1f4a2713aSLionel Sambuc //== ArrayBoundChecker.cpp ------------------------------*- C++ -*--==//
2f4a2713aSLionel Sambuc //
3f4a2713aSLionel Sambuc // The LLVM Compiler Infrastructure
4f4a2713aSLionel Sambuc //
5f4a2713aSLionel Sambuc // This file is distributed under the University of Illinois Open Source
6f4a2713aSLionel Sambuc // License. See LICENSE.TXT for details.
7f4a2713aSLionel Sambuc //
8f4a2713aSLionel Sambuc //===----------------------------------------------------------------------===//
9f4a2713aSLionel Sambuc //
10f4a2713aSLionel Sambuc // This file defines ArrayBoundChecker, which is a path-sensitive check
11f4a2713aSLionel Sambuc // which looks for an out-of-bound array element access.
12f4a2713aSLionel Sambuc //
13f4a2713aSLionel Sambuc //===----------------------------------------------------------------------===//
14f4a2713aSLionel Sambuc
15f4a2713aSLionel Sambuc #include "ClangSACheckers.h"
16f4a2713aSLionel Sambuc #include "clang/StaticAnalyzer/Core/BugReporter/BugType.h"
17f4a2713aSLionel Sambuc #include "clang/StaticAnalyzer/Core/Checker.h"
18f4a2713aSLionel Sambuc #include "clang/StaticAnalyzer/Core/CheckerManager.h"
19f4a2713aSLionel Sambuc #include "clang/StaticAnalyzer/Core/PathSensitive/CheckerContext.h"
20f4a2713aSLionel Sambuc #include "clang/StaticAnalyzer/Core/PathSensitive/ExprEngine.h"
21f4a2713aSLionel Sambuc
22f4a2713aSLionel Sambuc using namespace clang;
23f4a2713aSLionel Sambuc using namespace ento;
24f4a2713aSLionel Sambuc
25f4a2713aSLionel Sambuc namespace {
26f4a2713aSLionel Sambuc class ArrayBoundChecker :
27f4a2713aSLionel Sambuc public Checker<check::Location> {
28*0a6a1f1dSLionel Sambuc mutable std::unique_ptr<BuiltinBug> BT;
29*0a6a1f1dSLionel Sambuc
30f4a2713aSLionel Sambuc public:
31f4a2713aSLionel Sambuc void checkLocation(SVal l, bool isLoad, const Stmt* S,
32f4a2713aSLionel Sambuc CheckerContext &C) const;
33f4a2713aSLionel Sambuc };
34f4a2713aSLionel Sambuc }
35f4a2713aSLionel Sambuc
checkLocation(SVal l,bool isLoad,const Stmt * LoadS,CheckerContext & C) const36f4a2713aSLionel Sambuc void ArrayBoundChecker::checkLocation(SVal l, bool isLoad, const Stmt* LoadS,
37f4a2713aSLionel Sambuc CheckerContext &C) const {
38f4a2713aSLionel Sambuc // Check for out of bound array element access.
39f4a2713aSLionel Sambuc const MemRegion *R = l.getAsRegion();
40f4a2713aSLionel Sambuc if (!R)
41f4a2713aSLionel Sambuc return;
42f4a2713aSLionel Sambuc
43f4a2713aSLionel Sambuc const ElementRegion *ER = dyn_cast<ElementRegion>(R);
44f4a2713aSLionel Sambuc if (!ER)
45f4a2713aSLionel Sambuc return;
46f4a2713aSLionel Sambuc
47f4a2713aSLionel Sambuc // Get the index of the accessed element.
48f4a2713aSLionel Sambuc DefinedOrUnknownSVal Idx = ER->getIndex().castAs<DefinedOrUnknownSVal>();
49f4a2713aSLionel Sambuc
50f4a2713aSLionel Sambuc // Zero index is always in bound, this also passes ElementRegions created for
51f4a2713aSLionel Sambuc // pointer casts.
52f4a2713aSLionel Sambuc if (Idx.isZeroConstant())
53f4a2713aSLionel Sambuc return;
54f4a2713aSLionel Sambuc
55f4a2713aSLionel Sambuc ProgramStateRef state = C.getState();
56f4a2713aSLionel Sambuc
57f4a2713aSLionel Sambuc // Get the size of the array.
58f4a2713aSLionel Sambuc DefinedOrUnknownSVal NumElements
59f4a2713aSLionel Sambuc = C.getStoreManager().getSizeInElements(state, ER->getSuperRegion(),
60f4a2713aSLionel Sambuc ER->getValueType());
61f4a2713aSLionel Sambuc
62f4a2713aSLionel Sambuc ProgramStateRef StInBound = state->assumeInBound(Idx, NumElements, true);
63f4a2713aSLionel Sambuc ProgramStateRef StOutBound = state->assumeInBound(Idx, NumElements, false);
64f4a2713aSLionel Sambuc if (StOutBound && !StInBound) {
65f4a2713aSLionel Sambuc ExplodedNode *N = C.generateSink(StOutBound);
66f4a2713aSLionel Sambuc if (!N)
67f4a2713aSLionel Sambuc return;
68f4a2713aSLionel Sambuc
69f4a2713aSLionel Sambuc if (!BT)
70*0a6a1f1dSLionel Sambuc BT.reset(new BuiltinBug(
71*0a6a1f1dSLionel Sambuc this, "Out-of-bound array access",
72f4a2713aSLionel Sambuc "Access out-of-bound array element (buffer overflow)"));
73f4a2713aSLionel Sambuc
74f4a2713aSLionel Sambuc // FIXME: It would be nice to eventually make this diagnostic more clear,
75f4a2713aSLionel Sambuc // e.g., by referencing the original declaration or by saying *why* this
76f4a2713aSLionel Sambuc // reference is outside the range.
77f4a2713aSLionel Sambuc
78f4a2713aSLionel Sambuc // Generate a report for this bug.
79f4a2713aSLionel Sambuc BugReport *report =
80f4a2713aSLionel Sambuc new BugReport(*BT, BT->getDescription(), N);
81f4a2713aSLionel Sambuc
82f4a2713aSLionel Sambuc report->addRange(LoadS->getSourceRange());
83f4a2713aSLionel Sambuc C.emitReport(report);
84f4a2713aSLionel Sambuc return;
85f4a2713aSLionel Sambuc }
86f4a2713aSLionel Sambuc
87f4a2713aSLionel Sambuc // Array bound check succeeded. From this point forward the array bound
88f4a2713aSLionel Sambuc // should always succeed.
89f4a2713aSLionel Sambuc C.addTransition(StInBound);
90f4a2713aSLionel Sambuc }
91f4a2713aSLionel Sambuc
registerArrayBoundChecker(CheckerManager & mgr)92f4a2713aSLionel Sambuc void ento::registerArrayBoundChecker(CheckerManager &mgr) {
93f4a2713aSLionel Sambuc mgr.registerChecker<ArrayBoundChecker>();
94f4a2713aSLionel Sambuc }
95