21 using namespace clang;
23 using namespace taint;
26 class DivZeroChecker :
public Checker< check::PreStmt<BinaryOperator> > {
27 mutable std::unique_ptr<BuiltinBug> BT;
28 void reportBug(
const char *Msg,
ProgramStateRef StateZero, CheckerContext &C,
29 std::unique_ptr<BugReporterVisitor> Visitor =
nullptr)
const;
32 void checkPreStmt(
const BinaryOperator *B, CheckerContext &C)
const;
37 const Stmt *S = N->getLocationAs<
PreStmt>()->getStmt();
38 if (
const auto *BE = dyn_cast<BinaryOperator>(S))
43 void DivZeroChecker::reportBug(
45 std::unique_ptr<BugReporterVisitor> Visitor)
const {
46 if (ExplodedNode *N = C.generateErrorNode(StateZero)) {
48 BT.reset(
new BuiltinBug(
this,
"Division by zero"));
50 auto R = std::make_unique<PathSensitiveBugReport>(*BT, Msg, N);
51 R->addVisitor(std::move(Visitor));
52 bugreporter::trackExpressionValue(N,
getDenomExpr(N), *R);
53 C.emitReport(std::move(R));
58 CheckerContext &C)
const {
69 SVal Denom = C.getSVal(B->
getRHS());
78 ConstraintManager &CM = C.getConstraintManager();
80 std::tie(stateNotZero, stateZero) = CM.assumeDual(C.getState(), *DV);
84 reportBug(
"Division by zero", stateZero, C);
88 bool TaintedD =
isTainted(C.getState(), *DV);
89 if ((stateNotZero && stateZero && TaintedD)) {
90 reportBug(
"Division by a tainted value, possibly zero", stateZero, C,
91 std::make_unique<taint::TaintBugVisitor>(*DV));
97 C.addTransition(stateNotZero);
100 void ento::registerDivZeroChecker(CheckerManager &mgr) {
101 mgr.registerChecker<DivZeroChecker>();
104 bool ento::shouldRegisterDivZeroChecker(
const LangOptions &LO) {
Stmt - This represents one statement.
IntrusiveRefCntPtr< const ProgramState > ProgramStateRef
Keeps track of the various options that can be enabled, which controls the dialect of C or C++ that i...
A builtin binary operation expression such as "x + y" or "x <= y".
bool isScalarType() const
This represents one expression.
bool isTainted(ProgramStateRef State, const Stmt *S, const LocationContext *LCtx, TaintTagType Kind=TaintTagGeneric)
Check if the statement has a tainted value in the given state.
Dataflow Directional Tag Classes.
static const Expr * getDenomExpr(const ExplodedNode *N)