[llvm-bugs] [Bug 37142] New: UBSan failure (signed integer overflow) in clang::ento::ElementRegion::getAsArrayOffset()

[via llvm-bugs]

https://bugs.llvm.org/show_bug.cgi?id=37142

            Bug ID: 37142
           Summary: UBSan failure (signed integer overflow) in
                    clang::ento::ElementRegion::getAsArrayOffset()
           Product: clang
           Version: unspecified
          Hardware: PC
                OS: All
            Status: NEW
          Severity: enhancement
          Priority: P
         Component: Static Analyzer
          Assignee: dcoughlin at apple.com
          Reporter: alexfh at google.com
                CC: llvm-bugs at lists.llvm.org

$ cat test-ElementRegion__getAsArrayOffset.cc
void c(long long *d) {
  long e, f;
  e = f = d[1];
  for (; d[e];) f-- > 0;
}
$ ./clang-tidy -checks=-*,clang-analyzer*
test-ElementRegion__getAsArrayOffset.cc -- -std=c++11
include/clang/AST/CharUnits.h:143:35: runtime error: signed integer overflow: 8
* -9223372036854775808 cannot be represented in type 'long'
    #0 in operator* include/clang/AST/CharUnits.h:143:35
    #1 in operator* include/clang/AST/CharUnits.h:210
    #2 in clang::ento::ElementRegion::getAsArrayOffset() const
lib/StaticAnalyzer/Core/MemRegion.cpp:1253
    #3 in (anonymous
namespace)::RegionStoreManager::getBindingForElement((anonymous
namespace)::RegionBindingsRef const&, clang::ento::ElementRegion const*)
lib/StaticAnalyzer/Core/RegionStore.cpp:1644:33
    #4 in (anonymous namespace)::RegionStoreManager::getBinding((anonymous
namespace)::RegionBindingsRef const&, clang::ento::Loc, clang::QualType)
lib/StaticAnalyzer/Core/RegionStore.cpp:1457:29
    #5 in (anonymous namespace)::RegionStoreManager::getBinding(void const*,
clang::ento::Loc, clang::QualType)
lib/StaticAnalyzer/Core/RegionStore.cpp:509:12
    #6 in getRawSVal
include/clang/StaticAnalyzer/Core/PathSensitive/ProgramState.h:770:38
    #7 in clang::ento::ProgramState::getSVal(clang::ento::Loc, clang::QualType)
const lib/StaticAnalyzer/Core/ProgramState.cpp:258
    #8 in
clang::ento::ExprEngine::evalLoadCommon(clang::ento::ExplodedNodeSet&,
clang::Expr const*, clang::Expr const*, clang::ento::ExplodedNode*,
llvm::IntrusiveRefCntPtr<clang::ento::Pr
ogramState const>, clang::ento::SVal, clang::ProgramPointTag const*,
clang::QualType) lib/StaticAnalyzer/Core/ExprEngine.cpp:2967:18
    #9 in clang::ento::ExprEngine::evalLoad(clang::ento::ExplodedNodeSet&,
clang::Expr const*, clang::Expr const*, clang::ento::ExplodedNode*,
llvm::IntrusiveRefCntPtr<clang::ento::ProgramS
tate const>, clang::ento::SVal, clang::ProgramPointTag const*, clang::QualType)
lib/StaticAnalyzer/Core/ExprEngine.cpp:2935:3
    #10 in clang::ento::ExprEngine::VisitCast(clang::CastExpr const*,
clang::Expr const*, clang::ento::ExplodedNode*, clang::ento::ExplodedNodeSet&)
lib/StaticAnalyzer/Core/ExprEngineC.cpp:300:7
    #11 in clang::ento::ExprEngine::Visit(clang::Stmt const*,
clang::ento::ExplodedNode*, clang::ento::ExplodedNodeSet&)
lib/StaticAnalyzer/Core/ExprEngine.cpp:1756:7
    #12 in clang::ento::ExprEngine::ProcessStmt(clang::Stmt const*,
clang::ento::ExplodedNode*) lib/StaticAnalyzer/Core/ExprEngine.cpp:868:5
    #13 in clang::ento::ExprEngine::processCFGElement(clang::CFGElement,
clang::ento::ExplodedNode*, unsigned int, clang::ento::NodeBuilderContext*)
lib/StaticAnalyzer/Core/ExprEngine.cpp:698:7
    #14 in clang::ento::CoreEngine::HandlePostStmt(clang::CFGBlock const*,
unsigned int, clang::ento::ExplodedNode*)
lib/StaticAnalyzer/Core/CoreEngine.cpp:433:12
    #15 in
clang::ento::CoreEngine::dispatchWorkItem(clang::ento::ExplodedNode*,
clang::ProgramPoint, clang::ento::WorkListUnit const&)
lib/StaticAnalyzer/Core/CoreEngine.cpp:191:7
    #16 in clang::ento::CoreEngine::ExecuteWorkList(clang::LocationContext
const*, unsigned int, llvm::IntrusiveRefCntPtr<clang::ento::ProgramState
const>) lib/StaticAnalyzer/Core/CoreEngine.cpp:147:5
    #17 in ExecuteWorkList
include/clang/StaticAnalyzer/Core/PathSensitive/ExprEngine.h:168:19
    #18 in (anonymous
namespace)::AnalysisConsumer::ActionExprEngine(clang::Decl*, bool,
clang::ento::ExprEngine::InliningModes, llvm::DenseSet<clang::Decl const*,
llvm::DenseMapInfo<clang:
:Decl const*> >*) lib/StaticAnalyzer/Frontend/AnalysisConsumer.cpp:748
    #19 in (anonymous namespace)::AnalysisConsumer::HandleCode(clang::Decl*,
unsigned int, clang::ento::ExprEngine::InliningModes,
llvm::DenseSet<clang::Decl const*, llvm::DenseMapInfo<clan
g::Decl const*> >*) lib/StaticAnalyzer/Frontend/AnalysisConsumer.cpp
    #20 in HandleDeclsCallGraph
lib/StaticAnalyzer/Frontend/AnalysisConsumer.cpp:506:5
    #21 in runAnalysisOnTranslationUnit
lib/StaticAnalyzer/Frontend/AnalysisConsumer.cpp:553

-- 
You are receiving this mail because:
You are on the CC list for the bug.
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://lists.llvm.org/pipermail/llvm-bugs/attachments/20180416/42995754/attachment-0001.html>