Zhongxing Xu | 05a2338 | 2009-11-04 01:43:07 +0000 | [diff] [blame] | 1 | //=== VLASizeChecker.cpp - Undefined dereference checker --------*- C++ -*-===// |
| 2 | // |
| 3 | // The LLVM Compiler Infrastructure |
| 4 | // |
| 5 | // This file is distributed under the University of Illinois Open Source |
| 6 | // License. See LICENSE.TXT for details. |
| 7 | // |
| 8 | //===----------------------------------------------------------------------===// |
| 9 | // |
Ted Kremenek | ae16233 | 2009-11-07 03:56:57 +0000 | [diff] [blame] | 10 | // This defines VLASizeChecker, a builtin check in GRExprEngine that |
Zhongxing Xu | 05a2338 | 2009-11-04 01:43:07 +0000 | [diff] [blame] | 11 | // performs checks for declaration of VLA of undefined or zero size. |
| 12 | // |
| 13 | //===----------------------------------------------------------------------===// |
| 14 | |
Ted Kremenek | 84b3595 | 2009-11-06 21:51:50 +0000 | [diff] [blame] | 15 | #include "GRExprEngineInternalChecks.h" |
Jordy Rose | 52e04c5 | 2010-07-05 00:50:15 +0000 | [diff] [blame^] | 16 | #include "clang/AST/CharUnits.h" |
Benjamin Kramer | 5e2d2c2 | 2010-03-27 21:19:47 +0000 | [diff] [blame] | 17 | #include "clang/Checker/BugReporter/BugType.h" |
Ted Kremenek | 1309f9a | 2010-01-25 04:41:41 +0000 | [diff] [blame] | 18 | #include "clang/Checker/PathSensitive/CheckerVisitor.h" |
| 19 | #include "clang/Checker/PathSensitive/GRExprEngine.h" |
Zhongxing Xu | 05a2338 | 2009-11-04 01:43:07 +0000 | [diff] [blame] | 20 | |
| 21 | using namespace clang; |
| 22 | |
Ted Kremenek | 84b3595 | 2009-11-06 21:51:50 +0000 | [diff] [blame] | 23 | namespace { |
Kovarththanan Rajaratnam | ba5fb5a | 2009-11-28 06:07:30 +0000 | [diff] [blame] | 24 | class VLASizeChecker : public CheckerVisitor<VLASizeChecker> { |
Ted Kremenek | ae16233 | 2009-11-07 03:56:57 +0000 | [diff] [blame] | 25 | BugType *BT_zero; |
| 26 | BugType *BT_undef; |
Ted Kremenek | 84b3595 | 2009-11-06 21:51:50 +0000 | [diff] [blame] | 27 | |
| 28 | public: |
Ted Kremenek | ae16233 | 2009-11-07 03:56:57 +0000 | [diff] [blame] | 29 | VLASizeChecker() : BT_zero(0), BT_undef(0) {} |
| 30 | static void *getTag() { static int tag = 0; return &tag; } |
| 31 | void PreVisitDeclStmt(CheckerContext &C, const DeclStmt *DS); |
Ted Kremenek | 84b3595 | 2009-11-06 21:51:50 +0000 | [diff] [blame] | 32 | }; |
| 33 | } // end anonymous namespace |
| 34 | |
| 35 | void clang::RegisterVLASizeChecker(GRExprEngine &Eng) { |
Ted Kremenek | ae16233 | 2009-11-07 03:56:57 +0000 | [diff] [blame] | 36 | Eng.registerCheck(new VLASizeChecker()); |
Ted Kremenek | 84b3595 | 2009-11-06 21:51:50 +0000 | [diff] [blame] | 37 | } |
| 38 | |
Ted Kremenek | ae16233 | 2009-11-07 03:56:57 +0000 | [diff] [blame] | 39 | void VLASizeChecker::PreVisitDeclStmt(CheckerContext &C, const DeclStmt *DS) { |
| 40 | if (!DS->isSingleDecl()) |
| 41 | return; |
| 42 | |
| 43 | const VarDecl *VD = dyn_cast<VarDecl>(DS->getSingleDecl()); |
| 44 | if (!VD) |
| 45 | return; |
Jordy Rose | 52e04c5 | 2010-07-05 00:50:15 +0000 | [diff] [blame^] | 46 | |
| 47 | ASTContext &Ctx = C.getASTContext(); |
| 48 | const VariableArrayType *VLA = Ctx.getAsVariableArrayType(VD->getType()); |
Ted Kremenek | ae16233 | 2009-11-07 03:56:57 +0000 | [diff] [blame] | 49 | if (!VLA) |
| 50 | return; |
Zhongxing Xu | 05a2338 | 2009-11-04 01:43:07 +0000 | [diff] [blame] | 51 | |
Ted Kremenek | ae16233 | 2009-11-07 03:56:57 +0000 | [diff] [blame] | 52 | // FIXME: Handle multi-dimensional VLAs. |
| 53 | const Expr* SE = VLA->getSizeExpr(); |
| 54 | const GRState *state = C.getState(); |
Ted Kremenek | 1397663 | 2010-02-08 16:18:51 +0000 | [diff] [blame] | 55 | SVal sizeV = state->getSVal(SE); |
Zhongxing Xu | 05a2338 | 2009-11-04 01:43:07 +0000 | [diff] [blame] | 56 | |
Ted Kremenek | ae16233 | 2009-11-07 03:56:57 +0000 | [diff] [blame] | 57 | if (sizeV.isUndef()) { |
| 58 | // Generate an error node. |
Ted Kremenek | 19d67b5 | 2009-11-23 22:22:01 +0000 | [diff] [blame] | 59 | ExplodedNode *N = C.GenerateSink(); |
Ted Kremenek | ae16233 | 2009-11-07 03:56:57 +0000 | [diff] [blame] | 60 | if (!N) |
| 61 | return; |
| 62 | |
| 63 | if (!BT_undef) |
| 64 | BT_undef = new BuiltinBug("Declared variable-length array (VLA) uses a " |
| 65 | "garbage value as its size"); |
Zhongxing Xu | 05a2338 | 2009-11-04 01:43:07 +0000 | [diff] [blame] | 66 | |
Ted Kremenek | ae16233 | 2009-11-07 03:56:57 +0000 | [diff] [blame] | 67 | EnhancedBugReport *report = |
Benjamin Kramer | d02e232 | 2009-11-14 12:08:24 +0000 | [diff] [blame] | 68 | new EnhancedBugReport(*BT_undef, BT_undef->getName(), N); |
Ted Kremenek | ae16233 | 2009-11-07 03:56:57 +0000 | [diff] [blame] | 69 | report->addRange(SE->getSourceRange()); |
| 70 | report->addVisitorCreator(bugreporter::registerTrackNullOrUndefValue, SE); |
| 71 | C.EmitReport(report); |
| 72 | return; |
Zhongxing Xu | 05a2338 | 2009-11-04 01:43:07 +0000 | [diff] [blame] | 73 | } |
Jordy Rose | 52e04c5 | 2010-07-05 00:50:15 +0000 | [diff] [blame^] | 74 | |
| 75 | // See if the size value is known. It can't be undefined because we would have |
| 76 | // warned about that already. |
| 77 | if (sizeV.isUnknown()) |
| 78 | return; |
Ted Kremenek | ae16233 | 2009-11-07 03:56:57 +0000 | [diff] [blame] | 79 | |
| 80 | // Check if the size is zero. |
Jordy Rose | 52e04c5 | 2010-07-05 00:50:15 +0000 | [diff] [blame^] | 81 | DefinedSVal sizeD = cast<DefinedSVal>(sizeV); |
Zhongxing Xu | 05a2338 | 2009-11-04 01:43:07 +0000 | [diff] [blame] | 82 | |
Ted Kremenek | ae16233 | 2009-11-07 03:56:57 +0000 | [diff] [blame] | 83 | const GRState *stateNotZero, *stateZero; |
| 84 | llvm::tie(stateNotZero, stateZero) = state->Assume(sizeD); |
Zhongxing Xu | 05a2338 | 2009-11-04 01:43:07 +0000 | [diff] [blame] | 85 | |
Ted Kremenek | ae16233 | 2009-11-07 03:56:57 +0000 | [diff] [blame] | 86 | if (stateZero && !stateNotZero) { |
Ted Kremenek | 19d67b5 | 2009-11-23 22:22:01 +0000 | [diff] [blame] | 87 | ExplodedNode* N = C.GenerateSink(stateZero); |
Ted Kremenek | ae16233 | 2009-11-07 03:56:57 +0000 | [diff] [blame] | 88 | if (!BT_zero) |
| 89 | BT_zero = new BuiltinBug("Declared variable-length array (VLA) has zero " |
| 90 | "size"); |
Zhongxing Xu | 05a2338 | 2009-11-04 01:43:07 +0000 | [diff] [blame] | 91 | |
Ted Kremenek | ae16233 | 2009-11-07 03:56:57 +0000 | [diff] [blame] | 92 | EnhancedBugReport *report = |
Benjamin Kramer | d02e232 | 2009-11-14 12:08:24 +0000 | [diff] [blame] | 93 | new EnhancedBugReport(*BT_zero, BT_zero->getName(), N); |
Ted Kremenek | ae16233 | 2009-11-07 03:56:57 +0000 | [diff] [blame] | 94 | report->addRange(SE->getSourceRange()); |
| 95 | report->addVisitorCreator(bugreporter::registerTrackNullOrUndefValue, SE); |
| 96 | C.EmitReport(report); |
| 97 | return; |
Zhongxing Xu | 05a2338 | 2009-11-04 01:43:07 +0000 | [diff] [blame] | 98 | } |
Ted Kremenek | ae16233 | 2009-11-07 03:56:57 +0000 | [diff] [blame] | 99 | |
| 100 | // From this point on, assume that the size is not zero. |
Jordy Rose | 52e04c5 | 2010-07-05 00:50:15 +0000 | [diff] [blame^] | 101 | state = stateNotZero; |
| 102 | |
| 103 | // Convert the array length to size_t. |
| 104 | ValueManager &ValMgr = C.getValueManager(); |
| 105 | SValuator &SV = ValMgr.getSValuator(); |
| 106 | QualType SizeTy = Ctx.getSizeType(); |
| 107 | NonLoc ArrayLength = cast<NonLoc>(SV.EvalCast(sizeD, SizeTy, SE->getType())); |
| 108 | |
| 109 | // Get the element size. |
| 110 | CharUnits EleSize = Ctx.getTypeSizeInChars(VLA->getElementType()); |
| 111 | SVal EleSizeVal = ValMgr.makeIntVal(EleSize.getQuantity(), SizeTy); |
| 112 | |
| 113 | // Multiply the array length by the element size. |
| 114 | SVal ArraySizeVal = SV.EvalBinOpNN(state, BinaryOperator::Mul, ArrayLength, |
| 115 | cast<NonLoc>(EleSizeVal), SizeTy); |
| 116 | |
| 117 | // Finally, Assume that the array's extent matches the given size. |
| 118 | const LocationContext *LC = C.getPredecessor()->getLocationContext(); |
| 119 | DefinedOrUnknownSVal Extent = state->getRegion(VD, LC)->getExtent(ValMgr); |
| 120 | DefinedOrUnknownSVal ArraySize = cast<DefinedOrUnknownSVal>(ArraySizeVal); |
| 121 | DefinedOrUnknownSVal SizeIsKnown = SV.EvalEQ(state, Extent, ArraySize); |
| 122 | state = state->Assume(SizeIsKnown, true); |
| 123 | |
| 124 | // Remember our assumptions! |
| 125 | C.addTransition(state); |
Zhongxing Xu | 05a2338 | 2009-11-04 01:43:07 +0000 | [diff] [blame] | 126 | } |