forked from OSchip/llvm-project
112 lines
3.5 KiB
C++
112 lines
3.5 KiB
C++
//== NullDerefChecker.cpp - Null dereference checker ------------*- C++ -*--==//
|
|
//
|
|
// The LLVM Compiler Infrastructure
|
|
//
|
|
// This file is distributed under the University of Illinois Open Source
|
|
// License. See LICENSE.TXT for details.
|
|
//
|
|
//===----------------------------------------------------------------------===//
|
|
//
|
|
// This defines NullDerefChecker, a builtin check in GRExprEngine that performs
|
|
// checks for null pointers at loads and stores.
|
|
//
|
|
//===----------------------------------------------------------------------===//
|
|
|
|
#include "clang/Analysis/PathSensitive/Checkers/DereferenceChecker.h"
|
|
#include "clang/Analysis/PathSensitive/GRExprEngine.h"
|
|
#include "clang/Analysis/PathSensitive/BugReporter.h"
|
|
|
|
using namespace clang;
|
|
|
|
void *NullDerefChecker::getTag() {
|
|
static int x = 0;
|
|
return &x;
|
|
}
|
|
|
|
ExplodedNode *NullDerefChecker::CheckLocation(const Stmt *S, ExplodedNode *Pred,
|
|
const GRState *state, SVal V,
|
|
GRExprEngine &Eng) {
|
|
Loc *LV = dyn_cast<Loc>(&V);
|
|
|
|
// If the value is not a location, don't touch the node.
|
|
if (!LV)
|
|
return Pred;
|
|
|
|
const GRState *NotNullState = state->Assume(*LV, true);
|
|
const GRState *NullState = state->Assume(*LV, false);
|
|
|
|
GRStmtNodeBuilder &Builder = Eng.getBuilder();
|
|
BugReporter &BR = Eng.getBugReporter();
|
|
|
|
// The explicit NULL case.
|
|
if (NullState) {
|
|
// Use the GDM to mark in the state what lval was null.
|
|
const SVal *PersistentLV = Eng.getBasicVals().getPersistentSVal(*LV);
|
|
NullState = NullState->set<GRState::NullDerefTag>(PersistentLV);
|
|
|
|
ExplodedNode *N = Builder.generateNode(S, NullState, Pred,
|
|
ProgramPoint::PostNullCheckFailedKind);
|
|
if (N) {
|
|
N->markAsSink();
|
|
|
|
if (!NotNullState) { // Explicit null case.
|
|
if (!BT)
|
|
BT = new BuiltinBug("Null dereference","Dereference of null pointer");
|
|
|
|
EnhancedBugReport *R =
|
|
new EnhancedBugReport(*BT, BT->getDescription().c_str(), N);
|
|
|
|
R->addVisitorCreator(bugreporter::registerTrackNullOrUndefValue,
|
|
bugreporter::GetDerefExpr(N));
|
|
|
|
BR.EmitReport(R);
|
|
|
|
return 0;
|
|
} else // Implicit null case.
|
|
ImplicitNullDerefNodes.push_back(N);
|
|
}
|
|
}
|
|
|
|
if (!NotNullState)
|
|
return 0;
|
|
|
|
return Builder.generateNode(S, NotNullState, Pred,
|
|
ProgramPoint::PostLocationChecksSucceedKind);
|
|
}
|
|
|
|
|
|
void *UndefDerefChecker::getTag() {
|
|
static int x = 0;
|
|
return &x;
|
|
}
|
|
|
|
ExplodedNode *UndefDerefChecker::CheckLocation(const Stmt *S,
|
|
ExplodedNode *Pred,
|
|
const GRState *state, SVal V,
|
|
GRExprEngine &Eng) {
|
|
GRStmtNodeBuilder &Builder = Eng.getBuilder();
|
|
BugReporter &BR = Eng.getBugReporter();
|
|
|
|
if (V.isUndef()) {
|
|
ExplodedNode *N = Builder.generateNode(S, state, Pred,
|
|
ProgramPoint::PostUndefLocationCheckFailedKind);
|
|
if (N) {
|
|
N->markAsSink();
|
|
|
|
if (!BT)
|
|
BT = new BuiltinBug(0, "Undefined dereference",
|
|
"Dereference of undefined pointer value");
|
|
|
|
EnhancedBugReport *R =
|
|
new EnhancedBugReport(*BT, BT->getDescription().c_str(), N);
|
|
R->addVisitorCreator(bugreporter::registerTrackNullOrUndefValue,
|
|
bugreporter::GetDerefExpr(N));
|
|
BR.EmitReport(R);
|
|
}
|
|
return 0;
|
|
}
|
|
|
|
return Pred;
|
|
}
|
|
|