clang  10.0.0svn
BoolAssignmentChecker.cpp
Go to the documentation of this file.
1 //== BoolAssignmentChecker.cpp - Boolean assignment checker -----*- C++ -*--==//
2 //
3 // Part of the LLVM Project, under the Apache License v2.0 with LLVM Exceptions.
4 // See https://llvm.org/LICENSE.txt for license information.
5 // SPDX-License-Identifier: Apache-2.0 WITH LLVM-exception
6 //
7 //===----------------------------------------------------------------------===//
8 //
9 // This defines BoolAssignmentChecker, a builtin check in ExprEngine that
10 // performs checks for assignment of non-Boolean values to Boolean variables.
11 //
12 //===----------------------------------------------------------------------===//
13 
19 
20 using namespace clang;
21 using namespace ento;
22 
23 namespace {
24  class BoolAssignmentChecker : public Checker< check::Bind > {
25  mutable std::unique_ptr<BuiltinBug> BT;
26  void emitReport(ProgramStateRef state, CheckerContext &C) const;
27  public:
28  void checkBind(SVal loc, SVal val, const Stmt *S, CheckerContext &C) const;
29  };
30 } // end anonymous namespace
31 
32 void BoolAssignmentChecker::emitReport(ProgramStateRef state,
33  CheckerContext &C) const {
34  if (ExplodedNode *N = C.generateNonFatalErrorNode(state)) {
35  if (!BT)
36  BT.reset(new BuiltinBug(this, "Assignment of a non-Boolean value"));
37 
38  C.emitReport(
39  std::make_unique<PathSensitiveBugReport>(*BT, BT->getDescription(), N));
40  }
41 }
42 
43 static bool isBooleanType(QualType Ty) {
44  if (Ty->isBooleanType()) // C++ or C99
45  return true;
46 
47  if (const TypedefType *TT = Ty->getAs<TypedefType>())
48  return TT->getDecl()->getName() == "BOOL" || // Objective-C
49  TT->getDecl()->getName() == "_Bool" || // stdbool.h < C99
50  TT->getDecl()->getName() == "Boolean"; // MacTypes.h
51 
52  return false;
53 }
54 
55 void BoolAssignmentChecker::checkBind(SVal loc, SVal val, const Stmt *S,
56  CheckerContext &C) const {
57 
58  // We are only interested in stores into Booleans.
59  const TypedValueRegion *TR =
60  dyn_cast_or_null<TypedValueRegion>(loc.getAsRegion());
61 
62  if (!TR)
63  return;
64 
65  QualType valTy = TR->getValueType();
66 
67  if (!isBooleanType(valTy))
68  return;
69 
70  // Get the value of the right-hand side. We only care about values
71  // that are defined (UnknownVals and UndefinedVals are handled by other
72  // checkers).
73  Optional<DefinedSVal> DV = val.getAs<DefinedSVal>();
74  if (!DV)
75  return;
76 
77  // Check if the assigned value meets our criteria for correctness. It must
78  // be a value that is either 0 or 1. One way to check this is to see if
79  // the value is possibly < 0 (for a negative value) or greater than 1.
80  ProgramStateRef state = C.getState();
81  SValBuilder &svalBuilder = C.getSValBuilder();
82  ConstraintManager &CM = C.getConstraintManager();
83 
84  // First, ensure that the value is >= 0.
85  DefinedSVal zeroVal = svalBuilder.makeIntVal(0, valTy);
86  SVal greaterThanOrEqualToZeroVal =
87  svalBuilder.evalBinOp(state, BO_GE, *DV, zeroVal,
88  svalBuilder.getConditionType());
89 
90  Optional<DefinedSVal> greaterThanEqualToZero =
91  greaterThanOrEqualToZeroVal.getAs<DefinedSVal>();
92 
93  if (!greaterThanEqualToZero) {
94  // The SValBuilder cannot construct a valid SVal for this condition.
95  // This means we cannot properly reason about it.
96  return;
97  }
98 
99  ProgramStateRef stateLT, stateGE;
100  std::tie(stateGE, stateLT) = CM.assumeDual(state, *greaterThanEqualToZero);
101 
102  // Is it possible for the value to be less than zero?
103  if (stateLT) {
104  // It is possible for the value to be less than zero. We only
105  // want to emit a warning, however, if that value is fully constrained.
106  // If it it possible for the value to be >= 0, then essentially the
107  // value is underconstrained and there is nothing left to be done.
108  if (!stateGE)
109  emitReport(stateLT, C);
110 
111  // In either case, we are done.
112  return;
113  }
114 
115  // If we reach here, it must be the case that the value is constrained
116  // to only be >= 0.
117  assert(stateGE == state);
118 
119  // At this point we know that the value is >= 0.
120  // Now check to ensure that the value is <= 1.
121  DefinedSVal OneVal = svalBuilder.makeIntVal(1, valTy);
122  SVal lessThanEqToOneVal =
123  svalBuilder.evalBinOp(state, BO_LE, *DV, OneVal,
124  svalBuilder.getConditionType());
125 
126  Optional<DefinedSVal> lessThanEqToOne =
127  lessThanEqToOneVal.getAs<DefinedSVal>();
128 
129  if (!lessThanEqToOne) {
130  // The SValBuilder cannot construct a valid SVal for this condition.
131  // This means we cannot properly reason about it.
132  return;
133  }
134 
135  ProgramStateRef stateGT, stateLE;
136  std::tie(stateLE, stateGT) = CM.assumeDual(state, *lessThanEqToOne);
137 
138  // Is it possible for the value to be greater than one?
139  if (stateGT) {
140  // It is possible for the value to be greater than one. We only
141  // want to emit a warning, however, if that value is fully constrained.
142  // If it is possible for the value to be <= 1, then essentially the
143  // value is underconstrained and there is nothing left to be done.
144  if (!stateLE)
145  emitReport(stateGT, C);
146 
147  // In either case, we are done.
148  return;
149  }
150 
151  // If we reach here, it must be the case that the value is constrained
152  // to only be <= 1.
153  assert(stateLE == state);
154 }
155 
156 void ento::registerBoolAssignmentChecker(CheckerManager &mgr) {
157  mgr.registerChecker<BoolAssignmentChecker>();
158 }
159 
160 bool ento::shouldRegisterBoolAssignmentChecker(const LangOptions &LO) {
161  return true;
162 }
A (possibly-)qualified type.
Definition: Type.h:643
Stmt - This represents one statement.
Definition: Stmt.h:66
IntrusiveRefCntPtr< const ProgramState > ProgramStateRef
const T * getAs() const
Member-template getAs<specific type>&#39;.
Definition: Type.h:6858
Keeps track of the various options that can be enabled, which controls the dialect of C or C++ that i...
Definition: LangOptions.h:49
i32 captured_struct **param SharedsTy A type which contains references the shared variables *param Shareds Context with the list of shared variables from the p *TaskFunction *param Data Additional data for task generation like final * state
static bool isBooleanType(QualType Ty)
Dataflow Directional Tag Classes.
bool isBooleanType() const
Definition: Type.h:6767