1//===--- UndefinedNewArraySizeChecker.cpp -----------------------*- C++ -*--==//
2//
3// Part of the LLVM Project, under the Apache License v2.0 with LLVM Exceptions.
4// See https://llvm.org/LICENSE.txt for license information.
5// SPDX-License-Identifier: Apache-2.0 WITH LLVM-exception
6//
7//===----------------------------------------------------------------------===//
8//
9// This defines UndefinedNewArraySizeChecker, a builtin check in ExprEngine
10// that checks if the size of the array in a new[] expression is undefined.
11//
12//===----------------------------------------------------------------------===//
13
14#include "clang/StaticAnalyzer/Checkers/BuiltinCheckerRegistration.h"
15#include "clang/StaticAnalyzer/Core/BugReporter/BugType.h"
16#include "clang/StaticAnalyzer/Core/Checker.h"
17#include "clang/StaticAnalyzer/Core/CheckerManager.h"
18#include "clang/StaticAnalyzer/Core/PathSensitive/CallEvent.h"
19#include "clang/StaticAnalyzer/Core/PathSensitive/CheckerContext.h"
20
21using namespace clang;
22using namespace ento;
23
24namespace {
25class UndefinedNewArraySizeChecker : public Checker<check::PreCall> {
26
27private:
28 BugType BT{this, "Undefined array element count in new[]",
29 categories::LogicError};
30
31public:
32 void checkPreCall(const CallEvent &Call, CheckerContext &C) const;
33 void HandleUndefinedArrayElementCount(CheckerContext &C, SVal ArgVal,
34 const Expr *Init,
35 SourceRange Range) const;
36};
37} // namespace
38
39void UndefinedNewArraySizeChecker::checkPreCall(const CallEvent &Call,
40 CheckerContext &C) const {
41 if (const auto *AC = dyn_cast<CXXAllocatorCall>(Val: &Call)) {
42 if (!AC->isArray())
43 return;
44
45 auto *SizeEx = *AC->getArraySizeExpr();
46 auto SizeVal = AC->getArraySizeVal();
47
48 if (SizeVal.isUndef())
49 HandleUndefinedArrayElementCount(C, ArgVal: SizeVal, Init: SizeEx,
50 Range: SizeEx->getSourceRange());
51 }
52}
53
54void UndefinedNewArraySizeChecker::HandleUndefinedArrayElementCount(
55 CheckerContext &C, SVal ArgVal, const Expr *Init, SourceRange Range) const {
56
57 if (ExplodedNode *N = C.generateErrorNode()) {
58 auto R = std::make_unique<PathSensitiveBugReport>(
59 args: BT, args: "Element count in new[] is a garbage value", args&: N);
60 R->markInteresting(V: ArgVal);
61 R->addRange(R: Range);
62 bugreporter::trackExpressionValue(N, E: Init, R&: *R);
63
64 C.emitReport(R: std::move(R));
65 }
66}
67
68void ento::registerUndefinedNewArraySizeChecker(CheckerManager &mgr) {
69 mgr.registerChecker<UndefinedNewArraySizeChecker>();
70}
71
72bool ento::shouldRegisterUndefinedNewArraySizeChecker(
73 const CheckerManager &mgr) {
74 return mgr.getLangOpts().CPlusPlus;
75}
76