52 #include "llvm/ADT/SmallString.h"
53 #include "llvm/ADT/StringExtras.h"
57 using namespace clang;
69 "Errno description not applicable.");
70 return "may be undefined after the call and should not be used";
74 class StdLibraryFunctionsChecker
75 :
public Checker<check::PreCall, check::PostCall, eval::Call> {
81 enum InvalidationKind { NoEvalCall, EvalCallAsPure };
91 typedef std::vector<std::pair<RangeInt, RangeInt>> IntRangeVector;
96 typedef uint32_t ArgNo;
97 static const ArgNo
Ret;
103 class ValueConstraint;
110 using ValueConstraintPtr = std::shared_ptr<ValueConstraint>;
116 class ValueConstraint {
118 ValueConstraint(ArgNo ArgN) : ArgN(ArgN) {}
119 virtual ~ValueConstraint() {}
123 const Summary &Summary,
125 virtual ValueConstraintPtr negate()
const {
126 llvm_unreachable(
"Not implemented");
134 assert(ValidArg &&
"Arg out of range!");
138 return checkSpecificValidity(FD);
140 ArgNo getArgNo()
const {
return ArgN; }
146 virtual std::vector<ArgNo> getArgsToTrack()
const {
return {ArgN}; }
148 virtual StringRef
getName()
const = 0;
153 const Summary &Summary)
const {
157 llvm_unreachable(
"Not implemented");
164 virtual bool checkSpecificValidity(
const FunctionDecl *FD)
const {
170 enum RangeKind { OutOfRange, WithinRange };
173 class RangeConstraint :
public ValueConstraint {
183 IntRangeVector Ranges;
186 StringRef
getName()
const override {
return "Range"; }
187 RangeConstraint(ArgNo ArgN, RangeKind
Kind,
const IntRangeVector &Ranges)
188 : ValueConstraint(ArgN),
Kind(
Kind), Ranges(Ranges) {}
191 const Summary &Summary)
const override;
193 const IntRangeVector &getRanges()
const {
return Ranges; }
198 const Summary &Summary)
const;
201 const Summary &Summary)
const;
205 const Summary &Summary,
209 return applyAsOutOfRange(
State, Call, Summary);
211 return applyAsWithinRange(
State, Call, Summary);
213 llvm_unreachable(
"Unknown range kind!");
216 ValueConstraintPtr negate()
const override {
217 RangeConstraint Tmp(*
this);
220 Tmp.Kind = WithinRange;
223 Tmp.Kind = OutOfRange;
226 return std::make_shared<RangeConstraint>(Tmp);
229 bool checkSpecificValidity(
const FunctionDecl *FD)
const override {
230 const bool ValidArg =
233 "This constraint should be applied on an integral type");
238 class ComparisonConstraint :
public ValueConstraint {
243 virtual StringRef
getName()
const override {
return "Comparison"; };
246 : ValueConstraint(ArgN),
Opcode(
Opcode), OtherArgN(OtherArgN) {}
247 ArgNo getOtherArgNo()
const {
return OtherArgN; }
250 const Summary &Summary,
254 class NotNullConstraint :
public ValueConstraint {
255 using ValueConstraint::ValueConstraint;
257 bool CannotBeNull =
true;
261 const Summary &Summary)
const override;
262 StringRef
getName()
const override {
return "NonNull"; }
264 const Summary &Summary,
266 SVal V = getArgSVal(Call, getArgNo());
274 return State->assume(L, CannotBeNull);
277 ValueConstraintPtr negate()
const override {
278 NotNullConstraint Tmp(*
this);
279 Tmp.CannotBeNull = !this->CannotBeNull;
280 return std::make_shared<NotNullConstraint>(Tmp);
283 bool checkSpecificValidity(
const FunctionDecl *FD)
const override {
284 const bool ValidArg = getArgType(FD, ArgN)->isPointerType();
286 "This constraint should be applied only on a pointer type");
301 class BufferSizeConstraint :
public ValueConstraint {
314 StringRef
getName()
const override {
return "BufferSize"; }
315 BufferSizeConstraint(ArgNo Buffer,
llvm::APSInt BufMinSize)
316 : ValueConstraint(Buffer), ConcreteSize(BufMinSize) {}
317 BufferSizeConstraint(ArgNo Buffer, ArgNo BufSize)
318 : ValueConstraint(Buffer), SizeArgN(BufSize) {}
319 BufferSizeConstraint(ArgNo Buffer, ArgNo BufSize, ArgNo BufSizeMultiplier)
320 : ValueConstraint(Buffer), SizeArgN(BufSize),
321 SizeMultiplierArgN(BufSizeMultiplier) {}
323 std::vector<ArgNo> getArgsToTrack()
const override {
324 std::vector<ArgNo> Result{ArgN};
326 Result.push_back(*SizeArgN);
327 if (SizeMultiplierArgN)
328 Result.push_back(*SizeMultiplierArgN);
333 const Summary &Summary)
const override;
336 const Summary &Summary,
340 SVal BufV = getArgSVal(Call, getArgNo());
343 const SVal SizeV = [
this, &
State, &
Call, &Summary, &SvalBuilder]() {
347 assert(SizeArgN &&
"The constraint must be either a concrete value or "
348 "encoded in an argument.");
350 SVal SizeV = getArgSVal(Call, *SizeArgN);
352 if (SizeMultiplierArgN) {
353 SVal SizeMulV = getArgSVal(Call, *SizeMultiplierArgN);
355 Summary.getArgType(*SizeArgN));
366 return State->assume(*F,
true);
374 llvm_unreachable(
"Size argument or the dynamic size is Undefined");
377 ValueConstraintPtr negate()
const override {
378 BufferSizeConstraint Tmp(*
this);
380 return std::make_shared<BufferSizeConstraint>(Tmp);
383 bool checkSpecificValidity(
const FunctionDecl *FD)
const override {
384 const bool ValidArg = getArgType(FD, ArgN)->isPointerType();
386 "This constraint should be applied only on a pointer type");
392 using ConstraintSet = std::vector<ValueConstraintPtr>;
396 class ErrnoConstraintBase {
400 const Summary &Summary,
408 virtual ~ErrnoConstraintBase() {}
424 class ZeroRelatedErrnoConstraint :
public ErrnoConstraintBase {
430 : ErrnoConstraintBase(CS), Op(OpK) {
435 const Summary &Summary,
440 C.getLocationContext(),
C.getASTContext().IntTy,
444 SVB.
makeZeroVal(
C.getASTContext().IntTy).castAs<NonLoc>();
447 .castAs<DefinedOrUnknownSVal>();
452 ErrnoSVal, CheckState);
458 return (Twine(
"Assuming that function '") + FunctionName.str() +
459 "' fails, in this case the value 'errno' becomes " +
470 class SuccessErrnoConstraint :
public ErrnoConstraintBase {
472 SuccessErrnoConstraint()
476 const Summary &Summary,
482 return (Twine(
"Assuming that function '") + FunctionName.str() +
483 "' is successful, in this case the value 'errno' " +
491 class NoErrnoConstraint :
public ErrnoConstraintBase {
493 NoErrnoConstraint() : ErrnoConstraintBase(errno_modeling::
Irrelevant) {}
496 const Summary &Summary,
524 ConstraintSet Constraints;
525 const ErrnoConstraintBase &ErrnoConstraint;
529 SummaryCase(ConstraintSet &&Constraints,
const ErrnoConstraintBase &ErrnoC,
531 : Constraints(
std::move(Constraints)), ErrnoConstraint(ErrnoC),
534 SummaryCase(
const ConstraintSet &Constraints,
535 const ErrnoConstraintBase &ErrnoC, StringRef Note)
536 : Constraints(Constraints), ErrnoConstraint(ErrnoC),
Note(
Note) {}
538 const ConstraintSet &getConstraints()
const {
return Constraints; }
539 const ErrnoConstraintBase &getErrnoConstraint()
const {
540 return ErrnoConstraint;
542 StringRef getNote()
const {
return Note; }
545 using ArgTypes = std::vector<Optional<QualType>>;
558 using ArgQualTypes = std::vector<QualType>;
567 Signature(ArgTypes ArgTys, RetType RetTy) {
573 assertArgTypeSuitableForSignature(*Arg);
574 this->ArgTys.push_back(*Arg);
581 assertRetTypeSuitableForSignature(*RetTy);
582 this->RetTy = *RetTy;
590 static void assertArgTypeSuitableForSignature(
QualType T) {
592 "We should have no void types in the spec");
594 "We should only have canonical types in the spec");
596 static void assertRetTypeSuitableForSignature(
QualType T) {
598 "We should only have canonical types in the spec");
603 assert(FD &&
"Function must be set");
610 using SummaryCases = std::vector<SummaryCase>;
629 const InvalidationKind InvalidationKd;
631 ConstraintSet ArgConstraints;
638 Summary(InvalidationKind InvalidationKd) : InvalidationKd(InvalidationKd) {}
640 Summary &Case(ConstraintSet &&CS,
const ErrnoConstraintBase &ErrnoC,
641 StringRef Note =
"") {
642 Cases.push_back(SummaryCase(std::move(CS), ErrnoC, Note));
645 Summary &Case(
const ConstraintSet &CS,
const ErrnoConstraintBase &ErrnoC,
646 StringRef Note =
"") {
647 Cases.push_back(SummaryCase(CS, ErrnoC, Note));
650 Summary &ArgConstraint(ValueConstraintPtr VC) {
651 assert(VC->getArgNo() !=
Ret &&
652 "Arg constraint should not refer to the return value");
653 ArgConstraints.push_back(VC);
657 InvalidationKind getInvalidationKd()
const {
return InvalidationKd; }
658 const SummaryCases &getCases()
const {
return Cases; }
659 const ConstraintSet &getArgConstraints()
const {
return ArgConstraints; }
661 QualType getArgType(ArgNo ArgN)
const {
662 return StdLibraryFunctionsChecker::getArgType(FD, ArgN);
667 bool matchesAndSet(
const Signature &Sign,
const FunctionDecl *FD) {
668 bool Result = Sign.matches(FD) && validateByConstraints(FD);
670 assert(!this->FD &&
"FD must not be set more than once");
679 bool validateByConstraints(
const FunctionDecl *FD)
const {
680 for (
const SummaryCase &Case : Cases)
681 for (
const ValueConstraintPtr &Constraint : Case.getConstraints())
682 if (!Constraint->checkValidity(FD))
684 for (
const ValueConstraintPtr &Constraint : ArgConstraints)
685 if (!Constraint->checkValidity(FD))
693 using FunctionSummaryMapType = llvm::DenseMap<const FunctionDecl *, Summary>;
694 mutable FunctionSummaryMapType FunctionSummaryMap;
696 mutable std::unique_ptr<BugType> BT_InvalidArg;
697 mutable bool SummariesInitialized =
false;
700 return ArgN ==
Ret ?
Call.getReturnValue() :
Call.getArgSVal(ArgN);
709 CK_StdCLibraryFunctionArgsChecker,
710 CK_StdCLibraryFunctionsTesterChecker,
713 bool ChecksEnabled[CK_NumCheckKinds] = {
false};
716 bool DisplayLoadedSummaries =
false;
717 bool ModelPOSIX =
false;
718 bool ShouldAssumeControlledEnvironment =
false;
729 const ValueConstraint *VC,
const Summary &Summary,
731 if (!ChecksEnabled[CK_StdCLibraryFunctionArgsChecker])
734 (Twine(
"Function argument constraint is not satisfied, constraint: ") +
735 VC->getName().data())
738 BT_InvalidArg = std::make_unique<BugType>(
739 CheckNames[CK_StdCLibraryFunctionArgsChecker],
741 auto R = std::make_unique<PathSensitiveBugReport>(*BT_InvalidArg, Msg, N);
743 for (ArgNo ArgN : VC->getArgsToTrack())
747 R->addRange(
Call.getArgSourceRange(VC->getArgNo()));
750 R->addNote(VC->describe(
C.getState(), Summary), R->getLocation(),
751 Call.getArgSourceRange(VC->getArgNo()));
753 C.emitReport(std::move(R));
761 const NoErrnoConstraint ErrnoIrrelevant;
762 const SuccessErrnoConstraint ErrnoMustNotBeChecked;
763 const ZeroRelatedErrnoConstraint ErrnoNEZeroIrrelevant{
767 int StdLibraryFunctionsChecker::ErrnoConstraintBase::Tag = 0;
784 Result += getArgDesc(ArgN);
785 Result +=
" should not be NULL";
786 return Result.c_str();
794 QualType T = Summary.getArgType(getArgNo());
797 Result += getArgDesc(ArgN);
798 Result +=
" should be ";
801 Kind == OutOfRange ? Result +=
"out of" : Result +=
"within";
804 Result +=
" the range ";
805 if (Ranges.size() > 1)
807 unsigned I = Ranges.size();
808 for (
const std::pair<RangeInt, RangeInt> &R : Ranges) {
812 Min.toString(Result);
814 Max.toString(Result);
819 if (Ranges.size() > 1)
822 return Result.c_str();
826 StdLibraryFunctionsChecker::getArgDesc(StdLibraryFunctionsChecker::ArgNo ArgN) {
828 Result += std::to_string(ArgN + 1);
829 Result += llvm::getOrdinalSuffix(ArgN + 1);
837 Result +=
"The size of the ";
838 Result += getArgDesc(ArgN);
839 Result +=
" should be equal to or less than the value of ";
841 ConcreteSize->toString(Result);
842 }
else if (SizeArgN) {
844 Result += getArgDesc(*SizeArgN);
845 if (SizeMultiplierArgN) {
846 Result +=
" times the ";
847 Result += getArgDesc(*SizeMultiplierArgN);
850 return Result.c_str();
853 ProgramStateRef StdLibraryFunctionsChecker::RangeConstraint::applyAsOutOfRange(
855 const Summary &Summary)
const {
863 QualType T = Summary.getArgType(getArgNo());
864 SVal V = getArgSVal(Call, getArgNo());
866 if (
auto N =
V.getAs<
NonLoc>()) {
867 const IntRangeVector &R = getRanges();
869 for (
size_t I = 0; I != E; ++I) {
882 ProgramStateRef StdLibraryFunctionsChecker::RangeConstraint::applyAsWithinRange(
884 const Summary &Summary)
const {
892 QualType T = Summary.getArgType(getArgNo());
893 SVal V = getArgSVal(Call, getArgNo());
904 if (
auto N =
V.getAs<
NonLoc>()) {
905 const IntRangeVector &R = getRanges();
911 const llvm::APSInt &Left = BVF.getValue(R[0].first - 1ULL, T);
912 if (Left != PlusInf) {
913 assert(MinusInf <= Left);
919 const llvm::APSInt &Right = BVF.getValue(R[E - 1].second + 1ULL, T);
920 if (Right != MinusInf) {
921 assert(Right <= PlusInf);
927 for (
size_t I = 1; I != E; ++I) {
928 const llvm::APSInt &Min = BVF.getValue(R[I - 1].second + 1ULL, T);
929 const llvm::APSInt &Max = BVF.getValue(R[I].first - 1ULL, T);
941 ProgramStateRef StdLibraryFunctionsChecker::ComparisonConstraint::apply(
948 QualType T = Summary.getArgType(getArgNo());
949 SVal V = getArgSVal(Call, getArgNo());
952 ArgNo OtherArg = getOtherArgNo();
953 SVal OtherV = getArgSVal(Call, OtherArg);
954 QualType OtherT = Summary.getArgType(OtherArg);
956 OtherV = SVB.
evalCast(OtherV, T, OtherT);
963 void StdLibraryFunctionsChecker::checkPreCall(
const CallEvent &Call,
969 const Summary &Summary = *FoundSummary;
973 for (
const ValueConstraintPtr &Constraint : Summary.getArgConstraints()) {
974 ProgramStateRef SuccessSt = Constraint->apply(NewState, Call, Summary, C);
976 Constraint->negate()->apply(NewState, Call, Summary, C);
978 if (FailureSt && !SuccessSt) {
980 reportBug(Call, N, Constraint.get(), Summary, C);
988 NewState = SuccessSt;
991 if (NewState && NewState !=
State)
992 C.addTransition(NewState);
995 void StdLibraryFunctionsChecker::checkPostCall(
const CallEvent &Call,
1002 const Summary &Summary = *FoundSummary;
1007 for (
const SummaryCase &Case : Summary.getCases()) {
1009 for (
const ValueConstraintPtr &Constraint : Case.getConstraints()) {
1010 NewState = Constraint->apply(NewState, Call, Summary, C);
1016 NewState = Case.getErrnoConstraint().apply(NewState, Call, Summary, C);
1018 if (NewState && NewState !=
State) {
1019 if (Case.getNote().empty()) {
1021 if (
const auto *D = dyn_cast_or_null<FunctionDecl>(
Call.getDecl()))
1022 Note = Case.getErrnoConstraint().describe(D->getNameAsString());
1024 C.addTransition(NewState);
1028 StringRef
Note = Case.getNote();
1034 return (
Node->succ_size() > 1) ?
Note.str() :
"";
1037 C.addTransition(NewState, Tag);
1043 bool StdLibraryFunctionsChecker::evalCall(
const CallEvent &Call,
1049 const Summary &Summary = *FoundSummary;
1050 switch (Summary.getInvalidationKd()) {
1051 case EvalCallAsPure: {
1054 const auto *CE = cast<CallExpr>(
Call.getOriginExpr());
1055 SVal V =
C.getSValBuilder().conjureSymbolVal(
1056 CE, LC, CE->getType().getCanonicalType(),
C.blockCount());
1068 llvm_unreachable(
"Unknown invalidation kind!");
1085 auto RemoveRestrict = [&FD](
QualType T) {
1092 if (!isIrrelevant(RetTy)) {
1094 if (RetTy != FDRetTy)
1099 for (
size_t I = 0, E = ArgTys.size(); I != E; ++I) {
1101 if (isIrrelevant(ArgTy))
1105 if (ArgTy != FDArgTy)
1113 StdLibraryFunctionsChecker::findFunctionSummary(
const FunctionDecl *FD,
1118 initFunctionSummaries(C);
1121 if (FSMI == FunctionSummaryMap.end())
1123 return FSMI->second;
1127 StdLibraryFunctionsChecker::findFunctionSummary(
const CallEvent &Call,
1132 return findFunctionSummary(FD, C);
1135 void StdLibraryFunctionsChecker::initFunctionSummaries(
1137 if (SummariesInitialized)
1149 LookupType(
const ASTContext &ACtx) : ACtx(ACtx) {}
1155 if (LookupRes.empty())
1163 for (
Decl *D : LookupRes)
1164 if (
auto *TD = dyn_cast<TypedefNameDecl>(D))
1171 for (
Decl *D : LookupRes)
1172 if (
auto *TD = dyn_cast<TypeDecl>(D))
1180 class GetRestrictTy {
1184 GetRestrictTy(
const ASTContext &ACtx) : ACtx(ACtx) {}
1190 return operator()(*Ty);
1193 } getRestrictTy(ACtx);
1194 class GetPointerTy {
1198 GetPointerTy(
const ASTContext &ACtx) : ACtx(ACtx) {}
1202 return operator()(*Ty);
1205 } getPointerTy(ACtx);
1223 return operator()(*Ty);
1244 const QualType VoidPtrTy = getPointerTy(VoidTy);
1245 const QualType IntPtrTy = getPointerTy(IntTy);
1247 getPointerTy(UnsignedIntTy);
1248 const QualType VoidPtrRestrictTy = getRestrictTy(VoidPtrTy);
1250 getPointerTy(getConstTy(VoidTy));
1251 const QualType CharPtrTy = getPointerTy(CharTy);
1252 const QualType CharPtrRestrictTy = getRestrictTy(CharPtrTy);
1254 getPointerTy(getConstTy(CharTy));
1255 const QualType ConstCharPtrRestrictTy = getRestrictTy(ConstCharPtrTy);
1256 const QualType Wchar_tPtrTy = getPointerTy(WCharTy);
1258 getPointerTy(getConstTy(WCharTy));
1259 const QualType ConstVoidPtrRestrictTy = getRestrictTy(ConstVoidPtrTy);
1260 const QualType SizePtrTy = getPointerTy(SizeTy);
1261 const QualType SizePtrRestrictTy = getRestrictTy(SizePtrTy);
1263 const RangeInt IntMax = BVF.
getMaxValue(IntTy).getLimitedValue();
1264 const RangeInt UnsignedIntMax =
1266 const RangeInt LongMax = BVF.
getMaxValue(LongTy).getLimitedValue();
1267 const RangeInt SizeMax = BVF.
getMaxValue(SizeTy).getLimitedValue();
1275 const RangeInt UCharRangeMax =
1280 const auto EOFv = [&
C]() -> RangeInt {
1288 struct AddToFunctionSummaryMap {
1290 FunctionSummaryMapType ⤅
1291 bool DisplayLoadedSummaries;
1292 AddToFunctionSummaryMap(
const ASTContext &ACtx, FunctionSummaryMapType &FSM,
1293 bool DisplayLoadedSummaries)
1294 : ACtx(ACtx), Map(FSM), DisplayLoadedSummaries(DisplayLoadedSummaries) {
1302 bool operator()(StringRef Name, Signature Sign, Summary Sum) {
1303 if (Sign.isInvalid())
1307 if (LookupRes.empty())
1309 for (
Decl *D : LookupRes) {
1310 if (
auto *FD = dyn_cast<FunctionDecl>(D)) {
1311 if (Sum.matchesAndSet(Sign, FD)) {
1313 assert(Res.second &&
"Function already has a summary set!");
1315 if (DisplayLoadedSummaries) {
1316 llvm::errs() <<
"Loaded summary for: ";
1317 FD->
print(llvm::errs());
1318 llvm::errs() <<
"\n";
1328 void operator()(std::vector<StringRef> Names, Signature Sign, Summary Sum) {
1329 for (StringRef Name : Names)
1330 operator()(Name, Sign, Sum);
1332 } addToFunctionSummaryMap(ACtx, FunctionSummaryMap, DisplayLoadedSummaries);
1335 auto ArgumentCondition = [](ArgNo ArgN, RangeKind
Kind,
1336 IntRangeVector Ranges) {
1337 return std::make_shared<RangeConstraint>(ArgN,
Kind, Ranges);
1339 auto BufferSize = [](
auto... Args) {
1340 return std::make_shared<BufferSizeConstraint>(Args...);
1343 auto operator()(RangeKind
Kind, IntRangeVector Ranges) {
1344 return std::make_shared<RangeConstraint>(
Ret,
Kind, Ranges);
1347 return std::make_shared<ComparisonConstraint>(
Ret, Op, OtherArgN);
1349 } ReturnValueCondition;
1351 auto operator()(RangeInt
b, RangeInt e) {
1352 return IntRangeVector{std::pair<RangeInt, RangeInt>{
b, e}};
1356 return IntRangeVector{std::pair<RangeInt, RangeInt>{
b, *e}};
1357 return IntRangeVector{};
1359 auto operator()(std::pair<RangeInt, RangeInt> i0,
1362 return IntRangeVector{i0, {i1.first, *(i1.second)}};
1363 return IntRangeVector{i0};
1366 auto SingleValue = [](RangeInt
v) {
1367 return IntRangeVector{std::pair<RangeInt, RangeInt>{
v,
v}};
1369 auto LessThanOrEq = BO_LE;
1370 auto NotNull = [&](ArgNo ArgN) {
1371 return std::make_shared<NotNullConstraint>(ArgN);
1393 addToFunctionSummaryMap(
1394 "isalnum", Signature(ArgTypes{IntTy}, RetType{IntTy}),
1395 Summary(EvalCallAsPure)
1397 .Case({ArgumentCondition(0
U, WithinRange,
1398 {{
'0',
'9'}, {
'A',
'Z'}, {
'a',
'z'}}),
1399 ReturnValueCondition(OutOfRange, SingleValue(0))},
1400 ErrnoIrrelevant,
"Assuming the character is alphanumeric")
1404 .Case({ArgumentCondition(0
U, WithinRange, {{128, UCharRangeMax}})},
1409 {{
'0',
'9'}, {
'A',
'Z'}, {
'a',
'z'}, {128, UCharRangeMax}}),
1410 ReturnValueCondition(WithinRange, SingleValue(0))},
1411 ErrnoIrrelevant,
"Assuming the character is non-alphanumeric")
1412 .ArgConstraint(ArgumentCondition(
1413 0
U, WithinRange, {{EOFv, EOFv}, {0, UCharRangeMax}})));
1414 addToFunctionSummaryMap(
1415 "isalpha", Signature(ArgTypes{IntTy}, RetType{IntTy}),
1416 Summary(EvalCallAsPure)
1417 .Case({ArgumentCondition(0
U, WithinRange, {{
'A',
'Z'}, {
'a',
'z'}}),
1418 ReturnValueCondition(OutOfRange, SingleValue(0))},
1419 ErrnoIrrelevant,
"Assuming the character is alphabetical")
1421 .Case({ArgumentCondition(0
U, WithinRange, {{128, UCharRangeMax}})},
1423 .Case({ArgumentCondition(
1425 {{
'A',
'Z'}, {
'a',
'z'}, {128, UCharRangeMax}}),
1426 ReturnValueCondition(WithinRange, SingleValue(0))},
1427 ErrnoIrrelevant,
"Assuming the character is non-alphabetical"));
1428 addToFunctionSummaryMap(
1429 "isascii", Signature(ArgTypes{IntTy}, RetType{IntTy}),
1430 Summary(EvalCallAsPure)
1431 .Case({ArgumentCondition(0
U, WithinRange,
Range(0, 127)),
1432 ReturnValueCondition(OutOfRange, SingleValue(0))},
1433 ErrnoIrrelevant,
"Assuming the character is an ASCII character")
1434 .Case({ArgumentCondition(0
U, OutOfRange,
Range(0, 127)),
1435 ReturnValueCondition(WithinRange, SingleValue(0))},
1437 "Assuming the character is not an ASCII character"));
1438 addToFunctionSummaryMap(
1439 "isblank", Signature(ArgTypes{IntTy}, RetType{IntTy}),
1440 Summary(EvalCallAsPure)
1441 .Case({ArgumentCondition(0
U, WithinRange, {{
'\t',
'\t'}, {
' ',
' '}}),
1442 ReturnValueCondition(OutOfRange, SingleValue(0))},
1443 ErrnoIrrelevant,
"Assuming the character is a blank character")
1444 .Case({ArgumentCondition(0
U, OutOfRange, {{
'\t',
'\t'}, {
' ',
' '}}),
1445 ReturnValueCondition(WithinRange, SingleValue(0))},
1447 "Assuming the character is not a blank character"));
1448 addToFunctionSummaryMap(
1449 "iscntrl", Signature(ArgTypes{IntTy}, RetType{IntTy}),
1450 Summary(EvalCallAsPure)
1451 .Case({ArgumentCondition(0
U, WithinRange, {{0, 32}, {127, 127}}),
1452 ReturnValueCondition(OutOfRange, SingleValue(0))},
1454 "Assuming the character is a control character")
1455 .Case({ArgumentCondition(0
U, OutOfRange, {{0, 32}, {127, 127}}),
1456 ReturnValueCondition(WithinRange, SingleValue(0))},
1458 "Assuming the character is not a control character"));
1459 addToFunctionSummaryMap(
1460 "isdigit", Signature(ArgTypes{IntTy}, RetType{IntTy}),
1461 Summary(EvalCallAsPure)
1462 .Case({ArgumentCondition(0
U, WithinRange,
Range(
'0',
'9')),
1463 ReturnValueCondition(OutOfRange, SingleValue(0))},
1464 ErrnoIrrelevant,
"Assuming the character is a digit")
1465 .Case({ArgumentCondition(0
U, OutOfRange,
Range(
'0',
'9')),
1466 ReturnValueCondition(WithinRange, SingleValue(0))},
1467 ErrnoIrrelevant,
"Assuming the character is not a digit"));
1468 addToFunctionSummaryMap(
1469 "isgraph", Signature(ArgTypes{IntTy}, RetType{IntTy}),
1470 Summary(EvalCallAsPure)
1471 .Case({ArgumentCondition(0
U, WithinRange,
Range(33, 126)),
1472 ReturnValueCondition(OutOfRange, SingleValue(0))},
1474 "Assuming the character has graphical representation")
1476 {ArgumentCondition(0
U, OutOfRange,
Range(33, 126)),
1477 ReturnValueCondition(WithinRange, SingleValue(0))},
1479 "Assuming the character does not have graphical representation"));
1480 addToFunctionSummaryMap(
1481 "islower", Signature(ArgTypes{IntTy}, RetType{IntTy}),
1482 Summary(EvalCallAsPure)
1484 .Case({ArgumentCondition(0
U, WithinRange,
Range(
'a',
'z')),
1485 ReturnValueCondition(OutOfRange, SingleValue(0))},
1486 ErrnoIrrelevant,
"Assuming the character is a lowercase letter")
1488 .Case({ArgumentCondition(0
U, WithinRange,
Range(0, 127)),
1489 ArgumentCondition(0
U, OutOfRange,
Range(
'a',
'z')),
1490 ReturnValueCondition(WithinRange, SingleValue(0))},
1492 "Assuming the character is not a lowercase letter")
1494 .Case({ArgumentCondition(0
U, WithinRange, {{128, UCharRangeMax}})},
1497 .Case({ArgumentCondition(0
U, OutOfRange,
Range(0, UCharRangeMax)),
1498 ReturnValueCondition(WithinRange, SingleValue(0))},
1500 addToFunctionSummaryMap(
1501 "isprint", Signature(ArgTypes{IntTy}, RetType{IntTy}),
1502 Summary(EvalCallAsPure)
1503 .Case({ArgumentCondition(0
U, WithinRange,
Range(32, 126)),
1504 ReturnValueCondition(OutOfRange, SingleValue(0))},
1505 ErrnoIrrelevant,
"Assuming the character is printable")
1506 .Case({ArgumentCondition(0
U, OutOfRange,
Range(32, 126)),
1507 ReturnValueCondition(WithinRange, SingleValue(0))},
1508 ErrnoIrrelevant,
"Assuming the character is non-printable"));
1509 addToFunctionSummaryMap(
1510 "ispunct", Signature(ArgTypes{IntTy}, RetType{IntTy}),
1511 Summary(EvalCallAsPure)
1512 .Case({ArgumentCondition(
1514 {{
'!',
'/'}, {
':',
'@'}, {
'[',
'`'}, {
'{',
'~'}}),
1515 ReturnValueCondition(OutOfRange, SingleValue(0))},
1516 ErrnoIrrelevant,
"Assuming the character is a punctuation mark")
1517 .Case({ArgumentCondition(
1519 {{
'!',
'/'}, {
':',
'@'}, {
'[',
'`'}, {
'{',
'~'}}),
1520 ReturnValueCondition(WithinRange, SingleValue(0))},
1522 "Assuming the character is not a punctuation mark"));
1523 addToFunctionSummaryMap(
1524 "isspace", Signature(ArgTypes{IntTy}, RetType{IntTy}),
1525 Summary(EvalCallAsPure)
1527 .Case({ArgumentCondition(0
U, WithinRange, {{9, 13}, {
' ',
' '}}),
1528 ReturnValueCondition(OutOfRange, SingleValue(0))},
1530 "Assuming the character is a whitespace character")
1532 .Case({ArgumentCondition(0
U, WithinRange, {{128, UCharRangeMax}})},
1534 .Case({ArgumentCondition(0
U, OutOfRange,
1535 {{9, 13}, {
' ',
' '}, {128, UCharRangeMax}}),
1536 ReturnValueCondition(WithinRange, SingleValue(0))},
1538 "Assuming the character is not a whitespace character"));
1539 addToFunctionSummaryMap(
1540 "isupper", Signature(ArgTypes{IntTy}, RetType{IntTy}),
1541 Summary(EvalCallAsPure)
1543 .Case({ArgumentCondition(0
U, WithinRange,
Range(
'A',
'Z')),
1544 ReturnValueCondition(OutOfRange, SingleValue(0))},
1546 "Assuming the character is an uppercase letter")
1548 .Case({ArgumentCondition(0
U, WithinRange, {{128, UCharRangeMax}})},
1551 .Case({ArgumentCondition(0
U, OutOfRange,
1552 {{
'A',
'Z'}, {128, UCharRangeMax}}),
1553 ReturnValueCondition(WithinRange, SingleValue(0))},
1555 "Assuming the character is not an uppercase letter"));
1556 addToFunctionSummaryMap(
1557 "isxdigit", Signature(ArgTypes{IntTy}, RetType{IntTy}),
1558 Summary(EvalCallAsPure)
1559 .Case({ArgumentCondition(0
U, WithinRange,
1560 {{
'0',
'9'}, {
'A',
'F'}, {
'a',
'f'}}),
1561 ReturnValueCondition(OutOfRange, SingleValue(0))},
1563 "Assuming the character is a hexadecimal digit")
1564 .Case({ArgumentCondition(0
U, OutOfRange,
1565 {{
'0',
'9'}, {
'A',
'F'}, {
'a',
'f'}}),
1566 ReturnValueCondition(WithinRange, SingleValue(0))},
1568 "Assuming the character is not a hexadecimal digit"));
1569 addToFunctionSummaryMap(
1570 "toupper", Signature(ArgTypes{IntTy}, RetType{IntTy}),
1571 Summary(EvalCallAsPure)
1572 .ArgConstraint(ArgumentCondition(
1573 0
U, WithinRange, {{EOFv, EOFv}, {0, UCharRangeMax}})));
1574 addToFunctionSummaryMap(
1575 "tolower", Signature(ArgTypes{IntTy}, RetType{IntTy}),
1576 Summary(EvalCallAsPure)
1577 .ArgConstraint(ArgumentCondition(
1578 0
U, WithinRange, {{EOFv, EOFv}, {0, UCharRangeMax}})));
1579 addToFunctionSummaryMap(
1580 "toascii", Signature(ArgTypes{IntTy}, RetType{IntTy}),
1581 Summary(EvalCallAsPure)
1582 .ArgConstraint(ArgumentCondition(
1583 0
U, WithinRange, {{EOFv, EOFv}, {0, UCharRangeMax}})));
1586 addToFunctionSummaryMap(
1587 {
"getc",
"fgetc"}, Signature(ArgTypes{FilePtrTy}, RetType{IntTy}),
1589 .Case({ReturnValueCondition(WithinRange,
1590 {{EOFv, EOFv}, {0, UCharRangeMax}})},
1592 addToFunctionSummaryMap(
1593 "getchar", Signature(ArgTypes{}, RetType{IntTy}),
1595 .Case({ReturnValueCondition(WithinRange,
1596 {{EOFv, EOFv}, {0, UCharRangeMax}})},
1602 .Case({ReturnValueCondition(LessThanOrEq, ArgNo(2)),
1603 ReturnValueCondition(WithinRange,
Range(0, SizeMax))},
1605 .ArgConstraint(NotNull(ArgNo(0)))
1606 .ArgConstraint(NotNull(ArgNo(3)))
1607 .ArgConstraint(BufferSize(ArgNo(0), ArgNo(1),
1612 addToFunctionSummaryMap(
1614 Signature(ArgTypes{VoidPtrRestrictTy, SizeTy, SizeTy, FilePtrRestrictTy},
1619 addToFunctionSummaryMap(
"fwrite",
1620 Signature(ArgTypes{ConstVoidPtrRestrictTy, SizeTy,
1621 SizeTy, FilePtrRestrictTy},
1630 .Case({ReturnValueCondition(LessThanOrEq, ArgNo(2)),
1631 ReturnValueCondition(WithinRange,
Range(-1, Ssize_tMax))},
1637 addToFunctionSummaryMap(
1638 "read", Signature(ArgTypes{IntTy, VoidPtrTy, SizeTy}, RetType{Ssize_tTy}),
1641 addToFunctionSummaryMap(
1643 Signature(ArgTypes{IntTy, ConstVoidPtrTy, SizeTy}, RetType{Ssize_tTy}),
1646 auto GetLineSummary =
1648 .Case({ReturnValueCondition(WithinRange,
1649 Range({-1, -1}, {1, Ssize_tMax}))},
1652 QualType CharPtrPtrRestrictTy = getRestrictTy(getPointerTy(CharPtrTy));
1659 addToFunctionSummaryMap(
1662 ArgTypes{CharPtrPtrRestrictTy, SizePtrRestrictTy, FilePtrRestrictTy},
1663 RetType{Ssize_tTy}),
1667 addToFunctionSummaryMap(
1669 Signature(ArgTypes{CharPtrPtrRestrictTy, SizePtrRestrictTy, IntTy,
1671 RetType{Ssize_tTy}),
1675 Summary GetenvSummary =
1677 .ArgConstraint(NotNull(ArgNo(0)))
1678 .Case({NotNull(
Ret)}, ErrnoIrrelevant,
1679 "Assuming the environment variable exists");
1681 if (!ShouldAssumeControlledEnvironment)
1682 GetenvSummary.Case({NotNull(
Ret)->negate()}, ErrnoIrrelevant,
1683 "Assuming the environment variable does not exist");
1686 addToFunctionSummaryMap(
1687 "getenv", Signature(ArgTypes{ConstCharPtrTy}, RetType{CharPtrTy}),
1688 std::move(GetenvSummary));
1694 addToFunctionSummaryMap(
1695 "a64l", Signature(ArgTypes{ConstCharPtrTy}, RetType{LongTy}),
1696 Summary(NoEvalCall).ArgConstraint(NotNull(ArgNo(0))));
1699 addToFunctionSummaryMap(
"l64a",
1700 Signature(ArgTypes{LongTy}, RetType{CharPtrTy}),
1702 .ArgConstraint(ArgumentCondition(
1703 0, WithinRange,
Range(0, LongMax))));
1705 const auto ReturnsZeroOrMinusOne =
1706 ConstraintSet{ReturnValueCondition(WithinRange,
Range(-1, 0))};
1707 const auto ReturnsZero =
1708 ConstraintSet{ReturnValueCondition(WithinRange, SingleValue(0))};
1709 const auto ReturnsMinusOne =
1710 ConstraintSet{ReturnValueCondition(WithinRange, SingleValue(-1))};
1711 const auto ReturnsNonnegative =
1712 ConstraintSet{ReturnValueCondition(WithinRange,
Range(0, IntMax))};
1713 const auto ReturnsFileDescriptor =
1714 ConstraintSet{ReturnValueCondition(WithinRange,
Range(-1, IntMax))};
1715 const auto &ReturnsValidFileDescriptor = ReturnsNonnegative;
1718 addToFunctionSummaryMap(
1719 "access", Signature(ArgTypes{ConstCharPtrTy, IntTy}, RetType{IntTy}),
1721 .Case(ReturnsZero, ErrnoMustNotBeChecked)
1722 .Case(ReturnsMinusOne, ErrnoNEZeroIrrelevant)
1723 .ArgConstraint(NotNull(ArgNo(0))));
1726 addToFunctionSummaryMap(
1728 Signature(ArgTypes{IntTy, ConstCharPtrTy, IntTy, IntTy},
1731 .Case(ReturnsZero, ErrnoMustNotBeChecked)
1732 .Case(ReturnsMinusOne, ErrnoNEZeroIrrelevant)
1733 .ArgConstraint(NotNull(ArgNo(1))));
1736 addToFunctionSummaryMap(
1737 "dup", Signature(ArgTypes{IntTy}, RetType{IntTy}),
1739 .Case(ReturnsValidFileDescriptor, ErrnoMustNotBeChecked)
1740 .Case(ReturnsMinusOne, ErrnoNEZeroIrrelevant)
1742 ArgumentCondition(0, WithinRange,
Range(0, IntMax))));
1745 addToFunctionSummaryMap(
1746 "dup2", Signature(ArgTypes{IntTy, IntTy}, RetType{IntTy}),
1748 .Case(ReturnsValidFileDescriptor, ErrnoMustNotBeChecked)
1749 .Case(ReturnsMinusOne, ErrnoNEZeroIrrelevant)
1750 .ArgConstraint(ArgumentCondition(0, WithinRange,
Range(0, IntMax)))
1752 ArgumentCondition(1, WithinRange,
Range(0, IntMax))));
1755 addToFunctionSummaryMap(
"fdatasync",
1756 Signature(ArgTypes{IntTy}, RetType{IntTy}),
1758 .Case(ReturnsZero, ErrnoMustNotBeChecked)
1759 .Case(ReturnsMinusOne, ErrnoNEZeroIrrelevant)
1760 .ArgConstraint(ArgumentCondition(
1761 0, WithinRange,
Range(0, IntMax))));
1764 addToFunctionSummaryMap(
1766 Signature(ArgTypes{ConstCharPtrTy, ConstCharPtrTy, IntTy},
1769 .ArgConstraint(NotNull(ArgNo(0)))
1770 .ArgConstraint(NotNull(ArgNo(1))));
1773 addToFunctionSummaryMap(
"fsync", Signature(ArgTypes{IntTy}, RetType{IntTy}),
1775 .Case(ReturnsZero, ErrnoMustNotBeChecked)
1776 .Case(ReturnsMinusOne, ErrnoNEZeroIrrelevant)
1777 .ArgConstraint(ArgumentCondition(
1778 0, WithinRange,
Range(0, IntMax))));
1783 addToFunctionSummaryMap(
1785 Signature(ArgTypes{ConstCharPtrTy, Off_tTy}, RetType{IntTy}),
1787 .Case(ReturnsZero, ErrnoMustNotBeChecked)
1788 .Case(ReturnsMinusOne, ErrnoNEZeroIrrelevant)
1789 .ArgConstraint(NotNull(ArgNo(0))));
1792 addToFunctionSummaryMap(
1794 Signature(ArgTypes{ConstCharPtrTy, ConstCharPtrTy}, RetType{IntTy}),
1796 .Case(ReturnsZero, ErrnoMustNotBeChecked)
1797 .Case(ReturnsMinusOne, ErrnoNEZeroIrrelevant)
1798 .ArgConstraint(NotNull(ArgNo(0)))
1799 .ArgConstraint(NotNull(ArgNo(1))));
1802 addToFunctionSummaryMap(
1804 Signature(ArgTypes{ConstCharPtrTy, IntTy, ConstCharPtrTy},
1807 .Case(ReturnsZero, ErrnoMustNotBeChecked)
1808 .Case(ReturnsMinusOne, ErrnoNEZeroIrrelevant)
1809 .ArgConstraint(NotNull(ArgNo(0)))
1810 .ArgConstraint(ArgumentCondition(1, WithinRange,
Range(0, IntMax)))
1811 .ArgConstraint(NotNull(ArgNo(2))));
1814 addToFunctionSummaryMap(
1815 "lockf", Signature(ArgTypes{IntTy, IntTy, Off_tTy}, RetType{IntTy}),
1817 .Case(ReturnsZero, ErrnoMustNotBeChecked)
1818 .Case(ReturnsMinusOne, ErrnoNEZeroIrrelevant)
1820 ArgumentCondition(0, WithinRange,
Range(0, IntMax))));
1825 addToFunctionSummaryMap(
1826 "creat", Signature(ArgTypes{ConstCharPtrTy, Mode_tTy}, RetType{IntTy}),
1828 .Case(ReturnsValidFileDescriptor, ErrnoMustNotBeChecked)
1829 .Case(ReturnsMinusOne, ErrnoNEZeroIrrelevant)
1830 .ArgConstraint(NotNull(ArgNo(0))));
1833 addToFunctionSummaryMap(
1834 "sleep", Signature(ArgTypes{UnsignedIntTy}, RetType{UnsignedIntTy}),
1837 ArgumentCondition(0, WithinRange,
Range(0, UnsignedIntMax))));
1843 addToFunctionSummaryMap(
1844 "dirfd", Signature(ArgTypes{DirPtrTy}, RetType{IntTy}),
1846 .Case(ReturnsValidFileDescriptor, ErrnoMustNotBeChecked)
1847 .Case(ReturnsMinusOne, ErrnoNEZeroIrrelevant)
1848 .ArgConstraint(NotNull(ArgNo(0))));
1851 addToFunctionSummaryMap(
1852 "alarm", Signature(ArgTypes{UnsignedIntTy}, RetType{UnsignedIntTy}),
1855 ArgumentCondition(0, WithinRange,
Range(0, UnsignedIntMax))));
1858 addToFunctionSummaryMap(
"closedir",
1859 Signature(ArgTypes{DirPtrTy}, RetType{IntTy}),
1861 .Case(ReturnsZero, ErrnoMustNotBeChecked)
1862 .Case(ReturnsMinusOne, ErrnoNEZeroIrrelevant)
1863 .ArgConstraint(NotNull(ArgNo(0))));
1866 addToFunctionSummaryMap(
1867 "strdup", Signature(ArgTypes{ConstCharPtrTy}, RetType{CharPtrTy}),
1868 Summary(NoEvalCall).ArgConstraint(NotNull(ArgNo(0))));
1871 addToFunctionSummaryMap(
1873 Signature(ArgTypes{ConstCharPtrTy, SizeTy}, RetType{CharPtrTy}),
1875 .ArgConstraint(NotNull(ArgNo(0)))
1877 ArgumentCondition(1, WithinRange,
Range(0, SizeMax))));
1880 addToFunctionSummaryMap(
1881 "wcsdup", Signature(ArgTypes{ConstWchar_tPtrTy}, RetType{Wchar_tPtrTy}),
1882 Summary(NoEvalCall).ArgConstraint(NotNull(ArgNo(0))));
1885 addToFunctionSummaryMap(
1886 "mkstemp", Signature(ArgTypes{CharPtrTy}, RetType{IntTy}),
1888 .Case(ReturnsValidFileDescriptor, ErrnoMustNotBeChecked)
1889 .Case(ReturnsMinusOne, ErrnoNEZeroIrrelevant)
1890 .ArgConstraint(NotNull(ArgNo(0))));
1894 addToFunctionSummaryMap(
1895 "mkdtemp", Signature(ArgTypes{CharPtrTy}, RetType{CharPtrTy}),
1896 Summary(NoEvalCall).ArgConstraint(NotNull(ArgNo(0))));
1900 addToFunctionSummaryMap(
1901 "getcwd", Signature(ArgTypes{CharPtrTy, SizeTy}, RetType{CharPtrTy}),
1904 ArgumentCondition(1, WithinRange,
Range(0, SizeMax))));
1907 addToFunctionSummaryMap(
1908 "mkdir", Signature(ArgTypes{ConstCharPtrTy, Mode_tTy}, RetType{IntTy}),
1910 .Case(ReturnsZero, ErrnoMustNotBeChecked)
1911 .Case(ReturnsMinusOne, ErrnoNEZeroIrrelevant)
1912 .ArgConstraint(NotNull(ArgNo(0))));
1915 addToFunctionSummaryMap(
1917 Signature(ArgTypes{IntTy, ConstCharPtrTy, Mode_tTy}, RetType{IntTy}),
1919 .Case(ReturnsZero, ErrnoMustNotBeChecked)
1920 .Case(ReturnsMinusOne, ErrnoNEZeroIrrelevant)
1921 .ArgConstraint(NotNull(ArgNo(1))));
1926 addToFunctionSummaryMap(
1928 Signature(ArgTypes{ConstCharPtrTy, Mode_tTy, Dev_tTy}, RetType{IntTy}),
1930 .Case(ReturnsZero, ErrnoMustNotBeChecked)
1931 .Case(ReturnsMinusOne, ErrnoNEZeroIrrelevant)
1932 .ArgConstraint(NotNull(ArgNo(0))));
1935 addToFunctionSummaryMap(
1937 Signature(ArgTypes{IntTy, ConstCharPtrTy, Mode_tTy, Dev_tTy},
1940 .Case(ReturnsZero, ErrnoMustNotBeChecked)
1941 .Case(ReturnsMinusOne, ErrnoNEZeroIrrelevant)
1942 .ArgConstraint(NotNull(ArgNo(1))));
1945 addToFunctionSummaryMap(
1946 "chmod", Signature(ArgTypes{ConstCharPtrTy, Mode_tTy}, RetType{IntTy}),
1948 .Case(ReturnsZero, ErrnoMustNotBeChecked)
1949 .Case(ReturnsMinusOne, ErrnoNEZeroIrrelevant)
1950 .ArgConstraint(NotNull(ArgNo(0))));
1953 addToFunctionSummaryMap(
1955 Signature(ArgTypes{IntTy, ConstCharPtrTy, Mode_tTy, IntTy},
1958 .Case(ReturnsZero, ErrnoMustNotBeChecked)
1959 .Case(ReturnsMinusOne, ErrnoNEZeroIrrelevant)
1960 .ArgConstraint(ArgumentCondition(0, WithinRange,
Range(0, IntMax)))
1961 .ArgConstraint(NotNull(ArgNo(1))));
1964 addToFunctionSummaryMap(
1965 "fchmod", Signature(ArgTypes{IntTy, Mode_tTy}, RetType{IntTy}),
1967 .Case(ReturnsZero, ErrnoMustNotBeChecked)
1968 .Case(ReturnsMinusOne, ErrnoNEZeroIrrelevant)
1970 ArgumentCondition(0, WithinRange,
Range(0, IntMax))));
1977 addToFunctionSummaryMap(
1979 Signature(ArgTypes{IntTy, ConstCharPtrTy, Uid_tTy, Gid_tTy, IntTy},
1982 .Case(ReturnsZero, ErrnoMustNotBeChecked)
1983 .Case(ReturnsMinusOne, ErrnoNEZeroIrrelevant)
1984 .ArgConstraint(ArgumentCondition(0, WithinRange,
Range(0, IntMax)))
1985 .ArgConstraint(NotNull(ArgNo(1))));
1988 addToFunctionSummaryMap(
1990 Signature(ArgTypes{ConstCharPtrTy, Uid_tTy, Gid_tTy}, RetType{IntTy}),
1992 .Case(ReturnsZero, ErrnoMustNotBeChecked)
1993 .Case(ReturnsMinusOne, ErrnoNEZeroIrrelevant)
1994 .ArgConstraint(NotNull(ArgNo(0))));
1997 addToFunctionSummaryMap(
1999 Signature(ArgTypes{ConstCharPtrTy, Uid_tTy, Gid_tTy}, RetType{IntTy}),
2001 .Case(ReturnsZero, ErrnoMustNotBeChecked)
2002 .Case(ReturnsMinusOne, ErrnoNEZeroIrrelevant)
2003 .ArgConstraint(NotNull(ArgNo(0))));
2006 addToFunctionSummaryMap(
2007 "fchown", Signature(ArgTypes{IntTy, Uid_tTy, Gid_tTy}, RetType{IntTy}),
2009 .Case(ReturnsZero, ErrnoMustNotBeChecked)
2010 .Case(ReturnsMinusOne, ErrnoNEZeroIrrelevant)
2012 ArgumentCondition(0, WithinRange,
Range(0, IntMax))));
2015 addToFunctionSummaryMap(
"rmdir",
2016 Signature(ArgTypes{ConstCharPtrTy}, RetType{IntTy}),
2018 .Case(ReturnsZero, ErrnoMustNotBeChecked)
2019 .Case(ReturnsMinusOne, ErrnoNEZeroIrrelevant)
2020 .ArgConstraint(NotNull(ArgNo(0))));
2023 addToFunctionSummaryMap(
"chdir",
2024 Signature(ArgTypes{ConstCharPtrTy}, RetType{IntTy}),
2026 .Case(ReturnsZero, ErrnoMustNotBeChecked)
2027 .Case(ReturnsMinusOne, ErrnoNEZeroIrrelevant)
2028 .ArgConstraint(NotNull(ArgNo(0))));
2031 addToFunctionSummaryMap(
2033 Signature(ArgTypes{ConstCharPtrTy, ConstCharPtrTy}, RetType{IntTy}),
2035 .Case(ReturnsZero, ErrnoMustNotBeChecked)
2036 .Case(ReturnsMinusOne, ErrnoNEZeroIrrelevant)
2037 .ArgConstraint(NotNull(ArgNo(0)))
2038 .ArgConstraint(NotNull(ArgNo(1))));
2042 addToFunctionSummaryMap(
2044 Signature(ArgTypes{IntTy, ConstCharPtrTy, IntTy, ConstCharPtrTy, IntTy},
2047 .Case(ReturnsZero, ErrnoMustNotBeChecked)
2048 .Case(ReturnsMinusOne, ErrnoNEZeroIrrelevant)
2049 .ArgConstraint(ArgumentCondition(0, WithinRange,
Range(0, IntMax)))
2050 .ArgConstraint(NotNull(ArgNo(1)))
2051 .ArgConstraint(ArgumentCondition(2, WithinRange,
Range(0, IntMax)))
2052 .ArgConstraint(NotNull(ArgNo(3))));
2055 addToFunctionSummaryMap(
"unlink",
2056 Signature(ArgTypes{ConstCharPtrTy}, RetType{IntTy}),
2058 .Case(ReturnsZero, ErrnoMustNotBeChecked)
2059 .Case(ReturnsMinusOne, ErrnoNEZeroIrrelevant)
2060 .ArgConstraint(NotNull(ArgNo(0))));
2063 addToFunctionSummaryMap(
2065 Signature(ArgTypes{IntTy, ConstCharPtrTy, IntTy}, RetType{IntTy}),
2067 .Case(ReturnsZero, ErrnoMustNotBeChecked)
2068 .Case(ReturnsMinusOne, ErrnoNEZeroIrrelevant)
2069 .ArgConstraint(ArgumentCondition(0, WithinRange,
Range(0, IntMax)))
2070 .ArgConstraint(NotNull(ArgNo(1))));
2077 addToFunctionSummaryMap(
2078 "fstat", Signature(ArgTypes{IntTy, StructStatPtrTy}, RetType{IntTy}),
2080 .Case(ReturnsZero, ErrnoMustNotBeChecked)
2081 .Case(ReturnsMinusOne, ErrnoNEZeroIrrelevant)
2082 .ArgConstraint(ArgumentCondition(0, WithinRange,
Range(0, IntMax)))
2083 .ArgConstraint(NotNull(ArgNo(1))));
2086 addToFunctionSummaryMap(
2088 Signature(ArgTypes{ConstCharPtrRestrictTy, StructStatPtrRestrictTy},
2091 .Case(ReturnsZero, ErrnoMustNotBeChecked)
2092 .Case(ReturnsMinusOne, ErrnoNEZeroIrrelevant)
2093 .ArgConstraint(NotNull(ArgNo(0)))
2094 .ArgConstraint(NotNull(ArgNo(1))));
2097 addToFunctionSummaryMap(
2099 Signature(ArgTypes{ConstCharPtrRestrictTy, StructStatPtrRestrictTy},
2102 .Case(ReturnsZero, ErrnoMustNotBeChecked)
2103 .Case(ReturnsMinusOne, ErrnoNEZeroIrrelevant)
2104 .ArgConstraint(NotNull(ArgNo(0)))
2105 .ArgConstraint(NotNull(ArgNo(1))));
2109 addToFunctionSummaryMap(
2111 Signature(ArgTypes{IntTy, ConstCharPtrRestrictTy,
2112 StructStatPtrRestrictTy, IntTy},
2115 .Case(ReturnsZero, ErrnoMustNotBeChecked)
2116 .Case(ReturnsMinusOne, ErrnoNEZeroIrrelevant)
2117 .ArgConstraint(ArgumentCondition(0, WithinRange,
Range(0, IntMax)))
2118 .ArgConstraint(NotNull(ArgNo(1)))
2119 .ArgConstraint(NotNull(ArgNo(2))));
2123 addToFunctionSummaryMap(
2124 "opendir", Signature(ArgTypes{ConstCharPtrTy}, RetType{DirPtrTy}),
2125 Summary(NoEvalCall).ArgConstraint(NotNull(ArgNo(0))));
2129 addToFunctionSummaryMap(
"fdopendir",
2130 Signature(ArgTypes{IntTy}, RetType{DirPtrTy}),
2132 .ArgConstraint(ArgumentCondition(
2133 0, WithinRange,
Range(0, IntMax))));
2136 addToFunctionSummaryMap(
2137 "isatty", Signature(ArgTypes{IntTy}, RetType{IntTy}),
2139 .Case({ReturnValueCondition(WithinRange,
Range(0, 1))},
2142 ArgumentCondition(0, WithinRange,
Range(0, IntMax))));
2146 addToFunctionSummaryMap(
2148 Signature(ArgTypes{ConstCharPtrTy, ConstCharPtrTy}, RetType{FilePtrTy}),
2150 .ArgConstraint(NotNull(ArgNo(0)))
2151 .ArgConstraint(NotNull(ArgNo(1))));
2155 addToFunctionSummaryMap(
2156 "pclose", Signature(ArgTypes{FilePtrTy}, RetType{IntTy}),
2157 Summary(NoEvalCall).ArgConstraint(NotNull(ArgNo(0))));
2160 addToFunctionSummaryMap(
"close", Signature(ArgTypes{IntTy}, RetType{IntTy}),
2162 .Case(ReturnsZero, ErrnoMustNotBeChecked)
2163 .Case(ReturnsMinusOne, ErrnoNEZeroIrrelevant)
2164 .ArgConstraint(ArgumentCondition(
2165 0, WithinRange,
Range(-1, IntMax))));
2168 addToFunctionSummaryMap(
"fpathconf",
2169 Signature(ArgTypes{IntTy, IntTy}, RetType{LongTy}),
2171 .ArgConstraint(ArgumentCondition(
2172 0, WithinRange,
Range(0, IntMax))));
2175 addToFunctionSummaryMap(
2176 "pathconf", Signature(ArgTypes{ConstCharPtrTy, IntTy}, RetType{LongTy}),
2177 Summary(NoEvalCall).ArgConstraint(NotNull(ArgNo(0))));
2181 addToFunctionSummaryMap(
2183 Signature(ArgTypes{IntTy, ConstCharPtrTy}, RetType{FilePtrTy}),
2185 .ArgConstraint(ArgumentCondition(0, WithinRange,
Range(0, IntMax)))
2186 .ArgConstraint(NotNull(ArgNo(1))));
2189 addToFunctionSummaryMap(
2190 "rewinddir", Signature(ArgTypes{DirPtrTy}, RetType{VoidTy}),
2191 Summary(NoEvalCall).ArgConstraint(NotNull(ArgNo(0))));
2194 addToFunctionSummaryMap(
2195 "seekdir", Signature(ArgTypes{DirPtrTy, LongTy}, RetType{VoidTy}),
2196 Summary(NoEvalCall).ArgConstraint(NotNull(ArgNo(0))));
2199 addToFunctionSummaryMap(
2200 "rand_r", Signature(ArgTypes{UnsignedIntPtrTy}, RetType{IntTy}),
2201 Summary(NoEvalCall).ArgConstraint(NotNull(ArgNo(0))));
2204 addToFunctionSummaryMap(
2205 "fileno", Signature(ArgTypes{FilePtrTy}, RetType{IntTy}),
2207 .Case(ReturnsValidFileDescriptor, ErrnoMustNotBeChecked)
2208 .Case(ReturnsMinusOne, ErrnoNEZeroIrrelevant)
2209 .ArgConstraint(NotNull(ArgNo(0))));
2212 addToFunctionSummaryMap(
2214 Signature(ArgTypes{FilePtrTy, Off_tTy, IntTy}, RetType{IntTy}),
2216 .Case(ReturnsZeroOrMinusOne, ErrnoIrrelevant)
2217 .ArgConstraint(NotNull(ArgNo(0))));
2220 addToFunctionSummaryMap(
2221 "ftello", Signature(ArgTypes{FilePtrTy}, RetType{Off_tTy}),
2222 Summary(NoEvalCall).ArgConstraint(NotNull(ArgNo(0))));
2227 addToFunctionSummaryMap(
2229 Signature(ArgTypes{VoidPtrTy, SizeTy, IntTy, IntTy, IntTy, Off_tTy},
2230 RetType{VoidPtrTy}),
2232 .ArgConstraint(ArgumentCondition(1, WithinRange,
Range(1, SizeMax)))
2234 ArgumentCondition(4, WithinRange,
Range(-1, IntMax))));
2240 addToFunctionSummaryMap(
2242 Signature(ArgTypes{VoidPtrTy, SizeTy, IntTy, IntTy, IntTy, Off64_tTy},
2243 RetType{VoidPtrTy}),
2245 .ArgConstraint(ArgumentCondition(1, WithinRange,
Range(1, SizeMax)))
2247 ArgumentCondition(4, WithinRange,
Range(-1, IntMax))));
2250 addToFunctionSummaryMap(
"pipe",
2251 Signature(ArgTypes{IntPtrTy}, RetType{IntTy}),
2253 .Case(ReturnsZero, ErrnoMustNotBeChecked)
2254 .Case(ReturnsMinusOne, ErrnoNEZeroIrrelevant)
2255 .ArgConstraint(NotNull(ArgNo(0))));
2262 addToFunctionSummaryMap(
2263 "lseek", Signature(ArgTypes{IntTy, Off_tTy, IntTy}, RetType{Off_tTy}),
2265 .Case(ReturnsNonnegative, ErrnoIrrelevant)
2266 .Case(ReturnsMinusOne, ErrnoNEZeroIrrelevant)
2268 ArgumentCondition(0, WithinRange,
Range(0, IntMax))));
2272 addToFunctionSummaryMap(
2274 Signature(ArgTypes{ConstCharPtrRestrictTy, CharPtrRestrictTy, SizeTy},
2275 RetType{Ssize_tTy}),
2277 .Case({ReturnValueCondition(LessThanOrEq, ArgNo(2)),
2278 ReturnValueCondition(WithinRange,
Range(0, Ssize_tMax))},
2279 ErrnoMustNotBeChecked)
2280 .Case(ReturnsMinusOne, ErrnoNEZeroIrrelevant)
2281 .ArgConstraint(NotNull(ArgNo(0)))
2282 .ArgConstraint(NotNull(ArgNo(1)))
2283 .ArgConstraint(BufferSize(ArgNo(1),
2286 ArgumentCondition(2, WithinRange,
Range(0, SizeMax))));
2290 addToFunctionSummaryMap(
2293 ArgTypes{IntTy, ConstCharPtrRestrictTy, CharPtrRestrictTy, SizeTy},
2294 RetType{Ssize_tTy}),
2296 .Case({ReturnValueCondition(LessThanOrEq, ArgNo(3)),
2297 ReturnValueCondition(WithinRange,
Range(0, Ssize_tMax))},
2298 ErrnoMustNotBeChecked)
2299 .Case(ReturnsMinusOne, ErrnoNEZeroIrrelevant)
2300 .ArgConstraint(ArgumentCondition(0, WithinRange,
Range(0, IntMax)))
2301 .ArgConstraint(NotNull(ArgNo(1)))
2302 .ArgConstraint(NotNull(ArgNo(2)))
2303 .ArgConstraint(BufferSize(ArgNo(2),
2306 ArgumentCondition(3, WithinRange,
Range(0, SizeMax))));
2310 addToFunctionSummaryMap(
2312 Signature(ArgTypes{IntTy, ConstCharPtrTy, IntTy, ConstCharPtrTy},
2315 .Case(ReturnsZero, ErrnoMustNotBeChecked)
2316 .Case(ReturnsMinusOne, ErrnoNEZeroIrrelevant)
2317 .ArgConstraint(NotNull(ArgNo(1)))
2318 .ArgConstraint(NotNull(ArgNo(3))));
2323 addToFunctionSummaryMap(
2325 Signature(ArgTypes{ConstCharPtrRestrictTy, CharPtrRestrictTy},
2326 RetType{CharPtrTy}),
2327 Summary(NoEvalCall).ArgConstraint(NotNull(ArgNo(0))));
2329 QualType CharPtrConstPtr = getPointerTy(getConstTy(CharPtrTy));
2332 addToFunctionSummaryMap(
2334 Signature(ArgTypes{ConstCharPtrTy, CharPtrConstPtr}, RetType{IntTy}),
2336 .Case({ReturnValueCondition(WithinRange, SingleValue(-1))},
2338 .ArgConstraint(NotNull(ArgNo(0))));
2341 addToFunctionSummaryMap(
2343 Signature(ArgTypes{ConstCharPtrTy, CharPtrConstPtr}, RetType{IntTy}),
2345 .Case({ReturnValueCondition(WithinRange, SingleValue(-1))},
2347 .ArgConstraint(NotNull(ArgNo(0))));
2350 addToFunctionSummaryMap(
2352 Signature(ArgTypes{IntTy, CharPtrConstPtr, ConstCharPtrTy},
2355 .Case({ReturnValueCondition(WithinRange,
Range(-1, UCharRangeMax))},
2357 .ArgConstraint(ArgumentCondition(0, WithinRange,
Range(0, IntMax)))
2358 .ArgConstraint(NotNull(ArgNo(1)))
2359 .ArgConstraint(NotNull(ArgNo(2))));
2364 getPointerTy(getConstTy(StructSockaddrTy));
2366 getRestrictTy(StructSockaddrPtrTy);
2368 getRestrictTy(ConstStructSockaddrPtrTy);
2382 .Case(ReturnsValidFileDescriptor, ErrnoMustNotBeChecked)
2383 .Case(ReturnsMinusOne, ErrnoNEZeroIrrelevant)
2384 .ArgConstraint(ArgumentCondition(0, WithinRange,
Range(0, IntMax)));
2385 if (!addToFunctionSummaryMap(
2389 Signature(ArgTypes{IntTy, StructSockaddrPtrRestrictTy,
2390 Socklen_tPtrRestrictTy},
2393 addToFunctionSummaryMap(
2395 Signature(ArgTypes{IntTy,
Irrelevant, Socklen_tPtrRestrictTy},
2401 if (!addToFunctionSummaryMap(
2403 Signature(ArgTypes{IntTy, ConstStructSockaddrPtrTy, Socklen_tTy},
2406 .Case(ReturnsZero, ErrnoMustNotBeChecked)
2407 .Case(ReturnsMinusOne, ErrnoNEZeroIrrelevant)
2409 ArgumentCondition(0, WithinRange,
Range(0, IntMax)))
2410 .ArgConstraint(NotNull(ArgNo(1)))
2412 BufferSize(ArgNo(1), ArgNo(2)))
2414 ArgumentCondition(2, WithinRange,
Range(0, Socklen_tMax)))))
2416 addToFunctionSummaryMap(
2418 Signature(ArgTypes{IntTy,
Irrelevant, Socklen_tTy}, RetType{IntTy}),
2420 .Case(ReturnsZero, ErrnoMustNotBeChecked)
2421 .Case(ReturnsMinusOne, ErrnoNEZeroIrrelevant)
2423 ArgumentCondition(0, WithinRange,
Range(0, IntMax)))
2425 ArgumentCondition(2, WithinRange,
Range(0, Socklen_tMax))));
2429 if (!addToFunctionSummaryMap(
2431 Signature(ArgTypes{IntTy, StructSockaddrPtrRestrictTy,
2432 Socklen_tPtrRestrictTy},
2435 .Case(ReturnsZero, ErrnoMustNotBeChecked)
2436 .Case(ReturnsMinusOne, ErrnoNEZeroIrrelevant)
2438 ArgumentCondition(0, WithinRange,
Range(0, IntMax)))
2439 .ArgConstraint(NotNull(ArgNo(1)))
2440 .ArgConstraint(NotNull(ArgNo(2)))))
2441 addToFunctionSummaryMap(
2443 Signature(ArgTypes{IntTy,
Irrelevant, Socklen_tPtrRestrictTy},
2446 .Case(ReturnsZero, ErrnoMustNotBeChecked)
2447 .Case(ReturnsMinusOne, ErrnoNEZeroIrrelevant)
2449 ArgumentCondition(0, WithinRange,
Range(0, IntMax))));
2453 if (!addToFunctionSummaryMap(
2455 Signature(ArgTypes{IntTy, StructSockaddrPtrRestrictTy,
2456 Socklen_tPtrRestrictTy},
2459 .Case(ReturnsZero, ErrnoMustNotBeChecked)
2460 .Case(ReturnsMinusOne, ErrnoNEZeroIrrelevant)
2462 ArgumentCondition(0, WithinRange,
Range(0, IntMax)))
2463 .ArgConstraint(NotNull(ArgNo(1)))
2464 .ArgConstraint(NotNull(ArgNo(2)))))
2465 addToFunctionSummaryMap(
2467 Signature(ArgTypes{IntTy,
Irrelevant, Socklen_tPtrRestrictTy},
2470 .Case(ReturnsZero, ErrnoMustNotBeChecked)
2471 .Case(ReturnsMinusOne, ErrnoNEZeroIrrelevant)
2473 ArgumentCondition(0, WithinRange,
Range(0, IntMax))));
2477 if (!addToFunctionSummaryMap(
2479 Signature(ArgTypes{IntTy, ConstStructSockaddrPtrTy, Socklen_tTy},
2482 .Case(ReturnsZero, ErrnoMustNotBeChecked)
2483 .Case(ReturnsMinusOne, ErrnoNEZeroIrrelevant)
2485 ArgumentCondition(0, WithinRange,
Range(0, IntMax)))
2486 .ArgConstraint(NotNull(ArgNo(1)))))
2487 addToFunctionSummaryMap(
2489 Signature(ArgTypes{IntTy,
Irrelevant, Socklen_tTy}, RetType{IntTy}),
2491 .Case(ReturnsZero, ErrnoMustNotBeChecked)
2492 .Case(ReturnsMinusOne, ErrnoNEZeroIrrelevant)
2494 ArgumentCondition(0, WithinRange,
Range(0, IntMax))));
2498 .Case({ReturnValueCondition(LessThanOrEq, ArgNo(2)),
2499 ReturnValueCondition(WithinRange,
Range(0, Ssize_tMax))},
2500 ErrnoMustNotBeChecked)
2501 .Case(ReturnsMinusOne, ErrnoNEZeroIrrelevant)
2502 .ArgConstraint(ArgumentCondition(0, WithinRange,
Range(0, IntMax)))
2503 .ArgConstraint(BufferSize(ArgNo(1),
2505 if (!addToFunctionSummaryMap(
2511 Signature(ArgTypes{IntTy, VoidPtrRestrictTy, SizeTy, IntTy,
2512 StructSockaddrPtrRestrictTy,
2513 Socklen_tPtrRestrictTy},
2514 RetType{Ssize_tTy}),
2516 addToFunctionSummaryMap(
2518 Signature(ArgTypes{IntTy, VoidPtrRestrictTy, SizeTy, IntTy,
2520 RetType{Ssize_tTy}),
2525 .Case({ReturnValueCondition(LessThanOrEq, ArgNo(2)),
2526 ReturnValueCondition(WithinRange,
Range(0, Ssize_tMax))},
2527 ErrnoMustNotBeChecked)
2528 .Case(ReturnsMinusOne, ErrnoNEZeroIrrelevant)
2529 .ArgConstraint(ArgumentCondition(0, WithinRange,
Range(0, IntMax)))
2530 .ArgConstraint(BufferSize(ArgNo(1),
2532 if (!addToFunctionSummaryMap(
2537 Signature(ArgTypes{IntTy, ConstVoidPtrTy, SizeTy, IntTy,
2538 ConstStructSockaddrPtrTy, Socklen_tTy},
2539 RetType{Ssize_tTy}),
2541 addToFunctionSummaryMap(
2543 Signature(ArgTypes{IntTy, ConstVoidPtrTy, SizeTy, IntTy,
Irrelevant,
2545 RetType{Ssize_tTy}),
2549 addToFunctionSummaryMap(
"listen",
2550 Signature(ArgTypes{IntTy, IntTy}, RetType{IntTy}),
2552 .Case(ReturnsZero, ErrnoMustNotBeChecked)
2553 .Case(ReturnsMinusOne, ErrnoNEZeroIrrelevant)
2554 .ArgConstraint(ArgumentCondition(
2555 0, WithinRange,
Range(0, IntMax))));
2558 addToFunctionSummaryMap(
2560 Signature(ArgTypes{IntTy, VoidPtrTy, SizeTy, IntTy},
2561 RetType{Ssize_tTy}),
2563 .Case({ReturnValueCondition(LessThanOrEq, ArgNo(2)),
2564 ReturnValueCondition(WithinRange,
Range(0, Ssize_tMax))},
2565 ErrnoMustNotBeChecked)
2566 .Case(ReturnsMinusOne, ErrnoNEZeroIrrelevant)
2567 .ArgConstraint(ArgumentCondition(0, WithinRange,
Range(0, IntMax)))
2568 .ArgConstraint(BufferSize(ArgNo(1),
2574 getPointerTy(getConstTy(StructMsghdrTy));
2577 addToFunctionSummaryMap(
2579 Signature(ArgTypes{IntTy, StructMsghdrPtrTy, IntTy},
2580 RetType{Ssize_tTy}),
2582 .Case({ReturnValueCondition(WithinRange,
Range(0, Ssize_tMax))},
2583 ErrnoMustNotBeChecked)
2584 .Case(ReturnsMinusOne, ErrnoNEZeroIrrelevant)
2586 ArgumentCondition(0, WithinRange,
Range(0, IntMax))));
2589 addToFunctionSummaryMap(
2591 Signature(ArgTypes{IntTy, ConstStructMsghdrPtrTy, IntTy},
2592 RetType{Ssize_tTy}),
2594 .Case({ReturnValueCondition(WithinRange,
Range(0, Ssize_tMax))},
2595 ErrnoMustNotBeChecked)
2596 .Case(ReturnsMinusOne, ErrnoNEZeroIrrelevant)
2598 ArgumentCondition(0, WithinRange,
Range(0, IntMax))));
2602 addToFunctionSummaryMap(
2604 Signature(ArgTypes{IntTy, IntTy, IntTy, ConstVoidPtrTy, Socklen_tTy},
2607 .Case(ReturnsZero, ErrnoMustNotBeChecked)
2608 .Case(ReturnsMinusOne, ErrnoNEZeroIrrelevant)
2609 .ArgConstraint(NotNull(ArgNo(3)))
2611 BufferSize(ArgNo(3), ArgNo(4)))
2613 ArgumentCondition(4, WithinRange,
Range(0, Socklen_tMax))));
2618 addToFunctionSummaryMap(
2620 Signature(ArgTypes{IntTy, IntTy, IntTy, VoidPtrRestrictTy,
2621 Socklen_tPtrRestrictTy},
2624 .Case(ReturnsZero, ErrnoMustNotBeChecked)
2625 .Case(ReturnsMinusOne, ErrnoNEZeroIrrelevant)
2626 .ArgConstraint(NotNull(ArgNo(3)))
2627 .ArgConstraint(NotNull(ArgNo(4))));
2630 addToFunctionSummaryMap(
2632 Signature(ArgTypes{IntTy, ConstVoidPtrTy, SizeTy, IntTy},
2633 RetType{Ssize_tTy}),
2635 .Case({ReturnValueCondition(LessThanOrEq, ArgNo(2)),
2636 ReturnValueCondition(WithinRange,
Range(0, Ssize_tMax))},
2637 ErrnoMustNotBeChecked)
2638 .Case(ReturnsMinusOne, ErrnoNEZeroIrrelevant)
2639 .ArgConstraint(ArgumentCondition(0, WithinRange,
Range(0, IntMax)))
2640 .ArgConstraint(BufferSize(ArgNo(1),
2644 addToFunctionSummaryMap(
2646 Signature(ArgTypes{IntTy, IntTy, IntTy, IntPtrTy}, RetType{IntTy}),
2648 .Case(ReturnsZero, ErrnoMustNotBeChecked)
2649 .Case(ReturnsMinusOne, ErrnoNEZeroIrrelevant)
2650 .ArgConstraint(NotNull(ArgNo(3))));
2659 addToFunctionSummaryMap(
2661 Signature(ArgTypes{ConstStructSockaddrPtrRestrictTy, Socklen_tTy,
2662 CharPtrRestrictTy, Socklen_tTy, CharPtrRestrictTy,
2663 Socklen_tTy, IntTy},
2667 BufferSize(ArgNo(0), ArgNo(1)))
2669 ArgumentCondition(1, WithinRange,
Range(0, Socklen_tMax)))
2671 BufferSize(ArgNo(2), ArgNo(3)))
2673 ArgumentCondition(3, WithinRange,
Range(0, Socklen_tMax)))
2675 BufferSize(ArgNo(4), ArgNo(5)))
2677 ArgumentCondition(5, WithinRange,
Range(0, Socklen_tMax))));
2683 addToFunctionSummaryMap(
2685 Signature(ArgTypes{ConstCharPtrTy, StructUtimbufPtrTy}, RetType{IntTy}),
2687 .Case(ReturnsZero, ErrnoMustNotBeChecked)
2688 .Case(ReturnsMinusOne, ErrnoNEZeroIrrelevant)
2689 .ArgConstraint(NotNull(ArgNo(0))));
2694 getPointerTy(getConstTy(StructTimespecTy));
2697 addToFunctionSummaryMap(
2699 Signature(ArgTypes{IntTy, ConstStructTimespecPtrTy}, RetType{IntTy}),
2701 .Case(ReturnsZero, ErrnoMustNotBeChecked)
2702 .Case(ReturnsMinusOne, ErrnoNEZeroIrrelevant)
2704 ArgumentCondition(0, WithinRange,
Range(0, IntMax))));
2708 addToFunctionSummaryMap(
"utimensat",
2709 Signature(ArgTypes{IntTy, ConstCharPtrTy,
2710 ConstStructTimespecPtrTy, IntTy},
2713 .Case(ReturnsZero, ErrnoMustNotBeChecked)
2714 .Case(ReturnsMinusOne, ErrnoNEZeroIrrelevant)
2715 .ArgConstraint(NotNull(ArgNo(1))));
2719 getPointerTy(getConstTy(StructTimevalTy));
2722 addToFunctionSummaryMap(
2724 Signature(ArgTypes{ConstCharPtrTy, ConstStructTimevalPtrTy},
2727 .Case(ReturnsZero, ErrnoMustNotBeChecked)
2728 .Case(ReturnsMinusOne, ErrnoNEZeroIrrelevant)
2729 .ArgConstraint(NotNull(ArgNo(0))));
2732 addToFunctionSummaryMap(
2734 Signature(ArgTypes{ConstStructTimespecPtrTy, StructTimespecPtrTy},
2737 .Case(ReturnsZero, ErrnoMustNotBeChecked)
2738 .Case(ReturnsMinusOne, ErrnoNEZeroIrrelevant)
2739 .ArgConstraint(NotNull(ArgNo(0))));
2744 getRestrictTy(ConstTime_tPtrTy);
2750 getPointerTy(getConstTy(StructTmTy));
2752 getRestrictTy(ConstStructTmPtrTy);
2755 addToFunctionSummaryMap(
2757 Signature(ArgTypes{ConstTime_tPtrTy}, RetType{StructTmPtrTy}),
2758 Summary(NoEvalCall).ArgConstraint(NotNull(ArgNo(0))));
2762 addToFunctionSummaryMap(
2764 Signature(ArgTypes{ConstTime_tPtrRestrictTy, StructTmPtrRestrictTy},
2765 RetType{StructTmPtrTy}),
2767 .ArgConstraint(NotNull(ArgNo(0)))
2768 .ArgConstraint(NotNull(ArgNo(1))));
2771 addToFunctionSummaryMap(
2773 Signature(ArgTypes{ConstStructTmPtrRestrictTy, CharPtrRestrictTy},
2774 RetType{CharPtrTy}),
2776 .ArgConstraint(NotNull(ArgNo(0)))
2777 .ArgConstraint(NotNull(ArgNo(1)))
2778 .ArgConstraint(BufferSize(ArgNo(1),
2779 BVF.getValue(26, IntTy))));
2782 addToFunctionSummaryMap(
2784 Signature(ArgTypes{ConstTime_tPtrTy, CharPtrTy}, RetType{CharPtrTy}),
2786 .ArgConstraint(NotNull(ArgNo(0)))
2787 .ArgConstraint(NotNull(ArgNo(1)))
2788 .ArgConstraint(BufferSize(
2790 BVF.getValue(26, IntTy))));
2794 addToFunctionSummaryMap(
2796 Signature(ArgTypes{ConstTime_tPtrRestrictTy, StructTmPtrRestrictTy},
2797 RetType{StructTmPtrTy}),
2799 .ArgConstraint(NotNull(ArgNo(0)))
2800 .ArgConstraint(NotNull(ArgNo(1))));
2803 addToFunctionSummaryMap(
2804 "gmtime", Signature(ArgTypes{ConstTime_tPtrTy}, RetType{StructTmPtrTy}),
2805 Summary(NoEvalCall).ArgConstraint(NotNull(ArgNo(0))));
2810 addToFunctionSummaryMap(
2812 Signature(ArgTypes{Clockid_tTy, StructTimespecPtrTy}, RetType{IntTy}),
2814 .Case(ReturnsZero, ErrnoMustNotBeChecked)
2815 .Case(ReturnsMinusOne, ErrnoNEZeroIrrelevant)
2816 .ArgConstraint(NotNull(ArgNo(1))));
2822 addToFunctionSummaryMap(
2824 Signature(ArgTypes{IntTy, StructItimervalPtrTy}, RetType{IntTy}),
2826 .Case(ReturnsZero, ErrnoMustNotBeChecked)
2827 .Case(ReturnsMinusOne, ErrnoNEZeroIrrelevant)
2828 .ArgConstraint(NotNull(ArgNo(1))));
2838 getRestrictTy(Pthread_mutex_tPtrTy);
2842 getPointerTy(getConstTy(Pthread_attr_tTy));
2844 getRestrictTy(ConstPthread_attr_tPtrTy);
2847 getPointerTy(getConstTy(Pthread_mutexattr_tTy));
2849 getRestrictTy(ConstPthread_mutexattr_tPtrTy);
2851 QualType PthreadStartRoutineTy = getPointerTy(
2857 addToFunctionSummaryMap(
2858 {
"pthread_cond_signal",
"pthread_cond_broadcast"},
2859 Signature(ArgTypes{Pthread_cond_tPtrTy}, RetType{IntTy}),
2860 Summary(NoEvalCall).ArgConstraint(NotNull(ArgNo(0))));
2865 addToFunctionSummaryMap(
2867 Signature(ArgTypes{Pthread_tPtrRestrictTy,
2868 ConstPthread_attr_tPtrRestrictTy,
2869 PthreadStartRoutineTy, VoidPtrRestrictTy},
2872 .ArgConstraint(NotNull(ArgNo(0)))
2873 .ArgConstraint(NotNull(ArgNo(2))));
2877 addToFunctionSummaryMap(
2878 {
"pthread_attr_destroy",
"pthread_attr_init"},
2879 Signature(ArgTypes{Pthread_attr_tPtrTy}, RetType{IntTy}),
2880 Summary(NoEvalCall).ArgConstraint(NotNull(ArgNo(0))));
2886 addToFunctionSummaryMap(
2887 {
"pthread_attr_getstacksize",
"pthread_attr_getguardsize"},
2888 Signature(ArgTypes{ConstPthread_attr_tPtrRestrictTy, SizePtrRestrictTy},
2891 .ArgConstraint(NotNull(ArgNo(0)))
2892 .ArgConstraint(NotNull(ArgNo(1))));
2896 addToFunctionSummaryMap(
2897 {
"pthread_attr_setstacksize",
"pthread_attr_setguardsize"},
2898 Signature(ArgTypes{Pthread_attr_tPtrTy, SizeTy}, RetType{IntTy}),
2900 .ArgConstraint(NotNull(ArgNo(0)))
2902 ArgumentCondition(1, WithinRange,
Range(0, SizeMax))));
2906 addToFunctionSummaryMap(
2907 "pthread_mutex_init",
2908 Signature(ArgTypes{Pthread_mutex_tPtrRestrictTy,
2909 ConstPthread_mutexattr_tPtrRestrictTy},
2911 Summary(NoEvalCall).ArgConstraint(NotNull(ArgNo(0))));
2917 addToFunctionSummaryMap(
2918 {
"pthread_mutex_destroy",
"pthread_mutex_lock",
"pthread_mutex_trylock",
2919 "pthread_mutex_unlock"},
2920 Signature(ArgTypes{Pthread_mutex_tPtrTy}, RetType{IntTy}),
2921 Summary(NoEvalCall).ArgConstraint(NotNull(ArgNo(0))));
2925 if (ChecksEnabled[CK_StdCLibraryFunctionsTesterChecker]) {
2926 addToFunctionSummaryMap(
2927 "__not_null", Signature(ArgTypes{IntPtrTy}, RetType{IntTy}),
2928 Summary(EvalCallAsPure).ArgConstraint(NotNull(ArgNo(0))));
2931 addToFunctionSummaryMap(
2932 "__single_val_1", Signature(ArgTypes{IntTy}, RetType{IntTy}),
2933 Summary(EvalCallAsPure)
2934 .ArgConstraint(ArgumentCondition(0
U, WithinRange, SingleValue(1))));
2935 addToFunctionSummaryMap(
2936 "__range_1_2", Signature(ArgTypes{IntTy}, RetType{IntTy}),
2937 Summary(EvalCallAsPure)
2938 .ArgConstraint(ArgumentCondition(0
U, WithinRange,
Range(1, 2))));
2939 addToFunctionSummaryMap(
"__range_1_2__4_5",
2940 Signature(ArgTypes{IntTy}, RetType{IntTy}),
2941 Summary(EvalCallAsPure)
2942 .ArgConstraint(ArgumentCondition(
2943 0
U, WithinRange,
Range({1, 2}, {4, 5}))));
2946 addToFunctionSummaryMap(
2947 "__within", Signature(ArgTypes{IntTy}, RetType{IntTy}),
2948 Summary(EvalCallAsPure)
2949 .ArgConstraint(ArgumentCondition(0
U, WithinRange, SingleValue(1))));
2950 addToFunctionSummaryMap(
2951 "__out_of", Signature(ArgTypes{IntTy}, RetType{IntTy}),
2952 Summary(EvalCallAsPure)
2953 .ArgConstraint(ArgumentCondition(0
U, OutOfRange, SingleValue(1))));
2955 addToFunctionSummaryMap(
2956 "__two_constrained_args",
2957 Signature(ArgTypes{IntTy, IntTy}, RetType{IntTy}),
2958 Summary(EvalCallAsPure)
2959 .ArgConstraint(ArgumentCondition(0
U, WithinRange, SingleValue(1)))
2960 .ArgConstraint(ArgumentCondition(1
U, WithinRange, SingleValue(1))));
2961 addToFunctionSummaryMap(
2962 "__arg_constrained_twice", Signature(ArgTypes{IntTy}, RetType{IntTy}),
2963 Summary(EvalCallAsPure)
2964 .ArgConstraint(ArgumentCondition(0
U, OutOfRange, SingleValue(1)))
2965 .ArgConstraint(ArgumentCondition(0
U, OutOfRange, SingleValue(2))));
2966 addToFunctionSummaryMap(
2968 Signature(ArgTypes{
Irrelevant, IntTy}, RetType{IntTy}),
2969 Summary(EvalCallAsPure).ArgConstraint(NotNull(ArgNo(0))));
2970 addToFunctionSummaryMap(
2972 Signature(ArgTypes{VoidPtrTy, ConstCharPtrTy}, RetType{IntTy}),
2973 Summary(EvalCallAsPure)
2974 .ArgConstraint(NotNull(ArgNo(0)))
2975 .ArgConstraint(NotNull(ArgNo(1))));
2976 addToFunctionSummaryMap(
2977 "__buf_size_arg_constraint",
2978 Signature(ArgTypes{ConstVoidPtrTy, SizeTy}, RetType{IntTy}),
2979 Summary(EvalCallAsPure)
2981 BufferSize(ArgNo(0), ArgNo(1))));
2982 addToFunctionSummaryMap(
2983 "__buf_size_arg_constraint_mul",
2984 Signature(ArgTypes{ConstVoidPtrTy, SizeTy, SizeTy}, RetType{IntTy}),
2985 Summary(EvalCallAsPure)
2986 .ArgConstraint(BufferSize(ArgNo(0), ArgNo(1),
2988 addToFunctionSummaryMap(
2989 "__buf_size_arg_constraint_concrete",
2990 Signature(ArgTypes{ConstVoidPtrTy}, RetType{IntTy}),
2991 Summary(EvalCallAsPure)
2992 .ArgConstraint(BufferSize(ArgNo(0),
2993 BVF.getValue(10, IntTy))));
2994 addToFunctionSummaryMap(
2995 {
"__test_restrict_param_0",
"__test_restrict_param_1",
2996 "__test_restrict_param_2"},
2997 Signature(ArgTypes{VoidPtrRestrictTy}, RetType{VoidTy}),
2998 Summary(EvalCallAsPure));
3001 SummariesInitialized =
true;
3004 void ento::registerStdCLibraryFunctionsChecker(
CheckerManager &mgr) {
3007 Checker->DisplayLoadedSummaries =
3008 Opts.getCheckerBooleanOption(
Checker,
"DisplayLoadedSummaries");
3009 Checker->ModelPOSIX = Opts.getCheckerBooleanOption(
Checker,
"ModelPOSIX");
3010 Checker->ShouldAssumeControlledEnvironment =
3011 Opts.ShouldAssumeControlledEnvironment;
3014 bool ento::shouldRegisterStdCLibraryFunctionsChecker(
3019 #define REGISTER_CHECKER(name) \
3020 void ento::register##name(CheckerManager &mgr) { \
3021 StdLibraryFunctionsChecker *checker = \
3022 mgr.getChecker<StdLibraryFunctionsChecker>(); \
3023 checker->ChecksEnabled[StdLibraryFunctionsChecker::CK_##name] = true; \
3024 checker->CheckNames[StdLibraryFunctionsChecker::CK_##name] = \
3025 mgr.getCurrentCheckerName(); \
3028 bool ento::shouldRegister##name(const CheckerManager &mgr) { return true; }