QualType TypeContext::getPointerType(QualType ref) { assert(ref.isValid()); for (unsigned i=0; i<types.size(); i++) { Type* t = types[i]; if (isa<PointerType>(t)) { PointerType* P = cast<PointerType>(t); if (P->getPointeeType() == ref) return t; } } Type* N = new PointerType(ref); if (ref->hasCanonicalType()) N->setCanonicalType(N); return add(N); }
void CastToStructChecker::PreVisitCastExpr(CheckerContext &C, const CastExpr *CE) { const Expr *E = CE->getSubExpr(); ASTContext &Ctx = C.getASTContext(); QualType OrigTy = Ctx.getCanonicalType(E->getType()); QualType ToTy = Ctx.getCanonicalType(CE->getType()); PointerType *OrigPTy = dyn_cast<PointerType>(OrigTy.getTypePtr()); PointerType *ToPTy = dyn_cast<PointerType>(ToTy.getTypePtr()); if (!ToPTy || !OrigPTy) return; QualType OrigPointeeTy = OrigPTy->getPointeeType(); QualType ToPointeeTy = ToPTy->getPointeeType(); if (!ToPointeeTy->isStructureOrClassType()) return; // We allow cast from void*. if (OrigPointeeTy->isVoidType()) return; // Now the cast-to-type is struct pointer, the original type is not void*. if (!OrigPointeeTy->isRecordType()) { if (ExplodedNode *N = C.GenerateNode()) { if (!BT) BT = new BuiltinBug("Cast from non-struct type to struct type", "Casting a non-structure type to a structure type " "and accessing a field can lead to memory access " "errors or data corruption."); RangedBugReport *R = new RangedBugReport(*BT,BT->getDescription(), N); R->addRange(CE->getSourceRange()); C.EmitReport(R); } } }
void CastSizeChecker::PreVisitCastExpr(CheckerContext &C, const CastExpr *CE) { const Expr *E = CE->getSubExpr(); ASTContext &Ctx = C.getASTContext(); QualType ToTy = Ctx.getCanonicalType(CE->getType()); PointerType *ToPTy = dyn_cast<PointerType>(ToTy.getTypePtr()); if (!ToPTy) return; QualType ToPointeeTy = ToPTy->getPointeeType(); const GRState *state = C.getState(); const MemRegion *R = state->getSVal(E).getAsRegion(); if (R == 0) return; const SymbolicRegion *SR = dyn_cast<SymbolicRegion>(R); if (SR == 0) return; ValueManager &ValMgr = C.getValueManager(); SVal Extent = SR->getExtent(ValMgr); SValuator &SVator = ValMgr.getSValuator(); const llvm::APSInt *ExtentInt = SVator.getKnownValue(state, Extent); if (!ExtentInt) return; CharUnits RegionSize = CharUnits::fromQuantity(ExtentInt->getSExtValue()); CharUnits TypeSize = C.getASTContext().getTypeSizeInChars(ToPointeeTy); // Ignore void, and a few other un-sizeable types. if (TypeSize.isZero()) return; if (RegionSize % TypeSize != 0) { if (ExplodedNode *N = C.GenerateSink()) { if (!BT) BT = new BuiltinBug("Cast region with wrong size.", "Cast a region whose size is not a multiple of the" " destination type size."); RangedBugReport *R = new RangedBugReport(*BT, BT->getDescription(), N); R->addRange(CE->getSourceRange()); C.EmitReport(R); } } }