diff --git a/lib/Analysis/CMakeLists.txt b/lib/Analysis/CMakeLists.txt index 05d4ef1d9ebfe7721b0b7b9262c8428383134439..1f8584d9a15efe390aadb0998fbf245154700f0c 100644 --- a/lib/Analysis/CMakeLists.txt +++ b/lib/Analysis/CMakeLists.txt @@ -38,6 +38,7 @@ add_clang_library(clangAnalysis NSAutoreleasePoolChecker.cpp NSErrorChecker.cpp PathDiagnostic.cpp + PointerArithChecker.cpp PointerSubChecker.cpp RangeConstraintManager.cpp RegionStore.cpp diff --git a/lib/Analysis/GRExprEngineInternalChecks.cpp b/lib/Analysis/GRExprEngineInternalChecks.cpp index 41bb65558c40cdeafe55a525d7db12334a0c6d72..ee82969cd323ffe0158613bfd733720da0151349 100644 --- a/lib/Analysis/GRExprEngineInternalChecks.cpp +++ b/lib/Analysis/GRExprEngineInternalChecks.cpp @@ -413,6 +413,7 @@ void GRExprEngine::RegisterInternalChecks() { RegisterReturnStackAddressChecker(*this); RegisterReturnUndefChecker(*this); RegisterPointerSubChecker(*this); + RegisterPointerArithChecker(*this); RegisterFixedAddressChecker(*this); // Note that this must be registered after ReturnStackAddressChecker. RegisterReturnPointerRangeChecker(*this); diff --git a/lib/Analysis/GRExprEngineInternalChecks.h b/lib/Analysis/GRExprEngineInternalChecks.h index 4f8baadb78272ce120ba7d216f129af0850ebb12..cfbf5d7e154824f81e6dc7bf11ed596ea2370d3f 100644 --- a/lib/Analysis/GRExprEngineInternalChecks.h +++ b/lib/Analysis/GRExprEngineInternalChecks.h @@ -25,6 +25,7 @@ void RegisterReturnStackAddressChecker(GRExprEngine &Eng); void RegisterReturnUndefChecker(GRExprEngine &Eng); void RegisterVLASizeChecker(GRExprEngine &Eng); void RegisterPointerSubChecker(GRExprEngine &Eng); +void RegisterPointerArithChecker(GRExprEngine &Eng); void RegisterFixedAddressChecker(GRExprEngine &Eng); void RegisterCastToStructChecker(GRExprEngine &Eng); } // end clang namespace diff --git a/lib/Analysis/PointerArithChecker.cpp b/lib/Analysis/PointerArithChecker.cpp new file mode 100644 index 0000000000000000000000000000000000000000..5f5badb3d2df10e49937a389c0b0bcc6b12be0bb --- /dev/null +++ b/lib/Analysis/PointerArithChecker.cpp @@ -0,0 +1,72 @@ +//=== PointerArithChecker.cpp - Pointer arithmetic checker -----*- C++ -*--===// +// +// The LLVM Compiler Infrastructure +// +// This file is distributed under the University of Illinois Open Source +// License. See LICENSE.TXT for details. +// +//===----------------------------------------------------------------------===// +// +// This files defines PointerArithChecker, a builtin checker that checks for +// pointer arithmetic on locations other than array elements. +// +//===----------------------------------------------------------------------===// + +#include "clang/Analysis/PathSensitive/CheckerVisitor.h" +#include "GRExprEngineInternalChecks.h" + +using namespace clang; + +namespace { +class VISIBILITY_HIDDEN PointerArithChecker + : public CheckerVisitor<PointerArithChecker> { + BuiltinBug *BT; +public: + PointerArithChecker() : BT(0) {} + static void *getTag(); + void PreVisitBinaryOperator(CheckerContext &C, const BinaryOperator *B); +}; +} + +void *PointerArithChecker::getTag() { + static int x; + return &x; +} + +void PointerArithChecker::PreVisitBinaryOperator(CheckerContext &C, + const BinaryOperator *B) { + if (B->getOpcode() != BinaryOperator::Sub && + B->getOpcode() != BinaryOperator::Add) + return; + + const GRState *state = C.getState(); + SVal LV = state->getSVal(B->getLHS()); + SVal RV = state->getSVal(B->getRHS()); + + const MemRegion *LR = LV.getAsRegion(); + + if (!LR || !RV.isConstant()) + return; + + // If pointer arithmetic is done on variables of non-array type, this often + // means behavior rely on memory organization, which is dangerous. + if (isa<VarRegion>(LR) || isa<CodeTextRegion>(LR) || + isa<CompoundLiteralRegion>(LR)) { + + if (ExplodedNode *N = C.GenerateNode(B)) { + if (!BT) + BT = new BuiltinBug("Dangerous pointer arithmetic", + "Pointer arithmetic done on non-array variables " + "means reliance on memory layout, which is " + "dangerous."); + RangedBugReport *R = new RangedBugReport(*BT,BT->getDescription().c_str(), + N); + R->addRange(B->getSourceRange()); + C.EmitReport(R); + } + } +} + +void clang::RegisterPointerArithChecker(GRExprEngine &Eng) { + Eng.registerCheck(new PointerArithChecker()); +} diff --git a/test/Analysis/ptr-arith.c b/test/Analysis/ptr-arith.c index b9eecfcf1feb7f980b240b236c1736a528e05720..e53cc544268216e92e57e2ab25e2b171effc4d45 100644 --- a/test/Analysis/ptr-arith.c +++ b/test/Analysis/ptr-arith.c @@ -41,3 +41,12 @@ void f4() { int *p; p = (int*) 0x10000; // expected-warning{{Using a fixed address is not portable because that address will probably not be valid in all environments or platforms.}} } + +void f5() { + int x, y; + int *p; + p = &x + 1; // expected-warning{{Pointer arithmetic done on non array variables means reliance on memory layout, which is dangerous.}} + + int a[10]; + p = a + 1; // no-warning +}