23using namespace iterator;
27class STLAlgorithmModeling :
public Checker<eval::Call> {
36 {{{
"std",
"find"}, 3}, &STLAlgorithmModeling::evalFind},
37 {{{
"std",
"find"}, 4}, &STLAlgorithmModeling::evalFind},
38 {{{
"std",
"find_if"}, 3}, &STLAlgorithmModeling::evalFind},
39 {{{
"std",
"find_if"}, 4}, &STLAlgorithmModeling::evalFind},
40 {{{
"std",
"find_if_not"}, 3}, &STLAlgorithmModeling::evalFind},
41 {{{
"std",
"find_if_not"}, 4}, &STLAlgorithmModeling::evalFind},
42 {{{
"std",
"find_first_of"}, 4}, &STLAlgorithmModeling::evalFind},
43 {{{
"std",
"find_first_of"}, 5}, &STLAlgorithmModeling::evalFind},
44 {{{
"std",
"find_first_of"}, 6}, &STLAlgorithmModeling::evalFind},
45 {{{
"std",
"find_end"}, 4}, &STLAlgorithmModeling::evalFind},
46 {{{
"std",
"find_end"}, 5}, &STLAlgorithmModeling::evalFind},
47 {{{
"std",
"find_end"}, 6}, &STLAlgorithmModeling::evalFind},
48 {{{
"std",
"lower_bound"}, 3}, &STLAlgorithmModeling::evalFind},
49 {{{
"std",
"lower_bound"}, 4}, &STLAlgorithmModeling::evalFind},
50 {{{
"std",
"upper_bound"}, 3}, &STLAlgorithmModeling::evalFind},
51 {{{
"std",
"upper_bound"}, 4}, &STLAlgorithmModeling::evalFind},
52 {{{
"std",
"search"}, 3}, &STLAlgorithmModeling::evalFind},
53 {{{
"std",
"search"}, 4}, &STLAlgorithmModeling::evalFind},
54 {{{
"std",
"search"}, 5}, &STLAlgorithmModeling::evalFind},
55 {{{
"std",
"search"}, 6}, &STLAlgorithmModeling::evalFind},
56 {{{
"std",
"search_n"}, 4}, &STLAlgorithmModeling::evalFind},
57 {{{
"std",
"search_n"}, 5}, &STLAlgorithmModeling::evalFind},
58 {{{
"std",
"search_n"}, 6}, &STLAlgorithmModeling::evalFind},
62 STLAlgorithmModeling() =
default;
64 bool AggressiveStdFindModeling =
false;
71 const auto *CE = dyn_cast_or_null<CallExpr>(
Call.getOriginExpr());
75 const FnCheck *Handler = Callbacks.lookup(
Call);
79 return (this->**Handler)(
C, CE);
109 unsigned paramNum)
const {
110 auto State =
C.getState();
111 auto &SVB =
C.getSValBuilder();
112 const auto *LCtx =
C.getLocationContext();
114 SVal RetVal = SVB.conjureSymbolVal(
nullptr, CE, LCtx,
C.blockCount());
115 SVal Param = State->getSVal(CE->
getArg(paramNum), LCtx);
117 auto StateFound = State->BindExpr(CE, LCtx, RetVal);
126 CE, LCtx,
C.blockCount());
128 assert(NewPos &&
"Failed to create new iterator position.");
130 SVal GreaterOrEqual = SVB.evalBinOp(StateFound, BO_GE,
133 SVB.getConditionType());
134 assert(isa<DefinedSVal>(GreaterOrEqual) &&
135 "Symbol comparison must be a `DefinedSVal`");
139 Param = State->getSVal(CE->
getArg(paramNum + 1), LCtx);
148 CE, LCtx,
C.blockCount());
150 assert(NewPos &&
"Failed to create new iterator position.");
152 SVal Less = SVB.evalBinOp(StateFound, BO_LT,
155 SVB.getConditionType());
156 assert(isa<DefinedSVal>(
Less) &&
157 "Symbol comparison must be a `DefinedSVal`");
161 C.addTransition(StateFound);
163 if (AggressiveStdFindModeling) {
164 auto StateNotFound = State->BindExpr(CE, LCtx, Param);
165 C.addTransition(StateNotFound);
173 Checker->AggressiveStdFindModeling =
175 "AggressiveStdFindModeling");
178bool ento::shouldRegisterSTLAlgorithmModeling(
const CheckerManager &mgr) {
bool getCheckerBooleanOption(StringRef CheckerName, StringRef OptionName, bool SearchInParents=false) const
Interprets an option's string value as a boolean.
CallExpr - Represents a function call (C99 6.5.2.2, C++ [expr.call]).
Expr * getArg(unsigned Arg)
getArg - Return the specified argument.
An immutable map from CallDescriptions to arbitrary data.
Represents an abstract call to a function or method along a particular path.
const AnalyzerOptions & getAnalyzerOptions() const
CHECKER * registerChecker(AT &&... Args)
Used to register checkers.
SVal - This represents a symbolic expression, which can be either an L-value or an R-value.
T castAs() const
Convert to the specified SVal type, asserting that this SVal is of the desired type.
Represents symbolic expression that isn't a location.
bool isIteratorType(const QualType &Type)
const IteratorPosition * getIteratorPosition(ProgramStateRef State, const SVal &Val)
ProgramStateRef createIteratorPosition(ProgramStateRef State, const SVal &Val, const MemRegion *Cont, const Stmt *S, const LocationContext *LCtx, unsigned blockCount)