StaticAnalyzer/Checkers/CStringChecker.cpp

109   void evalMemcpy(CheckerContext &C, const CallExpr *CE) const;
110   void evalMempcpy(CheckerContext &C, const CallExpr *CE) const;
111   void evalMemmove(CheckerContext &C, const CallExpr *CE) const;
112   void evalBcopy(CheckerContext &C, const CallExpr *CE) const;
113   void evalCopyCommon(CheckerContext &C, const CallExpr *CE,
121   void evalMemcmp(CheckerContext &C, const CallExpr *CE) const;
123   void evalstrLength(CheckerContext &C, const CallExpr *CE) const;
124   void evalstrnLength(CheckerContext &C, const CallExpr *CE) const;
126                            const CallExpr *CE,
129   void evalStrcpy(CheckerContext &C, const CallExpr *CE) const;
130   void evalStrncpy(CheckerContext &C, const CallExpr *CE) const;
131   void evalStpcpy(CheckerContext &C, const CallExpr *CE) const;
132   void evalStrlcpy(CheckerContext &C, const CallExpr *CE) const;
133   void evalStrcpyCommon(CheckerContext &C, const CallExpr *CE, bool ReturnEnd,
137   void evalStrcat(CheckerContext &C, const CallExpr *CE) const;
138   void evalStrncat(CheckerContext &C, const CallExpr *CE) const;
139   void evalStrlcat(CheckerContext &C, const CallExpr *CE) const;
141   void evalStrcmp(CheckerContext &C, const CallExpr *CE) const;
142   void evalStrncmp(CheckerContext &C, const CallExpr *CE) const;
143   void evalStrcasecmp(CheckerContext &C, const CallExpr *CE) const;
144   void evalStrncasecmp(CheckerContext &C, const CallExpr *CE) const;
146                         const CallExpr *CE,
150   void evalStrsep(CheckerContext &C, const CallExpr *CE) const;
152   void evalStdCopy(CheckerContext &C, const CallExpr *CE) const;
153   void evalStdCopyBackward(CheckerContext &C, const CallExpr *CE) const;
154   void evalStdCopyCommon(CheckerContext &C, const CallExpr *CE) const;
155   void evalMemset(CheckerContext &C, const CallExpr *CE) const;
156   void evalBzero(CheckerContext &C, const CallExpr *CE) const;
1138                                     const CallExpr *CE,
1160     stateZeroSize = stateZeroSize->BindExpr(CE, LCtx, destVal);
1209         lastElement = C.getSValBuilder().conjureSymbolVal(nullptr, CE, LCtx,
1213       state = state->BindExpr(CE, LCtx, lastElement);
1217       state = state->BindExpr(CE, LCtx, destVal);
1239 void CStringChecker::evalMemcpy(CheckerContext &C, const CallExpr *CE) const {
1242   const Expr *Dest = CE->getArg(0);
1245   evalCopyCommon(C, CE, state, CE->getArg(2), Dest, CE->getArg(1), true);
1248 void CStringChecker::evalMempcpy(CheckerContext &C, const CallExpr *CE) const {
1251   const Expr *Dest = CE->getArg(0);
1254   evalCopyCommon(C, CE, state, CE->getArg(2), Dest, CE->getArg(1), true, true);
1257 void CStringChecker::evalMemmove(CheckerContext &C, const CallExpr *CE) const {
1260   const Expr *Dest = CE->getArg(0);
1263   evalCopyCommon(C, CE, state, CE->getArg(2), Dest, CE->getArg(1));
1266 void CStringChecker::evalBcopy(CheckerContext &C, const CallExpr *CE) const {
1268   evalCopyCommon(C, CE, C.getState(),
1269                  CE->getArg(2), CE->getArg(1), CE->getArg(0));
1272 void CStringChecker::evalMemcmp(CheckerContext &C, const CallExpr *CE) const {
1276   const Expr *Left = CE->getArg(0);
1277   const Expr *Right = CE->getArg(1);
1278   const Expr *Size = CE->getArg(2);
1296     state = state->BindExpr(CE, LCtx,
1297                             svalBuilder.makeZeroVal(CE->getType()));
1323         state = StSameBuf->BindExpr(CE, LCtx,
1324                                     svalBuilder.makeZeroVal(CE->getType()));
1337           svalBuilder.conjureSymbolVal(nullptr, CE, LCtx, C.blockCount());
1338       state = state->BindExpr(CE, LCtx, CmpV);
1345                                    const CallExpr *CE) const {
1347   evalstrLengthCommon(C, CE, /* IsStrnlen = */ false);
1351                                     const CallExpr *CE) const {
1353   evalstrLengthCommon(C, CE, /* IsStrnlen = */ true);
1356 void CStringChecker::evalstrLengthCommon(CheckerContext &C, const CallExpr *CE,
1363     const Expr *maxlenExpr = CE->getArg(1);
1373       SVal zero = C.getSValBuilder().makeZeroVal(CE->getType());
1374       stateZeroSize = stateZeroSize->BindExpr(CE, LCtx, zero);
1387   const Expr *Arg = CE->getArg(0);
1411     const Expr *maxlenExpr = CE->getArg(1);
1440       result = C.getSValBuilder().conjureSymbolVal(nullptr, CE, LCtx,
1464       result = C.getSValBuilder().conjureSymbolVal(nullptr, CE, LCtx,
1471   state = state->BindExpr(CE, LCtx, result);
1475 void CStringChecker::evalStrcpy(CheckerContext &C, const CallExpr *CE) const {
1477   evalStrcpyCommon(C, CE,
1483 void CStringChecker::evalStrncpy(CheckerContext &C, const CallExpr *CE) const {
1485   evalStrcpyCommon(C, CE,
1491 void CStringChecker::evalStpcpy(CheckerContext &C, const CallExpr *CE) const {
1493   evalStrcpyCommon(C, CE,
1499 void CStringChecker::evalStrlcpy(CheckerContext &C, const CallExpr *CE) const {
1501   evalStrcpyCommon(C, CE,
1508 void CStringChecker::evalStrcat(CheckerContext &C, const CallExpr *CE) const {
1510   evalStrcpyCommon(C, CE,
1516 void CStringChecker::evalStrncat(CheckerContext &C, const CallExpr *CE) const {
1518   evalStrcpyCommon(C, CE,
1524 void CStringChecker::evalStrlcat(CheckerContext &C, const CallExpr *CE) const {
1528   evalStrcpyCommon(C, CE,
1535 void CStringChecker::evalStrcpyCommon(CheckerContext &C, const CallExpr *CE,
1547   const Expr *Dst = CE->getArg(0);
1555   const Expr *srcExpr = CE->getArg(1);
1584   state = CheckOverlap(C, state, IsBounded ? CE->getArg(2) : CE->getArg(1), Dst,
1593     const Expr *lenExpr = CE->getArg(2);
1706             StateZeroSize = StateZeroSize->BindExpr(CE, LCtx, DstVal);
1710               StateZeroSize = StateZeroSize->BindExpr(CE, LCtx, strLength);
1715               StateZeroSize = StateZeroSize->BindExpr(CE, LCtx, retSize);
1784       finalStrLength = getCStringLength(C, state, CE, DstVal, true);
1848         state = CheckLocation(C, state, CE->getArg(2), maxLastElement,
1907       Result = svalBuilder.conjureSymbolVal(nullptr, CE, LCtx, C.blockCount());
1911   state = state->BindExpr(CE, LCtx, Result);
1915 void CStringChecker::evalStrcmp(CheckerContext &C, const CallExpr *CE) const {
1917   evalStrcmpCommon(C, CE, /* IsBounded = */ false, /* IgnoreCase = */ false);
1920 void CStringChecker::evalStrncmp(CheckerContext &C, const CallExpr *CE) const {
1922   evalStrcmpCommon(C, CE, /* IsBounded = */ true, /* IgnoreCase = */ false);
1926     const CallExpr *CE) const {
1928   evalStrcmpCommon(C, CE, /* IsBounded = */ false, /* IgnoreCase = */ true);
1932     const CallExpr *CE) const {
1934   evalStrcmpCommon(C, CE, /* IsBounded = */ true, /* IgnoreCase = */ true);
1937 void CStringChecker::evalStrcmpCommon(CheckerContext &C, const CallExpr *CE,
1944   const Expr *s1 = CE->getArg(0);
1951   const Expr *s2 = CE->getArg(1);
1982     StSameBuf = StSameBuf->BindExpr(CE, LCtx,
1983         svalBuilder.makeZeroVal(CE->getType()));
2001   SVal resultVal = svalBuilder.conjureSymbolVal(nullptr, CE, LCtx,
2010       const Expr *lenExpr = CE->getArg(2);
2042         resultVal = svalBuilder.makeIntVal(compareRes, CE->getType());
2045         DefinedSVal zeroVal = svalBuilder.makeIntVal(0, CE->getType());
2058   state = state->BindExpr(CE, LCtx, resultVal);
2064 void CStringChecker::evalStrsep(CheckerContext &C, const CallExpr *CE) const {
2067   const Expr *SearchStrPtr = CE->getArg(0);
2070       CE->getType().getUnqualifiedType() != CharPtrTy.getUnqualifiedType())
2085   const Expr *DelimStr = CE->getArg(1);
2106           CE,
2114     Result = SVB.conjureSymbolVal(nullptr, CE, LCtx, C.blockCount());
2118   State = State->BindExpr(CE, LCtx, Result);
2123 void CStringChecker::evalStdCopy(CheckerContext &C, const CallExpr *CE) const {
2124   evalStdCopyCommon(C, CE);
2128     const CallExpr *CE) const {
2129   evalStdCopyCommon(C, CE);
2133     const CallExpr *CE) const {
2134   if (!CE->getArg(2)->getType()->isPointerType())
2147   const Expr *Dst = CE->getArg(2);
2154   SVal ResultVal = SVB.conjureSymbolVal(nullptr, CE, LCtx, C.blockCount());
2155   State = State->BindExpr(CE, LCtx, ResultVal);
2160 void CStringChecker::evalMemset(CheckerContext &C, const CallExpr *CE) const {
2163   const Expr *Mem = CE->getArg(0);
2164   const Expr *CharE = CE->getArg(1);
2165   const Expr *Size = CE->getArg(2);
2183     StateZeroSize = StateZeroSize->BindExpr(CE, LCtx, MemVal);
2204   State = State->BindExpr(CE, LCtx, MemVal);
2208 void CStringChecker::evalBzero(CheckerContext &C, const CallExpr *CE) const {
2211   const Expr *Mem = CE->getArg(0);
2212   const Expr *Size = CE->getArg(1);
2257   const auto *CE = dyn_cast_or_null<CallExpr>(Call.getOriginExpr());
2258   if (!CE)
2275   for (auto I : CE->arguments()) {
2296   const auto *CE = cast<CallExpr>(Call.getOriginExpr());
2297   (this->*Callback)(C, CE);