[analyzer] CERT STR rule checkers: STR32-C

[Charusso]

Summary

This patch introduces a new experimental checker:
alpha.security.cert.str.32c

This checker is implemented based on the following rule:
https://wiki.sei.cmu.edu/confluence/display/c/STR32-C.+Do+not+pass+a+non-null-terminated+character+sequence+to+a+library+function+that+expects+a+string

It warns on reading non-null-terminated strings. This warning is restricted to
the allocations which the Static Analyzer models with unix.Malloc checker.

Also warns on misusing the strncpy() function.

[Charusso]

clang/lib/StaticAnalyzer/Checkers/cert/StrChecker.cpp

430

This is a huge assumption to make this checker as simple as possible. On each allocation I would store the memory regions which the size expression consists of. When we encounter a memory/string handler function call which has a size-expression parameter we could match whether the allocation considered the length of the string it will store.

May we will have a better idea, so I would leave that as it is, for now.

[Charusso]

Examples generated by CodeChecker from the curl project:

str32-c.tar.gz1 MBDownload

[Charusso]

• Add docs.
• Move to alpha.

[Charusso]

• Add notes to the initialization of char-arrays.
• Mark the string null-terminated calling strcpy() with an appropriate size.

[Charusso]

We need to add the interestingness to the NoteTags so that we only emit notes on initialization/function calls which leads to an error.

[Charusso]

clang/lib/StaticAnalyzer/Checkers/cert/StrChecker.cpp

479

-1 line

[Charusso]

• Rebase.

[Charusso]

• Refactor.
• State out explicitly whether the Analyzer models the dynamic size.

[baloghadamsoftware]

clang/docs/analyzer/checkers.rst

1926

Why? Is retrieving the size of arrays is so much more difficult? We miss the first example of the rule this way.

clang/lib/StaticAnalyzer/Checkers/cert/StrChecker.cpp

179

Why do we need this? The constructor of PathSensitiveBugReport takes a StringRef. Msg.str() returns a StringRef. Your solution creates a C++ string first, which means an unnecessary copy.

322

Do we really need to handle indirect pointers here? I means e.g. char ***?

331

What does it mean that the memory allocation could overflow?

334

Why checking PostCall and not PreCall? Usually PostCall is used for modeling and PreCall for checking because for modeling we need the call already evaluated (e.g. we need the return value) but checking should happen before starting the evaluation of the call.

346

Do we chack any call here passing non-null terminated strings? I disagree with that appraocah because there may be functions expecting e.g. binary data. It seems that we are not even checking the type so we could get false positives here for any mem...() function.

clang/test/Analysis/cert/str32-c.cpp

11

Please move this to the system header simulator instead of repeating it in every test file.

14

Why enum?

clang/docs/analyzer/checkers.rst

 alpha.security.cert.str.31c
 """""""""""""""""""""""""""
 
 SEI CERT checker of `STR31-C rule<https://wiki.sei.cmu.edu/confluence/display/c/STR31-C.+Guarantee+that+storage+for+strings+has+sufficient+space+for+character+data+and+the+null+terminator>`_.
 
 It warns on misusing the following functions:
 ``strcpy()``, ``gets()``, ``fscanf()``, ``sprintf()``.
 
+.. _alpha-security-cert-str-32c:
+
+alpha.security.cert.str.32c
+"""""""""""""""""""""""""""
+
+SEI CERT checker of `STR32-C rule<https://wiki.sei.cmu.edu/confluence/display/c/STR32-C.+Do+not+pass+a+non-null-terminated+character+sequence+to+a+library+function+that+expects+a+string>`_.
+
+It warns on reading non-null-terminated strings. This warning is restricted to
+the allocations which the Static Analyzer models with :ref:`unix.Malloc<unix-Malloc>`_.
+
+Also warns on misusing the ``strncpy()`` function.
+
 .. _alpha-security-ArrayBound:
 
 alpha.security.ArrayBound (C)
 """""""""""""""""""""""""""""
 Warn about buffer overflows (older checker).
 
 .. code-block:: c
 

clang/include/clang/StaticAnalyzer/Checkers/Checkers.td

def StrCheckerBase : Checker<"StrCheckerBase">,
   Documentation<HasDocumentation>,
   Hidden;
 
 def Str31cChecker : Checker<"31c">,
   HelpText<"SEI CERT checker of rules defined in STR31-C">,
   Dependencies<[StrCheckerBase]>,
   Documentation<HasDocumentation>;
 
+def Str32cChecker : Checker<"32c">,
+  HelpText<"SEI CERT checker of rules defined in STR32-C">,
+  Dependencies<[StrCheckerBase]>,
+  Documentation<HasDocumentation>;
+
 } // end "alpha.cert.str"
 
 let ParentPackage = SecurityAlpha in {
 
 def ArrayBoundChecker : Checker<"ArrayBound">,
   HelpText<"Warn about buffer overflows (older checker)">,
   Documentation<HasAlphaDocumentation>;
 

clang/include/clang/StaticAnalyzer/Core/PathSensitive/DynamicSize.h

 //===- DynamicSize.h - Dynamic size related APIs ----------------*- C++ -*-===//
 //
 // Part of the LLVM Project, under the Apache License v2.0 with LLVM Exceptions.
 // See https://llvm.org/LICENSE.txt for license information.
 // SPDX-License-Identifier: Apache-2.0 WITH LLVM-exception
 //
 //===----------------------------------------------------------------------===//
 //
 //  This file defines APIs that track and query dynamic size information.
 //
 //===----------------------------------------------------------------------===//
 
 #ifndef LLVM_CLANG_STATICANALYZER_CORE_PATHSENSITIVE_DYNAMICSIZE_H
 #define LLVM_CLANG_STATICANALYZER_CORE_PATHSENSITIVE_DYNAMICSIZE_H
 
+#include "clang/StaticAnalyzer/Core/PathSensitive/DynamicSizeInfo.h"
 #include "clang/StaticAnalyzer/Core/PathSensitive/MemRegion.h"
 #include "clang/StaticAnalyzer/Core/PathSensitive/ProgramState.h"
 #include "clang/StaticAnalyzer/Core/PathSensitive/ProgramStateTrait.h"
 #include "clang/StaticAnalyzer/Core/PathSensitive/ProgramState_Fwd.h"
 #include "clang/StaticAnalyzer/Core/PathSensitive/SValBuilder.h"
+#include "llvm/ADT/Optional.h"
 
 namespace clang {
 namespace ento {
 
 /// \returns The stored dynamic size for the region \p MR.
 DefinedOrUnknownSVal getDynamicSize(ProgramStateRef State, const MemRegion *MR,
                                     SValBuilder &SVB);
 
+/// \returns The stored dynamic size information or the array's static size
+/// information for the region \p MR.
+Optional<DynamicSizeInfo> getDynamicSizeInfo(ProgramStateRef State,
+                                             const MemRegion *MR,
+                                             SValBuilder &SVB);
+
 /// \returns The stored dynamic size expression for the region \p MR.
 const Expr *getDynamicSizeExpr(ProgramStateRef State, const MemRegion *MR);
 
 /// \returns The stored element count of the region \p MR.
 DefinedOrUnknownSVal getDynamicElementCount(ProgramStateRef State,
                                             const MemRegion *MR,
                                             SValBuilder &SVB,
                                             QualType ElementTy);

clang/lib/StaticAnalyzer/Checkers/cert/StrChecker.cpp

 //  handler function issues.
 //  The rules can be found in section 'Rule 07. Characters and Strings (STR)':
 //  https://wiki.sei.cmu.edu/confluence/pages/viewpage.action?pageId=87152038
 //
 //  This checker is a base checker which consist of the following checkers:
 //  - '31c'
 //  https://wiki.sei.cmu.edu/confluence/display/c/STR31-C.+Guarantee+that+storage+for+strings+has+sufficient+space+for+character+data+and+the+null+terminator
 //
+//  - '32c'
+//  https://wiki.sei.cmu.edu/confluence/display/c/STR32-C.+Do+not+pass+a+non-null-terminated+character+sequence+to+a+library+function+that+expects+a+string
+//
 //===----------------------------------------------------------------------===//
 
 #include "AllocationState.h"
 #include "clang/ASTMatchers/ASTMatchFinder.h"
 #include "clang/Lex/Lexer.h"
 #include "clang/StaticAnalyzer/Checkers/BuiltinCheckerRegistration.h"
 #include "clang/StaticAnalyzer/Core/BugReporter/BugType.h"
 #include "clang/StaticAnalyzer/Core/Checker.h"
 #include "clang/StaticAnalyzer/Core/CheckerManager.h"
 #include "clang/StaticAnalyzer/Core/PathSensitive/CallEvent.h"
 #include "clang/StaticAnalyzer/Core/PathSensitive/CheckerContext.h"
 #include "clang/StaticAnalyzer/Core/PathSensitive/DynamicSize.h"
 #include "clang/StaticAnalyzer/Core/PathSensitive/SValHasDescendant.h"
 #include "llvm/ADT/Optional.h"
 #include <utility>
 
 using namespace clang;
 using namespace ento;
 using namespace ast_matchers;
 
 namespace {
 
 struct CallContext {
   CallContext(Optional<unsigned> DestinationPos,
-              Optional<unsigned> SourcePos = None)
-      : DestinationPos(DestinationPos), SourcePos(SourcePos) {}
+              Optional<unsigned> SourcePos = None,
+              Optional<unsigned> LengthPos = None)
+      : DestinationPos(DestinationPos), SourcePos(SourcePos),
+        LengthPos(LengthPos) {}
 
   Optional<unsigned> DestinationPos;
   Optional<unsigned> SourcePos;
+  Optional<unsigned> LengthPos;
 };
 
-class StrCheckerBase : public Checker<check::PostCall, check::Bind> {
+class StrCheckerBase
+    : public Checker<check::PostCall, check::Bind, check::PostStmt<DeclStmt>> {
   using StrCheck = std::function<void(const StrCheckerBase *, const CallEvent &,
                                       const CallContext &, CheckerContext &)>;
 
 public:
   // We report a note when any of the calls in 'CDM' is being used because
   // they can cause a not null-terminated string. In this case we store the
   // string is being not null-terminated in the 'NullTerminationMap'.
   //
   // We report an error when the not null-terminated string is passed to a
   // function call. Assume that the non-'CDM' calls could read the string.
   void checkPostCall(const CallEvent &Call, CheckerContext &C) const;
 
   // We want to catch the hand-written null-termination of strings to prevent
   // false positives. For example: 'c_string[length] = '\0';'. In this case we
   // store the string is being null-terminated in the 'NullTerminationMap'.
   void checkBind(SVal L, SVal V, const Stmt *S, CheckerContext &C) const;
 
+  void checkPostStmt(const DeclStmt *S, CheckerContext &C) const;
+
   void checkGets(const CallEvent &Call, const CallContext &CallC,
                  CheckerContext &C) const;
   void checkSprintf(const CallEvent &Call, const CallContext &CallC,
                     CheckerContext &C) const;
   void checkFscanf(const CallEvent &Call, const CallContext &CallC,
                    CheckerContext &C) const;
   void checkStrcpy(const CallEvent &Call, const CallContext &CallC,
                    CheckerContext &C) const;
+  void checkStrncpy(const CallEvent &Call, const CallContext &CallC,
+                    CheckerContext &C) const;
 
   void createOverflowReport(const CallEvent &Call, const CallContext &CallC,
                             CheckerContext &C) const;
 
   std::unique_ptr<BugType> BT;
   bool WarnOnCall;
-  bool EnableStr31cChecker = false;
+
+  bool EnableStr31cChecker = false, EnableStr32cChecker = false;
 
 private:
   const CallDescriptionMap<std::pair<StrCheck, CallContext>> CDM = {
       // The following checks STR31-C rules.
       // char *gets(char *dest);
       {{"gets", 1}, {&StrCheckerBase::checkGets, {0}}},
       // int sprintf(char *dest, const char *format, ... [const char *source]);
       {{"sprintf", 3, 2}, {&StrCheckerBase::checkSprintf, {0}}},
       // int fscanf(FILE *stream, const char *format, ... [char *dest]);
       {{"fscanf", 3, 2}, {&StrCheckerBase::checkFscanf, {2}}},
       // char *strcpy(char *dest, const char *src);
-      {{"strcpy", 2}, {&StrCheckerBase::checkStrcpy, {0, 1}}}};
+      {{"strcpy", 2}, {&StrCheckerBase::checkStrcpy, {0, 1}}},
+
+      // The following checks STR32-C rules.
+      // char *strncpy(char *dest, const char *src, size_t count)
+      {{"strncpy", 3}, {&StrCheckerBase::checkStrncpy, {0, 1, 2}}}};
 };
 } // namespace
 
 // It stores whether the string is null-terminated.
 REGISTER_MAP_WITH_PROGRAMSTATE(NullTerminationMap, const MemRegion *, bool)
 
+// It stores the allocations which we emit notes on.
+REGISTER_LIST_WITH_PROGRAMSTATE(AllocationList, const MemRegion *)
+
 //===----------------------------------------------------------------------===//
 // Helper functions.
 //===----------------------------------------------------------------------===//
 
 // Returns a string representation of \p E.
 static std::string exprToStr(const Expr *E, CheckerContext &C) {
   assert(E);
 
void StrCheckerBase::createOverflowReport(const CallEvent &Call,
   SVal DestV = Call.getArgSVal(DestPos);
   const MemRegion *MR = getRegion(DestV);
   if (!MR)
     return;
 
   ProgramStateRef State = C.getState();
 
   std::string CallName = Call.getCalleeIdentifier()->getName();
-  Optional<std::string> ArrayName = getName(Call.getArgExpr(DestPos), C);
+  std::string ArrayName = "the array";
+  if (Optional<std::string> TmpArrayName = getName(Call.getArgExpr(DestPos), C))
+    ArrayName = *TmpArrayName;
 
   SmallString<128> Msg;
   llvm::raw_svector_ostream Out(Msg);
-  Out << '\'' << CallName << "' could write outside of "
-      << (ArrayName ? *ArrayName : "the array");
+  Out << '\'' << CallName << "' could write outside of " << ArrayName;
   std::string ReportMsg = Out.str();
 
-  if (WarnOnCall) {
+  if (WarnOnCall && !EnableStr32cChecker) {
     const Expr *Arg = Call.getArgExpr(DestPos);
 
     auto Report = std::make_unique<PathSensitiveBugReport>(
         *BT, ReportMsg, C.generateErrorNode());
     Report->addRange(Arg->getSourceRange());
 
     // Track the allocation.
     const auto *VR = MR->getAs<VarRegion>();
void StrCheckerBase::createOverflowReport(const CallEvent &Call,
   const NoteTag *Tag = C.getNoteTag([=]() -> std::string { return ReportMsg; },
                                     /*IsPrunable=*/false);
 
   // Mark the string could be not null-terminated.
   State = State->set<NullTerminationMap>(MR, false);
   C.addTransition(State, Tag);
 }
 
+void createWrongSizeReport(const MemRegion *MR, Optional<std::string> ArrayName,
+                           bool IsAlloc, ProgramStateRef State,
+                           CheckerContext &C) {
+  const NoteTag *Tag = C.getNoteTag(
+      [=]() -> std::string {
+        SmallString<128> Msg;
+        llvm::raw_svector_ostream Out(Msg);
+        Out << (ArrayName ? ('\'' + *ArrayName + '\'') : "The array") << " is "
+            << (IsAlloc ? "allocated" : "initialized")
+            << " without considering the length of the string it "
+               "will store, therefore it could overflow";
+
+        return Out.str();
+      },
+      /*IsPrunable=*/false);
+
+  // Mark the string could be not null-terminated.
+  State = State->set<NullTerminationMap>(MR, false);
+  State = State->add<AllocationList>(MR);
+  C.addTransition(State, C.getPredecessor(), Tag);
+}
+
+static bool isWrongAllocation(SVal DestV, SVal SrcV, CheckerContext &C) {
+  ProgramStateRef State = C.getState();
+  SValBuilder &SVB = C.getSValBuilder();
+
+  // Check the size of the allocation to prevent false alarms.
+  const MemRegion *SrcMR = getRegion(SrcV);
+  const MemRegion *DestMR = getRegion(DestV);
+  if (!SrcMR || !DestMR)
+    return false;
+
+  DefinedOrUnknownSVal SrcSize = getDynamicSize(State, SrcMR, SVB);
+  DefinedOrUnknownSVal DestSize = getDynamicSize(State, DestMR, SVB);
+
+  // 'strlen(src) + integer' is most likely fine.
+  // FIXME: We cannot catch every '+ integer' part at the moment so we do not
+  // check that property for now.
+  SValHasDescendant HasDescendantSrc(SrcMR);
+  if (HasDescendantSrc.Visit(DestSize))
+    return false;
+
+  if (const MemRegion *DestSizeR = DestSize.getAsRegion())
+    if (DestSizeR == SrcMR)
+      return false;
+
+  // 'StringRegion' returns the size with the null-terminator.
+  if (const llvm::APSInt *SrcSizeInt = SVB.getKnownValue(State, SrcSize))
+    if (const llvm::APSInt *DestSizeInt = SVB.getKnownValue(State, DestSize))
+      if (SrcSizeInt->getZExtValue() <= DestSizeInt->getZExtValue())
+        return false;
+
+  return true;
+}
+
+static bool isWrongAllocation(const CallEvent &Call, const CallContext &CallC,
+                              CheckerContext &C) {
+  SVal DestV = Call.getArgSVal(*CallC.DestinationPos);
+  SVal SrcV = Call.getArgSVal(*CallC.SourcePos);
+  return isWrongAllocation(DestV, SrcV, C);
+}
+
 //===----------------------------------------------------------------------===//
 // Evaluating problematic function calls.
 //===----------------------------------------------------------------------===//
 
 void StrCheckerBase::checkGets(const CallEvent &Call, const CallContext &CallC,
                                CheckerContext &C) const {
   if (EnableStr31cChecker)
     createOverflowReport(Call, CallC, C);

 }
 
 void StrCheckerBase::checkStrcpy(const CallEvent &Call,
                                  const CallContext &CallC,
                                  CheckerContext &C) const {
   if (!EnableStr31cChecker)
     return;
 
+  if (isWrongAllocation(Call, CallC, C)) {
+    createOverflowReport(Call, CallC, C);
+  } else {
+    // Mark the string null-terminated.
     ProgramStateRef State = C.getState();
-  SValBuilder &SVB = C.getSValBuilder();
-  SVal SrcV = Call.getArgSVal(*CallC.SourcePos);
-  SVal DestV = Call.getArgSVal(*CallC.DestinationPos);
-
-  // Check the size of the allocation to prevent false alarms.
-  const MemRegion *SrcMR = getRegion(SrcV);
-  const MemRegion *DestMR = getRegion(DestV);
-  if (!SrcMR || !DestMR)
-    return;
-
-  DefinedOrUnknownSVal SrcSize = getDynamicSize(State, SrcMR, SVB);
-  DefinedOrUnknownSVal DestSize = getDynamicSize(State, DestMR, SVB);
-
-  // 'strlen(src) + integer' is most likely fine.
-  // FIXME: We cannot catch every '+ integer' part at the moment so we do not
-  // check that property for now.
-  SValHasDescendant HasDescendantSrc(SrcMR);
-  if (HasDescendantSrc.Visit(DestSize))
-    return;
-
-  // 'StringRegion' returns the size with the null-terminator.
-  if (const llvm::APSInt *SrcSizeInt = SVB.getKnownValue(State, SrcSize))
-    if (const llvm::APSInt *DestSizeInt = SVB.getKnownValue(State, DestSize))
-      if (SrcSizeInt->getZExtValue() <= DestSizeInt->getZExtValue())
-        return;
+    State = State->set<NullTerminationMap>(
+        getRegion(Call.getArgSVal(*CallC.DestinationPos)), true);
+    C.addTransition(State);
+  }
+}
 
+void StrCheckerBase::checkStrncpy(const CallEvent &Call,
+                                  const CallContext &CallC,
+                                  CheckerContext &C) const {
+  if (EnableStr32cChecker)
     createOverflowReport(Call, CallC, C);
 }
 
 //===----------------------------------------------------------------------===//
 // Main logic to check a call.
 //===----------------------------------------------------------------------===//
 
 void StrCheckerBase::checkPostCall(const CallEvent &Call,
                                    CheckerContext &C) const {
   if (const auto *Lookup = CDM.lookup(Call)) {
     const StrCheck &Check = Lookup->first;
     Check(this, Call, Lookup->second, C);
     return;
   }
 
   // If we do not model the call and the given passed parameter is a string
   // which is not null-terminated see if the string is read to emit a report.
   // We assume that the string is read when it is passed to a function call
   // as const-qualified.
   for (unsigned I = 0; I < Call.parameters().size(); ++I) {
     SVal V = Call.getArgSVal(I);
     const MemRegion *MR = getRegion(V);
     if (!MR)
       continue;
 
     QualType ParamTy = Call.parameters()[I]->getType();
     if (ParamTy->isPointerType())
       ParamTy = ParamTy->getPointeeType();
for (unsigned I = 0; I < Call.parameters().size(); ++I) {
     } else if (const SymbolRef Sym = Call.getArgSVal(I).getAsSymbol()) {
       Report->addVisitor(allocation_state::getMallocBRVisitor(Sym));
     }
 
     C.emitReport(std::move(Report));
   }
 }
 
-void StrCheckerBase::checkBind(SVal L, SVal V, const Stmt *S,
-                               CheckerContext &C) const {
+static bool checkAllocation(SVal L, SVal V, const Stmt *S, CheckerContext &C,
+                            BugType &BT) {
+  const MemRegion *LocMR = getRegion(L);
+  const MemRegion *NonLocMR = getRegion(V);
+  if (!LocMR || !NonLocMR)
+    return false;
+
+  // A C-string is null-terminated.
+  if (isa<StringRegion>(NonLocMR))
+    return false;
+
+  // Only check for character allocations.
+  QualType Ty;
+  const auto *LocTVR = LocMR->getAs<TypedValueRegion>();
+  if (!LocTVR)
+    return false;
+
+  Ty = LocTVR->getValueType();
+  if (Ty.isNull())
+    return false;
+
+  if (Ty->isPointerType())
+    Ty = Ty->getPointeeType();
+
+  if (!Ty->isAnyCharacterType())
+    return false;
+
+  // See whether we have made a report so it prevent reports on rebindings.
   ProgramStateRef State = C.getState();
+  if (State->get<AllocationList>().contains(NonLocMR))
+    return false;
 
-  // Check for a hand-written null-termination, e.g: 'c_string[length] = '\0';'.
-  const MemRegion *MR = getRegion(L);
-  if (!MR)
+  // Check for allocations we model.
+  Optional<DynamicSizeInfo> SizeInfo =
+      getDynamicSizeInfo(State, NonLocMR, C.getSValBuilder());
+  if (!SizeInfo)
+    return false;
+
+  if (const auto *NonLocTVR = NonLocMR->getAs<TypedValueRegion>()) {
+    QualType Ty = NonLocTVR->getLocationType();
+    if (Ty->isPointerType())
+      Ty = Ty->getPointeeType();
+
+    if (Ty->getAsArrayTypeUnsafe())
+      return false;
+  }
+
+  // 'strlen(something) + something' is most likely fine.
+  // FIXME: Use the 'SValVisitor' to catch every such constructs of the symbol.
+  if (const SymExpr *SizeSym = SizeInfo->getSize().getAsSymExpr())
+    for (const SymExpr *Sym : SizeSym->symbols())
+      if (const auto *SIE = dyn_cast<SymIntExpr>(Sym))
+        if (SIE->getOpcode() == BO_Add)
+          if (const auto *SM = dyn_cast<SymbolMetadata>(SIE->getLHS()))
+            return true;
+
+  Optional<std::string> ArrayName;
+  if (const auto *VR = LocMR->getAs<VarRegion>())
+    if (const VarDecl *VD = VR->getDecl())
+      ArrayName = VD->getNameAsString();
+
+  createWrongSizeReport(NonLocMR, ArrayName, /*IsAlloc=*/true, State, C);
+  return true;
+}
+
+void StrCheckerBase::checkBind(SVal L, SVal V, const Stmt *S,
+                               CheckerContext &C) const {
+  if (EnableStr32cChecker)
+    if (checkAllocation(L, V, S, C, *BT))
       return;
 
+  ProgramStateRef State = C.getState();
   bool IsNullTermination = false;
   if (const llvm::APInt *Int = C.getSValBuilder().getKnownValue(State, V))
     IsNullTermination = Int->isNullValue();
 
   if (!IsNullTermination)
     return;
 
   // Mark the string null-terminated.
-  State = State->set<NullTerminationMap>(MR, true);
+  State = State->set<NullTerminationMap>(getRegion(L), true);
   C.addTransition(State);
 }
 
+void StrCheckerBase::checkPostStmt(const DeclStmt *S, CheckerContext &C) const {
+  if (const auto *VD = cast<VarDecl>(S->getSingleDecl())) {
+    if (VD->getType()->getAsArrayTypeUnsafe()) {
+      VD->dumpColor();
+      ProgramStateRef State = C.getState();
+
+      const VarRegion *VR = State->getRegion(VD, C.getLocationContext());
+
+      std::string ArrayName = VD->getNameAsString();
+      createWrongSizeReport(VR, ArrayName, /*IsAlloc=*/false, State, C);
+    }
+  }
+}
+
 void ento::registerStrCheckerBase(CheckerManager &Mgr) {
   auto *Checker = Mgr.registerChecker<StrCheckerBase>();
 
   Checker->WarnOnCall =
       Mgr.getAnalyzerOptions().getCheckerBooleanOption(Checker, "WarnOnCall");
 
   Checker->BT = std::make_unique<BugType>(
       Mgr.getCurrentCheckerName(), "Insecure string handler function call",
       categories::SecurityError);
 }
 
 bool ento::shouldRegisterStrCheckerBase(const LangOptions &) { return true; }
 
 #define REGISTER_CHECKER(Name)                                                 \
   void ento::register##Name(CheckerManager &Mgr) {                             \
     auto *Checker = Mgr.getChecker<StrCheckerBase>();                          \
     Checker->Enable##Name = true;                                              \
   }                                                                            \
                                                                                \
   bool ento::shouldRegister##Name(const LangOptions &LO) { return true; }
 
 REGISTER_CHECKER(Str31cChecker)
+REGISTER_CHECKER(Str32cChecker)

clang/lib/StaticAnalyzer/Core/DynamicSize.cpp

 DefinedOrUnknownSVal getDynamicSize(ProgramStateRef State, const MemRegion *MR,
                                     SValBuilder &SVB) {
   if (const DynamicSizeInfo *SizeInfo = State->get<DynamicSizeMap>(MR))
     return SizeInfo->getSize();
 
   return MR->getMemRegionManager().getStaticSize(MR, SVB);
 }
 
+Optional<DynamicSizeInfo> getDynamicSizeInfo(ProgramStateRef State,
+                                             const MemRegion *MR,
+                                             SValBuilder &SVB) {
+  if (const DynamicSizeInfo *SizeInfo = State->get<DynamicSizeMap>(MR))
+    return *SizeInfo;
+
+  if (const auto *TVR = MR->getAs<TypedValueRegion>())
+    if (TVR->getValueType()->getAsArrayTypeUnsafe())
+      return DynamicSizeInfo(MR->getMemRegionManager().getStaticSize(MR, SVB));
+
+  return None;
+}
+
 const Expr *getDynamicSizeExpr(ProgramStateRef State, const MemRegion *MR) {
   if (const DynamicSizeInfo *SizeInfo = State->get<DynamicSizeMap>(MR))
     return SizeInfo->getSizeExpr();
 
   return nullptr;
 }
 
 DefinedOrUnknownSVal getDynamicElementCount(ProgramStateRef State,

clang/test/Analysis/Inputs/system-header-simulator.h

 int fscanf(FILE *stream, const char *format, ...);
 int fscanf_s(FILE *stream, const char *format, ...);
 char *getenv(const char *varname);
 
 // Note, on some platforms errno macro gets replaced with a function call.
 extern int errno;
 typedef int errno_t;
 
-size_t strlen(const char *);
+void *memcpy(void *dest, const void *src, size_t count);
+
+size_t strlen(const char *str);
 char *strcpy(char *dest, const char *src);
 errno_t strcpy_s(char *dest, size_t destSize, const char *src);
 char *strncpy(char *dest, const char *src, size_t count);
 
-void *memcpy(void *dest, const void *src, size_t count);
+// Without -fms-compatibility, wchar_t isn't a builtin type. MSVC defines
+// _WCHAR_T_DEFINED if wchar_t is available. Microsoft recommends that you use
+// the builtin type: "Using the typedef version can cause portability
+// problems", but we're ok here because we're not actually running anything.
+// Also of note is this cryptic warning: "The wchar_t type is not supported
+// when you compile C code".
+//
+// See the docs for more:
+// https://msdn.microsoft.com/en-us/library/dh8che7s.aspx
+#if !defined(_WCHAR_T_DEFINED) && !__cplusplus
+// "Microsoft implements wchar_t as a two-byte unsigned value"
+typedef unsigned short wchar_t;
+#define _WCHAR_T_DEFINED
+#endif
+
+size_t wcslen(const wchar_t *str);
 
 typedef unsigned long __darwin_pthread_key_t;
 typedef __darwin_pthread_key_t pthread_key_t;
 int pthread_setspecific(pthread_key_t, const void *);
 
 typedef long long __int64_t;
 typedef __int64_t __darwin_off_t;
 typedef __darwin_off_t fpos_t;

clang/test/Analysis/cert/str31-c-notes-warn-on-call-off.cpp

void test_size_redefinition() {
   // expected-warning@-1 {{'p' is not null-terminated}}
   // expected-note@-2 {{'p' is not null-terminated}}
 
   free(p);
 }
 
 void test_using_before_terminating(const char *src) {
   char dest[128];
-  // expected-note@-1 {{'dest' initialized here}}
+  // expected-note@-1 {{'dest' is initialized without considering the length of the string it will store, therefore it could overflow}}
+  // expected-note@-2 {{'dest' initialized here}}
 
   strcpy(dest, src);
   // expected-note@-1 {{'strcpy' could write outside of 'dest'}}
   *dest = '\0';
 
   strcpy(dest, src);
   // expected-note@-1 {{'strcpy' could write outside of 'dest'}}
 
   do_something(dest);
   // expected-warning@-1 {{'dest' is not null-terminated}}
   // expected-note@-2 {{'dest' is not null-terminated}}
   *dest = '\0';
 
   do_something(dest);
 }

clang/test/Analysis/cert/str31-c-notes-warn-on-call-on.cpp

void test_size_redefinition() {
   }
 
   char *p = buf;
   free(p);
 }
 
 void test_using_before_terminating(const char *src) {
   char dest[128];
-  // expected-note@-1 {{'dest' initialized here}}
+  // expected-note@-1 {{'dest' is initialized without considering the length of the string it will store, therefore it could overflow}}
+  // expected-note@-2 {{'dest' initialized here}}
 
   strcpy(dest, src);
   // expected-note@-1 {{'strcpy' could write outside of 'dest'}}
   // expected-warning@-2 {{'strcpy' could write outside of 'dest'}}
   *dest = '\0';
 
   strcpy(dest, src);
   do_something(dest);
   *dest = '\0';
 
   do_something(dest);
 }

clang/test/Analysis/cert/str32-c-notes.cpp

+// RUN: %clang_analyze_cc1 \
+// RUN:  -analyzer-checker=core,unix,alpha.security.cert.str.32c \
+// RUN:  -analyzer-output=text -verify %s
+
+// See the examples on the page of STR32-C:
+// https://wiki.sei.cmu.edu/confluence/display/c/STR32-C.+Do+not+pass+a+non-null-terminated+character+sequence+to+a+library+function+that+expects+a+string
+
+#include "../Inputs/system-header-simulator.h"
+
+void *realloc(void *memblock, size_t size);
+
+namespace test_strncpy_bad {
+enum { STR_SIZE = 32 };
+
+size_t func(const char *source) {
+  char c_str[STR_SIZE];
+  // expected-note@-1 {{'c_str' is initialized without considering the length of the string it will store, therefore it could overflow}}
+  // expected-note@-2 {{'c_str' initialized here}}
+
+  size_t ret = 0;
+
+  if (source) {
+    // expected-note@-1 {{Assuming 'source' is non-null}}
+    // expected-note@-2 {{Taking true branch}}
+
+    c_str[sizeof(c_str) - 1] = '\0';
+    strncpy(c_str, source, sizeof(c_str));
+    // expected-note@-1 {{'strncpy' could write outside of 'c_str'}}
+
+    ret = strlen(c_str);
+    // expected-note@-1 {{'c_str' is not null-terminated}}
+    // expected-warning@-2 {{'c_str' is not null-terminated}}
+  }
+  return ret;
+}
+} // namespace test_strncpy_bad
+
+namespace test_realloc_bad {
+size_t cur_msg_size = 1024;
+size_t cur_msg_len = 0;
+
+void lessen_memory_usage(wchar_t *cur_msg) {
+  if (cur_msg == NULL) {
+    // expected-note@-1 {{Assuming 'cur_msg' is not equal to NULL}}
+    // expected-note@-2 {{Taking false branch}}
+    return;
+  }
+
+  size_t temp_size = cur_msg_size / 2 + 1;
+  wchar_t temp[256];
+  // expected-note@-1 {{'temp' is initialized without considering the length of the string it will store, therefore it could overflow}}
+  // expected-note@-2 {{'temp' initialized here}}
+
+  /* temp and cur_msg may no longer be null-terminated */
+
+  cur_msg = temp;
+  // expected-note@-1 {{Value assigned to 'cur_msg'}}
+
+  cur_msg_size = temp_size;
+  cur_msg_len = wcslen(cur_msg);
+  // expected-note@-1 {{'cur_msg' is not null-terminated}}
+  // expected-warning@-2 {{'cur_msg' is not null-terminated}}
+}
+} // namespace test_realloc_bad

clang/test/Analysis/cert/str32-c.cpp

+// RUN: %clang_analyze_cc1 \
+// RUN:  -analyzer-checker=core,unix,alpha.security.cert.str.32c \
+// RUN:  -verify %s
+
+// See the examples on the page of STR32-C:
+// https://wiki.sei.cmu.edu/confluence/display/c/STR32-C.+Do+not+pass+a+non-null-terminated+character+sequence+to+a+library+function+that+expects+a+string
+
+#include "../Inputs/system-header-simulator.h"
+
+void *realloc(void *memblock, size_t size);
+
+namespace test_strncpy_bad {
+enum { STR_SIZE = 32 };
+
+size_t func(const char *source) {
+  char c_str[STR_SIZE];
+  size_t ret = 0;
+
+  if (source) {
+    c_str[sizeof(c_str) - 1] = '\0';
+    strncpy(c_str, source, sizeof(c_str));
+    ret = strlen(c_str);
+    // expected-warning@-1 {{'c_str' is not null-terminated}}
+  }
+  return ret;
+}
+} // namespace test_strncpy_bad
+
+namespace test_strncpy_good {
+enum { STR_SIZE = 32 };
+
+size_t func(const char *src) {
+  char c_str[STR_SIZE];
+  size_t ret = 0;
+
+  if (src) {
+    strncpy(c_str, src, sizeof(c_str) - 1);
+    c_str[sizeof(c_str) - 1] = '\0';
+    ret = strlen(c_str);
+  }
+  return ret;
+}
+} // namespace test_strncpy_good
+
+namespace test_realloc_bad {
+wchar_t *cur_msg = NULL;
+size_t cur_msg_size = 1024;
+size_t cur_msg_len = 0;
+
+void lessen_memory_usage(void) {
+  if (cur_msg == NULL)
+    return;
+
+  size_t temp_size = cur_msg_size / 2 + 1;
+  wchar_t *temp = (wchar_t *)realloc(cur_msg, temp_size * sizeof(wchar_t));
+  /* temp and cur_msg may no longer be null-terminated */
+  if (temp == NULL)
+    return;
+
+  cur_msg = temp;
+  cur_msg_size = temp_size;
+  cur_msg_len = wcslen(cur_msg);
+  // expected-warning@-1 {{'cur_msg' is not null-terminated}}
+}
+} // namespace test_realloc_bad
+
+namespace test_realloc_good {
+wchar_t *cur_msg = NULL;
+size_t cur_msg_size = 1024;
+size_t cur_msg_len = 0;
+
+void lessen_memory_usage(void) {
+  if (cur_msg == NULL)
+    return;
+
+  size_t temp_size = cur_msg_size / 2 + 1;
+  wchar_t *temp = (wchar_t *)realloc(cur_msg, temp_size * sizeof(wchar_t));
+  /* temp and cur_msg may no longer be null-terminated */
+  if (temp == NULL)
+    return;
+
+  cur_msg = temp;
+  /* Properly null-terminate cur_msg */
+  cur_msg[temp_size - 1] = L'\0';
+  cur_msg_size = temp_size;
+  cur_msg_len = wcslen(cur_msg);
+}
+} // namespace test_realloc_good

clang/test/Analysis/malloc.c

 // RUN: %clang_analyze_cc1 -analyzer-store=region -verify %s \
 // RUN:   -analyzer-checker=core \
 // RUN:   -analyzer-checker=alpha.deadcode.UnreachableCode \
 // RUN:   -analyzer-checker=alpha.core.CastSize \
 // RUN:   -analyzer-checker=unix.Malloc \
 // RUN:   -analyzer-checker=debug.ExprInspection
 
 #include "Inputs/system-header-simulator.h"
 
 void clang_analyzer_eval(int);
 
-// Without -fms-compatibility, wchar_t isn't a builtin type. MSVC defines
-// _WCHAR_T_DEFINED if wchar_t is available. Microsoft recommends that you use
-// the builtin type: "Using the typedef version can cause portability
-// problems", but we're ok here because we're not actually running anything.
-// Also of note is this cryptic warning: "The wchar_t type is not supported
-// when you compile C code".
-//
-// See the docs for more:
-// https://msdn.microsoft.com/en-us/library/dh8che7s.aspx
-#if !defined(_WCHAR_T_DEFINED)
-// "Microsoft implements wchar_t as a two-byte unsigned value"
-typedef unsigned short wchar_t;
-#define _WCHAR_T_DEFINED
-#endif // !defined(_WCHAR_T_DEFINED)
-
 typedef __typeof(sizeof(int)) size_t;
 void *malloc(size_t);
 void *alloca(size_t);
 void *valloc(size_t);
 void free(void *);
 void *realloc(void *ptr, size_t size);
 void *reallocf(void *ptr, size_t size);
 void *calloc(size_t nmemb, size_t size);