[clang] [analyzer] Fix crash on dereference invalid return value of getAdjustedParameterIndex() (PR #83585)
via cfe-commits
cfe-commits at lists.llvm.org
Tue Mar 5 07:24:20 PST 2024
https://github.com/mzyKi updated https://github.com/llvm/llvm-project/pull/83585
>From 6a9f7a996c127462fa787a2626bc0676d4e04ff3 Mon Sep 17 00:00:00 2001
From: miaozhiyuan <miaozhiyuan at feysh.com>
Date: Fri, 1 Mar 2024 22:45:20 +0800
Subject: [PATCH 1/2] [clang][ExprEngineCXX] Fix crash on dereference invalid
return value of getAdjustedParameterIndex()
---
clang/lib/StaticAnalyzer/Core/ExprEngineCXX.cpp | 9 +++++++--
.../Analysis/engine/expr-engine-cxx-crash.cpp | 15 +++++++++++++++
2 files changed, 22 insertions(+), 2 deletions(-)
create mode 100644 clang/test/Analysis/engine/expr-engine-cxx-crash.cpp
diff --git a/clang/lib/StaticAnalyzer/Core/ExprEngineCXX.cpp b/clang/lib/StaticAnalyzer/Core/ExprEngineCXX.cpp
index 504fd7f05e0f99..dc72945d68d56f 100644
--- a/clang/lib/StaticAnalyzer/Core/ExprEngineCXX.cpp
+++ b/clang/lib/StaticAnalyzer/Core/ExprEngineCXX.cpp
@@ -354,8 +354,13 @@ SVal ExprEngine::computeObjectUnderConstruction(
// Operator arguments do not correspond to operator parameters
// because this-argument is implemented as a normal argument in
// operator call expressions but not in operator declarations.
- const TypedValueRegion *TVR = Caller->getParameterLocation(
- *Caller->getAdjustedParameterIndex(Idx), BldrCtx->blockCount());
+ std::optional<unsigned int> Index =
+ Caller->getAdjustedParameterIndex(Idx);
+ if (!Index) {
+ return std::nullopt;
+ }
+ const TypedValueRegion *TVR =
+ Caller->getParameterLocation(*Index, BldrCtx->blockCount());
if (!TVR)
return std::nullopt;
diff --git a/clang/test/Analysis/engine/expr-engine-cxx-crash.cpp b/clang/test/Analysis/engine/expr-engine-cxx-crash.cpp
new file mode 100644
index 00000000000000..a7d2e32db6eb6a
--- /dev/null
+++ b/clang/test/Analysis/engine/expr-engine-cxx-crash.cpp
@@ -0,0 +1,15 @@
+// RUN: %clang_analyze_cc1 -analyzer-checker=core.DivideZero -std=c++23 -verify %s
+// expected-no-diagnostics
+
+struct S
+{
+ constexpr auto operator==(this auto, S)
+ {
+ return true;
+ }
+};
+
+int main()
+{
+ return S {} == S {};
+}
>From a0276047adc5697e6d6c6668b8545f55b1ff1e64 Mon Sep 17 00:00:00 2001
From: miaozhiyuan <miaozhiyuan at feysh.com>
Date: Tue, 5 Mar 2024 23:24:07 +0800
Subject: [PATCH 2/2] fix testcase and fix root reason about crash with
tomasz-kaminski-sonarsource's help
---
clang/lib/StaticAnalyzer/Core/CallEvent.cpp | 2 +-
.../lib/StaticAnalyzer/Core/ExprEngineCXX.cpp | 9 ++-------
.../Analysis/engine/expr-engine-cxx-crash.cpp | 18 +++++++-----------
3 files changed, 10 insertions(+), 19 deletions(-)
diff --git a/clang/lib/StaticAnalyzer/Core/CallEvent.cpp b/clang/lib/StaticAnalyzer/Core/CallEvent.cpp
index 0ac1d91b79beb5..bc14aea27f6736 100644
--- a/clang/lib/StaticAnalyzer/Core/CallEvent.cpp
+++ b/clang/lib/StaticAnalyzer/Core/CallEvent.cpp
@@ -1409,7 +1409,7 @@ CallEventManager::getSimpleCall(const CallExpr *CE, ProgramStateRef State,
if (const auto *OpCE = dyn_cast<CXXOperatorCallExpr>(CE)) {
const FunctionDecl *DirectCallee = OpCE->getDirectCallee();
if (const auto *MD = dyn_cast<CXXMethodDecl>(DirectCallee))
- if (MD->isInstance())
+ if (MD->isImplicitObjectMemberFunction())
return create<CXXMemberOperatorCall>(OpCE, State, LCtx, ElemRef);
} else if (CE->getCallee()->getType()->isBlockPointerType()) {
diff --git a/clang/lib/StaticAnalyzer/Core/ExprEngineCXX.cpp b/clang/lib/StaticAnalyzer/Core/ExprEngineCXX.cpp
index dc72945d68d56f..504fd7f05e0f99 100644
--- a/clang/lib/StaticAnalyzer/Core/ExprEngineCXX.cpp
+++ b/clang/lib/StaticAnalyzer/Core/ExprEngineCXX.cpp
@@ -354,13 +354,8 @@ SVal ExprEngine::computeObjectUnderConstruction(
// Operator arguments do not correspond to operator parameters
// because this-argument is implemented as a normal argument in
// operator call expressions but not in operator declarations.
- std::optional<unsigned int> Index =
- Caller->getAdjustedParameterIndex(Idx);
- if (!Index) {
- return std::nullopt;
- }
- const TypedValueRegion *TVR =
- Caller->getParameterLocation(*Index, BldrCtx->blockCount());
+ const TypedValueRegion *TVR = Caller->getParameterLocation(
+ *Caller->getAdjustedParameterIndex(Idx), BldrCtx->blockCount());
if (!TVR)
return std::nullopt;
diff --git a/clang/test/Analysis/engine/expr-engine-cxx-crash.cpp b/clang/test/Analysis/engine/expr-engine-cxx-crash.cpp
index a7d2e32db6eb6a..2dfeac8392266a 100644
--- a/clang/test/Analysis/engine/expr-engine-cxx-crash.cpp
+++ b/clang/test/Analysis/engine/expr-engine-cxx-crash.cpp
@@ -1,15 +1,11 @@
-// RUN: %clang_analyze_cc1 -analyzer-checker=core.DivideZero -std=c++23 -verify %s
+// RUN: %clang_analyze_cc1 -analyzer-checker=core -std=c++23 -verify %s
// expected-no-diagnostics
-struct S
-{
- constexpr auto operator==(this auto, S)
- {
- return true;
- }
+struct S {
+ bool operator==(this auto, S) {
+ return true;
+ }
};
-
-int main()
-{
- return S {} == S {};
+int use_deducing_this() {
+ return S{} == S{};
}
More information about the cfe-commits
mailing list