ziqingluo-90 updated this revision to Diff 480703.
ziqingluo-90 added a comment.
Addressing all the comments we have so far.
CHANGES SINCE LAST ACTION
https://reviews.llvm.org/D137379/new/
https://reviews.llvm.org/D137379
Files:
clang/include/clang/Analysis/Analyses/UnsafeBufferUsageGadgets.def
clang/lib/Analysis/UnsafeBufferUsage.cpp
clang/test/SemaCXX/warn-unsafe-buffer-usage.cpp
Index: clang/test/SemaCXX/warn-unsafe-buffer-usage.cpp
===================================================================
--- clang/test/SemaCXX/warn-unsafe-buffer-usage.cpp
+++ clang/test/SemaCXX/warn-unsafe-buffer-usage.cpp
@@ -6,3 +6,63 @@
--p; // expected-warning{{unchecked operation on raw buffer in expression}}
p--; // expected-warning{{unchecked operation on raw buffer in expression}}
}
+
+void foo(...); // let arguments of `foo` to hold testing expressions
+
+void * voidPtrCall(void);
+char * charPtrCall(void);
+
+void testArraySubscripts(int *p, int **pp) {
+ foo(p[0], // expected-warning{{unchecked operation on raw buffer in expression}}
+ pp[0][0], // expected-warning2{{unchecked operation on raw buffer in expression}}
+ 0[0[pp]], // expected-warning2{{unchecked operation on raw buffer in expression}}
+ 0[pp][0] // expected-warning2{{unchecked operation on raw buffer in expression}}
+ );
+
+ if (p[3]) { // expected-warning{{unchecked operation on raw buffer in expression}}
+ void * q = p;
+
+ foo(((int*)q)[10]); // expected-warning{{unchecked operation on raw buffer in expression}}
+ }
+
+ foo(((int*)voidPtrCall())[3], // expected-warning{{unchecked operation on raw buffer in expression}}
+ 3[(int*)voidPtrCall()], // expected-warning{{unchecked operation on raw buffer in expression}}
+ charPtrCall()[3], // expected-warning{{unchecked operation on raw buffer in expression}}
+ 3[charPtrCall()] // expected-warning{{unchecked operation on raw buffer in expression}}
+ );
+
+ int a[10], b[10][10];
+
+ // not to warn subscripts on arrays
+ foo(a[0], a[1],
+ 0[a], 1[a],
+ b[3][4],
+ 4[b][3],
+ 4[3[b]]);
+}
+
+void testArraySubscriptsWithAuto(int *p, int **pp) {
+ int a[10];
+
+ auto ap1 = a;
+
+ foo(ap1[0]); // expected-warning{{unchecked operation on raw buffer in expression}}
+
+ auto ap2 = p;
+
+ foo(ap2[0]); // expected-warning{{unchecked operation on raw buffer in expression}}
+
+ auto ap3 = pp;
+
+ foo(pp[0][0]); // expected-warning2{{unchecked operation on raw buffer in expression}}
+
+ auto ap4 = *pp;
+
+ foo(ap4[0]); // expected-warning{{unchecked operation on raw buffer in expression}}
+}
+
+void testUnevaluatedContext(int * p) {
+ //TODO: do not warn for unevaluated context
+ foo(sizeof(p[1]), // expected-warning{{unchecked operation on raw buffer in expression}}
+ sizeof(decltype(p[1]))); // expected-warning{{unchecked operation on raw buffer in expression}}
+}
Index: clang/lib/Analysis/UnsafeBufferUsage.cpp
===================================================================
--- clang/lib/Analysis/UnsafeBufferUsage.cpp
+++ clang/lib/Analysis/UnsafeBufferUsage.cpp
@@ -128,6 +128,32 @@
const UnaryOperator *getBaseStmt() const override { return Op; }
};
+
+/// Array subscript expressions on raw pointers as if they're arrays. Unsafe as
+/// it doesn't have any bounds checks for the array.
+class ArraySubscriptGadget : public UnsafeGadget {
+ static constexpr const char *const ArraySubscrTag = "arraySubscr";
+ const ArraySubscriptExpr *ASE;
+
+public:
+ ArraySubscriptGadget(const MatchFinder::MatchResult &Result)
+ : UnsafeGadget(Kind::ArraySubscript),
+ ASE(Result.Nodes.getNodeAs<ArraySubscriptExpr>(ArraySubscrTag)) {}
+
+ static bool classof(const Gadget *G) {
+ return G->getKind() == Kind::ArraySubscript;
+ }
+
+ static Matcher matcher() {
+ // FIXME: What if the index is integer literal 0? Should this be
+ // a safe gadget in this case?
+ return stmt(
+ arraySubscriptExpr(hasBase(ignoringParenImpCasts(hasPointerType())))
+ .bind(ArraySubscrTag));
+ }
+
+ const ArraySubscriptExpr *getBaseStmt() const override { return ASE; }
+};
} // namespace
// Scan the function and return a list of gadgets found with provided kits.
Index: clang/include/clang/Analysis/Analyses/UnsafeBufferUsageGadgets.def
===================================================================
--- clang/include/clang/Analysis/Analyses/UnsafeBufferUsageGadgets.def
+++ clang/include/clang/Analysis/Analyses/UnsafeBufferUsageGadgets.def
@@ -27,6 +27,7 @@
UNSAFE_GADGET(Increment)
UNSAFE_GADGET(Decrement)
+UNSAFE_GADGET(ArraySubscript)
#undef SAFE_GADGET
#undef UNSAFE_GADGET
_______________________________________________
cfe-commits mailing list
[email protected]
https://lists.llvm.org/cgi-bin/mailman/listinfo/cfe-commits
