[clang-tools-extra] r318913 - [clang-tidy] Detect bugs in bugprone-misplaced-operator-in-strlen-in-alloc even in the case the allocation function is called using a constant function pointer

[Adam Balogh via cfe-commits]

Author: baloghadamsoftware
Date: Thu Nov 23 05:12:25 2017
New Revision: 318913

URL: http://llvm.org/viewvc/llvm-project?rev=318913&view=rev
Log:
[clang-tidy] Detect bugs in bugprone-misplaced-operator-in-strlen-in-alloc even in the case the allocation function is called using a constant function pointer

Detect bugs even if a function of the malloc() family is called using a constant pointer.


Modified:
    clang-tools-extra/trunk/clang-tidy/bugprone/MisplacedOperatorInStrlenInAllocCheck.cpp
    clang-tools-extra/trunk/docs/clang-tidy/checks/bugprone-misplaced-operator-in-strlen-in-alloc.rst
    clang-tools-extra/trunk/test/clang-tidy/bugprone-misplaced-operator-in-strlen-in-alloc.c

Modified: clang-tools-extra/trunk/clang-tidy/bugprone/MisplacedOperatorInStrlenInAllocCheck.cpp
URL: http://llvm.org/viewvc/llvm-project/clang-tools-extra/trunk/clang-tidy/bugprone/MisplacedOperatorInStrlenInAllocCheck.cpp?rev=318913&r1=318912&r2=318913&view=diff
==============================================================================
--- clang-tools-extra/trunk/clang-tidy/bugprone/MisplacedOperatorInStrlenInAllocCheck.cpp (original)
+++ clang-tools-extra/trunk/clang-tidy/bugprone/MisplacedOperatorInStrlenInAllocCheck.cpp Thu Nov 23 05:12:25 2017
@@ -49,10 +49,23 @@ void MisplacedOperatorInStrlenInAllocChe
       functionDecl(anyOf(hasName("::calloc"), hasName("std::calloc"),
                          hasName("::realloc"), hasName("std::realloc")));
 
-  Finder->addMatcher(
-      callExpr(callee(Alloc0Func), hasArgument(0, BadArg)).bind("Alloc"), this);
-  Finder->addMatcher(
-      callExpr(callee(Alloc1Func), hasArgument(1, BadArg)).bind("Alloc"), this);
+  const auto Alloc0FuncPtr =
+      varDecl(hasType(isConstQualified()),
+              hasInitializer(ignoringParenImpCasts(
+                  declRefExpr(hasDeclaration(Alloc0Func)))));
+  const auto Alloc1FuncPtr =
+      varDecl(hasType(isConstQualified()),
+              hasInitializer(ignoringParenImpCasts(
+                  declRefExpr(hasDeclaration(Alloc1Func)))));
+
+  Finder->addMatcher(callExpr(callee(decl(anyOf(Alloc0Func, Alloc0FuncPtr))),
+                              hasArgument(0, BadArg))
+                         .bind("Alloc"),
+                     this);
+  Finder->addMatcher(callExpr(callee(decl(anyOf(Alloc1Func, Alloc1FuncPtr))),
+                              hasArgument(1, BadArg))
+                         .bind("Alloc"),
+                     this);
   Finder->addMatcher(
       cxxNewExpr(isArray(), hasArraySize(BadArg)).bind("Alloc"), this);
 }

Modified: clang-tools-extra/trunk/docs/clang-tidy/checks/bugprone-misplaced-operator-in-strlen-in-alloc.rst
URL: http://llvm.org/viewvc/llvm-project/clang-tools-extra/trunk/docs/clang-tidy/checks/bugprone-misplaced-operator-in-strlen-in-alloc.rst?rev=318913&r1=318912&r2=318913&view=diff
==============================================================================
--- clang-tools-extra/trunk/docs/clang-tidy/checks/bugprone-misplaced-operator-in-strlen-in-alloc.rst (original)
+++ clang-tools-extra/trunk/docs/clang-tidy/checks/bugprone-misplaced-operator-in-strlen-in-alloc.rst Thu Nov 23 05:12:25 2017
@@ -7,9 +7,11 @@ Finds cases where ``1`` is added to the
 ``strnlen()``, ``strnlen_s()``, ``wcslen()``, ``wcsnlen()``, and ``wcsnlen_s()``
 instead of the result and the value is used as an argument to a memory
 allocation function (``malloc()``, ``calloc()``, ``realloc()``, ``alloca()``) or
-the ``new[]`` operator in `C++`. Cases where ``1`` is added both to the
-parameter and the result of the ``strlen()``-like function are ignored, as are
-cases where the whole addition is surrounded by extra parentheses.
+the ``new[]`` operator in `C++`. The check detects error cases even if one of
+these functions (except the ``new[]`` operator) is called by a constant function
+pointer.  Cases where ``1`` is added both to the parameter and the result of the
+``strlen()``-like function are ignored, as are cases where the whole addition is
+surrounded by extra parentheses.
 
 `C` example code:
 

Modified: clang-tools-extra/trunk/test/clang-tidy/bugprone-misplaced-operator-in-strlen-in-alloc.c
URL: http://llvm.org/viewvc/llvm-project/clang-tools-extra/trunk/test/clang-tidy/bugprone-misplaced-operator-in-strlen-in-alloc.c?rev=318913&r1=318912&r2=318913&view=diff
==============================================================================
--- clang-tools-extra/trunk/test/clang-tidy/bugprone-misplaced-operator-in-strlen-in-alloc.c (original)
+++ clang-tools-extra/trunk/test/clang-tidy/bugprone-misplaced-operator-in-strlen-in-alloc.c Thu Nov 23 05:12:25 2017
@@ -75,3 +75,11 @@ void intentional3(char *name) {
   // CHECK-MESSAGES-NOT: :[[@LINE-1]]:28: warning: addition operator is applied to the argument of strlen
   // If expression is in extra parentheses, consider it as intentional
 }
+
+void (*(*const alloc_ptr)(size_t)) = malloc;
+
+void bad_indirect_alloc(char *name) {
+  char *new_name = (char *)alloc_ptr(strlen(name + 1));
+  // CHECK-MESSAGES: :[[@LINE-1]]:28: warning: addition operator is applied to the argument of strlen
+  // CHECK-FIXES: {{^  char \*new_name = \(char \*\)alloc_ptr\(}}strlen(name) + 1{{\);$}}
+}