121 lines · cpp
1//=== UndefResultChecker.cpp ------------------------------------*- C++ -*-===//2//3// Part of the LLVM Project, under the Apache License v2.0 with LLVM Exceptions.4// See https://llvm.org/LICENSE.txt for license information.5// SPDX-License-Identifier: Apache-2.0 WITH LLVM-exception6//7//===----------------------------------------------------------------------===//8//9// This defines UndefResultChecker, a builtin check in ExprEngine that10// performs checks for undefined results of non-assignment binary operators.11//12//===----------------------------------------------------------------------===//13 14#include "clang/StaticAnalyzer/Checkers/BuiltinCheckerRegistration.h"15#include "clang/StaticAnalyzer/Core/BugReporter/BugType.h"16#include "clang/StaticAnalyzer/Core/Checker.h"17#include "clang/StaticAnalyzer/Core/CheckerManager.h"18#include "clang/StaticAnalyzer/Core/PathSensitive/CheckerContext.h"19#include "clang/StaticAnalyzer/Core/PathSensitive/DynamicExtent.h"20#include "clang/StaticAnalyzer/Core/PathSensitive/ExprEngine.h"21#include "llvm/Support/raw_ostream.h"22 23using namespace clang;24using namespace ento;25 26namespace {27class UndefResultChecker28 : public Checker< check::PostStmt<BinaryOperator> > {29 30 const BugType BT{this, "Result of operation is garbage or undefined"};31 32public:33 void checkPostStmt(const BinaryOperator *B, CheckerContext &C) const;34};35} // end anonymous namespace36 37static bool isArrayIndexOutOfBounds(CheckerContext &C, const Expr *Ex) {38 ProgramStateRef state = C.getState();39 40 if (!isa<ArraySubscriptExpr>(Ex))41 return false;42 43 SVal Loc = C.getSVal(Ex);44 if (!Loc.isValid())45 return false;46 47 const MemRegion *MR = Loc.castAs<loc::MemRegionVal>().getRegion();48 const ElementRegion *ER = dyn_cast<ElementRegion>(MR);49 if (!ER)50 return false;51 52 DefinedOrUnknownSVal Idx = ER->getIndex().castAs<DefinedOrUnknownSVal>();53 DefinedOrUnknownSVal ElementCount = getDynamicElementCount(54 state, ER->getSuperRegion(), C.getSValBuilder(), ER->getValueType());55 ProgramStateRef StInBound, StOutBound;56 std::tie(StInBound, StOutBound) = state->assumeInBoundDual(Idx, ElementCount);57 return StOutBound && !StInBound;58}59 60void UndefResultChecker::checkPostStmt(const BinaryOperator *B,61 CheckerContext &C) const {62 if (C.getSVal(B).isUndef()) {63 64 // Do not report assignments of uninitialized values inside swap functions.65 // This should allow to swap partially uninitialized structs66 if (const FunctionDecl *EnclosingFunctionDecl =67 dyn_cast<FunctionDecl>(C.getStackFrame()->getDecl()))68 if (C.getCalleeName(EnclosingFunctionDecl) == "swap")69 return;70 71 // Generate an error node.72 ExplodedNode *N = C.generateErrorNode();73 if (!N)74 return;75 76 SmallString<256> sbuf;77 llvm::raw_svector_ostream OS(sbuf);78 const Expr *Ex = nullptr;79 bool isLeft = true;80 81 if (C.getSVal(B->getLHS()).isUndef()) {82 Ex = B->getLHS()->IgnoreParenCasts();83 isLeft = true;84 }85 else if (C.getSVal(B->getRHS()).isUndef()) {86 Ex = B->getRHS()->IgnoreParenCasts();87 isLeft = false;88 }89 90 if (Ex) {91 OS << "The " << (isLeft ? "left" : "right") << " operand of '"92 << BinaryOperator::getOpcodeStr(B->getOpcode())93 << "' is a garbage value";94 if (isArrayIndexOutOfBounds(C, Ex))95 OS << " due to array index out of bounds";96 } else {97 // Neither operand was undefined, but the result is undefined.98 OS << "The result of the '"99 << BinaryOperator::getOpcodeStr(B->getOpcode())100 << "' expression is undefined";101 }102 auto report = std::make_unique<PathSensitiveBugReport>(BT, OS.str(), N);103 if (Ex) {104 report->addRange(Ex->getSourceRange());105 bugreporter::trackExpressionValue(N, Ex, *report);106 }107 else108 bugreporter::trackExpressionValue(N, B, *report);109 110 C.emitReport(std::move(report));111 }112}113 114void ento::registerUndefResultChecker(CheckerManager &mgr) {115 mgr.registerChecker<UndefResultChecker>();116}117 118bool ento::shouldRegisterUndefResultChecker(const CheckerManager &mgr) {119 return true;120}121