21 using namespace clang;
23 using namespace taint;
26 class DivZeroChecker :
public Checker< check::PreStmt<BinaryOperator> > {
27 mutable std::unique_ptr<BuiltinBug> BT;
28 void reportBug(
const char *Msg,
ProgramStateRef StateZero, CheckerContext &C,
29 std::unique_ptr<BugReporterVisitor> Visitor =
nullptr)
const;
32 void checkPreStmt(
const BinaryOperator *B, CheckerContext &C)
const;
37 const Stmt *S = N->getLocationAs<
PreStmt>()->getStmt();
38 if (
const auto *BE = dyn_cast<BinaryOperator>(S))
43 void DivZeroChecker::reportBug(
45 std::unique_ptr<BugReporterVisitor> Visitor)
const {
46 if (ExplodedNode *N =
C.generateErrorNode(StateZero)) {
48 BT.reset(
new BuiltinBug(
this,
"Division by zero"));
50 auto R = std::make_unique<PathSensitiveBugReport>(*BT, Msg, N);
51 R->addVisitor(std::move(Visitor));
53 C.emitReport(std::move(R));
58 CheckerContext &C)
const {
69 SVal Denom =
C.getSVal(B->
getRHS());
78 ConstraintManager &CM =
C.getConstraintManager();
80 std::tie(stateNotZero, stateZero) = CM.assumeDual(
C.getState(), *DV);
84 reportBug(
"Division by zero", stateZero, C);
89 if ((stateNotZero && stateZero && TaintedD)) {
90 reportBug(
"Division by a tainted value, possibly zero", stateZero, C,
91 std::make_unique<taint::TaintBugVisitor>(*DV));
97 C.addTransition(stateNotZero);
100 void ento::registerDivZeroChecker(CheckerManager &mgr) {
101 mgr.registerChecker<DivZeroChecker>();
104 bool ento::shouldRegisterDivZeroChecker(
const CheckerManager &mgr) {