[analyzer] PR41729: CStringChecker: Improve strlcat and strlcpy modeling.
- Fix false positive reports of strlcat.
- The return value of strlcat and strlcpy is now correctly calculated.
- The resulting string length of strlcat and strlcpy is now correctly
calculated.
Patch by Daniel Krupp!
Differential Revision: https://reviews.llvm.org/D66049
diff --git a/clang/test/Analysis/bsd-string.c b/clang/test/Analysis/bsd-string.c
index 6e04a62..d8a8883 100644
--- a/clang/test/Analysis/bsd-string.c
+++ b/clang/test/Analysis/bsd-string.c
@@ -9,6 +9,7 @@
typedef __typeof(sizeof(int)) size_t;
size_t strlcpy(char *dst, const char *src, size_t n);
size_t strlcat(char *dst, const char *src, size_t n);
+size_t strlen(const char *s);
void clang_analyzer_eval(int);
void f1() {
@@ -18,9 +19,11 @@
void f2() {
char buf[5];
- strlcpy(buf, "abcd", sizeof(buf)); // expected-no-warning
- // FIXME: This should not warn. The string is safely truncated.
- strlcat(buf, "efgh", sizeof(buf)); // expected-warning{{Size argument is greater than the free space in the destination buffer}}
+ size_t len;
+ len = strlcpy(buf, "abcd", sizeof(buf)); // expected-no-warning
+ clang_analyzer_eval(len == 4); // expected-warning{{TRUE}}
+ len = strlcat(buf, "efgh", sizeof(buf)); // expected-no-warning
+ clang_analyzer_eval(len == 8); // expected-warning{{TRUE}}
}
void f3() {
@@ -48,3 +51,83 @@
char buf[8];
return strlcpy(buf, "1234567", 0); // no-crash
}
+
+void f8(){
+ char buf[5];
+ size_t len;
+
+ // basic strlcpy
+ len = strlcpy(buf,"123", sizeof(buf));
+ clang_analyzer_eval(len==3);// expected-warning{{TRUE}}
+ len = strlen(buf);
+ clang_analyzer_eval(len==3);// expected-warning{{TRUE}}
+
+ // testing bounded strlcat
+ len = strlcat(buf,"456", sizeof(buf));
+ clang_analyzer_eval(len==6);// expected-warning{{TRUE}}
+ len = strlen(buf);
+ clang_analyzer_eval(len==4);// expected-warning{{TRUE}}
+
+ // testing strlcat with size==0
+ len = strlcat(buf,"789", 0);
+ clang_analyzer_eval(len==7);// expected-warning{{TRUE}}
+ len = strlen(buf);
+ clang_analyzer_eval(len==4);// expected-warning{{TRUE}}
+
+ // testing strlcpy with size==0
+ len = strlcpy(buf,"123",0);
+ clang_analyzer_eval(len==3);// expected-warning{{TRUE}}
+ len = strlen(buf);
+ clang_analyzer_eval(len==4);// expected-warning{{TRUE}}
+
+}
+
+void f9(int unknown_size, char* unknown_src, char* unknown_dst){
+ char buf[8];
+ size_t len;
+
+ len = strlcpy(buf,"abba",sizeof(buf));
+
+ clang_analyzer_eval(len==4);// expected-warning{{TRUE}}
+ clang_analyzer_eval(strlen(buf)==4);// expected-warning{{TRUE}}
+
+ //size is unknown
+ len = strlcat(buf,"cd", unknown_size);
+ clang_analyzer_eval(len==6);// expected-warning{{TRUE}}
+ clang_analyzer_eval(strlen(buf)>=4);// expected-warning{{TRUE}}
+
+ //dst is unknown
+ len = strlcpy(unknown_dst,"abbc",unknown_size);
+ clang_analyzer_eval(len==4);// expected-warning{{TRUE}}
+ clang_analyzer_eval(strlen(unknown_dst));// expected-warning{{UNKNOWN}}
+
+ //src is unknown
+ len = strlcpy(buf,unknown_src, sizeof(buf));
+ clang_analyzer_eval(len);// expected-warning{{UNKNOWN}}
+ clang_analyzer_eval(strlen(buf));// expected-warning{{UNKNOWN}}
+
+ //src, dst is unknown
+ len = strlcpy(unknown_dst, unknown_src, unknown_size);
+ clang_analyzer_eval(len);// expected-warning{{UNKNOWN}}
+ clang_analyzer_eval(strlen(unknown_dst));// expected-warning{{UNKNOWN}}
+
+ //size is unknown
+ len = strlcat(buf+2,unknown_src+1, sizeof(buf));// expected-warning{{Size argument is greater than the length of the destination buffer}};
+}
+
+void f10(){
+ char buf[8];
+ size_t len;
+
+ len = strlcpy(buf,"abba",sizeof(buf));
+ clang_analyzer_eval(len==4);// expected-warning{{TRUE}}
+ strlcat(buf, "efghi",9);// expected-warning{{Size argument is greater than the length of the destination buffer}}
+}
+
+void f11() {
+ //test for Bug 41729
+ char a[256], b[256];
+ strlcpy(a, "world", sizeof(a));
+ strlcpy(b, "hello ", sizeof(b));
+ strlcat(b, a, sizeof(b)); // no-warning
+}