81 lines · cpp
1//===--- UndefinedNewArraySizeChecker.cpp -----------------------*- C++ -*--==//2//3// Part of the LLVM Project, under the Apache License v2.0 with LLVM Exceptions.4// See https://llvm.org/LICENSE.txt for license information.5// SPDX-License-Identifier: Apache-2.0 WITH LLVM-exception6//7//===----------------------------------------------------------------------===//8//9// This defines UndefinedNewArraySizeChecker, a builtin check in ExprEngine10// that checks if the size of the array in a new[] expression is undefined.11//12//===----------------------------------------------------------------------===//13 14#include "clang/StaticAnalyzer/Checkers/BuiltinCheckerRegistration.h"15#include "clang/StaticAnalyzer/Core/BugReporter/BugType.h"16#include "clang/StaticAnalyzer/Core/Checker.h"17#include "clang/StaticAnalyzer/Core/CheckerManager.h"18#include "clang/StaticAnalyzer/Core/PathSensitive/CallEvent.h"19#include "clang/StaticAnalyzer/Core/PathSensitive/CheckerContext.h"20 21using namespace clang;22using namespace ento;23 24namespace {25class UndefinedNewArraySizeChecker : public Checker<check::PreCall> {26 27private:28 BugType BT{this, "Undefined array element count in new[]",29 categories::LogicError};30 31public:32 void checkPreCall(const CallEvent &Call, CheckerContext &C) const;33 void HandleUndefinedArrayElementCount(CheckerContext &C, SVal ArgVal,34 const Expr *Init,35 SourceRange Range) const;36};37} // namespace38 39void UndefinedNewArraySizeChecker::checkPreCall(const CallEvent &Call,40 CheckerContext &C) const {41 if (const auto *AC = dyn_cast<CXXAllocatorCall>(&Call)) {42 if (!AC->isArray())43 return;44 45 auto *SizeEx = *AC->getArraySizeExpr();46 auto SizeVal = AC->getArraySizeVal();47 48 if (SizeVal.isUndef())49 HandleUndefinedArrayElementCount(C, SizeVal, SizeEx,50 SizeEx->getSourceRange());51 }52}53 54void UndefinedNewArraySizeChecker::HandleUndefinedArrayElementCount(55 CheckerContext &C, SVal ArgVal, const Expr *Init, SourceRange Range) const {56 57 if (ExplodedNode *N = C.generateErrorNode()) {58 59 SmallString<100> buf;60 llvm::raw_svector_ostream os(buf);61 62 os << "Element count in new[] is a garbage value";63 64 auto R = std::make_unique<PathSensitiveBugReport>(BT, os.str(), N);65 R->markInteresting(ArgVal);66 R->addRange(Range);67 bugreporter::trackExpressionValue(N, Init, *R);68 69 C.emitReport(std::move(R));70 }71}72 73void ento::registerUndefinedNewArraySizeChecker(CheckerManager &mgr) {74 mgr.registerChecker<UndefinedNewArraySizeChecker>();75}76 77bool ento::shouldRegisterUndefinedNewArraySizeChecker(78 const CheckerManager &mgr) {79 return mgr.getLangOpts().CPlusPlus;80}81