Added path-sensitive check for return statements that return the address
of a stack variable. This is the path-sensitive version of a check that
is already done during semantic analysis.
git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@48980 91177308-0d34-0410-b5e6-96231b3b80d8
diff --git a/lib/Analysis/GRExprEngine.cpp b/lib/Analysis/GRExprEngine.cpp
index b70e219..bf0d5ea 100644
--- a/lib/Analysis/GRExprEngine.cpp
+++ b/lib/Analysis/GRExprEngine.cpp
@@ -1190,6 +1190,50 @@
MakeNode(Dst, ME, Pred, St);
}
+void GRExprEngine::VisitReturnStmt(ReturnStmt* S, NodeTy* Pred, NodeSet& Dst) {
+
+ Expr* R = S->getRetValue();
+
+ if (!R) {
+ Dst.Add(Pred);
+ return;
+ }
+
+ QualType T = R->getType();
+
+ if (T->isPointerType() || T->isReferenceType()) {
+
+ // Check if any of the return values return the address of a stack variable.
+
+ NodeSet Tmp;
+ Visit(R, Pred, Tmp);
+
+ for (NodeSet::iterator I=Tmp.begin(), E=Tmp.end(); I!=E; ++I) {
+ RVal X = GetRVal((*I)->getState(), R);
+
+ if (isa<lval::DeclVal>(X)) {
+
+ if (cast<lval::DeclVal>(X).getDecl()->hasLocalStorage()) {
+
+ // Create a special node representing the v
+
+ NodeTy* RetStackNode = Builder->generateNode(S, GetState(*I), *I);
+
+ if (RetStackNode) {
+ RetStackNode->markAsSink();
+ RetsStackAddr.insert(RetStackNode);
+ }
+
+ continue;
+ }
+ }
+
+ Dst.Add(*I);
+ }
+ }
+ else
+ Visit(R, Pred, Dst);
+}
void GRExprEngine::VisitBinaryOperator(BinaryOperator* B,
GRExprEngine::NodeTy* Pred,
@@ -1625,14 +1669,8 @@
// that users can quickly query what was the state at the
// exit points of a function.
- case Stmt::ReturnStmtClass: {
- if (Expr* R = cast<ReturnStmt>(S)->getRetValue())
- Visit(R, Pred, Dst);
- else
- Dst.Add(Pred);
-
- break;
- }
+ case Stmt::ReturnStmtClass:
+ VisitReturnStmt(cast<ReturnStmt>(S), Pred, Dst); break;
case Stmt::UnaryOperatorClass: {
UnaryOperator* U = cast<UnaryOperator>(S);
diff --git a/lib/Analysis/GRSimpleVals.cpp b/lib/Analysis/GRSimpleVals.cpp
index 94cedc0..697d256 100644
--- a/lib/Analysis/GRSimpleVals.cpp
+++ b/lib/Analysis/GRSimpleVals.cpp
@@ -166,6 +166,11 @@
CheckerState->undef_receivers_begin(),
CheckerState->undef_receivers_end(),
"Receiver in message expression is an uninitialized value.");
+
+ EmitWarning(Diag, SrcMgr,
+ CheckerState->ret_stackaddr_begin(),
+ CheckerState->ret_stackaddr_end(),
+ "Address of stack-allocated variable returned.");
FoundationCheck.get()->ReportResults(Diag);
#ifndef NDEBUG