[PATCH] D46633: [analyzer] add range check for InitList lookup

[Rafael Stahl via Phabricator via cfe-commits]

r.stahl created this revision.
r.stahl added reviewers: alexfh, NoQ, george.karpenkov.
Herald added subscribers: cfe-commits, a.sidorin, szepet, xazax.hun.

Fixes issue introduced by https://reviews.llvm.org/rC331556.

Closes bug: https://bugs.llvm.org/show_bug.cgi?id=37357


Repository:
  rC Clang

https://reviews.llvm.org/D46633

Files:
  lib/StaticAnalyzer/Core/RegionStore.cpp
  test/Analysis/initialization.c


Index: test/Analysis/initialization.c
===================================================================
--- test/Analysis/initialization.c
+++ test/Analysis/initialization.c
@@ -0,0 +1,8 @@
+// RUN: %clang_analyze_cc1 -analyzer-checker=core -verify %s
+// expected-no-diagnostics
+
+void initbug() {
+  const union { float a; } u = {};
+  (void)u.a; // no-crash
+}
+
Index: lib/StaticAnalyzer/Core/RegionStore.cpp
===================================================================
--- lib/StaticAnalyzer/Core/RegionStore.cpp
+++ lib/StaticAnalyzer/Core/RegionStore.cpp
@@ -1711,13 +1711,15 @@
   if (const auto *VR = dyn_cast<VarRegion>(superR)) {
     const VarDecl *VD = VR->getDecl();
     QualType RecordVarTy = VD->getType();
+    unsigned Index = FD->getFieldIndex();
     // Either the record variable or the field has to be const qualified.
     if (RecordVarTy.isConstQualified() || Ty.isConstQualified())
       if (const Expr *Init = VD->getInit())
         if (const auto *InitList = dyn_cast<InitListExpr>(Init))
-          if (const Expr *FieldInit = InitList->getInit(FD->getFieldIndex()))
-            if (Optional<SVal> V = svalBuilder.getConstantVal(FieldInit))
-              return *V;
+          if (Index < InitList->getNumInits())
+            if (const Expr *FieldInit = InitList->getInit(Index))
+              if (Optional<SVal> V = svalBuilder.getConstantVal(FieldInit))
+                return *V;
   }
 
   return getBindingForFieldOrElementCommon(B, R, Ty);


-------------- next part --------------
A non-text attachment was scrubbed...
Name: D46633.145880.patch
Type: text/x-patch
Size: 1491 bytes
Desc: not available
URL: <http://lists.llvm.org/pipermail/cfe-commits/attachments/20180509/9ce20448/attachment.bin>