diff options
| -rw-r--r-- | clang/lib/StaticAnalyzer/Checkers/CStringChecker.cpp | 13 | ||||
| -rw-r--r-- | clang/test/Analysis/string.c | 11 |
2 files changed, 19 insertions, 5 deletions
diff --git a/clang/lib/StaticAnalyzer/Checkers/CStringChecker.cpp b/clang/lib/StaticAnalyzer/Checkers/CStringChecker.cpp index bd4033784ef..a906ee63afc 100644 --- a/clang/lib/StaticAnalyzer/Checkers/CStringChecker.cpp +++ b/clang/lib/StaticAnalyzer/Checkers/CStringChecker.cpp @@ -395,8 +395,10 @@ ProgramStateRef CStringChecker::CheckBufferAccess(CheckerContext &C, // Compute the offset of the last element to be accessed: size-1. NonLoc One = svalBuilder.makeIntVal(1, sizeTy).castAs<NonLoc>(); - NonLoc LastOffset = svalBuilder - .evalBinOpNN(state, BO_Sub, *Length, One, sizeTy).castAs<NonLoc>(); + SVal Offset = svalBuilder.evalBinOpNN(state, BO_Sub, *Length, One, sizeTy); + if (Offset.isUnknown()) + return nullptr; + NonLoc LastOffset = Offset.castAs<NonLoc>(); // Check that the first buffer is sufficiently long. SVal BufStart = svalBuilder.evalCast(BufVal, PtrTy, FirstBuf->getType()); @@ -862,9 +864,10 @@ bool CStringChecker::IsFirstBufInBound(CheckerContext &C, // Compute the offset of the last element to be accessed: size-1. NonLoc One = svalBuilder.makeIntVal(1, sizeTy).castAs<NonLoc>(); - NonLoc LastOffset = - svalBuilder.evalBinOpNN(state, BO_Sub, *Length, One, sizeTy) - .castAs<NonLoc>(); + SVal Offset = svalBuilder.evalBinOpNN(state, BO_Sub, *Length, One, sizeTy); + if (Offset.isUnknown()) + return true; // cf top comment + NonLoc LastOffset = Offset.castAs<NonLoc>(); // Check that the first buffer is sufficiently long. SVal BufStart = svalBuilder.evalCast(BufVal, PtrTy, FirstBuf->getType()); diff --git a/clang/test/Analysis/string.c b/clang/test/Analysis/string.c index 8ea2068c561..5bfa31e732d 100644 --- a/clang/test/Analysis/string.c +++ b/clang/test/Analysis/string.c @@ -30,6 +30,7 @@ typedef typeof(sizeof(int)) size_t; void clang_analyzer_eval(int); int scanf(const char *restrict format, ...); +void *memcpy(void *, const void *, unsigned long); //===----------------------------------------------------------------------=== // strlen() @@ -1173,6 +1174,7 @@ void strcat_symbolic_src_length(char *src) { clang_analyzer_eval(strlen(dst) >= 4); // expected-warning{{UNKNOWN}} } + // The analyzer_eval call below should evaluate to true. Most likely the same // issue as the test above. void strncpy_exactly_matching_buffer2(char *y) { @@ -1185,3 +1187,12 @@ void strncpy_exactly_matching_buffer2(char *y) { // This time, we know that y fits in x anyway. clang_analyzer_eval(strlen(x) <= 3); // expected-warning{{UNKNOWN}} } + +struct S { + char f; +}; + +void nocrash_on_locint_offset(void *addr, void* from, struct S s) { + int iAdd = (int) addr; + memcpy(((void *) &(s.f)), from, iAdd); +} |
