diff --git a/clang/lib/StaticAnalyzer/Checkers/VLASizeChecker.cpp b/clang/lib/StaticAnalyzer/Checkers/VLASizeChecker.cpp --- a/clang/lib/StaticAnalyzer/Checkers/VLASizeChecker.cpp +++ b/clang/lib/StaticAnalyzer/Checkers/VLASizeChecker.cpp @@ -126,6 +126,11 @@ // Size overflow check does not work with symbolic expressions because a // overflow situation can not be detected easily. uint64_t IndexL = IndexLVal->getZExtValue(); + // constraints are not solved for expressions with multiple + // symbols, so just bail on invalid indices at this point. + if (IndexL <= 0) + return nullptr; + assert(IndexL > 0 && "Index length should have been checked for zero."); if (KnownSize <= SizeMax / IndexL) { KnownSize *= IndexL; diff --git a/clang/test/Analysis/vla.c b/clang/test/Analysis/vla.c --- a/clang/test/Analysis/vla.c +++ b/clang/test/Analysis/vla.c @@ -137,3 +137,17 @@ clang_analyzer_eval(clang_analyzer_getExtent(&vla3m) == 2 * x * 4 * sizeof(int)); // expected-warning@-1{{TRUE}} } + +// https://bugs.llvm.org/show_bug.cgi?id=46128 +// analyzer doesn't handle more than simple symmmmbolic expressions. +// Just don't crash. +extern void foo(void); +int a; +void b() { + int c = a + 1; + for (;;) { + int d[c]; + for (; 0 < c;) + foo(); + } +} // no-crash