[analyzer][NFC] Refine CStringLength modeling API

[steakhal]

Summary

Refines the CStringLength modeling API to be pure.
Also removes the magic hypothetical parameter from the CStringChecker.

Now the getters and setters are behaving as expected.

[steakhal]

It seems the Pre-merge clang-format went crazy.
I think just ignore the lint warnings for the unchanged lines.

[balazske]

Really I am still not totally familiar how the checkers work and if it is good to have these function names. I was thinking about any checker that needs a string length information. It could get the data from CStringChecker using a "get" function or test if there is data at all. In this case it may happen that this get function modifies state or computes the length at that point? And how do the set operation work, it only stores a value computed by the calling code? And the create operation then does the computation and set together? The functions look not symmetrical, the set and create takes a MemRegion but the get takes a SVal. The create function sets the length for the passed memory region but makes no tests on it like the set function (can we call the set function from the create?).

[NoQ]

clang/lib/StaticAnalyzer/Checkers/CStringChecker/CStringLength.h

42

Just pass by value then. It's already a "Ref".

50

This const does nothing.

[steakhal]

Fixed Artem's inline comments:

• cstring::getCStringLength now takes StateRef by value
• cstring::dumpCStringLengths now takes by StateRef by non const value

[steakhal]

In D84979#2190996, @balazske wrote:

Really I am still not totally familiar how the checkers work and if it is good to have these function names.

Yea, naming things is pretty hard. I'm open to have a less verbose one - especially since these API functions will live under some namespace.

[...] It could get the data from CStringChecker using a "get" function or test if there is data at all. In this case it may happen that this get function modifies state or computes the length at that point?

This patch makes sure that the get function will not modify the state (takes a const ProgramStateRef).
We don't really want to store the length of a StringLiteral, since that can be computed on demand.

And how do the set operation work, it only stores a value computed by the calling code?

It tries to avoid storing the length information. E.g. if a region refers to a string literal - we don't have to store the length. (This was the previous behavior, I don't want to change that.)
However, we don't handle ElementRegions (for now, but I'm working on it).

And the create operation then does the computation and set together?

CStringChecker needs a way to defer associating the length of the region.
I'm not sure why, but the magic Hypothetical parameter was introduced just for accomplishing that.
I'm not confident enough to refactor the function which exploits this. [1]

The functions look not symmetrical, the set and create takes a MemRegion but the get takes a SVal.

The current implementation checks if the SVal is a GotoLabel (which is not a MemRegion). I didn't want to change its behavior in this patch.
MemRegion parameter would fit much more nicely, just as you said.

The create function sets the length for the passed memory region

No, it just creates a symbol, representing a cstring length. That symbol is (strictly speaking) not yet associated with the memory region.
Furthermore, it applies implicit constraints like assuming that the cstring length is always less than the corresponding extent (It is not yet done, but I'm working on this too).

but makes no tests on it like the set function (can we call the set function from the create?).

We could call, but we need a mechanism to defer associating the length of a region.
CStringChecker relies on this behavior. See my paragraph about the Hypothetical parameter.

---

@balazske Unfortunately, I don't have satisfying answers to you, but any further improvements could be done in the future.

clang/lib/StaticAnalyzer/Checkers/CMakeLists.txt

 set(LLVM_LINK_COMPONENTS
   FrontendOpenMP
   Support
   )
 
 add_clang_library(clangStaticAnalyzerCheckers
   AnalysisOrderChecker.cpp
   AnalyzerStatsChecker.cpp
   ArrayBoundChecker.cpp
   ArrayBoundCheckerV2.cpp
   BasicObjCFoundationChecks.cpp
   BlockInCriticalSectionChecker.cpp
   BoolAssignmentChecker.cpp
   BuiltinFunctionChecker.cpp
-  CStringChecker.cpp
+  CStringChecker/CStringChecker.cpp
+  CStringChecker/CStringLengthModeling.cpp
   CStringSyntaxChecker.cpp
   CallAndMessageChecker.cpp
   CastSizeChecker.cpp
   CastToStructChecker.cpp
   CastValueChecker.cpp
   CheckObjCDealloc.cpp
   CheckObjCInstMethSignature.cpp
   CheckPlacementNew.cpp
add_clang_library(clangStaticAnalyzerCheckers
   clangAnalysis
   clangBasic
   clangLex
   clangStaticAnalyzerCore
 
   DEPENDS
   omp_gen
   )
+
+target_include_directories(clangStaticAnalyzerCheckers PRIVATE
+  CStringChecker
+  )

clang/lib/StaticAnalyzer/Checkers/CStringChecker/CStringChecker.h

+//= CStringChecker.h - Checks calls to C string functions ----------*- C++ -*-//
+//
+// Part of the LLVM Project, under the Apache License v2.0 with LLVM Exceptions.
+// See https://llvm.org/LICENSE.txt for license information.
+// SPDX-License-Identifier: Apache-2.0 WITH LLVM-exception
+//
+//===----------------------------------------------------------------------===//
+//
+// Models C string related functions.
+//
+//===----------------------------------------------------------------------===//
+
+#ifndef LLVM_CLANG_LIB_STATICANALYZER_CHECKERS_CSTRINGCHECKER_CSTRINGCHECKER_H
+#define LLVM_CLANG_LIB_STATICANALYZER_CHECKERS_CSTRINGCHECKER_CSTRINGCHECKER_H
+
+#include "clang/StaticAnalyzer/Core/PathSensitive/CallEvent.h"
+#include "clang/StaticAnalyzer/Core/PathSensitive/CheckerContext.h"
+
+namespace clang {
+namespace ento {
+namespace cstring {
+
+struct AnyArgExpr {
+  // FIXME: Remove constructor in C++17 to turn it into an aggregate.
+  AnyArgExpr(const Expr *Expression, unsigned ArgumentIndex)
+      : Expression{Expression}, ArgumentIndex{ArgumentIndex} {}
+  const Expr *Expression;
+  unsigned ArgumentIndex;
+};
+
+struct SourceArgExpr : AnyArgExpr {
+  using AnyArgExpr::AnyArgExpr; // FIXME: Remove using in C++17.
+};
+
+struct DestinationArgExpr : AnyArgExpr {
+  using AnyArgExpr::AnyArgExpr; // FIXME: Same.
+};
+
+struct SizeArgExpr : AnyArgExpr {
+  using AnyArgExpr::AnyArgExpr; // FIXME: Same.
+};
+
+class CStringChecker
+    : public Checker<eval::Call, check::PreStmt<DeclStmt>, check::LiveSymbols,
+                     check::DeadSymbols, check::RegionChanges> {
+  mutable std::unique_ptr<BugType> BT_Null, BT_Bounds, BT_Overlap,
+      BT_NotCString;
+
+  mutable const char *CurrentFunctionDescription;
+
+  using ErrorMessage = SmallString<128>;
+  enum class AccessKind { write, read };
+  enum class ConcatFnKind { none = 0, strcat = 1, strlcat = 2 };
+
+public:
+  /// Models and checks cstring related function pre and post-conditions.
+  bool evalCall(const CallEvent &Call, CheckerContext &C) const;
+
+  /// Tracks and maintains the associated cstring lengths of memory regions.
+  static void *getTag();
+  void checkPreStmt(const DeclStmt *, CheckerContext &) const;
+  void checkLiveSymbols(ProgramStateRef, SymbolReaper &) const;
+  void checkDeadSymbols(SymbolReaper &, CheckerContext &) const;
+  ProgramStateRef
+  checkRegionChanges(ProgramStateRef, const InvalidatedSymbols *,
+                     ArrayRef<const MemRegion *>, ArrayRef<const MemRegion *>,
+                     const LocationContext *, const CallEvent *) const;
+  // TODO: Is it useful?
+  void printState(raw_ostream &Out, ProgramStateRef State, const char *NL,
+                  const char *Sep) const;
+
+  /// The filter is used to filter out the diagnostics which are not enabled by
+  /// the user.
+  struct {
+    DefaultBool CheckCStringNullArg;
+    DefaultBool CheckCStringOutOfBounds;
+    DefaultBool CheckCStringBufferOverlap;
+    DefaultBool CheckCStringNotNullTerm;
+
+    CheckerNameRef CheckNameCStringNullArg;
+    CheckerNameRef CheckNameCStringOutOfBounds;
+    CheckerNameRef CheckNameCStringBufferOverlap;
+    CheckerNameRef CheckNameCStringNotNullTerm;
+  } Filter;
+
+private:
+  typedef void (CStringChecker::*FnCheck)(CheckerContext &,
+                                          const CallExpr *) const;
+  CallDescriptionMap<FnCheck> Callbacks = {
+      {{CDF_MaybeBuiltin, "memcpy", 3}, &CStringChecker::evalMemcpy},
+      {{CDF_MaybeBuiltin, "mempcpy", 3}, &CStringChecker::evalMempcpy},
+      {{CDF_MaybeBuiltin, "memcmp", 3}, &CStringChecker::evalMemcmp},
+      {{CDF_MaybeBuiltin, "memmove", 3}, &CStringChecker::evalMemmove},
+      {{CDF_MaybeBuiltin, "memset", 3}, &CStringChecker::evalMemset},
+      {{CDF_MaybeBuiltin, "explicit_memset", 3}, &CStringChecker::evalMemset},
+      {{CDF_MaybeBuiltin, "strcpy", 2}, &CStringChecker::evalStrcpy},
+      {{CDF_MaybeBuiltin, "strncpy", 3}, &CStringChecker::evalStrncpy},
+      {{CDF_MaybeBuiltin, "stpcpy", 2}, &CStringChecker::evalStpcpy},
+      {{CDF_MaybeBuiltin, "strlcpy", 3}, &CStringChecker::evalStrlcpy},
+      {{CDF_MaybeBuiltin, "strcat", 2}, &CStringChecker::evalStrcat},
+      {{CDF_MaybeBuiltin, "strncat", 3}, &CStringChecker::evalStrncat},
+      {{CDF_MaybeBuiltin, "strlcat", 3}, &CStringChecker::evalStrlcat},
+      {{CDF_MaybeBuiltin, "strlen", 1}, &CStringChecker::evalstrLength},
+      {{CDF_MaybeBuiltin, "strnlen", 2}, &CStringChecker::evalstrnLength},
+      {{CDF_MaybeBuiltin, "strcmp", 2}, &CStringChecker::evalStrcmp},
+      {{CDF_MaybeBuiltin, "strncmp", 3}, &CStringChecker::evalStrncmp},
+      {{CDF_MaybeBuiltin, "strcasecmp", 2}, &CStringChecker::evalStrcasecmp},
+      {{CDF_MaybeBuiltin, "strncasecmp", 3}, &CStringChecker::evalStrncasecmp},
+      {{CDF_MaybeBuiltin, "strsep", 2}, &CStringChecker::evalStrsep},
+      {{CDF_MaybeBuiltin, "bcopy", 3}, &CStringChecker::evalBcopy},
+      {{CDF_MaybeBuiltin, "bcmp", 3}, &CStringChecker::evalMemcmp},
+      {{CDF_MaybeBuiltin, "bzero", 2}, &CStringChecker::evalBzero},
+      {{CDF_MaybeBuiltin, "explicit_bzero", 2}, &CStringChecker::evalBzero},
+  };
+
+  // These require a bit of special handling.
+  CallDescription StdCopy{{"std", "copy"}, 3},
+      StdCopyBackward{{"std", "copy_backward"}, 3};
+
+  FnCheck identifyCall(const CallEvent &Call, CheckerContext &C) const;
+  void evalMemcpy(CheckerContext &C, const CallExpr *CE) const;
+  void evalMempcpy(CheckerContext &C, const CallExpr *CE) const;
+  void evalMemmove(CheckerContext &C, const CallExpr *CE) const;
+  void evalBcopy(CheckerContext &C, const CallExpr *CE) const;
+  void evalCopyCommon(CheckerContext &C, const CallExpr *CE,
+                      ProgramStateRef state, SizeArgExpr Size,
+                      DestinationArgExpr Dest, SourceArgExpr Source,
+                      bool Restricted, bool IsMempcpy) const;
+
+  void evalMemcmp(CheckerContext &C, const CallExpr *CE) const;
+
+  void evalstrLength(CheckerContext &C, const CallExpr *CE) const;
+  void evalstrnLength(CheckerContext &C, const CallExpr *CE) const;
+  void evalstrLengthCommon(CheckerContext &C, const CallExpr *CE,
+                           bool IsStrnlen = false) const;
+
+  void evalStrcpy(CheckerContext &C, const CallExpr *CE) const;
+  void evalStrncpy(CheckerContext &C, const CallExpr *CE) const;
+  void evalStpcpy(CheckerContext &C, const CallExpr *CE) const;
+  void evalStrlcpy(CheckerContext &C, const CallExpr *CE) const;
+  void evalStrcpyCommon(CheckerContext &C, const CallExpr *CE, bool ReturnEnd,
+                        bool IsBounded, ConcatFnKind appendK,
+                        bool returnPtr = true) const;
+
+  void evalStrcat(CheckerContext &C, const CallExpr *CE) const;
+  void evalStrncat(CheckerContext &C, const CallExpr *CE) const;
+  void evalStrlcat(CheckerContext &C, const CallExpr *CE) const;
+
+  void evalStrcmp(CheckerContext &C, const CallExpr *CE) const;
+  void evalStrncmp(CheckerContext &C, const CallExpr *CE) const;
+  void evalStrcasecmp(CheckerContext &C, const CallExpr *CE) const;
+  void evalStrncasecmp(CheckerContext &C, const CallExpr *CE) const;
+  void evalStrcmpCommon(CheckerContext &C, const CallExpr *CE,
+                        bool IsBounded = false, bool IgnoreCase = false) const;
+
+  void evalStrsep(CheckerContext &C, const CallExpr *CE) const;
+
+  void evalStdCopy(CheckerContext &C, const CallExpr *CE) const;
+  void evalStdCopyBackward(CheckerContext &C, const CallExpr *CE) const;
+  void evalStdCopyCommon(CheckerContext &C, const CallExpr *CE) const;
+  void evalMemset(CheckerContext &C, const CallExpr *CE) const;
+  void evalBzero(CheckerContext &C, const CallExpr *CE) const;
+
+  // Utility methods
+
+  static ErrorMessage createOutOfBoundErrorMsg(StringRef FunctionDescription,
+                                               AccessKind Access);
+
+  /// Simply wraps the cstring::getCStringLength function to emit warnings.
+  SVal getCStringLengthChecked(CheckerContext &Ctx, ProgramStateRef &State,
+                               const Expr *Ex, SVal Buf) const;
+
+  std::pair<ProgramStateRef, ProgramStateRef> static assumeZero(
+      CheckerContext &C, ProgramStateRef state, SVal V, QualType Ty);
+
+  static ProgramStateRef InvalidateBuffer(CheckerContext &C,
+                                          ProgramStateRef state, const Expr *Ex,
+                                          SVal V, bool IsSourceBuffer,
+                                          const Expr *Size);
+
+  static bool SummarizeRegion(raw_ostream &os, ASTContext &Ctx,
+                              const MemRegion *MR);
+
+  static bool memsetAux(const Expr *DstBuffer, SVal CharE, const Expr *Size,
+                        CheckerContext &C, ProgramStateRef &State);
+
+  // Re-usable checks
+  ProgramStateRef checkNonNull(CheckerContext &C, ProgramStateRef State,
+                               AnyArgExpr Arg, SVal l) const;
+  ProgramStateRef CheckLocation(CheckerContext &C, ProgramStateRef state,
+                                AnyArgExpr Buffer, SVal Element,
+                                AccessKind Access) const;
+  ProgramStateRef CheckBufferAccess(CheckerContext &C, ProgramStateRef State,
+                                    AnyArgExpr Buffer, SizeArgExpr Size,
+                                    AccessKind Access) const;
+  ProgramStateRef CheckOverlap(CheckerContext &C, ProgramStateRef state,
+                               SizeArgExpr Size, AnyArgExpr First,
+                               AnyArgExpr Second) const;
+  void emitOverlapBug(CheckerContext &C, ProgramStateRef state,
+                      const Stmt *First, const Stmt *Second) const;
+
+  void emitNullArgBug(CheckerContext &C, ProgramStateRef State, const Stmt *S,
+                      StringRef WarningMsg) const;
+  void emitOutOfBoundsBug(CheckerContext &C, ProgramStateRef State,
+                          const Stmt *S, StringRef WarningMsg) const;
+  void emitNotCStringBug(CheckerContext &C, ProgramStateRef State,
+                         const Stmt *S, StringRef WarningMsg) const;
+  void emitAdditionOverflowBug(CheckerContext &C, ProgramStateRef State) const;
+
+  ProgramStateRef checkAdditionOverflow(CheckerContext &C,
+                                        ProgramStateRef state, NonLoc left,
+                                        NonLoc right) const;
+
+  // Return true if the destination buffer of the copy function may be in bound.
+  // Expects SVal of Size to be positive and unsigned.
+  // Expects SVal of FirstBuf to be a FieldRegion.
+  static bool IsFirstBufInBound(CheckerContext &C, ProgramStateRef state,
+                                const Expr *FirstBuf, const Expr *Size);
+};
+
+} // namespace cstring
+} // namespace ento
+} // namespace clang
+
+#endif
 No newline at end of file

clang/lib/StaticAnalyzer/Checkers/CStringChecker/CStringChecker.cpp

 //= CStringChecker.cpp - Checks calls to C string functions --------*- C++ -*-//
 //
 // Part of the LLVM Project, under the Apache License v2.0 with LLVM Exceptions.
 // See https://llvm.org/LICENSE.txt for license information.
 // SPDX-License-Identifier: Apache-2.0 WITH LLVM-exception
 //
 //===----------------------------------------------------------------------===//
 //
 // This defines CStringChecker, which is an assortment of checks on calls
 // to functions in <string.h>.
 //
 //===----------------------------------------------------------------------===//
 
-#include "InterCheckerAPI.h"
+#include "CStringChecker.h"
+#include "CStringLength.h"
 #include "clang/Basic/CharInfo.h"
 #include "clang/StaticAnalyzer/Checkers/BuiltinCheckerRegistration.h"
 #include "clang/StaticAnalyzer/Core/BugReporter/BugType.h"
-#include "clang/StaticAnalyzer/Core/Checker.h"
 #include "clang/StaticAnalyzer/Core/CheckerManager.h"
 #include "clang/StaticAnalyzer/Core/PathSensitive/CallEvent.h"
 #include "clang/StaticAnalyzer/Core/PathSensitive/CheckerContext.h"
 #include "clang/StaticAnalyzer/Core/PathSensitive/DynamicSize.h"
-#include "clang/StaticAnalyzer/Core/PathSensitive/ProgramStateTrait.h"
 #include "llvm/ADT/STLExtras.h"
 #include "llvm/ADT/SmallString.h"
 #include "llvm/ADT/StringExtras.h"
 #include "llvm/Support/raw_ostream.h"
 
-using namespace clang;
-using namespace ento;
-
-namespace {
-struct AnyArgExpr {
-  // FIXME: Remove constructor in C++17 to turn it into an aggregate.
-  AnyArgExpr(const Expr *Expression, unsigned ArgumentIndex)
-      : Expression{Expression}, ArgumentIndex{ArgumentIndex} {}
-  const Expr *Expression;
-  unsigned ArgumentIndex;
-};
-
-struct SourceArgExpr : AnyArgExpr {
-  using AnyArgExpr::AnyArgExpr; // FIXME: Remove using in C++17.
-};
-
-struct DestinationArgExpr : AnyArgExpr {
-  using AnyArgExpr::AnyArgExpr; // FIXME: Same.
-};
-
-struct SizeArgExpr : AnyArgExpr {
-  using AnyArgExpr::AnyArgExpr; // FIXME: Same.
-};
-
-using ErrorMessage = SmallString<128>;
-enum class AccessKind { write, read };
-
-static ErrorMessage createOutOfBoundErrorMsg(StringRef FunctionDescription,
-                                             AccessKind Access) {
+namespace clang {
+namespace ento {
+namespace cstring {
+
+auto CStringChecker::createOutOfBoundErrorMsg(StringRef FunctionDescription,
+                                              AccessKind Access)
+    -> ErrorMessage {
   ErrorMessage Message;
   llvm::raw_svector_ostream Os(Message);
 
   // Function classification like: Memory copy function
   Os << toUppercase(FunctionDescription.front())
      << &FunctionDescription.data()[1];
 
   if (Access == AccessKind::write) {
     Os << " overflows the destination buffer";
   } else { // read access
     Os << " accesses out-of-bound array element";
   }
 
   return Message;
 }
 
-enum class ConcatFnKind { none = 0, strcat = 1, strlcat = 2 };
-class CStringChecker : public Checker< eval::Call,
-                                         check::PreStmt<DeclStmt>,
-                                         check::LiveSymbols,
-                                         check::DeadSymbols,
-                                         check::RegionChanges
-                                         > {
-  mutable std::unique_ptr<BugType> BT_Null, BT_Bounds, BT_Overlap,
-      BT_NotCString, BT_AdditionOverflow;
-
-  mutable const char *CurrentFunctionDescription;
-
-public:
-  /// The filter is used to filter out the diagnostics which are not enabled by
-  /// the user.
-  struct CStringChecksFilter {
-    DefaultBool CheckCStringNullArg;
-    DefaultBool CheckCStringOutOfBounds;
-    DefaultBool CheckCStringBufferOverlap;
-    DefaultBool CheckCStringNotNullTerm;
-
-    CheckerNameRef CheckNameCStringNullArg;
-    CheckerNameRef CheckNameCStringOutOfBounds;
-    CheckerNameRef CheckNameCStringBufferOverlap;
-    CheckerNameRef CheckNameCStringNotNullTerm;
-  };
-
-  CStringChecksFilter Filter;
-
-  static void *getTag() { static int tag; return &tag; }
-
-  bool evalCall(const CallEvent &Call, CheckerContext &C) const;
-  void checkPreStmt(const DeclStmt *DS, CheckerContext &C) const;
-  void checkLiveSymbols(ProgramStateRef state, SymbolReaper &SR) const;
-  void checkDeadSymbols(SymbolReaper &SR, CheckerContext &C) const;
-
-  ProgramStateRef
-    checkRegionChanges(ProgramStateRef state,
-                       const InvalidatedSymbols *,
-                       ArrayRef<const MemRegion *> ExplicitRegions,
-                       ArrayRef<const MemRegion *> Regions,
-                       const LocationContext *LCtx,
-                       const CallEvent *Call) const;
-
-  typedef void (CStringChecker::*FnCheck)(CheckerContext &,
-                                          const CallExpr *) const;
-  CallDescriptionMap<FnCheck> Callbacks = {
-      {{CDF_MaybeBuiltin, "memcpy", 3}, &CStringChecker::evalMemcpy},
-      {{CDF_MaybeBuiltin, "mempcpy", 3}, &CStringChecker::evalMempcpy},
-      {{CDF_MaybeBuiltin, "memcmp", 3}, &CStringChecker::evalMemcmp},
-      {{CDF_MaybeBuiltin, "memmove", 3}, &CStringChecker::evalMemmove},
-      {{CDF_MaybeBuiltin, "memset", 3}, &CStringChecker::evalMemset},
-      {{CDF_MaybeBuiltin, "explicit_memset", 3}, &CStringChecker::evalMemset},
-      {{CDF_MaybeBuiltin, "strcpy", 2}, &CStringChecker::evalStrcpy},
-      {{CDF_MaybeBuiltin, "strncpy", 3}, &CStringChecker::evalStrncpy},
-      {{CDF_MaybeBuiltin, "stpcpy", 2}, &CStringChecker::evalStpcpy},
-      {{CDF_MaybeBuiltin, "strlcpy", 3}, &CStringChecker::evalStrlcpy},
-      {{CDF_MaybeBuiltin, "strcat", 2}, &CStringChecker::evalStrcat},
-      {{CDF_MaybeBuiltin, "strncat", 3}, &CStringChecker::evalStrncat},
-      {{CDF_MaybeBuiltin, "strlcat", 3}, &CStringChecker::evalStrlcat},
-      {{CDF_MaybeBuiltin, "strlen", 1}, &CStringChecker::evalstrLength},
-      {{CDF_MaybeBuiltin, "strnlen", 2}, &CStringChecker::evalstrnLength},
-      {{CDF_MaybeBuiltin, "strcmp", 2}, &CStringChecker::evalStrcmp},
-      {{CDF_MaybeBuiltin, "strncmp", 3}, &CStringChecker::evalStrncmp},
-      {{CDF_MaybeBuiltin, "strcasecmp", 2}, &CStringChecker::evalStrcasecmp},
-      {{CDF_MaybeBuiltin, "strncasecmp", 3}, &CStringChecker::evalStrncasecmp},
-      {{CDF_MaybeBuiltin, "strsep", 2}, &CStringChecker::evalStrsep},
-      {{CDF_MaybeBuiltin, "bcopy", 3}, &CStringChecker::evalBcopy},
-      {{CDF_MaybeBuiltin, "bcmp", 3}, &CStringChecker::evalMemcmp},
-      {{CDF_MaybeBuiltin, "bzero", 2}, &CStringChecker::evalBzero},
-      {{CDF_MaybeBuiltin, "explicit_bzero", 2}, &CStringChecker::evalBzero},
-  };
-
-  // These require a bit of special handling.
-  CallDescription StdCopy{{"std", "copy"}, 3},
-      StdCopyBackward{{"std", "copy_backward"}, 3};
-
-  FnCheck identifyCall(const CallEvent &Call, CheckerContext &C) const;
-  void evalMemcpy(CheckerContext &C, const CallExpr *CE) const;
-  void evalMempcpy(CheckerContext &C, const CallExpr *CE) const;
-  void evalMemmove(CheckerContext &C, const CallExpr *CE) const;
-  void evalBcopy(CheckerContext &C, const CallExpr *CE) const;
-  void evalCopyCommon(CheckerContext &C, const CallExpr *CE,
-                      ProgramStateRef state, SizeArgExpr Size,
-                      DestinationArgExpr Dest, SourceArgExpr Source,
-                      bool Restricted, bool IsMempcpy) const;
-
-  void evalMemcmp(CheckerContext &C, const CallExpr *CE) const;
-
-  void evalstrLength(CheckerContext &C, const CallExpr *CE) const;
-  void evalstrnLength(CheckerContext &C, const CallExpr *CE) const;
-  void evalstrLengthCommon(CheckerContext &C,
-                           const CallExpr *CE,
-                           bool IsStrnlen = false) const;
-
-  void evalStrcpy(CheckerContext &C, const CallExpr *CE) const;
-  void evalStrncpy(CheckerContext &C, const CallExpr *CE) const;
-  void evalStpcpy(CheckerContext &C, const CallExpr *CE) const;
-  void evalStrlcpy(CheckerContext &C, const CallExpr *CE) const;
-  void evalStrcpyCommon(CheckerContext &C, const CallExpr *CE, bool ReturnEnd,
-                        bool IsBounded, ConcatFnKind appendK,
-                        bool returnPtr = true) const;
-
-  void evalStrcat(CheckerContext &C, const CallExpr *CE) const;
-  void evalStrncat(CheckerContext &C, const CallExpr *CE) const;
-  void evalStrlcat(CheckerContext &C, const CallExpr *CE) const;
-
-  void evalStrcmp(CheckerContext &C, const CallExpr *CE) const;
-  void evalStrncmp(CheckerContext &C, const CallExpr *CE) const;
-  void evalStrcasecmp(CheckerContext &C, const CallExpr *CE) const;
-  void evalStrncasecmp(CheckerContext &C, const CallExpr *CE) const;
-  void evalStrcmpCommon(CheckerContext &C,
-                        const CallExpr *CE,
-                        bool IsBounded = false,
-                        bool IgnoreCase = false) const;
-
-  void evalStrsep(CheckerContext &C, const CallExpr *CE) const;
-
-  void evalStdCopy(CheckerContext &C, const CallExpr *CE) const;
-  void evalStdCopyBackward(CheckerContext &C, const CallExpr *CE) const;
-  void evalStdCopyCommon(CheckerContext &C, const CallExpr *CE) const;
-  void evalMemset(CheckerContext &C, const CallExpr *CE) const;
-  void evalBzero(CheckerContext &C, const CallExpr *CE) const;
-
-  // Utility methods
-  std::pair<ProgramStateRef , ProgramStateRef >
-  static assumeZero(CheckerContext &C,
-                    ProgramStateRef state, SVal V, QualType Ty);
+//===----------------------------------------------------------------------===//
+// Individual checks and utility methods.
+//===----------------------------------------------------------------------===//
 
-  static ProgramStateRef setCStringLength(ProgramStateRef state,
-                                              const MemRegion *MR,
-                                              SVal strLength);
-  static SVal getCStringLengthForRegion(CheckerContext &C,
-                                        ProgramStateRef &state,
-                                        const Expr *Ex,
-                                        const MemRegion *MR,
-                                        bool hypothetical);
-  SVal getCStringLength(CheckerContext &C,
-                        ProgramStateRef &state,
-                        const Expr *Ex,
-                        SVal Buf,
-                        bool hypothetical = false) const;
-
-  const StringLiteral *getCStringLiteral(CheckerContext &C,
-                                         ProgramStateRef &state,
-                                         const Expr *expr,
-                                         SVal val) const;
+static const StringLiteral *getCStringLiteral(SVal val) {
+  // Get the memory region pointed to by the val.
+  const MemRegion *bufRegion = val.getAsRegion();
+  if (!bufRegion)
+    return nullptr;
 
-  static ProgramStateRef InvalidateBuffer(CheckerContext &C,
-                                          ProgramStateRef state,
-                                          const Expr *Ex, SVal V,
-                                          bool IsSourceBuffer,
-                                          const Expr *Size);
+  // Strip casts off the memory region.
+  bufRegion = bufRegion->StripCasts();
 
-  static bool SummarizeRegion(raw_ostream &os, ASTContext &Ctx,
-                              const MemRegion *MR);
+  // Cast the memory region to a string region.
+  const StringRegion *strRegion = dyn_cast<StringRegion>(bufRegion);
+  if (!strRegion)
+    return nullptr;
 
-  static bool memsetAux(const Expr *DstBuffer, SVal CharE,
-                        const Expr *Size, CheckerContext &C,
-                        ProgramStateRef &State);
+  // Return the actual string in the string region.
+  return strRegion->getStringLiteral();
+}
 
-  // Re-usable checks
-  ProgramStateRef checkNonNull(CheckerContext &C, ProgramStateRef State,
-                               AnyArgExpr Arg, SVal l) const;
-  ProgramStateRef CheckLocation(CheckerContext &C, ProgramStateRef state,
-                                AnyArgExpr Buffer, SVal Element,
-                                AccessKind Access) const;
-  ProgramStateRef CheckBufferAccess(CheckerContext &C, ProgramStateRef State,
-                                    AnyArgExpr Buffer, SizeArgExpr Size,
-                                    AccessKind Access) const;
-  ProgramStateRef CheckOverlap(CheckerContext &C, ProgramStateRef state,
-                               SizeArgExpr Size, AnyArgExpr First,
-                               AnyArgExpr Second) const;
-  void emitOverlapBug(CheckerContext &C,
-                      ProgramStateRef state,
-                      const Stmt *First,
-                      const Stmt *Second) const;
+SVal CStringChecker::getCStringLengthChecked(CheckerContext &Ctx,
+                                             ProgramStateRef &State,
+                                             const Expr *Ex, SVal Buf) const {
+  // Try to get the associated cstring length, if fails, create a new one.
+  const SVal CStrLen = [&]() -> SVal {
+    Optional<SVal> Tmp = cstring::getCStringLength(Ctx, State, Buf);
+    if (Tmp.hasValue())
+      return Tmp.getValue();
+    return cstring::createCStringLength(State, Ctx, Ex,
+                                        Buf.getAsRegion()->StripCasts());
+  }();
+
+  // Simply return if everything goes well.
+  // Otherwise we shall investigate why did it fail.
+  if (!CStrLen.isUndef())
+    return CStrLen;
 
-  void emitNullArgBug(CheckerContext &C, ProgramStateRef State, const Stmt *S,
-                      StringRef WarningMsg) const;
-  void emitOutOfBoundsBug(CheckerContext &C, ProgramStateRef State,
-                          const Stmt *S, StringRef WarningMsg) const;
-  void emitNotCStringBug(CheckerContext &C, ProgramStateRef State,
-                         const Stmt *S, StringRef WarningMsg) const;
-  void emitAdditionOverflowBug(CheckerContext &C, ProgramStateRef State) const;
+  // Handle if the buffer was not referring to a memory region.
+  const MemRegion *MR = Buf.getAsRegion();
+  if (!MR) {
+    // If we can't get a region, see if it's something we /know/ isn't a
+    // C string. In the context of locations, the only time we can issue such
+    // a warning is for labels.
+    if (Optional<loc::GotoLabel> Label = Buf.getAs<loc::GotoLabel>()) {
+      if (Filter.CheckCStringNotNullTerm) {
+        SmallString<120> buf;
+        llvm::raw_svector_ostream os(buf);
+        assert(CurrentFunctionDescription);
+        os << "Argument to " << CurrentFunctionDescription
+           << " is the address of the label '" << Label->getLabel()->getName()
+           << "', which is not a null-terminated string";
 
-  ProgramStateRef checkAdditionOverflow(CheckerContext &C,
-                                            ProgramStateRef state,
-                                            NonLoc left,
-                                            NonLoc right) const;
+        emitNotCStringBug(Ctx, State, Ex, os.str());
+      }
+      return UndefinedVal();
+    }
+  }
 
-  // Return true if the destination buffer of the copy function may be in bound.
-  // Expects SVal of Size to be positive and unsigned.
-  // Expects SVal of FirstBuf to be a FieldRegion.
-  static bool IsFirstBufInBound(CheckerContext &C,
-                                ProgramStateRef state,
-                                const Expr *FirstBuf,
-                                const Expr *Size);
-};
+  // Other regions (mostly non-data) can't have a reliable C string length.
+  // In this case, an error is emitted and UndefinedVal is returned.
+  // The caller should always be prepared to handle this case.
+  if (Filter.CheckCStringNotNullTerm) {
+    SmallString<120> buf;
+    llvm::raw_svector_ostream os(buf);
 
-} //end anonymous namespace
+    assert(CurrentFunctionDescription);
+    os << "Argument to " << CurrentFunctionDescription << " is ";
 
-REGISTER_MAP_WITH_PROGRAMSTATE(CStringLength, const MemRegion *, SVal)
+    if (SummarizeRegion(os, Ctx.getASTContext(), MR))
+      os << ", which is not a null-terminated string";
+    else
+      os << "not a null-terminated string";
 
-//===----------------------------------------------------------------------===//
-// Individual checks and utility methods.
-//===----------------------------------------------------------------------===//
+    emitNotCStringBug(Ctx, State, Ex, os.str());
+  }
+  return UndefinedVal();
+}
 
 std::pair<ProgramStateRef , ProgramStateRef >
 CStringChecker::assumeZero(CheckerContext &C, ProgramStateRef state, SVal V,
                            QualType Ty) {
   Optional<DefinedSVal> val = V.getAs<DefinedSVal>();
   if (!val)
     return std::pair<ProgramStateRef , ProgramStateRef >(state, state);
 
if (Optional<NonLoc> maxMinusRightNL = maxMinusRight.getAs<NonLoc>()) {
     // From now on, assume an overflow didn't occur.
     assert(stateOkay);
     state = stateOkay;
   }
 
   return state;
 }
 
-ProgramStateRef CStringChecker::setCStringLength(ProgramStateRef state,
-                                                const MemRegion *MR,
-                                                SVal strLength) {
-  assert(!strLength.isUndef() && "Attempt to set an undefined string length");
-
-  MR = MR->StripCasts();
-
-  switch (MR->getKind()) {
-  case MemRegion::StringRegionKind:
-    // FIXME: This can happen if we strcpy() into a string region. This is
-    // undefined [C99 6.4.5p6], but we should still warn about it.
-    return state;
-
-  case MemRegion::SymbolicRegionKind:
-  case MemRegion::AllocaRegionKind:
-  case MemRegion::NonParamVarRegionKind:
-  case MemRegion::ParamVarRegionKind:
-  case MemRegion::FieldRegionKind:
-  case MemRegion::ObjCIvarRegionKind:
-    // These are the types we can currently track string lengths for.
-    break;
-
-  case MemRegion::ElementRegionKind:
-    // FIXME: Handle element regions by upper-bounding the parent region's
-    // string length.
-    return state;
-
-  default:
-    // Other regions (mostly non-data) can't have a reliable C string length.
-    // For now, just ignore the change.
-    // FIXME: These are rare but not impossible. We should output some kind of
-    // warning for things like strcpy((char[]){'a', 0}, "b");
-    return state;
-  }
-
-  if (strLength.isUnknown())
-    return state->remove<CStringLength>(MR);
-
-  return state->set<CStringLength>(MR, strLength);
-}
-
-SVal CStringChecker::getCStringLengthForRegion(CheckerContext &C,
-                                               ProgramStateRef &state,
-                                               const Expr *Ex,
-                                               const MemRegion *MR,
-                                               bool hypothetical) {
-  if (!hypothetical) {
-    // If there's a recorded length, go ahead and return it.
-    const SVal *Recorded = state->get<CStringLength>(MR);
-    if (Recorded)
-      return *Recorded;
-  }
-
-  // Otherwise, get a new symbol and update the state.
-  SValBuilder &svalBuilder = C.getSValBuilder();
-  QualType sizeTy = svalBuilder.getContext().getSizeType();
-  SVal strLength = svalBuilder.getMetadataSymbolVal(CStringChecker::getTag(),
-                                                    MR, Ex, sizeTy,
-                                                    C.getLocationContext(),
-                                                    C.blockCount());
-
-  if (!hypothetical) {
-    if (Optional<NonLoc> strLn = strLength.getAs<NonLoc>()) {
-      // In case of unbounded calls strlen etc bound the range to SIZE_MAX/4
-      BasicValueFactory &BVF = svalBuilder.getBasicValueFactory();
-      const llvm::APSInt &maxValInt = BVF.getMaxValue(sizeTy);
-      llvm::APSInt fourInt = APSIntType(maxValInt).getValue(4);
-      const llvm::APSInt *maxLengthInt = BVF.evalAPSInt(BO_Div, maxValInt,
-                                                        fourInt);
-      NonLoc maxLength = svalBuilder.makeIntVal(*maxLengthInt);
-      SVal evalLength = svalBuilder.evalBinOpNN(state, BO_LE, *strLn,
-                                                maxLength, sizeTy);
-      state = state->assume(evalLength.castAs<DefinedOrUnknownSVal>(), true);
-    }
-    state = state->set<CStringLength>(MR, strLength);
-  }
-
-  return strLength;
-}
-
-SVal CStringChecker::getCStringLength(CheckerContext &C, ProgramStateRef &state,
-                                      const Expr *Ex, SVal Buf,
-                                      bool hypothetical) const {
-  const MemRegion *MR = Buf.getAsRegion();
-  if (!MR) {
-    // If we can't get a region, see if it's something we /know/ isn't a
-    // C string. In the context of locations, the only time we can issue such
-    // a warning is for labels.
-    if (Optional<loc::GotoLabel> Label = Buf.getAs<loc::GotoLabel>()) {
-      if (Filter.CheckCStringNotNullTerm) {
-        SmallString<120> buf;
-        llvm::raw_svector_ostream os(buf);
-        assert(CurrentFunctionDescription);
-        os << "Argument to " << CurrentFunctionDescription
-           << " is the address of the label '" << Label->getLabel()->getName()
-           << "', which is not a null-terminated string";
-
-        emitNotCStringBug(C, state, Ex, os.str());
-      }
-      return UndefinedVal();
-    }
-
-    // If it's not a region and not a label, give up.
-    return UnknownVal();
-  }
-
-  // If we have a region, strip casts from it and see if we can figure out
-  // its length. For anything we can't figure out, just return UnknownVal.
-  MR = MR->StripCasts();
-
-  switch (MR->getKind()) {
-  case MemRegion::StringRegionKind: {
-    // Modifying the contents of string regions is undefined [C99 6.4.5p6],
-    // so we can assume that the byte length is the correct C string length.
-    SValBuilder &svalBuilder = C.getSValBuilder();
-    QualType sizeTy = svalBuilder.getContext().getSizeType();
-    const StringLiteral *strLit = cast<StringRegion>(MR)->getStringLiteral();
-    return svalBuilder.makeIntVal(strLit->getByteLength(), sizeTy);
-  }
-  case MemRegion::SymbolicRegionKind:
-  case MemRegion::AllocaRegionKind:
-  case MemRegion::NonParamVarRegionKind:
-  case MemRegion::ParamVarRegionKind:
-  case MemRegion::FieldRegionKind:
-  case MemRegion::ObjCIvarRegionKind:
-    return getCStringLengthForRegion(C, state, Ex, MR, hypothetical);
-  case MemRegion::CompoundLiteralRegionKind:
-    // FIXME: Can we track this? Is it necessary?
-    return UnknownVal();
-  case MemRegion::ElementRegionKind:
-    // FIXME: How can we handle this? It's not good enough to subtract the
-    // offset from the base string length; consider "123\x00567" and &a[5].
-    return UnknownVal();
-  default:
-    // Other regions (mostly non-data) can't have a reliable C string length.
-    // In this case, an error is emitted and UndefinedVal is returned.
-    // The caller should always be prepared to handle this case.
-    if (Filter.CheckCStringNotNullTerm) {
-      SmallString<120> buf;
-      llvm::raw_svector_ostream os(buf);
-
-      assert(CurrentFunctionDescription);
-      os << "Argument to " << CurrentFunctionDescription << " is ";
-
-      if (SummarizeRegion(os, C.getASTContext(), MR))
-        os << ", which is not a null-terminated string";
-      else
-        os << "not a null-terminated string";
-
-      emitNotCStringBug(C, state, Ex, os.str());
-    }
-    return UndefinedVal();
-  }
-}
-
-const StringLiteral *CStringChecker::getCStringLiteral(CheckerContext &C,
-  ProgramStateRef &state, const Expr *expr, SVal val) const {
-
-  // Get the memory region pointed to by the val.
-  const MemRegion *bufRegion = val.getAsRegion();
-  if (!bufRegion)
-    return nullptr;
-
-  // Strip casts off the memory region.
-  bufRegion = bufRegion->StripCasts();
-
-  // Cast the memory region to a string region.
-  const StringRegion *strRegion= dyn_cast<StringRegion>(bufRegion);
-  if (!strRegion)
-    return nullptr;
-
-  // Return the actual string in the string region.
-  return strRegion->getStringLiteral();
-}
-
 bool CStringChecker::IsFirstBufInBound(CheckerContext &C,
                                        ProgramStateRef state,
                                        const Expr *FirstBuf,
                                        const Expr *Size) {
   // If we do not know that the buffer is long enough we return 'true'.
   // Otherwise the parent region of this field region would also get
   // invalidated, which would lead to warnings based on an unknown state.
 
if (StateWholeReg && !StateNotWholeReg && StateNullChar &&
       // third argument, just invalidate buffer.
       State = InvalidateBuffer(C, State, DstBuffer, MemVal,
                                /*IsSourceBuffer*/ false, Size);
     }
 
     if (StateNullChar && !StateNonNullChar) {
       // If the value of the second argument of 'memset()' is zero, set the
       // string length of destination buffer to 0 directly.
-      State = setCStringLength(State, MR,
-                               svalBuilder.makeZeroVal(Ctx.getSizeType()));
+      State = cstring::setCStringLength(
+          State, MR, svalBuilder.makeZeroVal(Ctx.getSizeType()));
     } else if (!StateNullChar && StateNonNullChar) {
       SVal NewStrLen = svalBuilder.getMetadataSymbolVal(
           CStringChecker::getTag(), MR, DstBuffer, Ctx.getSizeType(),
           C.getLocationContext(), C.blockCount());
 
       // If the value of second argument is not zero, then the string length
       // is at least the size argument.
       SVal NewStrLenGESize = svalBuilder.evalBinOp(
           State, BO_GE, NewStrLen, SizeVal, svalBuilder.getConditionType());
 
-      State = setCStringLength(
+      State = cstring::setCStringLength(
           State->assume(NewStrLenGESize.castAs<DefinedOrUnknownSVal>(), true),
           MR, NewStrLen);
     }
   } else {
     // If the offset is not zero and char value is not concrete, we can do
     // nothing but invalidate the buffer.
     State = InvalidateBuffer(C, State, DstBuffer, MemVal,
                              /*IsSourceBuffer*/ false, Size);
void CStringChecker::evalstrLengthCommon(CheckerContext &C, const CallExpr *CE,
   // Check that the string argument is non-null.
   AnyArgExpr Arg = {CE->getArg(0), 0};
   SVal ArgVal = state->getSVal(Arg.Expression, LCtx);
   state = checkNonNull(C, state, Arg, ArgVal);
 
   if (!state)
     return;
 
-  SVal strLength = getCStringLength(C, state, Arg.Expression, ArgVal);
+  SVal strLength = getCStringLengthChecked(C, state, Arg.Expression, ArgVal);
 
   // If the argument isn't a valid C string, there's no valid state to
   // transition to.
   if (strLength.isUndef())
     return;
 
   DefinedOrUnknownSVal result = UnknownVal();
 
void CStringChecker::evalStrcpyCommon(CheckerContext &C, const CallExpr *CE,
   // Check that the source is non-null.
   SourceArgExpr srcExpr = {CE->getArg(1), 1};
   SVal srcVal = state->getSVal(srcExpr.Expression, LCtx);
   state = checkNonNull(C, state, srcExpr, srcVal);
   if (!state)
     return;
 
   // Get the string length of the source.
-  SVal strLength = getCStringLength(C, state, srcExpr.Expression, srcVal);
+  SVal strLength =
+      getCStringLengthChecked(C, state, srcExpr.Expression, srcVal);
   Optional<NonLoc> strLengthNL = strLength.getAs<NonLoc>();
 
   // Get the string length of the destination buffer.
-  SVal dstStrLength = getCStringLength(C, state, Dst.Expression, DstVal);
+  SVal dstStrLength = getCStringLengthChecked(C, state, Dst.Expression, DstVal);
   Optional<NonLoc> dstStrLengthNL = dstStrLength.getAs<NonLoc>();
 
   // If the source isn't a valid C string, give up.
   if (strLength.isUndef())
     return;
 
   SValBuilder &svalBuilder = C.getSValBuilder();
   QualType cmpTy = svalBuilder.getConditionType();
if (amountCopiedNL && dstStrLengthNL) {
 
       finalStrLength = svalBuilder.evalBinOpNN(state, BO_Add, *amountCopiedNL,
                                                *dstStrLengthNL, sizeTy);
     }
 
     // If we couldn't get a single value for the final string length,
     // we can at least bound it by the individual lengths.
     if (finalStrLength.isUnknown()) {
-      // Try to get a "hypothetical" string length symbol, which we can later
+      // Get a //hypothetical// string length symbol, which we can later
       // set as a real value if that turns out to be the case.
-      finalStrLength = getCStringLength(C, state, CE, DstVal, true);
+      finalStrLength =
+          cstring::createCStringLength(state, C, CE, DstVal.getAsRegion());
       assert(!finalStrLength.isUndef());
 
       if (Optional<NonLoc> finalStrLengthNL = finalStrLength.getAs<NonLoc>()) {
         if (amountCopiedNL && appendK == ConcatFnKind::none) {
           // we overwrite dst string with the src
           // finalStrLength >= srcStrLength
           SVal sourceInResult = svalBuilder.evalBinOpNN(
               state, BO_GE, *finalStrLengthNL, *amountCopiedNL, cmpTy);
if (Optional<loc::MemRegionVal> dstRegVal =
     if (IsBounded && (appendK == ConcatFnKind::none)) {
       // strncpy is annoying in that it doesn't guarantee to null-terminate
       // the result string. If the original string didn't fit entirely inside
       // the bound (including the null-terminator), we don't know how long the
       // result is.
       if (amountCopied != strLength)
         finalStrLength = UnknownVal();
     }
-    state = setCStringLength(state, dstRegVal->getRegion(), finalStrLength);
+    state = cstring::setCStringLength(state, dstRegVal->getRegion(),
+                                      finalStrLength);
   }
 
   assert(state);
 
   if (returnPtr) {
     // If this is a stpcpy-style copy, but we were unable to check for a buffer
     // overflow, we still need a result. Conjure a return value.
     if (ReturnEnd && Result.isUnknown()) {
void CStringChecker::evalStrcmpCommon(CheckerContext &C, const CallExpr *CE,
   // Check that the second string is non-null.
   AnyArgExpr Right = {CE->getArg(1), 1};
   SVal RightVal = state->getSVal(Right.Expression, LCtx);
   state = checkNonNull(C, state, Right, RightVal);
   if (!state)
     return;
 
   // Get the string length of the first string or give up.
-  SVal LeftLength = getCStringLength(C, state, Left.Expression, LeftVal);
+  SVal LeftLength = getCStringLengthChecked(C, state, Left.Expression, LeftVal);
   if (LeftLength.isUndef())
     return;
 
   // Get the string length of the second string or give up.
-  SVal RightLength = getCStringLength(C, state, Right.Expression, RightVal);
+  SVal RightLength =
+      getCStringLengthChecked(C, state, Right.Expression, RightVal);
   if (RightLength.isUndef())
     return;
 
   // If we know the two buffers are the same, we know the result is 0.
   // First, get the two buffers' addresses. Another checker will have already
   // made sure they're not undefined.
   DefinedOrUnknownSVal LV = LeftVal.castAs<DefinedOrUnknownSVal>();
   DefinedOrUnknownSVal RV = RightVal.castAs<DefinedOrUnknownSVal>();
void CStringChecker::evalStrcmpCommon(CheckerContext &C, const CallExpr *CE,
 
   assert(StNotSameBuf);
   state = StNotSameBuf;
 
   // At this point we can go about comparing the two buffers.
   // For now, we only do this if they're both known string literals.
 
   // Attempt to extract string literals from both expressions.
-  const StringLiteral *LeftStrLiteral =
-      getCStringLiteral(C, state, Left.Expression, LeftVal);
-  const StringLiteral *RightStrLiteral =
-      getCStringLiteral(C, state, Right.Expression, RightVal);
+  const StringLiteral *LeftStrLiteral = getCStringLiteral(LeftVal);
+  const StringLiteral *RightStrLiteral = getCStringLiteral(RightVal);
   bool canComputeResult = false;
   SVal resultVal = svalBuilder.conjureSymbolVal(nullptr, CE, LCtx,
       C.blockCount());
 
   if (LeftStrLiteral && RightStrLiteral) {
     StringRef LeftStrRef = LeftStrLiteral->getString();
     StringRef RightStrRef = RightStrLiteral->getString();
 
bool CStringChecker::evalCall(const CallEvent &Call, CheckerContext &C) const {
   // handler.
   // Note, the custom CString evaluation calls assume that basic safety
   // properties are held. However, if the user chooses to turn off some of these
   // checks, we ignore the issues and leave the call evaluation to a generic
   // handler.
   return C.isDifferent();
 }
 
-void CStringChecker::checkPreStmt(const DeclStmt *DS, CheckerContext &C) const {
-  // Record string length for char a[] = "abc";
-  ProgramStateRef state = C.getState();
-
-  for (const auto *I : DS->decls()) {
-    const VarDecl *D = dyn_cast<VarDecl>(I);
-    if (!D)
-      continue;
-
-    // FIXME: Handle array fields of structs.
-    if (!D->getType()->isArrayType())
-      continue;
-
-    const Expr *Init = D->getInit();
-    if (!Init)
-      continue;
-    if (!isa<StringLiteral>(Init))
-      continue;
-
-    Loc VarLoc = state->getLValue(D, C.getLocationContext());
-    const MemRegion *MR = VarLoc.getAsRegion();
-    if (!MR)
-      continue;
-
-    SVal StrVal = C.getSVal(Init);
-    assert(StrVal.isValid() && "Initializer string is unknown or undefined");
-    DefinedOrUnknownSVal strLength =
-      getCStringLength(C, state, Init, StrVal).castAs<DefinedOrUnknownSVal>();
+} // namespace cstring
+} // namespace ento
+} // namespace clang
 
-    state = state->set<CStringLength>(MR, strLength);
-  }
+void clang::ento::registerCStringModeling(CheckerManager &Mgr) {
+  Mgr.registerChecker<clang::ento::cstring::CStringChecker>();
 
-  C.addTransition(state);
-}
-
-ProgramStateRef
-CStringChecker::checkRegionChanges(ProgramStateRef state,
-    const InvalidatedSymbols *,
-    ArrayRef<const MemRegion *> ExplicitRegions,
-    ArrayRef<const MemRegion *> Regions,
-    const LocationContext *LCtx,
-    const CallEvent *Call) const {
-  CStringLengthTy Entries = state->get<CStringLength>();
-  if (Entries.isEmpty())
-    return state;
-
-  llvm::SmallPtrSet<const MemRegion *, 8> Invalidated;
-  llvm::SmallPtrSet<const MemRegion *, 32> SuperRegions;
-
-  // First build sets for the changed regions and their super-regions.
-  for (ArrayRef<const MemRegion *>::iterator
-      I = Regions.begin(), E = Regions.end(); I != E; ++I) {
-    const MemRegion *MR = *I;
-    Invalidated.insert(MR);
-
-    SuperRegions.insert(MR);
-    while (const SubRegion *SR = dyn_cast<SubRegion>(MR)) {
-      MR = SR->getSuperRegion();
-      SuperRegions.insert(MR);
-    }
-  }
-
-  CStringLengthTy::Factory &F = state->get_context<CStringLength>();
-
-  // Then loop over the entries in the current state.
-  for (CStringLengthTy::iterator I = Entries.begin(),
-      E = Entries.end(); I != E; ++I) {
-    const MemRegion *MR = I.getKey();
-
-    // Is this entry for a super-region of a changed region?
-    if (SuperRegions.count(MR)) {
-      Entries = F.remove(Entries, MR);
-      continue;
-    }
-
-    // Is this entry for a sub-region of a changed region?
-    const MemRegion *Super = MR;
-    while (const SubRegion *SR = dyn_cast<SubRegion>(Super)) {
-      Super = SR->getSuperRegion();
-      if (Invalidated.count(Super)) {
-        Entries = F.remove(Entries, MR);
-        break;
-      }
-    }
-  }
-
-  return state->set<CStringLength>(Entries);
-}
-
-void CStringChecker::checkLiveSymbols(ProgramStateRef state,
-    SymbolReaper &SR) const {
-  // Mark all symbols in our string length map as valid.
-  CStringLengthTy Entries = state->get<CStringLength>();
-
-  for (CStringLengthTy::iterator I = Entries.begin(), E = Entries.end();
-      I != E; ++I) {
-    SVal Len = I.getData();
-
-    for (SymExpr::symbol_iterator si = Len.symbol_begin(),
-        se = Len.symbol_end(); si != se; ++si)
-      SR.markInUse(*si);
-  }
-}
-
-void CStringChecker::checkDeadSymbols(SymbolReaper &SR,
-    CheckerContext &C) const {
-  ProgramStateRef state = C.getState();
-  CStringLengthTy Entries = state->get<CStringLength>();
-  if (Entries.isEmpty())
-    return;
-
-  CStringLengthTy::Factory &F = state->get_context<CStringLength>();
-  for (CStringLengthTy::iterator I = Entries.begin(), E = Entries.end();
-      I != E; ++I) {
-    SVal Len = I.getData();
-    if (SymbolRef Sym = Len.getAsSymbol()) {
-      if (SR.isDead(Sym))
-        Entries = F.remove(Entries, I.getKey());
-    }
-  }
-
-  state = state->set<CStringLength>(Entries);
-  C.addTransition(state);
-}
-
-void ento::registerCStringModeling(CheckerManager &Mgr) {
-  Mgr.registerChecker<CStringChecker>();
-}
-
-bool ento::shouldRegisterCStringModeling(const CheckerManager &mgr) {
+bool clang::ento::shouldRegisterCStringModeling(const CheckerManager &) {
   return true;
 }
 
 #define REGISTER_CHECKER(name)                                                 \
-  void ento::register##name(CheckerManager &mgr) {                             \
-    CStringChecker *checker = mgr.getChecker<CStringChecker>();                \
+  void clang::ento::register##name(clang::ento::CheckerManager &mgr) {         \
+    auto *checker = mgr.getChecker<clang::ento::cstring::CStringChecker>();    \
     checker->Filter.Check##name = true;                                        \
     checker->Filter.CheckName##name = mgr.getCurrentCheckerName();             \
   }                                                                            \
                                                                                \
-  bool ento::shouldRegister##name(const CheckerManager &mgr) { return true; }
+  bool clang::ento::shouldRegister##name(                                      \
+      const clang::ento::CheckerManager &mgr) {                                \
+    return true;                                                               \
+  }
 
 REGISTER_CHECKER(CStringNullArg)
 REGISTER_CHECKER(CStringOutOfBounds)
 REGISTER_CHECKER(CStringBufferOverlap)
 REGISTER_CHECKER(CStringNotNullTerm)

clang/lib/StaticAnalyzer/Checkers/CStringChecker/CStringLength.h

+//=== CStringLength.h Query and store the length of a cstring. ---*- C++ -*--=//
+//
+// Part of the LLVM Project, under the Apache License v2.0 with LLVM Exceptions.
+// See https://llvm.org/LICENSE.txt for license information.
+// SPDX-License-Identifier: Apache-2.0 WITH LLVM-exception
+//
+//===----------------------------------------------------------------------===//
+//
+// Defines an interface for interacting and manipulating the associated cstring
+// length of a given memory region.
+// You can assign a cstring length to any memory region.
+// The represented value is what strlen would return on the given memory region.
+// Eg: 3 for both "ABC" and "abc\00def".
+//
+//===----------------------------------------------------------------------===//
+
+#ifndef LLVM_CLANG_LIB_STATICANALYZER_CHECKERS_CSTRINGLENGTH_H
+#define LLVM_CLANG_LIB_STATICANALYZER_CHECKERS_CSTRINGLENGTH_H
+
+#include "clang/StaticAnalyzer/Core/PathSensitive/ProgramState.h"
+#include "clang/StaticAnalyzer/Core/PathSensitive/SVals.h"
+
+namespace clang {
+namespace ento {
+class CheckerContext;
+
+namespace cstring {
+
+/// Assigns a cstring length to a memory region.
+LLVM_NODISCARD ProgramStateRef setCStringLength(ProgramStateRef State,
+                                                const MemRegion *MR,
+                                                SVal StrLength);
+
+/// Removes the assigned cstring length from the memory region.
+/// It is useful for invalidation.
+LLVM_NODISCARD ProgramStateRef removeCStringLength(ProgramStateRef State,
+                                                   const MemRegion *MR);
+
+/// Gets the associated cstring length of a region.
+/// If no such exists, None returned.
+LLVM_NODISCARD Optional<SVal> getCStringLength(CheckerContext &Ctx,
+                                               ProgramStateRef State, SVal Buf);
+
+/// Creates a metadata symbol, tracking the cstring length of the given region.
+/// It implicitly applies certain constraints to the created value.
+LLVM_NODISCARD NonLoc createCStringLength(ProgramStateRef &State,
+                                          CheckerContext &Ctx, const Expr *Ex,
+                                          const MemRegion *MR);
+
+LLVM_DUMP_METHOD void dumpCStringLengths(ProgramStateRef State,
+                                         raw_ostream &Out = llvm::errs(),
+                                         const char *NL = "\n",
+                                         const char *Sep = ": ");
+} // namespace cstring
+} // namespace ento
+} // namespace clang
+
+#endif

clang/lib/StaticAnalyzer/Checkers/CStringChecker/CStringLengthModeling.cpp

+//=== CStringLengthModeling.cpp  Implementation of CStringLength API C++ -*--=//
+//
+// Part of the LLVM Project, under the Apache License v2.0 with LLVM Exceptions.
+// See https://llvm.org/LICENSE.txt for license information.
+// SPDX-License-Identifier: Apache-2.0 WITH LLVM-exception
+//
+//===----------------------------------------------------------------------===//
+//
+// Implements the CStringLength API and the CStringChecker bookkeeping parts.
+// Updates the associated cstring lengths of memory regions:
+//  - Infers the cstring length of string literals.
+//  - Removes cstring length associations of dead symbols.
+//  - Handles region invalidation.
+//
+//===----------------------------------------------------------------------===//
+
+#include "CStringChecker.h"
+#include "CStringLength.h"
+
+#include "clang/StaticAnalyzer/Core/BugReporter/BugReporter.h"
+#include "clang/StaticAnalyzer/Core/CheckerManager.h"
+#include "clang/StaticAnalyzer/Core/PathSensitive/CheckerContext.h"
+#include "clang/StaticAnalyzer/Core/PathSensitive/ProgramStateTrait.h"
+#include "llvm/Support/raw_ostream.h"
+
+using namespace clang;
+using namespace ento;
+using namespace cstring;
+
+/// Associates an strlen to a memory region.
+REGISTER_MAP_WITH_PROGRAMSTATE(CStringLengthMap, const MemRegion *, SVal)
+
+//===----------------------------------------------------------------------===//
+// Implementation of the public CStringLength API.
+//===----------------------------------------------------------------------===//
+
+ProgramStateRef cstring::setCStringLength(ProgramStateRef State,
+                                          const MemRegion *MR, SVal StrLength) {
+  assert(!StrLength.isUndef() && "Attempt to set an undefined string length");
+
+  MR = MR->StripCasts();
+
+  switch (MR->getKind()) {
+  case MemRegion::StringRegionKind:
+    // FIXME: This can happen if we strcpy() into a string region. This is
+    // undefined [C99 6.4.5p6], but we should still warn about it.
+    return State;
+
+  case MemRegion::SymbolicRegionKind:
+  case MemRegion::AllocaRegionKind:
+  case MemRegion::NonParamVarRegionKind:
+  case MemRegion::ParamVarRegionKind:
+  case MemRegion::FieldRegionKind:
+  case MemRegion::ObjCIvarRegionKind:
+    // These are the types we can currently track string lengths for.
+    break;
+
+  case MemRegion::ElementRegionKind:
+    // FIXME: Handle element regions by upper-bounding the parent region's
+    // string length.
+    return State;
+
+  default:
+    // Other regions (mostly non-data) can't have a reliable C string length.
+    // For now, just ignore the change.
+    // FIXME: These are rare but not impossible. We should output some kind of
+    // warning for things like strcpy((char[]){'a', 0}, "b");
+    return State;
+  }
+
+  if (StrLength.isUnknown())
+    return removeCStringLength(State, MR);
+  return State->set<CStringLengthMap>(MR, StrLength);
+}
+
+ProgramStateRef cstring::removeCStringLength(ProgramStateRef State,
+                                             const MemRegion *MR) {
+  return State->remove<CStringLengthMap>(MR);
+}
+
+NonLoc cstring::createCStringLength(ProgramStateRef &State, CheckerContext &Ctx,
+                                    const Expr *Ex, const MemRegion *MR) {
+  assert(Ex);
+  assert(MR);
+
+  SValBuilder &SVB = Ctx.getSValBuilder();
+  QualType SizeTy = SVB.getContext().getSizeType();
+  NonLoc CStrLen =
+      SVB.getMetadataSymbolVal(CStringChecker::getTag(), MR, Ex, SizeTy,
+                               Ctx.getLocationContext(), Ctx.blockCount())
+          .castAs<NonLoc>();
+
+  // Implicitly constrain the range to SIZE_MAX/4
+  BasicValueFactory &BVF = SVB.getBasicValueFactory();
+  const llvm::APSInt &MaxValue = BVF.getMaxValue(SizeTy);
+  const llvm::APSInt Four = APSIntType(MaxValue).getValue(4);
+  const llvm::APSInt *MaxLength = BVF.evalAPSInt(BO_Div, MaxValue, Four);
+  const NonLoc MaxLengthSVal = SVB.makeIntVal(*MaxLength);
+  SVal Constrained =
+      SVB.evalBinOpNN(State, BO_LE, CStrLen, MaxLengthSVal, SizeTy);
+  State = State->assume(Constrained.castAs<DefinedOrUnknownSVal>(), true);
+  State = State->set<CStringLengthMap>(MR, CStrLen);
+  return CStrLen;
+}
+
+Optional<SVal> cstring::getCStringLength(CheckerContext &Ctx,
+                                         ProgramStateRef State, SVal Buf) {
+  if (Buf.isUnknownOrUndef())
+    return Buf;
+
+  if (Buf.getAs<loc::GotoLabel>())
+    return UndefinedVal();
+
+  // If it's not a region, give up.
+  const MemRegion *MR = Buf.getAsRegion();
+  if (!MR)
+    return UnknownVal();
+
+  // If we have a region, strip casts from it and see if we can figure out
+  // its length. For anything we can't figure out, just return UnknownVal.
+  MR = MR->StripCasts();
+
+  switch (MR->getKind()) {
+  case MemRegion::StringRegionKind: {
+    // Modifying the contents of string regions is undefined [C99 6.4.5p6],
+    // so we can assume that the byte length is the correct C string length.
+    SValBuilder &SVB = Ctx.getSValBuilder();
+    QualType SizeTy = SVB.getContext().getSizeType();
+    const StringLiteral *StrLiteral =
+        cast<StringRegion>(MR)->getStringLiteral();
+    return SVB.makeIntVal(StrLiteral->getByteLength(), SizeTy);
+  }
+  case MemRegion::SymbolicRegionKind:
+  case MemRegion::AllocaRegionKind:
+  case MemRegion::NonParamVarRegionKind:
+  case MemRegion::ParamVarRegionKind:
+  case MemRegion::FieldRegionKind:
+  case MemRegion::ObjCIvarRegionKind:
+    if (const SVal *RecordedLength = State->get<CStringLengthMap>(MR))
+      return *RecordedLength;
+    return llvm::None;
+  case MemRegion::CompoundLiteralRegionKind:
+    // FIXME: Can we track this? Is it necessary?
+    return UnknownVal();
+  case MemRegion::ElementRegionKind:
+    // FIXME: How can we handle this? It's not good enough to subtract the
+    // offset from the base string length; consider "123\x00567" and &a[5].
+    return UnknownVal();
+  default:
+    // Other regions (mostly non-data) can't have a reliable C string length.
+    return UndefinedVal();
+  }
+}
+
+void cstring::dumpCStringLengths(ProgramStateRef State, raw_ostream &Out,
+                                 const char *NL, const char *Sep) {
+  const CStringLengthMapTy Items = State->get<CStringLengthMap>();
+  if (!Items.isEmpty())
+    Out << "CString lengths:" << NL;
+  for (const auto &Item : Items) {
+    Item.first->dumpToStream(Out);
+    Out << Sep;
+    Item.second.dumpToStream(Out);
+    Out << NL;
+  }
+}
+
+//===----------------------------------------------------------------------===//
+// Implementation of the tracking and bookkeeping part of the CStringChecker.
+// Updates the CStringLengthMap.
+// - Infers the cstring length of string literals.
+// - Removes cstring length associations of dead symbols.
+// - Handles region invalidation.
+//===----------------------------------------------------------------------===//
+
+void *CStringChecker::getTag() {
+  static int Tag;
+  return &Tag;
+}
+
+void CStringChecker::checkPreStmt(const DeclStmt *DS, CheckerContext &C) const {
+  // Record string length for char a[] = "abc";
+  ProgramStateRef state = C.getState();
+
+  for (const auto *I : DS->decls()) {
+    const VarDecl *D = dyn_cast<VarDecl>(I);
+    if (!D)
+      continue;
+
+    // FIXME: Handle array fields of structs.
+    if (!D->getType()->isArrayType())
+      continue;
+
+    const Expr *Init = D->getInit();
+    if (!Init)
+      continue;
+    if (!isa<StringLiteral>(Init))
+      continue;
+
+    Loc VarLoc = state->getLValue(D, C.getLocationContext());
+    const MemRegion *MR = VarLoc.getAsRegion();
+    if (!MR)
+      continue;
+
+    SVal StrVal = C.getSVal(Init);
+    assert(StrVal.isValid() && "Initializer string is unknown or undefined");
+    DefinedOrUnknownSVal strLength =
+        getCStringLength(C, state, StrVal)->castAs<DefinedOrUnknownSVal>();
+
+    state = state->set<CStringLengthMap>(MR, strLength);
+  }
+
+  C.addTransition(state);
+}
+
+void CStringChecker::checkLiveSymbols(ProgramStateRef State,
+                                      SymbolReaper &SR) const {
+  // Mark all symbols in our string length map as valid.
+  for (const auto &Item : State->get<CStringLengthMap>()) {
+    SVal Len = Item.second;
+    const auto LenSymbolRange =
+        llvm::make_range(Len.symbol_begin(), Len.symbol_end());
+    for (SymbolRef Symbol : LenSymbolRange)
+      SR.markInUse(Symbol);
+  }
+}
+
+void CStringChecker::checkDeadSymbols(SymbolReaper &SR,
+                                      CheckerContext &C) const {
+  ProgramStateRef State = C.getState();
+  CStringLengthMapTy Entries = State->get<CStringLengthMap>();
+  if (Entries.isEmpty())
+    return;
+
+  CStringLengthMapTy::Factory &F = State->get_context<CStringLengthMap>();
+  for (CStringLengthMapTy::iterator I = Entries.begin(), E = Entries.end();
+       I != E; ++I) {
+    SVal Len = I.getData();
+    if (SymbolRef Sym = Len.getAsSymbol()) {
+      if (SR.isDead(Sym))
+        Entries = F.remove(Entries, I.getKey());
+    }
+  }
+
+  State = State->set<CStringLengthMap>(Entries);
+  C.addTransition(State);
+}
+
+ProgramStateRef CStringChecker::checkRegionChanges(
+    ProgramStateRef state, const InvalidatedSymbols *,
+    ArrayRef<const MemRegion *> ExplicitRegions,
+    ArrayRef<const MemRegion *> Regions, const LocationContext *,
+    const CallEvent *) const {
+  CStringLengthMapTy Entries = state->get<CStringLengthMap>();
+  if (Entries.isEmpty())
+    return state;
+
+  llvm::SmallPtrSet<const MemRegion *, 8> Invalidated;
+  llvm::SmallPtrSet<const MemRegion *, 32> SuperRegions;
+
+  // First build sets for the changed regions and their super-regions.
+  for (ArrayRef<const MemRegion *>::iterator I = Regions.begin(),
+                                             E = Regions.end();
+       I != E; ++I) {
+    const MemRegion *MR = *I;
+    Invalidated.insert(MR);
+
+    SuperRegions.insert(MR);
+    while (const SubRegion *SR = dyn_cast<SubRegion>(MR)) {
+      MR = SR->getSuperRegion();
+      SuperRegions.insert(MR);
+    }
+  }
+
+  CStringLengthMapTy::Factory &F = state->get_context<CStringLengthMap>();
+
+  // Then loop over the entries in the current state.
+  for (CStringLengthMapTy::iterator I = Entries.begin(), E = Entries.end();
+       I != E; ++I) {
+    const MemRegion *MR = I.getKey();
+
+    // Is this entry for a super-region of a changed region?
+    if (SuperRegions.count(MR)) {
+      Entries = F.remove(Entries, MR);
+      continue;
+    }
+
+    // Is this entry for a sub-region of a changed region?
+    const MemRegion *Super = MR;
+    while (const SubRegion *SR = dyn_cast<SubRegion>(Super)) {
+      Super = SR->getSuperRegion();
+      if (Invalidated.count(Super)) {
+        Entries = F.remove(Entries, MR);
+        break;
+      }
+    }
+  }
+
+  return state->set<CStringLengthMap>(Entries);
+}
+
+// TODO: Is it useful?
+void CStringChecker::printState(raw_ostream &Out, ProgramStateRef State,
+                                const char *NL, const char *Sep) const {
+  dumpCStringLengths(State, Out, NL, Sep);
+}