1//== BoolAssignmentChecker.cpp - Boolean assignment checker -----*- C++ -*--==//
2//
3// Part of the LLVM Project, under the Apache License v2.0 with LLVM Exceptions.
4// See https://llvm.org/LICENSE.txt for license information.
5// SPDX-License-Identifier: Apache-2.0 WITH LLVM-exception
6//
7//===----------------------------------------------------------------------===//
8//
9// This defines BoolAssignmentChecker, a builtin check in ExprEngine that
10// performs checks for assignment of non-Boolean values to Boolean variables.
11//
12//===----------------------------------------------------------------------===//
13
14#include "clang/StaticAnalyzer/Checkers/BuiltinCheckerRegistration.h"
15#include "clang/StaticAnalyzer/Core/BugReporter/BugType.h"
16#include "clang/StaticAnalyzer/Core/Checker.h"
17#include "clang/StaticAnalyzer/Core/CheckerManager.h"
18#include "clang/StaticAnalyzer/Core/PathSensitive/CheckerContext.h"
19
20using namespace clang;
21using namespace ento;
22
23namespace {
24  class BoolAssignmentChecker : public Checker< check::Bind > {
25    mutable std::unique_ptr<BuiltinBug> BT;
26    void emitReport(ProgramStateRef state, CheckerContext &C) const;
27  public:
28    void checkBind(SVal loc, SVal val, const Stmt *S, CheckerContext &C) const;
29  };
30} // end anonymous namespace
31
32void BoolAssignmentChecker::emitReport(ProgramStateRef state,
33                                       CheckerContext &C) const {
34  if (ExplodedNode *N = C.generateNonFatalErrorNode(state)) {
35    if (!BT)
36      BT.reset(new BuiltinBug(this, "Assignment of a non-Boolean value"));
37
38    C.emitReport(
39        std::make_unique<PathSensitiveBugReport>(*BT, BT->getDescription(), N));
40  }
41}
42
43static bool isBooleanType(QualType Ty) {
44  if (Ty->isBooleanType()) // C++ or C99
45    return true;
46
47  if (const TypedefType *TT = Ty->getAs<TypedefType>())
48    return TT->getDecl()->getName() == "BOOL"   || // Objective-C
49           TT->getDecl()->getName() == "_Bool"  || // stdbool.h < C99
50           TT->getDecl()->getName() == "Boolean";  // MacTypes.h
51
52  return false;
53}
54
55void BoolAssignmentChecker::checkBind(SVal loc, SVal val, const Stmt *S,
56                                      CheckerContext &C) const {
57
58  // We are only interested in stores into Booleans.
59  const TypedValueRegion *TR =
60    dyn_cast_or_null<TypedValueRegion>(loc.getAsRegion());
61
62  if (!TR)
63    return;
64
65  QualType valTy = TR->getValueType();
66
67  if (!isBooleanType(valTy))
68    return;
69
70  // Get the value of the right-hand side.  We only care about values
71  // that are defined (UnknownVals and UndefinedVals are handled by other
72  // checkers).
73  Optional<DefinedSVal> DV = val.getAs<DefinedSVal>();
74  if (!DV)
75    return;
76
77  // Check if the assigned value meets our criteria for correctness.  It must
78  // be a value that is either 0 or 1.  One way to check this is to see if
79  // the value is possibly < 0 (for a negative value) or greater than 1.
80  ProgramStateRef state = C.getState();
81  SValBuilder &svalBuilder = C.getSValBuilder();
82  ConstraintManager &CM = C.getConstraintManager();
83
84  // First, ensure that the value is >= 0.
85  DefinedSVal zeroVal = svalBuilder.makeIntVal(0, valTy);
86  SVal greaterThanOrEqualToZeroVal =
87    svalBuilder.evalBinOp(state, BO_GE, *DV, zeroVal,
88                          svalBuilder.getConditionType());
89
90  Optional<DefinedSVal> greaterThanEqualToZero =
91      greaterThanOrEqualToZeroVal.getAs<DefinedSVal>();
92
93  if (!greaterThanEqualToZero) {
94    // The SValBuilder cannot construct a valid SVal for this condition.
95    // This means we cannot properly reason about it.
96    return;
97  }
98
99  ProgramStateRef stateLT, stateGE;
100  std::tie(stateGE, stateLT) = CM.assumeDual(state, *greaterThanEqualToZero);
101
102  // Is it possible for the value to be less than zero?
103  if (stateLT) {
104    // It is possible for the value to be less than zero.  We only
105    // want to emit a warning, however, if that value is fully constrained.
106    // If it it possible for the value to be >= 0, then essentially the
107    // value is underconstrained and there is nothing left to be done.
108    if (!stateGE)
109      emitReport(stateLT, C);
110
111    // In either case, we are done.
112    return;
113  }
114
115  // If we reach here, it must be the case that the value is constrained
116  // to only be >= 0.
117  assert(stateGE == state);
118
119  // At this point we know that the value is >= 0.
120  // Now check to ensure that the value is <= 1.
121  DefinedSVal OneVal = svalBuilder.makeIntVal(1, valTy);
122  SVal lessThanEqToOneVal =
123    svalBuilder.evalBinOp(state, BO_LE, *DV, OneVal,
124                          svalBuilder.getConditionType());
125
126  Optional<DefinedSVal> lessThanEqToOne =
127      lessThanEqToOneVal.getAs<DefinedSVal>();
128
129  if (!lessThanEqToOne) {
130    // The SValBuilder cannot construct a valid SVal for this condition.
131    // This means we cannot properly reason about it.
132    return;
133  }
134
135  ProgramStateRef stateGT, stateLE;
136  std::tie(stateLE, stateGT) = CM.assumeDual(state, *lessThanEqToOne);
137
138  // Is it possible for the value to be greater than one?
139  if (stateGT) {
140    // It is possible for the value to be greater than one.  We only
141    // want to emit a warning, however, if that value is fully constrained.
142    // If it is possible for the value to be <= 1, then essentially the
143    // value is underconstrained and there is nothing left to be done.
144    if (!stateLE)
145      emitReport(stateGT, C);
146
147    // In either case, we are done.
148    return;
149  }
150
151  // If we reach here, it must be the case that the value is constrained
152  // to only be <= 1.
153  assert(stateLE == state);
154}
155
156void ento::registerBoolAssignmentChecker(CheckerManager &mgr) {
157    mgr.registerChecker<BoolAssignmentChecker>();
158}
159
160bool ento::shouldRegisterBoolAssignmentChecker(const LangOptions &LO) {
161  return true;
162}
163