Lines Matching +full:upper +full:- +full:bound +full:- +full:check

1 //== ArrayBoundCheckerV2.cpp ------------------------------------*- C++ -*--==//
8 //===----------------------------------------------------------------------===//
10 // This file defines ArrayBoundCheckerV2, which is a path-sensitive check
11 // which looks for an out-of-bound array element access.
13 //===----------------------------------------------------------------------===//
30     public Checker<check::Location> {
71     switch (region->getKind()) {  in computeExtentBegin()
79         region = cast<SubRegion>(region)->getSuperRegion();  in computeExtentBegin()
107   // CHECK LOWER BOUND: Is byteOffset < extent begin?  in checkLocation()
124       state->assume(*lowerBoundToCheck);  in checkLocation()
126     // Are we constrained enough to definitely precede the lower bound?  in checkLocation()
132     // Otherwise, assume the constraint of the lower bound.  in checkLocation()
138     // CHECK UPPER BOUND: Is byteOffset >= extent(baseRegion)?  If so,  in checkLocation()
141       rawOffset.getRegion()->getExtent(svalBuilder);  in checkLocation()
156       state->assume(*upperboundToCheck);  in checkLocation()
160       if (state->isTainted(rawOffset.getByteOffset()))  in checkLocation()
165     // If we are constrained enough to definitely exceed the upper bound, report.  in checkLocation()
190     BT.reset(new BuiltinBug(this, "Out-of-bound access"));  in reportOOB()
197   os << "Out of bound memory access ";  in reportOOB()
203     os << "(access exceeds upper limit of memory block)";  in reportOOB()
264     switch (region->getKind()) {  in computeOffset()
275         SVal index = elemReg->getIndex();  in computeOffset()
278         QualType elemType = elemReg->getElementType();  in computeOffset()
281         if (elemType->isIncompleteType())  in computeOffset()
296         region = elemReg->getSuperRegion();  in computeOffset()