clang 17.0.0git
EnumCastOutOfRangeChecker.cpp
Go to the documentation of this file.
1//===- EnumCastOutOfRangeChecker.cpp ---------------------------*- C++ -*--===//
2//
3// Part of the LLVM Project, under the Apache License v2.0 with LLVM Exceptions.
4// See https://llvm.org/LICENSE.txt for license information.
5// SPDX-License-Identifier: Apache-2.0 WITH LLVM-exception
6//
7//===----------------------------------------------------------------------===//
8//
9// The EnumCastOutOfRangeChecker is responsible for checking integer to
10// enumeration casts that could result in undefined values. This could happen
11// if the value that we cast from is out of the value range of the enumeration.
12// Reference:
13// [ISO/IEC 14882-2014] ISO/IEC 14882-2014.
14// Programming Languages — C++, Fourth Edition. 2014.
15// C++ Standard, [dcl.enum], in paragraph 8, which defines the range of an enum
16// C++ Standard, [expr.static.cast], paragraph 10, which defines the behaviour
17// of casting an integer value that is out of range
18// SEI CERT C++ Coding Standard, INT50-CPP. Do not cast to an out-of-range
19// enumeration value
20//===----------------------------------------------------------------------===//
21
25#include <optional>
26
27using namespace clang;
28using namespace ento;
29
30namespace {
31// This evaluator checks two SVals for equality. The first SVal is provided via
32// the constructor, the second is the parameter of the overloaded () operator.
33// It uses the in-built ConstraintManager to resolve the equlity to possible or
34// not possible ProgramStates.
35class ConstraintBasedEQEvaluator {
36 const DefinedOrUnknownSVal CompareValue;
37 const ProgramStateRef PS;
38 SValBuilder &SVB;
39
40public:
41 ConstraintBasedEQEvaluator(CheckerContext &C,
42 const DefinedOrUnknownSVal CompareValue)
43 : CompareValue(CompareValue), PS(C.getState()), SVB(C.getSValBuilder()) {}
44
45 bool operator()(const llvm::APSInt &EnumDeclInitValue) {
46 DefinedOrUnknownSVal EnumDeclValue = SVB.makeIntVal(EnumDeclInitValue);
47 DefinedOrUnknownSVal ElemEqualsValueToCast =
48 SVB.evalEQ(PS, EnumDeclValue, CompareValue);
49
50 return static_cast<bool>(PS->assume(ElemEqualsValueToCast, true));
51 }
52};
53
54// This checker checks CastExpr statements.
55// If the value provided to the cast is one of the values the enumeration can
56// represent, the said value matches the enumeration. If the checker can
57// establish the impossibility of matching it gives a warning.
58// Being conservative, it does not warn if there is slight possibility the
59// value can be matching.
60class EnumCastOutOfRangeChecker : public Checker<check::PreStmt<CastExpr>> {
61 mutable std::unique_ptr<BuiltinBug> EnumValueCastOutOfRange;
62 void reportWarning(CheckerContext &C) const;
63
64public:
65 void checkPreStmt(const CastExpr *CE, CheckerContext &C) const;
66};
67
68using EnumValueVector = llvm::SmallVector<llvm::APSInt, 6>;
69
70// Collects all of the values an enum can represent (as SVals).
71EnumValueVector getDeclValuesForEnum(const EnumDecl *ED) {
72 EnumValueVector DeclValues(
73 std::distance(ED->enumerator_begin(), ED->enumerator_end()));
74 llvm::transform(ED->enumerators(), DeclValues.begin(),
75 [](const EnumConstantDecl *D) { return D->getInitVal(); });
76 return DeclValues;
77}
78} // namespace
79
80void EnumCastOutOfRangeChecker::reportWarning(CheckerContext &C) const {
81 if (const ExplodedNode *N = C.generateNonFatalErrorNode()) {
82 if (!EnumValueCastOutOfRange)
83 EnumValueCastOutOfRange.reset(
84 new BuiltinBug(this, "Enum cast out of range",
85 "The value provided to the cast expression is not in "
86 "the valid range of values for the enum"));
87 C.emitReport(std::make_unique<PathSensitiveBugReport>(
88 *EnumValueCastOutOfRange, EnumValueCastOutOfRange->getDescription(),
89 N));
90 }
91}
92
93void EnumCastOutOfRangeChecker::checkPreStmt(const CastExpr *CE,
94 CheckerContext &C) const {
95
96 // Only perform enum range check on casts where such checks are valid. For
97 // all other cast kinds (where enum range checks are unnecessary or invalid),
98 // just return immediately. TODO: The set of casts allowed for enum range
99 // checking may be incomplete. Better to add a missing cast kind to enable a
100 // missing check than to generate false negatives and have to remove those
101 // later.
102 switch (CE->getCastKind()) {
103 case CK_IntegralCast:
104 break;
105
106 default:
107 return;
108 break;
109 }
110
111 // Get the value of the expression to cast.
112 const std::optional<DefinedOrUnknownSVal> ValueToCast =
113 C.getSVal(CE->getSubExpr()).getAs<DefinedOrUnknownSVal>();
114
115 // If the value cannot be reasoned about (not even a DefinedOrUnknownSVal),
116 // don't analyze further.
117 if (!ValueToCast)
118 return;
119
120 const QualType T = CE->getType();
121 // Check whether the cast type is an enum.
122 if (!T->isEnumeralType())
123 return;
124
125 // If the cast is an enum, get its declaration.
126 // If the isEnumeralType() returned true, then the declaration must exist
127 // even if it is a stub declaration. It is up to the getDeclValuesForEnum()
128 // function to handle this.
129 const EnumDecl *ED = T->castAs<EnumType>()->getDecl();
130
131 EnumValueVector DeclValues = getDeclValuesForEnum(ED);
132 // Check if any of the enum values possibly match.
133 bool PossibleValueMatch = llvm::any_of(
134 DeclValues, ConstraintBasedEQEvaluator(C, *ValueToCast));
135
136 // If there is no value that can possibly match any of the enum values, then
137 // warn.
138 if (!PossibleValueMatch)
139 reportWarning(C);
140}
141
142void ento::registerEnumCastOutOfRangeChecker(CheckerManager &mgr) {
143 mgr.registerChecker<EnumCastOutOfRangeChecker>();
144}
145
146bool ento::shouldRegisterEnumCastOutOfRangeChecker(const CheckerManager &mgr) {
147 return true;
148}
CastExpr - Base class for type casts, including both implicit casts (ImplicitCastExpr) and explicit c...
Definition: Expr.h:3482
CastKind getCastKind() const
Definition: Expr.h:3526
Expr * getSubExpr()
Definition: Expr.h:3532
An instance of this object exists for each enum constant that is defined.
Definition: Decl.h:3160
Represents an enum.
Definition: Decl.h:3720
enumerator_range enumerators() const
Definition: Decl.h:3853
enumerator_iterator enumerator_begin() const
Definition: Decl.h:3857
enumerator_iterator enumerator_end() const
Definition: Decl.h:3864
A helper class that allows the use of isa/cast/dyncast to detect TagType objects of enums.
Definition: Type.h:4861
QualType getType() const
Definition: Expr.h:142
A (possibly-)qualified type.
Definition: Type.h:736
const T * castAs() const
Member-template castAs<specific type>.
Definition: Type.h:7491
bool isEnumeralType() const
Definition: Type.h:7004
CHECKER * registerChecker(AT &&... Args)
Used to register checkers.
nonloc::ConcreteInt makeIntVal(const IntegerLiteral *integer)
Definition: SValBuilder.h:269
SVal evalEQ(ProgramStateRef state, SVal lhs, SVal rhs)
@ C
Languages that the frontend can parse and compile.