[clang] 8781944 - [analyzer] GenericTaint: Don't expect CallEvent to always have a Decl.

[Artem Dergachev via cfe-commits]

Author: Artem Dergachev
Date: 2020-04-20T15:31:43+03:00
New Revision: 878194414107e94600de31a11be09a347fb2598b

URL: https://github.com/llvm/llvm-project/commit/878194414107e94600de31a11be09a347fb2598b
DIFF: https://github.com/llvm/llvm-project/commit/878194414107e94600de31a11be09a347fb2598b.diff

LOG: [analyzer] GenericTaint: Don't expect CallEvent to always have a Decl.

This isn't the case when the callee is completely unknown,
eg. when it is a symbolic function pointer.

Added: 
    

Modified: 
    clang/lib/StaticAnalyzer/Checkers/GenericTaintChecker.cpp
    clang/test/Analysis/taint-generic.c

Removed: 
    


################################################################################
diff  --git a/clang/lib/StaticAnalyzer/Checkers/GenericTaintChecker.cpp b/clang/lib/StaticAnalyzer/Checkers/GenericTaintChecker.cpp
index 1f3e74989229..c06d2fcd8e7d 100644
--- a/clang/lib/StaticAnalyzer/Checkers/GenericTaintChecker.cpp
+++ b/clang/lib/StaticAnalyzer/Checkers/GenericTaintChecker.cpp
@@ -110,7 +110,9 @@ class GenericTaintChecker : public Checker<check::PreCall, check::PostCall> {
 
     static Optional<FunctionData> create(const CallEvent &Call,
                                          const CheckerContext &C) {
-      assert(Call.getDecl());
+      if (!Call.getDecl())
+        return None;
+
       const FunctionDecl *FDecl = Call.getDecl()->getAsFunction();
       if (!FDecl || (FDecl->getKind() != Decl::Function &&
                      FDecl->getKind() != Decl::CXXMethod))

diff  --git a/clang/test/Analysis/taint-generic.c b/clang/test/Analysis/taint-generic.c
index a299501b1068..1cc1913eb9a8 100644
--- a/clang/test/Analysis/taint-generic.c
+++ b/clang/test/Analysis/taint-generic.c
@@ -390,3 +390,7 @@ void testConfigurationSinks() {
   mySink(1, 2, x);
   // expected-warning at -1 {{Untrusted data is passed to a user-defined sink}}
 }
+
+void testUnknownFunction(void (*foo)(void)) {
+  foo(); // no-crash
+}