1//===--- UndefinedArraySubscriptChecker.h ----------------------*- C++ -*--===//
2//
3//                     The LLVM Compiler Infrastructure
4//
5// This file is distributed under the University of Illinois Open Source
6// License. See LICENSE.TXT for details.
7//
8//===----------------------------------------------------------------------===//
9//
10// This defines UndefinedArraySubscriptChecker, a builtin check in ExprEngine
11// that performs checks for undefined array subscripts.
12//
13//===----------------------------------------------------------------------===//
14
15#include "ClangSACheckers.h"
16#include "clang/AST/DeclCXX.h"
17#include "clang/StaticAnalyzer/Core/BugReporter/BugType.h"
18#include "clang/StaticAnalyzer/Core/Checker.h"
19#include "clang/StaticAnalyzer/Core/CheckerManager.h"
20#include "clang/StaticAnalyzer/Core/PathSensitive/CheckerContext.h"
21
22using namespace clang;
23using namespace ento;
24
25namespace {
26class UndefinedArraySubscriptChecker
27  : public Checker< check::PreStmt<ArraySubscriptExpr> > {
28  mutable std::unique_ptr<BugType> BT;
29
30public:
31  void checkPreStmt(const ArraySubscriptExpr *A, CheckerContext &C) const;
32};
33} // end anonymous namespace
34
35void
36UndefinedArraySubscriptChecker::checkPreStmt(const ArraySubscriptExpr *A,
37                                             CheckerContext &C) const {
38  const Expr *Index = A->getIdx();
39  if (!C.getSVal(Index).isUndef())
40    return;
41
42  // Sema generates anonymous array variables for copying array struct fields.
43  // Don't warn if we're in an implicitly-generated constructor.
44  const Decl *D = C.getLocationContext()->getDecl();
45  if (const CXXConstructorDecl *Ctor = dyn_cast<CXXConstructorDecl>(D))
46    if (Ctor->isDefaulted())
47      return;
48
49  ExplodedNode *N = C.generateErrorNode();
50  if (!N)
51    return;
52  if (!BT)
53    BT.reset(new BuiltinBug(this, "Array subscript is undefined"));
54
55  // Generate a report for this bug.
56  auto R = llvm::make_unique<BugReport>(*BT, BT->getName(), N);
57  R->addRange(A->getIdx()->getSourceRange());
58  bugreporter::trackNullOrUndefValue(N, A->getIdx(), *R);
59  C.emitReport(std::move(R));
60}
61
62void ento::registerUndefinedArraySubscriptChecker(CheckerManager &mgr) {
63  mgr.registerChecker<UndefinedArraySubscriptChecker>();
64}
65