[analyzer] Fix a crash by division by zero

[takeshi-yoshimura]

Summary

When I conducted static analysis without core checkers, clang encountered
a crash by division by zero. The cause of the division-by-zero is
that BasicValueFactory::evalAPSInt() blindly operates divisions with
*any* known values. It means the SVal builder operates divisions even if
RHS value is zero. My fix is simply adding a RHS check before performing
the division in BasicValueFactory::evalAPSInt().

[danielmarjamaki]

I can reproduce using your testcode. It's a good catch. And the fix looks good to me. Does anybody else have any opinions?

[takeshi-yoshimura]

Thanks, danielmarjamaki. I found llvm-lit fails with the test code, so I updated it.

[danielmarjamaki]

Thanks!

Do you need help to commit this?

Does anybody else have comments?

[takeshi-yoshimura]

Yes, could you commit this?

[danielmarjamaki]

Thanks! I committed the changes with 240643.

cfe/trunk/lib/StaticAnalyzer/Core/BasicValueFactory.cpp

BasicValueFactory::evalAPSInt(BinaryOperator::Opcode Op,
   switch (Op) {
     default:
       assert (false && "Invalid Opcode.");
 
     case BO_Mul:
       return &getValue( V1 * V2 );
 
     case BO_Div:
+      if (V2 == 0) // Avoid division by zero
+        return nullptr;
       return &getValue( V1 / V2 );
 
     case BO_Rem:
+      if (V2 == 0) // Avoid division by zero
+        return nullptr;
       return &getValue( V1 % V2 );
 
     case BO_Add:
       return &getValue( V1 + V2 );
 
     case BO_Sub:
       return &getValue( V1 - V2 );
 

cfe/trunk/test/Analysis/division-by-zero.c

+// RUN: %clang_cc1 -analyze -analyzer-checker=unix.Malloc %s
+// Do not crash due to division by zero
+
+int f(unsigned int a) {
+  if (a <= 0) return 1 / a;
+  return a;
+}