Issue with Setting Up Sparse

Issue with Setting Up Sparse

[Edgar Khachatryan]

[-- Attachment #1.1: Type: text/plain, Size: 1670 bytes --]

My name is Edgar Khachatryan, and I am a student currently working on a
project that involves static analysis using Sparse. I have encountered an
issue where running Sparse with the command "sparse file.c" does not detect
simple memory issues such as memory leaks, double frees, or use-after-free
errors in a single file.

I have attempted to install Sparse versions 0.6.3 and 0.6.4 on different
Ubuntu releases (20.04, 22.04, and 24.04) with LLVM versions 11 and 12.
However, none of these combinations have worked as expected.

Following the installation instructions provided in the documentation, I
ran "make" and "make install" in the Sparse directory, but I was unable to
find further details regarding dependencies or required versions for proper
setup and functioning. As a result, I am reaching out to ask for
clarification on the following:

1) Are there specific dependencies or versions of libraries (e.g., libxml,
sqlite3, gtk3, etc.) that need to be installed to ensure Sparse functions
correctly?
2) Is there any additional documentation available beyond what was
provided? It would be very helpful to have more detailed instructions or
guidelines for setting up Sparse in different environments.

I also have the command-line output text that details the issues I’ve
encountered and The C source file I used as input. I would be happy to
share it with you if it would help resolve the problem.

Thank you in advance for your time and assistance. I look forward to your
response and any guidance you can provide to help resolve this issue.

Best regards,
Edgar Khachatryan,
Russian-Armenian University, Yerevan, Armenia

[-- Attachment #1.2: Type: text/html, Size: 1770 bytes --]

[-- Attachment #2: test.c --]
[-- Type: text/x-csrc, Size: 845 bytes --]

#include <stdio.h>
#include <stdlib.h>

void memory_leak() {
    int *ptr = (int *)malloc(sizeof(int) * 10);  // Memory allocated but never freed
    if (!ptr) {
        printf("Memory allocation failed\n");
        return;
    }
    ptr[0] = 42;  // Some usage
}

void double_free() {
    int *ptr = (int *)malloc(sizeof(int) * 10);
    if (!ptr) {
        printf("Memory allocation failed\n");
        return;
    }
    free(ptr);  // First free
    free(ptr);  // Double free (undefined behavior)
}

void use_after_free() {
    int *ptr = (int *)malloc(sizeof(int) * 10);
    if (!ptr) {
        printf("Memory allocation failed\n");
        return;
    }
    free(ptr);    // Freeing memory
    ptr[0] = 42;  // Use after free (undefined behavior)
}

int main() {
    memory_leak();
    double_free();
    use_after_free();
    return 0;
}


[-- Attachment #3: cmd_out --]
[-- Type: application/octet-stream, Size: 4304 bytes --]

Re: Issue with Setting Up Sparse

[Dan Carpenter]

On Wed, Mar 12, 2025 at 06:04:02PM +0400, Edgar Khachatryan wrote:
> My name is Edgar Khachatryan, and I am a student currently working on a
> project that involves static analysis using Sparse. I have encountered an
> issue where running Sparse with the command "sparse file.c" does not detect
> simple memory issues such as memory leaks, double frees, or use-after-free
> errors in a single file.

Sparse doesn't look for those kinds of bugs.  You're better off using
Smatch for that.

With Smatch, I've never really looked for memory leaks.  It's quite a
hard problem and I've never been able to do it in a useful way without
introducing a lot of false positives.

$ ./smatch test.c
test.c:4:18: warning: non-ANSI function declaration of function 'memory_leak'
test.c:13:18: warning: non-ANSI function declaration of function 'double_free'
test.c:23:21: warning: non-ANSI function declaration of function 'use_after_free'
test.c:33:10: warning: non-ANSI function declaration of function 'main'
test.c:20 double_free() error: double free of 'ptr'
test.c:30 use_after_free() error: dereferencing freed memory 'ptr'
$

But the other problem with Smatch is that it's only ever really used on
the kernel so user space support is proof of concept quality.  I had to
push a quick patch it to make it find the use after free bug.  I use
a different check for check_free_strict.c module for kernel code.
https://github.com/error27/smatch/commit/993d157ab147720b558f0f6293dd4acfeb0d2a18

regards,
dan carpenter