[all-commits] [llvm/llvm-project] db28e4: [analyzer] Smarter range inference for {+, -, *} (#2...

[Balázs Benics via All-commits]

  Branch: refs/heads/main
  Home:   https://github.com/llvm/llvm-project
  Commit: db28e48d67e3b0c44d88be9ea2d28eca2d239a9a
      https://github.com/llvm/llvm-project/commit/db28e48d67e3b0c44d88be9ea2d28eca2d239a9a
  Author: Balázs Benics <benicsbalazs at gmail.com>
  Date:   2026-07-13 (Mon, 13 Jul 2026)

  Changed paths:
    M clang/lib/StaticAnalyzer/Core/RangeConstraintManager.cpp
    M clang/test/Analysis/ArrayBound/assumption-reporting.c
    M clang/test/Analysis/bitwise-shift-common.c
    M clang/test/Analysis/constant-folding.c
    M clang/test/Analysis/malloc.c
    M clang/test/Analysis/string.c

  Log Message:
  -----------
  [analyzer] Smarter range inference for {+,-,*} (#209048)

SymbolicRangeInferrer previously fell back to the full range of the
result type for BO_Add, BO_Sub and BO_Mul, discarding any constraints
known about the operands.

This caused a false positive in optin.taint.TaintedAlloc: a bounded
tainted value multiplied by a constant
(e.g. `malloc(groups * sizeof(gid_t))` with `groups` bounded) was
treated as unbounded whenever the multiplication was done in a wide
(e.g. 64-bit size_t) type, because the operand's range was lost. A
32-bit multiplication accidentally avoided the warning only because the
narrow result type already bounds the value below SIZE_MAX/4. Fixes
#173113

---

With `inferFromCorners` we compute the smallest and largest possible
outcome of the two range sets for `LHS {+,-,*} RHS`. If fails for some
reason, it falls back to the previous behavior and takes [MIN, MAX] for
type T - the most conservative range.

This patch also covers some pre-existing FIXMEs in the tests. I didn't
evaluate this change - however, I think it's harmless.

Assisted-by: Claude Opus 4.8



To unsubscribe from these emails, change your notification settings at https://github.com/llvm/llvm-project/settings/notifications