VLASizeChecker.cpp revision 9b663716449b618ba0390b1dbebc54fa8e971124
105a2338f7ba1c8a0136e120502f80a38cf0e9fd3Zhongxing Xu//=== VLASizeChecker.cpp - Undefined dereference checker --------*- C++ -*-===// 205a2338f7ba1c8a0136e120502f80a38cf0e9fd3Zhongxing Xu// 305a2338f7ba1c8a0136e120502f80a38cf0e9fd3Zhongxing Xu// The LLVM Compiler Infrastructure 405a2338f7ba1c8a0136e120502f80a38cf0e9fd3Zhongxing Xu// 505a2338f7ba1c8a0136e120502f80a38cf0e9fd3Zhongxing Xu// This file is distributed under the University of Illinois Open Source 605a2338f7ba1c8a0136e120502f80a38cf0e9fd3Zhongxing Xu// License. See LICENSE.TXT for details. 705a2338f7ba1c8a0136e120502f80a38cf0e9fd3Zhongxing Xu// 805a2338f7ba1c8a0136e120502f80a38cf0e9fd3Zhongxing Xu//===----------------------------------------------------------------------===// 905a2338f7ba1c8a0136e120502f80a38cf0e9fd3Zhongxing Xu// 10d2592a34a059e7cbb2b11dc53649ac4912422909Argyrios Kyrtzidis// This defines VLASizeChecker, a builtin check in ExprEngine that 1105a2338f7ba1c8a0136e120502f80a38cf0e9fd3Zhongxing Xu// performs checks for declaration of VLA of undefined or zero size. 12b2242d1b6fe4ae073361e6d8f3db751c95159ca5Jordy Rose// In addition, VLASizeChecker is responsible for defining the extent 13b2242d1b6fe4ae073361e6d8f3db751c95159ca5Jordy Rose// of the MemRegion that represents a VLA. 1405a2338f7ba1c8a0136e120502f80a38cf0e9fd3Zhongxing Xu// 1505a2338f7ba1c8a0136e120502f80a38cf0e9fd3Zhongxing Xu//===----------------------------------------------------------------------===// 1605a2338f7ba1c8a0136e120502f80a38cf0e9fd3Zhongxing Xu 1704291a7c76e16a2dc5433c80c3d13c826bf372dcArgyrios Kyrtzidis#include "InternalChecks.h" 1852e04c537633377fb14cfa4fa3c95e3e510fc942Jordy Rose#include "clang/AST/CharUnits.h" 199b663716449b618ba0390b1dbebc54fa8e971124Ted Kremenek#include "clang/StaticAnalyzer/Core/BugReporter/BugType.h" 209b663716449b618ba0390b1dbebc54fa8e971124Ted Kremenek#include "clang/StaticAnalyzer/Core/PathSensitive/CheckerVisitor.h" 219b663716449b618ba0390b1dbebc54fa8e971124Ted Kremenek#include "clang/StaticAnalyzer/Core/PathSensitive/ExprEngine.h" 2205a2338f7ba1c8a0136e120502f80a38cf0e9fd3Zhongxing Xu 2305a2338f7ba1c8a0136e120502f80a38cf0e9fd3Zhongxing Xuusing namespace clang; 249ef6537a894c33003359b1f9b9676e9178e028b7Ted Kremenekusing namespace ento; 2505a2338f7ba1c8a0136e120502f80a38cf0e9fd3Zhongxing Xu 2684b3595729d249d89b8b67a547e0992797e19793Ted Kremeneknamespace { 27ba5fb5a955c896815c439289fc51c03cf0635129Kovarththanan Rajaratnamclass VLASizeChecker : public CheckerVisitor<VLASizeChecker> { 28ae1623345aed43dcd2e069970a00618378a37b34Ted Kremenek BugType *BT_zero; 29ae1623345aed43dcd2e069970a00618378a37b34Ted Kremenek BugType *BT_undef; 3084b3595729d249d89b8b67a547e0992797e19793Ted Kremenek 3184b3595729d249d89b8b67a547e0992797e19793Ted Kremenekpublic: 32ae1623345aed43dcd2e069970a00618378a37b34Ted Kremenek VLASizeChecker() : BT_zero(0), BT_undef(0) {} 33ae1623345aed43dcd2e069970a00618378a37b34Ted Kremenek static void *getTag() { static int tag = 0; return &tag; } 34ae1623345aed43dcd2e069970a00618378a37b34Ted Kremenek void PreVisitDeclStmt(CheckerContext &C, const DeclStmt *DS); 3584b3595729d249d89b8b67a547e0992797e19793Ted Kremenek}; 3684b3595729d249d89b8b67a547e0992797e19793Ted Kremenek} // end anonymous namespace 3784b3595729d249d89b8b67a547e0992797e19793Ted Kremenek 389ef6537a894c33003359b1f9b9676e9178e028b7Ted Kremenekvoid ento::RegisterVLASizeChecker(ExprEngine &Eng) { 39ae1623345aed43dcd2e069970a00618378a37b34Ted Kremenek Eng.registerCheck(new VLASizeChecker()); 4005a2338f7ba1c8a0136e120502f80a38cf0e9fd3Zhongxing Xu} 4105a2338f7ba1c8a0136e120502f80a38cf0e9fd3Zhongxing Xu 42ae1623345aed43dcd2e069970a00618378a37b34Ted Kremenekvoid VLASizeChecker::PreVisitDeclStmt(CheckerContext &C, const DeclStmt *DS) { 43ae1623345aed43dcd2e069970a00618378a37b34Ted Kremenek if (!DS->isSingleDecl()) 44ae1623345aed43dcd2e069970a00618378a37b34Ted Kremenek return; 45ae1623345aed43dcd2e069970a00618378a37b34Ted Kremenek 46ae1623345aed43dcd2e069970a00618378a37b34Ted Kremenek const VarDecl *VD = dyn_cast<VarDecl>(DS->getSingleDecl()); 47ae1623345aed43dcd2e069970a00618378a37b34Ted Kremenek if (!VD) 48ae1623345aed43dcd2e069970a00618378a37b34Ted Kremenek return; 4952e04c537633377fb14cfa4fa3c95e3e510fc942Jordy Rose 5052e04c537633377fb14cfa4fa3c95e3e510fc942Jordy Rose ASTContext &Ctx = C.getASTContext(); 5152e04c537633377fb14cfa4fa3c95e3e510fc942Jordy Rose const VariableArrayType *VLA = Ctx.getAsVariableArrayType(VD->getType()); 52ae1623345aed43dcd2e069970a00618378a37b34Ted Kremenek if (!VLA) 53ae1623345aed43dcd2e069970a00618378a37b34Ted Kremenek return; 54ae1623345aed43dcd2e069970a00618378a37b34Ted Kremenek 55ae1623345aed43dcd2e069970a00618378a37b34Ted Kremenek // FIXME: Handle multi-dimensional VLAs. 56ae1623345aed43dcd2e069970a00618378a37b34Ted Kremenek const Expr* SE = VLA->getSizeExpr(); 57ae1623345aed43dcd2e069970a00618378a37b34Ted Kremenek const GRState *state = C.getState(); 581397663af9dbcc24dbf0e11de43931b3dc08fdbbTed Kremenek SVal sizeV = state->getSVal(SE); 59ae1623345aed43dcd2e069970a00618378a37b34Ted Kremenek 60ae1623345aed43dcd2e069970a00618378a37b34Ted Kremenek if (sizeV.isUndef()) { 61ae1623345aed43dcd2e069970a00618378a37b34Ted Kremenek // Generate an error node. 62d048c6ef5b6cfaa0cecb8cc1d4bdace32ed21d07Ted Kremenek ExplodedNode *N = C.generateSink(); 63ae1623345aed43dcd2e069970a00618378a37b34Ted Kremenek if (!N) 64ae1623345aed43dcd2e069970a00618378a37b34Ted Kremenek return; 65ae1623345aed43dcd2e069970a00618378a37b34Ted Kremenek 66ae1623345aed43dcd2e069970a00618378a37b34Ted Kremenek if (!BT_undef) 67ae1623345aed43dcd2e069970a00618378a37b34Ted Kremenek BT_undef = new BuiltinBug("Declared variable-length array (VLA) uses a " 68ae1623345aed43dcd2e069970a00618378a37b34Ted Kremenek "garbage value as its size"); 69ae1623345aed43dcd2e069970a00618378a37b34Ted Kremenek 70ae1623345aed43dcd2e069970a00618378a37b34Ted Kremenek EnhancedBugReport *report = 71d02e232c43b979758810794de24d3f5cde40fe93Benjamin Kramer new EnhancedBugReport(*BT_undef, BT_undef->getName(), N); 72ae1623345aed43dcd2e069970a00618378a37b34Ted Kremenek report->addRange(SE->getSourceRange()); 73ae1623345aed43dcd2e069970a00618378a37b34Ted Kremenek report->addVisitorCreator(bugreporter::registerTrackNullOrUndefValue, SE); 74ae1623345aed43dcd2e069970a00618378a37b34Ted Kremenek C.EmitReport(report); 75ae1623345aed43dcd2e069970a00618378a37b34Ted Kremenek return; 7605a2338f7ba1c8a0136e120502f80a38cf0e9fd3Zhongxing Xu } 7752e04c537633377fb14cfa4fa3c95e3e510fc942Jordy Rose 7852e04c537633377fb14cfa4fa3c95e3e510fc942Jordy Rose // See if the size value is known. It can't be undefined because we would have 7952e04c537633377fb14cfa4fa3c95e3e510fc942Jordy Rose // warned about that already. 8052e04c537633377fb14cfa4fa3c95e3e510fc942Jordy Rose if (sizeV.isUnknown()) 8152e04c537633377fb14cfa4fa3c95e3e510fc942Jordy Rose return; 82ae1623345aed43dcd2e069970a00618378a37b34Ted Kremenek 83ae1623345aed43dcd2e069970a00618378a37b34Ted Kremenek // Check if the size is zero. 8452e04c537633377fb14cfa4fa3c95e3e510fc942Jordy Rose DefinedSVal sizeD = cast<DefinedSVal>(sizeV); 85ae1623345aed43dcd2e069970a00618378a37b34Ted Kremenek 86ae1623345aed43dcd2e069970a00618378a37b34Ted Kremenek const GRState *stateNotZero, *stateZero; 8728f47b92e760ccf641ac91cb0fe1c12d9ca89795Ted Kremenek llvm::tie(stateNotZero, stateZero) = state->assume(sizeD); 88ae1623345aed43dcd2e069970a00618378a37b34Ted Kremenek 89ae1623345aed43dcd2e069970a00618378a37b34Ted Kremenek if (stateZero && !stateNotZero) { 90d048c6ef5b6cfaa0cecb8cc1d4bdace32ed21d07Ted Kremenek ExplodedNode* N = C.generateSink(stateZero); 91ae1623345aed43dcd2e069970a00618378a37b34Ted Kremenek if (!BT_zero) 92ae1623345aed43dcd2e069970a00618378a37b34Ted Kremenek BT_zero = new BuiltinBug("Declared variable-length array (VLA) has zero " 93ae1623345aed43dcd2e069970a00618378a37b34Ted Kremenek "size"); 94ae1623345aed43dcd2e069970a00618378a37b34Ted Kremenek 95ae1623345aed43dcd2e069970a00618378a37b34Ted Kremenek EnhancedBugReport *report = 96d02e232c43b979758810794de24d3f5cde40fe93Benjamin Kramer new EnhancedBugReport(*BT_zero, BT_zero->getName(), N); 97ae1623345aed43dcd2e069970a00618378a37b34Ted Kremenek report->addRange(SE->getSourceRange()); 98ae1623345aed43dcd2e069970a00618378a37b34Ted Kremenek report->addVisitorCreator(bugreporter::registerTrackNullOrUndefValue, SE); 99ae1623345aed43dcd2e069970a00618378a37b34Ted Kremenek C.EmitReport(report); 100ae1623345aed43dcd2e069970a00618378a37b34Ted Kremenek return; 10105a2338f7ba1c8a0136e120502f80a38cf0e9fd3Zhongxing Xu } 102ae1623345aed43dcd2e069970a00618378a37b34Ted Kremenek 103ae1623345aed43dcd2e069970a00618378a37b34Ted Kremenek // From this point on, assume that the size is not zero. 10452e04c537633377fb14cfa4fa3c95e3e510fc942Jordy Rose state = stateNotZero; 10552e04c537633377fb14cfa4fa3c95e3e510fc942Jordy Rose 106b2242d1b6fe4ae073361e6d8f3db751c95159ca5Jordy Rose // VLASizeChecker is responsible for defining the extent of the array being 107b2242d1b6fe4ae073361e6d8f3db751c95159ca5Jordy Rose // declared. We do this by multiplying the array length by the element size, 108b2242d1b6fe4ae073361e6d8f3db751c95159ca5Jordy Rose // then matching that with the array region's extent symbol. 109b2242d1b6fe4ae073361e6d8f3db751c95159ca5Jordy Rose 11052e04c537633377fb14cfa4fa3c95e3e510fc942Jordy Rose // Convert the array length to size_t. 111c8413fd03f73084a5c93028f8b4db619fc388087Ted Kremenek SValBuilder &svalBuilder = C.getSValBuilder(); 11252e04c537633377fb14cfa4fa3c95e3e510fc942Jordy Rose QualType SizeTy = Ctx.getSizeType(); 113c8413fd03f73084a5c93028f8b4db619fc388087Ted Kremenek NonLoc ArrayLength = cast<NonLoc>(svalBuilder.evalCast(sizeD, SizeTy, 114c8413fd03f73084a5c93028f8b4db619fc388087Ted Kremenek SE->getType())); 11552e04c537633377fb14cfa4fa3c95e3e510fc942Jordy Rose 11652e04c537633377fb14cfa4fa3c95e3e510fc942Jordy Rose // Get the element size. 11752e04c537633377fb14cfa4fa3c95e3e510fc942Jordy Rose CharUnits EleSize = Ctx.getTypeSizeInChars(VLA->getElementType()); 118c8413fd03f73084a5c93028f8b4db619fc388087Ted Kremenek SVal EleSizeVal = svalBuilder.makeIntVal(EleSize.getQuantity(), SizeTy); 11952e04c537633377fb14cfa4fa3c95e3e510fc942Jordy Rose 12052e04c537633377fb14cfa4fa3c95e3e510fc942Jordy Rose // Multiply the array length by the element size. 121c8413fd03f73084a5c93028f8b4db619fc388087Ted Kremenek SVal ArraySizeVal = svalBuilder.evalBinOpNN(state, BO_Mul, ArrayLength, 122c8413fd03f73084a5c93028f8b4db619fc388087Ted Kremenek cast<NonLoc>(EleSizeVal), SizeTy); 12352e04c537633377fb14cfa4fa3c95e3e510fc942Jordy Rose 12428f47b92e760ccf641ac91cb0fe1c12d9ca89795Ted Kremenek // Finally, assume that the array's extent matches the given size. 12552e04c537633377fb14cfa4fa3c95e3e510fc942Jordy Rose const LocationContext *LC = C.getPredecessor()->getLocationContext(); 126c8413fd03f73084a5c93028f8b4db619fc388087Ted Kremenek DefinedOrUnknownSVal Extent = 127c8413fd03f73084a5c93028f8b4db619fc388087Ted Kremenek state->getRegion(VD, LC)->getExtent(svalBuilder); 12852e04c537633377fb14cfa4fa3c95e3e510fc942Jordy Rose DefinedOrUnknownSVal ArraySize = cast<DefinedOrUnknownSVal>(ArraySizeVal); 129c8413fd03f73084a5c93028f8b4db619fc388087Ted Kremenek DefinedOrUnknownSVal sizeIsKnown = 130c8413fd03f73084a5c93028f8b4db619fc388087Ted Kremenek svalBuilder.evalEQ(state, Extent, ArraySize); 131c8413fd03f73084a5c93028f8b4db619fc388087Ted Kremenek state = state->assume(sizeIsKnown, true); 13252e04c537633377fb14cfa4fa3c95e3e510fc942Jordy Rose 133e4f5d72a504be32483aebdeb48fd2effce6756f2Zhongxing Xu // Assume should not fail at this point. 134e4f5d72a504be32483aebdeb48fd2effce6756f2Zhongxing Xu assert(state); 135e4f5d72a504be32483aebdeb48fd2effce6756f2Zhongxing Xu 13652e04c537633377fb14cfa4fa3c95e3e510fc942Jordy Rose // Remember our assumptions! 13752e04c537633377fb14cfa4fa3c95e3e510fc942Jordy Rose C.addTransition(state); 13805a2338f7ba1c8a0136e120502f80a38cf0e9fd3Zhongxing Xu} 139