[analyzer] MmapWriteExecChecker: use getAs instead of castAs

[danix800]

Summary

MmapWriteExecChecker: use getAs instead of castAs

Fixes https://github.com/llvm/llvm-project/issues/62285

[steakhal]

Could you please simplify the test case?
You could basically get rid of everything there, except for forwarding one top level parameter as the proto argument to the mmap call.

[danix800]

In D158953#4620125, @steakhal wrote:

Could you please simplify the test case?
You could basically get rid of everything there, except for forwarding one top level parameter as the proto argument to the mmap call.

No problem!

[danix800]

Simplify testcase

[steakhal]

Land it, whenever you wish. Thanks!
PS: usually we don't have a comment like that. The name of the function should give enough context, along with a // no-crash comment at the line where it was triggered in the past.
That usually just helps reviewers to understand the issue, but as I triaged this I'm aware what's going on.
In tricky situations.
I just let you know about these conventions, no need to adjust this patch.

clang/lib/StaticAnalyzer/Checkers/MmapWriteExecChecker.cpp

 int MmapWriteExecChecker::ProtWrite = 0x02;
 int MmapWriteExecChecker::ProtExec  = 0x04;
 int MmapWriteExecChecker::ProtRead  = 0x01;
 
 void MmapWriteExecChecker::checkPreCall(const CallEvent &Call,
                                          CheckerContext &C) const {
   if (matchesAny(Call, MmapFn, MprotectFn)) {
     SVal ProtVal = Call.getArgSVal(2);
-    auto ProtLoc = ProtVal.castAs<nonloc::ConcreteInt>();
-    int64_t Prot = ProtLoc.getValue().getSExtValue();
+    auto ProtLoc = ProtVal.getAs<nonloc::ConcreteInt>();
+    if (!ProtLoc)
+      return;
+    int64_t Prot = ProtLoc->getValue().getSExtValue();
     if (ProtExecOv != ProtExec)
       ProtExec = ProtExecOv;
     if (ProtReadOv != ProtRead)
       ProtRead = ProtReadOv;
 
     // Wrong settings
     if (ProtRead == ProtExec)
       return;

clang/test/Analysis/mmap-writeexec.c

 }
 
 void f3(void)
 {
   void *p = mmap(NULL, 1024, PROT_WRITE, MAP_PRIVATE | MAP_ANON, -1, 0); // no-warning
   int m = mprotect(p, 1024, PROT_WRITE | PROT_EXEC); // expected-warning{{Both PROT_WRITE and PROT_EXEC flags are set. This can lead to exploitable memory regions, which could be overwritten with malicious code}}
   (void)m;
 }
+
+// gh62285: no crash on non concrete arg 'prot'
+void *gh62285(void *addr, int prot)
+{
+  return mmap(addr, 1, prot, 1, 1, 1);
+}