diff options
| -rw-r--r-- | clang/lib/StaticAnalyzer/Core/ProgramState.cpp | 4 | ||||
| -rw-r--r-- | clang/test/Analysis/taint-tester.c | 7 |
2 files changed, 10 insertions, 1 deletions
diff --git a/clang/lib/StaticAnalyzer/Core/ProgramState.cpp b/clang/lib/StaticAnalyzer/Core/ProgramState.cpp index 3215c3ccd21..5b6b7339697 100644 --- a/clang/lib/StaticAnalyzer/Core/ProgramState.cpp +++ b/clang/lib/StaticAnalyzer/Core/ProgramState.cpp @@ -260,7 +260,9 @@ SVal ProgramState::getSVal(Loc location, QualType T) const { // be a constant value, use that value instead to lessen the burden // on later analysis stages (so we have less symbolic values to reason // about). - if (!T.isNull()) { + // We only go into this branch if we can convert the APSInt value we have + // to the type of T, which is not always the case (e.g. for void). + if (!T.isNull() && (T->isIntegralOrEnumerationType() || Loc::isLocType(T))) { if (SymbolRef sym = V.getAsSymbol()) { if (const llvm::APSInt *Int = getStateManager() .getConstraintManager() diff --git a/clang/test/Analysis/taint-tester.c b/clang/test/Analysis/taint-tester.c index 1b59e7bc8e9..3a8cc1825a0 100644 --- a/clang/test/Analysis/taint-tester.c +++ b/clang/test/Analysis/taint-tester.c @@ -189,3 +189,10 @@ void atoiTest() { } +char *pointer1; +void *pointer2; +void noCrashTest() { + if (!*pointer1) { + __builtin___memcpy_chk(pointer2, pointer1, 0, 0); // no-crash + } +} |
