clang  3.7.0
BuiltinFunctionChecker.cpp
Go to the documentation of this file.
1 //=== BuiltinFunctionChecker.cpp --------------------------------*- C++ -*-===//
2 //
3 // The LLVM Compiler Infrastructure
4 //
5 // This file is distributed under the University of Illinois Open Source
6 // License. See LICENSE.TXT for details.
7 //
8 //===----------------------------------------------------------------------===//
9 //
10 // This checker evaluates clang builtin functions.
11 //
12 //===----------------------------------------------------------------------===//
13 
14 #include "ClangSACheckers.h"
15 #include "clang/Basic/Builtins.h"
19 
20 using namespace clang;
21 using namespace ento;
22 
23 namespace {
24 
25 class BuiltinFunctionChecker : public Checker<eval::Call> {
26 public:
27  bool evalCall(const CallExpr *CE, CheckerContext &C) const;
28 };
29 
30 }
31 
32 bool BuiltinFunctionChecker::evalCall(const CallExpr *CE,
33  CheckerContext &C) const {
34  ProgramStateRef state = C.getState();
35  const FunctionDecl *FD = C.getCalleeDecl(CE);
36  const LocationContext *LCtx = C.getLocationContext();
37  if (!FD)
38  return false;
39 
40  switch (FD->getBuiltinID()) {
41  default:
42  return false;
43 
44  case Builtin::BI__builtin_expect:
45  case Builtin::BI__builtin_assume_aligned:
46  case Builtin::BI__builtin_addressof: {
47  // For __builtin_expect and __builtin_assume_aligned, just return the value
48  // of the subexpression.
49  // __builtin_addressof is going from a reference to a pointer, but those
50  // are represented the same way in the analyzer.
51  assert (CE->arg_begin() != CE->arg_end());
52  SVal X = state->getSVal(*(CE->arg_begin()), LCtx);
53  C.addTransition(state->BindExpr(CE, LCtx, X));
54  return true;
55  }
56 
57  case Builtin::BI__builtin_alloca: {
58  // FIXME: Refactor into StoreManager itself?
60  const AllocaRegion* R =
62 
63  // Set the extent of the region in bytes. This enables us to use the
64  // SVal of the argument directly. If we save the extent in bits, we
65  // cannot represent values like symbol*8.
67  state->getSVal(*(CE->arg_begin()), LCtx).castAs<DefinedOrUnknownSVal>();
68 
69  SValBuilder& svalBuilder = C.getSValBuilder();
70  DefinedOrUnknownSVal Extent = R->getExtent(svalBuilder);
71  DefinedOrUnknownSVal extentMatchesSizeArg =
72  svalBuilder.evalEQ(state, Extent, Size);
73  state = state->assume(extentMatchesSizeArg, true);
74  assert(state && "The region should not have any previous constraints");
75 
76  C.addTransition(state->BindExpr(CE, LCtx, loc::MemRegionVal(R)));
77  return true;
78  }
79 
80  case Builtin::BI__builtin_object_size: {
81  // This must be resolvable at compile time, so we defer to the constant
82  // evaluator for a value.
83  SVal V = UnknownVal();
84  llvm::APSInt Result;
85  if (CE->EvaluateAsInt(Result, C.getASTContext(), Expr::SE_NoSideEffects)) {
86  // Make sure the result has the correct type.
87  SValBuilder &SVB = C.getSValBuilder();
89  BVF.getAPSIntType(CE->getType()).apply(Result);
90  V = SVB.makeIntVal(Result);
91  }
92 
93  C.addTransition(state->BindExpr(CE, LCtx, V));
94  return true;
95  }
96  }
97 }
98 
99 void ento::registerBuiltinFunctionChecker(CheckerManager &mgr) {
100  mgr.registerChecker<BuiltinFunctionChecker>();
101 }
nonloc::ConcreteInt makeIntVal(const IntegerLiteral *integer)
Definition: SValBuilder.h:232
ExplodedNode * addTransition(ProgramStateRef State=nullptr, const ProgramPointTag *Tag=nullptr)
Generates a new transition in the program state graph (ExplodedGraph). Uses the default CheckerContex...
const FunctionDecl * getCalleeDecl(const CallExpr *CE) const
Get the declaration of the called function (path-sensitive).
unsigned blockCount() const
Returns the number of times the current block has been visited along the analyzed path...
const AllocaRegion * getAllocaRegion(const Expr *Ex, unsigned Cnt, const LocationContext *LC)
getAllocaRegion - Retrieve a region associated with a call to alloca().
Definition: MemRegion.cpp:1024
arg_iterator arg_end()
Definition: Expr.h:2247
DefinedOrUnknownSVal getExtent(SValBuilder &svalBuilder) const override
getExtent - Returns the size of the region in bytes.
Definition: MemRegion.cpp:216
const ProgramStateRef & getState() const
bool EvaluateAsInt(llvm::APSInt &Result, const ASTContext &Ctx, SideEffectsKind AllowSideEffects=SE_NoSideEffects) const
The result type of a method or function.
CHECKER * registerChecker()
Used to register checkers.
StoreManager & getStoreManager()
unsigned getBuiltinID() const
Returns a value indicating whether this function corresponds to a builtin function.
Definition: Decl.cpp:2601
QualType getType() const
Definition: Expr.h:125
MemRegionManager & getRegionManager()
Definition: Store.h:85
BasicValueFactory & getBasicValueFactory()
Definition: SValBuilder.h:134
arg_iterator arg_begin()
Definition: Expr.h:2246
X
Definition: SemaDecl.cpp:11429
SValBuilder & getSValBuilder()
APSIntType getAPSIntType(QualType T) const
Returns the type of the APSInt used to store values of the given QualType.
Defines enum values for all the target-independent builtin functions.
const LocationContext * getLocationContext() const