Zhongxing Xu | 05a2338 | 2009-11-04 01:43:07 +0000 | [diff] [blame] | 1 | //=== VLASizeChecker.cpp - Undefined dereference checker --------*- C++ -*-===// |
| 2 | // |
| 3 | // The LLVM Compiler Infrastructure |
| 4 | // |
| 5 | // This file is distributed under the University of Illinois Open Source |
| 6 | // License. See LICENSE.TXT for details. |
| 7 | // |
| 8 | //===----------------------------------------------------------------------===// |
| 9 | // |
Argyrios Kyrtzidis | d2592a3 | 2010-12-22 18:53:44 +0000 | [diff] [blame] | 10 | // This defines VLASizeChecker, a builtin check in ExprEngine that |
Zhongxing Xu | 05a2338 | 2009-11-04 01:43:07 +0000 | [diff] [blame] | 11 | // performs checks for declaration of VLA of undefined or zero size. |
Jordy Rose | b2242d1 | 2010-07-06 23:33:54 +0000 | [diff] [blame] | 12 | // In addition, VLASizeChecker is responsible for defining the extent |
| 13 | // of the MemRegion that represents a VLA. |
Zhongxing Xu | 05a2338 | 2009-11-04 01:43:07 +0000 | [diff] [blame] | 14 | // |
| 15 | //===----------------------------------------------------------------------===// |
| 16 | |
Argyrios Kyrtzidis | 3ce2b48 | 2011-02-28 01:27:54 +0000 | [diff] [blame] | 17 | #include "ClangSACheckers.h" |
Argyrios Kyrtzidis | ec8605f | 2011-03-01 01:16:21 +0000 | [diff] [blame] | 18 | #include "clang/StaticAnalyzer/Core/Checker.h" |
Argyrios Kyrtzidis | 3ce2b48 | 2011-02-28 01:27:54 +0000 | [diff] [blame] | 19 | #include "clang/StaticAnalyzer/Core/CheckerManager.h" |
| 20 | #include "clang/StaticAnalyzer/Core/PathSensitive/CheckerContext.h" |
Ted Kremenek | 9b66371 | 2011-02-10 01:03:03 +0000 | [diff] [blame] | 21 | #include "clang/StaticAnalyzer/Core/BugReporter/BugType.h" |
Argyrios Kyrtzidis | 3ce2b48 | 2011-02-28 01:27:54 +0000 | [diff] [blame] | 22 | #include "clang/AST/CharUnits.h" |
Zhongxing Xu | 05a2338 | 2009-11-04 01:43:07 +0000 | [diff] [blame] | 23 | |
| 24 | using namespace clang; |
Ted Kremenek | 9ef6537 | 2010-12-23 07:20:52 +0000 | [diff] [blame] | 25 | using namespace ento; |
Zhongxing Xu | 05a2338 | 2009-11-04 01:43:07 +0000 | [diff] [blame] | 26 | |
Ted Kremenek | 84b3595 | 2009-11-06 21:51:50 +0000 | [diff] [blame] | 27 | namespace { |
Argyrios Kyrtzidis | ec8605f | 2011-03-01 01:16:21 +0000 | [diff] [blame] | 28 | class VLASizeChecker : public Checker< check::PreStmt<DeclStmt> > { |
Argyrios Kyrtzidis | 3ce2b48 | 2011-02-28 01:27:54 +0000 | [diff] [blame] | 29 | mutable llvm::OwningPtr<BugType> BT_zero; |
| 30 | mutable llvm::OwningPtr<BugType> BT_undef; |
Ted Kremenek | 84b3595 | 2009-11-06 21:51:50 +0000 | [diff] [blame] | 31 | |
| 32 | public: |
Argyrios Kyrtzidis | 3ce2b48 | 2011-02-28 01:27:54 +0000 | [diff] [blame] | 33 | void checkPreStmt(const DeclStmt *DS, CheckerContext &C) const; |
Ted Kremenek | 84b3595 | 2009-11-06 21:51:50 +0000 | [diff] [blame] | 34 | }; |
| 35 | } // end anonymous namespace |
| 36 | |
Argyrios Kyrtzidis | 3ce2b48 | 2011-02-28 01:27:54 +0000 | [diff] [blame] | 37 | void VLASizeChecker::checkPreStmt(const DeclStmt *DS, CheckerContext &C) const { |
Ted Kremenek | ae16233 | 2009-11-07 03:56:57 +0000 | [diff] [blame] | 38 | if (!DS->isSingleDecl()) |
| 39 | return; |
| 40 | |
| 41 | const VarDecl *VD = dyn_cast<VarDecl>(DS->getSingleDecl()); |
| 42 | if (!VD) |
| 43 | return; |
Jordy Rose | 52e04c5 | 2010-07-05 00:50:15 +0000 | [diff] [blame] | 44 | |
| 45 | ASTContext &Ctx = C.getASTContext(); |
| 46 | const VariableArrayType *VLA = Ctx.getAsVariableArrayType(VD->getType()); |
Ted Kremenek | ae16233 | 2009-11-07 03:56:57 +0000 | [diff] [blame] | 47 | if (!VLA) |
| 48 | return; |
Zhongxing Xu | 05a2338 | 2009-11-04 01:43:07 +0000 | [diff] [blame] | 49 | |
Ted Kremenek | ae16233 | 2009-11-07 03:56:57 +0000 | [diff] [blame] | 50 | // FIXME: Handle multi-dimensional VLAs. |
Ted Kremenek | 9c378f7 | 2011-08-12 23:37:29 +0000 | [diff] [blame] | 51 | const Expr *SE = VLA->getSizeExpr(); |
Ted Kremenek | 18c66fd | 2011-08-15 22:09:50 +0000 | [diff] [blame] | 52 | const ProgramState *state = C.getState(); |
Ted Kremenek | 1397663 | 2010-02-08 16:18:51 +0000 | [diff] [blame] | 53 | SVal sizeV = state->getSVal(SE); |
Zhongxing Xu | 05a2338 | 2009-11-04 01:43:07 +0000 | [diff] [blame] | 54 | |
Ted Kremenek | ae16233 | 2009-11-07 03:56:57 +0000 | [diff] [blame] | 55 | if (sizeV.isUndef()) { |
| 56 | // Generate an error node. |
Ted Kremenek | d048c6e | 2010-12-20 21:19:09 +0000 | [diff] [blame] | 57 | ExplodedNode *N = C.generateSink(); |
Ted Kremenek | ae16233 | 2009-11-07 03:56:57 +0000 | [diff] [blame] | 58 | if (!N) |
| 59 | return; |
| 60 | |
| 61 | if (!BT_undef) |
Argyrios Kyrtzidis | 3ce2b48 | 2011-02-28 01:27:54 +0000 | [diff] [blame] | 62 | BT_undef.reset(new BuiltinBug("Declared variable-length array (VLA) " |
| 63 | "uses a garbage value as its size")); |
Zhongxing Xu | 05a2338 | 2009-11-04 01:43:07 +0000 | [diff] [blame] | 64 | |
Anna Zaks | e172e8b | 2011-08-17 23:00:25 +0000 | [diff] [blame] | 65 | BugReport *report = |
| 66 | new BugReport(*BT_undef, BT_undef->getName(), N); |
Ted Kremenek | ae16233 | 2009-11-07 03:56:57 +0000 | [diff] [blame] | 67 | report->addRange(SE->getSourceRange()); |
Anna Zaks | 50bbc16 | 2011-08-19 22:33:38 +0000 | [diff] [blame] | 68 | report->addVisitor(bugreporter::getTrackNullOrUndefValueVisitor(N, SE)); |
Ted Kremenek | ae16233 | 2009-11-07 03:56:57 +0000 | [diff] [blame] | 69 | C.EmitReport(report); |
| 70 | return; |
Zhongxing Xu | 05a2338 | 2009-11-04 01:43:07 +0000 | [diff] [blame] | 71 | } |
Jordy Rose | 52e04c5 | 2010-07-05 00:50:15 +0000 | [diff] [blame] | 72 | |
| 73 | // See if the size value is known. It can't be undefined because we would have |
| 74 | // warned about that already. |
| 75 | if (sizeV.isUnknown()) |
| 76 | return; |
Ted Kremenek | ae16233 | 2009-11-07 03:56:57 +0000 | [diff] [blame] | 77 | |
| 78 | // Check if the size is zero. |
Jordy Rose | 52e04c5 | 2010-07-05 00:50:15 +0000 | [diff] [blame] | 79 | DefinedSVal sizeD = cast<DefinedSVal>(sizeV); |
Zhongxing Xu | 05a2338 | 2009-11-04 01:43:07 +0000 | [diff] [blame] | 80 | |
Ted Kremenek | 18c66fd | 2011-08-15 22:09:50 +0000 | [diff] [blame] | 81 | const ProgramState *stateNotZero, *stateZero; |
Ted Kremenek | 28f47b9 | 2010-12-01 22:16:56 +0000 | [diff] [blame] | 82 | llvm::tie(stateNotZero, stateZero) = state->assume(sizeD); |
Zhongxing Xu | 05a2338 | 2009-11-04 01:43:07 +0000 | [diff] [blame] | 83 | |
Ted Kremenek | ae16233 | 2009-11-07 03:56:57 +0000 | [diff] [blame] | 84 | if (stateZero && !stateNotZero) { |
Ted Kremenek | 9c378f7 | 2011-08-12 23:37:29 +0000 | [diff] [blame] | 85 | ExplodedNode *N = C.generateSink(stateZero); |
Ted Kremenek | ae16233 | 2009-11-07 03:56:57 +0000 | [diff] [blame] | 86 | if (!BT_zero) |
Argyrios Kyrtzidis | 3ce2b48 | 2011-02-28 01:27:54 +0000 | [diff] [blame] | 87 | BT_zero.reset(new BuiltinBug("Declared variable-length array (VLA) has " |
| 88 | "zero size")); |
Zhongxing Xu | 05a2338 | 2009-11-04 01:43:07 +0000 | [diff] [blame] | 89 | |
Anna Zaks | e172e8b | 2011-08-17 23:00:25 +0000 | [diff] [blame] | 90 | BugReport *report = |
| 91 | new BugReport(*BT_zero, BT_zero->getName(), N); |
Ted Kremenek | ae16233 | 2009-11-07 03:56:57 +0000 | [diff] [blame] | 92 | report->addRange(SE->getSourceRange()); |
Anna Zaks | 50bbc16 | 2011-08-19 22:33:38 +0000 | [diff] [blame] | 93 | report->addVisitor(bugreporter::getTrackNullOrUndefValueVisitor(N, SE)); |
Ted Kremenek | ae16233 | 2009-11-07 03:56:57 +0000 | [diff] [blame] | 94 | C.EmitReport(report); |
| 95 | return; |
Zhongxing Xu | 05a2338 | 2009-11-04 01:43:07 +0000 | [diff] [blame] | 96 | } |
Ted Kremenek | ae16233 | 2009-11-07 03:56:57 +0000 | [diff] [blame] | 97 | |
| 98 | // From this point on, assume that the size is not zero. |
Jordy Rose | 52e04c5 | 2010-07-05 00:50:15 +0000 | [diff] [blame] | 99 | state = stateNotZero; |
| 100 | |
Jordy Rose | b2242d1 | 2010-07-06 23:33:54 +0000 | [diff] [blame] | 101 | // VLASizeChecker is responsible for defining the extent of the array being |
| 102 | // declared. We do this by multiplying the array length by the element size, |
| 103 | // then matching that with the array region's extent symbol. |
| 104 | |
Jordy Rose | 52e04c5 | 2010-07-05 00:50:15 +0000 | [diff] [blame] | 105 | // Convert the array length to size_t. |
Ted Kremenek | c8413fd | 2010-12-02 07:49:45 +0000 | [diff] [blame] | 106 | SValBuilder &svalBuilder = C.getSValBuilder(); |
Jordy Rose | 52e04c5 | 2010-07-05 00:50:15 +0000 | [diff] [blame] | 107 | QualType SizeTy = Ctx.getSizeType(); |
Ted Kremenek | c8413fd | 2010-12-02 07:49:45 +0000 | [diff] [blame] | 108 | NonLoc ArrayLength = cast<NonLoc>(svalBuilder.evalCast(sizeD, SizeTy, |
| 109 | SE->getType())); |
Jordy Rose | 52e04c5 | 2010-07-05 00:50:15 +0000 | [diff] [blame] | 110 | |
| 111 | // Get the element size. |
| 112 | CharUnits EleSize = Ctx.getTypeSizeInChars(VLA->getElementType()); |
Ted Kremenek | c8413fd | 2010-12-02 07:49:45 +0000 | [diff] [blame] | 113 | SVal EleSizeVal = svalBuilder.makeIntVal(EleSize.getQuantity(), SizeTy); |
Jordy Rose | 52e04c5 | 2010-07-05 00:50:15 +0000 | [diff] [blame] | 114 | |
| 115 | // Multiply the array length by the element size. |
Ted Kremenek | c8413fd | 2010-12-02 07:49:45 +0000 | [diff] [blame] | 116 | SVal ArraySizeVal = svalBuilder.evalBinOpNN(state, BO_Mul, ArrayLength, |
| 117 | cast<NonLoc>(EleSizeVal), SizeTy); |
Jordy Rose | 52e04c5 | 2010-07-05 00:50:15 +0000 | [diff] [blame] | 118 | |
Ted Kremenek | 28f47b9 | 2010-12-01 22:16:56 +0000 | [diff] [blame] | 119 | // Finally, assume that the array's extent matches the given size. |
Anna Zaks | 39ac187 | 2011-10-26 21:06:44 +0000 | [diff] [blame^] | 120 | const LocationContext *LC = C.getLocationContext(); |
Ted Kremenek | c8413fd | 2010-12-02 07:49:45 +0000 | [diff] [blame] | 121 | DefinedOrUnknownSVal Extent = |
| 122 | state->getRegion(VD, LC)->getExtent(svalBuilder); |
Jordy Rose | 52e04c5 | 2010-07-05 00:50:15 +0000 | [diff] [blame] | 123 | DefinedOrUnknownSVal ArraySize = cast<DefinedOrUnknownSVal>(ArraySizeVal); |
Ted Kremenek | c8413fd | 2010-12-02 07:49:45 +0000 | [diff] [blame] | 124 | DefinedOrUnknownSVal sizeIsKnown = |
| 125 | svalBuilder.evalEQ(state, Extent, ArraySize); |
| 126 | state = state->assume(sizeIsKnown, true); |
Jordy Rose | 52e04c5 | 2010-07-05 00:50:15 +0000 | [diff] [blame] | 127 | |
Zhongxing Xu | e4f5d72 | 2010-07-06 07:08:47 +0000 | [diff] [blame] | 128 | // Assume should not fail at this point. |
| 129 | assert(state); |
| 130 | |
Jordy Rose | 52e04c5 | 2010-07-05 00:50:15 +0000 | [diff] [blame] | 131 | // Remember our assumptions! |
Anna Zaks | 0bd6b11 | 2011-10-26 21:06:34 +0000 | [diff] [blame] | 132 | C.addTransition(state); |
Zhongxing Xu | 05a2338 | 2009-11-04 01:43:07 +0000 | [diff] [blame] | 133 | } |
Argyrios Kyrtzidis | 3ce2b48 | 2011-02-28 01:27:54 +0000 | [diff] [blame] | 134 | |
| 135 | void ento::registerVLASizeChecker(CheckerManager &mgr) { |
| 136 | mgr.registerChecker<VLASizeChecker>(); |
| 137 | } |