2946cd7010
to reflect the new license. We understand that people may be surprised that we're moving the header entirely to discuss the new license. We checked this carefully with the Foundation's lawyer and we believe this is the correct approach. Essentially, all code in the project is now made available by the LLVM project under our new license, so you will see that the license headers include that license only. Some of our contributors have contributed code under our old license, and accordingly, we have retained a copy of our old license notice in the top-level files in each project and repository. llvm-svn: 351636
93 lines
3.1 KiB
C++
93 lines
3.1 KiB
C++
//== ArrayBoundChecker.cpp ------------------------------*- C++ -*--==//
|
|
//
|
|
// Part of the LLVM Project, under the Apache License v2.0 with LLVM Exceptions.
|
|
// See https://llvm.org/LICENSE.txt for license information.
|
|
// SPDX-License-Identifier: Apache-2.0 WITH LLVM-exception
|
|
//
|
|
//===----------------------------------------------------------------------===//
|
|
//
|
|
// This file defines ArrayBoundChecker, which is a path-sensitive check
|
|
// which looks for an out-of-bound array element access.
|
|
//
|
|
//===----------------------------------------------------------------------===//
|
|
|
|
#include "clang/StaticAnalyzer/Checkers/BuiltinCheckerRegistration.h"
|
|
#include "clang/StaticAnalyzer/Core/BugReporter/BugType.h"
|
|
#include "clang/StaticAnalyzer/Core/Checker.h"
|
|
#include "clang/StaticAnalyzer/Core/CheckerManager.h"
|
|
#include "clang/StaticAnalyzer/Core/PathSensitive/CheckerContext.h"
|
|
#include "clang/StaticAnalyzer/Core/PathSensitive/ExprEngine.h"
|
|
|
|
using namespace clang;
|
|
using namespace ento;
|
|
|
|
namespace {
|
|
class ArrayBoundChecker :
|
|
public Checker<check::Location> {
|
|
mutable std::unique_ptr<BuiltinBug> BT;
|
|
|
|
public:
|
|
void checkLocation(SVal l, bool isLoad, const Stmt* S,
|
|
CheckerContext &C) const;
|
|
};
|
|
}
|
|
|
|
void ArrayBoundChecker::checkLocation(SVal l, bool isLoad, const Stmt* LoadS,
|
|
CheckerContext &C) const {
|
|
// Check for out of bound array element access.
|
|
const MemRegion *R = l.getAsRegion();
|
|
if (!R)
|
|
return;
|
|
|
|
const ElementRegion *ER = dyn_cast<ElementRegion>(R);
|
|
if (!ER)
|
|
return;
|
|
|
|
// Get the index of the accessed element.
|
|
DefinedOrUnknownSVal Idx = ER->getIndex().castAs<DefinedOrUnknownSVal>();
|
|
|
|
// Zero index is always in bound, this also passes ElementRegions created for
|
|
// pointer casts.
|
|
if (Idx.isZeroConstant())
|
|
return;
|
|
|
|
ProgramStateRef state = C.getState();
|
|
|
|
// Get the size of the array.
|
|
DefinedOrUnknownSVal NumElements
|
|
= C.getStoreManager().getSizeInElements(state, ER->getSuperRegion(),
|
|
ER->getValueType());
|
|
|
|
ProgramStateRef StInBound = state->assumeInBound(Idx, NumElements, true);
|
|
ProgramStateRef StOutBound = state->assumeInBound(Idx, NumElements, false);
|
|
if (StOutBound && !StInBound) {
|
|
ExplodedNode *N = C.generateErrorNode(StOutBound);
|
|
if (!N)
|
|
return;
|
|
|
|
if (!BT)
|
|
BT.reset(new BuiltinBug(
|
|
this, "Out-of-bound array access",
|
|
"Access out-of-bound array element (buffer overflow)"));
|
|
|
|
// FIXME: It would be nice to eventually make this diagnostic more clear,
|
|
// e.g., by referencing the original declaration or by saying *why* this
|
|
// reference is outside the range.
|
|
|
|
// Generate a report for this bug.
|
|
auto report = llvm::make_unique<BugReport>(*BT, BT->getDescription(), N);
|
|
|
|
report->addRange(LoadS->getSourceRange());
|
|
C.emitReport(std::move(report));
|
|
return;
|
|
}
|
|
|
|
// Array bound check succeeded. From this point forward the array bound
|
|
// should always succeed.
|
|
C.addTransition(StInBound);
|
|
}
|
|
|
|
void ento::registerArrayBoundChecker(CheckerManager &mgr) {
|
|
mgr.registerChecker<ArrayBoundChecker>();
|
|
}
|