10b57cec5SDimitry Andric //== BoolAssignmentChecker.cpp - Boolean assignment checker -----*- C++ -*--==//
20b57cec5SDimitry Andric //
30b57cec5SDimitry Andric // Part of the LLVM Project, under the Apache License v2.0 with LLVM Exceptions.
40b57cec5SDimitry Andric // See https://llvm.org/LICENSE.txt for license information.
50b57cec5SDimitry Andric // SPDX-License-Identifier: Apache-2.0 WITH LLVM-exception
60b57cec5SDimitry Andric //
70b57cec5SDimitry Andric //===----------------------------------------------------------------------===//
80b57cec5SDimitry Andric //
90b57cec5SDimitry Andric // This defines BoolAssignmentChecker, a builtin check in ExprEngine that
100b57cec5SDimitry Andric // performs checks for assignment of non-Boolean values to Boolean variables.
110b57cec5SDimitry Andric //
120b57cec5SDimitry Andric //===----------------------------------------------------------------------===//
130b57cec5SDimitry Andric
140b57cec5SDimitry Andric #include "clang/StaticAnalyzer/Checkers/BuiltinCheckerRegistration.h"
1581ad6265SDimitry Andric #include "clang/StaticAnalyzer/Checkers/Taint.h"
160b57cec5SDimitry Andric #include "clang/StaticAnalyzer/Core/BugReporter/BugType.h"
170b57cec5SDimitry Andric #include "clang/StaticAnalyzer/Core/Checker.h"
180b57cec5SDimitry Andric #include "clang/StaticAnalyzer/Core/CheckerManager.h"
190b57cec5SDimitry Andric #include "clang/StaticAnalyzer/Core/PathSensitive/CheckerContext.h"
20bdd1243dSDimitry Andric #include <optional>
210b57cec5SDimitry Andric
220b57cec5SDimitry Andric using namespace clang;
230b57cec5SDimitry Andric using namespace ento;
240b57cec5SDimitry Andric
250b57cec5SDimitry Andric namespace {
260b57cec5SDimitry Andric class BoolAssignmentChecker : public Checker< check::Bind > {
27647cbc5dSDimitry Andric const BugType BT{this, "Assignment of a non-Boolean value"};
2881ad6265SDimitry Andric void emitReport(ProgramStateRef state, CheckerContext &C,
2981ad6265SDimitry Andric bool IsTainted = false) const;
3081ad6265SDimitry Andric
310b57cec5SDimitry Andric public:
320b57cec5SDimitry Andric void checkBind(SVal loc, SVal val, const Stmt *S, CheckerContext &C) const;
330b57cec5SDimitry Andric };
340b57cec5SDimitry Andric } // end anonymous namespace
350b57cec5SDimitry Andric
emitReport(ProgramStateRef state,CheckerContext & C,bool IsTainted) const3681ad6265SDimitry Andric void BoolAssignmentChecker::emitReport(ProgramStateRef state, CheckerContext &C,
3781ad6265SDimitry Andric bool IsTainted) const {
380b57cec5SDimitry Andric if (ExplodedNode *N = C.generateNonFatalErrorNode(state)) {
3981ad6265SDimitry Andric StringRef Msg = IsTainted ? "Might assign a tainted non-Boolean value"
4081ad6265SDimitry Andric : "Assignment of a non-Boolean value";
41647cbc5dSDimitry Andric C.emitReport(std::make_unique<PathSensitiveBugReport>(BT, Msg, N));
420b57cec5SDimitry Andric }
430b57cec5SDimitry Andric }
440b57cec5SDimitry Andric
isBooleanType(QualType Ty)450b57cec5SDimitry Andric static bool isBooleanType(QualType Ty) {
460b57cec5SDimitry Andric if (Ty->isBooleanType()) // C++ or C99
470b57cec5SDimitry Andric return true;
480b57cec5SDimitry Andric
490b57cec5SDimitry Andric if (const TypedefType *TT = Ty->getAs<TypedefType>())
500b57cec5SDimitry Andric return TT->getDecl()->getName() == "BOOL" || // Objective-C
510b57cec5SDimitry Andric TT->getDecl()->getName() == "_Bool" || // stdbool.h < C99
520b57cec5SDimitry Andric TT->getDecl()->getName() == "Boolean"; // MacTypes.h
530b57cec5SDimitry Andric
540b57cec5SDimitry Andric return false;
550b57cec5SDimitry Andric }
560b57cec5SDimitry Andric
checkBind(SVal loc,SVal val,const Stmt * S,CheckerContext & C) const570b57cec5SDimitry Andric void BoolAssignmentChecker::checkBind(SVal loc, SVal val, const Stmt *S,
580b57cec5SDimitry Andric CheckerContext &C) const {
590b57cec5SDimitry Andric
600b57cec5SDimitry Andric // We are only interested in stores into Booleans.
610b57cec5SDimitry Andric const TypedValueRegion *TR =
620b57cec5SDimitry Andric dyn_cast_or_null<TypedValueRegion>(loc.getAsRegion());
630b57cec5SDimitry Andric
640b57cec5SDimitry Andric if (!TR)
650b57cec5SDimitry Andric return;
660b57cec5SDimitry Andric
670b57cec5SDimitry Andric QualType valTy = TR->getValueType();
680b57cec5SDimitry Andric
690b57cec5SDimitry Andric if (!isBooleanType(valTy))
700b57cec5SDimitry Andric return;
710b57cec5SDimitry Andric
720b57cec5SDimitry Andric // Get the value of the right-hand side. We only care about values
730b57cec5SDimitry Andric // that are defined (UnknownVals and UndefinedVals are handled by other
740b57cec5SDimitry Andric // checkers).
75bdd1243dSDimitry Andric std::optional<NonLoc> NV = val.getAs<NonLoc>();
765ffd83dbSDimitry Andric if (!NV)
770b57cec5SDimitry Andric return;
780b57cec5SDimitry Andric
790b57cec5SDimitry Andric // Check if the assigned value meets our criteria for correctness. It must
800b57cec5SDimitry Andric // be a value that is either 0 or 1. One way to check this is to see if
810b57cec5SDimitry Andric // the value is possibly < 0 (for a negative value) or greater than 1.
820b57cec5SDimitry Andric ProgramStateRef state = C.getState();
830b57cec5SDimitry Andric SValBuilder &svalBuilder = C.getSValBuilder();
845ffd83dbSDimitry Andric BasicValueFactory &BVF = svalBuilder.getBasicValueFactory();
850b57cec5SDimitry Andric ConstraintManager &CM = C.getConstraintManager();
860b57cec5SDimitry Andric
875ffd83dbSDimitry Andric llvm::APSInt Zero = BVF.getValue(0, valTy);
885ffd83dbSDimitry Andric llvm::APSInt One = BVF.getValue(1, valTy);
890b57cec5SDimitry Andric
905ffd83dbSDimitry Andric ProgramStateRef StIn, StOut;
915ffd83dbSDimitry Andric std::tie(StIn, StOut) = CM.assumeInclusiveRangeDual(state, *NV, Zero, One);
920b57cec5SDimitry Andric
935ffd83dbSDimitry Andric if (!StIn)
945ffd83dbSDimitry Andric emitReport(StOut, C);
9581ad6265SDimitry Andric if (StIn && StOut && taint::isTainted(state, *NV))
9681ad6265SDimitry Andric emitReport(StOut, C, /*IsTainted=*/true);
970b57cec5SDimitry Andric }
980b57cec5SDimitry Andric
registerBoolAssignmentChecker(CheckerManager & mgr)990b57cec5SDimitry Andric void ento::registerBoolAssignmentChecker(CheckerManager &mgr) {
1000b57cec5SDimitry Andric mgr.registerChecker<BoolAssignmentChecker>();
1010b57cec5SDimitry Andric }
1020b57cec5SDimitry Andric
shouldRegisterBoolAssignmentChecker(const CheckerManager & mgr)1035ffd83dbSDimitry Andric bool ento::shouldRegisterBoolAssignmentChecker(const CheckerManager &mgr) {
1040b57cec5SDimitry Andric return true;
1050b57cec5SDimitry Andric }
106