Reimplement out-of-bound array access checker with the new checker interface.
Now only one test case is XFAIL'ed.
git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@86834 91177308-0d34-0410-b5e6-96231b3b80d8
diff --git a/lib/Analysis/ArrayBoundChecker.cpp b/lib/Analysis/ArrayBoundChecker.cpp
new file mode 100644
index 0000000..ae8e114
--- /dev/null
+++ b/lib/Analysis/ArrayBoundChecker.cpp
@@ -0,0 +1,87 @@
+//== ArrayBoundChecker.cpp ------------------------------*- C++ -*--==//
+//
+// The LLVM Compiler Infrastructure
+//
+// This file is distributed under the University of Illinois Open Source
+// License. See LICENSE.TXT for details.
+//
+//===----------------------------------------------------------------------===//
+//
+// This file defines ArrayBoundChecker, which is a path-sensitive check
+// which looks for an out-of-bound array element access.
+//
+//===----------------------------------------------------------------------===//
+
+#include "GRExprEngineInternalChecks.h"
+#include "clang/Analysis/PathSensitive/GRExprEngine.h"
+#include "clang/Analysis/PathSensitive/BugReporter.h"
+#include "clang/Analysis/PathSensitive/CheckerVisitor.h"
+
+using namespace clang;
+
+namespace {
+class VISIBILITY_HIDDEN ArrayBoundChecker :
+ public CheckerVisitor<ArrayBoundChecker> {
+ BuiltinBug *BT;
+public:
+ ArrayBoundChecker() : BT(0) {}
+ static void *getTag();
+ void VisitLocation(CheckerContext &C, const Stmt *S, SVal l);
+};
+}
+
+void clang::RegisterArrayBoundChecker(GRExprEngine &Eng) {
+ Eng.registerCheck(new ArrayBoundChecker());
+}
+
+void *ArrayBoundChecker::getTag() {
+ static int x = 0; return &x;
+}
+
+void ArrayBoundChecker::VisitLocation(CheckerContext &C, const Stmt *S, SVal l){
+ // Check for out of bound array element access.
+ const MemRegion *R = l.getAsRegion();
+ if (!R)
+ return;
+
+ R = R->StripCasts();
+
+ const ElementRegion *ER = dyn_cast<ElementRegion>(R);
+ if (!ER)
+ return;
+
+ // Get the index of the accessed element.
+ DefinedOrUnknownSVal &Idx = cast<DefinedOrUnknownSVal>(ER->getIndex());
+
+ const GRState *state = C.getState();
+
+ // Get the size of the array.
+ SVal NumVal = C.getStoreManager().getSizeInElements(state,
+ ER->getSuperRegion());
+ DefinedOrUnknownSVal &NumElements = cast<DefinedOrUnknownSVal>(NumVal);
+
+ const GRState *StInBound = state->AssumeInBound(Idx, NumElements, true);
+ const GRState *StOutBound = state->AssumeInBound(Idx, NumElements, false);
+ if (StOutBound && !StInBound) {
+ ExplodedNode *N = C.GenerateNode(S, StOutBound, true);
+
+ if (!N)
+ return;
+
+ if (!BT)
+ BT = new BuiltinBug("Out-of-bound array access",
+ "Access out-of-bound array element (buffer overflow)");
+
+ // FIXME: It would be nice to eventually make this diagnostic more clear,
+ // e.g., by referencing the original declaration or by saying *why* this
+ // reference is outside the range.
+
+ // Generate a report for this bug.
+ RangedBugReport *report =
+ new RangedBugReport(*BT, BT->getDescription().c_str(), N);
+
+ report->addRange(S->getSourceRange());
+
+ C.EmitReport(report);
+ }
+}
diff --git a/lib/Analysis/CMakeLists.txt b/lib/Analysis/CMakeLists.txt
index 2d68486..82ef984 100644
--- a/lib/Analysis/CMakeLists.txt
+++ b/lib/Analysis/CMakeLists.txt
@@ -2,6 +2,7 @@
add_clang_library(clangAnalysis
AnalysisContext.cpp
+ ArrayBoundChecker.cpp
AttrNonNullChecker.cpp
BadCallChecker.cpp
BasicConstraintManager.cpp
diff --git a/lib/Analysis/GRExprEngineInternalChecks.cpp b/lib/Analysis/GRExprEngineInternalChecks.cpp
index 447dfc0..ea508a0 100644
--- a/lib/Analysis/GRExprEngineInternalChecks.cpp
+++ b/lib/Analysis/GRExprEngineInternalChecks.cpp
@@ -414,4 +414,5 @@
RegisterReturnPointerRangeChecker(*this);
RegisterCastToStructChecker(*this);
+ RegisterArrayBoundChecker(*this);
}
diff --git a/lib/Analysis/GRExprEngineInternalChecks.h b/lib/Analysis/GRExprEngineInternalChecks.h
index 22151a1..a0687fd 100644
--- a/lib/Analysis/GRExprEngineInternalChecks.h
+++ b/lib/Analysis/GRExprEngineInternalChecks.h
@@ -32,6 +32,7 @@
void RegisterFixedAddressChecker(GRExprEngine &Eng);
void RegisterCastToStructChecker(GRExprEngine &Eng);
void RegisterUndefinedArgChecker(GRExprEngine &Eng);
+void RegisterArrayBoundChecker(GRExprEngine &Eng);
} // end clang namespace
#endif
diff --git a/test/Analysis/no-outofbounds.c b/test/Analysis/no-outofbounds.c
index bb8f65e..67ea6b5 100644
--- a/test/Analysis/no-outofbounds.c
+++ b/test/Analysis/no-outofbounds.c
@@ -1,5 +1,6 @@
// RUN: clang-cc -checker-cfref -analyze -analyzer-store=basic -verify %s
// RUN: clang-cc -checker-cfref -analyze -analyzer-store=region -verify %s
+// XFAIL: *
//===----------------------------------------------------------------------===//
// This file tests cases where we should not flag out-of-bounds warnings.
diff --git a/test/Analysis/outofbound.c b/test/Analysis/outofbound.c
index e676ea3..102ab59 100644
--- a/test/Analysis/outofbound.c
+++ b/test/Analysis/outofbound.c
@@ -1,8 +1,7 @@
// RUN: clang-cc -analyze -checker-cfref -analyzer-store=region -verify %s
-// XFAIL: *
char f1() {
char* s = "abcd";
char c = s[4]; // no-warning
- return s[5] + c; // expected-warning{{Load or store into an out-of-bound memory position.}}
+ return s[5] + c; // expected-warning{{Access out-of-bound array element (buffer overflow)}}
}
diff --git a/test/Analysis/rdar-6541136-region.c b/test/Analysis/rdar-6541136-region.c
index e2779e8..a07308f 100644
--- a/test/Analysis/rdar-6541136-region.c
+++ b/test/Analysis/rdar-6541136-region.c
@@ -13,10 +13,10 @@
struct load_wine *cmd = (void*) &wonky[1];
cmd = cmd;
char *p = (void*) &wonky[1];
- *p = 1; // no-warning
+ //*p = 1; // this is also an out-of-bound access.
kernel_tea_cheese_t *q = &wonky[1];
// This test case tests both the RegionStore logic (doesn't crash) and
// the out-of-bounds checking. We don't expect the warning for now since
// out-of-bound checking is temporarily disabled.
- kernel_tea_cheese_t r = *q; // eventually-warning{{out-of-bound memory position}}
+ kernel_tea_cheese_t r = *q; // expected-warning{{Access out-of-bound array element (buffer overflow)}}
}