[cfe-dev] [analyzer] Modeling a function with an out parameter pointer in check::PostCall

via cfe-dev cfe-dev at lists.llvm.org
Sat Jun 13 14:05:19 PDT 2020

Hi list,

I am writing a static analyzer checker and trying to model a function of
the following type in check::PostCall:

void func(bool* outParam) {
    *outParam = true;

(in real life there are some other inputs that determine the value stored
in the out parameter, and a return value indicating whether there was an
error, but let's use this for the sake of a simple example)

Suppose I want my PostCall callback to store "true" in *outParam. Is this
possible to achieve with ProgramState::BindExpr or ProgramState::bindLoc?
How do I get the SVal for the memory pointed to by CallEvent::getArgSVal(0)?

I thought of "synthesizing" a UnaryOperator expression using UO_Deref on
CallEvent::getArgExpr(0) and passing that to ProgramState::BindExpr, but it
seems that getArgExpr returns a const Expr* and a non-const one is required
to construct a UnaryOperator expression.

Best regards,
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://lists.llvm.org/pipermail/cfe-dev/attachments/20200613/f7f344fd/attachment.html>

More information about the cfe-dev mailing list