================
@@ -0,0 +1,146 @@
+//=== StoreToImmutableChecker.cpp - Store to immutable memory checker -*- C++
+//-*-===//
+//
+// Part of the LLVM Project, under the Apache License v2.0 with LLVM
Exceptions.
+// See https://llvm.org/LICENSE.txt for license information.
+// SPDX-License-Identifier: Apache-2.0 WITH LLVM-exception
+//
+//===----------------------------------------------------------------------===//
+//
+// This file defines StoreToImmutableChecker, a checker that detects writes
+// to immutable memory regions. This implements part of SEI CERT Rule ENV30-C.
+//
+//===----------------------------------------------------------------------===//
+
+#include "clang/StaticAnalyzer/Checkers/BuiltinCheckerRegistration.h"
+#include "clang/StaticAnalyzer/Core/BugReporter/BugType.h"
+#include "clang/StaticAnalyzer/Core/Checker.h"
+#include "clang/StaticAnalyzer/Core/CheckerManager.h"
+#include "clang/StaticAnalyzer/Core/PathSensitive/CheckerContext.h"
+#include "clang/StaticAnalyzer/Core/PathSensitive/MemRegion.h"
+
+using namespace clang;
+using namespace ento;
+
+namespace {
+class StoreToImmutableChecker : public Checker<check::Bind> {
+ const BugType BT{this, "Write to immutable memory", "CERT Environment
(ENV)"};
+
+public:
+ void checkBind(SVal Loc, SVal Val, const Stmt *S, CheckerContext &C) const;
+
+private:
+ bool isConstVariable(const MemRegion *MR, CheckerContext &C) const;
+ bool isConstQualifiedType(const MemRegion *MR, CheckerContext &C) const;
+};
+} // end anonymous namespace
+
+bool StoreToImmutableChecker::isConstVariable(const MemRegion *MR,
+ CheckerContext &C) const {
----------------
gamesh411 wrote:
As you suspected, no hits for ParamVarRegion or StringRegion.
ParamVarRegion may not even be possible to encounter in this context (just a
guess), and I am not sure where is binding to a String region occurs. I will
remove these two cases for now.
```
38| |bool StoreToImmutableChecker::isConstVariable(const MemRegion *MR,
39| 21| CheckerContext &C)
const {
40| | // Check if the region is in the global immutable space
41| 21| const MemSpaceRegion *MS = MR->getMemorySpace(C.getState());
42| 21| if (isa<GlobalImmutableSpaceRegion>(MS))
43| 3| return true;
44| |
45| | // Check if this is a VarRegion with a const-qualified type
46| 18| if (const VarRegion *VR = dyn_cast<VarRegion>(MR)) {
47| 8| const VarDecl *VD = VR->getDecl();
48| 8| if (VD && VD->getType().isConstQualified())
49| 2| return true;
50| 8| }
51| |
52| | // Check if this is a ParamVarRegion with a const-qualified type
53| 16| if (const ParamVarRegion *PVR = dyn_cast<ParamVarRegion>(MR)) {
54| 0| const ParmVarDecl *PVD = PVR->getDecl();
55| 0| if (PVD && PVD->getType().isConstQualified())
56| 0| return true;
57| 0| }
58| |
59| | // Check if this is a FieldRegion with a const-qualified type
60| 16| if (const FieldRegion *FR = dyn_cast<FieldRegion>(MR)) {
61| 5| const FieldDecl *FD = FR->getDecl();
62| 5| if (FD && FD->getType().isConstQualified())
63| 4| return true;
64| 5| }
65| |
66| | // Check if this is a StringRegion (string literals are const)
67| 12| if (isa<StringRegion>(MR))
68| 0| return true;
69| |
70| | // Check if this is a SymbolicRegion with a const-qualified
pointee type
71| 12| if (const SymbolicRegion *SR = dyn_cast<SymbolicRegion>(MR)) {
72| 3| QualType PointeeType = SR->getPointeeStaticType();
73| 3| if (PointeeType.isConstQualified())
74| 3| return true;
75| 3| }
76| |
77| | // Check if this is an ElementRegion accessing a const array
78| 9| if (const ElementRegion *ER = dyn_cast<ElementRegion>(MR)) {
79| 2| return isConstQualifiedType(ER->getSuperRegion(), C);
80| 2| }
81| |
82| 7| return false;
83| 9|}
```
https://github.com/llvm/llvm-project/pull/150417
_______________________________________________
cfe-commits mailing list
cfe-commits@lists.llvm.org
https://lists.llvm.org/cgi-bin/mailman/listinfo/cfe-commits
