BuiltinFunctionChecker.cpp 4.2 KB

123456789101112131415161718192021222324252627282930313233343536373839404142434445464748495051525354555657585960616263646566676869707172737475767778798081828384858687888990919293949596979899100101102103104105106107108109110111112113114115116117118119120121122
  1. //=== BuiltinFunctionChecker.cpp --------------------------------*- C++ -*-===//
  2. //
  3. // The LLVM Compiler Infrastructure
  4. //
  5. // This file is distributed under the University of Illinois Open Source
  6. // License. See LICENSE.TXT for details.
  7. //
  8. //===----------------------------------------------------------------------===//
  9. //
  10. // This checker evaluates clang builtin functions.
  11. //
  12. //===----------------------------------------------------------------------===//
  13. #include "ClangSACheckers.h"
  14. #include "clang/Basic/Builtins.h"
  15. #include "clang/StaticAnalyzer/Core/Checker.h"
  16. #include "clang/StaticAnalyzer/Core/CheckerManager.h"
  17. #include "clang/StaticAnalyzer/Core/PathSensitive/CheckerContext.h"
  18. using namespace clang;
  19. using namespace ento;
  20. namespace {
  21. class BuiltinFunctionChecker : public Checker<eval::Call> {
  22. public:
  23. bool evalCall(const CallExpr *CE, CheckerContext &C) const;
  24. };
  25. }
  26. bool BuiltinFunctionChecker::evalCall(const CallExpr *CE,
  27. CheckerContext &C) const {
  28. ProgramStateRef state = C.getState();
  29. const FunctionDecl *FD = C.getCalleeDecl(CE);
  30. const LocationContext *LCtx = C.getLocationContext();
  31. if (!FD)
  32. return false;
  33. switch (FD->getBuiltinID()) {
  34. default:
  35. return false;
  36. case Builtin::BI__builtin_assume: {
  37. assert (CE->arg_begin() != CE->arg_end());
  38. SVal ArgSVal = C.getSVal(CE->getArg(0));
  39. if (ArgSVal.isUndef())
  40. return true; // Return true to model purity.
  41. state = state->assume(ArgSVal.castAs<DefinedOrUnknownSVal>(), true);
  42. // FIXME: do we want to warn here? Not right now. The most reports might
  43. // come from infeasible paths, thus being false positives.
  44. if (!state) {
  45. C.generateSink(C.getState(), C.getPredecessor());
  46. return true;
  47. }
  48. C.addTransition(state);
  49. return true;
  50. }
  51. case Builtin::BI__builtin_unpredictable:
  52. case Builtin::BI__builtin_expect:
  53. case Builtin::BI__builtin_assume_aligned:
  54. case Builtin::BI__builtin_addressof: {
  55. // For __builtin_unpredictable, __builtin_expect, and
  56. // __builtin_assume_aligned, just return the value of the subexpression.
  57. // __builtin_addressof is going from a reference to a pointer, but those
  58. // are represented the same way in the analyzer.
  59. assert (CE->arg_begin() != CE->arg_end());
  60. SVal X = C.getSVal(*(CE->arg_begin()));
  61. C.addTransition(state->BindExpr(CE, LCtx, X));
  62. return true;
  63. }
  64. case Builtin::BI__builtin_alloca_with_align:
  65. case Builtin::BI__builtin_alloca: {
  66. // FIXME: Refactor into StoreManager itself?
  67. MemRegionManager& RM = C.getStoreManager().getRegionManager();
  68. const AllocaRegion* R =
  69. RM.getAllocaRegion(CE, C.blockCount(), C.getLocationContext());
  70. // Set the extent of the region in bytes. This enables us to use the
  71. // SVal of the argument directly. If we save the extent in bits, we
  72. // cannot represent values like symbol*8.
  73. auto Size = C.getSVal(*(CE->arg_begin())).castAs<DefinedOrUnknownSVal>();
  74. SValBuilder& svalBuilder = C.getSValBuilder();
  75. DefinedOrUnknownSVal Extent = R->getExtent(svalBuilder);
  76. DefinedOrUnknownSVal extentMatchesSizeArg =
  77. svalBuilder.evalEQ(state, Extent, Size);
  78. state = state->assume(extentMatchesSizeArg, true);
  79. assert(state && "The region should not have any previous constraints");
  80. C.addTransition(state->BindExpr(CE, LCtx, loc::MemRegionVal(R)));
  81. return true;
  82. }
  83. case Builtin::BI__builtin_object_size:
  84. case Builtin::BI__builtin_constant_p: {
  85. // This must be resolvable at compile time, so we defer to the constant
  86. // evaluator for a value.
  87. SVal V = UnknownVal();
  88. Expr::EvalResult EVResult;
  89. if (CE->EvaluateAsInt(EVResult, C.getASTContext(), Expr::SE_NoSideEffects)) {
  90. // Make sure the result has the correct type.
  91. llvm::APSInt Result = EVResult.Val.getInt();
  92. SValBuilder &SVB = C.getSValBuilder();
  93. BasicValueFactory &BVF = SVB.getBasicValueFactory();
  94. BVF.getAPSIntType(CE->getType()).apply(Result);
  95. V = SVB.makeIntVal(Result);
  96. }
  97. C.addTransition(state->BindExpr(CE, LCtx, V));
  98. return true;
  99. }
  100. }
  101. }
  102. void ento::registerBuiltinFunctionChecker(CheckerManager &mgr) {
  103. mgr.registerChecker<BuiltinFunctionChecker>();
  104. }