diff options
Diffstat (limited to 'contrib/llvm/tools/clang/lib/StaticAnalyzer/Checkers/UndefResultChecker.cpp')
-rw-r--r-- | contrib/llvm/tools/clang/lib/StaticAnalyzer/Checkers/UndefResultChecker.cpp | 191 |
1 files changed, 0 insertions, 191 deletions
diff --git a/contrib/llvm/tools/clang/lib/StaticAnalyzer/Checkers/UndefResultChecker.cpp b/contrib/llvm/tools/clang/lib/StaticAnalyzer/Checkers/UndefResultChecker.cpp deleted file mode 100644 index 1ae287d39f11..000000000000 --- a/contrib/llvm/tools/clang/lib/StaticAnalyzer/Checkers/UndefResultChecker.cpp +++ /dev/null @@ -1,191 +0,0 @@ -//=== UndefResultChecker.cpp ------------------------------------*- C++ -*-===// -// -// Part of the LLVM Project, under the Apache License v2.0 with LLVM Exceptions. -// See https://llvm.org/LICENSE.txt for license information. -// SPDX-License-Identifier: Apache-2.0 WITH LLVM-exception -// -//===----------------------------------------------------------------------===// -// -// This defines UndefResultChecker, a builtin check in ExprEngine that -// performs checks for undefined results of non-assignment binary operators. -// -//===----------------------------------------------------------------------===// - -#include "clang/StaticAnalyzer/Checkers/BuiltinCheckerRegistration.h" -#include "clang/StaticAnalyzer/Core/BugReporter/BugType.h" -#include "clang/StaticAnalyzer/Core/Checker.h" -#include "clang/StaticAnalyzer/Core/CheckerManager.h" -#include "clang/StaticAnalyzer/Core/PathSensitive/CheckerContext.h" -#include "clang/StaticAnalyzer/Core/PathSensitive/ExprEngine.h" -#include "llvm/ADT/SmallString.h" -#include "llvm/Support/raw_ostream.h" - -using namespace clang; -using namespace ento; - -namespace { -class UndefResultChecker - : public Checker< check::PostStmt<BinaryOperator> > { - - mutable std::unique_ptr<BugType> BT; - -public: - void checkPostStmt(const BinaryOperator *B, CheckerContext &C) const; -}; -} // end anonymous namespace - -static bool isArrayIndexOutOfBounds(CheckerContext &C, const Expr *Ex) { - ProgramStateRef state = C.getState(); - - if (!isa<ArraySubscriptExpr>(Ex)) - return false; - - SVal Loc = C.getSVal(Ex); - if (!Loc.isValid()) - return false; - - const MemRegion *MR = Loc.castAs<loc::MemRegionVal>().getRegion(); - const ElementRegion *ER = dyn_cast<ElementRegion>(MR); - if (!ER) - return false; - - DefinedOrUnknownSVal Idx = ER->getIndex().castAs<DefinedOrUnknownSVal>(); - DefinedOrUnknownSVal NumElements = C.getStoreManager().getSizeInElements( - state, ER->getSuperRegion(), ER->getValueType()); - ProgramStateRef StInBound = state->assumeInBound(Idx, NumElements, true); - ProgramStateRef StOutBound = state->assumeInBound(Idx, NumElements, false); - return StOutBound && !StInBound; -} - -static bool isShiftOverflow(const BinaryOperator *B, CheckerContext &C) { - return C.isGreaterOrEqual( - B->getRHS(), C.getASTContext().getIntWidth(B->getLHS()->getType())); -} - -static bool isLeftShiftResultUnrepresentable(const BinaryOperator *B, - CheckerContext &C) { - SValBuilder &SB = C.getSValBuilder(); - ProgramStateRef State = C.getState(); - const llvm::APSInt *LHS = SB.getKnownValue(State, C.getSVal(B->getLHS())); - const llvm::APSInt *RHS = SB.getKnownValue(State, C.getSVal(B->getRHS())); - assert(LHS && RHS && "Values unknown, inconsistent state"); - return (unsigned)RHS->getZExtValue() > LHS->countLeadingZeros(); -} - -void UndefResultChecker::checkPostStmt(const BinaryOperator *B, - CheckerContext &C) const { - if (C.getSVal(B).isUndef()) { - - // Do not report assignments of uninitialized values inside swap functions. - // This should allow to swap partially uninitialized structs - // (radar://14129997) - if (const FunctionDecl *EnclosingFunctionDecl = - dyn_cast<FunctionDecl>(C.getStackFrame()->getDecl())) - if (C.getCalleeName(EnclosingFunctionDecl) == "swap") - return; - - // Generate an error node. - ExplodedNode *N = C.generateErrorNode(); - if (!N) - return; - - if (!BT) - BT.reset( - new BuiltinBug(this, "Result of operation is garbage or undefined")); - - SmallString<256> sbuf; - llvm::raw_svector_ostream OS(sbuf); - const Expr *Ex = nullptr; - bool isLeft = true; - - if (C.getSVal(B->getLHS()).isUndef()) { - Ex = B->getLHS()->IgnoreParenCasts(); - isLeft = true; - } - else if (C.getSVal(B->getRHS()).isUndef()) { - Ex = B->getRHS()->IgnoreParenCasts(); - isLeft = false; - } - - if (Ex) { - OS << "The " << (isLeft ? "left" : "right") << " operand of '" - << BinaryOperator::getOpcodeStr(B->getOpcode()) - << "' is a garbage value"; - if (isArrayIndexOutOfBounds(C, Ex)) - OS << " due to array index out of bounds"; - } else { - // Neither operand was undefined, but the result is undefined. - if ((B->getOpcode() == BinaryOperatorKind::BO_Shl || - B->getOpcode() == BinaryOperatorKind::BO_Shr) && - C.isNegative(B->getRHS())) { - OS << "The result of the " - << ((B->getOpcode() == BinaryOperatorKind::BO_Shl) ? "left" - : "right") - << " shift is undefined because the right operand is negative"; - Ex = B->getRHS(); - } else if ((B->getOpcode() == BinaryOperatorKind::BO_Shl || - B->getOpcode() == BinaryOperatorKind::BO_Shr) && - isShiftOverflow(B, C)) { - - OS << "The result of the " - << ((B->getOpcode() == BinaryOperatorKind::BO_Shl) ? "left" - : "right") - << " shift is undefined due to shifting by "; - Ex = B->getRHS(); - - SValBuilder &SB = C.getSValBuilder(); - const llvm::APSInt *I = - SB.getKnownValue(C.getState(), C.getSVal(B->getRHS())); - if (!I) - OS << "a value that is"; - else if (I->isUnsigned()) - OS << '\'' << I->getZExtValue() << "\', which is"; - else - OS << '\'' << I->getSExtValue() << "\', which is"; - - OS << " greater or equal to the width of type '" - << B->getLHS()->getType().getAsString() << "'."; - } else if (B->getOpcode() == BinaryOperatorKind::BO_Shl && - C.isNegative(B->getLHS())) { - OS << "The result of the left shift is undefined because the left " - "operand is negative"; - Ex = B->getLHS(); - } else if (B->getOpcode() == BinaryOperatorKind::BO_Shl && - isLeftShiftResultUnrepresentable(B, C)) { - ProgramStateRef State = C.getState(); - SValBuilder &SB = C.getSValBuilder(); - const llvm::APSInt *LHS = - SB.getKnownValue(State, C.getSVal(B->getLHS())); - const llvm::APSInt *RHS = - SB.getKnownValue(State, C.getSVal(B->getRHS())); - OS << "The result of the left shift is undefined due to shifting \'" - << LHS->getSExtValue() << "\' by \'" << RHS->getZExtValue() - << "\', which is unrepresentable in the unsigned version of " - << "the return type \'" << B->getLHS()->getType().getAsString() - << "\'"; - Ex = B->getLHS(); - } else { - OS << "The result of the '" - << BinaryOperator::getOpcodeStr(B->getOpcode()) - << "' expression is undefined"; - } - } - auto report = llvm::make_unique<BugReport>(*BT, OS.str(), N); - if (Ex) { - report->addRange(Ex->getSourceRange()); - bugreporter::trackExpressionValue(N, Ex, *report); - } - else - bugreporter::trackExpressionValue(N, B, *report); - - C.emitReport(std::move(report)); - } -} - -void ento::registerUndefResultChecker(CheckerManager &mgr) { - mgr.registerChecker<UndefResultChecker>(); -} - -bool ento::shouldRegisterUndefResultChecker(const LangOptions &LO) { - return true; -} |