1//== BoolAssignmentChecker.cpp - Boolean assignment checker -----*- C++ -*--==//
2//
3// Part of the LLVM Project, under the Apache License v2.0 with LLVM Exceptions.
4// See https://llvm.org/LICENSE.txt for license information.
5// SPDX-License-Identifier: Apache-2.0 WITH LLVM-exception
6//
7//===----------------------------------------------------------------------===//
8//
9// This defines BoolAssignmentChecker, a builtin check in ExprEngine that
10// performs checks for assignment of non-Boolean values to Boolean variables.
11//
12//===----------------------------------------------------------------------===//
13
14#include "clang/StaticAnalyzer/Checkers/BuiltinCheckerRegistration.h"
15#include "clang/StaticAnalyzer/Core/BugReporter/BugType.h"
16#include "clang/StaticAnalyzer/Core/Checker.h"
17#include "clang/StaticAnalyzer/Core/CheckerManager.h"
18#include "clang/StaticAnalyzer/Core/PathSensitive/CheckerContext.h"
19
20using namespace clang;
21using namespace ento;
22
23namespace {
24  class BoolAssignmentChecker : public Checker< check::Bind > {
25    mutable std::unique_ptr<BuiltinBug> BT;
26    void emitReport(ProgramStateRef state, CheckerContext &C) const;
27  public:
28    void checkBind(SVal loc, SVal val, const Stmt *S, CheckerContext &C) const;
29  };
30} // end anonymous namespace
31
32void BoolAssignmentChecker::emitReport(ProgramStateRef state,
33                                       CheckerContext &C) const {
34  if (ExplodedNode *N = C.generateNonFatalErrorNode(state)) {
35    if (!BT)
36      BT.reset(new BuiltinBug(this, "Assignment of a non-Boolean value"));
37
38    C.emitReport(
39        std::make_unique<PathSensitiveBugReport>(*BT, BT->getDescription(), N));
40  }
41}
42
43static bool isBooleanType(QualType Ty) {
44  if (Ty->isBooleanType()) // C++ or C99
45    return true;
46
47  if (const TypedefType *TT = Ty->getAs<TypedefType>())
48    return TT->getDecl()->getName() == "BOOL"   || // Objective-C
49           TT->getDecl()->getName() == "_Bool"  || // stdbool.h < C99
50           TT->getDecl()->getName() == "Boolean";  // MacTypes.h
51
52  return false;
53}
54
55void BoolAssignmentChecker::checkBind(SVal loc, SVal val, const Stmt *S,
56                                      CheckerContext &C) const {
57
58  // We are only interested in stores into Booleans.
59  const TypedValueRegion *TR =
60    dyn_cast_or_null<TypedValueRegion>(loc.getAsRegion());
61
62  if (!TR)
63    return;
64
65  QualType valTy = TR->getValueType();
66
67  if (!isBooleanType(valTy))
68    return;
69
70  // Get the value of the right-hand side.  We only care about values
71  // that are defined (UnknownVals and UndefinedVals are handled by other
72  // checkers).
73  Optional<NonLoc> NV = val.getAs<NonLoc>();
74  if (!NV)
75    return;
76
77  // Check if the assigned value meets our criteria for correctness.  It must
78  // be a value that is either 0 or 1.  One way to check this is to see if
79  // the value is possibly < 0 (for a negative value) or greater than 1.
80  ProgramStateRef state = C.getState();
81  SValBuilder &svalBuilder = C.getSValBuilder();
82  BasicValueFactory &BVF = svalBuilder.getBasicValueFactory();
83  ConstraintManager &CM = C.getConstraintManager();
84
85  llvm::APSInt Zero = BVF.getValue(0, valTy);
86  llvm::APSInt One = BVF.getValue(1, valTy);
87
88  ProgramStateRef StIn, StOut;
89  std::tie(StIn, StOut) = CM.assumeInclusiveRangeDual(state, *NV, Zero, One);
90
91  if (!StIn)
92    emitReport(StOut, C);
93}
94
95void ento::registerBoolAssignmentChecker(CheckerManager &mgr) {
96    mgr.registerChecker<BoolAssignmentChecker>();
97}
98
99bool ento::shouldRegisterBoolAssignmentChecker(const CheckerManager &mgr) {
100  return true;
101}
102