27#include "llvm/ADT/Sequence.h"
33using namespace std::placeholders;
49struct StreamErrorState {
57 bool isNoError()
const {
return NoError && !FEof && !FError; }
58 bool isFEof()
const {
return !NoError && FEof && !FError; }
59 bool isFError()
const {
return !NoError && !FEof && FError; }
61 bool operator==(
const StreamErrorState &ES)
const {
62 return NoError == ES.NoError && FEof == ES.FEof && FError == ES.FError;
65 bool operator!=(
const StreamErrorState &ES)
const {
return !(*
this == ES); }
67 StreamErrorState
operator|(
const StreamErrorState &
E)
const {
68 return {NoError ||
E.NoError, FEof ||
E.FEof, FError ||
E.FError};
71 StreamErrorState
operator&(
const StreamErrorState &
E)
const {
72 return {NoError &&
E.NoError, FEof &&
E.FEof, FError &&
E.FError};
75 StreamErrorState
operator~()
const {
return {!NoError, !FEof, !FError}; }
78 operator bool()
const {
return NoError || FEof || FError; }
80 LLVM_DUMP_METHOD
void dump()
const { dumpToStream(llvm::errs()); }
81 LLVM_DUMP_METHOD
void dumpToStream(llvm::raw_ostream &os)
const {
82 os <<
"NoError: " << NoError <<
", FEof: " << FEof
83 <<
", FError: " << FError;
86 void Profile(llvm::FoldingSetNodeID &ID)
const {
87 ID.AddBoolean(NoError);
89 ID.AddBoolean(FError);
93const StreamErrorState ErrorNone{
true,
false,
false};
94const StreamErrorState ErrorFEof{
false,
true,
false};
95const StreamErrorState ErrorFError{
false,
false,
true};
101 const FnDescription *LastOperation;
110 StringRef getKindStr()
const {
119 llvm_unreachable(
"Unknown StreamState!");
124 StreamErrorState
const ErrorState;
134 bool const FilePositionIndeterminate =
false;
136 StreamState(
const FnDescription *L, KindTy S,
const StreamErrorState &ES,
137 bool IsFilePositionIndeterminate)
138 : LastOperation(L), State(S), ErrorState(ES),
139 FilePositionIndeterminate(IsFilePositionIndeterminate) {
140 assert((!ES.isFEof() || !IsFilePositionIndeterminate) &&
141 "FilePositionIndeterminate should be false in FEof case.");
142 assert((State == Opened || ErrorState.isNoError()) &&
143 "ErrorState should be None in non-opened stream state.");
146 bool isOpened()
const {
return State == Opened; }
147 bool isClosed()
const {
return State ==
Closed; }
148 bool isOpenFailed()
const {
return State == OpenFailed; }
153 return LastOperation ==
X.LastOperation && State ==
X.State &&
154 ErrorState ==
X.ErrorState &&
155 FilePositionIndeterminate ==
X.FilePositionIndeterminate;
158 static StreamState getOpened(
const FnDescription *L,
159 const StreamErrorState &ES = ErrorNone,
160 bool IsFilePositionIndeterminate =
false) {
161 return StreamState{L, Opened, ES, IsFilePositionIndeterminate};
163 static StreamState getClosed(
const FnDescription *L) {
164 return StreamState{L,
Closed, {},
false};
166 static StreamState getOpenFailed(
const FnDescription *L) {
167 return StreamState{L, OpenFailed, {},
false};
170 LLVM_DUMP_METHOD
void dump()
const { dumpToStream(llvm::errs()); }
171 LLVM_DUMP_METHOD
void dumpToStream(llvm::raw_ostream &os)
const;
173 void Profile(llvm::FoldingSetNodeID &ID)
const {
174 ID.AddPointer(LastOperation);
175 ID.AddInteger(State);
176 ErrorState.Profile(ID);
177 ID.AddBoolean(FilePositionIndeterminate);
195using FnCheck = std::function<void(
const StreamChecker *,
const FnDescription *,
198using ArgNoTy =
unsigned int;
199static const ArgNoTy ArgNone = std::numeric_limits<ArgNoTy>::max();
201const char *FeofNote =
"Assuming stream reaches end-of-file here";
202const char *FerrorNote =
"Assuming this stream operation fails";
204struct FnDescription {
210LLVM_DUMP_METHOD
void StreamState::dumpToStream(llvm::raw_ostream &os)
const {
211 os <<
"{Kind: " << getKindStr() <<
", Last operation: " << LastOperation
213 ErrorState.dumpToStream(os);
214 os <<
", FilePos: " << (FilePositionIndeterminate ?
"Indeterminate" :
"OK")
221 assert(Desc && Desc->StreamArgNo != ArgNone &&
222 "Try to get a non-existing stream argument.");
223 return Call.getArgSVal(Desc->StreamArgNo);
228 assert(CE &&
"Expecting a call expression.");
231 return C.getSValBuilder()
232 .conjureSymbolVal(
nullptr, CE, LCtx,
C.blockCount())
239 State = State->BindExpr(CE,
C.getLocationContext(), RetVal);
240 State = State->assume(RetVal,
true);
241 assert(State &&
"Assumption on new value should not fail.");
247 State = State->BindExpr(CE,
C.getLocationContext(),
252inline void assertStreamStateOpened(
const StreamState *SS) {
253 assert(SS->isOpened() &&
"Stream is expected to be opened");
256class StreamChecker :
public Checker<check::PreCall, eval::Call,
257 check::DeadSymbols, check::PointerEscape,
258 check::ASTDecl<TranslationUnitDecl>> {
259 BugType BT_FileNull{
this,
"NULL stream pointer",
"Stream handling error"};
260 BugType BT_UseAfterClose{
this,
"Closed stream",
"Stream handling error"};
261 BugType BT_UseAfterOpenFailed{
this,
"Invalid stream",
262 "Stream handling error"};
263 BugType BT_IndeterminatePosition{
this,
"Invalid stream state",
264 "Stream handling error"};
265 BugType BT_IllegalWhence{
this,
"Illegal whence argument",
266 "Stream handling error"};
267 BugType BT_StreamEof{
this,
"Stream already in EOF",
"Stream handling error"};
268 BugType BT_ResourceLeak{
this,
"Resource leak",
"Stream handling error",
284 const BugType *getBT_StreamEof()
const {
return &BT_StreamEof; }
285 const BugType *getBT_IndeterminatePosition()
const {
286 return &BT_IndeterminatePosition;
312 &BR.
getBugType() != this->getBT_IndeterminatePosition())
328 BR.markNotInteresting(StreamSym);
331 if (&BR.
getBugType() == this->getBT_IndeterminatePosition()) {
332 BR.markNotInteresting(StreamSym);
341 bool TestMode =
false;
344 bool PedanticMode =
false;
350 {{CDM::CLibrary, {
"fopen"}, 2},
351 {
nullptr, &StreamChecker::evalFopen, ArgNone}},
352 {{CDM::CLibrary, {
"fdopen"}, 2},
353 {
nullptr, &StreamChecker::evalFopen, ArgNone}},
354 {{CDM::CLibrary, {
"freopen"}, 3},
355 {&StreamChecker::preFreopen, &StreamChecker::evalFreopen, 2}},
356 {{CDM::CLibrary, {
"tmpfile"}, 0},
357 {
nullptr, &StreamChecker::evalFopen, ArgNone}},
358 {FCloseDesc, {&StreamChecker::preDefault, &StreamChecker::evalFclose, 0}},
359 {{CDM::CLibrary, {
"fread"}, 4},
360 {&StreamChecker::preRead,
361 std::bind(&StreamChecker::evalFreadFwrite, _1,
_2, _3, _4,
true), 3}},
362 {{CDM::CLibrary, {
"fwrite"}, 4},
363 {&StreamChecker::preWrite,
364 std::bind(&StreamChecker::evalFreadFwrite, _1,
_2, _3, _4,
false), 3}},
365 {{CDM::CLibrary, {
"fgetc"}, 1},
366 {&StreamChecker::preRead,
367 std::bind(&StreamChecker::evalFgetx, _1,
_2, _3, _4,
true), 0}},
368 {{CDM::CLibrary, {
"fgets"}, 3},
369 {&StreamChecker::preRead,
370 std::bind(&StreamChecker::evalFgetx, _1,
_2, _3, _4,
false), 2}},
371 {{CDM::CLibrary, {
"getc"}, 1},
372 {&StreamChecker::preRead,
373 std::bind(&StreamChecker::evalFgetx, _1,
_2, _3, _4,
true), 0}},
374 {{CDM::CLibrary, {
"fputc"}, 2},
375 {&StreamChecker::preWrite,
376 std::bind(&StreamChecker::evalFputx, _1,
_2, _3, _4,
true), 1}},
377 {{CDM::CLibrary, {
"fputs"}, 2},
378 {&StreamChecker::preWrite,
379 std::bind(&StreamChecker::evalFputx, _1,
_2, _3, _4,
false), 1}},
380 {{CDM::CLibrary, {
"putc"}, 2},
381 {&StreamChecker::preWrite,
382 std::bind(&StreamChecker::evalFputx, _1,
_2, _3, _4,
true), 1}},
383 {{CDM::CLibrary, {
"fprintf"}},
384 {&StreamChecker::preWrite,
385 std::bind(&StreamChecker::evalFprintf, _1,
_2, _3, _4), 0}},
386 {{CDM::CLibrary, {
"vfprintf"}, 3},
387 {&StreamChecker::preWrite,
388 std::bind(&StreamChecker::evalFprintf, _1,
_2, _3, _4), 0}},
389 {{CDM::CLibrary, {
"fscanf"}},
390 {&StreamChecker::preRead,
391 std::bind(&StreamChecker::evalFscanf, _1,
_2, _3, _4), 0}},
392 {{CDM::CLibrary, {
"vfscanf"}, 3},
393 {&StreamChecker::preRead,
394 std::bind(&StreamChecker::evalFscanf, _1,
_2, _3, _4), 0}},
395 {{CDM::CLibrary, {
"ungetc"}, 2},
396 {&StreamChecker::preWrite,
397 std::bind(&StreamChecker::evalUngetc, _1,
_2, _3, _4), 1}},
398 {{CDM::CLibrary, {
"getdelim"}, 4},
399 {&StreamChecker::preRead,
400 std::bind(&StreamChecker::evalGetdelim, _1,
_2, _3, _4), 3}},
401 {{CDM::CLibrary, {
"getline"}, 3},
402 {&StreamChecker::preRead,
403 std::bind(&StreamChecker::evalGetdelim, _1,
_2, _3, _4), 2}},
404 {{CDM::CLibrary, {
"fseek"}, 3},
405 {&StreamChecker::preFseek, &StreamChecker::evalFseek, 0}},
406 {{CDM::CLibrary, {
"fseeko"}, 3},
407 {&StreamChecker::preFseek, &StreamChecker::evalFseek, 0}},
408 {{CDM::CLibrary, {
"ftell"}, 1},
409 {&StreamChecker::preWrite, &StreamChecker::evalFtell, 0}},
410 {{CDM::CLibrary, {
"ftello"}, 1},
411 {&StreamChecker::preWrite, &StreamChecker::evalFtell, 0}},
412 {{CDM::CLibrary, {
"fflush"}, 1},
413 {&StreamChecker::preFflush, &StreamChecker::evalFflush, 0}},
414 {{CDM::CLibrary, {
"rewind"}, 1},
415 {&StreamChecker::preDefault, &StreamChecker::evalRewind, 0}},
416 {{CDM::CLibrary, {
"fgetpos"}, 2},
417 {&StreamChecker::preWrite, &StreamChecker::evalFgetpos, 0}},
418 {{CDM::CLibrary, {
"fsetpos"}, 2},
419 {&StreamChecker::preDefault, &StreamChecker::evalFsetpos, 0}},
420 {{CDM::CLibrary, {
"clearerr"}, 1},
421 {&StreamChecker::preDefault, &StreamChecker::evalClearerr, 0}},
422 {{CDM::CLibrary, {
"feof"}, 1},
423 {&StreamChecker::preDefault,
424 std::bind(&StreamChecker::evalFeofFerror, _1,
_2, _3, _4, ErrorFEof),
426 {{CDM::CLibrary, {
"ferror"}, 1},
427 {&StreamChecker::preDefault,
428 std::bind(&StreamChecker::evalFeofFerror, _1,
_2, _3, _4, ErrorFError),
430 {{CDM::CLibrary, {
"fileno"}, 1},
431 {&StreamChecker::preDefault, &StreamChecker::evalFileno, 0}},
435 {{CDM::SimpleFunc, {
"StreamTesterChecker_make_feof_stream"}, 1},
437 std::bind(&StreamChecker::evalSetFeofFerror, _1,
_2, _3, _4, ErrorFEof,
440 {{CDM::SimpleFunc, {
"StreamTesterChecker_make_ferror_stream"}, 1},
442 std::bind(&StreamChecker::evalSetFeofFerror, _1,
_2, _3, _4,
446 {
"StreamTesterChecker_make_ferror_indeterminate_stream"},
449 std::bind(&StreamChecker::evalSetFeofFerror, _1,
_2, _3, _4,
455 mutable std::optional<int> EofVal;
457 mutable int SeekSetVal = 0;
459 mutable int SeekCurVal = 1;
461 mutable int SeekEndVal = 2;
465 mutable const VarDecl *StdinDecl =
nullptr;
466 mutable const VarDecl *StdoutDecl =
nullptr;
467 mutable const VarDecl *StderrDecl =
nullptr;
469 void evalFopen(
const FnDescription *Desc,
const CallEvent &
Call,
472 void preFreopen(
const FnDescription *Desc,
const CallEvent &
Call,
474 void evalFreopen(
const FnDescription *Desc,
const CallEvent &
Call,
477 void evalFclose(
const FnDescription *Desc,
const CallEvent &
Call,
480 void preRead(
const FnDescription *Desc,
const CallEvent &
Call,
483 void preWrite(
const FnDescription *Desc,
const CallEvent &
Call,
486 void evalFreadFwrite(
const FnDescription *Desc,
const CallEvent &
Call,
489 void evalFgetx(
const FnDescription *Desc,
const CallEvent &
Call,
492 void evalFputx(
const FnDescription *Desc,
const CallEvent &
Call,
495 void evalFprintf(
const FnDescription *Desc,
const CallEvent &
Call,
498 void evalFscanf(
const FnDescription *Desc,
const CallEvent &
Call,
501 void evalUngetc(
const FnDescription *Desc,
const CallEvent &
Call,
504 void evalGetdelim(
const FnDescription *Desc,
const CallEvent &
Call,
507 void preFseek(
const FnDescription *Desc,
const CallEvent &
Call,
509 void evalFseek(
const FnDescription *Desc,
const CallEvent &
Call,
512 void evalFgetpos(
const FnDescription *Desc,
const CallEvent &
Call,
515 void evalFsetpos(
const FnDescription *Desc,
const CallEvent &
Call,
518 void evalFtell(
const FnDescription *Desc,
const CallEvent &
Call,
521 void evalRewind(
const FnDescription *Desc,
const CallEvent &
Call,
524 void preDefault(
const FnDescription *Desc,
const CallEvent &
Call,
527 void evalClearerr(
const FnDescription *Desc,
const CallEvent &
Call,
530 void evalFeofFerror(
const FnDescription *Desc,
const CallEvent &
Call,
532 const StreamErrorState &ErrorKind)
const;
534 void evalSetFeofFerror(
const FnDescription *Desc,
const CallEvent &
Call,
536 bool Indeterminate)
const;
538 void preFflush(
const FnDescription *Desc,
const CallEvent &
Call,
541 void evalFflush(
const FnDescription *Desc,
const CallEvent &
Call,
544 void evalFileno(
const FnDescription *Desc,
const CallEvent &
Call,
596 for (
auto *
P :
Call.parameters()) {
599 T.getCanonicalType() != VaListType)
609 const std::string &Message)
const {
610 return C.getNoteTag([
this, StreamSym,
622 if (
const std::optional<int> OptInt =
627 if (
const std::optional<int> OptInt =
629 SeekSetVal = *OptInt;
630 if (
const std::optional<int> OptInt =
632 SeekEndVal = *OptInt;
633 if (
const std::optional<int> OptInt =
635 SeekCurVal = *OptInt;
639 VaListType =
C.getASTContext().getBuiltinVaListType().getCanonicalType();
649struct StreamOperationEvaluator {
654 const StreamState *SS =
nullptr;
656 StreamErrorState NewES;
659 : SVB(
C.getSValBuilder()), ACtx(
C.getASTContext()) {
665 StreamSym = getStreamArg(Desc,
Call).getAsSymbol();
668 SS = State->get<StreamMap>(StreamSym);
671 NewES = SS->ErrorState;
672 CE = dyn_cast_or_null<CallExpr>(
Call.getOriginExpr());
676 assertStreamStateOpened(SS);
681 bool isStreamEof()
const {
return SS->ErrorState == ErrorFEof; }
688 const StreamState &NewSS) {
689 NewES = NewSS.ErrorState;
690 return State->set<StreamMap>(StreamSym, NewSS);
695 return State->BindExpr(CE,
C.getLocationContext(), RetVal);
700 return State->BindExpr(CE,
C.getLocationContext(),
706 return State->BindExpr(CE,
C.getLocationContext(), Val);
711 return State->BindExpr(CE,
C.getLocationContext(),
712 C.getSValBuilder().makeNullWithType(CE->
getType()));
722 return State->assume(*Cond,
true);
728 State = State->BindExpr(CE,
C.getLocationContext(), RetVal);
729 return C.getConstraintManager().assumeDual(State, RetVal);
733 bool SetFeof = NewES.FEof && !SS->ErrorState.FEof;
734 bool SetFerror = NewES.FError && !SS->ErrorState.FError;
735 if (SetFeof && !SetFerror)
736 return Ch->constructSetEofNoteTag(
C, StreamSym);
737 if (!SetFeof && SetFerror)
738 return Ch->constructSetErrorNoteTag(
C, StreamSym);
739 if (SetFeof && SetFerror)
740 return Ch->constructSetEofOrErrorNoteTag(
C, StreamSym);
759 bool isClosingCallAsWritten(
const CallExpr &
Call)
const {
760 const auto *StreamChk =
static_cast<const StreamChecker *
>(&
Checker);
761 return StreamChk->FCloseDesc.matchesAsWritten(
Call);
767 const FunctionDecl *FD = dyn_cast<FunctionDecl>(Callee);
772 if (
const auto *
Call = Match.getNodeAs<
CallExpr>(
"call"))
773 if (isClosingCallAsWritten(*
Call))
783 return CallEnterState->get<StreamMap>(
Sym) !=
784 CallExitEndState->get<StreamMap>(Sym);
790 N->
getState()->getStateManager().getContext().getSourceManager());
791 return std::make_shared<PathDiagnosticEventPiece>(
792 L,
"Returning without closing stream object or storing it for later "
809 if (!State->get<StreamMap>(StreamSym))
815 if (!State->get<StreamMap>(StreamSym))
825 SValBuilder &SVB = State->getStateManager().getSValBuilder();
827 return Int->tryExtValue();
836 unsigned BlockCount,
const SubRegion *Buffer,
837 QualType ElemType, int64_t StartIndex,
838 int64_t ElementCount) {
839 constexpr auto DoNotInvalidateSuperRegion =
840 RegionAndSymbolInvalidationTraits::InvalidationKinds::
841 TK_DoNotInvalidateSuperRegion;
844 const ASTContext &Ctx = State->getStateManager().getContext();
845 SValBuilder &SVB = State->getStateManager().getSValBuilder();
849 EscapingVals.reserve(ElementCount);
852 for (
auto Idx : llvm::seq(StartIndex, StartIndex + ElementCount)) {
854 const auto *Element =
855 RegionManager.getElementRegion(ElemType, Index, Buffer, Ctx);
857 ITraits.
setTrait(Element, DoNotInvalidateSuperRegion);
859 return State->invalidateRegions(
860 EscapingVals,
Call.getOriginExpr(), BlockCount, LCtx,
862 nullptr, &
Call, &ITraits);
868 auto GetArgSVal = [&
Call](
int Idx) {
return Call.getArgSVal(Idx); };
869 auto EscapingVals = to_vector(map_range(EscapingArgs, GetArgSVal));
870 State = State->invalidateRegions(EscapingVals,
Call.getOriginExpr(),
871 C.blockCount(),
C.getLocationContext(),
886 const FnDescription *Desc = lookupFn(
Call);
887 if (!Desc || !Desc->PreFn)
890 Desc->PreFn(
this, Desc,
Call,
C);
894 const FnDescription *Desc = lookupFn(
Call);
895 if (!Desc && TestMode)
897 if (!Desc || !Desc->EvalFn)
900 Desc->EvalFn(
this, Desc,
Call,
C);
902 return C.isDifferent();
911 const auto *LCtx =
C.getLocationContext();
912 auto &StoreMgr =
C.getStoreManager();
913 auto &SVB =
C.getSValBuilder();
914 SVal VarValue = State->getSVal(StoreMgr.getLValueVar(Var, LCtx));
917 .castAs<DefinedOrUnknownSVal>();
918 return State->assume(NoAliasState,
true);
922 State = assumeRetNE(State, StdinDecl);
923 State = assumeRetNE(State, StdoutDecl);
924 State = assumeRetNE(State, StderrDecl);
929void StreamChecker::evalFopen(
const FnDescription *Desc,
const CallEvent &
Call,
932 const CallExpr *CE = dyn_cast_or_null<CallExpr>(
Call.getOriginExpr());
938 assert(RetSym &&
"RetVal must be a symbol here.");
940 State = State->BindExpr(CE,
C.getLocationContext(), RetVal);
941 State = assumeNoAliasingWithStdStreams(State, RetVal,
C);
946 std::tie(StateNotNull, StateNull) =
947 C.getConstraintManager().assumeDual(State, RetVal);
950 StateNotNull->set<StreamMap>(RetSym, StreamState::getOpened(Desc));
952 StateNull->set<StreamMap>(RetSym, StreamState::getOpenFailed(Desc));
954 C.addTransition(StateNotNull,
955 constructLeakNoteTag(
C, RetSym,
"Stream opened here"));
956 C.addTransition(StateNull);
959void StreamChecker::preFreopen(
const FnDescription *Desc,
const CallEvent &
Call,
963 State = ensureStreamNonNull(getStreamArg(Desc,
Call),
964 Call.getArgExpr(Desc->StreamArgNo),
C, State);
968 C.addTransition(State);
971void StreamChecker::evalFreopen(
const FnDescription *Desc,
976 auto *CE = dyn_cast_or_null<CallExpr>(
Call.getOriginExpr());
980 std::optional<DefinedSVal> StreamVal =
985 SymbolRef StreamSym = StreamVal->getAsSymbol();
992 if (!State->get<StreamMap>(StreamSym))
1000 State->BindExpr(CE,
C.getLocationContext(), *StreamVal);
1004 State->BindExpr(CE,
C.getLocationContext(),
1005 C.getSValBuilder().makeNullWithType(CE->
getType()));
1008 StateRetNotNull->set<StreamMap>(StreamSym, StreamState::getOpened(Desc));
1010 StateRetNull->set<StreamMap>(StreamSym, StreamState::getOpenFailed(Desc));
1012 C.addTransition(StateRetNotNull,
1013 constructLeakNoteTag(
C, StreamSym,
"Stream reopened here"));
1014 C.addTransition(StateRetNull);
1017void StreamChecker::evalFclose(
const FnDescription *Desc,
const CallEvent &
Call,
1020 StreamOperationEvaluator
E(
C);
1021 if (!
E.Init(Desc,
Call,
C, State))
1027 State =
E.setStreamState(State, StreamState::getClosed(Desc));
1030 C.addTransition(
E.bindReturnValue(State,
C, 0));
1031 C.addTransition(
E.bindReturnValue(State,
C, *EofVal));
1034void StreamChecker::preRead(
const FnDescription *Desc,
const CallEvent &
Call,
1037 SVal StreamVal = getStreamArg(Desc,
Call);
1038 State = ensureStreamNonNull(StreamVal,
Call.getArgExpr(Desc->StreamArgNo),
C,
1042 State = ensureStreamOpened(StreamVal,
C, State);
1045 State = ensureNoFilePositionIndeterminate(StreamVal,
C, State);
1050 if (Sym && State->get<StreamMap>(Sym)) {
1051 const StreamState *SS = State->get<StreamMap>(Sym);
1052 if (SS->ErrorState & ErrorFEof)
1053 reportFEofWarning(Sym,
C, State);
1055 C.addTransition(State);
1059void StreamChecker::preWrite(
const FnDescription *Desc,
const CallEvent &
Call,
1062 SVal StreamVal = getStreamArg(Desc,
Call);
1063 State = ensureStreamNonNull(StreamVal,
Call.getArgExpr(Desc->StreamArgNo),
C,
1067 State = ensureStreamOpened(StreamVal,
C, State);
1070 State = ensureNoFilePositionIndeterminate(StreamVal,
C, State);
1074 C.addTransition(State);
1080 if (
const auto *ER = dyn_cast<ElementRegion>(R))
1081 return ER->getElementType();
1082 if (
const auto *TR = dyn_cast<TypedValueRegion>(R))
1083 return TR->getValueType();
1084 if (
const auto *SR = dyn_cast<SymbolicRegion>(R))
1085 return SR->getPointeeStaticType();
1092 return std::nullopt;
1094 auto Zero = [&SVB] {
1099 if (
const auto *ER = dyn_cast<ElementRegion>(R))
1100 return ER->getIndex();
1101 if (isa<TypedValueRegion>(R))
1103 if (isa<SymbolicRegion>(R))
1105 return std::nullopt;
1113 const auto *Buffer =
1114 dyn_cast_or_null<SubRegion>(
Call.getArgSVal(0).getAsRegion());
1118 std::optional<SVal> StartElementIndex =
1122 if (
const auto *ER = dyn_cast_or_null<ElementRegion>(Buffer))
1123 Buffer = dyn_cast<SubRegion>(ER->getSuperRegion());
1125 std::optional<int64_t> CountVal =
getKnownValue(State, NMembVal);
1126 std::optional<int64_t> Size =
getKnownValue(State, SizeVal);
1127 std::optional<int64_t> StartIndexVal =
1130 if (!ElemTy.
isNull() && CountVal && Size && StartIndexVal) {
1131 int64_t NumBytesRead = Size.value() * CountVal.value();
1133 if (ElemSizeInChars == 0)
1136 bool IncompleteLastElement = (NumBytesRead % ElemSizeInChars) != 0;
1137 int64_t NumCompleteOrIncompleteElementsRead =
1138 NumBytesRead / ElemSizeInChars + IncompleteLastElement;
1140 constexpr int MaxInvalidatedElementsLimit = 64;
1141 if (NumCompleteOrIncompleteElementsRead <= MaxInvalidatedElementsLimit) {
1143 ElemTy, *StartIndexVal,
1144 NumCompleteOrIncompleteElementsRead);
1150void StreamChecker::evalFreadFwrite(
const FnDescription *Desc,
1152 bool IsFread)
const {
1154 StreamOperationEvaluator
E(
C);
1155 if (!
E.Init(Desc,
Call,
C, State))
1158 std::optional<NonLoc> SizeVal =
Call.getArgSVal(1).getAs<
NonLoc>();
1161 std::optional<NonLoc> NMembVal =
Call.getArgSVal(2).getAs<
NonLoc>();
1170 if (State->isNull(*SizeVal).isConstrainedTrue() ||
1171 State->isNull(*NMembVal).isConstrainedTrue()) {
1174 C.addTransition(
E.bindReturnValue(State,
C, 0));
1180 if (IsFread && !
E.isStreamEof()) {
1184 State,
C,
Call, *SizeVal, *NMembVal);
1186 InvalidatedState ? InvalidatedState :
escapeArgs(State,
C,
Call, {0});
1191 if (!IsFread || !
E.isStreamEof()) {
1193 State->BindExpr(
E.CE,
C.getLocationContext(), *NMembVal);
1195 E.setStreamState(StateNotFailed, StreamState::getOpened(Desc));
1196 C.addTransition(StateNotFailed);
1201 if (!IsFread && !PedanticMode)
1206 State->BindExpr(
E.CE,
C.getLocationContext(), RetVal);
1207 StateFailed =
E.assumeBinOpNN(StateFailed, BO_LT, RetVal, *NMembVal);
1211 StreamErrorState NewES;
1213 NewES =
E.isStreamEof() ? ErrorFEof : ErrorFEof | ErrorFError;
1215 NewES = ErrorFError;
1218 StateFailed =
E.setStreamState(
1219 StateFailed, StreamState::getOpened(Desc, NewES, !NewES.isFEof()));
1220 C.addTransition(StateFailed,
E.getFailureNoteTag(
this,
C));
1223void StreamChecker::evalFgetx(
const FnDescription *Desc,
const CallEvent &
Call,
1229 StreamOperationEvaluator
E(
C);
1230 if (!
E.Init(Desc,
Call,
C, State))
1233 if (!
E.isStreamEof()) {
1241 State->BindExpr(
E.CE,
C.getLocationContext(), RetVal);
1244 StateNotFailed = StateNotFailed->assumeInclusiveRange(
1246 E.SVB.getBasicValueFactory().getValue(0,
E.ACtx.UnsignedCharTy),
1247 E.SVB.getBasicValueFactory().getMaxValue(
E.ACtx.UnsignedCharTy),
1249 if (!StateNotFailed)
1251 C.addTransition(StateNotFailed);
1254 std::optional<DefinedSVal> GetBuf =
1259 State->BindExpr(
E.CE,
C.getLocationContext(), *GetBuf);
1261 E.setStreamState(StateNotFailed, StreamState::getOpened(Desc));
1262 C.addTransition(StateNotFailed);
1269 StateFailed =
E.bindReturnValue(State,
C, *EofVal);
1271 StateFailed =
E.bindNullReturnValue(State,
C);
1275 StreamErrorState NewES =
1276 E.isStreamEof() ? ErrorFEof : ErrorFEof | ErrorFError;
1277 StateFailed =
E.setStreamState(
1278 StateFailed, StreamState::getOpened(Desc, NewES, !NewES.isFEof()));
1279 C.addTransition(StateFailed,
E.getFailureNoteTag(
this,
C));
1282void StreamChecker::evalFputx(
const FnDescription *Desc,
const CallEvent &
Call,
1288 StreamOperationEvaluator
E(
C);
1289 if (!
E.Init(Desc,
Call,
C, State))
1294 std::optional<NonLoc> PutVal =
Call.getArgSVal(0).getAs<
NonLoc>();
1298 State->BindExpr(
E.CE,
C.getLocationContext(), *PutVal);
1300 E.setStreamState(StateNotFailed, StreamState::getOpened(Desc));
1301 C.addTransition(StateNotFailed);
1306 State->BindExpr(
E.CE,
C.getLocationContext(), RetVal);
1308 E.assumeBinOpNN(StateNotFailed, BO_GE, RetVal,
E.getZeroVal(
Call));
1309 if (!StateNotFailed)
1312 E.setStreamState(StateNotFailed, StreamState::getOpened(Desc));
1313 C.addTransition(StateNotFailed);
1322 StateFailed =
E.setStreamState(
1323 StateFailed, StreamState::getOpened(Desc, ErrorFError,
true));
1324 C.addTransition(StateFailed,
E.getFailureNoteTag(
this,
C));
1327void StreamChecker::evalFprintf(
const FnDescription *Desc,
1330 if (
Call.getNumArgs() < 2)
1334 StreamOperationEvaluator
E(
C);
1335 if (!
E.Init(Desc,
Call,
C, State))
1339 State = State->BindExpr(
E.CE,
C.getLocationContext(), RetVal);
1342 .evalBinOp(State, BO_GE, RetVal,
E.SVB.makeZeroVal(
E.ACtx.IntTy),
1343 E.SVB.getConditionType())
1344 .getAs<DefinedOrUnknownSVal>();
1348 std::tie(StateNotFailed, StateFailed) = State->assume(*Cond);
1351 E.setStreamState(StateNotFailed, StreamState::getOpened(Desc));
1352 C.addTransition(StateNotFailed);
1359 StateFailed =
E.setStreamState(
1360 StateFailed, StreamState::getOpened(Desc, ErrorFError,
true));
1361 C.addTransition(StateFailed,
E.getFailureNoteTag(
this,
C));
1364void StreamChecker::evalFscanf(
const FnDescription *Desc,
const CallEvent &
Call,
1366 if (
Call.getNumArgs() < 2)
1370 StreamOperationEvaluator
E(
C);
1371 if (!
E.Init(Desc,
Call,
C, State))
1382 if (!
E.isStreamEof()) {
1385 State->BindExpr(
E.CE,
C.getLocationContext(), RetVal);
1387 E.assumeBinOpNN(StateNotFailed, BO_GE, RetVal,
E.getZeroVal(
Call));
1388 if (!StateNotFailed)
1391 if (
auto const *Callee =
Call.getCalleeIdentifier();
1394 for (
auto EscArg : llvm::seq(2u,
Call.getNumArgs()))
1395 EscArgs.push_back(EscArg);
1400 C.addTransition(StateNotFailed);
1410 StreamErrorState NewES =
1411 E.isStreamEof() ? ErrorFEof : ErrorNone | ErrorFEof | ErrorFError;
1412 StateFailed =
E.setStreamState(
1413 StateFailed, StreamState::getOpened(Desc, NewES, !NewES.isFEof()));
1414 C.addTransition(StateFailed,
E.getFailureNoteTag(
this,
C));
1417void StreamChecker::evalUngetc(
const FnDescription *Desc,
const CallEvent &
Call,
1420 StreamOperationEvaluator
E(
C);
1421 if (!
E.Init(Desc,
Call,
C, State))
1425 std::optional<NonLoc> PutVal =
Call.getArgSVal(0).getAs<
NonLoc>();
1430 E.setStreamState(StateNotFailed, StreamState::getOpened(Desc));
1431 C.addTransition(StateNotFailed);
1440 StateFailed =
E.setStreamState(StateFailed, StreamState::getOpened(Desc));
1441 C.addTransition(StateFailed);
1444void StreamChecker::evalGetdelim(
const FnDescription *Desc,
1448 StreamOperationEvaluator
E(
C);
1449 if (!
E.Init(Desc,
Call,
C, State))
1458 if (!
E.isStreamEof()) {
1467 E.assumeBinOpNN(StateNotFailed, BO_GE, RetVal,
E.getZeroVal(
Call));
1471 if (NewLinePtr && isa<DefinedOrUnknownSVal>(*NewLinePtr))
1472 StateNotFailed = StateNotFailed->assume(
1477 SVal SizePtrSval =
Call.getArgSVal(1);
1479 if (NVal && isa<NonLoc>(*NVal)) {
1480 StateNotFailed =
E.assumeBinOpNN(StateNotFailed, BO_GT,
1481 NVal->castAs<
NonLoc>(), RetVal);
1482 StateNotFailed =
E.bindReturnValue(StateNotFailed,
C, RetVal);
1484 if (!StateNotFailed)
1486 C.addTransition(StateNotFailed);
1493 StreamErrorState NewES =
1494 E.isStreamEof() ? ErrorFEof : ErrorFEof | ErrorFError;
1495 StateFailed =
E.setStreamState(
1496 StateFailed, StreamState::getOpened(Desc, NewES, !NewES.isFEof()));
1499 StateFailed = StateFailed->bindLoc(*NewLinePtr,
UndefinedVal(),
1500 C.getLocationContext());
1501 C.addTransition(StateFailed,
E.getFailureNoteTag(
this,
C));
1504void StreamChecker::preFseek(
const FnDescription *Desc,
const CallEvent &
Call,
1507 SVal StreamVal = getStreamArg(Desc,
Call);
1508 State = ensureStreamNonNull(StreamVal,
Call.getArgExpr(Desc->StreamArgNo),
C,
1512 State = ensureStreamOpened(StreamVal,
C, State);
1515 State = ensureFseekWhenceCorrect(
Call.getArgSVal(2),
C, State);
1519 C.addTransition(State);
1522void StreamChecker::evalFseek(
const FnDescription *Desc,
const CallEvent &
Call,
1525 StreamOperationEvaluator
E(
C);
1526 if (!
E.Init(Desc,
Call,
C, State))
1533 E.setStreamState(StateNotFailed, StreamState::getOpened(Desc));
1534 C.addTransition(StateNotFailed);
1546 StateFailed =
E.setStreamState(
1547 StateFailed, StreamState::getOpened(Desc, ErrorNone | ErrorFError,
true));
1548 C.addTransition(StateFailed,
E.getFailureNoteTag(
this,
C));
1551void StreamChecker::evalFgetpos(
const FnDescription *Desc,
1555 StreamOperationEvaluator
E(
C);
1556 if (!
E.Init(Desc,
Call,
C, State))
1560 std::tie(StateFailed, StateNotFailed) =
E.makeRetValAndAssumeDual(State,
C);
1566 C.addTransition(StateNotFailed);
1567 C.addTransition(StateFailed);
1570void StreamChecker::evalFsetpos(
const FnDescription *Desc,
1574 StreamOperationEvaluator
E(
C);
1575 if (!
E.Init(Desc,
Call,
C, State))
1579 std::tie(StateFailed, StateNotFailed) =
E.makeRetValAndAssumeDual(State,
C);
1581 StateNotFailed =
E.setStreamState(
1582 StateNotFailed, StreamState::getOpened(Desc, ErrorNone,
false));
1583 C.addTransition(StateNotFailed);
1592 StateFailed =
E.setStreamState(
1593 StateFailed, StreamState::getOpened(Desc, ErrorNone | ErrorFError,
true));
1595 C.addTransition(StateFailed,
E.getFailureNoteTag(
this,
C));
1598void StreamChecker::evalFtell(
const FnDescription *Desc,
const CallEvent &
Call,
1601 StreamOperationEvaluator
E(
C);
1602 if (!
E.Init(Desc,
Call,
C, State))
1607 State->BindExpr(
E.CE,
C.getLocationContext(), RetVal);
1609 E.assumeBinOpNN(StateNotFailed, BO_GE, RetVal,
E.getZeroVal(
Call));
1610 if (!StateNotFailed)
1618 C.addTransition(StateNotFailed);
1619 C.addTransition(StateFailed);
1622void StreamChecker::evalRewind(
const FnDescription *Desc,
const CallEvent &
Call,
1625 StreamOperationEvaluator
E(
C);
1626 if (!
E.Init(Desc,
Call,
C, State))
1630 E.setStreamState(State, StreamState::getOpened(Desc, ErrorNone,
false));
1631 C.addTransition(State);
1634void StreamChecker::preFflush(
const FnDescription *Desc,
const CallEvent &
Call,
1637 SVal StreamVal = getStreamArg(Desc,
Call);
1643 std::tie(StateNotNull, StateNull) =
1644 C.getConstraintManager().assumeDual(State, *Stream);
1645 if (StateNotNull && !StateNull)
1646 ensureStreamOpened(StreamVal,
C, StateNotNull);
1649void StreamChecker::evalFflush(
const FnDescription *Desc,
const CallEvent &
Call,
1652 SVal StreamVal = getStreamArg(Desc,
Call);
1659 std::tie(StateNotNull, StateNull) =
1660 C.getConstraintManager().assumeDual(State, *Stream);
1661 if (StateNotNull && StateNull)
1663 if (StateNotNull && !StateNull)
1664 State = StateNotNull;
1668 const CallExpr *CE = dyn_cast_or_null<CallExpr>(
Call.getOriginExpr());
1677 auto ClearErrorInNotFailed = [&StateNotFailed, Desc](
SymbolRef Sym,
1678 const StreamState *SS) {
1679 if (SS->ErrorState & ErrorFError) {
1680 StreamErrorState NewES =
1681 (SS->ErrorState & ErrorFEof) ? ErrorFEof : ErrorNone;
1682 StreamState NewSS = StreamState::getOpened(Desc, NewES,
false);
1683 StateNotFailed = StateNotFailed->set<StreamMap>(Sym, NewSS);
1687 if (StateNotNull && !StateNull) {
1690 const StreamState *SS = State->get<StreamMap>(StreamSym);
1692 assert(SS->isOpened() &&
"Stream is expected to be opened");
1693 ClearErrorInNotFailed(StreamSym, SS);
1699 const StreamMapTy &Map = StateNotFailed->get<StreamMap>();
1700 for (
const auto &I : Map) {
1702 const StreamState &SS = I.second;
1704 ClearErrorInNotFailed(Sym, &SS);
1708 C.addTransition(StateNotFailed);
1709 C.addTransition(StateFailed);
1712void StreamChecker::evalClearerr(
const FnDescription *Desc,
1716 StreamOperationEvaluator
E(
C);
1717 if (!
E.Init(Desc,
Call,
C, State))
1721 State =
E.setStreamState(
1723 StreamState::getOpened(Desc, ErrorNone,
E.SS->FilePositionIndeterminate));
1724 C.addTransition(State);
1727void StreamChecker::evalFeofFerror(
const FnDescription *Desc,
1729 const StreamErrorState &ErrorKind)
const {
1731 StreamOperationEvaluator
E(
C);
1732 if (!
E.Init(Desc,
Call,
C, State))
1735 if (
E.SS->ErrorState & ErrorKind) {
1740 C.addTransition(
E.setStreamState(
1741 TrueState, StreamState::getOpened(Desc, ErrorKind,
1742 E.SS->FilePositionIndeterminate &&
1743 !ErrorKind.isFEof())));
1745 if (StreamErrorState NewES =
E.SS->ErrorState & (~ErrorKind)) {
1750 C.addTransition(
E.setStreamState(
1752 StreamState::getOpened(
1753 Desc, NewES,
E.SS->FilePositionIndeterminate && !NewES.isFEof())));
1757void StreamChecker::evalFileno(
const FnDescription *Desc,
const CallEvent &
Call,
1769 StreamOperationEvaluator
E(
C);
1770 if (!
E.Init(Desc,
Call,
C, State))
1774 State = State->BindExpr(
E.CE,
C.getLocationContext(), RetVal);
1775 State =
E.assumeBinOpNN(State, BO_GE, RetVal,
E.getZeroVal(
Call));
1779 C.addTransition(State);
1782void StreamChecker::preDefault(
const FnDescription *Desc,
const CallEvent &
Call,
1785 SVal StreamVal = getStreamArg(Desc,
Call);
1786 State = ensureStreamNonNull(StreamVal,
Call.getArgExpr(Desc->StreamArgNo),
C,
1790 State = ensureStreamOpened(StreamVal,
C, State);
1794 C.addTransition(State);
1797void StreamChecker::evalSetFeofFerror(
const FnDescription *Desc,
1799 const StreamErrorState &ErrorKind,
1800 bool Indeterminate)
const {
1802 SymbolRef StreamSym = getStreamArg(Desc,
Call).getAsSymbol();
1803 assert(StreamSym &&
"Operation not permitted on non-symbolic stream value.");
1804 const StreamState *SS = State->get<StreamMap>(StreamSym);
1805 assert(SS &&
"Stream should be tracked by the checker.");
1806 State = State->set<StreamMap>(
1808 StreamState::getOpened(SS->LastOperation, ErrorKind, Indeterminate));
1809 C.addTransition(State);
1813StreamChecker::ensureStreamNonNull(
SVal StreamVal,
const Expr *StreamE,
1823 std::tie(StateNotNull, StateNull) = CM.
assumeDual(State, *Stream);
1825 if (!StateNotNull && StateNull) {
1827 auto R = std::make_unique<PathSensitiveBugReport>(
1828 BT_FileNull,
"Stream pointer might be NULL.", N);
1831 C.emitReport(std::move(R));
1836 return StateNotNull;
1846 const StreamState *SS = State->get<StreamMap>(Sym);
1850 if (SS->isClosed()) {
1855 C.emitReport(std::make_unique<PathSensitiveBugReport>(
1857 "Stream might be already closed. Causes undefined behaviour.", N));
1864 if (SS->isOpenFailed()) {
1871 C.emitReport(std::make_unique<PathSensitiveBugReport>(
1872 BT_UseAfterOpenFailed,
1873 "Stream might be invalid after "
1874 "(re-)opening it has failed. "
1875 "Can cause undefined behaviour.",
1886 static const char *BugMessage =
1887 "File position of the stream might be 'indeterminate' "
1888 "after a failed operation. "
1889 "Can cause undefined behavior.";
1895 const StreamState *SS = State->get<StreamMap>(Sym);
1899 assert(SS->isOpened() &&
"First ensure that stream is opened.");
1901 if (SS->FilePositionIndeterminate) {
1902 if (SS->ErrorState & ErrorFEof) {
1910 auto R = std::make_unique<PathSensitiveBugReport>(
1911 BT_IndeterminatePosition, BugMessage, N);
1912 R->markInteresting(Sym);
1913 C.emitReport(std::move(R));
1914 return State->set<StreamMap>(
1915 Sym, StreamState::getOpened(SS->LastOperation, ErrorFEof,
false));
1921 auto R = std::make_unique<PathSensitiveBugReport>(
1922 BT_IndeterminatePosition, BugMessage, N);
1923 R->markInteresting(Sym);
1924 C.emitReport(std::move(R));
1936 std::optional<nonloc::ConcreteInt> CI =
1941 int64_t X = CI->getValue().getSExtValue();
1942 if (
X == SeekSetVal ||
X == SeekCurVal ||
X == SeekEndVal)
1946 C.emitReport(std::make_unique<PathSensitiveBugReport>(
1948 "The whence argument to fseek() should be "
1949 "SEEK_SET, SEEK_END, or SEEK_CUR.",
1960 auto R = std::make_unique<PathSensitiveBugReport>(
1962 "Read function called when stream is in EOF state. "
1963 "Function has no effect.",
1965 R->markInteresting(StreamSym);
1966 C.emitReport(std::move(R));
1969 C.addTransition(State);
1975 ExplodedNode *Err =
C.generateNonFatalErrorNode(
C.getState(), Pred);
1991 const ExplodedNode *StreamOpenNode = getAcquisitionSite(Err, LeakSym,
C);
1992 assert(StreamOpenNode &&
"Could not find place of stream opening.");
1997 StreamStmt,
C.getSourceManager(),
2000 std::unique_ptr<PathSensitiveBugReport> R =
2001 std::make_unique<PathSensitiveBugReport>(
2003 "Opened stream never closed. Potential resource leak.", Err,
2004 LocUsedForUniqueing,
2006 R->markInteresting(LeakSym);
2007 R->addVisitor<NoStreamStateChangeVisitor>(LeakSym,
this);
2008 C.emitReport(std::move(R));
2014void StreamChecker::checkDeadSymbols(
SymbolReaper &SymReaper,
2020 const StreamMapTy &Map = State->get<StreamMap>();
2021 for (
const auto &I : Map) {
2023 const StreamState &SS = I.second;
2024 if (!SymReaper.
isDead(Sym))
2027 LeakedSyms.push_back(Sym);
2028 State = State->remove<StreamMap>(Sym);
2032 if (!LeakedSyms.empty())
2033 N = reportLeaks(LeakedSyms,
C, N);
2035 C.addTransition(State, N);
2055 State = State->remove<StreamMap>(Sym);
2072 for (
const Decl *
D : LookupRes) {
2073 if (
auto *VD = dyn_cast_or_null<VarDecl>(
D)) {
2074 if (
SM.isInSystemHeader(VD->getLocation()) && VD->hasExternalStorage() &&
2075 VD->getType().getCanonicalType() == FilePtrTy) {
2100bool ento::shouldRegisterStreamChecker(
const CheckerManager &Mgr) {
2109bool ento::shouldRegisterStreamTesterChecker(
const CheckerManager &Mgr) {
static void dump(llvm::raw_ostream &OS, StringRef FunctionName, ArrayRef< CounterExpression > Expressions, ArrayRef< CounterMappingRegion > Regions)
#define REGISTER_MAP_WITH_PROGRAMSTATE(Name, Key, Value)
Declares an immutable map of type NameTy, suitable for placement into the ProgramState.
static const VarDecl * getGlobalStreamPointerByName(const TranslationUnitDecl *TU, StringRef VarName)
static ProgramStateRef tryToInvalidateFReadBufferByElements(ProgramStateRef State, CheckerContext &C, const CallEvent &Call, NonLoc SizeVal, NonLoc NMembVal)
static QualType getPointeeType(const MemRegion *R)
static std::optional< int64_t > getKnownValue(ProgramStateRef State, SVal V)
static ProgramStateRef escapeArgs(ProgramStateRef State, CheckerContext &C, const CallEvent &Call, ArrayRef< unsigned int > EscapingArgs)
static std::optional< NonLoc > getStartIndex(SValBuilder &SVB, const MemRegion *R)
static ProgramStateRef escapeByStartIndexAndCount(ProgramStateRef State, const CallEvent &Call, unsigned BlockCount, const SubRegion *Buffer, QualType ElemType, int64_t StartIndex, int64_t ElementCount)
Invalidate only the requested elements instead of the whole buffer.
Holds long-lived AST nodes (such as types and decls) that can be referred to throughout the semantic ...
SourceManager & getSourceManager()
QualType getFILEType() const
Retrieve the C FILE type.
QualType getPointerType(QualType T) const
Return the uniqued reference to the type for a pointer to the specified type.
CharUnits getTypeSizeInChars(QualType T) const
Return the size of the specified (complete) type T, in characters.
bool getCheckerBooleanOption(StringRef CheckerName, StringRef OptionName, bool SearchInParents=false) const
Interprets an option's string value as a boolean.
CallExpr - Represents a function call (C99 6.5.2.2, C++ [expr.call]).
QualType getCallReturnType(const ASTContext &Ctx) const
getCallReturnType - Get the return type of the call expr.
QuantityType getQuantity() const
getQuantity - Get the raw integer representation of this quantity.
lookup_result lookup(DeclarationName Name) const
lookup - Find the declarations (if any) with the given Name in this context.
Decl - This represents one declaration (or definition), e.g.
This represents one expression.
Represents a function declaration or definition.
Stmt * getBody(const FunctionDecl *&Definition) const
Retrieve the body (definition) of the function.
IdentifierInfo & get(StringRef Name)
Return the identifier token info for the specified named identifier.
It wraps the AnalysisDeclContext to represent both the call stack with the help of StackFrameContext ...
const Decl * getDecl() const
A (possibly-)qualified type.
bool isNull() const
Return true if this QualType doesn't point to a type yet.
QualType getCanonicalType() const
Stmt - This represents one statement.
The top declaration context.
ASTContext & getASTContext() const
bool isPointerType() const
bool isIntegralOrEnumerationType() const
Determine whether this type is an integral or enumeration type.
Represents a variable declaration or definition.
Maps string IDs to AST nodes matched by parts of a matcher.
const llvm::APSInt & getIntValue(uint64_t X, bool isUnsigned)
const BugType & getBugType() const
BugReporter is a utility class for generating PathDiagnostics for analysis.
An immutable map from CallDescriptions to arbitrary data.
const T * lookup(const CallEvent &Call) const
A CallDescription is a pattern that can be used to match calls based on the qualified name and the ar...
Represents an abstract call to a function or method along a particular path.
const AnalyzerOptions & getAnalyzerOptions() const
CHECKER * registerChecker(AT &&... Args)
Used to register checkers.
ProgramStatePair assumeDual(ProgramStateRef State, DefinedSVal Cond)
Returns a pair of states (StTrue, StFalse) where the given condition is assumed to be true or false,...
std::pair< ProgramStateRef, ProgramStateRef > ProgramStatePair
const ProgramStateRef & getState() const
const Stmt * getStmtForDiagnostics() const
If the node's program point corresponds to a statement, retrieve that statement.
ProgramPoint getLocation() const
getLocation - Returns the edge associated with the given node.
const LocationContext * getLocationContext() const
ExplodedNode * getFirstPred()
MemRegion - The root abstract class for all memory regions.
virtual bool doesFnIntendToHandleOwnership(const Decl *Callee, ASTContext &ACtx)=0
Heuristically guess whether the callee intended to free the resource.
const CheckerBase & Checker
virtual PathDiagnosticPieceRef emitNote(const ExplodedNode *N)=0
virtual bool hasResourceStateChanged(ProgramStateRef CallEnterState, ProgramStateRef CallExitEndState)=0
The tag upon which the TagVisitor reacts.
static PathDiagnosticLocation createBegin(const Decl *D, const SourceManager &SM)
Create a location for the beginning of the declaration.
static PathDiagnosticLocation create(const Decl *D, const SourceManager &SM)
Create a location corresponding to the given declaration.
void markNotInteresting(SymbolRef sym)
bool isInteresting(SymbolRef sym) const
Information about invalidation for a particular region/symbol.
void setTrait(SymbolRef Sym, InvalidationKinds IK)
DefinedOrUnknownSVal makeZeroVal(QualType type)
Construct an SVal representing '0' for the specified type.
virtual const llvm::APSInt * getKnownValue(ProgramStateRef state, SVal val)=0
Evaluates a given SVal.
BasicValueFactory & getBasicValueFactory()
NonLoc makeArrayIndex(uint64_t idx)
nonloc::ConcreteInt makeIntVal(const IntegerLiteral *integer)
virtual SVal evalBinOpNN(ProgramStateRef state, BinaryOperator::Opcode op, NonLoc lhs, NonLoc rhs, QualType resultTy)=0
Create a new value which represents a binary expression with two non- location operands.
QualType getConditionType() const
SVal evalBinOp(ProgramStateRef state, BinaryOperator::Opcode op, SVal lhs, SVal rhs, QualType type)
SVal - This represents a symbolic expression, which can be either an L-value or an R-value.
SymbolRef getAsSymbol(bool IncludeBaseRegions=false) const
If this SVal wraps a symbol return that SymbolRef.
std::optional< T > getAs() const
Convert to the specified SVal type, returning std::nullopt if this SVal is not of the desired type.
T castAs() const
Convert to the specified SVal type, asserting that this SVal is of the desired type.
SubRegion - A region that subsets another larger region.
MemRegionManager & getMemRegionManager() const override
A class responsible for cleaning up unused symbols.
bool isDead(SymbolRef sym)
Returns whether or not a symbol has been confirmed dead.
Value representing integer constant.
__inline void unsigned int _2
const internal::VariadicDynCastAllOfMatcher< Stmt, CallExpr > callExpr
Matches call expressions.
SmallVector< BoundNodes, 1 > match(MatcherT Matcher, const NodeT &Node, ASTContext &Context)
Returns the results of matching Matcher on Node.
internal::Matcher< T > findAll(const internal::Matcher< T > &Matcher)
Matches if the node or any descendant matches.
bool trackExpressionValue(const ExplodedNode *N, const Expr *E, PathSensitiveBugReport &R, TrackingOptions Opts={})
Attempts to add visitors to track expression value back to its point of origin.
PointerEscapeKind
Describes the different reasons a pointer escapes during analysis.
@ PSK_DirectEscapeOnCall
The pointer has been passed to a function call directly.
std::optional< SVal > getPointeeVal(SVal PtrSVal, ProgramStateRef State)
std::optional< int > tryExpandAsInteger(StringRef Macro, const Preprocessor &PP)
Try to parse the value of a defined preprocessor macro.
std::shared_ptr< PathDiagnosticPiece > PathDiagnosticPieceRef
The JSON file list parser is used to communicate input to InstallAPI.
if(T->getSizeExpr()) TRY_TO(TraverseStmt(const_cast< Expr * >(T -> getSizeExpr())))
bool operator==(const CallGraphNode::CallRecord &LHS, const CallGraphNode::CallRecord &RHS)
DiagnosticLevelMask operator&(DiagnosticLevelMask LHS, DiagnosticLevelMask RHS)
DiagnosticLevelMask operator~(DiagnosticLevelMask M)
DiagnosticLevelMask operator|(DiagnosticLevelMask LHS, DiagnosticLevelMask RHS)
bool operator!=(CanQual< T > x, CanQual< U > y)
const FunctionProtoType * T