76a21502fd
ClangCheckerRegistry is a very non-obvious, poorly documented, weird concept. It derives from CheckerRegistry, and is placed in lib/StaticAnalyzer/Frontend, whereas it's base is located in lib/StaticAnalyzer/Core. It was, from what I can imagine, used to circumvent the problem that the registry functions of the checkers are located in the clangStaticAnalyzerCheckers library, but that library depends on clangStaticAnalyzerCore. However, clangStaticAnalyzerFrontend depends on both of those libraries. One can make the observation however, that CheckerRegistry has no place in Core, it isn't used there at all! The only place where it is used is Frontend, which is where it ultimately belongs. This move implies that since include/clang/StaticAnalyzer/Checkers/ClangCheckers.h only contained a single function: class CheckerRegistry; void registerBuiltinCheckers(CheckerRegistry ®istry); it had to re purposed, as CheckerRegistry is no longer available to clangStaticAnalyzerCheckers. It was renamed to BuiltinCheckerRegistration.h, which actually describes it a lot better -- it does not contain the registration functions for checkers, but only those generated by the tblgen files. Differential Revision: https://reviews.llvm.org/D54436 llvm-svn: 349275
76 lines
2.4 KiB
C++
76 lines
2.4 KiB
C++
//=== PointerSubChecker.cpp - Pointer subtraction checker ------*- C++ -*--===//
|
|
//
|
|
// The LLVM Compiler Infrastructure
|
|
//
|
|
// This file is distributed under the University of Illinois Open Source
|
|
// License. See LICENSE.TXT for details.
|
|
//
|
|
//===----------------------------------------------------------------------===//
|
|
//
|
|
// This files defines PointerSubChecker, a builtin checker that checks for
|
|
// pointer subtractions on two pointers pointing to different memory chunks.
|
|
// This check corresponds to CWE-469.
|
|
//
|
|
//===----------------------------------------------------------------------===//
|
|
|
|
#include "clang/StaticAnalyzer/Checkers/BuiltinCheckerRegistration.h"
|
|
#include "clang/StaticAnalyzer/Core/BugReporter/BugType.h"
|
|
#include "clang/StaticAnalyzer/Core/Checker.h"
|
|
#include "clang/StaticAnalyzer/Core/CheckerManager.h"
|
|
#include "clang/StaticAnalyzer/Core/PathSensitive/CheckerContext.h"
|
|
|
|
using namespace clang;
|
|
using namespace ento;
|
|
|
|
namespace {
|
|
class PointerSubChecker
|
|
: public Checker< check::PreStmt<BinaryOperator> > {
|
|
mutable std::unique_ptr<BuiltinBug> BT;
|
|
|
|
public:
|
|
void checkPreStmt(const BinaryOperator *B, CheckerContext &C) const;
|
|
};
|
|
}
|
|
|
|
void PointerSubChecker::checkPreStmt(const BinaryOperator *B,
|
|
CheckerContext &C) const {
|
|
// When doing pointer subtraction, if the two pointers do not point to the
|
|
// same memory chunk, emit a warning.
|
|
if (B->getOpcode() != BO_Sub)
|
|
return;
|
|
|
|
SVal LV = C.getSVal(B->getLHS());
|
|
SVal RV = C.getSVal(B->getRHS());
|
|
|
|
const MemRegion *LR = LV.getAsRegion();
|
|
const MemRegion *RR = RV.getAsRegion();
|
|
|
|
if (!(LR && RR))
|
|
return;
|
|
|
|
const MemRegion *BaseLR = LR->getBaseRegion();
|
|
const MemRegion *BaseRR = RR->getBaseRegion();
|
|
|
|
if (BaseLR == BaseRR)
|
|
return;
|
|
|
|
// Allow arithmetic on different symbolic regions.
|
|
if (isa<SymbolicRegion>(BaseLR) || isa<SymbolicRegion>(BaseRR))
|
|
return;
|
|
|
|
if (ExplodedNode *N = C.generateNonFatalErrorNode()) {
|
|
if (!BT)
|
|
BT.reset(
|
|
new BuiltinBug(this, "Pointer subtraction",
|
|
"Subtraction of two pointers that do not point to "
|
|
"the same memory chunk may cause incorrect result."));
|
|
auto R = llvm::make_unique<BugReport>(*BT, BT->getDescription(), N);
|
|
R->addRange(B->getSourceRange());
|
|
C.emitReport(std::move(R));
|
|
}
|
|
}
|
|
|
|
void ento::registerPointerSubChecker(CheckerManager &mgr) {
|
|
mgr.registerChecker<PointerSubChecker>();
|
|
}
|