1 //== DivZeroChecker.cpp - Division by zero checker --------------*- C++ -*--==// 2 // 3 // The LLVM Compiler Infrastructure 4 // 5 // This file is distributed under the University of Illinois Open Source 6 // License. See LICENSE.TXT for details. 7 // 8 //===----------------------------------------------------------------------===// 9 // 10 // This defines DivZeroChecker, a builtin check in ExprEngine that performs 11 // checks for division by zeros. 12 // 13 //===----------------------------------------------------------------------===// 14 15 #include "ClangSACheckers.h" 16 #include "clang/StaticAnalyzer/Core/BugReporter/BugType.h" 17 #include "clang/StaticAnalyzer/Core/Checker.h" 18 #include "clang/StaticAnalyzer/Core/CheckerManager.h" 19 #include "clang/StaticAnalyzer/Core/PathSensitive/CheckerContext.h" 20 21 using namespace clang; 22 using namespace ento; 23 24 namespace { 25 class DivZeroChecker : public Checker< check::PreStmt<BinaryOperator> > { 26 mutable std::unique_ptr<BuiltinBug> BT; 27 void reportBug(const char *Msg, ProgramStateRef StateZero, CheckerContext &C, 28 std::unique_ptr<BugReporterVisitor> Visitor = nullptr) const; 29 30 public: 31 void checkPreStmt(const BinaryOperator *B, CheckerContext &C) const; 32 }; 33 } // end anonymous namespace 34 35 static const Expr *getDenomExpr(const ExplodedNode *N) { 36 const Stmt *S = N->getLocationAs<PreStmt>()->getStmt(); 37 if (const auto *BE = dyn_cast<BinaryOperator>(S)) 38 return BE->getRHS(); 39 return nullptr; 40 } 41 42 void DivZeroChecker::reportBug( 43 const char *Msg, ProgramStateRef StateZero, CheckerContext &C, 44 std::unique_ptr<BugReporterVisitor> Visitor) const { 45 if (ExplodedNode *N = C.generateErrorNode(StateZero)) { 46 if (!BT) 47 BT.reset(new BuiltinBug(this, "Division by zero")); 48 49 auto R = llvm::make_unique<BugReport>(*BT, Msg, N); 50 R->addVisitor(std::move(Visitor)); 51 bugreporter::trackExpressionValue(N, getDenomExpr(N), *R); 52 C.emitReport(std::move(R)); 53 } 54 } 55 56 void DivZeroChecker::checkPreStmt(const BinaryOperator *B, 57 CheckerContext &C) const { 58 BinaryOperator::Opcode Op = B->getOpcode(); 59 if (Op != BO_Div && 60 Op != BO_Rem && 61 Op != BO_DivAssign && 62 Op != BO_RemAssign) 63 return; 64 65 if (!B->getRHS()->getType()->isScalarType()) 66 return; 67 68 SVal Denom = C.getSVal(B->getRHS()); 69 Optional<DefinedSVal> DV = Denom.getAs<DefinedSVal>(); 70 71 // Divide-by-undefined handled in the generic checking for uses of 72 // undefined values. 73 if (!DV) 74 return; 75 76 // Check for divide by zero. 77 ConstraintManager &CM = C.getConstraintManager(); 78 ProgramStateRef stateNotZero, stateZero; 79 std::tie(stateNotZero, stateZero) = CM.assumeDual(C.getState(), *DV); 80 81 if (!stateNotZero) { 82 assert(stateZero); 83 reportBug("Division by zero", stateZero, C); 84 return; 85 } 86 87 bool TaintedD = C.getState()->isTainted(*DV); 88 if ((stateNotZero && stateZero && TaintedD)) { 89 reportBug("Division by a tainted value, possibly zero", stateZero, C, 90 llvm::make_unique<TaintBugVisitor>(*DV)); 91 return; 92 } 93 94 // If we get here, then the denom should not be zero. We abandon the implicit 95 // zero denom case for now. 96 C.addTransition(stateNotZero); 97 } 98 99 void ento::registerDivZeroChecker(CheckerManager &mgr) { 100 mgr.registerChecker<DivZeroChecker>(); 101 } 102