BoolAssignmentChecker.cpp [plain text]
#include "ClangSACheckers.h"
#include "clang/StaticAnalyzer/Core/Checker.h"
#include "clang/StaticAnalyzer/Core/CheckerManager.h"
#include "clang/StaticAnalyzer/Core/PathSensitive/CheckerContext.h"
#include "clang/StaticAnalyzer/Core/BugReporter/BugType.h"
using namespace clang;
using namespace ento;
namespace {
class BoolAssignmentChecker : public Checker< check::Bind > {
mutable llvm::OwningPtr<BuiltinBug> BT;
void emitReport(ProgramStateRef state, CheckerContext &C) const;
public:
void checkBind(SVal loc, SVal val, const Stmt *S, CheckerContext &C) const;
};
}
void BoolAssignmentChecker::emitReport(ProgramStateRef state,
CheckerContext &C) const {
if (ExplodedNode *N = C.addTransition(state)) {
if (!BT)
BT.reset(new BuiltinBug("Assignment of a non-Boolean value"));
C.EmitReport(new BugReport(*BT, BT->getDescription(), N));
}
}
static bool isBooleanType(QualType Ty) {
if (Ty->isBooleanType()) return true;
if (const TypedefType *TT = Ty->getAs<TypedefType>())
return TT->getDecl()->getName() == "BOOL" || TT->getDecl()->getName() == "_Bool" || TT->getDecl()->getName() == "Boolean";
return false;
}
void BoolAssignmentChecker::checkBind(SVal loc, SVal val, const Stmt *S,
CheckerContext &C) const {
const TypedValueRegion *TR =
dyn_cast_or_null<TypedValueRegion>(loc.getAsRegion());
if (!TR)
return;
QualType valTy = TR->getValueType();
if (!isBooleanType(valTy))
return;
const DefinedSVal *DV = dyn_cast<DefinedSVal>(&val);
if (!DV)
return;
ProgramStateRef state = C.getState();
SValBuilder &svalBuilder = C.getSValBuilder();
ConstraintManager &CM = C.getConstraintManager();
DefinedSVal zeroVal = svalBuilder.makeIntVal(0, valTy);
SVal greaterThanOrEqualToZeroVal =
svalBuilder.evalBinOp(state, BO_GE, *DV, zeroVal,
svalBuilder.getConditionType());
DefinedSVal *greaterThanEqualToZero =
dyn_cast<DefinedSVal>(&greaterThanOrEqualToZeroVal);
if (!greaterThanEqualToZero) {
return;
}
ProgramStateRef stateLT, stateGE;
llvm::tie(stateGE, stateLT) = CM.assumeDual(state, *greaterThanEqualToZero);
if (stateLT) {
if (!stateGE)
emitReport(stateLT, C);
return;
}
assert(stateGE == state);
DefinedSVal OneVal = svalBuilder.makeIntVal(1, valTy);
SVal lessThanEqToOneVal =
svalBuilder.evalBinOp(state, BO_LE, *DV, OneVal,
svalBuilder.getConditionType());
DefinedSVal *lessThanEqToOne =
dyn_cast<DefinedSVal>(&lessThanEqToOneVal);
if (!lessThanEqToOne) {
return;
}
ProgramStateRef stateGT, stateLE;
llvm::tie(stateLE, stateGT) = CM.assumeDual(state, *lessThanEqToOne);
if (stateGT) {
if (!stateLE)
emitReport(stateGT, C);
return;
}
assert(stateLE == state);
}
void ento::registerBoolAssignmentChecker(CheckerManager &mgr) {
mgr.registerChecker<BoolAssignmentChecker>();
}