[clang] [clang][analyzer] Fix for `security.ArrayBound` assertion failure on incomplete types (PR #231925)

[via cfe-commits]

llvmorg-github-actions[bot] wrote:


<!--LLVM PR SUMMARY COMMENT-->

@llvm/pr-subscribers-clang

Author: Matthew (matthew-j-code)

<details>
<summary>Changes</summary>

When the check clang-analyzer-security.ArrayBound is enabled, for a forward declaration, or any incomplete types, it tries to calculate the offset, which is unknown, therefore can not be calculated, causing the assertion ElemType cannot be incomplete.

---
Full diff: https://github.com/llvm/llvm-project/pull/231925.diff


3 Files Affected:

- (modified) clang/docs/ReleaseNotes.md (+2) 
- (modified) clang/lib/StaticAnalyzer/Checkers/ArrayBoundChecker.cpp (+6) 
- (modified) clang/test/Analysis/ArrayBound/cplusplus.cpp (+8) 


``````````diff
diff --git a/clang/docs/ReleaseNotes.md b/clang/docs/ReleaseNotes.md
index 1dc1764978ea27..32281e5ad67508 100644
--- a/clang/docs/ReleaseNotes.md
+++ b/clang/docs/ReleaseNotes.md
@@ -1188,6 +1188,8 @@ features cannot lower the translation-unit ABI level;
 %   - Moved checkers
 %   - Diagnostic changes
 
+- Fixed an assertion failure in the `alpha.security.ArrayBound` checker when analyzing incomplete types.
+
 #### Improvements
 
 - The lock-order-reversal check in ``alpha.unix.PthreadLock`` is now disabled by default.
diff --git a/clang/lib/StaticAnalyzer/Checkers/ArrayBoundChecker.cpp b/clang/lib/StaticAnalyzer/Checkers/ArrayBoundChecker.cpp
index 3acbf7cd75ab88..e75d43801864a1 100644
--- a/clang/lib/StaticAnalyzer/Checkers/ArrayBoundChecker.cpp
+++ b/clang/lib/StaticAnalyzer/Checkers/ArrayBoundChecker.cpp
@@ -230,6 +230,12 @@ computeOffset(ProgramStateRef State, SValBuilder &SVB,
     if (!Index)
       return std::nullopt;
 
+    // The size of an incomplete type (e.g forward declaration) is unknown, so
+    // the offset cannot be calculated.
+    QualType ElemType = CurRegion->getElementType();
+    if (ElemType->isIncompleteType())
+      return std::nullopt;
+
     // Calculate Delta = Index * sizeof(ElemType).
     NonLoc Size = SVB.makeArrayIndex(getElementSize(CurRegion, SVB));
     auto Delta = EvalBinOp(BO_Mul, *Index, Size);
diff --git a/clang/test/Analysis/ArrayBound/cplusplus.cpp b/clang/test/Analysis/ArrayBound/cplusplus.cpp
index 680fbf4817c301..457da1f15307ea 100644
--- a/clang/test/Analysis/ArrayBound/cplusplus.cpp
+++ b/clang/test/Analysis/ArrayBound/cplusplus.cpp
@@ -179,3 +179,11 @@ int test_reference_that_might_be_after_the_end(int idx) {
     return -1;
   return ref;
 }
+
+//The size of an incomplete type (e.g., a forward declaration) is unknown, so you cannot calculate the offset.
+struct Incomplete;
+void useIncomplete(Incomplete &);
+
+void test_incomplete(void *p) {
+  useIncomplete(*static_cast<Incomplete *>(p));
+}

``````````

</details>


https://github.com/llvm/llvm-project/pull/231925