[WIP][Analyzer] find stack addresses leaked via out-params - in checkEndFunction

[jkorous]

Summary

Related to https://reviews.llvm.org/D87800

Not working in present state - the bindings that I'd expect aren't iterated.

[NoQ]

The code you've added looks correct. I suspect either heap invalidation or dead symbol elimination cleaning up the binding.

Can you share a specific test that isn't working so that i could take a look?

clang/lib/StaticAnalyzer/Checkers/StackAddrEscapeChecker.cpp

void StackAddrEscapeChecker::checkEndFunction(const ReturnStmt *RS,
   public:
     SmallVector<std::pair<const MemRegion *, const MemRegion *>, 10> V;
 
     CallBack(CheckerContext &CC) : Ctx(CC), CurSFC(CC.getStackFrame()) {}
 
     bool HandleBinding(StoreManager &SMgr, Store S, const MemRegion *Region,
                        SVal Val) override {
 
-      if (!isa<GlobalsSpaceRegion>(Region->getMemorySpace()))
+      const MemSpaceRegion * MemSpace = Region->getMemorySpace();
+      if (isa<StackSpaceRegion>(MemSpace) && !isNotInCurrentFrame(MemSpace, Ctx))
         return true;
       const MemRegion *VR = Val.getAsRegion();
       if (VR && isa<StackSpaceRegion>(VR->getMemorySpace()) &&
           !isArcManagedBlock(VR, Ctx) && !isNotInCurrentFrame(VR, Ctx))
         V.emplace_back(Region, VR);
       return true;
     }
   };
 
   CallBack Cb(Ctx);
   State->getStateManager().getStoreManager().iterBindings(State->getStore(),
                                                           Cb);
 
   if (Cb.V.empty())
     return;
 
   // Generate an error node.
   ExplodedNode *N = Ctx.generateNonFatalErrorNode(State);
   if (!N)
     return;
 
   if (!BT_stackleak)
     BT_stackleak = std::make_unique<BuiltinBug>(
         CheckNames[CK_StackAddrEscapeChecker],
-        "Stack address stored into global variable",
-        "Stack address was saved into a global variable. "
+        "Stack address leaked",
+        "Address from the current stack frame is saved in a variable outside of the stack frame. "
         "This is dangerous because the address will become "
         "invalid after returning from the function");
 
   for (const auto &P : Cb.V) {
     // Generate a report for this bug.
     SmallString<128> Buf;
     llvm::raw_svector_ostream Out(Buf);
     SourceRange Range = genName(Out, P.second, Ctx.getASTContext());
     Out << " is still referred to by the ";
     if (isa<StaticGlobalSpaceRegion>(P.first->getMemorySpace()))
-      Out << "static";
-    else
-      Out << "global";
-    Out << " variable '";
+      Out << "static variable '";
+    else if (isa<GlobalsSpaceRegion>(P.first->getMemorySpace()))
+      Out << "global variable '";
+    else if (isa<HeapSpaceRegion>(P.first->getMemorySpace()))
+      Out << "dynamically allocated variable '";
+    else if (isa<StackSpaceRegion>(P.first->getMemorySpace()))
+      Out << "local variable from another function '";
     const VarRegion *VR = cast<VarRegion>(P.first->getBaseRegion());
     Out << *VR->getDecl()
         << "' upon returning to the caller.  This will be a dangling reference";
     auto Report =
         std::make_unique<PathSensitiveBugReport>(*BT_stackleak, Out.str(), N);
     if (Range.isValid())
       Report->addRange(Range);