diff --git a/clang/lib/StaticAnalyzer/Checkers/UnixAPIChecker.cpp b/clang/lib/StaticAnalyzer/Checkers/UnixAPIChecker.cpp --- a/clang/lib/StaticAnalyzer/Checkers/UnixAPIChecker.cpp +++ b/clang/lib/StaticAnalyzer/Checkers/UnixAPIChecker.cpp @@ -65,6 +65,7 @@ private: mutable std::unique_ptr BT_mallocZero; + mutable std::unique_ptr BT_printfPointerConversionSpecifierNULL; void CheckCallocZero(CheckerContext &C, const CallExpr *CE) const; void CheckMallocZero(CheckerContext &C, const CallExpr *CE) const; @@ -73,6 +74,10 @@ void CheckAllocaZero(CheckerContext &C, const CallExpr *CE) const; void CheckAllocaWithAlignZero(CheckerContext &C, const CallExpr *CE) const; void CheckVallocZero(CheckerContext &C, const CallExpr *CE) const; + void + CheckPrintfPointerConversionSpecifierNULL(CheckerContext &C, + const CallExpr *CE, + unsigned int data_args_index) const; bool ReportZeroByteAllocation(CheckerContext &C, ProgramStateRef falseState, @@ -83,6 +88,11 @@ const unsigned numArgs, const unsigned sizeArg, const char *fn) const; + + void + ReportPrintfPointerConversionSpecifierNULL(clang::ento::CheckerContext &C, + ProgramStateRef nullState, + const clang::Expr *arg) const; }; } //end anonymous namespace @@ -455,6 +465,67 @@ BasicAllocationCheck(C, CE, 1, 0, "valloc"); } +//===----------------------------------------------------------------------===// +// printf family of functions with null pointer passed to pointer +// conversion specifier +//===----------------------------------------------------------------------===// + +// Generates an error report, indicating that the result of passing a null +// pointer to pointer conversion specifier of printf family of functions is +// implementation defined. +void UnixAPIPortabilityChecker::ReportPrintfPointerConversionSpecifierNULL( + clang::ento::CheckerContext &C, ProgramStateRef nullState, + const clang::Expr *arg) const { + ExplodedNode *N = + C.generateNonFatalErrorNode(nullState ? nullState : C.getState()); + if (!N) + return; + LazyInitialize(this, BT_printfPointerConversionSpecifierNULL, + "Passing a null pointer to pointer conversion specifier of " + "printf family of functions"); + auto report = std::make_unique( + *BT_printfPointerConversionSpecifierNULL, + "The result of passing a null pointer to pointer conversion specifier of " + "printf family of functions is implementation defined", + N); + report->addRange(arg->getSourceRange()); + C.emitReport(std::move(report)); +} + +// Checks data arguments of printf family of functions for a null pointer, +// assuming it is passed to a pointer conversion specifier (%p), i.e. without +// checking the format string. +void UnixAPIPortabilityChecker::CheckPrintfPointerConversionSpecifierNULL( + CheckerContext &C, const CallExpr *CE, unsigned int data_args_index) const { + ProgramStateRef state = C.getState(); + ConstraintManager &CM = state->getConstraintManager(); + + for (unsigned int i = data_args_index; i < CE->getNumArgs(); i++) { + const Expr *arg = CE->getArg(i); + if (!arg) + continue; + + if (arg->isNullPointerConstant(C.getASTContext(), + Expr::NPC_ValueDependentIsNull)) { + ReportPrintfPointerConversionSpecifierNULL(C, nullptr, arg); + return; + } + + SVal argVal = C.getSVal(arg); + if (argVal.isUnknownOrUndef()) + continue; + + auto argDefinedVal = argVal.getAs(); + ProgramStateRef notNullState, nullState; + std::tie(notNullState, nullState) = + CM.assumeDual(C.getState(), *argDefinedVal); + if (!notNullState && nullState) { + ReportPrintfPointerConversionSpecifierNULL(C, nullState, arg); + return; + } + } +} + void UnixAPIPortabilityChecker::checkPreStmt(const CallExpr *CE, CheckerContext &C) const { const FunctionDecl *FD = C.getCalleeDecl(CE); @@ -491,6 +562,15 @@ else if (FName == "valloc") CheckVallocZero(C, CE); + + else if (FName == "printf") + CheckPrintfPointerConversionSpecifierNULL(C, CE, 1); + + else if (FName == "fprintf" || FName == "sprintf") + CheckPrintfPointerConversionSpecifierNULL(C, CE, 2); + + else if (FName == "snprintf") + CheckPrintfPointerConversionSpecifierNULL(C, CE, 3); } //===----------------------------------------------------------------------===// diff --git a/clang/test/Analysis/Inputs/expected-plists/unix-fns.c.plist b/clang/test/Analysis/Inputs/expected-plists/unix-fns.c.plist --- a/clang/test/Analysis/Inputs/expected-plists/unix-fns.c.plist +++ b/clang/test/Analysis/Inputs/expected-plists/unix-fns.c.plist @@ -3,6 +3,7 @@ clang_version +clang version 17.0.0 (git@github.com:llvm/llvm-project.git 1882a4ee69b3cc2202d8d7d7b6465475f6d19886) diagnostics @@ -16,12 +17,12 @@ start - line82 + line94 col3 file0 - line82 + line94 col5 file0 @@ -29,12 +30,12 @@ end - line84 + line96 col3 file0 - line84 + line96 col4 file0 @@ -50,12 +51,12 @@ start - line84 + line96 col3 file0 - line84 + line96 col4 file0 @@ -63,12 +64,12 @@ end - line84 + line96 col7 file0 - line84 + line96 col7 file0 @@ -80,7 +81,7 @@ kindevent location - line84 + line96 col7 file0 @@ -88,12 +89,12 @@ - line84 + line96 col7 file0 - line84 + line96 col9 file0 @@ -113,12 +114,12 @@ start - line84 + line96 col7 file0 - line84 + line96 col7 file0 @@ -126,12 +127,12 @@ end - line87 + line99 col3 file0 - line87 + line99 col4 file0 @@ -147,12 +148,12 @@ start - line87 + line99 col3 file0 - line87 + line99 col4 file0 @@ -160,12 +161,12 @@ end - line87 + line99 col8 file0 - line87 + line99 col11 file0 @@ -177,7 +178,7 @@ kindevent location - line87 + line99 col8 file0 @@ -185,12 +186,12 @@ - line87 + line99 col19 file0 - line87 + line99 col25 file0 @@ -214,7 +215,7 @@ issue_hash_function_offset6 location - line87 + line99 col8 file0 @@ -222,11 +223,11 @@ 0 - 81 - 82 - 83 - 84 - 87 + 93 + 94 + 95 + 96 + 99 @@ -241,12 +242,12 @@ start - line93 + line105 col3 file0 - line93 + line105 col5 file0 @@ -254,12 +255,12 @@ end - line95 + line107 col3 file0 - line95 + line107 col4 file0 @@ -275,12 +276,12 @@ start - line95 + line107 col3 file0 - line95 + line107 col4 file0 @@ -288,12 +289,12 @@ end - line95 + line107 col7 file0 - line95 + line107 col7 file0 @@ -305,7 +306,7 @@ kindevent location - line95 + line107 col7 file0 @@ -313,12 +314,12 @@ - line95 + line107 col7 file0 - line95 + line107 col9 file0 @@ -338,12 +339,12 @@ start - line95 + line107 col7 file0 - line95 + line107 col7 file0 @@ -351,12 +352,12 @@ end - line98 + line110 col3 file0 - line98 + line110 col4 file0 @@ -372,12 +373,12 @@ start - line98 + line110 col3 file0 - line98 + line110 col4 file0 @@ -385,12 +386,12 @@ end - line98 + line110 col8 file0 - line98 + line110 col13 file0 @@ -402,7 +403,7 @@ kindevent location - line98 + line110 col8 file0 @@ -410,12 +411,12 @@ - line98 + line110 col44 file0 - line98 + line110 col50 file0 @@ -439,7 +440,7 @@ issue_hash_function_offset6 location - line98 + line110 col8 file0 @@ -447,11 +448,11 @@ 0 - 92 - 93 - 94 - 95 - 98 + 104 + 105 + 106 + 107 + 110 @@ -466,12 +467,12 @@ start - line104 + line116 col3 file0 - line104 + line116 col17 file0 @@ -479,12 +480,12 @@ end - line105 + line117 col8 file0 - line105 + line117 col9 file0 @@ -500,12 +501,12 @@ start - line105 + line117 col8 file0 - line105 + line117 col9 file0 @@ -513,12 +514,12 @@ end - line105 + line117 col52 file0 - line105 + line117 col64 file0 @@ -530,7 +531,7 @@ kindevent location - line105 + line117 col52 file0 @@ -538,12 +539,12 @@ - line105 + line117 col66 file0 - line105 + line117 col72 file0 @@ -567,7 +568,7 @@ issue_hash_function_offset2 location - line105 + line117 col52 file0 @@ -575,9 +576,9 @@ 0 - 103 - 104 - 105 + 115 + 116 + 117 @@ -592,12 +593,12 @@ start - line115 + line127 col3 file0 - line115 + line127 col16 file0 @@ -605,12 +606,12 @@ end - line116 + line128 col3 file0 - line116 + line128 col14 file0 @@ -622,7 +623,7 @@ kindevent location - line116 + line128 col3 file0 @@ -630,12 +631,12 @@ - line116 + line128 col16 file0 - line116 + line128 col20 file0 @@ -659,7 +660,7 @@ issue_hash_function_offset2 location - line116 + line128 col3 file0 @@ -667,9 +668,9 @@ 0 - 114 - 115 - 116 + 126 + 127 + 128 @@ -684,12 +685,12 @@ start - line125 + line137 col3 file0 - line125 + line137 col6 file0 @@ -697,12 +698,12 @@ end - line125 + line137 col15 file0 - line125 + line137 col20 file0 @@ -714,7 +715,7 @@ kindevent location - line125 + line137 col15 file0 @@ -722,12 +723,12 @@ - line125 + line137 col22 file0 - line125 + line137 col22 file0 @@ -751,7 +752,7 @@ issue_hash_function_offset1 location - line125 + line137 col15 file0 @@ -759,8 +760,8 @@ 0 - 124 - 125 + 136 + 137 @@ -775,12 +776,12 @@ start - line137 + line149 col3 file0 - line137 + line149 col6 file0 @@ -788,12 +789,12 @@ end - line137 + line149 col15 file0 - line137 + line149 col20 file0 @@ -805,7 +806,7 @@ kindevent location - line137 + line149 col15 file0 @@ -813,12 +814,12 @@ - line137 + line149 col22 file0 - line137 + line149 col22 file0 @@ -842,7 +843,7 @@ issue_hash_function_offset1 location - line137 + line149 col15 file0 @@ -850,8 +851,8 @@ 0 - 136 - 137 + 148 + 149 @@ -866,12 +867,12 @@ start - line143 + line155 col3 file0 - line143 + line155 col6 file0 @@ -879,12 +880,12 @@ end - line143 + line155 col15 file0 - line143 + line155 col20 file0 @@ -896,7 +897,7 @@ kindevent location - line143 + line155 col15 file0 @@ -904,12 +905,12 @@ - line143 + line155 col26 file0 - line143 + line155 col26 file0 @@ -933,7 +934,7 @@ issue_hash_function_offset1 location - line143 + line155 col15 file0 @@ -941,8 +942,8 @@ 0 - 142 - 143 + 154 + 155 @@ -957,12 +958,12 @@ start - line155 + line167 col3 file0 - line155 + line167 col6 file0 @@ -970,12 +971,12 @@ end - line155 + line167 col15 file0 - line155 + line167 col21 file0 @@ -987,7 +988,7 @@ kindevent location - line155 + line167 col15 file0 @@ -995,12 +996,12 @@ - line155 + line167 col28 file0 - line155 + line167 col28 file0 @@ -1024,7 +1025,7 @@ issue_hash_function_offset1 location - line155 + line167 col15 file0 @@ -1032,8 +1033,8 @@ 0 - 154 - 155 + 166 + 167 @@ -1048,12 +1049,12 @@ start - line161 + line173 col3 file0 - line161 + line173 col6 file0 @@ -1061,12 +1062,12 @@ end - line161 + line173 col15 file0 - line161 + line173 col22 file0 @@ -1078,7 +1079,7 @@ kindevent location - line161 + line173 col15 file0 @@ -1086,12 +1087,12 @@ - line161 + line173 col29 file0 - line161 + line173 col29 file0 @@ -1115,7 +1116,7 @@ issue_hash_function_offset1 location - line161 + line173 col15 file0 @@ -1123,8 +1124,8 @@ 0 - 160 - 161 + 172 + 173 @@ -1139,12 +1140,12 @@ start - line179 + line191 col3 file0 - line179 + line191 col6 file0 @@ -1152,12 +1153,12 @@ end - line179 + line191 col15 file0 - line179 + line191 col20 file0 @@ -1169,7 +1170,7 @@ kindevent location - line179 + line191 col15 file0 @@ -1177,12 +1178,12 @@ - line179 + line191 col22 file0 - line179 + line191 col22 file0 @@ -1206,7 +1207,7 @@ issue_hash_function_offset1 location - line179 + line191 col15 file0 @@ -1214,8 +1215,8 @@ 0 - 178 - 179 + 190 + 191 @@ -1230,12 +1231,12 @@ start - line191 + line203 col3 file0 - line191 + line203 col6 file0 @@ -1243,12 +1244,12 @@ end - line191 + line203 col16 file0 - line191 + line203 col31 file0 @@ -1260,7 +1261,7 @@ kindevent location - line191 + line203 col16 file0 @@ -1268,12 +1269,12 @@ - line191 + line203 col33 file0 - line191 + line203 col33 file0 @@ -1297,7 +1298,7 @@ issue_hash_function_offset1 location - line191 + line203 col16 file0 @@ -1305,8 +1306,8 @@ 0 - 190 - 191 + 202 + 203 @@ -1321,12 +1322,12 @@ start - line203 + line215 col3 file0 - line203 + line215 col6 file0 @@ -1334,12 +1335,12 @@ end - line203 + line215 col15 file0 - line203 + line215 col20 file0 @@ -1351,7 +1352,7 @@ kindevent location - line203 + line215 col15 file0 @@ -1359,12 +1360,12 @@ - line203 + line215 col22 file0 - line203 + line215 col22 file0 @@ -1388,7 +1389,7 @@ issue_hash_function_offset1 location - line203 + line215 col15 file0 @@ -1396,8 +1397,8 @@ 0 - 202 - 203 + 214 + 215 @@ -1412,12 +1413,12 @@ start - line216 + line228 col3 file0 - line216 + line228 col17 file0 @@ -1425,12 +1426,12 @@ end - line217 + line229 col3 file0 - line217 + line229 col15 file0 @@ -1442,7 +1443,7 @@ kindevent location - line217 + line229 col3 file0 @@ -1450,12 +1451,12 @@ - line217 + line229 col17 file0 - line217 + line229 col21 file0 @@ -1479,7 +1480,7 @@ issue_hash_function_offset2 location - line217 + line229 col3 file0 @@ -1487,9 +1488,9 @@ 0 - 215 - 216 - 217 + 227 + 228 + 229 @@ -1500,7 +1501,7 @@ kindevent location - line222 + line234 col3 file0 @@ -1508,12 +1509,12 @@ - line222 + line234 col3 file0 - line222 + line234 col8 file0 @@ -1533,12 +1534,12 @@ start - line222 + line234 col3 file0 - line222 + line234 col5 file0 @@ -1546,12 +1547,12 @@ end - line223 + line235 col3 file0 - line223 + line235 col15 file0 @@ -1567,12 +1568,12 @@ start - line223 + line235 col3 file0 - line223 + line235 col15 file0 @@ -1580,12 +1581,12 @@ end - line223 + line235 col24 file0 - line223 + line235 col24 file0 @@ -1597,7 +1598,7 @@ kindevent location - line223 + line235 col24 file0 @@ -1605,12 +1606,12 @@ - line223 + line235 col24 file0 - line227 + line239 col3 file0 @@ -1630,12 +1631,12 @@ start - line223 + line235 col24 file0 - line223 + line235 col24 file0 @@ -1643,12 +1644,12 @@ end - line223 + line235 col3 file0 - line223 + line235 col15 file0 @@ -1660,7 +1661,7 @@ kindevent location - line223 + line235 col3 file0 @@ -1668,12 +1669,12 @@ - line223 + line235 col3 file0 - line227 + line239 col4 file0 @@ -1689,7 +1690,7 @@ kindevent location - line223 + line235 col3 file0 @@ -1697,12 +1698,12 @@ - line223 + line235 col3 file0 - line227 + line239 col4 file0 @@ -1718,7 +1719,7 @@ kindevent location - line223 + line235 col24 file0 @@ -1736,12 +1737,12 @@ start - line223 + line235 col24 file0 - line223 + line235 col24 file0 @@ -1749,12 +1750,12 @@ end - line224 + line236 col4 file0 - line224 + line236 col5 file0 @@ -1770,12 +1771,12 @@ start - line224 + line236 col4 file0 - line224 + line236 col5 file0 @@ -1783,12 +1784,12 @@ end - line224 + line236 col8 file0 - line224 + line236 col8 file0 @@ -1800,7 +1801,7 @@ kindevent location - line224 + line236 col8 file0 @@ -1808,12 +1809,12 @@ - line224 + line236 col8 file0 - line224 + line236 col8 file0 @@ -1833,12 +1834,12 @@ start - line224 + line236 col8 file0 - line224 + line236 col8 file0 @@ -1846,12 +1847,12 @@ end - line225 + line237 col3 file0 - line225 + line237 col3 file0 @@ -1867,12 +1868,12 @@ start - line225 + line237 col3 file0 - line225 + line237 col3 file0 @@ -1880,12 +1881,12 @@ end - line225 + line237 col6 file0 - line225 + line237 col6 file0 @@ -1897,7 +1898,7 @@ kindevent location - line225 + line237 col6 file0 @@ -1905,12 +1906,12 @@ - line225 + line237 col4 file0 - line225 + line237 col4 file0 @@ -1931,7 +1932,7 @@ issue_hash_content_of_line_in_context5d3f4c433004c7a6d4a06aa30cc3ea85 location - line225 + line237 col6 file0 @@ -1940,11 +1941,11 @@ 0 40 - 221 - 222 - 223 - 224 - 225 + 233 + 234 + 235 + 236 + 237 @@ -1959,12 +1960,12 @@ start - line232 + line244 col3 file0 - line232 + line244 col8 file0 @@ -1972,12 +1973,12 @@ end - line233 + line245 col3 file0 - line233 + line245 col5 file0 @@ -1989,7 +1990,7 @@ kindevent location - line233 + line245 col3 file0 @@ -1997,12 +1998,12 @@ - line233 + line245 col3 file0 - line233 + line245 col8 file0 @@ -2022,12 +2023,12 @@ start - line233 + line245 col3 file0 - line233 + line245 col5 file0 @@ -2035,12 +2036,12 @@ end - line234 + line246 col3 file0 - line234 + line246 col15 file0 @@ -2056,12 +2057,12 @@ start - line234 + line246 col3 file0 - line234 + line246 col15 file0 @@ -2069,12 +2070,12 @@ end - line234 + line246 col24 file0 - line234 + line246 col24 file0 @@ -2086,7 +2087,7 @@ kindevent location - line234 + line246 col24 file0 @@ -2094,12 +2095,12 @@ - line234 + line246 col24 file0 - line236 + line248 col3 file0 @@ -2119,12 +2120,12 @@ start - line234 + line246 col24 file0 - line234 + line246 col24 file0 @@ -2132,12 +2133,12 @@ end - line234 + line246 col3 file0 - line234 + line246 col15 file0 @@ -2149,7 +2150,7 @@ kindevent location - line234 + line246 col3 file0 @@ -2157,12 +2158,12 @@ - line234 + line246 col3 file0 - line236 + line248 col4 file0 @@ -2318,7 +2319,7 @@ kindevent location - line234 + line246 col24 file0 @@ -2336,12 +2337,12 @@ start - line234 + line246 col24 file0 - line234 + line246 col24 file0 @@ -2349,12 +2350,12 @@ end - line235 + line247 col4 file0 - line235 + line247 col4 file0 @@ -2370,12 +2371,12 @@ start - line235 + line247 col4 file0 - line235 + line247 col4 file0 @@ -2383,12 +2384,12 @@ end - line235 + line247 col7 file0 - line235 + line247 col7 file0 @@ -2400,7 +2401,7 @@ kindevent location - line235 + line247 col7 file0 @@ -2408,12 +2409,12 @@ - line235 + line247 col5 file0 - line235 + line247 col5 file0 @@ -2434,7 +2435,7 @@ issue_hash_content_of_line_in_context265c4fd608dafee211bfa93d21c28866 location - line235 + line247 col7 file0 @@ -2457,11 +2458,11 @@ 59 60 61 - 231 - 232 - 233 - 234 - 235 + 243 + 244 + 245 + 246 + 247 @@ -2476,12 +2477,12 @@ start - line241 + line253 col3 file0 - line241 + line253 col8 file0 @@ -2489,12 +2490,12 @@ end - line243 + line255 col3 file0 - line243 + line255 col15 file0 @@ -2506,7 +2507,7 @@ kindevent location - line243 + line255 col3 file0 @@ -2514,12 +2515,12 @@ - line243 + line255 col3 file0 - line245 + line257 col4 file0 @@ -2675,7 +2676,7 @@ kindevent location - line243 + line255 col24 file0 @@ -2693,12 +2694,12 @@ start - line243 + line255 col24 file0 - line243 + line255 col24 file0 @@ -2706,12 +2707,12 @@ end - line244 + line256 col7 file0 - line244 + line256 col7 file0 @@ -2723,7 +2724,7 @@ kindevent location - line244 + line256 col7 file0 @@ -2731,12 +2732,12 @@ - line244 + line256 col7 file0 - line244 + line256 col11 file0 @@ -2844,7 +2845,7 @@ kindevent location - line243 + line255 col3 file0 @@ -2852,12 +2853,12 @@ - line243 + line255 col3 file0 - line245 + line257 col4 file0 @@ -2877,12 +2878,12 @@ start - line243 + line255 col3 file0 - line243 + line255 col15 file0 @@ -2890,12 +2891,12 @@ end - line247 + line259 col3 file0 - line247 + line259 col3 file0 @@ -2911,12 +2912,12 @@ start - line247 + line259 col3 file0 - line247 + line259 col3 file0 @@ -2924,12 +2925,12 @@ end - line247 + line259 col6 file0 - line247 + line259 col6 file0 @@ -2941,7 +2942,7 @@ kindevent location - line247 + line259 col6 file0 @@ -2949,12 +2950,12 @@ - line247 + line259 col4 file0 - line247 + line259 col4 file0 @@ -2978,7 +2979,7 @@ issue_hash_function_offset7 location - line247 + line259 col6 file0 @@ -3002,18 +3003,1069 @@ 60 61 65 - 240 - 241 - 242 - 243 - 244 - 247 + 252 + 253 + 254 + 255 + 256 + 259 + + + + + path + + + kindevent + location + + line264 + col3 + file0 + + ranges + + + + line264 + col18 + file0 + + + line264 + col21 + file0 + + + + depth0 + extended_message + Result of passing a null pointer to pointer conversion specifier of printf family of functions is implementation defined + message + Result of passing a null pointer to pointer conversion specifier of printf family of functions is implementation defined + + + descriptionResult of passing a null pointer to pointer conversion specifier of printf family of functions is implementation defined + categoryUnix API + typePassing a null pointer to pointer conversion specifier of printf family of functions + check_nameoptin.portability.UnixAPI + + issue_hash_content_of_line_in_context54f0bba7f69b32693c15dc83c98853d0 + issue_context_kindfunction + issue_contexttest_printf_family_pointer_conversion_specifier_null + issue_hash_function_offset1 + location + + line264 + col3 + file0 + + ExecutedLines + + 0 + + 263 + 264 + + + + + path + + + kindcontrol + edges + + + start + + + line264 + col3 + file0 + + + line264 + col8 + file0 + + + end + + + line265 + col3 + file0 + + + line265 + col9 + file0 + + + + + + + kindevent + location + + line265 + col3 + file0 + + ranges + + + + line265 + col25 + file0 + + + line265 + col28 + file0 + + + + depth0 + extended_message + Result of passing a null pointer to pointer conversion specifier of printf family of functions is implementation defined + message + Result of passing a null pointer to pointer conversion specifier of printf family of functions is implementation defined + + + descriptionResult of passing a null pointer to pointer conversion specifier of printf family of functions is implementation defined + categoryUnix API + typePassing a null pointer to pointer conversion specifier of printf family of functions + check_nameoptin.portability.UnixAPI + + issue_hash_content_of_line_in_context7ac4aafe0c7678048a52432da06b132e + issue_context_kindfunction + issue_contexttest_printf_family_pointer_conversion_specifier_null + issue_hash_function_offset2 + location + + line265 + col3 + file0 + + ExecutedLines + + 0 + + 263 + 264 + 265 + + + + + path + + + kindcontrol + edges + + + start + + + line264 + col3 + file0 + + + line264 + col8 + file0 + + + end + + + line266 + col3 + file0 + + + line266 + col9 + file0 + + + + + + + kindevent + location + + line266 + col3 + file0 + + ranges + + + + line266 + col24 + file0 + + + line266 + col27 + file0 + + + + depth0 + extended_message + Result of passing a null pointer to pointer conversion specifier of printf family of functions is implementation defined + message + Result of passing a null pointer to pointer conversion specifier of printf family of functions is implementation defined + + + descriptionResult of passing a null pointer to pointer conversion specifier of printf family of functions is implementation defined + categoryUnix API + typePassing a null pointer to pointer conversion specifier of printf family of functions + check_nameoptin.portability.UnixAPI + + issue_hash_content_of_line_in_context5d719d079b1d940aa436d2556b319ac2 + issue_context_kindfunction + issue_contexttest_printf_family_pointer_conversion_specifier_null + issue_hash_function_offset3 + location + + line266 + col3 + file0 + + ExecutedLines + + 0 + + 263 + 264 + 265 + 266 + + + + + path + + + kindcontrol + edges + + + start + + + line264 + col3 + file0 + + + line264 + col8 + file0 + + + end + + + line267 + col3 + file0 + + + line267 + col10 + file0 + + + + + + + kindevent + location + + line267 + col3 + file0 + + ranges + + + + line267 + col35 + file0 + + + line267 + col38 + file0 + + + + depth0 + extended_message + Result of passing a null pointer to pointer conversion specifier of printf family of functions is implementation defined + message + Result of passing a null pointer to pointer conversion specifier of printf family of functions is implementation defined + + + descriptionResult of passing a null pointer to pointer conversion specifier of printf family of functions is implementation defined + categoryUnix API + typePassing a null pointer to pointer conversion specifier of printf family of functions + check_nameoptin.portability.UnixAPI + + issue_hash_content_of_line_in_contextf55429777fbe31b5860c1eef18ecda7b + issue_context_kindfunction + issue_contexttest_printf_family_pointer_conversion_specifier_null + issue_hash_function_offset4 + location + + line267 + col3 + file0 + + ExecutedLines + + 0 + + 263 + 264 + 265 + 266 + 267 + + + + + path + + + kindevent + location + + line272 + col3 + file0 + + ranges + + + + line272 + col18 + file0 + + + line272 + col21 + file0 + + + + depth0 + extended_message + Result of passing a null pointer to pointer conversion specifier of printf family of functions is implementation defined + message + Result of passing a null pointer to pointer conversion specifier of printf family of functions is implementation defined + + + descriptionResult of passing a null pointer to pointer conversion specifier of printf family of functions is implementation defined + categoryUnix API + typePassing a null pointer to pointer conversion specifier of printf family of functions + check_nameoptin.portability.UnixAPI + + issue_hash_content_of_line_in_context5fc70b5bb47d33b3280933d55060f634 + issue_context_kindfunction + issue_contexttest_printf_pointer_conversion_specifier_null_various_arguments + issue_hash_function_offset1 + location + + line272 + col3 + file0 + + ExecutedLines + + 0 + + 271 + 272 + + + + + path + + + kindcontrol + edges + + + start + + + line272 + col3 + file0 + + + line272 + col8 + file0 + + + end + + + line273 + col3 + file0 + + + line273 + col8 + file0 + + + + + + + kindevent + location + + line273 + col3 + file0 + + ranges + + + + line273 + col21 + file0 + + + line273 + col24 + file0 + + + + depth0 + extended_message + Result of passing a null pointer to pointer conversion specifier of printf family of functions is implementation defined + message + Result of passing a null pointer to pointer conversion specifier of printf family of functions is implementation defined + + + descriptionResult of passing a null pointer to pointer conversion specifier of printf family of functions is implementation defined + categoryUnix API + typePassing a null pointer to pointer conversion specifier of printf family of functions + check_nameoptin.portability.UnixAPI + + issue_hash_content_of_line_in_context7520f70eb44f12e3f8a1f45723f74e99 + issue_context_kindfunction + issue_contexttest_printf_pointer_conversion_specifier_null_various_arguments + issue_hash_function_offset2 + location + + line273 + col3 + file0 + + ExecutedLines + + 0 + + 271 + 272 + 273 + + + + + path + + + kindcontrol + edges + + + start + + + line272 + col3 + file0 + + + line272 + col8 + file0 + + + end + + + line274 + col3 + file0 + + + line274 + col8 + file0 + + + + + + + kindevent + location + + line274 + col3 + file0 + + ranges + + + + line274 + col21 + file0 + + + line274 + col24 + file0 + + + + depth0 + extended_message + Result of passing a null pointer to pointer conversion specifier of printf family of functions is implementation defined + message + Result of passing a null pointer to pointer conversion specifier of printf family of functions is implementation defined + + + descriptionResult of passing a null pointer to pointer conversion specifier of printf family of functions is implementation defined + categoryUnix API + typePassing a null pointer to pointer conversion specifier of printf family of functions + check_nameoptin.portability.UnixAPI + + issue_hash_content_of_line_in_context52803e48b3be5e2575cd92daee3a6224 + issue_context_kindfunction + issue_contexttest_printf_pointer_conversion_specifier_null_various_arguments + issue_hash_function_offset3 + location + + line274 + col3 + file0 + + ExecutedLines + + 0 + + 271 + 272 + 273 + 274 + + + + + path + + + kindcontrol + edges + + + start + + + line272 + col3 + file0 + + + line272 + col8 + file0 + + + end + + + line275 + col3 + file0 + + + line275 + col8 + file0 + + + + + + + kindevent + location + + line275 + col3 + file0 + + ranges + + + + line275 + col18 + file0 + + + line275 + col21 + file0 + + + + depth0 + extended_message + Result of passing a null pointer to pointer conversion specifier of printf family of functions is implementation defined + message + Result of passing a null pointer to pointer conversion specifier of printf family of functions is implementation defined + + + descriptionResult of passing a null pointer to pointer conversion specifier of printf family of functions is implementation defined + categoryUnix API + typePassing a null pointer to pointer conversion specifier of printf family of functions + check_nameoptin.portability.UnixAPI + + issue_hash_content_of_line_in_context7714fbaa2d536e4684ce0c206f8d515e + issue_context_kindfunction + issue_contexttest_printf_pointer_conversion_specifier_null_various_arguments + issue_hash_function_offset4 + location + + line275 + col3 + file0 + + ExecutedLines + + 0 + + 271 + 272 + 273 + 274 + 275 + + + + + path + + + kindcontrol + edges + + + start + + + line272 + col3 + file0 + + + line272 + col8 + file0 + + + end + + + line276 + col3 + file0 + + + line276 + col8 + file0 + + + + + + + kindevent + location + + line276 + col3 + file0 + + ranges + + + + line276 + col18 + file0 + + + line276 + col21 + file0 + + + + depth0 + extended_message + Result of passing a null pointer to pointer conversion specifier of printf family of functions is implementation defined + message + Result of passing a null pointer to pointer conversion specifier of printf family of functions is implementation defined + + + descriptionResult of passing a null pointer to pointer conversion specifier of printf family of functions is implementation defined + categoryUnix API + typePassing a null pointer to pointer conversion specifier of printf family of functions + check_nameoptin.portability.UnixAPI + + issue_hash_content_of_line_in_context3fe4cd67b2f852f7c3eb6a3711a4571a + issue_context_kindfunction + issue_contexttest_printf_pointer_conversion_specifier_null_various_arguments + issue_hash_function_offset5 + location + + line276 + col3 + file0 + + ExecutedLines + + 0 + + 271 + 272 + 273 + 274 + 275 + 276 + + + + + path + + + kindcontrol + edges + + + start + + + line281 + col3 + file0 + + + line281 + col6 + file0 + + + end + + + line282 + col3 + file0 + + + line282 + col8 + file0 + + + + + + + kindevent + location + + line282 + col3 + file0 + + ranges + + + + line282 + col18 + file0 + + + line282 + col25 + file0 + + + + depth0 + extended_message + Result of passing a null pointer to pointer conversion specifier of printf family of functions is implementation defined + message + Result of passing a null pointer to pointer conversion specifier of printf family of functions is implementation defined + + + descriptionResult of passing a null pointer to pointer conversion specifier of printf family of functions is implementation defined + categoryUnix API + typePassing a null pointer to pointer conversion specifier of printf family of functions + check_nameoptin.portability.UnixAPI + + issue_hash_content_of_line_in_context26d9e48052c090e449c0e6c2529d8c17 + issue_context_kindfunction + issue_contextprintf_pointer_conversion_specifier_null_pointer_constraint + issue_hash_function_offset2 + location + + line282 + col3 + file0 + + ExecutedLines + + 0 + + 280 + 281 + 282 + + + + + path + + + kindcontrol + edges + + + start + + + line281 + col3 + file0 + + + line281 + col6 + file0 + + + end + + + line283 + col3 + file0 + + + line283 + col4 + file0 + + + + + + + kindcontrol + edges + + + start + + + line283 + col3 + file0 + + + line283 + col4 + file0 + + + end + + + line283 + col7 + file0 + + + line283 + col14 + file0 + + + + + + + kindevent + location + + line283 + col7 + file0 + + ranges + + + + line283 + col7 + file0 + + + line283 + col22 + file0 + + + + depth0 + extended_message + Assuming 'pointer1' is equal to NULL + message + Assuming 'pointer1' is equal to NULL + + + kindcontrol + edges + + + start + + + line283 + col7 + file0 + + + line283 + col14 + file0 + + + end + + + line287 + col3 + file0 + + + line287 + col8 + file0 + + + + + + + kindevent + location + + line287 + col3 + file0 + + ranges + + + + line287 + col18 + file0 + + + line287 + col25 + file0 + + + + depth0 + extended_message + Result of passing a null pointer to pointer conversion specifier of printf family of functions is implementation defined + message + Result of passing a null pointer to pointer conversion specifier of printf family of functions is implementation defined + + + descriptionResult of passing a null pointer to pointer conversion specifier of printf family of functions is implementation defined + categoryUnix API + typePassing a null pointer to pointer conversion specifier of printf family of functions + check_nameoptin.portability.UnixAPI + + issue_hash_content_of_line_in_contextd84859aa24ef7e930e28c74657e7a568 + issue_context_kindfunction + issue_contextprintf_pointer_conversion_specifier_null_pointer_constraint + issue_hash_function_offset7 + location + + line287 + col3 + file0 + + ExecutedLines + + 0 + + 280 + 281 + 282 + 283 + 287 files + /Users/georgiy.lebedev/Work/llvm-project/clang/test/Analysis/unix-fns.c diff --git a/clang/test/Analysis/unix-fns.c b/clang/test/Analysis/unix-fns.c --- a/clang/test/Analysis/unix-fns.c +++ b/clang/test/Analysis/unix-fns.c @@ -78,6 +78,18 @@ int openat(int, const char *, int, ...); int close(int fildes); +#ifndef NULL +#define NULL ((void*) 0) +#endif + +struct FILE_t; +typedef struct FILE_t FILE; + +int printf( const char *, ... ); +int fprintf(FILE *, const char *, ...); +int sprintf(char *, const char *, ...); +int snprintf(char *, size_t, const char *, ...); + void test_open(const char *path) { int fd; fd = open(path, O_RDONLY); // no-warning @@ -246,3 +258,31 @@ *p = 7; // expected-warning {{Dereference of null pointer (loaded from variable 'p')}} } + +// Test basic case for the whole print family. +void test_printf_family_pointer_conversion_specifier_null(FILE *file, char *buf, size_t buf_size, char *format) { + printf(format, NULL); // expected-warning{{Result of passing a null pointer to pointer conversion specifier of printf family of functions is implementation defined}} + fprintf(file, format, NULL); // expected-warning{{Result of passing a null pointer to pointer conversion specifier of printf family of functions is implementation defined}} + sprintf(buf, format, NULL); // expected-warning{{Result of passing a null pointer to pointer conversion specifier of printf family of functions is implementation defined}} + snprintf(buf, buf_size, format, NULL); // expected-warning{{Result of passing a null pointer to pointer conversion specifier of printf family of functions is implementation defined}} +} + +// Test various arguments. +void test_printf_pointer_conversion_specifier_null_various_arguments(char *format) { + printf(format, NULL); // expected-warning{{Result of passing a null pointer to pointer conversion specifier of printf family of functions is implementation defined}} + printf(format, 1, NULL); // expected-warning{{Result of passing a null pointer to pointer conversion specifier of printf family of functions is implementation defined}} + printf(format, 1, NULL, 2); // expected-warning{{Result of passing a null pointer to pointer conversion specifier of printf family of functions is implementation defined}} + printf(format, NULL, NULL); // expected-warning{{Result of passing a null pointer to pointer conversion specifier of printf family of functions is implementation defined}} + printf(format, NULL, 1, NULL); // expected-warning{{Result of passing a null pointer to pointer conversion specifier of printf family of functions is implementation defined}} +} + +// Test pointer constraint. +void printf_pointer_conversion_specifier_null_pointer_constraint(char *format, void *pointer1) { + void *pointer2 = NULL; + printf(format, pointer2); // expected-warning{{Result of passing a null pointer to pointer conversion specifier of printf family of functions is implementation defined}} + if (pointer1 != NULL) { + printf(format, pointer1); // no-warning + return; + } + printf(format, pointer1); // expected-warning{{Result of passing a null pointer to pointer conversion specifier of printf family of functions is implementation defined}} +}