CastSizeChecker.cpp revision 04291a7c76e16a2dc5433c80c3d13c826bf372dc
1//=== CastSizeChecker.cpp ---------------------------------------*- C++ -*-===// 2// 3// The LLVM Compiler Infrastructure 4// 5// This file is distributed under the University of Illinois Open Source 6// License. See LICENSE.TXT for details. 7// 8//===----------------------------------------------------------------------===// 9// 10// CastSizeChecker checks when casting a malloc'ed symbolic region to type T, 11// whether the size of the symbolic region is a multiple of the size of T. 12// 13//===----------------------------------------------------------------------===// 14#include "clang/AST/CharUnits.h" 15#include "clang/StaticAnalyzer/BugReporter/BugType.h" 16#include "clang/StaticAnalyzer/PathSensitive/CheckerVisitor.h" 17#include "InternalChecks.h" 18 19using namespace clang; 20using namespace ento; 21 22namespace { 23class CastSizeChecker : public CheckerVisitor<CastSizeChecker> { 24 BuiltinBug *BT; 25public: 26 CastSizeChecker() : BT(0) {} 27 static void *getTag(); 28 void PreVisitCastExpr(CheckerContext &C, const CastExpr *B); 29}; 30} 31 32void *CastSizeChecker::getTag() { 33 static int x; 34 return &x; 35} 36 37void CastSizeChecker::PreVisitCastExpr(CheckerContext &C, const CastExpr *CE) { 38 const Expr *E = CE->getSubExpr(); 39 ASTContext &Ctx = C.getASTContext(); 40 QualType ToTy = Ctx.getCanonicalType(CE->getType()); 41 const PointerType *ToPTy = dyn_cast<PointerType>(ToTy.getTypePtr()); 42 43 if (!ToPTy) 44 return; 45 46 QualType ToPointeeTy = ToPTy->getPointeeType(); 47 48 // Only perform the check if 'ToPointeeTy' is a complete type. 49 if (ToPointeeTy->isIncompleteType()) 50 return; 51 52 const GRState *state = C.getState(); 53 const MemRegion *R = state->getSVal(E).getAsRegion(); 54 if (R == 0) 55 return; 56 57 const SymbolicRegion *SR = dyn_cast<SymbolicRegion>(R); 58 if (SR == 0) 59 return; 60 61 SValBuilder &svalBuilder = C.getSValBuilder(); 62 SVal extent = SR->getExtent(svalBuilder); 63 const llvm::APSInt *extentInt = svalBuilder.getKnownValue(state, extent); 64 if (!extentInt) 65 return; 66 67 CharUnits regionSize = CharUnits::fromQuantity(extentInt->getSExtValue()); 68 CharUnits typeSize = C.getASTContext().getTypeSizeInChars(ToPointeeTy); 69 70 // Ignore void, and a few other un-sizeable types. 71 if (typeSize.isZero()) 72 return; 73 74 if (regionSize % typeSize != 0) { 75 if (ExplodedNode *errorNode = C.generateSink()) { 76 if (!BT) 77 BT = new BuiltinBug("Cast region with wrong size.", 78 "Cast a region whose size is not a multiple of the" 79 " destination type size."); 80 RangedBugReport *R = new RangedBugReport(*BT, BT->getDescription(), 81 errorNode); 82 R->addRange(CE->getSourceRange()); 83 C.EmitReport(R); 84 } 85 } 86} 87 88 89void ento::RegisterCastSizeChecker(ExprEngine &Eng) { 90 Eng.registerCheck(new CastSizeChecker()); 91} 92