xref: /freebsd-src/contrib/llvm-project/clang/lib/StaticAnalyzer/Checkers/StdLibraryFunctionsChecker.cpp (revision 647cbc5de815c5651677bf8582797f716ec7b48d)
1 //=== StdLibraryFunctionsChecker.cpp - Model standard functions -*- C++ -*-===//
2 //
3 // Part of the LLVM Project, under the Apache License v2.0 with LLVM Exceptions.
4 // See https://llvm.org/LICENSE.txt for license information.
5 // SPDX-License-Identifier: Apache-2.0 WITH LLVM-exception
6 //
7 //===----------------------------------------------------------------------===//
8 //
9 // This checker improves modeling of a few simple library functions.
10 //
11 // This checker provides a specification format - `Summary' - and
12 // contains descriptions of some library functions in this format. Each
13 // specification contains a list of branches for splitting the program state
14 // upon call, and range constraints on argument and return-value symbols that
15 // are satisfied on each branch. This spec can be expanded to include more
16 // items, like external effects of the function.
17 //
18 // The main difference between this approach and the body farms technique is
19 // in more explicit control over how many branches are produced. For example,
20 // consider standard C function `ispunct(int x)', which returns a non-zero value
21 // iff `x' is a punctuation character, that is, when `x' is in range
22 //   ['!', '/']   [':', '@']  U  ['[', '\`']  U  ['{', '~'].
23 // `Summary' provides only two branches for this function. However,
24 // any attempt to describe this range with if-statements in the body farm
25 // would result in many more branches. Because each branch needs to be analyzed
26 // independently, this significantly reduces performance. Additionally,
27 // once we consider a branch on which `x' is in range, say, ['!', '/'],
28 // we assume that such branch is an important separate path through the program,
29 // which may lead to false positives because considering this particular path
30 // was not consciously intended, and therefore it might have been unreachable.
31 //
32 // This checker uses eval::Call for modeling pure functions (functions without
33 // side effets), for which their `Summary' is a precise model. This avoids
34 // unnecessary invalidation passes. Conflicts with other checkers are unlikely
35 // because if the function has no other effects, other checkers would probably
36 // never want to improve upon the modeling done by this checker.
37 //
38 // Non-pure functions, for which only partial improvement over the default
39 // behavior is expected, are modeled via check::PostCall, non-intrusively.
40 //
41 //===----------------------------------------------------------------------===//
42 
43 #include "ErrnoModeling.h"
44 #include "clang/StaticAnalyzer/Checkers/BuiltinCheckerRegistration.h"
45 #include "clang/StaticAnalyzer/Core/BugReporter/BugType.h"
46 #include "clang/StaticAnalyzer/Core/Checker.h"
47 #include "clang/StaticAnalyzer/Core/CheckerManager.h"
48 #include "clang/StaticAnalyzer/Core/PathSensitive/CallEvent.h"
49 #include "clang/StaticAnalyzer/Core/PathSensitive/CheckerContext.h"
50 #include "clang/StaticAnalyzer/Core/PathSensitive/CheckerHelpers.h"
51 #include "clang/StaticAnalyzer/Core/PathSensitive/DynamicExtent.h"
52 #include "llvm/ADT/STLExtras.h"
53 #include "llvm/ADT/SmallString.h"
54 #include "llvm/ADT/StringExtras.h"
55 #include "llvm/Support/FormatVariadic.h"
56 
57 #include <optional>
58 #include <string>
59 
60 using namespace clang;
61 using namespace clang::ento;
62 
63 namespace {
64 class StdLibraryFunctionsChecker
65     : public Checker<check::PreCall, check::PostCall, eval::Call> {
66 
67   class Summary;
68 
69   /// Specify how much the analyzer engine should entrust modeling this function
70   /// to us.
71   enum InvalidationKind {
72     /// No \c eval::Call for the function, it can be modeled elsewhere.
73     /// This checker checks only pre and post conditions.
74     NoEvalCall,
75     /// The function is modeled completely in this checker.
76     EvalCallAsPure
77   };
78 
79   /// Given a range, should the argument stay inside or outside this range?
80   enum RangeKind { OutOfRange, WithinRange };
81 
82   static RangeKind negateKind(RangeKind K) {
83     switch (K) {
84     case OutOfRange:
85       return WithinRange;
86     case WithinRange:
87       return OutOfRange;
88     }
89     llvm_unreachable("Unknown range kind");
90   }
91 
92   /// The universal integral type to use in value range descriptions.
93   /// Unsigned to make sure overflows are well-defined.
94   typedef uint64_t RangeInt;
95 
96   /// Describes a single range constraint. Eg. {{0, 1}, {3, 4}} is
97   /// a non-negative integer, which less than 5 and not equal to 2.
98   typedef std::vector<std::pair<RangeInt, RangeInt>> IntRangeVector;
99 
100   /// A reference to an argument or return value by its number.
101   /// ArgNo in CallExpr and CallEvent is defined as Unsigned, but
102   /// obviously uint32_t should be enough for all practical purposes.
103   typedef uint32_t ArgNo;
104   /// Special argument number for specifying the return value.
105   static const ArgNo Ret;
106 
107   /// Get a string representation of an argument index.
108   /// E.g.: (1) -> '1st arg', (2) - > '2nd arg'
109   static void printArgDesc(ArgNo, llvm::raw_ostream &Out);
110   /// Print value X of the argument in form " (which is X)",
111   /// if the value is a fixed known value, otherwise print nothing.
112   /// This is used as simple explanation of values if possible.
113   static void printArgValueInfo(ArgNo ArgN, ProgramStateRef State,
114                                 const CallEvent &Call, llvm::raw_ostream &Out);
115   /// Append textual description of a numeric range [RMin,RMax] to
116   /// \p Out.
117   static void appendInsideRangeDesc(llvm::APSInt RMin, llvm::APSInt RMax,
118                                     QualType ArgT, BasicValueFactory &BVF,
119                                     llvm::raw_ostream &Out);
120   /// Append textual description of a numeric range out of [RMin,RMax] to
121   /// \p Out.
122   static void appendOutOfRangeDesc(llvm::APSInt RMin, llvm::APSInt RMax,
123                                    QualType ArgT, BasicValueFactory &BVF,
124                                    llvm::raw_ostream &Out);
125 
126   class ValueConstraint;
127 
128   /// Pointer to the ValueConstraint. We need a copyable, polymorphic and
129   /// default initializable type (vector needs that). A raw pointer was good,
130   /// however, we cannot default initialize that. unique_ptr makes the Summary
131   /// class non-copyable, therefore not an option. Releasing the copyability
132   /// requirement would render the initialization of the Summary map infeasible.
133   /// Mind that a pointer to a new value constraint is created when the negate
134   /// function is used.
135   using ValueConstraintPtr = std::shared_ptr<ValueConstraint>;
136 
137   /// Polymorphic base class that represents a constraint on a given argument
138   /// (or return value) of a function. Derived classes implement different kind
139   /// of constraints, e.g range constraints or correlation between two
140   /// arguments.
141   /// These are used as argument constraints (preconditions) of functions, in
142   /// which case a bug report may be emitted if the constraint is not satisfied.
143   /// Another use is as conditions for summary cases, to create different
144   /// classes of behavior for a function. In this case no description of the
145   /// constraint is needed because the summary cases have an own (not generated)
146   /// description string.
147   class ValueConstraint {
148   public:
149     ValueConstraint(ArgNo ArgN) : ArgN(ArgN) {}
150     virtual ~ValueConstraint() {}
151 
152     /// Apply the effects of the constraint on the given program state. If null
153     /// is returned then the constraint is not feasible.
154     virtual ProgramStateRef apply(ProgramStateRef State, const CallEvent &Call,
155                                   const Summary &Summary,
156                                   CheckerContext &C) const = 0;
157 
158     /// Represents that in which context do we require a description of the
159     /// constraint.
160     enum DescriptionKind {
161       /// Describe a constraint that was violated.
162       /// Description should start with something like "should be".
163       Violation,
164       /// Describe a constraint that was assumed to be true.
165       /// This can be used when a precondition is satisfied, or when a summary
166       /// case is applied.
167       /// Description should start with something like "is".
168       Assumption
169     };
170 
171     /// Give a description that explains the constraint to the user. Used when
172     /// a bug is reported or when the constraint is applied and displayed as a
173     /// note. The description should not mention the argument (getArgNo).
174     /// See StdLibraryFunctionsChecker::reportBug about how this function is
175     /// used (this function is used not only there).
176     virtual void describe(DescriptionKind DK, const CallEvent &Call,
177                           ProgramStateRef State, const Summary &Summary,
178                           llvm::raw_ostream &Out) const {
179       // There are some descendant classes that are not used as argument
180       // constraints, e.g. ComparisonConstraint. In that case we can safely
181       // ignore the implementation of this function.
182       llvm_unreachable(
183           "Description not implemented for summary case constraints");
184     }
185 
186     /// Give a description that explains the actual argument value (where the
187     /// current ValueConstraint applies to) to the user. This function should be
188     /// called only when the current constraint is satisfied by the argument.
189     /// It should produce a more precise description than the constraint itself.
190     /// The actual value of the argument and the program state can be used to
191     /// make the description more precise. In the most simple case, if the
192     /// argument has a fixed known value this value can be printed into \p Out,
193     /// this is done by default.
194     /// The function should return true if a description was printed to \p Out,
195     /// otherwise false.
196     /// See StdLibraryFunctionsChecker::reportBug about how this function is
197     /// used.
198     virtual bool describeArgumentValue(const CallEvent &Call,
199                                        ProgramStateRef State,
200                                        const Summary &Summary,
201                                        llvm::raw_ostream &Out) const {
202       if (auto N = getArgSVal(Call, getArgNo()).getAs<NonLoc>()) {
203         if (const llvm::APSInt *Int = N->getAsInteger()) {
204           Out << *Int;
205           return true;
206         }
207       }
208       return false;
209     }
210 
211     /// Return those arguments that should be tracked when we report a bug about
212     /// argument constraint violation. By default it is the argument that is
213     /// constrained, however, in some special cases we need to track other
214     /// arguments as well. E.g. a buffer size might be encoded in another
215     /// argument.
216     /// The "return value" argument number can not occur as returned value.
217     virtual std::vector<ArgNo> getArgsToTrack() const { return {ArgN}; }
218 
219     /// Get a constraint that represents exactly the opposite of the current.
220     virtual ValueConstraintPtr negate() const {
221       llvm_unreachable("Not implemented");
222     };
223 
224     /// Check whether the constraint is malformed or not. It is malformed if the
225     /// specified argument has a mismatch with the given FunctionDecl (e.g. the
226     /// arg number is out-of-range of the function's argument list).
227     /// This condition can indicate if a probably wrong or unexpected function
228     /// was found where the constraint is to be applied.
229     bool checkValidity(const FunctionDecl *FD) const {
230       const bool ValidArg = ArgN == Ret || ArgN < FD->getNumParams();
231       assert(ValidArg && "Arg out of range!");
232       if (!ValidArg)
233         return false;
234       // Subclasses may further refine the validation.
235       return checkSpecificValidity(FD);
236     }
237 
238     /// Return the argument number (may be placeholder for "return value").
239     ArgNo getArgNo() const { return ArgN; }
240 
241   protected:
242     /// Argument to which to apply the constraint. It can be a real argument of
243     /// the function to check, or a special value to indicate the return value
244     /// of the function.
245     /// Every constraint is assigned to one main argument, even if other
246     /// arguments are involved.
247     ArgNo ArgN;
248 
249     /// Do constraint-specific validation check.
250     virtual bool checkSpecificValidity(const FunctionDecl *FD) const {
251       return true;
252     }
253   };
254 
255   /// Check if a single argument falls into a specific "range".
256   /// A range is formed as a set of intervals.
257   /// E.g. \code {['A', 'Z'], ['a', 'z'], ['_', '_']} \endcode
258   /// The intervals are closed intervals that contain one or more values.
259   ///
260   /// The default constructed RangeConstraint has an empty range, applying
261   /// such constraint does not involve any assumptions, thus the State remains
262   /// unchanged. This is meaningful, if the range is dependent on a looked up
263   /// type (e.g. [0, Socklen_tMax]). If the type is not found, then the range
264   /// is default initialized to be empty.
265   class RangeConstraint : public ValueConstraint {
266     /// The constraint can be specified by allowing or disallowing the range.
267     /// WithinRange indicates allowing the range, OutOfRange indicates
268     /// disallowing it (allowing the complementary range).
269     RangeKind Kind;
270 
271     /// A set of intervals.
272     IntRangeVector Ranges;
273 
274     /// A textual description of this constraint for the specific case where the
275     /// constraint is used. If empty a generated description will be used that
276     /// is built from the range of the constraint.
277     StringRef Description;
278 
279   public:
280     RangeConstraint(ArgNo ArgN, RangeKind Kind, const IntRangeVector &Ranges,
281                     StringRef Desc = "")
282         : ValueConstraint(ArgN), Kind(Kind), Ranges(Ranges), Description(Desc) {
283     }
284 
285     const IntRangeVector &getRanges() const { return Ranges; }
286 
287     ProgramStateRef apply(ProgramStateRef State, const CallEvent &Call,
288                           const Summary &Summary,
289                           CheckerContext &C) const override;
290 
291     void describe(DescriptionKind DK, const CallEvent &Call,
292                   ProgramStateRef State, const Summary &Summary,
293                   llvm::raw_ostream &Out) const override;
294 
295     bool describeArgumentValue(const CallEvent &Call, ProgramStateRef State,
296                                const Summary &Summary,
297                                llvm::raw_ostream &Out) const override;
298 
299     ValueConstraintPtr negate() const override {
300       RangeConstraint Tmp(*this);
301       Tmp.Kind = negateKind(Kind);
302       return std::make_shared<RangeConstraint>(Tmp);
303     }
304 
305   protected:
306     bool checkSpecificValidity(const FunctionDecl *FD) const override {
307       const bool ValidArg =
308           getArgType(FD, ArgN)->isIntegralType(FD->getASTContext());
309       assert(ValidArg &&
310              "This constraint should be applied on an integral type");
311       return ValidArg;
312     }
313 
314   private:
315     /// A callback function that is used when iterating over the range
316     /// intervals. It gets the begin and end (inclusive) of one interval.
317     /// This is used to make any kind of task possible that needs an iteration
318     /// over the intervals.
319     using RangeApplyFunction =
320         std::function<bool(const llvm::APSInt &Min, const llvm::APSInt &Max)>;
321 
322     /// Call a function on the intervals of the range.
323     /// The function is called with all intervals in the range.
324     void applyOnWithinRange(BasicValueFactory &BVF, QualType ArgT,
325                             const RangeApplyFunction &F) const;
326     /// Call a function on all intervals in the complementary range.
327     /// The function is called with all intervals that fall out of the range.
328     /// E.g. consider an interval list [A, B] and [C, D]
329     /// \code
330     /// -------+--------+------------------+------------+----------->
331     ///        A        B                  C            D
332     /// \endcode
333     /// We get the ranges [-inf, A - 1], [D + 1, +inf], [B + 1, C - 1].
334     /// The \p ArgT is used to determine the min and max of the type that is
335     /// used as "-inf" and "+inf".
336     void applyOnOutOfRange(BasicValueFactory &BVF, QualType ArgT,
337                            const RangeApplyFunction &F) const;
338     /// Call a function on the intervals of the range or the complementary
339     /// range.
340     void applyOnRange(RangeKind Kind, BasicValueFactory &BVF, QualType ArgT,
341                       const RangeApplyFunction &F) const {
342       switch (Kind) {
343       case OutOfRange:
344         applyOnOutOfRange(BVF, ArgT, F);
345         break;
346       case WithinRange:
347         applyOnWithinRange(BVF, ArgT, F);
348         break;
349       };
350     }
351   };
352 
353   /// Check relation of an argument to another.
354   class ComparisonConstraint : public ValueConstraint {
355     BinaryOperator::Opcode Opcode;
356     ArgNo OtherArgN;
357 
358   public:
359     ComparisonConstraint(ArgNo ArgN, BinaryOperator::Opcode Opcode,
360                          ArgNo OtherArgN)
361         : ValueConstraint(ArgN), Opcode(Opcode), OtherArgN(OtherArgN) {}
362     ArgNo getOtherArgNo() const { return OtherArgN; }
363     BinaryOperator::Opcode getOpcode() const { return Opcode; }
364     ProgramStateRef apply(ProgramStateRef State, const CallEvent &Call,
365                           const Summary &Summary,
366                           CheckerContext &C) const override;
367   };
368 
369   /// Check null or non-null-ness of an argument that is of pointer type.
370   class NotNullConstraint : public ValueConstraint {
371     using ValueConstraint::ValueConstraint;
372     // This variable has a role when we negate the constraint.
373     bool CannotBeNull = true;
374 
375   public:
376     NotNullConstraint(ArgNo ArgN, bool CannotBeNull = true)
377         : ValueConstraint(ArgN), CannotBeNull(CannotBeNull) {}
378 
379     ProgramStateRef apply(ProgramStateRef State, const CallEvent &Call,
380                           const Summary &Summary,
381                           CheckerContext &C) const override;
382 
383     void describe(DescriptionKind DK, const CallEvent &Call,
384                   ProgramStateRef State, const Summary &Summary,
385                   llvm::raw_ostream &Out) const override;
386 
387     bool describeArgumentValue(const CallEvent &Call, ProgramStateRef State,
388                                const Summary &Summary,
389                                llvm::raw_ostream &Out) const override;
390 
391     ValueConstraintPtr negate() const override {
392       NotNullConstraint Tmp(*this);
393       Tmp.CannotBeNull = !this->CannotBeNull;
394       return std::make_shared<NotNullConstraint>(Tmp);
395     }
396 
397   protected:
398     bool checkSpecificValidity(const FunctionDecl *FD) const override {
399       const bool ValidArg = getArgType(FD, ArgN)->isPointerType();
400       assert(ValidArg &&
401              "This constraint should be applied only on a pointer type");
402       return ValidArg;
403     }
404   };
405 
406   /// Check null or non-null-ness of an argument that is of pointer type.
407   /// The argument is meant to be a buffer that has a size constraint, and it
408   /// is allowed to have a NULL value if the size is 0. The size can depend on
409   /// 1 or 2 additional arguments, if one of these is 0 the buffer is allowed to
410   /// be NULL. This is useful for functions like `fread` which have this special
411   /// property.
412   class NotNullBufferConstraint : public ValueConstraint {
413     using ValueConstraint::ValueConstraint;
414     ArgNo SizeArg1N;
415     std::optional<ArgNo> SizeArg2N;
416     // This variable has a role when we negate the constraint.
417     bool CannotBeNull = true;
418 
419   public:
420     NotNullBufferConstraint(ArgNo ArgN, ArgNo SizeArg1N,
421                             std::optional<ArgNo> SizeArg2N,
422                             bool CannotBeNull = true)
423         : ValueConstraint(ArgN), SizeArg1N(SizeArg1N), SizeArg2N(SizeArg2N),
424           CannotBeNull(CannotBeNull) {}
425 
426     ProgramStateRef apply(ProgramStateRef State, const CallEvent &Call,
427                           const Summary &Summary,
428                           CheckerContext &C) const override;
429 
430     void describe(DescriptionKind DK, const CallEvent &Call,
431                   ProgramStateRef State, const Summary &Summary,
432                   llvm::raw_ostream &Out) const override;
433 
434     bool describeArgumentValue(const CallEvent &Call, ProgramStateRef State,
435                                const Summary &Summary,
436                                llvm::raw_ostream &Out) const override;
437 
438     ValueConstraintPtr negate() const override {
439       NotNullBufferConstraint Tmp(*this);
440       Tmp.CannotBeNull = !this->CannotBeNull;
441       return std::make_shared<NotNullBufferConstraint>(Tmp);
442     }
443 
444   protected:
445     bool checkSpecificValidity(const FunctionDecl *FD) const override {
446       const bool ValidArg = getArgType(FD, ArgN)->isPointerType();
447       assert(ValidArg &&
448              "This constraint should be applied only on a pointer type");
449       return ValidArg;
450     }
451   };
452 
453   // Represents a buffer argument with an additional size constraint. The
454   // constraint may be a concrete value, or a symbolic value in an argument.
455   // Example 1. Concrete value as the minimum buffer size.
456   //   char *asctime_r(const struct tm *restrict tm, char *restrict buf);
457   //   // `buf` size must be at least 26 bytes according the POSIX standard.
458   // Example 2. Argument as a buffer size.
459   //   ctime_s(char *buffer, rsize_t bufsz, const time_t *time);
460   // Example 3. The size is computed as a multiplication of other args.
461   //   size_t fread(void *ptr, size_t size, size_t nmemb, FILE *stream);
462   //   // Here, ptr is the buffer, and its minimum size is `size * nmemb`.
463   class BufferSizeConstraint : public ValueConstraint {
464     // The concrete value which is the minimum size for the buffer.
465     std::optional<llvm::APSInt> ConcreteSize;
466     // The argument which holds the size of the buffer.
467     std::optional<ArgNo> SizeArgN;
468     // The argument which is a multiplier to size. This is set in case of
469     // `fread` like functions where the size is computed as a multiplication of
470     // two arguments.
471     std::optional<ArgNo> SizeMultiplierArgN;
472     // The operator we use in apply. This is negated in negate().
473     BinaryOperator::Opcode Op = BO_LE;
474 
475   public:
476     BufferSizeConstraint(ArgNo Buffer, llvm::APSInt BufMinSize)
477         : ValueConstraint(Buffer), ConcreteSize(BufMinSize) {}
478     BufferSizeConstraint(ArgNo Buffer, ArgNo BufSize)
479         : ValueConstraint(Buffer), SizeArgN(BufSize) {}
480     BufferSizeConstraint(ArgNo Buffer, ArgNo BufSize, ArgNo BufSizeMultiplier)
481         : ValueConstraint(Buffer), SizeArgN(BufSize),
482           SizeMultiplierArgN(BufSizeMultiplier) {}
483 
484     ProgramStateRef apply(ProgramStateRef State, const CallEvent &Call,
485                           const Summary &Summary,
486                           CheckerContext &C) const override;
487 
488     void describe(DescriptionKind DK, const CallEvent &Call,
489                   ProgramStateRef State, const Summary &Summary,
490                   llvm::raw_ostream &Out) const override;
491 
492     bool describeArgumentValue(const CallEvent &Call, ProgramStateRef State,
493                                const Summary &Summary,
494                                llvm::raw_ostream &Out) const override;
495 
496     std::vector<ArgNo> getArgsToTrack() const override {
497       std::vector<ArgNo> Result{ArgN};
498       if (SizeArgN)
499         Result.push_back(*SizeArgN);
500       if (SizeMultiplierArgN)
501         Result.push_back(*SizeMultiplierArgN);
502       return Result;
503     }
504 
505     ValueConstraintPtr negate() const override {
506       BufferSizeConstraint Tmp(*this);
507       Tmp.Op = BinaryOperator::negateComparisonOp(Op);
508       return std::make_shared<BufferSizeConstraint>(Tmp);
509     }
510 
511   protected:
512     bool checkSpecificValidity(const FunctionDecl *FD) const override {
513       const bool ValidArg = getArgType(FD, ArgN)->isPointerType();
514       assert(ValidArg &&
515              "This constraint should be applied only on a pointer type");
516       return ValidArg;
517     }
518   };
519 
520   /// The complete list of constraints that defines a single branch.
521   using ConstraintSet = std::vector<ValueConstraintPtr>;
522 
523   /// Define how a function affects the system variable 'errno'.
524   /// This works together with the \c ErrnoModeling and \c ErrnoChecker classes.
525   /// Currently 3 use cases exist: success, failure, irrelevant.
526   /// In the future the failure case can be customized to set \c errno to a
527   /// more specific constraint (for example > 0), or new case can be added
528   /// for functions which require check of \c errno in both success and failure
529   /// case.
530   class ErrnoConstraintBase {
531   public:
532     /// Apply specific state changes related to the errno variable.
533     virtual ProgramStateRef apply(ProgramStateRef State, const CallEvent &Call,
534                                   const Summary &Summary,
535                                   CheckerContext &C) const = 0;
536     /// Get a description about what happens with 'errno' here and how it causes
537     /// a later bug report created by ErrnoChecker.
538     /// Empty return value means that 'errno' related bug may not happen from
539     /// the current analyzed function.
540     virtual const std::string describe(CheckerContext &C) const { return ""; }
541 
542     virtual ~ErrnoConstraintBase() {}
543 
544   protected:
545     ErrnoConstraintBase() = default;
546 
547     /// This is used for conjure symbol for errno to differentiate from the
548     /// original call expression (same expression is used for the errno symbol).
549     static int Tag;
550   };
551 
552   /// Reset errno constraints to irrelevant.
553   /// This is applicable to functions that may change 'errno' and are not
554   /// modeled elsewhere.
555   class ResetErrnoConstraint : public ErrnoConstraintBase {
556   public:
557     ProgramStateRef apply(ProgramStateRef State, const CallEvent &Call,
558                           const Summary &Summary,
559                           CheckerContext &C) const override {
560       return errno_modeling::setErrnoState(State, errno_modeling::Irrelevant);
561     }
562   };
563 
564   /// Do not change errno constraints.
565   /// This is applicable to functions that are modeled in another checker
566   /// and the already set errno constraints should not be changed in the
567   /// post-call event.
568   class NoErrnoConstraint : public ErrnoConstraintBase {
569   public:
570     ProgramStateRef apply(ProgramStateRef State, const CallEvent &Call,
571                           const Summary &Summary,
572                           CheckerContext &C) const override {
573       return State;
574     }
575   };
576 
577   /// Set errno constraint at failure cases of standard functions.
578   /// Failure case: 'errno' becomes not equal to 0 and may or may not be checked
579   /// by the program. \c ErrnoChecker does not emit a bug report after such a
580   /// function call.
581   class FailureErrnoConstraint : public ErrnoConstraintBase {
582   public:
583     ProgramStateRef apply(ProgramStateRef State, const CallEvent &Call,
584                           const Summary &Summary,
585                           CheckerContext &C) const override {
586       SValBuilder &SVB = C.getSValBuilder();
587       NonLoc ErrnoSVal =
588           SVB.conjureSymbolVal(&Tag, Call.getOriginExpr(),
589                                C.getLocationContext(), C.getASTContext().IntTy,
590                                C.blockCount())
591               .castAs<NonLoc>();
592       return errno_modeling::setErrnoForStdFailure(State, C, ErrnoSVal);
593     }
594   };
595 
596   /// Set errno constraint at success cases of standard functions.
597   /// Success case: 'errno' is not allowed to be used because the value is
598   /// undefined after successful call.
599   /// \c ErrnoChecker can emit bug report after such a function call if errno
600   /// is used.
601   class SuccessErrnoConstraint : public ErrnoConstraintBase {
602   public:
603     ProgramStateRef apply(ProgramStateRef State, const CallEvent &Call,
604                           const Summary &Summary,
605                           CheckerContext &C) const override {
606       return errno_modeling::setErrnoForStdSuccess(State, C);
607     }
608 
609     const std::string describe(CheckerContext &C) const override {
610       return "'errno' becomes undefined after the call";
611     }
612   };
613 
614   /// Set errno constraint at functions that indicate failure only with 'errno'.
615   /// In this case 'errno' is required to be observed.
616   /// \c ErrnoChecker can emit bug report after such a function call if errno
617   /// is overwritten without a read before.
618   class ErrnoMustBeCheckedConstraint : public ErrnoConstraintBase {
619   public:
620     ProgramStateRef apply(ProgramStateRef State, const CallEvent &Call,
621                           const Summary &Summary,
622                           CheckerContext &C) const override {
623       return errno_modeling::setErrnoStdMustBeChecked(State, C,
624                                                       Call.getOriginExpr());
625     }
626 
627     const std::string describe(CheckerContext &C) const override {
628       return "reading 'errno' is required to find out if the call has failed";
629     }
630   };
631 
632   /// A single branch of a function summary.
633   ///
634   /// A branch is defined by a series of constraints - "assumptions" -
635   /// that together form a single possible outcome of invoking the function.
636   /// When static analyzer considers a branch, it tries to introduce
637   /// a child node in the Exploded Graph. The child node has to include
638   /// constraints that define the branch. If the constraints contradict
639   /// existing constraints in the state, the node is not created and the branch
640   /// is dropped; otherwise it's queued for future exploration.
641   /// The branch is accompanied by a note text that may be displayed
642   /// to the user when a bug is found on a path that takes this branch.
643   ///
644   /// For example, consider the branches in `isalpha(x)`:
645   ///   Branch 1)
646   ///     x is in range ['A', 'Z'] or in ['a', 'z']
647   ///     then the return value is not 0. (I.e. out-of-range [0, 0])
648   ///     and the note may say "Assuming the character is alphabetical"
649   ///   Branch 2)
650   ///     x is out-of-range ['A', 'Z'] and out-of-range ['a', 'z']
651   ///     then the return value is 0
652   ///     and the note may say "Assuming the character is non-alphabetical".
653   class SummaryCase {
654     ConstraintSet Constraints;
655     const ErrnoConstraintBase &ErrnoConstraint;
656     StringRef Note;
657 
658   public:
659     SummaryCase(ConstraintSet &&Constraints, const ErrnoConstraintBase &ErrnoC,
660                 StringRef Note)
661         : Constraints(std::move(Constraints)), ErrnoConstraint(ErrnoC),
662           Note(Note) {}
663 
664     SummaryCase(const ConstraintSet &Constraints,
665                 const ErrnoConstraintBase &ErrnoC, StringRef Note)
666         : Constraints(Constraints), ErrnoConstraint(ErrnoC), Note(Note) {}
667 
668     const ConstraintSet &getConstraints() const { return Constraints; }
669     const ErrnoConstraintBase &getErrnoConstraint() const {
670       return ErrnoConstraint;
671     }
672     StringRef getNote() const { return Note; }
673   };
674 
675   using ArgTypes = std::vector<std::optional<QualType>>;
676   using RetType = std::optional<QualType>;
677 
678   // A placeholder type, we use it whenever we do not care about the concrete
679   // type in a Signature.
680   const QualType Irrelevant{};
681   bool static isIrrelevant(QualType T) { return T.isNull(); }
682 
683   // The signature of a function we want to describe with a summary. This is a
684   // concessive signature, meaning there may be irrelevant types in the
685   // signature which we do not check against a function with concrete types.
686   // All types in the spec need to be canonical.
687   class Signature {
688     using ArgQualTypes = std::vector<QualType>;
689     ArgQualTypes ArgTys;
690     QualType RetTy;
691     // True if any component type is not found by lookup.
692     bool Invalid = false;
693 
694   public:
695     // Construct a signature from optional types. If any of the optional types
696     // are not set then the signature will be invalid.
697     Signature(ArgTypes ArgTys, RetType RetTy) {
698       for (std::optional<QualType> Arg : ArgTys) {
699         if (!Arg) {
700           Invalid = true;
701           return;
702         } else {
703           assertArgTypeSuitableForSignature(*Arg);
704           this->ArgTys.push_back(*Arg);
705         }
706       }
707       if (!RetTy) {
708         Invalid = true;
709         return;
710       } else {
711         assertRetTypeSuitableForSignature(*RetTy);
712         this->RetTy = *RetTy;
713       }
714     }
715 
716     bool isInvalid() const { return Invalid; }
717     bool matches(const FunctionDecl *FD) const;
718 
719   private:
720     static void assertArgTypeSuitableForSignature(QualType T) {
721       assert((T.isNull() || !T->isVoidType()) &&
722              "We should have no void types in the spec");
723       assert((T.isNull() || T.isCanonical()) &&
724              "We should only have canonical types in the spec");
725     }
726     static void assertRetTypeSuitableForSignature(QualType T) {
727       assert((T.isNull() || T.isCanonical()) &&
728              "We should only have canonical types in the spec");
729     }
730   };
731 
732   static QualType getArgType(const FunctionDecl *FD, ArgNo ArgN) {
733     assert(FD && "Function must be set");
734     QualType T = (ArgN == Ret)
735                      ? FD->getReturnType().getCanonicalType()
736                      : FD->getParamDecl(ArgN)->getType().getCanonicalType();
737     return T;
738   }
739 
740   using SummaryCases = std::vector<SummaryCase>;
741 
742   /// A summary includes information about
743   ///   * function prototype (signature)
744   ///   * approach to invalidation,
745   ///   * a list of branches - so, a list of list of ranges,
746   ///   * a list of argument constraints, that must be true on every branch.
747   ///     If these constraints are not satisfied that means a fatal error
748   ///     usually resulting in undefined behaviour.
749   ///
750   /// Application of a summary:
751   ///   The signature and argument constraints together contain information
752   ///   about which functions are handled by the summary. The signature can use
753   ///   "wildcards", i.e. Irrelevant types. Irrelevant type of a parameter in
754   ///   a signature means that type is not compared to the type of the parameter
755   ///   in the found FunctionDecl. Argument constraints may specify additional
756   ///   rules for the given parameter's type, those rules are checked once the
757   ///   signature is matched.
758   class Summary {
759     const InvalidationKind InvalidationKd;
760     SummaryCases Cases;
761     ConstraintSet ArgConstraints;
762 
763     // The function to which the summary applies. This is set after lookup and
764     // match to the signature.
765     const FunctionDecl *FD = nullptr;
766 
767   public:
768     Summary(InvalidationKind InvalidationKd) : InvalidationKd(InvalidationKd) {}
769 
770     Summary &Case(ConstraintSet &&CS, const ErrnoConstraintBase &ErrnoC,
771                   StringRef Note = "") {
772       Cases.push_back(SummaryCase(std::move(CS), ErrnoC, Note));
773       return *this;
774     }
775     Summary &Case(const ConstraintSet &CS, const ErrnoConstraintBase &ErrnoC,
776                   StringRef Note = "") {
777       Cases.push_back(SummaryCase(CS, ErrnoC, Note));
778       return *this;
779     }
780     Summary &ArgConstraint(ValueConstraintPtr VC) {
781       assert(VC->getArgNo() != Ret &&
782              "Arg constraint should not refer to the return value");
783       ArgConstraints.push_back(VC);
784       return *this;
785     }
786 
787     InvalidationKind getInvalidationKd() const { return InvalidationKd; }
788     const SummaryCases &getCases() const { return Cases; }
789     const ConstraintSet &getArgConstraints() const { return ArgConstraints; }
790 
791     QualType getArgType(ArgNo ArgN) const {
792       return StdLibraryFunctionsChecker::getArgType(FD, ArgN);
793     }
794 
795     // Returns true if the summary should be applied to the given function.
796     // And if yes then store the function declaration.
797     bool matchesAndSet(const Signature &Sign, const FunctionDecl *FD) {
798       bool Result = Sign.matches(FD) && validateByConstraints(FD);
799       if (Result) {
800         assert(!this->FD && "FD must not be set more than once");
801         this->FD = FD;
802       }
803       return Result;
804     }
805 
806   private:
807     // Once we know the exact type of the function then do validation check on
808     // all the given constraints.
809     bool validateByConstraints(const FunctionDecl *FD) const {
810       for (const SummaryCase &Case : Cases)
811         for (const ValueConstraintPtr &Constraint : Case.getConstraints())
812           if (!Constraint->checkValidity(FD))
813             return false;
814       for (const ValueConstraintPtr &Constraint : ArgConstraints)
815         if (!Constraint->checkValidity(FD))
816           return false;
817       return true;
818     }
819   };
820 
821   // The map of all functions supported by the checker. It is initialized
822   // lazily, and it doesn't change after initialization.
823   using FunctionSummaryMapType = llvm::DenseMap<const FunctionDecl *, Summary>;
824   mutable FunctionSummaryMapType FunctionSummaryMap;
825 
826   const BugType BT_InvalidArg{this, "Function call with invalid argument"};
827   mutable bool SummariesInitialized = false;
828 
829   static SVal getArgSVal(const CallEvent &Call, ArgNo ArgN) {
830     return ArgN == Ret ? Call.getReturnValue() : Call.getArgSVal(ArgN);
831   }
832   static std::string getFunctionName(const CallEvent &Call) {
833     assert(Call.getDecl() &&
834            "Call was found by a summary, should have declaration");
835     return cast<NamedDecl>(Call.getDecl())->getNameAsString();
836   }
837 
838 public:
839   void checkPreCall(const CallEvent &Call, CheckerContext &C) const;
840   void checkPostCall(const CallEvent &Call, CheckerContext &C) const;
841   bool evalCall(const CallEvent &Call, CheckerContext &C) const;
842 
843   CheckerNameRef CheckName;
844   bool AddTestFunctions = false;
845 
846   bool DisplayLoadedSummaries = false;
847   bool ModelPOSIX = false;
848   bool ShouldAssumeControlledEnvironment = false;
849 
850 private:
851   std::optional<Summary> findFunctionSummary(const FunctionDecl *FD,
852                                              CheckerContext &C) const;
853   std::optional<Summary> findFunctionSummary(const CallEvent &Call,
854                                              CheckerContext &C) const;
855 
856   void initFunctionSummaries(CheckerContext &C) const;
857 
858   void reportBug(const CallEvent &Call, ExplodedNode *N,
859                  const ValueConstraint *VC, const ValueConstraint *NegatedVC,
860                  const Summary &Summary, CheckerContext &C) const {
861     assert(Call.getDecl() &&
862            "Function found in summary must have a declaration available");
863     SmallString<256> Msg;
864     llvm::raw_svector_ostream MsgOs(Msg);
865 
866     MsgOs << "The ";
867     printArgDesc(VC->getArgNo(), MsgOs);
868     MsgOs << " to '" << getFunctionName(Call) << "' ";
869     bool ValuesPrinted =
870         NegatedVC->describeArgumentValue(Call, N->getState(), Summary, MsgOs);
871     if (ValuesPrinted)
872       MsgOs << " but ";
873     else
874       MsgOs << "is out of the accepted range; It ";
875     VC->describe(ValueConstraint::Violation, Call, C.getState(), Summary,
876                  MsgOs);
877     Msg[0] = toupper(Msg[0]);
878     auto R = std::make_unique<PathSensitiveBugReport>(BT_InvalidArg, Msg, N);
879 
880     for (ArgNo ArgN : VC->getArgsToTrack()) {
881       bugreporter::trackExpressionValue(N, Call.getArgExpr(ArgN), *R);
882       R->markInteresting(Call.getArgSVal(ArgN));
883       // All tracked arguments are important, highlight them.
884       R->addRange(Call.getArgSourceRange(ArgN));
885     }
886 
887     C.emitReport(std::move(R));
888   }
889 
890   /// These are the errno constraints that can be passed to summary cases.
891   /// One of these should fit for a single summary case.
892   /// Usually if a failure return value exists for function, that function
893   /// needs different cases for success and failure with different errno
894   /// constraints (and different return value constraints).
895   const NoErrnoConstraint ErrnoUnchanged{};
896   const ResetErrnoConstraint ErrnoIrrelevant{};
897   const ErrnoMustBeCheckedConstraint ErrnoMustBeChecked{};
898   const SuccessErrnoConstraint ErrnoMustNotBeChecked{};
899   const FailureErrnoConstraint ErrnoNEZeroIrrelevant{};
900 };
901 
902 int StdLibraryFunctionsChecker::ErrnoConstraintBase::Tag = 0;
903 
904 const StdLibraryFunctionsChecker::ArgNo StdLibraryFunctionsChecker::Ret =
905     std::numeric_limits<ArgNo>::max();
906 
907 static BasicValueFactory &getBVF(ProgramStateRef State) {
908   ProgramStateManager &Mgr = State->getStateManager();
909   SValBuilder &SVB = Mgr.getSValBuilder();
910   return SVB.getBasicValueFactory();
911 }
912 
913 } // end of anonymous namespace
914 
915 void StdLibraryFunctionsChecker::printArgDesc(
916     StdLibraryFunctionsChecker::ArgNo ArgN, llvm::raw_ostream &Out) {
917   Out << std::to_string(ArgN + 1);
918   Out << llvm::getOrdinalSuffix(ArgN + 1);
919   Out << " argument";
920 }
921 
922 void StdLibraryFunctionsChecker::printArgValueInfo(ArgNo ArgN,
923                                                    ProgramStateRef State,
924                                                    const CallEvent &Call,
925                                                    llvm::raw_ostream &Out) {
926   if (const llvm::APSInt *Val =
927           State->getStateManager().getSValBuilder().getKnownValue(
928               State, getArgSVal(Call, ArgN)))
929     Out << " (which is " << *Val << ")";
930 }
931 
932 void StdLibraryFunctionsChecker::appendInsideRangeDesc(llvm::APSInt RMin,
933                                                        llvm::APSInt RMax,
934                                                        QualType ArgT,
935                                                        BasicValueFactory &BVF,
936                                                        llvm::raw_ostream &Out) {
937   if (RMin.isZero() && RMax.isZero())
938     Out << "zero";
939   else if (RMin == RMax)
940     Out << RMin;
941   else if (RMin == BVF.getMinValue(ArgT)) {
942     if (RMax == -1)
943       Out << "< 0";
944     else
945       Out << "<= " << RMax;
946   } else if (RMax == BVF.getMaxValue(ArgT)) {
947     if (RMin.isOne())
948       Out << "> 0";
949     else
950       Out << ">= " << RMin;
951   } else if (RMin.isNegative() == RMax.isNegative() &&
952              RMin.getLimitedValue() == RMax.getLimitedValue() - 1) {
953     Out << RMin << " or " << RMax;
954   } else {
955     Out << "between " << RMin << " and " << RMax;
956   }
957 }
958 
959 void StdLibraryFunctionsChecker::appendOutOfRangeDesc(llvm::APSInt RMin,
960                                                       llvm::APSInt RMax,
961                                                       QualType ArgT,
962                                                       BasicValueFactory &BVF,
963                                                       llvm::raw_ostream &Out) {
964   if (RMin.isZero() && RMax.isZero())
965     Out << "nonzero";
966   else if (RMin == RMax) {
967     Out << "not equal to " << RMin;
968   } else if (RMin == BVF.getMinValue(ArgT)) {
969     if (RMax == -1)
970       Out << ">= 0";
971     else
972       Out << "> " << RMax;
973   } else if (RMax == BVF.getMaxValue(ArgT)) {
974     if (RMin.isOne())
975       Out << "<= 0";
976     else
977       Out << "< " << RMin;
978   } else if (RMin.isNegative() == RMax.isNegative() &&
979              RMin.getLimitedValue() == RMax.getLimitedValue() - 1) {
980     Out << "not " << RMin << " and not " << RMax;
981   } else {
982     Out << "not between " << RMin << " and " << RMax;
983   }
984 }
985 
986 void StdLibraryFunctionsChecker::RangeConstraint::applyOnWithinRange(
987     BasicValueFactory &BVF, QualType ArgT, const RangeApplyFunction &F) const {
988   if (Ranges.empty())
989     return;
990 
991   for (auto [Start, End] : getRanges()) {
992     const llvm::APSInt &Min = BVF.getValue(Start, ArgT);
993     const llvm::APSInt &Max = BVF.getValue(End, ArgT);
994     assert(Min <= Max);
995     if (!F(Min, Max))
996       return;
997   }
998 }
999 
1000 void StdLibraryFunctionsChecker::RangeConstraint::applyOnOutOfRange(
1001     BasicValueFactory &BVF, QualType ArgT, const RangeApplyFunction &F) const {
1002   if (Ranges.empty())
1003     return;
1004 
1005   const IntRangeVector &R = getRanges();
1006   size_t E = R.size();
1007 
1008   const llvm::APSInt &MinusInf = BVF.getMinValue(ArgT);
1009   const llvm::APSInt &PlusInf = BVF.getMaxValue(ArgT);
1010 
1011   const llvm::APSInt &RangeLeft = BVF.getValue(R[0].first - 1ULL, ArgT);
1012   const llvm::APSInt &RangeRight = BVF.getValue(R[E - 1].second + 1ULL, ArgT);
1013 
1014   // Iterate over the "holes" between intervals.
1015   for (size_t I = 1; I != E; ++I) {
1016     const llvm::APSInt &Min = BVF.getValue(R[I - 1].second + 1ULL, ArgT);
1017     const llvm::APSInt &Max = BVF.getValue(R[I].first - 1ULL, ArgT);
1018     if (Min <= Max) {
1019       if (!F(Min, Max))
1020         return;
1021     }
1022   }
1023   // Check the interval [T_MIN, min(R) - 1].
1024   if (RangeLeft != PlusInf) {
1025     assert(MinusInf <= RangeLeft);
1026     if (!F(MinusInf, RangeLeft))
1027       return;
1028   }
1029   // Check the interval [max(R) + 1, T_MAX],
1030   if (RangeRight != MinusInf) {
1031     assert(RangeRight <= PlusInf);
1032     if (!F(RangeRight, PlusInf))
1033       return;
1034   }
1035 }
1036 
1037 ProgramStateRef StdLibraryFunctionsChecker::RangeConstraint::apply(
1038     ProgramStateRef State, const CallEvent &Call, const Summary &Summary,
1039     CheckerContext &C) const {
1040   ConstraintManager &CM = C.getConstraintManager();
1041   SVal V = getArgSVal(Call, getArgNo());
1042   QualType T = Summary.getArgType(getArgNo());
1043 
1044   if (auto N = V.getAs<NonLoc>()) {
1045     auto ExcludeRangeFromArg = [&](const llvm::APSInt &Min,
1046                                    const llvm::APSInt &Max) {
1047       State = CM.assumeInclusiveRange(State, *N, Min, Max, false);
1048       return static_cast<bool>(State);
1049     };
1050     // "OutOfRange R" is handled by excluding all ranges in R.
1051     // "WithinRange R" is treated as "OutOfRange [T_MIN, T_MAX] \ R".
1052     applyOnRange(negateKind(Kind), C.getSValBuilder().getBasicValueFactory(), T,
1053                  ExcludeRangeFromArg);
1054   }
1055 
1056   return State;
1057 }
1058 
1059 void StdLibraryFunctionsChecker::RangeConstraint::describe(
1060     DescriptionKind DK, const CallEvent &Call, ProgramStateRef State,
1061     const Summary &Summary, llvm::raw_ostream &Out) const {
1062 
1063   BasicValueFactory &BVF = getBVF(State);
1064   QualType T = Summary.getArgType(getArgNo());
1065 
1066   Out << ((DK == Violation) ? "should be " : "is ");
1067   if (!Description.empty()) {
1068     Out << Description;
1069   } else {
1070     unsigned I = Ranges.size();
1071     if (Kind == WithinRange) {
1072       for (const std::pair<RangeInt, RangeInt> &R : Ranges) {
1073         appendInsideRangeDesc(BVF.getValue(R.first, T),
1074                               BVF.getValue(R.second, T), T, BVF, Out);
1075         if (--I > 0)
1076           Out << " or ";
1077       }
1078     } else {
1079       for (const std::pair<RangeInt, RangeInt> &R : Ranges) {
1080         appendOutOfRangeDesc(BVF.getValue(R.first, T),
1081                              BVF.getValue(R.second, T), T, BVF, Out);
1082         if (--I > 0)
1083           Out << " and ";
1084       }
1085     }
1086   }
1087 }
1088 
1089 bool StdLibraryFunctionsChecker::RangeConstraint::describeArgumentValue(
1090     const CallEvent &Call, ProgramStateRef State, const Summary &Summary,
1091     llvm::raw_ostream &Out) const {
1092   unsigned int NRanges = 0;
1093   bool HaveAllRanges = true;
1094 
1095   ProgramStateManager &Mgr = State->getStateManager();
1096   BasicValueFactory &BVF = Mgr.getSValBuilder().getBasicValueFactory();
1097   ConstraintManager &CM = Mgr.getConstraintManager();
1098   SVal V = getArgSVal(Call, getArgNo());
1099 
1100   if (auto N = V.getAs<NonLoc>()) {
1101     if (const llvm::APSInt *Int = N->getAsInteger()) {
1102       Out << "is ";
1103       Out << *Int;
1104       return true;
1105     }
1106     QualType T = Summary.getArgType(getArgNo());
1107     SmallString<128> MoreInfo;
1108     llvm::raw_svector_ostream MoreInfoOs(MoreInfo);
1109     auto ApplyF = [&](const llvm::APSInt &Min, const llvm::APSInt &Max) {
1110       if (CM.assumeInclusiveRange(State, *N, Min, Max, true)) {
1111         if (NRanges > 0)
1112           MoreInfoOs << " or ";
1113         appendInsideRangeDesc(Min, Max, T, BVF, MoreInfoOs);
1114         ++NRanges;
1115       } else {
1116         HaveAllRanges = false;
1117       }
1118       return true;
1119     };
1120 
1121     applyOnRange(Kind, BVF, T, ApplyF);
1122     assert(NRanges > 0);
1123     if (!HaveAllRanges || NRanges == 1) {
1124       Out << "is ";
1125       Out << MoreInfo;
1126       return true;
1127     }
1128   }
1129   return false;
1130 }
1131 
1132 ProgramStateRef StdLibraryFunctionsChecker::ComparisonConstraint::apply(
1133     ProgramStateRef State, const CallEvent &Call, const Summary &Summary,
1134     CheckerContext &C) const {
1135 
1136   ProgramStateManager &Mgr = State->getStateManager();
1137   SValBuilder &SVB = Mgr.getSValBuilder();
1138   QualType CondT = SVB.getConditionType();
1139   QualType T = Summary.getArgType(getArgNo());
1140   SVal V = getArgSVal(Call, getArgNo());
1141 
1142   BinaryOperator::Opcode Op = getOpcode();
1143   ArgNo OtherArg = getOtherArgNo();
1144   SVal OtherV = getArgSVal(Call, OtherArg);
1145   QualType OtherT = Summary.getArgType(OtherArg);
1146   // Note: we avoid integral promotion for comparison.
1147   OtherV = SVB.evalCast(OtherV, T, OtherT);
1148   if (auto CompV = SVB.evalBinOp(State, Op, V, OtherV, CondT)
1149                        .getAs<DefinedOrUnknownSVal>())
1150     State = State->assume(*CompV, true);
1151   return State;
1152 }
1153 
1154 ProgramStateRef StdLibraryFunctionsChecker::NotNullConstraint::apply(
1155     ProgramStateRef State, const CallEvent &Call, const Summary &Summary,
1156     CheckerContext &C) const {
1157   SVal V = getArgSVal(Call, getArgNo());
1158   if (V.isUndef())
1159     return State;
1160 
1161   DefinedOrUnknownSVal L = V.castAs<DefinedOrUnknownSVal>();
1162   if (!isa<Loc>(L))
1163     return State;
1164 
1165   return State->assume(L, CannotBeNull);
1166 }
1167 
1168 void StdLibraryFunctionsChecker::NotNullConstraint::describe(
1169     DescriptionKind DK, const CallEvent &Call, ProgramStateRef State,
1170     const Summary &Summary, llvm::raw_ostream &Out) const {
1171   assert(CannotBeNull &&
1172          "Describe should not be used when the value must be NULL");
1173   if (DK == Violation)
1174     Out << "should not be NULL";
1175   else
1176     Out << "is not NULL";
1177 }
1178 
1179 bool StdLibraryFunctionsChecker::NotNullConstraint::describeArgumentValue(
1180     const CallEvent &Call, ProgramStateRef State, const Summary &Summary,
1181     llvm::raw_ostream &Out) const {
1182   assert(!CannotBeNull && "This function is used when the value is NULL");
1183   Out << "is NULL";
1184   return true;
1185 }
1186 
1187 ProgramStateRef StdLibraryFunctionsChecker::NotNullBufferConstraint::apply(
1188     ProgramStateRef State, const CallEvent &Call, const Summary &Summary,
1189     CheckerContext &C) const {
1190   SVal V = getArgSVal(Call, getArgNo());
1191   if (V.isUndef())
1192     return State;
1193   DefinedOrUnknownSVal L = V.castAs<DefinedOrUnknownSVal>();
1194   if (!isa<Loc>(L))
1195     return State;
1196 
1197   std::optional<DefinedOrUnknownSVal> SizeArg1 =
1198       getArgSVal(Call, SizeArg1N).getAs<DefinedOrUnknownSVal>();
1199   std::optional<DefinedOrUnknownSVal> SizeArg2;
1200   if (SizeArg2N)
1201     SizeArg2 = getArgSVal(Call, *SizeArg2N).getAs<DefinedOrUnknownSVal>();
1202 
1203   auto IsArgZero = [State](std::optional<DefinedOrUnknownSVal> Val) {
1204     if (!Val)
1205       return false;
1206     auto [IsNonNull, IsNull] = State->assume(*Val);
1207     return IsNull && !IsNonNull;
1208   };
1209 
1210   if (IsArgZero(SizeArg1) || IsArgZero(SizeArg2))
1211     return State;
1212 
1213   return State->assume(L, CannotBeNull);
1214 }
1215 
1216 void StdLibraryFunctionsChecker::NotNullBufferConstraint::describe(
1217     DescriptionKind DK, const CallEvent &Call, ProgramStateRef State,
1218     const Summary &Summary, llvm::raw_ostream &Out) const {
1219   assert(CannotBeNull &&
1220          "Describe should not be used when the value must be NULL");
1221   if (DK == Violation)
1222     Out << "should not be NULL";
1223   else
1224     Out << "is not NULL";
1225 }
1226 
1227 bool StdLibraryFunctionsChecker::NotNullBufferConstraint::describeArgumentValue(
1228     const CallEvent &Call, ProgramStateRef State, const Summary &Summary,
1229     llvm::raw_ostream &Out) const {
1230   assert(!CannotBeNull && "This function is used when the value is NULL");
1231   Out << "is NULL";
1232   return true;
1233 }
1234 
1235 ProgramStateRef StdLibraryFunctionsChecker::BufferSizeConstraint::apply(
1236     ProgramStateRef State, const CallEvent &Call, const Summary &Summary,
1237     CheckerContext &C) const {
1238   SValBuilder &SvalBuilder = C.getSValBuilder();
1239   // The buffer argument.
1240   SVal BufV = getArgSVal(Call, getArgNo());
1241 
1242   // Get the size constraint.
1243   const SVal SizeV = [this, &State, &Call, &Summary, &SvalBuilder]() {
1244     if (ConcreteSize) {
1245       return SVal(SvalBuilder.makeIntVal(*ConcreteSize));
1246     }
1247     assert(SizeArgN && "The constraint must be either a concrete value or "
1248                        "encoded in an argument.");
1249     // The size argument.
1250     SVal SizeV = getArgSVal(Call, *SizeArgN);
1251     // Multiply with another argument if given.
1252     if (SizeMultiplierArgN) {
1253       SVal SizeMulV = getArgSVal(Call, *SizeMultiplierArgN);
1254       SizeV = SvalBuilder.evalBinOp(State, BO_Mul, SizeV, SizeMulV,
1255                                     Summary.getArgType(*SizeArgN));
1256     }
1257     return SizeV;
1258   }();
1259 
1260   // The dynamic size of the buffer argument, got from the analyzer engine.
1261   SVal BufDynSize = getDynamicExtentWithOffset(State, BufV);
1262 
1263   SVal Feasible = SvalBuilder.evalBinOp(State, Op, SizeV, BufDynSize,
1264                                         SvalBuilder.getContext().BoolTy);
1265   if (auto F = Feasible.getAs<DefinedOrUnknownSVal>())
1266     return State->assume(*F, true);
1267 
1268   // We can get here only if the size argument or the dynamic size is
1269   // undefined. But the dynamic size should never be undefined, only
1270   // unknown. So, here, the size of the argument is undefined, i.e. we
1271   // cannot apply the constraint. Actually, other checkers like
1272   // CallAndMessage should catch this situation earlier, because we call a
1273   // function with an uninitialized argument.
1274   llvm_unreachable("Size argument or the dynamic size is Undefined");
1275 }
1276 
1277 void StdLibraryFunctionsChecker::BufferSizeConstraint::describe(
1278     DescriptionKind DK, const CallEvent &Call, ProgramStateRef State,
1279     const Summary &Summary, llvm::raw_ostream &Out) const {
1280   Out << ((DK == Violation) ? "should be " : "is ");
1281   Out << "a buffer with size equal to or greater than ";
1282   if (ConcreteSize) {
1283     Out << *ConcreteSize;
1284   } else if (SizeArgN) {
1285     Out << "the value of the ";
1286     printArgDesc(*SizeArgN, Out);
1287     printArgValueInfo(*SizeArgN, State, Call, Out);
1288     if (SizeMultiplierArgN) {
1289       Out << " times the ";
1290       printArgDesc(*SizeMultiplierArgN, Out);
1291       printArgValueInfo(*SizeMultiplierArgN, State, Call, Out);
1292     }
1293   }
1294 }
1295 
1296 bool StdLibraryFunctionsChecker::BufferSizeConstraint::describeArgumentValue(
1297     const CallEvent &Call, ProgramStateRef State, const Summary &Summary,
1298     llvm::raw_ostream &Out) const {
1299   SVal BufV = getArgSVal(Call, getArgNo());
1300   SVal BufDynSize = getDynamicExtentWithOffset(State, BufV);
1301   if (const llvm::APSInt *Val =
1302           State->getStateManager().getSValBuilder().getKnownValue(State,
1303                                                                   BufDynSize)) {
1304     Out << "is a buffer with size " << *Val;
1305     return true;
1306   }
1307   return false;
1308 }
1309 
1310 void StdLibraryFunctionsChecker::checkPreCall(const CallEvent &Call,
1311                                               CheckerContext &C) const {
1312   std::optional<Summary> FoundSummary = findFunctionSummary(Call, C);
1313   if (!FoundSummary)
1314     return;
1315 
1316   const Summary &Summary = *FoundSummary;
1317   ProgramStateRef State = C.getState();
1318 
1319   ProgramStateRef NewState = State;
1320   ExplodedNode *NewNode = C.getPredecessor();
1321   for (const ValueConstraintPtr &Constraint : Summary.getArgConstraints()) {
1322     ValueConstraintPtr NegatedConstraint = Constraint->negate();
1323     ProgramStateRef SuccessSt = Constraint->apply(NewState, Call, Summary, C);
1324     ProgramStateRef FailureSt =
1325         NegatedConstraint->apply(NewState, Call, Summary, C);
1326     // The argument constraint is not satisfied.
1327     if (FailureSt && !SuccessSt) {
1328       if (ExplodedNode *N = C.generateErrorNode(State, NewNode))
1329         reportBug(Call, N, Constraint.get(), NegatedConstraint.get(), Summary,
1330                   C);
1331       break;
1332     }
1333     // We will apply the constraint even if we cannot reason about the
1334     // argument. This means both SuccessSt and FailureSt can be true. If we
1335     // weren't applying the constraint that would mean that symbolic
1336     // execution continues on a code whose behaviour is undefined.
1337     assert(SuccessSt);
1338     NewState = SuccessSt;
1339     if (NewState != State) {
1340       SmallString<128> Msg;
1341       llvm::raw_svector_ostream Os(Msg);
1342       Os << "Assuming that the ";
1343       printArgDesc(Constraint->getArgNo(), Os);
1344       Os << " to '";
1345       Os << getFunctionName(Call);
1346       Os << "' ";
1347       Constraint->describe(ValueConstraint::Assumption, Call, NewState, Summary,
1348                            Os);
1349       const auto ArgSVal = Call.getArgSVal(Constraint->getArgNo());
1350       NewNode = C.addTransition(
1351           NewState, NewNode,
1352           C.getNoteTag([Msg = std::move(Msg), ArgSVal](
1353                            PathSensitiveBugReport &BR, llvm::raw_ostream &OS) {
1354             if (BR.isInteresting(ArgSVal))
1355               OS << Msg;
1356           }));
1357     }
1358   }
1359 }
1360 
1361 void StdLibraryFunctionsChecker::checkPostCall(const CallEvent &Call,
1362                                                CheckerContext &C) const {
1363   std::optional<Summary> FoundSummary = findFunctionSummary(Call, C);
1364   if (!FoundSummary)
1365     return;
1366 
1367   // Now apply the constraints.
1368   const Summary &Summary = *FoundSummary;
1369   ProgramStateRef State = C.getState();
1370   ExplodedNode *Node = C.getPredecessor();
1371 
1372   // Apply case/branch specifications.
1373   for (const SummaryCase &Case : Summary.getCases()) {
1374     ProgramStateRef NewState = State;
1375     for (const ValueConstraintPtr &Constraint : Case.getConstraints()) {
1376       NewState = Constraint->apply(NewState, Call, Summary, C);
1377       if (!NewState)
1378         break;
1379     }
1380 
1381     if (NewState)
1382       NewState = Case.getErrnoConstraint().apply(NewState, Call, Summary, C);
1383 
1384     if (!NewState)
1385       continue;
1386 
1387     // Here it's possible that NewState == State, e.g. when other checkers
1388     // already applied the same constraints (or stricter ones).
1389     // Still add these note tags, the other checker should add only its
1390     // specialized note tags. These general note tags are handled always by
1391     // StdLibraryFunctionsChecker.
1392 
1393     ExplodedNode *Pred = Node;
1394     DeclarationName FunctionName =
1395         cast<NamedDecl>(Call.getDecl())->getDeclName();
1396 
1397     std::string ErrnoNote = Case.getErrnoConstraint().describe(C);
1398     std::string CaseNote;
1399     if (Case.getNote().empty()) {
1400       if (!ErrnoNote.empty())
1401         ErrnoNote =
1402             llvm::formatv("After calling '{0}' {1}", FunctionName, ErrnoNote);
1403     } else {
1404       CaseNote = llvm::formatv(Case.getNote().str().c_str(), FunctionName);
1405     }
1406     const SVal RV = Call.getReturnValue();
1407 
1408     if (Summary.getInvalidationKd() == EvalCallAsPure) {
1409       // Do not expect that errno is interesting (the "pure" functions do not
1410       // affect it).
1411       if (!CaseNote.empty()) {
1412         const NoteTag *Tag = C.getNoteTag(
1413             [Node, CaseNote, RV](PathSensitiveBugReport &BR) -> std::string {
1414               // Try to omit the note if we know in advance which branch is
1415               // taken (this means, only one branch exists).
1416               // This check is performed inside the lambda, after other
1417               // (or this) checkers had a chance to add other successors.
1418               // Dereferencing the saved node object is valid because it's part
1419               // of a bug report call sequence.
1420               // FIXME: This check is not exact. We may be here after a state
1421               // split that was performed by another checker (and can not find
1422               // the successors). This is why this check is only used in the
1423               // EvalCallAsPure case.
1424               if (BR.isInteresting(RV) && Node->succ_size() > 1)
1425                 return CaseNote;
1426               return "";
1427             });
1428         Pred = C.addTransition(NewState, Pred, Tag);
1429       }
1430     } else {
1431       if (!CaseNote.empty() || !ErrnoNote.empty()) {
1432         const NoteTag *Tag =
1433             C.getNoteTag([CaseNote, ErrnoNote,
1434                           RV](PathSensitiveBugReport &BR) -> std::string {
1435               // If 'errno' is interesting, show the user a note about the case
1436               // (what happened at the function call) and about how 'errno'
1437               // causes the problem. ErrnoChecker sets the errno (but not RV) to
1438               // interesting.
1439               // If only the return value is interesting, show only the case
1440               // note.
1441               std::optional<Loc> ErrnoLoc =
1442                   errno_modeling::getErrnoLoc(BR.getErrorNode()->getState());
1443               bool ErrnoImportant = !ErrnoNote.empty() && ErrnoLoc &&
1444                                     BR.isInteresting(ErrnoLoc->getAsRegion());
1445               if (ErrnoImportant) {
1446                 BR.markNotInteresting(ErrnoLoc->getAsRegion());
1447                 if (CaseNote.empty())
1448                   return ErrnoNote;
1449                 return llvm::formatv("{0}; {1}", CaseNote, ErrnoNote);
1450               } else {
1451                 if (BR.isInteresting(RV))
1452                   return CaseNote;
1453               }
1454               return "";
1455             });
1456         Pred = C.addTransition(NewState, Pred, Tag);
1457       }
1458     }
1459 
1460     // Add the transition if no note tag was added.
1461     if (Pred == Node && NewState != State)
1462       C.addTransition(NewState);
1463   }
1464 }
1465 
1466 bool StdLibraryFunctionsChecker::evalCall(const CallEvent &Call,
1467                                           CheckerContext &C) const {
1468   std::optional<Summary> FoundSummary = findFunctionSummary(Call, C);
1469   if (!FoundSummary)
1470     return false;
1471 
1472   const Summary &Summary = *FoundSummary;
1473   switch (Summary.getInvalidationKd()) {
1474   case EvalCallAsPure: {
1475     ProgramStateRef State = C.getState();
1476     const LocationContext *LC = C.getLocationContext();
1477     const auto *CE = cast<CallExpr>(Call.getOriginExpr());
1478     SVal V = C.getSValBuilder().conjureSymbolVal(
1479         CE, LC, CE->getType().getCanonicalType(), C.blockCount());
1480     State = State->BindExpr(CE, LC, V);
1481 
1482     C.addTransition(State);
1483 
1484     return true;
1485   }
1486   case NoEvalCall:
1487     // Summary tells us to avoid performing eval::Call. The function is possibly
1488     // evaluated by another checker, or evaluated conservatively.
1489     return false;
1490   }
1491   llvm_unreachable("Unknown invalidation kind!");
1492 }
1493 
1494 bool StdLibraryFunctionsChecker::Signature::matches(
1495     const FunctionDecl *FD) const {
1496   assert(!isInvalid());
1497   // Check the number of arguments.
1498   if (FD->param_size() != ArgTys.size())
1499     return false;
1500 
1501   // The "restrict" keyword is illegal in C++, however, many libc
1502   // implementations use the "__restrict" compiler intrinsic in functions
1503   // prototypes. The "__restrict" keyword qualifies a type as a restricted type
1504   // even in C++.
1505   // In case of any non-C99 languages, we don't want to match based on the
1506   // restrict qualifier because we cannot know if the given libc implementation
1507   // qualifies the paramter type or not.
1508   auto RemoveRestrict = [&FD](QualType T) {
1509     if (!FD->getASTContext().getLangOpts().C99)
1510       T.removeLocalRestrict();
1511     return T;
1512   };
1513 
1514   // Check the return type.
1515   if (!isIrrelevant(RetTy)) {
1516     QualType FDRetTy = RemoveRestrict(FD->getReturnType().getCanonicalType());
1517     if (RetTy != FDRetTy)
1518       return false;
1519   }
1520 
1521   // Check the argument types.
1522   for (auto [Idx, ArgTy] : llvm::enumerate(ArgTys)) {
1523     if (isIrrelevant(ArgTy))
1524       continue;
1525     QualType FDArgTy =
1526         RemoveRestrict(FD->getParamDecl(Idx)->getType().getCanonicalType());
1527     if (ArgTy != FDArgTy)
1528       return false;
1529   }
1530 
1531   return true;
1532 }
1533 
1534 std::optional<StdLibraryFunctionsChecker::Summary>
1535 StdLibraryFunctionsChecker::findFunctionSummary(const FunctionDecl *FD,
1536                                                 CheckerContext &C) const {
1537   if (!FD)
1538     return std::nullopt;
1539 
1540   initFunctionSummaries(C);
1541 
1542   auto FSMI = FunctionSummaryMap.find(FD->getCanonicalDecl());
1543   if (FSMI == FunctionSummaryMap.end())
1544     return std::nullopt;
1545   return FSMI->second;
1546 }
1547 
1548 std::optional<StdLibraryFunctionsChecker::Summary>
1549 StdLibraryFunctionsChecker::findFunctionSummary(const CallEvent &Call,
1550                                                 CheckerContext &C) const {
1551   const FunctionDecl *FD = dyn_cast_or_null<FunctionDecl>(Call.getDecl());
1552   if (!FD)
1553     return std::nullopt;
1554   return findFunctionSummary(FD, C);
1555 }
1556 
1557 void StdLibraryFunctionsChecker::initFunctionSummaries(
1558     CheckerContext &C) const {
1559   if (SummariesInitialized)
1560     return;
1561   SummariesInitialized = true;
1562 
1563   SValBuilder &SVB = C.getSValBuilder();
1564   BasicValueFactory &BVF = SVB.getBasicValueFactory();
1565   const ASTContext &ACtx = BVF.getContext();
1566   Preprocessor &PP = C.getPreprocessor();
1567 
1568   // Helper class to lookup a type by its name.
1569   class LookupType {
1570     const ASTContext &ACtx;
1571 
1572   public:
1573     LookupType(const ASTContext &ACtx) : ACtx(ACtx) {}
1574 
1575     // Find the type. If not found then the optional is not set.
1576     std::optional<QualType> operator()(StringRef Name) {
1577       IdentifierInfo &II = ACtx.Idents.get(Name);
1578       auto LookupRes = ACtx.getTranslationUnitDecl()->lookup(&II);
1579       if (LookupRes.empty())
1580         return std::nullopt;
1581 
1582       // Prioritze typedef declarations.
1583       // This is needed in case of C struct typedefs. E.g.:
1584       //   typedef struct FILE FILE;
1585       // In this case, we have a RecordDecl 'struct FILE' with the name 'FILE'
1586       // and we have a TypedefDecl with the name 'FILE'.
1587       for (Decl *D : LookupRes)
1588         if (auto *TD = dyn_cast<TypedefNameDecl>(D))
1589           return ACtx.getTypeDeclType(TD).getCanonicalType();
1590 
1591       // Find the first TypeDecl.
1592       // There maybe cases when a function has the same name as a struct.
1593       // E.g. in POSIX: `struct stat` and the function `stat()`:
1594       //   int stat(const char *restrict path, struct stat *restrict buf);
1595       for (Decl *D : LookupRes)
1596         if (auto *TD = dyn_cast<TypeDecl>(D))
1597           return ACtx.getTypeDeclType(TD).getCanonicalType();
1598       return std::nullopt;
1599     }
1600   } lookupTy(ACtx);
1601 
1602   // Below are auxiliary classes to handle optional types that we get as a
1603   // result of the lookup.
1604   class GetRestrictTy {
1605     const ASTContext &ACtx;
1606 
1607   public:
1608     GetRestrictTy(const ASTContext &ACtx) : ACtx(ACtx) {}
1609     QualType operator()(QualType Ty) {
1610       return ACtx.getLangOpts().C99 ? ACtx.getRestrictType(Ty) : Ty;
1611     }
1612     std::optional<QualType> operator()(std::optional<QualType> Ty) {
1613       if (Ty)
1614         return operator()(*Ty);
1615       return std::nullopt;
1616     }
1617   } getRestrictTy(ACtx);
1618   class GetPointerTy {
1619     const ASTContext &ACtx;
1620 
1621   public:
1622     GetPointerTy(const ASTContext &ACtx) : ACtx(ACtx) {}
1623     QualType operator()(QualType Ty) { return ACtx.getPointerType(Ty); }
1624     std::optional<QualType> operator()(std::optional<QualType> Ty) {
1625       if (Ty)
1626         return operator()(*Ty);
1627       return std::nullopt;
1628     }
1629   } getPointerTy(ACtx);
1630   class {
1631   public:
1632     std::optional<QualType> operator()(std::optional<QualType> Ty) {
1633       return Ty ? std::optional<QualType>(Ty->withConst()) : std::nullopt;
1634     }
1635     QualType operator()(QualType Ty) { return Ty.withConst(); }
1636   } getConstTy;
1637   class GetMaxValue {
1638     BasicValueFactory &BVF;
1639 
1640   public:
1641     GetMaxValue(BasicValueFactory &BVF) : BVF(BVF) {}
1642     std::optional<RangeInt> operator()(QualType Ty) {
1643       return BVF.getMaxValue(Ty).getLimitedValue();
1644     }
1645     std::optional<RangeInt> operator()(std::optional<QualType> Ty) {
1646       if (Ty) {
1647         return operator()(*Ty);
1648       }
1649       return std::nullopt;
1650     }
1651   } getMaxValue(BVF);
1652 
1653   // These types are useful for writing specifications quickly,
1654   // New specifications should probably introduce more types.
1655   // Some types are hard to obtain from the AST, eg. "ssize_t".
1656   // In such cases it should be possible to provide multiple variants
1657   // of function summary for common cases (eg. ssize_t could be int or long
1658   // or long long, so three summary variants would be enough).
1659   // Of course, function variants are also useful for C++ overloads.
1660   const QualType VoidTy = ACtx.VoidTy;
1661   const QualType CharTy = ACtx.CharTy;
1662   const QualType WCharTy = ACtx.WCharTy;
1663   const QualType IntTy = ACtx.IntTy;
1664   const QualType UnsignedIntTy = ACtx.UnsignedIntTy;
1665   const QualType LongTy = ACtx.LongTy;
1666   const QualType SizeTy = ACtx.getSizeType();
1667 
1668   const QualType VoidPtrTy = getPointerTy(VoidTy); // void *
1669   const QualType IntPtrTy = getPointerTy(IntTy);   // int *
1670   const QualType UnsignedIntPtrTy =
1671       getPointerTy(UnsignedIntTy); // unsigned int *
1672   const QualType VoidPtrRestrictTy = getRestrictTy(VoidPtrTy);
1673   const QualType ConstVoidPtrTy =
1674       getPointerTy(getConstTy(VoidTy));            // const void *
1675   const QualType CharPtrTy = getPointerTy(CharTy); // char *
1676   const QualType CharPtrRestrictTy = getRestrictTy(CharPtrTy);
1677   const QualType ConstCharPtrTy =
1678       getPointerTy(getConstTy(CharTy)); // const char *
1679   const QualType ConstCharPtrRestrictTy = getRestrictTy(ConstCharPtrTy);
1680   const QualType Wchar_tPtrTy = getPointerTy(WCharTy); // wchar_t *
1681   const QualType ConstWchar_tPtrTy =
1682       getPointerTy(getConstTy(WCharTy)); // const wchar_t *
1683   const QualType ConstVoidPtrRestrictTy = getRestrictTy(ConstVoidPtrTy);
1684   const QualType SizePtrTy = getPointerTy(SizeTy);
1685   const QualType SizePtrRestrictTy = getRestrictTy(SizePtrTy);
1686 
1687   const RangeInt IntMax = BVF.getMaxValue(IntTy).getLimitedValue();
1688   const RangeInt UnsignedIntMax =
1689       BVF.getMaxValue(UnsignedIntTy).getLimitedValue();
1690   const RangeInt LongMax = BVF.getMaxValue(LongTy).getLimitedValue();
1691   const RangeInt SizeMax = BVF.getMaxValue(SizeTy).getLimitedValue();
1692 
1693   // Set UCharRangeMax to min of int or uchar maximum value.
1694   // The C standard states that the arguments of functions like isalpha must
1695   // be representable as an unsigned char. Their type is 'int', so the max
1696   // value of the argument should be min(UCharMax, IntMax). This just happen
1697   // to be true for commonly used and well tested instruction set
1698   // architectures, but not for others.
1699   const RangeInt UCharRangeMax =
1700       std::min(BVF.getMaxValue(ACtx.UnsignedCharTy).getLimitedValue(), IntMax);
1701 
1702   // Get platform dependent values of some macros.
1703   // Try our best to parse this from the Preprocessor, otherwise fallback to a
1704   // default value (what is found in a library header).
1705   const auto EOFv = tryExpandAsInteger("EOF", PP).value_or(-1);
1706   const auto AT_FDCWDv = tryExpandAsInteger("AT_FDCWD", PP).value_or(-100);
1707 
1708   // Auxiliary class to aid adding summaries to the summary map.
1709   struct AddToFunctionSummaryMap {
1710     const ASTContext &ACtx;
1711     FunctionSummaryMapType &Map;
1712     bool DisplayLoadedSummaries;
1713     AddToFunctionSummaryMap(const ASTContext &ACtx, FunctionSummaryMapType &FSM,
1714                             bool DisplayLoadedSummaries)
1715         : ACtx(ACtx), Map(FSM), DisplayLoadedSummaries(DisplayLoadedSummaries) {
1716     }
1717 
1718     // Add a summary to a FunctionDecl found by lookup. The lookup is performed
1719     // by the given Name, and in the global scope. The summary will be attached
1720     // to the found FunctionDecl only if the signatures match.
1721     //
1722     // Returns true if the summary has been added, false otherwise.
1723     bool operator()(StringRef Name, Signature Sign, Summary Sum) {
1724       if (Sign.isInvalid())
1725         return false;
1726       IdentifierInfo &II = ACtx.Idents.get(Name);
1727       auto LookupRes = ACtx.getTranslationUnitDecl()->lookup(&II);
1728       if (LookupRes.empty())
1729         return false;
1730       for (Decl *D : LookupRes) {
1731         if (auto *FD = dyn_cast<FunctionDecl>(D)) {
1732           if (Sum.matchesAndSet(Sign, FD)) {
1733             auto Res = Map.insert({FD->getCanonicalDecl(), Sum});
1734             assert(Res.second && "Function already has a summary set!");
1735             (void)Res;
1736             if (DisplayLoadedSummaries) {
1737               llvm::errs() << "Loaded summary for: ";
1738               FD->print(llvm::errs());
1739               llvm::errs() << "\n";
1740             }
1741             return true;
1742           }
1743         }
1744       }
1745       return false;
1746     }
1747     // Add the same summary for different names with the Signature explicitly
1748     // given.
1749     void operator()(std::vector<StringRef> Names, Signature Sign, Summary Sum) {
1750       for (StringRef Name : Names)
1751         operator()(Name, Sign, Sum);
1752     }
1753   } addToFunctionSummaryMap(ACtx, FunctionSummaryMap, DisplayLoadedSummaries);
1754 
1755   // Below are helpers functions to create the summaries.
1756   auto ArgumentCondition = [](ArgNo ArgN, RangeKind Kind, IntRangeVector Ranges,
1757                               StringRef Desc = "") {
1758     return std::make_shared<RangeConstraint>(ArgN, Kind, Ranges, Desc);
1759   };
1760   auto BufferSize = [](auto... Args) {
1761     return std::make_shared<BufferSizeConstraint>(Args...);
1762   };
1763   struct {
1764     auto operator()(RangeKind Kind, IntRangeVector Ranges) {
1765       return std::make_shared<RangeConstraint>(Ret, Kind, Ranges);
1766     }
1767     auto operator()(BinaryOperator::Opcode Op, ArgNo OtherArgN) {
1768       return std::make_shared<ComparisonConstraint>(Ret, Op, OtherArgN);
1769     }
1770   } ReturnValueCondition;
1771   struct {
1772     auto operator()(RangeInt b, RangeInt e) {
1773       return IntRangeVector{std::pair<RangeInt, RangeInt>{b, e}};
1774     }
1775     auto operator()(RangeInt b, std::optional<RangeInt> e) {
1776       if (e)
1777         return IntRangeVector{std::pair<RangeInt, RangeInt>{b, *e}};
1778       return IntRangeVector{};
1779     }
1780     auto operator()(std::pair<RangeInt, RangeInt> i0,
1781                     std::pair<RangeInt, std::optional<RangeInt>> i1) {
1782       if (i1.second)
1783         return IntRangeVector{i0, {i1.first, *(i1.second)}};
1784       return IntRangeVector{i0};
1785     }
1786   } Range;
1787   auto SingleValue = [](RangeInt v) {
1788     return IntRangeVector{std::pair<RangeInt, RangeInt>{v, v}};
1789   };
1790   auto LessThanOrEq = BO_LE;
1791   auto NotNull = [&](ArgNo ArgN) {
1792     return std::make_shared<NotNullConstraint>(ArgN);
1793   };
1794   auto IsNull = [&](ArgNo ArgN) {
1795     return std::make_shared<NotNullConstraint>(ArgN, false);
1796   };
1797   auto NotNullBuffer = [&](ArgNo ArgN, ArgNo SizeArg1N, ArgNo SizeArg2N) {
1798     return std::make_shared<NotNullBufferConstraint>(ArgN, SizeArg1N,
1799                                                      SizeArg2N);
1800   };
1801 
1802   std::optional<QualType> FileTy = lookupTy("FILE");
1803   std::optional<QualType> FilePtrTy = getPointerTy(FileTy);
1804   std::optional<QualType> FilePtrRestrictTy = getRestrictTy(FilePtrTy);
1805 
1806   std::optional<QualType> FPosTTy = lookupTy("fpos_t");
1807   std::optional<QualType> FPosTPtrTy = getPointerTy(FPosTTy);
1808   std::optional<QualType> ConstFPosTPtrTy = getPointerTy(getConstTy(FPosTTy));
1809   std::optional<QualType> FPosTPtrRestrictTy = getRestrictTy(FPosTPtrTy);
1810 
1811   constexpr llvm::StringLiteral GenericSuccessMsg(
1812       "Assuming that '{0}' is successful");
1813   constexpr llvm::StringLiteral GenericFailureMsg("Assuming that '{0}' fails");
1814 
1815   // We are finally ready to define specifications for all supported functions.
1816   //
1817   // Argument ranges should always cover all variants. If return value
1818   // is completely unknown, omit it from the respective range set.
1819   //
1820   // Every item in the list of range sets represents a particular
1821   // execution path the analyzer would need to explore once
1822   // the call is modeled - a new program state is constructed
1823   // for every range set, and each range line in the range set
1824   // corresponds to a specific constraint within this state.
1825 
1826   // The isascii() family of functions.
1827   // The behavior is undefined if the value of the argument is not
1828   // representable as unsigned char or is not equal to EOF. See e.g. C99
1829   // 7.4.1.2 The isalpha function (p: 181-182).
1830   addToFunctionSummaryMap(
1831       "isalnum", Signature(ArgTypes{IntTy}, RetType{IntTy}),
1832       Summary(EvalCallAsPure)
1833           // Boils down to isupper() or islower() or isdigit().
1834           .Case({ArgumentCondition(0U, WithinRange,
1835                                    {{'0', '9'}, {'A', 'Z'}, {'a', 'z'}}),
1836                  ReturnValueCondition(OutOfRange, SingleValue(0))},
1837                 ErrnoIrrelevant, "Assuming the character is alphanumeric")
1838           // The locale-specific range.
1839           // No post-condition. We are completely unaware of
1840           // locale-specific return values.
1841           .Case({ArgumentCondition(0U, WithinRange, {{128, UCharRangeMax}})},
1842                 ErrnoIrrelevant)
1843           .Case(
1844               {ArgumentCondition(
1845                    0U, OutOfRange,
1846                    {{'0', '9'}, {'A', 'Z'}, {'a', 'z'}, {128, UCharRangeMax}}),
1847                ReturnValueCondition(WithinRange, SingleValue(0))},
1848               ErrnoIrrelevant, "Assuming the character is non-alphanumeric")
1849           .ArgConstraint(ArgumentCondition(0U, WithinRange,
1850                                            {{EOFv, EOFv}, {0, UCharRangeMax}},
1851                                            "an unsigned char value or EOF")));
1852   addToFunctionSummaryMap(
1853       "isalpha", Signature(ArgTypes{IntTy}, RetType{IntTy}),
1854       Summary(EvalCallAsPure)
1855           .Case({ArgumentCondition(0U, WithinRange, {{'A', 'Z'}, {'a', 'z'}}),
1856                  ReturnValueCondition(OutOfRange, SingleValue(0))},
1857                 ErrnoIrrelevant, "Assuming the character is alphabetical")
1858           // The locale-specific range.
1859           .Case({ArgumentCondition(0U, WithinRange, {{128, UCharRangeMax}})},
1860                 ErrnoIrrelevant)
1861           .Case({ArgumentCondition(
1862                      0U, OutOfRange,
1863                      {{'A', 'Z'}, {'a', 'z'}, {128, UCharRangeMax}}),
1864                  ReturnValueCondition(WithinRange, SingleValue(0))},
1865                 ErrnoIrrelevant, "Assuming the character is non-alphabetical"));
1866   addToFunctionSummaryMap(
1867       "isascii", Signature(ArgTypes{IntTy}, RetType{IntTy}),
1868       Summary(EvalCallAsPure)
1869           .Case({ArgumentCondition(0U, WithinRange, Range(0, 127)),
1870                  ReturnValueCondition(OutOfRange, SingleValue(0))},
1871                 ErrnoIrrelevant, "Assuming the character is an ASCII character")
1872           .Case({ArgumentCondition(0U, OutOfRange, Range(0, 127)),
1873                  ReturnValueCondition(WithinRange, SingleValue(0))},
1874                 ErrnoIrrelevant,
1875                 "Assuming the character is not an ASCII character"));
1876   addToFunctionSummaryMap(
1877       "isblank", Signature(ArgTypes{IntTy}, RetType{IntTy}),
1878       Summary(EvalCallAsPure)
1879           .Case({ArgumentCondition(0U, WithinRange, {{'\t', '\t'}, {' ', ' '}}),
1880                  ReturnValueCondition(OutOfRange, SingleValue(0))},
1881                 ErrnoIrrelevant, "Assuming the character is a blank character")
1882           .Case({ArgumentCondition(0U, OutOfRange, {{'\t', '\t'}, {' ', ' '}}),
1883                  ReturnValueCondition(WithinRange, SingleValue(0))},
1884                 ErrnoIrrelevant,
1885                 "Assuming the character is not a blank character"));
1886   addToFunctionSummaryMap(
1887       "iscntrl", Signature(ArgTypes{IntTy}, RetType{IntTy}),
1888       Summary(EvalCallAsPure)
1889           .Case({ArgumentCondition(0U, WithinRange, {{0, 32}, {127, 127}}),
1890                  ReturnValueCondition(OutOfRange, SingleValue(0))},
1891                 ErrnoIrrelevant,
1892                 "Assuming the character is a control character")
1893           .Case({ArgumentCondition(0U, OutOfRange, {{0, 32}, {127, 127}}),
1894                  ReturnValueCondition(WithinRange, SingleValue(0))},
1895                 ErrnoIrrelevant,
1896                 "Assuming the character is not a control character"));
1897   addToFunctionSummaryMap(
1898       "isdigit", Signature(ArgTypes{IntTy}, RetType{IntTy}),
1899       Summary(EvalCallAsPure)
1900           .Case({ArgumentCondition(0U, WithinRange, Range('0', '9')),
1901                  ReturnValueCondition(OutOfRange, SingleValue(0))},
1902                 ErrnoIrrelevant, "Assuming the character is a digit")
1903           .Case({ArgumentCondition(0U, OutOfRange, Range('0', '9')),
1904                  ReturnValueCondition(WithinRange, SingleValue(0))},
1905                 ErrnoIrrelevant, "Assuming the character is not a digit"));
1906   addToFunctionSummaryMap(
1907       "isgraph", Signature(ArgTypes{IntTy}, RetType{IntTy}),
1908       Summary(EvalCallAsPure)
1909           .Case({ArgumentCondition(0U, WithinRange, Range(33, 126)),
1910                  ReturnValueCondition(OutOfRange, SingleValue(0))},
1911                 ErrnoIrrelevant,
1912                 "Assuming the character has graphical representation")
1913           .Case(
1914               {ArgumentCondition(0U, OutOfRange, Range(33, 126)),
1915                ReturnValueCondition(WithinRange, SingleValue(0))},
1916               ErrnoIrrelevant,
1917               "Assuming the character does not have graphical representation"));
1918   addToFunctionSummaryMap(
1919       "islower", Signature(ArgTypes{IntTy}, RetType{IntTy}),
1920       Summary(EvalCallAsPure)
1921           // Is certainly lowercase.
1922           .Case({ArgumentCondition(0U, WithinRange, Range('a', 'z')),
1923                  ReturnValueCondition(OutOfRange, SingleValue(0))},
1924                 ErrnoIrrelevant, "Assuming the character is a lowercase letter")
1925           // Is ascii but not lowercase.
1926           .Case({ArgumentCondition(0U, WithinRange, Range(0, 127)),
1927                  ArgumentCondition(0U, OutOfRange, Range('a', 'z')),
1928                  ReturnValueCondition(WithinRange, SingleValue(0))},
1929                 ErrnoIrrelevant,
1930                 "Assuming the character is not a lowercase letter")
1931           // The locale-specific range.
1932           .Case({ArgumentCondition(0U, WithinRange, {{128, UCharRangeMax}})},
1933                 ErrnoIrrelevant)
1934           // Is not an unsigned char.
1935           .Case({ArgumentCondition(0U, OutOfRange, Range(0, UCharRangeMax)),
1936                  ReturnValueCondition(WithinRange, SingleValue(0))},
1937                 ErrnoIrrelevant));
1938   addToFunctionSummaryMap(
1939       "isprint", Signature(ArgTypes{IntTy}, RetType{IntTy}),
1940       Summary(EvalCallAsPure)
1941           .Case({ArgumentCondition(0U, WithinRange, Range(32, 126)),
1942                  ReturnValueCondition(OutOfRange, SingleValue(0))},
1943                 ErrnoIrrelevant, "Assuming the character is printable")
1944           .Case({ArgumentCondition(0U, OutOfRange, Range(32, 126)),
1945                  ReturnValueCondition(WithinRange, SingleValue(0))},
1946                 ErrnoIrrelevant, "Assuming the character is non-printable"));
1947   addToFunctionSummaryMap(
1948       "ispunct", Signature(ArgTypes{IntTy}, RetType{IntTy}),
1949       Summary(EvalCallAsPure)
1950           .Case({ArgumentCondition(
1951                      0U, WithinRange,
1952                      {{'!', '/'}, {':', '@'}, {'[', '`'}, {'{', '~'}}),
1953                  ReturnValueCondition(OutOfRange, SingleValue(0))},
1954                 ErrnoIrrelevant, "Assuming the character is a punctuation mark")
1955           .Case({ArgumentCondition(
1956                      0U, OutOfRange,
1957                      {{'!', '/'}, {':', '@'}, {'[', '`'}, {'{', '~'}}),
1958                  ReturnValueCondition(WithinRange, SingleValue(0))},
1959                 ErrnoIrrelevant,
1960                 "Assuming the character is not a punctuation mark"));
1961   addToFunctionSummaryMap(
1962       "isspace", Signature(ArgTypes{IntTy}, RetType{IntTy}),
1963       Summary(EvalCallAsPure)
1964           // Space, '\f', '\n', '\r', '\t', '\v'.
1965           .Case({ArgumentCondition(0U, WithinRange, {{9, 13}, {' ', ' '}}),
1966                  ReturnValueCondition(OutOfRange, SingleValue(0))},
1967                 ErrnoIrrelevant,
1968                 "Assuming the character is a whitespace character")
1969           // The locale-specific range.
1970           .Case({ArgumentCondition(0U, WithinRange, {{128, UCharRangeMax}})},
1971                 ErrnoIrrelevant)
1972           .Case({ArgumentCondition(0U, OutOfRange,
1973                                    {{9, 13}, {' ', ' '}, {128, UCharRangeMax}}),
1974                  ReturnValueCondition(WithinRange, SingleValue(0))},
1975                 ErrnoIrrelevant,
1976                 "Assuming the character is not a whitespace character"));
1977   addToFunctionSummaryMap(
1978       "isupper", Signature(ArgTypes{IntTy}, RetType{IntTy}),
1979       Summary(EvalCallAsPure)
1980           // Is certainly uppercase.
1981           .Case({ArgumentCondition(0U, WithinRange, Range('A', 'Z')),
1982                  ReturnValueCondition(OutOfRange, SingleValue(0))},
1983                 ErrnoIrrelevant,
1984                 "Assuming the character is an uppercase letter")
1985           // The locale-specific range.
1986           .Case({ArgumentCondition(0U, WithinRange, {{128, UCharRangeMax}})},
1987                 ErrnoIrrelevant)
1988           // Other.
1989           .Case({ArgumentCondition(0U, OutOfRange,
1990                                    {{'A', 'Z'}, {128, UCharRangeMax}}),
1991                  ReturnValueCondition(WithinRange, SingleValue(0))},
1992                 ErrnoIrrelevant,
1993                 "Assuming the character is not an uppercase letter"));
1994   addToFunctionSummaryMap(
1995       "isxdigit", Signature(ArgTypes{IntTy}, RetType{IntTy}),
1996       Summary(EvalCallAsPure)
1997           .Case({ArgumentCondition(0U, WithinRange,
1998                                    {{'0', '9'}, {'A', 'F'}, {'a', 'f'}}),
1999                  ReturnValueCondition(OutOfRange, SingleValue(0))},
2000                 ErrnoIrrelevant,
2001                 "Assuming the character is a hexadecimal digit")
2002           .Case({ArgumentCondition(0U, OutOfRange,
2003                                    {{'0', '9'}, {'A', 'F'}, {'a', 'f'}}),
2004                  ReturnValueCondition(WithinRange, SingleValue(0))},
2005                 ErrnoIrrelevant,
2006                 "Assuming the character is not a hexadecimal digit"));
2007   addToFunctionSummaryMap(
2008       "toupper", Signature(ArgTypes{IntTy}, RetType{IntTy}),
2009       Summary(EvalCallAsPure)
2010           .ArgConstraint(ArgumentCondition(0U, WithinRange,
2011                                            {{EOFv, EOFv}, {0, UCharRangeMax}},
2012                                            "an unsigned char value or EOF")));
2013   addToFunctionSummaryMap(
2014       "tolower", Signature(ArgTypes{IntTy}, RetType{IntTy}),
2015       Summary(EvalCallAsPure)
2016           .ArgConstraint(ArgumentCondition(0U, WithinRange,
2017                                            {{EOFv, EOFv}, {0, UCharRangeMax}},
2018                                            "an unsigned char value or EOF")));
2019   addToFunctionSummaryMap(
2020       "toascii", Signature(ArgTypes{IntTy}, RetType{IntTy}),
2021       Summary(EvalCallAsPure)
2022           .ArgConstraint(ArgumentCondition(0U, WithinRange,
2023                                            {{EOFv, EOFv}, {0, UCharRangeMax}},
2024                                            "an unsigned char value or EOF")));
2025 
2026   // The getc() family of functions that returns either a char or an EOF.
2027   addToFunctionSummaryMap(
2028       {"getc", "fgetc"}, Signature(ArgTypes{FilePtrTy}, RetType{IntTy}),
2029       Summary(NoEvalCall)
2030           .Case({ReturnValueCondition(WithinRange,
2031                                       {{EOFv, EOFv}, {0, UCharRangeMax}})},
2032                 ErrnoIrrelevant));
2033   addToFunctionSummaryMap(
2034       "getchar", Signature(ArgTypes{}, RetType{IntTy}),
2035       Summary(NoEvalCall)
2036           .Case({ReturnValueCondition(WithinRange,
2037                                       {{EOFv, EOFv}, {0, UCharRangeMax}})},
2038                 ErrnoIrrelevant));
2039 
2040   // read()-like functions that never return more than buffer size.
2041   auto FreadSummary =
2042       Summary(NoEvalCall)
2043           .Case({ArgumentCondition(1U, WithinRange, Range(1, SizeMax)),
2044                  ArgumentCondition(2U, WithinRange, Range(1, SizeMax)),
2045                  ReturnValueCondition(BO_LT, ArgNo(2)),
2046                  ReturnValueCondition(WithinRange, Range(0, SizeMax))},
2047                 ErrnoNEZeroIrrelevant, GenericFailureMsg)
2048           .Case({ArgumentCondition(1U, WithinRange, Range(1, SizeMax)),
2049                  ReturnValueCondition(BO_EQ, ArgNo(2)),
2050                  ReturnValueCondition(WithinRange, Range(0, SizeMax))},
2051                 ErrnoMustNotBeChecked, GenericSuccessMsg)
2052           .Case({ArgumentCondition(1U, WithinRange, SingleValue(0)),
2053                  ReturnValueCondition(WithinRange, SingleValue(0))},
2054                 ErrnoMustNotBeChecked,
2055                 "Assuming that argument 'size' to '{0}' is 0")
2056           .ArgConstraint(NotNullBuffer(ArgNo(0), ArgNo(1), ArgNo(2)))
2057           .ArgConstraint(NotNull(ArgNo(3)))
2058           .ArgConstraint(BufferSize(/*Buffer=*/ArgNo(0), /*BufSize=*/ArgNo(1),
2059                                     /*BufSizeMultiplier=*/ArgNo(2)));
2060 
2061   // size_t fread(void *restrict ptr, size_t size, size_t nitems,
2062   //              FILE *restrict stream);
2063   addToFunctionSummaryMap(
2064       "fread",
2065       Signature(ArgTypes{VoidPtrRestrictTy, SizeTy, SizeTy, FilePtrRestrictTy},
2066                 RetType{SizeTy}),
2067       FreadSummary);
2068   // size_t fwrite(const void *restrict ptr, size_t size, size_t nitems,
2069   //               FILE *restrict stream);
2070   addToFunctionSummaryMap("fwrite",
2071                           Signature(ArgTypes{ConstVoidPtrRestrictTy, SizeTy,
2072                                              SizeTy, FilePtrRestrictTy},
2073                                     RetType{SizeTy}),
2074                           FreadSummary);
2075 
2076   std::optional<QualType> Ssize_tTy = lookupTy("ssize_t");
2077   std::optional<RangeInt> Ssize_tMax = getMaxValue(Ssize_tTy);
2078 
2079   auto ReadSummary =
2080       Summary(NoEvalCall)
2081           .Case({ReturnValueCondition(LessThanOrEq, ArgNo(2)),
2082                  ReturnValueCondition(WithinRange, Range(-1, Ssize_tMax))},
2083                 ErrnoIrrelevant);
2084 
2085   // FIXME these are actually defined by POSIX and not by the C standard, we
2086   // should handle them together with the rest of the POSIX functions.
2087   // ssize_t read(int fildes, void *buf, size_t nbyte);
2088   addToFunctionSummaryMap(
2089       "read", Signature(ArgTypes{IntTy, VoidPtrTy, SizeTy}, RetType{Ssize_tTy}),
2090       ReadSummary);
2091   // ssize_t write(int fildes, const void *buf, size_t nbyte);
2092   addToFunctionSummaryMap(
2093       "write",
2094       Signature(ArgTypes{IntTy, ConstVoidPtrTy, SizeTy}, RetType{Ssize_tTy}),
2095       ReadSummary);
2096 
2097   auto GetLineSummary =
2098       Summary(NoEvalCall)
2099           .Case({ReturnValueCondition(WithinRange,
2100                                       Range({-1, -1}, {1, Ssize_tMax}))},
2101                 ErrnoIrrelevant);
2102 
2103   QualType CharPtrPtrRestrictTy = getRestrictTy(getPointerTy(CharPtrTy));
2104 
2105   // getline()-like functions either fail or read at least the delimiter.
2106   // FIXME these are actually defined by POSIX and not by the C standard, we
2107   // should handle them together with the rest of the POSIX functions.
2108   // ssize_t getline(char **restrict lineptr, size_t *restrict n,
2109   //                 FILE *restrict stream);
2110   addToFunctionSummaryMap(
2111       "getline",
2112       Signature(
2113           ArgTypes{CharPtrPtrRestrictTy, SizePtrRestrictTy, FilePtrRestrictTy},
2114           RetType{Ssize_tTy}),
2115       GetLineSummary);
2116   // ssize_t getdelim(char **restrict lineptr, size_t *restrict n,
2117   //                  int delimiter, FILE *restrict stream);
2118   addToFunctionSummaryMap(
2119       "getdelim",
2120       Signature(ArgTypes{CharPtrPtrRestrictTy, SizePtrRestrictTy, IntTy,
2121                          FilePtrRestrictTy},
2122                 RetType{Ssize_tTy}),
2123       GetLineSummary);
2124 
2125   {
2126     Summary GetenvSummary =
2127         Summary(NoEvalCall)
2128             .ArgConstraint(NotNull(ArgNo(0)))
2129             .Case({NotNull(Ret)}, ErrnoIrrelevant,
2130                   "Assuming the environment variable exists");
2131     // In untrusted environments the envvar might not exist.
2132     if (!ShouldAssumeControlledEnvironment)
2133       GetenvSummary.Case({NotNull(Ret)->negate()}, ErrnoIrrelevant,
2134                          "Assuming the environment variable does not exist");
2135 
2136     // char *getenv(const char *name);
2137     addToFunctionSummaryMap(
2138         "getenv", Signature(ArgTypes{ConstCharPtrTy}, RetType{CharPtrTy}),
2139         std::move(GetenvSummary));
2140   }
2141 
2142   if (ModelPOSIX) {
2143     const auto ReturnsZeroOrMinusOne =
2144         ConstraintSet{ReturnValueCondition(WithinRange, Range(-1, 0))};
2145     const auto ReturnsZero =
2146         ConstraintSet{ReturnValueCondition(WithinRange, SingleValue(0))};
2147     const auto ReturnsMinusOne =
2148         ConstraintSet{ReturnValueCondition(WithinRange, SingleValue(-1))};
2149     const auto ReturnsNonnegative =
2150         ConstraintSet{ReturnValueCondition(WithinRange, Range(0, IntMax))};
2151     const auto ReturnsNonZero =
2152         ConstraintSet{ReturnValueCondition(OutOfRange, SingleValue(0))};
2153     const auto ReturnsFileDescriptor =
2154         ConstraintSet{ReturnValueCondition(WithinRange, Range(-1, IntMax))};
2155     const auto &ReturnsValidFileDescriptor = ReturnsNonnegative;
2156 
2157     auto ValidFileDescriptorOrAtFdcwd = [&](ArgNo ArgN) {
2158       return std::make_shared<RangeConstraint>(
2159           ArgN, WithinRange, Range({AT_FDCWDv, AT_FDCWDv}, {0, IntMax}),
2160           "a valid file descriptor or AT_FDCWD");
2161     };
2162 
2163     // FILE *fopen(const char *restrict pathname, const char *restrict mode);
2164     addToFunctionSummaryMap(
2165         "fopen",
2166         Signature(ArgTypes{ConstCharPtrRestrictTy, ConstCharPtrRestrictTy},
2167                   RetType{FilePtrTy}),
2168         Summary(NoEvalCall)
2169             .Case({NotNull(Ret)}, ErrnoMustNotBeChecked, GenericSuccessMsg)
2170             .Case({IsNull(Ret)}, ErrnoNEZeroIrrelevant, GenericFailureMsg)
2171             .ArgConstraint(NotNull(ArgNo(0)))
2172             .ArgConstraint(NotNull(ArgNo(1))));
2173 
2174     // FILE *tmpfile(void);
2175     addToFunctionSummaryMap(
2176         "tmpfile", Signature(ArgTypes{}, RetType{FilePtrTy}),
2177         Summary(NoEvalCall)
2178             .Case({NotNull(Ret)}, ErrnoMustNotBeChecked, GenericSuccessMsg)
2179             .Case({IsNull(Ret)}, ErrnoNEZeroIrrelevant, GenericFailureMsg));
2180 
2181     // FILE *freopen(const char *restrict pathname, const char *restrict mode,
2182     //               FILE *restrict stream);
2183     addToFunctionSummaryMap(
2184         "freopen",
2185         Signature(ArgTypes{ConstCharPtrRestrictTy, ConstCharPtrRestrictTy,
2186                            FilePtrRestrictTy},
2187                   RetType{FilePtrTy}),
2188         Summary(NoEvalCall)
2189             .Case({ReturnValueCondition(BO_EQ, ArgNo(2))},
2190                   ErrnoMustNotBeChecked, GenericSuccessMsg)
2191             .Case({IsNull(Ret)}, ErrnoNEZeroIrrelevant, GenericFailureMsg)
2192             .ArgConstraint(NotNull(ArgNo(1)))
2193             .ArgConstraint(NotNull(ArgNo(2))));
2194 
2195     // int fclose(FILE *stream);
2196     addToFunctionSummaryMap(
2197         "fclose", Signature(ArgTypes{FilePtrTy}, RetType{IntTy}),
2198         Summary(NoEvalCall)
2199             .Case(ReturnsZero, ErrnoMustNotBeChecked, GenericSuccessMsg)
2200             .Case({ReturnValueCondition(WithinRange, SingleValue(EOFv))},
2201                   ErrnoNEZeroIrrelevant, GenericFailureMsg)
2202             .ArgConstraint(NotNull(ArgNo(0))));
2203 
2204     // int fseek(FILE *stream, long offset, int whence);
2205     // FIXME: It can be possible to get the 'SEEK_' values (like EOFv) and use
2206     // these for condition of arg 2.
2207     // Now the range [0,2] is used (the `SEEK_*` constants are usually 0,1,2).
2208     addToFunctionSummaryMap(
2209         "fseek", Signature(ArgTypes{FilePtrTy, LongTy, IntTy}, RetType{IntTy}),
2210         Summary(NoEvalCall)
2211             .Case(ReturnsZero, ErrnoMustNotBeChecked, GenericSuccessMsg)
2212             .Case(ReturnsMinusOne, ErrnoNEZeroIrrelevant, GenericFailureMsg)
2213             .ArgConstraint(NotNull(ArgNo(0)))
2214             .ArgConstraint(ArgumentCondition(2, WithinRange, {{0, 2}})));
2215 
2216     // int fgetpos(FILE *restrict stream, fpos_t *restrict pos);
2217     // From 'The Open Group Base Specifications Issue 7, 2018 edition':
2218     // "The fgetpos() function shall not change the setting of errno if
2219     // successful."
2220     addToFunctionSummaryMap(
2221         "fgetpos",
2222         Signature(ArgTypes{FilePtrRestrictTy, FPosTPtrRestrictTy},
2223                   RetType{IntTy}),
2224         Summary(NoEvalCall)
2225             .Case(ReturnsZero, ErrnoUnchanged, GenericSuccessMsg)
2226             .Case(ReturnsNonZero, ErrnoNEZeroIrrelevant, GenericFailureMsg)
2227             .ArgConstraint(NotNull(ArgNo(0)))
2228             .ArgConstraint(NotNull(ArgNo(1))));
2229 
2230     // int fsetpos(FILE *stream, const fpos_t *pos);
2231     // From 'The Open Group Base Specifications Issue 7, 2018 edition':
2232     // "The fsetpos() function shall not change the setting of errno if
2233     // successful."
2234     addToFunctionSummaryMap(
2235         "fsetpos",
2236         Signature(ArgTypes{FilePtrTy, ConstFPosTPtrTy}, RetType{IntTy}),
2237         Summary(NoEvalCall)
2238             .Case(ReturnsZero, ErrnoUnchanged, GenericSuccessMsg)
2239             .Case(ReturnsNonZero, ErrnoNEZeroIrrelevant, GenericFailureMsg)
2240             .ArgConstraint(NotNull(ArgNo(0)))
2241             .ArgConstraint(NotNull(ArgNo(1))));
2242 
2243     // int fflush(FILE *stream);
2244     addToFunctionSummaryMap(
2245         "fflush", Signature(ArgTypes{FilePtrTy}, RetType{IntTy}),
2246         Summary(NoEvalCall)
2247             .Case(ReturnsZero, ErrnoMustNotBeChecked, GenericSuccessMsg)
2248             .Case({ReturnValueCondition(WithinRange, SingleValue(EOFv))},
2249                   ErrnoNEZeroIrrelevant, GenericFailureMsg));
2250 
2251     // long ftell(FILE *stream);
2252     // From 'The Open Group Base Specifications Issue 7, 2018 edition':
2253     // "The ftell() function shall not change the setting of errno if
2254     // successful."
2255     addToFunctionSummaryMap(
2256         "ftell", Signature(ArgTypes{FilePtrTy}, RetType{LongTy}),
2257         Summary(NoEvalCall)
2258             .Case({ReturnValueCondition(WithinRange, Range(1, LongMax))},
2259                   ErrnoUnchanged, GenericSuccessMsg)
2260             .Case(ReturnsMinusOne, ErrnoNEZeroIrrelevant, GenericFailureMsg)
2261             .ArgConstraint(NotNull(ArgNo(0))));
2262 
2263     // int fileno(FILE *stream);
2264     addToFunctionSummaryMap(
2265         "fileno", Signature(ArgTypes{FilePtrTy}, RetType{IntTy}),
2266         Summary(NoEvalCall)
2267             .Case(ReturnsValidFileDescriptor, ErrnoMustNotBeChecked,
2268                   GenericSuccessMsg)
2269             .Case(ReturnsMinusOne, ErrnoNEZeroIrrelevant, GenericFailureMsg)
2270             .ArgConstraint(NotNull(ArgNo(0))));
2271 
2272     // void rewind(FILE *stream);
2273     // This function indicates error only by setting of 'errno'.
2274     addToFunctionSummaryMap("rewind",
2275                             Signature(ArgTypes{FilePtrTy}, RetType{VoidTy}),
2276                             Summary(NoEvalCall)
2277                                 .Case({}, ErrnoMustBeChecked)
2278                                 .ArgConstraint(NotNull(ArgNo(0))));
2279 
2280     // void clearerr(FILE *stream);
2281     addToFunctionSummaryMap(
2282         "clearerr", Signature(ArgTypes{FilePtrTy}, RetType{VoidTy}),
2283         Summary(NoEvalCall).ArgConstraint(NotNull(ArgNo(0))));
2284 
2285     // int feof(FILE *stream);
2286     addToFunctionSummaryMap(
2287         "feof", Signature(ArgTypes{FilePtrTy}, RetType{IntTy}),
2288         Summary(NoEvalCall).ArgConstraint(NotNull(ArgNo(0))));
2289 
2290     // int ferror(FILE *stream);
2291     addToFunctionSummaryMap(
2292         "ferror", Signature(ArgTypes{FilePtrTy}, RetType{IntTy}),
2293         Summary(NoEvalCall).ArgConstraint(NotNull(ArgNo(0))));
2294 
2295     // long a64l(const char *str64);
2296     addToFunctionSummaryMap(
2297         "a64l", Signature(ArgTypes{ConstCharPtrTy}, RetType{LongTy}),
2298         Summary(NoEvalCall).ArgConstraint(NotNull(ArgNo(0))));
2299 
2300     // char *l64a(long value);
2301     addToFunctionSummaryMap("l64a",
2302                             Signature(ArgTypes{LongTy}, RetType{CharPtrTy}),
2303                             Summary(NoEvalCall)
2304                                 .ArgConstraint(ArgumentCondition(
2305                                     0, WithinRange, Range(0, LongMax))));
2306 
2307     // int open(const char *path, int oflag, ...);
2308     addToFunctionSummaryMap(
2309         "open", Signature(ArgTypes{ConstCharPtrTy, IntTy}, RetType{IntTy}),
2310         Summary(NoEvalCall)
2311             .Case(ReturnsValidFileDescriptor, ErrnoMustNotBeChecked,
2312                   GenericSuccessMsg)
2313             .Case(ReturnsMinusOne, ErrnoNEZeroIrrelevant, GenericFailureMsg)
2314             .ArgConstraint(NotNull(ArgNo(0))));
2315 
2316     // int openat(int fd, const char *path, int oflag, ...);
2317     addToFunctionSummaryMap(
2318         "openat",
2319         Signature(ArgTypes{IntTy, ConstCharPtrTy, IntTy}, RetType{IntTy}),
2320         Summary(NoEvalCall)
2321             .Case(ReturnsValidFileDescriptor, ErrnoMustNotBeChecked,
2322                   GenericSuccessMsg)
2323             .Case(ReturnsMinusOne, ErrnoNEZeroIrrelevant, GenericFailureMsg)
2324             .ArgConstraint(ValidFileDescriptorOrAtFdcwd(ArgNo(0)))
2325             .ArgConstraint(NotNull(ArgNo(1))));
2326 
2327     // int access(const char *pathname, int amode);
2328     addToFunctionSummaryMap(
2329         "access", Signature(ArgTypes{ConstCharPtrTy, IntTy}, RetType{IntTy}),
2330         Summary(NoEvalCall)
2331             .Case(ReturnsZero, ErrnoMustNotBeChecked, GenericSuccessMsg)
2332             .Case(ReturnsMinusOne, ErrnoNEZeroIrrelevant, GenericFailureMsg)
2333             .ArgConstraint(NotNull(ArgNo(0))));
2334 
2335     // int faccessat(int dirfd, const char *pathname, int mode, int flags);
2336     addToFunctionSummaryMap(
2337         "faccessat",
2338         Signature(ArgTypes{IntTy, ConstCharPtrTy, IntTy, IntTy},
2339                   RetType{IntTy}),
2340         Summary(NoEvalCall)
2341             .Case(ReturnsZero, ErrnoMustNotBeChecked, GenericSuccessMsg)
2342             .Case(ReturnsMinusOne, ErrnoNEZeroIrrelevant, GenericFailureMsg)
2343             .ArgConstraint(ValidFileDescriptorOrAtFdcwd(ArgNo(0)))
2344             .ArgConstraint(NotNull(ArgNo(1))));
2345 
2346     // int dup(int fildes);
2347     addToFunctionSummaryMap(
2348         "dup", Signature(ArgTypes{IntTy}, RetType{IntTy}),
2349         Summary(NoEvalCall)
2350             .Case(ReturnsValidFileDescriptor, ErrnoMustNotBeChecked,
2351                   GenericSuccessMsg)
2352             .Case(ReturnsMinusOne, ErrnoNEZeroIrrelevant, GenericFailureMsg)
2353             .ArgConstraint(
2354                 ArgumentCondition(0, WithinRange, Range(0, IntMax))));
2355 
2356     // int dup2(int fildes1, int filedes2);
2357     addToFunctionSummaryMap(
2358         "dup2", Signature(ArgTypes{IntTy, IntTy}, RetType{IntTy}),
2359         Summary(NoEvalCall)
2360             .Case(ReturnsValidFileDescriptor, ErrnoMustNotBeChecked,
2361                   GenericSuccessMsg)
2362             .Case(ReturnsMinusOne, ErrnoNEZeroIrrelevant, GenericFailureMsg)
2363             .ArgConstraint(ArgumentCondition(0, WithinRange, Range(0, IntMax)))
2364             .ArgConstraint(
2365                 ArgumentCondition(1, WithinRange, Range(0, IntMax))));
2366 
2367     // int fdatasync(int fildes);
2368     addToFunctionSummaryMap(
2369         "fdatasync", Signature(ArgTypes{IntTy}, RetType{IntTy}),
2370         Summary(NoEvalCall)
2371             .Case(ReturnsZero, ErrnoMustNotBeChecked, GenericSuccessMsg)
2372             .Case(ReturnsMinusOne, ErrnoNEZeroIrrelevant, GenericFailureMsg)
2373             .ArgConstraint(
2374                 ArgumentCondition(0, WithinRange, Range(0, IntMax))));
2375 
2376     // int fnmatch(const char *pattern, const char *string, int flags);
2377     addToFunctionSummaryMap(
2378         "fnmatch",
2379         Signature(ArgTypes{ConstCharPtrTy, ConstCharPtrTy, IntTy},
2380                   RetType{IntTy}),
2381         Summary(NoEvalCall)
2382             .ArgConstraint(NotNull(ArgNo(0)))
2383             .ArgConstraint(NotNull(ArgNo(1))));
2384 
2385     // int fsync(int fildes);
2386     addToFunctionSummaryMap(
2387         "fsync", Signature(ArgTypes{IntTy}, RetType{IntTy}),
2388         Summary(NoEvalCall)
2389             .Case(ReturnsZero, ErrnoMustNotBeChecked, GenericSuccessMsg)
2390             .Case(ReturnsMinusOne, ErrnoNEZeroIrrelevant, GenericFailureMsg)
2391             .ArgConstraint(
2392                 ArgumentCondition(0, WithinRange, Range(0, IntMax))));
2393 
2394     std::optional<QualType> Off_tTy = lookupTy("off_t");
2395 
2396     // int truncate(const char *path, off_t length);
2397     addToFunctionSummaryMap(
2398         "truncate",
2399         Signature(ArgTypes{ConstCharPtrTy, Off_tTy}, RetType{IntTy}),
2400         Summary(NoEvalCall)
2401             .Case(ReturnsZero, ErrnoMustNotBeChecked, GenericSuccessMsg)
2402             .Case(ReturnsMinusOne, ErrnoNEZeroIrrelevant, GenericFailureMsg)
2403             .ArgConstraint(NotNull(ArgNo(0))));
2404 
2405     // int symlink(const char *oldpath, const char *newpath);
2406     addToFunctionSummaryMap(
2407         "symlink",
2408         Signature(ArgTypes{ConstCharPtrTy, ConstCharPtrTy}, RetType{IntTy}),
2409         Summary(NoEvalCall)
2410             .Case(ReturnsZero, ErrnoMustNotBeChecked, GenericSuccessMsg)
2411             .Case(ReturnsMinusOne, ErrnoNEZeroIrrelevant, GenericFailureMsg)
2412             .ArgConstraint(NotNull(ArgNo(0)))
2413             .ArgConstraint(NotNull(ArgNo(1))));
2414 
2415     // int symlinkat(const char *oldpath, int newdirfd, const char *newpath);
2416     addToFunctionSummaryMap(
2417         "symlinkat",
2418         Signature(ArgTypes{ConstCharPtrTy, IntTy, ConstCharPtrTy},
2419                   RetType{IntTy}),
2420         Summary(NoEvalCall)
2421             .Case(ReturnsZero, ErrnoMustNotBeChecked, GenericSuccessMsg)
2422             .Case(ReturnsMinusOne, ErrnoNEZeroIrrelevant, GenericFailureMsg)
2423             .ArgConstraint(NotNull(ArgNo(0)))
2424             .ArgConstraint(ValidFileDescriptorOrAtFdcwd(ArgNo(1)))
2425             .ArgConstraint(NotNull(ArgNo(2))));
2426 
2427     // int lockf(int fd, int cmd, off_t len);
2428     addToFunctionSummaryMap(
2429         "lockf", Signature(ArgTypes{IntTy, IntTy, Off_tTy}, RetType{IntTy}),
2430         Summary(NoEvalCall)
2431             .Case(ReturnsZero, ErrnoMustNotBeChecked, GenericSuccessMsg)
2432             .Case(ReturnsMinusOne, ErrnoNEZeroIrrelevant, GenericFailureMsg)
2433             .ArgConstraint(
2434                 ArgumentCondition(0, WithinRange, Range(0, IntMax))));
2435 
2436     std::optional<QualType> Mode_tTy = lookupTy("mode_t");
2437 
2438     // int creat(const char *pathname, mode_t mode);
2439     addToFunctionSummaryMap(
2440         "creat", Signature(ArgTypes{ConstCharPtrTy, Mode_tTy}, RetType{IntTy}),
2441         Summary(NoEvalCall)
2442             .Case(ReturnsValidFileDescriptor, ErrnoMustNotBeChecked,
2443                   GenericSuccessMsg)
2444             .Case(ReturnsMinusOne, ErrnoNEZeroIrrelevant, GenericFailureMsg)
2445             .ArgConstraint(NotNull(ArgNo(0))));
2446 
2447     // unsigned int sleep(unsigned int seconds);
2448     addToFunctionSummaryMap(
2449         "sleep", Signature(ArgTypes{UnsignedIntTy}, RetType{UnsignedIntTy}),
2450         Summary(NoEvalCall)
2451             .ArgConstraint(
2452                 ArgumentCondition(0, WithinRange, Range(0, UnsignedIntMax))));
2453 
2454     std::optional<QualType> DirTy = lookupTy("DIR");
2455     std::optional<QualType> DirPtrTy = getPointerTy(DirTy);
2456 
2457     // int dirfd(DIR *dirp);
2458     addToFunctionSummaryMap(
2459         "dirfd", Signature(ArgTypes{DirPtrTy}, RetType{IntTy}),
2460         Summary(NoEvalCall)
2461             .Case(ReturnsValidFileDescriptor, ErrnoMustNotBeChecked,
2462                   GenericSuccessMsg)
2463             .Case(ReturnsMinusOne, ErrnoNEZeroIrrelevant, GenericFailureMsg)
2464             .ArgConstraint(NotNull(ArgNo(0))));
2465 
2466     // unsigned int alarm(unsigned int seconds);
2467     addToFunctionSummaryMap(
2468         "alarm", Signature(ArgTypes{UnsignedIntTy}, RetType{UnsignedIntTy}),
2469         Summary(NoEvalCall)
2470             .ArgConstraint(
2471                 ArgumentCondition(0, WithinRange, Range(0, UnsignedIntMax))));
2472 
2473     // int closedir(DIR *dir);
2474     addToFunctionSummaryMap(
2475         "closedir", Signature(ArgTypes{DirPtrTy}, RetType{IntTy}),
2476         Summary(NoEvalCall)
2477             .Case(ReturnsZero, ErrnoMustNotBeChecked, GenericSuccessMsg)
2478             .Case(ReturnsMinusOne, ErrnoNEZeroIrrelevant, GenericFailureMsg)
2479             .ArgConstraint(NotNull(ArgNo(0))));
2480 
2481     // char *strdup(const char *s);
2482     addToFunctionSummaryMap(
2483         "strdup", Signature(ArgTypes{ConstCharPtrTy}, RetType{CharPtrTy}),
2484         Summary(NoEvalCall).ArgConstraint(NotNull(ArgNo(0))));
2485 
2486     // char *strndup(const char *s, size_t n);
2487     addToFunctionSummaryMap(
2488         "strndup",
2489         Signature(ArgTypes{ConstCharPtrTy, SizeTy}, RetType{CharPtrTy}),
2490         Summary(NoEvalCall)
2491             .ArgConstraint(NotNull(ArgNo(0)))
2492             .ArgConstraint(
2493                 ArgumentCondition(1, WithinRange, Range(0, SizeMax))));
2494 
2495     // wchar_t *wcsdup(const wchar_t *s);
2496     addToFunctionSummaryMap(
2497         "wcsdup", Signature(ArgTypes{ConstWchar_tPtrTy}, RetType{Wchar_tPtrTy}),
2498         Summary(NoEvalCall).ArgConstraint(NotNull(ArgNo(0))));
2499 
2500     // int mkstemp(char *template);
2501     addToFunctionSummaryMap(
2502         "mkstemp", Signature(ArgTypes{CharPtrTy}, RetType{IntTy}),
2503         Summary(NoEvalCall)
2504             .Case(ReturnsValidFileDescriptor, ErrnoMustNotBeChecked,
2505                   GenericSuccessMsg)
2506             .Case(ReturnsMinusOne, ErrnoNEZeroIrrelevant, GenericFailureMsg)
2507             .ArgConstraint(NotNull(ArgNo(0))));
2508 
2509     // char *mkdtemp(char *template);
2510     // FIXME: Improve for errno modeling.
2511     addToFunctionSummaryMap(
2512         "mkdtemp", Signature(ArgTypes{CharPtrTy}, RetType{CharPtrTy}),
2513         Summary(NoEvalCall).ArgConstraint(NotNull(ArgNo(0))));
2514 
2515     // char *getcwd(char *buf, size_t size);
2516     // FIXME: Improve for errno modeling.
2517     addToFunctionSummaryMap(
2518         "getcwd", Signature(ArgTypes{CharPtrTy, SizeTy}, RetType{CharPtrTy}),
2519         Summary(NoEvalCall)
2520             .ArgConstraint(
2521                 ArgumentCondition(1, WithinRange, Range(0, SizeMax))));
2522 
2523     // int mkdir(const char *pathname, mode_t mode);
2524     addToFunctionSummaryMap(
2525         "mkdir", Signature(ArgTypes{ConstCharPtrTy, Mode_tTy}, RetType{IntTy}),
2526         Summary(NoEvalCall)
2527             .Case(ReturnsZero, ErrnoMustNotBeChecked, GenericSuccessMsg)
2528             .Case(ReturnsMinusOne, ErrnoNEZeroIrrelevant, GenericFailureMsg)
2529             .ArgConstraint(NotNull(ArgNo(0))));
2530 
2531     // int mkdirat(int dirfd, const char *pathname, mode_t mode);
2532     addToFunctionSummaryMap(
2533         "mkdirat",
2534         Signature(ArgTypes{IntTy, ConstCharPtrTy, Mode_tTy}, RetType{IntTy}),
2535         Summary(NoEvalCall)
2536             .Case(ReturnsZero, ErrnoMustNotBeChecked, GenericSuccessMsg)
2537             .Case(ReturnsMinusOne, ErrnoNEZeroIrrelevant, GenericFailureMsg)
2538             .ArgConstraint(ValidFileDescriptorOrAtFdcwd(ArgNo(0)))
2539             .ArgConstraint(NotNull(ArgNo(1))));
2540 
2541     std::optional<QualType> Dev_tTy = lookupTy("dev_t");
2542 
2543     // int mknod(const char *pathname, mode_t mode, dev_t dev);
2544     addToFunctionSummaryMap(
2545         "mknod",
2546         Signature(ArgTypes{ConstCharPtrTy, Mode_tTy, Dev_tTy}, RetType{IntTy}),
2547         Summary(NoEvalCall)
2548             .Case(ReturnsZero, ErrnoMustNotBeChecked, GenericSuccessMsg)
2549             .Case(ReturnsMinusOne, ErrnoNEZeroIrrelevant, GenericFailureMsg)
2550             .ArgConstraint(NotNull(ArgNo(0))));
2551 
2552     // int mknodat(int dirfd, const char *pathname, mode_t mode, dev_t dev);
2553     addToFunctionSummaryMap(
2554         "mknodat",
2555         Signature(ArgTypes{IntTy, ConstCharPtrTy, Mode_tTy, Dev_tTy},
2556                   RetType{IntTy}),
2557         Summary(NoEvalCall)
2558             .Case(ReturnsZero, ErrnoMustNotBeChecked, GenericSuccessMsg)
2559             .Case(ReturnsMinusOne, ErrnoNEZeroIrrelevant, GenericFailureMsg)
2560             .ArgConstraint(ValidFileDescriptorOrAtFdcwd(ArgNo(0)))
2561             .ArgConstraint(NotNull(ArgNo(1))));
2562 
2563     // int chmod(const char *path, mode_t mode);
2564     addToFunctionSummaryMap(
2565         "chmod", Signature(ArgTypes{ConstCharPtrTy, Mode_tTy}, RetType{IntTy}),
2566         Summary(NoEvalCall)
2567             .Case(ReturnsZero, ErrnoMustNotBeChecked, GenericSuccessMsg)
2568             .Case(ReturnsMinusOne, ErrnoNEZeroIrrelevant, GenericFailureMsg)
2569             .ArgConstraint(NotNull(ArgNo(0))));
2570 
2571     // int fchmodat(int dirfd, const char *pathname, mode_t mode, int flags);
2572     addToFunctionSummaryMap(
2573         "fchmodat",
2574         Signature(ArgTypes{IntTy, ConstCharPtrTy, Mode_tTy, IntTy},
2575                   RetType{IntTy}),
2576         Summary(NoEvalCall)
2577             .Case(ReturnsZero, ErrnoMustNotBeChecked, GenericSuccessMsg)
2578             .Case(ReturnsMinusOne, ErrnoNEZeroIrrelevant, GenericFailureMsg)
2579             .ArgConstraint(ValidFileDescriptorOrAtFdcwd(ArgNo(0)))
2580             .ArgConstraint(NotNull(ArgNo(1))));
2581 
2582     // int fchmod(int fildes, mode_t mode);
2583     addToFunctionSummaryMap(
2584         "fchmod", Signature(ArgTypes{IntTy, Mode_tTy}, RetType{IntTy}),
2585         Summary(NoEvalCall)
2586             .Case(ReturnsZero, ErrnoMustNotBeChecked, GenericSuccessMsg)
2587             .Case(ReturnsMinusOne, ErrnoNEZeroIrrelevant, GenericFailureMsg)
2588             .ArgConstraint(
2589                 ArgumentCondition(0, WithinRange, Range(0, IntMax))));
2590 
2591     std::optional<QualType> Uid_tTy = lookupTy("uid_t");
2592     std::optional<QualType> Gid_tTy = lookupTy("gid_t");
2593 
2594     // int fchownat(int dirfd, const char *pathname, uid_t owner, gid_t group,
2595     //              int flags);
2596     addToFunctionSummaryMap(
2597         "fchownat",
2598         Signature(ArgTypes{IntTy, ConstCharPtrTy, Uid_tTy, Gid_tTy, IntTy},
2599                   RetType{IntTy}),
2600         Summary(NoEvalCall)
2601             .Case(ReturnsZero, ErrnoMustNotBeChecked, GenericSuccessMsg)
2602             .Case(ReturnsMinusOne, ErrnoNEZeroIrrelevant, GenericFailureMsg)
2603             .ArgConstraint(ValidFileDescriptorOrAtFdcwd(ArgNo(0)))
2604             .ArgConstraint(NotNull(ArgNo(1))));
2605 
2606     // int chown(const char *path, uid_t owner, gid_t group);
2607     addToFunctionSummaryMap(
2608         "chown",
2609         Signature(ArgTypes{ConstCharPtrTy, Uid_tTy, Gid_tTy}, RetType{IntTy}),
2610         Summary(NoEvalCall)
2611             .Case(ReturnsZero, ErrnoMustNotBeChecked, GenericSuccessMsg)
2612             .Case(ReturnsMinusOne, ErrnoNEZeroIrrelevant, GenericFailureMsg)
2613             .ArgConstraint(NotNull(ArgNo(0))));
2614 
2615     // int lchown(const char *path, uid_t owner, gid_t group);
2616     addToFunctionSummaryMap(
2617         "lchown",
2618         Signature(ArgTypes{ConstCharPtrTy, Uid_tTy, Gid_tTy}, RetType{IntTy}),
2619         Summary(NoEvalCall)
2620             .Case(ReturnsZero, ErrnoMustNotBeChecked, GenericSuccessMsg)
2621             .Case(ReturnsMinusOne, ErrnoNEZeroIrrelevant, GenericFailureMsg)
2622             .ArgConstraint(NotNull(ArgNo(0))));
2623 
2624     // int fchown(int fildes, uid_t owner, gid_t group);
2625     addToFunctionSummaryMap(
2626         "fchown", Signature(ArgTypes{IntTy, Uid_tTy, Gid_tTy}, RetType{IntTy}),
2627         Summary(NoEvalCall)
2628             .Case(ReturnsZero, ErrnoMustNotBeChecked, GenericSuccessMsg)
2629             .Case(ReturnsMinusOne, ErrnoNEZeroIrrelevant, GenericFailureMsg)
2630             .ArgConstraint(
2631                 ArgumentCondition(0, WithinRange, Range(0, IntMax))));
2632 
2633     // int rmdir(const char *pathname);
2634     addToFunctionSummaryMap(
2635         "rmdir", Signature(ArgTypes{ConstCharPtrTy}, RetType{IntTy}),
2636         Summary(NoEvalCall)
2637             .Case(ReturnsZero, ErrnoMustNotBeChecked, GenericSuccessMsg)
2638             .Case(ReturnsMinusOne, ErrnoNEZeroIrrelevant, GenericFailureMsg)
2639             .ArgConstraint(NotNull(ArgNo(0))));
2640 
2641     // int chdir(const char *path);
2642     addToFunctionSummaryMap(
2643         "chdir", Signature(ArgTypes{ConstCharPtrTy}, RetType{IntTy}),
2644         Summary(NoEvalCall)
2645             .Case(ReturnsZero, ErrnoMustNotBeChecked, GenericSuccessMsg)
2646             .Case(ReturnsMinusOne, ErrnoNEZeroIrrelevant, GenericFailureMsg)
2647             .ArgConstraint(NotNull(ArgNo(0))));
2648 
2649     // int link(const char *oldpath, const char *newpath);
2650     addToFunctionSummaryMap(
2651         "link",
2652         Signature(ArgTypes{ConstCharPtrTy, ConstCharPtrTy}, RetType{IntTy}),
2653         Summary(NoEvalCall)
2654             .Case(ReturnsZero, ErrnoMustNotBeChecked, GenericSuccessMsg)
2655             .Case(ReturnsMinusOne, ErrnoNEZeroIrrelevant, GenericFailureMsg)
2656             .ArgConstraint(NotNull(ArgNo(0)))
2657             .ArgConstraint(NotNull(ArgNo(1))));
2658 
2659     // int linkat(int fd1, const char *path1, int fd2, const char *path2,
2660     //            int flag);
2661     addToFunctionSummaryMap(
2662         "linkat",
2663         Signature(ArgTypes{IntTy, ConstCharPtrTy, IntTy, ConstCharPtrTy, IntTy},
2664                   RetType{IntTy}),
2665         Summary(NoEvalCall)
2666             .Case(ReturnsZero, ErrnoMustNotBeChecked, GenericSuccessMsg)
2667             .Case(ReturnsMinusOne, ErrnoNEZeroIrrelevant, GenericFailureMsg)
2668             .ArgConstraint(ValidFileDescriptorOrAtFdcwd(ArgNo(0)))
2669             .ArgConstraint(NotNull(ArgNo(1)))
2670             .ArgConstraint(ValidFileDescriptorOrAtFdcwd(ArgNo(2)))
2671             .ArgConstraint(NotNull(ArgNo(3))));
2672 
2673     // int unlink(const char *pathname);
2674     addToFunctionSummaryMap(
2675         "unlink", Signature(ArgTypes{ConstCharPtrTy}, RetType{IntTy}),
2676         Summary(NoEvalCall)
2677             .Case(ReturnsZero, ErrnoMustNotBeChecked, GenericSuccessMsg)
2678             .Case(ReturnsMinusOne, ErrnoNEZeroIrrelevant, GenericFailureMsg)
2679             .ArgConstraint(NotNull(ArgNo(0))));
2680 
2681     // int unlinkat(int fd, const char *path, int flag);
2682     addToFunctionSummaryMap(
2683         "unlinkat",
2684         Signature(ArgTypes{IntTy, ConstCharPtrTy, IntTy}, RetType{IntTy}),
2685         Summary(NoEvalCall)
2686             .Case(ReturnsZero, ErrnoMustNotBeChecked, GenericSuccessMsg)
2687             .Case(ReturnsMinusOne, ErrnoNEZeroIrrelevant, GenericFailureMsg)
2688             .ArgConstraint(ValidFileDescriptorOrAtFdcwd(ArgNo(0)))
2689             .ArgConstraint(NotNull(ArgNo(1))));
2690 
2691     std::optional<QualType> StructStatTy = lookupTy("stat");
2692     std::optional<QualType> StructStatPtrTy = getPointerTy(StructStatTy);
2693     std::optional<QualType> StructStatPtrRestrictTy =
2694         getRestrictTy(StructStatPtrTy);
2695 
2696     // int fstat(int fd, struct stat *statbuf);
2697     addToFunctionSummaryMap(
2698         "fstat", Signature(ArgTypes{IntTy, StructStatPtrTy}, RetType{IntTy}),
2699         Summary(NoEvalCall)
2700             .Case(ReturnsZero, ErrnoMustNotBeChecked, GenericSuccessMsg)
2701             .Case(ReturnsMinusOne, ErrnoNEZeroIrrelevant, GenericFailureMsg)
2702             .ArgConstraint(ArgumentCondition(0, WithinRange, Range(0, IntMax)))
2703             .ArgConstraint(NotNull(ArgNo(1))));
2704 
2705     // int stat(const char *restrict path, struct stat *restrict buf);
2706     addToFunctionSummaryMap(
2707         "stat",
2708         Signature(ArgTypes{ConstCharPtrRestrictTy, StructStatPtrRestrictTy},
2709                   RetType{IntTy}),
2710         Summary(NoEvalCall)
2711             .Case(ReturnsZero, ErrnoMustNotBeChecked, GenericSuccessMsg)
2712             .Case(ReturnsMinusOne, ErrnoNEZeroIrrelevant, GenericFailureMsg)
2713             .ArgConstraint(NotNull(ArgNo(0)))
2714             .ArgConstraint(NotNull(ArgNo(1))));
2715 
2716     // int lstat(const char *restrict path, struct stat *restrict buf);
2717     addToFunctionSummaryMap(
2718         "lstat",
2719         Signature(ArgTypes{ConstCharPtrRestrictTy, StructStatPtrRestrictTy},
2720                   RetType{IntTy}),
2721         Summary(NoEvalCall)
2722             .Case(ReturnsZero, ErrnoMustNotBeChecked, GenericSuccessMsg)
2723             .Case(ReturnsMinusOne, ErrnoNEZeroIrrelevant, GenericFailureMsg)
2724             .ArgConstraint(NotNull(ArgNo(0)))
2725             .ArgConstraint(NotNull(ArgNo(1))));
2726 
2727     // int fstatat(int fd, const char *restrict path,
2728     //             struct stat *restrict buf, int flag);
2729     addToFunctionSummaryMap(
2730         "fstatat",
2731         Signature(ArgTypes{IntTy, ConstCharPtrRestrictTy,
2732                            StructStatPtrRestrictTy, IntTy},
2733                   RetType{IntTy}),
2734         Summary(NoEvalCall)
2735             .Case(ReturnsZero, ErrnoMustNotBeChecked, GenericSuccessMsg)
2736             .Case(ReturnsMinusOne, ErrnoNEZeroIrrelevant, GenericFailureMsg)
2737             .ArgConstraint(ValidFileDescriptorOrAtFdcwd(ArgNo(0)))
2738             .ArgConstraint(NotNull(ArgNo(1)))
2739             .ArgConstraint(NotNull(ArgNo(2))));
2740 
2741     // DIR *opendir(const char *name);
2742     // FIXME: Improve for errno modeling.
2743     addToFunctionSummaryMap(
2744         "opendir", Signature(ArgTypes{ConstCharPtrTy}, RetType{DirPtrTy}),
2745         Summary(NoEvalCall).ArgConstraint(NotNull(ArgNo(0))));
2746 
2747     // DIR *fdopendir(int fd);
2748     // FIXME: Improve for errno modeling.
2749     addToFunctionSummaryMap("fdopendir",
2750                             Signature(ArgTypes{IntTy}, RetType{DirPtrTy}),
2751                             Summary(NoEvalCall)
2752                                 .ArgConstraint(ArgumentCondition(
2753                                     0, WithinRange, Range(0, IntMax))));
2754 
2755     // int isatty(int fildes);
2756     addToFunctionSummaryMap(
2757         "isatty", Signature(ArgTypes{IntTy}, RetType{IntTy}),
2758         Summary(NoEvalCall)
2759             .Case({ReturnValueCondition(WithinRange, Range(0, 1))},
2760                   ErrnoIrrelevant)
2761             .ArgConstraint(
2762                 ArgumentCondition(0, WithinRange, Range(0, IntMax))));
2763 
2764     // FILE *popen(const char *command, const char *type);
2765     // FIXME: Improve for errno modeling.
2766     addToFunctionSummaryMap(
2767         "popen",
2768         Signature(ArgTypes{ConstCharPtrTy, ConstCharPtrTy}, RetType{FilePtrTy}),
2769         Summary(NoEvalCall)
2770             .ArgConstraint(NotNull(ArgNo(0)))
2771             .ArgConstraint(NotNull(ArgNo(1))));
2772 
2773     // int pclose(FILE *stream);
2774     // FIXME: Improve for errno modeling.
2775     addToFunctionSummaryMap(
2776         "pclose", Signature(ArgTypes{FilePtrTy}, RetType{IntTy}),
2777         Summary(NoEvalCall).ArgConstraint(NotNull(ArgNo(0))));
2778 
2779     // int close(int fildes);
2780     addToFunctionSummaryMap(
2781         "close", Signature(ArgTypes{IntTy}, RetType{IntTy}),
2782         Summary(NoEvalCall)
2783             .Case(ReturnsZero, ErrnoMustNotBeChecked, GenericSuccessMsg)
2784             .Case(ReturnsMinusOne, ErrnoNEZeroIrrelevant, GenericFailureMsg)
2785             .ArgConstraint(
2786                 ArgumentCondition(0, WithinRange, Range(-1, IntMax))));
2787 
2788     // long fpathconf(int fildes, int name);
2789     addToFunctionSummaryMap("fpathconf",
2790                             Signature(ArgTypes{IntTy, IntTy}, RetType{LongTy}),
2791                             Summary(NoEvalCall)
2792                                 .ArgConstraint(ArgumentCondition(
2793                                     0, WithinRange, Range(0, IntMax))));
2794 
2795     // long pathconf(const char *path, int name);
2796     addToFunctionSummaryMap(
2797         "pathconf", Signature(ArgTypes{ConstCharPtrTy, IntTy}, RetType{LongTy}),
2798         Summary(NoEvalCall).ArgConstraint(NotNull(ArgNo(0))));
2799 
2800     // FILE *fdopen(int fd, const char *mode);
2801     // FIXME: Improve for errno modeling.
2802     addToFunctionSummaryMap(
2803         "fdopen",
2804         Signature(ArgTypes{IntTy, ConstCharPtrTy}, RetType{FilePtrTy}),
2805         Summary(NoEvalCall)
2806             .ArgConstraint(ArgumentCondition(0, WithinRange, Range(0, IntMax)))
2807             .ArgConstraint(NotNull(ArgNo(1))));
2808 
2809     // void rewinddir(DIR *dir);
2810     addToFunctionSummaryMap(
2811         "rewinddir", Signature(ArgTypes{DirPtrTy}, RetType{VoidTy}),
2812         Summary(NoEvalCall).ArgConstraint(NotNull(ArgNo(0))));
2813 
2814     // void seekdir(DIR *dirp, long loc);
2815     addToFunctionSummaryMap(
2816         "seekdir", Signature(ArgTypes{DirPtrTy, LongTy}, RetType{VoidTy}),
2817         Summary(NoEvalCall).ArgConstraint(NotNull(ArgNo(0))));
2818 
2819     // int rand_r(unsigned int *seedp);
2820     addToFunctionSummaryMap(
2821         "rand_r", Signature(ArgTypes{UnsignedIntPtrTy}, RetType{IntTy}),
2822         Summary(NoEvalCall).ArgConstraint(NotNull(ArgNo(0))));
2823 
2824     // int fseeko(FILE *stream, off_t offset, int whence);
2825     addToFunctionSummaryMap(
2826         "fseeko",
2827         Signature(ArgTypes{FilePtrTy, Off_tTy, IntTy}, RetType{IntTy}),
2828         Summary(NoEvalCall)
2829             .Case(ReturnsZeroOrMinusOne, ErrnoIrrelevant)
2830             .ArgConstraint(NotNull(ArgNo(0))));
2831 
2832     // off_t ftello(FILE *stream);
2833     addToFunctionSummaryMap(
2834         "ftello", Signature(ArgTypes{FilePtrTy}, RetType{Off_tTy}),
2835         Summary(NoEvalCall).ArgConstraint(NotNull(ArgNo(0))));
2836 
2837     // void *mmap(void *addr, size_t length, int prot, int flags, int fd,
2838     // off_t offset);
2839     // FIXME: Improve for errno modeling.
2840     addToFunctionSummaryMap(
2841         "mmap",
2842         Signature(ArgTypes{VoidPtrTy, SizeTy, IntTy, IntTy, IntTy, Off_tTy},
2843                   RetType{VoidPtrTy}),
2844         Summary(NoEvalCall)
2845             .ArgConstraint(ArgumentCondition(1, WithinRange, Range(1, SizeMax)))
2846             .ArgConstraint(
2847                 ArgumentCondition(4, WithinRange, Range(-1, IntMax))));
2848 
2849     std::optional<QualType> Off64_tTy = lookupTy("off64_t");
2850     // void *mmap64(void *addr, size_t length, int prot, int flags, int fd,
2851     // off64_t offset);
2852     // FIXME: Improve for errno modeling.
2853     addToFunctionSummaryMap(
2854         "mmap64",
2855         Signature(ArgTypes{VoidPtrTy, SizeTy, IntTy, IntTy, IntTy, Off64_tTy},
2856                   RetType{VoidPtrTy}),
2857         Summary(NoEvalCall)
2858             .ArgConstraint(ArgumentCondition(1, WithinRange, Range(1, SizeMax)))
2859             .ArgConstraint(
2860                 ArgumentCondition(4, WithinRange, Range(-1, IntMax))));
2861 
2862     // int pipe(int fildes[2]);
2863     addToFunctionSummaryMap(
2864         "pipe", Signature(ArgTypes{IntPtrTy}, RetType{IntTy}),
2865         Summary(NoEvalCall)
2866             .Case(ReturnsZero, ErrnoMustNotBeChecked, GenericSuccessMsg)
2867             .Case(ReturnsMinusOne, ErrnoNEZeroIrrelevant, GenericFailureMsg)
2868             .ArgConstraint(NotNull(ArgNo(0))));
2869 
2870     // off_t lseek(int fildes, off_t offset, int whence);
2871     // In the first case we can not tell for sure if it failed or not.
2872     // A return value different from of the expected offset (that is unknown
2873     // here) may indicate failure. For this reason we do not enforce the errno
2874     // check (can cause false positive).
2875     addToFunctionSummaryMap(
2876         "lseek", Signature(ArgTypes{IntTy, Off_tTy, IntTy}, RetType{Off_tTy}),
2877         Summary(NoEvalCall)
2878             .Case(ReturnsNonnegative, ErrnoIrrelevant)
2879             .Case(ReturnsMinusOne, ErrnoNEZeroIrrelevant, GenericFailureMsg)
2880             .ArgConstraint(
2881                 ArgumentCondition(0, WithinRange, Range(0, IntMax))));
2882 
2883     // ssize_t readlink(const char *restrict path, char *restrict buf,
2884     //                  size_t bufsize);
2885     addToFunctionSummaryMap(
2886         "readlink",
2887         Signature(ArgTypes{ConstCharPtrRestrictTy, CharPtrRestrictTy, SizeTy},
2888                   RetType{Ssize_tTy}),
2889         Summary(NoEvalCall)
2890             .Case({ArgumentCondition(2, WithinRange, Range(1, IntMax)),
2891                    ReturnValueCondition(LessThanOrEq, ArgNo(2)),
2892                    ReturnValueCondition(WithinRange, Range(1, Ssize_tMax))},
2893                   ErrnoMustNotBeChecked, GenericSuccessMsg)
2894             .Case({ArgumentCondition(2, WithinRange, SingleValue(0)),
2895                    ReturnValueCondition(WithinRange, SingleValue(0))},
2896                   ErrnoMustNotBeChecked,
2897                   "Assuming that argument 'bufsize' is 0")
2898             .Case(ReturnsMinusOne, ErrnoNEZeroIrrelevant, GenericFailureMsg)
2899             .ArgConstraint(NotNull(ArgNo(0)))
2900             .ArgConstraint(NotNull(ArgNo(1)))
2901             .ArgConstraint(BufferSize(/*Buffer=*/ArgNo(1),
2902                                       /*BufSize=*/ArgNo(2)))
2903             .ArgConstraint(
2904                 ArgumentCondition(2, WithinRange, Range(0, SizeMax))));
2905 
2906     // ssize_t readlinkat(int fd, const char *restrict path,
2907     //                    char *restrict buf, size_t bufsize);
2908     addToFunctionSummaryMap(
2909         "readlinkat",
2910         Signature(
2911             ArgTypes{IntTy, ConstCharPtrRestrictTy, CharPtrRestrictTy, SizeTy},
2912             RetType{Ssize_tTy}),
2913         Summary(NoEvalCall)
2914             .Case({ArgumentCondition(3, WithinRange, Range(1, IntMax)),
2915                    ReturnValueCondition(LessThanOrEq, ArgNo(3)),
2916                    ReturnValueCondition(WithinRange, Range(1, Ssize_tMax))},
2917                   ErrnoMustNotBeChecked, GenericSuccessMsg)
2918             .Case({ArgumentCondition(3, WithinRange, SingleValue(0)),
2919                    ReturnValueCondition(WithinRange, SingleValue(0))},
2920                   ErrnoMustNotBeChecked,
2921                   "Assuming that argument 'bufsize' is 0")
2922             .Case(ReturnsMinusOne, ErrnoNEZeroIrrelevant, GenericFailureMsg)
2923             .ArgConstraint(ValidFileDescriptorOrAtFdcwd(ArgNo(0)))
2924             .ArgConstraint(NotNull(ArgNo(1)))
2925             .ArgConstraint(NotNull(ArgNo(2)))
2926             .ArgConstraint(BufferSize(/*Buffer=*/ArgNo(2),
2927                                       /*BufSize=*/ArgNo(3)))
2928             .ArgConstraint(
2929                 ArgumentCondition(3, WithinRange, Range(0, SizeMax))));
2930 
2931     // int renameat(int olddirfd, const char *oldpath, int newdirfd, const char
2932     // *newpath);
2933     addToFunctionSummaryMap(
2934         "renameat",
2935         Signature(ArgTypes{IntTy, ConstCharPtrTy, IntTy, ConstCharPtrTy},
2936                   RetType{IntTy}),
2937         Summary(NoEvalCall)
2938             .Case(ReturnsZero, ErrnoMustNotBeChecked, GenericSuccessMsg)
2939             .Case(ReturnsMinusOne, ErrnoNEZeroIrrelevant, GenericFailureMsg)
2940             .ArgConstraint(ValidFileDescriptorOrAtFdcwd(ArgNo(0)))
2941             .ArgConstraint(NotNull(ArgNo(1)))
2942             .ArgConstraint(ValidFileDescriptorOrAtFdcwd(ArgNo(2)))
2943             .ArgConstraint(NotNull(ArgNo(3))));
2944 
2945     // char *realpath(const char *restrict file_name,
2946     //                char *restrict resolved_name);
2947     // FIXME: Improve for errno modeling.
2948     addToFunctionSummaryMap(
2949         "realpath",
2950         Signature(ArgTypes{ConstCharPtrRestrictTy, CharPtrRestrictTy},
2951                   RetType{CharPtrTy}),
2952         Summary(NoEvalCall).ArgConstraint(NotNull(ArgNo(0))));
2953 
2954     QualType CharPtrConstPtr = getPointerTy(getConstTy(CharPtrTy));
2955 
2956     // int execv(const char *path, char *const argv[]);
2957     addToFunctionSummaryMap(
2958         "execv",
2959         Signature(ArgTypes{ConstCharPtrTy, CharPtrConstPtr}, RetType{IntTy}),
2960         Summary(NoEvalCall)
2961             .Case({ReturnValueCondition(WithinRange, SingleValue(-1))},
2962                   ErrnoIrrelevant)
2963             .ArgConstraint(NotNull(ArgNo(0))));
2964 
2965     // int execvp(const char *file, char *const argv[]);
2966     addToFunctionSummaryMap(
2967         "execvp",
2968         Signature(ArgTypes{ConstCharPtrTy, CharPtrConstPtr}, RetType{IntTy}),
2969         Summary(NoEvalCall)
2970             .Case({ReturnValueCondition(WithinRange, SingleValue(-1))},
2971                   ErrnoIrrelevant)
2972             .ArgConstraint(NotNull(ArgNo(0))));
2973 
2974     // int getopt(int argc, char * const argv[], const char *optstring);
2975     addToFunctionSummaryMap(
2976         "getopt",
2977         Signature(ArgTypes{IntTy, CharPtrConstPtr, ConstCharPtrTy},
2978                   RetType{IntTy}),
2979         Summary(NoEvalCall)
2980             .Case({ReturnValueCondition(WithinRange, Range(-1, UCharRangeMax))},
2981                   ErrnoIrrelevant)
2982             .ArgConstraint(ArgumentCondition(0, WithinRange, Range(0, IntMax)))
2983             .ArgConstraint(NotNull(ArgNo(1)))
2984             .ArgConstraint(NotNull(ArgNo(2))));
2985 
2986     std::optional<QualType> StructSockaddrTy = lookupTy("sockaddr");
2987     std::optional<QualType> StructSockaddrPtrTy =
2988         getPointerTy(StructSockaddrTy);
2989     std::optional<QualType> ConstStructSockaddrPtrTy =
2990         getPointerTy(getConstTy(StructSockaddrTy));
2991     std::optional<QualType> StructSockaddrPtrRestrictTy =
2992         getRestrictTy(StructSockaddrPtrTy);
2993     std::optional<QualType> ConstStructSockaddrPtrRestrictTy =
2994         getRestrictTy(ConstStructSockaddrPtrTy);
2995     std::optional<QualType> Socklen_tTy = lookupTy("socklen_t");
2996     std::optional<QualType> Socklen_tPtrTy = getPointerTy(Socklen_tTy);
2997     std::optional<QualType> Socklen_tPtrRestrictTy =
2998         getRestrictTy(Socklen_tPtrTy);
2999     std::optional<RangeInt> Socklen_tMax = getMaxValue(Socklen_tTy);
3000 
3001     // In 'socket.h' of some libc implementations with C99, sockaddr parameter
3002     // is a transparent union of the underlying sockaddr_ family of pointers
3003     // instead of being a pointer to struct sockaddr. In these cases, the
3004     // standardized signature will not match, thus we try to match with another
3005     // signature that has the joker Irrelevant type. We also remove those
3006     // constraints which require pointer types for the sockaddr param.
3007 
3008     // int socket(int domain, int type, int protocol);
3009     addToFunctionSummaryMap(
3010         "socket", Signature(ArgTypes{IntTy, IntTy, IntTy}, RetType{IntTy}),
3011         Summary(NoEvalCall)
3012             .Case(ReturnsValidFileDescriptor, ErrnoMustNotBeChecked,
3013                   GenericSuccessMsg)
3014             .Case(ReturnsMinusOne, ErrnoNEZeroIrrelevant, GenericFailureMsg));
3015 
3016     auto Accept =
3017         Summary(NoEvalCall)
3018             .Case(ReturnsValidFileDescriptor, ErrnoMustNotBeChecked,
3019                   GenericSuccessMsg)
3020             .Case(ReturnsMinusOne, ErrnoNEZeroIrrelevant, GenericFailureMsg)
3021             .ArgConstraint(ArgumentCondition(0, WithinRange, Range(0, IntMax)));
3022     if (!addToFunctionSummaryMap(
3023             "accept",
3024             // int accept(int socket, struct sockaddr *restrict address,
3025             //            socklen_t *restrict address_len);
3026             Signature(ArgTypes{IntTy, StructSockaddrPtrRestrictTy,
3027                                Socklen_tPtrRestrictTy},
3028                       RetType{IntTy}),
3029             Accept))
3030       addToFunctionSummaryMap(
3031           "accept",
3032           Signature(ArgTypes{IntTy, Irrelevant, Socklen_tPtrRestrictTy},
3033                     RetType{IntTy}),
3034           Accept);
3035 
3036     // int bind(int socket, const struct sockaddr *address, socklen_t
3037     //          address_len);
3038     if (!addToFunctionSummaryMap(
3039             "bind",
3040             Signature(ArgTypes{IntTy, ConstStructSockaddrPtrTy, Socklen_tTy},
3041                       RetType{IntTy}),
3042             Summary(NoEvalCall)
3043                 .Case(ReturnsZero, ErrnoMustNotBeChecked, GenericSuccessMsg)
3044                 .Case(ReturnsMinusOne, ErrnoNEZeroIrrelevant, GenericFailureMsg)
3045                 .ArgConstraint(
3046                     ArgumentCondition(0, WithinRange, Range(0, IntMax)))
3047                 .ArgConstraint(NotNull(ArgNo(1)))
3048                 .ArgConstraint(
3049                     BufferSize(/*Buffer=*/ArgNo(1), /*BufSize=*/ArgNo(2)))
3050                 .ArgConstraint(
3051                     ArgumentCondition(2, WithinRange, Range(0, Socklen_tMax)))))
3052       // Do not add constraints on sockaddr.
3053       addToFunctionSummaryMap(
3054           "bind",
3055           Signature(ArgTypes{IntTy, Irrelevant, Socklen_tTy}, RetType{IntTy}),
3056           Summary(NoEvalCall)
3057               .Case(ReturnsZero, ErrnoMustNotBeChecked, GenericSuccessMsg)
3058               .Case(ReturnsMinusOne, ErrnoNEZeroIrrelevant, GenericFailureMsg)
3059               .ArgConstraint(
3060                   ArgumentCondition(0, WithinRange, Range(0, IntMax)))
3061               .ArgConstraint(
3062                   ArgumentCondition(2, WithinRange, Range(0, Socklen_tMax))));
3063 
3064     // int getpeername(int socket, struct sockaddr *restrict address,
3065     //                 socklen_t *restrict address_len);
3066     if (!addToFunctionSummaryMap(
3067             "getpeername",
3068             Signature(ArgTypes{IntTy, StructSockaddrPtrRestrictTy,
3069                                Socklen_tPtrRestrictTy},
3070                       RetType{IntTy}),
3071             Summary(NoEvalCall)
3072                 .Case(ReturnsZero, ErrnoMustNotBeChecked, GenericSuccessMsg)
3073                 .Case(ReturnsMinusOne, ErrnoNEZeroIrrelevant, GenericFailureMsg)
3074                 .ArgConstraint(
3075                     ArgumentCondition(0, WithinRange, Range(0, IntMax)))
3076                 .ArgConstraint(NotNull(ArgNo(1)))
3077                 .ArgConstraint(NotNull(ArgNo(2)))))
3078       addToFunctionSummaryMap(
3079           "getpeername",
3080           Signature(ArgTypes{IntTy, Irrelevant, Socklen_tPtrRestrictTy},
3081                     RetType{IntTy}),
3082           Summary(NoEvalCall)
3083               .Case(ReturnsZero, ErrnoMustNotBeChecked, GenericSuccessMsg)
3084               .Case(ReturnsMinusOne, ErrnoNEZeroIrrelevant, GenericFailureMsg)
3085               .ArgConstraint(
3086                   ArgumentCondition(0, WithinRange, Range(0, IntMax))));
3087 
3088     // int getsockname(int socket, struct sockaddr *restrict address,
3089     //                 socklen_t *restrict address_len);
3090     if (!addToFunctionSummaryMap(
3091             "getsockname",
3092             Signature(ArgTypes{IntTy, StructSockaddrPtrRestrictTy,
3093                                Socklen_tPtrRestrictTy},
3094                       RetType{IntTy}),
3095             Summary(NoEvalCall)
3096                 .Case(ReturnsZero, ErrnoMustNotBeChecked, GenericSuccessMsg)
3097                 .Case(ReturnsMinusOne, ErrnoNEZeroIrrelevant, GenericFailureMsg)
3098                 .ArgConstraint(
3099                     ArgumentCondition(0, WithinRange, Range(0, IntMax)))
3100                 .ArgConstraint(NotNull(ArgNo(1)))
3101                 .ArgConstraint(NotNull(ArgNo(2)))))
3102       addToFunctionSummaryMap(
3103           "getsockname",
3104           Signature(ArgTypes{IntTy, Irrelevant, Socklen_tPtrRestrictTy},
3105                     RetType{IntTy}),
3106           Summary(NoEvalCall)
3107               .Case(ReturnsZero, ErrnoMustNotBeChecked, GenericSuccessMsg)
3108               .Case(ReturnsMinusOne, ErrnoNEZeroIrrelevant, GenericFailureMsg)
3109               .ArgConstraint(
3110                   ArgumentCondition(0, WithinRange, Range(0, IntMax))));
3111 
3112     // int connect(int socket, const struct sockaddr *address, socklen_t
3113     //             address_len);
3114     if (!addToFunctionSummaryMap(
3115             "connect",
3116             Signature(ArgTypes{IntTy, ConstStructSockaddrPtrTy, Socklen_tTy},
3117                       RetType{IntTy}),
3118             Summary(NoEvalCall)
3119                 .Case(ReturnsZero, ErrnoMustNotBeChecked, GenericSuccessMsg)
3120                 .Case(ReturnsMinusOne, ErrnoNEZeroIrrelevant, GenericFailureMsg)
3121                 .ArgConstraint(
3122                     ArgumentCondition(0, WithinRange, Range(0, IntMax)))
3123                 .ArgConstraint(NotNull(ArgNo(1)))))
3124       addToFunctionSummaryMap(
3125           "connect",
3126           Signature(ArgTypes{IntTy, Irrelevant, Socklen_tTy}, RetType{IntTy}),
3127           Summary(NoEvalCall)
3128               .Case(ReturnsZero, ErrnoMustNotBeChecked, GenericSuccessMsg)
3129               .Case(ReturnsMinusOne, ErrnoNEZeroIrrelevant, GenericFailureMsg)
3130               .ArgConstraint(
3131                   ArgumentCondition(0, WithinRange, Range(0, IntMax))));
3132 
3133     auto Recvfrom =
3134         Summary(NoEvalCall)
3135             .Case({ReturnValueCondition(LessThanOrEq, ArgNo(2)),
3136                    ReturnValueCondition(WithinRange, Range(1, Ssize_tMax))},
3137                   ErrnoMustNotBeChecked, GenericSuccessMsg)
3138             .Case({ReturnValueCondition(WithinRange, SingleValue(0)),
3139                    ArgumentCondition(2, WithinRange, SingleValue(0))},
3140                   ErrnoMustNotBeChecked, GenericSuccessMsg)
3141             .Case(ReturnsMinusOne, ErrnoNEZeroIrrelevant, GenericFailureMsg)
3142             .ArgConstraint(ArgumentCondition(0, WithinRange, Range(0, IntMax)))
3143             .ArgConstraint(BufferSize(/*Buffer=*/ArgNo(1),
3144                                       /*BufSize=*/ArgNo(2)));
3145     if (!addToFunctionSummaryMap(
3146             "recvfrom",
3147             // ssize_t recvfrom(int socket, void *restrict buffer,
3148             //                  size_t length,
3149             //                  int flags, struct sockaddr *restrict address,
3150             //                  socklen_t *restrict address_len);
3151             Signature(ArgTypes{IntTy, VoidPtrRestrictTy, SizeTy, IntTy,
3152                                StructSockaddrPtrRestrictTy,
3153                                Socklen_tPtrRestrictTy},
3154                       RetType{Ssize_tTy}),
3155             Recvfrom))
3156       addToFunctionSummaryMap(
3157           "recvfrom",
3158           Signature(ArgTypes{IntTy, VoidPtrRestrictTy, SizeTy, IntTy,
3159                              Irrelevant, Socklen_tPtrRestrictTy},
3160                     RetType{Ssize_tTy}),
3161           Recvfrom);
3162 
3163     auto Sendto =
3164         Summary(NoEvalCall)
3165             .Case({ReturnValueCondition(LessThanOrEq, ArgNo(2)),
3166                    ReturnValueCondition(WithinRange, Range(1, Ssize_tMax))},
3167                   ErrnoMustNotBeChecked, GenericSuccessMsg)
3168             .Case({ReturnValueCondition(WithinRange, SingleValue(0)),
3169                    ArgumentCondition(2, WithinRange, SingleValue(0))},
3170                   ErrnoMustNotBeChecked, GenericSuccessMsg)
3171             .Case(ReturnsMinusOne, ErrnoNEZeroIrrelevant, GenericFailureMsg)
3172             .ArgConstraint(ArgumentCondition(0, WithinRange, Range(0, IntMax)))
3173             .ArgConstraint(BufferSize(/*Buffer=*/ArgNo(1),
3174                                       /*BufSize=*/ArgNo(2)));
3175     if (!addToFunctionSummaryMap(
3176             "sendto",
3177             // ssize_t sendto(int socket, const void *message, size_t length,
3178             //                int flags, const struct sockaddr *dest_addr,
3179             //                socklen_t dest_len);
3180             Signature(ArgTypes{IntTy, ConstVoidPtrTy, SizeTy, IntTy,
3181                                ConstStructSockaddrPtrTy, Socklen_tTy},
3182                       RetType{Ssize_tTy}),
3183             Sendto))
3184       addToFunctionSummaryMap(
3185           "sendto",
3186           Signature(ArgTypes{IntTy, ConstVoidPtrTy, SizeTy, IntTy, Irrelevant,
3187                              Socklen_tTy},
3188                     RetType{Ssize_tTy}),
3189           Sendto);
3190 
3191     // int listen(int sockfd, int backlog);
3192     addToFunctionSummaryMap(
3193         "listen", Signature(ArgTypes{IntTy, IntTy}, RetType{IntTy}),
3194         Summary(NoEvalCall)
3195             .Case(ReturnsZero, ErrnoMustNotBeChecked, GenericSuccessMsg)
3196             .Case(ReturnsMinusOne, ErrnoNEZeroIrrelevant, GenericFailureMsg)
3197             .ArgConstraint(
3198                 ArgumentCondition(0, WithinRange, Range(0, IntMax))));
3199 
3200     // ssize_t recv(int sockfd, void *buf, size_t len, int flags);
3201     addToFunctionSummaryMap(
3202         "recv",
3203         Signature(ArgTypes{IntTy, VoidPtrTy, SizeTy, IntTy},
3204                   RetType{Ssize_tTy}),
3205         Summary(NoEvalCall)
3206             .Case({ReturnValueCondition(LessThanOrEq, ArgNo(2)),
3207                    ReturnValueCondition(WithinRange, Range(1, Ssize_tMax))},
3208                   ErrnoMustNotBeChecked, GenericSuccessMsg)
3209             .Case({ReturnValueCondition(WithinRange, SingleValue(0)),
3210                    ArgumentCondition(2, WithinRange, SingleValue(0))},
3211                   ErrnoMustNotBeChecked, GenericSuccessMsg)
3212             .Case(ReturnsMinusOne, ErrnoNEZeroIrrelevant, GenericFailureMsg)
3213             .ArgConstraint(ArgumentCondition(0, WithinRange, Range(0, IntMax)))
3214             .ArgConstraint(BufferSize(/*Buffer=*/ArgNo(1),
3215                                       /*BufSize=*/ArgNo(2))));
3216 
3217     std::optional<QualType> StructMsghdrTy = lookupTy("msghdr");
3218     std::optional<QualType> StructMsghdrPtrTy = getPointerTy(StructMsghdrTy);
3219     std::optional<QualType> ConstStructMsghdrPtrTy =
3220         getPointerTy(getConstTy(StructMsghdrTy));
3221 
3222     // ssize_t recvmsg(int sockfd, struct msghdr *msg, int flags);
3223     addToFunctionSummaryMap(
3224         "recvmsg",
3225         Signature(ArgTypes{IntTy, StructMsghdrPtrTy, IntTy},
3226                   RetType{Ssize_tTy}),
3227         Summary(NoEvalCall)
3228             .Case({ReturnValueCondition(WithinRange, Range(1, Ssize_tMax))},
3229                   ErrnoMustNotBeChecked, GenericSuccessMsg)
3230             .Case(ReturnsMinusOne, ErrnoNEZeroIrrelevant, GenericFailureMsg)
3231             .ArgConstraint(
3232                 ArgumentCondition(0, WithinRange, Range(0, IntMax))));
3233 
3234     // ssize_t sendmsg(int sockfd, const struct msghdr *msg, int flags);
3235     addToFunctionSummaryMap(
3236         "sendmsg",
3237         Signature(ArgTypes{IntTy, ConstStructMsghdrPtrTy, IntTy},
3238                   RetType{Ssize_tTy}),
3239         Summary(NoEvalCall)
3240             .Case({ReturnValueCondition(WithinRange, Range(1, Ssize_tMax))},
3241                   ErrnoMustNotBeChecked, GenericSuccessMsg)
3242             .Case(ReturnsMinusOne, ErrnoNEZeroIrrelevant, GenericFailureMsg)
3243             .ArgConstraint(
3244                 ArgumentCondition(0, WithinRange, Range(0, IntMax))));
3245 
3246     // int setsockopt(int socket, int level, int option_name,
3247     //                const void *option_value, socklen_t option_len);
3248     addToFunctionSummaryMap(
3249         "setsockopt",
3250         Signature(ArgTypes{IntTy, IntTy, IntTy, ConstVoidPtrTy, Socklen_tTy},
3251                   RetType{IntTy}),
3252         Summary(NoEvalCall)
3253             .Case(ReturnsZero, ErrnoMustNotBeChecked, GenericSuccessMsg)
3254             .Case(ReturnsMinusOne, ErrnoNEZeroIrrelevant, GenericFailureMsg)
3255             .ArgConstraint(NotNull(ArgNo(3)))
3256             .ArgConstraint(
3257                 BufferSize(/*Buffer=*/ArgNo(3), /*BufSize=*/ArgNo(4)))
3258             .ArgConstraint(
3259                 ArgumentCondition(4, WithinRange, Range(0, Socklen_tMax))));
3260 
3261     // int getsockopt(int socket, int level, int option_name,
3262     //                void *restrict option_value,
3263     //                socklen_t *restrict option_len);
3264     addToFunctionSummaryMap(
3265         "getsockopt",
3266         Signature(ArgTypes{IntTy, IntTy, IntTy, VoidPtrRestrictTy,
3267                            Socklen_tPtrRestrictTy},
3268                   RetType{IntTy}),
3269         Summary(NoEvalCall)
3270             .Case(ReturnsZero, ErrnoMustNotBeChecked, GenericSuccessMsg)
3271             .Case(ReturnsMinusOne, ErrnoNEZeroIrrelevant, GenericFailureMsg)
3272             .ArgConstraint(NotNull(ArgNo(3)))
3273             .ArgConstraint(NotNull(ArgNo(4))));
3274 
3275     // ssize_t send(int sockfd, const void *buf, size_t len, int flags);
3276     addToFunctionSummaryMap(
3277         "send",
3278         Signature(ArgTypes{IntTy, ConstVoidPtrTy, SizeTy, IntTy},
3279                   RetType{Ssize_tTy}),
3280         Summary(NoEvalCall)
3281             .Case({ReturnValueCondition(LessThanOrEq, ArgNo(2)),
3282                    ReturnValueCondition(WithinRange, Range(1, Ssize_tMax))},
3283                   ErrnoMustNotBeChecked, GenericSuccessMsg)
3284             .Case({ReturnValueCondition(WithinRange, SingleValue(0)),
3285                    ArgumentCondition(2, WithinRange, SingleValue(0))},
3286                   ErrnoMustNotBeChecked, GenericSuccessMsg)
3287             .Case(ReturnsMinusOne, ErrnoNEZeroIrrelevant, GenericFailureMsg)
3288             .ArgConstraint(ArgumentCondition(0, WithinRange, Range(0, IntMax)))
3289             .ArgConstraint(BufferSize(/*Buffer=*/ArgNo(1),
3290                                       /*BufSize=*/ArgNo(2))));
3291 
3292     // int socketpair(int domain, int type, int protocol, int sv[2]);
3293     addToFunctionSummaryMap(
3294         "socketpair",
3295         Signature(ArgTypes{IntTy, IntTy, IntTy, IntPtrTy}, RetType{IntTy}),
3296         Summary(NoEvalCall)
3297             .Case(ReturnsZero, ErrnoMustNotBeChecked, GenericSuccessMsg)
3298             .Case(ReturnsMinusOne, ErrnoNEZeroIrrelevant, GenericFailureMsg)
3299             .ArgConstraint(NotNull(ArgNo(3))));
3300 
3301     // int shutdown(int socket, int how);
3302     addToFunctionSummaryMap(
3303         "shutdown", Signature(ArgTypes{IntTy, IntTy}, RetType{IntTy}),
3304         Summary(NoEvalCall)
3305             .Case(ReturnsZero, ErrnoMustNotBeChecked, GenericSuccessMsg)
3306             .Case(ReturnsMinusOne, ErrnoNEZeroIrrelevant, GenericFailureMsg)
3307             .ArgConstraint(
3308                 ArgumentCondition(0, WithinRange, Range(0, IntMax))));
3309 
3310     // int getnameinfo(const struct sockaddr *restrict sa, socklen_t salen,
3311     //                 char *restrict node, socklen_t nodelen,
3312     //                 char *restrict service,
3313     //                 socklen_t servicelen, int flags);
3314     //
3315     // This is defined in netdb.h. And contrary to 'socket.h', the sockaddr
3316     // parameter is never handled as a transparent union in netdb.h
3317     addToFunctionSummaryMap(
3318         "getnameinfo",
3319         Signature(ArgTypes{ConstStructSockaddrPtrRestrictTy, Socklen_tTy,
3320                            CharPtrRestrictTy, Socklen_tTy, CharPtrRestrictTy,
3321                            Socklen_tTy, IntTy},
3322                   RetType{IntTy}),
3323         Summary(NoEvalCall)
3324             .ArgConstraint(
3325                 BufferSize(/*Buffer=*/ArgNo(0), /*BufSize=*/ArgNo(1)))
3326             .ArgConstraint(
3327                 ArgumentCondition(1, WithinRange, Range(0, Socklen_tMax)))
3328             .ArgConstraint(
3329                 BufferSize(/*Buffer=*/ArgNo(2), /*BufSize=*/ArgNo(3)))
3330             .ArgConstraint(
3331                 ArgumentCondition(3, WithinRange, Range(0, Socklen_tMax)))
3332             .ArgConstraint(
3333                 BufferSize(/*Buffer=*/ArgNo(4), /*BufSize=*/ArgNo(5)))
3334             .ArgConstraint(
3335                 ArgumentCondition(5, WithinRange, Range(0, Socklen_tMax))));
3336 
3337     std::optional<QualType> StructUtimbufTy = lookupTy("utimbuf");
3338     std::optional<QualType> StructUtimbufPtrTy = getPointerTy(StructUtimbufTy);
3339 
3340     // int utime(const char *filename, struct utimbuf *buf);
3341     addToFunctionSummaryMap(
3342         "utime",
3343         Signature(ArgTypes{ConstCharPtrTy, StructUtimbufPtrTy}, RetType{IntTy}),
3344         Summary(NoEvalCall)
3345             .Case(ReturnsZero, ErrnoMustNotBeChecked, GenericSuccessMsg)
3346             .Case(ReturnsMinusOne, ErrnoNEZeroIrrelevant, GenericFailureMsg)
3347             .ArgConstraint(NotNull(ArgNo(0))));
3348 
3349     std::optional<QualType> StructTimespecTy = lookupTy("timespec");
3350     std::optional<QualType> StructTimespecPtrTy =
3351         getPointerTy(StructTimespecTy);
3352     std::optional<QualType> ConstStructTimespecPtrTy =
3353         getPointerTy(getConstTy(StructTimespecTy));
3354 
3355     // int futimens(int fd, const struct timespec times[2]);
3356     addToFunctionSummaryMap(
3357         "futimens",
3358         Signature(ArgTypes{IntTy, ConstStructTimespecPtrTy}, RetType{IntTy}),
3359         Summary(NoEvalCall)
3360             .Case(ReturnsZero, ErrnoMustNotBeChecked, GenericSuccessMsg)
3361             .Case(ReturnsMinusOne, ErrnoNEZeroIrrelevant, GenericFailureMsg)
3362             .ArgConstraint(
3363                 ArgumentCondition(0, WithinRange, Range(0, IntMax))));
3364 
3365     // int utimensat(int dirfd, const char *pathname,
3366     //               const struct timespec times[2], int flags);
3367     addToFunctionSummaryMap(
3368         "utimensat",
3369         Signature(
3370             ArgTypes{IntTy, ConstCharPtrTy, ConstStructTimespecPtrTy, IntTy},
3371             RetType{IntTy}),
3372         Summary(NoEvalCall)
3373             .Case(ReturnsZero, ErrnoMustNotBeChecked, GenericSuccessMsg)
3374             .Case(ReturnsMinusOne, ErrnoNEZeroIrrelevant, GenericFailureMsg)
3375             .ArgConstraint(NotNull(ArgNo(1))));
3376 
3377     std::optional<QualType> StructTimevalTy = lookupTy("timeval");
3378     std::optional<QualType> ConstStructTimevalPtrTy =
3379         getPointerTy(getConstTy(StructTimevalTy));
3380 
3381     // int utimes(const char *filename, const struct timeval times[2]);
3382     addToFunctionSummaryMap(
3383         "utimes",
3384         Signature(ArgTypes{ConstCharPtrTy, ConstStructTimevalPtrTy},
3385                   RetType{IntTy}),
3386         Summary(NoEvalCall)
3387             .Case(ReturnsZero, ErrnoMustNotBeChecked, GenericSuccessMsg)
3388             .Case(ReturnsMinusOne, ErrnoNEZeroIrrelevant, GenericFailureMsg)
3389             .ArgConstraint(NotNull(ArgNo(0))));
3390 
3391     // int nanosleep(const struct timespec *rqtp, struct timespec *rmtp);
3392     addToFunctionSummaryMap(
3393         "nanosleep",
3394         Signature(ArgTypes{ConstStructTimespecPtrTy, StructTimespecPtrTy},
3395                   RetType{IntTy}),
3396         Summary(NoEvalCall)
3397             .Case(ReturnsZero, ErrnoMustNotBeChecked, GenericSuccessMsg)
3398             .Case(ReturnsMinusOne, ErrnoNEZeroIrrelevant, GenericFailureMsg)
3399             .ArgConstraint(NotNull(ArgNo(0))));
3400 
3401     std::optional<QualType> Time_tTy = lookupTy("time_t");
3402     std::optional<QualType> ConstTime_tPtrTy =
3403         getPointerTy(getConstTy(Time_tTy));
3404     std::optional<QualType> ConstTime_tPtrRestrictTy =
3405         getRestrictTy(ConstTime_tPtrTy);
3406 
3407     std::optional<QualType> StructTmTy = lookupTy("tm");
3408     std::optional<QualType> StructTmPtrTy = getPointerTy(StructTmTy);
3409     std::optional<QualType> StructTmPtrRestrictTy =
3410         getRestrictTy(StructTmPtrTy);
3411     std::optional<QualType> ConstStructTmPtrTy =
3412         getPointerTy(getConstTy(StructTmTy));
3413     std::optional<QualType> ConstStructTmPtrRestrictTy =
3414         getRestrictTy(ConstStructTmPtrTy);
3415 
3416     // struct tm * localtime(const time_t *tp);
3417     addToFunctionSummaryMap(
3418         "localtime",
3419         Signature(ArgTypes{ConstTime_tPtrTy}, RetType{StructTmPtrTy}),
3420         Summary(NoEvalCall).ArgConstraint(NotNull(ArgNo(0))));
3421 
3422     // struct tm *localtime_r(const time_t *restrict timer,
3423     //                        struct tm *restrict result);
3424     addToFunctionSummaryMap(
3425         "localtime_r",
3426         Signature(ArgTypes{ConstTime_tPtrRestrictTy, StructTmPtrRestrictTy},
3427                   RetType{StructTmPtrTy}),
3428         Summary(NoEvalCall)
3429             .ArgConstraint(NotNull(ArgNo(0)))
3430             .ArgConstraint(NotNull(ArgNo(1))));
3431 
3432     // char *asctime_r(const struct tm *restrict tm, char *restrict buf);
3433     addToFunctionSummaryMap(
3434         "asctime_r",
3435         Signature(ArgTypes{ConstStructTmPtrRestrictTy, CharPtrRestrictTy},
3436                   RetType{CharPtrTy}),
3437         Summary(NoEvalCall)
3438             .ArgConstraint(NotNull(ArgNo(0)))
3439             .ArgConstraint(NotNull(ArgNo(1)))
3440             .ArgConstraint(BufferSize(/*Buffer=*/ArgNo(1),
3441                                       /*MinBufSize=*/BVF.getValue(26, IntTy))));
3442 
3443     // char *ctime_r(const time_t *timep, char *buf);
3444     addToFunctionSummaryMap(
3445         "ctime_r",
3446         Signature(ArgTypes{ConstTime_tPtrTy, CharPtrTy}, RetType{CharPtrTy}),
3447         Summary(NoEvalCall)
3448             .ArgConstraint(NotNull(ArgNo(0)))
3449             .ArgConstraint(NotNull(ArgNo(1)))
3450             .ArgConstraint(BufferSize(
3451                 /*Buffer=*/ArgNo(1),
3452                 /*MinBufSize=*/BVF.getValue(26, IntTy))));
3453 
3454     // struct tm *gmtime_r(const time_t *restrict timer,
3455     //                     struct tm *restrict result);
3456     addToFunctionSummaryMap(
3457         "gmtime_r",
3458         Signature(ArgTypes{ConstTime_tPtrRestrictTy, StructTmPtrRestrictTy},
3459                   RetType{StructTmPtrTy}),
3460         Summary(NoEvalCall)
3461             .ArgConstraint(NotNull(ArgNo(0)))
3462             .ArgConstraint(NotNull(ArgNo(1))));
3463 
3464     // struct tm * gmtime(const time_t *tp);
3465     addToFunctionSummaryMap(
3466         "gmtime", Signature(ArgTypes{ConstTime_tPtrTy}, RetType{StructTmPtrTy}),
3467         Summary(NoEvalCall).ArgConstraint(NotNull(ArgNo(0))));
3468 
3469     std::optional<QualType> Clockid_tTy = lookupTy("clockid_t");
3470 
3471     // int clock_gettime(clockid_t clock_id, struct timespec *tp);
3472     addToFunctionSummaryMap(
3473         "clock_gettime",
3474         Signature(ArgTypes{Clockid_tTy, StructTimespecPtrTy}, RetType{IntTy}),
3475         Summary(NoEvalCall)
3476             .Case(ReturnsZero, ErrnoMustNotBeChecked, GenericSuccessMsg)
3477             .Case(ReturnsMinusOne, ErrnoNEZeroIrrelevant, GenericFailureMsg)
3478             .ArgConstraint(NotNull(ArgNo(1))));
3479 
3480     std::optional<QualType> StructItimervalTy = lookupTy("itimerval");
3481     std::optional<QualType> StructItimervalPtrTy =
3482         getPointerTy(StructItimervalTy);
3483 
3484     // int getitimer(int which, struct itimerval *curr_value);
3485     addToFunctionSummaryMap(
3486         "getitimer",
3487         Signature(ArgTypes{IntTy, StructItimervalPtrTy}, RetType{IntTy}),
3488         Summary(NoEvalCall)
3489             .Case(ReturnsZero, ErrnoMustNotBeChecked, GenericSuccessMsg)
3490             .Case(ReturnsMinusOne, ErrnoNEZeroIrrelevant, GenericFailureMsg)
3491             .ArgConstraint(NotNull(ArgNo(1))));
3492 
3493     std::optional<QualType> Pthread_cond_tTy = lookupTy("pthread_cond_t");
3494     std::optional<QualType> Pthread_cond_tPtrTy =
3495         getPointerTy(Pthread_cond_tTy);
3496     std::optional<QualType> Pthread_tTy = lookupTy("pthread_t");
3497     std::optional<QualType> Pthread_tPtrTy = getPointerTy(Pthread_tTy);
3498     std::optional<QualType> Pthread_tPtrRestrictTy =
3499         getRestrictTy(Pthread_tPtrTy);
3500     std::optional<QualType> Pthread_mutex_tTy = lookupTy("pthread_mutex_t");
3501     std::optional<QualType> Pthread_mutex_tPtrTy =
3502         getPointerTy(Pthread_mutex_tTy);
3503     std::optional<QualType> Pthread_mutex_tPtrRestrictTy =
3504         getRestrictTy(Pthread_mutex_tPtrTy);
3505     std::optional<QualType> Pthread_attr_tTy = lookupTy("pthread_attr_t");
3506     std::optional<QualType> Pthread_attr_tPtrTy =
3507         getPointerTy(Pthread_attr_tTy);
3508     std::optional<QualType> ConstPthread_attr_tPtrTy =
3509         getPointerTy(getConstTy(Pthread_attr_tTy));
3510     std::optional<QualType> ConstPthread_attr_tPtrRestrictTy =
3511         getRestrictTy(ConstPthread_attr_tPtrTy);
3512     std::optional<QualType> Pthread_mutexattr_tTy =
3513         lookupTy("pthread_mutexattr_t");
3514     std::optional<QualType> ConstPthread_mutexattr_tPtrTy =
3515         getPointerTy(getConstTy(Pthread_mutexattr_tTy));
3516     std::optional<QualType> ConstPthread_mutexattr_tPtrRestrictTy =
3517         getRestrictTy(ConstPthread_mutexattr_tPtrTy);
3518 
3519     QualType PthreadStartRoutineTy = getPointerTy(
3520         ACtx.getFunctionType(/*ResultTy=*/VoidPtrTy, /*Args=*/VoidPtrTy,
3521                              FunctionProtoType::ExtProtoInfo()));
3522 
3523     // int pthread_cond_signal(pthread_cond_t *cond);
3524     // int pthread_cond_broadcast(pthread_cond_t *cond);
3525     addToFunctionSummaryMap(
3526         {"pthread_cond_signal", "pthread_cond_broadcast"},
3527         Signature(ArgTypes{Pthread_cond_tPtrTy}, RetType{IntTy}),
3528         Summary(NoEvalCall).ArgConstraint(NotNull(ArgNo(0))));
3529 
3530     // int pthread_create(pthread_t *restrict thread,
3531     //                    const pthread_attr_t *restrict attr,
3532     //                    void *(*start_routine)(void*), void *restrict arg);
3533     addToFunctionSummaryMap(
3534         "pthread_create",
3535         Signature(ArgTypes{Pthread_tPtrRestrictTy,
3536                            ConstPthread_attr_tPtrRestrictTy,
3537                            PthreadStartRoutineTy, VoidPtrRestrictTy},
3538                   RetType{IntTy}),
3539         Summary(NoEvalCall)
3540             .ArgConstraint(NotNull(ArgNo(0)))
3541             .ArgConstraint(NotNull(ArgNo(2))));
3542 
3543     // int pthread_attr_destroy(pthread_attr_t *attr);
3544     // int pthread_attr_init(pthread_attr_t *attr);
3545     addToFunctionSummaryMap(
3546         {"pthread_attr_destroy", "pthread_attr_init"},
3547         Signature(ArgTypes{Pthread_attr_tPtrTy}, RetType{IntTy}),
3548         Summary(NoEvalCall).ArgConstraint(NotNull(ArgNo(0))));
3549 
3550     // int pthread_attr_getstacksize(const pthread_attr_t *restrict attr,
3551     //                               size_t *restrict stacksize);
3552     // int pthread_attr_getguardsize(const pthread_attr_t *restrict attr,
3553     //                               size_t *restrict guardsize);
3554     addToFunctionSummaryMap(
3555         {"pthread_attr_getstacksize", "pthread_attr_getguardsize"},
3556         Signature(ArgTypes{ConstPthread_attr_tPtrRestrictTy, SizePtrRestrictTy},
3557                   RetType{IntTy}),
3558         Summary(NoEvalCall)
3559             .ArgConstraint(NotNull(ArgNo(0)))
3560             .ArgConstraint(NotNull(ArgNo(1))));
3561 
3562     // int pthread_attr_setstacksize(pthread_attr_t *attr, size_t stacksize);
3563     // int pthread_attr_setguardsize(pthread_attr_t *attr, size_t guardsize);
3564     addToFunctionSummaryMap(
3565         {"pthread_attr_setstacksize", "pthread_attr_setguardsize"},
3566         Signature(ArgTypes{Pthread_attr_tPtrTy, SizeTy}, RetType{IntTy}),
3567         Summary(NoEvalCall)
3568             .ArgConstraint(NotNull(ArgNo(0)))
3569             .ArgConstraint(
3570                 ArgumentCondition(1, WithinRange, Range(0, SizeMax))));
3571 
3572     // int pthread_mutex_init(pthread_mutex_t *restrict mutex, const
3573     //                        pthread_mutexattr_t *restrict attr);
3574     addToFunctionSummaryMap(
3575         "pthread_mutex_init",
3576         Signature(ArgTypes{Pthread_mutex_tPtrRestrictTy,
3577                            ConstPthread_mutexattr_tPtrRestrictTy},
3578                   RetType{IntTy}),
3579         Summary(NoEvalCall).ArgConstraint(NotNull(ArgNo(0))));
3580 
3581     // int pthread_mutex_destroy(pthread_mutex_t *mutex);
3582     // int pthread_mutex_lock(pthread_mutex_t *mutex);
3583     // int pthread_mutex_trylock(pthread_mutex_t *mutex);
3584     // int pthread_mutex_unlock(pthread_mutex_t *mutex);
3585     addToFunctionSummaryMap(
3586         {"pthread_mutex_destroy", "pthread_mutex_lock", "pthread_mutex_trylock",
3587          "pthread_mutex_unlock"},
3588         Signature(ArgTypes{Pthread_mutex_tPtrTy}, RetType{IntTy}),
3589         Summary(NoEvalCall).ArgConstraint(NotNull(ArgNo(0))));
3590   }
3591 
3592   // Functions for testing.
3593   if (AddTestFunctions) {
3594     const RangeInt IntMin = BVF.getMinValue(IntTy).getLimitedValue();
3595 
3596     addToFunctionSummaryMap(
3597         "__not_null", Signature(ArgTypes{IntPtrTy}, RetType{IntTy}),
3598         Summary(EvalCallAsPure).ArgConstraint(NotNull(ArgNo(0))));
3599 
3600     addToFunctionSummaryMap(
3601         "__not_null_buffer",
3602         Signature(ArgTypes{VoidPtrTy, IntTy, IntTy}, RetType{IntTy}),
3603         Summary(EvalCallAsPure)
3604             .ArgConstraint(NotNullBuffer(ArgNo(0), ArgNo(1), ArgNo(2))));
3605 
3606     // Test inside range constraints.
3607     addToFunctionSummaryMap(
3608         "__single_val_0", Signature(ArgTypes{IntTy}, RetType{IntTy}),
3609         Summary(EvalCallAsPure)
3610             .ArgConstraint(ArgumentCondition(0U, WithinRange, SingleValue(0))));
3611     addToFunctionSummaryMap(
3612         "__single_val_1", Signature(ArgTypes{IntTy}, RetType{IntTy}),
3613         Summary(EvalCallAsPure)
3614             .ArgConstraint(ArgumentCondition(0U, WithinRange, SingleValue(1))));
3615     addToFunctionSummaryMap(
3616         "__range_1_2", Signature(ArgTypes{IntTy}, RetType{IntTy}),
3617         Summary(EvalCallAsPure)
3618             .ArgConstraint(ArgumentCondition(0U, WithinRange, Range(1, 2))));
3619     addToFunctionSummaryMap(
3620         "__range_m1_1", Signature(ArgTypes{IntTy}, RetType{IntTy}),
3621         Summary(EvalCallAsPure)
3622             .ArgConstraint(ArgumentCondition(0U, WithinRange, Range(-1, 1))));
3623     addToFunctionSummaryMap(
3624         "__range_m2_m1", Signature(ArgTypes{IntTy}, RetType{IntTy}),
3625         Summary(EvalCallAsPure)
3626             .ArgConstraint(ArgumentCondition(0U, WithinRange, Range(-2, -1))));
3627     addToFunctionSummaryMap(
3628         "__range_m10_10", Signature(ArgTypes{IntTy}, RetType{IntTy}),
3629         Summary(EvalCallAsPure)
3630             .ArgConstraint(ArgumentCondition(0U, WithinRange, Range(-10, 10))));
3631     addToFunctionSummaryMap("__range_m1_inf",
3632                             Signature(ArgTypes{IntTy}, RetType{IntTy}),
3633                             Summary(EvalCallAsPure)
3634                                 .ArgConstraint(ArgumentCondition(
3635                                     0U, WithinRange, Range(-1, IntMax))));
3636     addToFunctionSummaryMap("__range_0_inf",
3637                             Signature(ArgTypes{IntTy}, RetType{IntTy}),
3638                             Summary(EvalCallAsPure)
3639                                 .ArgConstraint(ArgumentCondition(
3640                                     0U, WithinRange, Range(0, IntMax))));
3641     addToFunctionSummaryMap("__range_1_inf",
3642                             Signature(ArgTypes{IntTy}, RetType{IntTy}),
3643                             Summary(EvalCallAsPure)
3644                                 .ArgConstraint(ArgumentCondition(
3645                                     0U, WithinRange, Range(1, IntMax))));
3646     addToFunctionSummaryMap("__range_minf_m1",
3647                             Signature(ArgTypes{IntTy}, RetType{IntTy}),
3648                             Summary(EvalCallAsPure)
3649                                 .ArgConstraint(ArgumentCondition(
3650                                     0U, WithinRange, Range(IntMin, -1))));
3651     addToFunctionSummaryMap("__range_minf_0",
3652                             Signature(ArgTypes{IntTy}, RetType{IntTy}),
3653                             Summary(EvalCallAsPure)
3654                                 .ArgConstraint(ArgumentCondition(
3655                                     0U, WithinRange, Range(IntMin, 0))));
3656     addToFunctionSummaryMap("__range_minf_1",
3657                             Signature(ArgTypes{IntTy}, RetType{IntTy}),
3658                             Summary(EvalCallAsPure)
3659                                 .ArgConstraint(ArgumentCondition(
3660                                     0U, WithinRange, Range(IntMin, 1))));
3661     addToFunctionSummaryMap("__range_1_2__4_6",
3662                             Signature(ArgTypes{IntTy}, RetType{IntTy}),
3663                             Summary(EvalCallAsPure)
3664                                 .ArgConstraint(ArgumentCondition(
3665                                     0U, WithinRange, Range({1, 2}, {4, 6}))));
3666     addToFunctionSummaryMap(
3667         "__range_1_2__4_inf", Signature(ArgTypes{IntTy}, RetType{IntTy}),
3668         Summary(EvalCallAsPure)
3669             .ArgConstraint(ArgumentCondition(0U, WithinRange,
3670                                              Range({1, 2}, {4, IntMax}))));
3671 
3672     // Test out of range constraints.
3673     addToFunctionSummaryMap(
3674         "__single_val_out_0", Signature(ArgTypes{IntTy}, RetType{IntTy}),
3675         Summary(EvalCallAsPure)
3676             .ArgConstraint(ArgumentCondition(0U, OutOfRange, SingleValue(0))));
3677     addToFunctionSummaryMap(
3678         "__single_val_out_1", Signature(ArgTypes{IntTy}, RetType{IntTy}),
3679         Summary(EvalCallAsPure)
3680             .ArgConstraint(ArgumentCondition(0U, OutOfRange, SingleValue(1))));
3681     addToFunctionSummaryMap(
3682         "__range_out_1_2", Signature(ArgTypes{IntTy}, RetType{IntTy}),
3683         Summary(EvalCallAsPure)
3684             .ArgConstraint(ArgumentCondition(0U, OutOfRange, Range(1, 2))));
3685     addToFunctionSummaryMap(
3686         "__range_out_m1_1", Signature(ArgTypes{IntTy}, RetType{IntTy}),
3687         Summary(EvalCallAsPure)
3688             .ArgConstraint(ArgumentCondition(0U, OutOfRange, Range(-1, 1))));
3689     addToFunctionSummaryMap(
3690         "__range_out_m2_m1", Signature(ArgTypes{IntTy}, RetType{IntTy}),
3691         Summary(EvalCallAsPure)
3692             .ArgConstraint(ArgumentCondition(0U, OutOfRange, Range(-2, -1))));
3693     addToFunctionSummaryMap(
3694         "__range_out_m10_10", Signature(ArgTypes{IntTy}, RetType{IntTy}),
3695         Summary(EvalCallAsPure)
3696             .ArgConstraint(ArgumentCondition(0U, OutOfRange, Range(-10, 10))));
3697     addToFunctionSummaryMap("__range_out_m1_inf",
3698                             Signature(ArgTypes{IntTy}, RetType{IntTy}),
3699                             Summary(EvalCallAsPure)
3700                                 .ArgConstraint(ArgumentCondition(
3701                                     0U, OutOfRange, Range(-1, IntMax))));
3702     addToFunctionSummaryMap("__range_out_0_inf",
3703                             Signature(ArgTypes{IntTy}, RetType{IntTy}),
3704                             Summary(EvalCallAsPure)
3705                                 .ArgConstraint(ArgumentCondition(
3706                                     0U, OutOfRange, Range(0, IntMax))));
3707     addToFunctionSummaryMap("__range_out_1_inf",
3708                             Signature(ArgTypes{IntTy}, RetType{IntTy}),
3709                             Summary(EvalCallAsPure)
3710                                 .ArgConstraint(ArgumentCondition(
3711                                     0U, OutOfRange, Range(1, IntMax))));
3712     addToFunctionSummaryMap("__range_out_minf_m1",
3713                             Signature(ArgTypes{IntTy}, RetType{IntTy}),
3714                             Summary(EvalCallAsPure)
3715                                 .ArgConstraint(ArgumentCondition(
3716                                     0U, OutOfRange, Range(IntMin, -1))));
3717     addToFunctionSummaryMap("__range_out_minf_0",
3718                             Signature(ArgTypes{IntTy}, RetType{IntTy}),
3719                             Summary(EvalCallAsPure)
3720                                 .ArgConstraint(ArgumentCondition(
3721                                     0U, OutOfRange, Range(IntMin, 0))));
3722     addToFunctionSummaryMap("__range_out_minf_1",
3723                             Signature(ArgTypes{IntTy}, RetType{IntTy}),
3724                             Summary(EvalCallAsPure)
3725                                 .ArgConstraint(ArgumentCondition(
3726                                     0U, OutOfRange, Range(IntMin, 1))));
3727     addToFunctionSummaryMap("__range_out_1_2__4_6",
3728                             Signature(ArgTypes{IntTy}, RetType{IntTy}),
3729                             Summary(EvalCallAsPure)
3730                                 .ArgConstraint(ArgumentCondition(
3731                                     0U, OutOfRange, Range({1, 2}, {4, 6}))));
3732     addToFunctionSummaryMap(
3733         "__range_out_1_2__4_inf", Signature(ArgTypes{IntTy}, RetType{IntTy}),
3734         Summary(EvalCallAsPure)
3735             .ArgConstraint(
3736                 ArgumentCondition(0U, OutOfRange, Range({1, 2}, {4, IntMax}))));
3737 
3738     // Test range kind.
3739     addToFunctionSummaryMap(
3740         "__within", Signature(ArgTypes{IntTy}, RetType{IntTy}),
3741         Summary(EvalCallAsPure)
3742             .ArgConstraint(ArgumentCondition(0U, WithinRange, SingleValue(1))));
3743     addToFunctionSummaryMap(
3744         "__out_of", Signature(ArgTypes{IntTy}, RetType{IntTy}),
3745         Summary(EvalCallAsPure)
3746             .ArgConstraint(ArgumentCondition(0U, OutOfRange, SingleValue(1))));
3747 
3748     addToFunctionSummaryMap(
3749         "__two_constrained_args",
3750         Signature(ArgTypes{IntTy, IntTy}, RetType{IntTy}),
3751         Summary(EvalCallAsPure)
3752             .ArgConstraint(ArgumentCondition(0U, WithinRange, SingleValue(1)))
3753             .ArgConstraint(ArgumentCondition(1U, WithinRange, SingleValue(1))));
3754     addToFunctionSummaryMap(
3755         "__arg_constrained_twice", Signature(ArgTypes{IntTy}, RetType{IntTy}),
3756         Summary(EvalCallAsPure)
3757             .ArgConstraint(ArgumentCondition(0U, OutOfRange, SingleValue(1)))
3758             .ArgConstraint(ArgumentCondition(0U, OutOfRange, SingleValue(2))));
3759     addToFunctionSummaryMap(
3760         "__defaultparam",
3761         Signature(ArgTypes{Irrelevant, IntTy}, RetType{IntTy}),
3762         Summary(EvalCallAsPure).ArgConstraint(NotNull(ArgNo(0))));
3763     addToFunctionSummaryMap(
3764         "__variadic",
3765         Signature(ArgTypes{VoidPtrTy, ConstCharPtrTy}, RetType{IntTy}),
3766         Summary(EvalCallAsPure)
3767             .ArgConstraint(NotNull(ArgNo(0)))
3768             .ArgConstraint(NotNull(ArgNo(1))));
3769     addToFunctionSummaryMap(
3770         "__buf_size_arg_constraint",
3771         Signature(ArgTypes{ConstVoidPtrTy, SizeTy}, RetType{IntTy}),
3772         Summary(EvalCallAsPure)
3773             .ArgConstraint(
3774                 BufferSize(/*Buffer=*/ArgNo(0), /*BufSize=*/ArgNo(1))));
3775     addToFunctionSummaryMap(
3776         "__buf_size_arg_constraint_mul",
3777         Signature(ArgTypes{ConstVoidPtrTy, SizeTy, SizeTy}, RetType{IntTy}),
3778         Summary(EvalCallAsPure)
3779             .ArgConstraint(BufferSize(/*Buffer=*/ArgNo(0), /*BufSize=*/ArgNo(1),
3780                                       /*BufSizeMultiplier=*/ArgNo(2))));
3781     addToFunctionSummaryMap(
3782         "__buf_size_arg_constraint_concrete",
3783         Signature(ArgTypes{ConstVoidPtrTy}, RetType{IntTy}),
3784         Summary(EvalCallAsPure)
3785             .ArgConstraint(BufferSize(/*Buffer=*/ArgNo(0),
3786                                       /*BufSize=*/BVF.getValue(10, IntTy))));
3787     addToFunctionSummaryMap(
3788         {"__test_restrict_param_0", "__test_restrict_param_1",
3789          "__test_restrict_param_2"},
3790         Signature(ArgTypes{VoidPtrRestrictTy}, RetType{VoidTy}),
3791         Summary(EvalCallAsPure));
3792 
3793     // Test the application of cases.
3794     addToFunctionSummaryMap(
3795         "__test_case_note", Signature(ArgTypes{}, RetType{IntTy}),
3796         Summary(EvalCallAsPure)
3797             .Case({ReturnValueCondition(WithinRange, SingleValue(0))},
3798                   ErrnoIrrelevant, "Function returns 0")
3799             .Case({ReturnValueCondition(WithinRange, SingleValue(1))},
3800                   ErrnoIrrelevant, "Function returns 1"));
3801     addToFunctionSummaryMap(
3802         "__test_case_range_1_2__4_6",
3803         Signature(ArgTypes{IntTy}, RetType{IntTy}),
3804         Summary(EvalCallAsPure)
3805             .Case({ArgumentCondition(0U, WithinRange,
3806                                      IntRangeVector{{IntMin, 0}, {3, 3}}),
3807                    ReturnValueCondition(WithinRange, SingleValue(1))},
3808                   ErrnoIrrelevant)
3809             .Case({ArgumentCondition(0U, WithinRange,
3810                                      IntRangeVector{{3, 3}, {7, IntMax}}),
3811                    ReturnValueCondition(WithinRange, SingleValue(2))},
3812                   ErrnoIrrelevant)
3813             .Case({ArgumentCondition(0U, WithinRange,
3814                                      IntRangeVector{{IntMin, 0}, {7, IntMax}}),
3815                    ReturnValueCondition(WithinRange, SingleValue(3))},
3816                   ErrnoIrrelevant)
3817             .Case({ArgumentCondition(
3818                        0U, WithinRange,
3819                        IntRangeVector{{IntMin, 0}, {3, 3}, {7, IntMax}}),
3820                    ReturnValueCondition(WithinRange, SingleValue(4))},
3821                   ErrnoIrrelevant));
3822   }
3823 }
3824 
3825 void ento::registerStdCLibraryFunctionsChecker(CheckerManager &mgr) {
3826   auto *Checker = mgr.registerChecker<StdLibraryFunctionsChecker>();
3827   Checker->CheckName = mgr.getCurrentCheckerName();
3828   const AnalyzerOptions &Opts = mgr.getAnalyzerOptions();
3829   Checker->DisplayLoadedSummaries =
3830       Opts.getCheckerBooleanOption(Checker, "DisplayLoadedSummaries");
3831   Checker->ModelPOSIX = Opts.getCheckerBooleanOption(Checker, "ModelPOSIX");
3832   Checker->ShouldAssumeControlledEnvironment =
3833       Opts.ShouldAssumeControlledEnvironment;
3834 }
3835 
3836 bool ento::shouldRegisterStdCLibraryFunctionsChecker(
3837     const CheckerManager &mgr) {
3838   return true;
3839 }
3840 
3841 void ento::registerStdCLibraryFunctionsTesterChecker(CheckerManager &mgr) {
3842   auto *Checker = mgr.getChecker<StdLibraryFunctionsChecker>();
3843   Checker->AddTestFunctions = true;
3844 }
3845 
3846 bool ento::shouldRegisterStdCLibraryFunctionsTesterChecker(
3847     const CheckerManager &mgr) {
3848   return true;
3849 }
3850