[clang][analyzer] Add more wide-character functions to CStringChecker

[balazske]

Summary

Support for functions wmempcpy, wmemmove, wmemcmp is added to the checker.
The same tests are copied that exist for the non-wide versions, with
non-wide functions and character types changed to the wide version.

[steakhal]

Other than nits, I think it looks great.

clang/lib/StaticAnalyzer/Checkers/CStringChecker.cpp

1368

Personally, I dislike bools for this purpose.
Did you consider something like enum CharacterFlavor {Regular, Wide}? It would be more readable in the CallDescription table.

[balazske]

A related question:
Is it better to have a more generic function like this:

void CStringChecker::evalMemmove(CheckerContext &C, const CallExpr *CE,
                                 bool IsRestricted, bool IsMempcpy, bool IsWide) const {
  // void *memmove(void *dst, const void *src, size_t n);
  // The return value is the address of the destination buffer.
  DestinationArgExpr Dest = {CE->getArg(0), 0};
  SourceArgExpr Src = {CE->getArg(1), 1};
  SizeArgExpr Size = {CE->getArg(2), 2};

  evalCopyCommon(C, CE, C.getState(), Size, Dest, Src, IsRestricted, IsMempcpy,
                 IsWide);
}

(Instead of bool enums can be used.) Or make additional versions of the eval functions and remove the IsWide argument (this is even more code repetition)?

[martong]

In D130470#3682131, @balazske wrote:

A related question:
Is it better to have a more generic function like this:

void CStringChecker::evalMemmove(CheckerContext &C, const CallExpr *CE,
                                 bool IsRestricted, bool IsMempcpy, bool IsWide) const {
  // void *memmove(void *dst, const void *src, size_t n);
  // The return value is the address of the destination buffer.
  DestinationArgExpr Dest = {CE->getArg(0), 0};
  SourceArgExpr Src = {CE->getArg(1), 1};
  SizeArgExpr Size = {CE->getArg(2), 2};

  evalCopyCommon(C, CE, C.getState(), Size, Dest, Src, IsRestricted, IsMempcpy,
                 IsWide);
}

(Instead of bool enums can be used.) Or make additional versions of the eval functions and remove the IsWide argument (this is even more code repetition)?

I'd strive for the least code repetition. But I consider this just some nice to have sugar.

LGTM

clang/test/Analysis/wstring.c

372–376

This comment is probably outdated (I know it has been copied from bstring.c but still). Perhaps we should have the else branch now not just here but also in bstring.c.

[steakhal]

clang/lib/StaticAnalyzer/Checkers/CStringChecker.cpp

1343

Do you think we should also update these comments?
It no longer matches to only this function.

[balazske]

Change of bool argument to enum, added inline function to get char type.

[balazske]

clang/lib/StaticAnalyzer/Checkers/CStringChecker.cpp

1343

These are only for "reference" purpose and already not exact declarations (no restricted). The wide version is similar, does not look not necessary to repeat here.

clang/test/Analysis/wstring.c

372–376

clang_analyzer_eval(n == 0) is TRUE and FALSE, not UNKNOWN here. n can be 0 or non-0 but it is connected to values of a and b too.

[steakhal]

clang/lib/StaticAnalyzer/Checkers/CStringChecker.cpp

138–139

If you were using a plain-old enum, it would feel less repetitive.
You are already in the anonymous namespace, so it would not pollute anything anyway.
You could also use std::bind, to make it denser.

175

This line looks dead.

[balazske]

Use shorter enum names, remove unneeded line.

[balazske]

clang/lib/StaticAnalyzer/Checkers/CStringChecker.cpp

138–139

Every other enum in the file is enum class, I like more to use enum class. But the name can be shortened and constants added because it is used often.

[martong]

I think there's only some very minor style nits which are remained, but that should not block this any further. Let's land it.

clang/docs/analyzer/checkers.rst

void test() {
    fclose(p);
  }
 
 
 .. _alpha-unix-cstring-BufferOverlap:
 
 alpha.unix.cstring.BufferOverlap (C)
 """"""""""""""""""""""""""""""""""""
-Checks for overlap in two buffer arguments. Applies to:  ``memcpy, mempcpy, wmemcpy``.
+Checks for overlap in two buffer arguments. Applies to:  ``memcpy, mempcpy, wmemcpy, wmempcpy``.
 
 .. code-block:: c
 
  void test() {
    int a[4] = {0};
    memcpy(a + 2, a + 1, 8); // warn
  }
 

clang/lib/StaticAnalyzer/Checkers/CStringChecker.cpp

static ErrorMessage createOutOfBoundErrorMsg(StringRef FunctionDescription,
   } else { // read access
     Os << " accesses out-of-bound array element";
   }
 
   return Message;
 }
 
 enum class ConcatFnKind { none = 0, strcat = 1, strlcat = 2 };
+
+enum class CharKind { Regular = 0, Wide };
+constexpr CharKind CK_Regular = CharKind::Regular;
+constexpr CharKind CK_Wide = CharKind::Wide;
+
+static QualType getCharPtrType(ASTContext &Ctx, CharKind CK) {
+  return Ctx.getPointerType(CK == CharKind::Regular ? Ctx.CharTy
+                                                    : Ctx.WideCharTy);
+}
+
 class CStringChecker : public Checker< eval::Call,
                                          check::PreStmt<DeclStmt>,
                                          check::LiveSymbols,
                                          check::DeadSymbols,
                                          check::RegionChanges
                                          > {
   mutable std::unique_ptr<BugType> BT_Null, BT_Bounds, BT_Overlap,
       BT_NotCString, BT_AdditionOverflow, BT_UninitRead;
checkRegionChanges(ProgramStateRef state,
                        const LocationContext *LCtx,
                        const CallEvent *Call) const;
 
   using FnCheck = std::function<void(const CStringChecker *, CheckerContext &,
                                      const CallExpr *)>;
 
   CallDescriptionMap<FnCheck> Callbacks = {
       {{CDF_MaybeBuiltin, "memcpy", 3},
-       std::bind(&CStringChecker::evalMemcpy, _1, _2, _3, false)},
+       std::bind(&CStringChecker::evalMemcpy, _1, _2, _3, CK_Regular)},
       {{CDF_MaybeBuiltin, "wmemcpy", 3},
-       std::bind(&CStringChecker::evalMemcpy, _1, _2, _3, true)},
-      {{CDF_MaybeBuiltin, "mempcpy", 3}, &CStringChecker::evalMempcpy},
-      {{CDF_MaybeBuiltin, "memcmp", 3}, &CStringChecker::evalMemcmp},
-      {{CDF_MaybeBuiltin, "memmove", 3}, &CStringChecker::evalMemmove},
+       std::bind(&CStringChecker::evalMemcpy, _1, _2, _3, CK_Wide)},
+      {{CDF_MaybeBuiltin, "mempcpy", 3},
+       std::bind(&CStringChecker::evalMempcpy, _1, _2, _3, CK_Regular)},
+      {{CDF_None, "wmempcpy", 3},
+       std::bind(&CStringChecker::evalMempcpy, _1, _2, _3, CK_Wide)},
+      {{CDF_MaybeBuiltin, "memcmp", 3},
+       std::bind(&CStringChecker::evalMemcmp, _1, _2, _3, CK_Regular)},
+      {{CDF_MaybeBuiltin, "wmemcmp", 3},
+       std::bind(&CStringChecker::evalMemcmp, _1, _2, _3, CK_Wide)},
+      {{CDF_MaybeBuiltin, "memmove", 3},
+       std::bind(&CStringChecker::evalMemmove, _1, _2, _3, CK_Regular)},
+      {{CDF_MaybeBuiltin, "wmemmove", 3},
+       std::bind(&CStringChecker::evalMemmove, _1, _2, _3, CK_Wide)},
       {{CDF_MaybeBuiltin, "memset", 3}, &CStringChecker::evalMemset},
       {{CDF_MaybeBuiltin, "explicit_memset", 3}, &CStringChecker::evalMemset},
       {{CDF_MaybeBuiltin, "strcpy", 2}, &CStringChecker::evalStrcpy},
       {{CDF_MaybeBuiltin, "strncpy", 3}, &CStringChecker::evalStrncpy},
       {{CDF_MaybeBuiltin, "stpcpy", 2}, &CStringChecker::evalStpcpy},
       {{CDF_MaybeBuiltin, "strlcpy", 3}, &CStringChecker::evalStrlcpy},
       {{CDF_MaybeBuiltin, "strcat", 2}, &CStringChecker::evalStrcat},
       {{CDF_MaybeBuiltin, "strncat", 3}, &CStringChecker::evalStrncat},
       {{CDF_MaybeBuiltin, "strlcat", 3}, &CStringChecker::evalStrlcat},
       {{CDF_MaybeBuiltin, "strlen", 1}, &CStringChecker::evalstrLength},
       {{CDF_MaybeBuiltin, "wcslen", 1}, &CStringChecker::evalstrLength},
       {{CDF_MaybeBuiltin, "strnlen", 2}, &CStringChecker::evalstrnLength},
       {{CDF_MaybeBuiltin, "wcsnlen", 2}, &CStringChecker::evalstrnLength},
       {{CDF_MaybeBuiltin, "strcmp", 2}, &CStringChecker::evalStrcmp},
       {{CDF_MaybeBuiltin, "strncmp", 3}, &CStringChecker::evalStrncmp},
       {{CDF_MaybeBuiltin, "strcasecmp", 2}, &CStringChecker::evalStrcasecmp},
       {{CDF_MaybeBuiltin, "strncasecmp", 3}, &CStringChecker::evalStrncasecmp},
       {{CDF_MaybeBuiltin, "strsep", 2}, &CStringChecker::evalStrsep},
       {{CDF_MaybeBuiltin, "bcopy", 3}, &CStringChecker::evalBcopy},
-      {{CDF_MaybeBuiltin, "bcmp", 3}, &CStringChecker::evalMemcmp},
+      {{CDF_MaybeBuiltin, "bcmp", 3},
+       std::bind(&CStringChecker::evalMemcmp, _1, _2, _3, CK_Regular)},
       {{CDF_MaybeBuiltin, "bzero", 2}, &CStringChecker::evalBzero},
       {{CDF_MaybeBuiltin, "explicit_bzero", 2}, &CStringChecker::evalBzero},
   };
 
   // These require a bit of special handling.
   CallDescription StdCopy{{"std", "copy"}, 3},
       StdCopyBackward{{"std", "copy_backward"}, 3};
 
   FnCheck identifyCall(const CallEvent &Call, CheckerContext &C) const;
-  void evalMemcpy(CheckerContext &C, const CallExpr *CE, bool IsWide) const;
-  void evalMempcpy(CheckerContext &C, const CallExpr *CE) const;
-  void evalMemmove(CheckerContext &C, const CallExpr *CE) const;
+  void evalMemcpy(CheckerContext &C, const CallExpr *CE, CharKind CK) const;
+  void evalMempcpy(CheckerContext &C, const CallExpr *CE, CharKind CK) const;
+  void evalMemmove(CheckerContext &C, const CallExpr *CE, CharKind CK) const;
   void evalBcopy(CheckerContext &C, const CallExpr *CE) const;
   void evalCopyCommon(CheckerContext &C, const CallExpr *CE,
                       ProgramStateRef state, SizeArgExpr Size,
                       DestinationArgExpr Dest, SourceArgExpr Source,
-                      bool Restricted, bool IsMempcpy, bool IsWide) const;
+                      bool Restricted, bool IsMempcpy, CharKind CK) const;
 
-  void evalMemcmp(CheckerContext &C, const CallExpr *CE) const;
+  void evalMemcmp(CheckerContext &C, const CallExpr *CE, CharKind CK) const;
 
   void evalstrLength(CheckerContext &C, const CallExpr *CE) const;
   void evalstrnLength(CheckerContext &C, const CallExpr *CE) const;
   void evalstrLengthCommon(CheckerContext &C,
                            const CallExpr *CE,
                            bool IsStrnlen = false) const;
 
   void evalStrcpy(CheckerContext &C, const CallExpr *CE) const;
static bool memsetAux(const Expr *DstBuffer, SVal CharE,
                         const Expr *Size, CheckerContext &C,
                         ProgramStateRef &State);
 
   // Re-usable checks
   ProgramStateRef checkNonNull(CheckerContext &C, ProgramStateRef State,
                                AnyArgExpr Arg, SVal l) const;
   ProgramStateRef CheckLocation(CheckerContext &C, ProgramStateRef state,
                                 AnyArgExpr Buffer, SVal Element,
-                                AccessKind Access, bool IsWide = false) const;
+                                AccessKind Access,
+                                CharKind CK = CharKind::Regular) const;
   ProgramStateRef CheckBufferAccess(CheckerContext &C, ProgramStateRef State,
                                     AnyArgExpr Buffer, SizeArgExpr Size,
                                     AccessKind Access,
-                                    bool IsWide = false) const;
+                                    CharKind CK = CharKind::Regular) const;
   ProgramStateRef CheckOverlap(CheckerContext &C, ProgramStateRef state,
                                SizeArgExpr Size, AnyArgExpr First,
-                               AnyArgExpr Second, bool IsWide = false) const;
+                               AnyArgExpr Second,
+                               CharKind CK = CharKind::Regular) const;
   void emitOverlapBug(CheckerContext &C,
                       ProgramStateRef state,
                       const Stmt *First,
                       const Stmt *Second) const;
 
   void emitNullArgBug(CheckerContext &C, ProgramStateRef State, const Stmt *S,
                       StringRef WarningMsg) const;
   void emitOutOfBoundsBug(CheckerContext &C, ProgramStateRef State,
ProgramStateRef CStringChecker::checkNonNull(CheckerContext &C,
   return stateNonNull;
 }
 
 // FIXME: This was originally copied from ArrayBoundChecker.cpp. Refactor?
 ProgramStateRef CStringChecker::CheckLocation(CheckerContext &C,
                                               ProgramStateRef state,
                                               AnyArgExpr Buffer, SVal Element,
                                               AccessKind Access,
-                                              bool IsWide) const {
+                                              CharKind CK) const {
 
   // If a previous check has failed, propagate the failure.
   if (!state)
     return nullptr;
 
   // Check for out of bound array element access.
   const MemRegion *R = Element.getAsRegion();
   if (!R)
     return state;
 
   const auto *ER = dyn_cast<ElementRegion>(R);
   if (!ER)
     return state;
 
   SValBuilder &svalBuilder = C.getSValBuilder();
   ASTContext &Ctx = svalBuilder.getContext();
 
   // Get the index of the accessed element.
   NonLoc Idx = ER->getIndex();
 
-  if (!IsWide) {
+  if (CK == CharKind::Regular) {
     if (ER->getValueType() != Ctx.CharTy)
       return state;
   } else {
     if (ER->getValueType() != Ctx.WideCharTy)
       return state;
 
     QualType SizeTy = Ctx.getSizeType();
     NonLoc WideSize =
ProgramStateRef CStringChecker::CheckLocation(CheckerContext &C,
   // Array bound check succeeded.  From this point forward the array bound
   // should always succeed.
   return StInBound;
 }
 
 ProgramStateRef
 CStringChecker::CheckBufferAccess(CheckerContext &C, ProgramStateRef State,
                                   AnyArgExpr Buffer, SizeArgExpr Size,
-                                  AccessKind Access, bool IsWide) const {
+                                  AccessKind Access, CharKind CK) const {
   // If a previous check has failed, propagate the failure.
   if (!State)
     return nullptr;
 
   SValBuilder &svalBuilder = C.getSValBuilder();
   ASTContext &Ctx = svalBuilder.getContext();
 
   QualType SizeTy = Size.Expression->getType();
-  QualType PtrTy = Ctx.getPointerType(IsWide ? Ctx.WideCharTy : Ctx.CharTy);
+  QualType PtrTy = getCharPtrType(Ctx, CK);
 
   // Check that the first buffer is non-null.
   SVal BufVal = C.getSVal(Buffer.Expression);
   State = checkNonNull(C, State, Buffer, BufVal);
   if (!State)
     return nullptr;
 
   // If out-of-bounds checking is turned off, skip the rest.
CStringChecker::CheckBufferAccess(CheckerContext &C, ProgramStateRef State,
 
   // Check that the first buffer is sufficiently long.
   SVal BufStart =
       svalBuilder.evalCast(BufVal, PtrTy, Buffer.Expression->getType());
   if (Optional<Loc> BufLoc = BufStart.getAs<Loc>()) {
 
     SVal BufEnd =
         svalBuilder.evalBinOpLN(State, BO_Add, *BufLoc, LastOffset, PtrTy);
-    State = CheckLocation(C, State, Buffer, BufEnd, Access, IsWide);
+    State = CheckLocation(C, State, Buffer, BufEnd, Access, CK);
 
     // If the buffer isn't large enough, abort.
     if (!State)
       return nullptr;
   }
 
   // Large enough or not, return this state!
   return State;
 }
 
 ProgramStateRef CStringChecker::CheckOverlap(CheckerContext &C,
                                              ProgramStateRef state,
                                              SizeArgExpr Size, AnyArgExpr First,
                                              AnyArgExpr Second,
-                                             bool IsWide) const {
+                                             CharKind CK) const {
   if (!Filter.CheckCStringBufferOverlap)
     return state;
 
   // Do a simple check for overlap: if the two arguments are from the same
   // buffer, see if the end of the first is greater than the start of the second
   // or vice versa.
 
   // If a previous check has failed, propagate the failure.
ProgramStateRef CStringChecker::CheckOverlap(CheckerContext &C,
   SVal LengthVal = state->getSVal(Size.Expression, LCtx);
   Optional<NonLoc> Length = LengthVal.getAs<NonLoc>();
   if (!Length)
     return state;
 
   // Convert the first buffer's start address to char*.
   // Bail out if the cast fails.
   ASTContext &Ctx = svalBuilder.getContext();
-  QualType CharPtrTy = Ctx.getPointerType(IsWide ? Ctx.WideCharTy : Ctx.CharTy);
+  QualType CharPtrTy = getCharPtrType(Ctx, CK);
   SVal FirstStart =
       svalBuilder.evalCast(*firstLoc, CharPtrTy, First.Expression->getType());
   Optional<Loc> FirstStartLoc = FirstStart.getAs<Loc>();
   if (!FirstStartLoc)
     return state;
 
   // Compute the end of the first buffer. Bail out if THAT fails.
   SVal FirstEnd = svalBuilder.evalBinOpLN(state, BO_Add, *FirstStartLoc,

 //===----------------------------------------------------------------------===//
 // evaluation of individual function calls.
 //===----------------------------------------------------------------------===//
 
 void CStringChecker::evalCopyCommon(CheckerContext &C, const CallExpr *CE,
                                     ProgramStateRef state, SizeArgExpr Size,
                                     DestinationArgExpr Dest,
                                     SourceArgExpr Source, bool Restricted,
-                                    bool IsMempcpy, bool IsWide) const {
+                                    bool IsMempcpy, CharKind CK) const {
   CurrentFunctionDescription = "memory copy function";
 
   // See if the size argument is zero.
   const LocationContext *LCtx = C.getLocationContext();
   SVal sizeVal = state->getSVal(Size.Expression, LCtx);
   QualType sizeTy = Size.Expression->getType();
 
   ProgramStateRef stateZeroSize, stateNonZeroSize;
if (stateNonZeroSize) {
 
     // Ensure the source is not null. If it is NULL there will be a
     // NULL pointer dereference.
     state = checkNonNull(C, state, Source, srcVal);
     if (!state)
       return;
 
     // Ensure the accesses are valid and that the buffers do not overlap.
-    state = CheckBufferAccess(C, state, Dest, Size, AccessKind::write, IsWide);
-    state = CheckBufferAccess(C, state, Source, Size, AccessKind::read, IsWide);
+    state = CheckBufferAccess(C, state, Dest, Size, AccessKind::write, CK);
+    state = CheckBufferAccess(C, state, Source, Size, AccessKind::read, CK);
 
     if (Restricted)
-      state = CheckOverlap(C, state, Size, Dest, Source, IsWide);
+      state = CheckOverlap(C, state, Size, Dest, Source, CK);
 
     if (!state)
       return;
 
     // If this is mempcpy, get the byte after the last byte copied and
     // bind the expr.
     if (IsMempcpy) {
       // Get the byte after the last byte copied.
       SValBuilder &SvalBuilder = C.getSValBuilder();
       ASTContext &Ctx = SvalBuilder.getContext();
-      QualType CharPtrTy = Ctx.getPointerType(Ctx.CharTy);
+      QualType CharPtrTy = getCharPtrType(Ctx, CK);
       SVal DestRegCharVal =
           SvalBuilder.evalCast(destVal, CharPtrTy, Dest.Expression->getType());
       SVal lastElement = C.getSValBuilder().evalBinOp(
           state, BO_Add, DestRegCharVal, sizeVal, Dest.Expression->getType());
       // If we don't know how much we copied, we can at least
       // conjure a return value for later.
       if (lastElement.isUnknown())
         lastElement = C.getSValBuilder().conjureSymbolVal(nullptr, CE, LCtx,
state = InvalidateBuffer(C, state, Source.Expression,
                              C.getSVal(Source.Expression),
                              /*IsSourceBuffer*/ true, nullptr);
 
     C.addTransition(state);
   }
 }
 
 void CStringChecker::evalMemcpy(CheckerContext &C, const CallExpr *CE,
-                                bool IsWide) const {
+                                CharKind CK) const {
   // void *memcpy(void *restrict dst, const void *restrict src, size_t n);
   // The return value is the address of the destination buffer.
   DestinationArgExpr Dest = {CE->getArg(0), 0};
   SourceArgExpr Src = {CE->getArg(1), 1};
   SizeArgExpr Size = {CE->getArg(2), 2};
 
   ProgramStateRef State = C.getState();
 
   constexpr bool IsRestricted = true;
   constexpr bool IsMempcpy = false;
-  evalCopyCommon(C, CE, State, Size, Dest, Src, IsRestricted, IsMempcpy,
-                 IsWide);
+  evalCopyCommon(C, CE, State, Size, Dest, Src, IsRestricted, IsMempcpy, CK);
 }
 
-void CStringChecker::evalMempcpy(CheckerContext &C, const CallExpr *CE) const {
+void CStringChecker::evalMempcpy(CheckerContext &C, const CallExpr *CE,
+                                 CharKind CK) const {
   // void *mempcpy(void *restrict dst, const void *restrict src, size_t n);
   // The return value is a pointer to the byte following the last written byte.
   DestinationArgExpr Dest = {CE->getArg(0), 0};
   SourceArgExpr Src = {CE->getArg(1), 1};
   SizeArgExpr Size = {CE->getArg(2), 2};
 
   constexpr bool IsRestricted = true;
   constexpr bool IsMempcpy = true;
   evalCopyCommon(C, CE, C.getState(), Size, Dest, Src, IsRestricted, IsMempcpy,
-                 false);
+                 CK);
 }
 
-void CStringChecker::evalMemmove(CheckerContext &C, const CallExpr *CE) const {
+void CStringChecker::evalMemmove(CheckerContext &C, const CallExpr *CE,
+                                 CharKind CK) const {
   // void *memmove(void *dst, const void *src, size_t n);
   // The return value is the address of the destination buffer.
   DestinationArgExpr Dest = {CE->getArg(0), 0};
   SourceArgExpr Src = {CE->getArg(1), 1};
   SizeArgExpr Size = {CE->getArg(2), 2};
 
   constexpr bool IsRestricted = false;
   constexpr bool IsMempcpy = false;
   evalCopyCommon(C, CE, C.getState(), Size, Dest, Src, IsRestricted, IsMempcpy,
-                 false);
+                 CK);
 }
 
 void CStringChecker::evalBcopy(CheckerContext &C, const CallExpr *CE) const {
   // void bcopy(const void *src, void *dst, size_t n);
   SourceArgExpr Src(CE->getArg(0), 0);
   DestinationArgExpr Dest = {CE->getArg(1), 1};
   SizeArgExpr Size = {CE->getArg(2), 2};
 
   constexpr bool IsRestricted = false;
   constexpr bool IsMempcpy = false;
   evalCopyCommon(C, CE, C.getState(), Size, Dest, Src, IsRestricted, IsMempcpy,
-                 false);
+                 CharKind::Regular);
 }
 
-void CStringChecker::evalMemcmp(CheckerContext &C, const CallExpr *CE) const {
+void CStringChecker::evalMemcmp(CheckerContext &C, const CallExpr *CE,
+                                CharKind CK) const {
   // int memcmp(const void *s1, const void *s2, size_t n);
   CurrentFunctionDescription = "memory comparison function";
 
   AnyArgExpr Left = {CE->getArg(0), 0};
   AnyArgExpr Right = {CE->getArg(1), 1};
   SizeArgExpr Size = {CE->getArg(2), 2};
 
   ProgramStateRef State = C.getState();
if (SameBuffer && !NotSameBuffer) {
         C.addTransition(State);
       }
       return;
     }
 
     // If the two arguments might be different buffers, we have to check
     // the size of both of them.
     assert(NotSameBuffer);
-    State = CheckBufferAccess(C, State, Right, Size, AccessKind::read);
-    State = CheckBufferAccess(C, State, Left, Size, AccessKind::read);
+    State = CheckBufferAccess(C, State, Right, Size, AccessKind::read, CK);
+    State = CheckBufferAccess(C, State, Left, Size, AccessKind::read, CK);
     if (State) {
       // The return value is the comparison result, which we don't know.
       SVal CmpV = Builder.conjureSymbolVal(nullptr, CE, LCtx, C.blockCount());
       State = State->BindExpr(CE, LCtx, CmpV);
       C.addTransition(State);
     }
   }
 }

clang/test/Analysis/wstring.c

 #endif /* USE_BUILTINS */
 
 typedef __SIZE_TYPE__ size_t;
 typedef __WCHAR_TYPE__ wchar_t;
 
 void clang_analyzer_eval(int);
 
 //===----------------------------------------------------------------------===
-// wwmemcpy()
+// wmemcpy()
 //===----------------------------------------------------------------------===
 
 #define wmemcpy BUILTIN(wmemcpy)
 wchar_t *wmemcpy(wchar_t *restrict s1, const wchar_t *restrict s2, size_t n);
 
 void wmemcpy0 (void) {
   wchar_t src[] = {1, 2, 3, 4};
   wchar_t dst[4] = {0};

 
 void wmemcpy_unknown_size_warn (size_t n) {
   wchar_t a[4];
   void *result = wmemcpy(a, 0, n); // expected-warning{{Null pointer passed as 2nd argument to memory copy function}}
   clang_analyzer_eval(result == a); // no-warning (above is fatal)
 }
 
 //===----------------------------------------------------------------------===
+// wmempcpy()
+//===----------------------------------------------------------------------===
+
+wchar_t *wmempcpy(wchar_t *restrict s1, const wchar_t *restrict s2, size_t n);
+
+void wmempcpy0 (void) {
+  wchar_t src[] = {1, 2, 3, 4};
+  wchar_t dst[5] = {0};
+
+  wmempcpy(dst, src, 4); // no-warning
+
+  clang_analyzer_eval(wmempcpy(dst, src, 4) == &dst[4]); // expected-warning{{TRUE}}
+
+  // If we actually model the copy, we can make this known.
+  // The important thing for now is that the old value has been invalidated.
+  clang_analyzer_eval(dst[0] != 0); // expected-warning{{UNKNOWN}}
+}
+
+void wmempcpy1 (void) {
+  wchar_t src[] = {1, 2, 3, 4};
+  wchar_t dst[10];
+
+  wmempcpy(dst, src, 5); // expected-warning{{Memory copy function accesses out-of-bound array element}}
+}
+
+void wmempcpy2 (void) {
+  wchar_t src[] = {1, 2, 3, 4};
+  wchar_t dst[1];
+
+  wmempcpy(dst, src, 4); // expected-warning{{Memory copy function overflows the destination buffer}}
+}
+
+void wmempcpy3 (void) {
+  wchar_t src[] = {1, 2, 3, 4};
+  wchar_t dst[3];
+
+  wmempcpy(dst+1, src+2, 2); // no-warning
+}
+
+void wmempcpy4 (void) {
+  wchar_t src[] = {1, 2, 3, 4};
+  wchar_t dst[10];
+
+  wmempcpy(dst+2, src+2, 3); // expected-warning{{Memory copy function accesses out-of-bound array element}}
+}
+
+void wmempcpy5(void) {
+  wchar_t src[] = {1, 2, 3, 4};
+  wchar_t dst[3];
+
+  wmempcpy(dst + 2, src + 2, 2); // expected-warning{{Memory copy function overflows the destination buffer}}
+}
+
+void wmempcpy6(void) {
+  wchar_t a[4] = {0};
+  wmempcpy(a, a, 2); // expected-warning{{overlapping}}
+}
+
+void wmempcpy7(void) {
+  wchar_t a[4] = {0};
+  wmempcpy(a+2, a+1, 2); // expected-warning{{overlapping}}
+}
+
+void wmempcpy8(void) {
+  wchar_t a[4] = {0};
+  wmempcpy(a+1, a+2, 2); // expected-warning{{overlapping}}
+}
+
+void wmempcpy9(void) {
+  wchar_t a[4] = {0};
+  wmempcpy(a+2, a+1, 1); // no-warning
+  wmempcpy(a+1, a+2, 1); // no-warning
+}
+
+void wmempcpy10(void) {
+  wchar_t a[4] = {0};
+  wmempcpy(0, a, 1); // expected-warning{{Null pointer passed as 1st argument to memory copy function}}
+}
+
+void wmempcpy11(void) {
+  wchar_t a[4] = {0};
+  wmempcpy(a, 0, 1); // expected-warning{{Null pointer passed as 2nd argument to memory copy function}}
+}
+
+void wmempcpy12(void) {
+  wchar_t a[4] = {0};
+  wmempcpy(0, a, 0); // no-warning
+}
+
+void wmempcpy13(void) {
+  wchar_t a[4] = {0};
+  wmempcpy(a, 0, 0); // no-warning
+}
+
+void wmempcpy14(void) {
+  wchar_t src[] = {1, 2, 3, 4};
+  wchar_t dst[5] = {0};
+  wchar_t *p;
+
+  p = wmempcpy(dst, src, 4);
+
+  clang_analyzer_eval(p == &dst[4]); // expected-warning{{TRUE}}
+}
+
+struct st {
+  wchar_t i;
+  wchar_t j;
+};
+
+void wmempcpy15(void) {
+  struct st s1 = {0};
+  struct st s2;
+  struct st *p1;
+  struct st *p2;
+
+  p1 = (&s2) + 1;
+  p2 = (struct st *)wmempcpy((wchar_t *)&s2, (wchar_t *)&s1, 2);
+
+  clang_analyzer_eval(p1 == p2); // expected-warning{{TRUE}}
+}
+
+void wmempcpy16(void) {
+  struct st s1[10] = {{0}};
+  struct st s2[10];
+  struct st *p1;
+  struct st *p2;
+
+  p1 = (&s2[0]) + 5;
+  p2 = (struct st *)wmempcpy((wchar_t *)&s2[0], (wchar_t *)&s1[0], 5 * 2);
+
+  clang_analyzer_eval(p1 == p2); // expected-warning{{TRUE}}
+}
+
+void wmempcpy_unknown_size_warn (size_t n) {
+  wchar_t a[4];
+  void *result = wmempcpy(a, 0, n); // expected-warning{{Null pointer passed as 2nd argument to memory copy function}}
+  clang_analyzer_eval(result == a); // no-warning (above is fatal)
+}
+
+void wmempcpy_unknownable_size (wchar_t *src, float n) {
+  wchar_t a[4];
+  // This used to crash because we don't model floats.
+  wmempcpy(a, src, (size_t)n);
+}
+
+//===----------------------------------------------------------------------===
+// wmemmove()
+//===----------------------------------------------------------------------===
+
+#define wmemmove BUILTIN(wmemmove)
+wchar_t *wmemmove(wchar_t *s1, const wchar_t *s2, size_t n);
+
+void wmemmove0 (void) {
+  wchar_t src[] = {1, 2, 3, 4};
+  wchar_t dst[4] = {0};
+
+  wmemmove(dst, src, 4); // no-warning
+
+  clang_analyzer_eval(wmemmove(dst, src, 4) == dst); // expected-warning{{TRUE}}
+
+  clang_analyzer_eval(dst[0] != 0); // expected-warning{{UNKNOWN}}
+}
+
+void wmemmove1 (void) {
+  wchar_t src[] = {1, 2, 3, 4};
+  wchar_t dst[10];
+
+  wmemmove(dst, src, 5); // expected-warning{{out-of-bound}}
+}
+
+void wmemmove2 (void) {
+  wchar_t src[] = {1, 2, 3, 4};
+  wchar_t dst[1];
+
+  wmemmove(dst, src, 4); // expected-warning{{Memory copy function overflows the destination buffer}}
+}
+
+//===----------------------------------------------------------------------===
+// wmemcmp()
+//===----------------------------------------------------------------------===
+
+#define wmemcmp BUILTIN(wmemcmp)
+int wmemcmp(const wchar_t *s1, const wchar_t *s2, size_t n);
+
+void wmemcmp0 (void) {
+  wchar_t a[] = {1, 2, 3, 4};
+  wchar_t b[4] = { 0 };
+
+  wmemcmp(a, b, 4); // no-warning
+}
+
+void wmemcmp1 (void) {
+  wchar_t a[] = {1, 2, 3, 4};
+  wchar_t b[10] = { 0 };
+
+  wmemcmp(a, b, 5); // expected-warning{{out-of-bound}}
+}
+
+void wmemcmp2 (void) {
+  wchar_t a[] = {1, 2, 3, 4};
+  wchar_t b[1] = { 0 };
+
+  wmemcmp(a, b, 4); // expected-warning{{out-of-bound}}
+}
+
+void wmemcmp3 (void) {
+  wchar_t a[] = {1, 2, 3, 4};
+
+  clang_analyzer_eval(wmemcmp(a, a, 4) == 0); // expected-warning{{TRUE}}
+}
+
+void wmemcmp4 (wchar_t *input) {
+  wchar_t a[] = {1, 2, 3, 4};
+
+  clang_analyzer_eval(wmemcmp(a, input, 4) == 0); // expected-warning{{UNKNOWN}}
+}
+
+void wmemcmp5 (wchar_t *input) {
+  wchar_t a[] = {1, 2, 3, 4};
+
+  clang_analyzer_eval(wmemcmp(a, 0, 0) == 0); // expected-warning{{TRUE}}
+  clang_analyzer_eval(wmemcmp(0, a, 0) == 0); // expected-warning{{TRUE}}
+  clang_analyzer_eval(wmemcmp(a, input, 0) == 0); // expected-warning{{TRUE}}
+}
+
+void wmemcmp6 (wchar_t *a, wchar_t *b, size_t n) {
+  int result = wmemcmp(a, b, n);
+  if (result != 0)
+    clang_analyzer_eval(n != 0); // expected-warning{{TRUE}}
+  // else
+  //   analyzer_assert_unknown(n == 0);
+
+  // We can't do the above comparison because n has already been constrained.
+  // On one path n == 0, on the other n != 0.
+}
+
+int wmemcmp7 (wchar_t *a, size_t x, size_t y, size_t n) {
+  // We used to crash when either of the arguments was unknown.
+  return wmemcmp(a, &a[x*y], n) +
+         wmemcmp(&a[x*y], a, n);
+}
+
+int wmemcmp8(wchar_t *a, size_t n) {
+  wchar_t *b = 0;
+  // Do not warn about the first argument!
+  return wmemcmp(a, b, n); // expected-warning{{Null pointer passed as 2nd argument to memory comparison function}}
+}
+
+//===----------------------------------------------------------------------===
 // wcslen()
 //===----------------------------------------------------------------------===
 
 #define wcslen BUILTIN(wcslen)
 size_t wcslen(const wchar_t *s);
 
 void wcslen_constant0(void) {
   clang_analyzer_eval(wcslen(L"123") == 3); // expected-warning{{TRUE}}