[clang][analyzer] Add standard streams to alpha.unix.Stream checker.

[balazske]

Summary

Recognize initial value of standard streams (stdin, ...)
and assume that a new opened stream is not equal to these.

[martong]

clang/lib/StaticAnalyzer/Checkers/StreamChecker.cpp

233–236

Would it be possible to reuse (i.e put in a common place) the StdLibraryFunctionChecker's lookupTy? That also handles the cases when FILEType is null or when we have a typedef struct FILE FILE;.

[martong]

clang/lib/StaticAnalyzer/Checkers/StreamChecker.cpp

233–236

Could you please consider the above question?

[Szelethus]

I like the idea, though I wonder whether evalAssume would be a better callback for this. That way, you'd only need to add an assumption when you reach a condition where one of the operands is standard.

Though it may be more trouble than its worth. I don't have strong feelings on this.

clang/lib/StaticAnalyzer/Checkers/StreamChecker.cpp

256

How about getStdStreamSymbol?

[balazske]

Split some type lookup functions from StdLibraryFunctionsChecker into separate files.

[martong]

In D106644#2913676, @balazske wrote:

Split some type lookup functions from StdLibraryFunctionsChecker into separate files.

Thank you, this is awesome!

clang/lib/StaticAnalyzer/Checkers/StreamChecker.cpp

490

We should be careful, to cache the results (either here, or deeper in the call stack).
I mean, we certainly don't want to do a lookup of "stdin" every time a function is evaluated. We should do this lazily, only once.

[steakhal]

clang/lib/StaticAnalyzer/Checkers/ASTLookup.cpp

27

Decl *D -> const Decl *D. Same for the other loop.

clang/lib/StaticAnalyzer/Checkers/StreamChecker.cpp

242

You calculate this 3 times now. I mean it's not a big deal, but we could save this to do it only once.

244–253

It will early return and uses one fewer continue.

490

I agree. We should do this only for the first top-level function, instead of doing this for every top-level function.

573

It might be a personal preference but I think lambdas should be pure in the sense that it takes something and produces something else.
Regardless of your choice, the trailing return type would highlight it.

577

SValBuilder::getConditionType(), oh they are the same under the hood. We should still probably prefer this one instead.
It might worth hoisting C.getSValBuilder() to a local variable though.
The symbol for StdStream also deserves a separate variable IMO.

578–581

I think you should be fine with castAs(). I'm not expecting this to fail.

clang/test/Analysis/stream.c

278–279

How about checking this way instead?

clang_analyzer_eval(F != stdin);  // TRUE
clang_analyzer_eval(F != stdout); // TRUE
clang_analyzer_eval(F != stderr); // TRUE

[balazske]

clang/lib/StaticAnalyzer/Checkers/StreamChecker.cpp

244–253

The intent was that if no FILEType is found we find just the first VarDecl and do not check the type. This recommended change returns always null if no FILEType is found.

490

I am not sure if the SymbolRef values are safe to store between top-level function analyses. The FILE type and std stream declarations are safe to cache, but the SymbolRef values of these variables probably not.

[balazske]

Init std declarations and FILE type only once.
Make a lambda not operate on captured data.
Simplify test.

[steakhal]

Let's see if we can cache the stream symbols across top-level analyses.

clang/lib/StaticAnalyzer/Checkers/StreamChecker.cpp

244–253

Hm, it was not immediately clear to me.

490

I think it should be safe. But place there an assert and run the test suite. If it won't trigger, that means that we have high confidentiality that this is safe. I know it's not 100%, but pretty close.

493

497

538

This should be probably at the definition of StdinSym and getStdStreamSym().

[balazske]

clang/lib/StaticAnalyzer/Checkers/StreamChecker.cpp

490

I tried to check if these SymbolRef's are the same at checkBeginFunction after initialized once. The assertion for equality failed sometimes, or other crash happened when dump was called on the value. So it looks not safe to cache these. And should we add assumptions about that these StdinSym, StdoutSym, StderrSym are not equal to each other?

577

This lambda is possible to improve.

[steakhal]

clang/lib/StaticAnalyzer/Checkers/StreamChecker.cpp

490

Good to know. I don't think it's necessary to add assertions.

[balazske]

Simplified a lambda usage.
Moved some functions, changed documentation.

[steakhal]

It's fine on my part.

[martong]

clang/lib/StaticAnalyzer/Checkers/StreamChecker.cpp

490

Okay, so we should not cache the SymbolRefs then. But we must cache the VarDecls. I mean, we should avoid calling

StdinDecl = findStdStreamDecl("stdin", C);

more than once for each TU.

I think you could use and Optional for StdinDecl (and the others) to achieve this.

clang/lib/StaticAnalyzer/Checkers/ASTLookup.h

+//=== ASTLookup.h - Lookup and construct objects from AST. ---------*- C++ -*-//
+//
+// Part of the LLVM Project, under the Apache License v2.0 with LLVM Exceptions.
+// See https://llvm.org/LICENSE.txt for license information.
+// SPDX-License-Identifier: Apache-2.0 WITH LLVM-exception
+//
+//===----------------------------------------------------------------------===//
+//
+// Defines a simple interface to search for specific objects (types) in a clang
+// AST and compute derived objects (types) from these.
+// This is designed to be useful in checkers that need to lookup big amount of
+// specific types and properties of them.
+//
+//===----------------------------------------------------------------------===//
+
+#ifndef LLVM_CLANG_LIB_STATICANALYZER_CHECKERS_ASTLOOKUP_H
+#define LLVM_CLANG_LIB_STATICANALYZER_CHECKERS_ASTLOOKUP_H
+
+#include "clang/AST/ASTContext.h"
+#include "clang/StaticAnalyzer/Core/PathSensitive/BasicValueFactory.h"
+
+namespace clang {
+namespace ento {
+namespace ast_lookup {
+
+/// Try to find a type with specific name.
+/// If there is a typedef with same name use this instead.
+class LookupType {
+  const ASTContext &ACtx;
+
+public:
+  LookupType(const ASTContext &ACtx) : ACtx(ACtx) {}
+
+  // Find the type. If not found then the optional is not set.
+  llvm::Optional<QualType> operator()(StringRef Name);
+};
+
+/// Construct the "restrict" (C99) version of a type.
+/// If not applicable or empty is passed in, return the same value.
+class GetRestrictTy {
+  const ASTContext &ACtx;
+
+public:
+  GetRestrictTy(const ASTContext &ACtx) : ACtx(ACtx) {}
+
+  QualType operator()(QualType Ty);
+  Optional<QualType> operator()(Optional<QualType> Ty);
+};
+
+/// Construct a pointer to a type.
+class GetPointerTy {
+  const ASTContext &ACtx;
+
+public:
+  GetPointerTy(const ASTContext &ACtx) : ACtx(ACtx) {}
+
+  QualType operator()(QualType Ty);
+  Optional<QualType> operator()(Optional<QualType> Ty);
+};
+
+/// Construct a const version of a type.
+class GetConstTy {
+public:
+  Optional<QualType> operator()(Optional<QualType> Ty);
+  QualType operator()(QualType Ty);
+};
+
+/// Get the maximum possible value of a type.
+class GetMaxValue {
+  BasicValueFactory &BVF;
+
+public:
+  GetMaxValue(BasicValueFactory &BVF) : BVF(BVF) {}
+
+  Optional<uint64_t> operator()(QualType Ty);
+  Optional<uint64_t> operator()(Optional<QualType> Ty);
+};
+
+} // namespace ast_lookup
+} // namespace ento
+} // namespace clang
+
+#endif // LLVM_CLANG_LIB_STATICANALYZER_CHECKERS_ASTLOOKUP_H

clang/lib/StaticAnalyzer/Checkers/ASTLookup.cpp

+//== ASTLookup.cpp ----------------------------------------------*- C++ -*--==//
+//
+// Part of the LLVM Project, under the Apache License v2.0 with LLVM Exceptions.
+// See https://llvm.org/LICENSE.txt for license information.
+// SPDX-License-Identifier: Apache-2.0 WITH LLVM-exception
+//
+//===----------------------------------------------------------------------===//
+
+#include "ASTLookup.h"
+
+namespace clang {
+namespace ento {
+namespace ast_lookup {
+
+llvm::Optional<QualType> LookupType::operator()(StringRef Name) {
+  IdentifierInfo &II = ACtx.Idents.get(Name);
+  auto LookupRes = ACtx.getTranslationUnitDecl()->lookup(&II);
+  if (LookupRes.empty())
+    return None;
+
+  // Prioritze typedef declarations.
+  // This is needed in case of C struct typedefs. E.g.:
+  //   typedef struct FILE FILE;
+  // In this case, we have a RecordDecl 'struct FILE' with the name 'FILE'
+  // and we have a TypedefDecl with the name 'FILE'.
+  for (const Decl *D : LookupRes)
+    if (const auto *TD = dyn_cast<TypedefNameDecl>(D))
+      return ACtx.getTypeDeclType(TD).getCanonicalType();
+
+  // Find the first TypeDecl.
+  // There maybe cases when a function has the same name as a struct.
+  // E.g. in POSIX: `struct stat` and the function `stat()`:
+  //   int stat(const char *restrict path, struct stat *restrict buf);
+  for (const Decl *D : LookupRes)
+    if (const auto *TD = dyn_cast<TypeDecl>(D))
+      return ACtx.getTypeDeclType(TD).getCanonicalType();
+  return None;
+}
+
+QualType GetRestrictTy::operator()(QualType Ty) {
+  return ACtx.getLangOpts().C99 ? ACtx.getRestrictType(Ty) : Ty;
+}
+
+Optional<QualType> GetRestrictTy::operator()(Optional<QualType> Ty) {
+  if (Ty)
+    return operator()(*Ty);
+  return None;
+}
+
+QualType GetPointerTy::operator()(QualType Ty) {
+  return ACtx.getPointerType(Ty);
+}
+
+Optional<QualType> GetPointerTy::operator()(Optional<QualType> Ty) {
+  if (Ty)
+    return operator()(*Ty);
+  return None;
+}
+
+Optional<QualType> GetConstTy::operator()(Optional<QualType> Ty) {
+  return Ty ? Optional<QualType>(Ty->withConst()) : None;
+}
+
+QualType GetConstTy::operator()(QualType Ty) { return Ty.withConst(); }
+
+Optional<uint64_t> GetMaxValue::operator()(QualType Ty) {
+  return BVF.getMaxValue(Ty).getLimitedValue();
+}
+Optional<uint64_t> GetMaxValue::operator()(Optional<QualType> Ty) {
+  if (Ty) {
+    return operator()(*Ty);
+  }
+  return None;
+}
+
+} // namespace ast_lookup
+} // namespace ento
+} // namespace clang

clang/lib/StaticAnalyzer/Checkers/CMakeLists.txt

 set(LLVM_LINK_COMPONENTS
   FrontendOpenMP
   Support
   )
 
 add_clang_library(clangStaticAnalyzerCheckers
   AnalysisOrderChecker.cpp
   AnalyzerStatsChecker.cpp
   ArrayBoundChecker.cpp
   ArrayBoundCheckerV2.cpp
+  ASTLookup.cpp
   BasicObjCFoundationChecks.cpp
   BlockInCriticalSectionChecker.cpp
   BoolAssignmentChecker.cpp
   BuiltinFunctionChecker.cpp
   CStringChecker.cpp
   CStringSyntaxChecker.cpp
   CallAndMessageChecker.cpp
   CastSizeChecker.cpp

clang/lib/StaticAnalyzer/Checkers/StdLibraryFunctionsChecker.cpp

 //   fread      isalnum   isgraph   isxdigit
 //   fwrite     isalpha   islower   read
 //   getc       isascii   isprint   write
 //   getchar    isblank   ispunct   toupper
 //   getdelim   iscntrl   isspace   tolower
 //
 //===----------------------------------------------------------------------===//
 
+#include "ASTLookup.h"
 #include "clang/StaticAnalyzer/Checkers/BuiltinCheckerRegistration.h"
 #include "clang/StaticAnalyzer/Core/BugReporter/BugType.h"
 #include "clang/StaticAnalyzer/Core/Checker.h"
 #include "clang/StaticAnalyzer/Core/CheckerManager.h"
 #include "clang/StaticAnalyzer/Core/PathSensitive/CallEvent.h"
 #include "clang/StaticAnalyzer/Core/PathSensitive/CheckerContext.h"
 #include "clang/StaticAnalyzer/Core/PathSensitive/CheckerHelpers.h"
 #include "clang/StaticAnalyzer/Core/PathSensitive/DynamicExtent.h"
void StdLibraryFunctionsChecker::initFunctionSummaries(
     CheckerContext &C) const {
   if (SummariesInitialized)
     return;
 
   SValBuilder &SVB = C.getSValBuilder();
   BasicValueFactory &BVF = SVB.getBasicValueFactory();
   const ASTContext &ACtx = BVF.getContext();
 
-  // Helper class to lookup a type by its name.
-  class LookupType {
-    const ASTContext &ACtx;
-
-  public:
-    LookupType(const ASTContext &ACtx) : ACtx(ACtx) {}
-
-    // Find the type. If not found then the optional is not set.
-    llvm::Optional<QualType> operator()(StringRef Name) {
-      IdentifierInfo &II = ACtx.Idents.get(Name);
-      auto LookupRes = ACtx.getTranslationUnitDecl()->lookup(&II);
-      if (LookupRes.empty())
-        return None;
-
-      // Prioritze typedef declarations.
-      // This is needed in case of C struct typedefs. E.g.:
-      //   typedef struct FILE FILE;
-      // In this case, we have a RecordDecl 'struct FILE' with the name 'FILE'
-      // and we have a TypedefDecl with the name 'FILE'.
-      for (Decl *D : LookupRes)
-        if (auto *TD = dyn_cast<TypedefNameDecl>(D))
-          return ACtx.getTypeDeclType(TD).getCanonicalType();
-
-      // Find the first TypeDecl.
-      // There maybe cases when a function has the same name as a struct.
-      // E.g. in POSIX: `struct stat` and the function `stat()`:
-      //   int stat(const char *restrict path, struct stat *restrict buf);
-      for (Decl *D : LookupRes)
-        if (auto *TD = dyn_cast<TypeDecl>(D))
-          return ACtx.getTypeDeclType(TD).getCanonicalType();
-      return None;
-    }
-  } lookupTy(ACtx);
-
-  // Below are auxiliary classes to handle optional types that we get as a
-  // result of the lookup.
-  class GetRestrictTy {
-    const ASTContext &ACtx;
-
-  public:
-    GetRestrictTy(const ASTContext &ACtx) : ACtx(ACtx) {}
-    QualType operator()(QualType Ty) {
-      return ACtx.getLangOpts().C99 ? ACtx.getRestrictType(Ty) : Ty;
-    }
-    Optional<QualType> operator()(Optional<QualType> Ty) {
-      if (Ty)
-        return operator()(*Ty);
-      return None;
-    }
-  } getRestrictTy(ACtx);
-  class GetPointerTy {
-    const ASTContext &ACtx;
-
-  public:
-    GetPointerTy(const ASTContext &ACtx) : ACtx(ACtx) {}
-    QualType operator()(QualType Ty) { return ACtx.getPointerType(Ty); }
-    Optional<QualType> operator()(Optional<QualType> Ty) {
-      if (Ty)
-        return operator()(*Ty);
-      return None;
-    }
-  } getPointerTy(ACtx);
-  class {
-  public:
-    Optional<QualType> operator()(Optional<QualType> Ty) {
-      return Ty ? Optional<QualType>(Ty->withConst()) : None;
-    }
-    QualType operator()(QualType Ty) { return Ty.withConst(); }
-  } getConstTy;
-  class GetMaxValue {
-    BasicValueFactory &BVF;
-
-  public:
-    GetMaxValue(BasicValueFactory &BVF) : BVF(BVF) {}
-    Optional<RangeInt> operator()(QualType Ty) {
-      return BVF.getMaxValue(Ty).getLimitedValue();
-    }
-    Optional<RangeInt> operator()(Optional<QualType> Ty) {
-      if (Ty) {
-        return operator()(*Ty);
-      }
-      return None;
-    }
-  } getMaxValue(BVF);
+  ast_lookup::LookupType lookupTy(ACtx);
+  ast_lookup::GetRestrictTy getRestrictTy(ACtx);
+  ast_lookup::GetPointerTy getPointerTy(ACtx);
+  ast_lookup::GetConstTy getConstTy;
+  ast_lookup::GetMaxValue getMaxValue(BVF);
 
   // These types are useful for writing specifications quickly,
   // New specifications should probably introduce more types.
   // Some types are hard to obtain from the AST, eg. "ssize_t".
   // In such cases it should be possible to provide multiple variants
   // of function summary for common cases (eg. ssize_t could be int or long
   // or long long, so three summary variants would be enough).
   // Of course, function variants are also useful for C++ overloads.

clang/lib/StaticAnalyzer/Checkers/StreamChecker.cpp

 //===-- StreamChecker.cpp -----------------------------------------*- C++ -*--//
 //
 // Part of the LLVM Project, under the Apache License v2.0 with LLVM Exceptions.
 // See https://llvm.org/LICENSE.txt for license information.
 // SPDX-License-Identifier: Apache-2.0 WITH LLVM-exception
 //
 //===----------------------------------------------------------------------===//
 //
 // This file defines checkers that model and check stream handling functions.
 //
 //===----------------------------------------------------------------------===//
 
+#include "ASTLookup.h"
+#include "clang/AST/ParentMapContext.h"
 #include "clang/StaticAnalyzer/Checkers/BuiltinCheckerRegistration.h"
 #include "clang/StaticAnalyzer/Core/BugReporter/BugType.h"
 #include "clang/StaticAnalyzer/Core/Checker.h"
 #include "clang/StaticAnalyzer/Core/CheckerManager.h"
 #include "clang/StaticAnalyzer/Core/PathSensitive/CallEvent.h"
 #include "clang/StaticAnalyzer/Core/PathSensitive/CheckerContext.h"
 #include "clang/StaticAnalyzer/Core/PathSensitive/ProgramState.h"
 #include "clang/StaticAnalyzer/Core/PathSensitive/ProgramStateTrait.h"

 };
 
 } // namespace
 
 //===----------------------------------------------------------------------===//
 // StreamChecker class and utility functions.
 //===----------------------------------------------------------------------===//
 
+// This map holds the state of a stream.
+// The stream is identified with a SymbolRef that is created when a stream
+// opening function is modeled by the checker.
+REGISTER_MAP_WITH_PROGRAMSTATE(StreamMap, SymbolRef, StreamState)
+
 namespace {
 
 class StreamChecker;
 using FnCheck = std::function<void(const StreamChecker *, const FnDescription *,
                                    const CallEvent &, CheckerContext &)>;
 
 using ArgNoTy = unsigned int;
 static const ArgNoTy ArgNone = std::numeric_limits<ArgNoTy>::max();
 
 struct FnDescription {
   FnCheck PreFn;
   FnCheck EvalFn;
   ArgNoTy StreamArgNo;
 };
 
+/// Find symbolic value of a global "standard stream"
+/// (stdin, stdout, stderr) variable.
+/// The StdDecl value is allowed to be nullptr.
+SymbolRef getStdStreamSym(const VarDecl *StdDecl, CheckerContext &C) {
+  if (!StdDecl)
+    return nullptr;
+
+  const LocationContext *LCtx = C.getLocationContext();
+
+  const VarRegion *RegionOfStdStreamVar =
+      C.getState()->getRegion(StdDecl, LCtx);
+  if (!RegionOfStdStreamVar)
+    return nullptr;
+  SVal StdVal = C.getState()->getSVal(RegionOfStdStreamVar, StdDecl->getType());
+  return StdVal.getAsSymbol();
+}
+
 /// Get the value of the stream argument out of the passed call event.
 /// The call should contain a function that is described by Desc.
 SVal getStreamArg(const FnDescription *Desc, const CallEvent &Call) {
   assert(Desc && Desc->StreamArgNo != ArgNone &&
          "Try to get a non-existing stream argument.");
   return Call.getArgSVal(Desc->StreamArgNo);
 }
 

 
 ProgramStateRef bindInt(uint64_t Value, ProgramStateRef State,
                         CheckerContext &C, const CallExpr *CE) {
   State = State->BindExpr(CE, C.getLocationContext(),
                           C.getSValBuilder().makeIntVal(Value, false));
   return State;
 }
 
-class StreamChecker : public Checker<check::PreCall, eval::Call,
-                                     check::DeadSymbols, check::PointerEscape> {
+class StreamChecker
+    : public Checker<check::BeginFunction, check::PreCall, eval::Call,
   BugType BT_FileNull{this, "NULL stream pointer", "Stream handling error"};
   BugType BT_UseAfterClose{this, "Closed stream", "Stream handling error"};
   BugType BT_UseAfterOpenFailed{this, "Invalid stream",
                                 "Stream handling error"};
   BugType BT_IndeterminatePosition{this, "Invalid stream state",
                                    "Stream handling error"};
   BugType BT_IllegalWhence{this, "Illegal whence argument",
                            "Stream handling error"};
   BugType BT_StreamEof{this, "Stream already in EOF", "Stream handling error"};
   BugType BT_ResourceLeak{this, "Resource leak", "Stream handling error",
                           /*SuppressOnSink =*/true};
 
 public:
+  void checkBeginFunction(CheckerContext &C) const;
   void checkPreCall(const CallEvent &Call, CheckerContext &C) const;
   bool evalCall(const CallEvent &Call, CheckerContext &C) const;
   void checkDeadSymbols(SymbolReaper &SymReaper, CheckerContext &C) const;
   ProgramStateRef checkPointerEscape(ProgramStateRef State,
                                      const InvalidatedSymbols &Escaped,
                                      const CallEvent *Call,
                                      PointerEscapeKind Kind) const;
 
   /// If true, evaluate special testing stream functions.
   bool TestMode = false;
 
   using BugMessageMap = llvm::DenseMap<const BugType *, const char *>;
   const BugMessageMap BugMessages = {
       {&BT_FileNull, "Assuming opening the stream fails here"},
       {&BT_UseAfterClose, "Stream closed here"},
CallDescriptionMap<FnDescription> FnTestDescriptions = {
         0}},
       {{"StreamTesterChecker_make_ferror_stream", 1},
        {nullptr,
         std::bind(&StreamChecker::evalSetFeofFerror, _1, _2, _3, _4,
                   ErrorFError),
         0}},
   };
 
+  mutable bool StdStreamsInitialized = false;
+  mutable Optional<QualType> FILEType;
+  // These can be nullptr if not found.
+  mutable const VarDecl *StdinDecl;
+  mutable const VarDecl *StdoutDecl;
+  mutable const VarDecl *StderrDecl;
+  // These can be nullptr if not found.
+  mutable SymbolRef StdinSym;
+  mutable SymbolRef StdoutSym;
+  mutable SymbolRef StderrSym;
+
   void evalFopen(const FnDescription *Desc, const CallEvent &Call,
                  CheckerContext &C) const;
 
   void preFreopen(const FnDescription *Desc, const CallEvent &Call,
                   CheckerContext &C) const;
   void evalFreopen(const FnDescription *Desc, const CallEvent &Call,
                    CheckerContext &C) const;
 
constructNoteTag(CheckerContext &C, SymbolRef StreamSym,
     });
   }
 
   /// Searches for the ExplodedNode where the file descriptor was acquired for
   /// StreamSym.
   static const ExplodedNode *getAcquisitionSite(const ExplodedNode *N,
                                                 SymbolRef StreamSym,
                                                 CheckerContext &C);
+
+  const VarDecl *findStdStreamDecl(StringRef StdName, CheckerContext &C) const;
 };
 
 } // end anonymous namespace
 
-// This map holds the state of a stream.
-// The stream is identified with a SymbolRef that is created when a stream
-// opening function is modeled by the checker.
-REGISTER_MAP_WITH_PROGRAMSTATE(StreamMap, SymbolRef, StreamState)
-
 inline void assertStreamStateOpened(const StreamState *SS) {
   assert(SS->isOpened() &&
          "Previous create of error node for non-opened stream failed?");
 }
 
+//===----------------------------------------------------------------------===//
+// Methods of StreamChecker.
+//===----------------------------------------------------------------------===//
+
 const ExplodedNode *StreamChecker::getAcquisitionSite(const ExplodedNode *N,
                                                       SymbolRef StreamSym,
                                                       CheckerContext &C) {
   ProgramStateRef State = N->getState();
   // When bug type is resource leak, exploded node N may not have state info
   // for leaked file descriptor, but predecessor should have it.
   if (!State->get<StreamMap>(StreamSym))
     N = N->getFirstPred();
 
   const ExplodedNode *Pred = N;
   while (N) {
     State = N->getState();
     if (!State->get<StreamMap>(StreamSym))
       return Pred;
     Pred = N;
     N = N->getFirstPred();
   }
 
   return nullptr;
 }
 
-//===----------------------------------------------------------------------===//
-// Methods of StreamChecker.
-//===----------------------------------------------------------------------===//
+const VarDecl *StreamChecker::findStdStreamDecl(StringRef StdName,
+                                                CheckerContext &C) const {
+  ASTContext &ACtx = C.getASTContext();
+
+  IdentifierInfo &II = ACtx.Idents.get(StdName);
+  auto LookupRes = ACtx.getTranslationUnitDecl()->lookup(&II);
+
+  for (Decl *D : LookupRes) {
+    D = D->getCanonicalDecl();
+    if (!C.getSourceManager().isInSystemHeader(D->getLocation()))
+      continue;
+    if (auto *VD = dyn_cast<VarDecl>(D)) {
+      if (FILEType && !ACtx.hasSameType(*FILEType, VD->getType()))
+        continue;
+      return VD;
+    }
+  }
+
+  return nullptr;
+}
+
+void StreamChecker::checkBeginFunction(CheckerContext &C) const {
+  if (!C.inTopFrame())
+    return;
+
+  if (!StdStreamsInitialized) {
+    StdStreamsInitialized = true;
+
+    ast_lookup::LookupType LookupType(C.getASTContext());
+    ast_lookup::GetPointerTy GetPointer(C.getASTContext());
+    FILEType = GetPointer(LookupType("FILE"));
+
+    StdinDecl = findStdStreamDecl("stdin", C);
+    StdoutDecl = findStdStreamDecl("stdout", C);
+    StderrDecl = findStdStreamDecl("stderr", C);
+  }
+
+  StdinSym = getStdStreamSym(StdinDecl, C);
+  StdoutSym = getStdStreamSym(StdoutDecl, C);
+  StderrSym = getStdStreamSym(StderrDecl, C);
+}
 
 void StreamChecker::checkPreCall(const CallEvent &Call,
                                  CheckerContext &C) const {
   const FnDescription *Desc = lookupFn(Call);
   if (!Desc || !Desc->PreFn)
     return;
 
   Desc->PreFn(this, Desc, Call, C);
 }
 
 bool StreamChecker::evalCall(const CallEvent &Call, CheckerContext &C) const {
   const FnDescription *Desc = lookupFn(Call);
   if (!Desc && TestMode)
     Desc = FnTestDescriptions.lookup(Call);
   if (!Desc || !Desc->EvalFn)
     return false;
 
   Desc->EvalFn(this, Desc, Call, C);
 
   return C.isDifferent();
void StreamChecker::evalFopen(const FnDescription *Desc, const CallEvent &Call,
   std::tie(StateNotNull, StateNull) =
       C.getConstraintManager().assumeDual(State, RetVal);
 
   StateNotNull =
       StateNotNull->set<StreamMap>(RetSym, StreamState::getOpened(Desc));
   StateNull =
       StateNull->set<StreamMap>(RetSym, StreamState::getOpenFailed(Desc));
 
+  SValBuilder &SVB = C.getSValBuilder();
+  auto AssumeRetValNotEq = [&SVB, RetVal](SymbolRef StdSym,
+                                          ProgramStateRef State) {
+    if (!StdSym)
+      return State;
+    SVal StdVal = SVB.makeSymbolVal(StdSym);
+    SVal NotEqS =
+        SVB.evalBinOp(State, BO_NE, RetVal, StdVal, SVB.getConditionType());
+    DefinedOrUnknownSVal NotEqDef = NotEqS.castAs<DefinedOrUnknownSVal>();
+    return State->assume(NotEqDef, true);
+  };
+  StateNotNull = AssumeRetValNotEq(StdinSym, StateNotNull);
+  StateNotNull = AssumeRetValNotEq(StdoutSym, StateNotNull);
+  StateNotNull = AssumeRetValNotEq(StderrSym, StateNotNull);
+
   C.addTransition(StateNotNull,
                   constructNoteTag(C, RetSym, {&BT_ResourceLeak}));
   C.addTransition(StateNull, constructNoteTag(C, RetSym, {&BT_FileNull}));
 }
 
 void StreamChecker::preFreopen(const FnDescription *Desc, const CallEvent &Call,
                                CheckerContext &C) const {
   // Do not allow NULL as passed stream pointer but allow a closed stream.

 
 void ento::registerStreamTesterChecker(CheckerManager &Mgr) {
   auto *Checker = Mgr.getChecker<StreamChecker>();
   Checker->TestMode = true;
 }
 
 bool ento::shouldRegisterStreamTesterChecker(const CheckerManager &Mgr) {
   return true;
-}
+}
 

clang/test/Analysis/stream.c

-// RUN: %clang_analyze_cc1 -analyzer-checker=core,alpha.unix.Stream -verify %s
+// RUN: %clang_analyze_cc1 -analyzer-checker=core,alpha.unix.Stream,debug.ExprInspection -verify %s
 
 #include "Inputs/system-header-simulator.h"
 
+void clang_analyzer_eval(int);
+
 void check_fread() {
   FILE *fp = tmpfile();
   fread(0, 0, 0, fp); // expected-warning {{Stream pointer might be NULL}}
   fclose(fp);
 }
 
 void check_fwrite() {
   FILE *fp = tmpfile();
if (!F1)
     return;
   if (Test == 1) {
     return; // no warning
   }
   rewind(F1);
 } // expected-warning {{Opened stream never closed. Potential resource leak}}
 // FIXME: This warning should be placed at the `return` above.
 // See https://reviews.llvm.org/D83120 about details.
+
+void check_fopen_is_not_std() {
+  FILE *F = fopen("file", "r");
+  if (!F)
+    return;
+  clang_analyzer_eval(F != stdin);  // expected-warning{{TRUE}}
+  clang_analyzer_eval(F != stdout); // expected-warning{{TRUE}}
+  clang_analyzer_eval(F != stderr); // expected-warning{{TRUE}}
+  fclose(F);
+}
+
+void check_tmpfile_is_not_std() {
+  FILE *F = tmpfile();
+  if (!F)
+    return;
+  clang_analyzer_eval(F != stdin);  // expected-warning{{TRUE}}
+  clang_analyzer_eval(F != stdout); // expected-warning{{TRUE}}
+  clang_analyzer_eval(F != stderr); // expected-warning{{TRUE}}
+  fclose(F);
+}