clang 18.0.0git
UndefinedAssignmentChecker.cpp
Go to the documentation of this file.
1//===--- UndefinedAssignmentChecker.h ---------------------------*- C++ -*--==//
2//
3// Part of the LLVM Project, under the Apache License v2.0 with LLVM Exceptions.
4// See https://llvm.org/LICENSE.txt for license information.
5// SPDX-License-Identifier: Apache-2.0 WITH LLVM-exception
6//
7//===----------------------------------------------------------------------===//
8//
9// This defines UndefinedAssignmentChecker, a builtin check in ExprEngine that
10// checks for assigning undefined values.
11//
12//===----------------------------------------------------------------------===//
13
19
20using namespace clang;
21using namespace ento;
22
23namespace {
24class UndefinedAssignmentChecker
25 : public Checker<check::Bind> {
26 mutable std::unique_ptr<BugType> BT;
27
28public:
29 void checkBind(SVal location, SVal val, const Stmt *S,
30 CheckerContext &C) const;
31};
32}
33
34void UndefinedAssignmentChecker::checkBind(SVal location, SVal val,
35 const Stmt *StoreE,
36 CheckerContext &C) const {
37 if (!val.isUndef())
38 return;
39
40 // Do not report assignments of uninitialized values inside swap functions.
41 // This should allow to swap partially uninitialized structs
42 if (const FunctionDecl *EnclosingFunctionDecl =
43 dyn_cast<FunctionDecl>(C.getStackFrame()->getDecl()))
44 if (C.getCalleeName(EnclosingFunctionDecl) == "swap")
45 return;
46
47 ExplodedNode *N = C.generateErrorNode();
48
49 if (!N)
50 return;
51
52 static const char *const DefaultMsg =
53 "Assigned value is garbage or undefined";
54 if (!BT)
55 BT.reset(new BugType(this, DefaultMsg));
56
57 // Generate a report for this bug.
59 llvm::raw_svector_ostream OS(Str);
60
61 const Expr *ex = nullptr;
62
63 while (StoreE) {
64 if (const UnaryOperator *U = dyn_cast<UnaryOperator>(StoreE)) {
65 OS << "The expression is an uninitialized value. "
66 "The computed value will also be garbage";
67
68 ex = U->getSubExpr();
69 break;
70 }
71
72 if (const BinaryOperator *B = dyn_cast<BinaryOperator>(StoreE)) {
73 if (B->isCompoundAssignmentOp()) {
74 if (C.getSVal(B->getLHS()).isUndef()) {
75 OS << "The left expression of the compound assignment is an "
76 "uninitialized value. The computed value will also be garbage";
77 ex = B->getLHS();
78 break;
79 }
80 }
81
82 ex = B->getRHS();
83 break;
84 }
85
86 if (const DeclStmt *DS = dyn_cast<DeclStmt>(StoreE)) {
87 const VarDecl *VD = cast<VarDecl>(DS->getSingleDecl());
88 ex = VD->getInit();
89 }
90
91 if (const auto *CD =
92 dyn_cast<CXXConstructorDecl>(C.getStackFrame()->getDecl())) {
93 if (CD->isImplicit()) {
94 for (auto *I : CD->inits()) {
95 if (I->getInit()->IgnoreImpCasts() == StoreE) {
96 OS << "Value assigned to field '" << I->getMember()->getName()
97 << "' in implicit constructor is garbage or undefined";
98 break;
99 }
100 }
101 }
102 }
103
104 break;
105 }
106
107 if (OS.str().empty())
108 OS << DefaultMsg;
109
110 auto R = std::make_unique<PathSensitiveBugReport>(*BT, OS.str(), N);
111 if (ex) {
112 R->addRange(ex->getSourceRange());
114 }
115 C.emitReport(std::move(R));
116}
117
118void ento::registerUndefinedAssignmentChecker(CheckerManager &mgr) {
119 mgr.registerChecker<UndefinedAssignmentChecker>();
120}
121
122bool ento::shouldRegisterUndefinedAssignmentChecker(const CheckerManager &mgr) {
123 return true;
124}
A builtin binary operation expression such as "x + y" or "x <= y".
Definition: Expr.h:3862
DeclStmt - Adaptor class for mixing declarations with statements and expressions.
Definition: Stmt.h:1493
This represents one expression.
Definition: Expr.h:110
Represents a function declaration or definition.
Definition: Decl.h:1957
Stmt - This represents one statement.
Definition: Stmt.h:84
SourceRange getSourceRange() const LLVM_READONLY
SourceLocation tokens are not useful in isolation - they are low level value objects created/interpre...
Definition: Stmt.cpp:325
UnaryOperator - This represents the unary-expression's (except sizeof and alignof),...
Definition: Expr.h:2210
Represents a variable declaration or definition.
Definition: Decl.h:916
const Expr * getInit() const
Definition: Decl.h:1350
CHECKER * registerChecker(AT &&... Args)
Used to register checkers.
SVal - This represents a symbolic expression, which can be either an L-value or an R-value.
Definition: SVals.h:55
bool isUndef() const
Definition: SVals.h:104
bool trackExpressionValue(const ExplodedNode *N, const Expr *E, PathSensitiveBugReport &R, TrackingOptions Opts={})
Attempts to add visitors to track expression value back to its point of origin.