21 #include "llvm/ADT/SmallString.h"
22 #include "llvm/Support/raw_ostream.h"
24 using namespace clang;
28 class UndefResultChecker
29 :
public Checker< check::PostStmt<BinaryOperator> > {
31 mutable std::unique_ptr<BugType> BT;
34 void checkPostStmt(
const BinaryOperator *B, CheckerContext &C)
const;
41 if (!isa<ArraySubscriptExpr>(Ex))
44 SVal Loc = C.getSVal(Ex);
48 const MemRegion *MR = Loc.castAs<loc::MemRegionVal>().getRegion();
49 const ElementRegion *ER = dyn_cast<ElementRegion>(MR);
53 DefinedOrUnknownSVal Idx = ER->getIndex().castAs<DefinedOrUnknownSVal>();
55 state, ER->getSuperRegion(), C.getSValBuilder(), ER->getValueType());
57 std::tie(StInBound, StOutBound) =
state->assumeInBoundDual(Idx, ElementCount);
58 return StOutBound && !StInBound;
62 return C.isGreaterOrEqual(
68 SValBuilder &SB = C.getSValBuilder();
72 assert(LHS && RHS &&
"Values unknown, inconsistent state");
73 return (
unsigned)RHS->getZExtValue() > LHS->countLeadingZeros();
77 CheckerContext &C)
const {
78 if (
C.getSVal(B).isUndef()) {
84 dyn_cast<FunctionDecl>(
C.getStackFrame()->getDecl()))
85 if (
C.getCalleeName(EnclosingFunctionDecl) ==
"swap")
89 ExplodedNode *N =
C.generateErrorNode();
95 new BuiltinBug(
this,
"Result of operation is garbage or undefined"));
98 llvm::raw_svector_ostream
OS(sbuf);
99 const Expr *Ex =
nullptr;
102 if (
C.getSVal(B->
getLHS()).isUndef()) {
106 else if (
C.getSVal(B->
getRHS()).isUndef()) {
112 OS <<
"The " << (isLeft ?
"left" :
"right") <<
" operand of '"
114 <<
"' is a garbage value";
116 OS <<
" due to array index out of bounds";
119 if ((B->
getOpcode() == BinaryOperatorKind::BO_Shl ||
120 B->
getOpcode() == BinaryOperatorKind::BO_Shr) &&
122 OS <<
"The result of the "
123 << ((B->
getOpcode() == BinaryOperatorKind::BO_Shl) ?
"left"
125 <<
" shift is undefined because the right operand is negative";
127 }
else if ((B->
getOpcode() == BinaryOperatorKind::BO_Shl ||
128 B->
getOpcode() == BinaryOperatorKind::BO_Shr) &&
131 OS <<
"The result of the "
132 << ((B->
getOpcode() == BinaryOperatorKind::BO_Shl) ?
"left"
134 <<
" shift is undefined due to shifting by ";
137 SValBuilder &SB =
C.getSValBuilder();
139 SB.getKnownValue(
C.getState(),
C.getSVal(B->
getRHS()));
141 OS <<
"a value that is";
142 else if (I->isUnsigned())
143 OS <<
'\'' << I->getZExtValue() <<
"\', which is";
145 OS <<
'\'' << I->getSExtValue() <<
"\', which is";
147 OS <<
" greater or equal to the width of type '"
149 }
else if (B->
getOpcode() == BinaryOperatorKind::BO_Shl &&
151 OS <<
"The result of the left shift is undefined because the left "
152 "operand is negative";
154 }
else if (B->
getOpcode() == BinaryOperatorKind::BO_Shl &&
157 SValBuilder &SB =
C.getSValBuilder();
162 OS <<
"The result of the left shift is undefined due to shifting \'"
163 << LHS->getSExtValue() <<
"\' by \'" << RHS->getZExtValue()
164 <<
"\', which is unrepresentable in the unsigned version of "
168 OS <<
"The result of the '"
170 <<
"' expression is undefined";
173 auto report = std::make_unique<PathSensitiveBugReport>(*BT,
OS.str(), N);
181 C.emitReport(std::move(report));
185 void ento::registerUndefResultChecker(CheckerManager &mgr) {
186 mgr.registerChecker<UndefResultChecker>();
189 bool ento::shouldRegisterUndefResultChecker(
const CheckerManager &mgr) {