1 //=== CastToStructChecker.cpp - Fixed address usage checker ----*- C++ -*--===//
3 // The LLVM Compiler Infrastructure
5 // This file is distributed under the University of Illinois Open Source
6 // License. See LICENSE.TXT for details.
8 //===----------------------------------------------------------------------===//
10 // This files defines CastToStructChecker, a builtin checker that checks for
11 // cast from non-struct pointer to struct pointer.
12 // This check corresponds to CWE-588.
14 //===----------------------------------------------------------------------===//
16 #include "ClangSACheckers.h"
17 #include "clang/StaticAnalyzer/Core/Checker.h"
18 #include "clang/StaticAnalyzer/Core/CheckerManager.h"
19 #include "clang/StaticAnalyzer/Core/PathSensitive/CheckerContext.h"
20 #include "clang/StaticAnalyzer/Core/BugReporter/BugType.h"
22 using namespace clang;
26 class CastToStructChecker : public Checker< check::PreStmt<CastExpr> > {
27 mutable llvm::OwningPtr<BuiltinBug> BT;
30 void checkPreStmt(const CastExpr *CE, CheckerContext &C) const;
34 void CastToStructChecker::checkPreStmt(const CastExpr *CE,
35 CheckerContext &C) const {
36 const Expr *E = CE->getSubExpr();
37 ASTContext &Ctx = C.getASTContext();
38 QualType OrigTy = Ctx.getCanonicalType(E->getType());
39 QualType ToTy = Ctx.getCanonicalType(CE->getType());
41 const PointerType *OrigPTy = dyn_cast<PointerType>(OrigTy.getTypePtr());
42 const PointerType *ToPTy = dyn_cast<PointerType>(ToTy.getTypePtr());
44 if (!ToPTy || !OrigPTy)
47 QualType OrigPointeeTy = OrigPTy->getPointeeType();
48 QualType ToPointeeTy = ToPTy->getPointeeType();
50 if (!ToPointeeTy->isStructureOrClassType())
53 // We allow cast from void*.
54 if (OrigPointeeTy->isVoidType())
57 // Now the cast-to-type is struct pointer, the original type is not void*.
58 if (!OrigPointeeTy->isRecordType()) {
59 if (ExplodedNode *N = C.generateNode()) {
61 BT.reset(new BuiltinBug("Cast from non-struct type to struct type",
62 "Casting a non-structure type to a structure type "
63 "and accessing a field can lead to memory access "
64 "errors or data corruption."));
65 BugReport *R = new BugReport(*BT,BT->getDescription(), N);
66 R->addRange(CE->getSourceRange());
72 void ento::registerCastToStructChecker(CheckerManager &mgr) {
73 mgr.registerChecker<CastToStructChecker>();