22 using namespace clang;
26 class ArrayBoundChecker :
27 public Checker<check::Location> {
28 mutable std::unique_ptr<BuiltinBug> BT;
31 void checkLocation(
SVal l,
bool isLoad,
const Stmt* S,
36 void ArrayBoundChecker::checkLocation(
SVal l,
bool isLoad,
const Stmt* LoadS,
62 ProgramStateRef StInBound = state->assumeInBound(Idx, NumElements,
true);
63 ProgramStateRef StOutBound = state->assumeInBound(Idx, NumElements,
false);
64 if (StOutBound && !StInBound) {
71 this,
"Out-of-bound array access",
72 "Access out-of-bound array element (buffer overflow)"));
79 auto report = llvm::make_unique<BugReport>(*BT, BT->getDescription(), N);
virtual DefinedOrUnknownSVal getSizeInElements(ProgramStateRef state, const MemRegion *region, QualType EleTy)
MemRegion - The root abstract class for all memory regions.
ExplodedNode * generateErrorNode(ProgramStateRef State=nullptr, const ProgramPointTag *Tag=nullptr)
Generate a transition to a node that will be used to report an error.
Stmt - This represents one statement.
ExplodedNode * addTransition(ProgramStateRef State=nullptr, const ProgramPointTag *Tag=nullptr)
Generates a new transition in the program state graph (ExplodedGraph).
const MemRegion * getSuperRegion() const
i32 captured_struct **param SharedsTy A type which contains references the shared variables *param Shareds Context with the list of shared variables from the p *TaskFunction *param Data Additional data for task generation like final * state
void emitReport(std::unique_ptr< BugReport > R)
Emit the diagnostics report.
CHECKER * registerChecker()
Used to register checkers.
StoreManager & getStoreManager()
const MemRegion * getAsRegion() const
SVal - This represents a symbolic expression, which can be either an L-value or an R-value...
Dataflow Directional Tag Classes.
bool isZeroConstant() const
T castAs() const
Convert to the specified SVal type, asserting that this SVal is of the desired type.
const ProgramStateRef & getState() const
QualType getValueType() const override
SourceRange getSourceRange() const LLVM_READONLY
SourceLocation tokens are not useful in isolation - they are low level value objects created/interpre...
ElementRegin is used to represent both array elements and casts.