clang 19.0.0git
UndefResultChecker.cpp
Go to the documentation of this file.
1//=== UndefResultChecker.cpp ------------------------------------*- C++ -*-===//
2//
3// Part of the LLVM Project, under the Apache License v2.0 with LLVM Exceptions.
4// See https://llvm.org/LICENSE.txt for license information.
5// SPDX-License-Identifier: Apache-2.0 WITH LLVM-exception
6//
7//===----------------------------------------------------------------------===//
8//
9// This defines UndefResultChecker, a builtin check in ExprEngine that
10// performs checks for undefined results of non-assignment binary operators.
11//
12//===----------------------------------------------------------------------===//
13
21#include "llvm/ADT/SmallString.h"
22#include "llvm/Support/raw_ostream.h"
23
24using namespace clang;
25using namespace ento;
26
27namespace {
28class UndefResultChecker
29 : public Checker< check::PostStmt<BinaryOperator> > {
30
31 const BugType BT{this, "Result of operation is garbage or undefined"};
32
33public:
34 void checkPostStmt(const BinaryOperator *B, CheckerContext &C) const;
35};
36} // end anonymous namespace
37
38static bool isArrayIndexOutOfBounds(CheckerContext &C, const Expr *Ex) {
39 ProgramStateRef state = C.getState();
40
41 if (!isa<ArraySubscriptExpr>(Ex))
42 return false;
43
44 SVal Loc = C.getSVal(Ex);
45 if (!Loc.isValid())
46 return false;
47
49 const ElementRegion *ER = dyn_cast<ElementRegion>(MR);
50 if (!ER)
51 return false;
52
55 state, ER->getSuperRegion(), C.getSValBuilder(), ER->getValueType());
56 ProgramStateRef StInBound, StOutBound;
57 std::tie(StInBound, StOutBound) = state->assumeInBoundDual(Idx, ElementCount);
58 return StOutBound && !StInBound;
59}
60
61void UndefResultChecker::checkPostStmt(const BinaryOperator *B,
62 CheckerContext &C) const {
63 if (C.getSVal(B).isUndef()) {
64
65 // Do not report assignments of uninitialized values inside swap functions.
66 // This should allow to swap partially uninitialized structs
67 if (const FunctionDecl *EnclosingFunctionDecl =
68 dyn_cast<FunctionDecl>(C.getStackFrame()->getDecl()))
69 if (C.getCalleeName(EnclosingFunctionDecl) == "swap")
70 return;
71
72 // Generate an error node.
73 ExplodedNode *N = C.generateErrorNode();
74 if (!N)
75 return;
76
78 llvm::raw_svector_ostream OS(sbuf);
79 const Expr *Ex = nullptr;
80 bool isLeft = true;
81
82 if (C.getSVal(B->getLHS()).isUndef()) {
83 Ex = B->getLHS()->IgnoreParenCasts();
84 isLeft = true;
85 }
86 else if (C.getSVal(B->getRHS()).isUndef()) {
87 Ex = B->getRHS()->IgnoreParenCasts();
88 isLeft = false;
89 }
90
91 if (Ex) {
92 OS << "The " << (isLeft ? "left" : "right") << " operand of '"
94 << "' is a garbage value";
96 OS << " due to array index out of bounds";
97 } else {
98 // Neither operand was undefined, but the result is undefined.
99 OS << "The result of the '"
101 << "' expression is undefined";
102 }
103 auto report = std::make_unique<PathSensitiveBugReport>(BT, OS.str(), N);
104 if (Ex) {
105 report->addRange(Ex->getSourceRange());
106 bugreporter::trackExpressionValue(N, Ex, *report);
107 }
108 else
110
111 C.emitReport(std::move(report));
112 }
113}
114
115void ento::registerUndefResultChecker(CheckerManager &mgr) {
116 mgr.registerChecker<UndefResultChecker>();
117}
118
119bool ento::shouldRegisterUndefResultChecker(const CheckerManager &mgr) {
120 return true;
121}
static const MemRegion * getRegion(const CallEvent &Call, const MutexDescriptor &Descriptor, bool IsLock)
static bool isArrayIndexOutOfBounds(CheckerContext &C, const Expr *Ex)
A builtin binary operation expression such as "x + y" or "x <= y".
Definition: Expr.h:3845
Expr * getLHS() const
Definition: Expr.h:3894
StringRef getOpcodeStr() const
Definition: Expr.h:3910
Expr * getRHS() const
Definition: Expr.h:3896
Opcode getOpcode() const
Definition: Expr.h:3889
This represents one expression.
Definition: Expr.h:110
Expr * IgnoreParenCasts() LLVM_READONLY
Skip past any parentheses and casts which might surround this expression until reaching a fixed point...
Definition: Expr.cpp:3075
Represents a function declaration or definition.
Definition: Decl.h:1971
SourceRange getSourceRange() const LLVM_READONLY
SourceLocation tokens are not useful in isolation - they are low level value objects created/interpre...
Definition: Stmt.cpp:326
CHECKER * registerChecker(AT &&... Args)
Used to register checkers.
bool isValid() const =delete
ElementRegion is used to represent both array elements and casts.
Definition: MemRegion.h:1199
QualType getValueType() const override
Definition: MemRegion.h:1221
NonLoc getIndex() const
Definition: MemRegion.h:1219
MemRegion - The root abstract class for all memory regions.
Definition: MemRegion.h:97
SVal - This represents a symbolic expression, which can be either an L-value or an R-value.
Definition: SVals.h:55
T castAs() const
Convert to the specified SVal type, asserting that this SVal is of the desired type.
Definition: SVals.h:82
LLVM_ATTRIBUTE_RETURNS_NONNULL const MemRegion * getSuperRegion() const
Definition: MemRegion.h:459
bool trackExpressionValue(const ExplodedNode *N, const Expr *E, PathSensitiveBugReport &R, TrackingOptions Opts={})
Attempts to add visitors to track expression value back to its point of origin.
DefinedOrUnknownSVal getDynamicElementCount(ProgramStateRef State, const MemRegion *MR, SValBuilder &SVB, QualType Ty)
The JSON file list parser is used to communicate input to InstallAPI.