23 using namespace clang;
27 class ReturnUndefChecker :
public Checker< check::PreStmt<ReturnStmt> > {
28 mutable std::unique_ptr<BuiltinBug> BT_Undef;
29 mutable std::unique_ptr<BuiltinBug> BT_NullReference;
39 void ReturnUndefChecker::checkPreStmt(
const ReturnStmt *RS,
82 const Expr *TrackingE =
nullptr) {
87 auto Report = llvm::make_unique<BugReport>(BT, BT.
getDescription(), N);
89 Report->addRange(RetE->getSourceRange());
99 "Undefined or garbage value returned to caller"));
106 std::tie(StNonNull, StNull) = C.
getState()->assume(RetVal);
115 if (!BT_NullReference)
116 BT_NullReference.reset(
new BuiltinBug(
this,
"Returning null reference"));
const Expr * getDerefExpr(const Stmt *S)
ExplodedNode * addTransition(ProgramStateRef State=nullptr, const ProgramPointTag *Tag=nullptr)
Generates a new transition in the program state graph (ExplodedGraph). Uses the default CheckerContex...
StringRef getDescription() const
bool isReferenceType() const
static void emitBug(CheckerContext &C, BuiltinBug &BT, const Expr *RetE, const Expr *TrackingE=nullptr)
ExplodedNode * generateSink(ProgramStateRef State=nullptr, ExplodedNode *Pred=nullptr, const ProgramPointTag *Tag=nullptr)
Generate a sink node. Generating a sink stops exploration of the given path.
const ProgramStateRef & getState() const
void emitReport(std::unique_ptr< BugReport > R)
Emit the diagnostics report.
CHECKER * registerChecker()
Used to register checkers.
const Decl * getDecl() const
const StackFrameContext * getStackFrame() const
const Expr * getRetValue() const
static QualType getDeclaredResultType(const Decl *D)
Returns the result type of a function or method declaration.
bool trackNullOrUndefValue(const ExplodedNode *N, const Stmt *S, BugReport &R, bool IsArg=false, bool EnableNullFPSuppression=true)
bool isNull() const
isNull - Return true if this QualType doesn't point to a type yet.
T castAs() const
Convert to the specified SVal type, asserting that this SVal is of the desired type.
SVal getSVal(const Stmt *S) const
Get the value of arbitrary expressions at this point in the path.