21 #include "llvm/ADT/SmallString.h" 22 #include "llvm/Support/raw_ostream.h" 24 using namespace clang;
28 class UndefResultChecker
29 :
public Checker< check::PostStmt<BinaryOperator> > {
31 mutable std::unique_ptr<BugType> BT;
34 void checkPostStmt(
const BinaryOperator *B, CheckerContext &C)
const;
41 if (!isa<ArraySubscriptExpr>(Ex))
44 SVal Loc = C.getSVal(Ex);
48 const MemRegion *MR = Loc.castAs<loc::MemRegionVal>().getRegion();
49 const ElementRegion *ER = dyn_cast<ElementRegion>(MR);
53 DefinedOrUnknownSVal Idx = ER->getIndex().castAs<DefinedOrUnknownSVal>();
54 DefinedOrUnknownSVal NumElements = C.getStoreManager().getSizeInElements(
55 state, ER->getSuperRegion(), ER->getValueType());
56 ProgramStateRef StInBound = state->assumeInBound(Idx, NumElements,
true);
57 ProgramStateRef StOutBound = state->assumeInBound(Idx, NumElements,
false);
58 return StOutBound && !StInBound;
62 return C.isGreaterOrEqual(
68 SValBuilder &SB = C.getSValBuilder();
70 const llvm::APSInt *LHS = SB.getKnownValue(State, C.getSVal(B->
getLHS()));
71 const llvm::APSInt *RHS = SB.getKnownValue(State, C.getSVal(B->
getRHS()));
72 assert(LHS && RHS &&
"Values unknown, inconsistent state");
73 return (
unsigned)RHS->getZExtValue() > LHS->countLeadingZeros();
77 CheckerContext &C)
const {
78 if (C.getSVal(B).isUndef()) {
84 dyn_cast<FunctionDecl>(C.getStackFrame()->getDecl()))
85 if (C.getCalleeName(EnclosingFunctionDecl) ==
"swap")
89 ExplodedNode *N = C.generateErrorNode();
95 new BuiltinBug(
this,
"Result of operation is garbage or undefined"));
98 llvm::raw_svector_ostream
OS(sbuf);
99 const Expr *Ex =
nullptr;
102 if (C.getSVal(B->
getLHS()).isUndef()) {
106 else if (C.getSVal(B->
getRHS()).isUndef()) {
112 OS <<
"The " << (isLeft ?
"left" :
"right") <<
" operand of '" 114 <<
"' is a garbage value";
116 OS <<
" due to array index out of bounds";
119 if ((B->
getOpcode() == BinaryOperatorKind::BO_Shl ||
120 B->
getOpcode() == BinaryOperatorKind::BO_Shr) &&
121 C.isNegative(B->
getRHS())) {
122 OS <<
"The result of the " 123 << ((B->
getOpcode() == BinaryOperatorKind::BO_Shl) ?
"left" 125 <<
" shift is undefined because the right operand is negative";
127 }
else if ((B->
getOpcode() == BinaryOperatorKind::BO_Shl ||
128 B->
getOpcode() == BinaryOperatorKind::BO_Shr) &&
131 OS <<
"The result of the " 132 << ((B->
getOpcode() == BinaryOperatorKind::BO_Shl) ?
"left" 134 <<
" shift is undefined due to shifting by ";
137 SValBuilder &SB = C.getSValBuilder();
138 const llvm::APSInt *I =
139 SB.getKnownValue(C.getState(), C.getSVal(B->
getRHS()));
141 OS <<
"a value that is";
142 else if (I->isUnsigned())
143 OS <<
'\'' << I->getZExtValue() <<
"\', which is";
145 OS <<
'\'' << I->getSExtValue() <<
"\', which is";
147 OS <<
" greater or equal to the width of type '" 149 }
else if (B->
getOpcode() == BinaryOperatorKind::BO_Shl &&
150 C.isNegative(B->
getLHS())) {
151 OS <<
"The result of the left shift is undefined because the left " 152 "operand is negative";
154 }
else if (B->
getOpcode() == BinaryOperatorKind::BO_Shl &&
157 SValBuilder &SB = C.getSValBuilder();
158 const llvm::APSInt *LHS =
159 SB.getKnownValue(State, C.getSVal(B->
getLHS()));
160 const llvm::APSInt *RHS =
161 SB.getKnownValue(State, C.getSVal(B->
getRHS()));
162 OS <<
"The result of the left shift is undefined due to shifting \'" 163 << LHS->getSExtValue() <<
"\' by \'" << RHS->getZExtValue()
164 <<
"\', which is unrepresentable in the unsigned version of " 169 OS <<
"The result of the '" 171 <<
"' expression is undefined";
174 auto report = llvm::make_unique<BugReport>(*BT, OS.str(), N);
177 bugreporter::trackExpressionValue(N, Ex, *report);
180 bugreporter::trackExpressionValue(N, B, *report);
182 C.emitReport(std::move(report));
186 void ento::registerUndefResultChecker(CheckerManager &mgr) {
187 mgr.registerChecker<UndefResultChecker>();
Represents a function declaration or definition.
IntrusiveRefCntPtr< const ProgramState > ProgramStateRef
i32 captured_struct **param SharedsTy A type which contains references the shared variables *param Shareds Context with the list of shared variables from the p *TaskFunction *param Data Additional data for task generation like final * state
static bool isShiftOverflow(const BinaryOperator *B, CheckerContext &C)
StringRef getOpcodeStr() const
static bool isArrayIndexOutOfBounds(CheckerContext &C, const Expr *Ex)
A builtin binary operation expression such as "x + y" or "x <= y".
Expr * IgnoreParenCasts() LLVM_READONLY
IgnoreParenCasts - Ignore parentheses and casts.
static bool isLeftShiftResultUnrepresentable(const BinaryOperator *B, CheckerContext &C)
This represents one expression.
Dataflow Directional Tag Classes.
static std::string getAsString(SplitQualType split, const PrintingPolicy &Policy)
Indicates that the tracking object is a descendant of a referenced-counted OSObject, used in the Darwin kernel.
SourceRange getSourceRange() const LLVM_READONLY
SourceLocation tokens are not useful in isolation - they are low level value objects created/interpre...