[cfe-dev] [analyzer] Modeling a function with an out parameter pointer in check::PostCall

[via cfe-dev]

Hi list,

I am writing a static analyzer checker and trying to model a function of
the following type in check::PostCall:

void func(bool* outParam) {
    assert(outParam);
    *outParam = true;
}

(in real life there are some other inputs that determine the value stored
in the out parameter, and a return value indicating whether there was an
error, but let's use this for the sake of a simple example)

Suppose I want my PostCall callback to store "true" in *outParam. Is this
possible to achieve with ProgramState::BindExpr or ProgramState::bindLoc?
How do I get the SVal for the memory pointed to by CallEvent::getArgSVal(0)?

I thought of "synthesizing" a UnaryOperator expression using UO_Deref on
CallEvent::getArgExpr(0) and passing that to ProgramState::BindExpr, but it
seems that getArgExpr returns a const Expr* and a non-const one is required
to construct a UnaryOperator expression.

Best regards,
-- 
Philip
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://lists.llvm.org/pipermail/cfe-dev/attachments/20200613/f7f344fd/attachment.html>