21 using namespace clang;
25 class ArrayBoundChecker :
26 public Checker<check::Location> {
27 mutable std::unique_ptr<BuiltinBug> BT;
30 void checkLocation(SVal l,
bool isLoad,
const Stmt* S,
31 CheckerContext &C)
const;
35 void ArrayBoundChecker::checkLocation(SVal l,
bool isLoad,
const Stmt* LoadS,
36 CheckerContext &C)
const {
38 const MemRegion *R = l.getAsRegion();
42 const ElementRegion *ER = dyn_cast<ElementRegion>(R);
47 DefinedOrUnknownSVal Idx = ER->getIndex().castAs<DefinedOrUnknownSVal>();
51 if (Idx.isZeroConstant())
57 DefinedOrUnknownSVal NumElements
58 = C.getStoreManager().getSizeInElements(state, ER->getSuperRegion(),
61 ProgramStateRef StInBound = state->assumeInBound(Idx, NumElements,
true);
62 ProgramStateRef StOutBound = state->assumeInBound(Idx, NumElements,
false);
63 if (StOutBound && !StInBound) {
64 ExplodedNode *N = C.generateErrorNode(StOutBound);
69 BT.reset(
new BuiltinBug(
70 this,
"Out-of-bound array access",
71 "Access out-of-bound array element (buffer overflow)"));
79 std::make_unique<PathSensitiveBugReport>(*BT, BT->getDescription(), N);
82 C.emitReport(std::move(report));
88 C.addTransition(StInBound);
91 void ento::registerArrayBoundChecker(CheckerManager &mgr) {
92 mgr.registerChecker<ArrayBoundChecker>();
95 bool ento::shouldRegisterArrayBoundChecker(
const LangOptions &LO) {
Stmt - This represents one statement.
IntrusiveRefCntPtr< const ProgramState > ProgramStateRef
Keeps track of the various options that can be enabled, which controls the dialect of C or C++ that i...
i32 captured_struct **param SharedsTy A type which contains references the shared variables *param Shareds Context with the list of shared variables from the p *TaskFunction *param Data Additional data for task generation like final * state
Dataflow Directional Tag Classes.
SourceRange getSourceRange() const LLVM_READONLY
SourceLocation tokens are not useful in isolation - they are low level value objects created/interpre...