[PATCH] D46633: [analyzer] add range check for InitList lookup

[Alexander Kornienko via Phabricator via cfe-commits]

This revision was automatically updated to reflect the committed changes.
Closed by commit rL331870: Fixes issue introduced by r331556. (authored by alexfh, committed by ).
Herald added a subscriber: llvm-commits.

Changed prior to commit:
  https://reviews.llvm.org/D46633?vs=145880&id=145899#toc

Repository:
  rL LLVM

https://reviews.llvm.org/D46633

Files:
  cfe/trunk/lib/StaticAnalyzer/Core/RegionStore.cpp
  cfe/trunk/test/Analysis/initialization.c


Index: cfe/trunk/test/Analysis/initialization.c
===================================================================
--- cfe/trunk/test/Analysis/initialization.c
+++ cfe/trunk/test/Analysis/initialization.c
@@ -0,0 +1,7 @@
+// RUN: %clang_analyze_cc1 -analyzer-checker=core -verify %s
+// expected-no-diagnostics
+
+void initbug() {
+  const union { float a; } u = {};
+  (void)u.a; // no-crash
+}
Index: cfe/trunk/lib/StaticAnalyzer/Core/RegionStore.cpp
===================================================================
--- cfe/trunk/lib/StaticAnalyzer/Core/RegionStore.cpp
+++ cfe/trunk/lib/StaticAnalyzer/Core/RegionStore.cpp
@@ -1711,13 +1711,15 @@
   if (const auto *VR = dyn_cast<VarRegion>(superR)) {
     const VarDecl *VD = VR->getDecl();
     QualType RecordVarTy = VD->getType();
+    unsigned Index = FD->getFieldIndex();
     // Either the record variable or the field has to be const qualified.
     if (RecordVarTy.isConstQualified() || Ty.isConstQualified())
       if (const Expr *Init = VD->getInit())
         if (const auto *InitList = dyn_cast<InitListExpr>(Init))
-          if (const Expr *FieldInit = InitList->getInit(FD->getFieldIndex()))
-            if (Optional<SVal> V = svalBuilder.getConstantVal(FieldInit))
-              return *V;
+          if (Index < InitList->getNumInits())
+            if (const Expr *FieldInit = InitList->getInit(Index))
+              if (Optional<SVal> V = svalBuilder.getConstantVal(FieldInit))
+                return *V;
   }
 
   return getBindingForFieldOrElementCommon(B, R, Ty);


-------------- next part --------------
A non-text attachment was scrubbed...
Name: D46633.145899.patch
Type: text/x-patch
Size: 1549 bytes
Desc: not available
URL: <http://lists.llvm.org/pipermail/cfe-commits/attachments/20180509/f09e5b35/attachment-0001.bin>