[analyzer] Apply clang-format to GenericTaintChecker.cpp

[boga95]

Summary

I would like to add some patch for this checker later and I found that it isn't well formatted.

[gerazo]

Looks correct clang-format to me.

[boga95]

If you find it ok, can you please commit it? @xazax.hun

[Szelethus]

Please don't mind me intruding.
If you create a patch for the Clang Static Analyzer, please add "[analyzer]" in the revision title, because many of us are automatically subscribed to those patches. Also, upload patches with full context.
https://llvm.org/docs/Phabricator.html#requesting-a-review-via-the-web-interface

I see the point here, and I think it'd be worth to just clang-format most of the files we work with, as the benefits would outweigh the drawbacks (at least eventually...), but I vaguely remember @george.karpenkov having many great points against it -- please don't commit until he can take a look :)

[Szelethus]

Hmm, actually, if you're doing changes all over the file in the followup patches, it shouldn't matter much. Let's just wait a couple days for ppl to object, now that they are subscribed.

[NoQ]

I appreciate the cleanup in general and any work on taint analysis in particular, thanks!

In D54918#1332089, @Szelethus wrote:

I vaguely remember @george.karpenkov having many great points against it -- please don't commit until he can take a look :)

Essentially, it messes with git blame, and also causes a lot of merge conflicts for downstream developers (we have a few of those). But if you plan to work on this checker actively anyway, please feel free to start with formatting.

Here's the relevant quote from the guidelines:

Our long term goal is for the entire codebase to follow the convention, but we explicitly *do not* want patches that do large-scale reformatting of existing code. On the other hand, it is reasonable to rename the methods of a class if you’re about to change it in some other way. Just do the reformatting as a separate commit from the functionality change.

[Szelethus]

@boga95 Do you have commit access, or need this to be commited on your behalf?

[boga95]

I don't have commit access. Can you please do it on my behalf?

lib/StaticAnalyzer/Checkers/GenericTaintChecker.cpp

 #include "clang/StaticAnalyzer/Core/PathSensitive/CheckerContext.h"
 #include "clang/StaticAnalyzer/Core/PathSensitive/ProgramStateTrait.h"
 #include <climits>
 
 using namespace clang;
 using namespace ento;
 
 namespace {
-class GenericTaintChecker : public Checker< check::PostStmt<CallExpr>,
-                                            check::PreStmt<CallExpr> > {
+class GenericTaintChecker
+    : public Checker<check::PostStmt<CallExpr>, check::PreStmt<CallExpr>> {
 public:
-  static void *getTag() { static int Tag; return &Tag; }
+  static void *getTag() {
+    static int Tag;
+    return &Tag;
+  }
 
   void checkPostStmt(const CallExpr *CE, CheckerContext &C) const;
 
   void checkPreStmt(const CallExpr *CE, CheckerContext &C) const;
 
 private:
   static const unsigned InvalidArgIndex = UINT_MAX;
   /// Denotes the return vale.
private:
   /// Check if the region the expression evaluates to is the standard input,
   /// and thus, is tainted.
   static bool isStdin(const Expr *E, CheckerContext &C);
 
   /// Given a pointer argument, return the value it points to.
   static Optional<SVal> getPointedToSVal(CheckerContext &C, const Expr *Arg);
 
   /// Functions defining the attack surface.
-  typedef ProgramStateRef (GenericTaintChecker::*FnCheck)(const CallExpr *,
-                                                       CheckerContext &C) const;
+  typedef ProgramStateRef (GenericTaintChecker::*FnCheck)(
+      const CallExpr *, CheckerContext &C) const;
   ProgramStateRef postScanf(const CallExpr *CE, CheckerContext &C) const;
   ProgramStateRef postSocket(const CallExpr *CE, CheckerContext &C) const;
   ProgramStateRef postRetTaint(const CallExpr *CE, CheckerContext &C) const;
 
   /// Taint the scanned input if the file is tainted.
   ProgramStateRef preFscanf(const CallExpr *CE, CheckerContext &C) const;
 
   /// Check for CWE-134: Uncontrolled Format String.
struct TaintPropagationRule {
     /// List of arguments which can be taint sources and should be checked.
     ArgVector SrcArgs;
     /// List of arguments which should be tainted on function return.
     ArgVector DstArgs;
     // TODO: Check if using other data structures would be more optimal.
 
     TaintPropagationRule() {}
 
-    TaintPropagationRule(unsigned SArg,
-                         unsigned DArg, bool TaintRet = false) {
+    TaintPropagationRule(unsigned SArg, unsigned DArg, bool TaintRet = false) {
       SrcArgs.push_back(SArg);
       DstArgs.push_back(DArg);
       if (TaintRet)
         DstArgs.push_back(ReturnValueIndex);
     }
 
-    TaintPropagationRule(unsigned SArg1, unsigned SArg2,
-                         unsigned DArg, bool TaintRet = false) {
+    TaintPropagationRule(unsigned SArg1, unsigned SArg2, unsigned DArg,
+                         bool TaintRet = false) {
       SrcArgs.push_back(SArg1);
       SrcArgs.push_back(SArg2);
       DstArgs.push_back(DArg);
       if (TaintRet)
         DstArgs.push_back(ReturnValueIndex);
     }
 
     /// Get the propagation rule for a given function.
     static TaintPropagationRule
-      getTaintPropagationRule(const FunctionDecl *FDecl,
-                              StringRef Name,
-                              CheckerContext &C);
+    getTaintPropagationRule(const FunctionDecl *FDecl, StringRef Name,
 
     inline void addSrcArg(unsigned A) { SrcArgs.push_back(A); }
-    inline void addDstArg(unsigned A)  { DstArgs.push_back(A); }
+    inline void addDstArg(unsigned A) { DstArgs.push_back(A); }
 
     inline bool isNull() const { return SrcArgs.empty(); }
 
     inline bool isDestinationArgument(unsigned ArgNum) const {
-      return (std::find(DstArgs.begin(),
-                        DstArgs.end(), ArgNum) != DstArgs.end());
+      return (std::find(DstArgs.begin(), DstArgs.end(), ArgNum) !=
+              DstArgs.end());
     }
 
     static inline bool isTaintedOrPointsToTainted(const Expr *E,
                                                   ProgramStateRef State,
                                                   CheckerContext &C) {
       if (State->isTainted(E, C.getLocationContext()) || isStdin(E, C))
         return true;
 
       if (!E->getType().getTypePtr()->isPointerType())
         return false;
 
       Optional<SVal> V = getPointedToSVal(C, E);
       return (V && State->isTainted(*V));
     }
 
     /// Pre-process a function which propagates taint according to the
     /// taint rule.
     ProgramStateRef process(const CallExpr *CE, CheckerContext &C) const;
-
   };
 };
 
 const unsigned GenericTaintChecker::ReturnValueIndex;
 const unsigned GenericTaintChecker::InvalidArgIndex;
 
 const char GenericTaintChecker::MsgUncontrolledFormatString[] =
     "Untrusted data is used as a format string "
     "(CWE-134: Uncontrolled Format String)";
 
 const char GenericTaintChecker::MsgSanitizeSystemArgs[] =
     "Untrusted data is passed to a system call "
     "(CERT/STR02-C. Sanitize data passed to complex subsystems)";
 
 const char GenericTaintChecker::MsgTaintedBufferSize[] =
     "Untrusted data is used to specify the buffer size "
-  "(CERT/STR31-C. Guarantee that storage for strings has sufficient space for "
+    "(CERT/STR31-C. Guarantee that storage for strings has sufficient space "
+    "for "
     "character data and the null terminator)";
 
 } // end of anonymous namespace
 
 /// A set which is used to pass information from call pre-visit instruction
 /// to the call post-visit. The values are unsigned integers, which are either
 /// ReturnValueIndex, or indexes of the pointer/reference argument, which
 /// points to data, which should be tainted on return.
 REGISTER_SET_WITH_PROGRAMSTATE(TaintArgsOnPostVisit, unsigned)
 
 GenericTaintChecker::TaintPropagationRule
 GenericTaintChecker::TaintPropagationRule::getTaintPropagationRule(
-                                                     const FunctionDecl *FDecl,
-                                                     StringRef Name,
-                                                     CheckerContext &C) {
+    const FunctionDecl *FDecl, StringRef Name, CheckerContext &C) {
   // TODO: Currently, we might lose precision here: we always mark a return
   // value as tainted even if it's just a pointer, pointing to tainted data.
 
   // Check for exact name match for functions without builtin substitutes.
-  TaintPropagationRule Rule = llvm::StringSwitch<TaintPropagationRule>(Name)
+  TaintPropagationRule Rule =
+      llvm::StringSwitch<TaintPropagationRule>(Name)
           .Case("atoi", TaintPropagationRule(0, ReturnValueIndex))
           .Case("atol", TaintPropagationRule(0, ReturnValueIndex))
           .Case("atoll", TaintPropagationRule(0, ReturnValueIndex))
           .Case("getc", TaintPropagationRule(0, ReturnValueIndex))
           .Case("fgetc", TaintPropagationRule(0, ReturnValueIndex))
           .Case("getc_unlocked", TaintPropagationRule(0, ReturnValueIndex))
           .Case("getw", TaintPropagationRule(0, ReturnValueIndex))
           .Case("toupper", TaintPropagationRule(0, ReturnValueIndex))
           .Case("tolower", TaintPropagationRule(0, ReturnValueIndex))
           .Case("strchr", TaintPropagationRule(0, ReturnValueIndex))
           .Case("strrchr", TaintPropagationRule(0, ReturnValueIndex))
           .Case("read", TaintPropagationRule(0, 2, 1, true))
           .Case("pread", TaintPropagationRule(InvalidArgIndex, 1, true))
           .Case("gets", TaintPropagationRule(InvalidArgIndex, 0, true))
           .Case("fgets", TaintPropagationRule(2, 0, true))
           .Case("getline", TaintPropagationRule(2, 0))
           .Case("getdelim", TaintPropagationRule(3, 0))
           .Case("fgetln", TaintPropagationRule(0, ReturnValueIndex))
           .Default(TaintPropagationRule());
 
   if (!Rule.isNull())
     return Rule;
 
   // Check if it's one of the memory setting/copying functions.
   // This check is specialized but faster then calling isCLibraryFunction.
   unsigned BId = 0;
-  if ( (BId = FDecl->getMemoryFunctionKind()) )
-    switch(BId) {
+  if ((BId = FDecl->getMemoryFunctionKind()))
+    switch (BId) {
     case Builtin::BImemcpy:
     case Builtin::BImemmove:
     case Builtin::BIstrncpy:
     case Builtin::BIstrncat:
       return TaintPropagationRule(1, 2, 0, true);
     case Builtin::BIstrlcpy:
     case Builtin::BIstrlcat:
       return TaintPropagationRule(1, 2, 0, false);
if (!FDecl || FDecl->getKind() != Decl::Function)
     return;
 
   StringRef Name = C.getCalleeName(FDecl);
   if (Name.empty())
     return;
 
   // First, try generating a propagation rule for this function.
   TaintPropagationRule Rule =
       TaintPropagationRule::getTaintPropagationRule(FDecl, Name, C);
   if (!Rule.isNull()) {
     State = Rule.process(CE, C);
     if (!State)
       return;
     C.addTransition(State);
     return;
   }
 
   // Otherwise, check if we have custom pre-processing implemented.
   FnCheck evalFunction = llvm::StringSwitch<FnCheck>(Name)
                              .Case("fscanf", &GenericTaintChecker::preFscanf)
                              .Default(nullptr);
   // Check and evaluate the call.
   if (evalFunction)
     State = (this->*evalFunction)(CE, C);
   if (!State)
     return;
   C.addTransition(State);
-
 }
 
 bool GenericTaintChecker::propagateFromPre(const CallExpr *CE,
                                            CheckerContext &C) const {
   ProgramStateRef State = C.getState();
 
   // Depending on what was tainted at pre-visit, we determined a set of
   // arguments which should be tainted after the function returns. These are
   // stored in the state as TaintArgsOnPostVisit set.
   TaintArgsOnPostVisitTy TaintArgs = State->get<TaintArgsOnPostVisit>();
   if (TaintArgs.isEmpty())
     return false;
 
-  for (llvm::ImmutableSet<unsigned>::iterator
-         I = TaintArgs.begin(), E = TaintArgs.end(); I != E; ++I) {
-    unsigned ArgNum  = *I;
+  for (llvm::ImmutableSet<unsigned>::iterator I = TaintArgs.begin(),
+                                              E = TaintArgs.end();
+       I != E; ++I) {
+    unsigned ArgNum = *I;
 
     // Special handling for the tainted return value.
     if (ArgNum == ReturnValueIndex) {
       State = State->addTaint(CE, C.getLocationContext());
       continue;
     }
 
     // The arguments are pointer arguments. The data they are pointing at is
     // tainted after the call.
     if (CE->getNumArgs() < (ArgNum + 1))
       return false;
-    const Expr* Arg = CE->getArg(ArgNum);
+    const Expr *Arg = CE->getArg(ArgNum);
     Optional<SVal> V = getPointedToSVal(C, Arg);
     if (V)
       State = State->addTaint(*V);
   }
 
   // Clear up the taint info from the state.
   State = State->remove<TaintArgsOnPostVisit>();
 
void GenericTaintChecker::addSourcesPost(const CallExpr *CE,
   // Set the evaluation function by switching on the callee name.
   const FunctionDecl *FDecl = C.getCalleeDecl(CE);
   if (!FDecl || FDecl->getKind() != Decl::Function)
     return;
 
   StringRef Name = C.getCalleeName(FDecl);
   if (Name.empty())
     return;
-  FnCheck evalFunction = llvm::StringSwitch<FnCheck>(Name)
+  FnCheck evalFunction =
+      llvm::StringSwitch<FnCheck>(Name)
           .Case("scanf", &GenericTaintChecker::postScanf)
           // TODO: Add support for vfscanf & family.
           .Case("getchar", &GenericTaintChecker::postRetTaint)
           .Case("getchar_unlocked", &GenericTaintChecker::postRetTaint)
           .Case("getenv", &GenericTaintChecker::postRetTaint)
           .Case("fopen", &GenericTaintChecker::postRetTaint)
           .Case("fdopen", &GenericTaintChecker::postRetTaint)
           .Case("freopen", &GenericTaintChecker::postRetTaint)
           .Case("getch", &GenericTaintChecker::postRetTaint)
           .Case("wgetch", &GenericTaintChecker::postRetTaint)
           .Case("socket", &GenericTaintChecker::postSocket)
           .Default(nullptr);
 
   // If the callee isn't defined, it is not of security concern.
   // Check and evaluate the call.
   ProgramStateRef State = nullptr;
   if (evalFunction)
     State = (this->*evalFunction)(CE, C);
   if (!State)
     return;
 
   C.addTransition(State);
 }
 
-bool GenericTaintChecker::checkPre(const CallExpr *CE, CheckerContext &C) const{
+bool GenericTaintChecker::checkPre(const CallExpr *CE,
+                                   CheckerContext &C) const {
 
   if (checkUncontrolledFormatString(CE, C))
     return true;
 
   const FunctionDecl *FDecl = C.getCalleeDecl(CE);
   if (!FDecl || FDecl->getKind() != Decl::Function)
     return false;
 

 
 ProgramStateRef
 GenericTaintChecker::TaintPropagationRule::process(const CallExpr *CE,
                                                    CheckerContext &C) const {
   ProgramStateRef State = C.getState();
 
   // Check for taint in arguments.
   bool IsTainted = false;
-  for (ArgVector::const_iterator I = SrcArgs.begin(),
-                                 E = SrcArgs.end(); I != E; ++I) {
+  for (ArgVector::const_iterator I = SrcArgs.begin(), E = SrcArgs.end(); I != E;
+       ++I) {
     unsigned ArgNum = *I;
 
     if (ArgNum == InvalidArgIndex) {
       // Check if any of the arguments is tainted, but skip the
       // destination arguments.
       for (unsigned int i = 0; i < CE->getNumArgs(); ++i) {
         if (isDestinationArgument(i))
           continue;
         if ((IsTainted = isTaintedOrPointsToTainted(CE->getArg(i), State, C)))
           break;
       }
       break;
     }
 
     if (CE->getNumArgs() < (ArgNum + 1))
       return State;
     if ((IsTainted = isTaintedOrPointsToTainted(CE->getArg(ArgNum), State, C)))
       break;
   }
   if (!IsTainted)
     return State;
 
   // Mark the arguments which should be tainted after the function returns.
-  for (ArgVector::const_iterator I = DstArgs.begin(),
-                                 E = DstArgs.end(); I != E; ++I) {
+  for (ArgVector::const_iterator I = DstArgs.begin(), E = DstArgs.end(); I != E;
+       ++I) {
     unsigned ArgNum = *I;
 
     // Should we mark all arguments as tainted?
     if (ArgNum == InvalidArgIndex) {
       // For all pointer and references that were passed in:
       //   If they are not pointing to const data, mark data as tainted.
       //   TODO: So far we are just going one level down; ideally we'd need to
       //         recurse here.
       for (unsigned int i = 0; i < CE->getNumArgs(); ++i) {
         const Expr *Arg = CE->getArg(i);
         // Process pointer argument.
         const Type *ArgTy = Arg->getType().getTypePtr();
         QualType PType = ArgTy->getPointeeType();
-        if ((!PType.isNull() && !PType.isConstQualified())
-            || (ArgTy->isReferenceType() && !Arg->getType().isConstQualified()))
+        if ((!PType.isNull() && !PType.isConstQualified()) ||
+            (ArgTy->isReferenceType() && !Arg->getType().isConstQualified()))
           State = State->add<TaintArgsOnPostVisit>(i);
       }
       continue;
     }
 
     // Should mark the return value?
     if (ArgNum == ReturnValueIndex) {
       State = State->add<TaintArgsOnPostVisit>(ReturnValueIndex);
       continue;
     }
 
     // Mark the given argument.
     assert(ArgNum < CE->getNumArgs());
     State = State->add<TaintArgsOnPostVisit>(ArgNum);
   }
 
   return State;
 }
 
-
 // If argument 0 (file descriptor) is tainted, all arguments except for arg 0
 // and arg 1 should get taint.
 ProgramStateRef GenericTaintChecker::preFscanf(const CallExpr *CE,
-                                                   CheckerContext &C) const {
   assert(CE->getNumArgs() >= 2);
   ProgramStateRef State = C.getState();
 
   // Check is the file descriptor is tainted.
   if (State->isTainted(CE->getArg(0), C.getLocationContext()) ||
       isStdin(CE->getArg(0), C)) {
     // All arguments except for the first two should get taint.
     for (unsigned int i = 2; i < CE->getNumArgs(); ++i)
-        State = State->add<TaintArgsOnPostVisit>(i);
     return State;
   }
 
   return nullptr;
 }
 
-
 // If argument 0(protocol domain) is network, the return value should get taint.
 ProgramStateRef GenericTaintChecker::postSocket(const CallExpr *CE,
                                                 CheckerContext &C) const {
   ProgramStateRef State = C.getState();
   if (CE->getNumArgs() < 3)
     return State;
 
   SourceLocation DomLoc = CE->getArg(0)->getExprLoc();
   StringRef DomName = C.getMacroNameOrSpelling(DomLoc);
   // White list the internal communication protocols.
   if (DomName.equals("AF_SYSTEM") || DomName.equals("AF_LOCAL") ||
       DomName.equals("AF_UNIX") || DomName.equals("AF_RESERVED_36"))
     return State;
   State = State->addTaint(CE, C.getLocationContext());
   return State;
 }
 
 ProgramStateRef GenericTaintChecker::postScanf(const CallExpr *CE,
-                                                   CheckerContext &C) const {
   ProgramStateRef State = C.getState();
   if (CE->getNumArgs() < 2)
     return State;
 
   // All arguments except for the very first one should get taint.
   for (unsigned int i = 1; i < CE->getNumArgs(); ++i) {
     // The arguments are pointer arguments. The data they are pointing at is
     // tainted after the call.
-    const Expr* Arg = CE->getArg(i);
+    const Expr *Arg = CE->getArg(i);
     Optional<SVal> V = getPointedToSVal(C, Arg);
     if (V)
       State = State->addTaint(*V);
   }
   return State;
 }
 
 ProgramStateRef GenericTaintChecker::postRetTaint(const CallExpr *CE,
bool GenericTaintChecker::isStdin(const Expr *E, CheckerContext &C) {
   const MemRegion *MemReg = Val.getAsRegion();
 
   // The region should be symbolic, we do not know it's value.
   const SymbolicRegion *SymReg = dyn_cast_or_null<SymbolicRegion>(MemReg);
   if (!SymReg)
     return false;
 
   // Get it's symbol and find the declaration region it's pointing to.
-  const SymbolRegionValue *Sm =dyn_cast<SymbolRegionValue>(SymReg->getSymbol());
+  const SymbolRegionValue *Sm =
+      dyn_cast<SymbolRegionValue>(SymReg->getSymbol());
   if (!Sm)
     return false;
   const DeclRegion *DeclReg = dyn_cast_or_null<DeclRegion>(Sm->getRegion());
   if (!DeclReg)
     return false;
 
   // This region corresponds to a declaration, find out if it's a global/extern
   // variable named stdin with the proper type.
   if (const VarDecl *D = dyn_cast_or_null<VarDecl>(DeclReg->getDecl())) {
     D = D->getCanonicalDecl();
     if ((D->getName().find("stdin") != StringRef::npos) && D->isExternC())
-        if (const PointerType * PtrTy =
+      if (const PointerType *PtrTy =
               dyn_cast<PointerType>(D->getType().getTypePtr()))
-          if (PtrTy->getPointeeType().getCanonicalType() ==
-              C.getASTContext().getFILEType().getCanonicalType())
-            return true;
   }
   return false;
 }
 
 static bool getPrintfFormatArgumentNum(const CallExpr *CE,
                                        const CheckerContext &C,
                                        unsigned int &ArgNum) {
   // Find if the function contains a format string argument.
   // Handles: fprintf, printf, sprintf, snprintf, vfprintf, vprintf, vsprintf,
   // vsnprintf, syslog, custom annotated functions.
   const FunctionDecl *FDecl = C.getCalleeDecl(CE);
   if (!FDecl)
     return false;
   for (const auto *Format : FDecl->specific_attrs<FormatAttr>()) {
     ArgNum = Format->getFormatIdx() - 1;
-    if ((Format->getType()->getName() == "printf") &&
-         CE->getNumArgs() > ArgNum)
+    if ((Format->getType()->getName() == "printf") && CE->getNumArgs() > ArgNum)
       return true;
   }
 
   // Or if a function is named setproctitle (this is a heuristic).
   if (C.getCalleeName(CE).find("setproctitle") != StringRef::npos) {
     ArgNum = 0;
     return true;
   }
if (ExplodedNode *N = C.generateNonFatalErrorNode()) {
     report->addRange(E->getSourceRange());
     report->addVisitor(llvm::make_unique<TaintBugVisitor>(TaintedSVal));
     C.emitReport(std::move(report));
     return true;
   }
   return false;
 }
 
-bool GenericTaintChecker::checkUncontrolledFormatString(const CallExpr *CE,
-                                                        CheckerContext &C) const{
+bool GenericTaintChecker::checkUncontrolledFormatString(
+    const CallExpr *CE, CheckerContext &C) const {
   // Check if the function contains a format string argument.
   unsigned int ArgNum = 0;
   if (!getPrintfFormatArgumentNum(CE, C, ArgNum))
     return false;
 
-  // If either the format string content or the pointer itself are tainted, warn.
+  // If either the format string content or the pointer itself are tainted,
+  // warn.
   return generateReportIfTainted(CE->getArg(ArgNum),
                                  MsgUncontrolledFormatString, C);
 }
 
-bool GenericTaintChecker::checkSystemCall(const CallExpr *CE,
-                                          StringRef Name,
+bool GenericTaintChecker::checkSystemCall(const CallExpr *CE, StringRef Name,
                                           CheckerContext &C) const {
   // TODO: It might make sense to run this check on demand. In some cases,
   // we should check if the environment has been cleansed here. We also might
   // need to know if the user was reset before these calls(seteuid).
   unsigned ArgNum = llvm::StringSwitch<unsigned>(Name)
                         .Case("system", 0)
                         .Case("popen", 0)
                         .Case("execl", 0)
                         .Case("execle", 0)
                         .Case("execlp", 0)
                         .Case("execv", 0)
                         .Case("execvp", 0)
                         .Case("execvP", 0)
                         .Case("execve", 0)
                         .Case("dlopen", 0)
                         .Default(UINT_MAX);
 
   if (ArgNum == UINT_MAX || CE->getNumArgs() < (ArgNum + 1))
     return false;
 
   return generateReportIfTainted(CE->getArg(ArgNum), MsgSanitizeSystemArgs, C);
 }
 
 // TODO: Should this check be a part of the CString checker?
 // If yes, should taint be a global setting?
 bool GenericTaintChecker::checkTaintedBufferSize(const CallExpr *CE,
                                                  const FunctionDecl *FDecl,
                                                  CheckerContext &C) const {
   // If the function has a buffer size argument, set ArgNum.
   unsigned ArgNum = InvalidArgIndex;
   unsigned BId = 0;
-  if ( (BId = FDecl->getMemoryFunctionKind()) )
-    switch(BId) {
+  if ((BId = FDecl->getMemoryFunctionKind()))
+    switch (BId) {
     case Builtin::BImemcpy:
     case Builtin::BImemmove:
     case Builtin::BIstrncpy:
       ArgNum = 2;
       break;
     case Builtin::BIstrndup:
       ArgNum = 1;
       break;