27class DivZeroChecker :
public Checker< check::PreStmt<BinaryOperator> > {
28 mutable std::unique_ptr<BugType> BT;
29 mutable std::unique_ptr<BugType> TaintBT;
43 if (
const auto *BE = dyn_cast<BinaryOperator>(S))
54 auto R = std::make_unique<PathSensitiveBugReport>(*BT, Msg, N);
56 C.emitReport(std::move(R));
60void DivZeroChecker::reportTaintBug(
68 auto R = std::make_unique<PathSensitiveBugReport>(*TaintBT, Msg, N);
70 for (
auto Sym : TaintedSyms)
71 R->markInteresting(Sym);
72 C.emitReport(std::move(R));
99 std::tie(stateNotZero, stateZero) = CM.
assumeDual(
C.getState(), *DV);
103 reportBug(
"Division by zero", stateZero,
C);
107 if ((stateNotZero && stateZero)) {
109 if (!taintedSyms.empty()) {
110 reportTaintBug(
"Division by a tainted value, possibly zero", stateZero,
C,
118 C.addTransition(stateNotZero);
125bool ento::shouldRegisterDivZeroChecker(
const CheckerManager &mgr) {
static const Expr * getDenomExpr(const ExplodedNode *N)
A builtin binary operation expression such as "x + y" or "x <= y".
This represents one expression.
Stmt - This represents one statement.
bool isScalarType() const
CHECKER * registerChecker(AT &&... Args)
Used to register checkers.
ProgramStatePair assumeDual(ProgramStateRef State, DefinedSVal Cond)
Returns a pair of states (StTrue, StFalse) where the given condition is assumed to be true or false,...
std::optional< T > getLocationAs() const &
SVal - This represents a symbolic expression, which can be either an L-value or an R-value.
std::optional< T > getAs() const
Convert to the specified SVal type, returning std::nullopt if this SVal is not of the desired type.
bool trackExpressionValue(const ExplodedNode *N, const Expr *E, PathSensitiveBugReport &R, TrackingOptions Opts={})
Attempts to add visitors to track expression value back to its point of origin.
const char *const LogicError
const char *const TaintedData
std::vector< SymbolRef > getTaintedSymbols(ProgramStateRef State, const Stmt *S, const LocationContext *LCtx, TaintTagType Kind=TaintTagGeneric)
Returns the tainted Symbols for a given Statement and state.