22 using namespace clang;
28 const CheckerBase *Checker;
32 explicit CastToStructVisitor(BugReporter &B,
const CheckerBase *Checker,
34 : BR(B), Checker(Checker), AC(A) {}
35 bool VisitCastExpr(
const CastExpr *CE);
39 bool CastToStructVisitor::VisitCastExpr(
const CastExpr *CE) {
48 if (!ToPTy || !OrigPTy)
64 PathDiagnosticLocation Loc(CE, BR.getSourceManager(), AC);
66 AC->getDecl(), Checker,
"Cast from non-struct type to struct type",
68 "type and accessing a field can lead to memory " 69 "access errors or data corruption.",
74 if (!U || U->getOpcode() != UO_AddrOf)
79 if (
const auto *SE = dyn_cast<DeclRefExpr>(U->getSubExpr()))
81 else if (
const auto *SE = dyn_cast<MemberExpr>(U->getSubExpr()))
82 VD = SE->getMemberDecl();
93 if (ToWidth <= OrigWidth)
96 PathDiagnosticLocation Loc(CE, BR.getSourceManager(), AC);
97 BR.EmitBasicReport(AC->getDecl(), Checker,
"Widening cast to struct type",
99 "Casting data to a larger structure type and accessing " 100 "a field can lead to memory access errors or data " 109 class CastToStructChecker :
public Checker<check::ASTCodeBody> {
111 void checkASTCodeBody(
const Decl *D, AnalysisManager &Mgr,
112 BugReporter &BR)
const {
113 CastToStructVisitor Visitor(BR,
this, Mgr.getAnalysisDeclContext(D));
114 Visitor.TraverseDecl(const_cast<Decl *>(D));
119 void ento::registerCastToStructChecker(CheckerManager &mgr) {
120 mgr.registerChecker<CastToStructChecker>();
123 bool ento::shouldRegisterCastToStructChecker(
const LangOptions &LO) {
PointerType - C99 6.7.5.1 - Pointer Declarators.
QualType getPointeeType() const
A (possibly-)qualified type.
QualType getPointeeType() const
If this is a pointer, ObjC object pointer, or block pointer, this returns the respective pointee...
bool isRecordType() const
Decl - This represents one declaration (or definition), e.g.
Holds long-lived AST nodes (such as types and decls) that can be referred to throughout the semantic ...
AnalysisDeclContext contains the context data for the function or method under analysis.
bool isReferenceType() const
Keeps track of the various options that can be enabled, which controls the dialect of C or C++ that i...
const char *const LogicError
const Type * getTypePtr() const
Retrieves a pointer to the underlying (unqualified) type.
CastExpr - Base class for type casts, including both implicit casts (ImplicitCastExpr) and explicit c...
A class that does preorder or postorder depth-first traversal on the entire Clang AST and visits each...
Represent the declaration of a variable (in which case it is an lvalue) a function (in which case it ...
This represents one expression.
UnaryOperator - This represents the unary-expression's (except sizeof and alignof), the postinc/postdec operators from postfix-expression, and various extensions.
bool isStructureOrClassType() const
Dataflow Directional Tag Classes.
bool isIncompleteType(NamedDecl **Def=nullptr) const
Types are partitioned into 3 broad categories (C99 6.2.5p1): object types, function types...
CanQualType getCanonicalType(QualType T) const
Return the canonical (structural) type corresponding to the specified potentially non-canonical type ...
TypeInfo getTypeInfo(const Type *T) const
Get the size and alignment of the specified complete type in bits.
SourceRange getSourceRange() const LLVM_READONLY
SourceLocation tokens are not useful in isolation - they are low level value objects created/interpre...
A trivial tuple used to represent a source range.