632e3b7ee2
(Stmt*,LocationContext*) pairs to SVals instead of Stmt* to SVals. This is needed to support basic IPA via inlining. Without this, we cannot tell if a Stmt* binding is part of the current analysis scope (StackFrameContext) or part of a parent context. This change introduces an uglification of the use of getSVal(), and thus takes two steps forward and one step back. There are also potential performance implications of enlarging the Environment. Both can be addressed going forward by refactoring the APIs and optimizing the internal representation of Environment. This patch mainly introduces the functionality upon when we want to build upon (and clean up). llvm-svn: 147688
55 lines
1.9 KiB
C++
55 lines
1.9 KiB
C++
//===--- UndefinedArraySubscriptChecker.h ----------------------*- C++ -*--===//
|
|
//
|
|
// The LLVM Compiler Infrastructure
|
|
//
|
|
// This file is distributed under the University of Illinois Open Source
|
|
// License. See LICENSE.TXT for details.
|
|
//
|
|
//===----------------------------------------------------------------------===//
|
|
//
|
|
// This defines UndefinedArraySubscriptChecker, a builtin check in ExprEngine
|
|
// that performs checks for undefined array subscripts.
|
|
//
|
|
//===----------------------------------------------------------------------===//
|
|
|
|
#include "ClangSACheckers.h"
|
|
#include "clang/StaticAnalyzer/Core/Checker.h"
|
|
#include "clang/StaticAnalyzer/Core/CheckerManager.h"
|
|
#include "clang/StaticAnalyzer/Core/PathSensitive/CheckerContext.h"
|
|
#include "clang/StaticAnalyzer/Core/BugReporter/BugType.h"
|
|
|
|
using namespace clang;
|
|
using namespace ento;
|
|
|
|
namespace {
|
|
class UndefinedArraySubscriptChecker
|
|
: public Checker< check::PreStmt<ArraySubscriptExpr> > {
|
|
mutable llvm::OwningPtr<BugType> BT;
|
|
|
|
public:
|
|
void checkPreStmt(const ArraySubscriptExpr *A, CheckerContext &C) const;
|
|
};
|
|
} // end anonymous namespace
|
|
|
|
void
|
|
UndefinedArraySubscriptChecker::checkPreStmt(const ArraySubscriptExpr *A,
|
|
CheckerContext &C) const {
|
|
if (C.getState()->getSVal(A->getIdx(), C.getLocationContext()).isUndef()) {
|
|
if (ExplodedNode *N = C.generateSink()) {
|
|
if (!BT)
|
|
BT.reset(new BuiltinBug("Array subscript is undefined"));
|
|
|
|
// Generate a report for this bug.
|
|
BugReport *R = new BugReport(*BT, BT->getName(), N);
|
|
R->addRange(A->getIdx()->getSourceRange());
|
|
R->addVisitor(bugreporter::getTrackNullOrUndefValueVisitor(N,
|
|
A->getIdx()));
|
|
C.EmitReport(R);
|
|
}
|
|
}
|
|
}
|
|
|
|
void ento::registerUndefinedArraySubscriptChecker(CheckerManager &mgr) {
|
|
mgr.registerChecker<UndefinedArraySubscriptChecker>();
|
|
}
|