26class ArrayBoundChecker :
27 public Checker<check::Location> {
28 mutable std::unique_ptr<BugType> BT;
31 void checkLocation(
SVal l,
bool isLoad,
const Stmt* S,
36void ArrayBoundChecker::checkLocation(
SVal l,
bool isLoad,
const Stmt* LoadS,
62 std::tie(StInBound, StOutBound) = state->assumeInBoundDual(Idx, ElementCount);
63 if (StOutBound && !StInBound) {
69 BT.reset(
new BugType(
this,
"Out-of-bound array access"));
76 auto report = std::make_unique<PathSensitiveBugReport>(
77 *BT,
"Access out-of-bound array element (buffer overflow)", N);
80 C.emitReport(std::move(report));
86 C.addTransition(StInBound);
93bool ento::shouldRegisterArrayBoundChecker(
const CheckerManager &mgr) {
Stmt - This represents one statement.
SourceRange getSourceRange() const LLVM_READONLY
SourceLocation tokens are not useful in isolation - they are low level value objects created/interpre...
CHECKER * registerChecker(AT &&... Args)
Used to register checkers.
ElementRegion is used to represent both array elements and casts.
QualType getValueType() const override
MemRegion - The root abstract class for all memory regions.
SVal - This represents a symbolic expression, which can be either an L-value or an R-value.
bool isZeroConstant() const
const MemRegion * getAsRegion() const
T castAs() const
Convert to the specified SVal type, asserting that this SVal is of the desired type.
LLVM_ATTRIBUTE_RETURNS_NONNULL const MemRegion * getSuperRegion() const
DefinedOrUnknownSVal getDynamicElementCount(ProgramStateRef State, const MemRegion *MR, SValBuilder &SVB, QualType Ty)