22357fe33a
Bounded string functions takes smallest of two values as it's copy size (`amountCopied` variable in `evalStrcpyCommon`), and it's used to decided whether this operation will cause out-of-bound access and invalidate it's super region if it does. for `strlcat`: `amountCopied = min (size - dstLen - 1 , srcLen)` for others: `amountCopied = min (srcLen, size)` Currently when one of two values is unknown or `SValBuilder` can't decide which one is smaller, `amountCopied` will remain `UnknownVal`, which will invalidate copy destination's super region unconditionally. This patch add check to see if one of these two values is definitely in-bound, if so `amountCopied` has to be in-bound too, because it‘s less than or equal to them, we can avoid the invalidation of super region and some related false positives in this situation. Note: This patch uses `size` as an approximation of `size - dstLen - 1` in `strlcat` case because currently analyzer doesn't handle complex expressions like this very well. Closes #143807.
133 lines
3.3 KiB
C++
133 lines
3.3 KiB
C++
// RUN: %clang_analyze_cc1 -analyzer-checker=core,unix.cstring,alpha.unix.cstring,debug.ExprInspection -verify %s
|
|
|
|
typedef decltype(sizeof(int)) size_t;
|
|
void clang_analyzer_eval(bool);
|
|
|
|
char *strncpy(char *dest, const char *src, size_t x);
|
|
|
|
constexpr int initB = 100;
|
|
struct Base {
|
|
int b;
|
|
Base(): b(initB) {}
|
|
};
|
|
|
|
// issue 143807
|
|
struct strncpyTestClass: public Base {
|
|
int *m_ptr;
|
|
char m_buff[1000];
|
|
|
|
void KnownLen(char *src) {
|
|
m_ptr = new int;
|
|
strncpy(m_buff, src, sizeof(m_buff)); // known len but unknown src size
|
|
delete m_ptr; // no warning
|
|
}
|
|
|
|
void KnownSrcLen(size_t n) {
|
|
m_ptr = new int;
|
|
strncpy(m_buff, "xyz", n); // known src size but unknown len
|
|
delete m_ptr; // no warning
|
|
}
|
|
};
|
|
|
|
void strncpyTest(char *src, size_t n) {
|
|
strncpyTestClass rep;
|
|
rep.KnownLen(src);
|
|
rep.KnownSrcLen(n);
|
|
clang_analyzer_eval(rep.b == initB); // expected-warning{{TRUE}}
|
|
}
|
|
|
|
size_t strlcpy(char *dest, const char *src, size_t size);
|
|
|
|
struct strlcpyTestClass: public Base {
|
|
int *m_ptr;
|
|
char m_buff[1000];
|
|
|
|
void KnownLen(char *src) {
|
|
m_ptr = new int;
|
|
strlcpy(m_buff, src, sizeof(m_buff)); // known len but unknown src size
|
|
delete m_ptr; // no warning
|
|
}
|
|
|
|
void KnownSrcLen(size_t n) {
|
|
m_ptr = new int;
|
|
strlcpy(m_buff, "xyz", n); // known src size but unknown len
|
|
delete m_ptr; // no warning
|
|
}
|
|
};
|
|
|
|
void strlcpyTest(char *src, size_t n) {
|
|
strlcpyTestClass rep;
|
|
rep.KnownLen(src);
|
|
rep.KnownSrcLen(n);
|
|
clang_analyzer_eval(rep.b == initB); // expected-warning{{TRUE}}
|
|
}
|
|
|
|
char *strncat(char *s1, const char *s2, size_t n);
|
|
|
|
struct strncatTestClass: public Base {
|
|
int *m_ptr;
|
|
char m_buff[1000];
|
|
|
|
void KnownLen(char *src) {
|
|
m_ptr = new int;
|
|
strncat(m_buff, src, sizeof(m_buff) - 1); // known len but unknown src size
|
|
delete m_ptr; // no warning
|
|
}
|
|
|
|
void KnownSrcLen(size_t n) {
|
|
m_ptr = new int;
|
|
strncat(m_buff, "xyz", n); // known src size but unknown len
|
|
delete m_ptr; // no warning
|
|
}
|
|
};
|
|
|
|
void strncatTest(char *src, size_t n) {
|
|
strncatTestClass rep;
|
|
rep.KnownLen(src);
|
|
rep.KnownSrcLen(n);
|
|
clang_analyzer_eval(rep.b == initB); // expected-warning{{TRUE}}
|
|
}
|
|
|
|
struct strncatReportOutOfBoundTestClass {
|
|
int *m_ptr;
|
|
char m_buff[1000];
|
|
|
|
void KnownLen(char *src) {
|
|
m_ptr = new int;
|
|
// expected-warning@+1{{String concatenation function overflows the destination buffer}}
|
|
strncat(m_buff, src, sizeof(m_buff)); // known len but unknown src size
|
|
delete m_ptr; // no warning
|
|
}
|
|
};
|
|
|
|
void strncatReportOutOfBoundTest(char *src, size_t n) {
|
|
strncatReportOutOfBoundTestClass rep;
|
|
rep.KnownLen(src);
|
|
}
|
|
|
|
size_t strlcat(char *dst, const char *src, size_t size);
|
|
|
|
struct strlcatTestClass: public Base {
|
|
int *m_ptr;
|
|
char m_buff[1000];
|
|
|
|
void KnownLen(char *src) {
|
|
m_ptr = new int;
|
|
strlcat(m_buff, src, sizeof(m_buff)); // known len but unknown src size
|
|
delete m_ptr; // no warning
|
|
}
|
|
|
|
void KnownSrcLen(size_t n) {
|
|
m_ptr = new int;
|
|
strlcat(m_buff, "xyz", n); // known src size but unknown len
|
|
delete m_ptr; // no warning
|
|
}
|
|
};
|
|
|
|
void strlcatTest(char *src, size_t n) {
|
|
strlcatTestClass rep;
|
|
rep.KnownLen(src);
|
|
rep.KnownSrcLen(n);
|
|
clang_analyzer_eval(rep.b == initB); // expected-warning{{TRUE}}
|
|
}
|