22 using namespace clang;
26 class ReturnPointerRangeChecker :
27 public Checker< check::PreStmt<ReturnStmt> > {
28 mutable std::unique_ptr<BuiltinBug> BT;
31 void checkPreStmt(
const ReturnStmt *RS, CheckerContext &C)
const;
35 void ReturnPointerRangeChecker::checkPreStmt(
const ReturnStmt *RS,
36 CheckerContext &C)
const {
43 SVal V = C.getSVal(RetE);
44 const MemRegion *R = V.getAsRegion();
46 const ElementRegion *ER = dyn_cast_or_null<ElementRegion>(R);
50 DefinedOrUnknownSVal Idx = ER->getIndex().castAs<DefinedOrUnknownSVal>();
53 if (Idx.isZeroConstant())
58 DefinedOrUnknownSVal NumElements
59 = C.getStoreManager().getSizeInElements(state, ER->getSuperRegion(),
62 ProgramStateRef StInBound = state->assumeInBound(Idx, NumElements,
true);
63 ProgramStateRef StOutBound = state->assumeInBound(Idx, NumElements,
false);
64 if (StOutBound && !StInBound) {
65 ExplodedNode *N = C.generateErrorNode(StOutBound);
73 BT.reset(
new BuiltinBug(
74 this,
"Return of pointer value outside of expected range",
75 "Returned pointer value points outside the original object " 76 "(potential buffer overflow)"));
83 auto report = llvm::make_unique<BugReport>(*BT, BT->getDescription(), N);
86 C.emitReport(std::move(report));
90 void ento::registerReturnPointerRangeChecker(CheckerManager &mgr) {
91 mgr.registerChecker<ReturnPointerRangeChecker>();
IntrusiveRefCntPtr< const ProgramState > ProgramStateRef
i32 captured_struct **param SharedsTy A type which contains references the shared variables *param Shareds Context with the list of shared variables from the p *TaskFunction *param Data Additional data for task generation like final * state
This represents one expression.
ReturnStmt - This represents a return, optionally of an expression: return; return 4;...
Dataflow Directional Tag Classes.
SourceRange getSourceRange() const LLVM_READONLY
SourceLocation tokens are not useful in isolation - they are low level value objects created/interpre...