21 using namespace clang;
25 class ReturnPointerRangeChecker :
26 public Checker< check::PreStmt<ReturnStmt> > {
27 mutable std::unique_ptr<BuiltinBug> BT;
30 void checkPreStmt(
const ReturnStmt *RS, CheckerContext &C)
const;
34 void ReturnPointerRangeChecker::checkPreStmt(
const ReturnStmt *RS,
35 CheckerContext &C)
const {
42 SVal
V = C.getSVal(RetE);
43 const MemRegion *R = V.getAsRegion();
45 const ElementRegion *ER = dyn_cast_or_null<ElementRegion>(R);
49 DefinedOrUnknownSVal Idx = ER->getIndex().castAs<DefinedOrUnknownSVal>();
52 if (Idx.isZeroConstant())
57 DefinedOrUnknownSVal NumElements
58 = C.getStoreManager().getSizeInElements(state, ER->getSuperRegion(),
61 ProgramStateRef StInBound = state->assumeInBound(Idx, NumElements,
true);
62 ProgramStateRef StOutBound = state->assumeInBound(Idx, NumElements,
false);
63 if (StOutBound && !StInBound) {
64 ExplodedNode *N = C.generateErrorNode(StOutBound);
72 BT.reset(
new BuiltinBug(
73 this,
"Return of pointer value outside of expected range",
74 "Returned pointer value points outside the original object " 75 "(potential buffer overflow)"));
83 std::make_unique<PathSensitiveBugReport>(*BT, BT->getDescription(), N);
86 C.emitReport(std::move(report));
90 void ento::registerReturnPointerRangeChecker(CheckerManager &mgr) {
91 mgr.registerChecker<ReturnPointerRangeChecker>();
94 bool ento::shouldRegisterReturnPointerRangeChecker(
const LangOptions &LO) {
IntrusiveRefCntPtr< const ProgramState > ProgramStateRef
Keeps track of the various options that can be enabled, which controls the dialect of C or C++ that i...
i32 captured_struct **param SharedsTy A type which contains references the shared variables *param Shareds Context with the list of shared variables from the p *TaskFunction *param Data Additional data for task generation like final * state
This represents one expression.
ReturnStmt - This represents a return, optionally of an expression: return; return 4;...
Dataflow Directional Tag Classes.
SourceRange getSourceRange() const LLVM_READONLY
SourceLocation tokens are not useful in isolation - they are low level value objects created/interpre...