@@ -1640,24 +1640,28 @@ the Clang Static Analyzer makes sure that allocating functions annotated with
16401640safely deallocated with the standard ``free()``.
16411641
16421642* Use ``ownership_returns`` to mark a function as an allocating function.
1643- It takes 1 or 2 parameters .
1644- The first parameter is a user-provided identifier representing the "kind" of the allocation.
1645- This is basically what is enforced when checking the deallocation.
1646- The second parameter is optional.
1643+ It takes 1 or 2 arguments .
1644+ The first argument is a user-provided identifier representing the "kind" of the allocation.
1645+ This is basically what is enforced when checking the deallocation. This is mandatory.
1646+ The second argument is optional.
16471647 It represents the index of the parameter that represents the allocation size in bytes (counting from 1).
16481648 The referenced parameter must have some integral type.
16491649 This attribute may appear at most once per declaration.
1650- If forward declarations have this attribute, those must have the same parameters.
1650+ If this argument is not set, then tooling, such as the Clang Static Analyzer,
1651+ won't be able to reason about the size of the allocation, thus check potential out-of-bounds accesses.
1652+ However, such tooling could still warn if the wrong deallocation function
1653+ was used for the ``ownership_returns`` attributed resource.
1654+ If forward declarations have this attribute, those must have the same arguments.
16511655* Use ``ownership_takes`` to mark a function as a deallocating function. Takes 2
1652- parameters : the allocation type, and the index of the parameter that is being
1656+ arguments : the allocation type, and the index of the parameter that is being
16531657 deallocated (counting from 1).
16541658* Use ``ownership_holds`` to mark that a function takes over the ownership of a
16551659 piece of memory and will free it at some unspecified point in the future. Like
1656- ``ownership_takes``, this takes 2 parameters : the allocation type, and the
1660+ ``ownership_takes``, this takes 2 arguments : the allocation type, and the
16571661 index of the parameter whose ownership will be taken over (counting from 1).
16581662
16591663The annotations ``ownership_takes`` and ``ownership_holds`` both prevent memory
1660- leak reports (concerning the specified argument ); the difference between them
1664+ leak reports (concerning the specified parameter ); the difference between them
16611665is that using taken memory is a use-after-free error, while using held memory
16621666is assumed to be legitimate.
16631667
@@ -1672,10 +1676,10 @@ Example:
16721676 // 'sz' (parameter 1) is the allocation size.
16731677 void __attribute((ownership_returns(malloc, 1))) *my_sized_malloc(size_t sz);
16741678
1675- // Denotes that my_free will deallocate its parameter using free().
1679+ // Denotes that my_free will deallocate its argument using free().
16761680 void __attribute((ownership_takes(malloc, 1))) my_free(void *);
16771681
1678- // Denotes that my_hold will take over the ownership of its parameter that was
1682+ // Denotes that my_hold will take over the ownership of its argument that was
16791683 // allocated via malloc().
16801684 void __attribute((ownership_holds(malloc, 1))) my_hold(void *);
16811685
0 commit comments