1 //== BoolAssignmentChecker.cpp - Boolean assignment checker -----*- C++ -*--==//
2 //
3 // The LLVM Compiler Infrastructure
4 //
5 // This file is distributed under the University of Illinois Open Source
6 // License. See LICENSE.TXT for details.
7 //
8 //===----------------------------------------------------------------------===//
9 //
10 // This defines BoolAssignmentChecker, a builtin check in ExprEngine that
11 // performs checks for assignment of non-Boolean values to Boolean variables.
12 //
13 //===----------------------------------------------------------------------===//
14
15 #include "ClangSACheckers.h"
16 #include "clang/StaticAnalyzer/Core/Checker.h"
17 #include "clang/StaticAnalyzer/Core/CheckerManager.h"
18 #include "clang/StaticAnalyzer/Core/PathSensitive/CheckerContext.h"
19 #include "clang/StaticAnalyzer/Core/BugReporter/BugType.h"
20
21 using namespace clang;
22 using namespace ento;
23
24 namespace {
25 class BoolAssignmentChecker : public Checker< check::Bind > {
26 mutable llvm::OwningPtr<BuiltinBug> BT;
27 void emitReport(ProgramStateRef state, CheckerContext &C) const;
28 public:
29 void checkBind(SVal loc, SVal val, const Stmt *S, CheckerContext &C) const;
30 };
31 } // end anonymous namespace
32
emitReport(ProgramStateRef state,CheckerContext & C) const33 void BoolAssignmentChecker::emitReport(ProgramStateRef state,
34 CheckerContext &C) const {
35 if (ExplodedNode *N = C.addTransition(state)) {
36 if (!BT)
37 BT.reset(new BuiltinBug("Assignment of a non-Boolean value"));
38 C.EmitReport(new BugReport(*BT, BT->getDescription(), N));
39 }
40 }
41
isBooleanType(QualType Ty)42 static bool isBooleanType(QualType Ty) {
43 if (Ty->isBooleanType()) // C++ or C99
44 return true;
45
46 if (const TypedefType *TT = Ty->getAs<TypedefType>())
47 return TT->getDecl()->getName() == "BOOL" || // Objective-C
48 TT->getDecl()->getName() == "_Bool" || // stdbool.h < C99
49 TT->getDecl()->getName() == "Boolean"; // MacTypes.h
50
51 return false;
52 }
53
checkBind(SVal loc,SVal val,const Stmt * S,CheckerContext & C) const54 void BoolAssignmentChecker::checkBind(SVal loc, SVal val, const Stmt *S,
55 CheckerContext &C) const {
56
57 // We are only interested in stores into Booleans.
58 const TypedValueRegion *TR =
59 dyn_cast_or_null<TypedValueRegion>(loc.getAsRegion());
60
61 if (!TR)
62 return;
63
64 QualType valTy = TR->getValueType();
65
66 if (!isBooleanType(valTy))
67 return;
68
69 // Get the value of the right-hand side. We only care about values
70 // that are defined (UnknownVals and UndefinedVals are handled by other
71 // checkers).
72 const DefinedSVal *DV = dyn_cast<DefinedSVal>(&val);
73 if (!DV)
74 return;
75
76 // Check if the assigned value meets our criteria for correctness. It must
77 // be a value that is either 0 or 1. One way to check this is to see if
78 // the value is possibly < 0 (for a negative value) or greater than 1.
79 ProgramStateRef state = C.getState();
80 SValBuilder &svalBuilder = C.getSValBuilder();
81 ConstraintManager &CM = C.getConstraintManager();
82
83 // First, ensure that the value is >= 0.
84 DefinedSVal zeroVal = svalBuilder.makeIntVal(0, valTy);
85 SVal greaterThanOrEqualToZeroVal =
86 svalBuilder.evalBinOp(state, BO_GE, *DV, zeroVal,
87 svalBuilder.getConditionType());
88
89 DefinedSVal *greaterThanEqualToZero =
90 dyn_cast<DefinedSVal>(&greaterThanOrEqualToZeroVal);
91
92 if (!greaterThanEqualToZero) {
93 // The SValBuilder cannot construct a valid SVal for this condition.
94 // This means we cannot properly reason about it.
95 return;
96 }
97
98 ProgramStateRef stateLT, stateGE;
99 llvm::tie(stateGE, stateLT) = CM.assumeDual(state, *greaterThanEqualToZero);
100
101 // Is it possible for the value to be less than zero?
102 if (stateLT) {
103 // It is possible for the value to be less than zero. We only
104 // want to emit a warning, however, if that value is fully constrained.
105 // If it it possible for the value to be >= 0, then essentially the
106 // value is underconstrained and there is nothing left to be done.
107 if (!stateGE)
108 emitReport(stateLT, C);
109
110 // In either case, we are done.
111 return;
112 }
113
114 // If we reach here, it must be the case that the value is constrained
115 // to only be >= 0.
116 assert(stateGE == state);
117
118 // At this point we know that the value is >= 0.
119 // Now check to ensure that the value is <= 1.
120 DefinedSVal OneVal = svalBuilder.makeIntVal(1, valTy);
121 SVal lessThanEqToOneVal =
122 svalBuilder.evalBinOp(state, BO_LE, *DV, OneVal,
123 svalBuilder.getConditionType());
124
125 DefinedSVal *lessThanEqToOne =
126 dyn_cast<DefinedSVal>(&lessThanEqToOneVal);
127
128 if (!lessThanEqToOne) {
129 // The SValBuilder cannot construct a valid SVal for this condition.
130 // This means we cannot properly reason about it.
131 return;
132 }
133
134 ProgramStateRef stateGT, stateLE;
135 llvm::tie(stateLE, stateGT) = CM.assumeDual(state, *lessThanEqToOne);
136
137 // Is it possible for the value to be greater than one?
138 if (stateGT) {
139 // It is possible for the value to be greater than one. We only
140 // want to emit a warning, however, if that value is fully constrained.
141 // If it is possible for the value to be <= 1, then essentially the
142 // value is underconstrained and there is nothing left to be done.
143 if (!stateLE)
144 emitReport(stateGT, C);
145
146 // In either case, we are done.
147 return;
148 }
149
150 // If we reach here, it must be the case that the value is constrained
151 // to only be <= 1.
152 assert(stateLE == state);
153 }
154
registerBoolAssignmentChecker(CheckerManager & mgr)155 void ento::registerBoolAssignmentChecker(CheckerManager &mgr) {
156 mgr.registerChecker<BoolAssignmentChecker>();
157 }
158