martong created this revision.
martong added reviewers: Szelethus, NoQ, steakhal.
Herald added subscribers: cfe-commits, ASDenysPetrov, Charusso, gamesh411,
dkrupp, donat.nagy, mikhail.ramalho, a.sidorin, rnkovacs, szepet,
baloghadamsoftware, xazax.hun, whisperity.
Herald added a project: clang.
martong added a parent revision: D77066: [analyzer] ApiModeling: Add buffer
size arg constraint.
Further develop the buffer size argumentum constraint so it can handle sizes
that we can get by multiplying two variables.
Repository:
rG LLVM Github Monorepo
https://reviews.llvm.org/D77148
Files:
clang/lib/StaticAnalyzer/Checkers/StdLibraryFunctionsChecker.cpp
clang/test/Analysis/std-c-library-functions-arg-constraints.c
Index: clang/test/Analysis/std-c-library-functions-arg-constraints.c
===================================================================
--- clang/test/Analysis/std-c-library-functions-arg-constraints.c
+++ clang/test/Analysis/std-c-library-functions-arg-constraints.c
@@ -141,3 +141,27 @@
// bugpath-note{{TRUE}} \
// bugpath-note{{'s' is <= 2}}
}
+int __buf_size_arg_constraint_mul(const void *, size_t, size_t);
+void test_buf_size_concrete_with_multiplication() {
+ short buf[3]; // bugpath-note{{'buf' initialized here}}
+ __buf_size_arg_constraint_mul(buf, 4, sizeof(short)); // \
+ // report-warning{{Function argument constraint is not satisfied}} \
+ // bugpath-warning{{Function argument constraint is not satisfied}} \
+ // bugpath-note{{Function argument constraint is not satisfied}}
+}
+void test_buf_size_symbolic_with_multiplication(size_t s) {
+ short buf[3];
+ __buf_size_arg_constraint_mul(buf, s, sizeof(short));
+ clang_analyzer_eval(s * sizeof(short) <= 6); // \
+ // report-warning{{TRUE}} \
+ // bugpath-warning{{TRUE}} \
+ // bugpath-note{{TRUE}}
+}
+void test_buf_size_symbolic_and_offset_with_multiplication(size_t s) {
+ short buf[3];
+ __buf_size_arg_constraint_mul(buf + 1, s, sizeof(short));
+ clang_analyzer_eval(s * sizeof(short) <= 4); // \
+ // report-warning{{TRUE}} \
+ // bugpath-warning{{TRUE}} \
+ // bugpath-note{{TRUE}}
+}
Index: clang/lib/StaticAnalyzer/Checkers/StdLibraryFunctionsChecker.cpp
===================================================================
--- clang/lib/StaticAnalyzer/Checkers/StdLibraryFunctionsChecker.cpp
+++ clang/lib/StaticAnalyzer/Checkers/StdLibraryFunctionsChecker.cpp
@@ -212,9 +212,16 @@
// Represents a buffer argument with an additional size argument.
// E.g. the first two arguments here:
// ctime_s(char *buffer, rsize_t bufsz, const time_t *time);
+ // Another example:
+ // size_t fread(void *ptr, size_t size, size_t nmemb, FILE *stream);
+ // // Here, ptr is the buffer, and its minimum size is `size * nmemb`.
class BufferSizeConstraint : public ValueConstraint {
// The argument which holds the size of the buffer.
ArgNo SizeArgN;
+ // The argument which is a multiplier to size. This is set in case of
+ // `fread` like functions where the size is computed as a multiplication of
+ // two arguments.
+ llvm::Optional<ArgNo> SizeMultiplierArgN;
// The operator we use in apply. This is negated in negate().
BinaryOperator::Opcode Op = BO_LE;
@@ -222,17 +229,27 @@
BufferSizeConstraint(ArgNo BufArgN, ArgNo SizeArgN)
: ValueConstraint(BufArgN), SizeArgN(SizeArgN) {}
+ BufferSizeConstraint(ArgNo BufArgN, ArgNo SizeArgN, ArgNo SizeMulArgN)
+ : ValueConstraint(BufArgN), SizeArgN(SizeArgN),
+ SizeMultiplierArgN(SizeMulArgN) {}
+
ProgramStateRef apply(ProgramStateRef State, const CallEvent &Call,
const Summary &Summary,
CheckerContext &C) const override {
+ SValBuilder &SvalBuilder = C.getSValBuilder();
// The buffer argument.
SVal BufV = getArgSVal(Call, getArgNo());
// The size argument.
SVal SizeV = getArgSVal(Call, SizeArgN);
+ // Multiply with another argument if given.
+ if (SizeMultiplierArgN) {
+ SVal SizeMulV = getArgSVal(Call, *SizeMultiplierArgN);
+ SizeV = SvalBuilder.evalBinOp(State, BO_Mul, SizeV, SizeMulV,
+ Summary.getArgType(SizeArgN));
+ }
// The dynamic size of the buffer argument, got from the analyzer engine.
SVal BufDynSize = getBufferDynamicSize(BufV, State, C);
- SValBuilder &SvalBuilder = C.getSValBuilder();
SVal Feasible = SvalBuilder.evalBinOp(State, Op, SizeV, BufDynSize,
SvalBuilder.getContext().BoolTy);
if (auto F = Feasible.getAs<DefinedOrUnknownSVal>())
@@ -739,8 +756,8 @@
IntRangeVector Ranges) {
return std::make_shared<RangeConstraint>(ArgN, Kind, Ranges);
};
- auto BufferSize = [](ArgNo BufArgN, ArgNo SizeArgN) {
- return std::make_shared<BufferSizeConstraint>(BufArgN, SizeArgN);
+ auto BufferSize = [](auto ...Args) {
+ return std::make_shared<BufferSizeConstraint>(Args...);
};
struct {
auto operator()(RangeKind Kind, IntRangeVector Ranges) {
@@ -1018,6 +1035,10 @@
Summaries{Summary(ArgTypes{ConstVoidPtrTy, SizeTy}, RetType{IntTy},
EvalCallAsPure)
.ArgConstraint(BufferSize(0, 1))}},
+ {"__buf_size_arg_constraint_mul",
+ Summaries{Summary(ArgTypes{ConstVoidPtrTy, SizeTy, SizeTy}, RetType{IntTy},
+ EvalCallAsPure)
+ .ArgConstraint(BufferSize(0, 1, 2))}},
};
for (auto &E : TestFunctionSummaryMap) {
auto InsertRes =
_______________________________________________
cfe-commits mailing list
cfe-commits@lists.llvm.org
https://lists.llvm.org/cgi-bin/mailman/listinfo/cfe-commits
