xref: /openbsd-src/gnu/llvm/clang/lib/StaticAnalyzer/Checkers/BoolAssignmentChecker.cpp (revision 12c855180aad702bbcca06e0398d774beeafb155)
1e5dd7070Spatrick //== BoolAssignmentChecker.cpp - Boolean assignment checker -----*- C++ -*--==//
2e5dd7070Spatrick //
3e5dd7070Spatrick // Part of the LLVM Project, under the Apache License v2.0 with LLVM Exceptions.
4e5dd7070Spatrick // See https://llvm.org/LICENSE.txt for license information.
5e5dd7070Spatrick // SPDX-License-Identifier: Apache-2.0 WITH LLVM-exception
6e5dd7070Spatrick //
7e5dd7070Spatrick //===----------------------------------------------------------------------===//
8e5dd7070Spatrick //
9e5dd7070Spatrick // This defines BoolAssignmentChecker, a builtin check in ExprEngine that
10e5dd7070Spatrick // performs checks for assignment of non-Boolean values to Boolean variables.
11e5dd7070Spatrick //
12e5dd7070Spatrick //===----------------------------------------------------------------------===//
13e5dd7070Spatrick 
14e5dd7070Spatrick #include "clang/StaticAnalyzer/Checkers/BuiltinCheckerRegistration.h"
15*12c85518Srobert #include "clang/StaticAnalyzer/Checkers/Taint.h"
16e5dd7070Spatrick #include "clang/StaticAnalyzer/Core/BugReporter/BugType.h"
17e5dd7070Spatrick #include "clang/StaticAnalyzer/Core/Checker.h"
18e5dd7070Spatrick #include "clang/StaticAnalyzer/Core/CheckerManager.h"
19e5dd7070Spatrick #include "clang/StaticAnalyzer/Core/PathSensitive/CheckerContext.h"
20*12c85518Srobert #include <optional>
21e5dd7070Spatrick 
22e5dd7070Spatrick using namespace clang;
23e5dd7070Spatrick using namespace ento;
24e5dd7070Spatrick 
25e5dd7070Spatrick namespace {
26e5dd7070Spatrick   class BoolAssignmentChecker : public Checker< check::Bind > {
27e5dd7070Spatrick     mutable std::unique_ptr<BuiltinBug> BT;
28*12c85518Srobert     void emitReport(ProgramStateRef state, CheckerContext &C,
29*12c85518Srobert                     bool IsTainted = false) const;
30*12c85518Srobert 
31e5dd7070Spatrick   public:
32e5dd7070Spatrick     void checkBind(SVal loc, SVal val, const Stmt *S, CheckerContext &C) const;
33e5dd7070Spatrick   };
34e5dd7070Spatrick } // end anonymous namespace
35e5dd7070Spatrick 
emitReport(ProgramStateRef state,CheckerContext & C,bool IsTainted) const36*12c85518Srobert void BoolAssignmentChecker::emitReport(ProgramStateRef state, CheckerContext &C,
37*12c85518Srobert                                        bool IsTainted) const {
38e5dd7070Spatrick   if (ExplodedNode *N = C.generateNonFatalErrorNode(state)) {
39e5dd7070Spatrick     if (!BT)
40e5dd7070Spatrick       BT.reset(new BuiltinBug(this, "Assignment of a non-Boolean value"));
41e5dd7070Spatrick 
42*12c85518Srobert     StringRef Msg = IsTainted ? "Might assign a tainted non-Boolean value"
43*12c85518Srobert                               : "Assignment of a non-Boolean value";
44*12c85518Srobert     C.emitReport(std::make_unique<PathSensitiveBugReport>(*BT, Msg, N));
45e5dd7070Spatrick   }
46e5dd7070Spatrick }
47e5dd7070Spatrick 
isBooleanType(QualType Ty)48e5dd7070Spatrick static bool isBooleanType(QualType Ty) {
49e5dd7070Spatrick   if (Ty->isBooleanType()) // C++ or C99
50e5dd7070Spatrick     return true;
51e5dd7070Spatrick 
52e5dd7070Spatrick   if (const TypedefType *TT = Ty->getAs<TypedefType>())
53e5dd7070Spatrick     return TT->getDecl()->getName() == "BOOL"   || // Objective-C
54e5dd7070Spatrick            TT->getDecl()->getName() == "_Bool"  || // stdbool.h < C99
55e5dd7070Spatrick            TT->getDecl()->getName() == "Boolean";  // MacTypes.h
56e5dd7070Spatrick 
57e5dd7070Spatrick   return false;
58e5dd7070Spatrick }
59e5dd7070Spatrick 
checkBind(SVal loc,SVal val,const Stmt * S,CheckerContext & C) const60e5dd7070Spatrick void BoolAssignmentChecker::checkBind(SVal loc, SVal val, const Stmt *S,
61e5dd7070Spatrick                                       CheckerContext &C) const {
62e5dd7070Spatrick 
63e5dd7070Spatrick   // We are only interested in stores into Booleans.
64e5dd7070Spatrick   const TypedValueRegion *TR =
65e5dd7070Spatrick     dyn_cast_or_null<TypedValueRegion>(loc.getAsRegion());
66e5dd7070Spatrick 
67e5dd7070Spatrick   if (!TR)
68e5dd7070Spatrick     return;
69e5dd7070Spatrick 
70e5dd7070Spatrick   QualType valTy = TR->getValueType();
71e5dd7070Spatrick 
72e5dd7070Spatrick   if (!isBooleanType(valTy))
73e5dd7070Spatrick     return;
74e5dd7070Spatrick 
75e5dd7070Spatrick   // Get the value of the right-hand side.  We only care about values
76e5dd7070Spatrick   // that are defined (UnknownVals and UndefinedVals are handled by other
77e5dd7070Spatrick   // checkers).
78*12c85518Srobert   std::optional<NonLoc> NV = val.getAs<NonLoc>();
79ec727ea7Spatrick   if (!NV)
80e5dd7070Spatrick     return;
81e5dd7070Spatrick 
82e5dd7070Spatrick   // Check if the assigned value meets our criteria for correctness.  It must
83e5dd7070Spatrick   // be a value that is either 0 or 1.  One way to check this is to see if
84e5dd7070Spatrick   // the value is possibly < 0 (for a negative value) or greater than 1.
85e5dd7070Spatrick   ProgramStateRef state = C.getState();
86e5dd7070Spatrick   SValBuilder &svalBuilder = C.getSValBuilder();
87ec727ea7Spatrick   BasicValueFactory &BVF = svalBuilder.getBasicValueFactory();
88e5dd7070Spatrick   ConstraintManager &CM = C.getConstraintManager();
89e5dd7070Spatrick 
90ec727ea7Spatrick   llvm::APSInt Zero = BVF.getValue(0, valTy);
91ec727ea7Spatrick   llvm::APSInt One = BVF.getValue(1, valTy);
92e5dd7070Spatrick 
93ec727ea7Spatrick   ProgramStateRef StIn, StOut;
94ec727ea7Spatrick   std::tie(StIn, StOut) = CM.assumeInclusiveRangeDual(state, *NV, Zero, One);
95e5dd7070Spatrick 
96ec727ea7Spatrick   if (!StIn)
97ec727ea7Spatrick     emitReport(StOut, C);
98*12c85518Srobert   if (StIn && StOut && taint::isTainted(state, *NV))
99*12c85518Srobert     emitReport(StOut, C, /*IsTainted=*/true);
100e5dd7070Spatrick }
101e5dd7070Spatrick 
registerBoolAssignmentChecker(CheckerManager & mgr)102e5dd7070Spatrick void ento::registerBoolAssignmentChecker(CheckerManager &mgr) {
103e5dd7070Spatrick     mgr.registerChecker<BoolAssignmentChecker>();
104e5dd7070Spatrick }
105e5dd7070Spatrick 
shouldRegisterBoolAssignmentChecker(const CheckerManager & mgr)106ec727ea7Spatrick bool ento::shouldRegisterBoolAssignmentChecker(const CheckerManager &mgr) {
107e5dd7070Spatrick   return true;
108e5dd7070Spatrick }
109