https://github.com/matthew-j-code created https://github.com/llvm/llvm-project/pull/231925
When the check clang-analyzer-security.ArrayBound is enabled, for a forward declaration, or any incomplete types, it tries to calculate the offset, which is unknown, therefore can not be calculated, causing the assertion ElemType cannot be incomplete. >From a2ffa678a6ca38cb5cfeffd58a9fa821f8b19aa7 Mon Sep 17 00:00:00 2001 From: "Jones, Matthew (DI SW SIM FRWK PLAT SIMFW HPC)" <[email protected]> Date: Tue, 13 Oct 2026 04:11:46 -0700 Subject: [PATCH] fix for ArrayBound check for incomplete types --- clang/docs/ReleaseNotes.md | 2 ++ clang/lib/StaticAnalyzer/Checkers/ArrayBoundChecker.cpp | 6 ++++++ clang/test/Analysis/ArrayBound/cplusplus.cpp | 8 ++++++++ 3 files changed, 16 insertions(+) diff --git a/clang/docs/ReleaseNotes.md b/clang/docs/ReleaseNotes.md index 1dc1764978ea27..32281e5ad67508 100644 --- a/clang/docs/ReleaseNotes.md +++ b/clang/docs/ReleaseNotes.md @@ -1188,6 +1188,8 @@ features cannot lower the translation-unit ABI level; % - Moved checkers % - Diagnostic changes +- Fixed an assertion failure in the `alpha.security.ArrayBound` checker when analyzing incomplete types. + #### Improvements - The lock-order-reversal check in ``alpha.unix.PthreadLock`` is now disabled by default. diff --git a/clang/lib/StaticAnalyzer/Checkers/ArrayBoundChecker.cpp b/clang/lib/StaticAnalyzer/Checkers/ArrayBoundChecker.cpp index 3acbf7cd75ab88..e75d43801864a1 100644 --- a/clang/lib/StaticAnalyzer/Checkers/ArrayBoundChecker.cpp +++ b/clang/lib/StaticAnalyzer/Checkers/ArrayBoundChecker.cpp @@ -230,6 +230,12 @@ computeOffset(ProgramStateRef State, SValBuilder &SVB, if (!Index) return std::nullopt; + // The size of an incomplete type (e.g forward declaration) is unknown, so + // the offset cannot be calculated. + QualType ElemType = CurRegion->getElementType(); + if (ElemType->isIncompleteType()) + return std::nullopt; + // Calculate Delta = Index * sizeof(ElemType). NonLoc Size = SVB.makeArrayIndex(getElementSize(CurRegion, SVB)); auto Delta = EvalBinOp(BO_Mul, *Index, Size); diff --git a/clang/test/Analysis/ArrayBound/cplusplus.cpp b/clang/test/Analysis/ArrayBound/cplusplus.cpp index 680fbf4817c301..457da1f15307ea 100644 --- a/clang/test/Analysis/ArrayBound/cplusplus.cpp +++ b/clang/test/Analysis/ArrayBound/cplusplus.cpp @@ -179,3 +179,11 @@ int test_reference_that_might_be_after_the_end(int idx) { return -1; return ref; } + +//The size of an incomplete type (e.g., a forward declaration) is unknown, so you cannot calculate the offset. +struct Incomplete; +void useIncomplete(Incomplete &); + +void test_incomplete(void *p) { + useIncomplete(*static_cast<Incomplete *>(p)); +} _______________________________________________ cfe-commits mailing list [email protected] https://lists.llvm.org/cgi-bin/mailman/listinfo/cfe-commits
