ValistChecker.cpp | Explore in Territory

//== ValistChecker.cpp - stdarg.h macro usage checker -----------*- C++ -*--==//
//
// Part of the LLVM Project, under the Apache License v2.0 with LLVM Exceptions.
// See https://llvm.org/LICENSE.txt for license information.
// SPDX-License-Identifier: Apache-2.0 WITH LLVM-exception
//
//===----------------------------------------------------------------------===//
//
// This defines checkers which detect usage of uninitialized va_list values
// and va_start calls with no matching va_end.
//
//===----------------------------------------------------------------------===//

#include "clang/StaticAnalyzer/Checkers/BuiltinCheckerRegistration.h"
#include "clang/StaticAnalyzer/Core/BugReporter/BugType.h"
#include "clang/StaticAnalyzer/Core/Checker.h"
#include "clang/StaticAnalyzer/Core/CheckerManager.h"
#include "clang/StaticAnalyzer/Core/PathSensitive/CallDescription.h"
#include "clang/StaticAnalyzer/Core/PathSensitive/CallEvent.h"
#include "clang/StaticAnalyzer/Core/PathSensitive/CheckerContext.h"

usingnamespaceclang;
usingnamespaceento;

REGISTER_SET_WITH_PROGRAMSTATE(…) …

namespace {
RegionVector;

class ValistChecker : public Checker<check::PreCall, check::PreStmt<VAArgExpr>,
                                     check::DeadSymbols> { … };

const SmallVector<ValistChecker::VAListAccepter, 15>
    ValistChecker::VAListAccepters = …;

const CallDescription ValistChecker::VaStart(CDM::CLibrary,
                                             { … }, /*Args=*/2,
                                             /*Params=*/1),
    ValistChecker::VaCopy(CDM::CLibrary, { … }, 2),
    ValistChecker::VaEnd(CDM::CLibrary, { … }, 1);
} // end anonymous namespace

void ValistChecker::checkPreCall(const CallEvent &Call,
                                 CheckerContext &C) const { … }

const MemRegion *ValistChecker::getVAListAsRegion(SVal SV, const Expr *E,
                                                  bool &IsSymbolic,
                                                  CheckerContext &C) const { … }

void ValistChecker::checkPreStmt(const VAArgExpr *VAA,
                                 CheckerContext &C) const { … }

void ValistChecker::checkDeadSymbols(SymbolReaper &SR,
                                     CheckerContext &C) const { … }

// This function traverses the exploded graph backwards and finds the node where
// the va_list is initialized. That node is used for uniquing the bug paths.
// It is not likely that there are several different va_lists that belongs to
// different stack frames, so that case is not yet handled.
const ExplodedNode *
ValistChecker::getStartCallSite(const ExplodedNode *N,
                                const MemRegion *Reg) const { … }

void ValistChecker::reportUninitializedAccess(const MemRegion *VAList,
                                              StringRef Msg,
                                              CheckerContext &C) const { … }

void ValistChecker::reportLeakedVALists(const RegionVector &LeakedVALists,
                                        StringRef Msg1, StringRef Msg2,
                                        CheckerContext &C, ExplodedNode *N,
                                        bool ReportUninit) const { … }

void ValistChecker::checkVAListStartCall(const CallEvent &Call,
                                         CheckerContext &C, bool IsCopy) const { … }

void ValistChecker::checkVAListEndCall(const CallEvent &Call,
                                       CheckerContext &C) const { … }

PathDiagnosticPieceRef ValistChecker::ValistBugVisitor::VisitNode(
    const ExplodedNode *N, BugReporterContext &BRC, PathSensitiveBugReport &) { … }

void ento::registerValistBase(CheckerManager &mgr) { … }

bool ento::shouldRegisterValistBase(const CheckerManager &mgr) { … }

#define REGISTER_CHECKER(name) …

REGISTER_CHECKER(Uninitialized)
REGISTER_CHECKER(Unterminated)
REGISTER_CHECKER(CopyToSelf)
llvm/clang/lib/StaticAnalyzer/Checkers/ValistChecker.cpp
