[PATCH] D37897: [StaticAnalyzer] Fix ProgramState for static variables that are not written

[Daniel Marjamäki via Phabricator via cfe-commits]

danielmarjamaki created this revision.

I saw a false positive where the analyzer made wrong conclusions about a static variable.

Static variables that are not written have known values (initialized values).

This is the (simplified) code that motivated me to create this patch:

  static char *allv[] = {
  	"rpcgen", "-s", "udp", "-s", "tcp",
  
  };
  static int allc = sizeof(allv) / sizeof(allv[0]);
  
  static void f(void) {
  	int i;
  
  	for (i = 1; i < allc; i++) {
  		const char *p = allv[i];  // <- line 28
  		i++;
  	}
  }

Clang output:

  array-fp3.c:28:19: warning: Access out-of-bound array element (buffer overflow)
                  const char *p = allv[i];
                                  ^~~~~~~

I added testcases that shows this patch solves both false positives and false negatives


Repository:
  rL LLVM

https://reviews.llvm.org/D37897

Files:
  include/clang/StaticAnalyzer/Core/PathSensitive/ExprEngine.h
  lib/StaticAnalyzer/Core/ExprEngine.cpp
  test/Analysis/global-vars.c

-------------- next part --------------
A non-text attachment was scrubbed...
Name: D37897.115374.patch
Type: text/x-patch
Size: 5831 bytes
Desc: not available
URL: <http://lists.llvm.org/pipermail/cfe-commits/attachments/20170915/426d2e2d/attachment.bin>