clang 19.0.0git
EnumCastOutOfRangeChecker.cpp
Go to the documentation of this file.
1//===- EnumCastOutOfRangeChecker.cpp ---------------------------*- C++ -*--===//
2//
3// Part of the LLVM Project, under the Apache License v2.0 with LLVM Exceptions.
4// See https://llvm.org/LICENSE.txt for license information.
5// SPDX-License-Identifier: Apache-2.0 WITH LLVM-exception
6//
7//===----------------------------------------------------------------------===//
8//
9// The EnumCastOutOfRangeChecker is responsible for checking integer to
10// enumeration casts that could result in undefined values. This could happen
11// if the value that we cast from is out of the value range of the enumeration.
12// Reference:
13// [ISO/IEC 14882-2014] ISO/IEC 14882-2014.
14// Programming Languages — C++, Fourth Edition. 2014.
15// C++ Standard, [dcl.enum], in paragraph 8, which defines the range of an enum
16// C++ Standard, [expr.static.cast], paragraph 10, which defines the behaviour
17// of casting an integer value that is out of range
18// SEI CERT C++ Coding Standard, INT50-CPP. Do not cast to an out-of-range
19// enumeration value
20//===----------------------------------------------------------------------===//
21
25#include "llvm/Support/FormatVariadic.h"
26#include <optional>
27
28using namespace clang;
29using namespace ento;
30using llvm::formatv;
31
32namespace {
33// This evaluator checks two SVals for equality. The first SVal is provided via
34// the constructor, the second is the parameter of the overloaded () operator.
35// It uses the in-built ConstraintManager to resolve the equlity to possible or
36// not possible ProgramStates.
37class ConstraintBasedEQEvaluator {
38 const DefinedOrUnknownSVal CompareValue;
39 const ProgramStateRef PS;
40 SValBuilder &SVB;
41
42public:
43 ConstraintBasedEQEvaluator(CheckerContext &C,
44 const DefinedOrUnknownSVal CompareValue)
45 : CompareValue(CompareValue), PS(C.getState()), SVB(C.getSValBuilder()) {}
46
47 bool operator()(const llvm::APSInt &EnumDeclInitValue) {
48 DefinedOrUnknownSVal EnumDeclValue = SVB.makeIntVal(EnumDeclInitValue);
49 DefinedOrUnknownSVal ElemEqualsValueToCast =
50 SVB.evalEQ(PS, EnumDeclValue, CompareValue);
51
52 return static_cast<bool>(PS->assume(ElemEqualsValueToCast, true));
53 }
54};
55
56// This checker checks CastExpr statements.
57// If the value provided to the cast is one of the values the enumeration can
58// represent, the said value matches the enumeration. If the checker can
59// establish the impossibility of matching it gives a warning.
60// Being conservative, it does not warn if there is slight possibility the
61// value can be matching.
62class EnumCastOutOfRangeChecker : public Checker<check::PreStmt<CastExpr>> {
63 const BugType EnumValueCastOutOfRange{this, "Enum cast out of range"};
64 void reportWarning(CheckerContext &C, const CastExpr *CE,
65 const EnumDecl *E) const;
66
67public:
68 void checkPreStmt(const CastExpr *CE, CheckerContext &C) const;
69};
70
71using EnumValueVector = llvm::SmallVector<llvm::APSInt, 6>;
72
73// Collects all of the values an enum can represent (as SVals).
74EnumValueVector getDeclValuesForEnum(const EnumDecl *ED) {
75 EnumValueVector DeclValues(
76 std::distance(ED->enumerator_begin(), ED->enumerator_end()));
77 llvm::transform(ED->enumerators(), DeclValues.begin(),
78 [](const EnumConstantDecl *D) { return D->getInitVal(); });
79 return DeclValues;
80}
81} // namespace
82
83void EnumCastOutOfRangeChecker::reportWarning(CheckerContext &C,
84 const CastExpr *CE,
85 const EnumDecl *E) const {
86 assert(E && "valid EnumDecl* is expected");
87 if (const ExplodedNode *N = C.generateNonFatalErrorNode()) {
88 std::string ValueStr = "", NameStr = "the enum";
89
90 // Try to add details to the message:
91 const auto ConcreteValue =
92 C.getSVal(CE->getSubExpr()).getAs<nonloc::ConcreteInt>();
93 if (ConcreteValue) {
94 ValueStr = formatv(" '{0}'", ConcreteValue->getValue());
95 }
96 if (StringRef EnumName{E->getName()}; !EnumName.empty()) {
97 NameStr = formatv("'{0}'", EnumName);
98 }
99
100 std::string Msg = formatv("The value{0} provided to the cast expression is "
101 "not in the valid range of values for {1}",
102 ValueStr, NameStr);
103
104 auto BR = std::make_unique<PathSensitiveBugReport>(EnumValueCastOutOfRange,
105 Msg, N);
107 BR->addNote("enum declared here",
108 PathDiagnosticLocation::create(E, C.getSourceManager()),
109 {E->getSourceRange()});
110 C.emitReport(std::move(BR));
111 }
112}
113
114void EnumCastOutOfRangeChecker::checkPreStmt(const CastExpr *CE,
115 CheckerContext &C) const {
116
117 // Only perform enum range check on casts where such checks are valid. For
118 // all other cast kinds (where enum range checks are unnecessary or invalid),
119 // just return immediately. TODO: The set of casts allowed for enum range
120 // checking may be incomplete. Better to add a missing cast kind to enable a
121 // missing check than to generate false negatives and have to remove those
122 // later.
123 switch (CE->getCastKind()) {
124 case CK_IntegralCast:
125 break;
126
127 default:
128 return;
129 break;
130 }
131
132 // Get the value of the expression to cast.
133 const std::optional<DefinedOrUnknownSVal> ValueToCast =
134 C.getSVal(CE->getSubExpr()).getAs<DefinedOrUnknownSVal>();
135
136 // If the value cannot be reasoned about (not even a DefinedOrUnknownSVal),
137 // don't analyze further.
138 if (!ValueToCast)
139 return;
140
141 const QualType T = CE->getType();
142 // Check whether the cast type is an enum.
143 if (!T->isEnumeralType())
144 return;
145
146 // If the cast is an enum, get its declaration.
147 // If the isEnumeralType() returned true, then the declaration must exist
148 // even if it is a stub declaration. It is up to the getDeclValuesForEnum()
149 // function to handle this.
150 const EnumDecl *ED = T->castAs<EnumType>()->getDecl();
151
152 EnumValueVector DeclValues = getDeclValuesForEnum(ED);
153
154 // If the declarator list is empty, bail out.
155 // Every initialization an enum with a fixed underlying type but without any
156 // enumerators would produce a warning if we were to continue at this point.
157 // The most notable example is std::byte in the C++17 standard library.
158 // TODO: Create heuristics to bail out when the enum type is intended to be
159 // used to store combinations of flag values (to mitigate the limitation
160 // described in the docs).
161 if (DeclValues.size() == 0)
162 return;
163
164 // Check if any of the enum values possibly match.
165 bool PossibleValueMatch =
166 llvm::any_of(DeclValues, ConstraintBasedEQEvaluator(C, *ValueToCast));
167
168 // If there is no value that can possibly match any of the enum values, then
169 // warn.
170 if (!PossibleValueMatch)
171 reportWarning(C, CE, ED);
172}
173
174void ento::registerEnumCastOutOfRangeChecker(CheckerManager &mgr) {
175 mgr.registerChecker<EnumCastOutOfRangeChecker>();
176}
177
178bool ento::shouldRegisterEnumCastOutOfRangeChecker(const CheckerManager &mgr) {
179 return true;
180}
CastExpr - Base class for type casts, including both implicit casts (ImplicitCastExpr) and explicit c...
Definition: Expr.h:3490
CastKind getCastKind() const
Definition: Expr.h:3534
Expr * getSubExpr()
Definition: Expr.h:3540
An instance of this object exists for each enum constant that is defined.
Definition: Decl.h:3265
Represents an enum.
Definition: Decl.h:3832
enumerator_range enumerators() const
Definition: Decl.h:3965
enumerator_iterator enumerator_begin() const
Definition: Decl.h:3969
enumerator_iterator enumerator_end() const
Definition: Decl.h:3976
A helper class that allows the use of isa/cast/dyncast to detect TagType objects of enums.
Definition: Type.h:5335
QualType getType() const
Definition: Expr.h:142
StringRef getName() const
Get the name of identifier for this declaration as a StringRef.
Definition: Decl.h:276
A (possibly-)qualified type.
Definition: Type.h:738
const T * castAs() const
Member-template castAs<specific type>.
Definition: Type.h:7945
bool isEnumeralType() const
Definition: Type.h:7465
CHECKER * registerChecker(AT &&... Args)
Used to register checkers.
static PathDiagnosticLocation create(const Decl *D, const SourceManager &SM)
Create a location corresponding to the given declaration.
nonloc::ConcreteInt makeIntVal(const IntegerLiteral *integer)
Definition: SValBuilder.h:290
SVal evalEQ(ProgramStateRef state, SVal lhs, SVal rhs)
Value representing integer constant.
Definition: SVals.h:305
bool trackExpressionValue(const ExplodedNode *N, const Expr *E, PathSensitiveBugReport &R, TrackingOptions Opts={})
Attempts to add visitors to track expression value back to its point of origin.
The JSON file list parser is used to communicate input to InstallAPI.