Index: lib/StaticAnalyzer/Checkers/CMakeLists.txt =================================================================== --- lib/StaticAnalyzer/Checkers/CMakeLists.txt +++ lib/StaticAnalyzer/Checkers/CMakeLists.txt @@ -26,6 +26,7 @@ CheckSizeofPointer.cpp CheckerDocumentation.cpp ChrootChecker.cpp + ConversionChecker.cpp ClangCheckers.cpp DeadStoresChecker.cpp DebugCheckers.cpp Index: lib/StaticAnalyzer/Checkers/Checkers.td =================================================================== --- lib/StaticAnalyzer/Checkers/Checkers.td +++ lib/StaticAnalyzer/Checkers/Checkers.td @@ -129,6 +129,10 @@ HelpText<"Check for cast from non-struct pointer to struct pointer">, DescFile<"CastToStructChecker.cpp">; +def ConversionChecker : Checker<"Conversion">, + HelpText<"Loss of sign/precision in conversions">, + DescFile<"ConversionChecker.cpp">; + def IdenticalExprChecker : Checker<"IdenticalExpr">, HelpText<"Warn about unintended use of identical expressions in operators">, DescFile<"IdenticalExprChecker.cpp">; Index: lib/StaticAnalyzer/Checkers/ConversionChecker.cpp =================================================================== --- lib/StaticAnalyzer/Checkers/ConversionChecker.cpp +++ lib/StaticAnalyzer/Checkers/ConversionChecker.cpp @@ -0,0 +1,149 @@ +//=== ConversionChecker.cpp -------------------------------------*- C++ -*-===// +// +// The LLVM Compiler Infrastructure +// +// This file is distributed under the University of Illinois Open Source +// License. See LICENSE.TXT for details. +// +//===----------------------------------------------------------------------===// +// +// This defines ConversionChecker that warns about dangerous conversions where +// there is possible loss of precision. +// +//===----------------------------------------------------------------------===// +#include "ClangSACheckers.h" +#include "clang/AST/ParentMap.h" +#include "clang/StaticAnalyzer/Core/BugReporter/BugType.h" +#include "clang/StaticAnalyzer/Core/Checker.h" +#include "clang/StaticAnalyzer/Core/CheckerManager.h" +#include "clang/StaticAnalyzer/Core/PathSensitive/CheckerContext.h" + +using namespace clang; +using namespace ento; + +namespace { +class ConversionChecker : public Checker> { + mutable std::unique_ptr BT; + +public: + void checkPreStmt(const ImplicitCastExpr *Cast, CheckerContext &C) const { + // TODO: For now we only warn about DeclRefExpr, to avoid noise. Warn for + // calculations also. + if (!isa(Cast->IgnoreParenImpCasts())) + return; + // Don't warn for loss of precision in macros + if (Cast->getExprLoc().isMacroID()) + return; + const ParentMap &PM = C.getLocationContext()->getParentMap(); + const Stmt *Parent = PM.getParent(Cast); + if (!Parent) + return; + const BinaryOperator *B = dyn_cast(Parent); + if (!B) + return; + + BinaryOperator::Opcode Opc = B->getOpcode(); + if (Opc == BO_Assign || BO_AddAssign || BO_SubAssign || Opc == BO_MulAssign) + diagnoseLossOfPrecision(Cast, C); + } + +private: + void diagnoseLossOfPrecision(const ImplicitCastExpr *Cast, + CheckerContext &C) const; + + void reportBug(CheckerContext &C, const char Msg[]) const { + // Generate an error node. + ExplodedNode *N = C.generateErrorNode(C.getState()); + if (!N) + return; + + if (!BT) + BT.reset(new BuiltinBug(this, "Conversion", "Loss of sign/precision.")); + + // Generate a report for this bug. + auto R = llvm::make_unique(*BT, Msg, N); + C.emitReport(std::move(R)); + } +}; +} + +static bool isSigned(const Expr *E) { + return E->getType()->isSignedIntegerType(); +} + +// Can E value be greater or equal than Val? +static bool canBeGreaterEqual(CheckerContext &C, const Expr *E, + unsigned long long Val) { + ProgramStateRef State = C.getState(); + llvm::Optional EVal = C.getSVal(E).getAs(); + if (!EVal) + return false; + + SValBuilder &Bldr = C.getSValBuilder(); + DefinedSVal V = Bldr.makeIntVal(Val, C.getASTContext().LongLongTy); + + // Is DefinedEVal less than V? + SVal GE = Bldr.evalBinOp(State, BO_GE, *EVal, V, Bldr.getConditionType()); + if (GE.isUnknownOrUndef()) + return false; + ConstraintManager &CM = C.getConstraintManager(); + ProgramStateRef StGE, StLT; + std::tie(StGE, StLT) = CM.assumeDual(State, GE.castAs()); + return (StGE && !StLT); +} + +// Can E have negative value? +static bool canBeNegative(CheckerContext &C, const Expr *E) { + ProgramStateRef State = C.getState(); + SVal EVal = State->getSVal(E, C.getLocationContext()); + if (EVal.isUnknownOrUndef() || !EVal.getAs()) + return false; + DefinedSVal DefinedEVal = EVal.castAs(); + + SValBuilder &Bldr = C.getSValBuilder(); + DefinedSVal V = Bldr.makeIntVal(0, false); + + SVal LT = + Bldr.evalBinOp(State, BO_LT, DefinedEVal, V, Bldr.getConditionType()); + + // Is E value greater than MaxVal? + ConstraintManager &CM = C.getConstraintManager(); + ProgramStateRef StNegative, StPositive; + std::tie(StNegative, StPositive) = + CM.assumeDual(State, LT.castAs()); + + return (StNegative && !StPositive); +} + +void ConversionChecker::diagnoseLossOfPrecision(const ImplicitCastExpr *Cast, + CheckerContext &C) const { + // Don't warn about explicit conversions in assignments. + if (Cast->isEvaluatable(C.getASTContext())) + return; + + QualType ResultType = Cast->getType(); + QualType SubType = Cast->IgnoreParenCasts()->getType(); + + if (!SubType->isIntegerType() || !ResultType->isIntegerType()) + return; + + if (C.getASTContext().getIntWidth(ResultType) >= + C.getASTContext().getIntWidth(SubType)) + return; + + unsigned W = C.getASTContext().getIntWidth(ResultType); + if (W == 1 || W >= 64U) + return; + + if (isSigned(Cast->IgnoreParenImpCasts()) && + canBeNegative(C, Cast->getSubExpr())) + return; + + unsigned long long MaxVal = 1ULL << W; + if (canBeGreaterEqual(C, Cast->getSubExpr(), MaxVal)) + reportBug(C, "Loss of precision, value too high"); +} + +void ento::registerConversionChecker(CheckerManager &mgr) { + mgr.registerChecker(); +} Index: test/Analysis/conversion.c =================================================================== --- test/Analysis/conversion.c +++ test/Analysis/conversion.c @@ -0,0 +1,23 @@ +// RUN: %clang_cc1 -analyze -analyzer-checker=core,alpha.core.Conversion -verify %s + +unsigned char U8; +signed char S8; + +void assign1() { + unsigned X = 1000; + U8 = X; // expected-warning {{Loss of precision}} +} + +// don't warn for macros +#define DOSTUFF ({ unsigned X = 1000; U8 = X; }) +void dontwarn1() { + DOSTUFF; +} + +// don't warn for calculations +// seen some fp. For instance: c2 = (c2 >= 'A' && c2 <= 'Z') ? c2 - 'A' + 'a' : c2; +// there is a todo in the checker to handle calculations +void dontwarn2() { + signed S = -32; + U8 = S+10; +}