[clang] [analyzer][NFC] Add ArrayBoundV2 testcase to document bad cast modeling (PR #108799)

DonĂ¡t Nagy via cfe-commits cfe-commits at lists.llvm.org
Mon Sep 16 00:27:41 PDT 2024


https://github.com/NagyDonat created https://github.com/llvm/llvm-project/pull/108799

Add a FIXME testcase which documents less than ideal behavior of the analyzer when a `const char *` is converted to `const unsigned char *`. This testcase is motivated by an ArrayBoundV2 report produced on the source file `id3v2enc.c` within the ffmpeg project.

>From 728c3c9d8c0575acb144fb067736ab01873eb16e Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Don=C3=A1t=20Nagy?= <donat.nagy at ericsson.com>
Date: Mon, 16 Sep 2024 09:20:25 +0200
Subject: [PATCH] [analyzer][NFC] Add a testcase documenting a borderline FP
 report

Add a FIXME testcase which documents less than ideal behavior of the
analyzer when a `const char *` is converted to `const unsigned char *`.
This testcase is motivated by an ArrayBoundV2 report produced on the
source file `id3v2enc.c` within the ffmpeg project.
---
 clang/test/Analysis/out-of-bounds.c | 18 +++++++++++++++++-
 1 file changed, 17 insertions(+), 1 deletion(-)

diff --git a/clang/test/Analysis/out-of-bounds.c b/clang/test/Analysis/out-of-bounds.c
index 1f771c2b3bd138..9b9cc368af94dc 100644
--- a/clang/test/Analysis/out-of-bounds.c
+++ b/clang/test/Analysis/out-of-bounds.c
@@ -1,4 +1,4 @@
-// RUN: %clang_analyze_cc1 -Wno-array-bounds -analyzer-checker=core,alpha.security.ArrayBoundV2,debug.ExprInspection -verify %s
+// RUN: %clang_analyze_cc1 -Wno-array-bounds -Wno-pointer-sign -analyzer-checker=core,alpha.security.ArrayBoundV2,debug.ExprInspection -verify %s
 
 void clang_analyzer_eval(int);
 
@@ -194,3 +194,19 @@ char test_comparison_with_extent_symbol(struct incomplete *p) {
   return ((char *)p)[-1]; // no-warning
 }
 
+
+typedef unsigned char uint8_t;
+static int string_is_ascii(const uint8_t *str) {
+  while (*str && *str < 128) str++;
+  // expected-warning at -1 {{Out of bound access to memory}}
+  return !*str;
+}
+void test_charptr_ucharptr_conversion(void) {
+  const char *s = "";
+  // NOTE: This code passes a `const char *` to a `const unsigned char *`
+  // parameter, which is a bit dodgy (it would be reported by -Wpointer-sign),
+  // but works on platforms where `char` is unsigned.
+  // FIXME: The analyzer is confused by this conversion and cannot deduce that
+  // `*str` is immediately equal to zero within `string_is_ascii()`.
+  string_is_ascii(s);
+}



More information about the cfe-commits mailing list