DivZeroChecker.cpp revision 341825
1//== DivZeroChecker.cpp - Division by zero checker --------------*- C++ -*--==// 2// 3// The LLVM Compiler Infrastructure 4// 5// This file is distributed under the University of Illinois Open Source 6// License. See LICENSE.TXT for details. 7// 8//===----------------------------------------------------------------------===// 9// 10// This defines DivZeroChecker, a builtin check in ExprEngine that performs 11// checks for division by zeros. 12// 13//===----------------------------------------------------------------------===// 14 15#include "ClangSACheckers.h" 16#include "clang/StaticAnalyzer/Core/BugReporter/BugType.h" 17#include "clang/StaticAnalyzer/Core/Checker.h" 18#include "clang/StaticAnalyzer/Core/CheckerManager.h" 19#include "clang/StaticAnalyzer/Core/PathSensitive/CheckerContext.h" 20 21using namespace clang; 22using namespace ento; 23 24namespace { 25class DivZeroChecker : public Checker< check::PreStmt<BinaryOperator> > { 26 mutable std::unique_ptr<BuiltinBug> BT; 27 void reportBug(const char *Msg, ProgramStateRef StateZero, CheckerContext &C, 28 std::unique_ptr<BugReporterVisitor> Visitor = nullptr) const; 29 30public: 31 void checkPreStmt(const BinaryOperator *B, CheckerContext &C) const; 32}; 33} // end anonymous namespace 34 35void DivZeroChecker::reportBug( 36 const char *Msg, ProgramStateRef StateZero, CheckerContext &C, 37 std::unique_ptr<BugReporterVisitor> Visitor) const { 38 if (ExplodedNode *N = C.generateErrorNode(StateZero)) { 39 if (!BT) 40 BT.reset(new BuiltinBug(this, "Division by zero")); 41 42 auto R = llvm::make_unique<BugReport>(*BT, Msg, N); 43 R->addVisitor(std::move(Visitor)); 44 bugreporter::trackNullOrUndefValue(N, bugreporter::GetDenomExpr(N), *R); 45 C.emitReport(std::move(R)); 46 } 47} 48 49void DivZeroChecker::checkPreStmt(const BinaryOperator *B, 50 CheckerContext &C) const { 51 BinaryOperator::Opcode Op = B->getOpcode(); 52 if (Op != BO_Div && 53 Op != BO_Rem && 54 Op != BO_DivAssign && 55 Op != BO_RemAssign) 56 return; 57 58 if (!B->getRHS()->getType()->isScalarType()) 59 return; 60 61 SVal Denom = C.getSVal(B->getRHS()); 62 Optional<DefinedSVal> DV = Denom.getAs<DefinedSVal>(); 63 64 // Divide-by-undefined handled in the generic checking for uses of 65 // undefined values. 66 if (!DV) 67 return; 68 69 // Check for divide by zero. 70 ConstraintManager &CM = C.getConstraintManager(); 71 ProgramStateRef stateNotZero, stateZero; 72 std::tie(stateNotZero, stateZero) = CM.assumeDual(C.getState(), *DV); 73 74 if (!stateNotZero) { 75 assert(stateZero); 76 reportBug("Division by zero", stateZero, C); 77 return; 78 } 79 80 bool TaintedD = C.getState()->isTainted(*DV); 81 if ((stateNotZero && stateZero && TaintedD)) { 82 reportBug("Division by a tainted value, possibly zero", stateZero, C, 83 llvm::make_unique<TaintBugVisitor>(*DV)); 84 return; 85 } 86 87 // If we get here, then the denom should not be zero. We abandon the implicit 88 // zero denom case for now. 89 C.addTransition(stateNotZero); 90} 91 92void ento::registerDivZeroChecker(CheckerManager &mgr) { 93 mgr.registerChecker<DivZeroChecker>(); 94} 95