2.c
create mode 100644 bench-moerman2018/general/divide_by_zero/03_simple_if_multi_func.c
create mode 100644 bench-moerman2018/general/divide_by_zero/04_simple_switch.c
create mode 100644 bench-moerman2018/general/divide_by_zero/05_simple_goto.c
create mode 100644 bench-moerman2018/general/divide_by_zero/06_simple_pass_by_reference.c
create mode 100644 bench-moerman2018/general/divide_by_zero/07_simple_cross_file.c
create mode 100644 bench-moerman2018/general/divide_by_zero/08_loop_for.c
create mode 100644 bench-moerman2018/general/divide_by_zero/09_loop_for_complex.c
create mode 100644 bench-moerman2018/general/divide_by_zero/10_loop_while_continue.c
create mode 100644 bench-moerman2018/general/divide_by_zero/11_loop_while_do_continue.c
create mode 100644 bench-moerman2018/general/divide_by_zero/12_loop_for_array_branching.c
create mode 100644 bench-moerman2018/general/divide_by_zero/13_loop_for_pointer_arithmetic.c
create mode 100644 bench-moerman2018/general/divide_by_zero/14_loop_recursion.c
create mode 100644 bench-moerman2018/general/divide_by_zero/15_loop_recursion_multi.c
create mode 100644 bench-moerman2018/general/divide_by_zero/16_misc_pseudo_recursion.c
create mode 100644 bench-moerman2018/general/divide_by_zero/17_complex_function_pointers.c
create mode 100644 bench-moerman2018/general/divide_by_zero/18_complex_struct_multiple_methods.c
create mode 100644 bench-moerman2018/general/divide_by_zero/19_complex_refcount.c
create mode 100644 bench-moerman2018/general/divide_by_zero/divide_by_zero.h
create mode 100644 bench-moerman2018/general/nullpointer/01_simple_if.c
create mode 100644 bench-moerman2018/general/nullpointer/02_simple_if_int1.c
create mode 100644 bench-moerman2018/general/nullpointer/02_simple_if_int2.c
create mode 100644 bench-moerman2018/general/nullpointer/03_simple_if_multi_func.c
create mode 100644 bench-moerman2018/general/nullpointer/04_simple_switch.c
create mode 100644 bench-moerman2018/general/nullpointer/05_simple_goto.c
create mode 100644 bench-moerman2018/general/nullpointer/06_simple_pass_by_reference.c
create mode 100644 bench-moerman2018/general/nullpointer/07_cross_file.c
create mode 100644 bench-moerman2018/general/nullpointer/08_loop_for.c
create mode 100644 bench-moerman2018/general/nullpointer/09_loop_for_complex.c
create mode 100644 bench-moerman2018/general/nullpointer/10_loop_while_continue.c
create mode 100644 bench-moerman2018/general/nullpointer/11_loop_while_do_continue.c
create mode 100644 bench-moerman2018/general/nullpointer/12_loop_for_array_branching.c
create mode 100644 bench-moerman2018/general/nullpointer/13_loop_for_pointer_arithmetic.c
create mode 100644 bench-moerman2018/general/nullpointer/14_loop_recursion.c
create mode 100644 bench-moerman2018/general/nullpointer/15_loop_recursion_multi.c
create mode 100644 bench-moerman2018/general/nullpointer/16_misc_pseudo_recursion.c
create mode 100644 bench-moerman2018/general/nullpointer/17_complex_function_pointers.c
create mode 100644 bench-moerman2018/general/nullpointer/18_complex_struct_multiple_methods.c
create mode 100644 bench-moerman2018/general/nullpointer/19_complex_refcount.c
create mode 100644 bench-moerman2018/general/nullpointer/nullpointer.h
create mode 100644 bench-moerman2018/general/uninitialized/pointer/01_simple_if.c
create mode 100644 bench-moerman2018/general/uninitialized/pointer/02_simple_if_int1.c
create mode 100644 bench-moerman2018/general/uninitialized/pointer/02_simple_if_int2.c
create mode 100644 bench-moerman2018/general/uninitialized/pointer/03_simple_if_multi_func.c
create mode 100644 bench-moerman2018/general/uninitialized/pointer/04_simple_switch.c
create mode 100644 bench-moerman2018/general/uninitialized/pointer/05_simple_goto.c
create mode 100644 bench-moerman2018/general/uninitialized/pointer/06_simple_pass_by_reference.c
create mode 100644 bench-moerman2018/general/uninitialized/pointer/07_cross_file.c
create mode 100644 bench-moerman2018/general/uninitialized/pointer/08_loop_for.c
create mode 100644 bench-moerman2018/general/uninitialized/pointer/09_loop_for_complex.c
create mode 100644 bench-moerman2018/general/uninitialized/pointer/10_loop_while_continue.c
create mode 100644 bench-moerman2018/general/uninitialized/pointer/11_loop_while_do_continue.c
create mode 100644 bench-moerman2018/general/uninitialized/pointer/12_loop_for_array_branching.c
create mode 100644 bench-moerman2018/general/uninitialized/pointer/13_loop_for_pointer_arithmetic.c
create mode 100644 bench-moerman2018/general/uninitialized/pointer/14_loop_recursion.c
create mode 100644 bench-moerman2018/general/uninitialized/pointer/15_loop_recursion_multi.c
create mode 100644 bench-moerman2018/general/uninitialized/pointer/16_misc_pseudo_recursion.c
create mode 100644 bench-moerman2018/general/uninitialized/pointer/17_complex_function_pointers.c
create mode 100644 bench-moerman2018/general/uninitialized/pointer/18_complex_struct_multiple_methods.c
create mode 100644 bench-moerman2018/general/uninitialized/pointer/19_complex_refcount.c
create mode 100644 bench-moerman2018/general/uninitialized/pointer/uninit_ptr.h
create mode 100644 bench-moerman2018/general/uninitialized/value/01_simple_if.c
create mode 100644 bench-moerman2018/general/uninitialized/value/02_simple_if_int1.c
create mode 100644 bench-moerman2018/general/uninitialized/value/02_simple_if_int2.c
create mode 100644 bench-moerman2018/general/uninitialized/value/03_simple_if_multi_func.c
create mode 100644 bench-moerman2018/general/uninitialized/value/04_simple_switch.c
create mode 100644 bench-moerman2018/general/uninitialized/value/05_simple_goto.c
create mode 100644 bench-moerman2018/general/uninitialized/value/06_simple_pass_by_reference.c
create mode 100644 bench-moerman2018/general/uninitialized/value/07_simple_cross_file.c
create mode 100644 bench-moerman2018/general/uninitialized/value/08_loop_for.c
create mode 100644 bench-moerman2018/general/uninitialized/value/09_loop_for_complex.c
create mode 100644 bench-moerman2018/general/uninitialized/value/10_loop_while_continue.c
create mode 100644 bench-moerman2018/general/uninitialized/value/11_loop_while_do_continue.c
create mode 100644 bench-moerman2018/general/uninitialized/value/12_loop_for_array_branching.c
create mode 100644 bench-moerman2018/general/uninitialized/value/13_loop_for_pointer_arithmetic.c
create mode 100644 bench-moerman2018/general/uninitialized/value/14_loop_recursion.c
create mode 100644 bench-moerman2018/general/uninitialized/value/15_loop_recursion_multi.c
create mode 100644 bench-moerman2018/general/uninitialized/value/16_misc_pseudo_recursion.c
create mode 100644 bench-moerman2018/general/uninitialized/value/17_complex_function_pointers.c
create mode 100644 bench-moerman2018/general/uninitialized/value/18_complex_struct_multiple_methods.c
create mode 100644 bench-moerman2018/general/uninitialized/value/19_complex_refcount.c
create mode 100644 bench-moerman2018/general/uninitialized/value/uninitialized_value.h
create mode 100644 bench-moerman2018/integers/overflow/01_simple_if.c
create mode 100644 bench-moerman2018/integers/overflow/02_simple_if_int1.c
create mode 100644 bench-moerman2018/integers/overflow/02_simple_if_int2.c
create mode 100644 bench-moerman2018/integers/overflow/03_simple_if_multi_func.c
create mode 100644 bench-moerman2018/integers/overflow/04_simple_switch.c
create mode 100644 bench-moerman2018/integers/overflow/05_simple_goto.c
create mode 100644 bench-moerman2018/integers/overflow/06_simple_pass_by_reference.c
create mode 100644 bench-moerman2018/integers/overflow/07_simple_cross_file.c
create mode 100644 bench-moerman2018/integers/overflow/08_loop_for.c
create mode 100644 bench-moerman2018/integers/overflow/09_loop_for_complex.c
create mode 100644 bench-moerman2018/integers/overflow/10_loop_while_continue.c
create mode 100644 bench-moerman2018/integers/overflow/11_loop_while_do_continue.c
create mode 100644 bench-moerman2018/integers/overflow/12_loop_for_array_branching.c
create mode 100644 bench-moerman2018/integers/overflow/13_loop_for_pointer_arithmetic.c
create mode 100644 bench-moerman2018/integers/overflow/14_loop_recursion.c
create mode 100644 bench-moerman2018/integers/overflow/15_loop_recursion_multi.c
create mode 100644 bench-moerman2018/integers/overflow/16_misc_pseudo_recursion.c
create mode 100644 bench-moerman2018/integers/overflow/17_complex_function_pointers.c
create mode 100644 bench-moerman2018/integers/overflow/18_complex_struct_multiple_methods.c
create mode 100644 bench-moerman2018/integers/overflow/19_complex_refcount.c
create mode 100644 bench-moerman2018/integers/overflow/integer_overflow.h
create mode 100644 bench-moerman2018/memory/access_uninit/01_simple_if.c
create mode 100644 bench-moerman2018/memory/access_uninit/02_simple_if_int1.c
create mode 100644 bench-moerman2018/memory/access_uninit/02_simple_if_int2.c
create mode 100644 bench-moerman2018/memory/access_uninit/03_simple_if_multi_func.c
create mode 100644 bench-moerman2018/memory/access_uninit/04_simple_switch.c
create mode 100644 bench-moerman2018/memory/access_uninit/05_simple_goto.c
create mode 100644 bench-moerman2018/memory/access_uninit/06_simple_pass_by_reference.c
create mode 100644 bench-moerman2018/memory/access_uninit/07_simple_cross_file.c
create mode 100644 bench-moerman2018/memory/access_uninit/08_loop_for.c
create mode 100644 bench-moerman2018/memory/access_uninit/09_loop_for_complex.c
create mode 100644 bench-moerman2018/memory/access_uninit/10_loop_while_continue.c
create mode 100644 bench-moerman2018/memory/access_uninit/11_loop_while_do_continue.c
create mode 100644 bench-moerman2018/memory/access_uninit/12_loop_for_array_branching.c
create mode 100644 bench-moerman2018/memory/access_uninit/13_loop_for_pointer_arithmetic.c
create mode 100644 bench-moerman2018/memory/access_uninit/14_loop_recursion.c
create mode 100644 bench-moerman2018/memory/access_uninit/15_loop_recursion_multi.c
create mode 100644 bench-moerman2018/memory/access_uninit/16_misc_pseudo_recursion.c
create mode 100644 bench-moerman2018/memory/access_uninit/17_complex_function_pointers.c
create mode 100644 bench-moerman2018/memory/access_uninit/18_complex_struct_multiple_methods.c
create mode 100644 bench-moerman2018/memory/access_uninit/19_complex_refcount.c
create mode 100644 bench-moerman2018/memory/access_uninit/test_correct/01_simple_if.c
create mode 100644 bench-moerman2018/memory/access_uninit/test_correct/02_simple_if_int1.c
create mode 100644 bench-moerman2018/memory/access_uninit/test_correct/02_simple_if_int2.c
create mode 100644 bench-moerman2018/memory/access_uninit/test_correct/03_simple_if_multi_func.c
create mode 100644 bench-moerman2018/memory/access_uninit/test_correct/04_simple_switch.c
create mode 100644 bench-moerman2018/memory/access_uninit/test_correct/05_simple_goto.c
create mode 100644 bench-moerman2018/memory/access_uninit/test_correct/06_simple_pass_by_reference.c
create mode 100644 bench-moerman2018/memory/access_uninit/test_correct/07_simple_cross_file.c
create mode 100644 bench-moerman2018/memory/access_uninit/test_correct/08_loop_for.c
create mode 100644 bench-moerman2018/memory/access_uninit/test_correct/09_loop_for_complex.c
create mode 100644 bench-moerman2018/memory/access_uninit/test_correct/10_loop_while_continue.c
create mode 100644 bench-moerman2018/memory/access_uninit/test_correct/11_loop_while_do_continue.c
create mode 100644 bench-moerman2018/memory/access_uninit/test_correct/12_loop_for_array_branching.c
create mode 100644 bench-moerman2018/memory/access_uninit/test_correct/13_loop_for_pointer_arithmetic.c
create mode 100644 bench-moerman2018/memory/access_uninit/test_correct/14_loop_recursion.c
create mode 100644 bench-moerman2018/memory/access_uninit/test_correct/15_loop_recursion_multi.c
create mode 100644 bench-moerman2018/memory/access_uninit/test_correct/16_misc_pseudo_recursion.c
create mode 100644 bench-moerman2018/memory/access_uninit/test_correct/17_complex_function_pointers.c
create mode 100644 bench-moerman2018/memory/access_uninit/test_correct/18_complex_struct_multiple_methods.c
create mode 100644 bench-moerman2018/memory/access_uninit/test_correct/19_complex_refcount.c
create mode 100644 bench-moerman2018/memory/access_uninit/test_correct_catch_bad/01_simple_if.c
create mode 100644 bench-moerman2018/memory/access_uninit/test_correct_catch_bad/02_simple_if_int1.c
create mode 100644 bench-moerman2018/memory/access_uninit/test_correct_catch_bad/02_simple_if_int2.c
create mode 100644 bench-moerman2018/memory/access_uninit/test_correct_catch_bad/03_simple_if_multi_func.c
create mode 100644 bench-moerman2018/memory/access_uninit/test_correct_catch_bad/04_simple_switch.c
create mode 100644 bench-moerman2018/memory/access_uninit/test_correct_catch_bad/05_simple_goto.c
create mode 100644 bench-moerman2018/memory/access_uninit/test_correct_catch_bad/06_simple_pass_by_reference.c
create mode 100644 bench-moerman2018/memory/access_uninit/test_correct_catch_bad/07_simple_cross_file.c
create mode 100644 bench-moerman2018/memory/access_uninit/test_correct_catch_bad/08_loop_for.c
create mode 100644 bench-moerman2018/memory/access_uninit/test_correct_catch_bad/09_loop_for_complex.c
create mode 100644 bench-moerman2018/memory/access_uninit/test_correct_catch_bad/10_loop_while_continue.c
create mode 100644 bench-moerman2018/memory/access_uninit/test_correct_catch_bad/11_loop_while_do_continue.c
create mode 100644 bench-moerman2018/memory/access_uninit/test_correct_catch_bad/12_loop_for_array_branching.c
create mode 100644 bench-moerman2018/memory/access_uninit/test_correct_catch_bad/13_loop_for_pointer_arithmetic.c
create mode 100644 bench-moerman2018/memory/access_uninit/test_correct_catch_bad/14_loop_recursion.c
create mode 100644 bench-moerman2018/memory/access_uninit/test_correct_catch_bad/15_loop_recursion_multi.c
create mode 100644 bench-moerman2018/memory/access_uninit/test_correct_catch_bad/16_misc_pseudo_recursion.c
create mode 100644 bench-moerman2018/memory/access_uninit/test_correct_catch_bad/17_complex_function_pointers.c
create mode 100644 bench-moerman2018/memory/access_uninit/test_correct_catch_bad/18_complex_struct_multiple_methods.c
create mode 100644 bench-moerman2018/memory/access_uninit/test_correct_catch_bad/19_complex_refcount.c
create mode 100644 bench-moerman2018/memory/access_uninit/test_incorrect/01_simple_if.c
create mode 100644 bench-moerman2018/memory/access_uninit/test_incorrect/02_simple_if_int1.c
create mode 100644 bench-moerman2018/memory/access_uninit/test_incorrect/02_simple_if_int2.c
create mode 100644 bench-moerman2018/memory/access_uninit/test_incorrect/03_simple_if_multi_func.c
create mode 100644 bench-moerman2018/memory/access_uninit/test_incorrect/04_simple_switch.c
create mode 100644 bench-moerman2018/memory/access_uninit/test_incorrect/05_simple_goto.c
create mode 100644 bench-moerman2018/memory/access_uninit/test_incorrect/06_simple_pass_by_reference.c
create mode 100644 bench-moerman2018/memory/access_uninit/test_incorrect/07_simple_cross_file.c
create mode 100644 bench-moerman2018/memory/access_uninit/test_incorrect/08_loop_for.c
create mode 100644 bench-moerman2018/memory/access_uninit/test_incorrect/09_loop_for_complex.c
create mode 100644 bench-moerman2018/memory/access_uninit/test_incorrect/10_loop_while_continue.c
create mode 100644 bench-moerman2018/memory/access_uninit/test_incorrect/11_loop_while_do_continue.c
create mode 100644 bench-moerman2018/memory/access_uninit/test_incorrect/12_loop_for_array_branching.c
create mode 100644 bench-moerman2018/memory/access_uninit/test_incorrect/13_loop_for_pointer_arithmetic.c
create mode 100644 bench-moerman2018/memory/access_uninit/test_incorrect/14_loop_recursion.c
create mode 100644 bench-moerman2018/memory/access_uninit/test_incorrect/15_loop_recursion_multi.c
create mode 100644 bench-moerman2018/memory/access_uninit/test_incorrect/16_misc_pseudo_recursion.c
create mode 100644 bench-moerman2018/memory/access_uninit/test_incorrect/17_complex_function_pointers.c
create mode 100644 bench-moerman2018/memory/access_uninit/test_incorrect/18_complex_struct_multiple_methods.c
create mode 100644 bench-moerman2018/memory/access_uninit/test_incorrect/19_complex_refcount.c
create mode 100644 bench-moerman2018/memory/access_uninit/test_lib_correct/01_simple_if.c
create mode 100644 bench-moerman2018/memory/access_uninit/test_lib_correct/02_simple_if_int1.c
create mode 100644 bench-moerman2018/memory/access_uninit/test_lib_correct/02_simple_if_int2.c
create mode 100644 bench-moerman2018/memory/access_uninit/test_lib_correct/03_simple_if_multi_func.c
create mode 100644 bench-moerman2018/memory/access_uninit/test_lib_correct/04_simple_switch.c
create mode 100644 bench-moerman2018/memory/access_uninit/test_lib_correct/05_simple_goto.c
create mode 100644 bench-moerman2018/memory/access_uninit/test_lib_correct/06_simple_pass_by_reference.c
create mode 100644 bench-moerman2018/memory/access_uninit/test_lib_correct/07_simple_cross_file.c
create mode 100644 bench-moerman2018/memory/access_uninit/test_lib_correct/08_loop_for.c
create mode 100644 bench-moerman2018/memory/access_uninit/test_lib_correct/09_loop_for_complex.c
create mode 100644 bench-moerman2018/memory/access_uninit/test_lib_correct/10_loop_while_continue.c
create mode 100644 bench-moerman2018/memory/access_uninit/test_lib_correct/11_loop_while_do_continue.c
create mode 100644 bench-moerman2018/memory/access_uninit/test_lib_correct/12_loop_for_array_branching.c
create mode 100644 bench-moerman2018/memory/access_uninit/test_lib_correct/13_loop_for_pointer_arithmetic.c
create mode 100644 bench-moerman2018/memory/access_uninit/test_lib_correct/14_loop_recursion.c
create mode 100644 bench-moerman2018/memory/access_uninit/test_lib_correct/15_loop_recursion_multi.c
create mode 100644 bench-moerman2018/memory/access_uninit/test_lib_correct/16_misc_pseudo_recursion.c
create mode 100644 bench-moerman2018/memory/access_uninit/test_lib_correct/17_complex_function_pointers.c
create mode 100644 bench-moerman2018/memory/access_uninit/test_lib_correct/18_complex_struct_multiple_methods.c
create mode 100644 bench-moerman2018/memory/access_uninit/test_lib_correct/19_complex_refcount.c
create mode 100644 bench-moerman2018/memory/access_uninit/test_lib_incorrect/01_simple_if.c
create mode 100644 bench-moerman2018/memory/access_uninit/test_lib_incorrect/02_simple_if_int1.c
create mode 100644 bench-moerman2018/memory/access_uninit/test_lib_incorrect/02_simple_if_int2.c
create mode 100644 bench-moerman2018/memory/access_uninit/test_lib_incorrect/03_simple_if_multi_func.c
create mode 100644 bench-moerman2018/memory/access_uninit/test_lib_incorrect/04_simple_switch.c
create mode 100644 bench-moerman2018/memory/access_uninit/test_lib_incorrect/05_simple_goto.c
create mode 100644 bench-moerman2018/memory/access_uninit/test_lib_incorrect/06_simple_pass_by_reference.c
create mode 100644 bench-moerman2018/memory/access_uninit/test_lib_incorrect/07_simple_cross_file.c
create mode 100644 bench-moerman2018/memory/access_uninit/test_lib_incorrect/08_loop_for.c
create mode 100644 bench-moerman2018/memory/access_uninit/test_lib_incorrect/09_loop_for_complex.c
create mode 100644 bench-moerman2018/memory/access_uninit/test_lib_incorrect/10_loop_while_continue.c
create mode 100644 bench-moerman2018/memory/access_uninit/test_lib_incorrect/11_loop_while_do_continue.c
create mode 100644 bench-moerman2018/memory/access_uninit/test_lib_incorrect/12_loop_for_array_branching.c
create mode 100644 bench-moerman2018/memory/access_uninit/test_lib_incorrect/13_loop_for_pointer_arithmetic.c
create mode 100644 bench-moerman2018/memory/access_uninit/test_lib_incorrect/14_loop_recursion.c
create mode 100644 bench-moerman2018/memory/access_uninit/test_lib_incorrect/15_loop_recursion_multi.c
create mode 100644 bench-moerman2018/memory/access_uninit/test_lib_incorrect/16_misc_pseudo_recursion.c
create mode 100644 bench-moerman2018/memory/access_uninit/test_lib_incorrect/17_complex_function_pointers.c
create mode 100644 bench-moerman2018/memory/access_uninit/test_lib_incorrect/18_complex_struct_multiple_methods.c
create mode 100644 bench-moerman2018/memory/access_uninit/test_lib_incorrect/19_complex_refcount.c
create mode 100644 bench-moerman2018/memory/access_uninit/uninitialized_malloc.h
create mode 100644 bench-moerman2018/memory/double_free/01_simple_if.c
create mode 100644 bench-moerman2018/memory/double_free/02_simple_if_int1.c
create mode 100644 bench-moerman2018/memory/double_free/02_simple_if_int2.c
create mode 100644 bench-moerman2018/memory/double_free/03_simple_if_multi_func.c
create mode 100644 bench-moerman2018/memory/double_free/04_simple_switch.c
create mode 100644 bench-moerman2018/memory/double_free/05_simple_goto.c
create mode 100644 bench-moerman2018/memory/double_free/06_simple_pass_by_reference.c
create mode 100644 bench-moerman2018/memory/double_free/07_cross_file.c
create mode 100644 bench-moerman2018/memory/double_free/08_loop_for.c
create mode 100644 bench-moerman2018/memory/double_free/09_loop_for_complex.c
create mode 100644 bench-moerman2018/memory/double_free/10_loop_while_continue.c
create mode 100644 bench-moerman2018/memory/double_free/11_loop_while_do_continue.c
create mode 100644 bench-moerman2018/memory/double_free/12_loop_for_array_branching.c
create mode 100644 bench-moerman2018/memory/double_free/13_loop_for_pointer_arithmetic.c
create mode 100644 bench-moerman2018/memory/double_free/14_loop_recursion.c
create mode 100644 bench-moerman2018/memory/double_free/14_loop_recursion_alt.c
create mode 100644 bench-moerman2018/memory/double_free/15_loop_recursion_multi.c
create mode 100644 bench-moerman2018/memory/double_free/15_loop_recursion_multi_alt.c
create mode 100644 bench-moerman2018/memory/double_free/16_misc_pseudo_recursion.c
create mode 100644 bench-moerman2018/memory/double_free/17_complex_function_pointers.c
create mode 100644 bench-moerman2018/memory/double_free/18_complex_struct_multiple_methods.c
create mode 100644 bench-moerman2018/memory/double_free/19_complex_refcount.c
create mode 100644 bench-moerman2018/memory/double_free/double_free.h
create mode 100644 bench-moerman2018/memory/leak/01_simple_if.c
create mode 100644 bench-moerman2018/memory/leak/02_simple_if_int1.c
create mode 100644 bench-moerman2018/memory/leak/02_simple_if_int2.c
create mode 100644 bench-moerman2018/memory/leak/03_simple_if_multi_func.c
create mode 100644 bench-moerman2018/memory/leak/04_simple_switch.c
create mode 100644 bench-moerman2018/memory/leak/05_simple_goto.c
create mode 100644 bench-moerman2018/memory/leak/06_simple_pass_by_reference.c
create mode 100644 bench-moerman2018/memory/leak/07_cross_file.c
create mode 100644 bench-moerman2018/memory/leak/08_loop_for.c
create mode 100644 bench-moerman2018/memory/leak/09_loop_for_complex.c
create mode 100644 bench-moerman2018/memory/leak/10_loop_while_continue.c
create mode 100644 bench-moerman2018/memory/leak/11_loop_while_do_continue.c
create mode 100644 bench-moerman2018/memory/leak/12_loop_for_array_branching.c
create mode 100644 bench-moerman2018/memory/leak/13_loop_for_pointer_arithmetic.c
create mode 100644 bench-moerman2018/memory/leak/14_loop_recursion.c
create mode 100644 bench-moerman2018/memory/leak/15_loop_recursion_multi.c
create mode 100644 bench-moerman2018/memory/leak/16_misc_pseudo_recursion.c
create mode 100644 bench-moerman2018/memory/leak/17_complex_function_pointers.c
create mode 100644 bench-moerman2018/memory/leak/18_complex_struct_multiple_methods.c
create mode 100644 bench-moerman2018/memory/leak/19_complex_refcount.c
create mode 100644 bench-moerman2018/memory/leak/memory_leak.h
create mode 100644 bench-moerman2018/memory/refer_free/01_simple_if.c
create mode 100644 bench-moerman2018/memory/refer_free/02_simple_if_int1.c
create mode 100644 bench-moerman2018/memory/refer_free/02_simple_if_int2.c
create mode 100644 bench-moerman2018/memory/refer_free/03_simple_if_multi_func.c
create mode 100644 bench-moerman2018/memory/refer_free/04_simple_switch.c
create mode 100644 bench-moerman2018/memory/refer_free/05_simple_goto.c
create mode 100644 bench-moerman2018/memory/refer_free/06_simple_pass_by_reference.c
create mode 100644 bench-moerman2018/memory/refer_free/07_cross_file.c
create mode 100644 bench-moerman2018/memory/refer_free/08_loop_for.c
create mode 100644 bench-moerman2018/memory/refer_free/09_loop_for_complex.c
create mode 100644 bench-moerman2018/memory/refer_free/10_loop_while_continue.c
create mode 100644 bench-moerman2018/memory/refer_free/11_loop_while_do_continue.c
create mode 100644 bench-moerman2018/memory/refer_free/12_loop_for_array_branching.c
create mode 100644 bench-moerman2018/memory/refer_free/13_loop_for_pointer_arithmetic.c
create mode 100644 bench-moerman2018/memory/refer_free/14_loop_recursion.c
create mode 100644 bench-moerman2018/memory/refer_free/15_loop_recursion_multi.c
create mode 100644 bench-moerman2018/memory/refer_free/16_misc_pseudo_recursion.c
create mode 100644 bench-moerman2018/memory/refer_free/17_complex_function_pointers.c
create mode 100644 bench-moerman2018/memory/refer_free/18_complex_struct_multiple_methods.c
create mode 100644 bench-moerman2018/memory/refer_free/19_complex_refcount.c
create mode 100644 bench-moerman2018/memory/refer_free/refer_free.h
create mode 100644 bench-moerman2018/memory/zero_alloc/01_simple_if.c
create mode 100644 bench-moerman2018/memory/zero_alloc/02_simple_if_int1.c
create mode 100644 bench-moerman2018/memory/zero_alloc/02_simple_if_int2.c
create mode 100644 bench-moerman2018/memory/zero_alloc/03_simple_if_multi_func.c
create mode 100644 bench-moerman2018/memory/zero_alloc/04_simple_switch.c
create mode 100644 bench-moerman2018/memory/zero_alloc/05_simple_goto.c
create mode 100644 bench-moerman2018/memory/zero_alloc/06_simple_pass_by_reference.c
create mode 100644 bench-moerman2018/memory/zero_alloc/07_cross_file.c
create mode 100644 bench-moerman2018/memory/zero_alloc/08_loop_for.c
create mode 100644 bench-moerman2018/memory/zero_alloc/09_loop_for_complex.c
create mode 100644 bench-moerman2018/memory/zero_alloc/10_loop_while_continue.c
create mode 100644 bench-moerman2018/memory/zero_alloc/11_loop_while_do_continue.c
create mode 100644 bench-moerman2018/memory/zero_alloc/12_loop_for_array_branching.c
create mode 100644 bench-moerman2018/memory/zero_alloc/13_loop_for_pointer_arithmetic.c
create mode 100644 bench-moerman2018/memory/zero_alloc/14_loop_recursion.c
create mode 100644 bench-moerman2018/memory/zero_alloc/15_loop_recursion_multi.c
create mode 100644 bench-moerman2018/memory/zero_alloc/16_misc_pseudo_recursion.c
create mode 100644 bench-moerman2018/memory/zero_alloc/17_complex_function_pointers.c
create mode 100644 bench-moerman2018/memory/zero_alloc/18_complex_struct_multiple_methods.c
create mode 100644 bench-moerman2018/memory/zero_alloc/19_complex_refcount.c
create mode 100644 bench-moerman2018/memory/zero_alloc/zero_alloc.h
create mode 100755 bench-moerman2018/preprocess_files.sh
create mode 100644 bench-moerman2018/strings/overflow/01_simple_if.c
create mode 100644 bench-moerman2018/strings/overflow/02_simple_if_int1.c
create mode 100644 bench-moerman2018/strings/overflow/02_simple_if_int2.c
create mode 100644 bench-moerman2018/strings/overflow/03_simple_if_multi_func.c
create mode 100644 bench-moerman2018/strings/overflow/04_simple_switch.c
create mode 100644 bench-moerman2018/strings/overflow/05_simple_goto.c
create mode 100644 bench-moerman2018/strings/overflow/06_simple_pass_by_reference.c
create mode 100644 bench-moerman2018/strings/overflow/07_simple_cross_file.c
create mode 100644 bench-moerman2018/strings/overflow/08_loop_for.c
create mode 100644 bench-moerman2018/strings/overflow/09_loop_for_complex.c
create mode 100644 bench-moerman2018/strings/overflow/10_loop_while_continue.c
create mode 100644 bench-moerman2018/strings/overflow/11_loop_while_do_continue.c
create mode 100644 bench-moerman2018/strings/overflow/12_loop_for_array_branching.c
create mode 100644 bench-moerman2018/strings/overflow/13_loop_for_pointer_arithmetic.c
create mode 100644 bench-moerman2018/strings/overflow/14_loop_recursion.c
create mode 100644 bench-moerman2018/strings/overflow/15_loop_recursion_multi.c
create mode 100644 bench-moerman2018/strings/overflow/16_misc_pseudo_recursion.c
create mode 100644 bench-moerman2018/strings/overflow/17_complex_function_pointers.c
create mode 100644 bench-moerman2018/strings/overflow/18_complex_struct_multiple_methods.c
create mode 100644 bench-moerman2018/strings/overflow/19_complex_refcount.c
create mode 100644 bench-moerman2018/strings/overflow/string_overflow.h
create mode 100644 bench-moerman2018/strings/unbounded_copy/01_simple_if.c
create mode 100644 bench-moerman2018/strings/unbounded_copy/02_simple_if_int1.c
create mode 100644 bench-moerman2018/strings/unbounded_copy/02_simple_if_int2.c
create mode 100644 bench-moerman2018/strings/unbounded_copy/03_simple_if_multi_func.c
create mode 100644 bench-moerman2018/strings/unbounded_copy/04_simple_switch.c
create mode 100644 bench-moerman2018/strings/unbounded_copy/05_simple_goto.c
create mode 100644 bench-moerman2018/strings/unbounded_copy/06_simple_pass_by_reference.c
create mode 100644 bench-moerman2018/strings/unbounded_copy/07_simple_cross_file.c
create mode 100644 bench-moerman2018/strings/unbounded_copy/08_loop_for.c
create mode 100644 bench-moerman2018/strings/unbounded_copy/09_loop_for_complex.c
create mode 100644 bench-moerman2018/strings/unbounded_copy/10_loop_while_continue.c
create mode 100644 bench-moerman2018/strings/unbounded_copy/11_loop_while_do_continue.c
create mode 100644 bench-moerman2018/strings/unbounded_copy/12_loop_for_array_branching.c
create mode 100644 bench-moerman2018/strings/unbounded_copy/13_loop_for_pointer_arithmetic.c
create mode 100644 bench-moerman2018/strings/unbounded_copy/14_loop_recursion.c
create mode 100644 bench-moerman2018/strings/unbounded_copy/15_loop_recursion_multi.c
create mode 100644 bench-moerman2018/strings/unbounded_copy/16_misc_pseudo_recursion.c
create mode 100644 bench-moerman2018/strings/unbounded_copy/17_complex_function_pointers.c
create mode 100644 bench-moerman2018/strings/unbounded_copy/18_complex_struct_multiple_methods.c
create mode 100644 bench-moerman2018/strings/unbounded_copy/19_complex_refcount.c
create mode 100644 bench-moerman2018/strings/unbounded_copy/string_copy.h
diff --git a/Makefile b/Makefile
index 71bb4dcf2..2126cf709 100644
--- a/Makefile
+++ b/Makefile
@@ -52,6 +52,7 @@ frama-c/build/bin/frama-c:
TARGETS=\
2048 \
basic-cwe-examples \
+ bench-moerman2018 \
cerberus \
chrony \
debie1 \
diff --git a/README.md b/README.md
index beac74897..2c47a2c84 100644
--- a/README.md
+++ b/README.md
@@ -120,6 +120,7 @@ when available. We also summarize the license of each directory below.
- `2048`: MIT
- `basic-cwe-examples`: see `LICENSE`
+- `bench-moerman2018`: MIT
- `chrony`: GPL
- `debie1`: distribution and use authorized by Patria Aviation Oy,
Space Systems Finland Ltd. and Tidorum Ltd, see `README.txt`
diff --git a/bench-moerman2018/.frama-c/.gitignore b/bench-moerman2018/.frama-c/.gitignore
new file mode 100644
index 000000000..b5c027fb0
--- /dev/null
+++ b/bench-moerman2018/.frama-c/.gitignore
@@ -0,0 +1,7 @@
+# extra .gitignore rules specific to this benchmark
+
+# we do not version the .parse and .eva directories due to their large size
+
+eval.txt
+*.eva
+*.parse
diff --git a/bench-moerman2018/.frama-c/GNUmakefile b/bench-moerman2018/.frama-c/GNUmakefile
new file mode 100644
index 000000000..9ae99e2d6
--- /dev/null
+++ b/bench-moerman2018/.frama-c/GNUmakefile
@@ -0,0 +1,76 @@
+# Makefile template for Frama-C/Eva case studies.
+# For details and usage information, see the Frama-C User Manual.
+
+### Prologue. Do not modify this block. #######################################
+-include path.mk
+FRAMAC ?= frama-c
+include $(shell $(FRAMAC)-config -scripts)/prologue.mk
+###############################################################################
+
+# Edit below as needed. MACHDEP is mandatory. Suggested flags are optional.
+
+MACHDEP = x86_32
+
+## Preprocessing flags (for -cpp-extra-args)
+CPPFLAGS += \
+ -I../common \
+
+## General flags
+FCFLAGS += \
+ -add-symbolic-path=.:.. \
+ -kernel-warn-key annot:missing-spec=abort \
+ -kernel-warn-key typing:implicit-function-declaration=abort \
+
+## Eva-specific flags
+EVAFLAGS += \
+ -eva-warn-key builtins:missing-spec=abort \
+ -eva-precision 3 \
+
+## GUI-only flags
+FCGUIFLAGS += \
+ -add-symbolic-path=.:.. \
+
+# This bench has several targets, so we use Makefile functions to generate
+# them. A few test cases are not run.
+
+# exclude files with recursive functions, and those testing memory leaks
+filter-out-substring = $(foreach v,$(2),$(if $(findstring $(1),$(v)),,$(v)))
+SRCS:=$(sort $(call filter-out-substring,leak,\
+ $(call filter-out-substring,recursion,\
+ $(wildcard ../base/*.c ../*/*/*.c))))
+
+# [target] converts a file name into a suitable target name,
+# removing the initial '../', the final '.c', and converting '/' into '_'.
+target = $(subst /,_,$(patsubst %.c,%,$(1:../%=%)))
+
+GOOD_TARGETS:=$(foreach s,$(SRCS),$(call target,$(s))_good.eva)
+BAD_TARGETS:=$(foreach s,$(SRCS),$(call target,$(s))_bad.eva)
+TARGETS:=$(GOOD_TARGETS) $(BAD_TARGETS)
+
+define generate-parse-rules =
+ $(call target,$(1))_good.parse: $(if $(findstring cross_file,$(1)),../common/common.c,) $(1)
+ $(call target,$(1))_good.parse: CPPFLAGS+="-DNO_BUG"
+ $(call target,$(1))_bad.parse: $(if $(findstring cross_file,$(1)),../common/common.c,) $(1)
+
+ $(call target,$(1))_good.eva/eval.txt: $(call target,$(1))_good.eva evaluate_case.sh
+ ./evaluate_case.sh good $$</alarms.csv > $$</eval.txt
+ $(call target,$(1))_bad.eva/eval.txt: $(call target,$(1))_bad.eva evaluate_case.sh
+ ./evaluate_case.sh bad $$</alarms.csv > $$</eval.txt
+endef
+$(foreach s,$(SRCS),$(eval $(call generate-parse-rules,$(s))))
+
+eval_summary.txt: $(addsuffix /eval.txt, $(TARGETS))
+ @echo "Updating summary: $(abspath $@)"
+ @cat $^ > eval_summary.txt
+
+evaluate: eval_summary.txt
+.PHONY: eval_summary.txt
+
+all: evaluate
+
+### Epilogue. Do not modify this block. #######################################
+include $(shell $(FRAMAC)-config -scripts)/epilogue.mk
+###############################################################################
+
+# optional, for OSCS
+-include ../../Makefile.common
diff --git a/bench-moerman2018/.frama-c/eval_summary.txt b/bench-moerman2018/.frama-c/eval_summary.txt
new file mode 100644
index 000000000..c9c1cc56f
--- /dev/null
+++ b/bench-moerman2018/.frama-c/eval_summary.txt
@@ -0,0 +1,400 @@
+base_files_access_closed_good.eva/alarms.csv (good): ok
+base_files_double_close_good.eva/alarms.csv (good): ok
+base_general_divide_by_0_good.eva/alarms.csv (good): ok
+base_general_nullpointer_good.eva/alarms.csv (good): ok
+base_general_uninitialized_pointer_good.eva/alarms.csv (good): ok
+base_general_uninitialized_value_good.eva/alarms.csv (good): ok
+base_integers_overflow_good.eva/alarms.csv (good): ok
+base_memory_double_free_good.eva/alarms.csv (good): ok
+base_memory_read_uninitialized_malloced_mem_good.eva/alarms.csv (good): ok
+base_memory_refer_freed_good.eva/alarms.csv (good): ok
+base_memory_zero_alloc_good.eva/alarms.csv (good): ok
+base_strings_overflow_good.eva/alarms.csv (good): ok
+base_strings_unbounded_copy_good.eva/alarms.csv (good): imprecise
+file_operations_access_closed_01_simple_if_good.eva/alarms.csv (good): ok
+file_operations_access_closed_02_simple_if_int1_good.eva/alarms.csv (good): ok
+file_operations_access_closed_02_simple_if_int2_good.eva/alarms.csv (good): ok
+file_operations_access_closed_03_simple_if_multi_func_good.eva/alarms.csv (good): ok
+file_operations_access_closed_04_simple_switch_good.eva/alarms.csv (good): ok
+file_operations_access_closed_05_simple_goto_good.eva/alarms.csv (good): ok
+file_operations_access_closed_06_simple_pass_by_reference_good.eva/alarms.csv (good): ok
+file_operations_access_closed_07_cross_file_good.eva/alarms.csv (good): ok
+file_operations_access_closed_08_loop_for_good.eva/alarms.csv (good): ok
+file_operations_access_closed_09_loop_for_complex_good.eva/alarms.csv (good): ok
+file_operations_access_closed_10_loop_while_continue_good.eva/alarms.csv (good): ok
+file_operations_access_closed_11_loop_while_do_continue_good.eva/alarms.csv (good): ok
+file_operations_access_closed_12_loop_for_array_branching_good.eva/alarms.csv (good): ok
+file_operations_access_closed_13_loop_for_pointer_arithmetic_good.eva/alarms.csv (good): ok
+file_operations_access_closed_17_complex_function_pointers_good.eva/alarms.csv (good): ok
+file_operations_access_closed_18_complex_struct_multiple_methods_good.eva/alarms.csv (good): ok
+file_operations_access_closed_19_complex_refcount_good.eva/alarms.csv (good): ok
+file_operations_double_close_01_simple_if_good.eva/alarms.csv (good): ok
+file_operations_double_close_02_simple_if_int1_good.eva/alarms.csv (good): ok
+file_operations_double_close_02_simple_if_int2_good.eva/alarms.csv (good): ok
+file_operations_double_close_03_simple_if_multi_func_good.eva/alarms.csv (good): ok
+file_operations_double_close_04_simple_switch_good.eva/alarms.csv (good): ok
+file_operations_double_close_05_simple_goto_good.eva/alarms.csv (good): ok
+file_operations_double_close_06_simple_pass_by_reference_good.eva/alarms.csv (good): ok
+file_operations_double_close_07_cross_file_good.eva/alarms.csv (good): ok
+file_operations_double_close_08_loop_for_good.eva/alarms.csv (good): ok
+file_operations_double_close_09_loop_for_complex_good.eva/alarms.csv (good): ok
+file_operations_double_close_10_loop_while_continue_good.eva/alarms.csv (good): ok
+file_operations_double_close_11_loop_while_do_continue_good.eva/alarms.csv (good): ok
+file_operations_double_close_12_loop_for_array_branching_good.eva/alarms.csv (good): ok
+file_operations_double_close_13_loop_for_pointer_arithmetic_good.eva/alarms.csv (good): ok
+file_operations_double_close_17_complex_function_pointers_good.eva/alarms.csv (good): ok
+file_operations_double_close_18_complex_struct_multiple_methods_good.eva/alarms.csv (good): ok
+file_operations_double_close_19_complex_refcount_good.eva/alarms.csv (good): ok
+general_divide_by_zero_01_simple_if_good.eva/alarms.csv (good): ok
+general_divide_by_zero_02_simple_if_int1_good.eva/alarms.csv (good): ok
+general_divide_by_zero_02_simple_if_int2_good.eva/alarms.csv (good): ok
+general_divide_by_zero_03_simple_if_multi_func_good.eva/alarms.csv (good): ok
+general_divide_by_zero_04_simple_switch_good.eva/alarms.csv (good): ok
+general_divide_by_zero_05_simple_goto_good.eva/alarms.csv (good): ok
+general_divide_by_zero_06_simple_pass_by_reference_good.eva/alarms.csv (good): ok
+general_divide_by_zero_07_simple_cross_file_good.eva/alarms.csv (good): ok
+general_divide_by_zero_08_loop_for_good.eva/alarms.csv (good): ok
+general_divide_by_zero_09_loop_for_complex_good.eva/alarms.csv (good): ok
+general_divide_by_zero_10_loop_while_continue_good.eva/alarms.csv (good): ok
+general_divide_by_zero_11_loop_while_do_continue_good.eva/alarms.csv (good): ok
+general_divide_by_zero_12_loop_for_array_branching_good.eva/alarms.csv (good): ok
+general_divide_by_zero_13_loop_for_pointer_arithmetic_good.eva/alarms.csv (good): ok
+general_divide_by_zero_17_complex_function_pointers_good.eva/alarms.csv (good): ok
+general_divide_by_zero_18_complex_struct_multiple_methods_good.eva/alarms.csv (good): ok
+general_divide_by_zero_19_complex_refcount_good.eva/alarms.csv (good): ok
+general_nullpointer_01_simple_if_good.eva/alarms.csv (good): ok
+general_nullpointer_02_simple_if_int1_good.eva/alarms.csv (good): ok
+general_nullpointer_02_simple_if_int2_good.eva/alarms.csv (good): ok
+general_nullpointer_03_simple_if_multi_func_good.eva/alarms.csv (good): ok
+general_nullpointer_04_simple_switch_good.eva/alarms.csv (good): ok
+general_nullpointer_05_simple_goto_good.eva/alarms.csv (good): ok
+general_nullpointer_06_simple_pass_by_reference_good.eva/alarms.csv (good): ok
+general_nullpointer_07_cross_file_good.eva/alarms.csv (good): ok
+general_nullpointer_08_loop_for_good.eva/alarms.csv (good): ok
+general_nullpointer_09_loop_for_complex_good.eva/alarms.csv (good): ok
+general_nullpointer_10_loop_while_continue_good.eva/alarms.csv (good): ok
+general_nullpointer_11_loop_while_do_continue_good.eva/alarms.csv (good): ok
+general_nullpointer_12_loop_for_array_branching_good.eva/alarms.csv (good): ok
+general_nullpointer_13_loop_for_pointer_arithmetic_good.eva/alarms.csv (good): ok
+general_nullpointer_17_complex_function_pointers_good.eva/alarms.csv (good): ok
+general_nullpointer_18_complex_struct_multiple_methods_good.eva/alarms.csv (good): ok
+general_nullpointer_19_complex_refcount_good.eva/alarms.csv (good): ok
+integers_overflow_01_simple_if_good.eva/alarms.csv (good): ok
+integers_overflow_02_simple_if_int1_good.eva/alarms.csv (good): ok
+integers_overflow_02_simple_if_int2_good.eva/alarms.csv (good): ok
+integers_overflow_03_simple_if_multi_func_good.eva/alarms.csv (good): ok
+integers_overflow_04_simple_switch_good.eva/alarms.csv (good): ok
+integers_overflow_05_simple_goto_good.eva/alarms.csv (good): ok
+integers_overflow_06_simple_pass_by_reference_good.eva/alarms.csv (good): ok
+integers_overflow_07_simple_cross_file_good.eva/alarms.csv (good): ok
+integers_overflow_08_loop_for_good.eva/alarms.csv (good): ok
+integers_overflow_09_loop_for_complex_good.eva/alarms.csv (good): ok
+integers_overflow_10_loop_while_continue_good.eva/alarms.csv (good): ok
+integers_overflow_11_loop_while_do_continue_good.eva/alarms.csv (good): ok
+integers_overflow_12_loop_for_array_branching_good.eva/alarms.csv (good): ok
+integers_overflow_13_loop_for_pointer_arithmetic_good.eva/alarms.csv (good): ok
+integers_overflow_17_complex_function_pointers_good.eva/alarms.csv (good): ok
+integers_overflow_18_complex_struct_multiple_methods_good.eva/alarms.csv (good): ok
+integers_overflow_19_complex_refcount_good.eva/alarms.csv (good): ok
+memory_access_uninit_01_simple_if_good.eva/alarms.csv (good): ok
+memory_access_uninit_02_simple_if_int1_good.eva/alarms.csv (good): ok
+memory_access_uninit_02_simple_if_int2_good.eva/alarms.csv (good): ok
+memory_access_uninit_03_simple_if_multi_func_good.eva/alarms.csv (good): ok
+memory_access_uninit_04_simple_switch_good.eva/alarms.csv (good): ok
+memory_access_uninit_05_simple_goto_good.eva/alarms.csv (good): ok
+memory_access_uninit_06_simple_pass_by_reference_good.eva/alarms.csv (good): ok
+memory_access_uninit_07_simple_cross_file_good.eva/alarms.csv (good): ok
+memory_access_uninit_08_loop_for_good.eva/alarms.csv (good): ok
+memory_access_uninit_09_loop_for_complex_good.eva/alarms.csv (good): ok
+memory_access_uninit_10_loop_while_continue_good.eva/alarms.csv (good): ok
+memory_access_uninit_11_loop_while_do_continue_good.eva/alarms.csv (good): ok
+memory_access_uninit_12_loop_for_array_branching_good.eva/alarms.csv (good): ok
+memory_access_uninit_13_loop_for_pointer_arithmetic_good.eva/alarms.csv (good): imprecise
+memory_access_uninit_17_complex_function_pointers_good.eva/alarms.csv (good): ok
+memory_access_uninit_18_complex_struct_multiple_methods_good.eva/alarms.csv (good): imprecise
+memory_access_uninit_19_complex_refcount_good.eva/alarms.csv (good): imprecise
+memory_double_free_01_simple_if_good.eva/alarms.csv (good): ok
+memory_double_free_02_simple_if_int1_good.eva/alarms.csv (good): ok
+memory_double_free_02_simple_if_int2_good.eva/alarms.csv (good): ok
+memory_double_free_03_simple_if_multi_func_good.eva/alarms.csv (good): ok
+memory_double_free_04_simple_switch_good.eva/alarms.csv (good): ok
+memory_double_free_05_simple_goto_good.eva/alarms.csv (good): ok
+memory_double_free_06_simple_pass_by_reference_good.eva/alarms.csv (good): ok
+memory_double_free_07_cross_file_good.eva/alarms.csv (good): ok
+memory_double_free_08_loop_for_good.eva/alarms.csv (good): ok
+memory_double_free_09_loop_for_complex_good.eva/alarms.csv (good): ok
+memory_double_free_10_loop_while_continue_good.eva/alarms.csv (good): ok
+memory_double_free_11_loop_while_do_continue_good.eva/alarms.csv (good): ok
+memory_double_free_12_loop_for_array_branching_good.eva/alarms.csv (good): ok
+memory_double_free_13_loop_for_pointer_arithmetic_good.eva/alarms.csv (good): imprecise
+memory_double_free_17_complex_function_pointers_good.eva/alarms.csv (good): ok
+memory_double_free_18_complex_struct_multiple_methods_good.eva/alarms.csv (good): ok
+memory_double_free_19_complex_refcount_good.eva/alarms.csv (good): ok
+memory_refer_free_01_simple_if_good.eva/alarms.csv (good): ok
+memory_refer_free_02_simple_if_int1_good.eva/alarms.csv (good): ok
+memory_refer_free_02_simple_if_int2_good.eva/alarms.csv (good): ok
+memory_refer_free_03_simple_if_multi_func_good.eva/alarms.csv (good): ok
+memory_refer_free_04_simple_switch_good.eva/alarms.csv (good): ok
+memory_refer_free_05_simple_goto_good.eva/alarms.csv (good): ok
+memory_refer_free_06_simple_pass_by_reference_good.eva/alarms.csv (good): ok
+memory_refer_free_07_cross_file_good.eva/alarms.csv (good): imprecise
+memory_refer_free_08_loop_for_good.eva/alarms.csv (good): ok
+memory_refer_free_09_loop_for_complex_good.eva/alarms.csv (good): ok
+memory_refer_free_10_loop_while_continue_good.eva/alarms.csv (good): ok
+memory_refer_free_11_loop_while_do_continue_good.eva/alarms.csv (good): ok
+memory_refer_free_12_loop_for_array_branching_good.eva/alarms.csv (good): ok
+memory_refer_free_13_loop_for_pointer_arithmetic_good.eva/alarms.csv (good): imprecise
+memory_refer_free_17_complex_function_pointers_good.eva/alarms.csv (good): ok
+memory_refer_free_18_complex_struct_multiple_methods_good.eva/alarms.csv (good): ok
+memory_refer_free_19_complex_refcount_good.eva/alarms.csv (good): ok
+memory_zero_alloc_01_simple_if_good.eva/alarms.csv (good): ok
+memory_zero_alloc_02_simple_if_int1_good.eva/alarms.csv (good): ok
+memory_zero_alloc_02_simple_if_int2_good.eva/alarms.csv (good): ok
+memory_zero_alloc_03_simple_if_multi_func_good.eva/alarms.csv (good): ok
+memory_zero_alloc_04_simple_switch_good.eva/alarms.csv (good): ok
+memory_zero_alloc_05_simple_goto_good.eva/alarms.csv (good): ok
+memory_zero_alloc_06_simple_pass_by_reference_good.eva/alarms.csv (good): ok
+memory_zero_alloc_07_cross_file_good.eva/alarms.csv (good): ok
+memory_zero_alloc_08_loop_for_good.eva/alarms.csv (good): ok
+memory_zero_alloc_09_loop_for_complex_good.eva/alarms.csv (good): ok
+memory_zero_alloc_10_loop_while_continue_good.eva/alarms.csv (good): ok
+memory_zero_alloc_11_loop_while_do_continue_good.eva/alarms.csv (good): imprecise
+memory_zero_alloc_12_loop_for_array_branching_good.eva/alarms.csv (good): ok
+memory_zero_alloc_13_loop_for_pointer_arithmetic_good.eva/alarms.csv (good): imprecise
+memory_zero_alloc_17_complex_function_pointers_good.eva/alarms.csv (good): ok
+memory_zero_alloc_18_complex_struct_multiple_methods_good.eva/alarms.csv (good): ok
+memory_zero_alloc_19_complex_refcount_good.eva/alarms.csv (good): ok
+strings_overflow_01_simple_if_good.eva/alarms.csv (good): ok
+strings_overflow_02_simple_if_int1_good.eva/alarms.csv (good): ok
+strings_overflow_02_simple_if_int2_good.eva/alarms.csv (good): ok
+strings_overflow_03_simple_if_multi_func_good.eva/alarms.csv (good): ok
+strings_overflow_04_simple_switch_good.eva/alarms.csv (good): ok
+strings_overflow_05_simple_goto_good.eva/alarms.csv (good): ok
+strings_overflow_06_simple_pass_by_reference_good.eva/alarms.csv (good): ok
+strings_overflow_07_simple_cross_file_good.eva/alarms.csv (good): ok
+strings_overflow_08_loop_for_good.eva/alarms.csv (good): ok
+strings_overflow_09_loop_for_complex_good.eva/alarms.csv (good): ok
+strings_overflow_10_loop_while_continue_good.eva/alarms.csv (good): ok
+strings_overflow_11_loop_while_do_continue_good.eva/alarms.csv (good): ok
+strings_overflow_12_loop_for_array_branching_good.eva/alarms.csv (good): ok
+strings_overflow_13_loop_for_pointer_arithmetic_good.eva/alarms.csv (good): imprecise
+strings_overflow_17_complex_function_pointers_good.eva/alarms.csv (good): ok
+strings_overflow_18_complex_struct_multiple_methods_good.eva/alarms.csv (good): ok
+strings_overflow_19_complex_refcount_good.eva/alarms.csv (good): ok
+strings_unbounded_copy_01_simple_if_good.eva/alarms.csv (good): imprecise
+strings_unbounded_copy_02_simple_if_int1_good.eva/alarms.csv (good): imprecise
+strings_unbounded_copy_02_simple_if_int2_good.eva/alarms.csv (good): imprecise
+strings_unbounded_copy_03_simple_if_multi_func_good.eva/alarms.csv (good): imprecise
+strings_unbounded_copy_04_simple_switch_good.eva/alarms.csv (good): imprecise
+strings_unbounded_copy_05_simple_goto_good.eva/alarms.csv (good): imprecise
+strings_unbounded_copy_06_simple_pass_by_reference_good.eva/alarms.csv (good): imprecise
+strings_unbounded_copy_07_simple_cross_file_good.eva/alarms.csv (good): imprecise
+strings_unbounded_copy_08_loop_for_good.eva/alarms.csv (good): imprecise
+strings_unbounded_copy_09_loop_for_complex_good.eva/alarms.csv (good): imprecise
+strings_unbounded_copy_10_loop_while_continue_good.eva/alarms.csv (good): imprecise
+strings_unbounded_copy_11_loop_while_do_continue_good.eva/alarms.csv (good): imprecise
+strings_unbounded_copy_12_loop_for_array_branching_good.eva/alarms.csv (good): imprecise
+strings_unbounded_copy_13_loop_for_pointer_arithmetic_good.eva/alarms.csv (good): imprecise
+strings_unbounded_copy_17_complex_function_pointers_good.eva/alarms.csv (good): imprecise
+strings_unbounded_copy_18_complex_struct_multiple_methods_good.eva/alarms.csv (good): imprecise
+strings_unbounded_copy_19_complex_refcount_good.eva/alarms.csv (good): imprecise
+base_files_access_closed_bad.eva/alarms.csv (bad): unsound
+base_files_double_close_bad.eva/alarms.csv (bad): unsound
+base_general_divide_by_0_bad.eva/alarms.csv (bad): ok
+base_general_nullpointer_bad.eva/alarms.csv (bad): ok
+base_general_uninitialized_pointer_bad.eva/alarms.csv (bad): ok
+base_general_uninitialized_value_bad.eva/alarms.csv (bad): ok
+base_integers_overflow_bad.eva/alarms.csv (bad): ok
+base_memory_double_free_bad.eva/alarms.csv (bad): ok
+base_memory_read_uninitialized_malloced_mem_bad.eva/alarms.csv (bad): ok
+base_memory_refer_freed_bad.eva/alarms.csv (bad): ok
+base_memory_zero_alloc_bad.eva/alarms.csv (bad): ok
+base_strings_overflow_bad.eva/alarms.csv (bad): ok
+base_strings_unbounded_copy_bad.eva/alarms.csv (bad): ok
+file_operations_access_closed_01_simple_if_bad.eva/alarms.csv (bad): unsound
+file_operations_access_closed_02_simple_if_int1_bad.eva/alarms.csv (bad): unsound
+file_operations_access_closed_02_simple_if_int2_bad.eva/alarms.csv (bad): unsound
+file_operations_access_closed_03_simple_if_multi_func_bad.eva/alarms.csv (bad): unsound
+file_operations_access_closed_04_simple_switch_bad.eva/alarms.csv (bad): unsound
+file_operations_access_closed_05_simple_goto_bad.eva/alarms.csv (bad): unsound
+file_operations_access_closed_06_simple_pass_by_reference_bad.eva/alarms.csv (bad): unsound
+file_operations_access_closed_07_cross_file_bad.eva/alarms.csv (bad): unsound
+file_operations_access_closed_08_loop_for_bad.eva/alarms.csv (bad): unsound
+file_operations_access_closed_09_loop_for_complex_bad.eva/alarms.csv (bad): unsound
+file_operations_access_closed_10_loop_while_continue_bad.eva/alarms.csv (bad): unsound
+file_operations_access_closed_11_loop_while_do_continue_bad.eva/alarms.csv (bad): unsound
+file_operations_access_closed_12_loop_for_array_branching_bad.eva/alarms.csv (bad): unsound
+file_operations_access_closed_13_loop_for_pointer_arithmetic_bad.eva/alarms.csv (bad): unsound
+file_operations_access_closed_17_complex_function_pointers_bad.eva/alarms.csv (bad): unsound
+file_operations_access_closed_18_complex_struct_multiple_methods_bad.eva/alarms.csv (bad): unsound
+file_operations_access_closed_19_complex_refcount_bad.eva/alarms.csv (bad): unsound
+file_operations_double_close_01_simple_if_bad.eva/alarms.csv (bad): unsound
+file_operations_double_close_02_simple_if_int1_bad.eva/alarms.csv (bad): unsound
+file_operations_double_close_02_simple_if_int2_bad.eva/alarms.csv (bad): unsound
+file_operations_double_close_03_simple_if_multi_func_bad.eva/alarms.csv (bad): unsound
+file_operations_double_close_04_simple_switch_bad.eva/alarms.csv (bad): unsound
+file_operations_double_close_05_simple_goto_bad.eva/alarms.csv (bad): unsound
+file_operations_double_close_06_simple_pass_by_reference_bad.eva/alarms.csv (bad): unsound
+file_operations_double_close_07_cross_file_bad.eva/alarms.csv (bad): unsound
+file_operations_double_close_08_loop_for_bad.eva/alarms.csv (bad): unsound
+file_operations_double_close_09_loop_for_complex_bad.eva/alarms.csv (bad): unsound
+file_operations_double_close_10_loop_while_continue_bad.eva/alarms.csv (bad): unsound
+file_operations_double_close_11_loop_while_do_continue_bad.eva/alarms.csv (bad): unsound
+file_operations_double_close_12_loop_for_array_branching_bad.eva/alarms.csv (bad): unsound
+file_operations_double_close_13_loop_for_pointer_arithmetic_bad.eva/alarms.csv (bad): unsound
+file_operations_double_close_17_complex_function_pointers_bad.eva/alarms.csv (bad): unsound
+file_operations_double_close_18_complex_struct_multiple_methods_bad.eva/alarms.csv (bad): unsound
+file_operations_double_close_19_complex_refcount_bad.eva/alarms.csv (bad): unsound
+general_divide_by_zero_01_simple_if_bad.eva/alarms.csv (bad): ok
+general_divide_by_zero_02_simple_if_int1_bad.eva/alarms.csv (bad): ok
+general_divide_by_zero_02_simple_if_int2_bad.eva/alarms.csv (bad): ok
+general_divide_by_zero_03_simple_if_multi_func_bad.eva/alarms.csv (bad): ok
+general_divide_by_zero_04_simple_switch_bad.eva/alarms.csv (bad): ok
+general_divide_by_zero_05_simple_goto_bad.eva/alarms.csv (bad): ok
+general_divide_by_zero_06_simple_pass_by_reference_bad.eva/alarms.csv (bad): ok
+general_divide_by_zero_07_simple_cross_file_bad.eva/alarms.csv (bad): ok
+general_divide_by_zero_08_loop_for_bad.eva/alarms.csv (bad): ok
+general_divide_by_zero_09_loop_for_complex_bad.eva/alarms.csv (bad): ok
+general_divide_by_zero_10_loop_while_continue_bad.eva/alarms.csv (bad): ok
+general_divide_by_zero_11_loop_while_do_continue_bad.eva/alarms.csv (bad): ok
+general_divide_by_zero_12_loop_for_array_branching_bad.eva/alarms.csv (bad): ok
+general_divide_by_zero_13_loop_for_pointer_arithmetic_bad.eva/alarms.csv (bad): ok
+general_divide_by_zero_17_complex_function_pointers_bad.eva/alarms.csv (bad): ok
+general_divide_by_zero_18_complex_struct_multiple_methods_bad.eva/alarms.csv (bad): ok
+general_divide_by_zero_19_complex_refcount_bad.eva/alarms.csv (bad): ok
+general_nullpointer_01_simple_if_bad.eva/alarms.csv (bad): ok
+general_nullpointer_02_simple_if_int1_bad.eva/alarms.csv (bad): ok
+general_nullpointer_02_simple_if_int2_bad.eva/alarms.csv (bad): ok
+general_nullpointer_03_simple_if_multi_func_bad.eva/alarms.csv (bad): ok
+general_nullpointer_04_simple_switch_bad.eva/alarms.csv (bad): ok
+general_nullpointer_05_simple_goto_bad.eva/alarms.csv (bad): ok
+general_nullpointer_06_simple_pass_by_reference_bad.eva/alarms.csv (bad): ok
+general_nullpointer_07_cross_file_bad.eva/alarms.csv (bad): ok
+general_nullpointer_08_loop_for_bad.eva/alarms.csv (bad): ok
+general_nullpointer_09_loop_for_complex_bad.eva/alarms.csv (bad): ok
+general_nullpointer_10_loop_while_continue_bad.eva/alarms.csv (bad): ok
+general_nullpointer_11_loop_while_do_continue_bad.eva/alarms.csv (bad): ok
+general_nullpointer_12_loop_for_array_branching_bad.eva/alarms.csv (bad): ok
+general_nullpointer_13_loop_for_pointer_arithmetic_bad.eva/alarms.csv (bad): ok
+general_nullpointer_17_complex_function_pointers_bad.eva/alarms.csv (bad): ok
+general_nullpointer_18_complex_struct_multiple_methods_bad.eva/alarms.csv (bad): ok
+general_nullpointer_19_complex_refcount_bad.eva/alarms.csv (bad): ok
+integers_overflow_01_simple_if_bad.eva/alarms.csv (bad): ok
+integers_overflow_02_simple_if_int1_bad.eva/alarms.csv (bad): ok
+integers_overflow_02_simple_if_int2_bad.eva/alarms.csv (bad): ok
+integers_overflow_03_simple_if_multi_func_bad.eva/alarms.csv (bad): ok
+integers_overflow_04_simple_switch_bad.eva/alarms.csv (bad): ok
+integers_overflow_05_simple_goto_bad.eva/alarms.csv (bad): ok
+integers_overflow_06_simple_pass_by_reference_bad.eva/alarms.csv (bad): ok
+integers_overflow_07_simple_cross_file_bad.eva/alarms.csv (bad): ok
+integers_overflow_08_loop_for_bad.eva/alarms.csv (bad): ok
+integers_overflow_09_loop_for_complex_bad.eva/alarms.csv (bad): ok
+integers_overflow_10_loop_while_continue_bad.eva/alarms.csv (bad): ok
+integers_overflow_11_loop_while_do_continue_bad.eva/alarms.csv (bad): ok
+integers_overflow_12_loop_for_array_branching_bad.eva/alarms.csv (bad): ok
+integers_overflow_13_loop_for_pointer_arithmetic_bad.eva/alarms.csv (bad): ok
+integers_overflow_17_complex_function_pointers_bad.eva/alarms.csv (bad): ok
+integers_overflow_18_complex_struct_multiple_methods_bad.eva/alarms.csv (bad): ok
+integers_overflow_19_complex_refcount_bad.eva/alarms.csv (bad): ok
+memory_access_uninit_01_simple_if_bad.eva/alarms.csv (bad): ok
+memory_access_uninit_02_simple_if_int1_bad.eva/alarms.csv (bad): ok
+memory_access_uninit_02_simple_if_int2_bad.eva/alarms.csv (bad): ok
+memory_access_uninit_03_simple_if_multi_func_bad.eva/alarms.csv (bad): ok
+memory_access_uninit_04_simple_switch_bad.eva/alarms.csv (bad): ok
+memory_access_uninit_05_simple_goto_bad.eva/alarms.csv (bad): ok
+memory_access_uninit_06_simple_pass_by_reference_bad.eva/alarms.csv (bad): ok
+memory_access_uninit_07_simple_cross_file_bad.eva/alarms.csv (bad): ok
+memory_access_uninit_08_loop_for_bad.eva/alarms.csv (bad): ok
+memory_access_uninit_09_loop_for_complex_bad.eva/alarms.csv (bad): ok
+memory_access_uninit_10_loop_while_continue_bad.eva/alarms.csv (bad): ok
+memory_access_uninit_11_loop_while_do_continue_bad.eva/alarms.csv (bad): ok
+memory_access_uninit_12_loop_for_array_branching_bad.eva/alarms.csv (bad): ok
+memory_access_uninit_13_loop_for_pointer_arithmetic_bad.eva/alarms.csv (bad): ok
+memory_access_uninit_17_complex_function_pointers_bad.eva/alarms.csv (bad): ok
+memory_access_uninit_18_complex_struct_multiple_methods_bad.eva/alarms.csv (bad): ok
+memory_access_uninit_19_complex_refcount_bad.eva/alarms.csv (bad): ok
+memory_double_free_01_simple_if_bad.eva/alarms.csv (bad): ok
+memory_double_free_02_simple_if_int1_bad.eva/alarms.csv (bad): ok
+memory_double_free_02_simple_if_int2_bad.eva/alarms.csv (bad): ok
+memory_double_free_03_simple_if_multi_func_bad.eva/alarms.csv (bad): ok
+memory_double_free_04_simple_switch_bad.eva/alarms.csv (bad): ok
+memory_double_free_05_simple_goto_bad.eva/alarms.csv (bad): ok
+memory_double_free_06_simple_pass_by_reference_bad.eva/alarms.csv (bad): ok
+memory_double_free_07_cross_file_bad.eva/alarms.csv (bad): ok
+memory_double_free_08_loop_for_bad.eva/alarms.csv (bad): ok
+memory_double_free_09_loop_for_complex_bad.eva/alarms.csv (bad): ok
+memory_double_free_10_loop_while_continue_bad.eva/alarms.csv (bad): ok
+memory_double_free_11_loop_while_do_continue_bad.eva/alarms.csv (bad): ok
+memory_double_free_12_loop_for_array_branching_bad.eva/alarms.csv (bad): ok
+memory_double_free_13_loop_for_pointer_arithmetic_bad.eva/alarms.csv (bad): ok
+memory_double_free_17_complex_function_pointers_bad.eva/alarms.csv (bad): ok
+memory_double_free_18_complex_struct_multiple_methods_bad.eva/alarms.csv (bad): ok
+memory_double_free_19_complex_refcount_bad.eva/alarms.csv (bad): ok
+memory_refer_free_01_simple_if_bad.eva/alarms.csv (bad): ok
+memory_refer_free_02_simple_if_int1_bad.eva/alarms.csv (bad): ok
+memory_refer_free_02_simple_if_int2_bad.eva/alarms.csv (bad): ok
+memory_refer_free_03_simple_if_multi_func_bad.eva/alarms.csv (bad): ok
+memory_refer_free_04_simple_switch_bad.eva/alarms.csv (bad): ok
+memory_refer_free_05_simple_goto_bad.eva/alarms.csv (bad): ok
+memory_refer_free_06_simple_pass_by_reference_bad.eva/alarms.csv (bad): ok
+memory_refer_free_07_cross_file_bad.eva/alarms.csv (bad): ok
+memory_refer_free_08_loop_for_bad.eva/alarms.csv (bad): ok
+memory_refer_free_09_loop_for_complex_bad.eva/alarms.csv (bad): ok
+memory_refer_free_10_loop_while_continue_bad.eva/alarms.csv (bad): ok
+memory_refer_free_11_loop_while_do_continue_bad.eva/alarms.csv (bad): ok
+memory_refer_free_12_loop_for_array_branching_bad.eva/alarms.csv (bad): ok
+memory_refer_free_13_loop_for_pointer_arithmetic_bad.eva/alarms.csv (bad): ok
+memory_refer_free_17_complex_function_pointers_bad.eva/alarms.csv (bad): ok
+memory_refer_free_18_complex_struct_multiple_methods_bad.eva/alarms.csv (bad): ok
+memory_refer_free_19_complex_refcount_bad.eva/alarms.csv (bad): ok
+memory_zero_alloc_01_simple_if_bad.eva/alarms.csv (bad): ok
+memory_zero_alloc_02_simple_if_int1_bad.eva/alarms.csv (bad): ok
+memory_zero_alloc_02_simple_if_int2_bad.eva/alarms.csv (bad): ok
+memory_zero_alloc_03_simple_if_multi_func_bad.eva/alarms.csv (bad): ok
+memory_zero_alloc_04_simple_switch_bad.eva/alarms.csv (bad): ok
+memory_zero_alloc_05_simple_goto_bad.eva/alarms.csv (bad): ok
+memory_zero_alloc_06_simple_pass_by_reference_bad.eva/alarms.csv (bad): ok
+memory_zero_alloc_07_cross_file_bad.eva/alarms.csv (bad): ok
+memory_zero_alloc_08_loop_for_bad.eva/alarms.csv (bad): ok
+memory_zero_alloc_09_loop_for_complex_bad.eva/alarms.csv (bad): ok
+memory_zero_alloc_10_loop_while_continue_bad.eva/alarms.csv (bad): ok
+memory_zero_alloc_11_loop_while_do_continue_bad.eva/alarms.csv (bad): ok
+memory_zero_alloc_12_loop_for_array_branching_bad.eva/alarms.csv (bad): ok
+memory_zero_alloc_13_loop_for_pointer_arithmetic_bad.eva/alarms.csv (bad): ok
+memory_zero_alloc_17_complex_function_pointers_bad.eva/alarms.csv (bad): ok
+memory_zero_alloc_18_complex_struct_multiple_methods_bad.eva/alarms.csv (bad): ok
+memory_zero_alloc_19_complex_refcount_bad.eva/alarms.csv (bad): ok
+strings_overflow_01_simple_if_bad.eva/alarms.csv (bad): ok
+strings_overflow_02_simple_if_int1_bad.eva/alarms.csv (bad): ok
+strings_overflow_02_simple_if_int2_bad.eva/alarms.csv (bad): ok
+strings_overflow_03_simple_if_multi_func_bad.eva/alarms.csv (bad): ok
+strings_overflow_04_simple_switch_bad.eva/alarms.csv (bad): ok
+strings_overflow_05_simple_goto_bad.eva/alarms.csv (bad): ok
+strings_overflow_06_simple_pass_by_reference_bad.eva/alarms.csv (bad): ok
+strings_overflow_07_simple_cross_file_bad.eva/alarms.csv (bad): ok
+strings_overflow_08_loop_for_bad.eva/alarms.csv (bad): ok
+strings_overflow_09_loop_for_complex_bad.eva/alarms.csv (bad): ok
+strings_overflow_10_loop_while_continue_bad.eva/alarms.csv (bad): ok
+strings_overflow_11_loop_while_do_continue_bad.eva/alarms.csv (bad): ok
+strings_overflow_12_loop_for_array_branching_bad.eva/alarms.csv (bad): ok
+strings_overflow_13_loop_for_pointer_arithmetic_bad.eva/alarms.csv (bad): ok
+strings_overflow_17_complex_function_pointers_bad.eva/alarms.csv (bad): ok
+strings_overflow_18_complex_struct_multiple_methods_bad.eva/alarms.csv (bad): ok
+strings_overflow_19_complex_refcount_bad.eva/alarms.csv (bad): ok
+strings_unbounded_copy_01_simple_if_bad.eva/alarms.csv (bad): ok
+strings_unbounded_copy_02_simple_if_int1_bad.eva/alarms.csv (bad): ok
+strings_unbounded_copy_02_simple_if_int2_bad.eva/alarms.csv (bad): ok
+strings_unbounded_copy_03_simple_if_multi_func_bad.eva/alarms.csv (bad): ok
+strings_unbounded_copy_04_simple_switch_bad.eva/alarms.csv (bad): ok
+strings_unbounded_copy_05_simple_goto_bad.eva/alarms.csv (bad): ok
+strings_unbounded_copy_06_simple_pass_by_reference_bad.eva/alarms.csv (bad): ok
+strings_unbounded_copy_07_simple_cross_file_bad.eva/alarms.csv (bad): ok
+strings_unbounded_copy_08_loop_for_bad.eva/alarms.csv (bad): ok
+strings_unbounded_copy_09_loop_for_complex_bad.eva/alarms.csv (bad): ok
+strings_unbounded_copy_10_loop_while_continue_bad.eva/alarms.csv (bad): ok
+strings_unbounded_copy_11_loop_while_do_continue_bad.eva/alarms.csv (bad): ok
+strings_unbounded_copy_12_loop_for_array_branching_bad.eva/alarms.csv (bad): ok
+strings_unbounded_copy_13_loop_for_pointer_arithmetic_bad.eva/alarms.csv (bad): ok
+strings_unbounded_copy_17_complex_function_pointers_bad.eva/alarms.csv (bad): ok
+strings_unbounded_copy_18_complex_struct_multiple_methods_bad.eva/alarms.csv (bad): ok
+strings_unbounded_copy_19_complex_refcount_bad.eva/alarms.csv (bad): ok
diff --git a/bench-moerman2018/.frama-c/evaluate_case.sh b/bench-moerman2018/.frama-c/evaluate_case.sh
new file mode 100755
index 000000000..80efc3234
--- /dev/null
+++ b/bench-moerman2018/.frama-c/evaluate_case.sh
@@ -0,0 +1,29 @@
+#!/bin/bash -eu
+
+if [ $# -lt 2 ]; then
+ echo "usage: $0 (good|bad) path/to/alarms.csv"
+ exit 1
+fi
+
+goodbad="$1"
+alarms=$(wc -l "$2" | cut -d' ' -f1)
+
+case $goodbad in
+ "good")
+ if [ "$alarms" -gt 1 ]; then
+ echo "$2 ($goodbad): imprecise"
+ else
+ echo "$2 ($goodbad): ok"
+ fi
+ ;;
+ "bad")
+ if [ "$alarms" -lt 2 ]; then
+ echo "$2 ($goodbad): unsound"
+ else
+ echo "$2 ($goodbad): ok"
+ fi
+ ;;
+ *)
+ echo "invalid '$goodbad': must be either 'good' or 'bad'."
+ exit 1
+esac
diff --git a/bench-moerman2018/.frama-c/path.mk b/bench-moerman2018/.frama-c/path.mk
new file mode 120000
index 000000000..57620d6d4
--- /dev/null
+++ b/bench-moerman2018/.frama-c/path.mk
@@ -0,0 +1 @@
+../../path.mk
\ No newline at end of file
diff --git a/bench-moerman2018/LICENSE b/bench-moerman2018/LICENSE
new file mode 100644
index 000000000..f6e9e392a
--- /dev/null
+++ b/bench-moerman2018/LICENSE
@@ -0,0 +1,21 @@
+MIT License
+
+Copyright (c) 2018 Jonathan Moerman
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.
diff --git a/bench-moerman2018/README.md b/bench-moerman2018/README.md
new file mode 100644
index 000000000..51785694e
--- /dev/null
+++ b/bench-moerman2018/README.md
@@ -0,0 +1,13 @@
+# About this test suite
+
+This test suite was designed and used for my bachelor thesis "Evaluating the performance of open source static analysis tools".
+
+This test suite was inspired by, and used in conjunction with the test suite presented in "Test-driving static analysis tools in search of c code vulnerabilities" by George Chatzieleftheriou and Panagiotis Katsaros.
+
+## How to use this test suite
+
+The .c files included in this test suite need to be preprocessed before use. The shellscript ```preprocess_files.sh``` can be used to accomplish this.
+
+- ```preprocess_files.sh``` needs a unix like environment with gpp installed to work.
+- Usage: ```preprocess_files.sh [directory to process]```, for example ```preprocess_files.sh ./integers/overflow/```.
+This should generate the sub directories ```test_correct``` (safe calls to unsafe functions), ```test_incorrect``` (unsafe calls to unsafe functions), ```test_lib_correct``` (safe functions, no entry point), ```test_lib_incorrect``` (unsafe functions, no entry point) and ```test_correct_catch_bad``` (safe calls to safe functions).
diff --git a/bench-moerman2018/base/files_access_closed.c b/bench-moerman2018/base/files_access_closed.c
new file mode 100644
index 000000000..e717051f7
--- /dev/null
+++ b/bench-moerman2018/base/files_access_closed.c
@@ -0,0 +1,22 @@
+#include <stdio.h>
+#include <stdlib.h>
+
+int main() {
+ FILE* file;
+
+ file = fopen("file.txt","r");
+
+ if(!file) {
+ return 0;
+ }
+
+#ifdef NO_BUG
+ printf("%i\n", (int) fgetc(file));
+ fclose(file);
+#else
+ fclose(file);
+ printf("%i\n", (int) fgetc(file));
+#endif
+
+ return 1;
+}
diff --git a/bench-moerman2018/base/files_double_close.c b/bench-moerman2018/base/files_double_close.c
new file mode 100644
index 000000000..b268cc3d7
--- /dev/null
+++ b/bench-moerman2018/base/files_double_close.c
@@ -0,0 +1,23 @@
+#include <stdio.h>
+#include <stdlib.h>
+
+int main() {
+ FILE* file;
+
+ file = fopen("file.txt","r");
+
+ if(!file) {
+ return 1;
+ }
+
+ printf("%i\n", (int) fgetc(file));
+
+#ifdef NO_BUG
+ fclose(file);
+#else
+ fclose(file);
+ fclose(file);
+#endif
+
+ return 1;
+}
diff --git a/bench-moerman2018/base/files_resource_leak.c b/bench-moerman2018/base/files_resource_leak.c
new file mode 100644
index 000000000..305e8d886
--- /dev/null
+++ b/bench-moerman2018/base/files_resource_leak.c
@@ -0,0 +1,20 @@
+#include <stdio.h>
+#include <stdlib.h>
+
+int main() {
+ FILE* file;
+
+ file = fopen("file.txt","r");
+
+ if(!file) {
+ return 1;
+ }
+
+ printf("%i\n", (int) fgetc(file));
+
+#ifdef NO_BUG
+ fclose(file);
+#endif
+
+ return 1;
+}
diff --git a/bench-moerman2018/base/general_divide_by_0.c b/bench-moerman2018/base/general_divide_by_0.c
new file mode 100644
index 000000000..e7dfd8a24
--- /dev/null
+++ b/bench-moerman2018/base/general_divide_by_0.c
@@ -0,0 +1,16 @@
+#include <stdio.h>
+#include <stdlib.h>
+
+int main() {
+ int x;
+
+#ifdef NO_BUG
+ x = 1;
+#else
+ x = 0;
+#endif
+
+ printf("%i\n", 5 / x);
+
+ return 1;
+}
diff --git a/bench-moerman2018/base/general_nullpointer.c b/bench-moerman2018/base/general_nullpointer.c
new file mode 100644
index 000000000..d68bd3fab
--- /dev/null
+++ b/bench-moerman2018/base/general_nullpointer.c
@@ -0,0 +1,17 @@
+#include <stdio.h>
+#include <stdlib.h>
+
+int main() {
+ int arr[3] = {1, 2, 3};
+ int* ptr;
+
+#ifdef NO_BUG
+ ptr = arr;
+#else
+ ptr = 0;
+#endif
+
+ printf("%i\n", *ptr + arr[2]);
+
+ return 1;
+}
diff --git a/bench-moerman2018/base/general_uninitialized_pointer.c b/bench-moerman2018/base/general_uninitialized_pointer.c
new file mode 100644
index 000000000..c52e9a2fb
--- /dev/null
+++ b/bench-moerman2018/base/general_uninitialized_pointer.c
@@ -0,0 +1,15 @@
+#include <stdio.h>
+#include <stdlib.h>
+
+int main() {
+ int arr[3] = {1, 2, 3};
+ int* ptr;
+
+#ifdef NO_BUG
+ ptr = arr;
+#endif
+
+ printf("%i\n", *ptr + arr[2]);
+
+ return 1;
+}
diff --git a/bench-moerman2018/base/general_uninitialized_value.c b/bench-moerman2018/base/general_uninitialized_value.c
new file mode 100644
index 000000000..3b40ae2f7
--- /dev/null
+++ b/bench-moerman2018/base/general_uninitialized_value.c
@@ -0,0 +1,14 @@
+#include <stdio.h>
+#include <stdlib.h>
+
+int main() {
+ int x;
+
+#ifdef NO_BUG
+ x = 5;
+#endif
+
+ printf("%i\n", x + 1);
+
+ return 1;
+}
diff --git a/bench-moerman2018/base/integers_overflow.c b/bench-moerman2018/base/integers_overflow.c
new file mode 100644
index 000000000..852a7c0ff
--- /dev/null
+++ b/bench-moerman2018/base/integers_overflow.c
@@ -0,0 +1,17 @@
+#include <stdio.h>
+#include <stdlib.h>
+#include <limits.h>
+
+int main() {
+ int x;
+
+#ifdef NO_BUG
+ x = INT_MAX - 1;
+#else
+ x = INT_MAX;
+#endif
+
+ printf("%i\n", x + 1);
+
+ return 1;
+}
diff --git a/bench-moerman2018/base/memory_double_free.c b/bench-moerman2018/base/memory_double_free.c
new file mode 100644
index 000000000..99356bac4
--- /dev/null
+++ b/bench-moerman2018/base/memory_double_free.c
@@ -0,0 +1,24 @@
+#include <stdio.h>
+#include <stdlib.h>
+
+int main() {
+ int* data;
+ int x = 33;
+
+ data = malloc(5 * sizeof(int));
+
+ if(!data) {
+ return -1;
+ }
+
+ *data = x;
+
+ printf("%i\n", *data);
+
+ free(data);
+#ifndef NO_BUG
+ free(data);
+#endif
+
+ return 1;
+}
diff --git a/bench-moerman2018/base/memory_leak.c b/bench-moerman2018/base/memory_leak.c
new file mode 100644
index 000000000..9ca1fa60a
--- /dev/null
+++ b/bench-moerman2018/base/memory_leak.c
@@ -0,0 +1,23 @@
+#include <stdio.h>
+#include <stdlib.h>
+
+int main() {
+ int* data;
+ int x = 33;
+
+ data = malloc(5 * sizeof(int));
+
+ if(!data) {
+ return -1;
+ }
+
+ *data = x;
+
+ printf("%i\n", *data);
+
+#ifdef NO_BUG
+ free(data);
+#endif
+
+ return 1;
+}
diff --git a/bench-moerman2018/base/memory_read_uninitialized_malloced_mem.c b/bench-moerman2018/base/memory_read_uninitialized_malloced_mem.c
new file mode 100644
index 000000000..3019d7de1
--- /dev/null
+++ b/bench-moerman2018/base/memory_read_uninitialized_malloced_mem.c
@@ -0,0 +1,23 @@
+#include <stdio.h>
+#include <stdlib.h>
+
+int main() {
+ int* data;
+
+ data = malloc(sizeof(int));
+
+
+ if(!data) {
+ return -1;
+ }
+
+#ifdef NO_BUG
+ *data = 37;
+#endif
+
+ printf("%i\n", *data);
+
+ free(data);
+
+ return 1;
+}
diff --git a/bench-moerman2018/base/memory_refer_freed.c b/bench-moerman2018/base/memory_refer_freed.c
new file mode 100644
index 000000000..a3386c212
--- /dev/null
+++ b/bench-moerman2018/base/memory_refer_freed.c
@@ -0,0 +1,25 @@
+#include <stdio.h>
+#include <stdlib.h>
+
+int main() {
+ int* data;
+ int x = 33;
+
+ data = malloc(5 * sizeof(int));
+
+ if(!data) {
+ return -1;
+ }
+
+ *data = x;
+
+#ifdef NO_BUG
+ printf("%i\n", *data);
+ free(data);
+#else
+ free(data);
+ printf("%i\n", *data);
+#endif
+
+ return 1;
+}
diff --git a/bench-moerman2018/base/memory_zero_alloc.c b/bench-moerman2018/base/memory_zero_alloc.c
new file mode 100644
index 000000000..a3d224535
--- /dev/null
+++ b/bench-moerman2018/base/memory_zero_alloc.c
@@ -0,0 +1,27 @@
+#include <stdio.h>
+#include <stdlib.h>
+
+int main() {
+ int* data;
+ int x;
+
+#ifdef NO_BUG
+ x = 1;
+#else
+ x = 0;
+#endif
+
+ data = malloc(x * sizeof(int));
+
+ if(!data) {
+ return -1;
+ }
+
+ *data = x;
+
+ printf("%i\n", *data);
+
+ free(data);
+
+ return 1;
+}
diff --git a/bench-moerman2018/base/strings_overflow.c b/bench-moerman2018/base/strings_overflow.c
new file mode 100644
index 000000000..55e8d7c61
--- /dev/null
+++ b/bench-moerman2018/base/strings_overflow.c
@@ -0,0 +1,16 @@
+#include <stdio.h>
+#include <stdlib.h>
+
+int main() {
+#ifdef NO_BUG
+ char test_string[] = "this is a long string";
+#else
+ char test_string[] = "short string";
+#endif
+
+ test_string[13] = '?';
+
+ printf("%s\n", test_string);
+
+ return 1;
+}
diff --git a/bench-moerman2018/base/strings_unbounded_copy.c b/bench-moerman2018/base/strings_unbounded_copy.c
new file mode 100644
index 000000000..ad1b7b0da
--- /dev/null
+++ b/bench-moerman2018/base/strings_unbounded_copy.c
@@ -0,0 +1,17 @@
+#include <stdio.h>
+#include <stdlib.h>
+#include <string.h>
+
+int main() {
+#ifdef NO_BUG
+ char test_string[22];
+#else
+ char test_string[13];
+#endif
+
+ strcpy(test_string, "this is a long string");
+
+ printf("%s\n", test_string);
+
+ return 1;
+}
diff --git a/bench-moerman2018/common/common.c b/bench-moerman2018/common/common.c
new file mode 100644
index 000000000..f7e71fa70
--- /dev/null
+++ b/bench-moerman2018/common/common.c
@@ -0,0 +1,52 @@
+#include <stdbool.h>
+#include <stdlib.h>
+#include <stdio.h>
+
+void assign_pointer(void** dest, void* source1, void* source2, bool condition) {
+ if(condition) {
+ *dest = source1;
+ } else {
+ *dest = source2;
+ }
+}
+
+void* choose_pointer(void* source1, void* source2, bool condition) {
+ if(condition) {
+ return source1;
+ } else {
+ return source2;
+ }
+}
+
+void conditional_free(void* ptr, bool condition, void** set_null) {
+ if(condition) {
+ free(ptr);
+ if(set_null) {
+ *set_null = 0;
+ }
+ }
+}
+
+int int_dereference_choice(int* source1, int* source2, bool condition) {
+ if(condition) {
+ return *source1;
+ }
+ return *source2;
+}
+
+int choose_int(int int1, int int2, bool condition) {
+ if(condition) {
+ return int1;
+ } else {
+ return int2;
+ }
+}
+
+void conditional_close(FILE* file, bool do_close, FILE** set_null) {
+ if(do_close) {
+ fclose(file);
+ if(set_null) {
+ *set_null = 0;
+ }
+ }
+}
diff --git a/bench-moerman2018/common/common.h b/bench-moerman2018/common/common.h
new file mode 100644
index 000000000..d1f23fcc0
--- /dev/null
+++ b/bench-moerman2018/common/common.h
@@ -0,0 +1,9 @@
+#include <stdbool.h>
+#include <stdio.h>
+
+int int_dereference_choice(int* source1, int* source2, bool condition);
+void* choose_pointer(void* source1, void* source2, bool condition);
+void conditional_free(void* ptr, bool condition, void** set_null);
+int choose_int(int int1, int int2, bool condition);
+void conditional_close(FILE* file, bool do_close, FILE** set_null);
+void assign_pointer(void** dest, void* source1, void* source2, bool condition);
diff --git a/bench-moerman2018/common/pointers.c b/bench-moerman2018/common/pointers.c
new file mode 100644
index 000000000..b2b1d3e8f
--- /dev/null
+++ b/bench-moerman2018/common/pointers.c
@@ -0,0 +1,24 @@
+#include <stdbool.h>
+
+void assign_pointer(void** dest, void* source1, void* source2, bool condition) {
+ if(condition) {
+ *dest = source1;
+ } else {
+ *dest = source2;
+ }
+}
+
+void* choose_pointer(void* source1, void* source2, bool condition) {
+ if(condition) {
+ return source1;
+ } else {
+ return source2;
+ }
+}
+
+int int_dereference_choice(int* source1, int* source2, bool condition) {
+ if(condition) {
+ return *source1;
+ }
+ return *source2;
+}
diff --git a/bench-moerman2018/file_operations/access_closed/01_simple_if.c b/bench-moerman2018/file_operations/access_closed/01_simple_if.c
new file mode 100644
index 000000000..ca40a50c8
--- /dev/null
+++ b/bench-moerman2018/file_operations/access_closed/01_simple_if.c
@@ -0,0 +1,56 @@
+#include <stdio.h>
+#include <stdlib.h>
+#include <stdbool.h>
+#include "access_closed.h"
+
+void access_closed_if_else(bool a, bool b) {
+ FILE* file;
+ int val = 0;
+
+#ifdef CATCH_BAD_PARAM
+ if(!a & !b) {
+ return;
+ }
+#endif
+
+ file = fopen("file.txt","r");
+
+ if(!file) {
+ return;
+ }
+
+ if(a) {
+ val = ((int) fgetc(file)) * 2;
+ } else {
+ val = (int) fgetc(file);
+ fclose(file);
+ }
+
+ if(b) {
+ val += 37;
+ } else {
+ val += (int) fgetc(file);
+ }
+
+ if(a) {
+ fclose(file);
+ }
+
+ printf("%i\n", val);
+}
+
+#ifndef NO_MAIN
+int main() {
+#ifdef NO_BUG
+ access_closed_if_else(true, true);
+ access_closed_if_else(true, false);
+ access_closed_if_else(false, true);
+#else
+ access_closed_if_else(true, true); /* OK */
+ access_closed_if_else(false, false); /* DANGER */
+ access_closed_if_else(false, true); /* OK */
+#endif
+
+ return 1;
+}
+#endif
diff --git a/bench-moerman2018/file_operations/access_closed/02_simple_if_int1.c b/bench-moerman2018/file_operations/access_closed/02_simple_if_int1.c
new file mode 100644
index 000000000..bd2d976fb
--- /dev/null
+++ b/bench-moerman2018/file_operations/access_closed/02_simple_if_int1.c
@@ -0,0 +1,55 @@
+#include <stdio.h>
+#include <stdlib.h>
+#include "access_closed.h"
+
+void access_closed_if_else_int1(int x, int y) {
+ int val = 0;
+ FILE* file;
+
+#ifdef CATCH_BAD_PARAM
+ if(x > 10 && x < y) {
+ return;
+ }
+#endif
+
+ file = fopen("file.txt","r");
+
+ if(!file) {
+ return;
+ }
+
+ if(x <= 10) {
+ val = ((int) fgetc(file)) * 2;
+ } else {
+ val = (int) fgetc(file);
+ fclose(file);
+ }
+
+ if(x >= y) {
+ val += 10;
+ } else {
+ val = ((int) fgetc(file)) * 2;
+ }
+
+ if(x <= 10) {
+ fclose(file);
+ }
+
+ printf("%i\n", val);
+}
+
+#ifndef NO_MAIN
+int main() {
+#ifdef NO_BUG
+ access_closed_if_else_int1(10, 10);
+ access_closed_if_else_int1(10, 11);
+ access_closed_if_else_int1(11, 11);
+#else
+ access_closed_if_else_int1(10, 10); /* OK */
+ access_closed_if_else_int1(11, 12); /* DANGER */
+ access_closed_if_else_int1(11, 11); /* OK */
+#endif
+
+ return 1;
+}
+#endif
diff --git a/bench-moerman2018/file_operations/access_closed/02_simple_if_int2.c b/bench-moerman2018/file_operations/access_closed/02_simple_if_int2.c
new file mode 100644
index 000000000..7473afcb4
--- /dev/null
+++ b/bench-moerman2018/file_operations/access_closed/02_simple_if_int2.c
@@ -0,0 +1,61 @@
+#include <stdio.h>
+#include <stdlib.h>
+#include "access_closed.h"
+
+void access_closed_if_else_int2(int x, int y) {
+ FILE* file;
+ int val = 0;
+ int m, n;
+
+ m = -1;
+ n = 5;
+
+ x = x*m+n;
+
+#ifdef CATCH_BAD_PARAM
+ if(x > 10 && x < y) {
+ return;
+ }
+#endif
+
+ file = fopen("file.txt","r");
+
+ if(!file) {
+ return;
+ }
+
+ if(x <= 10) {
+ val = ((int) fgetc(file)) * 2;
+ } else {
+ val = (int) fgetc(file);
+ fclose(file);
+ }
+
+ if(x >= y) {
+ val += 10;
+ } else {
+ val = ((int) fgetc(file)) * 2;
+ }
+
+ if(x <= 10) {
+ fclose(file);
+ }
+
+ printf("%i\n", val);
+}
+
+#ifndef NO_MAIN
+int main() {
+#ifdef NO_BUG
+ access_closed_if_else_int2(-5, 10);
+ access_closed_if_else_int2(-5, 11);
+ access_closed_if_else_int2(-6, 11);
+#else
+ access_closed_if_else_int2(-5, 10); /* OK */
+ access_closed_if_else_int2(-6, 12); /* DANGER */
+ access_closed_if_else_int2(-6, 11); /* OK */
+#endif
+
+ return 1;
+}
+#endif
diff --git a/bench-moerman2018/file_operations/access_closed/03_simple_if_multi_func.c b/bench-moerman2018/file_operations/access_closed/03_simple_if_multi_func.c
new file mode 100644
index 000000000..60ca39f74
--- /dev/null
+++ b/bench-moerman2018/file_operations/access_closed/03_simple_if_multi_func.c
@@ -0,0 +1,55 @@
+#include "access_closed.h"
+#include <stdbool.h>
+#include <stdlib.h>
+#include <stdio.h>
+
+static void conditional_close(FILE** ptr, bool condition) {
+ if(condition) {
+ fclose(*ptr);
+ }
+}
+
+static int conditional_fgetc(FILE** ptr, int def, bool condition) {
+ if(condition) {
+ return fgetc(*ptr);
+ }
+ return def;
+}
+
+void access_closed_if_else_multi(bool a, bool b) {
+ int val;
+ FILE* file;
+ FILE** file_ptr = &file;
+
+#ifdef CATCH_BAD_PARAM
+ if(!a & !b) {
+ return;
+ }
+#endif
+ file = fopen("file.txt","r");
+
+ if(!file) {
+ return;
+ }
+
+ conditional_close(file_ptr, !a);
+ val = conditional_fgetc(file_ptr, 897, !b);
+ conditional_close(file_ptr, a);
+
+ printf("%i\n", val);
+}
+
+#ifndef NO_MAIN
+int main() {
+#ifdef NO_BUG
+ access_closed_if_else_multi(true, true);
+ access_closed_if_else_multi(true, false);
+ access_closed_if_else_multi(false, true);
+#else
+ access_closed_if_else_multi(true, true); /* OK */
+ access_closed_if_else_multi(false, false); /* DANGER */
+ access_closed_if_else_multi(false, true); /* OK */
+#endif
+ return 1;
+}
+#endif
diff --git a/bench-moerman2018/file_operations/access_closed/04_simple_switch.c b/bench-moerman2018/file_operations/access_closed/04_simple_switch.c
new file mode 100644
index 000000000..5307d5301
--- /dev/null
+++ b/bench-moerman2018/file_operations/access_closed/04_simple_switch.c
@@ -0,0 +1,80 @@
+#include "access_closed.h"
+#include <stdbool.h>
+#include <stdlib.h>
+
+int access_closed_switch(int x, int y) {
+ FILE* file;
+ bool closed = false;
+ int val = 0;
+
+#ifdef CATCH_BAD_PARAM
+ if((x == 10 || x == 5) && x <= y) {
+ return -1;
+ }
+#endif
+ file = fopen("file.txt","r");
+
+ if(!file) {
+ return -1;
+ }
+
+ if(x > y) {
+ fclose(file);
+ closed = true;
+ }
+
+ switch (x) {
+ case 5: {
+ val = ((int) fgetc(file)); /* DANGER: x >= y */
+ break;
+ }
+ case 7: {
+ if(!closed) {
+ val = ((int) fgetc(file)) + 289;
+ } else {
+ val = 5687;
+ }
+ break;
+ }
+ case 10: {
+ val = ((int) fgetc(file)) + 36; /* DANGER: x >= y */
+ break;
+ }
+ case 12: {
+ if(!closed) {
+ val = ((int) fgetc(file)) + 49807;
+ } else {
+ val = 576;
+ }
+ break;
+ }
+ default: {
+ val = 7987;
+ break;
+ }
+ }
+
+ if(!closed) {
+ fclose(file);
+ }
+
+ return val;
+}
+
+#ifndef NO_MAIN
+int main() {
+#ifdef NO_BUG
+ access_closed_switch(5, 11);
+ access_closed_switch(10, 11);
+ access_closed_switch(11, 10);
+ access_closed_switch(7, 5);
+#else
+ access_closed_switch(5, 10); /* OK */
+ access_closed_switch(10, 9); /* DANGER */
+ access_closed_switch(11, 10); /* OK */
+ access_closed_switch(7, 5); /* OK */
+#endif
+
+ return 1;
+}
+#endif
diff --git a/bench-moerman2018/file_operations/access_closed/05_simple_goto.c b/bench-moerman2018/file_operations/access_closed/05_simple_goto.c
new file mode 100644
index 000000000..3c37b1b67
--- /dev/null
+++ b/bench-moerman2018/file_operations/access_closed/05_simple_goto.c
@@ -0,0 +1,46 @@
+#include <stdio.h>
+#include <stdlib.h>
+#include "access_closed.h"
+
+void access_closed_goto(int x) {
+ FILE* file = 0;
+ int val = 0;
+ int i = 0;
+
+#ifdef CATCH_BAD_PARAM
+ if(x > 0) {
+ return;
+ }
+#endif
+
+ file = fopen("file.txt","r");
+
+ if(!file) {
+ return;
+ }
+
+GOTO_LABEL:
+ if(i <= x) {
+ val += ((int) fgetc(file));
+ } else {
+ printf("%i\n", val);
+ }
+
+ if(i == 0) {
+ i++;
+ fclose(file);
+ goto GOTO_LABEL;
+ }
+}
+
+#ifndef NO_MAIN
+int main() {
+#ifdef NO_BUG
+ access_closed_goto(0);
+#else
+ access_closed_goto(1);
+#endif
+
+ return 1;
+}
+#endif
diff --git a/bench-moerman2018/file_operations/access_closed/06_simple_pass_by_reference.c b/bench-moerman2018/file_operations/access_closed/06_simple_pass_by_reference.c
new file mode 100644
index 000000000..ac7d59ee7
--- /dev/null
+++ b/bench-moerman2018/file_operations/access_closed/06_simple_pass_by_reference.c
@@ -0,0 +1,59 @@
+#include <stdio.h>
+#include <stdlib.h>
+#include <stdbool.h>
+#include "access_closed.h"
+
+static int assign_possibly_closed(FILE** dest, bool close_file) {
+ int val;
+ FILE* file = fopen("file.txt","r");
+ *dest = file;
+ if(!file) {
+ return -1;
+ }
+ val = (int) fgetc(file);
+ if(close_file) {
+ fclose(file);
+ }
+ return val;
+}
+
+void access_closed_pass_by_reference(bool a, bool b) {
+ FILE* file;
+ int val;
+
+#ifdef CATCH_BAD_PARAM
+ if(!a & !b) {
+ return;
+ }
+#endif
+
+ val = assign_possibly_closed(&file, !a);
+
+ if(!b && file) {
+ val += (int) fgetc(file);
+ } else {
+ val += 687;
+ }
+
+ if(a && file) {
+ fclose(file);
+ }
+
+ printf("%i\n", val);
+}
+
+#ifndef NO_MAIN
+int main() {
+#ifdef NO_BUG
+ access_closed_pass_by_reference(true, true);
+ access_closed_pass_by_reference(true, false);
+ access_closed_pass_by_reference(false, true);
+#else
+ access_closed_pass_by_reference(true, true); /* OK */
+ access_closed_pass_by_reference(false, false); /* DANGER */
+ access_closed_pass_by_reference(false, true); /* OK */
+#endif
+
+ return 1;
+}
+#endif
diff --git a/bench-moerman2018/file_operations/access_closed/07_cross_file.c b/bench-moerman2018/file_operations/access_closed/07_cross_file.c
new file mode 100644
index 000000000..97c3d38da
--- /dev/null
+++ b/bench-moerman2018/file_operations/access_closed/07_cross_file.c
@@ -0,0 +1,50 @@
+#include "access_closed.h"
+#include "common.h"
+#include <stdbool.h>
+#include <stdio.h>
+#include <stdlib.h>
+
+void access_closed_cross_file(bool a, bool b) {
+ int val;
+ FILE* file;
+
+#ifdef CATCH_BAD_PARAM
+ if(!a & !b) {
+ return;
+ }
+#endif
+ file = fopen("file.txt","r");
+
+ if(!file) {
+ return;
+ }
+
+ conditional_close(file, !a, 0);
+
+ if(b) {
+ val = 678;
+ } else {
+ val = (int) fgetc(file);
+ }
+
+ if(a) {
+ fclose(file);
+ }
+
+ printf("%i\n", val);
+}
+
+#ifndef NO_MAIN
+int main() {
+#ifdef NO_BUG
+ access_closed_cross_file(true, true);
+ access_closed_cross_file(true, false);
+ access_closed_cross_file(false, true);
+#else
+ access_closed_cross_file(true, true); /* OK */
+ access_closed_cross_file(false, false); /* DANGER */
+ access_closed_cross_file(false, true); /* OK */
+#endif
+ return 1;
+}
+#endif
diff --git a/bench-moerman2018/file_operations/access_closed/08_loop_for.c b/bench-moerman2018/file_operations/access_closed/08_loop_for.c
new file mode 100644
index 000000000..60408ce78
--- /dev/null
+++ b/bench-moerman2018/file_operations/access_closed/08_loop_for.c
@@ -0,0 +1,56 @@
+#include <stdio.h>
+#include <stdbool.h>
+#include <stdlib.h>
+#include "access_closed.h"
+
+void access_closed_for(int x) {
+ FILE* file;
+ int val = 0;
+ int i;
+
+#ifdef CATCH_BAD_PARAM
+ if(x < 10) {
+ return;
+ }
+#endif
+
+ file = fopen("file1.txt","r");
+
+ if(!file) {
+ return;
+ }
+
+ val = (int) fgetc(file);
+
+ fclose(file);
+
+ for(i = 0; i < 20; i++) {
+ if(i > x) {
+ val += (int) fgetc(file);
+ } else {
+ val += 24;
+ }
+ if(i == 10) {
+ file = fopen("file2.txt","r");
+ if(!file) {
+ return;
+ }
+ }
+ }
+
+ fclose(file);
+
+ printf("%i\n", val);
+}
+
+#ifndef NO_MAIN
+int main() {
+#ifdef NO_BUG
+ access_closed_for(10);
+#else
+ access_closed_for(9);
+#endif
+
+ return 1;
+}
+#endif
diff --git a/bench-moerman2018/file_operations/access_closed/09_loop_for_complex.c b/bench-moerman2018/file_operations/access_closed/09_loop_for_complex.c
new file mode 100644
index 000000000..d4c2ba096
--- /dev/null
+++ b/bench-moerman2018/file_operations/access_closed/09_loop_for_complex.c
@@ -0,0 +1,59 @@
+#include <stdio.h>
+#include <stdlib.h>
+#include "access_closed.h"
+
+void access_closed_for_complex(int x) {
+ FILE* file;
+ int val = 0;
+ int i = 0;
+
+#ifdef CATCH_BAD_PARAM
+ if(x < 10) {
+ return;
+ }
+#endif
+
+ file = fopen("file1.txt","r");
+
+ if(!file) {
+ return;
+ }
+
+ val = (int) fgetc(file);
+
+ fclose(file);
+
+ for(;;) {
+ if(i > x) {
+ val += (int) fgetc(file);
+ } else {
+ val += 24;
+ }
+ if(i == 10) {
+ file = fopen("file2.txt","r");
+ if(!file) {
+ return;
+ }
+ }
+ i++;
+ if(i >= 20) {
+ break;
+ }
+ }
+
+ fclose(file);
+
+ printf("%i\n", val);
+}
+
+#ifndef NO_MAIN
+int main() {
+#ifdef NO_BUG
+ access_closed_for_complex(10);
+#else
+ access_closed_for_complex(9);
+#endif
+
+ return 1;
+}
+#endif
diff --git a/bench-moerman2018/file_operations/access_closed/10_loop_while_continue.c b/bench-moerman2018/file_operations/access_closed/10_loop_while_continue.c
new file mode 100644
index 000000000..c711e56c7
--- /dev/null
+++ b/bench-moerman2018/file_operations/access_closed/10_loop_while_continue.c
@@ -0,0 +1,63 @@
+#include <stdio.h>
+#include <stdlib.h>
+#include "access_closed.h"
+
+void access_closed_while_continue(int x) {
+ FILE* file;
+ int val = 0;
+ int i = 0;
+
+#ifdef CATCH_BAD_PARAM
+ if(x < 10) {
+ return;
+ }
+#endif
+
+ file = fopen("file1.txt","r");
+
+ if(!file) {
+ return;
+ }
+
+ val = (int) fgetc(file);
+
+ fclose(file);
+
+ while(i < 30) {
+ if(i == 9) {
+ i++;
+ continue;
+ }
+ if(i > x) {
+ val += (int) fgetc(file);
+ } else {
+ val += 24;
+ }
+ if(i == 10) {
+ file = fopen("file2.txt","r");
+ if(!file) {
+ return;
+ }
+ }
+ i++;
+ if(i < 20) {
+ continue;
+ }
+ }
+
+ fclose(file);
+
+ printf("%i\n", val);
+}
+
+#ifndef NO_MAIN
+int main() {
+#ifdef NO_BUG
+ access_closed_while_continue(10);
+#else
+ access_closed_while_continue(9);
+#endif
+
+ return 1;
+}
+#endif
diff --git a/bench-moerman2018/file_operations/access_closed/11_loop_while_do_continue.c b/bench-moerman2018/file_operations/access_closed/11_loop_while_do_continue.c
new file mode 100644
index 000000000..2cf898ca6
--- /dev/null
+++ b/bench-moerman2018/file_operations/access_closed/11_loop_while_do_continue.c
@@ -0,0 +1,63 @@
+#include <stdio.h>
+#include <stdlib.h>
+#include "access_closed.h"
+
+void access_closed_do_while_continue(int x) {
+ FILE* file;
+ int val = 0;
+ int i = 0;
+
+#ifdef CATCH_BAD_PARAM
+ if(x < 10) {
+ return;
+ }
+#endif
+
+ file = fopen("file1.txt","r");
+
+ if(!file) {
+ return;
+ }
+
+ val = (int) fgetc(file);
+
+ fclose(file);
+
+ do {
+ if(i == 8) {
+ i++;
+ continue;
+ }
+ if(i > x) {
+ val += (int) fgetc(file);
+ } else {
+ val += 24;
+ }
+ if(i == 10) {
+ file = fopen("file2.txt","r");
+ if(!file) {
+ return;
+ }
+ }
+ i++;
+ if(i < 20) {
+ continue;
+ }
+ } while(i < 30);
+
+ fclose(file);
+
+ printf("%i\n", val);
+}
+
+#ifndef NO_MAIN
+int main() {
+#ifdef NO_BUG
+ access_closed_do_while_continue(10);
+#else
+ access_closed_do_while_continue(9);
+#endif
+
+ return 1;
+}
+#endif
diff --git a/bench-moerman2018/file_operations/access_closed/12_loop_for_array_branching.c b/bench-moerman2018/file_operations/access_closed/12_loop_for_array_branching.c
new file mode 100644
index 000000000..f9ac04c8c
--- /dev/null
+++ b/bench-moerman2018/file_operations/access_closed/12_loop_for_array_branching.c
@@ -0,0 +1,50 @@
+#include <stdio.h>
+#include <stdlib.h>
+#include <stdbool.h>
+#include "access_closed.h"
+
+void access_closed_for_array(int x) {
+ FILE* file = 0;
+ int p[20];
+ int val = 0;
+ int i;
+
+#ifdef CATCH_BAD_PARAM
+ if(x != 19) {
+ return;
+ }
+#endif
+
+ file = fopen("file.txt","r");
+
+ if(!file) {
+ return;
+ }
+
+ for(i = 0; i < 20; i++) {
+ p[i] = 0;
+ }
+ p[x] = 1;
+
+ for(i = 0; i < 20; i++) {
+ if(p[i] == 1) {
+ fclose(file);
+ } else {
+ val += ((int) fgetc(file)) + i;
+ }
+ }
+
+ printf("%i\n", val);
+}
+
+#ifndef NO_MAIN
+int main() {
+#ifdef NO_BUG
+ access_closed_for_array(19);
+#else
+ access_closed_for_array(10);
+#endif
+
+ return 1;
+}
+#endif
diff --git a/bench-moerman2018/file_operations/access_closed/13_loop_for_pointer_arithmetic.c b/bench-moerman2018/file_operations/access_closed/13_loop_for_pointer_arithmetic.c
new file mode 100644
index 000000000..ffbbe95b5
--- /dev/null
+++ b/bench-moerman2018/file_operations/access_closed/13_loop_for_pointer_arithmetic.c
@@ -0,0 +1,71 @@
+#include <stdlib.h>
+#include <stdio.h>
+#include "access_closed.h"
+
+static void initialize_array(FILE* ptr_arr[], int length) {
+ int i;
+ FILE** ptr = ptr_arr;
+
+ for(i = 0; i < length; i++, ptr++) {
+ *ptr = fopen("file.txt","r");
+ }
+}
+
+static void close_backwards(FILE** ptr, int to_close) {
+ int i;
+
+ for(i = 0; i < to_close; i++, ptr--) {
+ if(*ptr) fclose(*ptr);
+ }
+}
+
+static void close_forwards(FILE** ptr, int to_close) {
+ int i;
+
+ for(i = 0; i < to_close; i++, ptr++) {
+ if(*ptr) fclose(*ptr);
+ }
+}
+
+void access_closed_for_pointer(int x) {
+ FILE* pointers[10];
+ FILE** ptr;
+ int val = 0, i;
+
+ if(x > 10 || x < 0) {
+ return;
+ }
+
+#ifdef CATCH_BAD_PARAM
+ if(x > 5) {
+ return;
+ }
+#endif
+
+ initialize_array(pointers, 10);
+ close_backwards(pointers + 9, x);
+
+ ptr = pointers;
+ for(int i = 0; i < 5; i++, ptr++) {
+ if(*ptr) {
+ val += (int) fgetc(*ptr);
+ } else {
+ val--;
+ }
+ }
+
+ close_forwards(pointers, 10 - x);
+ printf("%i\n", val);
+}
+
+#ifndef NO_MAIN
+int main() {
+#ifdef NO_BUG
+ access_closed_for_pointer(4);
+#else
+ access_closed_for_pointer(6);
+#endif
+
+ return 1;
+}
+#endif
diff --git a/bench-moerman2018/file_operations/access_closed/14_loop_recursion.c b/bench-moerman2018/file_operations/access_closed/14_loop_recursion.c
new file mode 100644
index 000000000..b9b2bb608
--- /dev/null
+++ b/bench-moerman2018/file_operations/access_closed/14_loop_recursion.c
@@ -0,0 +1,58 @@
+#include <stdio.h>
+#include <stdbool.h>
+#include <stdlib.h>
+#include "access_closed.h"
+
+int access_closed_rec(int x, int i, FILE** file_ptr) {
+ int val;
+
+#ifdef CATCH_BAD_PARAM
+ if(x > 10) {
+ return -1;
+ }
+#endif
+
+ if(i <= 1) {
+ if(*file_ptr) fclose(*file_ptr);
+ *file_ptr = 0;
+ return 0;
+ }
+
+ if(i > 19 && !*file_ptr) {
+ *file_ptr = fopen("file.txt", "r");
+ return access_closed_rec(x, i-1, file_ptr);
+ }
+ if(i == 19) {
+ if(*file_ptr) {
+ fclose(*file_ptr);
+ }
+ return access_closed_rec(x, i-1, file_ptr);
+ }
+
+ if(i < x && *file_ptr) {
+ val = (int) fgetc(*file_ptr);
+ } else {
+ val = 8;
+ }
+ if(i == 10 && !*file_ptr) {
+ *file_ptr = fopen("file.txt","r");
+ if(!*file_ptr) return -1;
+ }
+
+ return val + access_closed_rec(x, i-1, file_ptr);
+}
+
+#ifndef NO_MAIN
+int main() {
+ FILE* file = 0;
+#ifdef NO_BUG
+ printf("%i\n", access_closed_rec(10, 20, &file));
+ file = fopen("file.txt", "r");
+ printf("%i\n", access_closed_rec(11, 18, &file));
+#else
+ printf("%i\n", access_closed_rec(11, 20, &file));
+#endif
+
+ return 1;
+}
+#endif
diff --git a/bench-moerman2018/file_operations/access_closed/15_loop_recursion_multi.c b/bench-moerman2018/file_operations/access_closed/15_loop_recursion_multi.c
new file mode 100644
index 000000000..58717a813
--- /dev/null
+++ b/bench-moerman2018/file_operations/access_closed/15_loop_recursion_multi.c
@@ -0,0 +1,61 @@
+#include <stdio.h>
+#include <stdbool.h>
+#include <stdlib.h>
+#include "access_closed.h"
+
+int access_closed_rec_decr(int x, int i, FILE** file_ptr) {
+ if(i <= 1) {
+ if(*file_ptr) fclose(*file_ptr);
+ *file_ptr = 0;
+ return 0;
+ }
+
+ return access_closed_rec_multi(x, i-1, file_ptr);
+}
+
+int access_closed_rec_multi(int x, int i, FILE** file_ptr) {
+ int val;
+
+#ifdef CATCH_BAD_PARAM
+ if(x > 10 && i > 18) {
+ return -1;
+ }
+#endif
+ if(i > 19 && !*file_ptr) {
+ *file_ptr = fopen("file.txt", "r");
+ access_closed_rec_decr(x, i, file_ptr);
+ }
+ if(i == 19) {
+ if(*file_ptr) {
+ fclose(*file_ptr);
+ }
+ access_closed_rec_decr(x, i, file_ptr);
+ }
+
+ if(i < x && *file_ptr) {
+ val = (int) fgetc(*file_ptr);
+ } else {
+ val = 8;
+ }
+ if(i == 10 && !*file_ptr) {
+ *file_ptr = fopen("file.txt","r");
+ if(!*file_ptr) return -1;
+ }
+
+ return val + access_closed_rec_decr(x, i, file_ptr);
+}
+
+#ifndef NO_MAIN
+int main() {
+ FILE* file = 0;
+#ifdef NO_BUG
+ printf("%i\n", access_closed_rec_multi(10, 20, &file));
+ file = fopen("file.txt", "r");
+ printf("%i\n", access_closed_rec_multi(11, 18, &file));
+#else
+ printf("%i\n", access_closed_rec_multi(11, 20, &file));
+#endif
+
+ return 1;
+}
+#endif
diff --git a/bench-moerman2018/file_operations/access_closed/16_misc_pseudo_recursion.c b/bench-moerman2018/file_operations/access_closed/16_misc_pseudo_recursion.c
new file mode 100644
index 000000000..a4a0f6f12
--- /dev/null
+++ b/bench-moerman2018/file_operations/access_closed/16_misc_pseudo_recursion.c
@@ -0,0 +1,65 @@
+#include <stdio.h>
+#include <stdlib.h>
+#include "access_closed.h"
+
+int access_closed_pseudo_rec1(int x, int y, int i, FILE** file_ptr) {
+ int val;
+#ifdef CATCH_BAD_PARAM
+ if(x >= y && x < 10) {
+ return -1;
+ }
+#endif
+
+ if(!*file_ptr) {
+ return -1;
+ }
+
+ val = ((int) fgetc(*file_ptr));
+
+ if(i > 0) {
+ fclose(*file_ptr);
+ return 37;
+ }
+
+ if(x < y) {
+ fclose(*file_ptr);
+ } else {
+ fgetc(*file_ptr);
+ }
+
+ return val + access_closed_pseudo_rec2(x, y, 1, file_ptr);
+}
+
+int access_closed_pseudo_rec2(int x, int y, int i, FILE** file_ptr) {
+ int val = 78;
+ if(i > 0) {
+ if(x < 10) {
+ val -= ((int) fgetc(*file_ptr));
+ } else {
+ val += 2;
+ }
+
+ if(x >= y) {
+ fclose(*file_ptr);
+ *file_ptr = 0;
+ }
+ return val;
+ }
+
+ return 5 + access_closed_pseudo_rec1(x, y, 1, file_ptr);
+}
+
+#ifndef NO_MAIN
+int main() {
+ FILE* file = fopen("file.txt", "r");
+#ifdef NO_BUG
+ printf("%i\n", access_closed_pseudo_rec1(9, 10, 0, &file));
+ file = fopen("file.txt", "r");
+ printf("%i\n", access_closed_pseudo_rec1(11, 10, 0, &file));
+#else
+ printf("%i\n", access_closed_pseudo_rec1(9, 8, 0, &file));
+#endif
+
+ return 1;
+}
+#endif
diff --git a/bench-moerman2018/file_operations/access_closed/17_complex_function_pointers.c b/bench-moerman2018/file_operations/access_closed/17_complex_function_pointers.c
new file mode 100644
index 000000000..f69f8dd0a
--- /dev/null
+++ b/bench-moerman2018/file_operations/access_closed/17_complex_function_pointers.c
@@ -0,0 +1,59 @@
+#include <stdio.h>
+#include <stdbool.h>
+#include <stdlib.h>
+#include "access_closed.h"
+
+static int assign_possibly_closed(FILE** dest, bool close_file) {
+ int val;
+ FILE* file = fopen("file.txt","r");
+ *dest = file;
+ if(!file) {
+ return -1;
+ }
+ val = (int) fgetc(file);
+ if(close_file) {
+ fclose(file);
+ }
+ return val;
+}
+
+void access_closed_function_pointer(bool a, bool b, int (*f)(FILE** dest, bool close_file)) {
+ FILE* file;
+ int val = 0;
+
+#ifdef CATCH_BAD_PARAM
+ if(!f || (!a & !b)) {
+ return;
+ }
+#endif
+
+ val = (*f)(&file, a);
+
+ if(!b && file) {
+ val += (int) fgetc(file);
+ } else {
+ val += 687;
+ }
+
+ if(a && file) {
+ fclose(file);
+ }
+
+ printf("%i\n", val);
+}
+
+#ifndef NO_MAIN
+int main() {
+#ifdef NO_BUG
+ access_closed_function_pointer(true, true, &assign_possibly_closed);
+ access_closed_function_pointer(true, false, &assign_possibly_closed);
+ access_closed_function_pointer(false, true, &assign_possibly_closed);
+#else
+ access_closed_function_pointer(true, true, &assign_possibly_closed); /* OK */
+ access_closed_function_pointer(false, false, &assign_possibly_closed); /* DANGER */
+ access_closed_function_pointer(false, true, &assign_possibly_closed); /* OK */
+#endif
+
+ return 1;
+}
+#endif
diff --git a/bench-moerman2018/file_operations/access_closed/18_complex_struct_multiple_methods.c b/bench-moerman2018/file_operations/access_closed/18_complex_struct_multiple_methods.c
new file mode 100644
index 000000000..796c8c89e
--- /dev/null
+++ b/bench-moerman2018/file_operations/access_closed/18_complex_struct_multiple_methods.c
@@ -0,0 +1,93 @@
+#include <stdio.h>
+#include <stdlib.h>
+#include "access_closed.h"
+
+#ifndef s_FILES_AC_REFCOUNT
+#define s_FILES_AC_REFCOUNT
+void access_closed_cont_init(FileCont* cont) {
+ cont->refc = 1;
+ cont->file = 0;
+}
+
+FileCont* access_closed_cont_new() {
+ FileCont* new_cont;
+
+ new_cont = malloc(sizeof(FileCont));
+
+ if(new_cont) {
+ access_closed_cont_init(new_cont);
+ }
+ return new_cont;
+}
+
+void access_closed_cont_ref(FileCont* cont) {
+ if(cont) {
+ cont->refc++;
+ }
+}
+void access_closed_cont_unref(FileCont* cont) {
+ if(cont->refc <= 1) {
+ fclose(cont->file);
+ } else {
+ cont->refc--;
+ }
+}
+
+FILE* access_closed_cont_get_file(FileCont* cont) {
+ return cont->file;
+}
+void access_closed_cont_set_file(FileCont* cont, FILE* file) {
+ cont->file = file;
+}
+#endif //s_FILES_AC_REFCOUNT
+
+void access_closed_struct(int x, int y) {
+ FileCont cont;
+ FILE* file;
+ int val = 78;
+
+#ifdef CATCH_BAD_PARAM
+ if(x > 10 && x <= y) {
+ return;
+ }
+#endif
+
+ file = fopen("file.txt","r");
+
+ if(!file) {
+ return;
+ }
+
+ access_closed_cont_init(&cont);
+ access_closed_cont_set_file(&cont, file);
+
+ if(x <= y) {
+ fclose(access_closed_cont_get_file(&cont));
+ }
+
+ if(x > 10) {
+ val = (int) fgetc(file);
+ } else {
+ val = val * 2;
+ }
+
+ if(x > y) {
+ fclose(access_closed_cont_get_file(&cont));
+ }
+
+ printf("%i\n", val);
+}
+
+#ifndef NO_MAIN
+int main() {
+#ifdef NO_BUG
+ access_closed_struct(9, 10);
+ access_closed_struct(10, 11);
+ access_closed_struct(11, 10);
+#else
+ access_closed_struct(11, 11); /* DANGER */
+#endif
+
+ return 1;
+}
+#endif
diff --git a/bench-moerman2018/file_operations/access_closed/19_complex_refcount.c b/bench-moerman2018/file_operations/access_closed/19_complex_refcount.c
new file mode 100644
index 000000000..7f8af5029
--- /dev/null
+++ b/bench-moerman2018/file_operations/access_closed/19_complex_refcount.c
@@ -0,0 +1,79 @@
+#include "access_closed.h"
+#include <stdlib.h>
+#include <stdio.h>
+
+#ifndef s_FILES_AC_REFCOUNT
+#define s_FILES_AC_REFCOUNT
+void access_closed_cont_init(FileCont* cont) {
+ cont->refc = 1;
+ cont->file = 0;
+}
+
+FileCont* access_closed_cont_new() {
+ FileCont* new_cont;
+
+ new_cont = malloc(sizeof(FileCont));
+
+ if(new_cont) {
+ access_closed_cont_init(new_cont);
+ }
+ return new_cont;
+}
+
+void access_closed_cont_ref(FileCont* cont) {
+ if(cont) {
+ cont->refc++;
+ }
+}
+void access_closed_cont_unref(FileCont* cont) {
+ if(cont->refc <= 1) {
+ if(cont->file) fclose(cont->file);
+ } else {
+ cont->refc--;
+ }
+}
+
+FILE* access_closed_cont_get_file(FileCont* cont) {
+ return cont->file;
+}
+void access_closed_cont_set_file(FileCont* cont, FILE* file) {
+ cont->file = file;
+}
+#endif //s_FILES_AC_REFCOUNT
+
+#ifndef NO_MAIN
+int main() {
+ FileCont* cont;
+ FILE* file;
+ int val;
+
+ file = fopen("file.txt", "r");
+ if(!file) {
+ return -1;
+ }
+
+ cont = access_closed_cont_new();
+ if(!cont) {
+ fclose(file);
+ return 1;
+ }
+ access_closed_cont_set_file(cont, file);
+
+ access_closed_cont_ref(cont);
+ access_closed_cont_ref(cont);
+ access_closed_cont_unref(cont);
+ access_closed_cont_unref(cont);
+#ifdef NO_BUG
+ val = ((int) fgetc(access_closed_cont_get_file(cont)));
+ access_closed_cont_unref(cont);
+#else
+ access_closed_cont_unref(cont);
+ val = ((int) fgetc(access_closed_cont_get_file(cont)));
+#endif
+ free(cont);
+
+ printf("%i\n", val);
+
+ return 1;
+}
+#endif
diff --git a/bench-moerman2018/file_operations/access_closed/access_closed.h b/bench-moerman2018/file_operations/access_closed/access_closed.h
new file mode 100644
index 000000000..2c22086e8
--- /dev/null
+++ b/bench-moerman2018/file_operations/access_closed/access_closed.h
@@ -0,0 +1,37 @@
+#include <stdbool.h>
+#include <stdio.h>
+
+typedef struct _ResLeakRefCont FileCont;
+
+struct _ResLeakRefCont {
+ FILE* file;
+ unsigned int refc;
+};
+
+void access_closed_cont_init(FileCont* cont);
+FileCont* access_closed_cont_new();
+void access_closed_cont_ref(FileCont* cont);
+void access_closed_cont_unref(FileCont* cont);
+FILE* access_closed_cont_get_file(FileCont* cont);
+void access_closed_cont_set_file(FileCont* cont, FILE* file);
+
+void access_closed_for(int x);
+void access_closed_for_complex(int x);
+void access_closed_while_continue(int x);
+void access_closed_do_while_continue(int x);
+void access_closed_for_array(int x);
+void access_closed_for_pointer(int x);
+void access_closed_goto(int x);
+void access_closed_if_else(bool a, bool b);
+void access_closed_if_else_multi(bool a, bool b);
+void access_closed_if_else_int1(int x, int y);
+void access_closed_if_else_int2(int x, int y);
+void access_closed_pass_by_reference(bool a, bool b);
+int access_closed_switch(int x, int y);
+int access_closed_rec_multi(int x, int i, FILE** file_pt);
+int access_closed_rec(int x, int i, FILE** file_ptr);
+int access_closed_pseudo_rec1(int x, int y, int i, FILE** file_ptr);
+int access_closed_pseudo_rec2(int x, int y, int i, FILE** file_ptr);
+void access_closed_struct(int x, int y);
+void access_closed_function_pointer(bool a, bool b, int (*f)(FILE** dest, bool close_file));
+void access_closed_cross_file(bool a, bool b);
diff --git a/bench-moerman2018/file_operations/double_close/01_simple_if.c b/bench-moerman2018/file_operations/double_close/01_simple_if.c
new file mode 100644
index 000000000..c1bb6a370
--- /dev/null
+++ b/bench-moerman2018/file_operations/double_close/01_simple_if.c
@@ -0,0 +1,56 @@
+#include <stdio.h>
+#include <stdlib.h>
+#include <stdbool.h>
+#include "double_close.h"
+
+void double_close_if_else(bool a, bool b) {
+ FILE* file;
+ int val = 0;
+
+#ifdef CATCH_BAD_PARAM
+ if(!a & !b) {
+ return;
+ }
+#endif
+
+ file = fopen("file.txt","r");
+
+ if(!file) {
+ return;
+ }
+
+ if(a) {
+ val = ((int) fgetc(file)) * 2;
+ } else {
+ val = (int) fgetc(file);
+ fclose(file);
+ }
+
+ if(b) {
+ val += 37;
+ } else {
+ fclose(file);
+ }
+
+ if(a & b) {
+ fclose(file);
+ }
+
+ printf("%i\n", val);
+}
+
+#ifndef NO_MAIN
+int main() {
+#ifdef NO_BUG
+ double_close_if_else(true, true);
+ double_close_if_else(true, false);
+ double_close_if_else(false, true);
+#else
+ double_close_if_else(true, true); /* OK */
+ double_close_if_else(false, false); /* DANGER */
+ double_close_if_else(false, true); /* OK */
+#endif
+
+ return 1;
+}
+#endif
diff --git a/bench-moerman2018/file_operations/double_close/02_simple_if_int1.c b/bench-moerman2018/file_operations/double_close/02_simple_if_int1.c
new file mode 100644
index 000000000..2697d674a
--- /dev/null
+++ b/bench-moerman2018/file_operations/double_close/02_simple_if_int1.c
@@ -0,0 +1,55 @@
+#include <stdio.h>
+#include <stdlib.h>
+#include "double_close.h"
+
+void double_close_if_else_int1(int x, int y) {
+ int val = 0;
+ FILE* file;
+
+#ifdef CATCH_BAD_PARAM
+ if(x > 10 && x < y) {
+ return;
+ }
+#endif
+
+ file = fopen("file.txt","r");
+
+ if(!file) {
+ return;
+ }
+
+ if(x <= 10) {
+ val = ((int) fgetc(file)) * 2;
+ } else {
+ val = (int) fgetc(file);
+ fclose(file);
+ }
+
+ if(x >= y) {
+ val += 37;
+ } else {
+ fclose(file);
+ }
+
+ if(x <= 10 && x >= y) {
+ fclose(file);
+ }
+
+ printf("%i\n", val);
+}
+
+#ifndef NO_MAIN
+int main() {
+#ifdef NO_BUG
+ double_close_if_else_int1(10, 10);
+ double_close_if_else_int1(10, 11);
+ double_close_if_else_int1(11, 11);
+#else
+ double_close_if_else_int1(10, 10); /* OK */
+ double_close_if_else_int1(11, 12); /* DANGER */
+ double_close_if_else_int1(11, 11); /* OK */
+#endif
+
+ return 1;
+}
+#endif
diff --git a/bench-moerman2018/file_operations/double_close/02_simple_if_int2.c b/bench-moerman2018/file_operations/double_close/02_simple_if_int2.c
new file mode 100644
index 000000000..6b3181c51
--- /dev/null
+++ b/bench-moerman2018/file_operations/double_close/02_simple_if_int2.c
@@ -0,0 +1,61 @@
+#include <stdio.h>
+#include <stdlib.h>
+#include "double_close.h"
+
+void double_close_if_else_int2(int x, int y) {
+ FILE* file;
+ int val = 0;
+ int m, n;
+
+ m = -1;
+ n = 5;
+
+ x = x*m+n;
+
+#ifdef CATCH_BAD_PARAM
+ if(x > 10 && x < y) {
+ return;
+ }
+#endif
+
+ file = fopen("file.txt","r");
+
+ if(!file) {
+ return;
+ }
+
+ if(x <= 10) {
+ val = ((int) fgetc(file)) * 2;
+ } else {
+ val = (int) fgetc(file);
+ fclose(file);
+ }
+
+ if(x >= y) {
+ val += 37;
+ } else {
+ fclose(file);
+ }
+
+ if(x <= 10 && x >= y) {
+ fclose(file);
+ }
+
+ printf("%i\n", val);
+}
+
+#ifndef NO_MAIN
+int main() {
+#ifdef NO_BUG
+ double_close_if_else_int2(-5, 10);
+ double_close_if_else_int2(-5, 11);
+ double_close_if_else_int2(-6, 11);
+#else
+ double_close_if_else_int2(-5, 10); /* OK */
+ double_close_if_else_int2(-6, 12); /* DANGER */
+ double_close_if_else_int2(-6, 11); /* OK */
+#endif
+
+ return 1;
+}
+#endif
diff --git a/bench-moerman2018/file_operations/double_close/03_simple_if_multi_func.c b/bench-moerman2018/file_operations/double_close/03_simple_if_multi_func.c
new file mode 100644
index 000000000..910d848ee
--- /dev/null
+++ b/bench-moerman2018/file_operations/double_close/03_simple_if_multi_func.c
@@ -0,0 +1,56 @@
+#include "double_close.h"
+#include <stdbool.h>
+#include <stdlib.h>
+#include <stdio.h>
+
+static void conditional_close(FILE** ptr, bool condition) {
+ if(condition) {
+ fclose(*ptr);
+ }
+}
+
+static int conditional_fgetc(FILE** ptr, int def, bool condition) {
+ if(condition) {
+ return fgetc(*ptr);
+ }
+ return def;
+}
+
+void double_close_if_else_multi(bool a, bool b) {
+ int val;
+ FILE* file;
+ FILE** file_ptr = &file;
+
+#ifdef CATCH_BAD_PARAM
+ if(!a & !b) {
+ return;
+ }
+#endif
+ file = fopen("file.txt","r");
+
+ if(!file) {
+ return;
+ }
+
+ conditional_close(file_ptr, !a);
+ val = conditional_fgetc(file_ptr, 897, b & a);
+ conditional_close(file_ptr, !b);
+ conditional_close(file_ptr, a & b);
+
+ printf("%i\n", val);
+}
+
+#ifndef NO_MAIN
+int main() {
+#ifdef NO_BUG
+ double_close_if_else_multi(true, true);
+ double_close_if_else_multi(true, false);
+ double_close_if_else_multi(false, true);
+#else
+ double_close_if_else_multi(true, true); /* OK */
+ double_close_if_else_multi(false, false); /* DANGER */
+ double_close_if_else_multi(false, true); /* OK */
+#endif
+ return 1;
+}
+#endif
diff --git a/bench-moerman2018/file_operations/double_close/04_simple_switch.c b/bench-moerman2018/file_operations/double_close/04_simple_switch.c
new file mode 100644
index 000000000..0291ec212
--- /dev/null
+++ b/bench-moerman2018/file_operations/double_close/04_simple_switch.c
@@ -0,0 +1,82 @@
+#include "double_close.h"
+#include <stdbool.h>
+#include <stdlib.h>
+
+int double_close_switch(int x, int y) {
+ FILE* file;
+ bool closed = false;
+ int val = 0;
+
+#ifdef CATCH_BAD_PARAM
+ if((x == 10 || x == 5) && x <= y) {
+ return -1;
+ }
+#endif
+ file = fopen("file.txt","r");
+
+ if(!file) {
+ return -1;
+ }
+
+ if(x > y) {
+ fclose(file);
+ closed = true;
+ }
+
+ switch (x) {
+ case 5: {
+ fclose(file); /* DANGER: x >= y */
+ val = val * 5;
+ break;
+ }
+ case 7: {
+ if(!closed) {
+ val = ((int) fgetc(file)) + 289;
+ } else {
+ val = 5687;
+ }
+ break;
+ }
+ case 10: {
+ fclose(file); /* DANGER: x >= y */
+ val = val * 2;
+ break;
+ }
+ case 12: {
+ if(!closed) {
+ val = ((int) fgetc(file)) + 49807;
+ } else {
+ val = 576;
+ }
+ break;
+ }
+ default: {
+ val = 7987;
+ break;
+ }
+ }
+
+ if(!closed) {
+ fclose(file);
+ }
+
+ return val;
+}
+
+#ifndef NO_MAIN
+int main() {
+#ifdef NO_BUG
+ double_close_switch(5, 11);
+ double_close_switch(10, 11);
+ double_close_switch(11, 10);
+ double_close_switch(7, 5);
+#else
+ double_close_switch(5, 10); /* OK */
+ double_close_switch(10, 9); /* DANGER */
+ double_close_switch(11, 10); /* OK */
+ double_close_switch(7, 5); /* OK */
+#endif
+
+ return 1;
+}
+#endif
diff --git a/bench-moerman2018/file_operations/double_close/05_simple_goto.c b/bench-moerman2018/file_operations/double_close/05_simple_goto.c
new file mode 100644
index 000000000..0a4c928f9
--- /dev/null
+++ b/bench-moerman2018/file_operations/double_close/05_simple_goto.c
@@ -0,0 +1,51 @@
+#include <stdio.h>
+#include <stdlib.h>
+#include "double_close.h"
+
+void double_close_goto(int x) {
+ FILE* file = 0;
+ int val = 0;
+ int i = 0;
+
+ if(i > x) {
+ return;
+ }
+
+#ifdef CATCH_BAD_PARAM
+ if(x > 0) {
+ return;
+ }
+#endif
+
+ file = fopen("file.txt","r");
+
+ if(!file) {
+ return;
+ }
+
+ val += (int) fgetc(file);
+
+GOTO_LABEL:
+ if(i <= x) {
+ fclose(file);
+ } else {
+ printf("%i\n", val);
+ }
+
+ if(i == 0) {
+ i++;
+ goto GOTO_LABEL;
+ }
+}
+
+#ifndef NO_MAIN
+int main() {
+#ifdef NO_BUG
+ double_close_goto(0);
+#else
+ double_close_goto(1);
+#endif
+
+ return 1;
+}
+#endif
diff --git a/bench-moerman2018/file_operations/double_close/06_simple_pass_by_reference.c b/bench-moerman2018/file_operations/double_close/06_simple_pass_by_reference.c
new file mode 100644
index 000000000..40def8672
--- /dev/null
+++ b/bench-moerman2018/file_operations/double_close/06_simple_pass_by_reference.c
@@ -0,0 +1,59 @@
+#include <stdio.h>
+#include <stdlib.h>
+#include <stdbool.h>
+#include "double_close.h"
+
+static int assign_possibly_closed(FILE** dest, bool close_file) {
+ int val;
+ FILE* file = fopen("file.txt","r");
+ *dest = file;
+ if(!file) {
+ return -1;
+ }
+ val = (int) fgetc(file);
+ if(close_file) {
+ fclose(file);
+ }
+ return val;
+}
+
+void double_close_pass_by_reference(bool a, bool b) {
+ FILE* file;
+ int val;
+
+#ifdef CATCH_BAD_PARAM
+ if(!a & !b) {
+ return;
+ }
+#endif
+
+ val = assign_possibly_closed(&file, !a);
+
+ if(!b) {
+ if(file) fclose(file);
+ } else {
+ val += 687;
+ }
+
+ if(a & b) {
+ if(file) fclose(file);
+ }
+
+ printf("%i\n", val);
+}
+
+#ifndef NO_MAIN
+int main() {
+#ifdef NO_BUG
+ double_close_pass_by_reference(true, true);
+ double_close_pass_by_reference(true, false);
+ double_close_pass_by_reference(false, true);
+#else
+ double_close_pass_by_reference(true, true); /* OK */
+ double_close_pass_by_reference(false, false); /* DANGER */
+ double_close_pass_by_reference(false, true); /* OK */
+#endif
+
+ return 1;
+}
+#endif
diff --git a/bench-moerman2018/file_operations/double_close/07_cross_file.c b/bench-moerman2018/file_operations/double_close/07_cross_file.c
new file mode 100644
index 000000000..c24e16fb6
--- /dev/null
+++ b/bench-moerman2018/file_operations/double_close/07_cross_file.c
@@ -0,0 +1,52 @@
+#include "double_close.h"
+#include "common.h"
+#include <stdbool.h>
+#include <stdio.h>
+#include <stdlib.h>
+
+void double_close_cross_file(bool a, bool b) {
+ int val;
+ FILE* file;
+
+#ifdef CATCH_BAD_PARAM
+ if(!a & !b) {
+ return;
+ }
+#endif
+ file = fopen("file.txt","r");
+
+ if(!file) {
+ return;
+ }
+
+ val = (int) fgetc(file);
+
+ conditional_close(file, !a, 0);
+
+ if(b) {
+ val = 678;
+ } else {
+ fclose(file);
+ }
+
+ if(a & b) {
+ fclose(file);
+ }
+
+ printf("%i\n", val);
+}
+
+#ifndef NO_MAIN
+int main() {
+#ifdef NO_BUG
+ double_close_cross_file(true, true);
+ double_close_cross_file(true, false);
+ double_close_cross_file(false, true);
+#else
+ double_close_cross_file(true, true); /* OK */
+ double_close_cross_file(false, false); /* DANGER */
+ double_close_cross_file(false, true); /* OK */
+#endif
+ return 1;
+}
+#endif
diff --git a/bench-moerman2018/file_operations/double_close/08_loop_for.c b/bench-moerman2018/file_operations/double_close/08_loop_for.c
new file mode 100644
index 000000000..c43df8dde
--- /dev/null
+++ b/bench-moerman2018/file_operations/double_close/08_loop_for.c
@@ -0,0 +1,61 @@
+#include <stdio.h>
+#include <stdbool.h>
+#include <stdlib.h>
+#include "double_close.h"
+
+void double_close_for(int x) {
+ FILE* file;
+ int val = 0;
+ int i;
+
+#ifdef CATCH_BAD_PARAM
+ if(x < 10) {
+ return;
+ }
+#endif
+
+ file = fopen("file1.txt","r");
+
+ if(!file) {
+ return;
+ }
+
+ val = (int) fgetc(file);
+
+ fclose(file);
+
+ for(i = 0; i < 20; i++) {
+ if(i > x) {
+ fclose(file);
+ file = fopen("file1.txt","r");
+ if(!file) {
+ return;
+ }
+ val += (int) fgetc(file);
+ } else {
+ val += 24;
+ }
+ if(i == 10) {
+ file = fopen("file2.txt","r");
+ if(!file) {
+ return;
+ }
+ }
+ }
+
+ fclose(file);
+
+ printf("%i\n", val);
+}
+
+#ifndef NO_MAIN
+int main() {
+#ifdef NO_BUG
+ double_close_for(10);
+#else
+ double_close_for(9);
+#endif
+
+ return 1;
+}
+#endif
diff --git a/bench-moerman2018/file_operations/double_close/09_loop_for_complex.c b/bench-moerman2018/file_operations/double_close/09_loop_for_complex.c
new file mode 100644
index 000000000..63e717e84
--- /dev/null
+++ b/bench-moerman2018/file_operations/double_close/09_loop_for_complex.c
@@ -0,0 +1,64 @@
+#include <stdio.h>
+#include <stdlib.h>
+#include "double_close.h"
+
+void double_close_for_complex(int x) {
+ FILE* file;
+ int val = 0;
+ int i = 0;
+
+#ifdef CATCH_BAD_PARAM
+ if(x < 10) {
+ return;
+ }
+#endif
+
+ file = fopen("file1.txt","r");
+
+ if(!file) {
+ return;
+ }
+
+ val = (int) fgetc(file);
+
+ fclose(file);
+
+ for(;;) {
+ if(i > x) {
+ fclose(file);
+ file = fopen("file1.txt","r");
+ if(!file) {
+ return;
+ }
+ val += (int) fgetc(file);
+ } else {
+ val += 24;
+ }
+ if(i == 10) {
+ file = fopen("file2.txt","r");
+ if(!file) {
+ return;
+ }
+ }
+ i++;
+ if(i >= 20) {
+ break;
+ }
+ }
+
+ fclose(file);
+
+ printf("%i\n", val);
+}
+
+#ifndef NO_MAIN
+int main() {
+#ifdef NO_BUG
+ double_close_for_complex(10);
+#else
+ double_close_for_complex(9);
+#endif
+
+ return 1;
+}
+#endif
diff --git a/bench-moerman2018/file_operations/double_close/10_loop_while_continue.c b/bench-moerman2018/file_operations/double_close/10_loop_while_continue.c
new file mode 100644
index 000000000..fb76ac2cf
--- /dev/null
+++ b/bench-moerman2018/file_operations/double_close/10_loop_while_continue.c
@@ -0,0 +1,68 @@
+#include <stdio.h>
+#include <stdlib.h>
+#include "double_close.h"
+
+void double_close_while_continue(int x) {
+ FILE* file;
+ int val = 0;
+ int i = 0;
+
+#ifdef CATCH_BAD_PARAM
+ if(x < 10) {
+ return;
+ }
+#endif
+
+ file = fopen("file1.txt","r");
+
+ if(!file) {
+ return;
+ }
+
+ val = (int) fgetc(file);
+
+ fclose(file);
+
+ while(i < 30) {
+ if(i == 9) {
+ i++;
+ continue;
+ }
+ if(i > x) {
+ fclose(file);
+ file = fopen("file1.txt","r");
+ if(!file) {
+ return;
+ }
+ val += (int) fgetc(file);
+ } else {
+ val += 24;
+ }
+ if(i == 10) {
+ file = fopen("file2.txt","r");
+ if(!file) {
+ return;
+ }
+ }
+ i++;
+ if(i < 20) {
+ continue;
+ }
+ }
+
+ fclose(file);
+
+ printf("%i\n", val);
+}
+
+#ifndef NO_MAIN
+int main() {
+#ifdef NO_BUG
+ double_close_while_continue(10);
+#else
+ double_close_while_continue(9);
+#endif
+
+ return 1;
+}
+#endif
diff --git a/bench-moerman2018/file_operations/double_close/11_loop_while_do_continue.c b/bench-moerman2018/file_operations/double_close/11_loop_while_do_continue.c
new file mode 100644
index 000000000..608dd5137
--- /dev/null
+++ b/bench-moerman2018/file_operations/double_close/11_loop_while_do_continue.c
@@ -0,0 +1,68 @@
+#include <stdio.h>
+#include <stdlib.h>
+#include "double_close.h"
+
+void double_close_do_while_continue(int x) {
+ FILE* file;
+ int val = 0;
+ int i = 0;
+
+#ifdef CATCH_BAD_PARAM
+ if(x < 10) {
+ return;
+ }
+#endif
+
+ file = fopen("file1.txt","r");
+
+ if(!file) {
+ return;
+ }
+
+ val = (int) fgetc(file);
+
+ fclose(file);
+
+ do {
+ if(i == 8) {
+ i++;
+ continue;
+ }
+ if(i > x) {
+ fclose(file);
+ file = fopen("file1.txt","r");
+ if(!file) {
+ return;
+ }
+ val += (int) fgetc(file);
+ } else {
+ val += 24;
+ }
+ if(i == 10) {
+ file = fopen("file2.txt","r");
+ if(!file) {
+ return;
+ }
+ }
+ i++;
+ if(i < 20) {
+ continue;
+ }
+ } while(i < 30);
+
+ fclose(file);
+
+ printf("%i\n", val);
+}
+
+#ifndef NO_MAIN
+int main() {
+#ifdef NO_BUG
+ double_close_do_while_continue(10);
+#else
+ double_close_do_while_continue(9);
+#endif
+
+ return 1;
+}
+#endif
diff --git a/bench-moerman2018/file_operations/double_close/12_loop_for_array_branching.c b/bench-moerman2018/file_operations/double_close/12_loop_for_array_branching.c
new file mode 100644
index 000000000..46876fa70
--- /dev/null
+++ b/bench-moerman2018/file_operations/double_close/12_loop_for_array_branching.c
@@ -0,0 +1,58 @@
+#include <stdio.h>
+#include <stdlib.h>
+#include <stdbool.h>
+#include "double_close.h"
+
+void double_close_for_array(int x) {
+ FILE* file = 0;
+ int p[20];
+ int val = 0;
+ int i;
+
+#ifdef CATCH_BAD_PARAM
+ if(x != 19) {
+ return;
+ }
+#endif
+
+ file = fopen("file.txt","r");
+
+ if(!file) {
+ return;
+ }
+
+ val += ((int) fgetc(file));
+
+ for(i = 0; i < 20; i++) {
+ p[i] = 0;
+ }
+ p[x] = 1;
+
+ for(i = 0; i < 20; i++) {
+ if(p[i] == 1) {
+ fclose(file);
+ } else {
+ fclose(file);
+ file = fopen("file.txt","r");
+
+ if(!file) {
+ return;
+ }
+ val += ((int) fgetc(file)) + i;
+ }
+ }
+
+ printf("%i\n", val);
+}
+
+#ifndef NO_MAIN
+int main() {
+#ifdef NO_BUG
+ double_close_for_array(19);
+#else
+ double_close_for_array(10);
+#endif
+
+ return 1;
+}
+#endif
diff --git a/bench-moerman2018/file_operations/double_close/13_loop_for_pointer_arithmetic.c b/bench-moerman2018/file_operations/double_close/13_loop_for_pointer_arithmetic.c
new file mode 100644
index 000000000..ba3fdfd8a
--- /dev/null
+++ b/bench-moerman2018/file_operations/double_close/13_loop_for_pointer_arithmetic.c
@@ -0,0 +1,80 @@
+#include <stdlib.h>
+#include <stdio.h>
+#include "double_close.h"
+
+static void initialize_array(FILE* ptr_arr[], int length) {
+ int i;
+ FILE** ptr = ptr_arr;
+
+ for(i = 0; i < length; i++, ptr++) {
+ *ptr = fopen("file.txt","r");
+ }
+}
+
+static void close_backwards(FILE** ptr, int to_close) {
+ int i;
+
+ for(i = 0; i < to_close; i++, ptr--) {
+ if(*ptr) fclose(*ptr);
+ }
+}
+
+static void close_forwards(FILE** ptr, int to_close) {
+ int i;
+
+ for(i = 0; i < to_close; i++, ptr++) {
+ if(*ptr) fclose(*ptr);
+ }
+}
+
+void double_close_for_pointer(int x) {
+ FILE* pointers[10];
+ FILE** ptr;
+ int val = 0, i;
+ int to_close;
+
+ if(x > 10) {
+ return;
+ }
+
+#ifdef CATCH_BAD_PARAM
+ if(x > 8) {
+ return;
+ }
+#endif
+
+ initialize_array(pointers, 10);
+
+ close_backwards(pointers + 9, 2);
+
+ ptr = pointers;
+ for(int i = 0; i < 8; i++, ptr++) {
+ if(*ptr) {
+ val += (int) fgetc(*ptr);
+ } else {
+ val--;
+ }
+ }
+
+ to_close = 8 - x;
+
+ close_forwards(pointers, x);
+
+ if(to_close > 0) {
+ close_forwards(pointers + x, to_close);
+ }
+
+ printf("%i\n", val);
+}
+
+#ifndef NO_MAIN
+int main() {
+#ifdef NO_BUG
+ double_close_for_pointer(4);
+#else
+ double_close_for_pointer(9);
+#endif
+
+ return 1;
+}
+#endif
diff --git a/bench-moerman2018/file_operations/double_close/14_loop_recursion.c b/bench-moerman2018/file_operations/double_close/14_loop_recursion.c
new file mode 100644
index 000000000..7c356528d
--- /dev/null
+++ b/bench-moerman2018/file_operations/double_close/14_loop_recursion.c
@@ -0,0 +1,65 @@
+#include <stdio.h>
+#include <stdbool.h>
+#include <stdlib.h>
+#include "double_close.h"
+
+int double_close_rec(int x, int i, FILE** file_ptr) {
+ int val;
+
+#ifdef CATCH_BAD_PARAM
+ if(x > 10 && i >= 19) {
+ return -1;
+ }
+#endif
+
+ if(i <= 1) {
+ if(*file_ptr) fclose(*file_ptr);
+ *file_ptr = 0;
+ return 0;
+ }
+
+ if(i > 19 && !*file_ptr) {
+ *file_ptr = fopen("file.txt", "r");
+ return double_close_rec(x, i-1, file_ptr);
+ }
+ if(i == 19) {
+ if(*file_ptr) {
+ fclose(*file_ptr);
+ }
+ return double_close_rec(x, i-1, file_ptr);
+ }
+
+ if(i < x) {
+ fclose(*file_ptr);
+ *file_ptr = fopen("file.txt","r");
+ if(!*file_ptr) {
+ return -1;
+ }
+ val = (int) fgetc(*file_ptr);
+ } else {
+ val = 8;
+ }
+ if(i == 10 && !*file_ptr) {
+ *file_ptr = fopen("file.txt","r");
+ if(!*file_ptr) {
+ return -1;
+ }
+ }
+
+ return val + double_close_rec(x, i-1, file_ptr);
+}
+
+#ifndef NO_MAIN
+int main() {
+ FILE* file = 0;
+#ifdef NO_BUG
+ printf("%i\n", double_close_rec(10, 20, &file));
+ file = fopen("file.txt", "r");
+ printf("%i\n", double_close_rec(11, 18, &file));
+#else
+ printf("%i\n", double_close_rec(11, 20, &file));
+#endif
+
+ return 1;
+}
+#endif
diff --git a/bench-moerman2018/file_operations/double_close/15_loop_recursion_multi.c b/bench-moerman2018/file_operations/double_close/15_loop_recursion_multi.c
new file mode 100644
index 000000000..2f7fe440f
--- /dev/null
+++ b/bench-moerman2018/file_operations/double_close/15_loop_recursion_multi.c
@@ -0,0 +1,69 @@
+#include <stdio.h>
+#include <stdbool.h>
+#include <stdlib.h>
+#include "double_close.h"
+
+int double_close_rec_decr(int x, int i, FILE** file_ptr) {
+ if(i <= 1) {
+ if(*file_ptr) fclose(*file_ptr);
+ *file_ptr = 0;
+ return 0;
+ }
+
+ return double_close_rec_multi(x, i-1, file_ptr);
+}
+
+int double_close_rec_multi(int x, int i, FILE** file_ptr) {
+ int val;
+
+#ifdef CATCH_BAD_PARAM
+ if(x > 10) {
+ return -1;
+ }
+#endif
+
+ if(i > 19 && !*file_ptr) {
+ *file_ptr = fopen("file.txt", "r");
+ return double_close_rec_decr(x, i, file_ptr);
+ }
+ if(i == 19) {
+ if(*file_ptr) {
+ fclose(*file_ptr);
+ }
+ return double_close_rec_decr(x, i, file_ptr);
+ }
+
+ if(i < x) {
+ fclose(*file_ptr);
+ *file_ptr = fopen("file.txt","r");
+ if(!*file_ptr) {
+ return -1;
+ }
+ val = (int) fgetc(*file_ptr);
+ } else {
+ val = 8;
+ }
+ if(i == 10 && !*file_ptr) {
+ *file_ptr = fopen("file.txt","r");
+ if(!*file_ptr) {
+ return -1;
+ }
+ }
+
+ return val + double_close_rec_decr(x, i, file_ptr);
+}
+
+#ifndef NO_MAIN
+int main() {
+ FILE* file = 0;
+#ifdef NO_BUG
+ printf("%i\n", double_close_rec_multi(10, 20, &file));
+ file = fopen("file.txt", "r");
+ printf("%i\n", double_close_rec_multi(11, 18, &file));
+#else
+ printf("%i\n", double_close_rec_multi(11, 20, &file));
+#endif
+
+ return 1;
+}
+#endif
diff --git a/bench-moerman2018/file_operations/double_close/16_misc_pseudo_recursion.c b/bench-moerman2018/file_operations/double_close/16_misc_pseudo_recursion.c
new file mode 100644
index 000000000..826bcb83a
--- /dev/null
+++ b/bench-moerman2018/file_operations/double_close/16_misc_pseudo_recursion.c
@@ -0,0 +1,65 @@
+#include <stdio.h>
+#include <stdlib.h>
+#include "double_close.h"
+
+int double_close_pseudo_rec1(int x, int y, int i, FILE** file_ptr) {
+ int val;
+#ifdef CATCH_BAD_PARAM
+ if(x >= y && x < 10) {
+ return -1;
+ }
+#endif
+
+ if(!*file_ptr) {
+ return -1;
+ }
+
+ val = ((int) fgetc(*file_ptr));
+
+ if(i > 0) {
+ fclose(*file_ptr);
+ return 37;
+ }
+
+ if(x < y) {
+ fclose(*file_ptr);
+ } else {
+ fgetc(*file_ptr);
+ }
+
+ return val + double_close_pseudo_rec2(x, y, 1, file_ptr);
+}
+
+int double_close_pseudo_rec2(int x, int y, int i, FILE** file_ptr) {
+ int val = 78;
+ if(i > 0) {
+ if(x < 10) {
+ fclose(*file_ptr);
+ } else {
+ val += 2;
+ }
+
+ if(x >= y && x >= 10) {
+ fclose(*file_ptr);
+ *file_ptr = 0;
+ }
+ return val;
+ }
+
+ return 5 + double_close_pseudo_rec1(x, y, 1, file_ptr);
+}
+
+#ifndef NO_MAIN
+int main() {
+ FILE* file = fopen("file.txt", "r");
+#ifdef NO_BUG
+ printf("%i\n", double_close_pseudo_rec1(9, 10, 0, &file));
+ file = fopen("file.txt", "r");
+ printf("%i\n", double_close_pseudo_rec1(11, 10, 0, &file));
+#else
+ printf("%i\n", double_close_pseudo_rec1(9, 8, 0, &file));
+#endif
+
+ return 1;
+}
+#endif
diff --git a/bench-moerman2018/file_operations/double_close/17_complex_function_pointers.c b/bench-moerman2018/file_operations/double_close/17_complex_function_pointers.c
new file mode 100644
index 000000000..0bf2caed5
--- /dev/null
+++ b/bench-moerman2018/file_operations/double_close/17_complex_function_pointers.c
@@ -0,0 +1,59 @@
+#include <stdio.h>
+#include <stdbool.h>
+#include <stdlib.h>
+#include "double_close.h"
+
+static int assign_possibly_closed(FILE** dest, bool close_file) {
+ int val;
+ FILE* file = fopen("file.txt","r");
+ *dest = file;
+ if(!file) {
+ return -1;
+ }
+ val = (int) fgetc(file);
+ if(close_file) {
+ fclose(file);
+ }
+ return val;
+}
+
+void double_close_function_pointer(bool a, bool b, int (*f)(FILE** dest, bool close_file)) {
+ FILE* file;
+ int val = 0;
+
+#ifdef CATCH_BAD_PARAM
+ if(!f || (!a & !b)) {
+ return;
+ }
+#endif
+
+ val = (*f)(&file, a);
+
+ if(!b && file) {
+ fclose(file);
+ } else {
+ val += 687;
+ }
+
+ if(a && b && file) {
+ fclose(file);
+ }
+
+ printf("%i\n", val);
+}
+
+#ifndef NO_MAIN
+int main() {
+#ifdef NO_BUG
+ double_close_function_pointer(true, true, &assign_possibly_closed);
+ double_close_function_pointer(true, false, &assign_possibly_closed);
+ double_close_function_pointer(false, true, &assign_possibly_closed);
+#else
+ double_close_function_pointer(true, true, &assign_possibly_closed); /* OK */
+ double_close_function_pointer(false, false, &assign_possibly_closed); /* DANGER */
+ double_close_function_pointer(false, true, &assign_possibly_closed); /* OK */
+#endif
+
+ return 1;
+}
+#endif
diff --git a/bench-moerman2018/file_operations/double_close/18_complex_struct_multiple_methods.c b/bench-moerman2018/file_operations/double_close/18_complex_struct_multiple_methods.c
new file mode 100644
index 000000000..ded3a9657
--- /dev/null
+++ b/bench-moerman2018/file_operations/double_close/18_complex_struct_multiple_methods.c
@@ -0,0 +1,95 @@
+#include <stdio.h>
+#include <stdlib.h>
+#include "double_close.h"
+
+#ifndef s_NULLPOINTER_REFCOUNT
+#define s_NULLPOINTER_REFCOUNT
+void double_close_cont_init(FileCont* cont) {
+ cont->refc = 1;
+ cont->file = 0;
+}
+
+FileCont* double_close_cont_new() {
+ FileCont* new_cont;
+
+ new_cont = malloc(sizeof(FileCont));
+
+ if(new_cont) {
+ double_close_cont_init(new_cont);
+ }
+ return new_cont;
+}
+
+void double_close_cont_ref(FileCont* cont) {
+ if(cont) {
+ cont->refc++;
+ }
+}
+void double_close_cont_unref(FileCont* cont) {
+ if(cont->refc <= 1) {
+ fclose(cont->file);
+ } else {
+ cont->refc--;
+ }
+}
+
+FILE* double_close_cont_get_file(FileCont* cont) {
+ return cont->file;
+}
+void double_close_cont_set_file(FileCont* cont, FILE* file) {
+ cont->file = file;
+}
+#endif //s_NULLPOINTER_REFCOUNT
+
+void double_close_struct(int x, int y) {
+ FileCont cont;
+ FILE* file;
+ int val = 78;
+
+#ifdef CATCH_BAD_PARAM
+ if(x > 10 && x <= y) {
+ return;
+ }
+#endif
+
+ file = fopen("file.txt","r");
+
+ if(!file) {
+ return;
+ }
+
+ double_close_cont_init(&cont);
+ double_close_cont_set_file(&cont, file);
+
+ val += (int) fgetc(file);
+
+ if(x <= y) {
+ fclose(double_close_cont_get_file(&cont));
+ }
+
+ if(x > 10) {
+ fclose(file);
+ } else {
+ val = val * 2;
+ }
+
+ if(x > y && x <= 10) {
+ fclose(double_close_cont_get_file(&cont));
+ }
+
+ printf("%i\n", val);
+}
+
+#ifndef NO_MAIN
+int main() {
+#ifdef NO_BUG
+ double_close_struct(9, 10);
+ double_close_struct(10, 11);
+ double_close_struct(11, 10);
+#else
+ double_close_struct(11, 11); /* DANGER */
+#endif
+
+ return 1;
+}
+#endif
diff --git a/bench-moerman2018/file_operations/double_close/19_complex_refcount.c b/bench-moerman2018/file_operations/double_close/19_complex_refcount.c
new file mode 100644
index 000000000..a0a593d71
--- /dev/null
+++ b/bench-moerman2018/file_operations/double_close/19_complex_refcount.c
@@ -0,0 +1,77 @@
+#include "double_close.h"
+#include <stdlib.h>
+#include <stdio.h>
+
+#ifndef s_FILES_DC_REFCOUNT
+#define s_FILES_DC_REFCOUNT
+void double_close_cont_init(FileCont* cont) {
+ cont->refc = 1;
+ cont->file = 0;
+}
+
+FileCont* double_close_cont_new() {
+ FileCont* new_cont;
+
+ new_cont = malloc(sizeof(FileCont));
+
+ if(new_cont) {
+ double_close_cont_init(new_cont);
+ }
+ return new_cont;
+}
+
+void double_close_cont_ref(FileCont* cont) {
+ if(cont) {
+ cont->refc++;
+ }
+}
+void double_close_cont_unref(FileCont* cont) {
+ if(cont->refc <= 1) {
+ if(cont->file) fclose(cont->file);
+ } else {
+ cont->refc--;
+ }
+}
+
+FILE* double_close_cont_get_file(FileCont* cont) {
+ return cont->file;
+}
+void double_close_cont_set_file(FileCont* cont, FILE* file) {
+ cont->file = file;
+}
+#endif //s_FILES_DC_REFCOUNT
+
+#ifndef NO_MAIN
+int main() {
+ FileCont* cont;
+ FILE* file;
+ int val;
+
+ file = fopen("file.txt", "r");
+ if(!file) {
+ return -1;
+ }
+
+ cont = double_close_cont_new();
+ if(!cont) {
+ fclose(file);
+ return 1;
+ }
+ double_close_cont_set_file(cont, file);
+
+ double_close_cont_ref(cont);
+ double_close_cont_ref(cont);
+ double_close_cont_unref(cont);
+ double_close_cont_unref(cont);
+ val = ((int) fgetc(double_close_cont_get_file(cont)));
+ double_close_cont_unref(cont);
+#ifndef NO_BUG
+ double_close_cont_unref(cont);
+#endif
+ free(cont);
+
+ printf("%i\n", val);
+
+ return 1;
+}
+#endif
diff --git a/bench-moerman2018/file_operations/double_close/double_close.h b/bench-moerman2018/file_operations/double_close/double_close.h
new file mode 100644
index 000000000..17b340149
--- /dev/null
+++ b/bench-moerman2018/file_operations/double_close/double_close.h
@@ -0,0 +1,37 @@
+#include <stdbool.h>
+#include <stdio.h>
+
+typedef struct _ResLeakRefCont FileCont;
+
+struct _ResLeakRefCont {
+ FILE* file;
+ unsigned int refc;
+};
+
+void double_close_cont_init(FileCont* cont);
+FileCont* double_close_cont_new();
+void double_close_cont_ref(FileCont* cont);
+void double_close_cont_unref(FileCont* cont);
+FILE* double_close_cont_get_file(FileCont* cont);
+void double_close_cont_set_file(FileCont* cont, FILE* file);
+
+void double_close_for(int x);
+void double_close_for_complex(int x);
+void double_close_while_continue(int x);
+void double_close_do_while_continue(int x);
+void double_close_for_array(int x);
+void double_close_for_pointer(int x);
+void double_close_goto(int x);
+void double_close_if_else(bool a, bool b);
+void double_close_if_else_multi(bool a, bool b);
+void double_close_if_else_int1(int x, int y);
+void double_close_if_else_int2(int x, int y);
+void double_close_pass_by_reference(bool a, bool b);
+int double_close_switch(int x, int y);
+int double_close_rec_multi(int x, int i, FILE** file_pt);
+int double_close_rec(int x, int i, FILE** file_ptr);
+int double_close_pseudo_rec1(int x, int y, int i, FILE** file_ptr);
+int double_close_pseudo_rec2(int x, int y, int i, FILE** file_ptr);
+void double_close_struct(int x, int y);
+void double_close_function_pointer(bool a, bool b, int (*f)(FILE** dest, bool close_file));
+void double_close_cross_file(bool a, bool b);
diff --git a/bench-moerman2018/file_operations/resource_leak/01_simple_if.c b/bench-moerman2018/file_operations/resource_leak/01_simple_if.c
new file mode 100644
index 000000000..efafb8091
--- /dev/null
+++ b/bench-moerman2018/file_operations/resource_leak/01_simple_if.c
@@ -0,0 +1,53 @@
+#include <stdio.h>
+#include <stdlib.h>
+#include <stdbool.h>
+#include "resource_leak.h"
+
+void res_leak_if_else(bool a, bool b) {
+ FILE* file;
+ int val = 0;
+
+#ifdef CATCH_BAD_PARAM
+ if(!a & !b) {
+ return;
+ }
+#endif
+
+ file = fopen("file.txt","r");
+
+ if(!file) {
+ return;
+ }
+
+ if(a) {
+ val = (int) fgetc(file);
+ fclose(file);
+ } else {
+ val = ((int) fgetc(file)) * 2;
+ }
+
+ if(b & !a) {
+ val += (int) fgetc(file);
+ fclose(file);
+ } else {
+ val += 37;
+ }
+
+ printf("%i\n", val);
+}
+
+#ifndef NO_MAIN
+int main() {
+#ifdef NO_BUG
+ res_leak_if_else(true, true);
+ res_leak_if_else(true, false);
+ res_leak_if_else(false, true);
+#else
+ res_leak_if_else(true, true); /* OK */
+ res_leak_if_else(false, false); /* DANGER */
+ res_leak_if_else(false, true); /* OK */
+#endif
+
+ return 1;
+}
+#endif
diff --git a/bench-moerman2018/file_operations/resource_leak/02_simple_if_int1.c b/bench-moerman2018/file_operations/resource_leak/02_simple_if_int1.c
new file mode 100644
index 000000000..370e0adc2
--- /dev/null
+++ b/bench-moerman2018/file_operations/resource_leak/02_simple_if_int1.c
@@ -0,0 +1,54 @@
+#include <stdio.h>
+#include <stdlib.h>
+#include "resource_leak.h"
+
+void res_leak_if_else_int1(int x, int y) {
+ int val = 0;
+ FILE* file;
+
+#ifdef CATCH_BAD_PARAM
+ if(x > 10 && x < y) {
+ return;
+ }
+#endif
+
+ file = fopen("file.txt","r");
+
+ if(!file) {
+ return;
+ }
+
+ if(x <= 10) {
+ val = ((int) fgetc(file));
+ fclose(file);
+ } else {
+ val = ((int) fgetc(file))*2;
+ }
+
+ if(x >= y) {
+ if(x > 10) {
+ val = ((int) fgetc(file)) * 2;
+ fclose(file);
+ }
+ } else {
+ val += 10;
+ }
+
+ printf("%i\n", val);
+}
+
+#ifndef NO_MAIN
+int main() {
+#ifdef NO_BUG
+ res_leak_if_else_int1(10, 10);
+ res_leak_if_else_int1(10, 11);
+ res_leak_if_else_int1(11, 11);
+#else
+ res_leak_if_else_int1(10, 10); /* OK */
+ res_leak_if_else_int1(11, 12); /* DANGER */
+ res_leak_if_else_int1(11, 11); /* OK */
+#endif
+
+ return 1;
+}
+#endif
diff --git a/bench-moerman2018/file_operations/resource_leak/02_simple_if_int2.c b/bench-moerman2018/file_operations/resource_leak/02_simple_if_int2.c
new file mode 100644
index 000000000..3eb6fd75b
--- /dev/null
+++ b/bench-moerman2018/file_operations/resource_leak/02_simple_if_int2.c
@@ -0,0 +1,60 @@
+#include <stdio.h>
+#include <stdlib.h>
+#include "resource_leak.h"
+
+void res_leak_if_else_int2(int x, int y) {
+ FILE* file;
+ int val = 0;
+ int m, n;
+
+ m = -1;
+ n = 5;
+
+ x = x*m+n;
+
+#ifdef CATCH_BAD_PARAM
+ if(x > 10 && x < y) {
+ return;
+ }
+#endif
+
+ file = fopen("file.txt","r");
+
+ if(!file) {
+ return;
+ }
+
+ if(x <= 10) {
+ val = ((int) fgetc(file));
+ fclose(file);
+ } else {
+ val = ((int) fgetc(file))*2;
+ }
+
+ if(x >= y) {
+ if(x > 10) {
+ val = ((int) fgetc(file)) * 2;
+ fclose(file);
+ }
+ } else {
+ val += 10;
+ }
+
+ printf("%i\n", val);
+}
+
+#ifndef NO_MAIN
+int main() {
+#ifdef NO_BUG
+ res_leak_if_else_int2(-5, 10);
+ res_leak_if_else_int2(-5, 11);
+ res_leak_if_else_int2(-6, 11);
+#else
+ res_leak_if_else_int2(-5, 10); /* OK */
+ res_leak_if_else_int2(-6, 12); /* DANGER */
+ res_leak_if_else_int2(-6, 11); /* OK */
+#endif
+
+ return 1;
+}
+#endif
diff --git a/bench-moerman2018/file_operations/resource_leak/03_simple_if_multi_func.c b/bench-moerman2018/file_operations/resource_leak/03_simple_if_multi_func.c
new file mode 100644
index 000000000..f0f1d0a8c
--- /dev/null
+++ b/bench-moerman2018/file_operations/resource_leak/03_simple_if_multi_func.c
@@ -0,0 +1,55 @@
+#include "resource_leak.h"
+#include <stdbool.h>
+#include <stdlib.h>
+#include <stdio.h>
+
+static void local_conditional_close(FILE** ptr, bool condition) {
+ if(condition) {
+ fclose(*ptr);
+ }
+}
+
+static int conditional_fgetc(FILE** ptr, int def, bool condition) {
+ if(condition) {
+ return fgetc(*ptr);
+ }
+ return def;
+}
+
+void res_leak_if_else_multi(bool a, bool b) {
+ int val;
+ FILE* file;
+ FILE** file_ptr = &file;
+
+#ifdef CATCH_BAD_PARAM
+ if(!a & !b) {
+ return;
+ }
+#endif
+ file = fopen("file.txt","r");
+
+ if(!file) {
+ return;
+ }
+
+ local_conditional_close(file_ptr, a);
+ val = conditional_fgetc(file_ptr, 897, !a);
+ local_conditional_close(file_ptr, b & !a);
+
+ printf("%i\n", val);
+}
+
+#ifndef NO_MAIN
+int main() {
+#ifdef NO_BUG
+ res_leak_if_else_multi(true, true);
+ res_leak_if_else_multi(true, false);
+ res_leak_if_else_multi(false, true);
+#else
+ res_leak_if_else_multi(true, true); /* OK */
+ res_leak_if_else_multi(false, false); /* DANGER */
+ res_leak_if_else_multi(false, true); /* OK */
+#endif
+ return 1;
+}
+#endif
diff --git a/bench-moerman2018/file_operations/resource_leak/04_simple_switch.c b/bench-moerman2018/file_operations/resource_leak/04_simple_switch.c
new file mode 100644
index 000000000..99fd3fae0
--- /dev/null
+++ b/bench-moerman2018/file_operations/resource_leak/04_simple_switch.c
@@ -0,0 +1,84 @@
+#include "resource_leak.h"
+#include <stdbool.h>
+#include <stdlib.h>
+
+int res_leak_switch(int x, int y) {
+ FILE* file;
+ bool closed = false;
+ int val = 0;
+
+#ifdef CATCH_BAD_PARAM
+ if((x == 10 || x == 5) && x > y) {
+ return -1;
+ }
+#endif
+ file = fopen("file.txt","r");
+
+ if(!file) {
+ return -1;
+ }
+
+ if(x <= y) {
+ fclose(file);
+ closed = true;
+ }
+
+ switch (x) {
+ case 5: {
+ if(!closed) val = ((int) fgetc(file));
+ closed = true; /* DANGER: x >= y */
+ break;
+ }
+ case 7: {
+ if(!closed) {
+ val = ((int) fgetc(file)) + 289;
+ fclose(file);
+ closed = true;
+ }
+ break;
+ }
+ case 10: {
+ if(!closed) {
+ val = ((int) fgetc(file)) + 36;
+ closed = true; /* DANGER: x >= y */
+ }
+ break;
+ }
+ case 12: {
+ if(!closed) {
+ val = ((int) fgetc(file)) + 49807;
+ fclose(file);
+ }
+ closed = true;
+ break;
+ }
+ default: {
+ val = 7987;
+ break;
+ }
+ }
+
+ if(!closed) {
+ fclose(file);
+ }
+
+ return val;
+}
+
+#ifndef NO_MAIN
+int main() {
+#ifdef NO_BUG
+ res_leak_switch(5, 11);
+ res_leak_switch(10, 11);
+ res_leak_switch(11, 10);
+ res_leak_switch(7, 5);
+#else
+ res_leak_switch(5, 10); /* OK */
+ res_leak_switch(10, 9); /* DANGER */
+ res_leak_switch(11, 10); /* OK */
+ res_leak_switch(7, 5); /* OK */
+#endif
+
+ return 1;
+}
+#endif
diff --git a/bench-moerman2018/file_operations/resource_leak/05_simple_goto.c b/bench-moerman2018/file_operations/resource_leak/05_simple_goto.c
new file mode 100644
index 000000000..d98e721f6
--- /dev/null
+++ b/bench-moerman2018/file_operations/resource_leak/05_simple_goto.c
@@ -0,0 +1,46 @@
+#include <stdio.h>
+#include <stdlib.h>
+#include "resource_leak.h"
+
+void res_leak_goto(int x) {
+ FILE* file = 0;
+ int val = 0;
+ int i = 0;
+
+#ifdef CATCH_BAD_PARAM
+ if(x > 0) {
+ return;
+ }
+#endif
+
+GOTO_LABEL:
+ if(i <= x) {
+ file = fopen("file.txt","r");
+
+ if(!file) {
+ return;
+ }
+
+ val += ((int) fgetc(file));
+ } else {
+ printf("%i\n", val);
+ }
+
+ if(i == 0) {
+ i++;
+ if(file) fclose(file);
+ goto GOTO_LABEL;
+ }
+}
+
+#ifndef NO_MAIN
+int main() {
+#ifdef NO_BUG
+ res_leak_goto(0);
+#else
+ res_leak_goto(1);
+#endif
+
+ return 1;
+}
+#endif
diff --git a/bench-moerman2018/file_operations/resource_leak/06_simple_pass_by_reference.c b/bench-moerman2018/file_operations/resource_leak/06_simple_pass_by_reference.c
new file mode 100644
index 000000000..c2ec18e2f
--- /dev/null
+++ b/bench-moerman2018/file_operations/resource_leak/06_simple_pass_by_reference.c
@@ -0,0 +1,56 @@
+#include <stdio.h>
+#include <stdlib.h>
+#include <stdbool.h>
+#include "resource_leak.h"
+
+static int assign_possibly_closed(FILE** dest, bool close_file) {
+ int val;
+ FILE* file = fopen("file.txt","r");
+ *dest = file;
+ if(!file) {
+ return -1;
+ }
+ val = (int) fgetc(file);
+ if(close_file) {
+ fclose(file);
+ }
+ return val;
+}
+
+void res_leak_pass_by_reference(bool a, bool b) {
+ FILE* file;
+ int val;
+
+#ifdef CATCH_BAD_PARAM
+ if(!a & !b) {
+ return;
+ }
+#endif
+
+ val = assign_possibly_closed(&file, a);
+
+ if(b && !a && file) {
+ val += (int) fgetc(file);
+ fclose(file);
+ } else {
+ val += 687;
+ }
+
+ printf("%i\n", val);
+}
+
+#ifndef NO_MAIN
+int main() {
+#ifdef NO_BUG
+ res_leak_pass_by_reference(true, true);
+ res_leak_pass_by_reference(true, false);
+ res_leak_pass_by_reference(false, true);
+#else
+ res_leak_pass_by_reference(true, true); /* OK */
+ res_leak_pass_by_reference(false, false); /* DANGER */
+ res_leak_pass_by_reference(false, true); /* OK */
+#endif
+
+ return 1;
+}
+#endif
diff --git a/bench-moerman2018/file_operations/resource_leak/07_cross_file.c b/bench-moerman2018/file_operations/resource_leak/07_cross_file.c
new file mode 100644
index 000000000..3a49f0d72
--- /dev/null
+++ b/bench-moerman2018/file_operations/resource_leak/07_cross_file.c
@@ -0,0 +1,47 @@
+#include "resource_leak.h"
+#include "common.h"
+#include <stdbool.h>
+#include <stdio.h>
+#include <stdlib.h>
+
+void res_leak_cross_file(bool a, bool b) {
+ int val;
+ FILE* file;
+
+#ifdef CATCH_BAD_PARAM
+ if(!a & !b) {
+ return;
+ }
+#endif
+ file = fopen("file.txt","r");
+
+ if(!file) {
+ return;
+ }
+
+ conditional_close(file, a, 0);
+
+ if(b & !a) {
+ val = (int) fgetc(file);
+ fclose(file);
+ } else {
+ val = 678;
+ }
+
+ printf("%i\n", val);
+}
+
+#ifndef NO_MAIN
+int main() {
+#ifdef NO_BUG
+ res_leak_cross_file(true, true);
+ res_leak_cross_file(true, false);
+ res_leak_cross_file(false, true);
+#else
+ res_leak_cross_file(true, true); /* OK */
+ res_leak_cross_file(false, false); /* DANGER */
+ res_leak_cross_file(false, true); /* OK */
+#endif
+ return 1;
+}
+#endif
diff --git a/bench-moerman2018/file_operations/resource_leak/08_loop_for.c b/bench-moerman2018/file_operations/resource_leak/08_loop_for.c
new file mode 100644
index 000000000..463075b1b
--- /dev/null
+++ b/bench-moerman2018/file_operations/resource_leak/08_loop_for.c
@@ -0,0 +1,57 @@
+#include <stdio.h>
+#include <stdbool.h>
+#include <stdlib.h>
+#include "resource_leak.h"
+
+void res_leak_for(int x) {
+ FILE* file;
+ int val = 0;
+ bool do_close = false;
+ bool is_closed = true;
+ int i;
+
+#ifdef CATCH_BAD_PARAM
+ if(x < 10) {
+ return;
+ }
+#endif
+
+ for(i = 0; i < 20; i++) {
+ if(i > x && is_closed) {
+ file = fopen("file.txt","r");
+ if(!file) {
+ return;
+ }
+ val += (int) fgetc(file) * 2;
+ if(do_close) {
+ fclose(file);
+ is_closed = true;
+ } else {
+ is_closed = false;
+ }
+ } else {
+ if(!is_closed) {
+ val += (int) fgetc(file);
+ } else {
+ val += 37;
+ }
+ }
+ if(i == 10) {
+ do_close = true;
+ }
+ }
+
+ printf("%i\n", val);
+}
+
+#ifndef NO_MAIN
+int main() {
+#ifdef NO_BUG
+ res_leak_for(10);
+#else
+ res_leak_for(9);
+#endif
+
+ return 1;
+}
+#endif
diff --git a/bench-moerman2018/file_operations/resource_leak/09_loop_for_complex.c b/bench-moerman2018/file_operations/resource_leak/09_loop_for_complex.c
new file mode 100644
index 000000000..bd517ef2d
--- /dev/null
+++ b/bench-moerman2018/file_operations/resource_leak/09_loop_for_complex.c
@@ -0,0 +1,60 @@
+#include <stdio.h>
+#include <stdlib.h>
+#include "resource_leak.h"
+
+void res_leak_for_complex(int x) {
+ FILE* file;
+ int val = 0;
+ bool do_close = false;
+ bool is_closed = true;
+ int i = 0;
+
+#ifdef CATCH_BAD_PARAM
+ if(x < 10) {
+ return;
+ }
+#endif
+
+ for(;;) {
+ if(i > x && is_closed) {
+ file = fopen("file.txt","r");
+ if(!file) {
+ return;
+ }
+ val += (int) fgetc(file) * 2;
+ if(do_close) {
+ fclose(file);
+ is_closed = true;
+ } else {
+ is_closed = false;
+ }
+ } else {
+ if(!is_closed) {
+ val += (int) fgetc(file);
+ } else {
+ val += 37;
+ }
+ }
+ if(i == 10) {
+ do_close = true;
+ }
+ i++;
+ if(i >= 20) {
+ break;
+ }
+ }
+
+ printf("%i\n", val);
+}
+
+#ifndef NO_MAIN
+int main() {
+#ifdef NO_BUG
+ res_leak_for_complex(10);
+#else
+ res_leak_for_complex(9);
+#endif
+
+ return 1;
+}
+#endif
diff --git a/bench-moerman2018/file_operations/resource_leak/10_loop_while_continue.c b/bench-moerman2018/file_operations/resource_leak/10_loop_while_continue.c
new file mode 100644
index 000000000..a6e450973
--- /dev/null
+++ b/bench-moerman2018/file_operations/resource_leak/10_loop_while_continue.c
@@ -0,0 +1,64 @@
+#include <stdio.h>
+#include <stdlib.h>
+#include "resource_leak.h"
+
+void res_leak_while_continue(int x) {
+ FILE* file;
+ int val = 0;
+ bool do_close = false;
+ bool is_closed = true;
+ int i = 0;
+
+#ifdef CATCH_BAD_PARAM
+ if(x < 10) {
+ return;
+ }
+#endif
+
+ while(i < 30) {
+ if(i == 9) {
+ i++;
+ continue;
+ }
+ if(i > x && is_closed) {
+ file = fopen("file.txt","r");
+ if(!file) {
+ return;
+ }
+ val += (int) fgetc(file) * 2;
+ if(do_close) {
+ fclose(file);
+ is_closed = true;
+ } else {
+ is_closed = false;
+ }
+ } else {
+ if(!is_closed) {
+ val += (int) fgetc(file);
+ } else {
+ val += 37;
+ }
+ }
+ if(i == 10) {
+ do_close = true;
+ }
+ i++;
+ if(i < 20) {
+ continue;
+ }
+ }
+
+ printf("%i\n", val);
+}
+
+#ifndef NO_MAIN
+int main() {
+#ifdef NO_BUG
+ res_leak_while_continue(10);
+#else
+ res_leak_while_continue(9);
+#endif
+
+ return 1;
+}
+#endif
diff --git a/bench-moerman2018/file_operations/resource_leak/11_loop_while_do_continue.c b/bench-moerman2018/file_operations/resource_leak/11_loop_while_do_continue.c
new file mode 100644
index 000000000..14fcbc77b
--- /dev/null
+++ b/bench-moerman2018/file_operations/resource_leak/11_loop_while_do_continue.c
@@ -0,0 +1,64 @@
+#include <stdio.h>
+#include <stdlib.h>
+#include "resource_leak.h"
+
+void res_leak_do_while_continue(int x) {
+ FILE* file;
+ int val = 0;
+ bool do_close = false;
+ bool is_closed = true;
+ int i = 0;
+
+#ifdef CATCH_BAD_PARAM
+ if(x < 10) {
+ return;
+ }
+#endif
+
+ do {
+ if(i == 8) {
+ i++;
+ continue;
+ }
+ if(i > x && is_closed) {
+ file = fopen("file.txt","r");
+ if(!file) {
+ return;
+ }
+ val += (int) fgetc(file) * 2;
+ if(do_close) {
+ fclose(file);
+ is_closed = true;
+ } else {
+ is_closed = false;
+ }
+ } else {
+ if(!is_closed) {
+ val += (int) fgetc(file);
+ } else {
+ val += 37;
+ }
+ }
+ if(i == 10) {
+ do_close = true;
+ }
+ i++;
+ if(i < 20) {
+ continue;
+ }
+ } while(i < 30);
+
+ printf("%i\n", val);
+}
+
+#ifndef NO_MAIN
+int main() {
+#ifdef NO_BUG
+ res_leak_do_while_continue(10);
+#else
+ res_leak_do_while_continue(9);
+#endif
+
+ return 1;
+}
+#endif
diff --git a/bench-moerman2018/file_operations/resource_leak/12_loop_for_array_branching.c b/bench-moerman2018/file_operations/resource_leak/12_loop_for_array_branching.c
new file mode 100644
index 000000000..4dc464d40
--- /dev/null
+++ b/bench-moerman2018/file_operations/resource_leak/12_loop_for_array_branching.c
@@ -0,0 +1,55 @@
+#include <stdio.h>
+#include <stdlib.h>
+#include <stdbool.h>
+#include "resource_leak.h"
+
+void res_leak_for_array(int x) {
+ FILE* file = 0;
+ int p[20];
+ int val = 0;
+ bool do_close = true;
+ int i;
+
+#ifdef CATCH_BAD_PARAM
+ if(x != 19) {
+ return;
+ }
+#endif
+
+ for(i = 0; i < 20; i++) {
+ p[i] = 0;
+ }
+ p[x] = 1;
+
+ for(i = 0; i < 20; i++) {
+ if(p[i] == 1) {
+ do_close = false;
+ } else {
+ if(!file) file = fopen("file.txt","r");
+
+ if(!file) {
+ return;
+ }
+
+ val += ((int) fgetc(file)) + i;
+ if(do_close) {
+ fclose(file);
+ file = 0;
+ }
+ }
+ }
+
+ printf("%i\n", val);
+}
+
+#ifndef NO_MAIN
+int main() {
+#ifdef NO_BUG
+ res_leak_for_array(19);
+#else
+ res_leak_for_array(10);
+#endif
+
+ return 1;
+}
+#endif
diff --git a/bench-moerman2018/file_operations/resource_leak/13_loop_for_pointer_arithmetic.c b/bench-moerman2018/file_operations/resource_leak/13_loop_for_pointer_arithmetic.c
new file mode 100644
index 000000000..99ea6ae15
--- /dev/null
+++ b/bench-moerman2018/file_operations/resource_leak/13_loop_for_pointer_arithmetic.c
@@ -0,0 +1,62 @@
+#include <stdlib.h>
+#include <stdio.h>
+#include "resource_leak.h"
+
+static void initialize_array(FILE* ptr_arr[], int length) {
+ int i;
+ FILE** ptr = ptr_arr;
+
+ for(i = 0; i < length; i++, ptr++) {
+ *ptr = fopen("file.txt","r");
+ }
+}
+
+static void close_array(FILE* ptr_arr[], int length) {
+ int i;
+ FILE** ptr = ptr_arr;
+
+ for(i = 0; i < length; i++, ptr++) {
+ if(*ptr) fclose(*ptr);
+ }
+}
+
+void res_leak_for_pointer(int x) {
+ FILE* pointers[10];
+ FILE** ptr;
+ int val = 0, i;
+
+ if(x > 10) {
+ return;
+ }
+
+#ifdef CATCH_BAD_PARAM
+ if(x != 10) {
+ return;
+ }
+#endif
+
+ initialize_array(pointers, 10);
+ ptr = pointers;
+ for(int i = 0; i < 10; i++, ptr++) {
+ if(*ptr) {
+ val += (int) fgetc(*ptr);
+ } else {
+ val--;
+ }
+ }
+
+ close_array(pointers, x);
+ printf("%i\n", val);
+}
+
+#ifndef NO_MAIN
+int main() {
+#ifdef NO_BUG
+ res_leak_for_pointer(10);
+#else
+ res_leak_for_pointer(9);
+#endif
+
+ return 1;
+}
+#endif
diff --git a/bench-moerman2018/file_operations/resource_leak/14_loop_recursion.c b/bench-moerman2018/file_operations/resource_leak/14_loop_recursion.c
new file mode 100644
index 000000000..4e3d3142f
--- /dev/null
+++ b/bench-moerman2018/file_operations/resource_leak/14_loop_recursion.c
@@ -0,0 +1,53 @@
+#include <stdio.h>
+#include <stdbool.h>
+#include <stdlib.h>
+#include "resource_leak.h"
+
+int res_leak_rec(int x, int i, FILE** file_ptr, bool do_close) {
+ int val;
+
+#ifdef CATCH_BAD_PARAM
+ if(!do_close && x > 10) {
+ return -1;
+ }
+#endif
+
+ if(i <= 1) {
+ return 0;
+ }
+
+ if(i < x) {
+ *file_ptr = fopen("file.txt","r");
+ if(!*file_ptr) return -1;
+ val = ((int) fgetc(*file_ptr));
+ if(do_close) {
+ fclose(*file_ptr);
+ *file_ptr = 0;
+ }
+ } else {
+ if(*file_ptr) {
+ val = ((int) fgetc(*file_ptr)) / 2;
+ } else {
+ val = 8;
+ }
+ }
+ if(i == 10) {
+ do_close = true;
+ }
+
+ return val + res_leak_rec(x, i-1, file_ptr, do_close);
+}
+
+#ifndef NO_MAIN
+int main() {
+ FILE* file = 0;
+#ifdef NO_BUG
+ printf("%i\n", res_leak_rec(10, 20, &file, false));
+ printf("%i\n", res_leak_rec(11, 20, &file, true));
+#else
+ printf("%i\n", res_leak_rec(11, 20, &file, false));
+#endif
+
+ return 1;
+}
+#endif
diff --git a/bench-moerman2018/file_operations/resource_leak/15_loop_recursion_multi.c b/bench-moerman2018/file_operations/resource_leak/15_loop_recursion_multi.c
new file mode 100644
index 000000000..caddb4451
--- /dev/null
+++ b/bench-moerman2018/file_operations/resource_leak/15_loop_recursion_multi.c
@@ -0,0 +1,61 @@
+#include <stdio.h>
+#include <stdbool.h>
+#include <stdlib.h>
+#include "resource_leak.h"
+
+int res_leak_rec_decr(int x, int i, FILE** file_ptr, bool do_close) {
+ if(i <= 1) {
+ return 0;
+ }
+
+ return res_leak_rec_multi(x, i-1, file_ptr, do_close);
+}
+
+int res_leak_rec_multi(int x, int i, FILE** file_ptr, bool do_close) {
+ int val;
+
+#ifdef CATCH_BAD_PARAM
+ if(!do_close && x > 10) {
+ return -1;
+ }
+#endif
+
+ if(i <= 1) {
+ return 0;
+ }
+
+ if(i < x) {
+ *file_ptr = fopen("file.txt","r");
+ if(!*file_ptr) return -1;
+ val = ((int) fgetc(*file_ptr));
+ if(do_close) {
+ fclose(*file_ptr);
+ *file_ptr = 0;
+ }
+ } else {
+ if(*file_ptr) {
+ val = ((int) fgetc(*file_ptr)) / 2;
+ } else {
+ val = 8;
+ }
+ }
+ if(i == 10) {
+ do_close = true;
+ }
+
+ return val + res_leak_rec_decr(x, i, file_ptr, do_close);
+}
+
+#ifndef NO_MAIN
+int main() {
+ FILE* file = 0;
+#ifdef NO_BUG
+ printf("%i\n", res_leak_rec_multi(10, 20, &file, false));
+ printf("%i\n", res_leak_rec_multi(11, 20, &file, true));
+#else
+ printf("%i\n", res_leak_rec_multi(11, 20, &file, false));
+#endif
+
+ return 1;
+}
+#endif
diff --git a/bench-moerman2018/file_operations/resource_leak/16_misc_pseudo_recursion.c b/bench-moerman2018/file_operations/resource_leak/16_misc_pseudo_recursion.c
new file mode 100644
index 000000000..6a295f682
--- /dev/null
+++ b/bench-moerman2018/file_operations/resource_leak/16_misc_pseudo_recursion.c
@@ -0,0 +1,66 @@
+#include <stdio.h>
+#include <stdlib.h>
+#include "resource_leak.h"
+
+int res_leak_pseudo_rec1(int x, int y, int i, char* file_name) {
+ FILE* file;
+ FILE** file_ptr;
+ int val;
+#ifdef CATCH_BAD_PARAM
+ if(x >= y && x < 10) {
+ return -1;
+ }
+#endif
+
+ file = fopen(file_name, "r");
+ if(!file) {
+ return -1;
+ }
+ file_ptr = &file;
+ val = ((int) fgetc(file));
+
+ if(i > 0) {
+ fclose(file);
+ return 37;
+ }
+
+ if(x < y) {
+ fclose(file);
+ file = 0;
+ } else {
+ fgetc(file);
+ }
+
+ return val + res_leak_pseudo_rec2(x, y, 1, file_ptr, file_name);
+}
+
+int res_leak_pseudo_rec2(int x, int y, int i, FILE** file_ptr, char* file_name) {
+ int val = 78;
+ if(i <= 0) {
+ return 5 + res_leak_pseudo_rec1(x, y, 1, file_name);
+ }
+
+ if(x < 10) {
+ val += 2;
+ } else {
+ if(*file_ptr) {
+ val -= ((int) fgetc(*file_ptr));
+ fclose(*file_ptr);
+ *file_ptr = 0;
+ }
+ }
+ return val;
+}
+
+#ifndef NO_MAIN
+int main() {
+#ifdef NO_BUG
+ printf("%i\n", res_leak_pseudo_rec1(9, 10, 0, "file.txt"));
+ printf("%i\n", res_leak_pseudo_rec1(11, 10, 0, "file.txt"));
+#else
+ printf("%i\n", res_leak_pseudo_rec1(9, 8, 0, "file.txt"));
+#endif
+
+ return 1;
+}
+#endif
diff --git a/bench-moerman2018/file_operations/resource_leak/17_complex_function_pointers.c b/bench-moerman2018/file_operations/resource_leak/17_complex_function_pointers.c
new file mode 100644
index 000000000..adfd3c421
--- /dev/null
+++ b/bench-moerman2018/file_operations/resource_leak/17_complex_function_pointers.c
@@ -0,0 +1,56 @@
+#include <stdio.h>
+#include <stdbool.h>
+#include <stdlib.h>
+#include "resource_leak.h"
+
+static int assign_possibly_closed(FILE** dest, bool close_file) {
+ int val;
+ FILE* file = fopen("file.txt","r");
+ *dest = file;
+ if(!file) {
+ return -1;
+ }
+ val = (int) fgetc(file);
+ if(close_file) {
+ fclose(file);
+ }
+ return val;
+}
+
+void res_leak_function_pointer(bool a, bool b, int (*f)(FILE** dest, bool close_file)) {
+ FILE* file;
+ int val = 0;
+
+#ifdef CATCH_BAD_PARAM
+ if(!f || (!a & !b)) {
+ return;
+ }
+#endif
+
+ val = (*f)(&file, a);
+
+ if(b && !a && file) {
+ val += (int) fgetc(file);
+ fclose(file);
+ } else {
+ val += 687;
+ }
+
+ printf("%i\n", val);
+}
+
+#ifndef NO_MAIN
+int main() {
+#ifdef NO_BUG
+ res_leak_function_pointer(true, true, &assign_possibly_closed);
+ res_leak_function_pointer(true, false, &assign_possibly_closed);
+ res_leak_function_pointer(false, true, &assign_possibly_closed);
+#else
+ res_leak_function_pointer(true, true, &assign_possibly_closed); /* OK */
+ res_leak_function_pointer(false, false, &assign_possibly_closed); /* DANGER */
+ res_leak_function_pointer(false, true, &assign_possibly_closed); /* OK */
+#endif
+
+ return 1;
+}
+#endif
diff --git a/bench-moerman2018/file_operations/resource_leak/18_complex_struct_multiple_methods.c b/bench-moerman2018/file_operations/resource_leak/18_complex_struct_multiple_methods.c
new file mode 100644
index 000000000..6e0838a21
--- /dev/null
+++ b/bench-moerman2018/file_operations/resource_leak/18_complex_struct_multiple_methods.c
@@ -0,0 +1,93 @@
+#include <stdio.h>
+#include <stdlib.h>
+#include "resource_leak.h"
+
+#ifndef s_FILES_RL_REFCOUNT
+#define s_FILES_RL_REFCOUNT
+void res_leak_cont_init(FileCont* cont) {
+ cont->refc = 1;
+ cont->file = 0;
+}
+
+FileCont* res_leak_cont_new() {
+ FileCont* new_cont;
+
+ new_cont = malloc(sizeof(FileCont));
+
+ if(new_cont) {
+ res_leak_cont_init(new_cont);
+ }
+ return new_cont;
+}
+
+void res_leak_cont_ref(FileCont* cont) {
+ if(cont) {
+ cont->refc++;
+ }
+}
+void res_leak_cont_unref(FileCont* cont) {
+ if(cont->refc <= 1) {
+ fclose(cont->file);
+ } else {
+ cont->refc--;
+ }
+}
+
+FILE* res_leak_cont_get_file(FileCont* cont) {
+ return cont->file;
+}
+void res_leak_cont_set_file(FileCont* cont, FILE* file) {
+ cont->file = file;
+}
+#endif //s_FILES_RL_REFCOUNT
+
+void res_leak_struct(int x, int y) {
+ FileCont cont;
+ FILE* file;
+ int val = 78;
+
+#ifdef CATCH_BAD_PARAM
+ if(x > 10 && x <= y) {
+ return;
+ }
+#endif
+
+ file = fopen("file.txt","r");
+
+ if(!file) {
+ return;
+ }
+
+ res_leak_cont_init(&cont);
+ res_leak_cont_set_file(&cont, file);
+
+ if(x > y) {
+ fclose(file);
+ file = 0;
+ }
+
+ if(x <= 10) {
+ if(file) {
+ val = (int) fgetc(file);
+ fclose(res_leak_cont_get_file(&cont));
+ }
+ } else {
+ val = val * 2;
+ }
+
+ printf("%i\n", val);
+}
+
+#ifndef NO_MAIN
+int main() {
+#ifdef NO_BUG
+ res_leak_struct(9, 10);
+ res_leak_struct(10, 11);
+ res_leak_struct(11, 10);
+#else
+ res_leak_struct(11, 11); /* DANGER */
+#endif
+
+ return 1;
+}
+#endif
diff --git a/bench-moerman2018/file_operations/resource_leak/19_complex_refcount.c b/bench-moerman2018/file_operations/resource_leak/19_complex_refcount.c
new file mode 100644
index 000000000..0be3e3a94
--- /dev/null
+++ b/bench-moerman2018/file_operations/resource_leak/19_complex_refcount.c
@@ -0,0 +1,76 @@
+#include "resource_leak.h"
+#include <stdlib.h>
+#include <stdio.h>
+
+#ifndef s_FILES_RL_REFCOUNT
+#define s_FILES_RL_REFCOUNT
+void res_leak_cont_init(FileCont* cont) {
+ cont->refc = 1;
+ cont->file = 0;
+}
+
+FileCont* res_leak_cont_new() {
+ FileCont* new_cont;
+
+ new_cont = malloc(sizeof(FileCont));
+
+ if(new_cont) {
+ res_leak_cont_init(new_cont);
+ }
+ return new_cont;
+}
+
+void res_leak_cont_ref(FileCont* cont) {
+ if(cont) {
+ cont->refc++;
+ }
+}
+void res_leak_cont_unref(FileCont* cont) {
+ if(cont->refc <= 1) {
+ if(cont->file) fclose(cont->file);
+ } else {
+ cont->refc--;
+ }
+}
+
+FILE* res_leak_cont_get_file(FileCont* cont) {
+ return cont->file;
+}
+void res_leak_cont_set_file(FileCont* cont, FILE* file) {
+ cont->file = file;
+}
+#endif //s_FILES_RL_REFCOUNT
+
+#ifndef NO_MAIN
+int main() {
+ FileCont* cont;
+ FILE* file;
+ int val;
+
+ file = fopen("file.txt", "r");
+ if(!file) {
+ return -1;
+ }
+
+ cont = res_leak_cont_new();
+ if(!cont) {
+ fclose(file);
+ return 1;
+ }
+ res_leak_cont_set_file(cont, file);
+
+ res_leak_cont_ref(cont);
+ res_leak_cont_ref(cont);
+ res_leak_cont_unref(cont);
+ res_leak_cont_unref(cont);
+ val = ((int) fgetc(res_leak_cont_get_file(cont)));
+#ifdef NO_BUG
+ res_leak_cont_unref(cont);
+#endif
+ free(cont);
+
+ printf("%i\n", val);
+
+ return 1;
+}
+#endif
diff --git a/bench-moerman2018/file_operations/resource_leak/resource_leak.h b/bench-moerman2018/file_operations/resource_leak/resource_leak.h
new file mode 100644
index 000000000..424c340ba
--- /dev/null
+++ b/bench-moerman2018/file_operations/resource_leak/resource_leak.h
@@ -0,0 +1,37 @@
+#include <stdbool.h>
+#include <stdio.h>
+
+typedef struct _ResLeakRefCont FileCont;
+
+struct _ResLeakRefCont {
+ FILE* file;
+ unsigned int refc;
+};
+
+void res_leak_cont_init(FileCont* cont);
+FileCont* res_leak_cont_new();
+void res_leak_cont_ref(FileCont* cont);
+void res_leak_cont_unref(FileCont* cont);
+FILE* res_leak_cont_get_file(FileCont* cont);
+void res_leak_cont_set_file(FileCont* cont, FILE* file);
+
+void res_leak_for(int x);
+void res_leak_for_complex(int x);
+void res_leak_while_continue(int x);
+void res_leak_do_while_continue(int x);
+void res_leak_for_array(int x);
+void res_leak_for_pointer(int x);
+void res_leak_goto(int x);
+void res_leak_if_else(bool a, bool b);
+void res_leak_if_else_multi(bool a, bool b);
+void res_leak_if_else_int1(int x, int y);
+void res_leak_if_else_int2(int x, int y);
+void res_leak_pass_by_reference(bool a, bool b);
+int res_leak_switch(int x, int y);
+int res_leak_rec_multi(int x, int i, FILE** file_ptr, bool do_close);
+int res_leak_rec(int x, int i, FILE** file_ptr, bool do_close);
+int res_leak_pseudo_rec1(int x, int y, int i, char* file_name);
+int res_leak_pseudo_rec2(int x, int y, int i, FILE** file_ptr, char* file_name);
+void res_leak_struct(int x, int y);
+void res_leak_function_pointer(bool a, bool b, int (*f)(FILE** dest, bool close_file));
+void res_leak_cross_file(bool a, bool b);
diff --git a/bench-moerman2018/general/divide_by_zero/01_simple_if.c b/bench-moerman2018/general/divide_by_zero/01_simple_if.c
new file mode 100644
index 000000000..afa94f1c0
--- /dev/null
+++ b/bench-moerman2018/general/divide_by_zero/01_simple_if.c
@@ -0,0 +1,44 @@
+#include <stdio.h>
+#include <stdbool.h>
+#include "divide_by_zero.h"
+
+void divide_zero_if_else(bool a, bool b) {
+ int divisor;
+ int val;
+
+#ifdef CATCH_BAD_PARAM
+ if(!a & !b) {
+ return;
+ }
+#endif
+
+ if(a) {
+ divisor = 1;
+ } else {
+ divisor = 2;
+ }
+
+ if(b) {
+ val = 37 / (divisor + 2);
+ } else {
+ val = 11 / (divisor - 2); /* DANGER, if !a & !b */
+ }
+
+ printf("%i\n", val);
+}
+
+#ifndef NO_MAIN
+int main() {
+#ifdef NO_BUG
+ divide_zero_if_else(true, true);
+ divide_zero_if_else(true, false);
+ divide_zero_if_else(false, true);
+#else
+ divide_zero_if_else(true, true); /* OK */
+ divide_zero_if_else(false, false); /* DANGER */
+ divide_zero_if_else(false, true); /* OK */
+#endif
+
+ return 1;
+}
+#endif
diff --git a/bench-moerman2018/general/divide_by_zero/02_simple_if_int1.c b/bench-moerman2018/general/divide_by_zero/02_simple_if_int1.c
new file mode 100644
index 000000000..a31d9c861
--- /dev/null
+++ b/bench-moerman2018/general/divide_by_zero/02_simple_if_int1.c
@@ -0,0 +1,43 @@
+#include <stdio.h>
+#include "divide_by_zero.h"
+
+void divide_zero_if_else_int1(int x, int y) {
+ int divisor;
+ int val;
+
+#ifdef CATCH_BAD_PARAM
+ if(x <= 10 && x >= y) {
+ return;
+ }
+#endif
+
+ if(x < y) {
+ divisor = 1;
+ } else {
+ divisor = 2;
+ }
+
+ if(x > 10) {
+ val = 37 / (divisor + 2);
+ } else {
+ val = 11 / (divisor - 2); /* DANGER, if x <= 10 & x >= y */
+ }
+
+ printf("x=%i: %i", x, val);
+}
+
+#ifndef NO_MAIN
+int main() {
+#ifdef NO_BUG
+ divide_zero_if_else_int1(9, 10);
+ divide_zero_if_else_int1(10, 11);
+ divide_zero_if_else_int1(11, 10);
+#else
+ divide_zero_if_else_int1(9, 10); /* OK */
+ divide_zero_if_else_int1(10, 10); /* DANGER */
+ divide_zero_if_else_int1(11, 10); /* OK */
+#endif
+
+ return 1;
+}
+#endif
diff --git a/bench-moerman2018/general/divide_by_zero/02_simple_if_int2.c b/bench-moerman2018/general/divide_by_zero/02_simple_if_int2.c
new file mode 100644
index 000000000..da8b55571
--- /dev/null
+++ b/bench-moerman2018/general/divide_by_zero/02_simple_if_int2.c
@@ -0,0 +1,48 @@
+#include <stdio.h>
+#include "divide_by_zero.h"
+
+void divide_zero_if_else_int2(int x, int y) {
+ int divisor;
+ int val, m, n;
+
+ m = -1;
+ n = 5;
+
+ x = x*m+n;
+
+#ifdef CATCH_BAD_PARAM
+ if(x <= 10 && x >= y) {
+ return;
+ }
+#endif
+
+ if(x < y) {
+ divisor = 1;
+ } else {
+ divisor = 2;
+ }
+
+ if(x > 10) {
+ val = 37 / (divisor + 2);
+ } else {
+ val = 11 / (divisor - 2); /* DANGER, if x <= 10 & x >= y */
+ }
+
+ printf("x=%i: %i", x, val);
+}
+
+#ifndef NO_MAIN
+int main() {
+#ifdef NO_BUG
+ divide_zero_if_else_int2(-4, 11);
+ divide_zero_if_else_int2(-5, 11);
+ divide_zero_if_else_int2(-6, 11);
+#else
+ divide_zero_if_else_int2(-4, 10); /* OK */
+ divide_zero_if_else_int2(-5, 10); /* DANGER */
+ divide_zero_if_else_int2(-6, 10); /* OK */
+#endif
+
+ return 1;
+}
+#endif
diff --git a/bench-moerman2018/general/divide_by_zero/03_simple_if_multi_func.c b/bench-moerman2018/general/divide_by_zero/03_simple_if_multi_func.c
new file mode 100644
index 000000000..51b83a445
--- /dev/null
+++ b/bench-moerman2018/general/divide_by_zero/03_simple_if_multi_func.c
@@ -0,0 +1,50 @@
+#include "divide_by_zero.h"
+#include <stdbool.h>
+#include <stdio.h>
+
+static int choose_divisor(int div1, int div2, bool condition) {
+ if(condition) {
+ return div1;
+ } else {
+ return div2;
+ }
+}
+
+static int conditional_divide(int val, int div1, int div2, bool condition) {
+ if(condition) {
+ return val / div1;
+ }
+ return val / div2;
+}
+
+void divide_zero_if_else_multi(bool a, bool b) {
+ int divisor;
+ int val;
+
+#ifdef CATCH_BAD_PARAM
+ if(!a & !b) {
+ return;
+ }
+#endif
+
+ divisor = choose_divisor(5, 0, a);
+
+ val = conditional_divide(25, divisor+2, divisor, b); /* DANGER, if !a & !b */
+
+ printf("%i\n", val);
+}
+
+#ifndef NO_MAIN
+int main() {
+#ifdef NO_BUG
+ divide_zero_if_else_multi(true, true);
+ divide_zero_if_else_multi(true, false);
+ divide_zero_if_else_multi(false, true);
+#else
+ divide_zero_if_else_multi(true, true); /* OK */
+ divide_zero_if_else_multi(false, false); /* DANGER */
+ divide_zero_if_else_multi(false, true); /* OK */
+#endif
+ return 1;
+}
+#endif
diff --git a/bench-moerman2018/general/divide_by_zero/04_simple_switch.c b/bench-moerman2018/general/divide_by_zero/04_simple_switch.c
new file mode 100644
index 000000000..6251c2d4f
--- /dev/null
+++ b/bench-moerman2018/general/divide_by_zero/04_simple_switch.c
@@ -0,0 +1,61 @@
+#include "divide_by_zero.h"
+
+int divide_zero_switch(int x, int y) {
+ int divisor;
+ int val;
+
+#ifdef CATCH_BAD_PARAM
+ if((x == 10 || x == 5) && x >= y) {
+ return -1;
+ }
+#endif
+
+ if(x < y) {
+ divisor = 1;
+ } else {
+ divisor = 2;
+ }
+
+ switch (x) {
+ case 5: {
+ val = 37 / (divisor - 2); /* DANGER: x >= y */
+ break;
+ }
+ case 7: {
+ val = -37 / (divisor + 2);
+ break;
+ }
+ case 10: {
+ val = 73 / (divisor - 2); /* DANGER: x >= y */
+ break;
+ }
+ case 12: {
+ val = 73 / (divisor + 1);
+ break;
+ }
+ default: {
+ val = 100 / divisor;
+ break;
+ }
+ };
+
+ return val;
+}
+
+#ifndef NO_MAIN
+int main() {
+#ifdef NO_BUG
+ divide_zero_switch(5, 11);
+ divide_zero_switch(10, 11);
+ divide_zero_switch(11, 11);
+ divide_zero_switch(7, 5);
+#else
+ divide_zero_switch(5, 10); /* OK */
+ divide_zero_switch(10, 10); /* DANGER */
+ divide_zero_switch(11, 10); /* OK */
+ divide_zero_switch(7, 5); /* OK */
+#endif
+
+ return 1;
+}
+#endif
diff --git a/bench-moerman2018/general/divide_by_zero/05_simple_goto.c b/bench-moerman2018/general/divide_by_zero/05_simple_goto.c
new file mode 100644
index 000000000..c0e37ab37
--- /dev/null
+++ b/bench-moerman2018/general/divide_by_zero/05_simple_goto.c
@@ -0,0 +1,42 @@
+#include <stdio.h>
+#include "divide_by_zero.h"
+
+void divide_zero_goto(int x) {
+ int val, i;
+ int divisor = 1;
+
+#ifdef CATCH_BAD_PARAM
+ if(x > 0) {
+ return;
+ }
+#endif
+
+ val = 37 / 3;
+ i = 0;
+
+GOTO_LABEL:
+ if(i <= x) {
+ val += 10 / (divisor + 1);
+ } else {
+ printf("%i\n", val);
+ }
+
+ divisor -= 2;
+
+ if(i == 0) {
+ i++;
+ goto GOTO_LABEL;
+ }
+}
+
+#ifndef NO_MAIN
+int main() {
+#ifdef NO_BUG
+ divide_zero_goto(0);
+#else
+ divide_zero_goto(1);
+#endif
+
+ return 1;
+}
+#endif
diff --git a/bench-moerman2018/general/divide_by_zero/06_simple_pass_by_reference.c b/bench-moerman2018/general/divide_by_zero/06_simple_pass_by_reference.c
new file mode 100644
index 000000000..369f80e27
--- /dev/null
+++ b/bench-moerman2018/general/divide_by_zero/06_simple_pass_by_reference.c
@@ -0,0 +1,48 @@
+#include <stdio.h>
+#include <stdbool.h>
+#include "divide_by_zero.h"
+
+static void assign_int(int* dest, int int1, int int2, bool condition) {
+ if(condition) {
+ *dest = int1;
+ } else {
+ *dest = int2;
+ }
+}
+
+void divide_zero_pass_by_reference(bool a, bool b) {
+ int divisor;
+ int val;
+
+#ifdef CATCH_BAD_PARAM
+ if(!a & !b) {
+ return;
+ }
+#endif
+
+ assign_int(&divisor, 2, 0, a);
+
+ if(b) {
+ val = 25 / 4;
+ } else {
+ val = 91 / divisor; /* DANGER, if !a & !b */
+ }
+
+ printf("%i\n", val);
+}
+
+#ifndef NO_MAIN
+int main() {
+#ifdef NO_BUG
+ divide_zero_pass_by_reference(true, true);
+ divide_zero_pass_by_reference(true, false);
+ divide_zero_pass_by_reference(false, true);
+#else
+ divide_zero_pass_by_reference(true, true); /* OK */
+ divide_zero_pass_by_reference(false, false); /* DANGER */
+ divide_zero_pass_by_reference(false, true); /* OK */
+#endif
+
+ return 1;
+}
+#endif
diff --git a/bench-moerman2018/general/divide_by_zero/07_simple_cross_file.c b/bench-moerman2018/general/divide_by_zero/07_simple_cross_file.c
new file mode 100644
index 000000000..3763d8881
--- /dev/null
+++ b/bench-moerman2018/general/divide_by_zero/07_simple_cross_file.c
@@ -0,0 +1,40 @@
+#include "divide_by_zero.h"
+#include "common.h"
+#include <stdbool.h>
+#include <stdio.h>
+
+void divide_zero_cross_file(bool a, bool b) {
+ int divisor;
+ int val;
+
+#ifdef CATCH_BAD_PARAM
+ if(!a & !b) {
+ return;
+ }
+#endif
+
+ divisor = choose_int(2, 0, a);
+
+ if(b) {
+ val = 10 / (divisor + 2);
+ } else {
+ val = 10 / divisor; /* DANGER, if !a & !b */
+ }
+
+ printf("%i\n", val);
+}
+
+#ifndef NO_MAIN
+int main() {
+#ifdef NO_BUG
+ divide_zero_cross_file(true, true);
+ divide_zero_cross_file(true, false);
+ divide_zero_cross_file(false, true);
+#else
+ divide_zero_cross_file(true, true); /* OK */
+ divide_zero_cross_file(false, false); /* DANGER */
+ divide_zero_cross_file(false, true); /* OK */
+#endif
+ return 1;
+}
+#endif
diff --git a/bench-moerman2018/general/divide_by_zero/08_loop_for.c b/bench-moerman2018/general/divide_by_zero/08_loop_for.c
new file mode 100644
index 000000000..80fb2eb69
--- /dev/null
+++ b/bench-moerman2018/general/divide_by_zero/08_loop_for.c
@@ -0,0 +1,40 @@
+#include <stdio.h>
+#include "divide_by_zero.h"
+
+void divide_zero_for(int x) {
+ int divisor = 2;
+ int val = 0;
+ int i;
+
+#ifdef CATCH_BAD_PARAM
+ if(x < 10) {
+ return;
+ }
+#endif
+
+ for(i = 0; i < 20; i++) {
+ if(i > x) {
+ val += 10 / (divisor - 2); /* DANGER: x < 10 */
+ } else {
+ val += 10 / (divisor + 2);
+ }
+ if(i == 10) {
+ divisor = 4;
+ val += 10 / divisor;
+ }
+ }
+
+ printf("val = %i\n", val);
+}
+
+#ifndef NO_MAIN
+int main() {
+#ifdef NO_BUG
+ divide_zero_for(10);
+#else
+ divide_zero_for(9);
+#endif
+
+ return 1;
+}
+#endif
diff --git a/bench-moerman2018/general/divide_by_zero/09_loop_for_complex.c b/bench-moerman2018/general/divide_by_zero/09_loop_for_complex.c
new file mode 100644
index 000000000..5d5dd0a47
--- /dev/null
+++ b/bench-moerman2018/general/divide_by_zero/09_loop_for_complex.c
@@ -0,0 +1,43 @@
+#include <stdio.h>
+#include "divide_by_zero.h"
+
+void divide_zero_for_complex(int x) {
+ int divisor = 2;
+ int val = 0, i = 0;
+
+#ifdef CATCH_BAD_PARAM
+ if(x < 10) {
+ return;
+ }
+#endif
+
+ for(;;) {
+ if(i > x) {
+ val += 10 / (divisor - 2); /* DANGER: x < 10 */
+ } else {
+ val += 10 / (divisor + 2);
+ }
+ if(i == 10) {
+ divisor = 4;
+ val += 10 / divisor;
+ }
+ i++;
+ if(i >= 20) {
+ break;
+ }
+ }
+
+ printf("val = %i\n", val);
+}
+
+#ifndef NO_MAIN
+int main() {
+#ifdef NO_BUG
+ divide_zero_for_complex(10);
+#else
+ divide_zero_for_complex(9);
+#endif
+
+ return 1;
+}
+#endif
diff --git a/bench-moerman2018/general/divide_by_zero/10_loop_while_continue.c b/bench-moerman2018/general/divide_by_zero/10_loop_while_continue.c
new file mode 100644
index 000000000..7aa484627
--- /dev/null
+++ b/bench-moerman2018/general/divide_by_zero/10_loop_while_continue.c
@@ -0,0 +1,43 @@
+#include <stdio.h>
+#include "divide_by_zero.h"
+
+void divide_zero_while_continue(int x) {
+ int divisor = 2;
+ int val = 0, i = 0;
+
+#ifdef CATCH_BAD_PARAM
+ if(x < 10) {
+ return;
+ }
+#endif
+
+ while(i < 30) {
+ if(i > x) {
+ val += 10 / (divisor - 2); /* DANGER: x < 10 */
+ } else {
+ val += 10 / (divisor + 2);
+ }
+ if(i == 10) {
+ divisor = 4;
+ val += 10 / divisor;
+ }
+ i++;
+ if(i < 20) {
+ continue;
+ }
+ }
+
+ printf("val = %i", val);
+}
+
+#ifndef NO_MAIN
+int main() {
+#ifdef NO_BUG
+ divide_zero_while_continue(10);
+#else
+ divide_zero_while_continue(9);
+#endif
+
+ return 1;
+}
+#endif
diff --git a/bench-moerman2018/general/divide_by_zero/11_loop_while_do_continue.c b/bench-moerman2018/general/divide_by_zero/11_loop_while_do_continue.c
new file mode 100644
index 000000000..47aa15bb0
--- /dev/null
+++ b/bench-moerman2018/general/divide_by_zero/11_loop_while_do_continue.c
@@ -0,0 +1,43 @@
+#include <stdio.h>
+#include "divide_by_zero.h"
+
+void divide_zero_do_while_continue(int x) {
+ int divisor = 2;
+ int val = 0, i = 0;
+
+#ifdef CATCH_BAD_PARAM
+ if(x < 10) {
+ return;
+ }
+#endif
+
+ do {
+ if(i > x) {
+ val += 10 / (divisor - 2); /* DANGER: x < 10 */
+ } else {
+ val += 10 / (divisor + 2);
+ }
+ if(i == 10) {
+ divisor = 4;
+ val += 10 / divisor;
+ }
+ i++;
+ if(i < 20) {
+ continue;
+ }
+ } while(i < 30);
+
+ printf("val = %i", val);
+}
+
+#ifndef NO_MAIN
+int main() {
+#ifdef NO_BUG
+ divide_zero_do_while_continue(10);
+#else
+ divide_zero_do_while_continue(9);
+#endif
+
+ return 1;
+}
+#endif
diff --git a/bench-moerman2018/general/divide_by_zero/12_loop_for_array_branching.c b/bench-moerman2018/general/divide_by_zero/12_loop_for_array_branching.c
new file mode 100644
index 000000000..9072950ba
--- /dev/null
+++ b/bench-moerman2018/general/divide_by_zero/12_loop_for_array_branching.c
@@ -0,0 +1,45 @@
+#include <stdio.h>
+#include "divide_by_zero.h"
+
+void divide_zero_for_array(int x) {
+ int divisor = 2;
+ int p[20];
+ int val = 0, i = 0;
+
+ if(x < 0 || x > 19) {
+ return;
+ }
+
+#ifdef CATCH_BAD_PARAM
+ if(x != 19) {
+ return;
+ }
+#endif
+
+ for(i = 0; i < 20; i++) {
+ p[i] = 0;
+ }
+ p[x] = 1;
+
+ for(i = 0; i < 20; i++) {
+ if(p[i] == 1) {
+ divisor -= 2;
+ } else {
+ val = 10 / divisor; /* DANGER: x < 19 */
+ }
+ }
+
+ printf("%i\n", val);
+}
+
+#ifndef NO_MAIN
+int main() {
+#ifdef NO_BUG
+ divide_zero_for_array(19);
+#else
+ divide_zero_for_array(10);
+#endif
+
+ return 1;
+}
+#endif
diff --git a/bench-moerman2018/general/divide_by_zero/13_loop_for_pointer_arithmetic.c b/bench-moerman2018/general/divide_by_zero/13_loop_for_pointer_arithmetic.c
new file mode 100644
index 000000000..e281be055
--- /dev/null
+++ b/bench-moerman2018/general/divide_by_zero/13_loop_for_pointer_arithmetic.c
@@ -0,0 +1,51 @@
+#include <stdlib.h>
+#include <stdio.h>
+#include "divide_by_zero.h"
+
+static void initialize_to_zero(int arr[], int length) {
+ int i;
+
+ for(i = 0; i < length; i++) {
+ arr[i] = 0;
+ }
+}
+
+void divide_zero_for_pointer(int x) {
+ int divisors[10];
+ int* ptr;
+ int val = 0, i;
+
+ if(x < 0 || x > 10) {
+ return;
+ }
+
+#ifdef CATCH_BAD_PARAM
+ if(x != 10) {
+ return;
+ }
+#endif
+
+ initialize_to_zero(divisors, 10);
+
+ for(i = 0, ptr = divisors; i < x; i++, ptr++) {
+ *ptr = i + 1;
+ }
+
+ for(i = 0, ptr = divisors; i <= 9; i++, ptr++) {
+ val += 100 / (*ptr);
+ }
+
+ printf("%i\n", val);
+}
+
+#ifndef NO_MAIN
+int main() {
+#ifdef NO_BUG
+ divide_zero_for_pointer(10);
+#else
+ divide_zero_for_pointer(9);
+#endif
+
+ return 1;
+}
+#endif
diff --git a/bench-moerman2018/general/divide_by_zero/14_loop_recursion.c b/bench-moerman2018/general/divide_by_zero/14_loop_recursion.c
new file mode 100644
index 000000000..50f62c20c
--- /dev/null
+++ b/bench-moerman2018/general/divide_by_zero/14_loop_recursion.c
@@ -0,0 +1,39 @@
+#include <stdio.h>
+#include "divide_by_zero.h"
+
+int divide_zero_rec(int x, int i, int div1, int div2) {
+ int divisor;
+
+ if(i <= 1 || div1 == 0) {
+ return 0;
+ }
+
+#ifdef CATCH_BAD_PARAM
+ if(x > 10 && i < x && div2 == 0) {
+ return divide_zero_rec(x, i-1, div1, div1);
+ }
+#endif
+
+ if(i < x) {
+ divisor = div2;
+ } else {
+ divisor = div1;
+ }
+ if(i == 10) {
+ div2 = div1;
+ }
+ return divide_zero_rec(x, i-1, div1, div2) + 100 / divisor;
+}
+
+#ifndef NO_MAIN
+int main() {
+#ifdef NO_BUG
+ printf("%i\n", divide_zero_rec(10, 20, 5, 0));
+ printf("%i\n", divide_zero_rec(11, 20, 5, 6));
+#else
+ printf("%i\n", divide_zero_rec(11, 20, 5, 0));
+#endif
+
+ return 1;
+}
+#endif
diff --git a/bench-moerman2018/general/divide_by_zero/15_loop_recursion_multi.c b/bench-moerman2018/general/divide_by_zero/15_loop_recursion_multi.c
new file mode 100644
index 000000000..b026d4c13
--- /dev/null
+++ b/bench-moerman2018/general/divide_by_zero/15_loop_recursion_multi.c
@@ -0,0 +1,48 @@
+#include <stdio.h>
+#include "divide_by_zero.h"
+
+int divide_zero_rec_decr(int x, int i, int div1, int div2) {
+ if(i <= 1) {
+ return 0;
+ }
+
+ return divide_zero_rec_multi(x, i-1, div1, div2);
+}
+
+int divide_zero_rec_multi(int x, int i, int div1, int div2) {
+ int divisor;
+
+ if(i <= 1 || div1 == 0) {
+ return 0;
+ }
+
+#ifdef CATCH_BAD_PARAM
+ if(x > 10 && i < x && div2 == 0) {
+ return divide_zero_rec(x, i-1, div1, div1);
+ }
+#endif
+
+ if(i < x) {
+ divisor = div2;
+ } else {
+ divisor = div1;
+ }
+ if(i == 10) {
+ div2 = div1;
+ }
+ return divide_zero_rec_decr(x, i, div1, div2) + 100 / divisor;
+}
+
+
+
+#ifndef NO_MAIN
+int main() {
+#ifdef NO_BUG
+ printf("%i", divide_zero_rec_multi(10, 20, 6, 0));
+#else
+ printf("%i", divide_zero_rec_multi(11, 20, 6, 0));
+#endif
+
+ return 1;
+}
+#endif
diff --git a/bench-moerman2018/general/divide_by_zero/16_misc_pseudo_recursion.c b/bench-moerman2018/general/divide_by_zero/16_misc_pseudo_recursion.c
new file mode 100644
index 000000000..6730681b2
--- /dev/null
+++ b/bench-moerman2018/general/divide_by_zero/16_misc_pseudo_recursion.c
@@ -0,0 +1,52 @@
+#include <stdio.h>
+#include "divide_by_zero.h"
+
+int divide_zero_pseudo_rec1(int x, int y, int i, int div1, int div2) {
+#ifdef CATCH_BAD_PARAM
+ if(!div2 && x >= y && x < 10) {
+ return 0;
+ }
+ if(!div1 && (x > 10 || (x <= 10 && x < y))) {
+ return 0;
+ }
+#endif
+
+ if(i > 0) {
+ return 37;
+ }
+
+ if(x < y) {
+ div2 = div1;
+ }
+
+ return divide_zero_pseudo_rec2(x, y, 1, div1, div2);
+}
+
+int divide_zero_pseudo_rec2(int x, int y, int i, int div1, int div2) {
+ int divisor;
+ if(i <= 0) {
+ return 10 / div1 + divide_zero_pseudo_rec1(x, y, 1, div1, div2);
+ }
+
+ if(x > 10) {
+ divisor = div1;
+ } else {
+ divisor = div2;
+ }
+
+ return 100 / divisor;
+}
+
+#ifndef NO_MAIN
+int main() {
+#ifdef NO_BUG
+ printf("%i\n", divide_zero_pseudo_rec1(9, 10, 0, 5, 0));
+ printf("%i\n", divide_zero_pseudo_rec1(10, 10, 0, 5, 6));
+ printf("%i\n", divide_zero_pseudo_rec1(11, 10, 0, 5, 0));
+#else
+ printf("%i\n", divide_zero_pseudo_rec1(10, 10, 0, 5, 0));
+#endif
+
+ return 1;
+}
+#endif
diff --git a/bench-moerman2018/general/divide_by_zero/17_complex_function_pointers.c b/bench-moerman2018/general/divide_by_zero/17_complex_function_pointers.c
new file mode 100644
index 000000000..f1f04ac48
--- /dev/null
+++ b/bench-moerman2018/general/divide_by_zero/17_complex_function_pointers.c
@@ -0,0 +1,48 @@
+#include <stdio.h>
+#include <stdbool.h>
+#include "divide_by_zero.h"
+
+static void assign_int(int* dest, int int1, int int2, bool condition) {
+ if(condition) {
+ *dest = int1;
+ } else {
+ *dest = int2;
+ }
+}
+
+void divide_zero_function_pointer(bool a, bool b, void (*f)(int*, int, int, bool)) {
+ int divisor;
+ int val;
+
+#ifdef CATCH_BAD_PARAM
+ if(!f || (!a & !b)) {
+ return;
+ }
+#endif
+
+ (*f)(&divisor, 2, 0, a);
+
+ if(b) {
+ val = 25 / 4;
+ } else {
+ val = 91 / divisor; /* DANGER, if !a & !b */
+ }
+
+ printf("%i\n", val);
+}
+
+#ifndef NO_MAIN
+int main() {
+#ifdef NO_BUG
+ divide_zero_function_pointer(true, true, &assign_int);
+ divide_zero_function_pointer(true, false, &assign_int);
+ divide_zero_function_pointer(false, true, &assign_int);
+#else
+ divide_zero_function_pointer(true, true, &assign_int); /* OK */
+ divide_zero_function_pointer(false, false, &assign_int); /* DANGER */
+ divide_zero_function_pointer(false, true, &assign_int); /* OK */
+#endif
+
+ return 1;
+}
+#endif
diff --git a/bench-moerman2018/general/divide_by_zero/18_complex_struct_multiple_methods.c b/bench-moerman2018/general/divide_by_zero/18_complex_struct_multiple_methods.c
new file mode 100644
index 000000000..7988245d2
--- /dev/null
+++ b/bench-moerman2018/general/divide_by_zero/18_complex_struct_multiple_methods.c
@@ -0,0 +1,78 @@
+#include <stdio.h>
+#include <stdlib.h>
+#include "divide_by_zero.h"
+
+#ifndef s_DIVBYZERO_REFCOUNT
+#define s_DIVBYZERO_REFCOUNT
+DivideCont* divide_zero_cont_new() {
+ DivideCont* new_cont;
+
+ new_cont = malloc(sizeof(DivideCont));
+
+ if(new_cont) {
+ new_cont->counter = 1;
+ new_cont->divisor = 0;
+ }
+ return new_cont;
+}
+
+void divide_zero_cont_incr(DivideCont* cont) {
+ if(cont) {
+ cont->counter++;
+ }
+}
+void divide_zero_cont_decr(DivideCont* cont) {
+ if(cont->counter <= 1) {
+ cont->divisor = 0;
+ } else {
+ cont->counter--;
+ }
+}
+
+int divide_zero_cont_get_divisor(DivideCont* cont) {
+ return cont->divisor;
+}
+void divide_zero_cont_set_divisor(DivideCont* cont, int divisor) {
+ cont->divisor = divisor;
+}
+#endif //s_DIVBYZERO_REFCOUNT
+
+void divide_zero_struct(int x, int y) {
+ DivideCont cont;
+ int val;
+
+#ifdef CATCH_BAD_PARAM
+ if(x <= 10 && x >= y) {
+ return;
+ }
+#endif
+
+ divide_zero_cont_set_divisor(&cont, 0);
+
+ if(x < y) {
+ divide_zero_cont_set_divisor(&cont, 7);
+ }
+
+ if(x > 10) {
+ val = 50 / 37;
+ } else {
+ /* DANGER: if x <= 10 & x >= y */
+ val = 30 / divide_zero_cont_get_divisor(&cont);
+ }
+
+ printf("x=%i: %i\n", x, val);
+}
+
+#ifndef NO_MAIN
+int main() {
+#ifdef NO_BUG
+ divide_zero_struct(9, 10);
+ divide_zero_struct(10, 11);
+ divide_zero_struct(11, 10);
+#else
+ divide_zero_struct(10, 10); /* DANGER */
+#endif
+
+ return 1;
+}
+#endif
diff --git a/bench-moerman2018/general/divide_by_zero/19_complex_refcount.c b/bench-moerman2018/general/divide_by_zero/19_complex_refcount.c
new file mode 100644
index 000000000..bcf3580d8
--- /dev/null
+++ b/bench-moerman2018/general/divide_by_zero/19_complex_refcount.c
@@ -0,0 +1,67 @@
+#include "divide_by_zero.h"
+#include <stdlib.h>
+#include <stdio.h>
+
+#ifndef s_DIVBYZERO_REFCOUNT
+#define s_DIVBYZERO_REFCOUNT
+DivideCont* divide_zero_cont_new() {
+ DivideCont* new_cont;
+
+ new_cont = malloc(sizeof(DivideCont));
+
+ if(new_cont) {
+ new_cont->counter = 1;
+ new_cont->divisor = 0;
+ }
+ return new_cont;
+}
+
+void divide_zero_cont_incr(DivideCont* cont) {
+ if(cont) {
+ cont->counter++;
+ }
+}
+void divide_zero_cont_decr(DivideCont* cont) {
+ if(cont->counter <= 1) {
+ cont->divisor = 0;
+ } else {
+ cont->counter--;
+ }
+}
+
+int divide_zero_cont_get_divisor(DivideCont* cont) {
+ return cont->divisor;
+}
+void divide_zero_cont_set_divisor(DivideCont* cont, int divisor) {
+ cont->divisor = divisor;
+}
+#endif //s_DIVBYZERO_REFCOUNT
+
+#ifndef NO_MAIN
+int main() {
+ DivideCont* cont;
+ int val;
+
+ cont = divide_zero_cont_new();
+ if(!cont) {
+ return 1;
+ }
+ divide_zero_cont_set_divisor(cont, 35);
+
+ divide_zero_cont_incr(cont);
+ divide_zero_cont_incr(cont);
+ divide_zero_cont_decr(cont);
+ divide_zero_cont_decr(cont);
+#ifndef NO_BUG
+ divide_zero_cont_decr(cont);
+#endif
+
+ val = 30 / divide_zero_cont_get_divisor(cont);
+
+ printf("%i\n", val);
+
+ free(cont);
+
+ return 1;
+}
+#endif
diff --git a/bench-moerman2018/general/divide_by_zero/divide_by_zero.h b/bench-moerman2018/general/divide_by_zero/divide_by_zero.h
new file mode 100644
index 000000000..2fda41f72
--- /dev/null
+++ b/bench-moerman2018/general/divide_by_zero/divide_by_zero.h
@@ -0,0 +1,35 @@
+#include <stdbool.h>
+
+typedef struct _DivideCont DivideCont;
+
+struct _DivideCont {
+ int divisor;
+ unsigned int counter;
+};
+
+DivideCont* divide_zero_cont_new();
+void divide_zero_cont_incr(DivideCont* cont);
+void divide_zero_cont_decr(DivideCont* cont);
+int divide_zero_cont_get_divisor(DivideCont* cont);
+void divide_zero_cont_set_divisor(DivideCont* cont, int divisor);
+
+void divide_zero_for(int x);
+void divide_zero_for_complex(int x);
+void divide_zero_while_continue(int x);
+void divide_zero_do_while_continue(int x);
+void divide_zero_for_array(int x);
+void divide_zero_for_pointer(int x);
+void divide_zero_goto(int x);
+void divide_zero_if_else(bool a, bool b);
+void divide_zero_if_else_multi(bool a, bool b);
+void divide_zero_if_else_int1(int x, int y);
+void divide_zero_if_else_int2(int x, int y);
+void divide_zero_pass_by_reference(bool a, bool b);
+int divide_zero_switch(int x, int y);
+int divide_zero_rec_multi(int x, int i, int div1, int div2);
+int divide_zero_rec(int x, int i, int div1, int div2);
+int divide_zero_pseudo_rec1(int x, int y, int i, int div1, int div2);
+int divide_zero_pseudo_rec2(int x, int y, int i, int div1, int div2);
+void divide_zero_struct(int x, int y);
+void divide_zero_function_pointer(bool a, bool b, void (*f)(int*, int, int, bool));
+void divide_zero_cross_file(bool a, bool b);
diff --git a/bench-moerman2018/general/nullpointer/01_simple_if.c b/bench-moerman2018/general/nullpointer/01_simple_if.c
new file mode 100644
index 000000000..9f48baaed
--- /dev/null
+++ b/bench-moerman2018/general/nullpointer/01_simple_if.c
@@ -0,0 +1,43 @@
+#include <stdio.h>
+#include <stdbool.h>
+#include "nullpointer.h"
+
+void nullpointer_if_else(bool a, bool b) {
+ int arr[3] = {1, 2, 3};
+ int* ptr = 0;
+ int val;
+
+#ifdef CATCH_BAD_PARAM
+ if(!a & !b) {
+ return;
+ }
+#endif
+
+ if(a) {
+ ptr = arr;
+ }
+
+ if(b) {
+ val = arr[2];
+ } else {
+ val = ptr[2]; /* DANGER, if !a & !b */
+ }
+
+ printf("%i\n", val);
+}
+
+#ifndef NO_MAIN
+int main() {
+#ifdef NO_BUG
+ nullpointer_if_else(true, true);
+ nullpointer_if_else(true, false);
+ nullpointer_if_else(false, true);
+#else
+ nullpointer_if_else(true, true); /* OK */
+ nullpointer_if_else(false, false); /* DANGER */
+ nullpointer_if_else(false, true); /* OK */
+#endif
+
+ return 1;
+}
+#endif
diff --git a/bench-moerman2018/general/nullpointer/02_simple_if_int1.c b/bench-moerman2018/general/nullpointer/02_simple_if_int1.c
new file mode 100644
index 000000000..09e38e5d8
--- /dev/null
+++ b/bench-moerman2018/general/nullpointer/02_simple_if_int1.c
@@ -0,0 +1,42 @@
+#include <stdio.h>
+#include "nullpointer.h"
+
+void nullpointer_if_else_int1(int x, int y) {
+ int arr[3] = {1, 2, 3};
+ int* ptr = 0;
+ int val;
+
+#ifdef CATCH_BAD_PARAM
+ if(x <= 10 && x >= y) {
+ return;
+ }
+#endif
+
+ if(x < y) {
+ ptr = arr;
+ }
+
+ if(x > 10) {
+ val = arr[2];
+ } else {
+ val = ptr[2]; /* DANGER, if x <= 10 & x >= y */
+ }
+
+ printf("x=%i: %i", x, val);
+}
+
+#ifndef NO_MAIN
+int main() {
+#ifdef NO_BUG
+ nullpointer_if_else_int1(9, 10);
+ nullpointer_if_else_int1(10, 11);
+ nullpointer_if_else_int1(11, 10);
+#else
+ nullpointer_if_else_int1(9, 10); /* OK */
+ nullpointer_if_else_int1(10, 10); /* DANGER */
+ nullpointer_if_else_int1(11, 10); /* OK */
+#endif
+
+ return 1;
+}
+#endif
diff --git a/bench-moerman2018/general/nullpointer/02_simple_if_int2.c b/bench-moerman2018/general/nullpointer/02_simple_if_int2.c
new file mode 100644
index 000000000..e1acecb3c
--- /dev/null
+++ b/bench-moerman2018/general/nullpointer/02_simple_if_int2.c
@@ -0,0 +1,47 @@
+#include <stdio.h>
+#include "nullpointer.h"
+
+void nullpointer_if_else_int2(int x, int y) {
+ int arr[3] = {1, 2, 3};
+ int* ptr = 0;
+ int val, m, n;
+
+ m = -1;
+ n = 5;
+
+ x = x*m+n;
+
+#ifdef CATCH_BAD_PARAM
+ if(x <= 10 && x >= y) {
+ return;
+ }
+#endif
+
+ if(x < y) {
+ ptr = arr;
+ }
+
+ if(x > 10) {
+ val = arr[2];
+ } else {
+ val = ptr[2]; /* DANGER: x <= 10 && x >= y */
+ }
+
+ printf("x=%i: %i", x, val);
+}
+
+#ifndef NO_MAIN
+int main() {
+#ifdef NO_BUG
+ nullpointer_if_else_int2(-4, 11);
+ nullpointer_if_else_int2(-5, 11);
+ nullpointer_if_else_int2(-6, 11);
+#else
+ nullpointer_if_else_int2(-4, 10); /* OK */
+ nullpointer_if_else_int2(-5, 10); /* DANGER */
+ nullpointer_if_else_int2(-6, 10); /* OK */
+#endif
+
+ return 1;
+}
+#endif
diff --git a/bench-moerman2018/general/nullpointer/03_simple_if_multi_func.c b/bench-moerman2018/general/nullpointer/03_simple_if_multi_func.c
new file mode 100644
index 000000000..f096cb9e9
--- /dev/null
+++ b/bench-moerman2018/general/nullpointer/03_simple_if_multi_func.c
@@ -0,0 +1,51 @@
+#include "nullpointer.h"
+#include <stdbool.h>
+#include <stdio.h>
+
+static int* choose_pointer_local(int* source1, int* source2, bool condition) {
+ if(condition) {
+ return source1;
+ } else {
+ return source2;
+ }
+}
+
+static int int_dereference_choice_local(int* source1, int* source2, bool condition) {
+ if(condition) {
+ return *source1;
+ }
+ return *source2;
+}
+
+void nullpointer_if_else_multi(bool a, bool b) {
+ int arr[3] = {1, 2, 3};
+ int* ptr = 0;
+ int val;
+
+#ifdef CATCH_BAD_PARAM
+ if(!a & !b) {
+ return;
+ }
+#endif
+
+ ptr = choose_pointer_local(arr+1, 0, a);
+
+ val = int_dereference_choice_local(arr+2, ptr, b); /* DANGER, if !a & !b */
+
+ printf("%i\n", val);
+}
+
+#ifndef NO_MAIN
+int main() {
+#ifdef NO_BUG
+ nullpointer_if_else_multi(true, true);
+ nullpointer_if_else_multi(true, false);
+ nullpointer_if_else_multi(false, true);
+#else
+ nullpointer_if_else_multi(true, true); /* OK */
+ nullpointer_if_else_multi(false, false); /* DANGER */
+ nullpointer_if_else_multi(false, true); /* OK */
+#endif
+ return 1;
+}
+#endif
diff --git a/bench-moerman2018/general/nullpointer/04_simple_switch.c b/bench-moerman2018/general/nullpointer/04_simple_switch.c
new file mode 100644
index 000000000..b2289b46b
--- /dev/null
+++ b/bench-moerman2018/general/nullpointer/04_simple_switch.c
@@ -0,0 +1,60 @@
+#include "nullpointer.h"
+
+int nullpointer_switch(int x, int y) {
+ int arr[3] = {1, 2, 3};
+ int* ptr = 0;
+ int val;
+
+#ifdef CATCH_BAD_PARAM
+ if((x == 10 || x == 5) && x >= y) {
+ return -1;
+ }
+#endif
+
+ if(x < y) {
+ ptr = arr;
+ }
+
+ switch (x) {
+ case 5: {
+ val = *(ptr+2); /* DANGER: x >= y */
+ break;
+ }
+ case 7: {
+ val = arr[0] + 5;
+ break;
+ }
+ case 10: {
+ val = *ptr; /* DANGER: x >= y */
+ break;
+ }
+ case 12: {
+ val = arr[2] + 5;
+ break;
+ }
+ default: {
+ val = arr[1];
+ break;
+ }
+ };
+
+ return val;
+}
+
+#ifndef NO_MAIN
+int main() {
+#ifdef NO_BUG
+ nullpointer_switch(5, 11);
+ nullpointer_switch(10, 11);
+ nullpointer_switch(11, 10);
+ nullpointer_switch(7, 5);
+#else
+ nullpointer_switch(5, 10); /* OK */
+ nullpointer_switch(10, 10); /* DANGER */
+ nullpointer_switch(11, 10); /* OK */
+ nullpointer_switch(7, 5); /* OK */
+#endif
+
+ return 1;
+}
+#endif
diff --git a/bench-moerman2018/general/nullpointer/05_simple_goto.c b/bench-moerman2018/general/nullpointer/05_simple_goto.c
new file mode 100644
index 000000000..8ef65e01c
--- /dev/null
+++ b/bench-moerman2018/general/nullpointer/05_simple_goto.c
@@ -0,0 +1,43 @@
+#include <stdio.h>
+#include "nullpointer.h"
+
+void nullpointer_goto(int x) {
+ int arr[3] = {1, 2, 3};
+ int* ptr = arr;
+ int val, i;
+
+#ifdef CATCH_BAD_PARAM
+ if(x > 0) {
+ return;
+ }
+#endif
+
+ val = *(ptr+1);
+ i = 0;
+
+GOTO_LABEL:
+ if(i <= x) {
+ val += *ptr;
+ } else {
+ printf("%i\n", val);
+ }
+
+ ptr = 0;
+
+ if(i == 0) {
+ i++;
+ goto GOTO_LABEL;
+ }
+}
+
+#ifndef NO_MAIN
+int main() {
+#ifdef NO_BUG
+ nullpointer_goto(0);
+#else
+ nullpointer_goto(1);
+#endif
+
+ return 1;
+}
+#endif
diff --git a/bench-moerman2018/general/nullpointer/06_simple_pass_by_reference.c b/bench-moerman2018/general/nullpointer/06_simple_pass_by_reference.c
new file mode 100644
index 000000000..3e16dd360
--- /dev/null
+++ b/bench-moerman2018/general/nullpointer/06_simple_pass_by_reference.c
@@ -0,0 +1,49 @@
+#include <stdio.h>
+#include <stdbool.h>
+#include "nullpointer.h"
+
+static void local_assign_pointer(void** dest, void* source1, void* source2, bool condition) {
+ if(condition) {
+ *dest = source1;
+ } else {
+ *dest = source2;
+ }
+}
+
+void nullpointer_pass_by_reference(bool a, bool b) {
+ int arr[3] = {1, 2, 3};
+ int* ptr;
+ int val;
+
+#ifdef CATCH_BAD_PARAM
+ if(!a & !b) {
+ return;
+ }
+#endif
+
+ local_assign_pointer((void**) &ptr, (void*) arr, 0, a);
+
+ if(b) {
+ val = arr[2];
+ } else {
+ val = ptr[2]; /* DANGER, if !a & !b */
+ }
+
+ printf("%i\n", val);
+}
+
+#ifndef NO_MAIN
+int main() {
+#ifdef NO_BUG
+ nullpointer_pass_by_reference(true, true);
+ nullpointer_pass_by_reference(true, false);
+ nullpointer_pass_by_reference(false, true);
+#else
+ nullpointer_pass_by_reference(true, true); /* OK */
+ nullpointer_pass_by_reference(false, false); /* DANGER */
+ nullpointer_pass_by_reference(false, true); /* OK */
+#endif
+
+ return 1;
+}
+#endif
diff --git a/bench-moerman2018/general/nullpointer/07_cross_file.c b/bench-moerman2018/general/nullpointer/07_cross_file.c
new file mode 100644
index 000000000..a427f32ce
--- /dev/null
+++ b/bench-moerman2018/general/nullpointer/07_cross_file.c
@@ -0,0 +1,41 @@
+#include "nullpointer.h"
+#include "common.h"
+#include <stdbool.h>
+#include <stdio.h>
+
+void nullpointer_cross_file(bool a, bool b) {
+ int arr[3] = {1, 2, 3};
+ int* ptr = 0;
+ int val;
+
+#ifdef CATCH_BAD_PARAM
+ if(!a & !b) {
+ return;
+ }
+#endif
+
+ ptr = (int*)choose_pointer((void*)(arr+1), 0, a);
+
+ if(b) {
+ val = arr[1];
+ } else {
+ val = ptr[1]; /* DANGER, if !a & !b */
+ }
+
+ printf("%i\n", val);
+}
+
+#ifndef NO_MAIN
+int main() {
+#ifdef NO_BUG
+ nullpointer_cross_file(true, true);
+ nullpointer_cross_file(true, false);
+ nullpointer_cross_file(false, true);
+#else
+ nullpointer_cross_file(true, true); /* OK */
+ nullpointer_cross_file(false, false); /* DANGER */
+ nullpointer_cross_file(false, true); /* OK */
+#endif
+ return 1;
+}
+#endif
diff --git a/bench-moerman2018/general/nullpointer/08_loop_for.c b/bench-moerman2018/general/nullpointer/08_loop_for.c
new file mode 100644
index 000000000..59e9f762c
--- /dev/null
+++ b/bench-moerman2018/general/nullpointer/08_loop_for.c
@@ -0,0 +1,41 @@
+#include <stdio.h>
+#include "nullpointer.h"
+
+void nullpointer_for(int x) {
+ int arr[3] = {1, 2, 3};
+ int* ptr = 0;
+ int val = 0;
+ int i;
+
+#ifdef CATCH_BAD_PARAM
+ if(x < 10) {
+ return;
+ }
+#endif
+
+ for(i = 0; i < 20; i++) {
+ if(i > x) {
+ val += *ptr; /* DANGER: x < 10 */
+ } else {
+ val += arr[0];
+ }
+ if(i == 10) {
+ ptr = arr;
+ val += *ptr;
+ }
+ }
+
+ printf("val = %i", val);
+}
+
+#ifndef NO_MAIN
+int main() {
+#ifdef NO_BUG
+ nullpointer_for(10);
+#else
+ nullpointer_for(9);
+#endif
+
+ return 1;
+}
+#endif
diff --git a/bench-moerman2018/general/nullpointer/09_loop_for_complex.c b/bench-moerman2018/general/nullpointer/09_loop_for_complex.c
new file mode 100644
index 000000000..7e738eb4d
--- /dev/null
+++ b/bench-moerman2018/general/nullpointer/09_loop_for_complex.c
@@ -0,0 +1,44 @@
+#include <stdio.h>
+#include "nullpointer.h"
+
+void nullpointer_for_complex(int x) {
+ int arr[3] = {1, 2, 3};
+ int* ptr = 0;
+ int val = 0, i = 0;
+
+#ifdef CATCH_BAD_PARAM
+ if(x < 10) {
+ return;
+ }
+#endif
+
+ for(;;) {
+ if(i > x) {
+ val += *ptr; /* DANGER: x < 10 */
+ } else {
+ val += arr[0];
+ }
+ if(i == 10) {
+ ptr = arr;
+ val += *ptr;
+ }
+ i++;
+ if(i >= 20) {
+ break;
+ }
+ }
+
+ printf("val = %i", val);
+}
+
+#ifndef NO_MAIN
+int main() {
+#ifdef NO_BUG
+ nullpointer_for_complex(10);
+#else
+ nullpointer_for_complex(9);
+#endif
+
+ return 1;
+}
+#endif
diff --git a/bench-moerman2018/general/nullpointer/10_loop_while_continue.c b/bench-moerman2018/general/nullpointer/10_loop_while_continue.c
new file mode 100644
index 000000000..f81e4557c
--- /dev/null
+++ b/bench-moerman2018/general/nullpointer/10_loop_while_continue.c
@@ -0,0 +1,44 @@
+#include <stdio.h>
+#include "nullpointer.h"
+
+void nullpointer_while_continue(int x) {
+ int arr[3] = {1, 2, 3};
+ int* ptr = 0;
+ int val = 0, i = 0;
+
+#ifdef CATCH_BAD_PARAM
+ if(x < 10) {
+ return;
+ }
+#endif
+
+ while(i < 30) {
+ if(i > x) {
+ val += *ptr; /* DANGER: x < 10 */
+ } else {
+ val += arr[0];
+ }
+ if(i == 10) {
+ ptr = arr;
+ val += *ptr;
+ }
+ i++;
+ if(i < 20) {
+ continue;
+ }
+ }
+
+ printf("val = %i", val);
+}
+
+#ifndef NO_MAIN
+int main() {
+#ifdef NO_BUG
+ nullpointer_while_continue(10);
+#else
+ nullpointer_while_continue(9);
+#endif
+
+ return 1;
+}
+#endif
diff --git a/bench-moerman2018/general/nullpointer/11_loop_while_do_continue.c b/bench-moerman2018/general/nullpointer/11_loop_while_do_continue.c
new file mode 100644
index 000000000..0122f8f6a
--- /dev/null
+++ b/bench-moerman2018/general/nullpointer/11_loop_while_do_continue.c
@@ -0,0 +1,44 @@
+#include <stdio.h>
+#include "nullpointer.h"
+
+void nullpointer_do_while_continue(int x) {
+ int arr[3] = {1, 2, 3};
+ int* ptr = 0;
+ int val = 0, i = 0;
+
+#ifdef CATCH_BAD_PARAM
+ if(x < 10) {
+ return;
+ }
+#endif
+
+ do {
+ if(i > x) {
+ val += *ptr; /* DANGER: x < 10 */
+ } else {
+ val += arr[0];
+ }
+ if(i == 10) {
+ ptr = arr;
+ val += *ptr;
+ }
+ i++;
+ if(i < 20) {
+ continue;
+ }
+ } while(i < 30);
+
+ printf("val = %i", val);
+}
+
+#ifndef NO_MAIN
+int main() {
+#ifdef NO_BUG
+ nullpointer_do_while_continue(10);
+#else
+ nullpointer_do_while_continue(9);
+#endif
+
+ return 1;
+}
+#endif
diff --git a/bench-moerman2018/general/nullpointer/12_loop_for_array_branching.c b/bench-moerman2018/general/nullpointer/12_loop_for_array_branching.c
new file mode 100644
index 000000000..7742003bf
--- /dev/null
+++ b/bench-moerman2018/general/nullpointer/12_loop_for_array_branching.c
@@ -0,0 +1,41 @@
+#include <stdio.h>
+#include "nullpointer.h"
+
+void nullpointer_for_array(int x) {
+ int p[20];
+ int* ptr = p;
+ int val = 0, i = 0;
+
+#ifdef CATCH_BAD_PARAM
+ if(x != 19) {
+ return;
+ }
+#endif
+
+ for(i = 0; i < 20; i++) {
+ p[i] = 0;
+ }
+ p[x] = 1;
+
+ for(i = 0; i < 20; i++) {
+ if(p[i] == 1) {
+ ptr = 0;
+ } else {
+ val = *ptr; /* DANGER: x < 19 */
+ }
+ }
+
+ printf("%i\n", val);
+}
+
+#ifndef NO_MAIN
+int main() {
+#ifdef NO_BUG
+ nullpointer_for_array(19);
+#else
+ nullpointer_for_array(10);
+#endif
+
+ return 1;
+}
+#endif
diff --git a/bench-moerman2018/general/nullpointer/13_loop_for_pointer_arithmetic.c b/bench-moerman2018/general/nullpointer/13_loop_for_pointer_arithmetic.c
new file mode 100644
index 000000000..62c389e7d
--- /dev/null
+++ b/bench-moerman2018/general/nullpointer/13_loop_for_pointer_arithmetic.c
@@ -0,0 +1,52 @@
+#include <stdlib.h>
+#include <stdio.h>
+#include "nullpointer.h"
+
+static void initialize_to_null(int* ptr_arr[], int length) {
+ int i;
+
+ for(i = 0; i < length; i++) {
+ ptr_arr[i] = 0;
+ }
+}
+
+void nullpointer_for_pointer(int x) {
+ int* pointers[10];
+ int** ptr;
+ int source[10];
+ int val = 0, i;
+
+#ifdef CATCH_BAD_PARAM
+ if(x != 10) {
+ return;
+ }
+#endif
+
+ initialize_to_null(pointers, 10);
+
+ for(i = 0, ptr = pointers; i < x; i++, ptr++) {
+ *(ptr) = source + i;
+ }
+
+ for(i = 0, ptr = pointers; i <= 9; i++, ptr++) {
+ **(ptr) = i;
+ }
+
+ for(i = 0, ptr = pointers; i <= 9; i++, ptr++) {
+ val += **(ptr);
+ }
+
+ printf("%i\n", val);
+}
+
+#ifndef NO_MAIN
+int main() {
+#ifdef NO_BUG
+ nullpointer_for_pointer(10);
+#else
+ nullpointer_for_pointer(9);
+#endif
+
+ return 1;
+}
+#endif
diff --git a/bench-moerman2018/general/nullpointer/14_loop_recursion.c b/bench-moerman2018/general/nullpointer/14_loop_recursion.c
new file mode 100644
index 000000000..794f8f19d
--- /dev/null
+++ b/bench-moerman2018/general/nullpointer/14_loop_recursion.c
@@ -0,0 +1,48 @@
+#include <stdio.h>
+#include "nullpointer.h"
+
+int nullpointer_rec(int x, int i, int* ptr1, int* ptr2) {
+ int* ptr;
+ int val = 0;
+
+ if(i <= 1) {
+ return 0;
+ }
+
+ if(!ptr1 || !ptr2) { /* Signal the tools that these can be null (for -DNO_MAIN) */
+ val++;
+ }
+
+#ifdef CATCH_BAD_PARAM
+ if(!ptr1 && (!ptr2 || i >= x || i >= 10)) {
+ return -1;
+ }
+ if(!ptr2 && (x > 2 || (i > 10 && x > 10))) {
+ return nullpointer_rec(x, i-1, ptr1, ptr1);
+ }
+#endif
+
+ if(i < x) {
+ ptr = ptr2;
+ } else {
+ ptr = ptr1;
+ }
+ if(i == 10) {
+ return *ptr + nullpointer_rec(x, i-1, ptr1, ptr1);
+ }
+ return val + *ptr + nullpointer_rec(x, i-1, ptr1, ptr2);
+}
+
+#ifndef NO_MAIN
+int main() {
+ int arr[3] = {1, 2, 3};
+#ifdef NO_BUG
+ printf("%i\n", nullpointer_rec(10, 20, arr, 0));
+ printf("%i\n", nullpointer_rec(11, 20, arr, arr+1));
+#else
+ printf("%i\n", nullpointer_rec(11, 20, arr, 0));
+#endif
+
+ return 1;
+}
+#endif
diff --git a/bench-moerman2018/general/nullpointer/15_loop_recursion_multi.c b/bench-moerman2018/general/nullpointer/15_loop_recursion_multi.c
new file mode 100644
index 000000000..a8197ec2a
--- /dev/null
+++ b/bench-moerman2018/general/nullpointer/15_loop_recursion_multi.c
@@ -0,0 +1,53 @@
+#include <stdio.h>
+#include "nullpointer.h"
+
+int nullpointer_rec_decr(int x, int i, int* ptr1, int* ptr2) {
+ if(i <= 1) {
+ return 0;
+ }
+
+ return nullpointer_rec_multi(x, i-1, ptr1, ptr2);
+}
+
+int nullpointer_rec_multi(int x, int i, int* ptr1, int* ptr2) {
+ int val = 0;
+ int* ptr;
+
+ if(!ptr1 || !ptr2) { /* Signal the tools that these can be null (for -DNO_MAIN) */
+ val++;
+ }
+
+#ifdef CATCH_BAD_PARAM
+ if(!ptr1 && (!ptr2 || i >= x || i >= 10)) {
+ return -1;
+ }
+ if(!ptr2 && (x > 2 || (i > 10 && x > 10))) {
+ return nullpointer_rec(x, i-1, ptr1, ptr1);
+ }
+#endif
+
+ if(i < x) {
+ ptr = ptr2;
+ } else {
+ ptr = ptr1;
+ }
+ if(i == 10) {
+ ptr2 = ptr1;
+ }
+ return val + *ptr + nullpointer_rec_decr(x, i, ptr1, ptr2);
+}
+
+
+
+#ifndef NO_MAIN
+int main() {
+ int arr[3] = {1, 2, 3};
+#ifdef NO_BUG
+ printf("%i", nullpointer_rec_multi(10, 20, arr, 0));
+#else
+ printf("%i", nullpointer_rec_multi(11, 20, arr, 0));
+#endif
+
+ return 1;
+}
+#endif
diff --git a/bench-moerman2018/general/nullpointer/16_misc_pseudo_recursion.c b/bench-moerman2018/general/nullpointer/16_misc_pseudo_recursion.c
new file mode 100644
index 000000000..129877cd6
--- /dev/null
+++ b/bench-moerman2018/general/nullpointer/16_misc_pseudo_recursion.c
@@ -0,0 +1,60 @@
+#include <stdio.h>
+#include "nullpointer.h"
+
+int nullpointer_pseudo_rec1(int x, int y, int i, int* ptr1, int* ptr2) {
+ int val = 0;
+
+ if(!ptr1 || !ptr2) { /* Signal the tools that these can be null (for -DNO_MAIN) */
+ val++;
+ }
+
+#ifdef CATCH_BAD_PARAM
+ if(!ptr1 && (x < y || x > 10)) {
+ return -1;
+ }
+ if(!ptr2 && x >= y && x <= 10) {
+ return -1;
+ }
+#endif
+
+ if(i > 0) {
+ return 37;
+ }
+
+ if(x < y) {
+ ptr2 = ptr1;
+ }
+
+ return val + nullpointer_pseudo_rec2(x, y, 1, ptr1, ptr2);
+}
+
+int nullpointer_pseudo_rec2(int x, int y, int i, int* ptr1, int* ptr2) {
+ int* ptr;
+
+ if(i <= 0) {
+ return *ptr1 + nullpointer_pseudo_rec1(x, y, 1, ptr1, ptr2);
+ }
+
+ if(x > 10) {
+ ptr = ptr1;
+ } else {
+ ptr = ptr2;
+ }
+
+ return *ptr;
+}
+
+#ifndef NO_MAIN
+int main() {
+ int arr[3] = {1, 2, 3};
+#ifdef NO_BUG
+ printf("%i\n", nullpointer_pseudo_rec1(9, 10, 0, arr, 0));
+ printf("%i\n", nullpointer_pseudo_rec1(10, 10, 0, arr, arr+1));
+ printf("%i\n", nullpointer_pseudo_rec1(11, 10, 0, arr, 0));
+#else
+ printf("%i\n", nullpointer_pseudo_rec1(10, 10, 0, arr, 0));
+#endif
+
+ return 1;
+}
+#endif
diff --git a/bench-moerman2018/general/nullpointer/17_complex_function_pointers.c b/bench-moerman2018/general/nullpointer/17_complex_function_pointers.c
new file mode 100644
index 000000000..10d6e1d8b
--- /dev/null
+++ b/bench-moerman2018/general/nullpointer/17_complex_function_pointers.c
@@ -0,0 +1,49 @@
+#include <stdio.h>
+#include <stdbool.h>
+#include "nullpointer.h"
+
+static void local_assign_pointer(void** dest, void* source1, void* source2, bool condition) {
+ if(condition) {
+ *dest = source1;
+ } else {
+ *dest = source2;
+ }
+}
+
+void nullpointer_function_pointer(bool a, bool b, void (*f)(void**, void*, void*, bool)) {
+ int arr[3] = {1, 2, 3};
+ int* ptr;
+ int val;
+
+#ifdef CATCH_BAD_PARAM
+ if(!f || (!a & !b)) {
+ return;
+ }
+#endif
+
+ (*f)((void**) &ptr, (void*) arr, 0, a);
+
+ if(b) {
+ val = arr[2];
+ } else {
+ val = ptr[2]; /* DANGER, if !a & !b */
+ }
+
+ printf("%i\n", val);
+}
+
+#ifndef NO_MAIN
+int main() {
+#ifdef NO_BUG
+ nullpointer_function_pointer(true, true, &local_assign_pointer);
+ nullpointer_function_pointer(true, false, &local_assign_pointer);
+ nullpointer_function_pointer(false, true, &local_assign_pointer);
+#else
+ nullpointer_function_pointer(true, true, &local_assign_pointer); /* OK */
+ nullpointer_function_pointer(false, false, &local_assign_pointer); /* DANGER */
+ nullpointer_function_pointer(false, true, &local_assign_pointer); /* OK */
+#endif
+
+ return 1;
+}
+#endif
diff --git a/bench-moerman2018/general/nullpointer/18_complex_struct_multiple_methods.c b/bench-moerman2018/general/nullpointer/18_complex_struct_multiple_methods.c
new file mode 100644
index 000000000..03bb9d7b6
--- /dev/null
+++ b/bench-moerman2018/general/nullpointer/18_complex_struct_multiple_methods.c
@@ -0,0 +1,91 @@
+#include <stdio.h>
+#include <stdlib.h>
+#include "nullpointer.h"
+
+#ifndef s_NULLPOINTER_REFCOUNT
+#define s_NULLPOINTER_REFCOUNT
+NRefCont* null_ref_cont_new() {
+ NRefCont* new_cont;
+
+ new_cont = malloc(sizeof(NRefCont));
+
+ if(new_cont) {
+ new_cont->refc = 1;
+ new_cont->p_data = 0;
+ }
+ return new_cont;
+}
+
+void null_ref(NRefCont* cont) {
+ if(cont) {
+ cont->refc++;
+ }
+}
+void null_unref(NRefCont* cont) {
+ if(cont->refc <= 1) {
+ if(cont->p_data) {
+ cont->p_data = 0;
+ }
+ } else {
+ cont->refc--;
+ }
+}
+
+void* null_ref_cont_get_pointer(NRefCont* cont) {
+ return cont->p_data;
+}
+void null_ref_cont_set_pointer(NRefCont* cont, void* p) {
+ cont->p_data = p;
+}
+#endif //s_NULLPOINTER_REFCOUNT
+
+void nullpointer_struct(int x, int y) {
+ int* data;
+ int val;
+ NRefCont cont;
+
+#ifdef CATCH_BAD_PARAM
+ if(x <= 10 && x >= y) {
+ return;
+ }
+#endif
+
+ null_ref_cont_set_pointer(&cont, 0);
+
+ data = malloc(sizeof(int));
+
+ if(!data) {
+ return;
+ }
+
+ *data = 37;
+
+ if(x < y) {
+ null_ref_cont_set_pointer(&cont, data);
+ }
+
+ if(x > 10) {
+ val = *data;
+ } else {
+ /* DANGER: if x <= 10 & x >= y */
+ val = *((int*) null_ref_cont_get_pointer(&cont));
+ }
+
+ printf("x=%i: %i", x, val);
+ free(data);
+}
+
+#ifndef NO_MAIN
+int main() {
+
+#ifdef NO_BUG
+ nullpointer_struct(9, 10);
+ nullpointer_struct(10, 11);
+ nullpointer_struct(11, 10);
+#else
+ nullpointer_struct(10, 10); /* DANGER */
+#endif
+
+ return 1;
+}
+#endif
diff --git a/bench-moerman2018/general/nullpointer/19_complex_refcount.c b/bench-moerman2018/general/nullpointer/19_complex_refcount.c
new file mode 100644
index 000000000..32e52c42b
--- /dev/null
+++ b/bench-moerman2018/general/nullpointer/19_complex_refcount.c
@@ -0,0 +1,70 @@
+#include "nullpointer.h"
+#include <stdlib.h>
+#include <stdio.h>
+
+#ifndef s_NULLPOINTER_REFCOUNT
+#define s_NULLPOINTER_REFCOUNT
+NRefCont* null_ref_cont_new() {
+ NRefCont* new_cont;
+
+ new_cont = malloc(sizeof(NRefCont));
+
+ if(new_cont) {
+ new_cont->refc = 1;
+ new_cont->p_data = 0;
+ }
+ return new_cont;
+}
+
+void null_ref(NRefCont* cont) {
+ if(cont) {
+ cont->refc++;
+ }
+}
+void null_unref(NRefCont* cont) {
+ if(cont->refc <= 1) {
+ if(cont->p_data) {
+ cont->p_data = 0;
+ }
+ } else {
+ cont->refc--;
+ }
+}
+
+void* null_ref_cont_get_pointer(NRefCont* cont) {
+ return cont->p_data;
+}
+void null_ref_cont_set_pointer(NRefCont* cont, void* p) {
+ cont->p_data = p;
+}
+#endif //s_NULLPOINTER_REFCOUNT
+
+#ifndef NO_MAIN
+int main() {
+ NRefCont* cont;
+ int arr[3] = {1, 2, 3};
+ int val;
+
+ cont = null_ref_cont_new();
+ if(!cont) {
+ return 1;
+ }
+ null_ref_cont_set_pointer(cont, arr);
+
+ null_ref(cont);
+ null_ref(cont);
+ null_unref(cont);
+ null_unref(cont);
+#ifndef NO_BUG
+ null_unref(cont);
+#endif
+
+ val = *((int*) null_ref_cont_get_pointer(cont));
+
+ printf("%i\n", val);
+
+ free(cont);
+
+ return 1;
+}
+#endif
diff --git a/bench-moerman2018/general/nullpointer/nullpointer.h b/bench-moerman2018/general/nullpointer/nullpointer.h
new file mode 100644
index 000000000..f79e51eb2
--- /dev/null
+++ b/bench-moerman2018/general/nullpointer/nullpointer.h
@@ -0,0 +1,36 @@
+#include <stdbool.h>
+
+typedef struct _NullRefCont NRefCont;
+
+struct _NullRefCont {
+ void* p_data;
+ unsigned int refc;
+};
+
+NRefCont* null_ref_cont_new();
+void null_ref(NRefCont* cont);
+void null_unref(NRefCont* cont);
+void* null_ref_cont_get_pointer(NRefCont* cont);
+void null_ref_cont_set_pointer(NRefCont* cont, void* p);
+
+void nullpointer_for(int x);
+void nullpointer_for_complex(int x);
+void nullpointer_while_continue(int x);
+void nullpointer_do_while_continue(int x);
+void nullpointer_for_array(int x);
+void nullpointer_for_pointer(int x);
+void nullpointer_goto(int x);
+void nullpointer_if_else(bool a, bool b);
+void nullpointer_if_else_multi(bool a, bool b);
+void nullpointer_if_else_int1(int x, int y);
+void nullpointer_if_else_int2(int x, int y);
+void nullpointer_pass_by_reference(bool a, bool b);
+int nullpointer_switch(int x, int y);
+int nullpointer_rec_multi(int x, int i, int* ptr1, int* ptr2);
+int nullpointer_rec(int x, int i, int* ptr1, int* ptr2);
+int nullpointer_rec_assign(int x, int i, int* ptr1, int* ptr2);
+int nullpointer_pseudo_rec1(int x, int y, int i, int* ptr1, int* ptr2);
+int nullpointer_pseudo_rec2(int x, int y, int i, int* ptr1, int* ptr2);
+void nullpointer_struct(int x, int y);
+void nullpointer_function_pointer(bool a, bool b, void (*f)(void**, void*, void*, bool));
+void nullpointer_cross_file(bool a, bool b);
diff --git a/bench-moerman2018/general/uninitialized/pointer/01_simple_if.c b/bench-moerman2018/general/uninitialized/pointer/01_simple_if.c
new file mode 100644
index 000000000..0c7f93083
--- /dev/null
+++ b/bench-moerman2018/general/uninitialized/pointer/01_simple_if.c
@@ -0,0 +1,43 @@
+#include <stdio.h>
+#include <stdbool.h>
+#include "uninit_ptr.h"
+
+void uninit_ptr_if_else(bool a, bool b) {
+ int arr[3] = {1, 2, 3};
+ int* ptr;
+ int val;
+
+#ifdef CATCH_BAD_PARAM
+ if(!a & !b) {
+ return;
+ }
+#endif
+
+ if(a) {
+ ptr = arr;
+ }
+
+ if(b) {
+ val = arr[2];
+ } else {
+ val = ptr[2]; /* DANGER, if !a & !b */
+ }
+
+ printf("%i\n", val);
+}
+
+#ifndef NO_MAIN
+int main() {
+#ifdef NO_BUG
+ uninit_ptr_if_else(true, true);
+ uninit_ptr_if_else(true, false);
+ uninit_ptr_if_else(false, true);
+#else
+ uninit_ptr_if_else(true, true); /* OK */
+ uninit_ptr_if_else(false, false); /* DANGER */
+ uninit_ptr_if_else(false, true); /* OK */
+#endif
+
+ return 1;
+}
+#endif
diff --git a/bench-moerman2018/general/uninitialized/pointer/02_simple_if_int1.c b/bench-moerman2018/general/uninitialized/pointer/02_simple_if_int1.c
new file mode 100644
index 000000000..ac79dec79
--- /dev/null
+++ b/bench-moerman2018/general/uninitialized/pointer/02_simple_if_int1.c
@@ -0,0 +1,42 @@
+#include <stdio.h>
+#include "uninit_ptr.h"
+
+void uninit_ptr_if_else_int1(int x, int y) {
+ int arr[3] = {1, 2, 3};
+ int* ptr;
+ int val;
+
+#ifdef CATCH_BAD_PARAM
+ if(x <= 10 && x >= y) {
+ return;
+ }
+#endif
+
+ if(x < y) {
+ ptr = arr;
+ }
+
+ if(x > 10) {
+ val = arr[2];
+ } else {
+ val = ptr[2]; /* DANGER, if x <= 10 & x >= y */
+ }
+
+ printf("x=%i: %i", x, val);
+}
+
+#ifndef NO_MAIN
+int main() {
+#ifdef NO_BUG
+ uninit_ptr_if_else_int1(9, 10);
+ uninit_ptr_if_else_int1(10, 11);
+ uninit_ptr_if_else_int1(11, 10);
+#else
+ uninit_ptr_if_else_int1(9, 10); /* OK */
+ uninit_ptr_if_else_int1(10, 10); /* DANGER */
+ uninit_ptr_if_else_int1(11, 10); /* OK */
+#endif
+
+ return 1;
+}
+#endif
diff --git a/bench-moerman2018/general/uninitialized/pointer/02_simple_if_int2.c b/bench-moerman2018/general/uninitialized/pointer/02_simple_if_int2.c
new file mode 100644
index 000000000..c377178f2
--- /dev/null
+++ b/bench-moerman2018/general/uninitialized/pointer/02_simple_if_int2.c
@@ -0,0 +1,47 @@
+#include <stdio.h>
+#include "uninit_ptr.h"
+
+void uninit_ptr_if_else_int2(int x, int y) {
+ int arr[3] = {1, 2, 3};
+ int* ptr;
+ int val, m, n;
+
+ m = -1;
+ n = 5;
+
+ x = x*m+n;
+
+#ifdef CATCH_BAD_PARAM
+ if(x <= 10 && x >= y) {
+ return;
+ }
+#endif
+
+ if(x < y) {
+ ptr = arr;
+ }
+
+ if(x > 10) {
+ val = arr[2];
+ } else {
+ val = ptr[2]; /* DANGER: x <= 10 && x >= y */
+ }
+
+ printf("x=%i: %i", x, val);
+}
+
+#ifndef NO_MAIN
+int main() {
+#ifdef NO_BUG
+ uninit_ptr_if_else_int2(-4, 11);
+ uninit_ptr_if_else_int2(-5, 11);
+ uninit_ptr_if_else_int2(-6, 11);
+#else
+ uninit_ptr_if_else_int2(-4, 10); /* OK */
+ uninit_ptr_if_else_int2(-5, 10); /* DANGER */
+ uninit_ptr_if_else_int2(-6, 10); /* OK */
+#endif
+
+ return 1;
+}
+#endif
diff --git a/bench-moerman2018/general/uninitialized/pointer/03_simple_if_multi_func.c b/bench-moerman2018/general/uninitialized/pointer/03_simple_if_multi_func.c
new file mode 100644
index 000000000..768eca5b4
--- /dev/null
+++ b/bench-moerman2018/general/uninitialized/pointer/03_simple_if_multi_func.c
@@ -0,0 +1,53 @@
+#include "uninit_ptr.h"
+#include <stdbool.h>
+#include <stdio.h>
+
+static int** choose_pointer_local(int** source1, int** source2, bool condition) {
+ if(condition) {
+ return source1;
+ } else {
+ return source2;
+ }
+}
+
+static int int_dereference_choice_local(int** source1, int** source2, bool condition) {
+ if(condition) {
+ return **source1;
+ }
+ return **source2;
+}
+
+void uninit_ptr_if_else_multi(bool a, bool b) {
+ int arr[3] = {1, 2, 3};
+ int* arr_allias = arr;
+ int** ptr;
+ int* uninit;
+ int val;
+
+#ifdef CATCH_BAD_PARAM
+ if(!a & !b) {
+ return;
+ }
+#endif
+
+ ptr = choose_pointer_local(&arr_allias, &uninit, a);
+
+ val = int_dereference_choice_local(&arr_allias, ptr, b); /* DANGER, if !a & !b */
+
+ printf("%i\n", val);
+}
+
+#ifndef NO_MAIN
+int main() {
+#ifdef NO_BUG
+ uninit_ptr_if_else_multi(true, true);
+ uninit_ptr_if_else_multi(true, false);
+ uninit_ptr_if_else_multi(false, true);
+#else
+ uninit_ptr_if_else_multi(true, true); /* OK */
+ uninit_ptr_if_else_multi(false, false); /* DANGER */
+ uninit_ptr_if_else_multi(false, true); /* OK */
+#endif
+ return 1;
+}
+#endif
diff --git a/bench-moerman2018/general/uninitialized/pointer/04_simple_switch.c b/bench-moerman2018/general/uninitialized/pointer/04_simple_switch.c
new file mode 100644
index 000000000..5b48f93c2
--- /dev/null
+++ b/bench-moerman2018/general/uninitialized/pointer/04_simple_switch.c
@@ -0,0 +1,60 @@
+#include "uninit_ptr.h"
+
+int uninit_ptr_switch(int x, int y) {
+ int arr[3] = {1, 2, 3};
+ int* ptr;
+ int val;
+
+#ifdef CATCH_BAD_PARAM
+ if((x == 10 || x == 5) && x >= y) {
+ return -1;
+ }
+#endif
+
+ if(x < y) {
+ ptr = arr;
+ }
+
+ switch (x) {
+ case 5: {
+ val = *(ptr+2); /* DANGER: x >= y */
+ break;
+ }
+ case 7: {
+ val = arr[0] + 5;
+ break;
+ }
+ case 10: {
+ val = *ptr; /* DANGER: x >= y */
+ break;
+ }
+ case 12: {
+ val = arr[2] + 5;
+ break;
+ }
+ default: {
+ val = arr[1];
+ break;
+ }
+ };
+
+ return val;
+}
+
+#ifndef NO_MAIN
+int main() {
+#ifdef NO_BUG
+ uninit_ptr_switch(5, 11);
+ uninit_ptr_switch(10, 11);
+ uninit_ptr_switch(11, 10);
+ uninit_ptr_switch(7, 5);
+#else
+ uninit_ptr_switch(5, 10); /* OK */
+ uninit_ptr_switch(10, 10); /* DANGER */
+ uninit_ptr_switch(11, 10); /* OK */
+ uninit_ptr_switch(7, 5); /* OK */
+#endif
+
+ return 1;
+}
+#endif
diff --git a/bench-moerman2018/general/uninitialized/pointer/05_simple_goto.c b/bench-moerman2018/general/uninitialized/pointer/05_simple_goto.c
new file mode 100644
index 000000000..1aa1aa8b9
--- /dev/null
+++ b/bench-moerman2018/general/uninitialized/pointer/05_simple_goto.c
@@ -0,0 +1,45 @@
+#include <stdio.h>
+#include "uninit_ptr.h"
+
+void uninit_ptr_goto(int x) {
+ int arr[3] = {1, 2, 3};
+ int* arr_allias = arr;
+ int** ptr = &arr_allias;
+ int* uninit;
+ int val, i;
+
+#ifdef CATCH_BAD_PARAM
+ if(x > 0) {
+ return;
+ }
+#endif
+
+ val = *(*(ptr) + 1);
+ i = 0;
+
+GOTO_LABEL:
+ if(i <= x) {
+ val += **ptr;
+ } else {
+ printf("%i\n", val);
+ }
+
+ ptr = &uninit;
+
+ if(i == 0) {
+ i++;
+ goto GOTO_LABEL;
+ }
+}
+
+#ifndef NO_MAIN
+int main() {
+#ifdef NO_BUG
+ uninit_ptr_goto(0);
+#else
+ uninit_ptr_goto(1);
+#endif
+
+ return 1;
+}
+#endif
diff --git a/bench-moerman2018/general/uninitialized/pointer/06_simple_pass_by_reference.c b/bench-moerman2018/general/uninitialized/pointer/06_simple_pass_by_reference.c
new file mode 100644
index 000000000..c66b061b0
--- /dev/null
+++ b/bench-moerman2018/general/uninitialized/pointer/06_simple_pass_by_reference.c
@@ -0,0 +1,51 @@
+#include <stdio.h>
+#include <stdbool.h>
+#include "uninit_ptr.h"
+
+static void local_assign_pointer(int*** dest, int** source1, int** source2, bool condition) {
+ if(condition) {
+ *dest = source1;
+ } else {
+ *dest = source2;
+ }
+}
+
+void uninit_ptr_pass_by_reference(bool a, bool b) {
+ int arr[3] = {1, 2, 3};
+ int* arr_allias = arr;
+ int** ptr;
+ int* uninit;
+ int val;
+
+#ifdef CATCH_BAD_PARAM
+ if(!a & !b) {
+ return;
+ }
+#endif
+
+ local_assign_pointer(&ptr, &arr_allias, &uninit, a);
+
+ if(b) {
+ val = arr[2];
+ } else {
+ val = **ptr; /* DANGER, if !a & !b */
+ }
+
+ printf("%i\n", val);
+}
+
+#ifndef NO_MAIN
+int main() {
+#ifdef NO_BUG
+ uninit_ptr_pass_by_reference(true, true);
+ uninit_ptr_pass_by_reference(true, false);
+ uninit_ptr_pass_by_reference(false, true);
+#else
+ uninit_ptr_pass_by_reference(true, true); /* OK */
+ uninit_ptr_pass_by_reference(false, false); /* DANGER */
+ uninit_ptr_pass_by_reference(false, true); /* OK */
+#endif
+
+ return 1;
+}
+#endif
diff --git a/bench-moerman2018/general/uninitialized/pointer/07_cross_file.c b/bench-moerman2018/general/uninitialized/pointer/07_cross_file.c
new file mode 100644
index 000000000..323490233
--- /dev/null
+++ b/bench-moerman2018/general/uninitialized/pointer/07_cross_file.c
@@ -0,0 +1,43 @@
+#include "uninit_ptr.h"
+#include "common.h"
+#include <stdbool.h>
+#include <stdio.h>
+
+void uninit_ptr_cross_file(bool a, bool b) {
+ int arr[3] = {1, 2, 3};
+ int* arr_allias = arr;
+ int** ptr;
+ int* uninit;
+ int val;
+
+#ifdef CATCH_BAD_PARAM
+ if(!a & !b) {
+ return;
+ }
+#endif
+
+ ptr = (int**)choose_pointer((void*) &arr_allias, (void*) &uninit, a);
+
+ if(b) {
+ val = arr[2];
+ } else {
+ val = **ptr; /* DANGER, if !a & !b */
+ }
+
+ printf("%i\n", val);
+}
+
+#ifndef NO_MAIN
+int main() {
+#ifdef NO_BUG
+ uninit_ptr_cross_file(true, true);
+ uninit_ptr_cross_file(true, false);
+ uninit_ptr_cross_file(false, true);
+#else
+ uninit_ptr_cross_file(true, true); /* OK */
+ uninit_ptr_cross_file(false, false); /* DANGER */
+ uninit_ptr_cross_file(false, true); /* OK */
+#endif
+ return 1;
+}
+#endif
diff --git a/bench-moerman2018/general/uninitialized/pointer/08_loop_for.c b/bench-moerman2018/general/uninitialized/pointer/08_loop_for.c
new file mode 100644
index 000000000..af0d51e78
--- /dev/null
+++ b/bench-moerman2018/general/uninitialized/pointer/08_loop_for.c
@@ -0,0 +1,41 @@
+#include <stdio.h>
+#include "uninit_ptr.h"
+
+void uninit_ptr_for(int x) {
+ int arr[3] = {1, 2, 3};
+ int* ptr;
+ int val = 0;
+ int i;
+
+#ifdef CATCH_BAD_PARAM
+ if(x < 10) {
+ return;
+ }
+#endif
+
+ for(i = 0; i < 20; i++) {
+ if(i > x) {
+ val += *ptr; /* DANGER: x < 10 */
+ } else {
+ val += arr[0];
+ }
+ if(i == 10) {
+ ptr = arr;
+ val += *ptr;
+ }
+ }
+
+ printf("val = %i", val);
+}
+
+#ifndef NO_MAIN
+int main() {
+#ifdef NO_BUG
+ uninit_ptr_for(10);
+#else
+ uninit_ptr_for(9);
+#endif
+
+ return 1;
+}
+#endif
diff --git a/bench-moerman2018/general/uninitialized/pointer/09_loop_for_complex.c b/bench-moerman2018/general/uninitialized/pointer/09_loop_for_complex.c
new file mode 100644
index 000000000..fa5b22643
--- /dev/null
+++ b/bench-moerman2018/general/uninitialized/pointer/09_loop_for_complex.c
@@ -0,0 +1,44 @@
+#include <stdio.h>
+#include "uninit_ptr.h"
+
+void uninit_ptr_for_complex(int x) {
+ int arr[3] = {1, 2, 3};
+ int* ptr;
+ int val = 0, i = 0;
+
+#ifdef CATCH_BAD_PARAM
+ if(x < 10) {
+ return;
+ }
+#endif
+
+ for(;;) {
+ if(i > x) {
+ val += *ptr; /* DANGER: x < 10 */
+ } else {
+ val += arr[0];
+ }
+ if(i == 10) {
+ ptr = arr;
+ val += *ptr;
+ }
+ i++;
+ if(i >= 20) {
+ break;
+ }
+ }
+
+ printf("val = %i", val);
+}
+
+#ifndef NO_MAIN
+int main() {
+#ifdef NO_BUG
+ uninit_ptr_for_complex(10);
+#else
+ uninit_ptr_for_complex(9);
+#endif
+
+ return 1;
+}
+#endif
diff --git a/bench-moerman2018/general/uninitialized/pointer/10_loop_while_continue.c b/bench-moerman2018/general/uninitialized/pointer/10_loop_while_continue.c
new file mode 100644
index 000000000..a0bdfe4d7
--- /dev/null
+++ b/bench-moerman2018/general/uninitialized/pointer/10_loop_while_continue.c
@@ -0,0 +1,44 @@
+#include <stdio.h>
+#include "uninit_ptr.h"
+
+void uninit_ptr_while_continue(int x) {
+ int arr[3] = {1, 2, 3};
+ int* ptr;
+ int val = 0, i = 0;
+
+#ifdef CATCH_BAD_PARAM
+ if(x < 10) {
+ return;
+ }
+#endif
+
+ while(i < 30) {
+ if(i > x) {
+ val += *ptr; /* DANGER: x < 10 */
+ } else {
+ val += arr[0];
+ }
+ if(i == 10) {
+ ptr = arr;
+ val += *ptr;
+ }
+ i++;
+ if(i < 20) {
+ continue;
+ }
+ }
+
+ printf("val = %i", val);
+}
+
+#ifndef NO_MAIN
+int main() {
+#ifdef NO_BUG
+ uninit_ptr_while_continue(10);
+#else
+ uninit_ptr_while_continue(9);
+#endif
+
+ return 1;
+}
+#endif
diff --git a/bench-moerman2018/general/uninitialized/pointer/11_loop_while_do_continue.c b/bench-moerman2018/general/uninitialized/pointer/11_loop_while_do_continue.c
new file mode 100644
index 000000000..e4cc07c91
--- /dev/null
+++ b/bench-moerman2018/general/uninitialized/pointer/11_loop_while_do_continue.c
@@ -0,0 +1,44 @@
+#include <stdio.h>
+#include "uninit_ptr.h"
+
+void uninit_ptr_do_while_continue(int x) {
+ int arr[3] = {1, 2, 3};
+ int* ptr;
+ int val = 0, i = 0;
+
+#ifdef CATCH_BAD_PARAM
+ if(x < 10) {
+ return;
+ }
+#endif
+
+ do {
+ if(i > x) {
+ val += *ptr; /* DANGER: x < 10 */
+ } else {
+ val += arr[0];
+ }
+ if(i == 10) {
+ ptr = arr;
+ val += *ptr;
+ }
+ i++;
+ if(i < 20) {
+ continue;
+ }
+ } while(i < 30);
+
+ printf("val = %i", val);
+}
+
+#ifndef NO_MAIN
+int main() {
+#ifdef NO_BUG
+ uninit_ptr_do_while_continue(10);
+#else
+ uninit_ptr_do_while_continue(9);
+#endif
+
+ return 1;
+}
+#endif
diff --git a/bench-moerman2018/general/uninitialized/pointer/12_loop_for_array_branching.c b/bench-moerman2018/general/uninitialized/pointer/12_loop_for_array_branching.c
new file mode 100644
index 000000000..99f8cfaa8
--- /dev/null
+++ b/bench-moerman2018/general/uninitialized/pointer/12_loop_for_array_branching.c
@@ -0,0 +1,43 @@
+#include <stdio.h>
+#include "uninit_ptr.h"
+
+void uninit_ptr_for_array(int x) {
+ int p[20];
+ int* arr_allias = p;
+ int** ptr = &arr_allias;
+ int* uninit;
+ int val = 0, i = 0;
+
+#ifdef CATCH_BAD_PARAM
+ if(x != 19) {
+ return;
+ }
+#endif
+
+ for(i = 0; i < 20; i++) {
+ p[i] = 0;
+ }
+ p[x] = 1;
+
+ for(i = 0; i < 20; i++) {
+ if(p[i] == 1) {
+ ptr = &uninit;
+ } else {
+ val = **ptr; /* DANGER: x < 19 */
+ }
+ }
+
+ printf("%i\n", val);
+}
+
+#ifndef NO_MAIN
+int main() {
+#ifdef NO_BUG
+ uninit_ptr_for_array(19);
+#else
+ uninit_ptr_for_array(10);
+#endif
+
+ return 1;
+}
+#endif
diff --git a/bench-moerman2018/general/uninitialized/pointer/13_loop_for_pointer_arithmetic.c b/bench-moerman2018/general/uninitialized/pointer/13_loop_for_pointer_arithmetic.c
new file mode 100644
index 000000000..69c685479
--- /dev/null
+++ b/bench-moerman2018/general/uninitialized/pointer/13_loop_for_pointer_arithmetic.c
@@ -0,0 +1,42 @@
+#include <stdlib.h>
+#include <stdio.h>
+#include "uninit_ptr.h"
+
+void uninit_ptr_for_pointer(int x) {
+ int* pointers[10];
+ int** ptr;
+ int source[10];
+ int val = 0, i;
+
+#ifdef CATCH_BAD_PARAM
+ if(x != 10) {
+ return;
+ }
+#endif
+
+ for(i = 0, ptr = pointers; i < x; i++, ptr++) {
+ *(ptr) = source + i;
+ }
+
+ for(i = 0, ptr = pointers; i <= 9; i++, ptr++) {
+ **(ptr) = i;
+ }
+
+ for(i = 0, ptr = pointers; i <= 9; i++, ptr++) {
+ val += **(ptr);
+ }
+
+ printf("%i\n", val);
+}
+
+#ifndef NO_MAIN
+int main() {
+#ifdef NO_BUG
+ uninit_ptr_for_pointer(10);
+#else
+ uninit_ptr_for_pointer(9);
+#endif
+
+ return 1;
+}
+#endif
diff --git a/bench-moerman2018/general/uninitialized/pointer/14_loop_recursion.c b/bench-moerman2018/general/uninitialized/pointer/14_loop_recursion.c
new file mode 100644
index 000000000..d53a9b811
--- /dev/null
+++ b/bench-moerman2018/general/uninitialized/pointer/14_loop_recursion.c
@@ -0,0 +1,47 @@
+#include <stdio.h>
+#include "uninit_ptr.h"
+
+int uninit_ptr_rec(int x, int i, int** ptr1, int** ptr2) {
+ int** ptr;
+ int* uninit;
+
+ if(i <= 1 || !ptr1) {
+ return 0;
+ }
+
+#ifdef CATCH_BAD_PARAM
+ if(!ptr2 && ((i < 10 && x > 2) || (i >= 10 && x > 10))) {
+ return uninit_ptr_rec(x, i-1, ptr1, ptr1);
+ }
+#endif
+ if(!ptr2) {
+ ptr2 = &uninit;
+ }
+
+ if(i < x) {
+ ptr = ptr2;
+ } else {
+ ptr = ptr1;
+ }
+ if(i == 10) {
+ return **ptr + uninit_ptr_rec(x, i-1, ptr1, ptr1);
+ }
+ return **ptr + uninit_ptr_rec(x, i-1, ptr1, ptr2);
+}
+
+#ifndef NO_MAIN
+int main() {
+ int arr[3] = {1, 2, 3};
+ int* arr_allias = arr;
+ int* uninit;
+#ifdef NO_BUG
+ int* arr_allias2 = arr+1;
+ printf("%i\n", uninit_ptr_rec(10, 20, &arr_allias, &uninit));
+ printf("%i\n", uninit_ptr_rec(11, 20, &arr_allias, &arr_allias2));
+#else
+ printf("%i\n", uninit_ptr_rec(11, 20, &arr_allias, &uninit));
+#endif
+
+ return 1;
+}
+#endif
diff --git a/bench-moerman2018/general/uninitialized/pointer/15_loop_recursion_multi.c b/bench-moerman2018/general/uninitialized/pointer/15_loop_recursion_multi.c
new file mode 100644
index 000000000..0da405202
--- /dev/null
+++ b/bench-moerman2018/general/uninitialized/pointer/15_loop_recursion_multi.c
@@ -0,0 +1,56 @@
+#include <stdio.h>
+#include "uninit_ptr.h"
+
+int uninit_ptr_rec_decr(int x, int i, int** ptr1, int** ptr2) {
+ if(i <= 1) {
+ return 0;
+ }
+
+ return uninit_ptr_rec_multi(x, i-1, ptr1, ptr2);
+}
+
+int uninit_ptr_rec_multi(int x, int i, int** ptr1, int** ptr2) {
+ int** ptr;
+ int* uninit;
+
+ if(!ptr1) {
+ return -1;
+ }
+
+#ifdef CATCH_BAD_PARAM
+ if(!ptr2 && ((i < 10 && x > 2) || (i >= 10 && x > 10))) {
+ return uninit_ptr_rec_decr(x, i, ptr1, ptr1);
+ }
+#endif
+ if(!ptr2) {
+ ptr2 = &uninit;
+ }
+
+ if(i < x) {
+ ptr = ptr2;
+ } else {
+ ptr = ptr1;
+ }
+ if(i == 10) {
+ ptr2 = ptr1;
+ }
+
+ return **ptr + uninit_ptr_rec_decr(x, i, ptr1, ptr2);
+}
+
+
+
+#ifndef NO_MAIN
+int main() {
+ int arr[3] = {1, 2, 3};
+ int* arr_allias = arr;
+ int* uninit;
+#ifdef NO_BUG
+ printf("%i", uninit_ptr_rec_multi(10, 20, &arr_allias, &uninit));
+#else
+ printf("%i", uninit_ptr_rec_multi(11, 20, &arr_allias, &uninit));
+#endif
+
+ return 1;
+}
+#endif
diff --git a/bench-moerman2018/general/uninitialized/pointer/16_misc_pseudo_recursion.c b/bench-moerman2018/general/uninitialized/pointer/16_misc_pseudo_recursion.c
new file mode 100644
index 000000000..702d4bdd3
--- /dev/null
+++ b/bench-moerman2018/general/uninitialized/pointer/16_misc_pseudo_recursion.c
@@ -0,0 +1,58 @@
+#include <stdio.h>
+#include "uninit_ptr.h"
+
+int uninit_ptr_pseudo_rec1(int x, int y, int i, int** ptr1, int** ptr2) {
+ int* uninit;
+#ifdef CATCH_BAD_PARAM
+ if(!ptr2 && x <= 10 && x >= y) {
+ return 0;
+ }
+#endif
+ if(!ptr2) {
+ ptr2 = &uninit;
+ }
+
+ if(i > 0) {
+ return 37;
+ }
+
+ if(x < y) {
+ ptr2 = ptr1;
+ }
+
+ return uninit_ptr_pseudo_rec2(x, y, 1, ptr1, ptr2);
+}
+
+int uninit_ptr_pseudo_rec2(int x, int y, int i, int** ptr1, int** ptr2) {
+ int** ptr;
+
+ if(i > 0) {
+ return **ptr1 + uninit_ptr_pseudo_rec1(x, y, 1, ptr1, ptr2);
+ }
+
+ if(x > 10) {
+ ptr = ptr1;
+ } else {
+ ptr = ptr2;
+ }
+
+ return **ptr;
+}
+
+#ifndef NO_MAIN
+int main() {
+ int arr[3] = {1, 2, 3};
+ int* arr_allias = arr;
+ int* uninit;
+#ifdef NO_BUG
+ int* arr_allias2 = arr+1;
+ printf("%i\n", uninit_ptr_pseudo_rec1(9, 10, 0, &arr_allias, &uninit));
+ printf("%i\n", uninit_ptr_pseudo_rec1(10, 10, 0, &arr_allias, &arr_allias2));
+ printf("%i\n", uninit_ptr_pseudo_rec1(11, 10, 0, &arr_allias, &uninit));
+#else
+ printf("%i\n", uninit_ptr_pseudo_rec1(10, 10, 0, &arr_allias, &uninit));
+#endif
+
+ return 1;
+}
+#endif
diff --git a/bench-moerman2018/general/uninitialized/pointer/17_complex_function_pointers.c b/bench-moerman2018/general/uninitialized/pointer/17_complex_function_pointers.c
new file mode 100644
index 000000000..40b04805a
--- /dev/null
+++ b/bench-moerman2018/general/uninitialized/pointer/17_complex_function_pointers.c
@@ -0,0 +1,51 @@
+#include <stdio.h>
+#include <stdbool.h>
+#include "uninit_ptr.h"
+
+static void local_assign_pointer(int*** dest, int** source1, int** source2, bool condition) {
+ if(condition) {
+ *dest = source1;
+ } else {
+ *dest = source2;
+ }
+}
+
+void uninit_ptr_function_pointer(bool a, bool b, void (*f)(int***, int**, int**, bool)) {
+ int arr[3] = {1, 2, 3};
+ int* arr_allias = arr;
+ int* uninit;
+ int** ptr;
+ int val;
+
+#ifdef CATCH_BAD_PARAM
+ if(!f || (!a & !b)) {
+ return;
+ }
+#endif
+
+ (*f)(&ptr, &arr_allias, &uninit, a);
+
+ if(b) {
+ val = arr[2];
+ } else {
+ val = **ptr; /* DANGER, if !a & !b */
+ }
+
+ printf("%i\n", val);
+}
+
+#ifndef NO_MAIN
+int main() {
+#ifdef NO_BUG
+ uninit_ptr_function_pointer(true, true, &local_assign_pointer);
+ uninit_ptr_function_pointer(true, false, &local_assign_pointer);
+ uninit_ptr_function_pointer(false, true, &local_assign_pointer);
+#else
+ uninit_ptr_function_pointer(true, true, &local_assign_pointer); /* OK */
+ uninit_ptr_function_pointer(false, false, &local_assign_pointer); /* DANGER */
+ uninit_ptr_function_pointer(false, true, &local_assign_pointer); /* OK */
+#endif
+
+ return 1;
+}
+#endif
diff --git a/bench-moerman2018/general/uninitialized/pointer/18_complex_struct_multiple_methods.c b/bench-moerman2018/general/uninitialized/pointer/18_complex_struct_multiple_methods.c
new file mode 100644
index 000000000..e87a941ef
--- /dev/null
+++ b/bench-moerman2018/general/uninitialized/pointer/18_complex_struct_multiple_methods.c
@@ -0,0 +1,92 @@
+#include <stdio.h>
+#include <stdlib.h>
+#include "uninit_ptr.h"
+
+#ifndef s_UNINITIALIZED_P_REFCOUNT
+#define s_UNINITIALIZED_P_REFCOUNT
+void init_uninit_ref_cont(URefCont* cont) {
+ cont->refc = 1;
+ cont->data_ptr = &(cont->data);
+}
+
+URefCont* uninit_ref_cont_new() {
+ URefCont* new_cont;
+
+ new_cont = malloc(sizeof(URefCont));
+
+ if(new_cont) {
+ init_uninit_ref_cont(new_cont);
+ }
+ return new_cont;
+}
+
+void uninit_ref(URefCont* cont) {
+ if(cont) {
+ cont->refc++;
+ }
+}
+void uninit_unref(URefCont* cont) {
+ if(cont->refc <= 1) {
+ cont->data_ptr = &(cont->uninit);
+ } else {
+ cont->refc--;
+ }
+}
+
+void* uninit_ref_cont_get_pointer(URefCont* cont) {
+ return *(cont->data_ptr);
+}
+void uninit_ref_cont_set_pointer(URefCont* cont, void* p) {
+ cont->data = p;
+}
+#endif //s_UNINITIALIZED_P_REFCOUNT
+
+void uninit_ptr_struct(int x, int y) {
+ URefCont cont;
+ int* data;
+ int val;
+
+#ifdef CATCH_BAD_PARAM
+ if(x <= 10 && x >= y) {
+ return;
+ }
+#endif
+
+ init_uninit_ref_cont(&cont);
+
+ data = malloc(sizeof(int));
+
+ if(!data) {
+ return;
+ }
+
+ *data = 37;
+
+ if(x < y) {
+ uninit_ref_cont_set_pointer(&cont, data);
+ }
+
+ if(x > 10) {
+ val = *data;
+ } else {
+ /* DANGER: if x <= 10 & x >= y */
+ val = *((int*) uninit_ref_cont_get_pointer(&cont));
+ }
+
+ printf("x=%i: %i", x, val);
+ free(data);
+}
+
+#ifndef NO_MAIN
+int main() {
+#ifdef NO_BUG
+ uninit_ptr_struct(9, 10);
+ uninit_ptr_struct(10, 11);
+ uninit_ptr_struct(11, 10);
+#else
+ uninit_ptr_struct(10, 10); /* DANGER */
+#endif
+
+ return 1;
+}
+#endif
diff --git a/bench-moerman2018/general/uninitialized/pointer/19_complex_refcount.c b/bench-moerman2018/general/uninitialized/pointer/19_complex_refcount.c
new file mode 100644
index 000000000..512945af8
--- /dev/null
+++ b/bench-moerman2018/general/uninitialized/pointer/19_complex_refcount.c
@@ -0,0 +1,72 @@
+#include "uninit_ptr.h"
+#include <stdlib.h>
+#include <stdio.h>
+
+#ifndef s_UNINITIALIZED_P_REFCOUNT
+#define s_UNINITIALIZED_P_REFCOUNT
+void init_uninit_ref_cont(URefCont* cont) {
+ cont->refc = 1;
+ cont->data_ptr = &(cont->data);
+}
+
+URefCont* uninit_ref_cont_new() {
+ URefCont* new_cont;
+
+ new_cont = malloc(sizeof(URefCont));
+
+ if(new_cont) {
+ init_uninit_ref_cont(new_cont);
+ }
+ return new_cont;
+}
+
+void uninit_ref(URefCont* cont) {
+ if(cont) {
+ cont->refc++;
+ }
+}
+void uninit_unref(URefCont* cont) {
+ if(cont->refc <= 1) {
+ cont->data_ptr = &(cont->uninit);
+ } else {
+ cont->refc--;
+ }
+}
+
+void* uninit_ref_cont_get_pointer(URefCont* cont) {
+ return *(cont->data_ptr);
+}
+void uninit_ref_cont_set_pointer(URefCont* cont, void* p) {
+ cont->data = p;
+}
+#endif //s_UNINITIALIZED_P_REFCOUNT
+
+#ifndef NO_MAIN
+int main() {
+ URefCont* cont;
+ int arr[3] = {1, 2, 3};
+ int val;
+
+ cont = uninit_ref_cont_new();
+ if(!cont) {
+ return 1;
+ }
+ uninit_ref_cont_set_pointer(cont, arr);
+
+ uninit_ref(cont);
+ uninit_ref(cont);
+ uninit_unref(cont);
+ uninit_unref(cont);
+#ifndef NO_BUG
+ uninit_unref(cont);
+#endif
+
+ val = *((int*) uninit_ref_cont_get_pointer(cont));
+
+ printf("%i\n", val);
+
+ free(cont);
+
+ return 1;
+}
+#endif
diff --git a/bench-moerman2018/general/uninitialized/pointer/uninit_ptr.h b/bench-moerman2018/general/uninitialized/pointer/uninit_ptr.h
new file mode 100644
index 000000000..dea78620f
--- /dev/null
+++ b/bench-moerman2018/general/uninitialized/pointer/uninit_ptr.h
@@ -0,0 +1,39 @@
+#include <stdbool.h>
+
+typedef struct _UninitRefCont URefCont;
+
+struct _UninitRefCont {
+ void** data_ptr;
+ void* data;
+ void* uninit;
+ unsigned int refc;
+};
+
+void init_uninit_ref_cont(URefCont* cont);
+URefCont* uninit_ref_cont_new();
+void uninit_ref(URefCont* cont);
+void uninit_unref(URefCont* cont);
+void* uninit_ref_cont_get_pointer(URefCont* cont);
+void uninit_ref_cont_set_pointer(URefCont* cont, void* p);
+
+void uninit_ptr_for(int x);
+void uninit_ptr_for_complex(int x);
+void uninit_ptr_while_continue(int x);
+void uninit_ptr_do_while_continue(int x);
+void uninit_ptr_for_array(int x);
+void uninit_ptr_for_pointer(int x);
+void uninit_ptr_goto(int x);
+void uninit_ptr_if_else(bool a, bool b);
+void uninit_ptr_if_else_multi(bool a, bool b);
+void uninit_ptr_if_else_int1(int x, int y);
+void uninit_ptr_if_else_int2(int x, int y);
+void uninit_ptr_pass_by_reference(bool a, bool b);
+int uninit_ptr_switch(int x, int y);
+int uninit_ptr_rec_multi(int x, int i, int** ptr1, int** ptr2);
+int uninit_ptr_rec(int x, int i, int** ptr1, int** ptr2);
+int uninit_ptr_rec_assign(int x, int i, int* ptr1, int* ptr2);
+int uninit_ptr_pseudo_rec1(int x, int y, int i, int** ptr1, int** ptr2);
+int uninit_ptr_pseudo_rec2(int x, int y, int i, int** ptr1, int** ptr2);
+void uninit_ptr_struct(int x, int y);
+void uninit_ptr_function_pointer(bool a, bool b, void (*f)(int***, int**, int**, bool));
+void uninit_ptr_cross_file(bool a, bool b);
diff --git a/bench-moerman2018/general/uninitialized/value/01_simple_if.c b/bench-moerman2018/general/uninitialized/value/01_simple_if.c
new file mode 100644
index 000000000..81784b0e6
--- /dev/null
+++ b/bench-moerman2018/general/uninitialized/value/01_simple_if.c
@@ -0,0 +1,42 @@
+#include <stdio.h>
+#include <stdbool.h>
+#include "uninitialized_value.h"
+
+void uninit_val_if_else(bool a, bool b) {
+ int possibly_uninit;
+ int val;
+
+#ifdef CATCH_BAD_PARAM
+ if(!a & !b) {
+ return;
+ }
+#endif
+
+ if(a) {
+ possibly_uninit = 1;
+ }
+
+ if(b) {
+ val = 37 * 2;
+ } else {
+ val = 11 * possibly_uninit; /* DANGER, if !a & !b */
+ }
+
+ printf("%i\n", val);
+}
+
+#ifndef NO_MAIN
+int main() {
+#ifdef NO_BUG
+ uninit_val_if_else(true, true);
+ uninit_val_if_else(true, false);
+ uninit_val_if_else(false, true);
+#else
+ uninit_val_if_else(true, true); /* OK */
+ uninit_val_if_else(false, false); /* DANGER */
+ uninit_val_if_else(false, true); /* OK */
+#endif
+
+ return 1;
+}
+#endif
diff --git a/bench-moerman2018/general/uninitialized/value/02_simple_if_int1.c b/bench-moerman2018/general/uninitialized/value/02_simple_if_int1.c
new file mode 100644
index 000000000..dd8fa6144
--- /dev/null
+++ b/bench-moerman2018/general/uninitialized/value/02_simple_if_int1.c
@@ -0,0 +1,41 @@
+#include <stdio.h>
+#include "uninitialized_value.h"
+
+void uninit_val_if_else_int1(int x, int y) {
+ int possibly_uninit;
+ int val;
+
+#ifdef CATCH_BAD_PARAM
+ if(x <= 10 && x >= y) {
+ return;
+ }
+#endif
+
+ if(x < y) {
+ possibly_uninit = 1;
+ }
+
+ if(x > 10) {
+ val = 37 * 2;
+ } else {
+ val = 11 * possibly_uninit; /* DANGER, if x <= 10 & x >= y */
+ }
+
+ printf("x=%i: %i", x, val);
+}
+
+#ifndef NO_MAIN
+int main() {
+#ifdef NO_BUG
+ uninit_val_if_else_int1(9, 10);
+ uninit_val_if_else_int1(10, 11);
+ uninit_val_if_else_int1(11, 10);
+#else
+ uninit_val_if_else_int1(9, 10); /* OK */
+ uninit_val_if_else_int1(10, 10); /* DANGER */
+ uninit_val_if_else_int1(11, 10); /* OK */
+#endif
+
+ return 1;
+}
+#endif
diff --git a/bench-moerman2018/general/uninitialized/value/02_simple_if_int2.c b/bench-moerman2018/general/uninitialized/value/02_simple_if_int2.c
new file mode 100644
index 000000000..65e1e779b
--- /dev/null
+++ b/bench-moerman2018/general/uninitialized/value/02_simple_if_int2.c
@@ -0,0 +1,46 @@
+#include <stdio.h>
+#include "uninitialized_value.h"
+
+void uninit_val_if_else_int2(int x, int y) {
+ int possibly_uninit;
+ int val, m, n;
+
+ m = -1;
+ n = 5;
+
+ x = x*m+n;
+
+#ifdef CATCH_BAD_PARAM
+ if(x <= 10 && x >= y) {
+ return;
+ }
+#endif
+
+ if(x < y) {
+ possibly_uninit = 1;
+ }
+
+ if(x > 10) {
+ val = 37 * 2;
+ } else {
+ val = 11 * possibly_uninit; /* DANGER, if x <= 10 & x >= y */
+ }
+
+ printf("x=%i: %i", x, val);
+}
+
+#ifndef NO_MAIN
+int main() {
+#ifdef NO_BUG
+ uninit_val_if_else_int2(-4, 11);
+ uninit_val_if_else_int2(-5, 11);
+ uninit_val_if_else_int2(-6, 11);
+#else
+ uninit_val_if_else_int2(-4, 10); /* OK */
+ uninit_val_if_else_int2(-5, 10); /* DANGER */
+ uninit_val_if_else_int2(-6, 10); /* OK */
+#endif
+
+ return 1;
+}
+#endif
diff --git a/bench-moerman2018/general/uninitialized/value/03_simple_if_multi_func.c b/bench-moerman2018/general/uninitialized/value/03_simple_if_multi_func.c
new file mode 100644
index 000000000..feae3f210
--- /dev/null
+++ b/bench-moerman2018/general/uninitialized/value/03_simple_if_multi_func.c
@@ -0,0 +1,52 @@
+#include "uninitialized_value.h"
+#include <stdbool.h>
+#include <stdio.h>
+
+static int* choose_int_ptr(int* ptr1, int* ptr2, bool condition) {
+ if(condition) {
+ return ptr1;
+ } else {
+ return ptr2;
+ }
+}
+
+static int conditional_assign(int* ptr1, int* ptr2, bool condition) {
+ if(condition) {
+ return *ptr1;
+ }
+ return *ptr2;
+}
+
+void uninit_val_if_else_multi(bool a, bool b) {
+ int temp_val = 5;
+ int uninit_value;
+ int* temp_ptr;
+ int val;
+
+#ifdef CATCH_BAD_PARAM
+ if(!a & !b) {
+ return;
+ }
+#endif
+
+ temp_ptr = choose_int_ptr(&temp_val, &uninit_value, a);
+
+ val = conditional_assign(&temp_val, temp_ptr, b); /* DANGER, if !a & !b */
+
+ printf("%i\n", val);
+}
+
+#ifndef NO_MAIN
+int main() {
+#ifdef NO_BUG
+ uninit_val_if_else_multi(true, true);
+ uninit_val_if_else_multi(true, false);
+ uninit_val_if_else_multi(false, true);
+#else
+ uninit_val_if_else_multi(true, true); /* OK */
+ uninit_val_if_else_multi(false, false); /* DANGER */
+ uninit_val_if_else_multi(false, true); /* OK */
+#endif
+ return 1;
+}
+#endif
diff --git a/bench-moerman2018/general/uninitialized/value/04_simple_switch.c b/bench-moerman2018/general/uninitialized/value/04_simple_switch.c
new file mode 100644
index 000000000..788117b90
--- /dev/null
+++ b/bench-moerman2018/general/uninitialized/value/04_simple_switch.c
@@ -0,0 +1,59 @@
+#include "uninitialized_value.h"
+
+int uninit_val_switch(int x, int y) {
+ int possibly_uninit;
+ int val;
+
+#ifdef CATCH_BAD_PARAM
+ if((x == 10 || x == 5) && x >= y) {
+ return -1;
+ }
+#endif
+
+ if(x < y) {
+ possibly_uninit = 1;
+ }
+
+ switch (x) {
+ case 5: {
+ val = 37 * possibly_uninit; /* DANGER: x >= y */
+ break;
+ }
+ case 7: {
+ val = -37 * 2;
+ break;
+ }
+ case 10: {
+ val = 73 * possibly_uninit; /* DANGER: x >= y */
+ break;
+ }
+ case 12: {
+ val = 73 * 5;
+ break;
+ }
+ default: {
+ val = 100 * 8;
+ break;
+ }
+ };
+
+ return val;
+}
+
+#ifndef NO_MAIN
+int main() {
+#ifdef NO_BUG
+ uninit_val_switch(5, 11);
+ uninit_val_switch(10, 11);
+ uninit_val_switch(11, 11);
+ uninit_val_switch(7, 5);
+#else
+ uninit_val_switch(5, 10); /* OK */
+ uninit_val_switch(10, 10); /* DANGER */
+ uninit_val_switch(11, 10); /* OK */
+ uninit_val_switch(7, 5); /* OK */
+#endif
+
+ return 1;
+}
+#endif
diff --git a/bench-moerman2018/general/uninitialized/value/05_simple_goto.c b/bench-moerman2018/general/uninitialized/value/05_simple_goto.c
new file mode 100644
index 000000000..a826c5b97
--- /dev/null
+++ b/bench-moerman2018/general/uninitialized/value/05_simple_goto.c
@@ -0,0 +1,44 @@
+#include <stdio.h>
+#include "uninitialized_value.h"
+
+void uninit_val_goto(int x) {
+ int val, i;
+ int possibly_uninit = 1;
+ int uninit_value;
+ int* val_ptr = &possibly_uninit;
+
+#ifdef CATCH_BAD_PARAM
+ if(x > 0) {
+ return;
+ }
+#endif
+
+ val = 37 * *val_ptr;
+ i = 0;
+
+GOTO_LABEL:
+ if(i <= x) {
+ val += *val_ptr;
+ } else {
+ printf("%i\n", val);
+ }
+
+ val_ptr = &uninit_value;
+
+ if(i == 0) {
+ i++;
+ goto GOTO_LABEL;
+ }
+}
+
+#ifndef NO_MAIN
+int main() {
+#ifdef NO_BUG
+ uninit_val_goto(0);
+#else
+ uninit_val_goto(1);
+#endif
+
+ return 1;
+}
+#endif
diff --git a/bench-moerman2018/general/uninitialized/value/06_simple_pass_by_reference.c b/bench-moerman2018/general/uninitialized/value/06_simple_pass_by_reference.c
new file mode 100644
index 000000000..a214848bf
--- /dev/null
+++ b/bench-moerman2018/general/uninitialized/value/06_simple_pass_by_reference.c
@@ -0,0 +1,52 @@
+#include <stdio.h>
+#include <stdbool.h>
+#include "uninitialized_value.h"
+
+static void assign_int_ptr(int** dest, int* ptr1, int* ptr2, bool condition) {
+ if(condition) {
+ *dest = ptr1;
+ } else {
+ *dest = ptr2;
+ }
+}
+
+void uninit_val_pass_by_reference(bool a, bool b) {
+ int* possibly_uninit;
+ int uninit_value;
+ int init_value = 5;
+ int val;
+
+#ifdef CATCH_BAD_PARAM
+ /* To be used if NO_BUG is defined */
+ /* and tool warns about possible dangerous input */
+ if(!a & !b) {
+ return;
+ }
+#endif
+
+ assign_int_ptr(&possibly_uninit, &init_value, &uninit_value, a);
+
+ if(b) {
+ val = 25 * 4;
+ } else {
+ val = 91 * (*possibly_uninit); /* DANGER, if !a & !b */
+ }
+
+ printf("%i\n", val);
+}
+
+#ifndef NO_MAIN
+int main() {
+#ifdef NO_BUG
+ uninit_val_pass_by_reference(true, true);
+ uninit_val_pass_by_reference(true, false);
+ uninit_val_pass_by_reference(false, true);
+#else
+ uninit_val_pass_by_reference(true, true); /* OK */
+ uninit_val_pass_by_reference(false, false); /* DANGER */
+ uninit_val_pass_by_reference(false, true); /* OK */
+#endif
+
+ return 1;
+}
+#endif
diff --git a/bench-moerman2018/general/uninitialized/value/07_simple_cross_file.c b/bench-moerman2018/general/uninitialized/value/07_simple_cross_file.c
new file mode 100644
index 000000000..1c9ae9b10
--- /dev/null
+++ b/bench-moerman2018/general/uninitialized/value/07_simple_cross_file.c
@@ -0,0 +1,42 @@
+#include "uninitialized_value.h"
+#include "common.h"
+#include <stdbool.h>
+#include <stdio.h>
+
+void uninit_val_cross_file(bool a, bool b) {
+ int* possibly_uninit;
+ int init_value = 5;
+ int uninit_value;
+ int val;
+
+#ifdef CATCH_BAD_PARAM
+ if(!a & !b) {
+ return;
+ }
+#endif
+
+ possibly_uninit = (int*) choose_pointer((void*) &init_value, (void*) &uninit_value, a);
+
+ if(b) {
+ val = 10 * 2;
+ } else {
+ val = 10 * (*possibly_uninit); /* DANGER, if !a & !b */
+ }
+
+ printf("%i\n", val);
+}
+
+#ifndef NO_MAIN
+int main() {
+#ifdef NO_BUG
+ uninit_val_cross_file(true, true);
+ uninit_val_cross_file(true, false);
+ uninit_val_cross_file(false, true);
+#else
+ uninit_val_cross_file(true, true); /* OK */
+ uninit_val_cross_file(false, false); /* DANGER */
+ uninit_val_cross_file(false, true); /* OK */
+#endif
+ return 1;
+}
+#endif
diff --git a/bench-moerman2018/general/uninitialized/value/08_loop_for.c b/bench-moerman2018/general/uninitialized/value/08_loop_for.c
new file mode 100644
index 000000000..3ce24b0de
--- /dev/null
+++ b/bench-moerman2018/general/uninitialized/value/08_loop_for.c
@@ -0,0 +1,40 @@
+#include <stdio.h>
+#include "uninitialized_value.h"
+
+void uninit_val_for(int x) {
+ int possibly_uninit;
+ int val = 0;
+ int i;
+
+#ifdef CATCH_BAD_PARAM
+ if(x < 10) {
+ return;
+ }
+#endif
+
+ for(i = 0; i < 20; i++) {
+ if(i > x) {
+ val += 10 * (possibly_uninit - 2); /* DANGER: x < 10 */
+ } else {
+ val += 10 * 4;
+ }
+ if(i == 10) {
+ possibly_uninit = 4;
+ val += 10 * possibly_uninit;
+ }
+ }
+
+ printf("val = %i\n", val);
+}
+
+#ifndef NO_MAIN
+int main() {
+#ifdef NO_BUG
+ uninit_val_for(10);
+#else
+ uninit_val_for(9);
+#endif
+
+ return 1;
+}
+#endif
diff --git a/bench-moerman2018/general/uninitialized/value/09_loop_for_complex.c b/bench-moerman2018/general/uninitialized/value/09_loop_for_complex.c
new file mode 100644
index 000000000..2dec8dfdb
--- /dev/null
+++ b/bench-moerman2018/general/uninitialized/value/09_loop_for_complex.c
@@ -0,0 +1,43 @@
+#include <stdio.h>
+#include "uninitialized_value.h"
+
+void uninit_val_for_complex(int x) {
+ int possibly_uninit;
+ int val = 0, i = 0;
+
+#ifdef CATCH_BAD_PARAM
+ if(x < 10) {
+ return;
+ }
+#endif
+
+ for(;;) {
+ if(i > x) {
+ val += 10 * (possibly_uninit - 2); /* DANGER: x < 10 */
+ } else {
+ val += 10 * 4;
+ }
+ if(i == 10) {
+ possibly_uninit = 4;
+ val += 10 * possibly_uninit;
+ }
+ i++;
+ if(i >= 20) {
+ break;
+ }
+ }
+
+ printf("val = %i\n", val);
+}
+
+#ifndef NO_MAIN
+int main() {
+#ifdef NO_BUG
+ uninit_val_for_complex(10);
+#else
+ uninit_val_for_complex(9);
+#endif
+
+ return 1;
+}
+#endif
diff --git a/bench-moerman2018/general/uninitialized/value/10_loop_while_continue.c b/bench-moerman2018/general/uninitialized/value/10_loop_while_continue.c
new file mode 100644
index 000000000..589551556
--- /dev/null
+++ b/bench-moerman2018/general/uninitialized/value/10_loop_while_continue.c
@@ -0,0 +1,43 @@
+#include <stdio.h>
+#include "uninitialized_value.h"
+
+void uninit_val_while_continue(int x) {
+ int possibly_uninit;
+ int val = 0, i = 0;
+
+#ifdef CATCH_BAD_PARAM
+ if(x < 10) {
+ return;
+ }
+#endif
+
+ while(i < 30) {
+ if(i > x) {
+ val += 10 * (possibly_uninit - 2); /* DANGER: x < 10 */
+ } else {
+ val += 10 * 4;
+ }
+ if(i == 10) {
+ possibly_uninit = 4;
+ val += 10 * possibly_uninit;
+ }
+ i++;
+ if(i < 20) {
+ continue;
+ }
+ }
+
+ printf("val = %i", val);
+}
+
+#ifndef NO_MAIN
+int main() {
+#ifdef NO_BUG
+ uninit_val_while_continue(10);
+#else
+ uninit_val_while_continue(9);
+#endif
+
+ return 1;
+}
+#endif
diff --git a/bench-moerman2018/general/uninitialized/value/11_loop_while_do_continue.c b/bench-moerman2018/general/uninitialized/value/11_loop_while_do_continue.c
new file mode 100644
index 000000000..c00ae8627
--- /dev/null
+++ b/bench-moerman2018/general/uninitialized/value/11_loop_while_do_continue.c
@@ -0,0 +1,43 @@
+#include <stdio.h>
+#include "uninitialized_value.h"
+
+void uninit_val_do_while_continue(int x) {
+ int possibly_uninit;
+ int val = 0, i = 0;
+
+#ifdef CATCH_BAD_PARAM
+ if(x < 10) {
+ return;
+ }
+#endif
+
+ do {
+ if(i > x) {
+ val += 10 * (possibly_uninit - 2); /* DANGER: x < 10 */
+ } else {
+ val += 10 * 4;
+ }
+ if(i == 10) {
+ possibly_uninit = 4;
+ val += 10 * possibly_uninit;
+ }
+ i++;
+ if(i < 20) {
+ continue;
+ }
+ } while(i < 30);
+
+ printf("val = %i", val);
+}
+
+#ifndef NO_MAIN
+int main() {
+#ifdef NO_BUG
+ uninit_val_do_while_continue(10);
+#else
+ uninit_val_do_while_continue(9);
+#endif
+
+ return 1;
+}
+#endif
diff --git a/bench-moerman2018/general/uninitialized/value/12_loop_for_array_branching.c b/bench-moerman2018/general/uninitialized/value/12_loop_for_array_branching.c
new file mode 100644
index 000000000..f3ac7fb5c
--- /dev/null
+++ b/bench-moerman2018/general/uninitialized/value/12_loop_for_array_branching.c
@@ -0,0 +1,47 @@
+#include <stdio.h>
+#include "uninitialized_value.h"
+
+void uninit_val_for_array(int x) {
+ int uninit_value;
+ int init_value = 35;
+ int* possibly_uninit = &init_value;
+ int p[20];
+ int val = 0, i = 0;
+
+ if(x < 0 || x > 19) {
+ return;
+ }
+
+#ifdef CATCH_BAD_PARAM
+ if(x != 19) {
+ return;
+ }
+#endif
+
+ for(i = 0; i < 20; i++) {
+ p[i] = 0;
+ }
+ p[x] = 1;
+
+ for(i = 0; i < 20; i++) {
+ if(p[i] == 1) {
+ possibly_uninit = &uninit_value;
+ } else {
+ val += *possibly_uninit; /* DANGER: x < 19 */
+ }
+ }
+
+ printf("%i\n", val);
+}
+
+#ifndef NO_MAIN
+int main() {
+#ifdef NO_BUG
+ uninit_val_for_array(19);
+#else
+ uninit_val_for_array(10);
+#endif
+
+ return 1;
+}
+#endif
diff --git a/bench-moerman2018/general/uninitialized/value/13_loop_for_pointer_arithmetic.c b/bench-moerman2018/general/uninitialized/value/13_loop_for_pointer_arithmetic.c
new file mode 100644
index 000000000..87fb431ff
--- /dev/null
+++ b/bench-moerman2018/general/uninitialized/value/13_loop_for_pointer_arithmetic.c
@@ -0,0 +1,51 @@
+#include <stdlib.h>
+#include <stdio.h>
+#include "uninitialized_value.h"
+
+static void initialize_to_zero(int arr[], int length) {
+ int i;
+
+ for(i = 0; i < length; i++) {
+ arr[i] = 0;
+ }
+}
+
+void uninit_val_for_pointer(int x) {
+ int possibly_uninits[10];
+ int* ptr;
+ int val = 0, i;
+
+ if(x < 0 || x > 10) {
+ return;
+ }
+
+#ifdef CATCH_BAD_PARAM
+ if(x != 10) {
+ return;
+ }
+#endif
+
+ ptr = possibly_uninits;
+ for(i = 0; i < x; i++, ptr++) {
+ *ptr = i + 1;
+ }
+
+ ptr = possibly_uninits;
+ for(i = 0; i <= 9; i++, ptr++) {
+ val += *ptr;
+ }
+
+ printf("%i\n", val);
+}
+
+#ifndef NO_MAIN
+int main() {
+#ifdef NO_BUG
+ uninit_val_for_pointer(10);
+#else
+ uninit_val_for_pointer(9);
+#endif
+
+ return 1;
+}
+#endif
diff --git a/bench-moerman2018/general/uninitialized/value/14_loop_recursion.c b/bench-moerman2018/general/uninitialized/value/14_loop_recursion.c
new file mode 100644
index 000000000..10946d456
--- /dev/null
+++ b/bench-moerman2018/general/uninitialized/value/14_loop_recursion.c
@@ -0,0 +1,45 @@
+#include <stdio.h>
+#include "uninitialized_value.h"
+
+int uninit_val_rec(int x, int i, int* ptr1, int* ptr2) {
+ int* possibly_uninit;
+ int uninit_val;
+
+ if(i <= 1 || !ptr1) {
+ return 0;
+ }
+
+#ifdef CATCH_BAD_PARAM
+ if(!ptr2 && ((i < 10 && x > 2) || (i >= 10 && x > 10))) {
+ return 0;
+ }
+#endif
+ if(!ptr2) {
+ ptr2 = &uninit_val;
+ }
+
+ if(i < x) {
+ possibly_uninit = ptr2;
+ } else {
+ possibly_uninit = ptr1;
+ }
+ if(i == 10) {
+ *ptr2 = *ptr1;
+ }
+ return 3 * *possibly_uninit + uninit_val_rec(x, i, ptr1, ptr2);
+}
+
+#ifndef NO_MAIN
+int main() {
+ int init_val = 6;
+ int uninit_val;
+#ifdef NO_BUG
+ printf("%i\n", uninit_val_rec(10, 20, &init_val, &uninit_val));
+ printf("%i\n", uninit_val_rec(11, 20, &init_val, &init_val));
+#else
+ printf("%i\n", uninit_val_rec(11, 20, &init_val, &uninit_val));
+#endif
+
+ return 1;
+}
+#endif
diff --git a/bench-moerman2018/general/uninitialized/value/15_loop_recursion_multi.c b/bench-moerman2018/general/uninitialized/value/15_loop_recursion_multi.c
new file mode 100644
index 000000000..ec211a69d
--- /dev/null
+++ b/bench-moerman2018/general/uninitialized/value/15_loop_recursion_multi.c
@@ -0,0 +1,52 @@
+#include <stdio.h>
+#include "uninitialized_value.h"
+
+int uninit_val_rec_decr(int x, int i, int* ptr1, int* ptr2) {
+ if(i <= 1) {
+ return 0;
+ }
+
+ return uninit_val_rec_multi(x, i-1, ptr1, ptr2);
+}
+
+int uninit_val_rec_multi(int x, int i, int* ptr1, int* ptr2) {
+ int* possibly_uninit;
+ int uninit_val;
+
+ if(i <= 1 || !ptr1) {
+ return 0;
+ }
+
+#ifdef CATCH_BAD_PARAM
+ if(!ptr2 && ((i < 10 && x > 2) || (i >= 10 && x > 10))) {
+ return 0;
+ }
+#endif
+ if(!ptr2) {
+ ptr2 = &uninit_val;
+ }
+
+ if(i < x) {
+ possibly_uninit = ptr2;
+ } else {
+ possibly_uninit = ptr1;
+ }
+ if(i == 10) {
+ *ptr2 = *ptr1;
+ }
+ return 3 * *possibly_uninit + uninit_val_rec_decr(x, i, ptr1, ptr2);
+}
+
+#ifndef NO_MAIN
+int main() {
+ int init_val = 6;
+ int uninit_val;
+#ifdef NO_BUG
+ printf("%i", uninit_val_rec_multi(10, 20, &init_val, &uninit_val));
+#else
+ printf("%i", uninit_val_rec_multi(11, 20, &init_val, &uninit_val));
+#endif
+
+ return 1;
+}
+#endif
diff --git a/bench-moerman2018/general/uninitialized/value/16_misc_pseudo_recursion.c b/bench-moerman2018/general/uninitialized/value/16_misc_pseudo_recursion.c
new file mode 100644
index 000000000..ea0e752a4
--- /dev/null
+++ b/bench-moerman2018/general/uninitialized/value/16_misc_pseudo_recursion.c
@@ -0,0 +1,64 @@
+#include <stdio.h>
+#include "uninitialized_value.h"
+
+int uninit_val_pseudo_rec1(int x, int y, int i, int* ptr1, int* ptr2) {
+ int uninit_val;
+ int val;
+
+ if(!ptr1) {
+ return 0;
+ }
+
+#ifdef CATCH_BAD_PARAM
+ if(!ptr2 && x <= 10 && x >= y) {
+ return 0;
+ }
+#endif
+ if(!ptr2) {
+ ptr2 = &uninit_val;
+ }
+
+ if(i > 0) {
+ return 37;
+ }
+
+ if(x < y) {
+ *ptr2 = *ptr1;
+ }
+
+ val = uninit_val_pseudo_rec2(x, y, 1, ptr1, ptr2);
+ ptr2 = 0;
+ return 1 + val;
+}
+
+int uninit_val_pseudo_rec2(int x, int y, int i, int* ptr1, int* ptr2) {
+ int* possibly_uninit;
+
+ if(i <= 0) {
+ return 3 * *ptr1 + uninit_val_pseudo_rec1(x, y, 1, ptr1, ptr2);
+ }
+
+ if(x > 10) {
+ possibly_uninit = ptr1;
+ } else {
+ possibly_uninit = ptr2;
+ }
+
+ return 3 * *possibly_uninit;
+}
+
+#ifndef NO_MAIN
+int main() {
+ int init_val = 6;
+ int uninit_val;
+#ifdef NO_BUG
+ printf("%i\n", uninit_val_pseudo_rec1(9, 10, 0, &init_val, &uninit_val));
+ printf("%i\n", uninit_val_pseudo_rec1(10, 10, 0, &init_val, &init_val));
+ printf("%i\n", uninit_val_pseudo_rec1(11, 10, 0, &init_val, &uninit_val));
+#else
+ printf("%i\n", uninit_val_pseudo_rec1(10, 10, 0, &init_val, &uninit_val));
+#endif
+
+ return 1;
+}
+#endif
diff --git a/bench-moerman2018/general/uninitialized/value/17_complex_function_pointers.c b/bench-moerman2018/general/uninitialized/value/17_complex_function_pointers.c
new file mode 100644
index 000000000..be31afa22
--- /dev/null
+++ b/bench-moerman2018/general/uninitialized/value/17_complex_function_pointers.c
@@ -0,0 +1,52 @@
+#include <stdio.h>
+#include <stdbool.h>
+#include "uninitialized_value.h"
+
+static void assign_int_ptr(int** dest, int* ptr1, int* ptr2, bool condition) {
+ if(condition) {
+ *dest = ptr1;
+ } else {
+ *dest = ptr2;
+ }
+}
+
+void uninit_val_function_pointer(bool a, bool b, void (*f)(int**, int*, int*, bool)) {
+ int* possibly_uninit;
+ int uninit_val;
+ int init_val = 7;
+ int val;
+
+#ifdef CATCH_BAD_PARAM
+ /* To be used if NO_BUG is defined */
+ /* and tool warns about possible dangerous input */
+ if(!f || (!a & !b)) {
+ return;
+ }
+#endif
+
+ (*f)(&possibly_uninit, &init_val, &uninit_val, a);
+
+ if(b) {
+ val = 25 * 4;
+ } else {
+ val = 91 * (*possibly_uninit); /* DANGER, if !a & !b */
+ }
+
+ printf("%i\n", val);
+}
+
+#ifndef NO_MAIN
+int main() {
+#ifdef NO_BUG
+ uninit_val_function_pointer(true, true, &assign_int_ptr);
+ uninit_val_function_pointer(true, false, &assign_int_ptr);
+ uninit_val_function_pointer(false, true, &assign_int_ptr);
+#else
+ uninit_val_function_pointer(true, true, &assign_int_ptr); /* OK */
+ uninit_val_function_pointer(false, false, &assign_int_ptr); /* DANGER */
+ uninit_val_function_pointer(false, true, &assign_int_ptr); /* OK */
+#endif
+
+ return 1;
+}
+#endif
diff --git a/bench-moerman2018/general/uninitialized/value/18_complex_struct_multiple_methods.c b/bench-moerman2018/general/uninitialized/value/18_complex_struct_multiple_methods.c
new file mode 100644
index 000000000..dbe9be466
--- /dev/null
+++ b/bench-moerman2018/general/uninitialized/value/18_complex_struct_multiple_methods.c
@@ -0,0 +1,82 @@
+#include <stdio.h>
+#include <stdlib.h>
+#include "uninitialized_value.h"
+
+#ifndef s_UNINIT_VAL_REFCOUNT
+#define s_UNINIT_VAL_REFCOUNT
+void uninit_val_cont_init(DivideCont* cont) {
+ cont->counter = 1;
+ cont->possibly_uninit = &(cont->init_val);
+}
+
+DivideCont* uninit_val_cont_new() {
+ DivideCont* new_cont;
+
+ new_cont = malloc(sizeof(DivideCont));
+
+ if(new_cont) {
+ uninit_val_cont_init(new_cont);
+ }
+ return new_cont;
+}
+
+void uninit_val_cont_incr(DivideCont* cont) {
+ if(cont) {
+ cont->counter++;
+ }
+}
+void uninit_val_cont_decr(DivideCont* cont) {
+ if(cont->counter <= 1) {
+ cont->possibly_uninit = &(cont->uninit_val);
+ } else {
+ cont->counter--;
+ }
+}
+
+int uninit_val_cont_get_value(DivideCont* cont) {
+ return *(cont->possibly_uninit);
+}
+void uninit_val_cont_set_value(DivideCont* cont, int value) {
+ cont->init_val = value;
+}
+#endif //s_UNINIT_VAL_REFCOUNT
+
+void uninit_val_struct(int x, int y) {
+ DivideCont cont;
+ int val;
+
+#ifdef CATCH_BAD_PARAM
+ if(x <= 10 && x >= y) {
+ return;
+ }
+#endif
+
+ uninit_val_cont_init(&cont);
+
+ if(x < y) {
+ uninit_val_cont_set_value(&cont, 7);
+ }
+
+ if(x > 10) {
+ val = 50 * 37;
+ } else {
+ /* DANGER: if x <= 10 & x >= y */
+ val = 30 * uninit_val_cont_get_value(&cont);
+ }
+
+ printf("x=%i: %i\n", x, val);
+}
+
+#ifndef NO_MAIN
+int main() {
+#ifdef NO_BUG
+ uninit_val_struct(9, 10);
+ uninit_val_struct(10, 11);
+ uninit_val_struct(11, 10);
+#else
+ uninit_val_struct(10, 10); /* DANGER */
+#endif
+
+ return 1;
+}
+#endif
diff --git a/bench-moerman2018/general/uninitialized/value/19_complex_refcount.c b/bench-moerman2018/general/uninitialized/value/19_complex_refcount.c
new file mode 100644
index 000000000..c3cd05278
--- /dev/null
+++ b/bench-moerman2018/general/uninitialized/value/19_complex_refcount.c
@@ -0,0 +1,71 @@
+#include "uninitialized_value.h"
+#include <stdlib.h>
+#include <stdio.h>
+
+#ifndef s_UNINITIALIZED_P_REFCOUNT
+#define s_UNINITIALIZED_P_REFCOUNT
+void uninit_val_cont_init(DivideCont* cont) {
+ cont->counter = 1;
+ cont->possibly_uninit = &(cont->init_val);
+}
+
+DivideCont* uninit_val_cont_new() {
+ DivideCont* new_cont;
+
+ new_cont = malloc(sizeof(DivideCont));
+
+ if(new_cont) {
+ uninit_val_cont_init(new_cont);
+ }
+ return new_cont;
+}
+
+void uninit_val_cont_incr(DivideCont* cont) {
+ if(cont) {
+ cont->counter++;
+ }
+}
+void uninit_val_cont_decr(DivideCont* cont) {
+ if(cont->counter <= 1) {
+ cont->possibly_uninit = &(cont->uninit_val);
+ } else {
+ cont->counter--;
+ }
+}
+
+int uninit_val_cont_get_value(DivideCont* cont) {
+ return *(cont->possibly_uninit);
+}
+void uninit_val_cont_set_value(DivideCont* cont, int value) {
+ cont->init_val = value;
+}
+#endif //s_UNINITIALIZED_P_REFCOUNT
+
+#ifndef NO_MAIN
+int main() {
+ DivideCont* cont;
+ int val;
+
+ cont = uninit_val_cont_new();
+ if(!cont) {
+ return 1;
+ }
+ uninit_val_cont_set_value(cont, 35);
+
+ uninit_val_cont_incr(cont);
+ uninit_val_cont_incr(cont);
+ uninit_val_cont_decr(cont);
+ uninit_val_cont_decr(cont);
+#ifndef NO_BUG
+ uninit_val_cont_decr(cont);
+#endif
+
+ val = 30 * uninit_val_cont_get_value(cont);
+
+ printf("%i\n", val);
+
+ free(cont);
+
+ return 1;
+}
+#endif
diff --git a/bench-moerman2018/general/uninitialized/value/uninitialized_value.h b/bench-moerman2018/general/uninitialized/value/uninitialized_value.h
new file mode 100644
index 000000000..7b7dfbcd7
--- /dev/null
+++ b/bench-moerman2018/general/uninitialized/value/uninitialized_value.h
@@ -0,0 +1,38 @@
+#include <stdbool.h>
+
+typedef struct _DivideCont DivideCont;
+
+struct _DivideCont {
+ int* possibly_uninit;
+ int uninit_val;
+ int init_val;
+ unsigned int counter;
+};
+
+void uninit_val_cont_init(DivideCont* cont);
+DivideCont* uninit_val_cont_new();
+void uninit_val_cont_incr(DivideCont* cont);
+void uninit_val_cont_decr(DivideCont* cont);
+int uninit_val_cont_get_value(DivideCont* cont);
+void uninit_val_cont_set_value(DivideCont* cont, int value);
+
+void uninit_val_for(int x);
+void uninit_val_for_complex(int x);
+void uninit_val_while_continue(int x);
+void uninit_val_do_while_continue(int x);
+void uninit_val_for_array(int x);
+void uninit_val_for_pointer(int x);
+void uninit_val_goto(int x);
+void uninit_val_if_else(bool a, bool b);
+void uninit_val_if_else_multi(bool a, bool b);
+void uninit_val_if_else_int1(int x, int y);
+void uninit_val_if_else_int2(int x, int y);
+void uninit_val_pass_by_reference(bool a, bool b);
+int uninit_val_switch(int x, int y);
+int uninit_val_rec_multi(int x, int i, int* ptr1, int* ptr2);
+int uninit_val_rec(int x, int i, int* ptr1, int* ptr2);
+int uninit_val_pseudo_rec1(int x, int y, int i, int* ptr1, int* ptr2);
+int uninit_val_pseudo_rec2(int x, int y, int i, int* ptr1, int* ptr2);
+void uninit_val_struct(int x, int y);
+void uninit_val_function_pointer(bool a, bool b, void (*f)(int**, int*, int*, bool));
+void uninit_val_cross_file(bool a, bool b);
diff --git a/bench-moerman2018/integers/overflow/01_simple_if.c b/bench-moerman2018/integers/overflow/01_simple_if.c
new file mode 100644
index 000000000..17f0d07e9
--- /dev/null
+++ b/bench-moerman2018/integers/overflow/01_simple_if.c
@@ -0,0 +1,44 @@
+#include <stdio.h>
+#include <stdbool.h>
+#include <limits.h>
+#include "integer_overflow.h"
+
+void integer_overflow_if_else(bool a, bool b) {
+ int val;
+
+#ifdef CATCH_BAD_PARAM
+ if(!a & !b) {
+ return;
+ }
+#endif
+
+ if(a) {
+ val = INT_MAX / 3 - 1;
+ } else {
+ val = INT_MAX / 2 - 1;
+ }
+
+ if(b) {
+ val = val * 2;
+ } else {
+ val = val * 3; /* DANGER if !a */
+ }
+
+ printf("%i\n", val);
+}
+
+#ifndef NO_MAIN
+int main() {
+#ifdef NO_BUG
+ integer_overflow_if_else(true, true);
+ integer_overflow_if_else(true, false);
+ integer_overflow_if_else(false, true);
+#else
+ integer_overflow_if_else(true, true); /* OK */
+ integer_overflow_if_else(false, false); /* DANGER */
+ integer_overflow_if_else(false, true); /* OK */
+#endif
+
+ return 1;
+}
+#endif
diff --git a/bench-moerman2018/integers/overflow/02_simple_if_int1.c b/bench-moerman2018/integers/overflow/02_simple_if_int1.c
new file mode 100644
index 000000000..985462ecf
--- /dev/null
+++ b/bench-moerman2018/integers/overflow/02_simple_if_int1.c
@@ -0,0 +1,43 @@
+#include <stdio.h>
+#include <limits.h>
+#include "integer_overflow.h"
+
+void integer_overflow_if_else_int1(int x, int y) {
+ int val;
+
+#ifdef CATCH_BAD_PARAM
+ if(x <= 10 && x >= y) {
+ return;
+ }
+#endif
+
+ if(x < y) {
+ val = INT_MAX / 3 - 1;
+ } else {
+ val = INT_MAX / 2 - 1;
+ }
+
+ if(x > 10) {
+ val = val * 2;
+ } else {
+ val = val * 3; /* DANGER if x <= 10 & x >= y */
+ }
+
+ printf("%i\n", val);
+}
+
+#ifndef NO_MAIN
+int main() {
+#ifdef NO_BUG
+ integer_overflow_if_else_int1(9, 10);
+ integer_overflow_if_else_int1(10, 11);
+ integer_overflow_if_else_int1(11, 10);
+#else
+ integer_overflow_if_else_int1(9, 10); /* OK */
+ integer_overflow_if_else_int1(10, 10); /* DANGER */
+ integer_overflow_if_else_int1(11, 10); /* OK */
+#endif
+
+ return 1;
+}
+#endif
diff --git a/bench-moerman2018/integers/overflow/02_simple_if_int2.c b/bench-moerman2018/integers/overflow/02_simple_if_int2.c
new file mode 100644
index 000000000..f0cb1a12b
--- /dev/null
+++ b/bench-moerman2018/integers/overflow/02_simple_if_int2.c
@@ -0,0 +1,48 @@
+#include <stdio.h>
+#include <limits.h>
+#include "integer_overflow.h"
+
+void integer_overflow_if_else_int2(int x, int y) {
+ int val, m, n;
+
+ m = -1;
+ n = 5;
+
+ x = x*m+n;
+
+#ifdef CATCH_BAD_PARAM
+ if(x <= 10 && x >= y) {
+ return;
+ }
+#endif
+
+ if(x < y) {
+ val = INT_MAX / 3 - 1;
+ } else {
+ val = INT_MAX / 2 - 1;
+ }
+
+ if(x > 10) {
+ val = val * 2;
+ } else {
+ val = val * 3; /* DANGER if x <= 10 & x >= y */
+ }
+
+ printf("%i\n", val);
+}
+
+#ifndef NO_MAIN
+int main() {
+#ifdef NO_BUG
+ integer_overflow_if_else_int2(-4, 11);
+ integer_overflow_if_else_int2(-5, 11);
+ integer_overflow_if_else_int2(-6, 11);
+#else
+ integer_overflow_if_else_int2(-4, 10); /* OK */
+ integer_overflow_if_else_int2(-5, 10); /* DANGER */
+ integer_overflow_if_else_int2(-6, 10); /* OK */
+#endif
+
+ return 1;
+}
+#endif
diff --git a/bench-moerman2018/integers/overflow/03_simple_if_multi_func.c b/bench-moerman2018/integers/overflow/03_simple_if_multi_func.c
new file mode 100644
index 000000000..f543749c1
--- /dev/null
+++ b/bench-moerman2018/integers/overflow/03_simple_if_multi_func.c
@@ -0,0 +1,50 @@
+#include "integer_overflow.h"
+#include <stdbool.h>
+#include <stdio.h>
+#include <limits.h>
+
+static int local_choose_int(int int1, int int2, bool condition) {
+ if(condition) {
+ return int1;
+ } else {
+ return int2;
+ }
+}
+
+static int conditional_mult(int val, int mult1, int mult2, bool condition) {
+ if(condition) {
+ return val * mult1;
+ }
+ return val * mult2;
+}
+
+void integer_overflow_if_else_multi(bool a, bool b) {
+ int val;
+
+#ifdef CATCH_BAD_PARAM
+ if(!a & !b) {
+ return;
+ }
+#endif
+
+ val = local_choose_int(INT_MAX / 3 - 1, INT_MAX / 2 - 1, a);
+
+ val = conditional_mult(val, 2, 3, b); /* DANGER, if !a & !b */
+
+ printf("%i\n", val);
+}
+
+#ifndef NO_MAIN
+int main() {
+#ifdef NO_BUG
+ integer_overflow_if_else_multi(true, true);
+ integer_overflow_if_else_multi(true, false);
+ integer_overflow_if_else_multi(false, true);
+#else
+ integer_overflow_if_else_multi(true, true); /* OK */
+ integer_overflow_if_else_multi(false, false); /* DANGER */
+ integer_overflow_if_else_multi(false, true); /* OK */
+#endif
+ return 1;
+}
+#endif
diff --git a/bench-moerman2018/integers/overflow/04_simple_switch.c b/bench-moerman2018/integers/overflow/04_simple_switch.c
new file mode 100644
index 000000000..d5476ea40
--- /dev/null
+++ b/bench-moerman2018/integers/overflow/04_simple_switch.c
@@ -0,0 +1,62 @@
+#include "integer_overflow.h"
+#include <limits.h>
+#include <stdio.h>
+
+void integer_overflow_switch(int x, int y) {
+ int val;
+
+#ifdef CATCH_BAD_PARAM
+ if((x == 10 || x == 5) && x >= y) {
+ return;
+ }
+#endif
+
+ if(x < y) {
+ val = INT_MAX / 4 - 1;
+ } else {
+ val = INT_MAX / 2 - 1;
+ }
+
+ switch (x) {
+ case 5: {
+ val = val * 3; /* DANGER: x >= y */
+ break;
+ }
+ case 7: {
+ val = -val;
+ break;
+ }
+ case 10: {
+ val = val * 4; /* DANGER: x >= y */
+ break;
+ }
+ case 12: {
+ val = 2 * val;
+ break;
+ }
+ default: {
+ val = -2 * val;
+ break;
+ }
+ };
+
+ printf("%i\n", val);
+}
+
+#ifndef NO_MAIN
+int main() {
+#ifdef NO_BUG
+ integer_overflow_switch(5, 11);
+ integer_overflow_switch(10, 11);
+ integer_overflow_switch(11, 11);
+ integer_overflow_switch(7, 5);
+#else
+ integer_overflow_switch(5, 10); /* OK */
+ integer_overflow_switch(10, 10); /* DANGER */
+ integer_overflow_switch(11, 10); /* OK */
+ integer_overflow_switch(7, 5); /* OK */
+#endif
+
+ return 1;
+}
+#endif
diff --git a/bench-moerman2018/integers/overflow/05_simple_goto.c b/bench-moerman2018/integers/overflow/05_simple_goto.c
new file mode 100644
index 000000000..c4b1514f2
--- /dev/null
+++ b/bench-moerman2018/integers/overflow/05_simple_goto.c
@@ -0,0 +1,41 @@
+#include <stdio.h>
+#include <limits.h>
+#include "integer_overflow.h"
+
+void integer_overflow_goto(int x) {
+ int val = INT_MAX / 3 - 1;
+ int i;
+
+#ifdef CATCH_BAD_PARAM
+ if(x > 0) {
+ return;
+ }
+#endif
+
+ i = 0;
+
+GOTO_LABEL:
+ if(i <= x) {
+ printf("%i\n", val * 3);
+ } else {
+ printf("%i\n", val);
+ }
+
+ if(i == 0) {
+ i++;
+ val = val * 2;
+ goto GOTO_LABEL;
+ }
+}
+
+#ifndef NO_MAIN
+int main() {
+#ifdef NO_BUG
+ integer_overflow_goto(0);
+#else
+ integer_overflow_goto(1);
+#endif
+
+ return 1;
+}
+#endif
diff --git a/bench-moerman2018/integers/overflow/06_simple_pass_by_reference.c b/bench-moerman2018/integers/overflow/06_simple_pass_by_reference.c
new file mode 100644
index 000000000..3ce79813b
--- /dev/null
+++ b/bench-moerman2018/integers/overflow/06_simple_pass_by_reference.c
@@ -0,0 +1,48 @@
+#include <stdio.h>
+#include <stdbool.h>
+#include <limits.h>
+#include "integer_overflow.h"
+
+static void assign_int(int* dest, int int1, int int2, bool condition) {
+ if(condition) {
+ *dest = int1;
+ } else {
+ *dest = int2;
+ }
+}
+
+void integer_overflow_pass_by_reference(bool a, bool b) {
+ int val;
+
+#ifdef CATCH_BAD_PARAM
+ if(!a & !b) {
+ return;
+ }
+#endif
+
+ assign_int(&val, INT_MAX / 3 - 1, INT_MAX / 2 - 1, a);
+
+ if(b) {
+ val = val * 2;
+ } else {
+ val = val * 3; /* DANGER if !a */
+ }
+
+ printf("%i\n", val);
+}
+
+#ifndef NO_MAIN
+int main() {
+#ifdef NO_BUG
+ integer_overflow_pass_by_reference(true, true);
+ integer_overflow_pass_by_reference(true, false);
+ integer_overflow_pass_by_reference(false, true);
+#else
+ integer_overflow_pass_by_reference(true, true); /* OK */
+ integer_overflow_pass_by_reference(false, false); /* DANGER */
+ integer_overflow_pass_by_reference(false, true); /* OK */
+#endif
+
+ return 1;
+}
+#endif
diff --git a/bench-moerman2018/integers/overflow/07_simple_cross_file.c b/bench-moerman2018/integers/overflow/07_simple_cross_file.c
new file mode 100644
index 000000000..4e16be901
--- /dev/null
+++ b/bench-moerman2018/integers/overflow/07_simple_cross_file.c
@@ -0,0 +1,40 @@
+#include "integer_overflow.h"
+#include "common.h"
+#include <stdbool.h>
+#include <limits.h>
+#include <stdio.h>
+
+void integer_overflow_cross_file(bool a, bool b) {
+ int val;
+
+#ifdef CATCH_BAD_PARAM
+ if(!a & !b) {
+ return;
+ }
+#endif
+
+ val = choose_int (INT_MAX / 3 - 1, INT_MAX / 2 - 1, a);
+
+ if(b) {
+ val = val * 2;
+ } else {
+ val = val * 3; /* DANGER if !a */
+ }
+
+ printf("%i\n", val);
+}
+
+#ifndef NO_MAIN
+int main() {
+#ifdef NO_BUG
+ integer_overflow_cross_file(true, true);
+ integer_overflow_cross_file(true, false);
+ integer_overflow_cross_file(false, true);
+#else
+ integer_overflow_cross_file(true, true); /* OK */
+ integer_overflow_cross_file(false, false); /* DANGER */
+ integer_overflow_cross_file(false, true); /* OK */
+#endif
+ return 1;
+}
+#endif
diff --git a/bench-moerman2018/integers/overflow/08_loop_for.c b/bench-moerman2018/integers/overflow/08_loop_for.c
new file mode 100644
index 000000000..c795073cb
--- /dev/null
+++ b/bench-moerman2018/integers/overflow/08_loop_for.c
@@ -0,0 +1,38 @@
+#include <stdio.h>
+#include <limits.h>
+#include "integer_overflow.h"
+
+void integer_overflow_for(int x) {
+ int val = INT_MAX - 20;
+ int i;
+
+#ifdef CATCH_BAD_PARAM
+ if(x < 9) {
+ return;
+ }
+#endif
+
+ for(i = 0; i < 20; i++) {
+ if(i > x) {
+ val += 10; /* DANGER: x < 10 */
+ } else {
+ val++;
+ }
+ if(i == 10) {
+ val -= 100;
+ }
+ }
+ printf("%i\n", val);
+}
+
+#ifndef NO_MAIN
+int main() {
+#ifdef NO_BUG
+ integer_overflow_for(9);
+#else
+ integer_overflow_for(8);
+#endif
+
+ return 1;
+}
+#endif
diff --git a/bench-moerman2018/integers/overflow/09_loop_for_complex.c b/bench-moerman2018/integers/overflow/09_loop_for_complex.c
new file mode 100644
index 000000000..560ff3e5a
--- /dev/null
+++ b/bench-moerman2018/integers/overflow/09_loop_for_complex.c
@@ -0,0 +1,41 @@
+#include <stdio.h>
+#include <limits.h>
+#include "integer_overflow.h"
+
+void integer_overflow_for_complex(int x) {
+ int val = INT_MAX / 2 - 20;
+ int i = 0;
+
+#ifdef CATCH_BAD_PARAM
+ if(x < 10) {
+ return;
+ }
+#endif
+
+ for(;;) {
+ if(i > x) {
+ printf("%i\n", val * 3); /* DANGER: x < 10 */
+ } else {
+ printf("%i\n", val * 2);
+ }
+ if(i == 10) {
+ val = INT_MAX / 3 - 1;
+ }
+ i++;
+ if(i >= 20) {
+ break;
+ }
+ }
+}
+
+#ifndef NO_MAIN
+int main() {
+#ifdef NO_BUG
+ integer_overflow_for_complex(10);
+#else
+ integer_overflow_for_complex(9);
+#endif
+
+ return 1;
+}
+#endif
diff --git a/bench-moerman2018/integers/overflow/10_loop_while_continue.c b/bench-moerman2018/integers/overflow/10_loop_while_continue.c
new file mode 100644
index 000000000..19631d00b
--- /dev/null
+++ b/bench-moerman2018/integers/overflow/10_loop_while_continue.c
@@ -0,0 +1,41 @@
+#include <stdio.h>
+#include <limits.h>
+#include "integer_overflow.h"
+
+void integer_overflow_while_continue(int x) {
+ int val = INT_MAX / 2 - 20;
+ int i = 0;
+
+#ifdef CATCH_BAD_PARAM
+ if(x < 10) {
+ return;
+ }
+#endif
+
+ while(i < 30) {
+ if(i > x) {
+ printf("%i\n", val * 3); /* DANGER: x < 10 */
+ } else {
+ printf("%i\n", val * 2);
+ }
+ if(i == 10) {
+ val = INT_MAX / 3 - 1;
+ }
+ i++;
+ if(i < 20) {
+ continue;
+ }
+ }
+}
+
+#ifndef NO_MAIN
+int main() {
+#ifdef NO_BUG
+ integer_overflow_while_continue(10);
+#else
+ integer_overflow_while_continue(9);
+#endif
+
+ return 1;
+}
+#endif
diff --git a/bench-moerman2018/integers/overflow/11_loop_while_do_continue.c b/bench-moerman2018/integers/overflow/11_loop_while_do_continue.c
new file mode 100644
index 000000000..f8148c3c4
--- /dev/null
+++ b/bench-moerman2018/integers/overflow/11_loop_while_do_continue.c
@@ -0,0 +1,41 @@
+#include <stdio.h>
+#include <limits.h>
+#include "integer_overflow.h"
+
+void integer_overflow_do_while_continue(int x) {
+ int val = INT_MAX / 2 - 20;
+ int i = 0;
+
+#ifdef CATCH_BAD_PARAM
+ if(x < 10) {
+ return;
+ }
+#endif
+
+ do {
+ if(i > x) {
+ printf("%i\n", val * 3); /* DANGER: x < 10 */
+ } else {
+ printf("%i\n", val * 2);
+ }
+ if(i == 10) {
+ val = INT_MAX / 3 - 1;
+ }
+ i++;
+ if(i < 20) {
+ continue;
+ }
+ } while(i < 30);
+}
+
+#ifndef NO_MAIN
+int main() {
+#ifdef NO_BUG
+ integer_overflow_do_while_continue(10);
+#else
+ integer_overflow_do_while_continue(9);
+#endif
+
+ return 1;
+}
+#endif
diff --git a/bench-moerman2018/integers/overflow/12_loop_for_array_branching.c b/bench-moerman2018/integers/overflow/12_loop_for_array_branching.c
new file mode 100644
index 000000000..562dac812
--- /dev/null
+++ b/bench-moerman2018/integers/overflow/12_loop_for_array_branching.c
@@ -0,0 +1,48 @@
+#include <stdio.h>
+#include <limits.h>
+#include "integer_overflow.h"
+
+void integer_overflow_for_array(int x) {
+ int p[20];
+ int val = INT_MAX - 29;
+ int incr_ammount = 1;
+ int i = 0;
+
+ if(x < 0 || x > 19) {
+ return;
+ }
+
+#ifdef CATCH_BAD_PARAM
+ if(x >= 18) {
+ return;
+ }
+#endif
+
+ for(i = 0; i < 20; i++) {
+ p[i] = 0;
+ }
+ p[x] = 1;
+
+ for(i = 0; i < 20; i++) {
+ if(p[i] == 1) {
+ val += incr_ammount;
+ incr_ammount = 10;
+ } else {
+ val += incr_ammount;
+ }
+ }
+
+ printf("%i\n", val);
+}
+
+#ifndef NO_MAIN
+int main() {
+#ifdef NO_BUG
+ integer_overflow_for_array(18);
+#else
+ integer_overflow_for_array(10);
+#endif
+
+ return 1;
+}
+#endif
diff --git a/bench-moerman2018/integers/overflow/13_loop_for_pointer_arithmetic.c b/bench-moerman2018/integers/overflow/13_loop_for_pointer_arithmetic.c
new file mode 100644
index 000000000..50b4ab079
--- /dev/null
+++ b/bench-moerman2018/integers/overflow/13_loop_for_pointer_arithmetic.c
@@ -0,0 +1,54 @@
+#include <stdlib.h>
+#include <stdio.h>
+#include <limits.h>
+#include "integer_overflow.h"
+
+static void initialize_to_value(int arr[], int value, int length) {
+ int i;
+
+ for(i = 0; i < length; i++) {
+ arr[i] = value;
+ }
+}
+
+void integer_overflow_for_pointer(int x) {
+ int arr[10];
+ int* ptr;
+ int i;
+
+ if(x < 0 || x > 10) {
+ return;
+ }
+
+#ifdef CATCH_BAD_PARAM
+ if(x != 10) {
+ return;
+ }
+#endif
+
+ initialize_to_value(arr, INT_MAX, 10);
+
+ ptr = arr;
+
+ for(i = 0; i < x; i++, ptr++) {
+ *ptr -= 20 + i;
+ }
+
+ ptr = arr;
+
+ for(i = 0; i < 10; i++, ptr++) {
+ printf("%i\n", *ptr + i);
+ }
+}
+
+#ifndef NO_MAIN
+int main() {
+#ifdef NO_BUG
+ integer_overflow_for_pointer(10);
+#else
+ integer_overflow_for_pointer(9);
+#endif
+
+ return 1;
+}
+#endif
diff --git a/bench-moerman2018/integers/overflow/14_loop_recursion.c b/bench-moerman2018/integers/overflow/14_loop_recursion.c
new file mode 100644
index 000000000..63f21d621
--- /dev/null
+++ b/bench-moerman2018/integers/overflow/14_loop_recursion.c
@@ -0,0 +1,41 @@
+#include <stdio.h>
+#include <limits.h>
+#include "integer_overflow.h"
+
+void integer_overflow_rec(int x, int i, int val) {
+ if(i <= 1) {
+ printf("%i\n", val);
+ return;
+ }
+
+#ifdef CATCH_BAD_PARAM
+ if(x > 10) {
+ printf("%i\n", val);
+ return;
+ }
+#endif
+
+ if(i < x) {
+ val += 10;
+ } else {
+ val += 1;
+ }
+
+ if(i == 10) {
+ printf("%i\n", val);
+ val = INT_MAX - 10;
+ }
+ integer_overflow_rec(x, i-1, val);
+}
+
+#ifndef NO_MAIN
+int main() {
+#ifdef NO_BUG
+ integer_overflow_rec(10, 20, INT_MAX - 110);
+#else
+ integer_overflow_rec(12, 20, INT_MAX - 110);
+#endif
+
+ return 1;
+}
+#endif
diff --git a/bench-moerman2018/integers/overflow/15_loop_recursion_multi.c b/bench-moerman2018/integers/overflow/15_loop_recursion_multi.c
new file mode 100644
index 000000000..552e26997
--- /dev/null
+++ b/bench-moerman2018/integers/overflow/15_loop_recursion_multi.c
@@ -0,0 +1,47 @@
+#include <stdio.h>
+#include <limits.h>
+#include "integer_overflow.h"
+
+void integer_overflow_rec_decr(int x, int i, int val) {
+ if(i <= 1) {
+ printf("%i\n", val);
+ return;
+ }
+
+ integer_overflow_rec_multi(x, i-1, val);
+}
+
+void integer_overflow_rec_multi(int x, int i, int val) {
+#ifdef CATCH_BAD_PARAM
+ if(x > 10) {
+ printf("%i\n", val);
+ return;
+ }
+#endif
+
+ if(i < x) {
+ val += 10;
+ } else {
+ val += 1;
+ }
+
+ if(i == 10) {
+ printf("%i\n", val);
+ val = INT_MAX - 10;
+ }
+ integer_overflow_rec_decr(x, i, val);
+}
+
+
+
+#ifndef NO_MAIN
+int main() {
+#ifdef NO_BUG
+ integer_overflow_rec_multi(10, 20, INT_MAX - 110);
+#else
+ integer_overflow_rec_multi(12, 20, INT_MAX - 110);
+#endif
+
+ return 1;
+}
+#endif
diff --git a/bench-moerman2018/integers/overflow/16_misc_pseudo_recursion.c b/bench-moerman2018/integers/overflow/16_misc_pseudo_recursion.c
new file mode 100644
index 000000000..9801e580c
--- /dev/null
+++ b/bench-moerman2018/integers/overflow/16_misc_pseudo_recursion.c
@@ -0,0 +1,50 @@
+#include <stdio.h>
+#include <limits.h>
+#include "integer_overflow.h"
+
+void integer_overflow_pseudo_rec1(int x, int y, int i, int val) {
+
+#ifdef CATCH_BAD_PARAM
+ if(x <= 10 && x >= y) {
+ return;
+ }
+#endif
+
+ if(i > 0) {
+ return;
+ }
+
+ if(x > 10) {
+ val = INT_MAX - 30;
+ } else {
+ val = INT_MAX - 10;
+ }
+
+ integer_overflow_pseudo_rec2(x, y, 1, val);
+}
+
+void integer_overflow_pseudo_rec2(int x, int y, int i, int val) {
+ if(i > 0) {
+ if(x < y) {
+ val += 5;
+ } else {
+ val += 25;
+ }
+ printf("%i\n", val);
+ } else {
+ integer_overflow_pseudo_rec1(x, y, 1, val);
+ }
+}
+
+#ifndef NO_MAIN
+int main() {
+#ifdef NO_BUG
+ integer_overflow_pseudo_rec1(9, 10, 0, 0);
+ integer_overflow_pseudo_rec1(11, 10, 0, 0);
+#else
+ integer_overflow_pseudo_rec1(10, 10, 0, 0);
+#endif
+
+ return 1;
+}
+#endif
diff --git a/bench-moerman2018/integers/overflow/17_complex_function_pointers.c b/bench-moerman2018/integers/overflow/17_complex_function_pointers.c
new file mode 100644
index 000000000..61de9e00c
--- /dev/null
+++ b/bench-moerman2018/integers/overflow/17_complex_function_pointers.c
@@ -0,0 +1,46 @@
+#include <stdio.h>
+#include <stdbool.h>
+#include <limits.h>
+#include "integer_overflow.h"
+
+static void assign_int(int* dest, int int1, int int2, bool condition) {
+ if(condition) {
+ *dest = int1;
+ } else {
+ *dest = int2;
+ }
+}
+
+void integer_overflow_function_pointer(bool a, bool b, void (*f)(int*, int, int, bool)) {
+ int val;
+
+#ifdef CATCH_BAD_PARAM
+ if(!f || (!a & !b)) {
+ return;
+ }
+#endif
+
+ (*f)(&val, INT_MAX / 3 - 1, INT_MAX / 2 - 1, a);
+
+ if(b) {
+ printf("%i\n", val * 2 - 15);
+ } else {
+ printf("%i\n", val * 3 - 37); /* DANGER, if !a & !b */
+ }
+}
+
+#ifndef NO_MAIN
+int main() {
+#ifdef NO_BUG
+ integer_overflow_function_pointer(true, true, &assign_int);
+ integer_overflow_function_pointer(true, false, &assign_int);
+ integer_overflow_function_pointer(false, true, &assign_int);
+#else
+ integer_overflow_function_pointer(true, true, &assign_int); /* OK */
+ integer_overflow_function_pointer(false, false, &assign_int); /* DANGER */
+ integer_overflow_function_pointer(false, true, &assign_int); /* OK */
+#endif
+
+ return 1;
+}
+#endif
diff --git a/bench-moerman2018/integers/overflow/18_complex_struct_multiple_methods.c b/bench-moerman2018/integers/overflow/18_complex_struct_multiple_methods.c
new file mode 100644
index 000000000..e5a677bd1
--- /dev/null
+++ b/bench-moerman2018/integers/overflow/18_complex_struct_multiple_methods.c
@@ -0,0 +1,84 @@
+#include <stdio.h>
+#include <stdlib.h>
+#include <limits.h>
+#include "integer_overflow.h"
+
+#ifndef s_INTEGERS_O_REFCOUNT
+#define s_INTEGERS_O_REFCOUNT
+void integer_overflow_cont_init(IntCont* cont) {
+ cont->counter = 1;
+ cont->int_value = 0;
+}
+
+IntCont* integer_overflow_cont_new() {
+ IntCont* new_cont;
+
+ new_cont = malloc(sizeof(IntCont));
+
+ if(new_cont) {
+ integer_overflow_cont_init(new_cont);
+ }
+ return new_cont;
+}
+
+void integer_overflow_cont_incr(IntCont* cont) {
+ if(cont) {
+ cont->counter++;
+ }
+}
+void integer_overflow_cont_decr(IntCont* cont) {
+ if(cont->counter <= 1) {
+ cont->int_value = INT_MAX;
+ } else {
+ cont->counter--;
+ }
+}
+
+int integer_overflow_cont_get_int(IntCont* cont) {
+ return cont->int_value;
+}
+void integer_overflow_cont_set_int(IntCont* cont, int int_value) {
+ cont->int_value = int_value;
+}
+#endif //s_INTEGERS_O_REFCOUNT
+
+void integer_overflow_struct(int x, int y) {
+ IntCont cont;
+ int val;
+
+#ifdef CATCH_BAD_PARAM
+ if(x <= 10 && x >= y) {
+ return;
+ }
+#endif
+ integer_overflow_cont_init(&cont);
+
+ integer_overflow_cont_set_int(&cont, INT_MAX - 300);
+
+ if(x < y) {
+ integer_overflow_cont_set_int(&cont, INT_MAX - 500);
+ }
+
+ if(x > 10) {
+ val = integer_overflow_cont_get_int(&cont) + 200;
+ } else {
+ /* DANGER: if x <= 10 & x >= y */
+ val = integer_overflow_cont_get_int(&cont) + 400;
+ }
+
+ printf("%i\n", val);
+}
+
+#ifndef NO_MAIN
+int main() {
+#ifdef NO_BUG
+ integer_overflow_struct(9, 10);
+ integer_overflow_struct(10, 11);
+ integer_overflow_struct(11, 10);
+#else
+ integer_overflow_struct(10, 10); /* DANGER */
+#endif
+
+ return 1;
+}
+#endif
diff --git a/bench-moerman2018/integers/overflow/19_complex_refcount.c b/bench-moerman2018/integers/overflow/19_complex_refcount.c
new file mode 100644
index 000000000..93e2f4079
--- /dev/null
+++ b/bench-moerman2018/integers/overflow/19_complex_refcount.c
@@ -0,0 +1,69 @@
+#include "integer_overflow.h"
+#include <stdlib.h>
+#include <stdio.h>
+#include <limits.h>
+
+#ifndef s_INTEGERS_O_REFCOUNT
+#define s_INTEGERS_O_REFCOUNT
+void integer_overflow_cont_init(IntCont* cont) {
+ cont->counter = 1;
+ cont->int_value = 0;
+}
+
+IntCont* integer_overflow_cont_new() {
+ IntCont* new_cont;
+
+ new_cont = malloc(sizeof(IntCont));
+
+ if(new_cont) {
+ integer_overflow_cont_init(new_cont);
+ }
+ return new_cont;
+}
+
+void integer_overflow_cont_incr(IntCont* cont) {
+ if(cont) {
+ cont->counter++;
+ }
+}
+void integer_overflow_cont_decr(IntCont* cont) {
+ if(cont->counter <= 1) {
+ cont->int_value = INT_MAX;
+ } else {
+ cont->counter--;
+ }
+}
+
+int integer_overflow_cont_get_int(IntCont* cont) {
+ return cont->int_value;
+}
+void integer_overflow_cont_set_int(IntCont* cont, int int_value) {
+ cont->int_value = int_value;
+}
+#endif //s_INTEGERS_O_REFCOUNT
+
+#ifndef NO_MAIN
+int main() {
+ IntCont* cont;
+
+ cont = integer_overflow_cont_new();
+ if(!cont) {
+ return 1;
+ }
+ integer_overflow_cont_set_int(cont, 35);
+
+ integer_overflow_cont_incr(cont);
+ integer_overflow_cont_incr(cont);
+ integer_overflow_cont_decr(cont);
+ integer_overflow_cont_decr(cont);
+#ifndef NO_BUG
+ integer_overflow_cont_decr(cont);
+#endif
+
+ printf("%i\n", integer_overflow_cont_get_int(cont) + 512);
+
+ free(cont);
+
+ return 1;
+}
+#endif
diff --git a/bench-moerman2018/integers/overflow/integer_overflow.h b/bench-moerman2018/integers/overflow/integer_overflow.h
new file mode 100644
index 000000000..de7893473
--- /dev/null
+++ b/bench-moerman2018/integers/overflow/integer_overflow.h
@@ -0,0 +1,36 @@
+#include <stdbool.h>
+
+typedef struct _IntCont IntCont;
+
+struct _IntCont {
+ int int_value;
+ unsigned int counter;
+};
+
+void integer_overflow_cont_init(IntCont* cont);
+IntCont* integer_overflow_cont_new();
+void integer_overflow_cont_incr(IntCont* cont);
+void integer_overflow_cont_decr(IntCont* cont);
+int integer_overflow_cont_get_int(IntCont* cont);
+void integer_overflow_cont_set_int(IntCont* cont, int int_value);
+
+void integer_overflow_for(int x);
+void integer_overflow_for_complex(int x);
+void integer_overflow_while_continue(int x);
+void integer_overflow_do_while_continue(int x);
+void integer_overflow_for_array(int x);
+void integer_overflow_for_pointer(int x);
+void integer_overflow_goto(int x);
+void integer_overflow_if_else(bool a, bool b);
+void integer_overflow_if_else_multi(bool a, bool b);
+void integer_overflow_if_else_int1(int x, int y);
+void integer_overflow_if_else_int2(int x, int y);
+void integer_overflow_pass_by_reference(bool a, bool b);
+void integer_overflow_switch(int x, int y);
+void integer_overflow_rec_multi(int x, int i, int val);
+void integer_overflow_rec(int x, int i, int val);
+void integer_overflow_pseudo_rec1(int x, int y, int i, int val);
+void integer_overflow_pseudo_rec2(int x, int y, int i, int val);
+void integer_overflow_struct(int x, int y);
+void integer_overflow_function_pointer(bool a, bool b, void (*f)(int*, int, int, bool));
+void integer_overflow_cross_file(bool a, bool b);
diff --git a/bench-moerman2018/memory/access_uninit/01_simple_if.c b/bench-moerman2018/memory/access_uninit/01_simple_if.c
new file mode 100644
index 000000000..465d91a3f
--- /dev/null
+++ b/bench-moerman2018/memory/access_uninit/01_simple_if.c
@@ -0,0 +1,51 @@
+#include <stdio.h>
+#include <stdlib.h>
+#include <stdbool.h>
+#include "uninitialized_malloc.h"
+
+void uninit_malloc_if_else(bool a, bool b) {
+ int* data;
+ int val;
+
+#ifdef CATCH_BAD_PARAM
+ if(!a & !b) {
+ return;
+ }
+#endif
+
+ data = malloc(sizeof(int));
+
+ if(!data) {
+ return;
+ }
+
+ if(a) {
+ *data = 1;
+ }
+
+ if(b) {
+ val = 37 * 2;
+ } else {
+ val = 11 * *data; /* DANGER, if !a & !b */
+ }
+
+ printf("%i\n", val);
+
+ free(data);
+}
+
+#ifndef NO_MAIN
+int main() {
+#ifdef NO_BUG
+ uninit_malloc_if_else(true, true);
+ uninit_malloc_if_else(true, false);
+ uninit_malloc_if_else(false, true);
+#else
+ uninit_malloc_if_else(true, true); /* OK */
+ uninit_malloc_if_else(false, false); /* DANGER */
+ uninit_malloc_if_else(false, true); /* OK */
+#endif
+
+ return 1;
+}
+#endif
diff --git a/bench-moerman2018/memory/access_uninit/02_simple_if_int1.c b/bench-moerman2018/memory/access_uninit/02_simple_if_int1.c
new file mode 100644
index 000000000..88ead4469
--- /dev/null
+++ b/bench-moerman2018/memory/access_uninit/02_simple_if_int1.c
@@ -0,0 +1,50 @@
+#include <stdio.h>
+#include <stdlib.h>
+#include "uninitialized_malloc.h"
+
+void uninit_malloc_if_else_int1(int x, int y) {
+ int* data;
+ int val;
+
+#ifdef CATCH_BAD_PARAM
+ if(x <= 10 && x >= y) {
+ return;
+ }
+#endif
+
+ data = malloc(sizeof(int));
+
+ if(!data) {
+ return;
+ }
+
+ if(x < y) {
+ *data = 1;
+ }
+
+ if(x > 10) {
+ val = 37 * 2;
+ } else {
+ val = 11 * *data; /* DANGER, if x <= 10 & x >= y */
+ }
+
+ printf("x=%i: %i", x, val);
+
+ free(data);
+}
+
+#ifndef NO_MAIN
+int main() {
+#ifdef NO_BUG
+ uninit_malloc_if_else_int1(9, 10);
+ uninit_malloc_if_else_int1(10, 11);
+ uninit_malloc_if_else_int1(11, 10);
+#else
+ uninit_malloc_if_else_int1(9, 10); /* OK */
+ uninit_malloc_if_else_int1(10, 10); /* DANGER */
+ uninit_malloc_if_else_int1(11, 10); /* OK */
+#endif
+
+ return 1;
+}
+#endif
diff --git a/bench-moerman2018/memory/access_uninit/02_simple_if_int2.c b/bench-moerman2018/memory/access_uninit/02_simple_if_int2.c
new file mode 100644
index 000000000..015c85215
--- /dev/null
+++ b/bench-moerman2018/memory/access_uninit/02_simple_if_int2.c
@@ -0,0 +1,55 @@
+#include <stdio.h>
+#include <stdlib.h>
+#include "uninitialized_malloc.h"
+
+void uninit_malloc_if_else_int2(int x, int y) {
+ int* data;
+ int val, m, n;
+
+ m = -1;
+ n = 5;
+
+ x = x*m+n;
+
+#ifdef CATCH_BAD_PARAM
+ if(x <= 10 && x >= y) {
+ return;
+ }
+#endif
+
+ data = malloc(sizeof(int));
+
+ if(!data) {
+ return;
+ }
+
+ if(x < y) {
+ *data = 1;
+ }
+
+ if(x > 10) {
+ val = 37 * 2;
+ } else {
+ val = 11 * *data; /* DANGER, if x <= 10 & x >= y */
+ }
+
+ printf("x=%i: %i", x, val);
+
+ free(data);
+}
+
+#ifndef NO_MAIN
+int main() {
+#ifdef NO_BUG
+ uninit_malloc_if_else_int2(-4, 11);
+ uninit_malloc_if_else_int2(-5, 11);
+ uninit_malloc_if_else_int2(-6, 11);
+#else
+ uninit_malloc_if_else_int2(-4, 10); /* OK */
+ uninit_malloc_if_else_int2(-5, 10); /* DANGER */
+ uninit_malloc_if_else_int2(-6, 10); /* OK */
+#endif
+
+ return 1;
+}
+#endif
diff --git a/bench-moerman2018/memory/access_uninit/03_simple_if_multi_func.c b/bench-moerman2018/memory/access_uninit/03_simple_if_multi_func.c
new file mode 100644
index 000000000..203fee53a
--- /dev/null
+++ b/bench-moerman2018/memory/access_uninit/03_simple_if_multi_func.c
@@ -0,0 +1,57 @@
+#include "uninitialized_malloc.h"
+#include <stdbool.h>
+#include <stdlib.h>
+#include <stdio.h>
+
+static void possibly_assign(int* dest, int val, bool condition) {
+ if(condition) {
+ *dest = val;
+ }
+}
+
+static int conditional_assign(int* ptr1, int* ptr2, bool condition) {
+ if(condition) {
+ return *ptr1;
+ }
+ return *ptr2;
+}
+
+void uninit_malloc_if_else_multi(bool a, bool b) {
+ int* data;
+ int val = -7189;
+
+#ifdef CATCH_BAD_PARAM
+ if(!a & !b) {
+ return;
+ }
+#endif
+
+ data = malloc(sizeof(int));
+
+ if(!data) {
+ return;
+ }
+
+ possibly_assign(data, 37, a);
+
+ val = conditional_assign(&val, data, b); /* DANGER, if !a & !b */
+
+ printf("%i\n", val);
+
+ free(data);
+}
+
+#ifndef NO_MAIN
+int main() {
+#ifdef NO_BUG
+ uninit_malloc_if_else_multi(true, true);
+ uninit_malloc_if_else_multi(true, false);
+ uninit_malloc_if_else_multi(false, true);
+#else
+ uninit_malloc_if_else_multi(true, true); /* OK */
+ uninit_malloc_if_else_multi(false, false); /* DANGER */
+ uninit_malloc_if_else_multi(false, true); /* OK */
+#endif
+ return 1;
+}
+#endif
diff --git a/bench-moerman2018/memory/access_uninit/04_simple_switch.c b/bench-moerman2018/memory/access_uninit/04_simple_switch.c
new file mode 100644
index 000000000..7da5ba984
--- /dev/null
+++ b/bench-moerman2018/memory/access_uninit/04_simple_switch.c
@@ -0,0 +1,66 @@
+#include "uninitialized_malloc.h"
+#include <stdlib.h>
+
+int uninit_malloc_switch(int x, int y) {
+ int* data;
+ int val;
+
+#ifdef CATCH_BAD_PARAM
+ if((x == 10 || x == 5) && x >= y) {
+ return -1;
+ }
+#endif
+ data = malloc(sizeof(int));
+ if(!data) {
+ return -1;
+ }
+
+ if(x < y) {
+ *data = 1;
+ }
+
+ switch (x) {
+ case 5: {
+ val = 37 * *data; /* DANGER: x >= y */
+ break;
+ }
+ case 7: {
+ val = -37 * 2;
+ break;
+ }
+ case 10: {
+ val = 73 * *data; /* DANGER: x >= y */
+ break;
+ }
+ case 12: {
+ val = 73 * 5;
+ break;
+ }
+ default: {
+ val = 100 * 8;
+ break;
+ }
+ };
+
+ free(data);
+
+ return val;
+}
+
+#ifndef NO_MAIN
+int main() {
+#ifdef NO_BUG
+ uninit_malloc_switch(5, 11);
+ uninit_malloc_switch(10, 11);
+ uninit_malloc_switch(11, 11);
+ uninit_malloc_switch(7, 5);
+#else
+ uninit_malloc_switch(5, 10); /* OK */
+ uninit_malloc_switch(10, 10); /* DANGER */
+ uninit_malloc_switch(11, 10); /* OK */
+ uninit_malloc_switch(7, 5); /* OK */
+#endif
+
+ return 1;
+}
+#endif
diff --git a/bench-moerman2018/memory/access_uninit/05_simple_goto.c b/bench-moerman2018/memory/access_uninit/05_simple_goto.c
new file mode 100644
index 000000000..b60552fa2
--- /dev/null
+++ b/bench-moerman2018/memory/access_uninit/05_simple_goto.c
@@ -0,0 +1,53 @@
+#include <stdio.h>
+#include <stdlib.h>
+#include "uninitialized_malloc.h"
+
+void uninit_malloc_goto(int x) {
+ int val = 0, i = 0;
+ int* data;
+
+#ifdef CATCH_BAD_PARAM
+ if(x > 0) {
+ return;
+ }
+#endif
+
+ data = malloc(sizeof(int));
+
+ if(!data) {
+ return;
+ }
+
+ *data = x;
+
+GOTO_LABEL:
+ if(i <= x) {
+ if(data) {
+ val += *data;
+ }
+ } else {
+ printf("%i\n", val);
+ }
+
+ free(data);
+ data = malloc(sizeof(int));
+
+ if(i == 0) {
+ i++;
+ goto GOTO_LABEL;
+ }
+
+ free(data);
+}
+
+#ifndef NO_MAIN
+int main() {
+#ifdef NO_BUG
+ uninit_malloc_goto(0);
+#else
+ uninit_malloc_goto(1);
+#endif
+
+ return 1;
+}
+#endif
diff --git a/bench-moerman2018/memory/access_uninit/06_simple_pass_by_reference.c b/bench-moerman2018/memory/access_uninit/06_simple_pass_by_reference.c
new file mode 100644
index 000000000..4ee825094
--- /dev/null
+++ b/bench-moerman2018/memory/access_uninit/06_simple_pass_by_reference.c
@@ -0,0 +1,51 @@
+#include <stdio.h>
+#include <stdlib.h>
+#include <stdbool.h>
+#include "uninitialized_malloc.h"
+
+static void possibly_assign(int** dest, int val, bool condition) {
+ if(condition) {
+ **dest = val;
+ }
+}
+
+void uninit_malloc_pass_by_reference(bool a, bool b) {
+ int* data;
+
+#ifdef CATCH_BAD_PARAM
+ /* To be used if NO_BUG is defined */
+ /* and tool warns about possible dangerous input */
+ if(!a & !b) {
+ return;
+ }
+#endif
+
+ data = malloc(sizeof(int));
+
+ if(!data) {
+ return;
+ }
+
+ possibly_assign(&data, 5, a);
+ possibly_assign(&data, 13, b);
+
+ printf("%i\n", *data);
+
+ free(data);
+}
+
+#ifndef NO_MAIN
+int main() {
+#ifdef NO_BUG
+ uninit_malloc_pass_by_reference(true, true);
+ uninit_malloc_pass_by_reference(true, false);
+ uninit_malloc_pass_by_reference(false, true);
+#else
+ uninit_malloc_pass_by_reference(true, true); /* OK */
+ uninit_malloc_pass_by_reference(false, false); /* DANGER */
+ uninit_malloc_pass_by_reference(false, true); /* OK */
+#endif
+
+ return 1;
+}
+#endif
diff --git a/bench-moerman2018/memory/access_uninit/07_simple_cross_file.c b/bench-moerman2018/memory/access_uninit/07_simple_cross_file.c
new file mode 100644
index 000000000..4a8b96ac4
--- /dev/null
+++ b/bench-moerman2018/memory/access_uninit/07_simple_cross_file.c
@@ -0,0 +1,50 @@
+#include "uninitialized_malloc.h"
+#include "common.h"
+#include <stdlib.h>
+#include <stdbool.h>
+#include <stdio.h>
+
+void uninit_malloc_cross_file(bool a, bool b) {
+ int* data;
+ int val;
+ int* int_ptr;
+
+#ifdef CATCH_BAD_PARAM
+ if(!a & !b) {
+ return;
+ }
+#endif
+
+ data = malloc(sizeof(int));
+
+ if(!data) {
+ return;
+ }
+
+ int_ptr = (int*) choose_pointer((void*) data, (void*) &val, a);
+ *int_ptr = 768;
+
+ if(b) {
+ val = 10 * 2;
+ } else {
+ val = 10 * *data; /* DANGER, if !a & !b */
+ }
+
+ printf("%i\n", val);
+ free(data);
+}
+
+#ifndef NO_MAIN
+int main() {
+#ifdef NO_BUG
+ uninit_malloc_cross_file(true, true);
+ uninit_malloc_cross_file(true, false);
+ uninit_malloc_cross_file(false, true);
+#else
+ uninit_malloc_cross_file(true, true); /* OK */
+ uninit_malloc_cross_file(false, false); /* DANGER */
+ uninit_malloc_cross_file(false, true); /* OK */
+#endif
+ return 1;
+}
+#endif
diff --git a/bench-moerman2018/memory/access_uninit/08_loop_for.c b/bench-moerman2018/memory/access_uninit/08_loop_for.c
new file mode 100644
index 000000000..289134fe3
--- /dev/null
+++ b/bench-moerman2018/memory/access_uninit/08_loop_for.c
@@ -0,0 +1,47 @@
+#include <stdio.h>
+#include <stdlib.h>
+#include "uninitialized_malloc.h"
+
+void uninit_malloc_for(int x) {
+ int* data;
+ int val = 0;
+ int i;
+
+#ifdef CATCH_BAD_PARAM
+ if(x < 10) {
+ return;
+ }
+#endif
+
+ data = malloc(sizeof(int));
+ if(!data) {
+ return;
+ }
+
+ for(i = 0; i < 20; i++) {
+ if(i > x) {
+ val += 10 * (*data - 2); /* DANGER: x < 10 */
+ } else {
+ val += 10 * 4;
+ }
+ if(i == 10) {
+ *data = 4;
+ val += 10 * *data;
+ }
+ }
+
+ printf("val = %i\n", val);
+ free(data);
+}
+
+#ifndef NO_MAIN
+int main() {
+#ifdef NO_BUG
+ uninit_malloc_for(10);
+#else
+ uninit_malloc_for(9);
+#endif
+
+ return 1;
+}
+#endif
diff --git a/bench-moerman2018/memory/access_uninit/09_loop_for_complex.c b/bench-moerman2018/memory/access_uninit/09_loop_for_complex.c
new file mode 100644
index 000000000..c7609a905
--- /dev/null
+++ b/bench-moerman2018/memory/access_uninit/09_loop_for_complex.c
@@ -0,0 +1,50 @@
+#include <stdio.h>
+#include <stdlib.h>
+#include "uninitialized_malloc.h"
+
+void uninit_malloc_for_complex(int x) {
+ int* data;
+ int val = 0, i = 0;
+
+#ifdef CATCH_BAD_PARAM
+ if(x < 10) {
+ return;
+ }
+#endif
+
+ data = malloc(sizeof(int));
+ if(!data) {
+ return;
+ }
+
+ for(;;) {
+ if(i > x) {
+ val += 10 * (*data - 2); /* DANGER: x < 10 */
+ } else {
+ val += 10 * 4;
+ }
+ if(i == 10) {
+ *data = 4;
+ val += 10 * *data;
+ }
+ i++;
+ if(i >= 20) {
+ break;
+ }
+ }
+
+ printf("val = %i\n", val);
+ free(data);
+}
+
+#ifndef NO_MAIN
+int main() {
+#ifdef NO_BUG
+ uninit_malloc_for_complex(10);
+#else
+ uninit_malloc_for_complex(9);
+#endif
+
+ return 1;
+}
+#endif
diff --git a/bench-moerman2018/memory/access_uninit/10_loop_while_continue.c b/bench-moerman2018/memory/access_uninit/10_loop_while_continue.c
new file mode 100644
index 000000000..2ef0ff0d7
--- /dev/null
+++ b/bench-moerman2018/memory/access_uninit/10_loop_while_continue.c
@@ -0,0 +1,50 @@
+#include <stdio.h>
+#include <stdlib.h>
+#include "uninitialized_malloc.h"
+
+void uninit_malloc_while_continue(int x) {
+ int* data;
+ int val = 0, i = 0;
+
+#ifdef CATCH_BAD_PARAM
+ if(x < 10) {
+ return;
+ }
+#endif
+
+ data = malloc(sizeof(int));
+ if(!data) {
+ return;
+ }
+
+ while(i < 30) {
+ if(i > x) {
+ val += 10 * (*data - 2); /* DANGER: x < 10 */
+ } else {
+ val += 10 * 4;
+ }
+ if(i == 10) {
+ *data = 4;
+ val += 10 * *data;
+ }
+ i++;
+ if(i < 20) {
+ continue;
+ }
+ }
+
+ printf("val = %i", val);
+ free(data);
+}
+
+#ifndef NO_MAIN
+int main() {
+#ifdef NO_BUG
+ uninit_malloc_while_continue(10);
+#else
+ uninit_malloc_while_continue(9);
+#endif
+
+ return 1;
+}
+#endif
diff --git a/bench-moerman2018/memory/access_uninit/11_loop_while_do_continue.c b/bench-moerman2018/memory/access_uninit/11_loop_while_do_continue.c
new file mode 100644
index 000000000..bee5902e1
--- /dev/null
+++ b/bench-moerman2018/memory/access_uninit/11_loop_while_do_continue.c
@@ -0,0 +1,50 @@
+#include <stdio.h>
+#include <stdlib.h>
+#include "uninitialized_malloc.h"
+
+void uninit_malloc_do_while_continue(int x) {
+ int* data;
+ int val = 0, i = 0;
+
+#ifdef CATCH_BAD_PARAM
+ if(x < 10) {
+ return;
+ }
+#endif
+
+ data = malloc(sizeof(int));
+ if(!data) {
+ return;
+ }
+
+ do {
+ if(i > x) {
+ val += 10 * (*data - 2); /* DANGER: x < 10 */
+ } else {
+ val += 10 * 4;
+ }
+ if(i == 10) {
+ *data = 4;
+ val += 10 * *data;
+ }
+ i++;
+ if(i < 20) {
+ continue;
+ }
+ } while(i < 30);
+
+ printf("val = %i", val);
+ free(data);
+}
+
+#ifndef NO_MAIN
+int main() {
+#ifdef NO_BUG
+ uninit_malloc_do_while_continue(10);
+#else
+ uninit_malloc_do_while_continue(9);
+#endif
+
+ return 1;
+}
+#endif
diff --git a/bench-moerman2018/memory/access_uninit/12_loop_for_array_branching.c b/bench-moerman2018/memory/access_uninit/12_loop_for_array_branching.c
new file mode 100644
index 000000000..b866ba675
--- /dev/null
+++ b/bench-moerman2018/memory/access_uninit/12_loop_for_array_branching.c
@@ -0,0 +1,58 @@
+#include <stdio.h>
+#include <stdlib.h>
+#include "uninitialized_malloc.h"
+
+void uninit_malloc_for_array(int x) {
+ int* data;
+ int p[20];
+ int val = 0, i = 0;
+
+ if(x < 0 || x > 19) {
+ return;
+ }
+
+#ifdef CATCH_BAD_PARAM
+ if(x != 19) {
+ return;
+ }
+#endif
+
+ data = malloc(sizeof(int));
+ if(!data) {
+ return;
+ }
+
+ *data = 12;
+
+ for(i = 0; i < 20; i++) {
+ p[i] = 0;
+ }
+ p[x] = 1;
+
+ for(i = 0; i < 20; i++) {
+ if(p[i] == 1) {
+ free(data);
+ data = malloc(sizeof(int));
+ if(!data) {
+ return;
+ }
+ } else {
+ val += *data; /* DANGER: x < 19 */
+ }
+ }
+
+ printf("%i\n", val);
+ free(data);
+}
+
+#ifndef NO_MAIN
+int main() {
+#ifdef NO_BUG
+ uninit_malloc_for_array(19);
+#else
+ uninit_malloc_for_array(10);
+#endif
+
+ return 1;
+}
+#endif
diff --git a/bench-moerman2018/memory/access_uninit/13_loop_for_pointer_arithmetic.c b/bench-moerman2018/memory/access_uninit/13_loop_for_pointer_arithmetic.c
new file mode 100644
index 000000000..02d29049d
--- /dev/null
+++ b/bench-moerman2018/memory/access_uninit/13_loop_for_pointer_arithmetic.c
@@ -0,0 +1,54 @@
+#include <stdlib.h>
+#include <stdio.h>
+#include "uninitialized_malloc.h"
+
+void uninit_malloc_for_pointer(int x) {
+ int* pointers[10];
+ int** pointers_alias = pointers;
+ int val = 0, i;
+
+ if(x < 0 || x > 10) {
+ return;
+ }
+
+#ifdef CATCH_BAD_PARAM
+ if(x != 10) {
+ return;
+ }
+#endif
+
+ for(i = 0; i < 10; i++, pointers_alias++) {
+ *pointers_alias = malloc(sizeof(int));
+ }
+
+ pointers_alias = pointers;
+ for(i = 0; i < x; i++, pointers_alias++) {
+ if(!(*pointers_alias)) {
+ continue;
+ }
+ **pointers_alias = i;
+ }
+
+ pointers_alias = pointers;
+ for(i = 0; i < 10; i++, pointers_alias++) {
+ if(!(*pointers_alias)) {
+ continue;
+ }
+ val += **pointers_alias;
+ free(*pointers_alias);
+ }
+
+ printf("%i\n", val);
+}
+
+#ifndef NO_MAIN
+int main() {
+#ifdef NO_BUG
+ uninit_malloc_for_pointer(10);
+#else
+ uninit_malloc_for_pointer(9);
+#endif
+
+ return 1;
+}
+#endif
diff --git a/bench-moerman2018/memory/access_uninit/14_loop_recursion.c b/bench-moerman2018/memory/access_uninit/14_loop_recursion.c
new file mode 100644
index 000000000..314047aed
--- /dev/null
+++ b/bench-moerman2018/memory/access_uninit/14_loop_recursion.c
@@ -0,0 +1,66 @@
+#include <stdio.h>
+#include <stdlib.h>
+#include "uninitialized_malloc.h"
+
+int uninit_malloc_rec(int x, int i, int* ptr1, int* ptr2) {
+ int val;
+
+ if(i <= 1) {
+ free(ptr1);
+ free(ptr2);
+ return 0;
+ }
+
+#ifdef CATCH_BAD_PARAM
+ if(x > 10 && i < x && ptr2 == 0) {
+ return uninit_malloc_rec(x, i-1, ptr1, ptr1);
+ }
+#endif
+
+ if(!ptr1) {
+ ptr1 = malloc(sizeof(int));
+ if(ptr1) {
+ *ptr1 = 1;
+ } else {
+ if(ptr2) {
+ free(ptr2);
+ }
+ return -1;
+ }
+ }
+ if(!ptr2) {
+ ptr2 = malloc(sizeof(int));
+ if(!ptr2) {
+ free(ptr1);
+ return -1;
+ }
+ return uninit_malloc_rec(x, i-1, ptr1, ptr2) + 2 * *ptr1;
+ }
+
+ if(i < x) {
+ val = *ptr2;
+ } else {
+ val = *ptr1;
+ }
+ if(i == 10) {
+ *ptr2 = *ptr1;
+ }
+ return uninit_malloc_rec(x, i-1, ptr1, ptr2) + 3 * val;
+}
+
+#ifndef NO_MAIN
+int main() {
+#ifdef NO_BUG
+ int* initialized = malloc(sizeof(int));
+ printf("%i\n", uninit_malloc_rec(10, 20, 0, 0));
+ if(initialized) {
+ *initialized = 2;
+ printf("%i\n", uninit_malloc_rec(11, 20, 0, initialized));
+ }
+#else
+ printf("%i\n", uninit_malloc_rec(11, 20, 0, 0));
+#endif
+
+ return 1;
+}
+#endif
diff --git a/bench-moerman2018/memory/access_uninit/15_loop_recursion_multi.c b/bench-moerman2018/memory/access_uninit/15_loop_recursion_multi.c
new file mode 100644
index 000000000..a94b2f7aa
--- /dev/null
+++ b/bench-moerman2018/memory/access_uninit/15_loop_recursion_multi.c
@@ -0,0 +1,78 @@
+#include <stdio.h>
+#include <stdlib.h>
+#include "uninitialized_malloc.h"
+
+int uninit_malloc_rec_decr(int x, int i, int* ptr1, int* ptr2) {
+ if(i <= 1) {
+ free(ptr1);
+ free(ptr2);
+ return 0;
+ }
+
+ return uninit_malloc_rec_multi(x, i-1, ptr1, ptr2);
+}
+
+int uninit_malloc_rec_multi(int x, int i, int* ptr1, int* ptr2) {
+ int val;
+
+ if(i <= 1) {
+ free(ptr1);
+ free(ptr2);
+ return 0;
+ }
+
+#ifdef CATCH_BAD_PARAM
+ if(!ptr2) {
+ if((x > 0 && i < 10) || (i >= 10 && x > 10)) {
+ return uninit_malloc_rec(x, i-1, ptr1, ptr1);
+ }
+ }
+#endif
+
+ if(!ptr1) {
+ ptr1 = malloc(sizeof(int));
+ if(ptr1) {
+ *ptr1 = 1;
+ } else {
+ if(ptr2) {
+ free(ptr2);
+ }
+ return -1;
+ }
+ }
+ if(!ptr2) {
+ ptr2 = malloc(sizeof(int));
+ if(!ptr2) {
+ free(ptr1);
+ return -1;
+ }
+ return 2 * *ptr1 + uninit_malloc_rec_decr(x, i, ptr1, ptr2);
+ }
+
+ if(i < x) {
+ val = *ptr2;
+ } else {
+ val = *ptr1;
+ }
+ if(i == 10) {
+ *ptr2 = *ptr1;
+ }
+ return uninit_malloc_rec_decr(x, i, ptr1, ptr2) + 3 * val;
+}
+
+#ifndef NO_MAIN
+int main() {
+#ifdef NO_BUG
+ int* initialized = malloc(sizeof(int));;
+ printf("%i\n", uninit_malloc_rec_multi(10, 20, 0, 0));
+ if(initialized) {
+ *initialized = 2;
+ printf("%i\n", uninit_malloc_rec_multi(11, 20, 0, initialized));
+ }
+#else
+ printf("%i\n", uninit_malloc_rec_multi(11, 20, 0, 0));
+#endif
+
+ return 1;
+}
+#endif
diff --git a/bench-moerman2018/memory/access_uninit/16_misc_pseudo_recursion.c b/bench-moerman2018/memory/access_uninit/16_misc_pseudo_recursion.c
new file mode 100644
index 000000000..ba85b87bd
--- /dev/null
+++ b/bench-moerman2018/memory/access_uninit/16_misc_pseudo_recursion.c
@@ -0,0 +1,78 @@
+#include <stdio.h>
+#include <stdlib.h>
+#include "uninitialized_malloc.h"
+
+int uninit_malloc_pseudo_rec1(int x, int y, int i, int* ptr1, int* ptr2) {
+ int *data;
+#ifdef CATCH_BAD_PARAM
+ if(!ptr2 && x >= y && x < 10) {
+ return 0;
+ }
+#endif
+
+ if(i > 0) {
+ return 37;
+ }
+
+ if(!ptr1) {
+ ptr1 = malloc(sizeof(int));
+ if(ptr1) {
+ *ptr1 = 1;
+ } else {
+ if(ptr2) {
+ free(ptr2);
+ }
+ return -1;
+ }
+ }
+ if(!ptr2) {
+ ptr2 = malloc(sizeof(int));
+ if(!ptr2) {
+ free(ptr1);
+ return -1;
+ }
+ }
+
+ if(x < y) {
+ *ptr2 = *ptr1;
+ }
+
+ return uninit_malloc_pseudo_rec2(x, y, 1, ptr1, ptr2);
+}
+
+int uninit_malloc_pseudo_rec2(int x, int y, int i, int* ptr1, int* ptr2) {
+ int val;
+
+ if(i <= 0) {
+ return 3 * (*ptr1) + uninit_malloc_pseudo_rec1(x, y, 1, ptr1, ptr2);
+ }
+
+ if(x > 10) {
+ val = *ptr1;
+ } else {
+ val = *ptr2;
+ }
+
+ free(ptr1);
+ free(ptr2);
+
+ return 3 * val;
+}
+
+#ifndef NO_MAIN
+int main() {
+#ifdef NO_BUG
+ int* initialized = malloc(sizeof(int));
+ printf("%i\n", uninit_malloc_pseudo_rec1(9, 10, 0, 0, 0));
+ if(initialized) {
+ *initialized = 2;
+ printf("%i\n", uninit_malloc_pseudo_rec1(10, 10, 0, 0, initialized));
+ }
+ printf("%i\n", uninit_malloc_pseudo_rec1(11, 10, 0, 0, 0));
+#else
+ printf("%i\n", uninit_malloc_pseudo_rec1(10, 10, 0, 0, 0));
+#endif
+
+ return 1;
+}
+#endif
diff --git a/bench-moerman2018/memory/access_uninit/17_complex_function_pointers.c b/bench-moerman2018/memory/access_uninit/17_complex_function_pointers.c
new file mode 100644
index 000000000..db44cacf3
--- /dev/null
+++ b/bench-moerman2018/memory/access_uninit/17_complex_function_pointers.c
@@ -0,0 +1,51 @@
+#include <stdio.h>
+#include <stdlib.h>
+#include <stdbool.h>
+#include "uninitialized_malloc.h"
+
+static void possibly_assign(int** dest, int val, bool condition) {
+ if(condition) {
+ **dest = val;
+ }
+}
+
+void uninit_malloc_function_pointer(bool a, bool b, void (*f)(int**, int, bool)) {
+ int *data;
+
+#ifdef CATCH_BAD_PARAM
+ /* To be used if NO_BUG is defined */
+ /* and tool warns about possible dangerous input */
+ if(!f || (!a & !b)) {
+ return;
+ }
+#endif
+
+ data = malloc(sizeof(int));
+
+ if(!data) {
+ return;
+ }
+
+ (*f)(&data, 5, a);
+ (*f)(&data, 13, b);
+
+ printf("%i\n", *data);
+
+ free(data);
+}
+
+#ifndef NO_MAIN
+int main() {
+#ifdef NO_BUG
+ uninit_malloc_function_pointer(true, true, &possibly_assign);
+ uninit_malloc_function_pointer(true, false, &possibly_assign);
+ uninit_malloc_function_pointer(false, true, &possibly_assign);
+#else
+ uninit_malloc_function_pointer(true, true, &possibly_assign); /* OK */
+ uninit_malloc_function_pointer(false, false, &possibly_assign); /* DANGER */
+ uninit_malloc_function_pointer(false, true, &possibly_assign); /* OK */
+#endif
+
+ return 1;
+}
+#endif
diff --git a/bench-moerman2018/memory/access_uninit/18_complex_struct_multiple_methods.c b/bench-moerman2018/memory/access_uninit/18_complex_struct_multiple_methods.c
new file mode 100644
index 000000000..71880c70f
--- /dev/null
+++ b/bench-moerman2018/memory/access_uninit/18_complex_struct_multiple_methods.c
@@ -0,0 +1,102 @@
+#include <stdio.h>
+#include <stdlib.h>
+#include "uninitialized_malloc.h"
+
+#ifndef s_MEMORY_AU_REFCOUNT
+#define s_MEMORY_AU_REFCOUNT
+void uninit_malloc_cont_init(MallocIntCont* cont) {
+ cont->counter = 1;
+ cont->data = malloc(sizeof(int));
+}
+
+MallocIntCont* uninit_malloc_cont_new() {
+ MallocIntCont* new_cont;
+
+ new_cont = malloc(sizeof(MallocIntCont));
+
+ if(new_cont) {
+ uninit_malloc_cont_init(new_cont);
+ }
+ return new_cont;
+}
+
+void uninit_malloc_cont_incr(MallocIntCont* cont) {
+ if(cont) {
+ cont->counter++;
+ }
+}
+void uninit_malloc_cont_decr(MallocIntCont* cont) {
+ if(cont->counter <= 1) {
+ if(cont->data) {
+ free(cont->data);
+ }
+ cont->data = malloc(sizeof(int));
+ } else {
+ cont->counter--;
+ }
+}
+
+void uninint_val_cont_free(MallocIntCont* cont) {
+ if(cont->data) {
+ free(cont->data);
+ }
+ free(cont);
+}
+
+int uninit_malloc_cont_get_value(MallocIntCont* cont) {
+ if(cont->data) {
+ return *(cont->data);
+ }
+ return 0;
+}
+void uninit_malloc_cont_set_value(MallocIntCont* cont, int value) {
+ if(!cont->data) {
+ return;
+ }
+ *(cont->data) = value;
+}
+#endif //s_MEMORY_AU_REFCOUNT
+
+void uninit_malloc_struct(int x, int y) {
+ MallocIntCont cont;
+ int val;
+
+#ifdef CATCH_BAD_PARAM
+ if(x <= 10 && x >= y) {
+ return;
+ }
+#endif
+
+ uninit_malloc_cont_init(&cont);
+
+ if(x < y) {
+ uninit_malloc_cont_set_value(&cont, 7);
+ }
+
+ if(x > 10) {
+ val = 50 * 37;
+ } else {
+ /* DANGER: if x <= 10 & x >= y */
+ val = 30 * uninit_malloc_cont_get_value(&cont);
+ }
+
+ if(cont.data) {
+ free(cont.data);
+ }
+
+ printf("x=%i: %i\n", x, val);
+}
+
+#ifndef NO_MAIN
+int main() {
+#ifdef NO_BUG
+ uninit_malloc_struct(9, 10);
+ uninit_malloc_struct(10, 11);
+ uninit_malloc_struct(11, 10);
+#else
+ uninit_malloc_struct(10, 10); /* DANGER */
+#endif
+
+ return 1;
+}
+#endif
diff --git a/bench-moerman2018/memory/access_uninit/19_complex_refcount.c b/bench-moerman2018/memory/access_uninit/19_complex_refcount.c
new file mode 100644
index 000000000..119168f88
--- /dev/null
+++ b/bench-moerman2018/memory/access_uninit/19_complex_refcount.c
@@ -0,0 +1,87 @@
+#include "uninitialized_malloc.h"
+#include <stdlib.h>
+#include <stdio.h>
+
+#ifndef s_MEMORY_AU_REFCOUNT
+#define s_MEMORY_AU_REFCOUNT
+void uninit_malloc_cont_init(MallocIntCont* cont) {
+ cont->counter = 1;
+ cont->data = malloc(sizeof(int));
+}
+
+MallocIntCont* uninit_malloc_cont_new() {
+ MallocIntCont* new_cont;
+
+ new_cont = malloc(sizeof(MallocIntCont));
+
+ if(new_cont) {
+ uninit_malloc_cont_init(new_cont);
+ }
+ return new_cont;
+}
+
+void uninit_malloc_cont_incr(MallocIntCont* cont) {
+ if(cont) {
+ cont->counter++;
+ }
+}
+void uninit_malloc_cont_decr(MallocIntCont* cont) {
+ if(cont->counter <= 1) {
+ if(cont->data) {
+ free(cont->data);
+ }
+ cont->data = malloc(sizeof(int));
+ } else {
+ cont->counter--;
+ }
+}
+
+void uninint_val_cont_free(MallocIntCont* cont) {
+ if(cont->data) {
+ free(cont->data);
+ }
+ free(cont);
+}
+
+int uninit_malloc_cont_get_value(MallocIntCont* cont) {
+ if(cont->data) {
+ return *(cont->data);
+ }
+ return 0;
+}
+void uninit_malloc_cont_set_value(MallocIntCont* cont, int value) {
+ if(!cont->data) {
+ return;
+ }
+ *(cont->data) = value;
+}
+#endif //s_MEMORY_AU_REFCOUNT
+
+#ifndef NO_MAIN
+int main() {
+ MallocIntCont* cont;
+ int val;
+
+ cont = uninit_malloc_cont_new();
+ if(!cont) {
+ return 1;
+ }
+ uninit_malloc_cont_set_value(cont, 35);
+
+ uninit_malloc_cont_incr(cont);
+ uninit_malloc_cont_incr(cont);
+ uninit_malloc_cont_decr(cont);
+ uninit_malloc_cont_decr(cont);
+#ifndef NO_BUG
+ uninit_malloc_cont_decr(cont);
+#endif
+
+ val = 30 * uninit_malloc_cont_get_value(cont);
+
+ printf("%i\n", val);
+
+ uninint_val_cont_free(cont);
+
+ return 1;
+}
+#endif
diff --git a/bench-moerman2018/memory/access_uninit/test_correct/01_simple_if.c b/bench-moerman2018/memory/access_uninit/test_correct/01_simple_if.c
new file mode 100644
index 000000000..736c54e6d
--- /dev/null
+++ b/bench-moerman2018/memory/access_uninit/test_correct/01_simple_if.c
@@ -0,0 +1,38 @@
+#include <stdio.h>
+#include <stdlib.h>
+#include <stdbool.h>
+#include "uninitialized_malloc.h"
+
+void uninit_malloc_if_else(bool a, bool b) {
+ int* data;
+ int val;
+
+
+ data = malloc(sizeof(int));
+
+ if(!data) {
+ return;
+ }
+
+ if(a) {
+ *data = 1;
+ }
+
+ if(b) {
+ val = 37 * 2;
+ } else {
+ val = 11 * *data; /* DANGER, if !a & !b */
+ }
+
+ printf("%i\n", val);
+
+ free(data);
+}
+
+int main() {
+ uninit_malloc_if_else(true, true);
+ uninit_malloc_if_else(true, false);
+ uninit_malloc_if_else(false, true);
+
+ return 1;
+}
diff --git a/bench-moerman2018/memory/access_uninit/test_correct/02_simple_if_int1.c b/bench-moerman2018/memory/access_uninit/test_correct/02_simple_if_int1.c
new file mode 100644
index 000000000..bbc98b1c8
--- /dev/null
+++ b/bench-moerman2018/memory/access_uninit/test_correct/02_simple_if_int1.c
@@ -0,0 +1,37 @@
+#include <stdio.h>
+#include <stdlib.h>
+#include "uninitialized_malloc.h"
+
+void uninit_malloc_if_else_int1(int x, int y) {
+ int* data;
+ int val;
+
+
+ data = malloc(sizeof(int));
+
+ if(!data) {
+ return;
+ }
+
+ if(x < y) {
+ *data = 1;
+ }
+
+ if(x > 10) {
+ val = 37 * 2;
+ } else {
+ val = 11 * *data; /* DANGER, if x <= 10 & x >= y */
+ }
+
+ printf("x=%i: %i", x, val);
+
+ free(data);
+}
+
+int main() {
+ uninit_malloc_if_else_int1(9, 10);
+ uninit_malloc_if_else_int1(10, 11);
+ uninit_malloc_if_else_int1(11, 10);
+
+ return 1;
+}
diff --git a/bench-moerman2018/memory/access_uninit/test_correct/02_simple_if_int2.c b/bench-moerman2018/memory/access_uninit/test_correct/02_simple_if_int2.c
new file mode 100644
index 000000000..75ef78806
--- /dev/null
+++ b/bench-moerman2018/memory/access_uninit/test_correct/02_simple_if_int2.c
@@ -0,0 +1,42 @@
+#include <stdio.h>
+#include <stdlib.h>
+#include "uninitialized_malloc.h"
+
+void uninit_malloc_if_else_int2(int x, int y) {
+ int* data;
+ int val, m, n;
+
+ m = -1;
+ n = 5;
+
+ x = x*m+n;
+
+
+ data = malloc(sizeof(int));
+
+ if(!data) {
+ return;
+ }
+
+ if(x < y) {
+ *data = 1;
+ }
+
+ if(x > 10) {
+ val = 37 * 2;
+ } else {
+ val = 11 * *data; /* DANGER, if x <= 10 & x >= y */
+ }
+
+ printf("x=%i: %i", x, val);
+
+ free(data);
+}
+
+int main() {
+ uninit_malloc_if_else_int2(-4, 11);
+ uninit_malloc_if_else_int2(-5, 11);
+ uninit_malloc_if_else_int2(-6, 11);
+
+ return 1;
+}
diff --git a/bench-moerman2018/memory/access_uninit/test_correct/03_simple_if_multi_func.c b/bench-moerman2018/memory/access_uninit/test_correct/03_simple_if_multi_func.c
new file mode 100644
index 000000000..14b0e2e40
--- /dev/null
+++ b/bench-moerman2018/memory/access_uninit/test_correct/03_simple_if_multi_func.c
@@ -0,0 +1,44 @@
+#include "uninitialized_malloc.h"
+#include <stdbool.h>
+#include <stdlib.h>
+#include <stdio.h>
+
+static void possibly_assign(int* dest, int val, bool condition) {
+ if(condition) {
+ *dest = val;
+ }
+}
+
+static int conditional_assign(int* ptr1, int* ptr2, bool condition) {
+ if(condition) {
+ return *ptr1;
+ }
+ return *ptr2;
+}
+
+void uninit_malloc_if_else_multi(bool a, bool b) {
+ int* data;
+ int val = -7189;
+
+
+ data = malloc(sizeof(int));
+
+ if(!data) {
+ return;
+ }
+
+ possibly_assign(data, 37, a);
+
+ val = conditional_assign(&val, data, b); /* DANGER, if !a & !b */
+
+ printf("%i\n", val);
+
+ free(data);
+}
+
+int main() {
+ uninit_malloc_if_else_multi(true, true);
+ uninit_malloc_if_else_multi(true, false);
+ uninit_malloc_if_else_multi(false, true);
+ return 1;
+}
diff --git a/bench-moerman2018/memory/access_uninit/test_correct/04_simple_switch.c b/bench-moerman2018/memory/access_uninit/test_correct/04_simple_switch.c
new file mode 100644
index 000000000..033ae56b5
--- /dev/null
+++ b/bench-moerman2018/memory/access_uninit/test_correct/04_simple_switch.c
@@ -0,0 +1,52 @@
+#include "uninitialized_malloc.h"
+#include <stdlib.h>
+
+int uninit_malloc_switch(int x, int y) {
+ int* data;
+ int val;
+
+ data = malloc(sizeof(int));
+ if(!data) {
+ return -1;
+ }
+
+ if(x < y) {
+ *data = 1;
+ }
+
+ switch (x) {
+ case 5: {
+ val = 37 * *data; /* DANGER: x >= y */
+ break;
+ }
+ case 7: {
+ val = -37 * 2;
+ break;
+ }
+ case 10: {
+ val = 73 * *data; /* DANGER: x >= y */
+ break;
+ }
+ case 12: {
+ val = 73 * 5;
+ break;
+ }
+ default: {
+ val = 100 * 8;
+ break;
+ }
+ };
+
+ free(data);
+
+ return val;
+}
+
+int main() {
+ uninit_malloc_switch(5, 11);
+ uninit_malloc_switch(10, 11);
+ uninit_malloc_switch(11, 11);
+ uninit_malloc_switch(7, 5);
+
+ return 1;
+}
diff --git a/bench-moerman2018/memory/access_uninit/test_correct/05_simple_goto.c b/bench-moerman2018/memory/access_uninit/test_correct/05_simple_goto.c
new file mode 100644
index 000000000..4be75e504
--- /dev/null
+++ b/bench-moerman2018/memory/access_uninit/test_correct/05_simple_goto.c
@@ -0,0 +1,42 @@
+#include <stdio.h>
+#include <stdlib.h>
+#include "uninitialized_malloc.h"
+
+void uninit_malloc_goto(int x) {
+ int val = 0, i = 0;
+ int* data;
+
+
+ data = malloc(sizeof(int));
+
+ if(!data) {
+ return;
+ }
+
+ *data = x;
+
+GOTO_LABEL:
+ if(i <= x) {
+ if(data) {
+ val += *data;
+ }
+ } else {
+ printf("%i\n", val);
+ }
+
+ free(data);
+ data = malloc(sizeof(int));
+
+ if(i == 0) {
+ i++;
+ goto GOTO_LABEL;
+ }
+
+ free(data);
+}
+
+int main() {
+ uninit_malloc_goto(0);
+
+ return 1;
+}
diff --git a/bench-moerman2018/memory/access_uninit/test_correct/06_simple_pass_by_reference.c b/bench-moerman2018/memory/access_uninit/test_correct/06_simple_pass_by_reference.c
new file mode 100644
index 000000000..a6bd50fe8
--- /dev/null
+++ b/bench-moerman2018/memory/access_uninit/test_correct/06_simple_pass_by_reference.c
@@ -0,0 +1,36 @@
+#include <stdio.h>
+#include <stdlib.h>
+#include <stdbool.h>
+#include "uninitialized_malloc.h"
+
+static void possibly_assign(int** dest, int val, bool condition) {
+ if(condition) {
+ **dest = val;
+ }
+}
+
+void uninit_malloc_pass_by_reference(bool a, bool b) {
+ int* data;
+
+
+ data = malloc(sizeof(int));
+
+ if(!data) {
+ return;
+ }
+
+ possibly_assign(&data, 5, a);
+ possibly_assign(&data, 13, b);
+
+ printf("%i\n", *data);
+
+ free(data);
+}
+
+int main() {
+ uninit_malloc_pass_by_reference(true, true);
+ uninit_malloc_pass_by_reference(true, false);
+ uninit_malloc_pass_by_reference(false, true);
+
+ return 1;
+}
diff --git a/bench-moerman2018/memory/access_uninit/test_correct/07_simple_cross_file.c b/bench-moerman2018/memory/access_uninit/test_correct/07_simple_cross_file.c
new file mode 100644
index 000000000..b9e871304
--- /dev/null
+++ b/bench-moerman2018/memory/access_uninit/test_correct/07_simple_cross_file.c
@@ -0,0 +1,37 @@
+#include "uninitialized_malloc.h"
+#include "common.h"
+#include <stdlib.h>
+#include <stdbool.h>
+#include <stdio.h>
+
+void uninit_malloc_cross_file(bool a, bool b) {
+ int* data;
+ int val;
+ int* int_ptr;
+
+
+ data = malloc(sizeof(int));
+
+ if(!data) {
+ return;
+ }
+
+ int_ptr = (int*) choose_pointer((void*) data, (void*) &val, a);
+ *int_ptr = 768;
+
+ if(b) {
+ val = 10 * 2;
+ } else {
+ val = 10 * *data; /* DANGER, if !a & !b */
+ }
+
+ printf("%i\n", val);
+ free(data);
+}
+
+int main() {
+ uninit_malloc_cross_file(true, true);
+ uninit_malloc_cross_file(true, false);
+ uninit_malloc_cross_file(false, true);
+ return 1;
+}
diff --git a/bench-moerman2018/memory/access_uninit/test_correct/08_loop_for.c b/bench-moerman2018/memory/access_uninit/test_correct/08_loop_for.c
new file mode 100644
index 000000000..b6ee431b1
--- /dev/null
+++ b/bench-moerman2018/memory/access_uninit/test_correct/08_loop_for.c
@@ -0,0 +1,36 @@
+#include <stdio.h>
+#include <stdlib.h>
+#include "uninitialized_malloc.h"
+
+void uninit_malloc_for(int x) {
+ int* data;
+ int val = 0;
+ int i;
+
+
+ data = malloc(sizeof(int));
+ if(!data) {
+ return;
+ }
+
+ for(i = 0; i < 20; i++) {
+ if(i > x) {
+ val += 10 * (*data - 2); /* DANGER: x < 10 */
+ } else {
+ val += 10 * 4;
+ }
+ if(i == 10) {
+ *data = 4;
+ val += 10 * *data;
+ }
+ }
+
+ printf("val = %i\n", val);
+ free(data);
+}
+
+int main() {
+ uninit_malloc_for(10);
+
+ return 1;
+}
diff --git a/bench-moerman2018/memory/access_uninit/test_correct/09_loop_for_complex.c b/bench-moerman2018/memory/access_uninit/test_correct/09_loop_for_complex.c
new file mode 100644
index 000000000..be2c1bfcd
--- /dev/null
+++ b/bench-moerman2018/memory/access_uninit/test_correct/09_loop_for_complex.c
@@ -0,0 +1,39 @@
+#include <stdio.h>
+#include <stdlib.h>
+#include "uninitialized_malloc.h"
+
+void uninit_malloc_for_complex(int x) {
+ int* data;
+ int val = 0, i = 0;
+
+
+ data = malloc(sizeof(int));
+ if(!data) {
+ return;
+ }
+
+ for(;;) {
+ if(i > x) {
+ val += 10 * (*data - 2); /* DANGER: x < 10 */
+ } else {
+ val += 10 * 4;
+ }
+ if(i == 10) {
+ *data = 4;
+ val += 10 * *data;
+ }
+ i++;
+ if(i >= 20) {
+ break;
+ }
+ }
+
+ printf("val = %i\n", val);
+ free(data);
+}
+
+int main() {
+ uninit_malloc_for_complex(10);
+
+ return 1;
+}
diff --git a/bench-moerman2018/memory/access_uninit/test_correct/10_loop_while_continue.c b/bench-moerman2018/memory/access_uninit/test_correct/10_loop_while_continue.c
new file mode 100644
index 000000000..8489e2125
--- /dev/null
+++ b/bench-moerman2018/memory/access_uninit/test_correct/10_loop_while_continue.c
@@ -0,0 +1,39 @@
+#include <stdio.h>
+#include <stdlib.h>
+#include "uninitialized_malloc.h"
+
+void uninit_malloc_while_continue(int x) {
+ int* data;
+ int val = 0, i = 0;
+
+
+ data = malloc(sizeof(int));
+ if(!data) {
+ return;
+ }
+
+ while(i < 30) {
+ if(i > x) {
+ val += 10 * (*data - 2); /* DANGER: x < 10 */
+ } else {
+ val += 10 * 4;
+ }
+ if(i == 10) {
+ *data = 4;
+ val += 10 * *data;
+ }
+ i++;
+ if(i < 20) {
+ continue;
+ }
+ }
+
+ printf("val = %i", val);
+ free(data);
+}
+
+int main() {
+ uninit_malloc_while_continue(10);
+
+ return 1;
+}
diff --git a/bench-moerman2018/memory/access_uninit/test_correct/11_loop_while_do_continue.c b/bench-moerman2018/memory/access_uninit/test_correct/11_loop_while_do_continue.c
new file mode 100644
index 000000000..f301fc397
--- /dev/null
+++ b/bench-moerman2018/memory/access_uninit/test_correct/11_loop_while_do_continue.c
@@ -0,0 +1,39 @@
+#include <stdio.h>
+#include <stdlib.h>
+#include "uninitialized_malloc.h"
+
+void uninit_malloc_do_while_continue(int x) {
+ int* data;
+ int val = 0, i = 0;
+
+
+ data = malloc(sizeof(int));
+ if(!data) {
+ return;
+ }
+
+ do {
+ if(i > x) {
+ val += 10 * (*data - 2); /* DANGER: x < 10 */
+ } else {
+ val += 10 * 4;
+ }
+ if(i == 10) {
+ *data = 4;
+ val += 10 * *data;
+ }
+ i++;
+ if(i < 20) {
+ continue;
+ }
+ } while(i < 30);
+
+ printf("val = %i", val);
+ free(data);
+}
+
+int main() {
+ uninit_malloc_do_while_continue(10);
+
+ return 1;
+}
diff --git a/bench-moerman2018/memory/access_uninit/test_correct/12_loop_for_array_branching.c b/bench-moerman2018/memory/access_uninit/test_correct/12_loop_for_array_branching.c
new file mode 100644
index 000000000..92a70f01b
--- /dev/null
+++ b/bench-moerman2018/memory/access_uninit/test_correct/12_loop_for_array_branching.c
@@ -0,0 +1,47 @@
+#include <stdio.h>
+#include <stdlib.h>
+#include "uninitialized_malloc.h"
+
+void uninit_malloc_for_array(int x) {
+ int* data;
+ int p[20];
+ int val = 0, i = 0;
+
+ if(x < 0 || x > 19) {
+ return;
+ }
+
+
+ data = malloc(sizeof(int));
+ if(!data) {
+ return;
+ }
+
+ *data = 12;
+
+ for(i = 0; i < 20; i++) {
+ p[i] = 0;
+ }
+ p[x] = 1;
+
+ for(i = 0; i < 20; i++) {
+ if(p[i] == 1) {
+ free(data);
+ data = malloc(sizeof(int));
+ if(!data) {
+ return;
+ }
+ } else {
+ val += *data; /* DANGER: x < 19 */
+ }
+ }
+
+ printf("%i\n", val);
+ free(data);
+}
+
+int main() {
+ uninit_malloc_for_array(19);
+
+ return 1;
+}
diff --git a/bench-moerman2018/memory/access_uninit/test_correct/13_loop_for_pointer_arithmetic.c b/bench-moerman2018/memory/access_uninit/test_correct/13_loop_for_pointer_arithmetic.c
new file mode 100644
index 000000000..ffda1d828
--- /dev/null
+++ b/bench-moerman2018/memory/access_uninit/test_correct/13_loop_for_pointer_arithmetic.c
@@ -0,0 +1,43 @@
+#include <stdlib.h>
+#include <stdio.h>
+#include "uninitialized_malloc.h"
+
+void uninit_malloc_for_pointer(int x) {
+ int* pointers[10];
+ int** pointers_alias = pointers;
+ int val = 0, i;
+
+ if(x < 0 || x > 10) {
+ return;
+ }
+
+
+ for(i = 0; i < 10; i++, pointers_alias++) {
+ *pointers_alias = malloc(sizeof(int));
+ }
+
+ pointers_alias = pointers;
+ for(i = 0; i < x; i++, pointers_alias++) {
+ if(!(*pointers_alias)) {
+ continue;
+ }
+ **pointers_alias = i;
+ }
+
+ pointers_alias = pointers;
+ for(i = 0; i < 10; i++, pointers_alias++) {
+ if(!(*pointers_alias)) {
+ continue;
+ }
+ val += **pointers_alias;
+ free(*pointers_alias);
+ }
+
+ printf("%i\n", val);
+}
+
+int main() {
+ uninit_malloc_for_pointer(10);
+
+ return 1;
+}
diff --git a/bench-moerman2018/memory/access_uninit/test_correct/14_loop_recursion.c b/bench-moerman2018/memory/access_uninit/test_correct/14_loop_recursion.c
new file mode 100644
index 000000000..2d911d22b
--- /dev/null
+++ b/bench-moerman2018/memory/access_uninit/test_correct/14_loop_recursion.c
@@ -0,0 +1,55 @@
+#include <stdio.h>
+#include <stdlib.h>
+#include "uninitialized_malloc.h"
+
+int uninit_malloc_rec(int x, int i, int* ptr1, int* ptr2) {
+ int val;
+
+ if(i <= 1) {
+ free(ptr1);
+ free(ptr2);
+ return 0;
+ }
+
+
+ if(!ptr1) {
+ ptr1 = malloc(sizeof(int));
+ if(ptr1) {
+ *ptr1 = 1;
+ } else {
+ if(ptr2) {
+ free(ptr2);
+ }
+ return -1;
+ }
+ }
+ if(!ptr2) {
+ ptr2 = malloc(sizeof(int));
+ if(!ptr2) {
+ free(ptr1);
+ return -1;
+ }
+ return uninit_malloc_rec(x, i-1, ptr1, ptr2) + 2 * *ptr1;
+ }
+
+ if(i < x) {
+ val = *ptr2;
+ } else {
+ val = *ptr1;
+ }
+ if(i == 10) {
+ *ptr2 = *ptr1;
+ }
+ return uninit_malloc_rec(x, i-1, ptr1, ptr2) + 3 * val;
+}
+
+int main() {
+ int* initialized = malloc(sizeof(int));
+ printf("%i\n", uninit_malloc_rec(10, 20, 0, 0));
+ if(initialized) {
+ *initialized = 2;
+ printf("%i\n", uninit_malloc_rec(11, 20, 0, initialized));
+ }
+
+ return 1;
+}
diff --git a/bench-moerman2018/memory/access_uninit/test_correct/15_loop_recursion_multi.c b/bench-moerman2018/memory/access_uninit/test_correct/15_loop_recursion_multi.c
new file mode 100644
index 000000000..b0f65e825
--- /dev/null
+++ b/bench-moerman2018/memory/access_uninit/test_correct/15_loop_recursion_multi.c
@@ -0,0 +1,63 @@
+#include <stdio.h>
+#include <stdlib.h>
+#include "uninitialized_malloc.h"
+
+int uninit_malloc_rec_decr(int x, int i, int* ptr1, int* ptr2) {
+ if(i <= 1) {
+ return 0;
+ }
+
+ return uninit_malloc_rec_multi(x, i-1, ptr1, ptr2);
+}
+
+int uninit_malloc_rec_multi(int x, int i, int* ptr1, int* ptr2) {
+ int val;
+
+ if(i <= 1) {
+ free(ptr1);
+ free(ptr2);
+ return 0;
+ }
+
+
+ if(!ptr1) {
+ ptr1 = malloc(sizeof(int));
+ if(ptr1) {
+ *ptr1 = 1;
+ } else {
+ if(ptr2) {
+ free(ptr2);
+ }
+ return -1;
+ }
+ }
+ if(!ptr2) {
+ ptr2 = malloc(sizeof(int));
+ if(!ptr2) {
+ free(ptr1);
+ return -1;
+ }
+ return 2 * *ptr1 + uninit_malloc_rec_decr(x, i, ptr1, ptr2);
+ }
+
+ if(i < x) {
+ val = *ptr2;
+ } else {
+ val = *ptr1;
+ }
+ if(i == 10) {
+ *ptr2 = *ptr1;
+ }
+ return uninit_malloc_rec_decr(x, i, ptr1, ptr2) + 3 * val;
+}
+
+int main() {
+ int* initialized = malloc(sizeof(int));;
+ printf("%i\n", uninit_malloc_rec_multi(10, 20, 0, 0));
+ if(initialized) {
+ *initialized = 2;
+ printf("%i\n", uninit_malloc_rec_multi(11, 20, 0, initialized));
+ }
+
+ return 1;
+}
diff --git a/bench-moerman2018/memory/access_uninit/test_correct/16_misc_pseudo_recursion.c b/bench-moerman2018/memory/access_uninit/test_correct/16_misc_pseudo_recursion.c
new file mode 100644
index 000000000..4419dfc4d
--- /dev/null
+++ b/bench-moerman2018/memory/access_uninit/test_correct/16_misc_pseudo_recursion.c
@@ -0,0 +1,67 @@
+#include <stdio.h>
+#include <stdlib.h>
+#include "uninitialized_malloc.h"
+
+int uninit_malloc_pseudo_rec1(int x, int y, int i, int* ptr1, int* ptr2) {
+ int *data;
+
+ if(i > 0) {
+ return 37;
+ }
+
+ if(!ptr1) {
+ ptr1 = malloc(sizeof(int));
+ if(ptr1) {
+ *ptr1 = 1;
+ } else {
+ if(ptr2) {
+ free(ptr2);
+ }
+ return -1;
+ }
+ }
+ if(!ptr2) {
+ ptr2 = malloc(sizeof(int));
+ if(!ptr2) {
+ free(ptr1);
+ return -1;
+ }
+ }
+
+ if(x < y) {
+ *ptr2 = *ptr1;
+ }
+
+ return uninit_malloc_pseudo_rec2(x, y, 1, ptr1, ptr2);
+}
+
+int uninit_malloc_pseudo_rec2(int x, int y, int i, int* ptr1, int* ptr2) {
+ int val;
+
+ if(i <= 0) {
+ return 3 * (*ptr1) + uninit_malloc_pseudo_rec1(x, y, 1, ptr1, ptr2);
+ }
+
+ if(x > 10) {
+ val = *ptr1;
+ } else {
+ val = *ptr2;
+ }
+
+ free(ptr1);
+ free(ptr2);
+
+ return 3 * val;
+}
+
+int main() {
+ int* initialized = malloc(sizeof(int));
+ printf("%i\n", uninit_malloc_pseudo_rec1(9, 10, 0, 0, 0));
+ if(initialized) {
+ *initialized = 2;
+ printf("%i\n", uninit_malloc_pseudo_rec1(10, 10, 0, 0, initialized));
+ }
+ printf("%i\n", uninit_malloc_pseudo_rec1(11, 10, 0, 0, 0));
+
+ return 1;
+}
diff --git a/bench-moerman2018/memory/access_uninit/test_correct/17_complex_function_pointers.c b/bench-moerman2018/memory/access_uninit/test_correct/17_complex_function_pointers.c
new file mode 100644
index 000000000..d2db683f1
--- /dev/null
+++ b/bench-moerman2018/memory/access_uninit/test_correct/17_complex_function_pointers.c
@@ -0,0 +1,36 @@
+#include <stdio.h>
+#include <stdlib.h>
+#include <stdbool.h>
+#include "uninitialized_malloc.h"
+
+static void possibly_assign(int** dest, int val, bool condition) {
+ if(condition) {
+ **dest = val;
+ }
+}
+
+void uninit_malloc_function_pointer(bool a, bool b, void (*f)(int**, int, bool)) {
+ int *data;
+
+
+ data = malloc(sizeof(int));
+
+ if(!data) {
+ return;
+ }
+
+ (*f)(&data, 5, a);
+ (*f)(&data, 13, b);
+
+ printf("%i\n", *data);
+
+ free(data);
+}
+
+int main() {
+ uninit_malloc_function_pointer(true, true, &possibly_assign);
+ uninit_malloc_function_pointer(true, false, &possibly_assign);
+ uninit_malloc_function_pointer(false, true, &possibly_assign);
+
+ return 1;
+}
diff --git a/bench-moerman2018/memory/access_uninit/test_correct/18_complex_struct_multiple_methods.c b/bench-moerman2018/memory/access_uninit/test_correct/18_complex_struct_multiple_methods.c
new file mode 100644
index 000000000..9f34bdaa1
--- /dev/null
+++ b/bench-moerman2018/memory/access_uninit/test_correct/18_complex_struct_multiple_methods.c
@@ -0,0 +1,91 @@
+#include <stdio.h>
+#include <stdlib.h>
+#include "uninitialized_malloc.h"
+
+#ifndef s_UNINIT_VAL_REFCOUNT
+#define s_UNINIT_VAL_REFCOUNT
+void uninit_malloc_cont_init(MallocIntCont* cont) {
+ cont->counter = 1;
+ cont->data = malloc(sizeof(int));
+}
+
+MallocIntCont* uninit_malloc_cont_new() {
+ MallocIntCont* new_cont;
+
+ new_cont = malloc(sizeof(MallocIntCont));
+
+ if(new_cont) {
+ uninit_malloc_cont_init(new_cont);
+ }
+ return new_cont;
+}
+
+void uninit_malloc_cont_incr(MallocIntCont* cont) {
+ if(cont) {
+ cont->counter++;
+ }
+}
+void uninit_malloc_cont_decr(MallocIntCont* cont) {
+ if(cont->counter <= 1) {
+ if(cont->data) {
+ free(cont->data);
+ }
+ cont->data = malloc(sizeof(int));
+ } else {
+ cont->counter--;
+ }
+}
+
+void uninint_val_cont_free(MallocIntCont* cont) {
+ if(cont->data) {
+ free(cont->data);
+ }
+ free(cont);
+}
+
+int uninit_malloc_cont_get_value(MallocIntCont* cont) {
+ if(cont->data) {
+ return *(cont->data);
+ }
+ return 0;
+}
+void uninit_malloc_cont_set_value(MallocIntCont* cont, int value) {
+ if(!cont->data) {
+ return;
+ }
+ *(cont->data) = value;
+}
+#endif //s_UNINIT_VAL_REFCOUNT
+
+void uninit_malloc_struct(int x, int y) {
+ MallocIntCont cont;
+ int val;
+
+
+ uninit_malloc_cont_init(&cont);
+
+ if(x < y) {
+ uninit_malloc_cont_set_value(&cont, 7);
+ }
+
+ if(x > 10) {
+ val = 50 * 37;
+ } else {
+ /* DANGER: if x <= 10 & x >= y */
+ val = 30 * uninit_malloc_cont_get_value(&cont);
+ }
+
+ if(cont.data) {
+ free(cont.data);
+ }
+
+ printf("x=%i: %i\n", x, val);
+}
+
+int main() {
+ uninit_malloc_struct(9, 10);
+ uninit_malloc_struct(10, 11);
+ uninit_malloc_struct(11, 10);
+
+ return 1;
+}
diff --git a/bench-moerman2018/memory/access_uninit/test_correct/19_complex_refcount.c b/bench-moerman2018/memory/access_uninit/test_correct/19_complex_refcount.c
new file mode 100644
index 000000000..d9b3c7973
--- /dev/null
+++ b/bench-moerman2018/memory/access_uninit/test_correct/19_complex_refcount.c
@@ -0,0 +1,82 @@
+#include "uninitialized_malloc.h"
+#include <stdlib.h>
+#include <stdio.h>
+
+#ifndef s_UNINIT_VAL_REFCOUNT
+#define s_UNINIT_VAL_REFCOUNT
+void uninit_malloc_cont_init(MallocIntCont* cont) {
+ cont->counter = 1;
+ cont->data = malloc(sizeof(int));
+}
+
+MallocIntCont* uninit_malloc_cont_new() {
+ MallocIntCont* new_cont;
+
+ new_cont = malloc(sizeof(MallocIntCont));
+
+ if(new_cont) {
+ uninit_malloc_cont_init(new_cont);
+ }
+ return new_cont;
+}
+
+void uninit_malloc_cont_incr(MallocIntCont* cont) {
+ if(cont) {
+ cont->counter++;
+ }
+}
+void uninit_malloc_cont_decr(MallocIntCont* cont) {
+ if(cont->counter <= 1) {
+ if(cont->data) {
+ free(cont->data);
+ }
+ cont->data = malloc(sizeof(int));
+ } else {
+ cont->counter--;
+ }
+}
+
+void uninint_val_cont_free(MallocIntCont* cont) {
+ if(cont->data) {
+ free(cont->data);
+ }
+ free(cont);
+}
+
+int uninit_malloc_cont_get_value(MallocIntCont* cont) {
+ if(cont->data) {
+ return *(cont->data);
+ }
+ return 0;
+}
+void uninit_malloc_cont_set_value(MallocIntCont* cont, int value) {
+ if(!cont->data) {
+ return;
+ }
+ *(cont->data) = value;
+}
+#endif //s_UNINIT_VAL_REFCOUNT
+
+int main() {
+ MallocIntCont* cont;
+ int val;
+
+ cont = uninit_malloc_cont_new();
+ if(!cont) {
+ return 1;
+ }
+ uninit_malloc_cont_set_value(cont, 35);
+
+ uninit_malloc_cont_incr(cont);
+ uninit_malloc_cont_incr(cont);
+ uninit_malloc_cont_decr(cont);
+ uninit_malloc_cont_decr(cont);
+
+ val = 30 * uninit_malloc_cont_get_value(cont);
+
+ printf("%i\n", val);
+
+ uninint_val_cont_free(cont);
+
+ return 1;
+}
diff --git a/bench-moerman2018/memory/access_uninit/test_correct_catch_bad/01_simple_if.c b/bench-moerman2018/memory/access_uninit/test_correct_catch_bad/01_simple_if.c
new file mode 100644
index 000000000..b7d85dc19
--- /dev/null
+++ b/bench-moerman2018/memory/access_uninit/test_correct_catch_bad/01_simple_if.c
@@ -0,0 +1,41 @@
+#include <stdio.h>
+#include <stdlib.h>
+#include <stdbool.h>
+#include "uninitialized_malloc.h"
+
+void uninit_malloc_if_else(bool a, bool b) {
+ int* data;
+ int val;
+
+ if(!a & !b) {
+ return;
+ }
+
+ data = malloc(sizeof(int));
+
+ if(!data) {
+ return;
+ }
+
+ if(a) {
+ *data = 1;
+ }
+
+ if(b) {
+ val = 37 * 2;
+ } else {
+ val = 11 * *data; /* DANGER, if !a & !b */
+ }
+
+ printf("%i\n", val);
+
+ free(data);
+}
+
+int main() {
+ uninit_malloc_if_else(true, true);
+ uninit_malloc_if_else(true, false);
+ uninit_malloc_if_else(false, true);
+
+ return 1;
+}
diff --git a/bench-moerman2018/memory/access_uninit/test_correct_catch_bad/02_simple_if_int1.c b/bench-moerman2018/memory/access_uninit/test_correct_catch_bad/02_simple_if_int1.c
new file mode 100644
index 000000000..ed6acaa36
--- /dev/null
+++ b/bench-moerman2018/memory/access_uninit/test_correct_catch_bad/02_simple_if_int1.c
@@ -0,0 +1,40 @@
+#include <stdio.h>
+#include <stdlib.h>
+#include "uninitialized_malloc.h"
+
+void uninit_malloc_if_else_int1(int x, int y) {
+ int* data;
+ int val;
+
+ if(x <= 10 && x >= y) {
+ return;
+ }
+
+ data = malloc(sizeof(int));
+
+ if(!data) {
+ return;
+ }
+
+ if(x < y) {
+ *data = 1;
+ }
+
+ if(x > 10) {
+ val = 37 * 2;
+ } else {
+ val = 11 * *data; /* DANGER, if x <= 10 & x >= y */
+ }
+
+ printf("x=%i: %i", x, val);
+
+ free(data);
+}
+
+int main() {
+ uninit_malloc_if_else_int1(9, 10);
+ uninit_malloc_if_else_int1(10, 11);
+ uninit_malloc_if_else_int1(11, 10);
+
+ return 1;
+}
diff --git a/bench-moerman2018/memory/access_uninit/test_correct_catch_bad/02_simple_if_int2.c b/bench-moerman2018/memory/access_uninit/test_correct_catch_bad/02_simple_if_int2.c
new file mode 100644
index 000000000..535165754
--- /dev/null
+++ b/bench-moerman2018/memory/access_uninit/test_correct_catch_bad/02_simple_if_int2.c
@@ -0,0 +1,45 @@
+#include <stdio.h>
+#include <stdlib.h>
+#include "uninitialized_malloc.h"
+
+void uninit_malloc_if_else_int2(int x, int y) {
+ int* data;
+ int val, m, n;
+
+ m = -1;
+ n = 5;
+
+ x = x*m+n;
+
+ if(x <= 10 && x >= y) {
+ return;
+ }
+
+ data = malloc(sizeof(int));
+
+ if(!data) {
+ return;
+ }
+
+ if(x < y) {
+ *data = 1;
+ }
+
+ if(x > 10) {
+ val = 37 * 2;
+ } else {
+ val = 11 * *data; /* DANGER, if x <= 10 & x >= y */
+ }
+
+ printf("x=%i: %i", x, val);
+
+ free(data);
+}
+
+int main() {
+ uninit_malloc_if_else_int2(-4, 11);
+ uninit_malloc_if_else_int2(-5, 11);
+ uninit_malloc_if_else_int2(-6, 11);
+
+ return 1;
+}
diff --git a/bench-moerman2018/memory/access_uninit/test_correct_catch_bad/03_simple_if_multi_func.c b/bench-moerman2018/memory/access_uninit/test_correct_catch_bad/03_simple_if_multi_func.c
new file mode 100644
index 000000000..d141e2736
--- /dev/null
+++ b/bench-moerman2018/memory/access_uninit/test_correct_catch_bad/03_simple_if_multi_func.c
@@ -0,0 +1,47 @@
+#include "uninitialized_malloc.h"
+#include <stdbool.h>
+#include <stdlib.h>
+#include <stdio.h>
+
+static void possibly_assign(int* dest, int val, bool condition) {
+ if(condition) {
+ *dest = val;
+ }
+}
+
+static int conditional_assign(int* ptr1, int* ptr2, bool condition) {
+ if(condition) {
+ return *ptr1;
+ }
+ return *ptr2;
+}
+
+void uninit_malloc_if_else_multi(bool a, bool b) {
+ int* data;
+ int val = -7189;
+
+ if(!a & !b) {
+ return;
+ }
+
+ data = malloc(sizeof(int));
+
+ if(!data) {
+ return;
+ }
+
+ possibly_assign(data, 37, a);
+
+ val = conditional_assign(&val, data, b); /* DANGER, if !a & !b */
+
+ printf("%i\n", val);
+
+ free(data);
+}
+
+int main() {
+ uninit_malloc_if_else_multi(true, true);
+ uninit_malloc_if_else_multi(true, false);
+ uninit_malloc_if_else_multi(false, true);
+ return 1;
+}
diff --git a/bench-moerman2018/memory/access_uninit/test_correct_catch_bad/04_simple_switch.c b/bench-moerman2018/memory/access_uninit/test_correct_catch_bad/04_simple_switch.c
new file mode 100644
index 000000000..ad43af9bb
--- /dev/null
+++ b/bench-moerman2018/memory/access_uninit/test_correct_catch_bad/04_simple_switch.c
@@ -0,0 +1,55 @@
+#include "uninitialized_malloc.h"
+#include <stdlib.h>
+
+int uninit_malloc_switch(int x, int y) {
+ int* data;
+ int val;
+
+ if((x == 10 || x == 5) && x >= y) {
+ return -1;
+ }
+ data = malloc(sizeof(int));
+ if(!data) {
+ return -1;
+ }
+
+ if(x < y) {
+ *data = 1;
+ }
+
+ switch (x) {
+ case 5: {
+ val = 37 * *data; /* DANGER: x >= y */
+ break;
+ }
+ case 7: {
+ val = -37 * 2;
+ break;
+ }
+ case 10: {
+ val = 73 * *data; /* DANGER: x >= y */
+ break;
+ }
+ case 12: {
+ val = 73 * 5;
+ break;
+ }
+ default: {
+ val = 100 * 8;
+ break;
+ }
+ };
+
+ free(data);
+
+ return val;
+}
+
+int main() {
+ uninit_malloc_switch(5, 11);
+ uninit_malloc_switch(10, 11);
+ uninit_malloc_switch(11, 11);
+ uninit_malloc_switch(7, 5);
+
+ return 1;
+}
diff --git a/bench-moerman2018/memory/access_uninit/test_correct_catch_bad/05_simple_goto.c b/bench-moerman2018/memory/access_uninit/test_correct_catch_bad/05_simple_goto.c
new file mode 100644
index 000000000..d2d477e3a
--- /dev/null
+++ b/bench-moerman2018/memory/access_uninit/test_correct_catch_bad/05_simple_goto.c
@@ -0,0 +1,45 @@
+#include <stdio.h>
+#include <stdlib.h>
+#include "uninitialized_malloc.h"
+
+void uninit_malloc_goto(int x) {
+ int val = 0, i = 0;
+ int* data;
+
+ if(x > 0) {
+ return;
+ }
+
+ data = malloc(sizeof(int));
+
+ if(!data) {
+ return;
+ }
+
+ *data = x;
+
+GOTO_LABEL:
+ if(i <= x) {
+ if(data) {
+ val += *data;
+ }
+ } else {
+ printf("%i\n", val);
+ }
+
+ free(data);
+ data = malloc(sizeof(int));
+
+ if(i == 0) {
+ i++;
+ goto GOTO_LABEL;
+ }
+
+ free(data);
+}
+
+int main() {
+ uninit_malloc_goto(0);
+
+ return 1;
+}
diff --git a/bench-moerman2018/memory/access_uninit/test_correct_catch_bad/06_simple_pass_by_reference.c b/bench-moerman2018/memory/access_uninit/test_correct_catch_bad/06_simple_pass_by_reference.c
new file mode 100644
index 000000000..2dc599331
--- /dev/null
+++ b/bench-moerman2018/memory/access_uninit/test_correct_catch_bad/06_simple_pass_by_reference.c
@@ -0,0 +1,41 @@
+#include <stdio.h>
+#include <stdlib.h>
+#include <stdbool.h>
+#include "uninitialized_malloc.h"
+
+static void possibly_assign(int** dest, int val, bool condition) {
+ if(condition) {
+ **dest = val;
+ }
+}
+
+void uninit_malloc_pass_by_reference(bool a, bool b) {
+ int* data;
+
+ /* To be used if is defined */
+ /* and tool warns about possible dangerous input */
+ if(!a & !b) {
+ return;
+ }
+
+ data = malloc(sizeof(int));
+
+ if(!data) {
+ return;
+ }
+
+ possibly_assign(&data, 5, a);
+ possibly_assign(&data, 13, b);
+
+ printf("%i\n", *data);
+
+ free(data);
+}
+
+int main() {
+ uninit_malloc_pass_by_reference(true, true);
+ uninit_malloc_pass_by_reference(true, false);
+ uninit_malloc_pass_by_reference(false, true);
+
+ return 1;
+}
diff --git a/bench-moerman2018/memory/access_uninit/test_correct_catch_bad/07_simple_cross_file.c b/bench-moerman2018/memory/access_uninit/test_correct_catch_bad/07_simple_cross_file.c
new file mode 100644
index 000000000..ff5082a00
--- /dev/null
+++ b/bench-moerman2018/memory/access_uninit/test_correct_catch_bad/07_simple_cross_file.c
@@ -0,0 +1,40 @@
+#include "uninitialized_malloc.h"
+#include "common.h"
+#include <stdlib.h>
+#include <stdbool.h>
+#include <stdio.h>
+
+void uninit_malloc_cross_file(bool a, bool b) {
+ int* data;
+ int val;
+ int* int_ptr;
+
+ if(!a & !b) {
+ return;
+ }
+
+ data = malloc(sizeof(int));
+
+ if(!data) {
+ return;
+ }
+
+ int_ptr = (int*) choose_pointer((void*) data, (void*) &val, a);
+ *int_ptr = 768;
+
+ if(b) {
+ val = 10 * 2;
+ } else {
+ val = 10 * *data; /* DANGER, if !a & !b */
+ }
+
+ printf("%i\n", val);
+ free(data);
+}
+
+int main() {
+ uninit_malloc_cross_file(true, true);
+ uninit_malloc_cross_file(true, false);
+ uninit_malloc_cross_file(false, true);
+ return 1;
+}
diff --git a/bench-moerman2018/memory/access_uninit/test_correct_catch_bad/08_loop_for.c b/bench-moerman2018/memory/access_uninit/test_correct_catch_bad/08_loop_for.c
new file mode 100644
index 000000000..4dd16d30f
--- /dev/null
+++ b/bench-moerman2018/memory/access_uninit/test_correct_catch_bad/08_loop_for.c
@@ -0,0 +1,39 @@
+#include <stdio.h>
+#include <stdlib.h>
+#include "uninitialized_malloc.h"
+
+void uninit_malloc_for(int x) {
+ int* data;
+ int val = 0;
+ int i;
+
+ if(x < 10) {
+ return;
+ }
+
+ data = malloc(sizeof(int));
+ if(!data) {
+ return;
+ }
+
+ for(i = 0; i < 20; i++) {
+ if(i > x) {
+ val += 10 * (*data - 2); /* DANGER: x < 10 */
+ } else {
+ val += 10 * 4;
+ }
+ if(i == 10) {
+ *data = 4;
+ val += 10 * *data;
+ }
+ }
+
+ printf("val = %i\n", val);
+ free(data);
+}
+
+int main() {
+ uninit_malloc_for(10);
+
+ return 1;
+}
diff --git a/bench-moerman2018/memory/access_uninit/test_correct_catch_bad/09_loop_for_complex.c b/bench-moerman2018/memory/access_uninit/test_correct_catch_bad/09_loop_for_complex.c
new file mode 100644
index 000000000..afe949b36
--- /dev/null
+++ b/bench-moerman2018/memory/access_uninit/test_correct_catch_bad/09_loop_for_complex.c
@@ -0,0 +1,42 @@
+#include <stdio.h>
+#include <stdlib.h>
+#include "uninitialized_malloc.h"
+
+void uninit_malloc_for_complex(int x) {
+ int* data;
+ int val = 0, i = 0;
+
+ if(x < 10) {
+ return;
+ }
+
+ data = malloc(sizeof(int));
+ if(!data) {
+ return;
+ }
+
+ for(;;) {
+ if(i > x) {
+ val += 10 * (*data - 2); /* DANGER: x < 10 */
+ } else {
+ val += 10 * 4;
+ }
+ if(i == 10) {
+ *data = 4;
+ val += 10 * *data;
+ }
+ i++;
+ if(i >= 20) {
+ break;
+ }
+ }
+
+ printf("val = %i\n", val);
+ free(data);
+}
+
+int main() {
+ uninit_malloc_for_complex(10);
+
+ return 1;
+}
diff --git a/bench-moerman2018/memory/access_uninit/test_correct_catch_bad/10_loop_while_continue.c b/bench-moerman2018/memory/access_uninit/test_correct_catch_bad/10_loop_while_continue.c
new file mode 100644
index 000000000..722db934f
--- /dev/null
+++ b/bench-moerman2018/memory/access_uninit/test_correct_catch_bad/10_loop_while_continue.c
@@ -0,0 +1,42 @@
+#include <stdio.h>
+#include <stdlib.h>
+#include "uninitialized_malloc.h"
+
+void uninit_malloc_while_continue(int x) {
+ int* data;
+ int val = 0, i = 0;
+
+ if(x < 10) {
+ return;
+ }
+
+ data = malloc(sizeof(int));
+ if(!data) {
+ return;
+ }
+
+ while(i < 30) {
+ if(i > x) {
+ val += 10 * (*data - 2); /* DANGER: x < 10 */
+ } else {
+ val += 10 * 4;
+ }
+ if(i == 10) {
+ *data = 4;
+ val += 10 * *data;
+ }
+ i++;
+ if(i < 20) {
+ continue;
+ }
+ }
+
+ printf("val = %i", val);
+ free(data);
+}
+
+int main() {
+ uninit_malloc_while_continue(10);
+
+ return 1;
+}
diff --git a/bench-moerman2018/memory/access_uninit/test_correct_catch_bad/11_loop_while_do_continue.c b/bench-moerman2018/memory/access_uninit/test_correct_catch_bad/11_loop_while_do_continue.c
new file mode 100644
index 000000000..b3d11f9e4
--- /dev/null
+++ b/bench-moerman2018/memory/access_uninit/test_correct_catch_bad/11_loop_while_do_continue.c
@@ -0,0 +1,42 @@
+#include <stdio.h>
+#include <stdlib.h>
+#include "uninitialized_malloc.h"
+
+void uninit_malloc_do_while_continue(int x) {
+ int* data;
+ int val = 0, i = 0;
+
+ if(x < 10) {
+ return;
+ }
+
+ data = malloc(sizeof(int));
+ if(!data) {
+ return;
+ }
+
+ do {
+ if(i > x) {
+ val += 10 * (*data - 2); /* DANGER: x < 10 */
+ } else {
+ val += 10 * 4;
+ }
+ if(i == 10) {
+ *data = 4;
+ val += 10 * *data;
+ }
+ i++;
+ if(i < 20) {
+ continue;
+ }
+ } while(i < 30);
+
+ printf("val = %i", val);
+ free(data);
+}
+
+int main() {
+ uninit_malloc_do_while_continue(10);
+
+ return 1;
+}
diff --git a/bench-moerman2018/memory/access_uninit/test_correct_catch_bad/12_loop_for_array_branching.c b/bench-moerman2018/memory/access_uninit/test_correct_catch_bad/12_loop_for_array_branching.c
new file mode 100644
index 000000000..a53538de2
--- /dev/null
+++ b/bench-moerman2018/memory/access_uninit/test_correct_catch_bad/12_loop_for_array_branching.c
@@ -0,0 +1,50 @@
+#include <stdio.h>
+#include <stdlib.h>
+#include "uninitialized_malloc.h"
+
+void uninit_malloc_for_array(int x) {
+ int* data;
+ int p[20];
+ int val = 0, i = 0;
+
+ if(x < 0 || x > 19) {
+ return;
+ }
+
+ if(x != 19) {
+ return;
+ }
+
+ data = malloc(sizeof(int));
+ if(!data) {
+ return;
+ }
+
+ *data = 12;
+
+ for(i = 0; i < 20; i++) {
+ p[i] = 0;
+ }
+ p[x] = 1;
+
+ for(i = 0; i < 20; i++) {
+ if(p[i] == 1) {
+ free(data);
+ data = malloc(sizeof(int));
+ if(!data) {
+ return;
+ }
+ } else {
+ val += *data; /* DANGER: x < 19 */
+ }
+ }
+
+ printf("%i\n", val);
+ free(data);
+}
+
+int main() {
+ uninit_malloc_for_array(19);
+
+ return 1;
+}
diff --git a/bench-moerman2018/memory/access_uninit/test_correct_catch_bad/13_loop_for_pointer_arithmetic.c b/bench-moerman2018/memory/access_uninit/test_correct_catch_bad/13_loop_for_pointer_arithmetic.c
new file mode 100644
index 000000000..f4101ee92
--- /dev/null
+++ b/bench-moerman2018/memory/access_uninit/test_correct_catch_bad/13_loop_for_pointer_arithmetic.c
@@ -0,0 +1,46 @@
+#include <stdlib.h>
+#include <stdio.h>
+#include "uninitialized_malloc.h"
+
+void uninit_malloc_for_pointer(int x) {
+ int* pointers[10];
+ int** pointers_alias = pointers;
+ int val = 0, i;
+
+ if(x < 0 || x > 10) {
+ return;
+ }
+
+ if(x != 10) {
+ return;
+ }
+
+ for(i = 0; i < 10; i++, pointers_alias++) {
+ *pointers_alias = malloc(sizeof(int));
+ }
+
+ pointers_alias = pointers;
+ for(i = 0; i < x; i++, pointers_alias++) {
+ if(!(*pointers_alias)) {
+ continue;
+ }
+ **pointers_alias = i;
+ }
+
+ pointers_alias = pointers;
+ for(i = 0; i < 10; i++, pointers_alias++) {
+ if(!(*pointers_alias)) {
+ continue;
+ }
+ val += **pointers_alias;
+ free(*pointers_alias);
+ }
+
+ printf("%i\n", val);
+}
+
+int main() {
+ uninit_malloc_for_pointer(10);
+
+ return 1;
+}
diff --git a/bench-moerman2018/memory/access_uninit/test_correct_catch_bad/14_loop_recursion.c b/bench-moerman2018/memory/access_uninit/test_correct_catch_bad/14_loop_recursion.c
new file mode 100644
index 000000000..39b2b0edf
--- /dev/null
+++ b/bench-moerman2018/memory/access_uninit/test_correct_catch_bad/14_loop_recursion.c
@@ -0,0 +1,58 @@
+#include <stdio.h>
+#include <stdlib.h>
+#include "uninitialized_malloc.h"
+
+int uninit_malloc_rec(int x, int i, int* ptr1, int* ptr2) {
+ int val;
+
+ if(i <= 1) {
+ free(ptr1);
+ free(ptr2);
+ return 0;
+ }
+
+ if(x > 10 && i < x && ptr2 == 0) {
+ return uninit_malloc_rec(x, i-1, ptr1, ptr1);
+ }
+
+ if(!ptr1) {
+ ptr1 = malloc(sizeof(int));
+ if(ptr1) {
+ *ptr1 = 1;
+ } else {
+ if(ptr2) {
+ free(ptr2);
+ }
+ return -1;
+ }
+ }
+ if(!ptr2) {
+ ptr2 = malloc(sizeof(int));
+ if(!ptr2) {
+ free(ptr1);
+ return -1;
+ }
+ return uninit_malloc_rec(x, i-1, ptr1, ptr2) + 2 * *ptr1;
+ }
+
+ if(i < x) {
+ val = *ptr2;
+ } else {
+ val = *ptr1;
+ }
+ if(i == 10) {
+ *ptr2 = *ptr1;
+ }
+ return uninit_malloc_rec(x, i-1, ptr1, ptr2) + 3 * val;
+}
+
+int main() {
+ int* initialized = malloc(sizeof(int));
+ printf("%i\n", uninit_malloc_rec(10, 20, 0, 0));
+ if(initialized) {
+ *initialized = 2;
+ printf("%i\n", uninit_malloc_rec(11, 20, 0, initialized));
+ }
+
+ return 1;
+}
diff --git a/bench-moerman2018/memory/access_uninit/test_correct_catch_bad/15_loop_recursion_multi.c b/bench-moerman2018/memory/access_uninit/test_correct_catch_bad/15_loop_recursion_multi.c
new file mode 100644
index 000000000..e6fad4eda
--- /dev/null
+++ b/bench-moerman2018/memory/access_uninit/test_correct_catch_bad/15_loop_recursion_multi.c
@@ -0,0 +1,68 @@
+#include <stdio.h>
+#include <stdlib.h>
+#include "uninitialized_malloc.h"
+
+int uninit_malloc_rec_decr(int x, int i, int* ptr1, int* ptr2) {
+ if(i <= 1) {
+ return 0;
+ }
+
+ return uninit_malloc_rec_multi(x, i-1, ptr1, ptr2);
+}
+
+int uninit_malloc_rec_multi(int x, int i, int* ptr1, int* ptr2) {
+ int val;
+
+ if(i <= 1) {
+ free(ptr1);
+ free(ptr2);
+ return 0;
+ }
+
+ if(!ptr2) {
+ if((x > 0 && i < 10) || (i >= 10 && x > 10)) {
+ return uninit_malloc_rec(x, i-1, ptr1, ptr1);
+ }
+ }
+
+ if(!ptr1) {
+ ptr1 = malloc(sizeof(int));
+ if(ptr1) {
+ *ptr1 = 1;
+ } else {
+ if(ptr2) {
+ free(ptr2);
+ }
+ return -1;
+ }
+ }
+ if(!ptr2) {
+ ptr2 = malloc(sizeof(int));
+ if(!ptr2) {
+ free(ptr1);
+ return -1;
+ }
+ return 2 * *ptr1 + uninit_malloc_rec_decr(x, i, ptr1, ptr2);
+ }
+
+ if(i < x) {
+ val = *ptr2;
+ } else {
+ val = *ptr1;
+ }
+ if(i == 10) {
+ *ptr2 = *ptr1;
+ }
+ return uninit_malloc_rec_decr(x, i, ptr1, ptr2) + 3 * val;
+}
+
+int main() {
+ int* initialized = malloc(sizeof(int));;
+ printf("%i\n", uninit_malloc_rec_multi(10, 20, 0, 0));
+ if(initialized) {
+ *initialized = 2;
+ printf("%i\n", uninit_malloc_rec_multi(11, 20, 0, initialized));
+ }
+
+ return 1;
+}
diff --git a/bench-moerman2018/memory/access_uninit/test_correct_catch_bad/16_misc_pseudo_recursion.c b/bench-moerman2018/memory/access_uninit/test_correct_catch_bad/16_misc_pseudo_recursion.c
new file mode 100644
index 000000000..6faf3e849
--- /dev/null
+++ b/bench-moerman2018/memory/access_uninit/test_correct_catch_bad/16_misc_pseudo_recursion.c
@@ -0,0 +1,70 @@
+#include <stdio.h>
+#include <stdlib.h>
+#include "uninitialized_malloc.h"
+
+int uninit_malloc_pseudo_rec1(int x, int y, int i, int* ptr1, int* ptr2) {
+ int *data;
+ if(!ptr2 && x >= y && x < 10) {
+ return 0;
+ }
+
+ if(i > 0) {
+ return 37;
+ }
+
+ if(!ptr1) {
+ ptr1 = malloc(sizeof(int));
+ if(ptr1) {
+ *ptr1 = 1;
+ } else {
+ if(ptr2) {
+ free(ptr2);
+ }
+ return -1;
+ }
+ }
+ if(!ptr2) {
+ ptr2 = malloc(sizeof(int));
+ if(!ptr2) {
+ free(ptr1);
+ return -1;
+ }
+ }
+
+ if(x < y) {
+ *ptr2 = *ptr1;
+ }
+
+ return uninit_malloc_pseudo_rec2(x, y, 1, ptr1, ptr2);
+}
+
+int uninit_malloc_pseudo_rec2(int x, int y, int i, int* ptr1, int* ptr2) {
+ int val;
+
+ if(i <= 0) {
+ return 3 * (*ptr1) + uninit_malloc_pseudo_rec1(x, y, 1, ptr1, ptr2);
+ }
+
+ if(x > 10) {
+ val = *ptr1;
+ } else {
+ val = *ptr2;
+ }
+
+ free(ptr1);
+ free(ptr2);
+
+ return 3 * val;
+}
+
+int main() {
+ int* initialized = malloc(sizeof(int));
+ printf("%i\n", uninit_malloc_pseudo_rec1(9, 10, 0, 0, 0));
+ if(initialized) {
+ *initialized = 2;
+ printf("%i\n", uninit_malloc_pseudo_rec1(10, 10, 0, 0, initialized));
+ }
+ printf("%i\n", uninit_malloc_pseudo_rec1(11, 10, 0, 0, 0));
+
+ return 1;
+}
diff --git a/bench-moerman2018/memory/access_uninit/test_correct_catch_bad/17_complex_function_pointers.c b/bench-moerman2018/memory/access_uninit/test_correct_catch_bad/17_complex_function_pointers.c
new file mode 100644
index 000000000..4c94f898b
--- /dev/null
+++ b/bench-moerman2018/memory/access_uninit/test_correct_catch_bad/17_complex_function_pointers.c
@@ -0,0 +1,41 @@
+#include <stdio.h>
+#include <stdlib.h>
+#include <stdbool.h>
+#include "uninitialized_malloc.h"
+
+static void possibly_assign(int** dest, int val, bool condition) {
+ if(condition) {
+ **dest = val;
+ }
+}
+
+void uninit_malloc_function_pointer(bool a, bool b, void (*f)(int**, int, bool)) {
+ int *data;
+
+ /* To be used if is defined */
+ /* and tool warns about possible dangerous input */
+ if(!f || (!a & !b)) {
+ return;
+ }
+
+ data = malloc(sizeof(int));
+
+ if(!data) {
+ return;
+ }
+
+ (*f)(&data, 5, a);
+ (*f)(&data, 13, b);
+
+ printf("%i\n", *data);
+
+ free(data);
+}
+
+int main() {
+ uninit_malloc_function_pointer(true, true, &possibly_assign);
+ uninit_malloc_function_pointer(true, false, &possibly_assign);
+ uninit_malloc_function_pointer(false, true, &possibly_assign);
+
+ return 1;
+}
diff --git a/bench-moerman2018/memory/access_uninit/test_correct_catch_bad/18_complex_struct_multiple_methods.c b/bench-moerman2018/memory/access_uninit/test_correct_catch_bad/18_complex_struct_multiple_methods.c
new file mode 100644
index 000000000..d9cc96f8e
--- /dev/null
+++ b/bench-moerman2018/memory/access_uninit/test_correct_catch_bad/18_complex_struct_multiple_methods.c
@@ -0,0 +1,94 @@
+#include <stdio.h>
+#include <stdlib.h>
+#include "uninitialized_malloc.h"
+
+#ifndef s_UNINIT_VAL_REFCOUNT
+#define s_UNINIT_VAL_REFCOUNT
+void uninit_malloc_cont_init(MallocIntCont* cont) {
+ cont->counter = 1;
+ cont->data = malloc(sizeof(int));
+}
+
+MallocIntCont* uninit_malloc_cont_new() {
+ MallocIntCont* new_cont;
+
+ new_cont = malloc(sizeof(MallocIntCont));
+
+ if(new_cont) {
+ uninit_malloc_cont_init(new_cont);
+ }
+ return new_cont;
+}
+
+void uninit_malloc_cont_incr(MallocIntCont* cont) {
+ if(cont) {
+ cont->counter++;
+ }
+}
+void uninit_malloc_cont_decr(MallocIntCont* cont) {
+ if(cont->counter <= 1) {
+ if(cont->data) {
+ free(cont->data);
+ }
+ cont->data = malloc(sizeof(int));
+ } else {
+ cont->counter--;
+ }
+}
+
+void uninint_val_cont_free(MallocIntCont* cont) {
+ if(cont->data) {
+ free(cont->data);
+ }
+ free(cont);
+}
+
+int uninit_malloc_cont_get_value(MallocIntCont* cont) {
+ if(cont->data) {
+ return *(cont->data);
+ }
+ return 0;
+}
+void uninit_malloc_cont_set_value(MallocIntCont* cont, int value) {
+ if(!cont->data) {
+ return;
+ }
+ *(cont->data) = value;
+}
+#endif //s_UNINIT_VAL_REFCOUNT
+
+void uninit_malloc_struct(int x, int y) {
+ MallocIntCont cont;
+ int val;
+
+ if(x <= 10 && x >= y) {
+ return;
+ }
+
+ uninit_malloc_cont_init(&cont);
+
+ if(x < y) {
+ uninit_malloc_cont_set_value(&cont, 7);
+ }
+
+ if(x > 10) {
+ val = 50 * 37;
+ } else {
+ /* DANGER: if x <= 10 & x >= y */
+ val = 30 * uninit_malloc_cont_get_value(&cont);
+ }
+
+ if(cont.data) {
+ free(cont.data);
+ }
+
+ printf("x=%i: %i\n", x, val);
+}
+
+int main() {
+ uninit_malloc_struct(9, 10);
+ uninit_malloc_struct(10, 11);
+ uninit_malloc_struct(11, 10);
+
+ return 1;
+}
diff --git a/bench-moerman2018/memory/access_uninit/test_correct_catch_bad/19_complex_refcount.c b/bench-moerman2018/memory/access_uninit/test_correct_catch_bad/19_complex_refcount.c
new file mode 100644
index 000000000..d9b3c7973
--- /dev/null
+++ b/bench-moerman2018/memory/access_uninit/test_correct_catch_bad/19_complex_refcount.c
@@ -0,0 +1,82 @@
+#include "uninitialized_malloc.h"
+#include <stdlib.h>
+#include <stdio.h>
+
+#ifndef s_UNINIT_VAL_REFCOUNT
+#define s_UNINIT_VAL_REFCOUNT
+void uninit_malloc_cont_init(MallocIntCont* cont) {
+ cont->counter = 1;
+ cont->data = malloc(sizeof(int));
+}
+
+MallocIntCont* uninit_malloc_cont_new() {
+ MallocIntCont* new_cont;
+
+ new_cont = malloc(sizeof(MallocIntCont));
+
+ if(new_cont) {
+ uninit_malloc_cont_init(new_cont);
+ }
+ return new_cont;
+}
+
+void uninit_malloc_cont_incr(MallocIntCont* cont) {
+ if(cont) {
+ cont->counter++;
+ }
+}
+void uninit_malloc_cont_decr(MallocIntCont* cont) {
+ if(cont->counter <= 1) {
+ if(cont->data) {
+ free(cont->data);
+ }
+ cont->data = malloc(sizeof(int));
+ } else {
+ cont->counter--;
+ }
+}
+
+void uninint_val_cont_free(MallocIntCont* cont) {
+ if(cont->data) {
+ free(cont->data);
+ }
+ free(cont);
+}
+
+int uninit_malloc_cont_get_value(MallocIntCont* cont) {
+ if(cont->data) {
+ return *(cont->data);
+ }
+ return 0;
+}
+void uninit_malloc_cont_set_value(MallocIntCont* cont, int value) {
+ if(!cont->data) {
+ return;
+ }
+ *(cont->data) = value;
+}
+#endif //s_UNINIT_VAL_REFCOUNT
+
+int main() {
+ MallocIntCont* cont;
+ int val;
+
+ cont = uninit_malloc_cont_new();
+ if(!cont) {
+ return 1;
+ }
+ uninit_malloc_cont_set_value(cont, 35);
+
+ uninit_malloc_cont_incr(cont);
+ uninit_malloc_cont_incr(cont);
+ uninit_malloc_cont_decr(cont);
+ uninit_malloc_cont_decr(cont);
+
+ val = 30 * uninit_malloc_cont_get_value(cont);
+
+ printf("%i\n", val);
+
+ uninint_val_cont_free(cont);
+
+ return 1;
+}
diff --git a/bench-moerman2018/memory/access_uninit/test_incorrect/01_simple_if.c b/bench-moerman2018/memory/access_uninit/test_incorrect/01_simple_if.c
new file mode 100644
index 000000000..37d2ea31d
--- /dev/null
+++ b/bench-moerman2018/memory/access_uninit/test_incorrect/01_simple_if.c
@@ -0,0 +1,38 @@
+#include <stdio.h>
+#include <stdlib.h>
+#include <stdbool.h>
+#include "uninitialized_malloc.h"
+
+void uninit_malloc_if_else(bool a, bool b) {
+ int* data;
+ int val;
+
+
+ data = malloc(sizeof(int));
+
+ if(!data) {
+ return;
+ }
+
+ if(a) {
+ *data = 1;
+ }
+
+ if(b) {
+ val = 37 * 2;
+ } else {
+ val = 11 * *data; /* DANGER, if !a & !b */
+ }
+
+ printf("%i\n", val);
+
+ free(data);
+}
+
+int main() {
+ uninit_malloc_if_else(true, true); /* OK */
+ uninit_malloc_if_else(false, false); /* DANGER */
+ uninit_malloc_if_else(false, true); /* OK */
+
+ return 1;
+}
diff --git a/bench-moerman2018/memory/access_uninit/test_incorrect/02_simple_if_int1.c b/bench-moerman2018/memory/access_uninit/test_incorrect/02_simple_if_int1.c
new file mode 100644
index 000000000..af69b525e
--- /dev/null
+++ b/bench-moerman2018/memory/access_uninit/test_incorrect/02_simple_if_int1.c
@@ -0,0 +1,37 @@
+#include <stdio.h>
+#include <stdlib.h>
+#include "uninitialized_malloc.h"
+
+void uninit_malloc_if_else_int1(int x, int y) {
+ int* data;
+ int val;
+
+
+ data = malloc(sizeof(int));
+
+ if(!data) {
+ return;
+ }
+
+ if(x < y) {
+ *data = 1;
+ }
+
+ if(x > 10) {
+ val = 37 * 2;
+ } else {
+ val = 11 * *data; /* DANGER, if x <= 10 & x >= y */
+ }
+
+ printf("x=%i: %i", x, val);
+
+ free(data);
+}
+
+int main() {
+ uninit_malloc_if_else_int1(9, 10); /* OK */
+ uninit_malloc_if_else_int1(10, 10); /* DANGER */
+ uninit_malloc_if_else_int1(11, 10); /* OK */
+
+ return 1;
+}
diff --git a/bench-moerman2018/memory/access_uninit/test_incorrect/02_simple_if_int2.c b/bench-moerman2018/memory/access_uninit/test_incorrect/02_simple_if_int2.c
new file mode 100644
index 000000000..02124b7fb
--- /dev/null
+++ b/bench-moerman2018/memory/access_uninit/test_incorrect/02_simple_if_int2.c
@@ -0,0 +1,42 @@
+#include <stdio.h>
+#include <stdlib.h>
+#include "uninitialized_malloc.h"
+
+void uninit_malloc_if_else_int2(int x, int y) {
+ int* data;
+ int val, m, n;
+
+ m = -1;
+ n = 5;
+
+ x = x*m+n;
+
+
+ data = malloc(sizeof(int));
+
+ if(!data) {
+ return;
+ }
+
+ if(x < y) {
+ *data = 1;
+ }
+
+ if(x > 10) {
+ val = 37 * 2;
+ } else {
+ val = 11 * *data; /* DANGER, if x <= 10 & x >= y */
+ }
+
+ printf("x=%i: %i", x, val);
+
+ free(data);
+}
+
+int main() {
+ uninit_malloc_if_else_int2(-4, 10); /* OK */
+ uninit_malloc_if_else_int2(-5, 10); /* DANGER */
+ uninit_malloc_if_else_int2(-6, 10); /* OK */
+
+ return 1;
+}
diff --git a/bench-moerman2018/memory/access_uninit/test_incorrect/03_simple_if_multi_func.c b/bench-moerman2018/memory/access_uninit/test_incorrect/03_simple_if_multi_func.c
new file mode 100644
index 000000000..d6db6248c
--- /dev/null
+++ b/bench-moerman2018/memory/access_uninit/test_incorrect/03_simple_if_multi_func.c
@@ -0,0 +1,44 @@
+#include "uninitialized_malloc.h"
+#include <stdbool.h>
+#include <stdlib.h>
+#include <stdio.h>
+
+static void possibly_assign(int* dest, int val, bool condition) {
+ if(condition) {
+ *dest = val;
+ }
+}
+
+static int conditional_assign(int* ptr1, int* ptr2, bool condition) {
+ if(condition) {
+ return *ptr1;
+ }
+ return *ptr2;
+}
+
+void uninit_malloc_if_else_multi(bool a, bool b) {
+ int* data;
+ int val = -7189;
+
+
+ data = malloc(sizeof(int));
+
+ if(!data) {
+ return;
+ }
+
+ possibly_assign(data, 37, a);
+
+ val = conditional_assign(&val, data, b); /* DANGER, if !a & !b */
+
+ printf("%i\n", val);
+
+ free(data);
+}
+
+int main() {
+ uninit_malloc_if_else_multi(true, true); /* OK */
+ uninit_malloc_if_else_multi(false, false); /* DANGER */
+ uninit_malloc_if_else_multi(false, true); /* OK */
+ return 1;
+}
diff --git a/bench-moerman2018/memory/access_uninit/test_incorrect/04_simple_switch.c b/bench-moerman2018/memory/access_uninit/test_incorrect/04_simple_switch.c
new file mode 100644
index 000000000..db966f2aa
--- /dev/null
+++ b/bench-moerman2018/memory/access_uninit/test_incorrect/04_simple_switch.c
@@ -0,0 +1,52 @@
+#include "uninitialized_malloc.h"
+#include <stdlib.h>
+
+int uninit_malloc_switch(int x, int y) {
+ int* data;
+ int val;
+
+ data = malloc(sizeof(int));
+ if(!data) {
+ return -1;
+ }
+
+ if(x < y) {
+ *data = 1;
+ }
+
+ switch (x) {
+ case 5: {
+ val = 37 * *data; /* DANGER: x >= y */
+ break;
+ }
+ case 7: {
+ val = -37 * 2;
+ break;
+ }
+ case 10: {
+ val = 73 * *data; /* DANGER: x >= y */
+ break;
+ }
+ case 12: {
+ val = 73 * 5;
+ break;
+ }
+ default: {
+ val = 100 * 8;
+ break;
+ }
+ };
+
+ free(data);
+
+ return val;
+}
+
+int main() {
+ uninit_malloc_switch(5, 10); /* OK */
+ uninit_malloc_switch(10, 10); /* DANGER */
+ uninit_malloc_switch(11, 10); /* OK */
+ uninit_malloc_switch(7, 5); /* OK */
+
+ return 1;
+}
diff --git a/bench-moerman2018/memory/access_uninit/test_incorrect/05_simple_goto.c b/bench-moerman2018/memory/access_uninit/test_incorrect/05_simple_goto.c
new file mode 100644
index 000000000..d55ddf23a
--- /dev/null
+++ b/bench-moerman2018/memory/access_uninit/test_incorrect/05_simple_goto.c
@@ -0,0 +1,42 @@
+#include <stdio.h>
+#include <stdlib.h>
+#include "uninitialized_malloc.h"
+
+void uninit_malloc_goto(int x) {
+ int val = 0, i = 0;
+ int* data;
+
+
+ data = malloc(sizeof(int));
+
+ if(!data) {
+ return;
+ }
+
+ *data = x;
+
+GOTO_LABEL:
+ if(i <= x) {
+ if(data) {
+ val += *data;
+ }
+ } else {
+ printf("%i\n", val);
+ }
+
+ free(data);
+ data = malloc(sizeof(int));
+
+ if(i == 0) {
+ i++;
+ goto GOTO_LABEL;
+ }
+
+ free(data);
+}
+
+int main() {
+ uninit_malloc_goto(1);
+
+ return 1;
+}
diff --git a/bench-moerman2018/memory/access_uninit/test_incorrect/06_simple_pass_by_reference.c b/bench-moerman2018/memory/access_uninit/test_incorrect/06_simple_pass_by_reference.c
new file mode 100644
index 000000000..c2856a44c
--- /dev/null
+++ b/bench-moerman2018/memory/access_uninit/test_incorrect/06_simple_pass_by_reference.c
@@ -0,0 +1,36 @@
+#include <stdio.h>
+#include <stdlib.h>
+#include <stdbool.h>
+#include "uninitialized_malloc.h"
+
+static void possibly_assign(int** dest, int val, bool condition) {
+ if(condition) {
+ **dest = val;
+ }
+}
+
+void uninit_malloc_pass_by_reference(bool a, bool b) {
+ int* data;
+
+
+ data = malloc(sizeof(int));
+
+ if(!data) {
+ return;
+ }
+
+ possibly_assign(&data, 5, a);
+ possibly_assign(&data, 13, b);
+
+ printf("%i\n", *data);
+
+ free(data);
+}
+
+int main() {
+ uninit_malloc_pass_by_reference(true, true); /* OK */
+ uninit_malloc_pass_by_reference(false, false); /* DANGER */
+ uninit_malloc_pass_by_reference(false, true); /* OK */
+
+ return 1;
+}
diff --git a/bench-moerman2018/memory/access_uninit/test_incorrect/07_simple_cross_file.c b/bench-moerman2018/memory/access_uninit/test_incorrect/07_simple_cross_file.c
new file mode 100644
index 000000000..720ae445b
--- /dev/null
+++ b/bench-moerman2018/memory/access_uninit/test_incorrect/07_simple_cross_file.c
@@ -0,0 +1,37 @@
+#include "uninitialized_malloc.h"
+#include "common.h"
+#include <stdlib.h>
+#include <stdbool.h>
+#include <stdio.h>
+
+void uninit_malloc_cross_file(bool a, bool b) {
+ int* data;
+ int val;
+ int* int_ptr;
+
+
+ data = malloc(sizeof(int));
+
+ if(!data) {
+ return;
+ }
+
+ int_ptr = (int*) choose_pointer((void*) data, (void*) &val, a);
+ *int_ptr = 768;
+
+ if(b) {
+ val = 10 * 2;
+ } else {
+ val = 10 * *data; /* DANGER, if !a & !b */
+ }
+
+ printf("%i\n", val);
+ free(data);
+}
+
+int main() {
+ uninit_malloc_cross_file(true, true); /* OK */
+ uninit_malloc_cross_file(false, false); /* DANGER */
+ uninit_malloc_cross_file(false, true); /* OK */
+ return 1;
+}
diff --git a/bench-moerman2018/memory/access_uninit/test_incorrect/08_loop_for.c b/bench-moerman2018/memory/access_uninit/test_incorrect/08_loop_for.c
new file mode 100644
index 000000000..05b9c9df0
--- /dev/null
+++ b/bench-moerman2018/memory/access_uninit/test_incorrect/08_loop_for.c
@@ -0,0 +1,36 @@
+#include <stdio.h>
+#include <stdlib.h>
+#include "uninitialized_malloc.h"
+
+void uninit_malloc_for(int x) {
+ int* data;
+ int val = 0;
+ int i;
+
+
+ data = malloc(sizeof(int));
+ if(!data) {
+ return;
+ }
+
+ for(i = 0; i < 20; i++) {
+ if(i > x) {
+ val += 10 * (*data - 2); /* DANGER: x < 10 */
+ } else {
+ val += 10 * 4;
+ }
+ if(i == 10) {
+ *data = 4;
+ val += 10 * *data;
+ }
+ }
+
+ printf("val = %i\n", val);
+ free(data);
+}
+
+int main() {
+ uninit_malloc_for(9);
+
+ return 1;
+}
diff --git a/bench-moerman2018/memory/access_uninit/test_incorrect/09_loop_for_complex.c b/bench-moerman2018/memory/access_uninit/test_incorrect/09_loop_for_complex.c
new file mode 100644
index 000000000..023b07d0c
--- /dev/null
+++ b/bench-moerman2018/memory/access_uninit/test_incorrect/09_loop_for_complex.c
@@ -0,0 +1,39 @@
+#include <stdio.h>
+#include <stdlib.h>
+#include "uninitialized_malloc.h"
+
+void uninit_malloc_for_complex(int x) {
+ int* data;
+ int val = 0, i = 0;
+
+
+ data = malloc(sizeof(int));
+ if(!data) {
+ return;
+ }
+
+ for(;;) {
+ if(i > x) {
+ val += 10 * (*data - 2); /* DANGER: x < 10 */
+ } else {
+ val += 10 * 4;
+ }
+ if(i == 10) {
+ *data = 4;
+ val += 10 * *data;
+ }
+ i++;
+ if(i >= 20) {
+ break;
+ }
+ }
+
+ printf("val = %i\n", val);
+ free(data);
+}
+
+int main() {
+ uninit_malloc_for_complex(9);
+
+ return 1;
+}
diff --git a/bench-moerman2018/memory/access_uninit/test_incorrect/10_loop_while_continue.c b/bench-moerman2018/memory/access_uninit/test_incorrect/10_loop_while_continue.c
new file mode 100644
index 000000000..6852d0c8e
--- /dev/null
+++ b/bench-moerman2018/memory/access_uninit/test_incorrect/10_loop_while_continue.c
@@ -0,0 +1,39 @@
+#include <stdio.h>
+#include <stdlib.h>
+#include "uninitialized_malloc.h"
+
+void uninit_malloc_while_continue(int x) {
+ int* data;
+ int val = 0, i = 0;
+
+
+ data = malloc(sizeof(int));
+ if(!data) {
+ return;
+ }
+
+ while(i < 30) {
+ if(i > x) {
+ val += 10 * (*data - 2); /* DANGER: x < 10 */
+ } else {
+ val += 10 * 4;
+ }
+ if(i == 10) {
+ *data = 4;
+ val += 10 * *data;
+ }
+ i++;
+ if(i < 20) {
+ continue;
+ }
+ }
+
+ printf("val = %i", val);
+ free(data);
+}
+
+int main() {
+ uninit_malloc_while_continue(9);
+
+ return 1;
+}
diff --git a/bench-moerman2018/memory/access_uninit/test_incorrect/11_loop_while_do_continue.c b/bench-moerman2018/memory/access_uninit/test_incorrect/11_loop_while_do_continue.c
new file mode 100644
index 000000000..4a210a0e3
--- /dev/null
+++ b/bench-moerman2018/memory/access_uninit/test_incorrect/11_loop_while_do_continue.c
@@ -0,0 +1,39 @@
+#include <stdio.h>
+#include <stdlib.h>
+#include "uninitialized_malloc.h"
+
+void uninit_malloc_do_while_continue(int x) {
+ int* data;
+ int val = 0, i = 0;
+
+
+ data = malloc(sizeof(int));
+ if(!data) {
+ return;
+ }
+
+ do {
+ if(i > x) {
+ val += 10 * (*data - 2); /* DANGER: x < 10 */
+ } else {
+ val += 10 * 4;
+ }
+ if(i == 10) {
+ *data = 4;
+ val += 10 * *data;
+ }
+ i++;
+ if(i < 20) {
+ continue;
+ }
+ } while(i < 30);
+
+ printf("val = %i", val);
+ free(data);
+}
+
+int main() {
+ uninit_malloc_do_while_continue(9);
+
+ return 1;
+}
diff --git a/bench-moerman2018/memory/access_uninit/test_incorrect/12_loop_for_array_branching.c b/bench-moerman2018/memory/access_uninit/test_incorrect/12_loop_for_array_branching.c
new file mode 100644
index 000000000..a9b1a0e56
--- /dev/null
+++ b/bench-moerman2018/memory/access_uninit/test_incorrect/12_loop_for_array_branching.c
@@ -0,0 +1,47 @@
+#include <stdio.h>
+#include <stdlib.h>
+#include "uninitialized_malloc.h"
+
+void uninit_malloc_for_array(int x) {
+ int* data;
+ int p[20];
+ int val = 0, i = 0;
+
+ if(x < 0 || x > 19) {
+ return;
+ }
+
+
+ data = malloc(sizeof(int));
+ if(!data) {
+ return;
+ }
+
+ *data = 12;
+
+ for(i = 0; i < 20; i++) {
+ p[i] = 0;
+ }
+ p[x] = 1;
+
+ for(i = 0; i < 20; i++) {
+ if(p[i] == 1) {
+ free(data);
+ data = malloc(sizeof(int));
+ if(!data) {
+ return;
+ }
+ } else {
+ val += *data; /* DANGER: x < 19 */
+ }
+ }
+
+ printf("%i\n", val);
+ free(data);
+}
+
+int main() {
+ uninit_malloc_for_array(10);
+
+ return 1;
+}
diff --git a/bench-moerman2018/memory/access_uninit/test_incorrect/13_loop_for_pointer_arithmetic.c b/bench-moerman2018/memory/access_uninit/test_incorrect/13_loop_for_pointer_arithmetic.c
new file mode 100644
index 000000000..f6ed2b464
--- /dev/null
+++ b/bench-moerman2018/memory/access_uninit/test_incorrect/13_loop_for_pointer_arithmetic.c
@@ -0,0 +1,43 @@
+#include <stdlib.h>
+#include <stdio.h>
+#include "uninitialized_malloc.h"
+
+void uninit_malloc_for_pointer(int x) {
+ int* pointers[10];
+ int** pointers_alias = pointers;
+ int val = 0, i;
+
+ if(x < 0 || x > 10) {
+ return;
+ }
+
+
+ for(i = 0; i < 10; i++, pointers_alias++) {
+ *pointers_alias = malloc(sizeof(int));
+ }
+
+ pointers_alias = pointers;
+ for(i = 0; i < x; i++, pointers_alias++) {
+ if(!(*pointers_alias)) {
+ continue;
+ }
+ **pointers_alias = i;
+ }
+
+ pointers_alias = pointers;
+ for(i = 0; i < 10; i++, pointers_alias++) {
+ if(!(*pointers_alias)) {
+ continue;
+ }
+ val += **pointers_alias;
+ free(*pointers_alias);
+ }
+
+ printf("%i\n", val);
+}
+
+int main() {
+ uninit_malloc_for_pointer(9);
+
+ return 1;
+}
diff --git a/bench-moerman2018/memory/access_uninit/test_incorrect/14_loop_recursion.c b/bench-moerman2018/memory/access_uninit/test_incorrect/14_loop_recursion.c
new file mode 100644
index 000000000..caed78493
--- /dev/null
+++ b/bench-moerman2018/memory/access_uninit/test_incorrect/14_loop_recursion.c
@@ -0,0 +1,50 @@
+#include <stdio.h>
+#include <stdlib.h>
+#include "uninitialized_malloc.h"
+
+int uninit_malloc_rec(int x, int i, int* ptr1, int* ptr2) {
+ int val;
+
+ if(i <= 1) {
+ free(ptr1);
+ free(ptr2);
+ return 0;
+ }
+
+
+ if(!ptr1) {
+ ptr1 = malloc(sizeof(int));
+ if(ptr1) {
+ *ptr1 = 1;
+ } else {
+ if(ptr2) {
+ free(ptr2);
+ }
+ return -1;
+ }
+ }
+ if(!ptr2) {
+ ptr2 = malloc(sizeof(int));
+ if(!ptr2) {
+ free(ptr1);
+ return -1;
+ }
+ return uninit_malloc_rec(x, i-1, ptr1, ptr2) + 2 * *ptr1;
+ }
+
+ if(i < x) {
+ val = *ptr2;
+ } else {
+ val = *ptr1;
+ }
+ if(i == 10) {
+ *ptr2 = *ptr1;
+ }
+ return uninit_malloc_rec(x, i-1, ptr1, ptr2) + 3 * val;
+}
+
+int main() {
+ printf("%i\n", uninit_malloc_rec(11, 20, 0, 0));
+
+ return 1;
+}
diff --git a/bench-moerman2018/memory/access_uninit/test_incorrect/15_loop_recursion_multi.c b/bench-moerman2018/memory/access_uninit/test_incorrect/15_loop_recursion_multi.c
new file mode 100644
index 000000000..78da23e02
--- /dev/null
+++ b/bench-moerman2018/memory/access_uninit/test_incorrect/15_loop_recursion_multi.c
@@ -0,0 +1,58 @@
+#include <stdio.h>
+#include <stdlib.h>
+#include "uninitialized_malloc.h"
+
+int uninit_malloc_rec_decr(int x, int i, int* ptr1, int* ptr2) {
+ if(i <= 1) {
+ return 0;
+ }
+
+ return uninit_malloc_rec_multi(x, i-1, ptr1, ptr2);
+}
+
+int uninit_malloc_rec_multi(int x, int i, int* ptr1, int* ptr2) {
+ int val;
+
+ if(i <= 1) {
+ free(ptr1);
+ free(ptr2);
+ return 0;
+ }
+
+
+ if(!ptr1) {
+ ptr1 = malloc(sizeof(int));
+ if(ptr1) {
+ *ptr1 = 1;
+ } else {
+ if(ptr2) {
+ free(ptr2);
+ }
+ return -1;
+ }
+ }
+ if(!ptr2) {
+ ptr2 = malloc(sizeof(int));
+ if(!ptr2) {
+ free(ptr1);
+ return -1;
+ }
+ return 2 * *ptr1 + uninit_malloc_rec_decr(x, i, ptr1, ptr2);
+ }
+
+ if(i < x) {
+ val = *ptr2;
+ } else {
+ val = *ptr1;
+ }
+ if(i == 10) {
+ *ptr2 = *ptr1;
+ }
+ return uninit_malloc_rec_decr(x, i, ptr1, ptr2) + 3 * val;
+}
+
+int main() {
+ printf("%i\n", uninit_malloc_rec_multi(11, 20, 0, 0));
+
+ return 1;
+}
diff --git a/bench-moerman2018/memory/access_uninit/test_incorrect/16_misc_pseudo_recursion.c b/bench-moerman2018/memory/access_uninit/test_incorrect/16_misc_pseudo_recursion.c
new file mode 100644
index 000000000..fb83e88a3
--- /dev/null
+++ b/bench-moerman2018/memory/access_uninit/test_incorrect/16_misc_pseudo_recursion.c
@@ -0,0 +1,61 @@
+#include <stdio.h>
+#include <stdlib.h>
+#include "uninitialized_malloc.h"
+
+int uninit_malloc_pseudo_rec1(int x, int y, int i, int* ptr1, int* ptr2) {
+ int *data;
+
+ if(i > 0) {
+ return 37;
+ }
+
+ if(!ptr1) {
+ ptr1 = malloc(sizeof(int));
+ if(ptr1) {
+ *ptr1 = 1;
+ } else {
+ if(ptr2) {
+ free(ptr2);
+ }
+ return -1;
+ }
+ }
+ if(!ptr2) {
+ ptr2 = malloc(sizeof(int));
+ if(!ptr2) {
+ free(ptr1);
+ return -1;
+ }
+ }
+
+ if(x < y) {
+ *ptr2 = *ptr1;
+ }
+
+ return uninit_malloc_pseudo_rec2(x, y, 1, ptr1, ptr2);
+}
+
+int uninit_malloc_pseudo_rec2(int x, int y, int i, int* ptr1, int* ptr2) {
+ int val;
+
+ if(i <= 0) {
+ return 3 * (*ptr1) + uninit_malloc_pseudo_rec1(x, y, 1, ptr1, ptr2);
+ }
+
+ if(x > 10) {
+ val = *ptr1;
+ } else {
+ val = *ptr2;
+ }
+
+ free(ptr1);
+ free(ptr2);
+
+ return 3 * val;
+}
+
+int main() {
+ printf("%i\n", uninit_malloc_pseudo_rec1(10, 10, 0, 0, 0));
+
+ return 1;
+}
diff --git a/bench-moerman2018/memory/access_uninit/test_incorrect/17_complex_function_pointers.c b/bench-moerman2018/memory/access_uninit/test_incorrect/17_complex_function_pointers.c
new file mode 100644
index 000000000..c52e4146a
--- /dev/null
+++ b/bench-moerman2018/memory/access_uninit/test_incorrect/17_complex_function_pointers.c
@@ -0,0 +1,36 @@
+#include <stdio.h>
+#include <stdlib.h>
+#include <stdbool.h>
+#include "uninitialized_malloc.h"
+
+static void possibly_assign(int** dest, int val, bool condition) {
+ if(condition) {
+ **dest = val;
+ }
+}
+
+void uninit_malloc_function_pointer(bool a, bool b, void (*f)(int**, int, bool)) {
+ int *data;
+
+
+ data = malloc(sizeof(int));
+
+ if(!data) {
+ return;
+ }
+
+ (*f)(&data, 5, a);
+ (*f)(&data, 13, b);
+
+ printf("%i\n", *data);
+
+ free(data);
+}
+
+int main() {
+ uninit_malloc_function_pointer(true, true, &possibly_assign); /* OK */
+ uninit_malloc_function_pointer(false, false, &possibly_assign); /* DANGER */
+ uninit_malloc_function_pointer(false, true, &possibly_assign); /* OK */
+
+ return 1;
+}
diff --git a/bench-moerman2018/memory/access_uninit/test_incorrect/18_complex_struct_multiple_methods.c b/bench-moerman2018/memory/access_uninit/test_incorrect/18_complex_struct_multiple_methods.c
new file mode 100644
index 000000000..16503cfdb
--- /dev/null
+++ b/bench-moerman2018/memory/access_uninit/test_incorrect/18_complex_struct_multiple_methods.c
@@ -0,0 +1,89 @@
+#include <stdio.h>
+#include <stdlib.h>
+#include "uninitialized_malloc.h"
+
+#ifndef s_UNINIT_VAL_REFCOUNT
+#define s_UNINIT_VAL_REFCOUNT
+void uninit_malloc_cont_init(MallocIntCont* cont) {
+ cont->counter = 1;
+ cont->data = malloc(sizeof(int));
+}
+
+MallocIntCont* uninit_malloc_cont_new() {
+ MallocIntCont* new_cont;
+
+ new_cont = malloc(sizeof(MallocIntCont));
+
+ if(new_cont) {
+ uninit_malloc_cont_init(new_cont);
+ }
+ return new_cont;
+}
+
+void uninit_malloc_cont_incr(MallocIntCont* cont) {
+ if(cont) {
+ cont->counter++;
+ }
+}
+void uninit_malloc_cont_decr(MallocIntCont* cont) {
+ if(cont->counter <= 1) {
+ if(cont->data) {
+ free(cont->data);
+ }
+ cont->data = malloc(sizeof(int));
+ } else {
+ cont->counter--;
+ }
+}
+
+void uninint_val_cont_free(MallocIntCont* cont) {
+ if(cont->data) {
+ free(cont->data);
+ }
+ free(cont);
+}
+
+int uninit_malloc_cont_get_value(MallocIntCont* cont) {
+ if(cont->data) {
+ return *(cont->data);
+ }
+ return 0;
+}
+void uninit_malloc_cont_set_value(MallocIntCont* cont, int value) {
+ if(!cont->data) {
+ return;
+ }
+ *(cont->data) = value;
+}
+#endif //s_UNINIT_VAL_REFCOUNT
+
+void uninit_malloc_struct(int x, int y) {
+ MallocIntCont cont;
+ int val;
+
+
+ uninit_malloc_cont_init(&cont);
+
+ if(x < y) {
+ uninit_malloc_cont_set_value(&cont, 7);
+ }
+
+ if(x > 10) {
+ val = 50 * 37;
+ } else {
+ /* DANGER: if x <= 10 & x >= y */
+ val = 30 * uninit_malloc_cont_get_value(&cont);
+ }
+
+ if(cont.data) {
+ free(cont.data);
+ }
+
+ printf("x=%i: %i\n", x, val);
+}
+
+int main() {
+ uninit_malloc_struct(10, 10); /* DANGER */
+
+ return 1;
+}
diff --git a/bench-moerman2018/memory/access_uninit/test_incorrect/19_complex_refcount.c b/bench-moerman2018/memory/access_uninit/test_incorrect/19_complex_refcount.c
new file mode 100644
index 000000000..5205aa5c9
--- /dev/null
+++ b/bench-moerman2018/memory/access_uninit/test_incorrect/19_complex_refcount.c
@@ -0,0 +1,83 @@
+#include "uninitialized_malloc.h"
+#include <stdlib.h>
+#include <stdio.h>
+
+#ifndef s_UNINIT_VAL_REFCOUNT
+#define s_UNINIT_VAL_REFCOUNT
+void uninit_malloc_cont_init(MallocIntCont* cont) {
+ cont->counter = 1;
+ cont->data = malloc(sizeof(int));
+}
+
+MallocIntCont* uninit_malloc_cont_new() {
+ MallocIntCont* new_cont;
+
+ new_cont = malloc(sizeof(MallocIntCont));
+
+ if(new_cont) {
+ uninit_malloc_cont_init(new_cont);
+ }
+ return new_cont;
+}
+
+void uninit_malloc_cont_incr(MallocIntCont* cont) {
+ if(cont) {
+ cont->counter++;
+ }
+}
+void uninit_malloc_cont_decr(MallocIntCont* cont) {
+ if(cont->counter <= 1) {
+ if(cont->data) {
+ free(cont->data);
+ }
+ cont->data = malloc(sizeof(int));
+ } else {
+ cont->counter--;
+ }
+}
+
+void uninint_val_cont_free(MallocIntCont* cont) {
+ if(cont->data) {
+ free(cont->data);
+ }
+ free(cont);
+}
+
+int uninit_malloc_cont_get_value(MallocIntCont* cont) {
+ if(cont->data) {
+ return *(cont->data);
+ }
+ return 0;
+}
+void uninit_malloc_cont_set_value(MallocIntCont* cont, int value) {
+ if(!cont->data) {
+ return;
+ }
+ *(cont->data) = value;
+}
+#endif //s_UNINIT_VAL_REFCOUNT
+
+int main() {
+ MallocIntCont* cont;
+ int val;
+
+ cont = uninit_malloc_cont_new();
+ if(!cont) {
+ return 1;
+ }
+ uninit_malloc_cont_set_value(cont, 35);
+
+ uninit_malloc_cont_incr(cont);
+ uninit_malloc_cont_incr(cont);
+ uninit_malloc_cont_decr(cont);
+ uninit_malloc_cont_decr(cont);
+ uninit_malloc_cont_decr(cont);
+
+ val = 30 * uninit_malloc_cont_get_value(cont);
+
+ printf("%i\n", val);
+
+ uninint_val_cont_free(cont);
+
+ return 1;
+}
diff --git a/bench-moerman2018/memory/access_uninit/test_lib_correct/01_simple_if.c b/bench-moerman2018/memory/access_uninit/test_lib_correct/01_simple_if.c
new file mode 100644
index 000000000..5277b1cc5
--- /dev/null
+++ b/bench-moerman2018/memory/access_uninit/test_lib_correct/01_simple_if.c
@@ -0,0 +1,34 @@
+#include <stdio.h>
+#include <stdlib.h>
+#include <stdbool.h>
+#include "uninitialized_malloc.h"
+
+void uninit_malloc_if_else(bool a, bool b) {
+ int* data;
+ int val;
+
+ if(!a & !b) {
+ return;
+ }
+
+ data = malloc(sizeof(int));
+
+ if(!data) {
+ return;
+ }
+
+ if(a) {
+ *data = 1;
+ }
+
+ if(b) {
+ val = 37 * 2;
+ } else {
+ val = 11 * *data; /* DANGER, if !a & !b */
+ }
+
+ printf("%i\n", val);
+
+ free(data);
+}
+
diff --git a/bench-moerman2018/memory/access_uninit/test_lib_correct/02_simple_if_int1.c b/bench-moerman2018/memory/access_uninit/test_lib_correct/02_simple_if_int1.c
new file mode 100644
index 000000000..4d6edc85b
--- /dev/null
+++ b/bench-moerman2018/memory/access_uninit/test_lib_correct/02_simple_if_int1.c
@@ -0,0 +1,33 @@
+#include <stdio.h>
+#include <stdlib.h>
+#include "uninitialized_malloc.h"
+
+void uninit_malloc_if_else_int1(int x, int y) {
+ int* data;
+ int val;
+
+ if(x <= 10 && x >= y) {
+ return;
+ }
+
+ data = malloc(sizeof(int));
+
+ if(!data) {
+ return;
+ }
+
+ if(x < y) {
+ *data = 1;
+ }
+
+ if(x > 10) {
+ val = 37 * 2;
+ } else {
+ val = 11 * *data; /* DANGER, if x <= 10 & x >= y */
+ }
+
+ printf("x=%i: %i", x, val);
+
+ free(data);
+}
+
diff --git a/bench-moerman2018/memory/access_uninit/test_lib_correct/02_simple_if_int2.c b/bench-moerman2018/memory/access_uninit/test_lib_correct/02_simple_if_int2.c
new file mode 100644
index 000000000..39c31e288
--- /dev/null
+++ b/bench-moerman2018/memory/access_uninit/test_lib_correct/02_simple_if_int2.c
@@ -0,0 +1,38 @@
+#include <stdio.h>
+#include <stdlib.h>
+#include "uninitialized_malloc.h"
+
+void uninit_malloc_if_else_int2(int x, int y) {
+ int* data;
+ int val, m, n;
+
+ m = -1;
+ n = 5;
+
+ x = x*m+n;
+
+ if(x <= 10 && x >= y) {
+ return;
+ }
+
+ data = malloc(sizeof(int));
+
+ if(!data) {
+ return;
+ }
+
+ if(x < y) {
+ *data = 1;
+ }
+
+ if(x > 10) {
+ val = 37 * 2;
+ } else {
+ val = 11 * *data; /* DANGER, if x <= 10 & x >= y */
+ }
+
+ printf("x=%i: %i", x, val);
+
+ free(data);
+}
+
diff --git a/bench-moerman2018/memory/access_uninit/test_lib_correct/03_simple_if_multi_func.c b/bench-moerman2018/memory/access_uninit/test_lib_correct/03_simple_if_multi_func.c
new file mode 100644
index 000000000..668baee4a
--- /dev/null
+++ b/bench-moerman2018/memory/access_uninit/test_lib_correct/03_simple_if_multi_func.c
@@ -0,0 +1,41 @@
+#include "uninitialized_malloc.h"
+#include <stdbool.h>
+#include <stdlib.h>
+#include <stdio.h>
+
+static void possibly_assign(int* dest, int val, bool condition) {
+ if(condition) {
+ *dest = val;
+ }
+}
+
+static int conditional_assign(int* ptr1, int* ptr2, bool condition) {
+ if(condition) {
+ return *ptr1;
+ }
+ return *ptr2;
+}
+
+void uninit_malloc_if_else_multi(bool a, bool b) {
+ int* data;
+ int val = -7189;
+
+ if(!a & !b) {
+ return;
+ }
+
+ data = malloc(sizeof(int));
+
+ if(!data) {
+ return;
+ }
+
+ possibly_assign(data, 37, a);
+
+ val = conditional_assign(&val, data, b); /* DANGER, if !a & !b */
+
+ printf("%i\n", val);
+
+ free(data);
+}
+
diff --git a/bench-moerman2018/memory/access_uninit/test_lib_correct/04_simple_switch.c b/bench-moerman2018/memory/access_uninit/test_lib_correct/04_simple_switch.c
new file mode 100644
index 000000000..e7fcb0262
--- /dev/null
+++ b/bench-moerman2018/memory/access_uninit/test_lib_correct/04_simple_switch.c
@@ -0,0 +1,47 @@
+#include "uninitialized_malloc.h"
+#include <stdlib.h>
+
+int uninit_malloc_switch(int x, int y) {
+ int* data;
+ int val;
+
+ if((x == 10 || x == 5) && x >= y) {
+ return -1;
+ }
+ data = malloc(sizeof(int));
+ if(!data) {
+ return -1;
+ }
+
+ if(x < y) {
+ *data = 1;
+ }
+
+ switch (x) {
+ case 5: {
+ val = 37 * *data; /* DANGER: x >= y */
+ break;
+ }
+ case 7: {
+ val = -37 * 2;
+ break;
+ }
+ case 10: {
+ val = 73 * *data; /* DANGER: x >= y */
+ break;
+ }
+ case 12: {
+ val = 73 * 5;
+ break;
+ }
+ default: {
+ val = 100 * 8;
+ break;
+ }
+ };
+
+ free(data);
+
+ return val;
+}
+
diff --git a/bench-moerman2018/memory/access_uninit/test_lib_correct/05_simple_goto.c b/bench-moerman2018/memory/access_uninit/test_lib_correct/05_simple_goto.c
new file mode 100644
index 000000000..73f904249
--- /dev/null
+++ b/bench-moerman2018/memory/access_uninit/test_lib_correct/05_simple_goto.c
@@ -0,0 +1,40 @@
+#include <stdio.h>
+#include <stdlib.h>
+#include "uninitialized_malloc.h"
+
+void uninit_malloc_goto(int x) {
+ int val = 0, i = 0;
+ int* data;
+
+ if(x > 0) {
+ return;
+ }
+
+ data = malloc(sizeof(int));
+
+ if(!data) {
+ return;
+ }
+
+ *data = x;
+
+GOTO_LABEL:
+ if(i <= x) {
+ if(data) {
+ val += *data;
+ }
+ } else {
+ printf("%i\n", val);
+ }
+
+ free(data);
+ data = malloc(sizeof(int));
+
+ if(i == 0) {
+ i++;
+ goto GOTO_LABEL;
+ }
+
+ free(data);
+}
+
diff --git a/bench-moerman2018/memory/access_uninit/test_lib_correct/06_simple_pass_by_reference.c b/bench-moerman2018/memory/access_uninit/test_lib_correct/06_simple_pass_by_reference.c
new file mode 100644
index 000000000..624c7fe17
--- /dev/null
+++ b/bench-moerman2018/memory/access_uninit/test_lib_correct/06_simple_pass_by_reference.c
@@ -0,0 +1,34 @@
+#include <stdio.h>
+#include <stdlib.h>
+#include <stdbool.h>
+#include "uninitialized_malloc.h"
+
+static void possibly_assign(int** dest, int val, bool condition) {
+ if(condition) {
+ **dest = val;
+ }
+}
+
+void uninit_malloc_pass_by_reference(bool a, bool b) {
+ int* data;
+
+ /* To be used if NO_BUG is defined */
+ /* and tool warns about possible dangerous input */
+ if(!a & !b) {
+ return;
+ }
+
+ data = malloc(sizeof(int));
+
+ if(!data) {
+ return;
+ }
+
+ possibly_assign(&data, 5, a);
+ possibly_assign(&data, 13, b);
+
+ printf("%i\n", *data);
+
+ free(data);
+}
+
diff --git a/bench-moerman2018/memory/access_uninit/test_lib_correct/07_simple_cross_file.c b/bench-moerman2018/memory/access_uninit/test_lib_correct/07_simple_cross_file.c
new file mode 100644
index 000000000..c84d5e15f
--- /dev/null
+++ b/bench-moerman2018/memory/access_uninit/test_lib_correct/07_simple_cross_file.c
@@ -0,0 +1,34 @@
+#include "uninitialized_malloc.h"
+#include "common.h"
+#include <stdlib.h>
+#include <stdbool.h>
+#include <stdio.h>
+
+void uninit_malloc_cross_file(bool a, bool b) {
+ int* data;
+ int val;
+ int* int_ptr;
+
+ if(!a & !b) {
+ return;
+ }
+
+ data = malloc(sizeof(int));
+
+ if(!data) {
+ return;
+ }
+
+ int_ptr = (int*) choose_pointer((void*) data, (void*) &val, a);
+ *int_ptr = 768;
+
+ if(b) {
+ val = 10 * 2;
+ } else {
+ val = 10 * *data; /* DANGER, if !a & !b */
+ }
+
+ printf("%i\n", val);
+ free(data);
+}
+
diff --git a/bench-moerman2018/memory/access_uninit/test_lib_correct/08_loop_for.c b/bench-moerman2018/memory/access_uninit/test_lib_correct/08_loop_for.c
new file mode 100644
index 000000000..16628d2c2
--- /dev/null
+++ b/bench-moerman2018/memory/access_uninit/test_lib_correct/08_loop_for.c
@@ -0,0 +1,34 @@
+#include <stdio.h>
+#include <stdlib.h>
+#include "uninitialized_malloc.h"
+
+void uninit_malloc_for(int x) {
+ int* data;
+ int val = 0;
+ int i;
+
+ if(x < 10) {
+ return;
+ }
+
+ data = malloc(sizeof(int));
+ if(!data) {
+ return;
+ }
+
+ for(i = 0; i < 20; i++) {
+ if(i > x) {
+ val += 10 * (*data - 2); /* DANGER: x < 10 */
+ } else {
+ val += 10 * 4;
+ }
+ if(i == 10) {
+ *data = 4;
+ val += 10 * *data;
+ }
+ }
+
+ printf("val = %i\n", val);
+ free(data);
+}
+
diff --git a/bench-moerman2018/memory/access_uninit/test_lib_correct/09_loop_for_complex.c b/bench-moerman2018/memory/access_uninit/test_lib_correct/09_loop_for_complex.c
new file mode 100644
index 000000000..47195dff3
--- /dev/null
+++ b/bench-moerman2018/memory/access_uninit/test_lib_correct/09_loop_for_complex.c
@@ -0,0 +1,37 @@
+#include <stdio.h>
+#include <stdlib.h>
+#include "uninitialized_malloc.h"
+
+void uninit_malloc_for_complex(int x) {
+ int* data;
+ int val = 0, i = 0;
+
+ if(x < 10) {
+ return;
+ }
+
+ data = malloc(sizeof(int));
+ if(!data) {
+ return;
+ }
+
+ for(;;) {
+ if(i > x) {
+ val += 10 * (*data - 2); /* DANGER: x < 10 */
+ } else {
+ val += 10 * 4;
+ }
+ if(i == 10) {
+ *data = 4;
+ val += 10 * *data;
+ }
+ i++;
+ if(i >= 20) {
+ break;
+ }
+ }
+
+ printf("val = %i\n", val);
+ free(data);
+}
+
diff --git a/bench-moerman2018/memory/access_uninit/test_lib_correct/10_loop_while_continue.c b/bench-moerman2018/memory/access_uninit/test_lib_correct/10_loop_while_continue.c
new file mode 100644
index 000000000..5931bb104
--- /dev/null
+++ b/bench-moerman2018/memory/access_uninit/test_lib_correct/10_loop_while_continue.c
@@ -0,0 +1,37 @@
+#include <stdio.h>
+#include <stdlib.h>
+#include "uninitialized_malloc.h"
+
+void uninit_malloc_while_continue(int x) {
+ int* data;
+ int val = 0, i = 0;
+
+ if(x < 10) {
+ return;
+ }
+
+ data = malloc(sizeof(int));
+ if(!data) {
+ return;
+ }
+
+ while(i < 30) {
+ if(i > x) {
+ val += 10 * (*data - 2); /* DANGER: x < 10 */
+ } else {
+ val += 10 * 4;
+ }
+ if(i == 10) {
+ *data = 4;
+ val += 10 * *data;
+ }
+ i++;
+ if(i < 20) {
+ continue;
+ }
+ }
+
+ printf("val = %i", val);
+ free(data);
+}
+
diff --git a/bench-moerman2018/memory/access_uninit/test_lib_correct/11_loop_while_do_continue.c b/bench-moerman2018/memory/access_uninit/test_lib_correct/11_loop_while_do_continue.c
new file mode 100644
index 000000000..0dfd69789
--- /dev/null
+++ b/bench-moerman2018/memory/access_uninit/test_lib_correct/11_loop_while_do_continue.c
@@ -0,0 +1,37 @@
+#include <stdio.h>
+#include <stdlib.h>
+#include "uninitialized_malloc.h"
+
+void uninit_malloc_do_while_continue(int x) {
+ int* data;
+ int val = 0, i = 0;
+
+ if(x < 10) {
+ return;
+ }
+
+ data = malloc(sizeof(int));
+ if(!data) {
+ return;
+ }
+
+ do {
+ if(i > x) {
+ val += 10 * (*data - 2); /* DANGER: x < 10 */
+ } else {
+ val += 10 * 4;
+ }
+ if(i == 10) {
+ *data = 4;
+ val += 10 * *data;
+ }
+ i++;
+ if(i < 20) {
+ continue;
+ }
+ } while(i < 30);
+
+ printf("val = %i", val);
+ free(data);
+}
+
diff --git a/bench-moerman2018/memory/access_uninit/test_lib_correct/12_loop_for_array_branching.c b/bench-moerman2018/memory/access_uninit/test_lib_correct/12_loop_for_array_branching.c
new file mode 100644
index 000000000..e80bd1608
--- /dev/null
+++ b/bench-moerman2018/memory/access_uninit/test_lib_correct/12_loop_for_array_branching.c
@@ -0,0 +1,45 @@
+#include <stdio.h>
+#include <stdlib.h>
+#include "uninitialized_malloc.h"
+
+void uninit_malloc_for_array(int x) {
+ int* data;
+ int p[20];
+ int val = 0, i = 0;
+
+ if(x < 0 || x > 19) {
+ return;
+ }
+
+ if(x != 19) {
+ return;
+ }
+
+ data = malloc(sizeof(int));
+ if(!data) {
+ return;
+ }
+
+ *data = 12;
+
+ for(i = 0; i < 20; i++) {
+ p[i] = 0;
+ }
+ p[x] = 1;
+
+ for(i = 0; i < 20; i++) {
+ if(p[i] == 1) {
+ free(data);
+ data = malloc(sizeof(int));
+ if(!data) {
+ return;
+ }
+ } else {
+ val += *data; /* DANGER: x < 19 */
+ }
+ }
+
+ printf("%i\n", val);
+ free(data);
+}
+
diff --git a/bench-moerman2018/memory/access_uninit/test_lib_correct/13_loop_for_pointer_arithmetic.c b/bench-moerman2018/memory/access_uninit/test_lib_correct/13_loop_for_pointer_arithmetic.c
new file mode 100644
index 000000000..151f89666
--- /dev/null
+++ b/bench-moerman2018/memory/access_uninit/test_lib_correct/13_loop_for_pointer_arithmetic.c
@@ -0,0 +1,41 @@
+#include <stdlib.h>
+#include <stdio.h>
+#include "uninitialized_malloc.h"
+
+void uninit_malloc_for_pointer(int x) {
+ int* pointers[10];
+ int** pointers_alias = pointers;
+ int val = 0, i;
+
+ if(x < 0 || x > 10) {
+ return;
+ }
+
+ if(x != 10) {
+ return;
+ }
+
+ for(i = 0; i < 10; i++, pointers_alias++) {
+ *pointers_alias = malloc(sizeof(int));
+ }
+
+ pointers_alias = pointers;
+ for(i = 0; i < x; i++, pointers_alias++) {
+ if(!(*pointers_alias)) {
+ continue;
+ }
+ **pointers_alias = i;
+ }
+
+ pointers_alias = pointers;
+ for(i = 0; i < 10; i++, pointers_alias++) {
+ if(!(*pointers_alias)) {
+ continue;
+ }
+ val += **pointers_alias;
+ free(*pointers_alias);
+ }
+
+ printf("%i\n", val);
+}
+
diff --git a/bench-moerman2018/memory/access_uninit/test_lib_correct/14_loop_recursion.c b/bench-moerman2018/memory/access_uninit/test_lib_correct/14_loop_recursion.c
new file mode 100644
index 000000000..7f3b85126
--- /dev/null
+++ b/bench-moerman2018/memory/access_uninit/test_lib_correct/14_loop_recursion.c
@@ -0,0 +1,48 @@
+#include <stdio.h>
+#include <stdlib.h>
+#include "uninitialized_malloc.h"
+
+int uninit_malloc_rec(int x, int i, int* ptr1, int* ptr2) {
+ int val;
+
+ if(i <= 1) {
+ free(ptr1);
+ free(ptr2);
+ return 0;
+ }
+
+ if(x > 10 && i < x && ptr2 == 0) {
+ return uninit_malloc_rec(x, i-1, ptr1, ptr1);
+ }
+
+ if(!ptr1) {
+ ptr1 = malloc(sizeof(int));
+ if(ptr1) {
+ *ptr1 = 1;
+ } else {
+ if(ptr2) {
+ free(ptr2);
+ }
+ return -1;
+ }
+ }
+ if(!ptr2) {
+ ptr2 = malloc(sizeof(int));
+ if(!ptr2) {
+ free(ptr1);
+ return -1;
+ }
+ return uninit_malloc_rec(x, i-1, ptr1, ptr2) + 2 * *ptr1;
+ }
+
+ if(i < x) {
+ val = *ptr2;
+ } else {
+ val = *ptr1;
+ }
+ if(i == 10) {
+ *ptr2 = *ptr1;
+ }
+ return uninit_malloc_rec(x, i-1, ptr1, ptr2) + 3 * val;
+}
+
diff --git a/bench-moerman2018/memory/access_uninit/test_lib_correct/15_loop_recursion_multi.c b/bench-moerman2018/memory/access_uninit/test_lib_correct/15_loop_recursion_multi.c
new file mode 100644
index 000000000..60df7846a
--- /dev/null
+++ b/bench-moerman2018/memory/access_uninit/test_lib_correct/15_loop_recursion_multi.c
@@ -0,0 +1,58 @@
+#include <stdio.h>
+#include <stdlib.h>
+#include "uninitialized_malloc.h"
+
+int uninit_malloc_rec_decr(int x, int i, int* ptr1, int* ptr2) {
+ if(i <= 1) {
+ return 0;
+ }
+
+ return uninit_malloc_rec_multi(x, i-1, ptr1, ptr2);
+}
+
+int uninit_malloc_rec_multi(int x, int i, int* ptr1, int* ptr2) {
+ int val;
+
+ if(i <= 1) {
+ free(ptr1);
+ free(ptr2);
+ return 0;
+ }
+
+ if(!ptr2) {
+ if((x > 0 && i < 10) || (i >= 10 && x > 10)) {
+ return uninit_malloc_rec(x, i-1, ptr1, ptr1);
+ }
+ }
+
+ if(!ptr1) {
+ ptr1 = malloc(sizeof(int));
+ if(ptr1) {
+ *ptr1 = 1;
+ } else {
+ if(ptr2) {
+ free(ptr2);
+ }
+ return -1;
+ }
+ }
+ if(!ptr2) {
+ ptr2 = malloc(sizeof(int));
+ if(!ptr2) {
+ free(ptr1);
+ return -1;
+ }
+ return 2 * *ptr1 + uninit_malloc_rec_decr(x, i, ptr1, ptr2);
+ }
+
+ if(i < x) {
+ val = *ptr2;
+ } else {
+ val = *ptr1;
+ }
+ if(i == 10) {
+ *ptr2 = *ptr1;
+ }
+ return uninit_malloc_rec_decr(x, i, ptr1, ptr2) + 3 * val;
+}
+
diff --git a/bench-moerman2018/memory/access_uninit/test_lib_correct/16_misc_pseudo_recursion.c b/bench-moerman2018/memory/access_uninit/test_lib_correct/16_misc_pseudo_recursion.c
new file mode 100644
index 000000000..eb621d03d
--- /dev/null
+++ b/bench-moerman2018/memory/access_uninit/test_lib_correct/16_misc_pseudo_recursion.c
@@ -0,0 +1,59 @@
+#include <stdio.h>
+#include <stdlib.h>
+#include "uninitialized_malloc.h"
+
+int uninit_malloc_pseudo_rec1(int x, int y, int i, int* ptr1, int* ptr2) {
+ int *data;
+ if(!ptr2 && x >= y && x < 10) {
+ return 0;
+ }
+
+ if(i > 0) {
+ return 37;
+ }
+
+ if(!ptr1) {
+ ptr1 = malloc(sizeof(int));
+ if(ptr1) {
+ *ptr1 = 1;
+ } else {
+ if(ptr2) {
+ free(ptr2);
+ }
+ return -1;
+ }
+ }
+ if(!ptr2) {
+ ptr2 = malloc(sizeof(int));
+ if(!ptr2) {
+ free(ptr1);
+ return -1;
+ }
+ }
+
+ if(x < y) {
+ *ptr2 = *ptr1;
+ }
+
+ return uninit_malloc_pseudo_rec2(x, y, 1, ptr1, ptr2);
+}
+
+int uninit_malloc_pseudo_rec2(int x, int y, int i, int* ptr1, int* ptr2) {
+ int val;
+
+ if(i <= 0) {
+ return 3 * (*ptr1) + uninit_malloc_pseudo_rec1(x, y, 1, ptr1, ptr2);
+ }
+
+ if(x > 10) {
+ val = *ptr1;
+ } else {
+ val = *ptr2;
+ }
+
+ free(ptr1);
+ free(ptr2);
+
+ return 3 * val;
+}
+
diff --git a/bench-moerman2018/memory/access_uninit/test_lib_correct/17_complex_function_pointers.c b/bench-moerman2018/memory/access_uninit/test_lib_correct/17_complex_function_pointers.c
new file mode 100644
index 000000000..1acc624b1
--- /dev/null
+++ b/bench-moerman2018/memory/access_uninit/test_lib_correct/17_complex_function_pointers.c
@@ -0,0 +1,34 @@
+#include <stdio.h>
+#include <stdlib.h>
+#include <stdbool.h>
+#include "uninitialized_malloc.h"
+
+static void possibly_assign(int** dest, int val, bool condition) {
+ if(condition) {
+ **dest = val;
+ }
+}
+
+void uninit_malloc_function_pointer(bool a, bool b, void (*f)(int**, int, bool)) {
+ int *data;
+
+ /* To be used if NO_BUG is defined */
+ /* and tool warns about possible dangerous input */
+ if(!f || (!a & !b)) {
+ return;
+ }
+
+ data = malloc(sizeof(int));
+
+ if(!data) {
+ return;
+ }
+
+ (*f)(&data, 5, a);
+ (*f)(&data, 13, b);
+
+ printf("%i\n", *data);
+
+ free(data);
+}
+
diff --git a/bench-moerman2018/memory/access_uninit/test_lib_correct/18_complex_struct_multiple_methods.c b/bench-moerman2018/memory/access_uninit/test_lib_correct/18_complex_struct_multiple_methods.c
new file mode 100644
index 000000000..bd12b5c44
--- /dev/null
+++ b/bench-moerman2018/memory/access_uninit/test_lib_correct/18_complex_struct_multiple_methods.c
@@ -0,0 +1,87 @@
+#include <stdio.h>
+#include <stdlib.h>
+#include "uninitialized_malloc.h"
+
+#ifndef s_UNINIT_VAL_REFCOUNT
+#define s_UNINIT_VAL_REFCOUNT
+void uninit_malloc_cont_init(MallocIntCont* cont) {
+ cont->counter = 1;
+ cont->data = malloc(sizeof(int));
+}
+
+MallocIntCont* uninit_malloc_cont_new() {
+ MallocIntCont* new_cont;
+
+ new_cont = malloc(sizeof(MallocIntCont));
+
+ if(new_cont) {
+ uninit_malloc_cont_init(new_cont);
+ }
+ return new_cont;
+}
+
+void uninit_malloc_cont_incr(MallocIntCont* cont) {
+ if(cont) {
+ cont->counter++;
+ }
+}
+void uninit_malloc_cont_decr(MallocIntCont* cont) {
+ if(cont->counter <= 1) {
+ if(cont->data) {
+ free(cont->data);
+ }
+ cont->data = malloc(sizeof(int));
+ } else {
+ cont->counter--;
+ }
+}
+
+void uninint_val_cont_free(MallocIntCont* cont) {
+ if(cont->data) {
+ free(cont->data);
+ }
+ free(cont);
+}
+
+int uninit_malloc_cont_get_value(MallocIntCont* cont) {
+ if(cont->data) {
+ return *(cont->data);
+ }
+ return 0;
+}
+void uninit_malloc_cont_set_value(MallocIntCont* cont, int value) {
+ if(!cont->data) {
+ return;
+ }
+ *(cont->data) = value;
+}
+#endif //s_UNINIT_VAL_REFCOUNT
+
+void uninit_malloc_struct(int x, int y) {
+ MallocIntCont cont;
+ int val;
+
+ if(x <= 10 && x >= y) {
+ return;
+ }
+
+ uninit_malloc_cont_init(&cont);
+
+ if(x < y) {
+ uninit_malloc_cont_set_value(&cont, 7);
+ }
+
+ if(x > 10) {
+ val = 50 * 37;
+ } else {
+ /* DANGER: if x <= 10 & x >= y */
+ val = 30 * uninit_malloc_cont_get_value(&cont);
+ }
+
+ if(cont.data) {
+ free(cont.data);
+ }
+
+ printf("x=%i: %i\n", x, val);
+}
+
diff --git a/bench-moerman2018/memory/access_uninit/test_lib_correct/19_complex_refcount.c b/bench-moerman2018/memory/access_uninit/test_lib_correct/19_complex_refcount.c
new file mode 100644
index 000000000..3e2b9f1af
--- /dev/null
+++ b/bench-moerman2018/memory/access_uninit/test_lib_correct/19_complex_refcount.c
@@ -0,0 +1,59 @@
+#include "uninitialized_malloc.h"
+#include <stdlib.h>
+#include <stdio.h>
+
+#ifndef s_UNINIT_VAL_REFCOUNT
+#define s_UNINIT_VAL_REFCOUNT
+void uninit_malloc_cont_init(MallocIntCont* cont) {
+ cont->counter = 1;
+ cont->data = malloc(sizeof(int));
+}
+
+MallocIntCont* uninit_malloc_cont_new() {
+ MallocIntCont* new_cont;
+
+ new_cont = malloc(sizeof(MallocIntCont));
+
+ if(new_cont) {
+ uninit_malloc_cont_init(new_cont);
+ }
+ return new_cont;
+}
+
+void uninit_malloc_cont_incr(MallocIntCont* cont) {
+ if(cont) {
+ cont->counter++;
+ }
+}
+void uninit_malloc_cont_decr(MallocIntCont* cont) {
+ if(cont->counter <= 1) {
+ if(cont->data) {
+ free(cont->data);
+ }
+ cont->data = malloc(sizeof(int));
+ } else {
+ cont->counter--;
+ }
+}
+
+void uninint_val_cont_free(MallocIntCont* cont) {
+ if(cont->data) {
+ free(cont->data);
+ }
+ free(cont);
+}
+
+int uninit_malloc_cont_get_value(MallocIntCont* cont) {
+ if(cont->data) {
+ return *(cont->data);
+ }
+ return 0;
+}
+void uninit_malloc_cont_set_value(MallocIntCont* cont, int value) {
+ if(!cont->data) {
+ return;
+ }
+ *(cont->data) = value;
+}
+#endif //s_UNINIT_VAL_REFCOUNT
+
diff --git a/bench-moerman2018/memory/access_uninit/test_lib_incorrect/01_simple_if.c b/bench-moerman2018/memory/access_uninit/test_lib_incorrect/01_simple_if.c
new file mode 100644
index 000000000..6a83c16b7
--- /dev/null
+++ b/bench-moerman2018/memory/access_uninit/test_lib_incorrect/01_simple_if.c
@@ -0,0 +1,31 @@
+#include <stdio.h>
+#include <stdlib.h>
+#include <stdbool.h>
+#include "uninitialized_malloc.h"
+
+void uninit_malloc_if_else(bool a, bool b) {
+ int* data;
+ int val;
+
+
+ data = malloc(sizeof(int));
+
+ if(!data) {
+ return;
+ }
+
+ if(a) {
+ *data = 1;
+ }
+
+ if(b) {
+ val = 37 * 2;
+ } else {
+ val = 11 * *data; /* DANGER, if !a & !b */
+ }
+
+ printf("%i\n", val);
+
+ free(data);
+}
+
diff --git a/bench-moerman2018/memory/access_uninit/test_lib_incorrect/02_simple_if_int1.c b/bench-moerman2018/memory/access_uninit/test_lib_incorrect/02_simple_if_int1.c
new file mode 100644
index 000000000..6ef90c4fa
--- /dev/null
+++ b/bench-moerman2018/memory/access_uninit/test_lib_incorrect/02_simple_if_int1.c
@@ -0,0 +1,30 @@
+#include <stdio.h>
+#include <stdlib.h>
+#include "uninitialized_malloc.h"
+
+void uninit_malloc_if_else_int1(int x, int y) {
+ int* data;
+ int val;
+
+
+ data = malloc(sizeof(int));
+
+ if(!data) {
+ return;
+ }
+
+ if(x < y) {
+ *data = 1;
+ }
+
+ if(x > 10) {
+ val = 37 * 2;
+ } else {
+ val = 11 * *data; /* DANGER, if x <= 10 & x >= y */
+ }
+
+ printf("x=%i: %i", x, val);
+
+ free(data);
+}
+
diff --git a/bench-moerman2018/memory/access_uninit/test_lib_incorrect/02_simple_if_int2.c b/bench-moerman2018/memory/access_uninit/test_lib_incorrect/02_simple_if_int2.c
new file mode 100644
index 000000000..36383ca67
--- /dev/null
+++ b/bench-moerman2018/memory/access_uninit/test_lib_incorrect/02_simple_if_int2.c
@@ -0,0 +1,35 @@
+#include <stdio.h>
+#include <stdlib.h>
+#include "uninitialized_malloc.h"
+
+void uninit_malloc_if_else_int2(int x, int y) {
+ int* data;
+ int val, m, n;
+
+ m = -1;
+ n = 5;
+
+ x = x*m+n;
+
+
+ data = malloc(sizeof(int));
+
+ if(!data) {
+ return;
+ }
+
+ if(x < y) {
+ *data = 1;
+ }
+
+ if(x > 10) {
+ val = 37 * 2;
+ } else {
+ val = 11 * *data; /* DANGER, if x <= 10 & x >= y */
+ }
+
+ printf("x=%i: %i", x, val);
+
+ free(data);
+}
+
diff --git a/bench-moerman2018/memory/access_uninit/test_lib_incorrect/03_simple_if_multi_func.c b/bench-moerman2018/memory/access_uninit/test_lib_incorrect/03_simple_if_multi_func.c
new file mode 100644
index 000000000..f6639f806
--- /dev/null
+++ b/bench-moerman2018/memory/access_uninit/test_lib_incorrect/03_simple_if_multi_func.c
@@ -0,0 +1,38 @@
+#include "uninitialized_malloc.h"
+#include <stdbool.h>
+#include <stdlib.h>
+#include <stdio.h>
+
+static void possibly_assign(int* dest, int val, bool condition) {
+ if(condition) {
+ *dest = val;
+ }
+}
+
+static int conditional_assign(int* ptr1, int* ptr2, bool condition) {
+ if(condition) {
+ return *ptr1;
+ }
+ return *ptr2;
+}
+
+void uninit_malloc_if_else_multi(bool a, bool b) {
+ int* data;
+ int val = -7189;
+
+
+ data = malloc(sizeof(int));
+
+ if(!data) {
+ return;
+ }
+
+ possibly_assign(data, 37, a);
+
+ val = conditional_assign(&val, data, b); /* DANGER, if !a & !b */
+
+ printf("%i\n", val);
+
+ free(data);
+}
+
diff --git a/bench-moerman2018/memory/access_uninit/test_lib_incorrect/04_simple_switch.c b/bench-moerman2018/memory/access_uninit/test_lib_incorrect/04_simple_switch.c
new file mode 100644
index 000000000..011f04d66
--- /dev/null
+++ b/bench-moerman2018/memory/access_uninit/test_lib_incorrect/04_simple_switch.c
@@ -0,0 +1,44 @@
+#include "uninitialized_malloc.h"
+#include <stdlib.h>
+
+int uninit_malloc_switch(int x, int y) {
+ int* data;
+ int val;
+
+ data = malloc(sizeof(int));
+ if(!data) {
+ return -1;
+ }
+
+ if(x < y) {
+ *data = 1;
+ }
+
+ switch (x) {
+ case 5: {
+ val = 37 * *data; /* DANGER: x >= y */
+ break;
+ }
+ case 7: {
+ val = -37 * 2;
+ break;
+ }
+ case 10: {
+ val = 73 * *data; /* DANGER: x >= y */
+ break;
+ }
+ case 12: {
+ val = 73 * 5;
+ break;
+ }
+ default: {
+ val = 100 * 8;
+ break;
+ }
+ };
+
+ free(data);
+
+ return val;
+}
+
diff --git a/bench-moerman2018/memory/access_uninit/test_lib_incorrect/05_simple_goto.c b/bench-moerman2018/memory/access_uninit/test_lib_incorrect/05_simple_goto.c
new file mode 100644
index 000000000..443d4f280
--- /dev/null
+++ b/bench-moerman2018/memory/access_uninit/test_lib_incorrect/05_simple_goto.c
@@ -0,0 +1,37 @@
+#include <stdio.h>
+#include <stdlib.h>
+#include "uninitialized_malloc.h"
+
+void uninit_malloc_goto(int x) {
+ int val = 0, i = 0;
+ int* data;
+
+
+ data = malloc(sizeof(int));
+
+ if(!data) {
+ return;
+ }
+
+ *data = x;
+
+GOTO_LABEL:
+ if(i <= x) {
+ if(data) {
+ val += *data;
+ }
+ } else {
+ printf("%i\n", val);
+ }
+
+ free(data);
+ data = malloc(sizeof(int));
+
+ if(i == 0) {
+ i++;
+ goto GOTO_LABEL;
+ }
+
+ free(data);
+}
+
diff --git a/bench-moerman2018/memory/access_uninit/test_lib_incorrect/06_simple_pass_by_reference.c b/bench-moerman2018/memory/access_uninit/test_lib_incorrect/06_simple_pass_by_reference.c
new file mode 100644
index 000000000..0e5d75d54
--- /dev/null
+++ b/bench-moerman2018/memory/access_uninit/test_lib_incorrect/06_simple_pass_by_reference.c
@@ -0,0 +1,29 @@
+#include <stdio.h>
+#include <stdlib.h>
+#include <stdbool.h>
+#include "uninitialized_malloc.h"
+
+static void possibly_assign(int** dest, int val, bool condition) {
+ if(condition) {
+ **dest = val;
+ }
+}
+
+void uninit_malloc_pass_by_reference(bool a, bool b) {
+ int* data;
+
+
+ data = malloc(sizeof(int));
+
+ if(!data) {
+ return;
+ }
+
+ possibly_assign(&data, 5, a);
+ possibly_assign(&data, 13, b);
+
+ printf("%i\n", *data);
+
+ free(data);
+}
+
diff --git a/bench-moerman2018/memory/access_uninit/test_lib_incorrect/07_simple_cross_file.c b/bench-moerman2018/memory/access_uninit/test_lib_incorrect/07_simple_cross_file.c
new file mode 100644
index 000000000..5a9661485
--- /dev/null
+++ b/bench-moerman2018/memory/access_uninit/test_lib_incorrect/07_simple_cross_file.c
@@ -0,0 +1,31 @@
+#include "uninitialized_malloc.h"
+#include "common.h"
+#include <stdlib.h>
+#include <stdbool.h>
+#include <stdio.h>
+
+void uninit_malloc_cross_file(bool a, bool b) {
+ int* data;
+ int val;
+ int* int_ptr;
+
+
+ data = malloc(sizeof(int));
+
+ if(!data) {
+ return;
+ }
+
+ int_ptr = (int*) choose_pointer((void*) data, (void*) &val, a);
+ *int_ptr = 768;
+
+ if(b) {
+ val = 10 * 2;
+ } else {
+ val = 10 * *data; /* DANGER, if !a & !b */
+ }
+
+ printf("%i\n", val);
+ free(data);
+}
+
diff --git a/bench-moerman2018/memory/access_uninit/test_lib_incorrect/08_loop_for.c b/bench-moerman2018/memory/access_uninit/test_lib_incorrect/08_loop_for.c
new file mode 100644
index 000000000..e2fc33b15
--- /dev/null
+++ b/bench-moerman2018/memory/access_uninit/test_lib_incorrect/08_loop_for.c
@@ -0,0 +1,31 @@
+#include <stdio.h>
+#include <stdlib.h>
+#include "uninitialized_malloc.h"
+
+void uninit_malloc_for(int x) {
+ int* data;
+ int val = 0;
+ int i;
+
+
+ data = malloc(sizeof(int));
+ if(!data) {
+ return;
+ }
+
+ for(i = 0; i < 20; i++) {
+ if(i > x) {
+ val += 10 * (*data - 2); /* DANGER: x < 10 */
+ } else {
+ val += 10 * 4;
+ }
+ if(i == 10) {
+ *data = 4;
+ val += 10 * *data;
+ }
+ }
+
+ printf("val = %i\n", val);
+ free(data);
+}
+
diff --git a/bench-moerman2018/memory/access_uninit/test_lib_incorrect/09_loop_for_complex.c b/bench-moerman2018/memory/access_uninit/test_lib_incorrect/09_loop_for_complex.c
new file mode 100644
index 000000000..40ae08980
--- /dev/null
+++ b/bench-moerman2018/memory/access_uninit/test_lib_incorrect/09_loop_for_complex.c
@@ -0,0 +1,34 @@
+#include <stdio.h>
+#include <stdlib.h>
+#include "uninitialized_malloc.h"
+
+void uninit_malloc_for_complex(int x) {
+ int* data;
+ int val = 0, i = 0;
+
+
+ data = malloc(sizeof(int));
+ if(!data) {
+ return;
+ }
+
+ for(;;) {
+ if(i > x) {
+ val += 10 * (*data - 2); /* DANGER: x < 10 */
+ } else {
+ val += 10 * 4;
+ }
+ if(i == 10) {
+ *data = 4;
+ val += 10 * *data;
+ }
+ i++;
+ if(i >= 20) {
+ break;
+ }
+ }
+
+ printf("val = %i\n", val);
+ free(data);
+}
+
diff --git a/bench-moerman2018/memory/access_uninit/test_lib_incorrect/10_loop_while_continue.c b/bench-moerman2018/memory/access_uninit/test_lib_incorrect/10_loop_while_continue.c
new file mode 100644
index 000000000..45021fd7c
--- /dev/null
+++ b/bench-moerman2018/memory/access_uninit/test_lib_incorrect/10_loop_while_continue.c
@@ -0,0 +1,34 @@
+#include <stdio.h>
+#include <stdlib.h>
+#include "uninitialized_malloc.h"
+
+void uninit_malloc_while_continue(int x) {
+ int* data;
+ int val = 0, i = 0;
+
+
+ data = malloc(sizeof(int));
+ if(!data) {
+ return;
+ }
+
+ while(i < 30) {
+ if(i > x) {
+ val += 10 * (*data - 2); /* DANGER: x < 10 */
+ } else {
+ val += 10 * 4;
+ }
+ if(i == 10) {
+ *data = 4;
+ val += 10 * *data;
+ }
+ i++;
+ if(i < 20) {
+ continue;
+ }
+ }
+
+ printf("val = %i", val);
+ free(data);
+}
+
diff --git a/bench-moerman2018/memory/access_uninit/test_lib_incorrect/11_loop_while_do_continue.c b/bench-moerman2018/memory/access_uninit/test_lib_incorrect/11_loop_while_do_continue.c
new file mode 100644
index 000000000..abbef5a00
--- /dev/null
+++ b/bench-moerman2018/memory/access_uninit/test_lib_incorrect/11_loop_while_do_continue.c
@@ -0,0 +1,34 @@
+#include <stdio.h>
+#include <stdlib.h>
+#include "uninitialized_malloc.h"
+
+void uninit_malloc_do_while_continue(int x) {
+ int* data;
+ int val = 0, i = 0;
+
+
+ data = malloc(sizeof(int));
+ if(!data) {
+ return;
+ }
+
+ do {
+ if(i > x) {
+ val += 10 * (*data - 2); /* DANGER: x < 10 */
+ } else {
+ val += 10 * 4;
+ }
+ if(i == 10) {
+ *data = 4;
+ val += 10 * *data;
+ }
+ i++;
+ if(i < 20) {
+ continue;
+ }
+ } while(i < 30);
+
+ printf("val = %i", val);
+ free(data);
+}
+
diff --git a/bench-moerman2018/memory/access_uninit/test_lib_incorrect/12_loop_for_array_branching.c b/bench-moerman2018/memory/access_uninit/test_lib_incorrect/12_loop_for_array_branching.c
new file mode 100644
index 000000000..0afcf7c39
--- /dev/null
+++ b/bench-moerman2018/memory/access_uninit/test_lib_incorrect/12_loop_for_array_branching.c
@@ -0,0 +1,42 @@
+#include <stdio.h>
+#include <stdlib.h>
+#include "uninitialized_malloc.h"
+
+void uninit_malloc_for_array(int x) {
+ int* data;
+ int p[20];
+ int val = 0, i = 0;
+
+ if(x < 0 || x > 19) {
+ return;
+ }
+
+
+ data = malloc(sizeof(int));
+ if(!data) {
+ return;
+ }
+
+ *data = 12;
+
+ for(i = 0; i < 20; i++) {
+ p[i] = 0;
+ }
+ p[x] = 1;
+
+ for(i = 0; i < 20; i++) {
+ if(p[i] == 1) {
+ free(data);
+ data = malloc(sizeof(int));
+ if(!data) {
+ return;
+ }
+ } else {
+ val += *data; /* DANGER: x < 19 */
+ }
+ }
+
+ printf("%i\n", val);
+ free(data);
+}
+
diff --git a/bench-moerman2018/memory/access_uninit/test_lib_incorrect/13_loop_for_pointer_arithmetic.c b/bench-moerman2018/memory/access_uninit/test_lib_incorrect/13_loop_for_pointer_arithmetic.c
new file mode 100644
index 000000000..142857af0
--- /dev/null
+++ b/bench-moerman2018/memory/access_uninit/test_lib_incorrect/13_loop_for_pointer_arithmetic.c
@@ -0,0 +1,38 @@
+#include <stdlib.h>
+#include <stdio.h>
+#include "uninitialized_malloc.h"
+
+void uninit_malloc_for_pointer(int x) {
+ int* pointers[10];
+ int** pointers_alias = pointers;
+ int val = 0, i;
+
+ if(x < 0 || x > 10) {
+ return;
+ }
+
+
+ for(i = 0; i < 10; i++, pointers_alias++) {
+ *pointers_alias = malloc(sizeof(int));
+ }
+
+ pointers_alias = pointers;
+ for(i = 0; i < x; i++, pointers_alias++) {
+ if(!(*pointers_alias)) {
+ continue;
+ }
+ **pointers_alias = i;
+ }
+
+ pointers_alias = pointers;
+ for(i = 0; i < 10; i++, pointers_alias++) {
+ if(!(*pointers_alias)) {
+ continue;
+ }
+ val += **pointers_alias;
+ free(*pointers_alias);
+ }
+
+ printf("%i\n", val);
+}
+
diff --git a/bench-moerman2018/memory/access_uninit/test_lib_incorrect/14_loop_recursion.c b/bench-moerman2018/memory/access_uninit/test_lib_incorrect/14_loop_recursion.c
new file mode 100644
index 000000000..ccb1bdf2f
--- /dev/null
+++ b/bench-moerman2018/memory/access_uninit/test_lib_incorrect/14_loop_recursion.c
@@ -0,0 +1,45 @@
+#include <stdio.h>
+#include <stdlib.h>
+#include "uninitialized_malloc.h"
+
+int uninit_malloc_rec(int x, int i, int* ptr1, int* ptr2) {
+ int val;
+
+ if(i <= 1) {
+ free(ptr1);
+ free(ptr2);
+ return 0;
+ }
+
+
+ if(!ptr1) {
+ ptr1 = malloc(sizeof(int));
+ if(ptr1) {
+ *ptr1 = 1;
+ } else {
+ if(ptr2) {
+ free(ptr2);
+ }
+ return -1;
+ }
+ }
+ if(!ptr2) {
+ ptr2 = malloc(sizeof(int));
+ if(!ptr2) {
+ free(ptr1);
+ return -1;
+ }
+ return uninit_malloc_rec(x, i-1, ptr1, ptr2) + 2 * *ptr1;
+ }
+
+ if(i < x) {
+ val = *ptr2;
+ } else {
+ val = *ptr1;
+ }
+ if(i == 10) {
+ *ptr2 = *ptr1;
+ }
+ return uninit_malloc_rec(x, i-1, ptr1, ptr2) + 3 * val;
+}
+
diff --git a/bench-moerman2018/memory/access_uninit/test_lib_incorrect/15_loop_recursion_multi.c b/bench-moerman2018/memory/access_uninit/test_lib_incorrect/15_loop_recursion_multi.c
new file mode 100644
index 000000000..3b89210dd
--- /dev/null
+++ b/bench-moerman2018/memory/access_uninit/test_lib_incorrect/15_loop_recursion_multi.c
@@ -0,0 +1,53 @@
+#include <stdio.h>
+#include <stdlib.h>
+#include "uninitialized_malloc.h"
+
+int uninit_malloc_rec_decr(int x, int i, int* ptr1, int* ptr2) {
+ if(i <= 1) {
+ return 0;
+ }
+
+ return uninit_malloc_rec_multi(x, i-1, ptr1, ptr2);
+}
+
+int uninit_malloc_rec_multi(int x, int i, int* ptr1, int* ptr2) {
+ int val;
+
+ if(i <= 1) {
+ free(ptr1);
+ free(ptr2);
+ return 0;
+ }
+
+
+ if(!ptr1) {
+ ptr1 = malloc(sizeof(int));
+ if(ptr1) {
+ *ptr1 = 1;
+ } else {
+ if(ptr2) {
+ free(ptr2);
+ }
+ return -1;
+ }
+ }
+ if(!ptr2) {
+ ptr2 = malloc(sizeof(int));
+ if(!ptr2) {
+ free(ptr1);
+ return -1;
+ }
+ return 2 * *ptr1 + uninit_malloc_rec_decr(x, i, ptr1, ptr2);
+ }
+
+ if(i < x) {
+ val = *ptr2;
+ } else {
+ val = *ptr1;
+ }
+ if(i == 10) {
+ *ptr2 = *ptr1;
+ }
+ return uninit_malloc_rec_decr(x, i, ptr1, ptr2) + 3 * val;
+}
+
diff --git a/bench-moerman2018/memory/access_uninit/test_lib_incorrect/16_misc_pseudo_recursion.c b/bench-moerman2018/memory/access_uninit/test_lib_incorrect/16_misc_pseudo_recursion.c
new file mode 100644
index 000000000..b62ae16ff
--- /dev/null
+++ b/bench-moerman2018/memory/access_uninit/test_lib_incorrect/16_misc_pseudo_recursion.c
@@ -0,0 +1,56 @@
+#include <stdio.h>
+#include <stdlib.h>
+#include "uninitialized_malloc.h"
+
+int uninit_malloc_pseudo_rec1(int x, int y, int i, int* ptr1, int* ptr2) {
+ int *data;
+
+ if(i > 0) {
+ return 37;
+ }
+
+ if(!ptr1) {
+ ptr1 = malloc(sizeof(int));
+ if(ptr1) {
+ *ptr1 = 1;
+ } else {
+ if(ptr2) {
+ free(ptr2);
+ }
+ return -1;
+ }
+ }
+ if(!ptr2) {
+ ptr2 = malloc(sizeof(int));
+ if(!ptr2) {
+ free(ptr1);
+ return -1;
+ }
+ }
+
+ if(x < y) {
+ *ptr2 = *ptr1;
+ }
+
+ return uninit_malloc_pseudo_rec2(x, y, 1, ptr1, ptr2);
+}
+
+int uninit_malloc_pseudo_rec2(int x, int y, int i, int* ptr1, int* ptr2) {
+ int val;
+
+ if(i <= 0) {
+ return 3 * (*ptr1) + uninit_malloc_pseudo_rec1(x, y, 1, ptr1, ptr2);
+ }
+
+ if(x > 10) {
+ val = *ptr1;
+ } else {
+ val = *ptr2;
+ }
+
+ free(ptr1);
+ free(ptr2);
+
+ return 3 * val;
+}
+
diff --git a/bench-moerman2018/memory/access_uninit/test_lib_incorrect/17_complex_function_pointers.c b/bench-moerman2018/memory/access_uninit/test_lib_incorrect/17_complex_function_pointers.c
new file mode 100644
index 000000000..668fed31b
--- /dev/null
+++ b/bench-moerman2018/memory/access_uninit/test_lib_incorrect/17_complex_function_pointers.c
@@ -0,0 +1,29 @@
+#include <stdio.h>
+#include <stdlib.h>
+#include <stdbool.h>
+#include "uninitialized_malloc.h"
+
+static void possibly_assign(int** dest, int val, bool condition) {
+ if(condition) {
+ **dest = val;
+ }
+}
+
+void uninit_malloc_function_pointer(bool a, bool b, void (*f)(int**, int, bool)) {
+ int *data;
+
+
+ data = malloc(sizeof(int));
+
+ if(!data) {
+ return;
+ }
+
+ (*f)(&data, 5, a);
+ (*f)(&data, 13, b);
+
+ printf("%i\n", *data);
+
+ free(data);
+}
+
diff --git a/bench-moerman2018/memory/access_uninit/test_lib_incorrect/18_complex_struct_multiple_methods.c b/bench-moerman2018/memory/access_uninit/test_lib_incorrect/18_complex_struct_multiple_methods.c
new file mode 100644
index 000000000..e98c8522b
--- /dev/null
+++ b/bench-moerman2018/memory/access_uninit/test_lib_incorrect/18_complex_struct_multiple_methods.c
@@ -0,0 +1,84 @@
+#include <stdio.h>
+#include <stdlib.h>
+#include "uninitialized_malloc.h"
+
+#ifndef s_UNINIT_VAL_REFCOUNT
+#define s_UNINIT_VAL_REFCOUNT
+void uninit_malloc_cont_init(MallocIntCont* cont) {
+ cont->counter = 1;
+ cont->data = malloc(sizeof(int));
+}
+
+MallocIntCont* uninit_malloc_cont_new() {
+ MallocIntCont* new_cont;
+
+ new_cont = malloc(sizeof(MallocIntCont));
+
+ if(new_cont) {
+ uninit_malloc_cont_init(new_cont);
+ }
+ return new_cont;
+}
+
+void uninit_malloc_cont_incr(MallocIntCont* cont) {
+ if(cont) {
+ cont->counter++;
+ }
+}
+void uninit_malloc_cont_decr(MallocIntCont* cont) {
+ if(cont->counter <= 1) {
+ if(cont->data) {
+ free(cont->data);
+ }
+ cont->data = malloc(sizeof(int));
+ } else {
+ cont->counter--;
+ }
+}
+
+void uninint_val_cont_free(MallocIntCont* cont) {
+ if(cont->data) {
+ free(cont->data);
+ }
+ free(cont);
+}
+
+int uninit_malloc_cont_get_value(MallocIntCont* cont) {
+ if(cont->data) {
+ return *(cont->data);
+ }
+ return 0;
+}
+void uninit_malloc_cont_set_value(MallocIntCont* cont, int value) {
+ if(!cont->data) {
+ return;
+ }
+ *(cont->data) = value;
+}
+#endif //s_UNINIT_VAL_REFCOUNT
+
+void uninit_malloc_struct(int x, int y) {
+ MallocIntCont cont;
+ int val;
+
+
+ uninit_malloc_cont_init(&cont);
+
+ if(x < y) {
+ uninit_malloc_cont_set_value(&cont, 7);
+ }
+
+ if(x > 10) {
+ val = 50 * 37;
+ } else {
+ /* DANGER: if x <= 10 & x >= y */
+ val = 30 * uninit_malloc_cont_get_value(&cont);
+ }
+
+ if(cont.data) {
+ free(cont.data);
+ }
+
+ printf("x=%i: %i\n", x, val);
+}
+
diff --git a/bench-moerman2018/memory/access_uninit/test_lib_incorrect/19_complex_refcount.c b/bench-moerman2018/memory/access_uninit/test_lib_incorrect/19_complex_refcount.c
new file mode 100644
index 000000000..3e2b9f1af
--- /dev/null
+++ b/bench-moerman2018/memory/access_uninit/test_lib_incorrect/19_complex_refcount.c
@@ -0,0 +1,59 @@
+#include "uninitialized_malloc.h"
+#include <stdlib.h>
+#include <stdio.h>
+
+#ifndef s_UNINIT_VAL_REFCOUNT
+#define s_UNINIT_VAL_REFCOUNT
+void uninit_malloc_cont_init(MallocIntCont* cont) {
+ cont->counter = 1;
+ cont->data = malloc(sizeof(int));
+}
+
+MallocIntCont* uninit_malloc_cont_new() {
+ MallocIntCont* new_cont;
+
+ new_cont = malloc(sizeof(MallocIntCont));
+
+ if(new_cont) {
+ uninit_malloc_cont_init(new_cont);
+ }
+ return new_cont;
+}
+
+void uninit_malloc_cont_incr(MallocIntCont* cont) {
+ if(cont) {
+ cont->counter++;
+ }
+}
+void uninit_malloc_cont_decr(MallocIntCont* cont) {
+ if(cont->counter <= 1) {
+ if(cont->data) {
+ free(cont->data);
+ }
+ cont->data = malloc(sizeof(int));
+ } else {
+ cont->counter--;
+ }
+}
+
+void uninint_val_cont_free(MallocIntCont* cont) {
+ if(cont->data) {
+ free(cont->data);
+ }
+ free(cont);
+}
+
+int uninit_malloc_cont_get_value(MallocIntCont* cont) {
+ if(cont->data) {
+ return *(cont->data);
+ }
+ return 0;
+}
+void uninit_malloc_cont_set_value(MallocIntCont* cont, int value) {
+ if(!cont->data) {
+ return;
+ }
+ *(cont->data) = value;
+}
+#endif //s_UNINIT_VAL_REFCOUNT
+
diff --git a/bench-moerman2018/memory/access_uninit/uninitialized_malloc.h b/bench-moerman2018/memory/access_uninit/uninitialized_malloc.h
new file mode 100644
index 000000000..7d9c052e5
--- /dev/null
+++ b/bench-moerman2018/memory/access_uninit/uninitialized_malloc.h
@@ -0,0 +1,37 @@
+#include <stdbool.h>
+
+typedef struct _MallocIntCont MallocIntCont;
+
+struct _MallocIntCont {
+ int* data;
+ unsigned int counter;
+};
+
+void uninit_malloc_cont_init(MallocIntCont* cont);
+MallocIntCont* uninit_malloc_cont_new();
+void uninit_malloc_cont_incr(MallocIntCont* cont);
+void uninit_malloc_cont_decr(MallocIntCont* cont);
+int uninit_malloc_cont_get_value(MallocIntCont* cont);
+void uninit_malloc_cont_set_value(MallocIntCont* cont, int value);
+void uninint_val_cont_free(MallocIntCont* cont);
+
+void uninit_malloc_for(int x);
+void uninit_malloc_for_complex(int x);
+void uninit_malloc_while_continue(int x);
+void uninit_malloc_do_while_continue(int x);
+void uninit_malloc_for_array(int x);
+void uninit_malloc_for_pointer(int x);
+void uninit_malloc_goto(int x);
+void uninit_malloc_if_else(bool a, bool b);
+void uninit_malloc_if_else_multi(bool a, bool b);
+void uninit_malloc_if_else_int1(int x, int y);
+void uninit_malloc_if_else_int2(int x, int y);
+void uninit_malloc_pass_by_reference(bool a, bool b);
+int uninit_malloc_switch(int x, int y);
+int uninit_malloc_rec_multi(int x, int i, int* ptr1, int* ptr2);
+int uninit_malloc_rec(int x, int i, int* ptr1, int* ptr2);
+int uninit_malloc_pseudo_rec1(int x, int y, int i, int* ptr1, int* ptr2);
+int uninit_malloc_pseudo_rec2(int x, int y, int i, int* ptr1, int* ptr2);
+void uninit_malloc_struct(int x, int y);
+void uninit_malloc_function_pointer(bool a, bool b, void (*f)(int**, int, bool));
+void uninit_malloc_cross_file(bool a, bool b);
diff --git a/bench-moerman2018/memory/double_free/01_simple_if.c b/bench-moerman2018/memory/double_free/01_simple_if.c
new file mode 100644
index 000000000..3743ee41f
--- /dev/null
+++ b/bench-moerman2018/memory/double_free/01_simple_if.c
@@ -0,0 +1,48 @@
+#include <stdio.h>
+#include <stdlib.h>
+#include <stdbool.h>
+#include "double_free.h"
+
+void double_free_if_else(bool a, bool b) {
+ int* data;
+
+#ifdef CATCH_BAD_PARAM
+ if(!a & !b) {
+ return;
+ }
+#endif
+
+ data = malloc(5*sizeof(int));
+
+ if(!data) {
+ return;
+ }
+
+ if(!a) {
+ free(data);
+ }
+
+ if(b) {
+ if(a) {
+ free(data);
+ }
+ } else {
+ free(data); /* DANGER, if !a & !b */
+ }
+}
+
+#ifndef NO_MAIN
+int main() {
+#ifdef NO_BUG
+ double_free_if_else(true, true);
+ double_free_if_else(true, false);
+ double_free_if_else(false, true);
+#else
+ double_free_if_else(true, true); /* OK */
+ double_free_if_else(false, false); /* DANGER */
+ double_free_if_else(false, true); /* OK */
+#endif
+
+ return 1;
+}
+#endif
diff --git a/bench-moerman2018/memory/double_free/02_simple_if_int1.c b/bench-moerman2018/memory/double_free/02_simple_if_int1.c
new file mode 100644
index 000000000..e1b74d93a
--- /dev/null
+++ b/bench-moerman2018/memory/double_free/02_simple_if_int1.c
@@ -0,0 +1,49 @@
+#include <stdio.h>
+#include <stdlib.h>
+#include "double_free.h"
+
+void double_free_if_else_int1(int x, int y) {
+ int* data;
+
+#ifdef CATCH_BAD_PARAM
+ if(x > 10 && x < y) {
+ return;
+ }
+#endif
+
+ data = malloc(5*sizeof(int));
+
+ if(!data) {
+ return;
+ }
+
+ if(x > 10) {
+ free(data);
+ } else {
+ data[3] = -4;
+ }
+
+ if(x < y) {
+ free(data); /* DANGER, if x <= 10 & x >= y */
+ }
+
+ if(x <= 10 && x >= y) {
+ free(data);
+ }
+}
+
+#ifndef NO_MAIN
+int main() {
+#ifdef NO_BUG
+ double_free_if_else_int1(10, 10);
+ double_free_if_else_int1(10, 11);
+ double_free_if_else_int1(11, 11);
+#else
+ double_free_if_else_int1(10, 10); /* OK */
+ double_free_if_else_int1(11, 12); /* DANGER */
+ double_free_if_else_int1(11, 11); /* OK */
+#endif
+
+ return 1;
+}
+#endif
diff --git a/bench-moerman2018/memory/double_free/02_simple_if_int2.c b/bench-moerman2018/memory/double_free/02_simple_if_int2.c
new file mode 100644
index 000000000..442de79aa
--- /dev/null
+++ b/bench-moerman2018/memory/double_free/02_simple_if_int2.c
@@ -0,0 +1,55 @@
+#include <stdio.h>
+#include <stdlib.h>
+#include "double_free.h"
+
+void double_free_if_else_int2(int x, int y) {
+ int* data;
+ int val, m, n;
+
+ m = -1;
+ n = 5;
+
+ x = x*m+n;
+
+#ifdef CATCH_BAD_PARAM
+ if(x > 10 && x < y) {
+ return;
+ }
+#endif
+
+ data = malloc(5*sizeof(int));
+
+ if(!data) {
+ return;
+ }
+
+ if(x > 10) {
+ free(data);
+ } else {
+ data[3] = -4;
+ }
+
+ if(x < y) {
+ free(data); /* DANGER, if x <= 10 & x >= y */
+ }
+
+ if(x <= 10 && x >= y) {
+ free(data);
+ }
+}
+
+#ifndef NO_MAIN
+int main() {
+#ifdef NO_BUG
+ double_free_if_else_int2(-5, 10);
+ double_free_if_else_int2(-5, 11);
+ double_free_if_else_int2(-6, 11);
+#else
+ double_free_if_else_int2(-5, 10); /* OK */
+ double_free_if_else_int2(-6, 12); /* DANGER */
+ double_free_if_else_int2(-6, 11); /* OK */
+#endif
+
+ return 1;
+}
+#endif
diff --git a/bench-moerman2018/memory/double_free/03_simple_if_multi_func.c b/bench-moerman2018/memory/double_free/03_simple_if_multi_func.c
new file mode 100644
index 000000000..a0dda4e6c
--- /dev/null
+++ b/bench-moerman2018/memory/double_free/03_simple_if_multi_func.c
@@ -0,0 +1,45 @@
+#include "double_free.h"
+#include <stdbool.h>
+#include <stdlib.h>
+#include <stdio.h>
+
+static void local_conditional_free(int** ptr, bool condition) {
+ if(condition) {
+ free(*ptr);
+ }
+}
+
+void double_free_if_else_multi(bool a, bool b) {
+ int* data;
+ int** data_ptr = &data;
+
+#ifdef CATCH_BAD_PARAM
+ if(!a & !b) {
+ return;
+ }
+#endif
+ data = malloc(5*sizeof(int));
+
+ if(!data) {
+ return;
+ }
+
+ local_conditional_free(data_ptr, a & b);
+ local_conditional_free(data_ptr, !b);
+ local_conditional_free(data_ptr, !a); /* DANGER, if !a & !b */
+}
+
+#ifndef NO_MAIN
+int main() {
+#ifdef NO_BUG
+ double_free_if_else_multi(true, true);
+ double_free_if_else_multi(true, false);
+ double_free_if_else_multi(false, true);
+#else
+ double_free_if_else_multi(true, true); /* OK */
+ double_free_if_else_multi(false, false); /* DANGER */
+ double_free_if_else_multi(false, true); /* OK */
+#endif
+ return 1;
+}
+#endif
diff --git a/bench-moerman2018/memory/double_free/04_simple_switch.c b/bench-moerman2018/memory/double_free/04_simple_switch.c
new file mode 100644
index 000000000..56f69897a
--- /dev/null
+++ b/bench-moerman2018/memory/double_free/04_simple_switch.c
@@ -0,0 +1,62 @@
+#include "double_free.h"
+#include <stdlib.h>
+
+void double_free_switch(int x, int y) {
+ int* data;
+
+#ifdef CATCH_BAD_PARAM
+ if((x == 10 || x == 5) && x > y) {
+ return;
+ }
+#endif
+ data = malloc(5*sizeof(int));
+
+ if(!data) {
+ return;
+ }
+
+ if(x > y) {
+ free(data);
+ }
+
+ switch (x) {
+ case 5: {
+ free(data); /* DANGER: x >= y */
+ break;
+ }
+ case 7: {
+ if(x <= y) free(data);
+ break;
+ }
+ case 10: {
+ free(data); /* DANGER: x >= y */
+ break;
+ }
+ case 12: {
+ if(x <= y) free(data);
+ break;
+ }
+ default: {
+ if(x <= y) free(data);
+ break;
+ }
+ };
+}
+
+#ifndef NO_MAIN
+int main() {
+#ifdef NO_BUG
+ double_free_switch(5, 11);
+ double_free_switch(10, 11);
+ double_free_switch(11, 10);
+ double_free_switch(7, 5);
+#else
+ double_free_switch(5, 10); /* OK */
+ double_free_switch(10, 9); /* DANGER */
+ double_free_switch(11, 10); /* OK */
+ double_free_switch(7, 5); /* OK */
+#endif
+
+ return 1;
+}
+#endif
diff --git a/bench-moerman2018/memory/double_free/05_simple_goto.c b/bench-moerman2018/memory/double_free/05_simple_goto.c
new file mode 100644
index 000000000..da78fe630
--- /dev/null
+++ b/bench-moerman2018/memory/double_free/05_simple_goto.c
@@ -0,0 +1,47 @@
+#include <stdio.h>
+#include <stdlib.h>
+#include "double_free.h"
+
+void double_free_goto(int x) {
+ int* data;
+ int i = 0;
+
+ if(x <= 0) {
+ return;
+ }
+
+#ifdef CATCH_BAD_PARAM
+ if(x > 0) {
+ return;
+ }
+#endif
+ data = malloc(5*sizeof(int));
+
+ if(!data) {
+ return;
+ }
+
+GOTO_LABEL:
+ if(i <= x) {
+ free(data);
+ } else {
+ printf("Data is freed\n");
+ }
+
+ if(i == 0) {
+ i++;
+ goto GOTO_LABEL;
+ }
+}
+
+#ifndef NO_MAIN
+int main() {
+#ifdef NO_BUG
+ double_free_goto(0);
+#else
+ double_free_goto(1);
+#endif
+
+ return 1;
+}
+#endif
diff --git a/bench-moerman2018/memory/double_free/06_simple_pass_by_reference.c b/bench-moerman2018/memory/double_free/06_simple_pass_by_reference.c
new file mode 100644
index 000000000..c060f269b
--- /dev/null
+++ b/bench-moerman2018/memory/double_free/06_simple_pass_by_reference.c
@@ -0,0 +1,49 @@
+#include <stdio.h>
+#include <stdlib.h>
+#include <stdbool.h>
+#include "double_free.h"
+
+static void assign_possibly_freed(int** dest, bool free_data) {
+ int* data = malloc(5*sizeof(int));
+ *dest = data;
+ if(free_data && data) {
+ free(data);
+ }
+}
+
+void double_free_pass_by_reference(bool a, bool b) {
+ int* data;
+
+#ifdef CATCH_BAD_PARAM
+ if(!a & !b) {
+ return;
+ }
+#endif
+
+ assign_possibly_freed(&data, !a);
+ if(b) {
+ if(a && data) {
+ free(data);
+ }
+ } else {
+ if(data) {
+ free(data); /* DANGER, if !a & !b */
+ }
+ }
+}
+
+#ifndef NO_MAIN
+int main() {
+#ifdef NO_BUG
+ double_free_pass_by_reference(true, true);
+ double_free_pass_by_reference(true, false);
+ double_free_pass_by_reference(false, true);
+#else
+ double_free_pass_by_reference(true, true); /* OK */
+ double_free_pass_by_reference(false, false); /* DANGER */
+ double_free_pass_by_reference(false, true); /* OK */
+#endif
+
+ return 1;
+}
+#endif
diff --git a/bench-moerman2018/memory/double_free/07_cross_file.c b/bench-moerman2018/memory/double_free/07_cross_file.c
new file mode 100644
index 000000000..0fe149f1a
--- /dev/null
+++ b/bench-moerman2018/memory/double_free/07_cross_file.c
@@ -0,0 +1,45 @@
+#include "double_free.h"
+#include "common.h"
+#include <stdbool.h>
+#include <stdio.h>
+#include <stdlib.h>
+
+void double_free_cross_file(bool a, bool b) {
+ int* data;
+
+#ifdef CATCH_BAD_PARAM
+ if(!a & !b) {
+ return;
+ }
+#endif
+ data = malloc(5*sizeof(int));
+
+ if(!data) {
+ return;
+ }
+
+ conditional_free((void*) data, !a, 0);
+
+ if(b) {
+ if (a) {
+ free(data);
+ }
+ } else {
+ free(data); /* DANGER, if !a & !b */
+ }
+}
+
+#ifndef NO_MAIN
+int main() {
+#ifdef NO_BUG
+ double_free_cross_file(true, true);
+ double_free_cross_file(true, false);
+ double_free_cross_file(false, true);
+#else
+ double_free_cross_file(true, true); /* OK */
+ double_free_cross_file(false, false); /* DANGER */
+ double_free_cross_file(false, true); /* OK */
+#endif
+ return 1;
+}
+#endif
diff --git a/bench-moerman2018/memory/double_free/08_loop_for.c b/bench-moerman2018/memory/double_free/08_loop_for.c
new file mode 100644
index 000000000..887021030
--- /dev/null
+++ b/bench-moerman2018/memory/double_free/08_loop_for.c
@@ -0,0 +1,64 @@
+#include <stdio.h>
+#include <stdbool.h>
+#include <stdlib.h>
+#include "double_free.h"
+
+void double_free_for(int x) {
+ int* data;
+ bool is_freed;
+ int n_freed = 21;
+ int i;
+
+#ifdef CATCH_BAD_PARAM
+ if(x < 10) {
+ return;
+ }
+#endif
+ data = malloc(5*sizeof(int));
+
+ if(!data) {
+ return;
+ }
+
+ free(data);
+ is_freed = true;
+
+ for(i = 0; i < 20; i++) {
+ if(i > x && is_freed) { /* should be !is_freed */
+ free(data); /* DANGER: x < 10 */
+ data = malloc(5*sizeof(int));
+ if(!data) {
+ return;
+ }
+ is_freed = false;
+ } else {
+ n_freed--;
+ }
+ if(i == 10) {
+ data = malloc(5*sizeof(int));
+ if(!data) {
+ return;
+ }
+ is_freed = false;
+ }
+ }
+
+ if(!is_freed) {
+ free(data);
+ n_freed--;
+ }
+
+ printf("Times freed = %i", n_freed);
+}
+
+#ifndef NO_MAIN
+int main() {
+#ifdef NO_BUG
+ double_free_for(10);
+#else
+ double_free_for(9);
+#endif
+
+ return 1;
+}
+#endif
diff --git a/bench-moerman2018/memory/double_free/09_loop_for_complex.c b/bench-moerman2018/memory/double_free/09_loop_for_complex.c
new file mode 100644
index 000000000..c0a438906
--- /dev/null
+++ b/bench-moerman2018/memory/double_free/09_loop_for_complex.c
@@ -0,0 +1,67 @@
+#include <stdio.h>
+#include <stdlib.h>
+#include "double_free.h"
+
+void double_free_for_complex(int x) {
+ int* data;
+ bool is_freed;
+ int n_freed = 21;
+ int i = 0;
+
+#ifdef CATCH_BAD_PARAM
+ if(x < 10) {
+ return;
+ }
+#endif
+ data = malloc(5*sizeof(int));
+
+ if(!data) {
+ return;
+ }
+
+ free(data);
+ is_freed = true;
+
+ for(;;) {
+ if(i > x && is_freed) { /* should be !is_freed */
+ free(data); /* DANGER: x < 10 */
+ data = malloc(5*sizeof(int));
+ if(!data) {
+ return;
+ }
+ is_freed = false;
+ } else {
+ n_freed--;
+ }
+ if(i == 10) {
+ data = malloc(5*sizeof(int));
+ if(!data) {
+ return;
+ }
+ is_freed = false;
+ }
+ i++;
+ if(i >= 20) {
+ break;
+ }
+ }
+
+ if(!is_freed) {
+ free(data);
+ n_freed--;
+ }
+
+ printf("Times freed = %i", n_freed);
+}
+
+#ifndef NO_MAIN
+int main() {
+#ifdef NO_BUG
+ double_free_for_complex(10);
+#else
+ double_free_for_complex(9);
+#endif
+
+ return 1;
+}
+#endif
diff --git a/bench-moerman2018/memory/double_free/10_loop_while_continue.c b/bench-moerman2018/memory/double_free/10_loop_while_continue.c
new file mode 100644
index 000000000..d3c2cb300
--- /dev/null
+++ b/bench-moerman2018/memory/double_free/10_loop_while_continue.c
@@ -0,0 +1,68 @@
+#include <stdio.h>
+#include <stdlib.h>
+#include "double_free.h"
+
+void double_free_while_continue(int x) {
+ int* data;
+ bool is_freed;
+ int n_freed = 30;
+ int i = 0;
+
+#ifdef CATCH_BAD_PARAM
+ if(x < 10) {
+ return;
+ }
+#endif
+ data = malloc(5*sizeof(int));
+
+ if(!data) {
+ return;
+ }
+
+ free(data);
+ is_freed = true;
+
+ while(i < 30) {
+ if(i == 9) {
+ i++;
+ continue;
+ }
+ if(i > x && is_freed) { /* should be !is_freed */
+ free(data); /* DANGER: x < 10 */
+ data = malloc(5*sizeof(int));
+ if(!data) {
+ return;
+ }
+ is_freed = false;
+ } else {
+ n_freed--;
+ }
+ if(i == 10) {
+ data = malloc(5*sizeof(int));
+ if(!data) {
+ return;
+ }
+ is_freed = false;
+ }
+ i++;
+ }
+
+ if(!is_freed) {
+ free(data);
+ n_freed--;
+ }
+
+ printf("Times freed = %i", n_freed);
+}
+
+#ifndef NO_MAIN
+int main() {
+#ifdef NO_BUG
+ double_free_while_continue(10);
+#else
+ double_free_while_continue(9);
+#endif
+
+ return 1;
+}
+#endif
diff --git a/bench-moerman2018/memory/double_free/11_loop_while_do_continue.c b/bench-moerman2018/memory/double_free/11_loop_while_do_continue.c
new file mode 100644
index 000000000..25a3b9bfc
--- /dev/null
+++ b/bench-moerman2018/memory/double_free/11_loop_while_do_continue.c
@@ -0,0 +1,68 @@
+#include <stdio.h>
+#include <stdlib.h>
+#include "double_free.h"
+
+void double_free_do_while_continue(int x) {
+ int* data;
+ bool is_freed;
+ int n_freed = 30;
+ int i = 0;
+ printf("Times freed = %i\n", n_freed);
+#ifdef CATCH_BAD_PARAM
+ if(x < 10) {
+ return;
+ }
+#endif
+ data = malloc(5*sizeof(int));
+
+ if(!data) {
+ return;
+ }
+
+ free(data);
+ is_freed = true;
+
+ do {
+ if(i == 8) {
+ i++;
+ continue;
+ }
+ if(i > x && is_freed) { /* should be !is_freed */
+ free(data); /* DANGER: x < 10 */
+ data = malloc(5*sizeof(int));
+ if(!data) {
+ return;
+ }
+ is_freed = false;
+ } else {
+ n_freed--;
+ }
+ if(i == 10) {
+ data = malloc(5*sizeof(int));
+ if(!data) {
+ return;
+ }
+ is_freed = false;
+ }
+ i++;
+ } while(i < 30);
+
+ if(!is_freed) {
+ free(data);
+ n_freed--;
+ }
+
+ printf("Times freed = %i\n", n_freed);
+}
+
+#ifndef NO_MAIN
+int main() {
+#ifdef NO_BUG
+ double_free_do_while_continue(10);
+#else
+ double_free_do_while_continue(9);
+#endif
+
+ return 1;
+}
+#endif
diff --git a/bench-moerman2018/memory/double_free/12_loop_for_array_branching.c b/bench-moerman2018/memory/double_free/12_loop_for_array_branching.c
new file mode 100644
index 000000000..16acb83d0
--- /dev/null
+++ b/bench-moerman2018/memory/double_free/12_loop_for_array_branching.c
@@ -0,0 +1,57 @@
+#include <stdio.h>
+#include <stdlib.h>
+#include "double_free.h"
+
+void double_free_for_array(int x) {
+ int* data;
+ int p[20];
+ int val = 0;
+ int i;
+
+#ifdef CATCH_BAD_PARAM
+ if(x != 19) {
+ return;
+ }
+#endif
+
+ data = malloc(sizeof(int));
+
+ if(!data) {
+ return;
+ }
+
+ *data = 27;
+
+ for(i = 0; i < 20; i++) {
+ p[i] = 0;
+ }
+ p[x] = 1;
+
+ for(i = 0; i < 20; i++) {
+ if(p[i] == 1) {
+ val = *data;
+ free(data);
+ } else {
+ free(data); /* DANGER: x < 19 */
+ data = malloc(sizeof(int));
+ if(!data) {
+ break;
+ }
+ *data = i;
+ }
+ }
+
+ printf("%i\n", val);
+}
+
+#ifndef NO_MAIN
+int main() {
+#ifdef NO_BUG
+ double_free_for_array(19);
+#else
+ double_free_for_array(10);
+#endif
+
+ return 1;
+}
+#endif
diff --git a/bench-moerman2018/memory/double_free/13_loop_for_pointer_arithmetic.c b/bench-moerman2018/memory/double_free/13_loop_for_pointer_arithmetic.c
new file mode 100644
index 000000000..48b0686ad
--- /dev/null
+++ b/bench-moerman2018/memory/double_free/13_loop_for_pointer_arithmetic.c
@@ -0,0 +1,47 @@
+#include <stdlib.h>
+#include <stdio.h>
+#include "double_free.h"
+
+static void initialize_array(int* ptr_arr[], int length) {
+ int i;
+
+ for(i = 0; i < length; i++) {
+ ptr_arr[i] = malloc(sizeof(int));
+ if(ptr_arr[i]) *ptr_arr[i] = i;
+ }
+}
+
+static void free_array(int* ptr_arr[], int length) {
+ int i;
+
+ for(i = 0; i < length; i++) {
+ if(ptr_arr[i]) free(ptr_arr[i]);
+ }
+}
+
+void double_free_for_pointer(int x) {
+ int* pointers[10];
+
+#ifdef CATCH_BAD_PARAM
+ if(x != 10) {
+ return;
+ }
+#endif
+
+ initialize_array(pointers, 10);
+ free_array(pointers, 10);
+ initialize_array(pointers, x);
+ free_array(pointers, 10);
+}
+
+#ifndef NO_MAIN
+int main() {
+#ifdef NO_BUG
+ double_free_for_pointer(10);
+#else
+ double_free_for_pointer(9);
+#endif
+
+ return 1;
+}
+#endif
diff --git a/bench-moerman2018/memory/double_free/14_loop_recursion.c b/bench-moerman2018/memory/double_free/14_loop_recursion.c
new file mode 100644
index 000000000..ddb461402
--- /dev/null
+++ b/bench-moerman2018/memory/double_free/14_loop_recursion.c
@@ -0,0 +1,65 @@
+#include <stdio.h>
+#include <stdbool.h>
+#include <stdlib.h>
+#include "double_free.h"
+
+int double_free_rec(int x, int i, int** data_ptr, bool* is_freed) {
+ int n_freed = 0;
+
+ if(i <= 1) {
+ return 0;
+ }
+
+#ifdef CATCH_BAD_PARAM
+ if(x > 10 && *is_freed) {
+ return -1;
+ }
+#endif
+
+ if(i < 20 && i < x) {
+ free(*data_ptr); /* DANGER: x > 10 */
+ *data_ptr = malloc(5*sizeof(int));
+ if(!data_ptr) {
+ *is_freed = true;
+ return 0;
+ }
+ *is_freed = false;
+ } else {
+ n_freed--;
+ }
+ if(i == 10 && *is_freed) {
+ *data_ptr = malloc(5*sizeof(int));
+ if(!(*data_ptr)) {
+ *is_freed = true;
+ return 0;
+ }
+ *is_freed = false;
+ }
+
+ return 1 + n_freed + double_free_rec(x, i-1, data_ptr, is_freed);
+}
+
+#ifndef NO_MAIN
+int main() {
+ int* data = malloc(sizeof(int));
+ int** data_ptr = &data;
+ free(data);
+ bool is_freed = true;
+#ifdef NO_BUG
+ printf("%i\n", double_free_rec(10, 20, data_ptr, &is_freed));
+ if(is_freed) {
+ data = malloc(sizeof(int));
+ is_freed = false;
+ }
+ printf("%i\n", double_free_rec(11, 20, data_ptr, &is_freed));
+#else
+ printf("%i\n", double_free_rec(11, 20, data_ptr, &is_freed));
+#endif
+ if(!is_freed) {
+ free(data);
+ is_freed = true;
+ }
+
+ return 1;
+}
+#endif
diff --git a/bench-moerman2018/memory/double_free/14_loop_recursion_alt.c b/bench-moerman2018/memory/double_free/14_loop_recursion_alt.c
new file mode 100644
index 000000000..bbd46f611
--- /dev/null
+++ b/bench-moerman2018/memory/double_free/14_loop_recursion_alt.c
@@ -0,0 +1,59 @@
+#include <stdio.h>
+#include <stdbool.h>
+#include <stdlib.h>
+#include "double_free.h"
+
+int double_free_rec_alt(int x, int i, int** data_ptr, bool* is_freed) {
+ int n_freed = 0;
+
+ if(i <= 1) {
+ return 0;
+ }
+
+#ifdef CATCH_BAD_PARAM
+ if(x < 9 && i >= 10) {
+ return -1;
+ }
+#endif
+
+ if(i < 20 && i > x) {
+ free(*data_ptr); /* DANGER: x < 9 */
+ *data_ptr = malloc(5*sizeof(int));
+ if(!data_ptr) {
+ *is_freed = true;
+ return 0;
+ }
+ *is_freed = false;
+ } else {
+ n_freed--;
+ }
+ if(i == 10 && !*is_freed) {
+ free(*data_ptr);
+ *is_freed = true;
+ n_freed++;
+ }
+
+ return 1 + n_freed + double_free_rec_alt(x, i-1, data_ptr, is_freed);
+}
+
+#ifndef NO_MAIN
+int main() {
+ int* data = malloc(sizeof(int));
+ bool is_freed = false;
+ if(!data) {
+ return 1;
+ }
+
+#ifdef NO_BUG
+ printf("%i\n", double_free_rec_alt(9, 20, &data, &is_freed));
+#else
+ printf("%i\n", double_free_rec_alt(8, 20, &data, &is_freed));
+#endif
+ if(!is_freed) {
+ free(data);
+ is_freed = true;
+ }
+
+ return 1;
+}
+#endif
diff --git a/bench-moerman2018/memory/double_free/15_loop_recursion_multi.c b/bench-moerman2018/memory/double_free/15_loop_recursion_multi.c
new file mode 100644
index 000000000..4db5c2916
--- /dev/null
+++ b/bench-moerman2018/memory/double_free/15_loop_recursion_multi.c
@@ -0,0 +1,73 @@
+#include <stdio.h>
+#include <stdbool.h>
+#include <stdlib.h>
+#include "double_free.h"
+
+int double_free_rec_decr(int x, int i, int** data_ptr, bool* is_freed) {
+ if(i <= 1) {
+ return 0;
+ }
+
+ return double_free_rec_multi(x, i-1, data_ptr, is_freed);
+}
+
+int double_free_rec_multi(int x, int i, int** data_ptr, bool* is_freed) {
+ int n_freed = 0;
+
+ if(i <= 1) {
+ return 0;
+ }
+
+#ifdef CATCH_BAD_PARAM
+ if(x > 10 && *is_freed) {
+ return -1;
+ }
+#endif
+
+ if(i < 20 && i < x) {
+ free(*data_ptr); /* DANGER: x > 10 */
+ *data_ptr = malloc(5*sizeof(int));
+ if(!data_ptr) {
+ *is_freed = true;
+ return 0;
+ }
+ *is_freed = false;
+ } else {
+ n_freed--;
+ }
+ if(i == 10 && *is_freed) {
+ *data_ptr = malloc(5*sizeof(int));
+ if(!(*data_ptr)) {
+ *is_freed = true;
+ return 0;
+ }
+ *is_freed = false;
+ }
+
+ return 1 + n_freed + double_free_rec_decr(x, i, data_ptr, is_freed);
+}
+
+#ifndef NO_MAIN
+int main() {
+ int* data = malloc(sizeof(int));
+ int** data_ptr = &data;
+ free(data);
+ bool is_freed = true;
+#ifdef NO_BUG
+ printf("%i\n", double_free_rec_multi(10, 20, data_ptr, &is_freed));
+ if(is_freed) {
+ data = malloc(sizeof(int));
+ is_freed = false;
+ }
+ printf("%i\n", double_free_rec_multi(11, 20, data_ptr, &is_freed));
+#else
+ printf("%i\n", double_free_rec_multi(11, 20, data_ptr, &is_freed));
+#endif
+ if(!is_freed) {
+ free(data);
+ is_freed = true;
+ }
+
+ return 1;
+}
+#endif
diff --git a/bench-moerman2018/memory/double_free/15_loop_recursion_multi_alt.c b/bench-moerman2018/memory/double_free/15_loop_recursion_multi_alt.c
new file mode 100644
index 000000000..578c091be
--- /dev/null
+++ b/bench-moerman2018/memory/double_free/15_loop_recursion_multi_alt.c
@@ -0,0 +1,66 @@
+#include <stdio.h>
+#include <stdbool.h>
+#include <stdlib.h>
+#include "double_free.h"
+
+int double_free_rec_decr_alt(int x, int i, int** data_ptr, bool* is_freed) {
+ if(i <= 1) {
+ return 0;
+ }
+
+ return double_free_rec_multi_alt(x, i-1, data_ptr, is_freed);
+}
+
+int double_free_rec_multi_alt(int x, int i, int** data_ptr, bool* is_freed) {
+ int n_freed = 0;
+
+ if(i <= 1) {
+ return 0;
+ }
+
+#ifdef CATCH_BAD_PARAM
+ if(x < 9 && i >= 10) {
+ return -1;
+ }
+#endif
+
+ if(i < 20 && i > x) {
+ free(*data_ptr); /* DANGER: x < 9 */
+ *data_ptr = malloc(5*sizeof(int));
+ if(!data_ptr) {
+ *is_freed = true;
+ return 0;
+ }
+ *is_freed = false;
+ } else {
+ n_freed--;
+ }
+ if(i == 10 && !*is_freed) {
+ free(*data_ptr);
+ *is_freed = true;
+ n_freed++;
+ }
+
+ return 1 + n_freed + double_free_rec_decr_alt(x, i, data_ptr, is_freed);
+}
+
+#ifndef NO_MAIN
+int main() {
+ int* data = malloc(sizeof(int));
+ bool is_freed = false;
+ if(!data) {
+ return 1;
+ }
+#ifdef NO_BUG
+ printf("%i\n", double_free_rec_multi_alt(9, 20, &data, &is_freed));
+#else
+ printf("%i\n", double_free_rec_multi_alt(8, 20, &data, &is_freed));
+#endif
+ if(!is_freed) {
+ free(data);
+ is_freed = true;
+ }
+
+ return 1;
+}
+#endif
diff --git a/bench-moerman2018/memory/double_free/16_misc_pseudo_recursion.c b/bench-moerman2018/memory/double_free/16_misc_pseudo_recursion.c
new file mode 100644
index 000000000..ecb5f6297
--- /dev/null
+++ b/bench-moerman2018/memory/double_free/16_misc_pseudo_recursion.c
@@ -0,0 +1,60 @@
+#include <stdio.h>
+#include <stdlib.h>
+#include "double_free.h"
+
+int double_free_pseudo_rec1(int x, int y, int i, int** data_ptr) {
+ int data_value = **data_ptr;
+#ifdef CATCH_BAD_PARAM
+ if(x >= y && x <= 10) {
+ free(*data_ptr);
+ return -1;
+ }
+#endif
+
+ if(i > 0) {
+ free(*data_ptr);
+ return 37;
+ }
+
+ if(x >= y) {
+ free(*data_ptr);
+ }
+
+ return data_value + double_free_pseudo_rec2(x, y, 1, data_ptr);
+}
+
+int double_free_pseudo_rec2(int x, int y, int i, int** data_ptr) {
+ if(i > 0) {
+ if(x <= 10) {
+ free(*data_ptr);
+ } else if(x > 10 && x < y) {
+ free(*data_ptr);
+ }
+ return -1;
+ }
+
+ return 5 + double_free_pseudo_rec1(x, y, 1, data_ptr);
+}
+
+#ifndef NO_MAIN
+int main() {
+ int* data = malloc(sizeof(int));
+ if(!data) {
+ return -1;
+ }
+ *data = 35;
+#ifdef NO_BUG
+ printf("%i\n", double_free_pseudo_rec1(9, 10, 0, &data));
+ data = malloc(sizeof(int));
+ if(!data) {
+ return -1;
+ }
+ *data = 35;
+ printf("%i\n", double_free_pseudo_rec1(11, 10, 0, &data));
+#else
+ printf("%i\n", double_free_pseudo_rec1(10, 10, 0, &data));
+#endif
+
+ return 1;
+}
+#endif
diff --git a/bench-moerman2018/memory/double_free/17_complex_function_pointers.c b/bench-moerman2018/memory/double_free/17_complex_function_pointers.c
new file mode 100644
index 000000000..63ed0c84c
--- /dev/null
+++ b/bench-moerman2018/memory/double_free/17_complex_function_pointers.c
@@ -0,0 +1,50 @@
+#include <stdio.h>
+#include <stdbool.h>
+#include <stdlib.h>
+#include "double_free.h"
+
+static void assign_possibly_freed(int** dest, bool free_data) {
+ int* data = malloc(5*sizeof(int));
+ *dest = data;
+ if(free_data && data) {
+ free(data);
+ }
+}
+
+void double_free_function_pointer(bool a, bool b, void (*f)(int** dest, bool free_data)) {
+ int* data;
+
+#ifdef CATCH_BAD_PARAM
+ if(!f || (!a & !b)) {
+ return;
+ }
+#endif
+
+ (*f)(&data, !a);
+
+ if(b) {
+ if(a && data) {
+ free(data);
+ }
+ } else {
+ if(data) {
+ free(data); /* DANGER, if !a & !b */
+ }
+ }
+}
+
+#ifndef NO_MAIN
+int main() {
+#ifdef NO_BUG
+ double_free_function_pointer(true, true, &assign_possibly_freed);
+ double_free_function_pointer(true, false, &assign_possibly_freed);
+ double_free_function_pointer(false, true, &assign_possibly_freed);
+#else
+ double_free_function_pointer(true, true, &assign_possibly_freed); /* OK */
+ double_free_function_pointer(false, false, &assign_possibly_freed); /* DANGER */
+ double_free_function_pointer(false, true, &assign_possibly_freed); /* OK */
+#endif
+
+ return 1;
+}
+#endif
diff --git a/bench-moerman2018/memory/double_free/18_complex_struct_multiple_methods.c b/bench-moerman2018/memory/double_free/18_complex_struct_multiple_methods.c
new file mode 100644
index 000000000..16ddfbdce
--- /dev/null
+++ b/bench-moerman2018/memory/double_free/18_complex_struct_multiple_methods.c
@@ -0,0 +1,90 @@
+#include <stdio.h>
+#include <stdlib.h>
+#include "double_free.h"
+
+#ifndef s_MEMORY_DF_REFCOUNT
+#define s_MEMORY_DF_REFCOUNT
+void double_free_cont_init(DRefCont* cont) {
+ cont->refc = 1;
+ cont->data = 0;
+}
+
+DRefCont* double_free_cont_new() {
+ DRefCont* new_cont;
+
+ new_cont = malloc(sizeof(DRefCont));
+
+ if(new_cont) {
+ double_free_cont_init(new_cont);
+ }
+ return new_cont;
+}
+
+void double_free_cont_ref(DRefCont* cont) {
+ if(cont) {
+ cont->refc++;
+ }
+}
+void double_free_cont_unref(DRefCont* cont) {
+ if(cont->refc <= 1) {
+ free(cont);
+ } else {
+ cont->refc--;
+ }
+}
+
+void* double_free_cont_get_pointer(DRefCont* cont) {
+ return cont->data;
+}
+void double_free_cont_set_pointer(DRefCont* cont, void* p) {
+ cont->data = p;
+}
+#endif //s_MEMORY_DF_REFCOUNT
+
+void double_free_struct(int x, int y) {
+ DRefCont cont;
+ int* data;
+
+#ifdef CATCH_BAD_PARAM
+ if(x <= 10 && x > y) {
+ return;
+ }
+#endif
+
+ data = malloc(sizeof(int));
+
+ if(!data) {
+ return;
+ }
+
+ double_free_cont_init(&cont);
+ double_free_cont_set_pointer(&cont, data);
+
+ *data = 37;
+
+ if(x > y) {
+ free(data);
+ }
+
+ if(x > 10) {
+ if(x <= y) {
+ free(double_free_cont_get_pointer(&cont));
+ }
+ } else {
+ free(double_free_cont_get_pointer(&cont)); /* DANGER: if x <= 10 & x > y */
+ }
+}
+
+#ifndef NO_MAIN
+int main() {
+#ifdef NO_BUG
+ double_free_struct(9, 10);
+ double_free_struct(10, 11);
+ double_free_struct(11, 10);
+#else
+ double_free_struct(10, 9); /* DANGER */
+#endif
+
+ return 1;
+}
+#endif
diff --git a/bench-moerman2018/memory/double_free/19_complex_refcount.c b/bench-moerman2018/memory/double_free/19_complex_refcount.c
new file mode 100644
index 000000000..99e775d4b
--- /dev/null
+++ b/bench-moerman2018/memory/double_free/19_complex_refcount.c
@@ -0,0 +1,71 @@
+#include "double_free.h"
+#include <stdlib.h>
+#include <stdio.h>
+
+#ifndef s_MEMORY_DF_REFCOUNT
+#define s_MEMORY_DF_REFCOUNT
+void double_free_cont_init(DRefCont* cont) {
+ cont->refc = 1;
+ cont->data = 0;
+}
+
+DRefCont* double_free_cont_new() {
+ DRefCont* new_cont;
+
+ new_cont = malloc(sizeof(DRefCont));
+
+ if(new_cont) {
+ double_free_cont_init(new_cont);
+ }
+ return new_cont;
+}
+
+void double_free_cont_ref(DRefCont* cont) {
+ if(cont) {
+ cont->refc++;
+ }
+}
+void double_free_cont_unref(DRefCont* cont) {
+ if(cont->refc <= 1) {
+ free(cont);
+ } else {
+ cont->refc--;
+ }
+}
+
+void* double_free_cont_get_pointer(DRefCont* cont) {
+ return cont->data;
+}
+void double_free_cont_set_pointer(DRefCont* cont, void* p) {
+ cont->data = p;
+}
+#endif //s_MEMORY_DF_REFCOUNT
+
+#ifndef NO_MAIN
+int main() {
+ DRefCont* cont;
+ int arr[1] = {99};
+ int val;
+
+ cont = double_free_cont_new();
+ if(!cont) {
+ return 1;
+ }
+ double_free_cont_set_pointer(cont, arr);
+
+ double_free_cont_ref(cont);
+ double_free_cont_ref(cont);
+ double_free_cont_unref(cont);
+ double_free_cont_unref(cont);
+ val = *((int*) double_free_cont_get_pointer(cont));
+#ifndef NO_BUG
+ double_free_cont_unref(cont);
+#endif
+
+ printf("%i\n", val);
+
+ free(cont);
+
+ return 1;
+}
+#endif
diff --git a/bench-moerman2018/memory/double_free/double_free.h b/bench-moerman2018/memory/double_free/double_free.h
new file mode 100644
index 000000000..b4a071298
--- /dev/null
+++ b/bench-moerman2018/memory/double_free/double_free.h
@@ -0,0 +1,38 @@
+#include <stdbool.h>
+
+typedef struct _DoubleFreeRefCont DRefCont;
+
+struct _DoubleFreeRefCont {
+ void* data;
+ unsigned int refc;
+};
+
+void double_free_cont_init(DRefCont* cont);
+DRefCont* double_free_cont_new();
+void double_free_cont_ref(DRefCont* cont);
+void double_free_cont_unref(DRefCont* cont);
+void* double_free_cont_get_pointer(DRefCont* cont);
+void double_free_cont_set_pointer(DRefCont* cont, void* p);
+
+void double_free_for(int x);
+void double_free_for_complex(int x);
+void double_free_while_continue(int x);
+void double_free_do_while_continue(int x);
+void double_free_for_array(int x);
+void double_free_for_pointer(int x);
+void double_free_goto(int x);
+void double_free_if_else(bool a, bool b);
+void double_free_if_else_multi(bool a, bool b);
+void double_free_if_else_int1(int x, int y);
+void double_free_if_else_int2(int x, int y);
+void double_free_pass_by_reference(bool a, bool b);
+void double_free_switch(int x, int y);
+int double_free_rec_multi(int x, int i, int** data_ptr, bool* is_freed);
+int double_free_rec_multi_alt(int x, int i, int** data_ptr, bool* is_freed);
+int double_free_rec(int x, int i, int** data_ptr, bool* is_freed);
+int double_free_rec_alt(int x, int i, int** data_ptr, bool* is_freed);
+int double_free_pseudo_rec1(int x, int y, int i, int** data_ptr);
+int double_free_pseudo_rec2(int x, int y, int i, int** data_ptr);
+void double_free_struct(int x, int y);
+void double_free_function_pointer(bool a, bool b, void (*f)(int** dest, bool free_data));
+void double_free_cross_file(bool a, bool b);
diff --git a/bench-moerman2018/memory/leak/01_simple_if.c b/bench-moerman2018/memory/leak/01_simple_if.c
new file mode 100644
index 000000000..691418eae
--- /dev/null
+++ b/bench-moerman2018/memory/leak/01_simple_if.c
@@ -0,0 +1,55 @@
+#include <stdio.h>
+#include <stdlib.h>
+#include <stdbool.h>
+#include "memory_leak.h"
+
+void mem_leak_if_else(bool a, bool b) {
+ int* data;
+ int val = 0;
+
+#ifdef CATCH_BAD_PARAM
+ if(!a & !b) {
+ return;
+ }
+#endif
+
+ data = malloc(5*sizeof(int));
+
+ if(!data) {
+ return;
+ }
+
+ *data = 27;
+
+ if(a) {
+ val = *data;
+ free(data);
+ } else {
+ (*data)++;
+ }
+
+ if(b & !a) {
+ val = *data;
+ free(data);
+ } else {
+ val += 37;
+ }
+
+ printf("%i\n", val);
+}
+
+#ifndef NO_MAIN
+int main() {
+#ifdef NO_BUG
+ mem_leak_if_else(true, true);
+ mem_leak_if_else(true, false);
+ mem_leak_if_else(false, true);
+#else
+ mem_leak_if_else(true, true); /* OK */
+ mem_leak_if_else(false, false); /* DANGER */
+ mem_leak_if_else(false, true); /* OK */
+#endif
+
+ return 1;
+}
+#endif
diff --git a/bench-moerman2018/memory/leak/02_simple_if_int1.c b/bench-moerman2018/memory/leak/02_simple_if_int1.c
new file mode 100644
index 000000000..fdf0764e7
--- /dev/null
+++ b/bench-moerman2018/memory/leak/02_simple_if_int1.c
@@ -0,0 +1,56 @@
+#include <stdio.h>
+#include <stdlib.h>
+#include "memory_leak.h"
+
+void mem_leak_if_else_int1(int x, int y) {
+ int val = 0;
+ int* data;
+
+#ifdef CATCH_BAD_PARAM
+ if(x <= 10 && x < y) {
+ return;
+ }
+#endif
+
+ data = malloc(5*sizeof(int));
+
+ if(!data) {
+ return;
+ }
+
+ *data = 27;
+
+ if(x <= 10) {
+ val = *data;
+ free(data);
+ } else {
+ (*data)++;
+ }
+
+ if(x >= y) {
+ if(x > 10) {
+ val = *data * 2;
+ free(data);
+ }
+ } else {
+ val += 10;
+ }
+
+ printf("%i\n", val);
+}
+
+#ifndef NO_MAIN
+int main() {
+#ifdef NO_BUG
+ mem_leak_if_else_int1(10, 10);
+ mem_leak_if_else_int1(10, 11);
+ mem_leak_if_else_int1(11, 11);
+#else
+ mem_leak_if_else_int1(10, 10); /* OK */
+ mem_leak_if_else_int1(11, 12); /* DANGER */
+ mem_leak_if_else_int1(11, 11); /* OK */
+#endif
+
+ return 1;
+}
+#endif
diff --git a/bench-moerman2018/memory/leak/02_simple_if_int2.c b/bench-moerman2018/memory/leak/02_simple_if_int2.c
new file mode 100644
index 000000000..23d5ae75c
--- /dev/null
+++ b/bench-moerman2018/memory/leak/02_simple_if_int2.c
@@ -0,0 +1,62 @@
+#include <stdio.h>
+#include <stdlib.h>
+#include "memory_leak.h"
+
+void mem_leak_if_else_int2(int x, int y) {
+ int* data;
+ int val = 0;
+ int m, n;
+
+ m = -1;
+ n = 5;
+
+ x = x*m+n;
+
+#ifdef CATCH_BAD_PARAM
+ if(x > 10 && x < y) {
+ return;
+ }
+#endif
+
+ data = malloc(5*sizeof(int));
+
+ if(!data) {
+ return;
+ }
+
+ *data = 27;
+
+ if(x <= 10) {
+ val = *data;
+ free(data);
+ } else {
+ (*data)++;
+ }
+
+ if(x >= y) {
+ if(x > 10) {
+ val = *data * 2;
+ free(data);
+ }
+ } else {
+ val += 10;
+ }
+
+ printf("%i\n", val);
+}
+
+#ifndef NO_MAIN
+int main() {
+#ifdef NO_BUG
+ mem_leak_if_else_int2(-5, 10);
+ mem_leak_if_else_int2(-5, 11);
+ mem_leak_if_else_int2(-6, 11);
+#else
+ mem_leak_if_else_int2(-5, 10); /* OK */
+ mem_leak_if_else_int2(-6, 12); /* DANGER */
+ mem_leak_if_else_int2(-6, 11); /* OK */
+#endif
+
+ return 1;
+}
+#endif
diff --git a/bench-moerman2018/memory/leak/03_simple_if_multi_func.c b/bench-moerman2018/memory/leak/03_simple_if_multi_func.c
new file mode 100644
index 000000000..4adab435a
--- /dev/null
+++ b/bench-moerman2018/memory/leak/03_simple_if_multi_func.c
@@ -0,0 +1,57 @@
+#include "memory_leak.h"
+#include <stdbool.h>
+#include <stdlib.h>
+#include <stdio.h>
+
+static void local_conditional_free(int** ptr, bool condition) {
+ if(condition) {
+ free(*ptr);
+ }
+}
+
+static int conditional_dereference(int** ptr, int def, bool condition) {
+ if(condition) {
+ return **ptr;
+ }
+ return def;
+}
+
+void mem_leak_if_else_multi(bool a, bool b) {
+ int val;
+ int* data;
+ int** data_ptr = &data;
+
+#ifdef CATCH_BAD_PARAM
+ if(!a & !b) {
+ return;
+ }
+#endif
+ data = malloc(5*sizeof(int));
+
+ if(!data) {
+ return;
+ }
+
+ *data = 27;
+
+ local_conditional_free(data_ptr, a);
+ val = conditional_dereference(data_ptr, 897, !a);
+ local_conditional_free(data_ptr, b & !a);
+
+ printf("%i\n", val);
+}
+
+#ifndef NO_MAIN
+int main() {
+#ifdef NO_BUG
+ mem_leak_if_else_multi(true, true);
+ mem_leak_if_else_multi(true, false);
+ mem_leak_if_else_multi(false, true);
+#else
+ mem_leak_if_else_multi(true, true); /* OK */
+ mem_leak_if_else_multi(false, false); /* DANGER */
+ mem_leak_if_else_multi(false, true); /* OK */
+#endif
+ return 1;
+}
+#endif
diff --git a/bench-moerman2018/memory/leak/04_simple_switch.c b/bench-moerman2018/memory/leak/04_simple_switch.c
new file mode 100644
index 000000000..ec310e164
--- /dev/null
+++ b/bench-moerman2018/memory/leak/04_simple_switch.c
@@ -0,0 +1,86 @@
+#include "memory_leak.h"
+#include <stdbool.h>
+#include <stdlib.h>
+
+int mem_leak_switch(int x, int y) {
+ int* data;
+ bool freed = false;
+ int val = 0;
+
+#ifdef CATCH_BAD_PARAM
+ if((x == 10 || x == 5) && x > y) {
+ return -1;
+ }
+#endif
+ data = malloc(5*sizeof(int));
+
+ if(!data) {
+ return -1;
+ }
+
+ *data = -1;
+
+ if(x <= y) {
+ free(data);
+ freed = true;
+ }
+
+ switch (x) {
+ case 5: {
+ if(!freed) val = *data;
+ freed = true; /* DANGER: x >= y */
+ break;
+ }
+ case 7: {
+ if(!freed) {
+ val = *data + 289;
+ free(data);
+ freed = true;
+ }
+ break;
+ }
+ case 10: {
+ if(!freed) {
+ val = *data + 36;
+ freed = true; /* DANGER: x >= y */
+ }
+ break;
+ }
+ case 12: {
+ if(!freed) {
+ val = *data + 49807;
+ free(data);
+ }
+ freed = true;
+ break;
+ }
+ default: {
+ val = 7987;
+ break;
+ }
+ }
+
+ if(!freed) {
+ free(data);
+ }
+
+ return val;
+}
+
+#ifndef NO_MAIN
+int main() {
+#ifdef NO_BUG
+ mem_leak_switch(5, 11);
+ mem_leak_switch(10, 11);
+ mem_leak_switch(11, 10);
+ mem_leak_switch(7, 5);
+#else
+ mem_leak_switch(5, 10); /* OK */
+ mem_leak_switch(10, 9); /* DANGER */
+ mem_leak_switch(11, 10); /* OK */
+ mem_leak_switch(7, 5); /* OK */
+#endif
+
+ return 1;
+}
+#endif
diff --git a/bench-moerman2018/memory/leak/05_simple_goto.c b/bench-moerman2018/memory/leak/05_simple_goto.c
new file mode 100644
index 000000000..4a756d37f
--- /dev/null
+++ b/bench-moerman2018/memory/leak/05_simple_goto.c
@@ -0,0 +1,47 @@
+#include <stdio.h>
+#include <stdlib.h>
+#include "memory_leak.h"
+
+void mem_leak_goto(int x) {
+ int* data = 0;
+ int val = 0;
+ int i = 0;
+
+#ifdef CATCH_BAD_PARAM
+ if(x > 0) {
+ return;
+ }
+#endif
+
+GOTO_LABEL:
+ if(i <= x) {
+ data = malloc(5*sizeof(int));
+
+ if(!data) {
+ return;
+ }
+
+ *data = 7698;
+ val += *data;
+ } else {
+ printf("%i\n", val);
+ }
+
+ if(i == 0 && data) {
+ i++;
+ free(data);
+ goto GOTO_LABEL;
+ }
+}
+
+#ifndef NO_MAIN
+int main() {
+#ifdef NO_BUG
+ mem_leak_goto(0);
+#else
+ mem_leak_goto(1);
+#endif
+
+ return 1;
+}
+#endif
diff --git a/bench-moerman2018/memory/leak/06_simple_pass_by_reference.c b/bench-moerman2018/memory/leak/06_simple_pass_by_reference.c
new file mode 100644
index 000000000..f4a2611fe
--- /dev/null
+++ b/bench-moerman2018/memory/leak/06_simple_pass_by_reference.c
@@ -0,0 +1,53 @@
+#include <stdio.h>
+#include <stdlib.h>
+#include <stdbool.h>
+#include "memory_leak.h"
+
+static void assign_possibly_freed(int** dest, bool free_data) {
+ int* data = malloc(5*sizeof(int));
+ *dest = data;
+ if(!data) {
+ return;
+ }
+ *data = 6;
+ if(free_data) {
+ free(data);
+ }
+}
+
+void mem_leak_pass_by_reference(bool a, bool b) {
+ int* data;
+ int val = -1;
+
+#ifdef CATCH_BAD_PARAM
+ if(!a & !b) {
+ return;
+ }
+#endif
+
+ assign_possibly_freed(&data, a);
+ if(b && !a && data) {
+ val = *data;
+ free(data);
+ } else {
+ val = 687;
+ }
+
+ printf("%i\n", val);
+}
+
+#ifndef NO_MAIN
+int main() {
+#ifdef NO_BUG
+ mem_leak_pass_by_reference(true, true);
+ mem_leak_pass_by_reference(true, false);
+ mem_leak_pass_by_reference(false, true);
+#else
+ mem_leak_pass_by_reference(true, true); /* OK */
+ mem_leak_pass_by_reference(false, false); /* DANGER */
+ mem_leak_pass_by_reference(false, true); /* OK */
+#endif
+
+ return 1;
+}
+#endif
diff --git a/bench-moerman2018/memory/leak/07_cross_file.c b/bench-moerman2018/memory/leak/07_cross_file.c
new file mode 100644
index 000000000..2a6571650
--- /dev/null
+++ b/bench-moerman2018/memory/leak/07_cross_file.c
@@ -0,0 +1,47 @@
+#include "memory_leak.h"
+#include "common.h"
+#include <stdbool.h>
+#include <stdio.h>
+#include <stdlib.h>
+
+void mem_leak_cross_file(bool a, bool b) {
+ int val;
+ int* data;
+
+#ifdef CATCH_BAD_PARAM
+ if(!a & !b) {
+ return;
+ }
+#endif
+ data = malloc(5*sizeof(int));
+
+ if(!data) {
+ return;
+ }
+
+ conditional_free((void*) data, !a, 0);
+
+ if(b & a) {
+ val = *data;
+ free(data);
+ } else {
+ val = 678;
+ }
+
+ printf("%i\n", val);
+}
+
+#ifndef NO_MAIN
+int main() {
+#ifdef NO_BUG
+ mem_leak_cross_file(true, true);
+ mem_leak_cross_file(true, false);
+ mem_leak_cross_file(false, true);
+#else
+ mem_leak_cross_file(true, true); /* OK */
+ mem_leak_cross_file(false, false); /* DANGER */
+ mem_leak_cross_file(false, true); /* OK */
+#endif
+ return 1;
+}
+#endif
diff --git a/bench-moerman2018/memory/leak/08_loop_for.c b/bench-moerman2018/memory/leak/08_loop_for.c
new file mode 100644
index 000000000..1de98f503
--- /dev/null
+++ b/bench-moerman2018/memory/leak/08_loop_for.c
@@ -0,0 +1,58 @@
+#include <stdio.h>
+#include <stdbool.h>
+#include <stdlib.h>
+#include "memory_leak.h"
+
+void mem_leak_for(int x) {
+ int* data;
+ int val = 0;
+ bool do_free = false;
+ bool is_freed = true;
+ int i;
+
+#ifdef CATCH_BAD_PARAM
+ if(x < 10) {
+ return;
+ }
+#endif
+
+ for(i = 0; i < 20; i++) {
+ if(i > x && is_freed) {
+ data = malloc(5*sizeof(int));
+ if(!data) {
+ return;
+ }
+ *data = i;
+ val += *data * 2;
+ if(do_free) {
+ free(data);
+ is_freed = true;
+ } else {
+ is_freed = false;
+ }
+ } else {
+ if(!is_freed) {
+ val += *data;
+ } else {
+ val += 37;
+ }
+ }
+ if(i == 10) {
+ do_free = true;
+ }
+ }
+
+ printf("%i\n", val);
+}
+
+#ifndef NO_MAIN
+int main() {
+#ifdef NO_BUG
+ mem_leak_for(10);
+#else
+ mem_leak_for(9);
+#endif
+
+ return 1;
+}
+#endif
diff --git a/bench-moerman2018/memory/leak/09_loop_for_complex.c b/bench-moerman2018/memory/leak/09_loop_for_complex.c
new file mode 100644
index 000000000..4e4e066b7
--- /dev/null
+++ b/bench-moerman2018/memory/leak/09_loop_for_complex.c
@@ -0,0 +1,61 @@
+#include <stdio.h>
+#include <stdlib.h>
+#include "memory_leak.h"
+
+void mem_leak_for_complex(int x) {
+ int* data;
+ int val = 0;
+ bool do_free = false;
+ bool is_freed = true;
+ int i = 0;
+
+#ifdef CATCH_BAD_PARAM
+ if(x < 10) {
+ return;
+ }
+#endif
+
+ for(;;) {
+ if(i > x && is_freed) {
+ data = malloc(5*sizeof(int));
+ if(!data) {
+ return;
+ }
+ *data = i;
+ val += *data * 2;
+ if(do_free) {
+ free(data);
+ is_freed = true;
+ } else {
+ is_freed = false;
+ }
+ } else {
+ if(!is_freed) {
+ val += *data;
+ } else {
+ val += 37;
+ }
+ }
+ if(i == 10) {
+ do_free = true;
+ }
+ i++;
+ if(i >= 20) {
+ break;
+ }
+ }
+
+ printf("%i\n", val);
+}
+
+#ifndef NO_MAIN
+int main() {
+#ifdef NO_BUG
+ mem_leak_for_complex(10);
+#else
+ mem_leak_for_complex(9);
+#endif
+
+ return 1;
+}
+#endif
diff --git a/bench-moerman2018/memory/leak/10_loop_while_continue.c b/bench-moerman2018/memory/leak/10_loop_while_continue.c
new file mode 100644
index 000000000..97f6e9ad7
--- /dev/null
+++ b/bench-moerman2018/memory/leak/10_loop_while_continue.c
@@ -0,0 +1,62 @@
+#include <stdio.h>
+#include <stdlib.h>
+#include "memory_leak.h"
+
+void mem_leak_while_continue(int x) {
+ int* data;
+ int val = 0;
+ bool do_free = false;
+ bool is_freed = true;
+ int i = 0;
+
+#ifdef CATCH_BAD_PARAM
+ if(x < 10) {
+ return;
+ }
+#endif
+
+ while(i < 30) {
+ if(i == 9) {
+ i++;
+ continue;
+ }
+ if(i > x && is_freed) {
+ data = malloc(5*sizeof(int));
+ if(!data) {
+ return;
+ }
+ *data = i;
+ val += *data * 2;
+ if(do_free) {
+ free(data);
+ is_freed = true;
+ } else {
+ is_freed = false;
+ }
+ } else {
+ if(!is_freed) {
+ val += *data;
+ } else {
+ val += 37;
+ }
+ }
+ if(i == 10) {
+ do_free = true;
+ }
+ i++;
+ }
+
+ printf("%i\n", val);
+}
+
+#ifndef NO_MAIN
+int main() {
+#ifdef NO_BUG
+ mem_leak_while_continue(10);
+#else
+ mem_leak_while_continue(9);
+#endif
+
+ return 1;
+}
+#endif
diff --git a/bench-moerman2018/memory/leak/11_loop_while_do_continue.c b/bench-moerman2018/memory/leak/11_loop_while_do_continue.c
new file mode 100644
index 000000000..36e74d49a
--- /dev/null
+++ b/bench-moerman2018/memory/leak/11_loop_while_do_continue.c
@@ -0,0 +1,62 @@
+#include <stdio.h>
+#include <stdlib.h>
+#include "memory_leak.h"
+
+void mem_leak_do_while_continue(int x) {
+ int* data;
+ int val = 0;
+ bool do_free = false;
+ bool is_freed = true;
+ int i = 0;
+
+#ifdef CATCH_BAD_PARAM
+ if(x < 10) {
+ return;
+ }
+#endif
+
+ do {
+ if(i == 8) {
+ i++;
+ continue;
+ }
+ if(i > x && is_freed) {
+ data = malloc(5*sizeof(int));
+ if(!data) {
+ return;
+ }
+ *data = i;
+ val += *data * 2;
+ if(do_free) {
+ free(data);
+ is_freed = true;
+ } else {
+ is_freed = false;
+ }
+ } else {
+ if(!is_freed) {
+ val += *data;
+ } else {
+ val += 37;
+ }
+ }
+ if(i == 10) {
+ do_free = true;
+ }
+ i++;
+ } while(i < 30);
+
+ printf("%i\n", val);
+}
+
+#ifndef NO_MAIN
+int main() {
+#ifdef NO_BUG
+ mem_leak_do_while_continue(10);
+#else
+ mem_leak_do_while_continue(9);
+#endif
+
+ return 1;
+}
+#endif
diff --git a/bench-moerman2018/memory/leak/12_loop_for_array_branching.c b/bench-moerman2018/memory/leak/12_loop_for_array_branching.c
new file mode 100644
index 000000000..f40bf926f
--- /dev/null
+++ b/bench-moerman2018/memory/leak/12_loop_for_array_branching.c
@@ -0,0 +1,56 @@
+#include <stdio.h>
+#include <stdlib.h>
+#include <stdbool.h>
+#include "memory_leak.h"
+
+void mem_leak_for_array(int x) {
+ int* data = 0;
+ int p[20];
+ int val = 0;
+ bool do_free = true;
+ int i;
+
+#ifdef CATCH_BAD_PARAM
+ if(x != 19) {
+ return;
+ }
+#endif
+
+ for(i = 0; i < 20; i++) {
+ p[i] = 0;
+ }
+ p[x] = 1;
+
+ for(i = 0; i < 20; i++) {
+ if(p[i] == 1) {
+ do_free = false;
+ } else {
+ if(!data) data = malloc(sizeof(int));
+
+ if(!data) {
+ return;
+ }
+
+ *data = 27;
+ val += *data + i;
+ if(do_free) {
+ free(data);
+ data = 0;
+ }
+ }
+ }
+
+ printf("%i\n", val);
+}
+
+#ifndef NO_MAIN
+int main() {
+#ifdef NO_BUG
+ mem_leak_for_array(19);
+#else
+ mem_leak_for_array(10);
+#endif
+
+ return 1;
+}
+#endif
diff --git a/bench-moerman2018/memory/leak/13_loop_for_pointer_arithmetic.c b/bench-moerman2018/memory/leak/13_loop_for_pointer_arithmetic.c
new file mode 100644
index 000000000..5a9bd9e8a
--- /dev/null
+++ b/bench-moerman2018/memory/leak/13_loop_for_pointer_arithmetic.c
@@ -0,0 +1,60 @@
+#include <stdlib.h>
+#include <stdio.h>
+#include "memory_leak.h"
+
+static void initialize_array(int* ptr_arr[], int length) {
+ int i;
+ int** ptr = ptr_arr;
+
+ for(i = 0; i < length; i++, ptr++) {
+ *ptr = malloc(sizeof(int));
+ if(*ptr) **ptr = i;
+ }
+}
+
+static void free_array(int* ptr_arr[], int length) {
+ int i;
+ int** ptr = ptr_arr;
+
+ for(i = 0; i < length; i++, ptr++) {
+ if(*ptr) free(*ptr);
+ }
+}
+
+void mem_leak_for_pointer(int x) {
+ int* pointers[10];
+ int** ptr;
+ int source[10];
+ int val = 0, i;
+
+#ifdef CATCH_BAD_PARAM
+ if(x != 10) {
+ return;
+ }
+#endif
+
+ initialize_array(pointers, 10);
+ ptr = pointers;
+ for(int i = 0; i < 10; i++, ptr++) {
+ if(*ptr) {
+ val += **ptr;
+ } else {
+ val--;
+ }
+ }
+
+ free_array(pointers, x);
+ printf("%i\n", val);
+}
+
+#ifndef NO_MAIN
+int main() {
+#ifdef NO_BUG
+ mem_leak_for_pointer(10);
+#else
+ mem_leak_for_pointer(9);
+#endif
+
+ return 1;
+}
+#endif
diff --git a/bench-moerman2018/memory/leak/14_loop_recursion.c b/bench-moerman2018/memory/leak/14_loop_recursion.c
new file mode 100644
index 000000000..d118101f7
--- /dev/null
+++ b/bench-moerman2018/memory/leak/14_loop_recursion.c
@@ -0,0 +1,53 @@
+#include <stdio.h>
+#include <stdbool.h>
+#include <stdlib.h>
+#include "memory_leak.h"
+
+int mem_leak_rec(int x, int i, int* data, bool do_free) {
+ int val;
+
+ if(i <= 1) {
+ return 0;
+ }
+
+#ifdef CATCH_BAD_PARAM
+ if(!do_free && (x > 10 || i < 10)) {
+ return -1;
+ }
+#endif
+
+ if(i < x) {
+ if(!data) data = malloc(sizeof(int));
+ if(!data) return -1;
+ *data = i;
+ val = *data;
+ if(do_free) {
+ free(data);
+ data = 0;
+ }
+ } else {
+ if(data) {
+ val = *data / 2;
+ } else {
+ val = 8;
+ }
+ }
+ if(i == 10) {
+ do_free = true;
+ }
+
+ return val + mem_leak_rec(x, i-1, data, do_free);
+}
+
+#ifndef NO_MAIN
+int main() {
+#ifdef NO_BUG
+ printf("%i\n", mem_leak_rec(10, 20, 0, false));
+ printf("%i\n", mem_leak_rec(11, 20, 0, true));
+#else
+ printf("%i\n", mem_leak_rec(11, 20, 0, false));
+#endif
+
+ return 1;
+}
+#endif
diff --git a/bench-moerman2018/memory/leak/15_loop_recursion_multi.c b/bench-moerman2018/memory/leak/15_loop_recursion_multi.c
new file mode 100644
index 000000000..f02014edf
--- /dev/null
+++ b/bench-moerman2018/memory/leak/15_loop_recursion_multi.c
@@ -0,0 +1,61 @@
+#include <stdio.h>
+#include <stdbool.h>
+#include <stdlib.h>
+#include "memory_leak.h"
+
+int mem_leak_rec_decr(int x, int i, int* data, bool do_free) {
+ if(i <= 1) {
+ return 0;
+ }
+
+ return mem_leak_rec_multi(x, i-1, data, do_free);
+}
+
+int mem_leak_rec_multi(int x, int i, int* data, bool do_free) {
+ int val;
+
+ if(i <= 1) {
+ return 0;
+ }
+
+#ifdef CATCH_BAD_PARAM
+ if(!do_free && (x > 10 || i < 10)) {
+ return -1;
+ }
+#endif
+
+ if(i < x) {
+ if(!data) data = malloc(sizeof(int));
+ if(!data) return -1;
+ *data = i;
+ val = *data;
+ if(do_free) {
+ free(data);
+ data = 0;
+ }
+ } else {
+ if(data) {
+ val = *data / 2;
+ } else {
+ val = 8;
+ }
+ }
+ if(i == 10) {
+ do_free = true;
+ }
+
+ return val + mem_leak_rec_decr(x, i, data, do_free);
+}
+
+#ifndef NO_MAIN
+int main() {
+#ifdef NO_BUG
+ printf("%i\n", mem_leak_rec_multi(10, 20, 0, false));
+ printf("%i\n", mem_leak_rec_multi(11, 20, 0, true));
+#else
+ printf("%i\n", mem_leak_rec_multi(11, 20, 0, false));
+#endif
+
+ return 1;
+}
+#endif
diff --git a/bench-moerman2018/memory/leak/16_misc_pseudo_recursion.c b/bench-moerman2018/memory/leak/16_misc_pseudo_recursion.c
new file mode 100644
index 000000000..14c004d98
--- /dev/null
+++ b/bench-moerman2018/memory/leak/16_misc_pseudo_recursion.c
@@ -0,0 +1,78 @@
+#include <stdio.h>
+#include <stdlib.h>
+#include "memory_leak.h"
+
+int mem_leak_pseudo_rec1(int x, int y, int i, int** data_ptr) {
+ int data_value;
+
+ if(!*data_ptr) {
+ *data_ptr = malloc(sizeof(int));
+ if(!*data_ptr) {
+ return -1;
+ }
+ **data_ptr = -37;
+ }
+
+ data_value = **data_ptr;
+#ifdef CATCH_BAD_PARAM
+ if(x >= y && x < 10) {
+ free(*data_ptr);
+ return -1;
+ }
+#endif
+
+ if(i > 0) {
+ free(*data_ptr);
+ return 37;
+ }
+
+ if(x < y) {
+ free(*data_ptr);
+ *data_ptr = 0;
+ } else {
+ (**data_ptr)++;
+ }
+
+ return data_value + mem_leak_pseudo_rec2(x, y, 1, data_ptr);
+}
+
+int mem_leak_pseudo_rec2(int x, int y, int i, int** data_ptr) {
+ int val = 78;
+ if(i <= 0) {
+ return 5 + mem_leak_pseudo_rec1(x, y, 1, data_ptr);
+ }
+
+ if(x < 10) {
+ val += 2;
+ } else {
+ if(*data_ptr) {
+ val -= **data_ptr;
+ free(*data_ptr);
+ *data_ptr = 0;
+ }
+ }
+ return val;
+}
+
+#ifndef NO_MAIN
+int main() {
+ int* data = malloc(sizeof(int));
+ if(!data) {
+ return -1;
+ }
+ *data = 35;
+#ifdef NO_BUG
+ printf("%i\n", mem_leak_pseudo_rec1(9, 10, 0, &data));
+ data = malloc(sizeof(int));
+ if(!data) {
+ return -1;
+ }
+ *data = 35;
+ printf("%i\n", mem_leak_pseudo_rec1(11, 10, 0, &data));
+#else
+ printf("%i\n", mem_leak_pseudo_rec1(9, 8, 0, &data));
+#endif
+
+ return 1;
+}
+#endif
diff --git a/bench-moerman2018/memory/leak/17_complex_function_pointers.c b/bench-moerman2018/memory/leak/17_complex_function_pointers.c
new file mode 100644
index 000000000..dcb924aa6
--- /dev/null
+++ b/bench-moerman2018/memory/leak/17_complex_function_pointers.c
@@ -0,0 +1,54 @@
+#include <stdio.h>
+#include <stdbool.h>
+#include <stdlib.h>
+#include "memory_leak.h"
+
+static void assign_possibly_freed(int** dest, bool free_data) {
+ int* data = malloc(5*sizeof(int));
+ *dest = data;
+ if(!data) {
+ return;
+ }
+ if(free_data) {
+ free(data);
+ } else {
+ *data = 67982;
+ }
+}
+
+void mem_leak_function_pointer(bool a, bool b, void (*f)(int** dest, bool free_data)) {
+ int* data;
+ int val = 0;
+
+#ifdef CATCH_BAD_PARAM
+ if(!f || (!a & !b)) {
+ return;
+ }
+#endif
+
+ (*f)(&data, a);
+ if(b && !a && data) {
+ val = *data;
+ free(data);
+ } else {
+ val = 687;
+ }
+
+ printf("%i\n", val);
+}
+
+#ifndef NO_MAIN
+int main() {
+#ifdef NO_BUG
+ mem_leak_function_pointer(true, true, &assign_possibly_freed);
+ mem_leak_function_pointer(true, false, &assign_possibly_freed);
+ mem_leak_function_pointer(false, true, &assign_possibly_freed);
+#else
+ mem_leak_function_pointer(true, true, &assign_possibly_freed); /* OK */
+ mem_leak_function_pointer(false, false, &assign_possibly_freed); /* DANGER */
+ mem_leak_function_pointer(false, true, &assign_possibly_freed); /* OK */
+#endif
+
+ return 1;
+}
+#endif
diff --git a/bench-moerman2018/memory/leak/18_complex_struct_multiple_methods.c b/bench-moerman2018/memory/leak/18_complex_struct_multiple_methods.c
new file mode 100644
index 000000000..ffe2afb71
--- /dev/null
+++ b/bench-moerman2018/memory/leak/18_complex_struct_multiple_methods.c
@@ -0,0 +1,95 @@
+#include <stdio.h>
+#include <stdlib.h>
+#include "memory_leak.h"
+
+#ifndef s_MEMORY_L_REFCOUNT
+#define s_MEMORY_L_REFCOUNT
+void mem_leak_cont_init(LRefCont* cont) {
+ cont->refc = 1;
+ cont->data = 0;
+}
+
+LRefCont* mem_leak_cont_new() {
+ LRefCont* new_cont;
+
+ new_cont = malloc(sizeof(LRefCont));
+
+ if(new_cont) {
+ mem_leak_cont_init(new_cont);
+ }
+ return new_cont;
+}
+
+void mem_leak_cont_ref(LRefCont* cont) {
+ if(cont) {
+ cont->refc++;
+ }
+}
+void mem_leak_cont_unref(LRefCont* cont) {
+ if(cont->refc <= 1) {
+ free(cont);
+ } else {
+ cont->refc--;
+ }
+}
+
+void* mem_leak_cont_get_pointer(LRefCont* cont) {
+ return cont->data;
+}
+void mem_leak_cont_set_pointer(LRefCont* cont, void* p) {
+ cont->data = p;
+}
+#endif //s_MEMORY_L_REFCOUNT
+
+void mem_leak_struct(int x, int y) {
+ LRefCont cont;
+ int* data;
+ int val = 78;
+
+#ifdef CATCH_BAD_PARAM
+ if(x > 10 && x <= y) {
+ return;
+ }
+#endif
+
+ data = malloc(sizeof(int));
+
+ if(!data) {
+ return;
+ }
+
+ mem_leak_cont_init(&cont);
+ mem_leak_cont_set_pointer(&cont, data);
+
+ *data = 37;
+
+ if(x > y) {
+ free(data);
+ data = 0;
+ }
+
+ if(x <= 10) {
+ if(data) {
+ val = *data;
+ free(mem_leak_cont_get_pointer(&cont));
+ }
+ } else {
+ val = val * 2;
+ }
+
+ printf("%i\n", val);
+}
+
+#ifndef NO_MAIN
+int main() {
+#ifdef NO_BUG
+ mem_leak_struct(9, 10);
+ mem_leak_struct(10, 11);
+ mem_leak_struct(11, 10);
+#else
+ mem_leak_struct(11, 11); /* DANGER */
+#endif
+
+ return 1;
+}
+#endif
diff --git a/bench-moerman2018/memory/leak/19_complex_refcount.c b/bench-moerman2018/memory/leak/19_complex_refcount.c
new file mode 100644
index 000000000..b8073e20c
--- /dev/null
+++ b/bench-moerman2018/memory/leak/19_complex_refcount.c
@@ -0,0 +1,69 @@
+#include "memory_leak.h"
+#include <stdlib.h>
+#include <stdio.h>
+
+#ifndef s_MEMORY_L_REFCOUNT
+#define s_MEMORY_L_REFCOUNT
+void mem_leak_cont_init(LRefCont* cont) {
+ cont->refc = 1;
+ cont->data = 0;
+}
+
+LRefCont* mem_leak_cont_new() {
+ LRefCont* new_cont;
+
+ new_cont = malloc(sizeof(LRefCont));
+
+ if(new_cont) {
+ mem_leak_cont_init(new_cont);
+ }
+ return new_cont;
+}
+
+void mem_leak_cont_ref(LRefCont* cont) {
+ if(cont) {
+ cont->refc++;
+ }
+}
+void mem_leak_cont_unref(LRefCont* cont) {
+ if(cont->refc <= 1) {
+ free(cont);
+ } else {
+ cont->refc--;
+ }
+}
+
+void* mem_leak_cont_get_pointer(LRefCont* cont) {
+ return cont->data;
+}
+void mem_leak_cont_set_pointer(LRefCont* cont, void* p) {
+ cont->data = p;
+}
+#endif //s_MEMORY_L_REFCOUNT
+
+#ifndef NO_MAIN
+int main() {
+ LRefCont* cont;
+ int arr[1] = {99};
+ int val;
+
+ cont = mem_leak_cont_new();
+ if(!cont) {
+ return 1;
+ }
+ mem_leak_cont_set_pointer(cont, arr);
+
+ mem_leak_cont_ref(cont);
+ mem_leak_cont_ref(cont);
+ mem_leak_cont_unref(cont);
+ mem_leak_cont_unref(cont);
+ val = *((int*) mem_leak_cont_get_pointer(cont));
+#ifdef NO_BUG
+ mem_leak_cont_unref(cont);
+#endif
+
+ printf("%i\n", val);
+
+ return 1;
+}
+#endif
diff --git a/bench-moerman2018/memory/leak/memory_leak.h b/bench-moerman2018/memory/leak/memory_leak.h
new file mode 100644
index 000000000..e71d13114
--- /dev/null
+++ b/bench-moerman2018/memory/leak/memory_leak.h
@@ -0,0 +1,36 @@
+#include <stdbool.h>
+
+typedef struct _MemLeakRefCont LRefCont;
+
+struct _MemLeakRefCont {
+ void* data;
+ unsigned int refc;
+};
+
+void mem_leak_cont_init(LRefCont* cont);
+LRefCont* mem_leak_cont_new();
+void mem_leak_cont_ref(LRefCont* cont);
+void mem_leak_cont_unref(LRefCont* cont);
+void* mem_leak_cont_get_pointer(LRefCont* cont);
+void mem_leak_cont_set_pointer(LRefCont* cont, void* p);
+
+void mem_leak_for(int x);
+void mem_leak_for_complex(int x);
+void mem_leak_while_continue(int x);
+void mem_leak_do_while_continue(int x);
+void mem_leak_for_array(int x);
+void mem_leak_for_pointer(int x);
+void mem_leak_goto(int x);
+void mem_leak_if_else(bool a, bool b);
+void mem_leak_if_else_multi(bool a, bool b);
+void mem_leak_if_else_int1(int x, int y);
+void mem_leak_if_else_int2(int x, int y);
+void mem_leak_pass_by_reference(bool a, bool b);
+int mem_leak_switch(int x, int y);
+int mem_leak_rec_multi(int x, int i, int* data_ptr, bool do_free);
+int mem_leak_rec(int x, int i, int* data_ptr, bool do_free);
+int mem_leak_pseudo_rec1(int x, int y, int i, int** data_ptr);
+int mem_leak_pseudo_rec2(int x, int y, int i, int** data_ptr);
+void mem_leak_struct(int x, int y);
+void mem_leak_function_pointer(bool a, bool b, void (*f)(int** dest, bool free_data));
+void mem_leak_cross_file(bool a, bool b);
diff --git a/bench-moerman2018/memory/refer_free/01_simple_if.c b/bench-moerman2018/memory/refer_free/01_simple_if.c
new file mode 100644
index 000000000..fc7a049f6
--- /dev/null
+++ b/bench-moerman2018/memory/refer_free/01_simple_if.c
@@ -0,0 +1,57 @@
+#include <stdio.h>
+#include <stdlib.h>
+#include <stdbool.h>
+#include "refer_free.h"
+
+void refer_free_if_else(bool a, bool b) {
+ int* data;
+ int val;
+
+#ifdef CATCH_BAD_PARAM
+ if(!a & !b) {
+ return;
+ }
+#endif
+
+ data = malloc(5*sizeof(int));
+
+ if(!data) {
+ return;
+ }
+
+ *data = 27;
+
+ if(!a) {
+ free(data);
+ } else {
+ (*data)++;
+ }
+
+ if(b) {
+ val = 37;
+ } else {
+ val = *data; /* DANGER, if !a & !b */
+ }
+
+ if(a) {
+ free(data);
+ }
+
+ printf("%i\n", val);
+}
+
+#ifndef NO_MAIN
+int main() {
+#ifdef NO_BUG
+ refer_free_if_else(true, true);
+ refer_free_if_else(true, false);
+ refer_free_if_else(false, true);
+#else
+ refer_free_if_else(true, true); /* OK */
+ refer_free_if_else(false, false); /* DANGER */
+ refer_free_if_else(false, true); /* OK */
+#endif
+
+ return 1;
+}
+#endif
diff --git a/bench-moerman2018/memory/refer_free/02_simple_if_int1.c b/bench-moerman2018/memory/refer_free/02_simple_if_int1.c
new file mode 100644
index 000000000..11a3acbf2
--- /dev/null
+++ b/bench-moerman2018/memory/refer_free/02_simple_if_int1.c
@@ -0,0 +1,56 @@
+#include <stdio.h>
+#include <stdlib.h>
+#include "refer_free.h"
+
+void refer_free_if_else_int1(int x, int y) {
+ int val;
+ int* data;
+
+#ifdef CATCH_BAD_PARAM
+ if(x > 10 && x < y) {
+ return;
+ }
+#endif
+
+ data = malloc(5*sizeof(int));
+
+ if(!data) {
+ return;
+ }
+
+ *data = 27;
+
+ if(x > 10) {
+ free(data);
+ } else {
+ data[3] = -4;
+ }
+
+ if(x >= y) {
+ val = 78;
+ } else {
+ val = *data; /* DANGER, if x <= 10 & x >= y */
+ }
+
+ if(x <= 10) {
+ free(data);
+ }
+
+ printf("%i\n", val);
+}
+
+#ifndef NO_MAIN
+int main() {
+#ifdef NO_BUG
+ refer_free_if_else_int1(10, 10);
+ refer_free_if_else_int1(10, 11);
+ refer_free_if_else_int1(11, 11);
+#else
+ refer_free_if_else_int1(10, 10); /* OK */
+ refer_free_if_else_int1(11, 12); /* DANGER */
+ refer_free_if_else_int1(11, 11); /* OK */
+#endif
+
+ return 1;
+}
+#endif
diff --git a/bench-moerman2018/memory/refer_free/02_simple_if_int2.c b/bench-moerman2018/memory/refer_free/02_simple_if_int2.c
new file mode 100644
index 000000000..512ac62dc
--- /dev/null
+++ b/bench-moerman2018/memory/refer_free/02_simple_if_int2.c
@@ -0,0 +1,61 @@
+#include <stdio.h>
+#include <stdlib.h>
+#include "refer_free.h"
+
+void refer_free_if_else_int2(int x, int y) {
+ int* data;
+ int val, m, n;
+
+ m = -1;
+ n = 5;
+
+ x = x*m+n;
+
+#ifdef CATCH_BAD_PARAM
+ if(x > 10 && x < y) {
+ return;
+ }
+#endif
+
+ data = malloc(5*sizeof(int));
+
+ if(!data) {
+ return;
+ }
+
+ *data = 27;
+
+ if(x > 10) {
+ free(data);
+ } else {
+ data[3] = -4;
+ }
+
+ if(x >= y) {
+ val = 78;
+ } else {
+ val = *data; /* DANGER, if x <= 10 & x >= y */
+ }
+
+ if(x <= 10) {
+ free(data);
+ }
+
+ printf("%i\n", val);
+}
+
+#ifndef NO_MAIN
+int main() {
+#ifdef NO_BUG
+ refer_free_if_else_int2(-5, 10);
+ refer_free_if_else_int2(-5, 11);
+ refer_free_if_else_int2(-6, 11);
+#else
+ refer_free_if_else_int2(-5, 10); /* OK */
+ refer_free_if_else_int2(-6, 12); /* DANGER */
+ refer_free_if_else_int2(-6, 11); /* OK */
+#endif
+
+ return 1;
+}
+#endif
diff --git a/bench-moerman2018/memory/refer_free/03_simple_if_multi_func.c b/bench-moerman2018/memory/refer_free/03_simple_if_multi_func.c
new file mode 100644
index 000000000..a1ecd858c
--- /dev/null
+++ b/bench-moerman2018/memory/refer_free/03_simple_if_multi_func.c
@@ -0,0 +1,57 @@
+#include "refer_free.h"
+#include <stdbool.h>
+#include <stdlib.h>
+#include <stdio.h>
+
+static void local_conditional_free(int** ptr, bool condition) {
+ if(condition) {
+ free(*ptr);
+ }
+}
+
+static int conditional_dereference(int** ptr, int def, bool condition) {
+ if(condition) {
+ return **ptr;
+ }
+ return def;
+}
+
+void refer_free_if_else_multi(bool a, bool b) {
+ int val;
+ int* data;
+ int** data_ptr = &data;
+
+#ifdef CATCH_BAD_PARAM
+ if(!a & !b) {
+ return;
+ }
+#endif
+ data = malloc(5*sizeof(int));
+
+ if(!data) {
+ return;
+ }
+
+ *data = 27;
+
+ local_conditional_free(data_ptr, !a);
+ val = conditional_dereference(data_ptr, 8, !b); /* DANGER, if !a & !b */
+ local_conditional_free(data_ptr, a);
+
+ printf("%i\n", val);
+}
+
+#ifndef NO_MAIN
+int main() {
+#ifdef NO_BUG
+ refer_free_if_else_multi(true, true);
+ refer_free_if_else_multi(true, false);
+ refer_free_if_else_multi(false, true);
+#else
+ refer_free_if_else_multi(true, true); /* OK */
+ refer_free_if_else_multi(false, false); /* DANGER */
+ refer_free_if_else_multi(false, true); /* OK */
+#endif
+ return 1;
+}
+#endif
diff --git a/bench-moerman2018/memory/refer_free/04_simple_switch.c b/bench-moerman2018/memory/refer_free/04_simple_switch.c
new file mode 100644
index 000000000..a6e687008
--- /dev/null
+++ b/bench-moerman2018/memory/refer_free/04_simple_switch.c
@@ -0,0 +1,71 @@
+#include "refer_free.h"
+#include <stdlib.h>
+
+int refer_free_switch(int x, int y) {
+ int* data;
+ int val;
+
+#ifdef CATCH_BAD_PARAM
+ if((x == 10 || x == 5) && x > y) {
+ return -1;
+ }
+#endif
+ data = malloc(5*sizeof(int));
+
+ if(!data) {
+ return -1;
+ }
+
+ *data = -1;
+
+ if(x > y) {
+ free(data);
+ }
+
+ switch (x) {
+ case 5: {
+ val = *data; /* DANGER: x >= y */
+ break;
+ }
+ case 7: {
+ val = 289;
+ break;
+ }
+ case 10: {
+ val = *data + 36; /* DANGER: x >= y */
+ break;
+ }
+ case 12: {
+ val = 49807;
+ break;
+ }
+ default: {
+ val = 7987;
+ break;
+ }
+ }
+
+ if(x <= y) {
+ free(data);
+ }
+
+ return val;
+}
+
+#ifndef NO_MAIN
+int main() {
+#ifdef NO_BUG
+ refer_free_switch(5, 11);
+ refer_free_switch(10, 11);
+ refer_free_switch(11, 10);
+ refer_free_switch(7, 5);
+#else
+ refer_free_switch(5, 10); /* OK */
+ refer_free_switch(10, 9); /* DANGER */
+ refer_free_switch(11, 10); /* OK */
+ refer_free_switch(7, 5); /* OK */
+#endif
+
+ return 1;
+}
+#endif
diff --git a/bench-moerman2018/memory/refer_free/05_simple_goto.c b/bench-moerman2018/memory/refer_free/05_simple_goto.c
new file mode 100644
index 000000000..5ae81841f
--- /dev/null
+++ b/bench-moerman2018/memory/refer_free/05_simple_goto.c
@@ -0,0 +1,48 @@
+#include <stdio.h>
+#include <stdlib.h>
+#include "refer_free.h"
+
+void refer_free_goto(int x) {
+ int* data;
+ int val;
+ int i = 0;
+
+#ifdef CATCH_BAD_PARAM
+ if(x > 0) {
+ return;
+ }
+#endif
+
+ data = malloc(5*sizeof(int));
+
+ if(!data) {
+ return;
+ }
+
+ *data = 7698;
+
+GOTO_LABEL:
+ if(i <= x) {
+ val = *data;
+ } else {
+ printf("%i\n", val);
+ }
+
+ if(i == 0) {
+ i++;
+ free(data);
+ goto GOTO_LABEL;
+ }
+}
+
+#ifndef NO_MAIN
+int main() {
+#ifdef NO_BUG
+ refer_free_goto(0);
+#else
+ refer_free_goto(1);
+#endif
+
+ return 1;
+}
+#endif
diff --git a/bench-moerman2018/memory/refer_free/06_simple_pass_by_reference.c b/bench-moerman2018/memory/refer_free/06_simple_pass_by_reference.c
new file mode 100644
index 000000000..4dbac6877
--- /dev/null
+++ b/bench-moerman2018/memory/refer_free/06_simple_pass_by_reference.c
@@ -0,0 +1,58 @@
+#include <stdio.h>
+#include <stdlib.h>
+#include <stdbool.h>
+#include "refer_free.h"
+
+static void assign_possibly_freed(int** dest, bool free_data) {
+ int* data = malloc(5*sizeof(int));
+ *dest = data;
+ if(!data) {
+ return;
+ }
+ *data = 6;
+ if(free_data) {
+ free(data);
+ }
+}
+
+void refer_free_pass_by_reference(bool a, bool b) {
+ int* data;
+ int val = -1;
+
+#ifdef CATCH_BAD_PARAM
+ if(!a & !b) {
+ return;
+ }
+#endif
+
+ assign_possibly_freed(&data, !a);
+ if(b) {
+ val = 687;
+ } else {
+ if(data) {
+ val = *data; /* DANGER, if !a & !b */
+ }
+ }
+
+ if(a && data) {
+ free(data);
+ }
+
+ printf("%i\n", val);
+}
+
+#ifndef NO_MAIN
+int main() {
+#ifdef NO_BUG
+ refer_free_pass_by_reference(true, true);
+ refer_free_pass_by_reference(true, false);
+ refer_free_pass_by_reference(false, true);
+#else
+ refer_free_pass_by_reference(true, true); /* OK */
+ refer_free_pass_by_reference(false, false); /* DANGER */
+ refer_free_pass_by_reference(false, true); /* OK */
+#endif
+
+ return 1;
+}
+#endif
diff --git a/bench-moerman2018/memory/refer_free/07_cross_file.c b/bench-moerman2018/memory/refer_free/07_cross_file.c
new file mode 100644
index 000000000..f823aba15
--- /dev/null
+++ b/bench-moerman2018/memory/refer_free/07_cross_file.c
@@ -0,0 +1,50 @@
+#include "refer_free.h"
+#include "common.h"
+#include <stdbool.h>
+#include <stdio.h>
+#include <stdlib.h>
+
+void refer_free_cross_file(bool a, bool b) {
+ int val;
+ int* data;
+
+#ifdef CATCH_BAD_PARAM
+ if(!a & !b) {
+ return;
+ }
+#endif
+ data = malloc(5*sizeof(int));
+
+ if(!data) {
+ return;
+ }
+
+ conditional_free((void*) data, !a, 0);
+
+ if(b) {
+ val = 678;
+ } else {
+ val = *data; /* DANGER, if !a & !b */
+ }
+
+ if(a) {
+ free(data);
+ }
+
+ printf("%i\n", val);
+}
+
+#ifndef NO_MAIN
+int main() {
+#ifdef NO_BUG
+ refer_free_cross_file(true, true);
+ refer_free_cross_file(true, false);
+ refer_free_cross_file(false, true);
+#else
+ refer_free_cross_file(true, true); /* OK */
+ refer_free_cross_file(false, false); /* DANGER */
+ refer_free_cross_file(false, true); /* OK */
+#endif
+ return 1;
+}
+#endif
diff --git a/bench-moerman2018/memory/refer_free/08_loop_for.c b/bench-moerman2018/memory/refer_free/08_loop_for.c
new file mode 100644
index 000000000..1cb216a7e
--- /dev/null
+++ b/bench-moerman2018/memory/refer_free/08_loop_for.c
@@ -0,0 +1,56 @@
+#include <stdio.h>
+#include <stdbool.h>
+#include <stdlib.h>
+#include "refer_free.h"
+
+void refer_free_for(int x) {
+ int* data;
+ int val = 0;
+ int i;
+
+#ifdef CATCH_BAD_PARAM
+ if(x < 10) {
+ return;
+ }
+#endif
+ data = malloc(5*sizeof(int));
+
+ if(!data) {
+ return;
+ }
+
+ *data = 9;
+
+ free(data);
+
+ for(i = 0; i < 20; i++) {
+ if(i > x) {
+ val += *data;
+ } else {
+ val += 37;
+ }
+ if(i == 10) {
+ data = malloc(5*sizeof(int));
+ if(!data) {
+ return;
+ }
+ *data = 9;
+ }
+ }
+
+ free(data);
+
+ printf("%i\n", val);
+}
+
+#ifndef NO_MAIN
+int main() {
+#ifdef NO_BUG
+ refer_free_for(10);
+#else
+ refer_free_for(9);
+#endif
+
+ return 1;
+}
+#endif
diff --git a/bench-moerman2018/memory/refer_free/09_loop_for_complex.c b/bench-moerman2018/memory/refer_free/09_loop_for_complex.c
new file mode 100644
index 000000000..356ebcd33
--- /dev/null
+++ b/bench-moerman2018/memory/refer_free/09_loop_for_complex.c
@@ -0,0 +1,57 @@
+#include <stdio.h>
+#include <stdlib.h>
+#include "refer_free.h"
+
+void refer_free_for_complex(int x) {
+ int* data;
+ int val = 0;
+ int i = 0;
+
+#ifdef CATCH_BAD_PARAM
+ if(x < 10) {
+ return;
+ }
+#endif
+ data = malloc(5*sizeof(int));
+
+ if(!data) {
+ return;
+ }
+
+ free(data);
+
+ for(;;) {
+ if(i > x) {
+ val += *data; /* Dangerous if x < 10 */
+ } else {
+ val += 37;
+ }
+ if(i == 10) {
+ data = malloc(5*sizeof(int));
+ if(!data) {
+ return;
+ }
+ *data = 9;
+ }
+ i++;
+ if(i >= 20) {
+ break;
+ }
+ }
+
+ free(data);
+
+ printf("%i\n", val);
+}
+
+#ifndef NO_MAIN
+int main() {
+#ifdef NO_BUG
+ refer_free_for_complex(10);
+#else
+ refer_free_for_complex(9);
+#endif
+
+ return 1;
+}
+#endif
diff --git a/bench-moerman2018/memory/refer_free/10_loop_while_continue.c b/bench-moerman2018/memory/refer_free/10_loop_while_continue.c
new file mode 100644
index 000000000..40e0c1544
--- /dev/null
+++ b/bench-moerman2018/memory/refer_free/10_loop_while_continue.c
@@ -0,0 +1,58 @@
+#include <stdio.h>
+#include <stdlib.h>
+#include "refer_free.h"
+
+void refer_free_while_continue(int x) {
+ int* data;
+ int val = 0;
+ int i = 0;
+
+#ifdef CATCH_BAD_PARAM
+ if(x < 10 && x != 8) {
+ return;
+ }
+#endif
+ data = malloc(5*sizeof(int));
+
+ if(!data) {
+ return;
+ }
+
+ free(data);
+
+ while(i < 30) {
+ if(i == 9) {
+ i++;
+ continue;
+ }
+ if(i > x) {
+ val += *data; /* Dangerous if x < 10 */
+ } else {
+ val += 37;
+ }
+ if(i == 10) {
+ data = malloc(5*sizeof(int));
+ if(!data) {
+ return;
+ }
+ *data = 9;
+ }
+ i++;
+ }
+
+ free(data);
+
+ printf("%i\n", val);
+}
+
+#ifndef NO_MAIN
+int main() {
+#ifdef NO_BUG
+ refer_free_while_continue(10);
+#else
+ refer_free_while_continue(9);
+#endif
+
+ return 1;
+}
+#endif
diff --git a/bench-moerman2018/memory/refer_free/11_loop_while_do_continue.c b/bench-moerman2018/memory/refer_free/11_loop_while_do_continue.c
new file mode 100644
index 000000000..c4ec94d8e
--- /dev/null
+++ b/bench-moerman2018/memory/refer_free/11_loop_while_do_continue.c
@@ -0,0 +1,58 @@
+#include <stdio.h>
+#include <stdlib.h>
+#include "refer_free.h"
+
+void refer_free_do_while_continue(int x) {
+ int* data;
+ int val = 0;
+ int i = 0;
+
+#ifdef CATCH_BAD_PARAM
+ if(x < 10 && x != 8) {
+ return;
+ }
+#endif
+ data = malloc(5*sizeof(int));
+
+ if(!data) {
+ return;
+ }
+
+ free(data);
+
+ do {
+ if(i == 8) {
+ i++;
+ continue;
+ }
+ if(i > x) {
+ val += *data; /* Dangerous if x < 10 */
+ } else {
+ val += 37;
+ }
+ if(i == 10) {
+ data = malloc(5*sizeof(int));
+ if(!data) {
+ return;
+ }
+ *data = 9;
+ }
+ i++;
+ } while(i < 30);
+
+ free(data);
+
+ printf("%i\n", val);
+}
+
+#ifndef NO_MAIN
+int main() {
+#ifdef NO_BUG
+ refer_free_do_while_continue(10);
+#else
+ refer_free_do_while_continue(9);
+#endif
+
+ return 1;
+}
+#endif
diff --git a/bench-moerman2018/memory/refer_free/12_loop_for_array_branching.c b/bench-moerman2018/memory/refer_free/12_loop_for_array_branching.c
new file mode 100644
index 000000000..612b069b8
--- /dev/null
+++ b/bench-moerman2018/memory/refer_free/12_loop_for_array_branching.c
@@ -0,0 +1,52 @@
+#include <stdio.h>
+#include <stdlib.h>
+#include "refer_free.h"
+
+void refer_free_for_array(int x) {
+ int* data;
+ int p[20];
+ int val = 0;
+ int i;
+
+#ifdef CATCH_BAD_PARAM
+ if(x != 19) {
+ return;
+ }
+#endif
+
+ data = malloc(sizeof(int));
+
+ if(!data) {
+ return;
+ }
+
+ *data = 27;
+
+ for(i = 0; i < 20; i++) {
+ p[i] = 0;
+ }
+ p[x] = 1;
+
+ for(i = 0; i < 20; i++) {
+ if(p[i] == 1) {
+ free(data);
+ } else {
+ val += *data; /* DANGER: x < 19 */
+ *data = i;
+ }
+ }
+
+ printf("%i\n", val);
+}
+
+#ifndef NO_MAIN
+int main() {
+#ifdef NO_BUG
+ refer_free_for_array(19);
+#else
+ refer_free_for_array(10);
+#endif
+
+ return 1;
+}
+#endif
diff --git a/bench-moerman2018/memory/refer_free/13_loop_for_pointer_arithmetic.c b/bench-moerman2018/memory/refer_free/13_loop_for_pointer_arithmetic.c
new file mode 100644
index 000000000..8fe0348a2
--- /dev/null
+++ b/bench-moerman2018/memory/refer_free/13_loop_for_pointer_arithmetic.c
@@ -0,0 +1,56 @@
+#include <stdlib.h>
+#include <stdio.h>
+#include "refer_free.h"
+
+static void initialize_array(int* ptr_arr[], int length) {
+ int i;
+
+ for(i = 0; i < length; i++) {
+ ptr_arr[i] = malloc(sizeof(int));
+ if(ptr_arr[i]) *ptr_arr[i] = i;
+ }
+}
+
+static void free_array(int* ptr_arr[], int length) {
+ int i;
+
+ for(i = 0; i < length; i++) {
+ if(ptr_arr[i]) free(ptr_arr[i]);
+ }
+}
+
+void refer_free_for_pointer(int x) {
+ int* pointers[10];
+ int** ptr;
+ int source[10];
+ int val = 0, i;
+
+#ifdef CATCH_BAD_PARAM
+ if(x != 10) {
+ return;
+ }
+#endif
+
+ initialize_array(pointers, 10);
+ free_array(pointers, 10);
+ initialize_array(pointers, x);
+ ptr = pointers;
+ for(int i = 0; i < 10; i++, ptr++) {
+ val += **ptr;
+ }
+
+ free_array(pointers, x);
+ printf("%i\n", val);
+}
+
+#ifndef NO_MAIN
+int main() {
+#ifdef NO_BUG
+ refer_free_for_pointer(10);
+#else
+ refer_free_for_pointer(9);
+#endif
+
+ return 1;
+}
+#endif
diff --git a/bench-moerman2018/memory/refer_free/14_loop_recursion.c b/bench-moerman2018/memory/refer_free/14_loop_recursion.c
new file mode 100644
index 000000000..53ce81b50
--- /dev/null
+++ b/bench-moerman2018/memory/refer_free/14_loop_recursion.c
@@ -0,0 +1,47 @@
+#include <stdio.h>
+#include <stdbool.h>
+#include <stdlib.h>
+#include "refer_free.h"
+
+int refer_free_rec(int x, int i, int** data_ptr) {
+ int val;
+
+#ifdef CATCH_BAD_PARAM
+ if(x < 9 && i >= 10) {
+ return -1;
+ }
+#endif
+
+ if(i <= 1) {
+ return 0;
+ }
+
+ if(i < 20 && i > x && *data_ptr) {
+ val = **data_ptr;
+ } else {
+ val = 8;
+ }
+ if(i == 10) {
+ free(*data_ptr);
+ }
+
+ return val + refer_free_rec(x, i-1, data_ptr);
+}
+
+#ifndef NO_MAIN
+int main() {
+ int* data = malloc(sizeof(int));
+ if(!data) {
+ return -1;
+ }
+ *data = 3;
+#ifdef NO_BUG
+ printf("%i\n", refer_free_rec(9, 20, &data));
+#else
+ printf("%i\n", refer_free_rec(8, 20, &data));
+#endif
+ free(data);
+
+ return 1;
+}
+#endif
diff --git a/bench-moerman2018/memory/refer_free/15_loop_recursion_multi.c b/bench-moerman2018/memory/refer_free/15_loop_recursion_multi.c
new file mode 100644
index 000000000..62c34ac4c
--- /dev/null
+++ b/bench-moerman2018/memory/refer_free/15_loop_recursion_multi.c
@@ -0,0 +1,55 @@
+#include <stdio.h>
+#include <stdbool.h>
+#include <stdlib.h>
+#include "refer_free.h"
+
+int refer_free_rec_decr(int x, int i, int** data_ptr) {
+ if(i <= 1) {
+ return 0;
+ }
+
+ return refer_free_rec_multi(x, i-1, data_ptr);
+}
+
+int refer_free_rec_multi(int x, int i, int** data_ptr) {
+ int val;
+
+#ifdef CATCH_BAD_PARAM
+ if(x < 9 && i >= 10) {
+ return -1;
+ }
+#endif
+
+ if(i <= 1) {
+ return 0;
+ }
+
+ if(i < 20 && i > x && *data_ptr) {
+ val = **data_ptr;
+ } else {
+ val = 8;
+ }
+ if(i == 10) {
+ free(*data_ptr);
+ }
+
+ return val + refer_free_rec_decr(x, i, data_ptr);
+}
+
+#ifndef NO_MAIN
+int main() {
+ int* data = malloc(sizeof(int));
+ if(!data) {
+ return -1;
+ }
+ *data = 3;
+#ifdef NO_BUG
+ printf("%i\n", refer_free_rec_multi(9, 20, &data));
+#else
+ printf("%i\n", refer_free_rec_multi(8, 20, &data));
+#endif
+ free(data);
+
+ return 1;
+}
+#endif
diff --git a/bench-moerman2018/memory/refer_free/16_misc_pseudo_recursion.c b/bench-moerman2018/memory/refer_free/16_misc_pseudo_recursion.c
new file mode 100644
index 000000000..5ff8eb055
--- /dev/null
+++ b/bench-moerman2018/memory/refer_free/16_misc_pseudo_recursion.c
@@ -0,0 +1,56 @@
+#include <stdio.h>
+#include <stdlib.h>
+#include "refer_free.h"
+
+int refer_free_pseudo_rec1(int x, int y, int i, int** data_ptr) {
+ int data_value = **data_ptr;
+#ifdef CATCH_BAD_PARAM
+ if(x >= y && x <= 10) {
+ free(*data_ptr);
+ return -1;
+ }
+#endif
+
+ if(i > 0) {
+ free(*data_ptr);
+ return 37;
+ }
+
+ if(x >= y) {
+ free(*data_ptr);
+ }
+
+ return data_value + refer_free_pseudo_rec2(x, y, 1, data_ptr);
+}
+
+int refer_free_pseudo_rec2(int x, int y, int i, int** data_ptr) {
+ int val = 78;
+ if(i > 0) {
+ if(x <= 10) {
+ val += **data_ptr;
+ }
+ if(x < y) {
+ free(*data_ptr);
+ }
+ return val;
+ }
+
+ return 5 + refer_free_pseudo_rec1(x, y, 1, data_ptr);
+}
+
+#ifndef NO_MAIN
+int main() {
+ int* data = malloc(sizeof(int));
+ *data = 35;
+#ifdef NO_BUG
+ printf("%i\n", refer_free_pseudo_rec1(9, 10, 0, &data));
+ data = malloc(sizeof(int));
+ *data = 35;
+ printf("%i\n", refer_free_pseudo_rec1(11, 10, 0, &data));
+#else
+ printf("%i\n", refer_free_pseudo_rec1(10, 10, 0, &data));
+#endif
+
+ return 1;
+}
+#endif
diff --git a/bench-moerman2018/memory/refer_free/17_complex_function_pointers.c b/bench-moerman2018/memory/refer_free/17_complex_function_pointers.c
new file mode 100644
index 000000000..6a626c2b1
--- /dev/null
+++ b/bench-moerman2018/memory/refer_free/17_complex_function_pointers.c
@@ -0,0 +1,56 @@
+#include <stdio.h>
+#include <stdbool.h>
+#include <stdlib.h>
+#include "refer_free.h"
+
+static void assign_possibly_freed(int** dest, bool free_data) {
+ int* data = malloc(5*sizeof(int));
+ *dest = data;
+ if(!data) {
+ return;
+ }
+ if(free_data) {
+ free(data);
+ } else {
+ *data = 67982;
+ }
+}
+
+void refer_free_function_pointer(bool a, bool b, void (*f)(int** dest, bool free_data)) {
+ int* data;
+ int val = 89;
+
+#ifdef CATCH_BAD_PARAM
+ if(!f || (!a & !b)) {
+ return;
+ }
+#endif
+
+ (*f)(&data, !a);
+
+ if(!b && data) {
+ val = *data; /* DANGER, if !a & !b */
+ }
+
+ if(a && data) {
+ free(data);
+ }
+
+ printf("%i\n", val);
+}
+
+#ifndef NO_MAIN
+int main() {
+#ifdef NO_BUG
+ refer_free_function_pointer(true, true, &assign_possibly_freed);
+ refer_free_function_pointer(true, false, &assign_possibly_freed);
+ refer_free_function_pointer(false, true, &assign_possibly_freed);
+#else
+ refer_free_function_pointer(true, true, &assign_possibly_freed); /* OK */
+ refer_free_function_pointer(false, false, &assign_possibly_freed); /* DANGER */
+ refer_free_function_pointer(false, true, &assign_possibly_freed); /* OK */
+#endif
+
+ return 1;
+}
+#endif
diff --git a/bench-moerman2018/memory/refer_free/18_complex_struct_multiple_methods.c b/bench-moerman2018/memory/refer_free/18_complex_struct_multiple_methods.c
new file mode 100644
index 000000000..3b8f24967
--- /dev/null
+++ b/bench-moerman2018/memory/refer_free/18_complex_struct_multiple_methods.c
@@ -0,0 +1,93 @@
+#include <stdio.h>
+#include <stdlib.h>
+#include "refer_free.h"
+
+#ifndef s_NULLPOINTER_REFCOUNT
+#define s_NULLPOINTER_REFCOUNT
+void refer_free_cont_init(RRefCont* cont) {
+ cont->refc = 1;
+ cont->data = 0;
+}
+
+RRefCont* refer_free_cont_new() {
+ RRefCont* new_cont;
+
+ new_cont = malloc(sizeof(RRefCont));
+
+ if(new_cont) {
+ refer_free_cont_init(new_cont);
+ }
+ return new_cont;
+}
+
+void refer_free_cont_ref(RRefCont* cont) {
+ if(cont) {
+ cont->refc++;
+ }
+}
+void refer_free_cont_unref(RRefCont* cont) {
+ if(cont->refc <= 1) {
+ free(cont);
+ } else {
+ cont->refc--;
+ }
+}
+
+void* refer_free_cont_get_pointer(RRefCont* cont) {
+ return cont->data;
+}
+void refer_free_cont_set_pointer(RRefCont* cont, void* p) {
+ cont->data = p;
+}
+#endif //s_NULLPOINTER_REFCOUNT
+
+void refer_free_struct(int x, int y) {
+ RRefCont cont;
+ int* data;
+ int val = 78;
+
+#ifdef CATCH_BAD_PARAM
+ if(x <= 10 && x > y) {
+ return;
+ }
+#endif
+
+ data = malloc(sizeof(int));
+
+ if(!data) {
+ return;
+ }
+
+ refer_free_cont_init(&cont);
+ refer_free_cont_set_pointer(&cont, data);
+
+ *data = 37;
+
+ if(x > y) {
+ free(data);
+ }
+
+ if(x <= 10) {
+ val = *((int*) refer_free_cont_get_pointer(&cont)); /* DANGER: if x <= 10 & x > y */
+ }
+
+ if(x <= y) {
+ free(data);
+ }
+
+ printf("%i\n", val);
+}
+
+#ifndef NO_MAIN
+int main() {
+#ifdef NO_BUG
+ refer_free_struct(9, 10);
+ refer_free_struct(10, 11);
+ refer_free_struct(11, 10);
+#else
+ refer_free_struct(10, 9); /* DANGER */
+#endif
+
+ return 1;
+}
+#endif
diff --git a/bench-moerman2018/memory/refer_free/19_complex_refcount.c b/bench-moerman2018/memory/refer_free/19_complex_refcount.c
new file mode 100644
index 000000000..1e17a9994
--- /dev/null
+++ b/bench-moerman2018/memory/refer_free/19_complex_refcount.c
@@ -0,0 +1,72 @@
+#include "refer_free.h"
+#include <stdlib.h>
+#include <stdio.h>
+
+#ifndef s_MEMORY_RF_REFCOUNT
+#define s_MEMORY_RF_REFCOUNT
+void refer_free_cont_init(RRefCont* cont) {
+ cont->refc = 1;
+ cont->data = 0;
+}
+
+RRefCont* refer_free_cont_new() {
+ RRefCont* new_cont;
+
+ new_cont = malloc(sizeof(RRefCont));
+
+ if(new_cont) {
+ refer_free_cont_init(new_cont);
+ }
+ return new_cont;
+}
+
+void refer_free_cont_ref(RRefCont* cont) {
+ if(cont) {
+ cont->refc++;
+ }
+}
+void refer_free_cont_unref(RRefCont* cont) {
+ if(cont->refc <= 1) {
+ free(cont);
+ } else {
+ cont->refc--;
+ }
+}
+
+void* refer_free_cont_get_pointer(RRefCont* cont) {
+ return cont->data;
+}
+void refer_free_cont_set_pointer(RRefCont* cont, void* p) {
+ cont->data = p;
+}
+#endif //s_MEMORY_RF_REFCOUNT
+
+#ifndef NO_MAIN
+int main() {
+ RRefCont* cont;
+ int arr[1] = {99};
+ int val;
+
+ cont = refer_free_cont_new();
+ if(!cont) {
+ return 1;
+ }
+ refer_free_cont_set_pointer(cont, arr);
+
+ refer_free_cont_ref(cont);
+ refer_free_cont_ref(cont);
+ refer_free_cont_unref(cont);
+ refer_free_cont_unref(cont);
+#ifdef NO_BUG
+ val = *((int*) refer_free_cont_get_pointer(cont));
+ refer_free_cont_unref(cont);
+#else
+ refer_free_cont_unref(cont);
+ val = *((int*) refer_free_cont_get_pointer(cont));
+#endif
+
+ printf("%i\n", val);
+
+ return 1;
+}
+#endif
diff --git a/bench-moerman2018/memory/refer_free/refer_free.h b/bench-moerman2018/memory/refer_free/refer_free.h
new file mode 100644
index 000000000..496df007c
--- /dev/null
+++ b/bench-moerman2018/memory/refer_free/refer_free.h
@@ -0,0 +1,36 @@
+#include <stdbool.h>
+
+typedef struct _ReferFreeRefCont RRefCont;
+
+struct _ReferFreeRefCont {
+ void* data;
+ unsigned int refc;
+};
+
+void refer_free_cont_init(RRefCont* cont);
+RRefCont* refer_free_cont_new();
+void refer_free_cont_ref(RRefCont* cont);
+void refer_free_cont_unref(RRefCont* cont);
+void* refer_free_cont_get_pointer(RRefCont* cont);
+void refer_free_cont_set_pointer(RRefCont* cont, void* p);
+
+void refer_free_for(int x);
+void refer_free_for_complex(int x);
+void refer_free_while_continue(int x);
+void refer_free_do_while_continue(int x);
+void refer_free_for_array(int x);
+void refer_free_for_pointer(int x);
+void refer_free_goto(int x);
+void refer_free_if_else(bool a, bool b);
+void refer_free_if_else_multi(bool a, bool b);
+void refer_free_if_else_int1(int x, int y);
+void refer_free_if_else_int2(int x, int y);
+void refer_free_pass_by_reference(bool a, bool b);
+int refer_free_switch(int x, int y);
+int refer_free_rec_multi(int x, int i, int** data_ptr);
+int refer_free_rec(int x, int i, int** data_ptr);
+int refer_free_pseudo_rec1(int x, int y, int i, int** data_ptr);
+int refer_free_pseudo_rec2(int x, int y, int i, int** data_ptr);
+void refer_free_struct(int x, int y);
+void refer_free_function_pointer(bool a, bool b, void (*f)(int** dest, bool free_data));
+void refer_free_cross_file(bool a, bool b);
diff --git a/bench-moerman2018/memory/zero_alloc/01_simple_if.c b/bench-moerman2018/memory/zero_alloc/01_simple_if.c
new file mode 100644
index 000000000..4d8a9bb3e
--- /dev/null
+++ b/bench-moerman2018/memory/zero_alloc/01_simple_if.c
@@ -0,0 +1,51 @@
+#include <stdio.h>
+#include <stdlib.h>
+#include <stdbool.h>
+#include "zero_alloc.h"
+
+void zero_alloc_if_else(bool a, bool b) {
+ size_t size;
+ int* data;
+
+#ifdef CATCH_BAD_PARAM
+ if(!a & !b) {
+ return;
+ }
+#endif
+
+ if(a) {
+ size = 5 * sizeof(int);
+ } else {
+ size = 0;
+ }
+
+ if(b) {
+ size += 3 * sizeof(int);
+ } else {
+ size = size * 5;
+ }
+
+ data = malloc(size); /* DANGER, if !a & !b */
+
+ if(data) {
+ *data = 34;
+ printf("%i\n", *data);
+ free(data);
+ }
+}
+
+#ifndef NO_MAIN
+int main() {
+#ifdef NO_BUG
+ zero_alloc_if_else(true, true);
+ zero_alloc_if_else(true, false);
+ zero_alloc_if_else(false, true);
+#else
+ zero_alloc_if_else(true, true); /* OK */
+ zero_alloc_if_else(false, false); /* DANGER */
+ zero_alloc_if_else(false, true); /* OK */
+#endif
+
+ return 1;
+}
+#endif
diff --git a/bench-moerman2018/memory/zero_alloc/02_simple_if_int1.c b/bench-moerman2018/memory/zero_alloc/02_simple_if_int1.c
new file mode 100644
index 000000000..d918e8116
--- /dev/null
+++ b/bench-moerman2018/memory/zero_alloc/02_simple_if_int1.c
@@ -0,0 +1,50 @@
+#include <stdio.h>
+#include <stdlib.h>
+#include "zero_alloc.h"
+
+void zero_alloc_if_else_int1(int x, int y) {
+ size_t size;
+ int* data;
+
+#ifdef CATCH_BAD_PARAM
+ if(x > 10 && x < y) {
+ return;
+ }
+#endif
+
+ if(x <= 10) {
+ size = 5 * sizeof(int);
+ } else {
+ size = 0;
+ }
+
+ if(x >= y) {
+ size += 3 * sizeof(int);
+ } else {
+ size = size * 5;
+ }
+
+ data = malloc(size); /* DANGER, if !a & !b */
+
+ if(data) {
+ *data = 34;
+ printf("%i\n", *data);
+ free(data);
+ }
+}
+
+#ifndef NO_MAIN
+int main() {
+#ifdef NO_BUG
+ zero_alloc_if_else_int1(10, 10);
+ zero_alloc_if_else_int1(10, 11);
+ zero_alloc_if_else_int1(11, 11);
+#else
+ zero_alloc_if_else_int1(10, 10); /* OK */
+ zero_alloc_if_else_int1(11, 12); /* DANGER */
+ zero_alloc_if_else_int1(11, 11); /* OK */
+#endif
+
+ return 1;
+}
+#endif
diff --git a/bench-moerman2018/memory/zero_alloc/02_simple_if_int2.c b/bench-moerman2018/memory/zero_alloc/02_simple_if_int2.c
new file mode 100644
index 000000000..40ae0383c
--- /dev/null
+++ b/bench-moerman2018/memory/zero_alloc/02_simple_if_int2.c
@@ -0,0 +1,56 @@
+#include <stdio.h>
+#include <stdlib.h>
+#include "zero_alloc.h"
+
+void zero_alloc_if_else_int2(int x, int y) {
+ size_t size;
+ int* data;
+ int m, n;
+
+ m = -1;
+ n = 5;
+
+ x = x*m+n;
+
+#ifdef CATCH_BAD_PARAM
+ if(x > 10 && x < y) {
+ return;
+ }
+#endif
+
+ if(x <= 10) {
+ size = 5 * sizeof(int);
+ } else {
+ size = 0;
+ }
+
+ if(x >= y) {
+ size += 3 * sizeof(int);
+ } else {
+ size = size * 5;
+ }
+
+ data = malloc(size); /* DANGER, if !a & !b */
+
+ if(data) {
+ *data = 34;
+ printf("%i\n", *data);
+ free(data);
+ }
+}
+
+#ifndef NO_MAIN
+int main() {
+#ifdef NO_BUG
+ zero_alloc_if_else_int2(-5, 10);
+ zero_alloc_if_else_int2(-5, 11);
+ zero_alloc_if_else_int2(-6, 11);
+#else
+ zero_alloc_if_else_int2(-5, 10); /* OK */
+ zero_alloc_if_else_int2(-6, 12); /* DANGER */
+ zero_alloc_if_else_int2(-6, 11); /* OK */
+#endif
+
+ return 1;
+}
+#endif
diff --git a/bench-moerman2018/memory/zero_alloc/03_simple_if_multi_func.c b/bench-moerman2018/memory/zero_alloc/03_simple_if_multi_func.c
new file mode 100644
index 000000000..d8292122e
--- /dev/null
+++ b/bench-moerman2018/memory/zero_alloc/03_simple_if_multi_func.c
@@ -0,0 +1,54 @@
+#include "zero_alloc.h"
+#include <stdbool.h>
+#include <stdlib.h>
+#include <stdio.h>
+
+static size_t choose_size(int size1, int size2, bool return_first) {
+ if(return_first) {
+ return size1;
+ }
+ return size2;
+}
+
+static void* malloc_conditional_size(size_t size1, size_t size2, bool use_first) {
+ if(use_first) {
+ return malloc(size1);
+ } else {
+ return malloc(size2);
+ }
+}
+
+void zero_alloc_if_else_multi(bool a, bool b) {
+ size_t size;
+ int* data;
+
+#ifdef CATCH_BAD_PARAM
+ if(!a & !b) {
+ return;
+ }
+#endif
+
+ size = choose_size(sizeof(int), 0, a);
+ data = (int*) malloc_conditional_size(size + sizeof(int), size * 3, b); /* DANGER, if !a & !b */
+
+ if(data) {
+ *data = 34;
+ printf("%i\n", *data);
+ free(data);
+ }
+}
+
+#ifndef NO_MAIN
+int main() {
+#ifdef NO_BUG
+ zero_alloc_if_else_multi(true, true);
+ zero_alloc_if_else_multi(true, false);
+ zero_alloc_if_else_multi(false, true);
+#else
+ zero_alloc_if_else_multi(true, true); /* OK */
+ zero_alloc_if_else_multi(false, false); /* DANGER */
+ zero_alloc_if_else_multi(false, true); /* OK */
+#endif
+ return 1;
+}
+#endif
diff --git a/bench-moerman2018/memory/zero_alloc/04_simple_switch.c b/bench-moerman2018/memory/zero_alloc/04_simple_switch.c
new file mode 100644
index 000000000..9233c4479
--- /dev/null
+++ b/bench-moerman2018/memory/zero_alloc/04_simple_switch.c
@@ -0,0 +1,67 @@
+#include "zero_alloc.h"
+#include <stdlib.h>
+#include <stdio.h>
+
+void zero_alloc_switch(int x, int y) {
+ size_t size;
+ int* data;
+
+#ifdef CATCH_BAD_PARAM
+ if((x == 10 || x == 5) && x > y) {
+ return;
+ }
+#endif
+
+ if(x <= y) {
+ size = 2 * sizeof(int);
+ } else {
+ size = 0;
+ }
+
+ switch (x) {
+ case 5: {
+ data = malloc(size * 2); /* DANGER: x >= y */
+ break;
+ }
+ case 7: {
+ data = malloc(size + sizeof(int));
+ break;
+ }
+ case 10: {
+ data = malloc(size * 3); /* DANGER: x >= y */
+ break;
+ }
+ case 12: {
+ data = malloc(size + 3 * sizeof(int));
+ break;
+ }
+ default: {
+ data = malloc(size + 5 * sizeof(int));
+ break;
+ }
+ };
+
+ if(data) {
+ *data = 34;
+ printf("%i\n", *data);
+ free(data);
+ }
+}
+
+#ifndef NO_MAIN
+int main() {
+#ifdef NO_BUG
+ zero_alloc_switch(5, 11);
+ zero_alloc_switch(10, 11);
+ zero_alloc_switch(11, 10);
+ zero_alloc_switch(7, 5);
+#else
+ zero_alloc_switch(5, 10); /* OK */
+ zero_alloc_switch(10, 9); /* DANGER */
+ zero_alloc_switch(11, 10); /* OK */
+ zero_alloc_switch(7, 5); /* OK */
+#endif
+
+ return 1;
+}
+#endif
diff --git a/bench-moerman2018/memory/zero_alloc/05_simple_goto.c b/bench-moerman2018/memory/zero_alloc/05_simple_goto.c
new file mode 100644
index 000000000..afa9ec360
--- /dev/null
+++ b/bench-moerman2018/memory/zero_alloc/05_simple_goto.c
@@ -0,0 +1,43 @@
+#include <stdio.h>
+#include <stdlib.h>
+#include "zero_alloc.h"
+
+void zero_alloc_goto(int x) {
+ int* data;
+ size_t size = sizeof(int);
+ int i = 0;
+
+#ifdef CATCH_BAD_PARAM
+ if(x > 0) {
+ return;
+ }
+#endif
+
+GOTO_LABEL:
+ if(i <= x) {
+ data = malloc(size);
+ if(data) {
+ *data = i;
+ printf("%i\n", *data);
+ free(data);
+ }
+ }
+
+ if(i == 0) {
+ i++;
+ size -= sizeof(int);
+ goto GOTO_LABEL;
+ }
+}
+
+#ifndef NO_MAIN
+int main() {
+#ifdef NO_BUG
+ zero_alloc_goto(0);
+#else
+ zero_alloc_goto(1);
+#endif
+
+ return 1;
+}
+#endif
diff --git a/bench-moerman2018/memory/zero_alloc/06_simple_pass_by_reference.c b/bench-moerman2018/memory/zero_alloc/06_simple_pass_by_reference.c
new file mode 100644
index 000000000..20f49e8db
--- /dev/null
+++ b/bench-moerman2018/memory/zero_alloc/06_simple_pass_by_reference.c
@@ -0,0 +1,53 @@
+#include <stdio.h>
+#include <stdlib.h>
+#include <stdbool.h>
+#include "zero_alloc.h"
+
+static void assign_size(size_t* size, size_t size1, size_t size2, bool use_first) {
+ if(use_first) {
+ *size = size1;
+ } else {
+ *size = size2;
+ }
+}
+
+void zero_alloc_pass_by_reference(bool a, bool b) {
+ int* data;
+ size_t size;
+
+#ifdef CATCH_BAD_PARAM
+ if(!a & !b) {
+ return;
+ }
+#endif
+
+ assign_size(&size, sizeof(int) * 2, sizeof(int), a);
+
+ if(b) {
+ data = malloc(size);
+ } else {
+ data = malloc(size - sizeof(int)); /* DANGER, if !a & !b */
+ }
+
+ if(data) {
+ *data = 34;
+ printf("%i\n", *data);
+ free(data);
+ }
+}
+
+#ifndef NO_MAIN
+int main() {
+#ifdef NO_BUG
+ zero_alloc_pass_by_reference(true, true);
+ zero_alloc_pass_by_reference(true, false);
+ zero_alloc_pass_by_reference(false, true);
+#else
+ zero_alloc_pass_by_reference(true, true); /* OK */
+ zero_alloc_pass_by_reference(false, false); /* DANGER */
+ zero_alloc_pass_by_reference(false, true); /* OK */
+#endif
+
+ return 1;
+}
+#endif
diff --git a/bench-moerman2018/memory/zero_alloc/07_cross_file.c b/bench-moerman2018/memory/zero_alloc/07_cross_file.c
new file mode 100644
index 000000000..35f2a836e
--- /dev/null
+++ b/bench-moerman2018/memory/zero_alloc/07_cross_file.c
@@ -0,0 +1,49 @@
+#include "zero_alloc.h"
+#include "common.h"
+#include <stdbool.h>
+#include <stdio.h>
+#include <stdlib.h>
+
+void zero_alloc_cross_file(bool a, bool b) {
+ size_t size;
+ int* data;
+
+#ifdef CATCH_BAD_PARAM
+ if(!a & !b) {
+ return;
+ }
+#endif
+
+ size = sizeof(int) * choose_int(2, 0, a);
+
+ if(b) {
+ data = malloc(size + sizeof(int));
+ } else {
+ data = malloc(size); /* DANGER, if !a & !b */
+ }
+
+ if(data) {
+
+ }
+
+ if(data) {
+ *data = 34;
+ printf("%i\n", *data);
+ free(data);
+ }
+}
+
+#ifndef NO_MAIN
+int main() {
+#ifdef NO_BUG
+ zero_alloc_cross_file(true, true);
+ zero_alloc_cross_file(true, false);
+ zero_alloc_cross_file(false, true);
+#else
+ zero_alloc_cross_file(true, true); /* OK */
+ zero_alloc_cross_file(false, false); /* DANGER */
+ zero_alloc_cross_file(false, true); /* OK */
+#endif
+ return 1;
+}
+#endif
diff --git a/bench-moerman2018/memory/zero_alloc/08_loop_for.c b/bench-moerman2018/memory/zero_alloc/08_loop_for.c
new file mode 100644
index 000000000..e5ae30e6c
--- /dev/null
+++ b/bench-moerman2018/memory/zero_alloc/08_loop_for.c
@@ -0,0 +1,46 @@
+#include <stdio.h>
+#include <stdbool.h>
+#include <stdlib.h>
+#include "zero_alloc.h"
+
+void zero_alloc_for(int x) {
+ int* data;
+ size_t size = 0;
+ int i;
+
+#ifdef CATCH_BAD_PARAM
+ if(x < 10) {
+ return;
+ }
+#endif
+
+ for(i = 0; i < 20; i++) {
+ if(i > x) {
+ data = malloc(size); /* DANGER: x < 10 */
+ } else {
+ data = malloc(size + sizeof(int));
+ }
+
+ if(data) {
+ *data = i;
+ printf("%i\n", *data);
+ free(data);
+ }
+
+ if(i == 10) {
+ size += sizeof(int);
+ }
+ }
+}
+
+#ifndef NO_MAIN
+int main() {
+#ifdef NO_BUG
+ zero_alloc_for(10);
+#else
+ zero_alloc_for(9);
+#endif
+
+ return 1;
+}
+#endif
diff --git a/bench-moerman2018/memory/zero_alloc/09_loop_for_complex.c b/bench-moerman2018/memory/zero_alloc/09_loop_for_complex.c
new file mode 100644
index 000000000..c2a9cb323
--- /dev/null
+++ b/bench-moerman2018/memory/zero_alloc/09_loop_for_complex.c
@@ -0,0 +1,49 @@
+#include <stdio.h>
+#include <stdlib.h>
+#include "zero_alloc.h"
+
+void zero_alloc_for_complex(int x) {
+ int* data;
+ size_t size = 0;
+ int i = 0;
+
+#ifdef CATCH_BAD_PARAM
+ if(x < 10) {
+ return;
+ }
+#endif
+
+ for(;;) {
+ if(i > x) {
+ data = malloc(size); /* DANGER: x < 10 */
+ } else {
+ data = malloc(size + sizeof(int));
+ }
+
+ if(data) {
+ *data = i;
+ printf("%i\n", *data);
+ free(data);
+ }
+
+ if(i == 10) {
+ size += sizeof(int);
+ }
+ i++;
+ if(i >= 20) {
+ break;
+ }
+ }
+}
+
+#ifndef NO_MAIN
+int main() {
+#ifdef NO_BUG
+ zero_alloc_for_complex(10);
+#else
+ zero_alloc_for_complex(9);
+#endif
+
+ return 1;
+}
+#endif
diff --git a/bench-moerman2018/memory/zero_alloc/10_loop_while_continue.c b/bench-moerman2018/memory/zero_alloc/10_loop_while_continue.c
new file mode 100644
index 000000000..7d070c13e
--- /dev/null
+++ b/bench-moerman2018/memory/zero_alloc/10_loop_while_continue.c
@@ -0,0 +1,50 @@
+#include <stdio.h>
+#include <stdlib.h>
+#include "zero_alloc.h"
+
+void zero_alloc_while_continue(int x) {
+ int* data;
+ size_t size = 0;
+ int i = 0;
+
+#ifdef CATCH_BAD_PARAM
+ if(x < 10) {
+ return;
+ }
+#endif
+
+ while(i < 30) {
+ if(i == 9) {
+ i++;
+ continue;
+ }
+ if(i > x) {
+ data = malloc(size); /* DANGER: x < 10 */
+ } else {
+ data = malloc(size + sizeof(int));
+ }
+
+ if(data) {
+ *data = i;
+ printf("%i\n", *data);
+ free(data);
+ }
+
+ if(i == 10) {
+ size += sizeof(int);
+ }
+ i++;
+ }
+}
+
+#ifndef NO_MAIN
+int main() {
+#ifdef NO_BUG
+ zero_alloc_while_continue(10);
+#else
+ zero_alloc_while_continue(9);
+#endif
+
+ return 1;
+}
+#endif
diff --git a/bench-moerman2018/memory/zero_alloc/11_loop_while_do_continue.c b/bench-moerman2018/memory/zero_alloc/11_loop_while_do_continue.c
new file mode 100644
index 000000000..abec6505c
--- /dev/null
+++ b/bench-moerman2018/memory/zero_alloc/11_loop_while_do_continue.c
@@ -0,0 +1,50 @@
+#include <stdio.h>
+#include <stdlib.h>
+#include "zero_alloc.h"
+
+void zero_alloc_do_while_continue(int x) {
+ int* data;
+ size_t size = 0;
+ int i = 0;
+
+#ifdef CATCH_BAD_PARAM
+ if(x < 10) {
+ return;
+ }
+#endif
+
+ do {
+ if(i == 8) {
+ i++;
+ continue;
+ }
+ if(i > x) {
+ data = malloc(size); /* DANGER: x < 10 */
+ } else {
+ data = malloc(size + sizeof(int));
+ }
+
+ if(data) {
+ *data = i;
+ printf("%i\n", *data);
+ free(data);
+ }
+
+ if(i == 10) {
+ size += sizeof(int);
+ }
+ i++;
+ } while(i < 30);
+}
+
+#ifndef NO_MAIN
+int main() {
+#ifdef NO_BUG
+ zero_alloc_do_while_continue(10);
+#else
+ zero_alloc_do_while_continue(9);
+#endif
+
+ return 1;
+}
+#endif
diff --git a/bench-moerman2018/memory/zero_alloc/12_loop_for_array_branching.c b/bench-moerman2018/memory/zero_alloc/12_loop_for_array_branching.c
new file mode 100644
index 000000000..bb0608a8b
--- /dev/null
+++ b/bench-moerman2018/memory/zero_alloc/12_loop_for_array_branching.c
@@ -0,0 +1,49 @@
+#include <stdio.h>
+#include <stdlib.h>
+#include "zero_alloc.h"
+
+void zero_alloc_for_array(int x) {
+ int* data;
+ size_t size;
+ int p[20];
+ int i;
+
+#ifdef CATCH_BAD_PARAM
+ if(x != 19) {
+ return;
+ }
+#endif
+
+ size = sizeof(int);
+
+ for(i = 0; i < 20; i++) {
+ p[i] = 0;
+ }
+ p[x] = 1;
+
+ for(i = 0; i < 20; i++) {
+ if(p[i] == 1) {
+ size -= sizeof(int);
+ } else {
+ data = malloc(size); /* DANGER: x < 19 */
+ if(!data) {
+ break;
+ }
+ *data = i;
+ printf("%i\n", *data);
+ free(data);
+ }
+ }
+}
+
+#ifndef NO_MAIN
+int main() {
+#ifdef NO_BUG
+ zero_alloc_for_array(19);
+#else
+ zero_alloc_for_array(10);
+#endif
+
+ return 1;
+}
+#endif
diff --git a/bench-moerman2018/memory/zero_alloc/13_loop_for_pointer_arithmetic.c b/bench-moerman2018/memory/zero_alloc/13_loop_for_pointer_arithmetic.c
new file mode 100644
index 000000000..7fca6250a
--- /dev/null
+++ b/bench-moerman2018/memory/zero_alloc/13_loop_for_pointer_arithmetic.c
@@ -0,0 +1,65 @@
+#include <stdlib.h>
+#include <stdio.h>
+#include "zero_alloc.h"
+
+static void initialize_to_value(size_t* ptr, size_t val, int length) {
+ int i;
+
+ for(i = 0; i < length; i++, ptr++) {
+ *ptr = val;
+ }
+}
+
+static void free_array(int* ptr_arr[], int length) {
+ int i;
+
+ for(i = 0; i < length; i++) {
+ if(ptr_arr[i]) free(ptr_arr[i]);
+ }
+}
+
+void zero_alloc_for_pointer(int x) {
+ int* pointers[10];
+ int** pointers_alias = pointers;
+ size_t sizes[10];
+ size_t* ptr = sizes;
+ int val = 0;
+ int i;
+
+#ifdef CATCH_BAD_PARAM
+ if(x != 10) {
+ return;
+ }
+#endif
+
+ initialize_to_value(sizes, 0, 10);
+ initialize_to_value(sizes, sizeof(int), x);
+
+ for(i = 0; i < 10; i++, ptr++) {
+ pointers[i] = malloc(*ptr);
+ if(pointers[i]) {
+ *pointers[i] = i;
+ }
+ }
+
+ for(i = 0; i < 10; i++, pointers_alias++) {
+ if(*pointers_alias) {
+ val += **pointers_alias;
+ free(*pointers_alias);
+ }
+ }
+
+ printf("%i\n", val);
+}
+
+#ifndef NO_MAIN
+int main() {
+#ifdef NO_BUG
+ zero_alloc_for_pointer(10);
+#else
+ zero_alloc_for_pointer(9);
+#endif
+
+ return 1;
+}
+#endif
diff --git a/bench-moerman2018/memory/zero_alloc/14_loop_recursion.c b/bench-moerman2018/memory/zero_alloc/14_loop_recursion.c
new file mode 100644
index 000000000..65c528cfe
--- /dev/null
+++ b/bench-moerman2018/memory/zero_alloc/14_loop_recursion.c
@@ -0,0 +1,51 @@
+#include <stdio.h>
+#include <stdbool.h>
+#include <stdlib.h>
+#include "zero_alloc.h"
+
+int zero_alloc_rec(int x, int i, size_t size1, size_t size2) {
+ size_t size;
+ int* data;
+ int val = -1;
+
+ if(i <= 1 || size1 == 0) {
+ return 0;
+ }
+
+#ifdef CATCH_BAD_PARAM
+ if(x > 10 && i < x && size2 == 0) {
+ return zero_alloc_rec(x, i-1, size1, size1);
+ }
+#endif
+
+ if(i < x) {
+ size = size2;
+ } else {
+ size = size1;
+ }
+ if(i == 10) {
+ size2 = size1;
+ }
+
+ data = malloc(size);
+ if(data) {
+ *data = i;
+ val = *data * x;
+ free(data);
+ }
+
+ return zero_alloc_rec(x, i-1, size1, size2) + val;
+}
+
+#ifndef NO_MAIN
+int main() {
+#ifdef NO_BUG
+ printf("%i\n", zero_alloc_rec(10, 20, sizeof(int) * 5, 0));
+ printf("%i\n", zero_alloc_rec(11, 20, sizeof(int) * 5, sizeof(int) * 6));
+#else
+ printf("%i\n", zero_alloc_rec(11, 20, sizeof(int) * 5, 0));
+#endif
+
+ return 1;
+}
+#endif
diff --git a/bench-moerman2018/memory/zero_alloc/15_loop_recursion_multi.c b/bench-moerman2018/memory/zero_alloc/15_loop_recursion_multi.c
new file mode 100644
index 000000000..edb71b841
--- /dev/null
+++ b/bench-moerman2018/memory/zero_alloc/15_loop_recursion_multi.c
@@ -0,0 +1,59 @@
+#include <stdio.h>
+#include <stdbool.h>
+#include <stdlib.h>
+#include "zero_alloc.h"
+
+int zero_alloc_rec_decr(int x, int i, size_t size1, size_t size2) {
+ if(i <= 1) {
+ return 0;
+ }
+
+ return zero_alloc_rec_multi(x, i-1, size1, size2);
+}
+
+int zero_alloc_rec_multi(int x, int i, size_t size1, size_t size2) {
+ size_t size;
+ int* data;
+ int val = -1;
+
+ if(size1 == 0) {
+ return 0;
+ }
+
+#ifdef CATCH_BAD_PARAM
+ if(x > 10 && i < x && size2 == 0) {
+ return zero_alloc_rec_multi(x, i-1, size1, size1);
+ }
+#endif
+
+ if(i < x) {
+ size = size2;
+ } else {
+ size = size1;
+ }
+ if(i == 10) {
+ size2 = size1;
+ }
+
+ data = malloc(size);
+ if(data) {
+ *data = i;
+ val = *data * x;
+ free(data);
+ }
+
+ return zero_alloc_rec_decr(x, i, size1, size2) + val;
+}
+
+#ifndef NO_MAIN
+int main() {
+#ifdef NO_BUG
+ printf("%i\n", zero_alloc_rec_multi(10, 20, sizeof(int) * 5, 0));
+ printf("%i\n", zero_alloc_rec_multi(11, 20, sizeof(int) * 5, sizeof(int) * 6));
+#else
+ printf("%i\n", zero_alloc_rec_multi(11, 20, sizeof(int) * 5, 0));
+#endif
+
+ return 1;
+}
+#endif
diff --git a/bench-moerman2018/memory/zero_alloc/16_misc_pseudo_recursion.c b/bench-moerman2018/memory/zero_alloc/16_misc_pseudo_recursion.c
new file mode 100644
index 000000000..3238486ab
--- /dev/null
+++ b/bench-moerman2018/memory/zero_alloc/16_misc_pseudo_recursion.c
@@ -0,0 +1,61 @@
+#include <stdio.h>
+#include <stdlib.h>
+#include "zero_alloc.h"
+
+int zero_alloc_pseudo_rec1(int x, int y, int i, size_t size1, size_t size2) {
+#ifdef CATCH_BAD_PARAM
+ if(x >= y && x <= 10) {
+ return -1;
+ }
+#endif
+
+ if(i > 0) {
+ return 37;
+ }
+
+ if(x < y) {
+ size2 += sizeof(int);
+ } else {
+ size1 += sizeof(int);
+ }
+
+ return zero_alloc_pseudo_rec2(x, y, 1, size1, size2);
+}
+
+int zero_alloc_pseudo_rec2(int x, int y, int i, size_t size1, size_t size2) {
+ size_t size;
+ int* data;
+ int val = -1;
+
+ if(i <= 0) {
+ return 5 + zero_alloc_pseudo_rec1(x, y, 1, size1, size2);
+ }
+
+ if(x > 10) {
+ size = size1 + sizeof(int);
+ } else {
+ size = size2;
+ }
+
+ data = malloc(size);
+ if(data) {
+ *data = x;
+ val = *data * y;
+ free(data);
+ }
+ return val;
+}
+
+#ifndef NO_MAIN
+int main() {
+#ifdef NO_BUG
+ printf("%i\n", zero_alloc_pseudo_rec1(9, 10, 0, sizeof(int), 0));
+ printf("%i\n", zero_alloc_pseudo_rec1(10, 10, 0, 0, sizeof(int)));
+ printf("%i\n", zero_alloc_pseudo_rec1(11, 10, 0, sizeof(int), 0));
+#else
+ printf("%i\n", zero_alloc_pseudo_rec1(10, 10, 0, sizeof(int), 0));
+#endif
+
+ return 1;
+}
+#endif
diff --git a/bench-moerman2018/memory/zero_alloc/17_complex_function_pointers.c b/bench-moerman2018/memory/zero_alloc/17_complex_function_pointers.c
new file mode 100644
index 000000000..b71340697
--- /dev/null
+++ b/bench-moerman2018/memory/zero_alloc/17_complex_function_pointers.c
@@ -0,0 +1,53 @@
+#include <stdio.h>
+#include <stdbool.h>
+#include <stdlib.h>
+#include "zero_alloc.h"
+
+static void assign_size(size_t* size, size_t size1, size_t size2, bool use_first) {
+ if(use_first) {
+ *size = size1;
+ } else {
+ *size = size2;
+ }
+}
+
+void zero_alloc_function_pointer(bool a, bool b, void (*f)(size_t* size, size_t size1, size_t size2, bool use_first)) {
+ int* data;
+ size_t size;
+
+#ifdef CATCH_BAD_PARAM
+ if(!f || (!a & !b)) {
+ return;
+ }
+#endif
+
+ (*f)(&size, sizeof(int) * 2, sizeof(int), a);
+
+ if(b) {
+ data = malloc(size);
+ } else {
+ data = malloc(size - sizeof(int)); /* DANGER, if !a & !b */
+ }
+
+ if(data) {
+ *data = 34;
+ printf("%i\n", *data);
+ free(data);
+ }
+}
+
+#ifndef NO_MAIN
+int main() {
+#ifdef NO_BUG
+ zero_alloc_function_pointer(true, true, &assign_size);
+ zero_alloc_function_pointer(true, false, &assign_size);
+ zero_alloc_function_pointer(false, true, &assign_size);
+#else
+ zero_alloc_function_pointer(true, true, &assign_size); /* OK */
+ zero_alloc_function_pointer(false, false, &assign_size); /* DANGER */
+ zero_alloc_function_pointer(false, true, &assign_size); /* OK */
+#endif
+
+ return 1;
+}
+#endif
diff --git a/bench-moerman2018/memory/zero_alloc/18_complex_struct_multiple_methods.c b/bench-moerman2018/memory/zero_alloc/18_complex_struct_multiple_methods.c
new file mode 100644
index 000000000..2e09c2f35
--- /dev/null
+++ b/bench-moerman2018/memory/zero_alloc/18_complex_struct_multiple_methods.c
@@ -0,0 +1,87 @@
+#include <stdio.h>
+#include <stdlib.h>
+#include "zero_alloc.h"
+
+#ifndef s_MEMORY_ZA_REFCOUNT
+#define s_MEMORY_ZA_REFCOUNT
+void zero_alloc_cont_init(SizeCont* cont) {
+ cont->refc = 1;
+ cont->size = 0;
+}
+
+SizeCont* zero_alloc_cont_new() {
+ SizeCont* new_cont;
+
+ new_cont = malloc(sizeof(SizeCont));
+
+ if(new_cont) {
+ zero_alloc_cont_init(new_cont);
+ }
+ return new_cont;
+}
+
+void zero_alloc_cont_ref(SizeCont* cont) {
+ if(cont) {
+ cont->refc++;
+ }
+}
+void zero_alloc_cont_unref(SizeCont* cont) {
+ if(cont->refc <= 1) {
+ cont->size = 0;
+ } else {
+ cont->refc--;
+ }
+}
+
+size_t zero_alloc_cont_get_size(SizeCont* cont) {
+ return cont->size;
+}
+void zero_alloc_cont_set_size(SizeCont* cont, size_t size) {
+ cont->size = size;
+}
+#endif //s_MEMORY_ZA_REFCOUNT
+
+void zero_alloc_struct(int x, int y) {
+ SizeCont cont;
+ int* data;
+
+#ifdef CATCH_BAD_PARAM
+ if(x <= 10 && x > y) {
+ return;
+ }
+#endif
+
+ zero_alloc_cont_init(&cont);
+ if(x > y) {
+ zero_alloc_cont_set_size(&cont, sizeof(int));
+ } else {
+ zero_alloc_cont_set_size(&cont, 2 * sizeof(int));
+ }
+
+
+ if(x > 10) {
+ data = malloc(zero_alloc_cont_get_size(&cont));
+ } else {
+ data = malloc(zero_alloc_cont_get_size(&cont) - sizeof(int)); /* DANGER: if x <= 10 & x > y */
+ }
+
+ if(data) {
+ *data = 37;
+ printf("%i\n", *data);
+ free(data);
+ }
+}
+
+#ifndef NO_MAIN
+int main() {
+#ifdef NO_BUG
+ zero_alloc_struct(9, 10);
+ zero_alloc_struct(10, 11);
+ zero_alloc_struct(11, 10);
+#else
+ zero_alloc_struct(10, 9); /* DANGER */
+#endif
+
+ return 1;
+}
+#endif
diff --git a/bench-moerman2018/memory/zero_alloc/19_complex_refcount.c b/bench-moerman2018/memory/zero_alloc/19_complex_refcount.c
new file mode 100644
index 000000000..887c7e91e
--- /dev/null
+++ b/bench-moerman2018/memory/zero_alloc/19_complex_refcount.c
@@ -0,0 +1,76 @@
+#include "zero_alloc.h"
+#include <stdlib.h>
+#include <stdio.h>
+
+#ifndef s_MEMORY_ZA_REFCOUNT
+#define s_MEMORY_ZA_REFCOUNT
+void zero_alloc_cont_init(SizeCont* cont) {
+ cont->refc = 1;
+ cont->size = 0;
+}
+
+SizeCont* zero_alloc_cont_new() {
+ SizeCont* new_cont;
+
+ new_cont = malloc(sizeof(SizeCont));
+
+ if(new_cont) {
+ zero_alloc_cont_init(new_cont);
+ }
+ return new_cont;
+}
+
+void zero_alloc_cont_ref(SizeCont* cont) {
+ if(cont) {
+ cont->refc++;
+ }
+}
+void zero_alloc_cont_unref(SizeCont* cont) {
+ if(cont->refc <= 1) {
+ cont->size = 0;
+ } else {
+ cont->refc--;
+ }
+}
+
+size_t zero_alloc_cont_get_size(SizeCont* cont) {
+ return cont->size;
+}
+void zero_alloc_cont_set_size(SizeCont* cont, size_t size) {
+ cont->size = size;
+}
+#endif //s_MEMORY_ZA_REFCOUNT
+
+#ifndef NO_MAIN
+int main() {
+ SizeCont* cont;
+ int* data;
+
+ cont = zero_alloc_cont_new();
+ if(!cont) {
+ return 1;
+ }
+ zero_alloc_cont_set_size(cont, 5 * sizeof(int));
+
+ zero_alloc_cont_ref(cont);
+ zero_alloc_cont_ref(cont);
+ zero_alloc_cont_unref(cont);
+ zero_alloc_cont_unref(cont);
+#ifdef NO_BUG
+ data = malloc(zero_alloc_cont_get_size(cont));
+ zero_alloc_cont_unref(cont);
+#else
+ zero_alloc_cont_unref(cont);
+ data = malloc(zero_alloc_cont_get_size(cont));
+#endif
+ free(cont);
+
+ if(data) {
+ *data = 1234;
+ printf("%i\n", *data);
+ free(data);
+ }
+
+ return 1;
+}
+#endif
diff --git a/bench-moerman2018/memory/zero_alloc/zero_alloc.h b/bench-moerman2018/memory/zero_alloc/zero_alloc.h
new file mode 100644
index 000000000..9ae55b29b
--- /dev/null
+++ b/bench-moerman2018/memory/zero_alloc/zero_alloc.h
@@ -0,0 +1,37 @@
+#include <stdbool.h>
+#include <stddef.h>
+
+typedef struct _SizeRefCont SizeCont;
+
+struct _SizeRefCont {
+ size_t size;
+ unsigned int refc;
+};
+
+void zero_alloc_cont_init(SizeCont* cont);
+SizeCont* zero_alloc_cont_new();
+void zero_alloc_cont_ref(SizeCont* cont);
+void zero_alloc_cont_unref(SizeCont* cont);
+size_t zero_alloc_cont_get_size(SizeCont* cont);
+void zero_alloc_cont_set_size(SizeCont* cont, size_t size);
+
+void zero_alloc_for(int x);
+void zero_alloc_for_complex(int x);
+void zero_alloc_while_continue(int x);
+void zero_alloc_do_while_continue(int x);
+void zero_alloc_for_array(int x);
+void zero_alloc_for_pointer(int x);
+void zero_alloc_goto(int x);
+void zero_alloc_if_else(bool a, bool b);
+void zero_alloc_if_else_multi(bool a, bool b);
+void zero_alloc_if_else_int1(int x, int y);
+void zero_alloc_if_else_int2(int x, int y);
+void zero_alloc_pass_by_reference(bool a, bool b);
+void zero_alloc_switch(int x, int y);
+int zero_alloc_rec_multi(int x, int i, size_t size1, size_t size2);
+int zero_alloc_rec(int x, int i, size_t size1, size_t size2);
+int zero_alloc_pseudo_rec1(int x, int y, int i, size_t size1, size_t size2);
+int zero_alloc_pseudo_rec2(int x, int y, int i, size_t size1, size_t size2);
+void zero_alloc_struct(int x, int y);
+void zero_alloc_function_pointer(bool a, bool b, void (*f)(size_t* size, size_t size1, size_t size2, bool use_first));
+void zero_alloc_cross_file(bool a, bool b);
diff --git a/bench-moerman2018/preprocess_files.sh b/bench-moerman2018/preprocess_files.sh
new file mode 100755
index 000000000..f7391bc56
--- /dev/null
+++ b/bench-moerman2018/preprocess_files.sh
@@ -0,0 +1,47 @@
+#!/bin/bash
+if [ $# != 1 ]; then
+ echo "incorrect number of arguments"
+fi
+
+WORK_DIR="$1"
+CORR_DIR="$WORK_DIR/test_correct"
+INCORR_DIR="$WORK_DIR/test_incorrect"
+WITH_MAIN_CATCH="$WORK_DIR/test_correct_catch_bad"
+NO_MAIN_C_DIR="$WORK_DIR/test_lib_correct"
+NO_MAIN_I_DIR="$WORK_DIR/test_lib_incorrect"
+
+if [ ! -d "$CORR_DIR" ]; then
+ mkdir "$CORR_DIR"
+fi
+
+if [ ! -d "$INCORR_DIR" ]; then
+ mkdir "$INCORR_DIR"
+fi
+
+if [ ! -d "$NO_MAIN_C_DIR" ]; then
+ mkdir "$NO_MAIN_C_DIR"
+fi
+
+if [ ! -d "$NO_MAIN_I_DIR" ]; then
+ mkdir "$NO_MAIN_I_DIR"
+fi
+
+if [ ! -d "$WITH_MAIN_CATCH" ]; then
+ mkdir "$WITH_MAIN_CATCH"
+fi
+
+temp_file=$(mktemp)
+
+for filename in "$WORK_DIR"/*.c; do
+ bname=${filename##*/}
+ echo "preprocessing $bname"
+ sed -e 's/#include/\/\/_#_include/g' -e 's/#ifndef s_/\/\/_#_ifndef s_/g' -e 's/#define s_/\/\/_#_define s_/g' -e 's/#endif \/\/s_/\/\/_#_endif \/\/s_/g' "$filename" > $temp_file
+ gpp +s "\"" "\"" "\\" +s "'" "'" "\\" -DNO_BUG $temp_file -o "$CORR_DIR/$bname"
+ gpp +s "\"" "\"" "\\" +s "'" "'" "\\" $temp_file -o "$INCORR_DIR/$bname"
+ gpp +s "\"" "\"" "\\" +s "'" "'" "\\" -DNO_MAIN $temp_file -o "$NO_MAIN_I_DIR/$bname"
+ gpp +s "\"" "\"" "\\" +s "'" "'" "\\" -DNO_MAIN -DCATCH_BAD_PARAM $temp_file -o "$NO_MAIN_C_DIR/$bname"
+ gpp +s "\"" "\"" "\\" +s "'" "'" "\\" -DNO_BUG -DCATCH_BAD_PARAM $temp_file -o "$WITH_MAIN_CATCH/$bname"
+ sed -i -e 's/\/\/_#_include/#include/g' -e 's/\/\/_#_ifndef/#ifndef/g' -e 's/\/\/_#_define/#define/g' -e 's/\/\/_#_endif \/\/s_/#endif \/\/s_/g' "$INCORR_DIR/$bname" "$CORR_DIR/$bname" "$NO_MAIN_I_DIR/$bname" "$NO_MAIN_C_DIR/$bname" "$WITH_MAIN_CATCH/$bname"
+done
+
+rm -f temp_file
diff --git a/bench-moerman2018/strings/overflow/01_simple_if.c b/bench-moerman2018/strings/overflow/01_simple_if.c
new file mode 100644
index 000000000..5b2e21514
--- /dev/null
+++ b/bench-moerman2018/strings/overflow/01_simple_if.c
@@ -0,0 +1,46 @@
+#include <stdio.h>
+#include <stdbool.h>
+#include <string.h>
+#include "string_overflow.h"
+
+void string_overflow_if_else(bool a, bool b) {
+ char long_string[] = "this is a long string";
+ char short_string[] = "short string";
+ char* to_print;
+
+#ifdef CATCH_BAD_PARAM
+ if(!a & !b) {
+ return;
+ }
+#endif
+
+ if(a) {
+ to_print = long_string;
+ } else {
+ to_print = short_string;
+ }
+
+ if(b) {
+ to_print[11] = '?';
+ } else {
+ to_print[13] = '?';
+ }
+
+ printf("%s\n", to_print);
+}
+
+#ifndef NO_MAIN
+int main() {
+#ifdef NO_BUG
+ string_overflow_if_else(true, true);
+ string_overflow_if_else(true, false);
+ string_overflow_if_else(false, true);
+#else
+ string_overflow_if_else(true, true); /* OK */
+ string_overflow_if_else(false, false); /* DANGER */
+ string_overflow_if_else(false, true); /* OK */
+#endif
+
+ return 1;
+}
+#endif
diff --git a/bench-moerman2018/strings/overflow/02_simple_if_int1.c b/bench-moerman2018/strings/overflow/02_simple_if_int1.c
new file mode 100644
index 000000000..aac13ae1c
--- /dev/null
+++ b/bench-moerman2018/strings/overflow/02_simple_if_int1.c
@@ -0,0 +1,45 @@
+#include <stdio.h>
+#include <string.h>
+#include "string_overflow.h"
+
+void string_overflow_if_else_int1(int x, int y) {
+ char long_string[] = "this is a long string";
+ char short_string[] = "short string";
+ char* to_print;
+
+#ifdef CATCH_BAD_PARAM
+ if(x <= 10 && x >= y) {
+ return;
+ }
+#endif
+
+ if(x < y) {
+ to_print = long_string;
+ } else {
+ to_print = short_string;
+ }
+
+ if(x > 10) {
+ to_print[11] = '?';
+ } else {
+ to_print[13] = '?'; /* DANGER if x <= 10 & x >= y */
+ }
+
+ printf("%s\n", to_print);
+}
+
+#ifndef NO_MAIN
+int main() {
+#ifdef NO_BUG
+ string_overflow_if_else_int1(9, 10);
+ string_overflow_if_else_int1(10, 11);
+ string_overflow_if_else_int1(11, 10);
+#else
+ string_overflow_if_else_int1(9, 10); /* OK */
+ string_overflow_if_else_int1(10, 10); /* DANGER */
+ string_overflow_if_else_int1(11, 10); /* OK */
+#endif
+
+ return 1;
+}
+#endif
diff --git a/bench-moerman2018/strings/overflow/02_simple_if_int2.c b/bench-moerman2018/strings/overflow/02_simple_if_int2.c
new file mode 100644
index 000000000..518f1a394
--- /dev/null
+++ b/bench-moerman2018/strings/overflow/02_simple_if_int2.c
@@ -0,0 +1,51 @@
+#include <stdio.h>
+#include <string.h>
+#include "string_overflow.h"
+
+void string_overflow_if_else_int2(int x, int y) {
+ char long_string[] = "this is a long string";
+ char short_string[] = "short string";
+ char* to_print;
+ int m, n;
+
+ m = -1;
+ n = 5;
+
+ x = x*m+n;
+
+#ifdef CATCH_BAD_PARAM
+ if(x <= 10 && x >= y) {
+ return;
+ }
+#endif
+
+ if(x < y) {
+ to_print = long_string;
+ } else {
+ to_print = short_string;
+ }
+
+ if(x > 10) {
+ to_print[11] = '?';
+ } else {
+ to_print[13] = '?'; /* DANGER if x <= 10 & x >= y */
+ }
+
+ printf("%s\n", to_print);
+}
+
+#ifndef NO_MAIN
+int main() {
+#ifdef NO_BUG
+ string_overflow_if_else_int2(-4, 11);
+ string_overflow_if_else_int2(-5, 11);
+ string_overflow_if_else_int2(-6, 11);
+#else
+ string_overflow_if_else_int2(-4, 10); /* OK */
+ string_overflow_if_else_int2(-5, 10); /* DANGER */
+ string_overflow_if_else_int2(-6, 10); /* OK */
+#endif
+
+ return 1;
+}
+#endif
diff --git a/bench-moerman2018/strings/overflow/03_simple_if_multi_func.c b/bench-moerman2018/strings/overflow/03_simple_if_multi_func.c
new file mode 100644
index 000000000..9c0574ef8
--- /dev/null
+++ b/bench-moerman2018/strings/overflow/03_simple_if_multi_func.c
@@ -0,0 +1,53 @@
+#include "string_overflow.h"
+#include <stdbool.h>
+#include <stdio.h>
+#include <string.h>
+
+static char* choose_string(char* string1, char* string2, bool condition) {
+ if(condition) {
+ return string1;
+ } else {
+ return string2;
+ }
+}
+
+static void overwrite_char(char* string, int pos1, int pos2, char replacement, bool condition) {
+ if(condition) {
+ string[pos1] = replacement;
+ } else {
+ string[pos2] = replacement;
+ }
+}
+
+void string_overflow_if_else_multi(bool a, bool b) {
+ char long_string[] = "this is a long string";
+ char short_string[] = "short string";
+ char* to_print;
+
+#ifdef CATCH_BAD_PARAM
+ if(!a & !b) {
+ return;
+ }
+#endif
+
+ to_print = choose_string(long_string, short_string, a);
+
+ overwrite_char(to_print, 11, 13, '?', b); /* DANGER, if !a & !b */
+
+ printf("%s\n", to_print);
+}
+
+#ifndef NO_MAIN
+int main() {
+#ifdef NO_BUG
+ string_overflow_if_else_multi(true, true);
+ string_overflow_if_else_multi(true, false);
+ string_overflow_if_else_multi(false, true);
+#else
+ string_overflow_if_else_multi(true, true); /* OK */
+ string_overflow_if_else_multi(false, false); /* DANGER */
+ string_overflow_if_else_multi(false, true); /* OK */
+#endif
+ return 1;
+}
+#endif
diff --git a/bench-moerman2018/strings/overflow/04_simple_switch.c b/bench-moerman2018/strings/overflow/04_simple_switch.c
new file mode 100644
index 000000000..48de0c9e1
--- /dev/null
+++ b/bench-moerman2018/strings/overflow/04_simple_switch.c
@@ -0,0 +1,64 @@
+#include "string_overflow.h"
+#include <string.h>
+#include <stdio.h>
+
+void string_overflow_switch(int x, int y) {
+ char long_string[22] = "this is a long string";
+ char short_string[13] = "short string";
+ char* to_print;
+
+#ifdef CATCH_BAD_PARAM
+ if((x == 10 || x == 5) && x >= y) {
+ return -1;
+ }
+#endif
+
+ if(x < y) {
+ to_print = long_string;
+ } else {
+ to_print = short_string;
+ }
+
+ switch (x) {
+ case 5: {
+ to_print[13] = '?'; /* DANGER: x >= y */
+ break;
+ }
+ case 7: {
+ to_print[11] = '?';
+ break;
+ }
+ case 10: {
+ to_print[15] = '?'; /* DANGER: x >= y */
+ break;
+ }
+ case 12: {
+ to_print[8] = '?';
+ break;
+ }
+ default: {
+ to_print[0] = '?';
+ break;
+ }
+ };
+
+ printf("%s\n", to_print);
+}
+
+#ifndef NO_MAIN
+int main() {
+#ifdef NO_BUG
+ string_overflow_switch(5, 11);
+ string_overflow_switch(10, 11);
+ string_overflow_switch(11, 11);
+ string_overflow_switch(7, 5);
+#else
+ string_overflow_switch(5, 10); /* OK */
+ string_overflow_switch(10, 10); /* DANGER */
+ string_overflow_switch(11, 10); /* OK */
+ string_overflow_switch(7, 5); /* OK */
+#endif
+
+ return 1;
+}
+#endif
diff --git a/bench-moerman2018/strings/overflow/05_simple_goto.c b/bench-moerman2018/strings/overflow/05_simple_goto.c
new file mode 100644
index 000000000..8342449af
--- /dev/null
+++ b/bench-moerman2018/strings/overflow/05_simple_goto.c
@@ -0,0 +1,44 @@
+#include <stdio.h>
+#include <string.h>
+#include "string_overflow.h"
+
+void string_overflow_goto(int x) {
+ char short_string[] = "Short string";
+ char to_print_text[] = "Default string content";
+ char* to_print = to_print_text;
+ int i;
+
+#ifdef CATCH_BAD_PARAM
+ if(x > 0) {
+ return;
+ }
+#endif
+
+ i = 0;
+
+GOTO_LABEL:
+ if(i <= x) {
+ to_print[15] = '?';
+ } else {
+ printf("%s\n", to_print);
+ }
+
+ to_print = short_string;
+
+ if(i == 0) {
+ i++;
+ goto GOTO_LABEL;
+ }
+}
+
+#ifndef NO_MAIN
+int main() {
+#ifdef NO_BUG
+ string_overflow_goto(0);
+#else
+ string_overflow_goto(1);
+#endif
+
+ return 1;
+}
+#endif
diff --git a/bench-moerman2018/strings/overflow/06_simple_pass_by_reference.c b/bench-moerman2018/strings/overflow/06_simple_pass_by_reference.c
new file mode 100644
index 000000000..0aab798da
--- /dev/null
+++ b/bench-moerman2018/strings/overflow/06_simple_pass_by_reference.c
@@ -0,0 +1,50 @@
+#include <stdio.h>
+#include <stdbool.h>
+#include <string.h>
+#include "string_overflow.h"
+
+static void choose_string(char** destination, char* string1, char* string2, bool condition) {
+ if(condition) {
+ *destination = string1;
+ } else {
+ *destination = string2;
+ }
+}
+
+void string_overflow_pass_by_reference(bool a, bool b) {
+ char long_string[22] = "this is a long string";
+ char short_string[13] = "short string";
+ char* to_print;
+
+#ifdef CATCH_BAD_PARAM
+ if(!a & !b) {
+ return;
+ }
+#endif
+
+ choose_string(&to_print, long_string, short_string, a);
+
+ if(b) {
+ to_print[11] = '?';
+ } else {
+ to_print[13] = '?'; /* DANGER if !a */
+ }
+
+ printf("%s\n", to_print);
+}
+
+#ifndef NO_MAIN
+int main() {
+#ifdef NO_BUG
+ string_overflow_pass_by_reference(true, true);
+ string_overflow_pass_by_reference(true, false);
+ string_overflow_pass_by_reference(false, true);
+#else
+ string_overflow_pass_by_reference(true, true); /* OK */
+ string_overflow_pass_by_reference(false, false); /* DANGER */
+ string_overflow_pass_by_reference(false, true); /* OK */
+#endif
+
+ return 1;
+}
+#endif
diff --git a/bench-moerman2018/strings/overflow/07_simple_cross_file.c b/bench-moerman2018/strings/overflow/07_simple_cross_file.c
new file mode 100644
index 000000000..c7a6952ec
--- /dev/null
+++ b/bench-moerman2018/strings/overflow/07_simple_cross_file.c
@@ -0,0 +1,42 @@
+#include "string_overflow.h"
+#include "common.h"
+#include <stdbool.h>
+#include <string.h>
+#include <stdio.h>
+
+void string_overflow_cross_file(bool a, bool b) {
+ char long_string[22] = "this is a long string";
+ char short_string[13] = "short string";
+ char* to_print;
+
+#ifdef CATCH_BAD_PARAM
+ if(!a & !b) {
+ return;
+ }
+#endif
+
+ to_print = (char*) choose_pointer((void*) long_string, (void*) short_string, a);
+
+ if(b) {
+ to_print[11] = '?';
+ } else {
+ to_print[13] = '?'; /* DANGER if !a */
+ }
+
+ printf("%s\n", to_print);
+}
+
+#ifndef NO_MAIN
+int main() {
+#ifdef NO_BUG
+ string_overflow_cross_file(true, true);
+ string_overflow_cross_file(true, false);
+ string_overflow_cross_file(false, true);
+#else
+ string_overflow_cross_file(true, true); /* OK */
+ string_overflow_cross_file(false, false); /* DANGER */
+ string_overflow_cross_file(false, true); /* OK */
+#endif
+ return 1;
+}
+#endif
diff --git a/bench-moerman2018/strings/overflow/08_loop_for.c b/bench-moerman2018/strings/overflow/08_loop_for.c
new file mode 100644
index 000000000..008ad0cbf
--- /dev/null
+++ b/bench-moerman2018/strings/overflow/08_loop_for.c
@@ -0,0 +1,40 @@
+#include <stdio.h>
+#include <string.h>
+#include "string_overflow.h"
+
+void string_overflow_for(int x) {
+ char long_string[22] = "this is a long string";
+ char short_string[5] = "1234";
+ char* to_print = short_string;
+ int i;
+
+#ifdef CATCH_BAD_PARAM
+ if(x < 10) {
+ return;
+ }
+#endif
+
+ for(i = 0; i < 20; i++) {
+ if(i > x) {
+ to_print[i] = '?'; /* DANGER: x < 10 */
+ } else {
+ to_print[3] = '?';
+ }
+ if(i == 10) {
+ to_print = long_string;
+ }
+ printf("val = %s\n", to_print);
+ }
+}
+
+#ifndef NO_MAIN
+int main() {
+#ifdef NO_BUG
+ string_overflow_for(10);
+#else
+ string_overflow_for(9);
+#endif
+
+ return 1;
+}
+#endif
diff --git a/bench-moerman2018/strings/overflow/09_loop_for_complex.c b/bench-moerman2018/strings/overflow/09_loop_for_complex.c
new file mode 100644
index 000000000..673a69b27
--- /dev/null
+++ b/bench-moerman2018/strings/overflow/09_loop_for_complex.c
@@ -0,0 +1,44 @@
+#include <stdio.h>
+#include <string.h>
+#include "string_overflow.h"
+
+void string_overflow_for_complex(int x) {
+ char long_string[22] = "this is a long string";
+ char short_string[13] = "short string";
+ char* to_print = short_string;
+ int i = 0;
+
+#ifdef CATCH_BAD_PARAM
+ if(x < 10) {
+ return;
+ }
+#endif
+
+ for(;;) {
+ if(i > x) {
+ to_print[13] = '?'; /* DANGER: x < 10 */
+ } else {
+ to_print[11] = '?';
+ }
+ if(i == 10) {
+ to_print = long_string;
+ }
+ printf("val = %s\n", to_print);
+ i++;
+ if(i >= 20) {
+ break;
+ }
+ }
+}
+
+#ifndef NO_MAIN
+int main() {
+#ifdef NO_BUG
+ string_overflow_for_complex(10);
+#else
+ string_overflow_for_complex(9);
+#endif
+
+ return 1;
+}
+#endif
diff --git a/bench-moerman2018/strings/overflow/10_loop_while_continue.c b/bench-moerman2018/strings/overflow/10_loop_while_continue.c
new file mode 100644
index 000000000..31c12b6eb
--- /dev/null
+++ b/bench-moerman2018/strings/overflow/10_loop_while_continue.c
@@ -0,0 +1,44 @@
+#include <stdio.h>
+#include <string.h>
+#include "string_overflow.h"
+
+void string_overflow_while_continue(int x) {
+ char long_string[22] = "this is a long string";
+ char short_string[13] = "short string";
+ char* to_print = short_string;
+ int i = 0;
+
+#ifdef CATCH_BAD_PARAM
+ if(x < 10) {
+ return;
+ }
+#endif
+
+ while(i < 30) {
+ if(i > x) {
+ to_print[13] = '?'; /* DANGER: x < 10 */
+ } else {
+ to_print[11] = '?';
+ }
+ if(i == 10) {
+ to_print = long_string;
+ }
+ printf("val = %s\n", to_print);
+ i++;
+ if(i < 20) {
+ continue;
+ }
+ }
+}
+
+#ifndef NO_MAIN
+int main() {
+#ifdef NO_BUG
+ string_overflow_while_continue(10);
+#else
+ string_overflow_while_continue(9);
+#endif
+
+ return 1;
+}
+#endif
diff --git a/bench-moerman2018/strings/overflow/11_loop_while_do_continue.c b/bench-moerman2018/strings/overflow/11_loop_while_do_continue.c
new file mode 100644
index 000000000..4dcf33636
--- /dev/null
+++ b/bench-moerman2018/strings/overflow/11_loop_while_do_continue.c
@@ -0,0 +1,44 @@
+#include <stdio.h>
+#include <string.h>
+#include "string_overflow.h"
+
+void string_overflow_do_while_continue(int x) {
+ char long_string[22] = "this is a long string";
+ char short_string[13] = "short string";
+ char* to_print = short_string;
+ int i = 0;
+
+#ifdef CATCH_BAD_PARAM
+ if(x < 10) {
+ return;
+ }
+#endif
+
+ do {
+ if(i > x) {
+ to_print[13] = '?'; /* DANGER: x < 10 */
+ } else {
+ to_print[11] = '?';
+ }
+ if(i == 10) {
+ to_print = long_string;
+ }
+ printf("val = %s\n", to_print);
+ i++;
+ if(i < 20) {
+ continue;
+ }
+ } while(i < 30);
+}
+
+#ifndef NO_MAIN
+int main() {
+#ifdef NO_BUG
+ string_overflow_do_while_continue(10);
+#else
+ string_overflow_do_while_continue(9);
+#endif
+
+ return 1;
+}
+#endif
diff --git a/bench-moerman2018/strings/overflow/12_loop_for_array_branching.c b/bench-moerman2018/strings/overflow/12_loop_for_array_branching.c
new file mode 100644
index 000000000..d6f95428c
--- /dev/null
+++ b/bench-moerman2018/strings/overflow/12_loop_for_array_branching.c
@@ -0,0 +1,48 @@
+#include <stdio.h>
+#include <string.h>
+#include "string_overflow.h"
+
+void string_overflow_for_array(int x) {
+ int p[20];
+ char long_string[22] = "this is a long string";
+ char short_string[13] = "short string";
+ char* to_print = long_string;
+ int i = 0;
+
+ if(x < 0 || x > 19) {
+ return;
+ }
+
+#ifdef CATCH_BAD_PARAM
+ if(x != 19) {
+ return;
+ }
+#endif
+
+ for(i = 0; i < 20; i++) {
+ p[i] = 0;
+ }
+ p[x] = 1;
+
+ for(i = 0; i < 20; i++) {
+ if(p[i] == 1) {
+ to_print = short_string;
+ } else {
+ to_print[13] = '?'; /* DANGER: x < 19 */
+ }
+ }
+
+ printf("%s\n", to_print);
+}
+
+#ifndef NO_MAIN
+int main() {
+#ifdef NO_BUG
+ string_overflow_for_array(19);
+#else
+ string_overflow_for_array(10);
+#endif
+
+ return 1;
+}
+#endif
diff --git a/bench-moerman2018/strings/overflow/13_loop_for_pointer_arithmetic.c b/bench-moerman2018/strings/overflow/13_loop_for_pointer_arithmetic.c
new file mode 100644
index 000000000..091c3ea11
--- /dev/null
+++ b/bench-moerman2018/strings/overflow/13_loop_for_pointer_arithmetic.c
@@ -0,0 +1,53 @@
+#include <stdlib.h>
+#include <stdio.h>
+#include <string.h>
+#include "string_overflow.h"
+
+static void initialize_to_string(char* arr[], char* string, int length) {
+ int i;
+
+ for(i = 0; i < length; i++) {
+ arr[i] = string;
+ }
+}
+
+void string_overflow_for_pointer(int x) {
+ char* string_arr[10];
+ char** ptr;
+ char long_string[22] = "this is a long string";
+ char short_string[13] = "short string";
+ int val = 0, i;
+
+ if(x < 0 || x > 10) {
+ return;
+ }
+
+#ifdef CATCH_BAD_PARAM
+ if(x != 10) {
+ return;
+ }
+#endif
+
+ initialize_to_string(string_arr, short_string, 10);
+ initialize_to_string(string_arr, long_string, x);
+
+ ptr = string_arr;
+
+ for(i = 0; i < 10; i++, ptr++) {
+ (*string_arr)[13] = (char) i;
+ }
+
+ printf("%s\n", *ptr);
+}
+
+#ifndef NO_MAIN
+int main() {
+#ifdef NO_BUG
+ string_overflow_for_pointer(10);
+#else
+ string_overflow_for_pointer(9);
+#endif
+
+ return 1;
+}
+#endif
diff --git a/bench-moerman2018/strings/overflow/14_loop_recursion.c b/bench-moerman2018/strings/overflow/14_loop_recursion.c
new file mode 100644
index 000000000..f68204e91
--- /dev/null
+++ b/bench-moerman2018/strings/overflow/14_loop_recursion.c
@@ -0,0 +1,43 @@
+#include <stdio.h>
+#include <string.h>
+#include "string_overflow.h"
+
+static char long_string[22] = "";
+static char short_string[13] = "";
+
+void string_overflow_rec(int x, int i, char* to_print) {
+ if(i <= 1) {
+ printf("%s\n", to_print);
+ return;
+ }
+
+#ifdef CATCH_BAD_PARAM
+ if(x < 10) {
+ printf("%s\n", to_print);
+ return;
+ }
+#endif
+
+ if(i > x) {
+ to_print[13] = '?';
+ } else {
+ to_print[11] = '?';
+ }
+
+ if(i == 10) {
+ to_print = short_string;
+ }
+ string_overflow_rec(x, i-1, to_print);
+}
+
+#ifndef NO_MAIN
+int main() {
+#ifdef NO_BUG
+ string_overflow_rec(10, 20, long_string);
+#else
+ string_overflow_rec(9, 20, long_string);
+#endif
+
+ return 1;
+}
+#endif
diff --git a/bench-moerman2018/strings/overflow/15_loop_recursion_multi.c b/bench-moerman2018/strings/overflow/15_loop_recursion_multi.c
new file mode 100644
index 000000000..87dd23668
--- /dev/null
+++ b/bench-moerman2018/strings/overflow/15_loop_recursion_multi.c
@@ -0,0 +1,49 @@
+#include <stdio.h>
+#include <string.h>
+#include "string_overflow.h"
+
+static char long_string[22] = "";
+static char short_string[13] = "";
+
+void string_overflow_rec_decr(int x, int i, char* to_print) {
+ if(i <= 1) {
+ printf("%s\n", to_print);
+ return;
+ }
+
+ string_overflow_rec_multi(x, i-1, to_print);
+}
+
+void string_overflow_rec_multi(int x, int i, char* to_print) {
+#ifdef CATCH_BAD_PARAM
+ if(x < 10) {
+ printf("%s\n", to_print);
+ return;
+ }
+#endif
+
+ if(i > x) {
+ to_print[13] = '?';
+ } else {
+ to_print[11] = '?';
+ }
+
+ if(i == 10) {
+ to_print = short_string;
+ }
+ string_overflow_rec_decr(x, i, to_print);
+}
+
+
+
+#ifndef NO_MAIN
+int main() {
+#ifdef NO_BUG
+ string_overflow_rec_multi(10, 20, long_string);
+#else
+ string_overflow_rec_multi(11, 20, long_string);
+#endif
+
+ return 1;
+}
+#endif
diff --git a/bench-moerman2018/strings/overflow/16_misc_pseudo_recursion.c b/bench-moerman2018/strings/overflow/16_misc_pseudo_recursion.c
new file mode 100644
index 000000000..1f9e4ae14
--- /dev/null
+++ b/bench-moerman2018/strings/overflow/16_misc_pseudo_recursion.c
@@ -0,0 +1,55 @@
+#include <stdio.h>
+#include <string.h>
+#include "string_overflow.h"
+
+static char long_string[22] = "";
+static char short_string[13] = "";
+
+void string_overflow_pseudo_rec1(int x, int y, int i, char* to_print) {
+
+#ifdef CATCH_BAD_PARAM
+ if(x <= 10 && x >= y) {
+ return;
+ }
+#endif
+
+ if(i > 0) {
+ return;
+ }
+
+ if(x > 10) {
+ if(!to_print) {
+ to_print = long_string;
+ }
+ } else {
+ to_print = short_string;
+ }
+
+ string_overflow_pseudo_rec2(x, y, 1,to_print);
+}
+
+void string_overflow_pseudo_rec2(int x, int y, int i, char* to_print) {
+ if(i > 0) {
+ if(x < y) {
+ to_print[11] = '?';
+ } else {
+ to_print[13] = '?';
+ }
+ printf("%s\n", to_print);
+ } else {
+ string_overflow_pseudo_rec1(x, y, 1, to_print);
+ }
+}
+
+#ifndef NO_MAIN
+int main() {
+#ifdef NO_BUG
+ string_overflow_pseudo_rec1(9, 10, 0, 0);
+ string_overflow_pseudo_rec1(11, 10, 0, 0);
+#else
+ string_overflow_pseudo_rec1(10, 10, 0, 0);
+#endif
+
+ return 1;
+}
+#endif
diff --git a/bench-moerman2018/strings/overflow/17_complex_function_pointers.c b/bench-moerman2018/strings/overflow/17_complex_function_pointers.c
new file mode 100644
index 000000000..d7df75687
--- /dev/null
+++ b/bench-moerman2018/strings/overflow/17_complex_function_pointers.c
@@ -0,0 +1,51 @@
+#include <stdio.h>
+#include <stdbool.h>
+#include <string.h>
+#include "string_overflow.h"
+
+static char long_string[22] = "";
+static char short_string[13] = "";
+
+static void select_string(char** dest, bool condition) {
+ if(condition) {
+ *dest = long_string;
+ } else {
+ *dest = short_string;
+ }
+}
+
+void string_overflow_function_pointer(bool a, bool b, void (*f)(char**, bool)) {
+ char* to_print;
+
+#ifdef CATCH_BAD_PARAM
+ if(!f || (!a & !b)) {
+ return;
+ }
+#endif
+
+ (*f)(&to_print, a);
+
+ if(b) {
+ to_print[11] = '?';
+ } else {
+ to_print[13] = '?'; /* DANGER, if !a & !b */
+ }
+
+ printf("%s\n", to_print);
+}
+
+#ifndef NO_MAIN
+int main() {
+#ifdef NO_BUG
+ string_overflow_function_pointer(true, true, &select_string);
+ string_overflow_function_pointer(true, false, &select_string);
+ string_overflow_function_pointer(false, true, &select_string);
+#else
+ string_overflow_function_pointer(true, true, &select_string); /* OK */
+ string_overflow_function_pointer(false, false, &select_string); /* DANGER */
+ string_overflow_function_pointer(false, true, &select_string); /* OK */
+#endif
+
+ return 1;
+}
+#endif
diff --git a/bench-moerman2018/strings/overflow/18_complex_struct_multiple_methods.c b/bench-moerman2018/strings/overflow/18_complex_struct_multiple_methods.c
new file mode 100644
index 000000000..3d2000170
--- /dev/null
+++ b/bench-moerman2018/strings/overflow/18_complex_struct_multiple_methods.c
@@ -0,0 +1,93 @@
+#include <stdio.h>
+#include <stdlib.h>
+#include <string.h>
+#include "string_overflow.h"
+
+static char long_string[22] = "";
+static char short_string[13] = "";
+
+#ifndef s_STRINGS_O_REFCOUNT
+#define s_STRINGS_O_REFCOUNT
+static char small_string[15] = "";
+
+void string_overflow_cont_init(StringCont* cont) {
+ cont->counter = 1;
+ cont->small_string = small_string;
+ cont->normal_string = 0;
+ cont->selected_string = &(cont->normal_string);
+}
+
+StringCont* string_overflow_cont_new() {
+ StringCont* new_cont;
+
+ new_cont = malloc(sizeof(StringCont));
+
+ if(new_cont) {
+ string_overflow_cont_init(new_cont);
+ }
+ return new_cont;
+}
+
+void string_overflow_cont_incr(StringCont* cont) {
+ if(cont) {
+ cont->counter++;
+ }
+}
+void string_overflow_cont_decr(StringCont* cont) {
+ if(cont->counter <= 1) {
+ cont->selected_string = &(cont->small_string);
+ } else {
+ cont->counter--;
+ }
+}
+
+char* string_overflow_cont_get_string(StringCont* cont) {
+ return *(cont->selected_string);
+}
+void string_overflow_cont_set_string(StringCont* cont, char* string) {
+ cont->normal_string = string;
+}
+#endif //s_STRINGS_O_REFCOUNT
+
+void string_overflow_struct(int x, int y) {
+ StringCont cont;
+ char* to_print;
+
+#ifdef CATCH_BAD_PARAM
+ if(x <= 10 && x >= y) {
+ return;
+ }
+#endif
+ string_overflow_cont_init(&cont);
+
+ string_overflow_cont_set_string(&cont, short_string);
+
+ if(x < y) {
+ string_overflow_cont_set_string(&cont, long_string);
+ }
+
+ to_print = string_overflow_cont_get_string(&cont);
+
+ if(x > 10) {
+ to_print[11] = '?';
+ } else {
+ /* DANGER: if x <= 10 & x >= y */
+ to_print[13] = '?';
+ }
+
+ printf("%s\n", string_overflow_cont_get_string(&cont));
+}
+
+#ifndef NO_MAIN
+int main() {
+#ifdef NO_BUG
+ string_overflow_struct(9, 10);
+ string_overflow_struct(10, 11);
+ string_overflow_struct(11, 10);
+#else
+ string_overflow_struct(10, 10); /* DANGER */
+#endif
+
+ return 1;
+}
+#endif
diff --git a/bench-moerman2018/strings/overflow/19_complex_refcount.c b/bench-moerman2018/strings/overflow/19_complex_refcount.c
new file mode 100644
index 000000000..19c16a10f
--- /dev/null
+++ b/bench-moerman2018/strings/overflow/19_complex_refcount.c
@@ -0,0 +1,77 @@
+#include "string_overflow.h"
+#include <stdlib.h>
+#include <stdio.h>
+#include <string.h>
+
+static char long_string[22] = "";
+
+#ifndef s_STRINGS_O_REFCOUNT
+#define s_STRINGS_O_REFCOUNT
+static char small_string[13] = "";
+
+void string_overflow_cont_init(StringCont* cont) {
+ cont->counter = 1;
+ cont->small_string = small_string;
+ cont->normal_string = 0;
+ cont->selected_string = &(cont->normal_string);
+}
+
+StringCont* string_overflow_cont_new() {
+ StringCont* new_cont;
+
+ new_cont = malloc(sizeof(StringCont));
+
+ if(new_cont) {
+ string_overflow_cont_init(new_cont);
+ }
+ return new_cont;
+}
+
+void string_overflow_cont_incr(StringCont* cont) {
+ if(cont) {
+ cont->counter++;
+ }
+}
+void string_overflow_cont_decr(StringCont* cont) {
+ if(cont->counter <= 1) {
+ cont->selected_string = (char**) &(cont->small_string);
+ } else {
+ cont->counter--;
+ }
+}
+
+char* string_overflow_cont_get_string(StringCont* cont) {
+ return *(cont->selected_string);
+}
+void string_overflow_cont_set_string(StringCont* cont, char* string) {
+ cont->normal_string = string;
+}
+#endif //s_STRINGS_O_REFCOUNT
+
+#ifndef NO_MAIN
+int main() {
+ StringCont* cont;
+
+ cont = string_overflow_cont_new();
+ if(!cont) {
+ return 1;
+ }
+ string_overflow_cont_set_string(cont, long_string);
+
+ string_overflow_cont_incr(cont);
+ string_overflow_cont_incr(cont);
+ string_overflow_cont_decr(cont);
+ string_overflow_cont_decr(cont);
+#ifndef NO_BUG
+ string_overflow_cont_decr(cont);
+#endif
+
+ string_overflow_cont_get_string(cont)[13] = '?';
+
+ printf("%s\n", string_overflow_cont_get_string(cont));
+
+ free(cont);
+
+ return 1;
+}
+#endif
diff --git a/bench-moerman2018/strings/overflow/string_overflow.h b/bench-moerman2018/strings/overflow/string_overflow.h
new file mode 100644
index 000000000..76caf866c
--- /dev/null
+++ b/bench-moerman2018/strings/overflow/string_overflow.h
@@ -0,0 +1,38 @@
+#include <stdbool.h>
+
+typedef struct _StringCont StringCont;
+
+struct _StringCont {
+ char** selected_string;
+ char* normal_string;
+ char* small_string;
+ unsigned int counter;
+};
+
+void string_overflow_cont_init(StringCont* cont);
+StringCont* string_overflow_cont_new();
+void string_overflow_cont_incr(StringCont* cont);
+void string_overflow_cont_decr(StringCont* cont);
+char* string_overflow_cont_get_string(StringCont* cont);
+void string_overflow_cont_set_string(StringCont* cont, char* string);
+
+void string_overflow_for(int x);
+void string_overflow_for_complex(int x);
+void string_overflow_while_continue(int x);
+void string_overflow_do_while_continue(int x);
+void string_overflow_for_array(int x);
+void string_overflow_for_pointer(int x);
+void string_overflow_goto(int x);
+void string_overflow_if_else(bool a, bool b);
+void string_overflow_if_else_multi(bool a, bool b);
+void string_overflow_if_else_int1(int x, int y);
+void string_overflow_if_else_int2(int x, int y);
+void string_overflow_pass_by_reference(bool a, bool b);
+void string_overflow_switch(int x, int y);
+void string_overflow_rec_multi(int x, int i, char* to_print);
+void string_overflow_rec(int x, int i, char* to_print);
+void string_overflow_pseudo_rec1(int x, int y, int i, char* to_print);
+void string_overflow_pseudo_rec2(int x, int y, int i, char* to_print);
+void string_overflow_struct(int x, int y);
+void string_overflow_function_pointer(bool a, bool b, void (*f)(char**, bool));
+void string_overflow_cross_file(bool a, bool b);
diff --git a/bench-moerman2018/strings/unbounded_copy/01_simple_if.c b/bench-moerman2018/strings/unbounded_copy/01_simple_if.c
new file mode 100644
index 000000000..78a15c070
--- /dev/null
+++ b/bench-moerman2018/strings/unbounded_copy/01_simple_if.c
@@ -0,0 +1,46 @@
+#include <stdio.h>
+#include <stdbool.h>
+#include <string.h>
+#include "string_copy.h"
+
+void string_copy_if_else(bool a, bool b) {
+ char long_string[22];
+ char short_string[13];
+ char* to_print;
+
+#ifdef CATCH_BAD_PARAM
+ if(!a & !b) {
+ return;
+ }
+#endif
+
+ if(a) {
+ to_print = long_string;
+ } else {
+ to_print = short_string;
+ }
+
+ if(b) {
+ strcpy(to_print, "short string");
+ } else {
+ strcpy(to_print, "this is a long string");
+ }
+
+ printf("%s\n", to_print);
+}
+
+#ifndef NO_MAIN
+int main() {
+#ifdef NO_BUG
+ string_copy_if_else(true, true);
+ string_copy_if_else(true, false);
+ string_copy_if_else(false, true);
+#else
+ string_copy_if_else(true, true); /* OK */
+ string_copy_if_else(false, false); /* DANGER */
+ string_copy_if_else(false, true); /* OK */
+#endif
+
+ return 1;
+}
+#endif
diff --git a/bench-moerman2018/strings/unbounded_copy/02_simple_if_int1.c b/bench-moerman2018/strings/unbounded_copy/02_simple_if_int1.c
new file mode 100644
index 000000000..2ffbf2c9d
--- /dev/null
+++ b/bench-moerman2018/strings/unbounded_copy/02_simple_if_int1.c
@@ -0,0 +1,45 @@
+#include <stdio.h>
+#include <string.h>
+#include "string_copy.h"
+
+void string_copy_if_else_int1(int x, int y) {
+ char long_string[22];
+ char short_string[13];
+ char* to_print;
+
+#ifdef CATCH_BAD_PARAM
+ if(x <= 10 && x >= y) {
+ return;
+ }
+#endif
+
+ if(x < y) {
+ to_print = long_string;
+ } else {
+ to_print = short_string;
+ }
+
+ if(x > 10) {
+ strcpy(to_print, "short string");
+ } else {
+ strcpy(to_print, "this is a long string"); /* DANGER if x <= 10 & x >= y */
+ }
+
+ printf("%s\n", to_print);
+}
+
+#ifndef NO_MAIN
+int main() {
+#ifdef NO_BUG
+ string_copy_if_else_int1(9, 10);
+ string_copy_if_else_int1(10, 11);
+ string_copy_if_else_int1(11, 10);
+#else
+ string_copy_if_else_int1(9, 10); /* OK */
+ string_copy_if_else_int1(10, 10); /* DANGER */
+ string_copy_if_else_int1(11, 10); /* OK */
+#endif
+
+ return 1;
+}
+#endif
diff --git a/bench-moerman2018/strings/unbounded_copy/02_simple_if_int2.c b/bench-moerman2018/strings/unbounded_copy/02_simple_if_int2.c
new file mode 100644
index 000000000..4fb67d642
--- /dev/null
+++ b/bench-moerman2018/strings/unbounded_copy/02_simple_if_int2.c
@@ -0,0 +1,51 @@
+#include <stdio.h>
+#include <string.h>
+#include "string_copy.h"
+
+void string_copy_if_else_int2(int x, int y) {
+ char long_string[22];
+ char short_string[13];
+ char* to_print;
+ int m, n;
+
+ m = -1;
+ n = 5;
+
+ x = x*m+n;
+
+#ifdef CATCH_BAD_PARAM
+ if(x <= 10 && x >= y) {
+ return;
+ }
+#endif
+
+ if(x < y) {
+ to_print = long_string;
+ } else {
+ to_print = short_string;
+ }
+
+ if(x > 10) {
+ strcpy(to_print, "short string");
+ } else {
+ strcpy(to_print, "this is a long string"); /* DANGER if x <= 10 & x >= y */
+ }
+
+ printf("%s\n", to_print);
+}
+
+#ifndef NO_MAIN
+int main() {
+#ifdef NO_BUG
+ string_copy_if_else_int2(-4, 11);
+ string_copy_if_else_int2(-5, 11);
+ string_copy_if_else_int2(-6, 11);
+#else
+ string_copy_if_else_int2(-4, 10); /* OK */
+ string_copy_if_else_int2(-5, 10); /* DANGER */
+ string_copy_if_else_int2(-6, 10); /* OK */
+#endif
+
+ return 1;
+}
+#endif
diff --git a/bench-moerman2018/strings/unbounded_copy/03_simple_if_multi_func.c b/bench-moerman2018/strings/unbounded_copy/03_simple_if_multi_func.c
new file mode 100644
index 000000000..6a8baba6c
--- /dev/null
+++ b/bench-moerman2018/strings/unbounded_copy/03_simple_if_multi_func.c
@@ -0,0 +1,53 @@
+#include "string_copy.h"
+#include <stdbool.h>
+#include <stdio.h>
+#include <string.h>
+
+static char* choose_string(char* string1, char* string2, bool condition) {
+ if(condition) {
+ return string1;
+ } else {
+ return string2;
+ }
+}
+
+static void conditional_copy(char* destination, char* source1, char* source2, bool condition) {
+ if(condition) {
+ strcpy(destination, source1);
+ } else {
+ strcpy(destination, source2);
+ }
+}
+
+void string_copy_if_else_multi(bool a, bool b) {
+ char long_string[22];
+ char short_string[13];
+ char* to_print;
+
+#ifdef CATCH_BAD_PARAM
+ if(!a & !b) {
+ return;
+ }
+#endif
+
+ to_print = choose_string(long_string, short_string, a);
+
+ conditional_copy(to_print, "short string", "this is a long string", b); /* DANGER, if !a & !b */
+
+ printf("%s\n", to_print);
+}
+
+#ifndef NO_MAIN
+int main() {
+#ifdef NO_BUG
+ string_copy_if_else_multi(true, true);
+ string_copy_if_else_multi(true, false);
+ string_copy_if_else_multi(false, true);
+#else
+ string_copy_if_else_multi(true, true); /* OK */
+ string_copy_if_else_multi(false, false); /* DANGER */
+ string_copy_if_else_multi(false, true); /* OK */
+#endif
+ return 1;
+}
+#endif
diff --git a/bench-moerman2018/strings/unbounded_copy/04_simple_switch.c b/bench-moerman2018/strings/unbounded_copy/04_simple_switch.c
new file mode 100644
index 000000000..2429fe3c0
--- /dev/null
+++ b/bench-moerman2018/strings/unbounded_copy/04_simple_switch.c
@@ -0,0 +1,66 @@
+#include "string_copy.h"
+#include <string.h>
+#include <stdio.h>
+
+void string_copy_switch(int x, int y) {
+ char long_string[22];
+ char short_string[13];
+ char long_string_input[] = "this is a long string";
+ char short_string_input[] = "short string";
+ char* to_print;
+
+#ifdef CATCH_BAD_PARAM
+ if((x == 10 || x == 5) && x >= y) {
+ return;
+ }
+#endif
+
+ if(x < y) {
+ to_print = long_string;
+ } else {
+ to_print = short_string;
+ }
+
+ switch (x) {
+ case 5: {
+ strcpy(to_print, long_string_input); /* DANGER: x >= y */
+ break;
+ }
+ case 7: {
+ strcpy(to_print, short_string_input);
+ break;
+ }
+ case 10: {
+ strcpy(to_print, long_string_input); /* DANGER: x >= y */
+ break;
+ }
+ case 12: {
+ strcpy(to_print, short_string_input);
+ break;
+ }
+ default: {
+ strcpy(to_print, short_string_input);
+ break;
+ }
+ };
+
+ printf("%s\n", to_print);
+}
+
+#ifndef NO_MAIN
+int main() {
+#ifdef NO_BUG
+ string_copy_switch(5, 11);
+ string_copy_switch(10, 11);
+ string_copy_switch(11, 11);
+ string_copy_switch(7, 5);
+#else
+ string_copy_switch(5, 10); /* OK */
+ string_copy_switch(10, 10); /* DANGER */
+ string_copy_switch(11, 10); /* OK */
+ string_copy_switch(7, 5); /* OK */
+#endif
+
+ return 1;
+}
+#endif
diff --git a/bench-moerman2018/strings/unbounded_copy/05_simple_goto.c b/bench-moerman2018/strings/unbounded_copy/05_simple_goto.c
new file mode 100644
index 000000000..63463950c
--- /dev/null
+++ b/bench-moerman2018/strings/unbounded_copy/05_simple_goto.c
@@ -0,0 +1,43 @@
+#include <stdio.h>
+#include <string.h>
+#include "string_copy.h"
+
+void string_copy_goto(int x) {
+ char short_string[] = "Short string";
+ char* to_print = "Default string content";
+ int i;
+
+#ifdef CATCH_BAD_PARAM
+ if(x > 0) {
+ return;
+ }
+#endif
+
+ i = 0;
+
+GOTO_LABEL:
+ if(i <= x) {
+ strcpy(to_print, "this is a long string");
+ } else {
+ printf("%s\n", to_print);
+ }
+
+ to_print = short_string;
+
+ if(i == 0) {
+ i++;
+ goto GOTO_LABEL;
+ }
+}
+
+#ifndef NO_MAIN
+int main() {
+#ifdef NO_BUG
+ string_copy_goto(0);
+#else
+ string_copy_goto(1);
+#endif
+
+ return 1;
+}
+#endif
diff --git a/bench-moerman2018/strings/unbounded_copy/06_simple_pass_by_reference.c b/bench-moerman2018/strings/unbounded_copy/06_simple_pass_by_reference.c
new file mode 100644
index 000000000..f54879a8c
--- /dev/null
+++ b/bench-moerman2018/strings/unbounded_copy/06_simple_pass_by_reference.c
@@ -0,0 +1,50 @@
+#include <stdio.h>
+#include <stdbool.h>
+#include <string.h>
+#include "string_copy.h"
+
+static void choose_string(char** destination, char* string1, char* string2, bool condition) {
+ if(condition) {
+ *destination = string1;
+ } else {
+ *destination = string2;
+ }
+}
+
+void string_copy_pass_by_reference(bool a, bool b) {
+ char long_string[22];
+ char short_string[13];
+ char* to_print;
+
+#ifdef CATCH_BAD_PARAM
+ if(!a & !b) {
+ return;
+ }
+#endif
+
+ choose_string(&to_print, long_string, short_string, a);
+
+ if(b) {
+ strcpy(to_print, "short string");
+ } else {
+ strcpy(to_print, "this is a long string");
+ }
+
+ printf("%s\n", to_print);
+}
+
+#ifndef NO_MAIN
+int main() {
+#ifdef NO_BUG
+ string_copy_pass_by_reference(true, true);
+ string_copy_pass_by_reference(true, false);
+ string_copy_pass_by_reference(false, true);
+#else
+ string_copy_pass_by_reference(true, true); /* OK */
+ string_copy_pass_by_reference(false, false); /* DANGER */
+ string_copy_pass_by_reference(false, true); /* OK */
+#endif
+
+ return 1;
+}
+#endif
diff --git a/bench-moerman2018/strings/unbounded_copy/07_simple_cross_file.c b/bench-moerman2018/strings/unbounded_copy/07_simple_cross_file.c
new file mode 100644
index 000000000..50dea7bde
--- /dev/null
+++ b/bench-moerman2018/strings/unbounded_copy/07_simple_cross_file.c
@@ -0,0 +1,42 @@
+#include "string_copy.h"
+#include "common.h"
+#include <stdbool.h>
+#include <string.h>
+#include <stdio.h>
+
+void string_copy_cross_file(bool a, bool b) {
+ char long_string[22];
+ char short_string[13];
+ char* to_print;
+
+#ifdef CATCH_BAD_PARAM
+ if(!a & !b) {
+ return;
+ }
+#endif
+
+ to_print = (char*) choose_pointer((void*) long_string, (void*) short_string, a);
+
+ if(b) {
+ strcpy(to_print, "short string");
+ } else {
+ strcpy(to_print, "this is a long string");
+ }
+
+ printf("%s\n", to_print);
+}
+
+#ifndef NO_MAIN
+int main() {
+#ifdef NO_BUG
+ string_copy_cross_file(true, true);
+ string_copy_cross_file(true, false);
+ string_copy_cross_file(false, true);
+#else
+ string_copy_cross_file(true, true); /* OK */
+ string_copy_cross_file(false, false); /* DANGER */
+ string_copy_cross_file(false, true); /* OK */
+#endif
+ return 1;
+}
+#endif
diff --git a/bench-moerman2018/strings/unbounded_copy/08_loop_for.c b/bench-moerman2018/strings/unbounded_copy/08_loop_for.c
new file mode 100644
index 000000000..e80f50f70
--- /dev/null
+++ b/bench-moerman2018/strings/unbounded_copy/08_loop_for.c
@@ -0,0 +1,40 @@
+#include <stdio.h>
+#include <string.h>
+#include "string_copy.h"
+
+void string_copy_for(int x) {
+ char long_string[22];
+ char short_string[13];
+ char* to_print = short_string;
+ int i;
+
+#ifdef CATCH_BAD_PARAM
+ if(x < 10) {
+ return;
+ }
+#endif
+
+ for(i = 0; i < 20; i++) {
+ if(i > x) {
+ strcpy(to_print, "this is a long string"); /* DANGER: x < 10 */
+ } else {
+ strcpy(to_print, "short string");
+ }
+ if(i == 10) {
+ to_print = long_string;
+ }
+ printf("val = %s\n", to_print);
+ }
+}
+
+#ifndef NO_MAIN
+int main() {
+#ifdef NO_BUG
+ string_copy_for(10);
+#else
+ string_copy_for(9);
+#endif
+
+ return 1;
+}
+#endif
diff --git a/bench-moerman2018/strings/unbounded_copy/09_loop_for_complex.c b/bench-moerman2018/strings/unbounded_copy/09_loop_for_complex.c
new file mode 100644
index 000000000..7fd9ddcf9
--- /dev/null
+++ b/bench-moerman2018/strings/unbounded_copy/09_loop_for_complex.c
@@ -0,0 +1,44 @@
+#include <stdio.h>
+#include <string.h>
+#include "string_copy.h"
+
+void string_copy_for_complex(int x) {
+ char long_string[22];
+ char short_string[13];
+ char* to_print = short_string;
+ int i = 0;
+
+#ifdef CATCH_BAD_PARAM
+ if(x < 10) {
+ return;
+ }
+#endif
+
+ for(;;) {
+ if(i > x) {
+ strcpy(to_print, "this is a long string"); /* DANGER: x < 10 */
+ } else {
+ strcpy(to_print, "short string");
+ }
+ if(i == 10) {
+ to_print = long_string;
+ }
+ printf("val = %s\n", to_print);
+ i++;
+ if(i >= 20) {
+ break;
+ }
+ }
+}
+
+#ifndef NO_MAIN
+int main() {
+#ifdef NO_BUG
+ string_copy_for_complex(10);
+#else
+ string_copy_for_complex(9);
+#endif
+
+ return 1;
+}
+#endif
diff --git a/bench-moerman2018/strings/unbounded_copy/10_loop_while_continue.c b/bench-moerman2018/strings/unbounded_copy/10_loop_while_continue.c
new file mode 100644
index 000000000..9c38cc90b
--- /dev/null
+++ b/bench-moerman2018/strings/unbounded_copy/10_loop_while_continue.c
@@ -0,0 +1,44 @@
+#include <stdio.h>
+#include <string.h>
+#include "string_copy.h"
+
+void string_copy_while_continue(int x) {
+ char long_string[22];
+ char short_string[13];
+ char* to_print = short_string;
+ int i = 0;
+
+#ifdef CATCH_BAD_PARAM
+ if(x < 10) {
+ return;
+ }
+#endif
+
+ while(i < 30) {
+ if(i > x) {
+ strcpy(to_print, "this is a long string"); /* DANGER: x < 10 */
+ } else {
+ strcpy(to_print, "short string");
+ }
+ if(i == 10) {
+ to_print = long_string;
+ }
+ printf("val = %s\n", to_print);
+ i++;
+ if(i < 20) {
+ continue;
+ }
+ }
+}
+
+#ifndef NO_MAIN
+int main() {
+#ifdef NO_BUG
+ string_copy_while_continue(10);
+#else
+ string_copy_while_continue(9);
+#endif
+
+ return 1;
+}
+#endif
diff --git a/bench-moerman2018/strings/unbounded_copy/11_loop_while_do_continue.c b/bench-moerman2018/strings/unbounded_copy/11_loop_while_do_continue.c
new file mode 100644
index 000000000..bf2231252
--- /dev/null
+++ b/bench-moerman2018/strings/unbounded_copy/11_loop_while_do_continue.c
@@ -0,0 +1,44 @@
+#include <stdio.h>
+#include <string.h>
+#include "string_copy.h"
+
+void string_copy_do_while_continue(int x) {
+ char long_string[22];
+ char short_string[13];
+ char* to_print = short_string;
+ int i = 0;
+
+#ifdef CATCH_BAD_PARAM
+ if(x < 10) {
+ return;
+ }
+#endif
+
+ do {
+ if(i > x) {
+ strcpy(to_print, "this is a long string"); /* DANGER: x < 10 */
+ } else {
+ strcpy(to_print, "short string");
+ }
+ if(i == 10) {
+ to_print = long_string;
+ }
+ printf("val = %s\n", to_print);
+ i++;
+ if(i < 20) {
+ continue;
+ }
+ } while(i < 30);
+}
+
+#ifndef NO_MAIN
+int main() {
+#ifdef NO_BUG
+ string_copy_do_while_continue(10);
+#else
+ string_copy_do_while_continue(9);
+#endif
+
+ return 1;
+}
+#endif
diff --git a/bench-moerman2018/strings/unbounded_copy/12_loop_for_array_branching.c b/bench-moerman2018/strings/unbounded_copy/12_loop_for_array_branching.c
new file mode 100644
index 000000000..4bddae9e2
--- /dev/null
+++ b/bench-moerman2018/strings/unbounded_copy/12_loop_for_array_branching.c
@@ -0,0 +1,48 @@
+#include <stdio.h>
+#include <string.h>
+#include "string_copy.h"
+
+void string_copy_for_array(int x) {
+ int p[20];
+ char long_string[22];
+ char short_string[13];
+ char* to_print = long_string;
+ int i = 0;
+
+ if(x < 0 || x > 19) {
+ return;
+ }
+
+#ifdef CATCH_BAD_PARAM
+ if(x != 19) {
+ return;
+ }
+#endif
+
+ for(i = 0; i < 20; i++) {
+ p[i] = 0;
+ }
+ p[x] = 1;
+
+ for(i = 0; i < 20; i++) {
+ if(p[i] == 1) {
+ to_print = short_string;
+ } else {
+ strcpy(to_print, "this is a long string"); /* DANGER: x < 19 */
+ }
+ }
+
+ printf("%s\n", to_print);
+}
+
+#ifndef NO_MAIN
+int main() {
+#ifdef NO_BUG
+ string_copy_for_array(19);
+#else
+ string_copy_for_array(10);
+#endif
+
+ return 1;
+}
+#endif
diff --git a/bench-moerman2018/strings/unbounded_copy/13_loop_for_pointer_arithmetic.c b/bench-moerman2018/strings/unbounded_copy/13_loop_for_pointer_arithmetic.c
new file mode 100644
index 000000000..54ea55e58
--- /dev/null
+++ b/bench-moerman2018/strings/unbounded_copy/13_loop_for_pointer_arithmetic.c
@@ -0,0 +1,53 @@
+#include <stdlib.h>
+#include <stdio.h>
+#include <string.h>
+#include "string_copy.h"
+
+static void initialize_to_string(char* arr[], char* string, int length) {
+ int i;
+
+ for(i = 0; i < length; i++) {
+ arr[i] = string;
+ }
+}
+
+void string_copy_for_pointer(int x) {
+ char* string_arr[10];
+ char** ptr;
+ char long_string[22];
+ char short_string[13];
+ int val = 0, i;
+
+ if(x < 0 || x > 10) {
+ return;
+ }
+
+#ifdef CATCH_BAD_PARAM
+ if(x != 10) {
+ return;
+ }
+#endif
+
+ initialize_to_string(string_arr, short_string, 10);
+ initialize_to_string(string_arr, long_string, x);
+
+ ptr = string_arr;
+
+ for(i = 0; i < 10; i++, ptr++) {
+ strcpy(*string_arr, "this is a long string");
+ }
+
+ printf("%s\n", *(ptr - 1));
+}
+
+#ifndef NO_MAIN
+int main() {
+#ifdef NO_BUG
+ string_copy_for_pointer(10);
+#else
+ string_copy_for_pointer(9);
+#endif
+
+ return 1;
+}
+#endif
diff --git a/bench-moerman2018/strings/unbounded_copy/14_loop_recursion.c b/bench-moerman2018/strings/unbounded_copy/14_loop_recursion.c
new file mode 100644
index 000000000..9a8cd3278
--- /dev/null
+++ b/bench-moerman2018/strings/unbounded_copy/14_loop_recursion.c
@@ -0,0 +1,43 @@
+#include <stdio.h>
+#include <string.h>
+#include "string_copy.h"
+
+static char long_string[22] = "";
+static char short_string[13] = "";
+
+void string_copy_rec(int x, int i, char* to_print) {
+ if(i <= 1) {
+ printf("%s\n", to_print);
+ return;
+ }
+
+#ifdef CATCH_BAD_PARAM
+ if(x < 10) {
+ printf("%s\n", to_print);
+ return;
+ }
+#endif
+
+ if(i > x) {
+ strcpy(to_print, "this is a long string");
+ } else {
+ strcpy(to_print, "short string");
+ }
+
+ if(i == 10) {
+ to_print = short_string;
+ }
+ string_copy_rec(x, i-1, to_print);
+}
+
+#ifndef NO_MAIN
+int main() {
+#ifdef NO_BUG
+ string_copy_rec(10, 20, long_string);
+#else
+ string_copy_rec(9, 20, long_string);
+#endif
+
+ return 1;
+}
+#endif
diff --git a/bench-moerman2018/strings/unbounded_copy/15_loop_recursion_multi.c b/bench-moerman2018/strings/unbounded_copy/15_loop_recursion_multi.c
new file mode 100644
index 000000000..70122ee79
--- /dev/null
+++ b/bench-moerman2018/strings/unbounded_copy/15_loop_recursion_multi.c
@@ -0,0 +1,49 @@
+#include <stdio.h>
+#include <string.h>
+#include "string_copy.h"
+
+static char long_string[22] = "";
+static char short_string[13] = "";
+
+void string_copy_rec_decr(int x, int i, char* to_print) {
+ if(i <= 1) {
+ printf("%s\n", to_print);
+ return;
+ }
+
+ string_copy_rec_multi(x, i-1, to_print);
+}
+
+void string_copy_rec_multi(int x, int i, char* to_print) {
+#ifdef CATCH_BAD_PARAM
+ if(x < 10) {
+ printf("%s\n", to_print);
+ return;
+ }
+#endif
+
+ if(i > x) {
+ strcpy(to_print, "this is a long string");
+ } else {
+ strcpy(to_print, "short string");
+ }
+
+ if(i == 10) {
+ to_print = short_string;
+ }
+ string_copy_rec_decr(x, i, to_print);
+}
+
+
+
+#ifndef NO_MAIN
+int main() {
+#ifdef NO_BUG
+ string_copy_rec_multi(10, 20, long_string);
+#else
+ string_copy_rec_multi(11, 20, long_string);
+#endif
+
+ return 1;
+}
+#endif
diff --git a/bench-moerman2018/strings/unbounded_copy/16_misc_pseudo_recursion.c b/bench-moerman2018/strings/unbounded_copy/16_misc_pseudo_recursion.c
new file mode 100644
index 000000000..02a8a0a98
--- /dev/null
+++ b/bench-moerman2018/strings/unbounded_copy/16_misc_pseudo_recursion.c
@@ -0,0 +1,55 @@
+#include <stdio.h>
+#include <string.h>
+#include "string_copy.h"
+
+static char long_string[22] = "";
+static char short_string[13] = "";
+
+void string_copy_pseudo_rec1(int x, int y, int i, char* to_print) {
+
+#ifdef CATCH_BAD_PARAM
+ if(x <= 10 && x >= y) {
+ return;
+ }
+#endif
+
+ if(i > 0) {
+ return;
+ }
+
+ if(x > 10) {
+ if(!to_print) {
+ to_print = long_string;
+ }
+ } else {
+ to_print = short_string;
+ }
+
+ string_copy_pseudo_rec2(x, y, 1,to_print);
+}
+
+void string_copy_pseudo_rec2(int x, int y, int i, char* to_print) {
+ if(i > 0) {
+ if(x < y) {
+ strcpy(to_print, "short string");
+ } else {
+ strcpy(to_print, "this is a long string");
+ }
+ printf("%s\n", to_print);
+ } else {
+ string_copy_pseudo_rec1(x, y, 1, to_print);
+ }
+}
+
+#ifndef NO_MAIN
+int main() {
+#ifdef NO_BUG
+ string_copy_pseudo_rec1(9, 10, 0, 0);
+ string_copy_pseudo_rec1(11, 10, 0, 0);
+#else
+ string_copy_pseudo_rec1(10, 10, 0, 0);
+#endif
+
+ return 1;
+}
+#endif
diff --git a/bench-moerman2018/strings/unbounded_copy/17_complex_function_pointers.c b/bench-moerman2018/strings/unbounded_copy/17_complex_function_pointers.c
new file mode 100644
index 000000000..84787c5b3
--- /dev/null
+++ b/bench-moerman2018/strings/unbounded_copy/17_complex_function_pointers.c
@@ -0,0 +1,53 @@
+#include <stdio.h>
+#include <stdbool.h>
+#include <string.h>
+#include "string_copy.h"
+
+static char long_string[22] = "";
+static char short_string[13] = "";
+
+static void select_string(char** dest, bool condition) {
+ if(condition) {
+ *dest = long_string;
+ } else {
+ *dest = short_string;
+ }
+}
+
+void string_copy_function_pointer(bool a, bool b, void (*f)(char**, bool)) {
+ char* to_print;
+
+#ifdef CATCH_BAD_PARAM
+ /* To be used if NO_BUG is defined */
+ /* and tool warns about possible dangerous input */
+ if(!f || (!a & !b)) {
+ return;
+ }
+#endif
+
+ (*f)(&to_print, a);
+
+ if(b) {
+ strcpy(to_print, "short string");
+ } else {
+ strcpy(to_print, "this is a long string"); /* DANGER, if !a & !b */
+ }
+
+ printf("%s\n", to_print);
+}
+
+#ifndef NO_MAIN
+int main() {
+#ifdef NO_BUG
+ string_copy_function_pointer(true, true, &select_string);
+ string_copy_function_pointer(true, false, &select_string);
+ string_copy_function_pointer(false, true, &select_string);
+#else
+ string_copy_function_pointer(true, true, &select_string); /* OK */
+ string_copy_function_pointer(false, false, &select_string); /* DANGER */
+ string_copy_function_pointer(false, true, &select_string); /* OK */
+#endif
+
+ return 1;
+}
+#endif
diff --git a/bench-moerman2018/strings/unbounded_copy/18_complex_struct_multiple_methods.c b/bench-moerman2018/strings/unbounded_copy/18_complex_struct_multiple_methods.c
new file mode 100644
index 000000000..47f3a8ea4
--- /dev/null
+++ b/bench-moerman2018/strings/unbounded_copy/18_complex_struct_multiple_methods.c
@@ -0,0 +1,93 @@
+#include <stdio.h>
+#include <stdlib.h>
+#include <string.h>
+#include "string_copy.h"
+
+static char long_string[22] = "";
+static char short_string[13] = "";
+
+#ifndef s_NULLPOINTER_REFCOUNT
+#define s_NULLPOINTER_REFCOUNT
+static char small_string[15] = "";
+
+void string_copy_cont_init(StringCont* cont) {
+ cont->counter = 1;
+ cont->small_string = small_string;
+ cont->normal_string = 0;
+ cont->selected_string = &(cont->normal_string);
+}
+
+StringCont* string_copy_cont_new() {
+ StringCont* new_cont;
+
+ new_cont = malloc(sizeof(StringCont));
+
+ if(new_cont) {
+ string_copy_cont_init(new_cont);
+ }
+ return new_cont;
+}
+
+void string_copy_cont_incr(StringCont* cont) {
+ if(cont) {
+ cont->counter++;
+ }
+}
+void string_copy_cont_decr(StringCont* cont) {
+ if(cont->counter <= 1) {
+ cont->selected_string = &(cont->small_string);
+ } else {
+ cont->counter--;
+ }
+}
+
+char* string_copy_cont_get_string(StringCont* cont) {
+ return *(cont->selected_string);
+}
+void string_copy_cont_set_string(StringCont* cont, char* string) {
+ cont->normal_string = string;
+}
+#endif //s_NULLPOINTER_REFCOUNT
+
+void string_copy_struct(int x, int y) {
+ StringCont cont;
+ char* to_print;
+
+#ifdef CATCH_BAD_PARAM
+ if(x <= 10 && x >= y) {
+ return;
+ }
+#endif
+ string_copy_cont_init(&cont);
+
+ string_copy_cont_set_string(&cont, short_string);
+
+ if(x < y) {
+ string_copy_cont_set_string(&cont, long_string);
+ }
+
+ to_print = string_copy_cont_get_string(&cont);
+
+ if(x > 10) {
+ strcpy(to_print, "short string");
+ } else {
+ /* DANGER: if x <= 10 & x >= y */
+ strcpy(to_print, "this is a long string");
+ }
+
+ printf("%s\n", string_copy_cont_get_string(&cont));
+}
+
+#ifndef NO_MAIN
+int main() {
+#ifdef NO_BUG
+ string_copy_struct(9, 10);
+ string_copy_struct(10, 11);
+ string_copy_struct(11, 10);
+#else
+ string_copy_struct(10, 10); /* DANGER */
+#endif
+
+ return 1;
+}
+#endif
diff --git a/bench-moerman2018/strings/unbounded_copy/19_complex_refcount.c b/bench-moerman2018/strings/unbounded_copy/19_complex_refcount.c
new file mode 100644
index 000000000..6c7503fe9
--- /dev/null
+++ b/bench-moerman2018/strings/unbounded_copy/19_complex_refcount.c
@@ -0,0 +1,77 @@
+#include "string_copy.h"
+#include <stdlib.h>
+#include <stdio.h>
+#include <string.h>
+
+static char long_string[22] = "";
+
+#ifndef s_STRINGS_UC_REFCOUNT
+#define s_STRINGS_UC_REFCOUNT
+static char small_string[15] = "";
+
+void string_copy_cont_init(StringCont* cont) {
+ cont->counter = 1;
+ cont->small_string = small_string;
+ cont->normal_string = 0;
+ cont->selected_string = &(cont->normal_string);
+}
+
+StringCont* string_copy_cont_new() {
+ StringCont* new_cont;
+
+ new_cont = malloc(sizeof(StringCont));
+
+ if(new_cont) {
+ string_copy_cont_init(new_cont);
+ }
+ return new_cont;
+}
+
+void string_copy_cont_incr(StringCont* cont) {
+ if(cont) {
+ cont->counter++;
+ }
+}
+void string_copy_cont_decr(StringCont* cont) {
+ if(cont->counter <= 1) {
+ cont->selected_string = (char**) &(cont->small_string);
+ } else {
+ cont->counter--;
+ }
+}
+
+char* string_copy_cont_get_string(StringCont* cont) {
+ return *(cont->selected_string);
+}
+void string_copy_cont_set_string(StringCont* cont, char* string) {
+ cont->normal_string = string;
+}
+#endif //s_STRINGS_UC_REFCOUNT
+
+#ifndef NO_MAIN
+int main() {
+ StringCont* cont;
+
+ cont = string_copy_cont_new();
+ if(!cont) {
+ return 1;
+ }
+ string_copy_cont_set_string(cont, long_string);
+
+ string_copy_cont_incr(cont);
+ string_copy_cont_incr(cont);
+ string_copy_cont_decr(cont);
+ string_copy_cont_decr(cont);
+#ifndef NO_BUG
+ string_copy_cont_decr(cont);
+#endif
+
+ strcpy(string_copy_cont_get_string(cont), "this is a long string");
+
+ printf("%s\n", string_copy_cont_get_string(cont));
+
+ free(cont);
+
+ return 1;
+}
+#endif
diff --git a/bench-moerman2018/strings/unbounded_copy/string_copy.h b/bench-moerman2018/strings/unbounded_copy/string_copy.h
new file mode 100644
index 000000000..c4b9c5499
--- /dev/null
+++ b/bench-moerman2018/strings/unbounded_copy/string_copy.h
@@ -0,0 +1,38 @@
+#include <stdbool.h>
+
+typedef struct _StringCont StringCont;
+
+struct _StringCont {
+ char** selected_string;
+ char* normal_string;
+ char* small_string;
+ unsigned int counter;
+};
+
+void string_copy_cont_init(StringCont* cont);
+StringCont* string_copy_cont_new();
+void string_copy_cont_incr(StringCont* cont);
+void string_copy_cont_decr(StringCont* cont);
+char* string_copy_cont_get_string(StringCont* cont);
+void string_copy_cont_set_string(StringCont* cont, char* string);
+
+void string_copy_for(int x);
+void string_copy_for_complex(int x);
+void string_copy_while_continue(int x);
+void string_copy_do_while_continue(int x);
+void string_copy_for_array(int x);
+void string_copy_for_pointer(int x);
+void string_copy_goto(int x);
+void string_copy_if_else(bool a, bool b);
+void string_copy_if_else_multi(bool a, bool b);
+void string_copy_if_else_int1(int x, int y);
+void string_copy_if_else_int2(int x, int y);
+void string_copy_pass_by_reference(bool a, bool b);
+void string_copy_switch(int x, int y);
+void string_copy_rec_multi(int x, int i, char* to_print);
+void string_copy_rec(int x, int i, char* to_print);
+void string_copy_pseudo_rec1(int x, int y, int i, char* to_print);
+void string_copy_pseudo_rec2(int x, int y, int i, char* to_print);
+void string_copy_struct(int x, int y);
+void string_copy_function_pointer(bool a, bool b, void (*f)(char**, bool));
+void string_copy_cross_file(bool a, bool b);
--
GitLab