20 #include "llvm/ADT/SmallString.h" 21 #include "llvm/Support/raw_ostream.h" 23 using namespace clang;
27 class UndefResultChecker
28 :
public Checker< check::PostStmt<BinaryOperator> > {
30 mutable std::unique_ptr<BugType> BT;
33 void checkPostStmt(
const BinaryOperator *B, CheckerContext &C)
const;
40 if (!isa<ArraySubscriptExpr>(Ex))
43 SVal Loc = C.getSVal(Ex);
47 const MemRegion *MR = Loc.castAs<loc::MemRegionVal>().getRegion();
48 const ElementRegion *ER = dyn_cast<ElementRegion>(MR);
52 DefinedOrUnknownSVal Idx = ER->getIndex().castAs<DefinedOrUnknownSVal>();
53 DefinedOrUnknownSVal NumElements = C.getStoreManager().getSizeInElements(
54 state, ER->getSuperRegion(), ER->getValueType());
55 ProgramStateRef StInBound = state->assumeInBound(Idx, NumElements,
true);
56 ProgramStateRef StOutBound = state->assumeInBound(Idx, NumElements,
false);
57 return StOutBound && !StInBound;
61 return C.isGreaterOrEqual(
67 SValBuilder &SB = C.getSValBuilder();
71 assert(LHS && RHS &&
"Values unknown, inconsistent state");
72 return (
unsigned)RHS->getZExtValue() > LHS->countLeadingZeros();
76 CheckerContext &C)
const {
77 if (C.getSVal(B).isUndef()) {
83 dyn_cast<FunctionDecl>(C.getStackFrame()->getDecl()))
84 if (C.getCalleeName(EnclosingFunctionDecl) ==
"swap")
88 ExplodedNode *N = C.generateErrorNode();
94 new BuiltinBug(
this,
"Result of operation is garbage or undefined"));
97 llvm::raw_svector_ostream
OS(sbuf);
98 const Expr *Ex =
nullptr;
101 if (C.getSVal(B->
getLHS()).isUndef()) {
105 else if (C.getSVal(B->
getRHS()).isUndef()) {
111 OS <<
"The " << (isLeft ?
"left" :
"right") <<
" operand of '" 113 <<
"' is a garbage value";
115 OS <<
" due to array index out of bounds";
118 if ((B->
getOpcode() == BinaryOperatorKind::BO_Shl ||
119 B->
getOpcode() == BinaryOperatorKind::BO_Shr) &&
120 C.isNegative(B->
getRHS())) {
121 OS <<
"The result of the " 122 << ((B->
getOpcode() == BinaryOperatorKind::BO_Shl) ?
"left" 124 <<
" shift is undefined because the right operand is negative";
126 }
else if ((B->
getOpcode() == BinaryOperatorKind::BO_Shl ||
127 B->
getOpcode() == BinaryOperatorKind::BO_Shr) &&
130 OS <<
"The result of the " 131 << ((B->
getOpcode() == BinaryOperatorKind::BO_Shl) ?
"left" 133 <<
" shift is undefined due to shifting by ";
136 SValBuilder &SB = C.getSValBuilder();
138 SB.getKnownValue(C.getState(), C.getSVal(B->
getRHS()));
140 OS <<
"a value that is";
141 else if (I->isUnsigned())
142 OS <<
'\'' << I->getZExtValue() <<
"\', which is";
144 OS <<
'\'' << I->getSExtValue() <<
"\', which is";
146 OS <<
" greater or equal to the width of type '" 148 }
else if (B->
getOpcode() == BinaryOperatorKind::BO_Shl &&
149 C.isNegative(B->
getLHS())) {
150 OS <<
"The result of the left shift is undefined because the left " 151 "operand is negative";
153 }
else if (B->
getOpcode() == BinaryOperatorKind::BO_Shl &&
156 SValBuilder &SB = C.getSValBuilder();
158 SB.getKnownValue(State, C.getSVal(B->
getLHS()));
160 SB.getKnownValue(State, C.getSVal(B->
getRHS()));
161 OS <<
"The result of the left shift is undefined due to shifting \'" 162 << LHS->getSExtValue() <<
"\' by \'" << RHS->getZExtValue()
163 <<
"\', which is unrepresentable in the unsigned version of " 168 OS <<
"The result of the '" 170 <<
"' expression is undefined";
173 auto report = std::make_unique<PathSensitiveBugReport>(*BT, OS.str(), N);
176 bugreporter::trackExpressionValue(N, Ex, *report);
179 bugreporter::trackExpressionValue(N, B, *report);
181 C.emitReport(std::move(report));
185 void ento::registerUndefResultChecker(CheckerManager &mgr) {
186 mgr.registerChecker<UndefResultChecker>();
189 bool ento::shouldRegisterUndefResultChecker(
const LangOptions &LO) {
Represents a function declaration or definition.
IntrusiveRefCntPtr< const ProgramState > ProgramStateRef
Keeps track of the various options that can be enabled, which controls the dialect of C or C++ that i...
i32 captured_struct **param SharedsTy A type which contains references the shared variables *param Shareds Context with the list of shared variables from the p *TaskFunction *param Data Additional data for task generation like final * state
static bool isShiftOverflow(const BinaryOperator *B, CheckerContext &C)
StringRef getOpcodeStr() const
static bool isArrayIndexOutOfBounds(CheckerContext &C, const Expr *Ex)
A builtin binary operation expression such as "x + y" or "x <= y".
Expr * IgnoreParenCasts() LLVM_READONLY
Skip past any parentheses and casts which might surround this expression until reaching a fixed point...
static bool isLeftShiftResultUnrepresentable(const BinaryOperator *B, CheckerContext &C)
This represents one expression.
Dataflow Directional Tag Classes.
static std::string getAsString(SplitQualType split, const PrintingPolicy &Policy)
Indicates that the tracking object is a descendant of a referenced-counted OSObject, used in the Darwin kernel.
SourceRange getSourceRange() const LLVM_READONLY
SourceLocation tokens are not useful in isolation - they are low level value objects created/interpre...