ArrayBoundChecker.cpp 3.0 KB

123456789101112131415161718192021222324252627282930313233343536373839404142434445464748495051525354555657585960616263646566676869707172737475767778798081828384858687888990919293
  1. //== ArrayBoundChecker.cpp ------------------------------*- C++ -*--==//
  2. //
  3. // The LLVM Compiler Infrastructure
  4. //
  5. // This file is distributed under the University of Illinois Open Source
  6. // License. See LICENSE.TXT for details.
  7. //
  8. //===----------------------------------------------------------------------===//
  9. //
  10. // This file defines ArrayBoundChecker, which is a path-sensitive check
  11. // which looks for an out-of-bound array element access.
  12. //
  13. //===----------------------------------------------------------------------===//
  14. #include "ClangSACheckers.h"
  15. #include "clang/StaticAnalyzer/Core/BugReporter/BugType.h"
  16. #include "clang/StaticAnalyzer/Core/Checker.h"
  17. #include "clang/StaticAnalyzer/Core/CheckerManager.h"
  18. #include "clang/StaticAnalyzer/Core/PathSensitive/CheckerContext.h"
  19. #include "clang/StaticAnalyzer/Core/PathSensitive/ExprEngine.h"
  20. using namespace clang;
  21. using namespace ento;
  22. namespace {
  23. class ArrayBoundChecker :
  24. public Checker<check::Location> {
  25. mutable OwningPtr<BuiltinBug> BT;
  26. public:
  27. void checkLocation(SVal l, bool isLoad, const Stmt* S,
  28. CheckerContext &C) const;
  29. };
  30. }
  31. void ArrayBoundChecker::checkLocation(SVal l, bool isLoad, const Stmt* LoadS,
  32. CheckerContext &C) const {
  33. // Check for out of bound array element access.
  34. const MemRegion *R = l.getAsRegion();
  35. if (!R)
  36. return;
  37. const ElementRegion *ER = dyn_cast<ElementRegion>(R);
  38. if (!ER)
  39. return;
  40. // Get the index of the accessed element.
  41. DefinedOrUnknownSVal Idx = ER->getIndex().castAs<DefinedOrUnknownSVal>();
  42. // Zero index is always in bound, this also passes ElementRegions created for
  43. // pointer casts.
  44. if (Idx.isZeroConstant())
  45. return;
  46. ProgramStateRef state = C.getState();
  47. // Get the size of the array.
  48. DefinedOrUnknownSVal NumElements
  49. = C.getStoreManager().getSizeInElements(state, ER->getSuperRegion(),
  50. ER->getValueType());
  51. ProgramStateRef StInBound = state->assumeInBound(Idx, NumElements, true);
  52. ProgramStateRef StOutBound = state->assumeInBound(Idx, NumElements, false);
  53. if (StOutBound && !StInBound) {
  54. ExplodedNode *N = C.generateSink(StOutBound);
  55. if (!N)
  56. return;
  57. if (!BT)
  58. BT.reset(new BuiltinBug(
  59. this, "Out-of-bound array access",
  60. "Access out-of-bound array element (buffer overflow)"));
  61. // FIXME: It would be nice to eventually make this diagnostic more clear,
  62. // e.g., by referencing the original declaration or by saying *why* this
  63. // reference is outside the range.
  64. // Generate a report for this bug.
  65. BugReport *report =
  66. new BugReport(*BT, BT->getDescription(), N);
  67. report->addRange(LoadS->getSourceRange());
  68. C.emitReport(report);
  69. return;
  70. }
  71. // Array bound check succeeded. From this point forward the array bound
  72. // should always succeed.
  73. C.addTransition(StInBound);
  74. }
  75. void ento::registerArrayBoundChecker(CheckerManager &mgr) {
  76. mgr.registerChecker<ArrayBoundChecker>();
  77. }