clang  14.0.0git
EnumCastOutOfRangeChecker.cpp
Go to the documentation of this file.
1 //===- EnumCastOutOfRangeChecker.cpp ---------------------------*- C++ -*--===//
2 //
3 // Part of the LLVM Project, under the Apache License v2.0 with LLVM Exceptions.
4 // See https://llvm.org/LICENSE.txt for license information.
5 // SPDX-License-Identifier: Apache-2.0 WITH LLVM-exception
6 //
7 //===----------------------------------------------------------------------===//
8 //
9 // The EnumCastOutOfRangeChecker is responsible for checking integer to
10 // enumeration casts that could result in undefined values. This could happen
11 // if the value that we cast from is out of the value range of the enumeration.
12 // Reference:
13 // [ISO/IEC 14882-2014] ISO/IEC 14882-2014.
14 // Programming Languages — C++, Fourth Edition. 2014.
15 // C++ Standard, [dcl.enum], in paragraph 8, which defines the range of an enum
16 // C++ Standard, [expr.static.cast], paragraph 10, which defines the behaviour
17 // of casting an integer value that is out of range
18 // SEI CERT C++ Coding Standard, INT50-CPP. Do not cast to an out-of-range
19 // enumeration value
20 //===----------------------------------------------------------------------===//
21 
25 
26 using namespace clang;
27 using namespace ento;
28 
29 namespace {
30 // This evaluator checks two SVals for equality. The first SVal is provided via
31 // the constructor, the second is the parameter of the overloaded () operator.
32 // It uses the in-built ConstraintManager to resolve the equlity to possible or
33 // not possible ProgramStates.
34 class ConstraintBasedEQEvaluator {
35  const DefinedOrUnknownSVal CompareValue;
36  const ProgramStateRef PS;
37  SValBuilder &SVB;
38 
39 public:
40  ConstraintBasedEQEvaluator(CheckerContext &C,
41  const DefinedOrUnknownSVal CompareValue)
42  : CompareValue(CompareValue), PS(C.getState()), SVB(C.getSValBuilder()) {}
43 
44  bool operator()(const llvm::APSInt &EnumDeclInitValue) {
45  DefinedOrUnknownSVal EnumDeclValue = SVB.makeIntVal(EnumDeclInitValue);
46  DefinedOrUnknownSVal ElemEqualsValueToCast =
47  SVB.evalEQ(PS, EnumDeclValue, CompareValue);
48 
49  return static_cast<bool>(PS->assume(ElemEqualsValueToCast, true));
50  }
51 };
52 
53 // This checker checks CastExpr statements.
54 // If the value provided to the cast is one of the values the enumeration can
55 // represent, the said value matches the enumeration. If the checker can
56 // establish the impossibility of matching it gives a warning.
57 // Being conservative, it does not warn if there is slight possibility the
58 // value can be matching.
59 class EnumCastOutOfRangeChecker : public Checker<check::PreStmt<CastExpr>> {
60  mutable std::unique_ptr<BuiltinBug> EnumValueCastOutOfRange;
61  void reportWarning(CheckerContext &C) const;
62 
63 public:
64  void checkPreStmt(const CastExpr *CE, CheckerContext &C) const;
65 };
66 
67 using EnumValueVector = llvm::SmallVector<llvm::APSInt, 6>;
68 
69 // Collects all of the values an enum can represent (as SVals).
70 EnumValueVector getDeclValuesForEnum(const EnumDecl *ED) {
71  EnumValueVector DeclValues(
73  llvm::transform(ED->enumerators(), DeclValues.begin(),
74  [](const EnumConstantDecl *D) { return D->getInitVal(); });
75  return DeclValues;
76 }
77 } // namespace
78 
79 void EnumCastOutOfRangeChecker::reportWarning(CheckerContext &C) const {
80  if (const ExplodedNode *N = C.generateNonFatalErrorNode()) {
81  if (!EnumValueCastOutOfRange)
82  EnumValueCastOutOfRange.reset(
83  new BuiltinBug(this, "Enum cast out of range",
84  "The value provided to the cast expression is not in "
85  "the valid range of values for the enum"));
86  C.emitReport(std::make_unique<PathSensitiveBugReport>(
87  *EnumValueCastOutOfRange, EnumValueCastOutOfRange->getDescription(),
88  N));
89  }
90 }
91 
92 void EnumCastOutOfRangeChecker::checkPreStmt(const CastExpr *CE,
93  CheckerContext &C) const {
94 
95  // Only perform enum range check on casts where such checks are valid. For
96  // all other cast kinds (where enum range checks are unnecessary or invalid),
97  // just return immediately. TODO: The set of casts whitelisted for enum
98  // range checking may be incomplete. Better to add a missing cast kind to
99  // enable a missing check than to generate false negatives and have to remove
100  // those later.
101  switch (CE->getCastKind()) {
102  case CK_IntegralCast:
103  break;
104 
105  default:
106  return;
107  break;
108  }
109 
110  // Get the value of the expression to cast.
111  const llvm::Optional<DefinedOrUnknownSVal> ValueToCast =
112  C.getSVal(CE->getSubExpr()).getAs<DefinedOrUnknownSVal>();
113 
114  // If the value cannot be reasoned about (not even a DefinedOrUnknownSVal),
115  // don't analyze further.
116  if (!ValueToCast)
117  return;
118 
119  const QualType T = CE->getType();
120  // Check whether the cast type is an enum.
121  if (!T->isEnumeralType())
122  return;
123 
124  // If the cast is an enum, get its declaration.
125  // If the isEnumeralType() returned true, then the declaration must exist
126  // even if it is a stub declaration. It is up to the getDeclValuesForEnum()
127  // function to handle this.
128  const EnumDecl *ED = T->castAs<EnumType>()->getDecl();
129 
130  EnumValueVector DeclValues = getDeclValuesForEnum(ED);
131  // Check if any of the enum values possibly match.
132  bool PossibleValueMatch = llvm::any_of(
133  DeclValues, ConstraintBasedEQEvaluator(C, *ValueToCast));
134 
135  // If there is no value that can possibly match any of the enum values, then
136  // warn.
137  if (!PossibleValueMatch)
138  reportWarning(C);
139 }
140 
141 void ento::registerEnumCastOutOfRangeChecker(CheckerManager &mgr) {
142  mgr.registerChecker<EnumCastOutOfRangeChecker>();
143 }
144 
145 bool ento::shouldRegisterEnumCastOutOfRangeChecker(const CheckerManager &mgr) {
146  return true;
147 }
clang::EnumDecl::enumerator_end
enumerator_iterator enumerator_end() const
Definition: Decl.h:3734
clang::EnumDecl::enumerators
enumerator_range enumerators() const
Definition: Decl.h:3723
llvm::SmallVector
Definition: LLVM.h:38
clang::CastExpr::getSubExpr
Expr * getSubExpr()
Definition: Expr.h:3524
clang::ento::ProgramStateRef
IntrusiveRefCntPtr< const ProgramState > ProgramStateRef
Definition: ProgramState_Fwd.h:37
clang::QualType
A (possibly-)qualified type.
Definition: Type.h:673
AttributeLangSupport::C
@ C
Definition: SemaDeclAttr.cpp:54
distance
float __ovld __cnfn distance(float p0, float p1)
Returns the distance between p0 and p1.
llvm::Optional
Definition: LLVM.h:40
clang::EnumDecl
Represents an enum.
Definition: Decl.h:3590
APSInt
llvm::APSInt APSInt
Definition: ByteCodeEmitter.cpp:19
BuiltinCheckerRegistration.h
clang::EnumDecl::enumerator_begin
enumerator_iterator enumerator_begin() const
Definition: Decl.h:3727
clang::EnumConstantDecl
An instance of this object exists for each enum constant that is defined.
Definition: Decl.h:3050
clang::Type::isEnumeralType
bool isEnumeralType() const
Definition: Type.h:6766
clang::CastExpr::getCastKind
CastKind getCastKind() const
Definition: Expr.h:3518
clang::Type::castAs
const T * castAs() const
Member-template castAs<specific type>.
Definition: Type.h:7226
BugType.h
CheckerContext.h
clang
Definition: CalledOnceCheck.h:17
clang::Expr::getType
QualType getType() const
Definition: Expr.h:141
clang::EnumType
A helper class that allows the use of isa/cast/dyncast to detect TagType objects of enums.
Definition: Type.h:4639
clang::CastExpr
CastExpr - Base class for type casts, including both implicit casts (ImplicitCastExpr) and explicit c...
Definition: Expr.h:3473