#include "clang/AST/CharUnits.h"#include "clang/AST/ParentMapContext.h"#include "clang/StaticAnalyzer/Checkers/BoundsChecking.h"#include "clang/StaticAnalyzer/Checkers/BuiltinCheckerRegistration.h"#include "clang/StaticAnalyzer/Checkers/Taint.h"#include "clang/StaticAnalyzer/Core/BugReporter/BugType.h"#include "clang/StaticAnalyzer/Core/Checker.h"#include "clang/StaticAnalyzer/Core/CheckerManager.h"#include "clang/StaticAnalyzer/Core/PathSensitive/APSIntType.h"#include "clang/StaticAnalyzer/Core/PathSensitive/CheckerContext.h"#include "clang/StaticAnalyzer/Core/PathSensitive/DynamicExtent.h"#include "clang/StaticAnalyzer/Core/PathSensitive/ExprEngine.h"#include "llvm/ADT/APSInt.h"#include "llvm/Support/FormatVariadic.h"#include "llvm/Support/raw_ostream.h"#include <optional>Go to the source code of this file.
Functions | |
| static bool | isDeterminedByInterestingSymbol (SVal SV, PathSensitiveBugReport &BR) |
Return true if information about the value of SV can put constraints on some symbol which is interesting within the bug report BR. | |
| static std::optional< std::pair< const SubRegion *, NonLoc > > | computeOffset (ProgramStateRef State, SValBuilder &SVB, const ElementRegion *CurRegion) |
For a given CurRegion that can be represented as a symbolic expression Arr[Idx] (or perhaps Arr[Idx1][Idx2] etc.), return the parent memory block Arr and the distance of Location from the beginning of Arr (expressed in a NonLoc that specifies the number of CharUnits). | |
| static std::optional< int64_t > | getConcreteValue (NonLoc SV) |
| static std::optional< int64_t > | getConcreteValue (std::optional< NonLoc > SV) |
| static StringRef | getAdjective (const bounds::CheckResult &R) |
| static StringRef | getPreposition (const bounds::CheckResult &R) |
| static BugDescription | describeInvalidAccess (bounds::CheckResult Res, StringRef RegName, SizeUnit SU) |
| static BugDescription | describeTaintBug (StringRef RegName, StringRef OffsetName, bool AlsoMentionUnderflow) |
| static std::string | getAssumptionNote (bounds::CheckResult Res, PathSensitiveBugReport &BR, StringRef RegName, SizeUnit SU) |
When the access was ambiguous (that is, mayBeInBounds() && mayBeInvalid()), returns the note "assuming in bounds" note that is relevant for the bug report BR. | |
Function Documentation
◆ computeOffset()
|
static |
For a given CurRegion that can be represented as a symbolic expression Arr[Idx] (or perhaps Arr[Idx1][Idx2] etc.), return the parent memory block Arr and the distance of Location from the beginning of Arr (expressed in a NonLoc that specifies the number of CharUnits).
Returns nullopt when these cannot be determined.
Definition at line 209 of file ArrayBoundChecker.cpp.
References clang::ento::SValBuilder::evalBinOpNN(), clang::ento::SValBuilder::getArrayIndexType(), clang::ento::MemRegion::getAs(), clang::ento::SVal::getAs(), clang::ento::SValBuilder::getContext(), clang::ento::ElementRegion::getElementType(), clang::ento::ElementRegion::getIndex(), clang::CharUnits::getQuantity(), clang::ento::SubRegion::getSuperRegion(), clang::ASTContext::getTypeSizeInChars(), clang::Type::isIncompleteType(), clang::ento::SValBuilder::makeArrayIndex(), clang::ento::SValBuilder::makeZeroArrayIndex(), and clang::T.
◆ describeInvalidAccess()
|
static |
Definition at line 279 of file ArrayBoundChecker.cpp.
References getAdjective(), getConcreteValue(), clang::ento::bounds::CheckResult::getExtentIfMayOverflow(), clang::ento::bounds::CheckResult::getOffset(), getPreposition(), clang::ento::bounds::CheckResult::mayOverflow(), and clang::ento::bounds::CheckResult::mayUnderflow().
◆ describeTaintBug()
|
static |
Definition at line 334 of file ArrayBoundChecker.cpp.
◆ getAdjective()
|
static |
Definition at line 268 of file ArrayBoundChecker.cpp.
Referenced by describeInvalidAccess().
◆ getAssumptionNote()
|
static |
When the access was ambiguous (that is, mayBeInBounds() && mayBeInvalid()), returns the note "assuming in bounds" note that is relevant for the bug report BR.
When the access wasn't ambiguous or the the assumption is irrelevant for BR, this returns the empty string (which signifies "do
not emit a note tag" when returned by a note tag callback).
Definition at line 348 of file ArrayBoundChecker.cpp.
References getConcreteValue(), clang::ento::bounds::CheckResult::getExtentIfMayOverflow(), clang::ento::bounds::CheckResult::getOffset(), isDeterminedByInterestingSymbol(), clang::ento::bounds::CheckResult::mayOverflow(), and clang::ento::bounds::CheckResult::mayUnderflow().
◆ getConcreteValue() [1/2]
|
static |
Definition at line 257 of file ArrayBoundChecker.cpp.
References clang::ento::SVal::getAs().
Referenced by describeInvalidAccess(), getAssumptionNote(), and getConcreteValue().
◆ getConcreteValue() [2/2]
|
static |
Definition at line 264 of file ArrayBoundChecker.cpp.
References getConcreteValue().
◆ getPreposition()
|
static |
Definition at line 274 of file ArrayBoundChecker.cpp.
Referenced by describeInvalidAccess().
◆ isDeterminedByInterestingSymbol()
|
static |
Return true if information about the value of SV can put constraints on some symbol which is interesting within the bug report BR.
In particular, this returns true when SV is interesting within BR; but it also returns true if SV is an expression that contains integer constants and a single symbolic operand which is interesting (in BR). We need to use this instead of plain BR.isInteresting() because if we are analyzing code like int array[10]; int f(int arg) { return array[arg] && array[arg + 10]; } then the byte offsets are arg * 4 and (arg + 10) * 4, which are not sub-expressions of each other (but getSimplifiedOffsets is smart enough to detect this out of bounds access).
Definition at line 184 of file ArrayBoundChecker.cpp.
References clang::ento::SVal::getAsSymbol(), clang::isa(), clang::ento::PathSensitiveBugReport::isInteresting(), and clang::ento::SymExpr::symbols().
Referenced by getAssumptionNote().
Generated on for clang by
1.14.0