forked from OSchip/llvm-project
parent
0e34da42c5
commit
c1c09b1f35
|
@ -1,55 +0,0 @@
|
|||
//===----------------------------------------------------------------------===//
|
||||
// Random notes for the static analysis module.
|
||||
//===----------------------------------------------------------------------===//
|
||||
|
||||
Currently the analyzer with basic store will report false alarm for such code:
|
||||
|
||||
p[0] = "/bin/sh";
|
||||
p[1] = NULL;
|
||||
|
||||
execv(p[0], argv);
|
||||
|
||||
This is because BasicStore "collapses" all elements of an array into their base
|
||||
region. BasicStore should return UnknownVal() when getLValueElement. But that
|
||||
way will break current test in null-deref-ps.c.
|
||||
|
||||
//===----------------------------------------------------------------------===//
|
||||
|
||||
Investigate what classes of exprs are passed silently in GRExprEngine::Visit().
|
||||
|
||||
One is PredefinedExpr.
|
||||
|
||||
//===----------------------------------------------------------------------===//
|
||||
|
||||
Remove PersistentSValPairs and PersistentSVals?
|
||||
|
||||
//===----------------------------------------------------------------------===//
|
||||
|
||||
If the pointer is symbolic, we should expand it to a full region with symbolic
|
||||
values. This can eliminate the following false warning.
|
||||
|
||||
struct file {
|
||||
int lineno;
|
||||
};
|
||||
|
||||
struct file *fileinfo;
|
||||
|
||||
void f10() {
|
||||
int i;
|
||||
int *p = 0;
|
||||
|
||||
if (fileinfo->lineno)
|
||||
p = &i;
|
||||
|
||||
if (fileinfo->lineno)
|
||||
*p = 3; // false warning
|
||||
}
|
||||
|
||||
Now we return a symbolic region for fileinfo->lineno in RegionStore. Loading
|
||||
from it returns an UnknownVal. Therefore the path condition is not recorded.
|
||||
|
||||
Where should we call this ExpandSymbolicPointer method? Perhaps in
|
||||
GRExprEngine::VisitMemberExpr().
|
||||
|
||||
Problem: The base expr of MemberExpr can be in various form. How do we get the
|
||||
pointer varregion(or other kind of region) to be changed?
|
Loading…
Reference in New Issue