replica
/
hanchenye-llvm-project
2
0
Fork 0
Code Issues Pull Requests Projects Releases Wiki Activity

Fix crash in StoreManager::CastRegion() when the base region is a type with 0 size. 

llvm-svn: 100594
This commit is contained in:
Ted Kremenek 2010-04-07 00:46:49 +00:00
parent 8e36d53e34
commit 6e95bfc6a5
2 changed files with 16 additions and 7 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

15
clang/lib/Checker/Store.cpp
View File

@ -170,13 +170,14 @@ const MemRegion *StoreManager::CastRegion(const MemRegion *R, QualType CastToTy)
if (IsCompleteType(Ctx, PointeeTy)) {
// Compute the size in **bytes**.
CharUnits pointeeTySize = Ctx.getTypeSizeInChars(PointeeTy);
// Is the offset a multiple of the size? If so, we can layer the
// ElementRegion (with elementType == PointeeTy) directly on top of
// the base region.
if (off % pointeeTySize == 0) {
newIndex = off / pointeeTySize;
newSuperR = baseR;
if (!pointeeTySize.isZero()) {
// Is the offset a multiple of the size? If so, we can layer the
// ElementRegion (with elementType == PointeeTy) directly on top of
// the base region.
if (off % pointeeTySize == 0) {
newIndex = off / pointeeTySize;
newSuperR = baseR;
}
}
}

8
clang/test/Analysis/misc-ps-region-store.m
View File

@ -976,3 +976,11 @@ void rdar7817800_qux(void*);
}
@end
// PR 6036 - This test case triggered a crash inside StoreManager::CastRegion because the size
// of 'unsigned long (*)[0]' is 0.
struct pr6036_a { int pr6036_b; };
struct pr6036_c;
void u132monitk (struct pr6036_c *pr6036_d) {
(void) ((struct pr6036_a *) (unsigned long (*)[0]) ((char *) pr6036_d - 1))->pr6036_b; // expected-warning{{Casting a non-structure type to a structure type and accessing a field can lead to memory access errors or data corruption}}
}