StaticAnalyzer/Checkers/GenericTaintChecker.cpp

154     inline bool isDestinationArgument(unsigned ArgNum) const {
156                         DstArgs.end(), ArgNum) != DstArgs.end());
341     unsigned ArgNum  = *I;
344     if (ArgNum == ReturnValueIndex) {
351     if (CE->getNumArgs() < (ArgNum + 1))
353     const Expr* Arg = CE->getArg(ArgNum);
454     unsigned ArgNum = *I;
456     if (ArgNum == InvalidArgIndex) {
468     if (CE->getNumArgs() < (ArgNum + 1))
470     if ((IsTainted = isTaintedOrPointsToTainted(CE->getArg(ArgNum), State, C)))
479     unsigned ArgNum = *I;
482     if (ArgNum == InvalidArgIndex) {
500     if (ArgNum == ReturnValueIndex) {
506     assert(ArgNum < CE->getNumArgs());
507     State = State->add<TaintArgsOnPostVisit>(ArgNum);
609                                        unsigned int &ArgNum) {
621     ArgNum = Format->getFormatIdx() - 1;
623          CE->getNumArgs() > ArgNum)
629     ArgNum = 0;
661   unsigned int ArgNum = 0;
662   if (!getPrintfFormatArgumentNum(CE, C, ArgNum))
666   if (generateReportIfTainted(CE->getArg(ArgNum),
678   unsigned ArgNum = llvm::StringSwitch<unsigned>(Name)
691   if (ArgNum == UINT_MAX || CE->getNumArgs() < (ArgNum + 1))
694   if (generateReportIfTainted(CE->getArg(ArgNum),
706   // If the function has a buffer size argument, set ArgNum.
707   unsigned ArgNum = InvalidArgIndex;
714       ArgNum = 2;
717       ArgNum = 1;
723   if (ArgNum == InvalidArgIndex) {
727       ArgNum = 0;
729       ArgNum = 3;
731       ArgNum = 1;
733       ArgNum = 2;
736   if (ArgNum != InvalidArgIndex && CE->getNumArgs() > ArgNum &&
737       generateReportIfTainted(CE->getArg(ArgNum), MsgTaintedBufferSize, C))