replica
/
hanchenye-llvm-project
2
0
Fork 0
Code Issues Pull Requests Projects Releases Wiki Activity

[analyzer] Improve subscripting null arrays for catching null dereferences. 

Array-to-pointer cast now works correctly when the pointer to the array
is concrete, eg. null, which allows further symbolic calculations involving
such values.

Inlined defensive checks are now detected correctly when the resulting null
symbol is being array-subscripted before dereference.

Differential Revision: https://reviews.llvm.org/D32291

llvm-svn: 301251
This commit is contained in:
Artem Dergachev 2017-04-24 20:55:07 +00:00
parent 9e32aa2587
commit cbd7cd8360
3 changed files with 22 additions and 17 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

19
clang/lib/StaticAnalyzer/Core/BugReporterVisitors.cpp
View File

@ -61,7 +61,9 @@ const Expr *bugreporter::getDerefExpr(const Stmt *S) {
return U->getSubExpr()->IgnoreParenCasts();
}
else if (const MemberExpr *ME = dyn_cast<MemberExpr>(E)) {
if (ME->isArrow() || isDeclRefExprToReference(ME->getBase())) {
if (ME->isImplicitAccess()) {
return ME;
} else if (ME->isArrow() || isDeclRefExprToReference(ME->getBase())) {
return ME->getBase()->IgnoreParenCasts();
} else {
// If we have a member expr with a dot, the base must have been
@ -73,9 +75,9 @@ const Expr *bugreporter::getDerefExpr(const Stmt *S) {
return IvarRef->getBase()->IgnoreParenCasts();
}
else if (const ArraySubscriptExpr *AE = dyn_cast<ArraySubscriptExpr>(E)) {
return AE->getBase();
return getDerefExpr(AE->getBase());
}
else if (isDeclRefExprToReference(E)) {
else if (isa<DeclRefExpr>(E)) {
return E;
}
break;
@ -974,14 +976,11 @@ bool bugreporter::trackNullOrUndefValue(const ExplodedNode *N,
// This code interacts heavily with this hack; otherwise the value
// would not be null at all for most fields, so we'd be unable to track it.
if (const auto *Op = dyn_cast<UnaryOperator>(Ex))
if (Op->getOpcode() == UO_AddrOf && Op->getSubExpr()->isLValue()) {
Ex = Op->getSubExpr()->IgnoreParenCasts();
while (const auto *ME = dyn_cast<MemberExpr>(Ex)) {
Ex = ME->getBase()->IgnoreParenCasts();
}
}
if (Op->getOpcode() == UO_AddrOf && Op->getSubExpr()->isLValue())
if (const Expr *DerefEx = getDerefExpr(Op->getSubExpr()))
Ex = DerefEx;
if (ExplodedGraph::isInterestingLValueExpr(Ex) || CallEvent::isCallStmt(Ex))
if (Ex && (ExplodedGraph::isInterestingLValueExpr(Ex) || CallEvent::isCallStmt(Ex)))
Inner = Ex;
}

3
clang/lib/StaticAnalyzer/Core/RegionStore.cpp
View File

@ -1338,6 +1338,9 @@ RegionStoreManager::getSizeInElements(ProgramStateRef state,
/// the array). This is called by ExprEngine when evaluating casts
/// from arrays to pointers.
SVal RegionStoreManager::ArrayToPointer(Loc Array, QualType T) {
if (Array.getAs<loc::ConcreteInt>())
return Array;
if (!Array.getAs<loc::MemRegionVal>())
return UnknownVal();

17
clang/test/Analysis/null-deref-offsets.c
View File

@ -7,7 +7,7 @@ struct S {
int z[2];
};
void testOffsets(struct S *s) {
void testOffsets(struct S *s, int coin) {
if (s != 0)
return;
@ -21,14 +21,17 @@ void testOffsets(struct S *s) {
// FIXME: These should ideally be true.
clang_analyzer_eval(&(s->y) == 4); // expected-warning{{FALSE}}
clang_analyzer_eval(&(s->z[0]) == 8); // expected-warning{{UNKNOWN}}
clang_analyzer_eval(&(s->z[1]) == 12); // expected-warning{{UNKNOWN}}
clang_analyzer_eval(&(s->z[0]) == 8); // expected-warning{{FALSE}}
clang_analyzer_eval(&(s->z[1]) == 12); // expected-warning{{FALSE}}
// FIXME: These should ideally be false.
clang_analyzer_eval(&(s->y) == 0); // expected-warning{{TRUE}}
clang_analyzer_eval(&(s->z[0]) == 0); // expected-warning{{UNKNOWN}}
clang_analyzer_eval(&(s->z[1]) == 0); // expected-warning{{UNKNOWN}}
clang_analyzer_eval(&(s->z[0]) == 0); // expected-warning{{TRUE}}
clang_analyzer_eval(&(s->z[1]) == 0); // expected-warning{{TRUE}}
// But this should still be a null dereference.
s->y = 5; // expected-warning{{Access to field 'y' results in a dereference of a null pointer (loaded from variable 's')}}
// But these should still be reported as null dereferences.
if (coin)
s->y = 5; // expected-warning{{Access to field 'y' results in a dereference of a null pointer (loaded from variable 's')}}
else
s->z[1] = 6; // expected-warning{{Array access (via field 'z') results in a null pointer dereference}}
}