clang::ento::bounds::CheckResult Class Reference

Public Member Functions
bool	isCorruptedState () const
	When true, the bounds check noticed that the value of an unsigned expression is constrained to negative values (because the analyzer skipped the modeling of a cast expression).
bool	mayBeInBounds () const
	When true, the checked offset may be in bounds.
bool	mayUnderflow () const
	When true, the checked offset may be negative.
bool	mayOverflow () const
	When true, the checked offset may be >= the extent of the region.
bool	mayBeInvalid () const
	When true, the checked offset may be out of bounds.
NonLoc	getOffset () const
	Returns the offset of the accessed location from the beginning of the accessd region.
std::optional< NonLoc >	getExtentIfMayOverflow () const
	Returns the extent of the accessed region if it is relevant (because the offset may overflow it), otherwise returns std::nullopt.
ProgramStateRef	getInBoundsState () const
	Returns the program state that should be used for continuing the analysis after this bounds check.

Friends
CheckResult	checkBounds (ProgramStateRef State, SValBuilder &SVB, NonLoc Offset, std::optional< NonLoc > Extent, CheckFlags Flags)
	Checks the validity of accessing a memory region with extent Extent at offset Offset.

Detailed Description

Definition at line 137 of file ArrayBoundChecker.cpp.

Member Function Documentation

getExtentIfMayOverflow()

std::optional< NonLoc > clang::ento::bounds::CheckResult::getExtentIfMayOverflow ( ) const

inline

Returns the extent of the accessed region if it is relevant (because the offset may overflow it), otherwise returns std::nullopt.

Definition at line 167 of file ArrayBoundChecker.cpp.

Referenced by describeInvalidAccess(), and getAssumptionNote().

getInBoundsState()

ProgramStateRef clang::ento::bounds::CheckResult::getInBoundsState ( ) const

inline

Returns the program state that should be used for continuing the analysis after this bounds check.

This returns null if mayBeInBounds() is false, in that case the state before the check should be used in the error node. Note that we also have a valid state in the exception case when the 'access' calculates the past-the-end pointer without dereferencing it.

Definition at line 176 of file ArrayBoundChecker.cpp.

getOffset()

NonLoc clang::ento::bounds::CheckResult::getOffset ( ) const

inline

Returns the offset of the accessed location from the beginning of the accessd region.

Definition at line 163 of file ArrayBoundChecker.cpp.

Referenced by describeInvalidAccess(), and getAssumptionNote().

isCorruptedState()

bool clang::ento::bounds::CheckResult::isCorruptedState ( ) const

inline

When true, the bounds check noticed that the value of an unsigned expression is constrained to negative values (because the analyzer skipped the modeling of a cast expression).

This execution path must be discarded because it does not represent a real possibility. FIXME: This hack is currently needed to filter out many ugly false positives; but it should be removed when we fix cast modeling.

Definition at line 145 of file ArrayBoundChecker.cpp.

mayBeInBounds()

bool clang::ento::bounds::CheckResult::mayBeInBounds ( ) const

inline

When true, the checked offset may be in bounds.

As an exceptional case, this is also true for idiomatic expressions that define a past-the-end pointer (and do not dereference it).

Definition at line 150 of file ArrayBoundChecker.cpp.

mayBeInvalid()

bool clang::ento::bounds::CheckResult::mayBeInvalid ( ) const

inline

When true, the checked offset may be out of bounds.

Definition at line 159 of file ArrayBoundChecker.cpp.

mayOverflow()

bool clang::ento::bounds::CheckResult::mayOverflow ( ) const

inline

When true, the checked offset may be >= the extent of the region.

As an exceptional case, this is also false for idiomatic expressions that define a past-the-end pointer (and do not dereference it).

Definition at line 157 of file ArrayBoundChecker.cpp.

Referenced by describeInvalidAccess(), and getAssumptionNote().

mayUnderflow()

bool clang::ento::bounds::CheckResult::mayUnderflow ( ) const

inline

When true, the checked offset may be negative.

Definition at line 153 of file ArrayBoundChecker.cpp.

Referenced by describeInvalidAccess(), and getAssumptionNote().

Friends And Related Symbol Documentation

checkBounds

CheckResult checkBounds ( ProgramStateRef State, SValBuilder & SVB, NonLoc Offset, std::optional< NonLoc > Extent, CheckFlags Flags )

friend

Checks the validity of accessing a memory region with extent Extent at offset Offset.

The Flags influence the semantics of the check, in particular if AcceptPastTheEnd is true, then Offset == Extent is also accepted as valid.

---

The documentation for this class was generated from the following file:

• lib/StaticAnalyzer/Checkers/ArrayBoundChecker.cpp