xref: /llvm-project/clang/lib/StaticAnalyzer/Checkers/StreamChecker.cpp (revision fc4b09d16139348533f1a1c9c72c99dacba51417)
1 //===-- StreamChecker.cpp -----------------------------------------*- C++ -*--//
2 //
3 // Part of the LLVM Project, under the Apache License v2.0 with LLVM Exceptions.
4 // See https://llvm.org/LICENSE.txt for license information.
5 // SPDX-License-Identifier: Apache-2.0 WITH LLVM-exception
6 //
7 //===----------------------------------------------------------------------===//
8 //
9 // This file defines checkers that model and check stream handling functions.
10 //
11 //===----------------------------------------------------------------------===//
12 
13 #include "NoOwnershipChangeVisitor.h"
14 #include "clang/ASTMatchers/ASTMatchFinder.h"
15 #include "clang/ASTMatchers/ASTMatchers.h"
16 #include "clang/StaticAnalyzer/Checkers/BuiltinCheckerRegistration.h"
17 #include "clang/StaticAnalyzer/Core/BugReporter/BugType.h"
18 #include "clang/StaticAnalyzer/Core/Checker.h"
19 #include "clang/StaticAnalyzer/Core/CheckerManager.h"
20 #include "clang/StaticAnalyzer/Core/PathSensitive/CallDescription.h"
21 #include "clang/StaticAnalyzer/Core/PathSensitive/CallEvent.h"
22 #include "clang/StaticAnalyzer/Core/PathSensitive/CheckerContext.h"
23 #include "clang/StaticAnalyzer/Core/PathSensitive/CheckerHelpers.h"
24 #include "clang/StaticAnalyzer/Core/PathSensitive/ProgramState.h"
25 #include "clang/StaticAnalyzer/Core/PathSensitive/ProgramStateTrait.h"
26 #include "clang/StaticAnalyzer/Core/PathSensitive/SymbolManager.h"
27 #include "llvm/ADT/Sequence.h"
28 #include <functional>
29 #include <optional>
30 
31 using namespace clang;
32 using namespace ento;
33 using namespace std::placeholders;
34 
35 //===----------------------------------------------------------------------===//
36 // Definition of state data structures.
37 //===----------------------------------------------------------------------===//
38 
39 namespace {
40 
41 struct FnDescription;
42 
43 /// State of the stream error flags.
44 /// Sometimes it is not known to the checker what error flags are set.
45 /// This is indicated by setting more than one flag to true.
46 /// This is an optimization to avoid state splits.
47 /// A stream can either be in FEOF or FERROR but not both at the same time.
48 /// Multiple flags are set to handle the corresponding states together.
49 struct StreamErrorState {
50   /// The stream can be in state where none of the error flags set.
51   bool NoError = true;
52   /// The stream can be in state where the EOF indicator is set.
53   bool FEof = false;
54   /// The stream can be in state where the error indicator is set.
55   bool FError = false;
56 
57   bool isNoError() const { return NoError && !FEof && !FError; }
58   bool isFEof() const { return !NoError && FEof && !FError; }
59   bool isFError() const { return !NoError && !FEof && FError; }
60 
61   bool operator==(const StreamErrorState &ES) const {
62     return NoError == ES.NoError && FEof == ES.FEof && FError == ES.FError;
63   }
64 
65   bool operator!=(const StreamErrorState &ES) const { return !(*this == ES); }
66 
67   StreamErrorState operator|(const StreamErrorState &E) const {
68     return {NoError || E.NoError, FEof || E.FEof, FError || E.FError};
69   }
70 
71   StreamErrorState operator&(const StreamErrorState &E) const {
72     return {NoError && E.NoError, FEof && E.FEof, FError && E.FError};
73   }
74 
75   StreamErrorState operator~() const { return {!NoError, !FEof, !FError}; }
76 
77   /// Returns if the StreamErrorState is a valid object.
78   operator bool() const { return NoError || FEof || FError; }
79 
80   LLVM_DUMP_METHOD void dump() const { dumpToStream(llvm::errs()); }
81   LLVM_DUMP_METHOD void dumpToStream(llvm::raw_ostream &os) const {
82     os << "NoError: " << NoError << ", FEof: " << FEof
83        << ", FError: " << FError;
84   }
85 
86   void Profile(llvm::FoldingSetNodeID &ID) const {
87     ID.AddBoolean(NoError);
88     ID.AddBoolean(FEof);
89     ID.AddBoolean(FError);
90   }
91 };
92 
93 const StreamErrorState ErrorNone{true, false, false};
94 const StreamErrorState ErrorFEof{false, true, false};
95 const StreamErrorState ErrorFError{false, false, true};
96 
97 /// Full state information about a stream pointer.
98 struct StreamState {
99   /// The last file operation called in the stream.
100   /// Can be nullptr.
101   const FnDescription *LastOperation;
102 
103   /// State of a stream symbol.
104   enum KindTy {
105     Opened, /// Stream is opened.
106     Closed, /// Closed stream (an invalid stream pointer after it was closed).
107     OpenFailed /// The last open operation has failed.
108   } State;
109 
110   StringRef getKindStr() const {
111     switch (State) {
112     case Opened:
113       return "Opened";
114     case Closed:
115       return "Closed";
116     case OpenFailed:
117       return "OpenFailed";
118     }
119     llvm_unreachable("Unknown StreamState!");
120   }
121 
122   /// State of the error flags.
123   /// Ignored in non-opened stream state but must be NoError.
124   StreamErrorState const ErrorState;
125 
126   /// Indicate if the file has an "indeterminate file position indicator".
127   /// This can be set at a failing read or write or seek operation.
128   /// If it is set no more read or write is allowed.
129   /// This value is not dependent on the stream error flags:
130   /// The error flag may be cleared with `clearerr` but the file position
131   /// remains still indeterminate.
132   /// This value applies to all error states in ErrorState except FEOF.
133   /// An EOF+indeterminate state is the same as EOF state.
134   bool const FilePositionIndeterminate = false;
135 
136   StreamState(const FnDescription *L, KindTy S, const StreamErrorState &ES,
137               bool IsFilePositionIndeterminate)
138       : LastOperation(L), State(S), ErrorState(ES),
139         FilePositionIndeterminate(IsFilePositionIndeterminate) {
140     assert((!ES.isFEof() || !IsFilePositionIndeterminate) &&
141            "FilePositionIndeterminate should be false in FEof case.");
142     assert((State == Opened || ErrorState.isNoError()) &&
143            "ErrorState should be None in non-opened stream state.");
144   }
145 
146   bool isOpened() const { return State == Opened; }
147   bool isClosed() const { return State == Closed; }
148   bool isOpenFailed() const { return State == OpenFailed; }
149 
150   bool operator==(const StreamState &X) const {
151     // In not opened state error state should always NoError, so comparison
152     // here is no problem.
153     return LastOperation == X.LastOperation && State == X.State &&
154            ErrorState == X.ErrorState &&
155            FilePositionIndeterminate == X.FilePositionIndeterminate;
156   }
157 
158   static StreamState getOpened(const FnDescription *L,
159                                const StreamErrorState &ES = ErrorNone,
160                                bool IsFilePositionIndeterminate = false) {
161     return StreamState{L, Opened, ES, IsFilePositionIndeterminate};
162   }
163   static StreamState getClosed(const FnDescription *L) {
164     return StreamState{L, Closed, {}, false};
165   }
166   static StreamState getOpenFailed(const FnDescription *L) {
167     return StreamState{L, OpenFailed, {}, false};
168   }
169 
170   LLVM_DUMP_METHOD void dump() const { dumpToStream(llvm::errs()); }
171   LLVM_DUMP_METHOD void dumpToStream(llvm::raw_ostream &os) const;
172 
173   void Profile(llvm::FoldingSetNodeID &ID) const {
174     ID.AddPointer(LastOperation);
175     ID.AddInteger(State);
176     ErrorState.Profile(ID);
177     ID.AddBoolean(FilePositionIndeterminate);
178   }
179 };
180 
181 } // namespace
182 
183 // This map holds the state of a stream.
184 // The stream is identified with a SymbolRef that is created when a stream
185 // opening function is modeled by the checker.
186 REGISTER_MAP_WITH_PROGRAMSTATE(StreamMap, SymbolRef, StreamState)
187 
188 //===----------------------------------------------------------------------===//
189 // StreamChecker class and utility functions.
190 //===----------------------------------------------------------------------===//
191 
192 namespace {
193 
194 class StreamChecker;
195 using FnCheck = std::function<void(const StreamChecker *, const FnDescription *,
196                                    const CallEvent &, CheckerContext &)>;
197 
198 using ArgNoTy = unsigned int;
199 static const ArgNoTy ArgNone = std::numeric_limits<ArgNoTy>::max();
200 
201 const char *FeofNote = "Assuming stream reaches end-of-file here";
202 const char *FerrorNote = "Assuming this stream operation fails";
203 
204 struct FnDescription {
205   FnCheck PreFn;
206   FnCheck EvalFn;
207   ArgNoTy StreamArgNo;
208 };
209 
210 LLVM_DUMP_METHOD void StreamState::dumpToStream(llvm::raw_ostream &os) const {
211   os << "{Kind: " << getKindStr() << ", Last operation: " << LastOperation
212      << ", ErrorState: ";
213   ErrorState.dumpToStream(os);
214   os << ", FilePos: " << (FilePositionIndeterminate ? "Indeterminate" : "OK")
215      << '}';
216 }
217 
218 /// Get the value of the stream argument out of the passed call event.
219 /// The call should contain a function that is described by Desc.
220 SVal getStreamArg(const FnDescription *Desc, const CallEvent &Call) {
221   assert(Desc && Desc->StreamArgNo != ArgNone &&
222          "Try to get a non-existing stream argument.");
223   return Call.getArgSVal(Desc->StreamArgNo);
224 }
225 
226 /// Create a conjured symbol return value for a call expression.
227 DefinedSVal makeRetVal(CheckerContext &C, const CallExpr *CE) {
228   assert(CE && "Expecting a call expression.");
229 
230   const LocationContext *LCtx = C.getLocationContext();
231   return C.getSValBuilder()
232       .conjureSymbolVal(nullptr, CE, LCtx, C.blockCount())
233       .castAs<DefinedSVal>();
234 }
235 
236 ProgramStateRef bindAndAssumeTrue(ProgramStateRef State, CheckerContext &C,
237                                   const CallExpr *CE) {
238   DefinedSVal RetVal = makeRetVal(C, CE);
239   State = State->BindExpr(CE, C.getLocationContext(), RetVal);
240   State = State->assume(RetVal, true);
241   assert(State && "Assumption on new value should not fail.");
242   return State;
243 }
244 
245 ProgramStateRef bindInt(uint64_t Value, ProgramStateRef State,
246                         CheckerContext &C, const CallExpr *CE) {
247   State = State->BindExpr(CE, C.getLocationContext(),
248                           C.getSValBuilder().makeIntVal(Value, CE->getType()));
249   return State;
250 }
251 
252 inline void assertStreamStateOpened(const StreamState *SS) {
253   assert(SS->isOpened() && "Stream is expected to be opened");
254 }
255 
256 class StreamChecker : public Checker<check::PreCall, eval::Call,
257                                      check::DeadSymbols, check::PointerEscape> {
258   BugType BT_FileNull{this, "NULL stream pointer", "Stream handling error"};
259   BugType BT_UseAfterClose{this, "Closed stream", "Stream handling error"};
260   BugType BT_UseAfterOpenFailed{this, "Invalid stream",
261                                 "Stream handling error"};
262   BugType BT_IndeterminatePosition{this, "Invalid stream state",
263                                    "Stream handling error"};
264   BugType BT_IllegalWhence{this, "Illegal whence argument",
265                            "Stream handling error"};
266   BugType BT_StreamEof{this, "Stream already in EOF", "Stream handling error"};
267   BugType BT_ResourceLeak{this, "Resource leak", "Stream handling error",
268                           /*SuppressOnSink =*/true};
269 
270 public:
271   void checkPreCall(const CallEvent &Call, CheckerContext &C) const;
272   bool evalCall(const CallEvent &Call, CheckerContext &C) const;
273   void checkDeadSymbols(SymbolReaper &SymReaper, CheckerContext &C) const;
274   ProgramStateRef checkPointerEscape(ProgramStateRef State,
275                                      const InvalidatedSymbols &Escaped,
276                                      const CallEvent *Call,
277                                      PointerEscapeKind Kind) const;
278 
279   const BugType *getBT_StreamEof() const { return &BT_StreamEof; }
280   const BugType *getBT_IndeterminatePosition() const {
281     return &BT_IndeterminatePosition;
282   }
283 
284   const NoteTag *constructSetEofNoteTag(CheckerContext &C,
285                                         SymbolRef StreamSym) const {
286     return C.getNoteTag([this, StreamSym](PathSensitiveBugReport &BR) {
287       if (!BR.isInteresting(StreamSym) ||
288           &BR.getBugType() != this->getBT_StreamEof())
289         return "";
290 
291       BR.markNotInteresting(StreamSym);
292 
293       return FeofNote;
294     });
295   }
296 
297   const NoteTag *constructSetErrorNoteTag(CheckerContext &C,
298                                           SymbolRef StreamSym) const {
299     return C.getNoteTag([this, StreamSym](PathSensitiveBugReport &BR) {
300       if (!BR.isInteresting(StreamSym) ||
301           &BR.getBugType() != this->getBT_IndeterminatePosition())
302         return "";
303 
304       BR.markNotInteresting(StreamSym);
305 
306       return FerrorNote;
307     });
308   }
309 
310   const NoteTag *constructSetEofOrErrorNoteTag(CheckerContext &C,
311                                                SymbolRef StreamSym) const {
312     return C.getNoteTag([this, StreamSym](PathSensitiveBugReport &BR) {
313       if (!BR.isInteresting(StreamSym))
314         return "";
315 
316       if (&BR.getBugType() == this->getBT_StreamEof()) {
317         BR.markNotInteresting(StreamSym);
318         return FeofNote;
319       }
320       if (&BR.getBugType() == this->getBT_IndeterminatePosition()) {
321         BR.markNotInteresting(StreamSym);
322         return FerrorNote;
323       }
324 
325       return "";
326     });
327   }
328 
329   /// If true, evaluate special testing stream functions.
330   bool TestMode = false;
331 
332   /// If true, generate failure branches for cases that are often not checked.
333   bool PedanticMode = false;
334 
335   const CallDescription FCloseDesc = {CDM::CLibrary, {"fclose"}, 1};
336 
337 private:
338   CallDescriptionMap<FnDescription> FnDescriptions = {
339       {{CDM::CLibrary, {"fopen"}, 2},
340        {nullptr, &StreamChecker::evalFopen, ArgNone}},
341       {{CDM::CLibrary, {"fdopen"}, 2},
342        {nullptr, &StreamChecker::evalFopen, ArgNone}},
343       {{CDM::CLibrary, {"freopen"}, 3},
344        {&StreamChecker::preFreopen, &StreamChecker::evalFreopen, 2}},
345       {{CDM::CLibrary, {"tmpfile"}, 0},
346        {nullptr, &StreamChecker::evalFopen, ArgNone}},
347       {FCloseDesc, {&StreamChecker::preDefault, &StreamChecker::evalFclose, 0}},
348       {{CDM::CLibrary, {"fread"}, 4},
349        {&StreamChecker::preRead,
350         std::bind(&StreamChecker::evalFreadFwrite, _1, _2, _3, _4, true), 3}},
351       {{CDM::CLibrary, {"fwrite"}, 4},
352        {&StreamChecker::preWrite,
353         std::bind(&StreamChecker::evalFreadFwrite, _1, _2, _3, _4, false), 3}},
354       {{CDM::CLibrary, {"fgetc"}, 1},
355        {&StreamChecker::preRead,
356         std::bind(&StreamChecker::evalFgetx, _1, _2, _3, _4, true), 0}},
357       {{CDM::CLibrary, {"fgets"}, 3},
358        {&StreamChecker::preRead,
359         std::bind(&StreamChecker::evalFgetx, _1, _2, _3, _4, false), 2}},
360       {{CDM::CLibrary, {"getc"}, 1},
361        {&StreamChecker::preRead,
362         std::bind(&StreamChecker::evalFgetx, _1, _2, _3, _4, true), 0}},
363       {{CDM::CLibrary, {"fputc"}, 2},
364        {&StreamChecker::preWrite,
365         std::bind(&StreamChecker::evalFputx, _1, _2, _3, _4, true), 1}},
366       {{CDM::CLibrary, {"fputs"}, 2},
367        {&StreamChecker::preWrite,
368         std::bind(&StreamChecker::evalFputx, _1, _2, _3, _4, false), 1}},
369       {{CDM::CLibrary, {"putc"}, 2},
370        {&StreamChecker::preWrite,
371         std::bind(&StreamChecker::evalFputx, _1, _2, _3, _4, true), 1}},
372       {{CDM::CLibrary, {"fprintf"}},
373        {&StreamChecker::preWrite,
374         std::bind(&StreamChecker::evalFprintf, _1, _2, _3, _4), 0}},
375       {{CDM::CLibrary, {"vfprintf"}, 3},
376        {&StreamChecker::preWrite,
377         std::bind(&StreamChecker::evalFprintf, _1, _2, _3, _4), 0}},
378       {{CDM::CLibrary, {"fscanf"}},
379        {&StreamChecker::preRead,
380         std::bind(&StreamChecker::evalFscanf, _1, _2, _3, _4), 0}},
381       {{CDM::CLibrary, {"vfscanf"}, 3},
382        {&StreamChecker::preRead,
383         std::bind(&StreamChecker::evalFscanf, _1, _2, _3, _4), 0}},
384       {{CDM::CLibrary, {"ungetc"}, 2},
385        {&StreamChecker::preWrite,
386         std::bind(&StreamChecker::evalUngetc, _1, _2, _3, _4), 1}},
387       {{CDM::CLibrary, {"getdelim"}, 4},
388        {&StreamChecker::preRead,
389         std::bind(&StreamChecker::evalGetdelim, _1, _2, _3, _4), 3}},
390       {{CDM::CLibrary, {"getline"}, 3},
391        {&StreamChecker::preRead,
392         std::bind(&StreamChecker::evalGetdelim, _1, _2, _3, _4), 2}},
393       {{CDM::CLibrary, {"fseek"}, 3},
394        {&StreamChecker::preFseek, &StreamChecker::evalFseek, 0}},
395       {{CDM::CLibrary, {"fseeko"}, 3},
396        {&StreamChecker::preFseek, &StreamChecker::evalFseek, 0}},
397       {{CDM::CLibrary, {"ftell"}, 1},
398        {&StreamChecker::preWrite, &StreamChecker::evalFtell, 0}},
399       {{CDM::CLibrary, {"ftello"}, 1},
400        {&StreamChecker::preWrite, &StreamChecker::evalFtell, 0}},
401       {{CDM::CLibrary, {"fflush"}, 1},
402        {&StreamChecker::preFflush, &StreamChecker::evalFflush, 0}},
403       {{CDM::CLibrary, {"rewind"}, 1},
404        {&StreamChecker::preDefault, &StreamChecker::evalRewind, 0}},
405       {{CDM::CLibrary, {"fgetpos"}, 2},
406        {&StreamChecker::preWrite, &StreamChecker::evalFgetpos, 0}},
407       {{CDM::CLibrary, {"fsetpos"}, 2},
408        {&StreamChecker::preDefault, &StreamChecker::evalFsetpos, 0}},
409       {{CDM::CLibrary, {"clearerr"}, 1},
410        {&StreamChecker::preDefault, &StreamChecker::evalClearerr, 0}},
411       {{CDM::CLibrary, {"feof"}, 1},
412        {&StreamChecker::preDefault,
413         std::bind(&StreamChecker::evalFeofFerror, _1, _2, _3, _4, ErrorFEof),
414         0}},
415       {{CDM::CLibrary, {"ferror"}, 1},
416        {&StreamChecker::preDefault,
417         std::bind(&StreamChecker::evalFeofFerror, _1, _2, _3, _4, ErrorFError),
418         0}},
419       {{CDM::CLibrary, {"fileno"}, 1},
420        {&StreamChecker::preDefault, &StreamChecker::evalFileno, 0}},
421   };
422 
423   CallDescriptionMap<FnDescription> FnTestDescriptions = {
424       {{CDM::SimpleFunc, {"StreamTesterChecker_make_feof_stream"}, 1},
425        {nullptr,
426         std::bind(&StreamChecker::evalSetFeofFerror, _1, _2, _3, _4, ErrorFEof,
427                   false),
428         0}},
429       {{CDM::SimpleFunc, {"StreamTesterChecker_make_ferror_stream"}, 1},
430        {nullptr,
431         std::bind(&StreamChecker::evalSetFeofFerror, _1, _2, _3, _4,
432                   ErrorFError, false),
433         0}},
434       {{CDM::SimpleFunc,
435         {"StreamTesterChecker_make_ferror_indeterminate_stream"},
436         1},
437        {nullptr,
438         std::bind(&StreamChecker::evalSetFeofFerror, _1, _2, _3, _4,
439                   ErrorFError, true),
440         0}},
441   };
442 
443   /// Expanded value of EOF, empty before initialization.
444   mutable std::optional<int> EofVal;
445   /// Expanded value of SEEK_SET, 0 if not found.
446   mutable int SeekSetVal = 0;
447   /// Expanded value of SEEK_CUR, 1 if not found.
448   mutable int SeekCurVal = 1;
449   /// Expanded value of SEEK_END, 2 if not found.
450   mutable int SeekEndVal = 2;
451   /// The built-in va_list type is platform-specific
452   mutable QualType VaListType;
453 
454   void evalFopen(const FnDescription *Desc, const CallEvent &Call,
455                  CheckerContext &C) const;
456 
457   void preFreopen(const FnDescription *Desc, const CallEvent &Call,
458                   CheckerContext &C) const;
459   void evalFreopen(const FnDescription *Desc, const CallEvent &Call,
460                    CheckerContext &C) const;
461 
462   void evalFclose(const FnDescription *Desc, const CallEvent &Call,
463                   CheckerContext &C) const;
464 
465   void preRead(const FnDescription *Desc, const CallEvent &Call,
466                CheckerContext &C) const;
467 
468   void preWrite(const FnDescription *Desc, const CallEvent &Call,
469                 CheckerContext &C) const;
470 
471   void evalFreadFwrite(const FnDescription *Desc, const CallEvent &Call,
472                        CheckerContext &C, bool IsFread) const;
473 
474   void evalFgetx(const FnDescription *Desc, const CallEvent &Call,
475                  CheckerContext &C, bool SingleChar) const;
476 
477   void evalFputx(const FnDescription *Desc, const CallEvent &Call,
478                  CheckerContext &C, bool IsSingleChar) const;
479 
480   void evalFprintf(const FnDescription *Desc, const CallEvent &Call,
481                    CheckerContext &C) const;
482 
483   void evalFscanf(const FnDescription *Desc, const CallEvent &Call,
484                   CheckerContext &C) const;
485 
486   void evalUngetc(const FnDescription *Desc, const CallEvent &Call,
487                   CheckerContext &C) const;
488 
489   void evalGetdelim(const FnDescription *Desc, const CallEvent &Call,
490                     CheckerContext &C) const;
491 
492   void preFseek(const FnDescription *Desc, const CallEvent &Call,
493                 CheckerContext &C) const;
494   void evalFseek(const FnDescription *Desc, const CallEvent &Call,
495                  CheckerContext &C) const;
496 
497   void evalFgetpos(const FnDescription *Desc, const CallEvent &Call,
498                    CheckerContext &C) const;
499 
500   void evalFsetpos(const FnDescription *Desc, const CallEvent &Call,
501                    CheckerContext &C) const;
502 
503   void evalFtell(const FnDescription *Desc, const CallEvent &Call,
504                  CheckerContext &C) const;
505 
506   void evalRewind(const FnDescription *Desc, const CallEvent &Call,
507                   CheckerContext &C) const;
508 
509   void preDefault(const FnDescription *Desc, const CallEvent &Call,
510                   CheckerContext &C) const;
511 
512   void evalClearerr(const FnDescription *Desc, const CallEvent &Call,
513                     CheckerContext &C) const;
514 
515   void evalFeofFerror(const FnDescription *Desc, const CallEvent &Call,
516                       CheckerContext &C,
517                       const StreamErrorState &ErrorKind) const;
518 
519   void evalSetFeofFerror(const FnDescription *Desc, const CallEvent &Call,
520                          CheckerContext &C, const StreamErrorState &ErrorKind,
521                          bool Indeterminate) const;
522 
523   void preFflush(const FnDescription *Desc, const CallEvent &Call,
524                  CheckerContext &C) const;
525 
526   void evalFflush(const FnDescription *Desc, const CallEvent &Call,
527                   CheckerContext &C) const;
528 
529   void evalFileno(const FnDescription *Desc, const CallEvent &Call,
530                   CheckerContext &C) const;
531 
532   /// Check that the stream (in StreamVal) is not NULL.
533   /// If it can only be NULL a fatal error is emitted and nullptr returned.
534   /// Otherwise the return value is a new state where the stream is constrained
535   /// to be non-null.
536   ProgramStateRef ensureStreamNonNull(SVal StreamVal, const Expr *StreamE,
537                                       CheckerContext &C,
538                                       ProgramStateRef State) const;
539 
540   /// Check that the stream is the opened state.
541   /// If the stream is known to be not opened an error is generated
542   /// and nullptr returned, otherwise the original state is returned.
543   ProgramStateRef ensureStreamOpened(SVal StreamVal, CheckerContext &C,
544                                      ProgramStateRef State) const;
545 
546   /// Check that the stream has not an invalid ("indeterminate") file position,
547   /// generate warning for it.
548   /// (EOF is not an invalid position.)
549   /// The returned state can be nullptr if a fatal error was generated.
550   /// It can return non-null state if the stream has not an invalid position or
551   /// there is execution path with non-invalid position.
552   ProgramStateRef
553   ensureNoFilePositionIndeterminate(SVal StreamVal, CheckerContext &C,
554                                     ProgramStateRef State) const;
555 
556   /// Check the legality of the 'whence' argument of 'fseek'.
557   /// Generate error and return nullptr if it is found to be illegal.
558   /// Otherwise returns the state.
559   /// (State is not changed here because the "whence" value is already known.)
560   ProgramStateRef ensureFseekWhenceCorrect(SVal WhenceVal, CheckerContext &C,
561                                            ProgramStateRef State) const;
562 
563   /// Generate warning about stream in EOF state.
564   /// There will be always a state transition into the passed State,
565   /// by the new non-fatal error node or (if failed) a normal transition,
566   /// to ensure uniform handling.
567   void reportFEofWarning(SymbolRef StreamSym, CheckerContext &C,
568                          ProgramStateRef State) const;
569 
570   /// Emit resource leak warnings for the given symbols.
571   /// Createn a non-fatal error node for these, and returns it (if any warnings
572   /// were generated). Return value is non-null.
573   ExplodedNode *reportLeaks(const SmallVector<SymbolRef, 2> &LeakedSyms,
574                             CheckerContext &C, ExplodedNode *Pred) const;
575 
576   /// Find the description data of the function called by a call event.
577   /// Returns nullptr if no function is recognized.
578   const FnDescription *lookupFn(const CallEvent &Call) const {
579     // Recognize "global C functions" with only integral or pointer arguments
580     // (and matching name) as stream functions.
581     for (auto *P : Call.parameters()) {
582       QualType T = P->getType();
583       if (!T->isIntegralOrEnumerationType() && !T->isPointerType() &&
584           T.getCanonicalType() != VaListType)
585         return nullptr;
586     }
587 
588     return FnDescriptions.lookup(Call);
589   }
590 
591   /// Generate a message for BugReporterVisitor if the stored symbol is
592   /// marked as interesting by the actual bug report.
593   const NoteTag *constructLeakNoteTag(CheckerContext &C, SymbolRef StreamSym,
594                                       const std::string &Message) const {
595     return C.getNoteTag([this, StreamSym,
596                          Message](PathSensitiveBugReport &BR) -> std::string {
597       if (BR.isInteresting(StreamSym) && &BR.getBugType() == &BT_ResourceLeak)
598         return Message;
599       return "";
600     });
601   }
602 
603   void initMacroValues(CheckerContext &C) const {
604     if (EofVal)
605       return;
606 
607     if (const std::optional<int> OptInt =
608             tryExpandAsInteger("EOF", C.getPreprocessor()))
609       EofVal = *OptInt;
610     else
611       EofVal = -1;
612     if (const std::optional<int> OptInt =
613             tryExpandAsInteger("SEEK_SET", C.getPreprocessor()))
614       SeekSetVal = *OptInt;
615     if (const std::optional<int> OptInt =
616             tryExpandAsInteger("SEEK_END", C.getPreprocessor()))
617       SeekEndVal = *OptInt;
618     if (const std::optional<int> OptInt =
619             tryExpandAsInteger("SEEK_CUR", C.getPreprocessor()))
620       SeekCurVal = *OptInt;
621   }
622 
623   void initVaListType(CheckerContext &C) const {
624     VaListType = C.getASTContext().getBuiltinVaListType().getCanonicalType();
625   }
626 
627   /// Searches for the ExplodedNode where the file descriptor was acquired for
628   /// StreamSym.
629   static const ExplodedNode *getAcquisitionSite(const ExplodedNode *N,
630                                                 SymbolRef StreamSym,
631                                                 CheckerContext &C);
632 };
633 
634 struct StreamOperationEvaluator {
635   SValBuilder &SVB;
636   const ASTContext &ACtx;
637 
638   SymbolRef StreamSym = nullptr;
639   const StreamState *SS = nullptr;
640   const CallExpr *CE = nullptr;
641   StreamErrorState NewES;
642 
643   StreamOperationEvaluator(CheckerContext &C)
644       : SVB(C.getSValBuilder()), ACtx(C.getASTContext()) {
645     ;
646   }
647 
648   bool Init(const FnDescription *Desc, const CallEvent &Call, CheckerContext &C,
649             ProgramStateRef State) {
650     StreamSym = getStreamArg(Desc, Call).getAsSymbol();
651     if (!StreamSym)
652       return false;
653     SS = State->get<StreamMap>(StreamSym);
654     if (!SS)
655       return false;
656     NewES = SS->ErrorState;
657     CE = dyn_cast_or_null<CallExpr>(Call.getOriginExpr());
658     if (!CE)
659       return false;
660 
661     assertStreamStateOpened(SS);
662 
663     return true;
664   }
665 
666   bool isStreamEof() const { return SS->ErrorState == ErrorFEof; }
667 
668   NonLoc getZeroVal(const CallEvent &Call) {
669     return *SVB.makeZeroVal(Call.getResultType()).getAs<NonLoc>();
670   }
671 
672   ProgramStateRef setStreamState(ProgramStateRef State,
673                                  const StreamState &NewSS) {
674     NewES = NewSS.ErrorState;
675     return State->set<StreamMap>(StreamSym, NewSS);
676   }
677 
678   ProgramStateRef makeAndBindRetVal(ProgramStateRef State, CheckerContext &C) {
679     NonLoc RetVal = makeRetVal(C, CE).castAs<NonLoc>();
680     return State->BindExpr(CE, C.getLocationContext(), RetVal);
681   }
682 
683   ProgramStateRef bindReturnValue(ProgramStateRef State, CheckerContext &C,
684                                   uint64_t Val) {
685     return State->BindExpr(CE, C.getLocationContext(),
686                            SVB.makeIntVal(Val, CE->getCallReturnType(ACtx)));
687   }
688 
689   ProgramStateRef bindReturnValue(ProgramStateRef State, CheckerContext &C,
690                                   SVal Val) {
691     return State->BindExpr(CE, C.getLocationContext(), Val);
692   }
693 
694   ProgramStateRef bindNullReturnValue(ProgramStateRef State,
695                                       CheckerContext &C) {
696     return State->BindExpr(CE, C.getLocationContext(),
697                            C.getSValBuilder().makeNullWithType(CE->getType()));
698   }
699 
700   ProgramStateRef assumeBinOpNN(ProgramStateRef State,
701                                 BinaryOperator::Opcode Op, NonLoc LHS,
702                                 NonLoc RHS) {
703     auto Cond = SVB.evalBinOpNN(State, Op, LHS, RHS, SVB.getConditionType())
704                     .getAs<DefinedOrUnknownSVal>();
705     if (!Cond)
706       return nullptr;
707     return State->assume(*Cond, true);
708   }
709 
710   ConstraintManager::ProgramStatePair
711   makeRetValAndAssumeDual(ProgramStateRef State, CheckerContext &C) {
712     DefinedSVal RetVal = makeRetVal(C, CE);
713     State = State->BindExpr(CE, C.getLocationContext(), RetVal);
714     return C.getConstraintManager().assumeDual(State, RetVal);
715   }
716 
717   const NoteTag *getFailureNoteTag(const StreamChecker *Ch, CheckerContext &C) {
718     bool SetFeof = NewES.FEof && !SS->ErrorState.FEof;
719     bool SetFerror = NewES.FError && !SS->ErrorState.FError;
720     if (SetFeof && !SetFerror)
721       return Ch->constructSetEofNoteTag(C, StreamSym);
722     if (!SetFeof && SetFerror)
723       return Ch->constructSetErrorNoteTag(C, StreamSym);
724     if (SetFeof && SetFerror)
725       return Ch->constructSetEofOrErrorNoteTag(C, StreamSym);
726     return nullptr;
727   }
728 };
729 
730 } // end anonymous namespace
731 
732 //===----------------------------------------------------------------------===//
733 // Definition of NoStreamStateChangeVisitor.
734 //===----------------------------------------------------------------------===//
735 
736 namespace {
737 class NoStreamStateChangeVisitor final : public NoOwnershipChangeVisitor {
738 protected:
739   /// Syntactically checks whether the callee is a closing function. Since
740   /// we have no path-sensitive information on this call (we would need a
741   /// CallEvent instead of a CallExpr for that), its possible that a
742   /// closing function was called indirectly through a function pointer,
743   /// but we are not able to tell, so this is a best effort analysis.
744   bool isClosingCallAsWritten(const CallExpr &Call) const {
745     const auto *StreamChk = static_cast<const StreamChecker *>(&Checker);
746     return StreamChk->FCloseDesc.matchesAsWritten(Call);
747   }
748 
749   bool doesFnIntendToHandleOwnership(const Decl *Callee,
750                                      ASTContext &ACtx) final {
751     using namespace clang::ast_matchers;
752     const FunctionDecl *FD = dyn_cast<FunctionDecl>(Callee);
753 
754     auto Matches =
755         match(findAll(callExpr().bind("call")), *FD->getBody(), ACtx);
756     for (BoundNodes Match : Matches) {
757       if (const auto *Call = Match.getNodeAs<CallExpr>("call"))
758         if (isClosingCallAsWritten(*Call))
759           return true;
760     }
761     // TODO: Ownership might change with an attempt to store stream object, not
762     // only through closing it. Check for attempted stores as well.
763     return false;
764   }
765 
766   bool hasResourceStateChanged(ProgramStateRef CallEnterState,
767                                ProgramStateRef CallExitEndState) final {
768     return CallEnterState->get<StreamMap>(Sym) !=
769            CallExitEndState->get<StreamMap>(Sym);
770   }
771 
772   PathDiagnosticPieceRef emitNote(const ExplodedNode *N) override {
773     PathDiagnosticLocation L = PathDiagnosticLocation::create(
774         N->getLocation(),
775         N->getState()->getStateManager().getContext().getSourceManager());
776     return std::make_shared<PathDiagnosticEventPiece>(
777         L, "Returning without closing stream object or storing it for later "
778            "release");
779   }
780 
781 public:
782   NoStreamStateChangeVisitor(SymbolRef Sym, const StreamChecker *Checker)
783       : NoOwnershipChangeVisitor(Sym, Checker) {}
784 };
785 
786 } // end anonymous namespace
787 
788 const ExplodedNode *StreamChecker::getAcquisitionSite(const ExplodedNode *N,
789                                                       SymbolRef StreamSym,
790                                                       CheckerContext &C) {
791   ProgramStateRef State = N->getState();
792   // When bug type is resource leak, exploded node N may not have state info
793   // for leaked file descriptor, but predecessor should have it.
794   if (!State->get<StreamMap>(StreamSym))
795     N = N->getFirstPred();
796 
797   const ExplodedNode *Pred = N;
798   while (N) {
799     State = N->getState();
800     if (!State->get<StreamMap>(StreamSym))
801       return Pred;
802     Pred = N;
803     N = N->getFirstPred();
804   }
805 
806   return nullptr;
807 }
808 
809 static std::optional<int64_t> getKnownValue(ProgramStateRef State, SVal V) {
810   SValBuilder &SVB = State->getStateManager().getSValBuilder();
811   if (const llvm::APSInt *Int = SVB.getKnownValue(State, V))
812     return Int->tryExtValue();
813   return std::nullopt;
814 }
815 
816 /// Invalidate only the requested elements instead of the whole buffer.
817 /// This is basically a refinement of the more generic 'escapeArgs' or
818 /// the plain old 'invalidateRegions'.
819 static ProgramStateRef
820 escapeByStartIndexAndCount(ProgramStateRef State, const CallEvent &Call,
821                            unsigned BlockCount, const SubRegion *Buffer,
822                            QualType ElemType, int64_t StartIndex,
823                            int64_t ElementCount) {
824   constexpr auto DoNotInvalidateSuperRegion =
825       RegionAndSymbolInvalidationTraits::InvalidationKinds::
826           TK_DoNotInvalidateSuperRegion;
827 
828   const LocationContext *LCtx = Call.getLocationContext();
829   const ASTContext &Ctx = State->getStateManager().getContext();
830   SValBuilder &SVB = State->getStateManager().getSValBuilder();
831   auto &RegionManager = Buffer->getMemRegionManager();
832 
833   SmallVector<SVal> EscapingVals;
834   EscapingVals.reserve(ElementCount);
835 
836   RegionAndSymbolInvalidationTraits ITraits;
837   for (auto Idx : llvm::seq(StartIndex, StartIndex + ElementCount)) {
838     NonLoc Index = SVB.makeArrayIndex(Idx);
839     const auto *Element =
840         RegionManager.getElementRegion(ElemType, Index, Buffer, Ctx);
841     EscapingVals.push_back(loc::MemRegionVal(Element));
842     ITraits.setTrait(Element, DoNotInvalidateSuperRegion);
843   }
844   return State->invalidateRegions(
845       EscapingVals, Call.getOriginExpr(), BlockCount, LCtx,
846       /*CausesPointerEscape=*/false,
847       /*InvalidatedSymbols=*/nullptr, &Call, &ITraits);
848 }
849 
850 static ProgramStateRef escapeArgs(ProgramStateRef State, CheckerContext &C,
851                                   const CallEvent &Call,
852                                   ArrayRef<unsigned int> EscapingArgs) {
853   auto GetArgSVal = [&Call](int Idx) { return Call.getArgSVal(Idx); };
854   auto EscapingVals = to_vector(map_range(EscapingArgs, GetArgSVal));
855   State = State->invalidateRegions(EscapingVals, Call.getOriginExpr(),
856                                    C.blockCount(), C.getLocationContext(),
857                                    /*CausesPointerEscape=*/false,
858                                    /*InvalidatedSymbols=*/nullptr);
859   return State;
860 }
861 
862 //===----------------------------------------------------------------------===//
863 // Methods of StreamChecker.
864 //===----------------------------------------------------------------------===//
865 
866 void StreamChecker::checkPreCall(const CallEvent &Call,
867                                  CheckerContext &C) const {
868   initMacroValues(C);
869   initVaListType(C);
870 
871   const FnDescription *Desc = lookupFn(Call);
872   if (!Desc || !Desc->PreFn)
873     return;
874 
875   Desc->PreFn(this, Desc, Call, C);
876 }
877 
878 bool StreamChecker::evalCall(const CallEvent &Call, CheckerContext &C) const {
879   const FnDescription *Desc = lookupFn(Call);
880   if (!Desc && TestMode)
881     Desc = FnTestDescriptions.lookup(Call);
882   if (!Desc || !Desc->EvalFn)
883     return false;
884 
885   Desc->EvalFn(this, Desc, Call, C);
886 
887   return C.isDifferent();
888 }
889 
890 void StreamChecker::evalFopen(const FnDescription *Desc, const CallEvent &Call,
891                               CheckerContext &C) const {
892   ProgramStateRef State = C.getState();
893   const CallExpr *CE = dyn_cast_or_null<CallExpr>(Call.getOriginExpr());
894   if (!CE)
895     return;
896 
897   DefinedSVal RetVal = makeRetVal(C, CE);
898   SymbolRef RetSym = RetVal.getAsSymbol();
899   assert(RetSym && "RetVal must be a symbol here.");
900 
901   State = State->BindExpr(CE, C.getLocationContext(), RetVal);
902 
903   // Bifurcate the state into two: one with a valid FILE* pointer, the other
904   // with a NULL.
905   ProgramStateRef StateNotNull, StateNull;
906   std::tie(StateNotNull, StateNull) =
907       C.getConstraintManager().assumeDual(State, RetVal);
908 
909   StateNotNull =
910       StateNotNull->set<StreamMap>(RetSym, StreamState::getOpened(Desc));
911   StateNull =
912       StateNull->set<StreamMap>(RetSym, StreamState::getOpenFailed(Desc));
913 
914   C.addTransition(StateNotNull,
915                   constructLeakNoteTag(C, RetSym, "Stream opened here"));
916   C.addTransition(StateNull);
917 }
918 
919 void StreamChecker::preFreopen(const FnDescription *Desc, const CallEvent &Call,
920                                CheckerContext &C) const {
921   // Do not allow NULL as passed stream pointer but allow a closed stream.
922   ProgramStateRef State = C.getState();
923   State = ensureStreamNonNull(getStreamArg(Desc, Call),
924                               Call.getArgExpr(Desc->StreamArgNo), C, State);
925   if (!State)
926     return;
927 
928   C.addTransition(State);
929 }
930 
931 void StreamChecker::evalFreopen(const FnDescription *Desc,
932                                 const CallEvent &Call,
933                                 CheckerContext &C) const {
934   ProgramStateRef State = C.getState();
935 
936   auto *CE = dyn_cast_or_null<CallExpr>(Call.getOriginExpr());
937   if (!CE)
938     return;
939 
940   std::optional<DefinedSVal> StreamVal =
941       getStreamArg(Desc, Call).getAs<DefinedSVal>();
942   if (!StreamVal)
943     return;
944 
945   SymbolRef StreamSym = StreamVal->getAsSymbol();
946   // Do not care about concrete values for stream ("(FILE *)0x12345"?).
947   // FIXME: Can be stdin, stdout, stderr such values?
948   if (!StreamSym)
949     return;
950 
951   // Do not handle untracked stream. It is probably escaped.
952   if (!State->get<StreamMap>(StreamSym))
953     return;
954 
955   // Generate state for non-failed case.
956   // Return value is the passed stream pointer.
957   // According to the documentations, the stream is closed first
958   // but any close error is ignored. The state changes to (or remains) opened.
959   ProgramStateRef StateRetNotNull =
960       State->BindExpr(CE, C.getLocationContext(), *StreamVal);
961   // Generate state for NULL return value.
962   // Stream switches to OpenFailed state.
963   ProgramStateRef StateRetNull =
964       State->BindExpr(CE, C.getLocationContext(),
965                       C.getSValBuilder().makeNullWithType(CE->getType()));
966 
967   StateRetNotNull =
968       StateRetNotNull->set<StreamMap>(StreamSym, StreamState::getOpened(Desc));
969   StateRetNull =
970       StateRetNull->set<StreamMap>(StreamSym, StreamState::getOpenFailed(Desc));
971 
972   C.addTransition(StateRetNotNull,
973                   constructLeakNoteTag(C, StreamSym, "Stream reopened here"));
974   C.addTransition(StateRetNull);
975 }
976 
977 void StreamChecker::evalFclose(const FnDescription *Desc, const CallEvent &Call,
978                                CheckerContext &C) const {
979   ProgramStateRef State = C.getState();
980   StreamOperationEvaluator E(C);
981   if (!E.Init(Desc, Call, C, State))
982     return;
983 
984   // Close the File Descriptor.
985   // Regardless if the close fails or not, stream becomes "closed"
986   // and can not be used any more.
987   State = E.setStreamState(State, StreamState::getClosed(Desc));
988 
989   // Return 0 on success, EOF on failure.
990   C.addTransition(E.bindReturnValue(State, C, 0));
991   C.addTransition(E.bindReturnValue(State, C, *EofVal));
992 }
993 
994 void StreamChecker::preRead(const FnDescription *Desc, const CallEvent &Call,
995                             CheckerContext &C) const {
996   ProgramStateRef State = C.getState();
997   SVal StreamVal = getStreamArg(Desc, Call);
998   State = ensureStreamNonNull(StreamVal, Call.getArgExpr(Desc->StreamArgNo), C,
999                               State);
1000   if (!State)
1001     return;
1002   State = ensureStreamOpened(StreamVal, C, State);
1003   if (!State)
1004     return;
1005   State = ensureNoFilePositionIndeterminate(StreamVal, C, State);
1006   if (!State)
1007     return;
1008 
1009   SymbolRef Sym = StreamVal.getAsSymbol();
1010   if (Sym && State->get<StreamMap>(Sym)) {
1011     const StreamState *SS = State->get<StreamMap>(Sym);
1012     if (SS->ErrorState & ErrorFEof)
1013       reportFEofWarning(Sym, C, State);
1014   } else {
1015     C.addTransition(State);
1016   }
1017 }
1018 
1019 void StreamChecker::preWrite(const FnDescription *Desc, const CallEvent &Call,
1020                              CheckerContext &C) const {
1021   ProgramStateRef State = C.getState();
1022   SVal StreamVal = getStreamArg(Desc, Call);
1023   State = ensureStreamNonNull(StreamVal, Call.getArgExpr(Desc->StreamArgNo), C,
1024                               State);
1025   if (!State)
1026     return;
1027   State = ensureStreamOpened(StreamVal, C, State);
1028   if (!State)
1029     return;
1030   State = ensureNoFilePositionIndeterminate(StreamVal, C, State);
1031   if (!State)
1032     return;
1033 
1034   C.addTransition(State);
1035 }
1036 
1037 static std::optional<QualType> getPointeeType(const MemRegion *R) {
1038   if (!R)
1039     return std::nullopt;
1040   if (const auto *ER = dyn_cast<ElementRegion>(R))
1041     return ER->getElementType();
1042   if (const auto *TR = dyn_cast<TypedValueRegion>(R))
1043     return TR->getValueType();
1044   if (const auto *SR = dyn_cast<SymbolicRegion>(R))
1045     return SR->getPointeeStaticType();
1046   return std::nullopt;
1047 }
1048 
1049 static std::optional<NonLoc> getStartIndex(SValBuilder &SVB,
1050                                            const MemRegion *R) {
1051   if (!R)
1052     return std::nullopt;
1053 
1054   auto Zero = [&SVB] {
1055     BasicValueFactory &BVF = SVB.getBasicValueFactory();
1056     return nonloc::ConcreteInt(BVF.getIntValue(0, /*isUnsigned=*/false));
1057   };
1058 
1059   if (const auto *ER = dyn_cast<ElementRegion>(R))
1060     return ER->getIndex();
1061   if (isa<TypedValueRegion>(R))
1062     return Zero();
1063   if (isa<SymbolicRegion>(R))
1064     return Zero();
1065   return std::nullopt;
1066 }
1067 
1068 static ProgramStateRef
1069 tryToInvalidateFReadBufferByElements(ProgramStateRef State, CheckerContext &C,
1070                                      const CallEvent &Call, NonLoc SizeVal,
1071                                      NonLoc NMembVal) {
1072   // Try to invalidate the individual elements.
1073   const auto *Buffer =
1074       dyn_cast_or_null<SubRegion>(Call.getArgSVal(0).getAsRegion());
1075 
1076   std::optional<QualType> ElemTy = getPointeeType(Buffer);
1077   std::optional<SVal> StartElementIndex =
1078       getStartIndex(C.getSValBuilder(), Buffer);
1079 
1080   // Drop the outermost ElementRegion to get the buffer.
1081   if (const auto *ER = dyn_cast_or_null<ElementRegion>(Buffer))
1082     Buffer = dyn_cast<SubRegion>(ER->getSuperRegion());
1083 
1084   std::optional<int64_t> CountVal = getKnownValue(State, NMembVal);
1085   std::optional<int64_t> Size = getKnownValue(State, SizeVal);
1086   std::optional<int64_t> StartIndexVal =
1087       getKnownValue(State, StartElementIndex.value_or(UnknownVal()));
1088 
1089   if (ElemTy && CountVal && Size && StartIndexVal) {
1090     int64_t NumBytesRead = Size.value() * CountVal.value();
1091     int64_t ElemSizeInChars =
1092         C.getASTContext().getTypeSizeInChars(*ElemTy).getQuantity();
1093     bool IncompleteLastElement = (NumBytesRead % ElemSizeInChars) != 0;
1094     int64_t NumCompleteOrIncompleteElementsRead =
1095         NumBytesRead / ElemSizeInChars + IncompleteLastElement;
1096 
1097     constexpr int MaxInvalidatedElementsLimit = 64;
1098     if (NumCompleteOrIncompleteElementsRead <= MaxInvalidatedElementsLimit) {
1099       return escapeByStartIndexAndCount(State, Call, C.blockCount(), Buffer,
1100                                         *ElemTy, *StartIndexVal,
1101                                         NumCompleteOrIncompleteElementsRead);
1102     }
1103   }
1104   return nullptr;
1105 }
1106 
1107 void StreamChecker::evalFreadFwrite(const FnDescription *Desc,
1108                                     const CallEvent &Call, CheckerContext &C,
1109                                     bool IsFread) const {
1110   ProgramStateRef State = C.getState();
1111   StreamOperationEvaluator E(C);
1112   if (!E.Init(Desc, Call, C, State))
1113     return;
1114 
1115   std::optional<NonLoc> SizeVal = Call.getArgSVal(1).getAs<NonLoc>();
1116   if (!SizeVal)
1117     return;
1118   std::optional<NonLoc> NMembVal = Call.getArgSVal(2).getAs<NonLoc>();
1119   if (!NMembVal)
1120     return;
1121 
1122   // C'99 standard, §7.19.8.1.3, the return value of fread:
1123   // The fread function returns the number of elements successfully read, which
1124   // may be less than nmemb if a read error or end-of-file is encountered. If
1125   // size or nmemb is zero, fread returns zero and the contents of the array and
1126   // the state of the stream remain unchanged.
1127   if (State->isNull(*SizeVal).isConstrainedTrue() ||
1128       State->isNull(*NMembVal).isConstrainedTrue()) {
1129     // This is the "size or nmemb is zero" case.
1130     // Just return 0, do nothing more (not clear the error flags).
1131     C.addTransition(E.bindReturnValue(State, C, 0));
1132     return;
1133   }
1134 
1135   // At read, invalidate the buffer in any case of error or success,
1136   // except if EOF was already present.
1137   if (IsFread && !E.isStreamEof()) {
1138     // Try to invalidate the individual elements.
1139     // Otherwise just fall back to invalidating the whole buffer.
1140     ProgramStateRef InvalidatedState = tryToInvalidateFReadBufferByElements(
1141         State, C, Call, *SizeVal, *NMembVal);
1142     State =
1143         InvalidatedState ? InvalidatedState : escapeArgs(State, C, Call, {0});
1144   }
1145 
1146   // Generate a transition for the success state.
1147   // If we know the state to be FEOF at fread, do not add a success state.
1148   if (!IsFread || !E.isStreamEof()) {
1149     ProgramStateRef StateNotFailed =
1150         State->BindExpr(E.CE, C.getLocationContext(), *NMembVal);
1151     StateNotFailed =
1152         E.setStreamState(StateNotFailed, StreamState::getOpened(Desc));
1153     C.addTransition(StateNotFailed);
1154   }
1155 
1156   // Add transition for the failed state.
1157   // At write, add failure case only if "pedantic mode" is on.
1158   if (!IsFread && !PedanticMode)
1159     return;
1160 
1161   NonLoc RetVal = makeRetVal(C, E.CE).castAs<NonLoc>();
1162   ProgramStateRef StateFailed =
1163       State->BindExpr(E.CE, C.getLocationContext(), RetVal);
1164   StateFailed = E.assumeBinOpNN(StateFailed, BO_LT, RetVal, *NMembVal);
1165   if (!StateFailed)
1166     return;
1167 
1168   StreamErrorState NewES;
1169   if (IsFread)
1170     NewES = E.isStreamEof() ? ErrorFEof : ErrorFEof | ErrorFError;
1171   else
1172     NewES = ErrorFError;
1173   // If a (non-EOF) error occurs, the resulting value of the file position
1174   // indicator for the stream is indeterminate.
1175   StateFailed = E.setStreamState(
1176       StateFailed, StreamState::getOpened(Desc, NewES, !NewES.isFEof()));
1177   C.addTransition(StateFailed, E.getFailureNoteTag(this, C));
1178 }
1179 
1180 void StreamChecker::evalFgetx(const FnDescription *Desc, const CallEvent &Call,
1181                               CheckerContext &C, bool SingleChar) const {
1182   // `fgetc` returns the read character on success, otherwise returns EOF.
1183   // `fgets` returns the read buffer address on success, otherwise returns NULL.
1184 
1185   ProgramStateRef State = C.getState();
1186   StreamOperationEvaluator E(C);
1187   if (!E.Init(Desc, Call, C, State))
1188     return;
1189 
1190   if (!E.isStreamEof()) {
1191     // If there was already EOF, assume that read buffer is not changed.
1192     // Otherwise it may change at success or failure.
1193     State = escapeArgs(State, C, Call, {0});
1194     if (SingleChar) {
1195       // Generate a transition for the success state of `fgetc`.
1196       NonLoc RetVal = makeRetVal(C, E.CE).castAs<NonLoc>();
1197       ProgramStateRef StateNotFailed =
1198           State->BindExpr(E.CE, C.getLocationContext(), RetVal);
1199       // The returned 'unsigned char' of `fgetc` is converted to 'int',
1200       // so we need to check if it is in range [0, 255].
1201       StateNotFailed = StateNotFailed->assumeInclusiveRange(
1202           RetVal,
1203           E.SVB.getBasicValueFactory().getValue(0, E.ACtx.UnsignedCharTy),
1204           E.SVB.getBasicValueFactory().getMaxValue(E.ACtx.UnsignedCharTy),
1205           true);
1206       if (!StateNotFailed)
1207         return;
1208       C.addTransition(StateNotFailed);
1209     } else {
1210       // Generate a transition for the success state of `fgets`.
1211       std::optional<DefinedSVal> GetBuf =
1212           Call.getArgSVal(0).getAs<DefinedSVal>();
1213       if (!GetBuf)
1214         return;
1215       ProgramStateRef StateNotFailed =
1216           State->BindExpr(E.CE, C.getLocationContext(), *GetBuf);
1217       StateNotFailed =
1218           E.setStreamState(StateNotFailed, StreamState::getOpened(Desc));
1219       C.addTransition(StateNotFailed);
1220     }
1221   }
1222 
1223   // Add transition for the failed state.
1224   ProgramStateRef StateFailed;
1225   if (SingleChar)
1226     StateFailed = E.bindReturnValue(State, C, *EofVal);
1227   else
1228     StateFailed = E.bindNullReturnValue(State, C);
1229 
1230   // If a (non-EOF) error occurs, the resulting value of the file position
1231   // indicator for the stream is indeterminate.
1232   StreamErrorState NewES =
1233       E.isStreamEof() ? ErrorFEof : ErrorFEof | ErrorFError;
1234   StateFailed = E.setStreamState(
1235       StateFailed, StreamState::getOpened(Desc, NewES, !NewES.isFEof()));
1236   C.addTransition(StateFailed, E.getFailureNoteTag(this, C));
1237 }
1238 
1239 void StreamChecker::evalFputx(const FnDescription *Desc, const CallEvent &Call,
1240                               CheckerContext &C, bool IsSingleChar) const {
1241   // `fputc` returns the written character on success, otherwise returns EOF.
1242   // `fputs` returns a nonnegative value on success, otherwise returns EOF.
1243 
1244   ProgramStateRef State = C.getState();
1245   StreamOperationEvaluator E(C);
1246   if (!E.Init(Desc, Call, C, State))
1247     return;
1248 
1249   if (IsSingleChar) {
1250     // Generate a transition for the success state of `fputc`.
1251     std::optional<NonLoc> PutVal = Call.getArgSVal(0).getAs<NonLoc>();
1252     if (!PutVal)
1253       return;
1254     ProgramStateRef StateNotFailed =
1255         State->BindExpr(E.CE, C.getLocationContext(), *PutVal);
1256     StateNotFailed =
1257         E.setStreamState(StateNotFailed, StreamState::getOpened(Desc));
1258     C.addTransition(StateNotFailed);
1259   } else {
1260     // Generate a transition for the success state of `fputs`.
1261     NonLoc RetVal = makeRetVal(C, E.CE).castAs<NonLoc>();
1262     ProgramStateRef StateNotFailed =
1263         State->BindExpr(E.CE, C.getLocationContext(), RetVal);
1264     StateNotFailed =
1265         E.assumeBinOpNN(StateNotFailed, BO_GE, RetVal, E.getZeroVal(Call));
1266     if (!StateNotFailed)
1267       return;
1268     StateNotFailed =
1269         E.setStreamState(StateNotFailed, StreamState::getOpened(Desc));
1270     C.addTransition(StateNotFailed);
1271   }
1272 
1273   if (!PedanticMode)
1274     return;
1275 
1276   // Add transition for the failed state. The resulting value of the file
1277   // position indicator for the stream is indeterminate.
1278   ProgramStateRef StateFailed = E.bindReturnValue(State, C, *EofVal);
1279   StateFailed = E.setStreamState(
1280       StateFailed, StreamState::getOpened(Desc, ErrorFError, true));
1281   C.addTransition(StateFailed, E.getFailureNoteTag(this, C));
1282 }
1283 
1284 void StreamChecker::evalFprintf(const FnDescription *Desc,
1285                                 const CallEvent &Call,
1286                                 CheckerContext &C) const {
1287   if (Call.getNumArgs() < 2)
1288     return;
1289 
1290   ProgramStateRef State = C.getState();
1291   StreamOperationEvaluator E(C);
1292   if (!E.Init(Desc, Call, C, State))
1293     return;
1294 
1295   NonLoc RetVal = makeRetVal(C, E.CE).castAs<NonLoc>();
1296   State = State->BindExpr(E.CE, C.getLocationContext(), RetVal);
1297   auto Cond =
1298       E.SVB
1299           .evalBinOp(State, BO_GE, RetVal, E.SVB.makeZeroVal(E.ACtx.IntTy),
1300                      E.SVB.getConditionType())
1301           .getAs<DefinedOrUnknownSVal>();
1302   if (!Cond)
1303     return;
1304   ProgramStateRef StateNotFailed, StateFailed;
1305   std::tie(StateNotFailed, StateFailed) = State->assume(*Cond);
1306 
1307   StateNotFailed =
1308       E.setStreamState(StateNotFailed, StreamState::getOpened(Desc));
1309   C.addTransition(StateNotFailed);
1310 
1311   if (!PedanticMode)
1312     return;
1313 
1314   // Add transition for the failed state. The resulting value of the file
1315   // position indicator for the stream is indeterminate.
1316   StateFailed = E.setStreamState(
1317       StateFailed, StreamState::getOpened(Desc, ErrorFError, true));
1318   C.addTransition(StateFailed, E.getFailureNoteTag(this, C));
1319 }
1320 
1321 void StreamChecker::evalFscanf(const FnDescription *Desc, const CallEvent &Call,
1322                                CheckerContext &C) const {
1323   if (Call.getNumArgs() < 2)
1324     return;
1325 
1326   ProgramStateRef State = C.getState();
1327   StreamOperationEvaluator E(C);
1328   if (!E.Init(Desc, Call, C, State))
1329     return;
1330 
1331   // Add the success state.
1332   // In this context "success" means there is not an EOF or other read error
1333   // before any item is matched in 'fscanf'. But there may be match failure,
1334   // therefore return value can be 0 or greater.
1335   // It is not specified what happens if some items (not all) are matched and
1336   // then EOF or read error happens. Now this case is handled like a "success"
1337   // case, and no error flags are set on the stream. This is probably not
1338   // accurate, and the POSIX documentation does not tell more.
1339   if (!E.isStreamEof()) {
1340     NonLoc RetVal = makeRetVal(C, E.CE).castAs<NonLoc>();
1341     ProgramStateRef StateNotFailed =
1342         State->BindExpr(E.CE, C.getLocationContext(), RetVal);
1343     StateNotFailed =
1344         E.assumeBinOpNN(StateNotFailed, BO_GE, RetVal, E.getZeroVal(Call));
1345     if (!StateNotFailed)
1346       return;
1347 
1348     if (auto const *Callee = Call.getCalleeIdentifier();
1349         !Callee || Callee->getName() != "vfscanf") {
1350       SmallVector<unsigned int> EscArgs;
1351       for (auto EscArg : llvm::seq(2u, Call.getNumArgs()))
1352         EscArgs.push_back(EscArg);
1353       StateNotFailed = escapeArgs(StateNotFailed, C, Call, EscArgs);
1354     }
1355 
1356     if (StateNotFailed)
1357       C.addTransition(StateNotFailed);
1358   }
1359 
1360   // Add transition for the failed state.
1361   // Error occurs if nothing is matched yet and reading the input fails.
1362   // Error can be EOF, or other error. At "other error" FERROR or 'errno' can
1363   // be set but it is not further specified if all are required to be set.
1364   // Documentation does not mention, but file position will be set to
1365   // indeterminate similarly as at 'fread'.
1366   ProgramStateRef StateFailed = E.bindReturnValue(State, C, *EofVal);
1367   StreamErrorState NewES =
1368       E.isStreamEof() ? ErrorFEof : ErrorNone | ErrorFEof | ErrorFError;
1369   StateFailed = E.setStreamState(
1370       StateFailed, StreamState::getOpened(Desc, NewES, !NewES.isFEof()));
1371   C.addTransition(StateFailed, E.getFailureNoteTag(this, C));
1372 }
1373 
1374 void StreamChecker::evalUngetc(const FnDescription *Desc, const CallEvent &Call,
1375                                CheckerContext &C) const {
1376   ProgramStateRef State = C.getState();
1377   StreamOperationEvaluator E(C);
1378   if (!E.Init(Desc, Call, C, State))
1379     return;
1380 
1381   // Generate a transition for the success state.
1382   std::optional<NonLoc> PutVal = Call.getArgSVal(0).getAs<NonLoc>();
1383   if (!PutVal)
1384     return;
1385   ProgramStateRef StateNotFailed = E.bindReturnValue(State, C, *PutVal);
1386   StateNotFailed =
1387       E.setStreamState(StateNotFailed, StreamState::getOpened(Desc));
1388   C.addTransition(StateNotFailed);
1389 
1390   // Add transition for the failed state.
1391   // Failure of 'ungetc' does not result in feof or ferror state.
1392   // If the PutVal has value of EofVal the function should "fail", but this is
1393   // the same transition as the success state.
1394   // In this case only one state transition is added by the analyzer (the two
1395   // new states may be similar).
1396   ProgramStateRef StateFailed = E.bindReturnValue(State, C, *EofVal);
1397   StateFailed = E.setStreamState(StateFailed, StreamState::getOpened(Desc));
1398   C.addTransition(StateFailed);
1399 }
1400 
1401 void StreamChecker::evalGetdelim(const FnDescription *Desc,
1402                                  const CallEvent &Call,
1403                                  CheckerContext &C) const {
1404   ProgramStateRef State = C.getState();
1405   StreamOperationEvaluator E(C);
1406   if (!E.Init(Desc, Call, C, State))
1407     return;
1408 
1409   // Upon successful completion, the getline() and getdelim() functions shall
1410   // return the number of bytes written into the buffer.
1411   // If the end-of-file indicator for the stream is set, the function shall
1412   // return -1.
1413   // If an error occurs, the function shall return -1 and set 'errno'.
1414 
1415   if (!E.isStreamEof()) {
1416     // Escape buffer and size (may change by the call).
1417     // May happen even at error (partial read?).
1418     State = escapeArgs(State, C, Call, {0, 1});
1419 
1420     // Add transition for the successful state.
1421     NonLoc RetVal = makeRetVal(C, E.CE).castAs<NonLoc>();
1422     ProgramStateRef StateNotFailed = E.bindReturnValue(State, C, RetVal);
1423     StateNotFailed =
1424         E.assumeBinOpNN(StateNotFailed, BO_GE, RetVal, E.getZeroVal(Call));
1425 
1426     // On success, a buffer is allocated.
1427     auto NewLinePtr = getPointeeVal(Call.getArgSVal(0), State);
1428     if (NewLinePtr && isa<DefinedOrUnknownSVal>(*NewLinePtr))
1429       StateNotFailed = StateNotFailed->assume(
1430           NewLinePtr->castAs<DefinedOrUnknownSVal>(), true);
1431 
1432     // The buffer size `*n` must be enough to hold the whole line, and
1433     // greater than the return value, since it has to account for '\0'.
1434     SVal SizePtrSval = Call.getArgSVal(1);
1435     auto NVal = getPointeeVal(SizePtrSval, State);
1436     if (NVal && isa<NonLoc>(*NVal)) {
1437       StateNotFailed = E.assumeBinOpNN(StateNotFailed, BO_GT,
1438                                        NVal->castAs<NonLoc>(), RetVal);
1439       StateNotFailed = E.bindReturnValue(StateNotFailed, C, RetVal);
1440     }
1441     if (!StateNotFailed)
1442       return;
1443     C.addTransition(StateNotFailed);
1444   }
1445 
1446   // Add transition for the failed state.
1447   // If a (non-EOF) error occurs, the resulting value of the file position
1448   // indicator for the stream is indeterminate.
1449   ProgramStateRef StateFailed = E.bindReturnValue(State, C, -1);
1450   StreamErrorState NewES =
1451       E.isStreamEof() ? ErrorFEof : ErrorFEof | ErrorFError;
1452   StateFailed = E.setStreamState(
1453       StateFailed, StreamState::getOpened(Desc, NewES, !NewES.isFEof()));
1454   // On failure, the content of the buffer is undefined.
1455   if (auto NewLinePtr = getPointeeVal(Call.getArgSVal(0), State))
1456     StateFailed = StateFailed->bindLoc(*NewLinePtr, UndefinedVal(),
1457                                        C.getLocationContext());
1458   C.addTransition(StateFailed, E.getFailureNoteTag(this, C));
1459 }
1460 
1461 void StreamChecker::preFseek(const FnDescription *Desc, const CallEvent &Call,
1462                              CheckerContext &C) const {
1463   ProgramStateRef State = C.getState();
1464   SVal StreamVal = getStreamArg(Desc, Call);
1465   State = ensureStreamNonNull(StreamVal, Call.getArgExpr(Desc->StreamArgNo), C,
1466                               State);
1467   if (!State)
1468     return;
1469   State = ensureStreamOpened(StreamVal, C, State);
1470   if (!State)
1471     return;
1472   State = ensureFseekWhenceCorrect(Call.getArgSVal(2), C, State);
1473   if (!State)
1474     return;
1475 
1476   C.addTransition(State);
1477 }
1478 
1479 void StreamChecker::evalFseek(const FnDescription *Desc, const CallEvent &Call,
1480                               CheckerContext &C) const {
1481   ProgramStateRef State = C.getState();
1482   StreamOperationEvaluator E(C);
1483   if (!E.Init(Desc, Call, C, State))
1484     return;
1485 
1486   // Add success state.
1487   ProgramStateRef StateNotFailed = E.bindReturnValue(State, C, 0);
1488   // No failure: Reset the state to opened with no error.
1489   StateNotFailed =
1490       E.setStreamState(StateNotFailed, StreamState::getOpened(Desc));
1491   C.addTransition(StateNotFailed);
1492 
1493   if (!PedanticMode)
1494     return;
1495 
1496   // Add failure state.
1497   // At error it is possible that fseek fails but sets none of the error flags.
1498   // If fseek failed, assume that the file position becomes indeterminate in any
1499   // case.
1500   // It is allowed to set the position beyond the end of the file. EOF error
1501   // should not occur.
1502   ProgramStateRef StateFailed = E.bindReturnValue(State, C, -1);
1503   StateFailed = E.setStreamState(
1504       StateFailed, StreamState::getOpened(Desc, ErrorNone | ErrorFError, true));
1505   C.addTransition(StateFailed, E.getFailureNoteTag(this, C));
1506 }
1507 
1508 void StreamChecker::evalFgetpos(const FnDescription *Desc,
1509                                 const CallEvent &Call,
1510                                 CheckerContext &C) const {
1511   ProgramStateRef State = C.getState();
1512   StreamOperationEvaluator E(C);
1513   if (!E.Init(Desc, Call, C, State))
1514     return;
1515 
1516   ProgramStateRef StateNotFailed, StateFailed;
1517   std::tie(StateFailed, StateNotFailed) = E.makeRetValAndAssumeDual(State, C);
1518   StateNotFailed = escapeArgs(StateNotFailed, C, Call, {1});
1519 
1520   // This function does not affect the stream state.
1521   // Still we add success and failure state with the appropriate return value.
1522   // StdLibraryFunctionsChecker can change these states (set the 'errno' state).
1523   C.addTransition(StateNotFailed);
1524   C.addTransition(StateFailed);
1525 }
1526 
1527 void StreamChecker::evalFsetpos(const FnDescription *Desc,
1528                                 const CallEvent &Call,
1529                                 CheckerContext &C) const {
1530   ProgramStateRef State = C.getState();
1531   StreamOperationEvaluator E(C);
1532   if (!E.Init(Desc, Call, C, State))
1533     return;
1534 
1535   ProgramStateRef StateNotFailed, StateFailed;
1536   std::tie(StateFailed, StateNotFailed) = E.makeRetValAndAssumeDual(State, C);
1537 
1538   StateNotFailed = E.setStreamState(
1539       StateNotFailed, StreamState::getOpened(Desc, ErrorNone, false));
1540   C.addTransition(StateNotFailed);
1541 
1542   if (!PedanticMode)
1543     return;
1544 
1545   // At failure ferror could be set.
1546   // The standards do not tell what happens with the file position at failure.
1547   // But we can assume that it is dangerous to make a next I/O operation after
1548   // the position was not set correctly (similar to 'fseek').
1549   StateFailed = E.setStreamState(
1550       StateFailed, StreamState::getOpened(Desc, ErrorNone | ErrorFError, true));
1551 
1552   C.addTransition(StateFailed, E.getFailureNoteTag(this, C));
1553 }
1554 
1555 void StreamChecker::evalFtell(const FnDescription *Desc, const CallEvent &Call,
1556                               CheckerContext &C) const {
1557   ProgramStateRef State = C.getState();
1558   StreamOperationEvaluator E(C);
1559   if (!E.Init(Desc, Call, C, State))
1560     return;
1561 
1562   NonLoc RetVal = makeRetVal(C, E.CE).castAs<NonLoc>();
1563   ProgramStateRef StateNotFailed =
1564       State->BindExpr(E.CE, C.getLocationContext(), RetVal);
1565   StateNotFailed =
1566       E.assumeBinOpNN(StateNotFailed, BO_GE, RetVal, E.getZeroVal(Call));
1567   if (!StateNotFailed)
1568     return;
1569 
1570   ProgramStateRef StateFailed = E.bindReturnValue(State, C, -1);
1571 
1572   // This function does not affect the stream state.
1573   // Still we add success and failure state with the appropriate return value.
1574   // StdLibraryFunctionsChecker can change these states (set the 'errno' state).
1575   C.addTransition(StateNotFailed);
1576   C.addTransition(StateFailed);
1577 }
1578 
1579 void StreamChecker::evalRewind(const FnDescription *Desc, const CallEvent &Call,
1580                                CheckerContext &C) const {
1581   ProgramStateRef State = C.getState();
1582   StreamOperationEvaluator E(C);
1583   if (!E.Init(Desc, Call, C, State))
1584     return;
1585 
1586   State =
1587       E.setStreamState(State, StreamState::getOpened(Desc, ErrorNone, false));
1588   C.addTransition(State);
1589 }
1590 
1591 void StreamChecker::preFflush(const FnDescription *Desc, const CallEvent &Call,
1592                               CheckerContext &C) const {
1593   ProgramStateRef State = C.getState();
1594   SVal StreamVal = getStreamArg(Desc, Call);
1595   std::optional<DefinedSVal> Stream = StreamVal.getAs<DefinedSVal>();
1596   if (!Stream)
1597     return;
1598 
1599   ProgramStateRef StateNotNull, StateNull;
1600   std::tie(StateNotNull, StateNull) =
1601       C.getConstraintManager().assumeDual(State, *Stream);
1602   if (StateNotNull && !StateNull)
1603     ensureStreamOpened(StreamVal, C, StateNotNull);
1604 }
1605 
1606 void StreamChecker::evalFflush(const FnDescription *Desc, const CallEvent &Call,
1607                                CheckerContext &C) const {
1608   ProgramStateRef State = C.getState();
1609   SVal StreamVal = getStreamArg(Desc, Call);
1610   std::optional<DefinedSVal> Stream = StreamVal.getAs<DefinedSVal>();
1611   if (!Stream)
1612     return;
1613 
1614   // Skip if the stream can be both NULL and non-NULL.
1615   ProgramStateRef StateNotNull, StateNull;
1616   std::tie(StateNotNull, StateNull) =
1617       C.getConstraintManager().assumeDual(State, *Stream);
1618   if (StateNotNull && StateNull)
1619     return;
1620   if (StateNotNull && !StateNull)
1621     State = StateNotNull;
1622   else
1623     State = StateNull;
1624 
1625   const CallExpr *CE = dyn_cast_or_null<CallExpr>(Call.getOriginExpr());
1626   if (!CE)
1627     return;
1628 
1629   // `fflush` returns EOF on failure, otherwise returns 0.
1630   ProgramStateRef StateFailed = bindInt(*EofVal, State, C, CE);
1631   ProgramStateRef StateNotFailed = bindInt(0, State, C, CE);
1632 
1633   // Clear error states if `fflush` returns 0, but retain their EOF flags.
1634   auto ClearErrorInNotFailed = [&StateNotFailed, Desc](SymbolRef Sym,
1635                                                        const StreamState *SS) {
1636     if (SS->ErrorState & ErrorFError) {
1637       StreamErrorState NewES =
1638           (SS->ErrorState & ErrorFEof) ? ErrorFEof : ErrorNone;
1639       StreamState NewSS = StreamState::getOpened(Desc, NewES, false);
1640       StateNotFailed = StateNotFailed->set<StreamMap>(Sym, NewSS);
1641     }
1642   };
1643 
1644   if (StateNotNull && !StateNull) {
1645     // Skip if the input stream's state is unknown, open-failed or closed.
1646     if (SymbolRef StreamSym = StreamVal.getAsSymbol()) {
1647       const StreamState *SS = State->get<StreamMap>(StreamSym);
1648       if (SS) {
1649         assert(SS->isOpened() && "Stream is expected to be opened");
1650         ClearErrorInNotFailed(StreamSym, SS);
1651       } else
1652         return;
1653     }
1654   } else {
1655     // Clear error states for all streams.
1656     const StreamMapTy &Map = StateNotFailed->get<StreamMap>();
1657     for (const auto &I : Map) {
1658       SymbolRef Sym = I.first;
1659       const StreamState &SS = I.second;
1660       if (SS.isOpened())
1661         ClearErrorInNotFailed(Sym, &SS);
1662     }
1663   }
1664 
1665   C.addTransition(StateNotFailed);
1666   C.addTransition(StateFailed);
1667 }
1668 
1669 void StreamChecker::evalClearerr(const FnDescription *Desc,
1670                                  const CallEvent &Call,
1671                                  CheckerContext &C) const {
1672   ProgramStateRef State = C.getState();
1673   StreamOperationEvaluator E(C);
1674   if (!E.Init(Desc, Call, C, State))
1675     return;
1676 
1677   // FilePositionIndeterminate is not cleared.
1678   State = E.setStreamState(
1679       State,
1680       StreamState::getOpened(Desc, ErrorNone, E.SS->FilePositionIndeterminate));
1681   C.addTransition(State);
1682 }
1683 
1684 void StreamChecker::evalFeofFerror(const FnDescription *Desc,
1685                                    const CallEvent &Call, CheckerContext &C,
1686                                    const StreamErrorState &ErrorKind) const {
1687   ProgramStateRef State = C.getState();
1688   StreamOperationEvaluator E(C);
1689   if (!E.Init(Desc, Call, C, State))
1690     return;
1691 
1692   if (E.SS->ErrorState & ErrorKind) {
1693     // Execution path with error of ErrorKind.
1694     // Function returns true.
1695     // From now on it is the only one error state.
1696     ProgramStateRef TrueState = bindAndAssumeTrue(State, C, E.CE);
1697     C.addTransition(E.setStreamState(
1698         TrueState, StreamState::getOpened(Desc, ErrorKind,
1699                                           E.SS->FilePositionIndeterminate &&
1700                                               !ErrorKind.isFEof())));
1701   }
1702   if (StreamErrorState NewES = E.SS->ErrorState & (~ErrorKind)) {
1703     // Execution path(s) with ErrorKind not set.
1704     // Function returns false.
1705     // New error state is everything before minus ErrorKind.
1706     ProgramStateRef FalseState = E.bindReturnValue(State, C, 0);
1707     C.addTransition(E.setStreamState(
1708         FalseState,
1709         StreamState::getOpened(
1710             Desc, NewES, E.SS->FilePositionIndeterminate && !NewES.isFEof())));
1711   }
1712 }
1713 
1714 void StreamChecker::evalFileno(const FnDescription *Desc, const CallEvent &Call,
1715                                CheckerContext &C) const {
1716   // Fileno should fail only if the passed pointer is invalid.
1717   // Some of the preconditions are checked already in preDefault.
1718   // Here we can assume that the operation does not fail, because if we
1719   // introduced a separate branch where fileno() returns -1, then it would cause
1720   // many unexpected and unwanted warnings in situations where fileno() is
1721   // called on valid streams.
1722   // The stream error states are not modified by 'fileno', and 'errno' is also
1723   // left unchanged (so this evalCall does not invalidate it, but we have a
1724   // custom evalCall instead of the default that would invalidate it).
1725   ProgramStateRef State = C.getState();
1726   StreamOperationEvaluator E(C);
1727   if (!E.Init(Desc, Call, C, State))
1728     return;
1729 
1730   NonLoc RetVal = makeRetVal(C, E.CE).castAs<NonLoc>();
1731   State = State->BindExpr(E.CE, C.getLocationContext(), RetVal);
1732   State = E.assumeBinOpNN(State, BO_GE, RetVal, E.getZeroVal(Call));
1733   if (!State)
1734     return;
1735 
1736   C.addTransition(State);
1737 }
1738 
1739 void StreamChecker::preDefault(const FnDescription *Desc, const CallEvent &Call,
1740                                CheckerContext &C) const {
1741   ProgramStateRef State = C.getState();
1742   SVal StreamVal = getStreamArg(Desc, Call);
1743   State = ensureStreamNonNull(StreamVal, Call.getArgExpr(Desc->StreamArgNo), C,
1744                               State);
1745   if (!State)
1746     return;
1747   State = ensureStreamOpened(StreamVal, C, State);
1748   if (!State)
1749     return;
1750 
1751   C.addTransition(State);
1752 }
1753 
1754 void StreamChecker::evalSetFeofFerror(const FnDescription *Desc,
1755                                       const CallEvent &Call, CheckerContext &C,
1756                                       const StreamErrorState &ErrorKind,
1757                                       bool Indeterminate) const {
1758   ProgramStateRef State = C.getState();
1759   SymbolRef StreamSym = getStreamArg(Desc, Call).getAsSymbol();
1760   assert(StreamSym && "Operation not permitted on non-symbolic stream value.");
1761   const StreamState *SS = State->get<StreamMap>(StreamSym);
1762   assert(SS && "Stream should be tracked by the checker.");
1763   State = State->set<StreamMap>(
1764       StreamSym,
1765       StreamState::getOpened(SS->LastOperation, ErrorKind, Indeterminate));
1766   C.addTransition(State);
1767 }
1768 
1769 ProgramStateRef
1770 StreamChecker::ensureStreamNonNull(SVal StreamVal, const Expr *StreamE,
1771                                    CheckerContext &C,
1772                                    ProgramStateRef State) const {
1773   auto Stream = StreamVal.getAs<DefinedSVal>();
1774   if (!Stream)
1775     return State;
1776 
1777   ConstraintManager &CM = C.getConstraintManager();
1778 
1779   ProgramStateRef StateNotNull, StateNull;
1780   std::tie(StateNotNull, StateNull) = CM.assumeDual(State, *Stream);
1781 
1782   if (!StateNotNull && StateNull) {
1783     if (ExplodedNode *N = C.generateErrorNode(StateNull)) {
1784       auto R = std::make_unique<PathSensitiveBugReport>(
1785           BT_FileNull, "Stream pointer might be NULL.", N);
1786       if (StreamE)
1787         bugreporter::trackExpressionValue(N, StreamE, *R);
1788       C.emitReport(std::move(R));
1789     }
1790     return nullptr;
1791   }
1792 
1793   return StateNotNull;
1794 }
1795 
1796 ProgramStateRef StreamChecker::ensureStreamOpened(SVal StreamVal,
1797                                                   CheckerContext &C,
1798                                                   ProgramStateRef State) const {
1799   SymbolRef Sym = StreamVal.getAsSymbol();
1800   if (!Sym)
1801     return State;
1802 
1803   const StreamState *SS = State->get<StreamMap>(Sym);
1804   if (!SS)
1805     return State;
1806 
1807   if (SS->isClosed()) {
1808     // Using a stream pointer after 'fclose' causes undefined behavior
1809     // according to cppreference.com .
1810     ExplodedNode *N = C.generateErrorNode();
1811     if (N) {
1812       C.emitReport(std::make_unique<PathSensitiveBugReport>(
1813           BT_UseAfterClose,
1814           "Stream might be already closed. Causes undefined behaviour.", N));
1815       return nullptr;
1816     }
1817 
1818     return State;
1819   }
1820 
1821   if (SS->isOpenFailed()) {
1822     // Using a stream that has failed to open is likely to cause problems.
1823     // This should usually not occur because stream pointer is NULL.
1824     // But freopen can cause a state when stream pointer remains non-null but
1825     // failed to open.
1826     ExplodedNode *N = C.generateErrorNode();
1827     if (N) {
1828       C.emitReport(std::make_unique<PathSensitiveBugReport>(
1829           BT_UseAfterOpenFailed,
1830           "Stream might be invalid after "
1831           "(re-)opening it has failed. "
1832           "Can cause undefined behaviour.",
1833           N));
1834       return nullptr;
1835     }
1836   }
1837 
1838   return State;
1839 }
1840 
1841 ProgramStateRef StreamChecker::ensureNoFilePositionIndeterminate(
1842     SVal StreamVal, CheckerContext &C, ProgramStateRef State) const {
1843   static const char *BugMessage =
1844       "File position of the stream might be 'indeterminate' "
1845       "after a failed operation. "
1846       "Can cause undefined behavior.";
1847 
1848   SymbolRef Sym = StreamVal.getAsSymbol();
1849   if (!Sym)
1850     return State;
1851 
1852   const StreamState *SS = State->get<StreamMap>(Sym);
1853   if (!SS)
1854     return State;
1855 
1856   assert(SS->isOpened() && "First ensure that stream is opened.");
1857 
1858   if (SS->FilePositionIndeterminate) {
1859     if (SS->ErrorState & ErrorFEof) {
1860       // The error is unknown but may be FEOF.
1861       // Continue analysis with the FEOF error state.
1862       // Report warning because the other possible error states.
1863       ExplodedNode *N = C.generateNonFatalErrorNode(State);
1864       if (!N)
1865         return nullptr;
1866 
1867       auto R = std::make_unique<PathSensitiveBugReport>(
1868           BT_IndeterminatePosition, BugMessage, N);
1869       R->markInteresting(Sym);
1870       C.emitReport(std::move(R));
1871       return State->set<StreamMap>(
1872           Sym, StreamState::getOpened(SS->LastOperation, ErrorFEof, false));
1873     }
1874 
1875     // Known or unknown error state without FEOF possible.
1876     // Stop analysis, report error.
1877     if (ExplodedNode *N = C.generateErrorNode(State)) {
1878       auto R = std::make_unique<PathSensitiveBugReport>(
1879           BT_IndeterminatePosition, BugMessage, N);
1880       R->markInteresting(Sym);
1881       C.emitReport(std::move(R));
1882     }
1883 
1884     return nullptr;
1885   }
1886 
1887   return State;
1888 }
1889 
1890 ProgramStateRef
1891 StreamChecker::ensureFseekWhenceCorrect(SVal WhenceVal, CheckerContext &C,
1892                                         ProgramStateRef State) const {
1893   std::optional<nonloc::ConcreteInt> CI =
1894       WhenceVal.getAs<nonloc::ConcreteInt>();
1895   if (!CI)
1896     return State;
1897 
1898   int64_t X = CI->getValue().getSExtValue();
1899   if (X == SeekSetVal || X == SeekCurVal || X == SeekEndVal)
1900     return State;
1901 
1902   if (ExplodedNode *N = C.generateNonFatalErrorNode(State)) {
1903     C.emitReport(std::make_unique<PathSensitiveBugReport>(
1904         BT_IllegalWhence,
1905         "The whence argument to fseek() should be "
1906         "SEEK_SET, SEEK_END, or SEEK_CUR.",
1907         N));
1908     return nullptr;
1909   }
1910 
1911   return State;
1912 }
1913 
1914 void StreamChecker::reportFEofWarning(SymbolRef StreamSym, CheckerContext &C,
1915                                       ProgramStateRef State) const {
1916   if (ExplodedNode *N = C.generateNonFatalErrorNode(State)) {
1917     auto R = std::make_unique<PathSensitiveBugReport>(
1918         BT_StreamEof,
1919         "Read function called when stream is in EOF state. "
1920         "Function has no effect.",
1921         N);
1922     R->markInteresting(StreamSym);
1923     C.emitReport(std::move(R));
1924     return;
1925   }
1926   C.addTransition(State);
1927 }
1928 
1929 ExplodedNode *
1930 StreamChecker::reportLeaks(const SmallVector<SymbolRef, 2> &LeakedSyms,
1931                            CheckerContext &C, ExplodedNode *Pred) const {
1932   ExplodedNode *Err = C.generateNonFatalErrorNode(C.getState(), Pred);
1933   if (!Err)
1934     return Pred;
1935 
1936   for (SymbolRef LeakSym : LeakedSyms) {
1937     // Resource leaks can result in multiple warning that describe the same kind
1938     // of programming error:
1939     //  void f() {
1940     //    FILE *F = fopen("a.txt");
1941     //    if (rand()) // state split
1942     //      return; // warning
1943     //  } // warning
1944     // While this isn't necessarily true (leaking the same stream could result
1945     // from a different kinds of errors), the reduction in redundant reports
1946     // makes this a worthwhile heuristic.
1947     // FIXME: Add a checker option to turn this uniqueing feature off.
1948     const ExplodedNode *StreamOpenNode = getAcquisitionSite(Err, LeakSym, C);
1949     assert(StreamOpenNode && "Could not find place of stream opening.");
1950 
1951     PathDiagnosticLocation LocUsedForUniqueing;
1952     if (const Stmt *StreamStmt = StreamOpenNode->getStmtForDiagnostics())
1953       LocUsedForUniqueing = PathDiagnosticLocation::createBegin(
1954           StreamStmt, C.getSourceManager(),
1955           StreamOpenNode->getLocationContext());
1956 
1957     std::unique_ptr<PathSensitiveBugReport> R =
1958         std::make_unique<PathSensitiveBugReport>(
1959             BT_ResourceLeak,
1960             "Opened stream never closed. Potential resource leak.", Err,
1961             LocUsedForUniqueing,
1962             StreamOpenNode->getLocationContext()->getDecl());
1963     R->markInteresting(LeakSym);
1964     R->addVisitor<NoStreamStateChangeVisitor>(LeakSym, this);
1965     C.emitReport(std::move(R));
1966   }
1967 
1968   return Err;
1969 }
1970 
1971 void StreamChecker::checkDeadSymbols(SymbolReaper &SymReaper,
1972                                      CheckerContext &C) const {
1973   ProgramStateRef State = C.getState();
1974 
1975   llvm::SmallVector<SymbolRef, 2> LeakedSyms;
1976 
1977   const StreamMapTy &Map = State->get<StreamMap>();
1978   for (const auto &I : Map) {
1979     SymbolRef Sym = I.first;
1980     const StreamState &SS = I.second;
1981     if (!SymReaper.isDead(Sym))
1982       continue;
1983     if (SS.isOpened())
1984       LeakedSyms.push_back(Sym);
1985     State = State->remove<StreamMap>(Sym);
1986   }
1987 
1988   ExplodedNode *N = C.getPredecessor();
1989   if (!LeakedSyms.empty())
1990     N = reportLeaks(LeakedSyms, C, N);
1991 
1992   C.addTransition(State, N);
1993 }
1994 
1995 ProgramStateRef StreamChecker::checkPointerEscape(
1996     ProgramStateRef State, const InvalidatedSymbols &Escaped,
1997     const CallEvent *Call, PointerEscapeKind Kind) const {
1998   // Check for file-handling system call that is not handled by the checker.
1999   // FIXME: The checker should be updated to handle all system calls that take
2000   // 'FILE*' argument. These are now ignored.
2001   if (Kind == PSK_DirectEscapeOnCall && Call->isInSystemHeader())
2002     return State;
2003 
2004   for (SymbolRef Sym : Escaped) {
2005     // The symbol escaped.
2006     // From now the stream can be manipulated in unknown way to the checker,
2007     // it is not possible to handle it any more.
2008     // Optimistically, assume that the corresponding file handle will be closed
2009     // somewhere else.
2010     // Remove symbol from state so the following stream calls on this symbol are
2011     // not handled by the checker.
2012     State = State->remove<StreamMap>(Sym);
2013   }
2014   return State;
2015 }
2016 
2017 //===----------------------------------------------------------------------===//
2018 // Checker registration.
2019 //===----------------------------------------------------------------------===//
2020 
2021 void ento::registerStreamChecker(CheckerManager &Mgr) {
2022   auto *Checker = Mgr.registerChecker<StreamChecker>();
2023   Checker->PedanticMode =
2024       Mgr.getAnalyzerOptions().getCheckerBooleanOption(Checker, "Pedantic");
2025 }
2026 
2027 bool ento::shouldRegisterStreamChecker(const CheckerManager &Mgr) {
2028   return true;
2029 }
2030 
2031 void ento::registerStreamTesterChecker(CheckerManager &Mgr) {
2032   auto *Checker = Mgr.getChecker<StreamChecker>();
2033   Checker->TestMode = true;
2034 }
2035 
2036 bool ento::shouldRegisterStreamTesterChecker(const CheckerManager &Mgr) {
2037   return true;
2038 }
2039