1 //===- EnumCastOutOfRangeChecker.cpp ---------------------------*- C++ -*--===//
3 // Part of the LLVM Project, under the Apache License v2.0 with LLVM Exceptions.
4 // See https://llvm.org/LICENSE.txt for license information.
5 // SPDX-License-Identifier: Apache-2.0 WITH LLVM-exception
7 //===----------------------------------------------------------------------===//
9 // The EnumCastOutOfRangeChecker is responsible for checking integer to
10 // enumeration casts that could result in undefined values. This could happen
11 // if the value that we cast from is out of the value range of the enumeration.
13 // [ISO/IEC 14882-2014] ISO/IEC 14882-2014.
14 // Programming Languages — C++, Fourth Edition. 2014.
15 // C++ Standard, [dcl.enum], in paragraph 8, which defines the range of an enum
16 // C++ Standard, [expr.static.cast], paragraph 10, which defines the behaviour
17 // of casting an integer value that is out of range
18 // SEI CERT C++ Coding Standard, INT50-CPP. Do not cast to an out-of-range
20 //===----------------------------------------------------------------------===//
22 #include "clang/StaticAnalyzer/Checkers/BuiltinCheckerRegistration.h"
23 #include "clang/StaticAnalyzer/Core/BugReporter/BugType.h"
24 #include "clang/StaticAnalyzer/Core/PathSensitive/CheckerContext.h"
26 using namespace clang;
30 // This evaluator checks two SVals for equality. The first SVal is provided via
31 // the constructor, the second is the parameter of the overloaded () operator.
32 // It uses the in-built ConstraintManager to resolve the equlity to possible or
33 // not possible ProgramStates.
34 class ConstraintBasedEQEvaluator {
35 const DefinedOrUnknownSVal CompareValue;
36 const ProgramStateRef PS;
40 ConstraintBasedEQEvaluator(CheckerContext &C,
41 const DefinedOrUnknownSVal CompareValue)
42 : CompareValue(CompareValue), PS(C.getState()), SVB(C.getSValBuilder()) {}
44 bool operator()(const llvm::APSInt &EnumDeclInitValue) {
45 DefinedOrUnknownSVal EnumDeclValue = SVB.makeIntVal(EnumDeclInitValue);
46 DefinedOrUnknownSVal ElemEqualsValueToCast =
47 SVB.evalEQ(PS, EnumDeclValue, CompareValue);
49 return static_cast<bool>(PS->assume(ElemEqualsValueToCast, true));
53 // This checker checks CastExpr statements.
54 // If the value provided to the cast is one of the values the enumeration can
55 // represent, the said value matches the enumeration. If the checker can
56 // establish the impossibility of matching it gives a warning.
57 // Being conservative, it does not warn if there is slight possibility the
58 // value can be matching.
59 class EnumCastOutOfRangeChecker : public Checker<check::PreStmt<CastExpr>> {
60 mutable std::unique_ptr<BuiltinBug> EnumValueCastOutOfRange;
61 void reportWarning(CheckerContext &C) const;
64 void checkPreStmt(const CastExpr *CE, CheckerContext &C) const;
67 using EnumValueVector = llvm::SmallVector<llvm::APSInt, 6>;
69 // Collects all of the values an enum can represent (as SVals).
70 EnumValueVector getDeclValuesForEnum(const EnumDecl *ED) {
71 EnumValueVector DeclValues(
72 std::distance(ED->enumerator_begin(), ED->enumerator_end()));
73 llvm::transform(ED->enumerators(), DeclValues.begin(),
74 [](const EnumConstantDecl *D) { return D->getInitVal(); });
79 void EnumCastOutOfRangeChecker::reportWarning(CheckerContext &C) const {
80 if (const ExplodedNode *N = C.generateNonFatalErrorNode()) {
81 if (!EnumValueCastOutOfRange)
82 EnumValueCastOutOfRange.reset(
83 new BuiltinBug(this, "Enum cast out of range",
84 "The value provided to the cast expression is not in "
85 "the valid range of values for the enum"));
86 C.emitReport(llvm::make_unique<BugReport>(
87 *EnumValueCastOutOfRange, EnumValueCastOutOfRange->getDescription(),
92 void EnumCastOutOfRangeChecker::checkPreStmt(const CastExpr *CE,
93 CheckerContext &C) const {
95 // Only perform enum range check on casts where such checks are valid. For
96 // all other cast kinds (where enum range checks are unnecessary or invalid),
97 // just return immediately. TODO: The set of casts whitelisted for enum
98 // range checking may be incomplete. Better to add a missing cast kind to
99 // enable a missing check than to generate false negatives and have to remove
101 switch (CE->getCastKind()) {
102 case CK_IntegralCast:
110 // Get the value of the expression to cast.
111 const llvm::Optional<DefinedOrUnknownSVal> ValueToCast =
112 C.getSVal(CE->getSubExpr()).getAs<DefinedOrUnknownSVal>();
114 // If the value cannot be reasoned about (not even a DefinedOrUnknownSVal),
115 // don't analyze further.
119 const QualType T = CE->getType();
120 // Check whether the cast type is an enum.
121 if (!T->isEnumeralType())
124 // If the cast is an enum, get its declaration.
125 // If the isEnumeralType() returned true, then the declaration must exist
126 // even if it is a stub declaration. It is up to the getDeclValuesForEnum()
127 // function to handle this.
128 const EnumDecl *ED = T->castAs<EnumType>()->getDecl();
130 EnumValueVector DeclValues = getDeclValuesForEnum(ED);
131 // Check if any of the enum values possibly match.
132 bool PossibleValueMatch = llvm::any_of(
133 DeclValues, ConstraintBasedEQEvaluator(C, *ValueToCast));
135 // If there is no value that can possibly match any of the enum values, then
137 if (!PossibleValueMatch)
141 void ento::registerEnumCastOutOfRangeChecker(CheckerManager &mgr) {
142 mgr.registerChecker<EnumCastOutOfRangeChecker>();
145 bool ento::shouldRegisterEnumCastOutOfRangeChecker(const LangOptions &LO) {