maxjhandsome
/
llvm-project
forked from OSchip/llvm-project
1
0
Fork 0
Code Issues Pull Requests Packages Releases Wiki Activity

Fix null pointer dereference in StreamChecker::Fseek (reported in PR 8081) and simplify surrounding checking logic. 

llvm-svn: 113282
This commit is contained in:
Ted Kremenek 2010-09-07 20:45:26 +00:00
parent 420c8a604f
commit aba4958db2
2 changed files with 18 additions and 17 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

29
clang/lib/Checker/StreamChecker.cpp
View File

@ -271,29 +271,24 @@ void StreamChecker::Fseek(CheckerContext &C, const CallExpr *CE) {
return;
// Check the legality of the 'whence' argument of 'fseek'.
SVal Whence = state->getSVal(CE->getArg(2));
bool WhenceIsLegal = true;
const nonloc::ConcreteInt *CI = dyn_cast<nonloc::ConcreteInt>(&Whence);
if (!CI)
WhenceIsLegal = false;
return;
int64_t x = CI->getValue().getSExtValue();
if (!(x == 0 || x == 1 || x == 2))
WhenceIsLegal = false;
if (!WhenceIsLegal) {
if (ExplodedNode *N = C.GenerateSink(state)) {
if (!BT_illegalwhence)
BT_illegalwhence = new BuiltinBug("Illegal whence argument",
"The whence argument to fseek() should be "
"SEEK_SET, SEEK_END, or SEEK_CUR.");
BugReport *R = new BugReport(*BT_illegalwhence,
BT_illegalwhence->getDescription(), N);
C.EmitReport(R);
}
if (x >= 0 && x <= 2)
return;
}
C.addTransition(state);
if (ExplodedNode *N = C.GenerateNode(state)) {
if (!BT_illegalwhence)
BT_illegalwhence = new BuiltinBug("Illegal whence argument",
"The whence argument to fseek() should be "
"SEEK_SET, SEEK_END, or SEEK_CUR.");
BugReport *R = new BugReport(*BT_illegalwhence,
BT_illegalwhence->getDescription(), N);
C.EmitReport(R);
}
}
void StreamChecker::Ftell(CheckerContext &C, const CallExpr *CE) {

6
clang/test/Analysis/stream.c
View File

@ -77,3 +77,9 @@ FILE *f9(void) {
void pr7831(FILE *fp) {
fclose(fp); // no-warning
}
// PR 8081 - null pointer crash when 'whence' is not an integer constant
void pr8081(FILE *stream, long offset, int whence) {
fseek(stream, offset, whence);
}