<html><head><meta http-equiv="Content-Type" content="text/html charset=iso-8859-1"></head><body style="word-wrap: break-word; -webkit-nbsp-mode: space; -webkit-line-break: after-white-space; ">Peeter,<div><br></div><div><div>For the purposes of tracking the state of the file, you could just track the symbol representing the struct, not the file handle inside of it. I would suggest getting this working first.</div></div><div><br></div><div>In order to get rid of the false positive, you should build an SVal expression representing "fh.fh == -1" and use ConstraintManager::assumeDual() to check if it's true/false/underconstrained in the given state, similarly to how checkNull() is implemented. (I don't think there is isNegative() helper function; but you are welcome to add it.)</div><div><br></div><div>When building the expression, you can use the helper routines in the SValBuilder (ex: <span style="font-family: Monaco; font-size: 11px; ">evalBinOp</span>). You should be using MemRegionManager::getFieldRegion to represent the field of the struct. (Ex: See how BoolAssignmentChecker.cpp is building an expression and uses assumeDual.)</div><div><br></div><div>Cheers,</div><div>Anna.</div><div><div><div>On Nov 21, 2012, at 12:42 PM, Peeter Joot <<a href="mailto:peeter.joot@gmail.com">peeter.joot@gmail.com</a>> wrote:</div><br class="Apple-interchange-newline"><blockquote type="cite"><div>I'm interested in trying out clang based code analysis. I saw the following slides:<br><a href="http://llvm.org/devmtg/2012-11/Zaks-Rose-Checker24Hours.pdf"><br class="">http://llvm.org/devmtg/2012-11/Zaks-Rose-Checker24Hours.pdf</a> <br clear="all">
<br class="">So thought I'd try using tools/clang/lib/StaticAnalyzer/Checkers/SimpleStreamChecker.cpp as a base for a similar check using our products' internal file API.</div><div><br></div><div>In the sample, there's the following code to get the close parameter:<br>
<br>void SimpleStreamChecker::checkPreCall<br></div><div>...</div><div><div> // Get the symbolic value corresponding to the file handle.</div><div> SymbolRef FileDesc = Call.getArgSVal(0).getAsSymbol();</div></div><div>
<br></div><div>I'll want to do the same thing, with a small difference. My close API looks like:<br><br>struct my_filehandle { int fh ; ... } ;<br><br>int myclose( my_filehandle & fh )</div><div><br>so once I get the close parameter symbol, I have the task of looking up the actual file descriptor.<br>
<br>I'm guessing that I have to:<br><br>1) check it for -1 instead of NULL (hardcoding the assumption for now that I'm only running this checking on Unix)</div><div><br>I've changed:<br><br>ConditionTruthVal OpenFailed = CMgr.isNull(State, Sym);<br>
<br>to call isNegative(), which I think will do the trick, provided I first:</div><div><br></div><div>2) find the symbol that the myclose() parameter is a reference to.<br>3) look up the my_filehandle::fh value out of that symbol.<br>
</div><div>4) put that ::fh symbol in the checker stream instead of the FILE*.</div><div><br></div></blockquote><div><br></div><div><br></div><blockquote type="cite"><div>Anybody willing to give any tips on how to do 2-3 above.</div><div><br></div>-- <br>Peeter<br>
_______________________________________________<br>cfe-dev mailing list<br><a href="mailto:cfe-dev@cs.uiuc.edu">cfe-dev@cs.uiuc.edu</a><br>http://lists.cs.uiuc.edu/mailman/listinfo/cfe-dev<br></blockquote></div><br></div></body></html>