This is an archive of the discontinued LLVM Phabricator instance.

Paths

[analyzer] Fix assertion crash in CStringChecker
ClosedPublic

Authored by george.karpenkov on Mar 30 2018, 4:12 PM.

Reviewers

dcoughlin
NoQ

Commits

Summary

An offset might be unknown.

rdar://39054939

Test?

More LocAsInteger problems. We need more flexible symbolic expressions.

This revision is now accepted and ready to land.Mar 30 2018, 6:08 PM

This revision was automatically updated to reflect the committed changes.

Path

Size

lib/

StaticAnalyzer/

Checkers/

7 lines

Show First 20 Lines • Show All 856 Lines • ▼ Show 20 Lines	bool CStringChecker::IsFirstBufInBound(CheckerContext &C,

SVal LengthVal = state->getSVal(Size, LCtx);		SVal LengthVal = state->getSVal(Size, LCtx);
Optional<NonLoc> Length = LengthVal.getAs<NonLoc>();		Optional<NonLoc> Length = LengthVal.getAs<NonLoc>();
if (!Length)		if (!Length)
return true; // cf top comment.		return true; // cf top comment.

// Compute the offset of the last element to be accessed: size-1.		// Compute the offset of the last element to be accessed: size-1.
NonLoc One = svalBuilder.makeIntVal(1, sizeTy).castAs<NonLoc>();		NonLoc One = svalBuilder.makeIntVal(1, sizeTy).castAs<NonLoc>();
NonLoc LastOffset =		SVal Offset = svalBuilder.evalBinOpNN(state, BO_Sub, *Length, One, sizeTy);
svalBuilder.evalBinOpNN(state, BO_Sub, *Length, One, sizeTy)		if (Offset.isUnknown())
.castAs<NonLoc>();		return true; // cf top comment
		NonLoc LastOffset = Offset.castAs<NonLoc>();

// Check that the first buffer is sufficiently long.		// Check that the first buffer is sufficiently long.
SVal BufStart = svalBuilder.evalCast(BufVal, PtrTy, FirstBuf->getType());		SVal BufStart = svalBuilder.evalCast(BufVal, PtrTy, FirstBuf->getType());
Optional<Loc> BufLoc = BufStart.getAs<Loc>();		Optional<Loc> BufLoc = BufStart.getAs<Loc>();
if (!BufLoc)		if (!BufLoc)
return true; // cf top comment.		return true; // cf top comment.

SVal BufEnd =		SVal BufEnd =
▲ Show 20 Lines • Show All 991 Lines • Show Last 20 Lines