EnumCastOutOfRangeChecker.cpp revision 360784
1//===- EnumCastOutOfRangeChecker.cpp ---------------------------*- C++ -*--===// 2// 3// Part of the LLVM Project, under the Apache License v2.0 with LLVM Exceptions. 4// See https://llvm.org/LICENSE.txt for license information. 5// SPDX-License-Identifier: Apache-2.0 WITH LLVM-exception 6// 7//===----------------------------------------------------------------------===// 8// 9// The EnumCastOutOfRangeChecker is responsible for checking integer to 10// enumeration casts that could result in undefined values. This could happen 11// if the value that we cast from is out of the value range of the enumeration. 12// Reference: 13// [ISO/IEC 14882-2014] ISO/IEC 14882-2014. 14// Programming Languages ��� C++, Fourth Edition. 2014. 15// C++ Standard, [dcl.enum], in paragraph 8, which defines the range of an enum 16// C++ Standard, [expr.static.cast], paragraph 10, which defines the behaviour 17// of casting an integer value that is out of range 18// SEI CERT C++ Coding Standard, INT50-CPP. Do not cast to an out-of-range 19// enumeration value 20//===----------------------------------------------------------------------===// 21 22#include "clang/StaticAnalyzer/Checkers/BuiltinCheckerRegistration.h" 23#include "clang/StaticAnalyzer/Core/BugReporter/BugType.h" 24#include "clang/StaticAnalyzer/Core/PathSensitive/CheckerContext.h" 25 26using namespace clang; 27using namespace ento; 28 29namespace { 30// This evaluator checks two SVals for equality. The first SVal is provided via 31// the constructor, the second is the parameter of the overloaded () operator. 32// It uses the in-built ConstraintManager to resolve the equlity to possible or 33// not possible ProgramStates. 34class ConstraintBasedEQEvaluator { 35 const DefinedOrUnknownSVal CompareValue; 36 const ProgramStateRef PS; 37 SValBuilder &SVB; 38 39public: 40 ConstraintBasedEQEvaluator(CheckerContext &C, 41 const DefinedOrUnknownSVal CompareValue) 42 : CompareValue(CompareValue), PS(C.getState()), SVB(C.getSValBuilder()) {} 43 44 bool operator()(const llvm::APSInt &EnumDeclInitValue) { 45 DefinedOrUnknownSVal EnumDeclValue = SVB.makeIntVal(EnumDeclInitValue); 46 DefinedOrUnknownSVal ElemEqualsValueToCast = 47 SVB.evalEQ(PS, EnumDeclValue, CompareValue); 48 49 return static_cast<bool>(PS->assume(ElemEqualsValueToCast, true)); 50 } 51}; 52 53// This checker checks CastExpr statements. 54// If the value provided to the cast is one of the values the enumeration can 55// represent, the said value matches the enumeration. If the checker can 56// establish the impossibility of matching it gives a warning. 57// Being conservative, it does not warn if there is slight possibility the 58// value can be matching. 59class EnumCastOutOfRangeChecker : public Checker<check::PreStmt<CastExpr>> { 60 mutable std::unique_ptr<BuiltinBug> EnumValueCastOutOfRange; 61 void reportWarning(CheckerContext &C) const; 62 63public: 64 void checkPreStmt(const CastExpr *CE, CheckerContext &C) const; 65}; 66 67using EnumValueVector = llvm::SmallVector<llvm::APSInt, 6>; 68 69// Collects all of the values an enum can represent (as SVals). 70EnumValueVector getDeclValuesForEnum(const EnumDecl *ED) { 71 EnumValueVector DeclValues( 72 std::distance(ED->enumerator_begin(), ED->enumerator_end())); 73 llvm::transform(ED->enumerators(), DeclValues.begin(), 74 [](const EnumConstantDecl *D) { return D->getInitVal(); }); 75 return DeclValues; 76} 77} // namespace 78 79void EnumCastOutOfRangeChecker::reportWarning(CheckerContext &C) const { 80 if (const ExplodedNode *N = C.generateNonFatalErrorNode()) { 81 if (!EnumValueCastOutOfRange) 82 EnumValueCastOutOfRange.reset( 83 new BuiltinBug(this, "Enum cast out of range", 84 "The value provided to the cast expression is not in " 85 "the valid range of values for the enum")); 86 C.emitReport(std::make_unique<PathSensitiveBugReport>( 87 *EnumValueCastOutOfRange, EnumValueCastOutOfRange->getDescription(), 88 N)); 89 } 90} 91 92void EnumCastOutOfRangeChecker::checkPreStmt(const CastExpr *CE, 93 CheckerContext &C) const { 94 95 // Only perform enum range check on casts where such checks are valid. For 96 // all other cast kinds (where enum range checks are unnecessary or invalid), 97 // just return immediately. TODO: The set of casts whitelisted for enum 98 // range checking may be incomplete. Better to add a missing cast kind to 99 // enable a missing check than to generate false negatives and have to remove 100 // those later. 101 switch (CE->getCastKind()) { 102 case CK_IntegralCast: 103 break; 104 105 default: 106 return; 107 break; 108 } 109 110 // Get the value of the expression to cast. 111 const llvm::Optional<DefinedOrUnknownSVal> ValueToCast = 112 C.getSVal(CE->getSubExpr()).getAs<DefinedOrUnknownSVal>(); 113 114 // If the value cannot be reasoned about (not even a DefinedOrUnknownSVal), 115 // don't analyze further. 116 if (!ValueToCast) 117 return; 118 119 const QualType T = CE->getType(); 120 // Check whether the cast type is an enum. 121 if (!T->isEnumeralType()) 122 return; 123 124 // If the cast is an enum, get its declaration. 125 // If the isEnumeralType() returned true, then the declaration must exist 126 // even if it is a stub declaration. It is up to the getDeclValuesForEnum() 127 // function to handle this. 128 const EnumDecl *ED = T->castAs<EnumType>()->getDecl(); 129 130 EnumValueVector DeclValues = getDeclValuesForEnum(ED); 131 // Check if any of the enum values possibly match. 132 bool PossibleValueMatch = llvm::any_of( 133 DeclValues, ConstraintBasedEQEvaluator(C, *ValueToCast)); 134 135 // If there is no value that can possibly match any of the enum values, then 136 // warn. 137 if (!PossibleValueMatch) 138 reportWarning(C); 139} 140 141void ento::registerEnumCastOutOfRangeChecker(CheckerManager &mgr) { 142 mgr.registerChecker<EnumCastOutOfRangeChecker>(); 143} 144 145bool ento::shouldRegisterEnumCastOutOfRangeChecker(const LangOptions &LO) { 146 return true; 147} 148