26 class BoolAssignmentChecker :
public Checker< check::Bind > {
27 mutable std::unique_ptr<BugType> BT;
29 bool IsTainted =
false)
const;
37 bool IsTainted)
const {
40 BT.reset(
new BugType(
this,
"Assignment of a non-Boolean value"));
42 StringRef Msg = IsTainted ?
"Might assign a tainted non-Boolean value"
43 :
"Assignment of a non-Boolean value";
44 C.emitReport(std::make_unique<PathSensitiveBugReport>(*BT, Msg, N));
53 return TT->getDecl()->getName() ==
"BOOL" ||
54 TT->getDecl()->getName() ==
"_Bool" ||
55 TT->getDecl()->getName() ==
"Boolean";
60void BoolAssignmentChecker::checkBind(
SVal loc,
SVal val,
const Stmt *S,
65 dyn_cast_or_null<TypedValueRegion>(loc.
getAsRegion());
90 llvm::APSInt
Zero = BVF.getValue(0, valTy);
91 llvm::APSInt One = BVF.getValue(1, valTy);
99 emitReport(StOut,
C,
true);
106bool ento::shouldRegisterBoolAssignmentChecker(
const CheckerManager &mgr) {
static bool isBooleanType(QualType Ty)
A (possibly-)qualified type.
Stmt - This represents one statement.
bool isBooleanType() const
const T * getAs() const
Member-template getAs<specific type>'.
CHECKER * registerChecker(AT &&... Args)
Used to register checkers.
ProgramStatePair assumeInclusiveRangeDual(ProgramStateRef State, NonLoc Value, const llvm::APSInt &From, const llvm::APSInt &To)
Returns a pair of states (StInRange, StOutOfRange) where the given value is assumed to be in the rang...
BasicValueFactory & getBasicValueFactory()
SVal - This represents a symbolic expression, which can be either an L-value or an R-value.
std::optional< T > getAs() const
Convert to the specified SVal type, returning std::nullopt if this SVal is not of the desired type.
const MemRegion * getAsRegion() const
TypedValueRegion - An abstract class representing regions having a typed value.
virtual QualType getValueType() const =0
bool isTainted(ProgramStateRef State, const Stmt *S, const LocationContext *LCtx, TaintTagType Kind=TaintTagGeneric)
Check if the statement has a tainted value in the given state.
bool Zero(InterpState &S, CodePtr OpPC)