[cfe-commits] r54253 - in /cfe/trunk: include/clang/Analysis/PathSensitive/BugReporter.h lib/Analysis/GRExprEngineInternalChecks.cpp test/Analysis/null-deref-ps.c test/Analysis/stack-addr-ps.c

[Ted Kremenek]

Author: kremenek
Date: Thu Jul 31 15:31:27 2008
New Revision: 54253

URL: http://llvm.org/viewvc/llvm-project?rev=54253&view=rev
Log:
Enhanced path-sensitive return-of-stack-address check to print out the name of the variable whose address was returned.

Modified:
    cfe/trunk/include/clang/Analysis/PathSensitive/BugReporter.h
    cfe/trunk/lib/Analysis/GRExprEngineInternalChecks.cpp
    cfe/trunk/test/Analysis/null-deref-ps.c
    cfe/trunk/test/Analysis/stack-addr-ps.c

Modified: cfe/trunk/include/clang/Analysis/PathSensitive/BugReporter.h
URL: http://llvm.org/viewvc/llvm-project/cfe/trunk/include/clang/Analysis/PathSensitive/BugReporter.h?rev=54253&r1=54252&r2=54253&view=diff

==============================================================================
--- cfe/trunk/include/clang/Analysis/PathSensitive/BugReporter.h (original)
+++ cfe/trunk/include/clang/Analysis/PathSensitive/BugReporter.h Thu Jul 31 15:31:27 2008
@@ -107,14 +107,21 @@
   
 class RangedBugReport : public BugReport {
   std::vector<SourceRange> Ranges;
+  const char* desc;
 public:
-  RangedBugReport(BugType& D, ExplodedNode<ValueState> *n)
-    : BugReport(D, n) {}
+  RangedBugReport(BugType& D, ExplodedNode<ValueState> *n,
+                  const char* description = 0)
+    : BugReport(D, n), desc(description) {}
   
   virtual ~RangedBugReport();
+
+  virtual const char* getDescription() const {
+    return desc ? desc : BugReport::getDescription();
+  }
   
   void addRange(SourceRange R) { Ranges.push_back(R); }
   
+  
   virtual void getRanges(BugReporter& BR,const SourceRange*& beg,           
                          const SourceRange*& end) {
     

Modified: cfe/trunk/lib/Analysis/GRExprEngineInternalChecks.cpp
URL: http://llvm.org/viewvc/llvm-project/cfe/trunk/lib/Analysis/GRExprEngineInternalChecks.cpp?rev=54253&r1=54252&r2=54253&view=diff

==============================================================================
--- cfe/trunk/lib/Analysis/GRExprEngineInternalChecks.cpp (original)
+++ cfe/trunk/lib/Analysis/GRExprEngineInternalChecks.cpp Thu Jul 31 15:31:27 2008
@@ -15,7 +15,7 @@
 #include "clang/Analysis/PathSensitive/BugReporter.h"
 #include "clang/Analysis/PathSensitive/GRExprEngine.h"
 #include "llvm/Support/Compiler.h"
-
+#include <sstream>
 
 using namespace clang;
 
@@ -42,9 +42,12 @@
   const char* name;
   const char* desc;
 public:
-  BuiltinBug(const char* n, const char* d) : name(n), desc(d) {}  
+  BuiltinBug(const char* n, const char* d = 0) : name(n), desc(d) {}  
   virtual const char* getName() const { return name; }
-  virtual const char* getDescription() const { return desc; }
+  virtual const char* getDescription() const {
+    return desc ? desc : name;
+  }
+  
   virtual void EmitBuiltinWarnings(BugReporter& BR, GRExprEngine& Eng) = 0;
   virtual void EmitWarnings(BugReporter& BR) {
     EmitBuiltinWarnings(BR, cast<GRBugReporter>(BR).getEngine());
@@ -177,20 +180,29 @@
   
 class VISIBILITY_HIDDEN RetStack : public BuiltinBug {
 public:
-  RetStack() : BuiltinBug("return of stack address",
-                          "Address of stack-allocated variable returned.") {}
+  RetStack() : BuiltinBug("return of stack address") {}
   
   virtual void EmitBuiltinWarnings(BugReporter& BR, GRExprEngine& Eng) {
     for (GRExprEngine::ret_stackaddr_iterator I=Eng.ret_stackaddr_begin(),
          End = Eng.ret_stackaddr_end(); I!=End; ++I) {
-      
-      // Generate a report for this bug.
-      RangedBugReport report(*this, *I);
-      
+
       ExplodedNode<ValueState>* N = *I;
       Stmt *S = cast<PostStmt>(N->getLocation()).getStmt();
       Expr* E = cast<ReturnStmt>(S)->getRetValue();
       assert (E && "Return expression cannot be NULL");
+      
+      // Get the value associated with E.
+      lval::DeclVal V =
+        cast<lval::DeclVal>(Eng.getStateManager().GetRVal(N->getState(), E));
+      
+      // Generate a report for this bug.
+      std::ostringstream os;
+      os << "Address of stack memory associated with local variable '"
+         << V.getDecl()->getName() << "' returned.";
+      
+      std::string s = os.str();
+      
+      RangedBugReport report(*this, N, s.c_str());
       report.addRange(E->getSourceRange());
       
       // Emit the warning.

Modified: cfe/trunk/test/Analysis/null-deref-ps.c
URL: http://llvm.org/viewvc/llvm-project/cfe/trunk/test/Analysis/null-deref-ps.c?rev=54253&r1=54252&r2=54253&view=diff

==============================================================================
--- cfe/trunk/test/Analysis/null-deref-ps.c (original)
+++ cfe/trunk/test/Analysis/null-deref-ps.c Thu Jul 31 15:31:27 2008
@@ -62,4 +62,19 @@
   return !p ? bar(p) : *p; // expected-warning {{Null pointer passed as an argument to a 'nonnull' parameter}}
 } 
 
+int* qux();
+
+int f7(int x) {
+  
+  int* p = 0;
+  
+  if (0 == x)
+    p = qux();
+  
+  if (0 == x)
+    *p = 1; // no-warning
+    
+  return x;
+}
+
 

Modified: cfe/trunk/test/Analysis/stack-addr-ps.c
URL: http://llvm.org/viewvc/llvm-project/cfe/trunk/test/Analysis/stack-addr-ps.c?rev=54253&r1=54252&r2=54253&view=diff

==============================================================================
--- cfe/trunk/test/Analysis/stack-addr-ps.c (original)
+++ cfe/trunk/test/Analysis/stack-addr-ps.c Thu Jul 31 15:31:27 2008
@@ -2,11 +2,11 @@
 
 int* f1() {
   int x = 0;
-  return &x; // expected-warning{{Address of stack-allocated variable returned.}} expected-warning{{address of stack memory associated with local variable 'x' returned}}
+  return &x; // expected-warning{{Address of stack memory associated with local variable 'x' returned.}} expected-warning{{address of stack memory associated with local variable 'x' returned}}
 }
 
 int* f2(int y) {
-  return &y;  // expected-warning{{Address of stack-allocated variable returned.}} expected-warning{{address of stack memory associated with local variable 'y' returned}}
+  return &y;  // expected-warning{{Address of stack memory associated with local variable 'y' returned.}} expected-warning{{address of stack memory associated with local variable 'y' returned}}
 }
 
 int* f3(int x, int *y) {
@@ -15,7 +15,7 @@
   if (x)
     y = &w;
     
-  return y; // expected-warning{{Address of stack-allocated variable returned.}}
+  return y; // expected-warning{{Address of stack memory associated with local variable 'w' returned.}}
 }