1 //== BoolAssignmentChecker.cpp - Boolean assignment checker -----*- C++ -*--==//
3 // The LLVM Compiler Infrastructure
5 // This file is distributed under the University of Illinois Open Source
6 // License. See LICENSE.TXT for details.
8 //===----------------------------------------------------------------------===//
10 // This defines BoolAssignmentChecker, a builtin check in ExprEngine that
11 // performs checks for assignment of non-Boolean values to Boolean variables.
13 //===----------------------------------------------------------------------===//
15 #include "ClangSACheckers.h"
16 #include "clang/StaticAnalyzer/Core/BugReporter/BugType.h"
17 #include "clang/StaticAnalyzer/Core/Checker.h"
18 #include "clang/StaticAnalyzer/Core/CheckerManager.h"
19 #include "clang/StaticAnalyzer/Core/PathSensitive/CheckerContext.h"
21 using namespace clang;
25 class BoolAssignmentChecker : public Checker< check::Bind > {
26 mutable std::unique_ptr<BuiltinBug> BT;
27 void emitReport(ProgramStateRef state, CheckerContext &C) const;
29 void checkBind(SVal loc, SVal val, const Stmt *S, CheckerContext &C) const;
31 } // end anonymous namespace
33 void BoolAssignmentChecker::emitReport(ProgramStateRef state,
34 CheckerContext &C) const {
35 if (ExplodedNode *N = C.generateNonFatalErrorNode(state)) {
37 BT.reset(new BuiltinBug(this, "Assignment of a non-Boolean value"));
38 C.emitReport(llvm::make_unique<BugReport>(*BT, BT->getDescription(), N));
42 static bool isBooleanType(QualType Ty) {
43 if (Ty->isBooleanType()) // C++ or C99
46 if (const TypedefType *TT = Ty->getAs<TypedefType>())
47 return TT->getDecl()->getName() == "BOOL" || // Objective-C
48 TT->getDecl()->getName() == "_Bool" || // stdbool.h < C99
49 TT->getDecl()->getName() == "Boolean"; // MacTypes.h
54 void BoolAssignmentChecker::checkBind(SVal loc, SVal val, const Stmt *S,
55 CheckerContext &C) const {
57 // We are only interested in stores into Booleans.
58 const TypedValueRegion *TR =
59 dyn_cast_or_null<TypedValueRegion>(loc.getAsRegion());
64 QualType valTy = TR->getValueType();
66 if (!isBooleanType(valTy))
69 // Get the value of the right-hand side. We only care about values
70 // that are defined (UnknownVals and UndefinedVals are handled by other
72 Optional<DefinedSVal> DV = val.getAs<DefinedSVal>();
76 // Check if the assigned value meets our criteria for correctness. It must
77 // be a value that is either 0 or 1. One way to check this is to see if
78 // the value is possibly < 0 (for a negative value) or greater than 1.
79 ProgramStateRef state = C.getState();
80 SValBuilder &svalBuilder = C.getSValBuilder();
81 ConstraintManager &CM = C.getConstraintManager();
83 // First, ensure that the value is >= 0.
84 DefinedSVal zeroVal = svalBuilder.makeIntVal(0, valTy);
85 SVal greaterThanOrEqualToZeroVal =
86 svalBuilder.evalBinOp(state, BO_GE, *DV, zeroVal,
87 svalBuilder.getConditionType());
89 Optional<DefinedSVal> greaterThanEqualToZero =
90 greaterThanOrEqualToZeroVal.getAs<DefinedSVal>();
92 if (!greaterThanEqualToZero) {
93 // The SValBuilder cannot construct a valid SVal for this condition.
94 // This means we cannot properly reason about it.
98 ProgramStateRef stateLT, stateGE;
99 std::tie(stateGE, stateLT) = CM.assumeDual(state, *greaterThanEqualToZero);
101 // Is it possible for the value to be less than zero?
103 // It is possible for the value to be less than zero. We only
104 // want to emit a warning, however, if that value is fully constrained.
105 // If it it possible for the value to be >= 0, then essentially the
106 // value is underconstrained and there is nothing left to be done.
108 emitReport(stateLT, C);
110 // In either case, we are done.
114 // If we reach here, it must be the case that the value is constrained
116 assert(stateGE == state);
118 // At this point we know that the value is >= 0.
119 // Now check to ensure that the value is <= 1.
120 DefinedSVal OneVal = svalBuilder.makeIntVal(1, valTy);
121 SVal lessThanEqToOneVal =
122 svalBuilder.evalBinOp(state, BO_LE, *DV, OneVal,
123 svalBuilder.getConditionType());
125 Optional<DefinedSVal> lessThanEqToOne =
126 lessThanEqToOneVal.getAs<DefinedSVal>();
128 if (!lessThanEqToOne) {
129 // The SValBuilder cannot construct a valid SVal for this condition.
130 // This means we cannot properly reason about it.
134 ProgramStateRef stateGT, stateLE;
135 std::tie(stateLE, stateGT) = CM.assumeDual(state, *lessThanEqToOne);
137 // Is it possible for the value to be greater than one?
139 // It is possible for the value to be greater than one. We only
140 // want to emit a warning, however, if that value is fully constrained.
141 // If it is possible for the value to be <= 1, then essentially the
142 // value is underconstrained and there is nothing left to be done.
144 emitReport(stateGT, C);
146 // In either case, we are done.
150 // If we reach here, it must be the case that the value is constrained
152 assert(stateLE == state);
155 void ento::registerBoolAssignmentChecker(CheckerManager &mgr) {
156 mgr.registerChecker<BoolAssignmentChecker>();