This is an archive of the discontinued LLVM Phabricator instance.

[analyzer] Fix null deref in AnyFunctionCall::getRuntimeDefinition
ClosedPublic

Authored by r.stahl on Apr 12 2018, 5:14 AM.

Diff Detail

Event Timeline

r.stahl created this revision.Apr 12 2018, 5:14 AM

I encountered this with a construct like this:

struct S
{
    void (*fp)();
};

int main()
{
    struct S s;
    s.fp();
}

We encountered the same problem but did not have time yet to submit the patch. We have literally the same fix internally, so it looks good to me. One minor style nit inline.

Could you add your repro as a regression test? You can also extend existing CTU tests just make sure to trigger the crash before the patch.

Thank you for the submission and the minimal reproducer.

lib/StaticAnalyzer/Core/CallEvent.cpp
390

We usually do not write the braces for single statements.

r.stahl updated this revision to Diff 142381.Apr 13 2018, 5:17 AM
r.stahl edited the summary of this revision. (Show Details)

addressed review comments.

I created a new test because certain checkers would cause early exits in the engine (because of undefined func ptr) and not cause the crash.

Since I don't have commit access, please commit for me.

xazax.hun accepted this revision.Apr 13 2018, 5:33 AM
This revision is now accepted and ready to land.Apr 13 2018, 5:33 AM
This revision was automatically updated to reflect the committed changes.