76a21502fd
ClangCheckerRegistry is a very non-obvious, poorly documented, weird concept. It derives from CheckerRegistry, and is placed in lib/StaticAnalyzer/Frontend, whereas it's base is located in lib/StaticAnalyzer/Core. It was, from what I can imagine, used to circumvent the problem that the registry functions of the checkers are located in the clangStaticAnalyzerCheckers library, but that library depends on clangStaticAnalyzerCore. However, clangStaticAnalyzerFrontend depends on both of those libraries. One can make the observation however, that CheckerRegistry has no place in Core, it isn't used there at all! The only place where it is used is Frontend, which is where it ultimately belongs. This move implies that since include/clang/StaticAnalyzer/Checkers/ClangCheckers.h only contained a single function: class CheckerRegistry; void registerBuiltinCheckers(CheckerRegistry ®istry); it had to re purposed, as CheckerRegistry is no longer available to clangStaticAnalyzerCheckers. It was renamed to BuiltinCheckerRegistration.h, which actually describes it a lot better -- it does not contain the registration functions for checkers, but only those generated by the tblgen files. Differential Revision: https://reviews.llvm.org/D54436 llvm-svn: 349275
94 lines
3.1 KiB
C++
94 lines
3.1 KiB
C++
//== ArrayBoundChecker.cpp ------------------------------*- C++ -*--==//
|
|
//
|
|
// The LLVM Compiler Infrastructure
|
|
//
|
|
// This file is distributed under the University of Illinois Open Source
|
|
// License. See LICENSE.TXT for details.
|
|
//
|
|
//===----------------------------------------------------------------------===//
|
|
//
|
|
// This file defines ArrayBoundChecker, which is a path-sensitive check
|
|
// which looks for an out-of-bound array element access.
|
|
//
|
|
//===----------------------------------------------------------------------===//
|
|
|
|
#include "clang/StaticAnalyzer/Checkers/BuiltinCheckerRegistration.h"
|
|
#include "clang/StaticAnalyzer/Core/BugReporter/BugType.h"
|
|
#include "clang/StaticAnalyzer/Core/Checker.h"
|
|
#include "clang/StaticAnalyzer/Core/CheckerManager.h"
|
|
#include "clang/StaticAnalyzer/Core/PathSensitive/CheckerContext.h"
|
|
#include "clang/StaticAnalyzer/Core/PathSensitive/ExprEngine.h"
|
|
|
|
using namespace clang;
|
|
using namespace ento;
|
|
|
|
namespace {
|
|
class ArrayBoundChecker :
|
|
public Checker<check::Location> {
|
|
mutable std::unique_ptr<BuiltinBug> BT;
|
|
|
|
public:
|
|
void checkLocation(SVal l, bool isLoad, const Stmt* S,
|
|
CheckerContext &C) const;
|
|
};
|
|
}
|
|
|
|
void ArrayBoundChecker::checkLocation(SVal l, bool isLoad, const Stmt* LoadS,
|
|
CheckerContext &C) const {
|
|
// Check for out of bound array element access.
|
|
const MemRegion *R = l.getAsRegion();
|
|
if (!R)
|
|
return;
|
|
|
|
const ElementRegion *ER = dyn_cast<ElementRegion>(R);
|
|
if (!ER)
|
|
return;
|
|
|
|
// Get the index of the accessed element.
|
|
DefinedOrUnknownSVal Idx = ER->getIndex().castAs<DefinedOrUnknownSVal>();
|
|
|
|
// Zero index is always in bound, this also passes ElementRegions created for
|
|
// pointer casts.
|
|
if (Idx.isZeroConstant())
|
|
return;
|
|
|
|
ProgramStateRef state = C.getState();
|
|
|
|
// Get the size of the array.
|
|
DefinedOrUnknownSVal NumElements
|
|
= C.getStoreManager().getSizeInElements(state, ER->getSuperRegion(),
|
|
ER->getValueType());
|
|
|
|
ProgramStateRef StInBound = state->assumeInBound(Idx, NumElements, true);
|
|
ProgramStateRef StOutBound = state->assumeInBound(Idx, NumElements, false);
|
|
if (StOutBound && !StInBound) {
|
|
ExplodedNode *N = C.generateErrorNode(StOutBound);
|
|
if (!N)
|
|
return;
|
|
|
|
if (!BT)
|
|
BT.reset(new BuiltinBug(
|
|
this, "Out-of-bound array access",
|
|
"Access out-of-bound array element (buffer overflow)"));
|
|
|
|
// FIXME: It would be nice to eventually make this diagnostic more clear,
|
|
// e.g., by referencing the original declaration or by saying *why* this
|
|
// reference is outside the range.
|
|
|
|
// Generate a report for this bug.
|
|
auto report = llvm::make_unique<BugReport>(*BT, BT->getDescription(), N);
|
|
|
|
report->addRange(LoadS->getSourceRange());
|
|
C.emitReport(std::move(report));
|
|
return;
|
|
}
|
|
|
|
// Array bound check succeeded. From this point forward the array bound
|
|
// should always succeed.
|
|
C.addTransition(StInBound);
|
|
}
|
|
|
|
void ento::registerArrayBoundChecker(CheckerManager &mgr) {
|
|
mgr.registerChecker<ArrayBoundChecker>();
|
|
}
|