xref: /minix3/external/bsd/llvm/dist/clang/lib/StaticAnalyzer/Checkers/ArrayBoundChecker.cpp (revision 0a6a1f1d05b60e214de2f05a7310ddd1f0e590e7)
1f4a2713aSLionel Sambuc //== ArrayBoundChecker.cpp ------------------------------*- C++ -*--==//
2f4a2713aSLionel Sambuc //
3f4a2713aSLionel Sambuc //                     The LLVM Compiler Infrastructure
4f4a2713aSLionel Sambuc //
5f4a2713aSLionel Sambuc // This file is distributed under the University of Illinois Open Source
6f4a2713aSLionel Sambuc // License. See LICENSE.TXT for details.
7f4a2713aSLionel Sambuc //
8f4a2713aSLionel Sambuc //===----------------------------------------------------------------------===//
9f4a2713aSLionel Sambuc //
10f4a2713aSLionel Sambuc // This file defines ArrayBoundChecker, which is a path-sensitive check
11f4a2713aSLionel Sambuc // which looks for an out-of-bound array element access.
12f4a2713aSLionel Sambuc //
13f4a2713aSLionel Sambuc //===----------------------------------------------------------------------===//
14f4a2713aSLionel Sambuc 
15f4a2713aSLionel Sambuc #include "ClangSACheckers.h"
16f4a2713aSLionel Sambuc #include "clang/StaticAnalyzer/Core/BugReporter/BugType.h"
17f4a2713aSLionel Sambuc #include "clang/StaticAnalyzer/Core/Checker.h"
18f4a2713aSLionel Sambuc #include "clang/StaticAnalyzer/Core/CheckerManager.h"
19f4a2713aSLionel Sambuc #include "clang/StaticAnalyzer/Core/PathSensitive/CheckerContext.h"
20f4a2713aSLionel Sambuc #include "clang/StaticAnalyzer/Core/PathSensitive/ExprEngine.h"
21f4a2713aSLionel Sambuc 
22f4a2713aSLionel Sambuc using namespace clang;
23f4a2713aSLionel Sambuc using namespace ento;
24f4a2713aSLionel Sambuc 
25f4a2713aSLionel Sambuc namespace {
26f4a2713aSLionel Sambuc class ArrayBoundChecker :
27f4a2713aSLionel Sambuc     public Checker<check::Location> {
28*0a6a1f1dSLionel Sambuc   mutable std::unique_ptr<BuiltinBug> BT;
29*0a6a1f1dSLionel Sambuc 
30f4a2713aSLionel Sambuc public:
31f4a2713aSLionel Sambuc   void checkLocation(SVal l, bool isLoad, const Stmt* S,
32f4a2713aSLionel Sambuc                      CheckerContext &C) const;
33f4a2713aSLionel Sambuc };
34f4a2713aSLionel Sambuc }
35f4a2713aSLionel Sambuc 
checkLocation(SVal l,bool isLoad,const Stmt * LoadS,CheckerContext & C) const36f4a2713aSLionel Sambuc void ArrayBoundChecker::checkLocation(SVal l, bool isLoad, const Stmt* LoadS,
37f4a2713aSLionel Sambuc                                       CheckerContext &C) const {
38f4a2713aSLionel Sambuc   // Check for out of bound array element access.
39f4a2713aSLionel Sambuc   const MemRegion *R = l.getAsRegion();
40f4a2713aSLionel Sambuc   if (!R)
41f4a2713aSLionel Sambuc     return;
42f4a2713aSLionel Sambuc 
43f4a2713aSLionel Sambuc   const ElementRegion *ER = dyn_cast<ElementRegion>(R);
44f4a2713aSLionel Sambuc   if (!ER)
45f4a2713aSLionel Sambuc     return;
46f4a2713aSLionel Sambuc 
47f4a2713aSLionel Sambuc   // Get the index of the accessed element.
48f4a2713aSLionel Sambuc   DefinedOrUnknownSVal Idx = ER->getIndex().castAs<DefinedOrUnknownSVal>();
49f4a2713aSLionel Sambuc 
50f4a2713aSLionel Sambuc   // Zero index is always in bound, this also passes ElementRegions created for
51f4a2713aSLionel Sambuc   // pointer casts.
52f4a2713aSLionel Sambuc   if (Idx.isZeroConstant())
53f4a2713aSLionel Sambuc     return;
54f4a2713aSLionel Sambuc 
55f4a2713aSLionel Sambuc   ProgramStateRef state = C.getState();
56f4a2713aSLionel Sambuc 
57f4a2713aSLionel Sambuc   // Get the size of the array.
58f4a2713aSLionel Sambuc   DefinedOrUnknownSVal NumElements
59f4a2713aSLionel Sambuc     = C.getStoreManager().getSizeInElements(state, ER->getSuperRegion(),
60f4a2713aSLionel Sambuc                                             ER->getValueType());
61f4a2713aSLionel Sambuc 
62f4a2713aSLionel Sambuc   ProgramStateRef StInBound = state->assumeInBound(Idx, NumElements, true);
63f4a2713aSLionel Sambuc   ProgramStateRef StOutBound = state->assumeInBound(Idx, NumElements, false);
64f4a2713aSLionel Sambuc   if (StOutBound && !StInBound) {
65f4a2713aSLionel Sambuc     ExplodedNode *N = C.generateSink(StOutBound);
66f4a2713aSLionel Sambuc     if (!N)
67f4a2713aSLionel Sambuc       return;
68f4a2713aSLionel Sambuc 
69f4a2713aSLionel Sambuc     if (!BT)
70*0a6a1f1dSLionel Sambuc       BT.reset(new BuiltinBug(
71*0a6a1f1dSLionel Sambuc           this, "Out-of-bound array access",
72f4a2713aSLionel Sambuc           "Access out-of-bound array element (buffer overflow)"));
73f4a2713aSLionel Sambuc 
74f4a2713aSLionel Sambuc     // FIXME: It would be nice to eventually make this diagnostic more clear,
75f4a2713aSLionel Sambuc     // e.g., by referencing the original declaration or by saying *why* this
76f4a2713aSLionel Sambuc     // reference is outside the range.
77f4a2713aSLionel Sambuc 
78f4a2713aSLionel Sambuc     // Generate a report for this bug.
79f4a2713aSLionel Sambuc     BugReport *report =
80f4a2713aSLionel Sambuc       new BugReport(*BT, BT->getDescription(), N);
81f4a2713aSLionel Sambuc 
82f4a2713aSLionel Sambuc     report->addRange(LoadS->getSourceRange());
83f4a2713aSLionel Sambuc     C.emitReport(report);
84f4a2713aSLionel Sambuc     return;
85f4a2713aSLionel Sambuc   }
86f4a2713aSLionel Sambuc 
87f4a2713aSLionel Sambuc   // Array bound check succeeded.  From this point forward the array bound
88f4a2713aSLionel Sambuc   // should always succeed.
89f4a2713aSLionel Sambuc   C.addTransition(StInBound);
90f4a2713aSLionel Sambuc }
91f4a2713aSLionel Sambuc 
registerArrayBoundChecker(CheckerManager & mgr)92f4a2713aSLionel Sambuc void ento::registerArrayBoundChecker(CheckerManager &mgr) {
93f4a2713aSLionel Sambuc   mgr.registerChecker<ArrayBoundChecker>();
94f4a2713aSLionel Sambuc }
95