Author: Malavika Samak Date: 2024-01-22T10:46:59-08:00 New Revision: 414df7051ac90f186fac9d3d8968aa827eceb697
URL: https://github.com/llvm/llvm-project/commit/414df7051ac90f186fac9d3d8968aa827eceb697 DIFF: https://github.com/llvm/llvm-project/commit/414df7051ac90f186fac9d3d8968aa827eceb697.diff LOG: [-Wunsafe-buffer-usage] Fix the crash introduced by the unsafe invocation of span::data warning (#78815) The patch fixes the crash introduced by the DataInvocation warning gadget designed to warn against unsafe invocations of span::data method. It also now considers the invocation of span::data method inside parenthesis. Radar: 121223051 --------- Co-authored-by: MalavikaSamak <malavi...@apple.com> Added: Modified: clang/lib/Analysis/UnsafeBufferUsage.cpp clang/lib/Sema/AnalysisBasedWarnings.cpp clang/test/SemaCXX/warn-unsafe-buffer-usage-warning-data-invocation.cpp Removed: ################################################################################ diff --git a/clang/lib/Analysis/UnsafeBufferUsage.cpp b/clang/lib/Analysis/UnsafeBufferUsage.cpp index 724c4304a072420..7df706beb22662c 100644 --- a/clang/lib/Analysis/UnsafeBufferUsage.cpp +++ b/clang/lib/Analysis/UnsafeBufferUsage.cpp @@ -739,9 +739,10 @@ class DataInvocationGadget : public WarningGadget { } static Matcher matcher() { + Matcher callExpr = cxxMemberCallExpr( + callee(cxxMethodDecl(hasName("data"), ofClass(hasName("std::span"))))); return stmt( - explicitCastExpr(has(cxxMemberCallExpr(callee(cxxMethodDecl( - hasName("data"), ofClass(hasName("std::span"))))))) + explicitCastExpr(anyOf(has(callExpr), has(parenExpr(has(callExpr))))) .bind(OpTag)); } const Stmt *getBaseStmt() const override { return Op; } diff --git a/clang/lib/Sema/AnalysisBasedWarnings.cpp b/clang/lib/Sema/AnalysisBasedWarnings.cpp index 9eb1df5f0240596..649c3f533b8206e 100644 --- a/clang/lib/Sema/AnalysisBasedWarnings.cpp +++ b/clang/lib/Sema/AnalysisBasedWarnings.cpp @@ -2263,15 +2263,20 @@ class UnsafeBufferUsageReporter : public UnsafeBufferUsageHandler { MsgParam = 3; } else if (const auto *ECE = dyn_cast<ExplicitCastExpr>(Operation)) { QualType destType = ECE->getType(); + if (!isa<PointerType>(destType)) + return; + + const Expr *subExpr = ECE->getSubExpr(); + const uint64_t dSize = Ctx.getTypeSize(destType.getTypePtr()->getPointeeType()); - if (const auto *CE = dyn_cast<CXXMemberCallExpr>(ECE->getSubExpr())) { - QualType srcType = CE->getType(); - const uint64_t sSize = - Ctx.getTypeSize(srcType.getTypePtr()->getPointeeType()); - if (sSize >= dSize) - return; - } + + QualType srcType = ECE->getSubExpr()->getType(); + const uint64_t sSize = + Ctx.getTypeSize(srcType.getTypePtr()->getPointeeType()); + if (sSize >= dSize) + return; + MsgParam = 4; } Loc = Operation->getBeginLoc(); diff --git a/clang/test/SemaCXX/warn-unsafe-buffer-usage-warning-data-invocation.cpp b/clang/test/SemaCXX/warn-unsafe-buffer-usage-warning-data-invocation.cpp index 79eb3bb4bacc6e7..574afcd0eb6dce3 100644 --- a/clang/test/SemaCXX/warn-unsafe-buffer-usage-warning-data-invocation.cpp +++ b/clang/test/SemaCXX/warn-unsafe-buffer-usage-warning-data-invocation.cpp @@ -7,6 +7,7 @@ // RUN: %clang_cc1 -std=c++20 -fblocks -include %s %s 2>&1 | FileCheck --allow-empty %s // CHECK-NOT: [-Wunsafe-buffer-usage] +#include <stdint.h> #ifndef INCLUDED #define INCLUDED #pragma clang system_header @@ -90,15 +91,18 @@ void cast_without_data(int *ptr) { void warned_patterns(std::span<int> span_ptr, std::span<Base> base_span, span<int> span_without_qual) { A *a1 = (A*)span_ptr.data(); // expected-warning{{unsafe invocation of span::data}} a1 = (A*)span_ptr.data(); // expected-warning{{unsafe invocation of span::data}} - - A *a2 = (A*) span_without_qual.data(); // expected-warning{{unsafe invocation of span::data}} - - // TODO:: Should we warn when we cast from base to derived type? - Derived *b = dynamic_cast<Derived*> (base_span.data());// expected-warning{{unsafe invocation of span::data}} - // TODO:: This pattern is safe. We can add special handling for it, if we decide this - // is the recommended fixit for the unsafe invocations. - A *a3 = (A*)span_ptr.subspan(0, sizeof(A)).data(); // expected-warning{{unsafe invocation of span::data}} + a1 = (A*)(span_ptr.data()); // expected-warning{{unsafe invocation of span::data}} + A *a2 = (A*) (span_without_qual.data()); // expected-warning{{unsafe invocation of span::data}} + + a2 = (A*) span_without_qual.data(); // expected-warning{{unsafe invocation of span::data}} + + // TODO:: Should we warn when we cast from base to derived type? + Derived *b = dynamic_cast<Derived*> (base_span.data());// expected-warning{{unsafe invocation of span::data}} + + // TODO:: This pattern is safe. We can add special handling for it, if we decide this + // is the recommended fixit for the unsafe invocations. + A *a3 = (A*)span_ptr.subspan(0, sizeof(A)).data(); // expected-warning{{unsafe invocation of span::data}} } void not_warned_patterns(std::span<A> span_ptr, std::span<Base> base_span) { @@ -108,6 +112,9 @@ void not_warned_patterns(std::span<A> span_ptr, std::span<Base> base_span) { p = (int*) span_ptr.data(); A *a = (A*) span_ptr.hello(); // Invoking other methods. + + intptr_t k = (intptr_t) span_ptr.data(); + k = (intptr_t) (span_ptr.data()); } // We do not want to warn about other types _______________________________________________ cfe-commits mailing list cfe-commits@lists.llvm.org https://lists.llvm.org/cgi-bin/mailman/listinfo/cfe-commits
