1 //===- EnumCastOutOfRangeChecker.cpp ---------------------------*- C++ -*--===//
2 //
3 // Part of the LLVM Project, under the Apache License v2.0 with LLVM Exceptions.
4 // See https://llvm.org/LICENSE.txt for license information.
5 // SPDX-License-Identifier: Apache-2.0 WITH LLVM-exception
6 //
7 //===----------------------------------------------------------------------===//
8 //
9 // The EnumCastOutOfRangeChecker is responsible for checking integer to
10 // enumeration casts that could result in undefined values. This could happen
11 // if the value that we cast from is out of the value range of the enumeration.
12 // Reference:
13 // [ISO/IEC 14882-2014] ISO/IEC 14882-2014.
14 //   Programming Languages — C++, Fourth Edition. 2014.
15 // C++ Standard, [dcl.enum], in paragraph 8, which defines the range of an enum
16 // C++ Standard, [expr.static.cast], paragraph 10, which defines the behaviour
17 //   of casting an integer value that is out of range
18 // SEI CERT C++ Coding Standard, INT50-CPP. Do not cast to an out-of-range
19 //   enumeration value
20 //===----------------------------------------------------------------------===//
21 
22 #include "clang/StaticAnalyzer/Checkers/BuiltinCheckerRegistration.h"
23 #include "clang/StaticAnalyzer/Core/BugReporter/BugType.h"
24 #include "clang/StaticAnalyzer/Core/PathSensitive/CheckerContext.h"
25 #include <optional>
26 
27 using namespace clang;
28 using namespace ento;
29 
30 namespace {
31 // This evaluator checks two SVals for equality. The first SVal is provided via
32 // the constructor, the second is the parameter of the overloaded () operator.
33 // It uses the in-built ConstraintManager to resolve the equlity to possible or
34 // not possible ProgramStates.
35 class ConstraintBasedEQEvaluator {
36   const DefinedOrUnknownSVal CompareValue;
37   const ProgramStateRef PS;
38   SValBuilder &SVB;
39 
40 public:
41   ConstraintBasedEQEvaluator(CheckerContext &C,
42                              const DefinedOrUnknownSVal CompareValue)
43       : CompareValue(CompareValue), PS(C.getState()), SVB(C.getSValBuilder()) {}
44 
45   bool operator()(const llvm::APSInt &EnumDeclInitValue) {
46     DefinedOrUnknownSVal EnumDeclValue = SVB.makeIntVal(EnumDeclInitValue);
47     DefinedOrUnknownSVal ElemEqualsValueToCast =
48         SVB.evalEQ(PS, EnumDeclValue, CompareValue);
49 
50     return static_cast<bool>(PS->assume(ElemEqualsValueToCast, true));
51   }
52 };
53 
54 // This checker checks CastExpr statements.
55 // If the value provided to the cast is one of the values the enumeration can
56 // represent, the said value matches the enumeration. If the checker can
57 // establish the impossibility of matching it gives a warning.
58 // Being conservative, it does not warn if there is slight possibility the
59 // value can be matching.
60 class EnumCastOutOfRangeChecker : public Checker<check::PreStmt<CastExpr>> {
61   mutable std::unique_ptr<BuiltinBug> EnumValueCastOutOfRange;
62   void reportWarning(CheckerContext &C) const;
63 
64 public:
65   void checkPreStmt(const CastExpr *CE, CheckerContext &C) const;
66 };
67 
68 using EnumValueVector = llvm::SmallVector<llvm::APSInt, 6>;
69 
70 // Collects all of the values an enum can represent (as SVals).
71 EnumValueVector getDeclValuesForEnum(const EnumDecl *ED) {
72   EnumValueVector DeclValues(
73       std::distance(ED->enumerator_begin(), ED->enumerator_end()));
74   llvm::transform(ED->enumerators(), DeclValues.begin(),
75                  [](const EnumConstantDecl *D) { return D->getInitVal(); });
76   return DeclValues;
77 }
78 } // namespace
79 
80 void EnumCastOutOfRangeChecker::reportWarning(CheckerContext &C) const {
81   if (const ExplodedNode *N = C.generateNonFatalErrorNode()) {
82     if (!EnumValueCastOutOfRange)
83       EnumValueCastOutOfRange.reset(
84           new BuiltinBug(this, "Enum cast out of range",
85                          "The value provided to the cast expression is not in "
86                          "the valid range of values for the enum"));
87     C.emitReport(std::make_unique<PathSensitiveBugReport>(
88         *EnumValueCastOutOfRange, EnumValueCastOutOfRange->getDescription(),
89         N));
90   }
91 }
92 
93 void EnumCastOutOfRangeChecker::checkPreStmt(const CastExpr *CE,
94                                              CheckerContext &C) const {
95 
96   // Only perform enum range check on casts where such checks are valid.  For
97   // all other cast kinds (where enum range checks are unnecessary or invalid),
98   // just return immediately.  TODO: The set of casts allowed for enum range
99   // checking may be incomplete.  Better to add a missing cast kind to enable a
100   // missing check than to generate false negatives and have to remove those
101   // later.
102   switch (CE->getCastKind()) {
103   case CK_IntegralCast:
104     break;
105 
106   default:
107     return;
108     break;
109   }
110 
111   // Get the value of the expression to cast.
112   const std::optional<DefinedOrUnknownSVal> ValueToCast =
113       C.getSVal(CE->getSubExpr()).getAs<DefinedOrUnknownSVal>();
114 
115   // If the value cannot be reasoned about (not even a DefinedOrUnknownSVal),
116   // don't analyze further.
117   if (!ValueToCast)
118     return;
119 
120   const QualType T = CE->getType();
121   // Check whether the cast type is an enum.
122   if (!T->isEnumeralType())
123     return;
124 
125   // If the cast is an enum, get its declaration.
126   // If the isEnumeralType() returned true, then the declaration must exist
127   // even if it is a stub declaration. It is up to the getDeclValuesForEnum()
128   // function to handle this.
129   const EnumDecl *ED = T->castAs<EnumType>()->getDecl();
130 
131   EnumValueVector DeclValues = getDeclValuesForEnum(ED);
132   // Check if any of the enum values possibly match.
133   bool PossibleValueMatch = llvm::any_of(
134       DeclValues, ConstraintBasedEQEvaluator(C, *ValueToCast));
135 
136   // If there is no value that can possibly match any of the enum values, then
137   // warn.
138   if (!PossibleValueMatch)
139     reportWarning(C);
140 }
141 
142 void ento::registerEnumCastOutOfRangeChecker(CheckerManager &mgr) {
143   mgr.registerChecker<EnumCastOutOfRangeChecker>();
144 }
145 
146 bool ento::shouldRegisterEnumCastOutOfRangeChecker(const CheckerManager &mgr) {
147   return true;
148 }
149