r337721 - [CStringSyntaxChecker] Improvements of strlcpy check

[David Carlier via cfe-commits]

Author: devnexen
Date: Mon Jul 23 11:26:38 2018
New Revision: 337721

URL: http://llvm.org/viewvc/llvm-project?rev=337721&view=rev
Log:
[CStringSyntaxChecker] Improvements of strlcpy check

Adding an additional check whenwe offset fro the buffer base address.

Reviewers: george.karpenkov,NoQ

Reviewed By: george.karpenkov

Differential Revision: https://reviews.llvm.org/D49633

Modified:
    cfe/trunk/lib/StaticAnalyzer/Checkers/CStringSyntaxChecker.cpp
    cfe/trunk/test/Analysis/cstring-syntax.c

Modified: cfe/trunk/lib/StaticAnalyzer/Checkers/CStringSyntaxChecker.cpp
URL: http://llvm.org/viewvc/llvm-project/cfe/trunk/lib/StaticAnalyzer/Checkers/CStringSyntaxChecker.cpp?rev=337721&r1=337720&r2=337721&view=diff
==============================================================================
--- cfe/trunk/lib/StaticAnalyzer/Checkers/CStringSyntaxChecker.cpp (original)
+++ cfe/trunk/lib/StaticAnalyzer/Checkers/CStringSyntaxChecker.cpp Mon Jul 23 11:26:38 2018
@@ -88,6 +88,7 @@ class WalkAST: public StmtVisitor<WalkAS
   ///   size_t cpy = 4;
   ///   strlcpy(dst, "abcd", sizeof("abcd") - 1);
   ///   strlcpy(dst, "abcd", 4);
+  ///   strlcpy(dst + 3, "abcd", 2);
   ///   strlcpy(dst, "abcd", cpy);
   bool containsBadStrlcpyPattern(const CallExpr *CE);
 
@@ -149,6 +150,7 @@ bool WalkAST::containsBadStrlcpyPattern(
 
   const auto *DstArgDecl = dyn_cast<DeclRefExpr>(DstArg->IgnoreParenImpCasts());
   const auto *LenArgDecl = dyn_cast<DeclRefExpr>(LenArg->IgnoreParenLValueCasts());
+  uint64_t DstOff = 0;
   // - size_t dstlen = sizeof(dst)
   if (LenArgDecl) {
     const auto *LenArgVal = dyn_cast<VarDecl>(LenArgDecl->getDecl());
@@ -158,14 +160,28 @@ bool WalkAST::containsBadStrlcpyPattern(
 
   // - integral value
   // We try to figure out if the last argument is possibly longer
-  // than the destination can possibly handle if its size can be defined
+  // than the destination can possibly handle if its size can be defined.
   if (const auto *IL = dyn_cast<IntegerLiteral>(LenArg->IgnoreParenImpCasts())) {
     uint64_t ILRawVal = IL->getValue().getZExtValue();
+
+    // Case when there is pointer arithmetic on the destination buffer
+    // especially when we offset from the base decreasing the
+    // buffer length accordingly.
+    if (!DstArgDecl) {
+      if (const auto *BE = dyn_cast<BinaryOperator>(DstArg->IgnoreParenImpCasts())) {
+        DstArgDecl = dyn_cast<DeclRefExpr>(BE->getLHS()->IgnoreParenImpCasts());
+        if (BE->getOpcode() == BO_Add) {
+          if ((IL = dyn_cast<IntegerLiteral>(BE->getRHS()->IgnoreParenImpCasts()))) {
+            DstOff = IL->getValue().getZExtValue();
+          }
+        }
+      }
+    }
     if (DstArgDecl) {
       if (const auto *Buffer = dyn_cast<ConstantArrayType>(DstArgDecl->getType())) {
         ASTContext &C = BR.getContext();
         uint64_t BufferLen = C.getTypeSize(Buffer) / 8;
-        if (BufferLen < ILRawVal)
+        if ((BufferLen - DstOff) < ILRawVal)
           return true;
       }
     }

Modified: cfe/trunk/test/Analysis/cstring-syntax.c
URL: http://llvm.org/viewvc/llvm-project/cfe/trunk/test/Analysis/cstring-syntax.c?rev=337721&r1=337720&r2=337721&view=diff
==============================================================================
--- cfe/trunk/test/Analysis/cstring-syntax.c (original)
+++ cfe/trunk/test/Analysis/cstring-syntax.c Mon Jul 23 11:26:38 2018
@@ -31,4 +31,5 @@ void testStrlcpy(const char *src) {
   strlcpy(dest, src, badlen); // expected-warning {{The third argument is larger than the size of the input buffer. Replace with the value 'sizeof(dest)` or lower}}
   strlcpy(dest, src, ulen);
   strlcpy(dest + 5, src, 5);
+  strlcpy(dest + 5, src, 10); // expected-warning {{The third argument is larger than the size of the input buffer.}}
 }