intel/llvm
1
0
Fork 0
mirror of https://github.com/intel/llvm.git synced 2026-01-25 19:44:38 +08:00
Code Issues Packages Projects Releases Wiki Activity

[analyzer] Move TaintBugVisitor from GenericTaintChecker.cpp to BugReporterVisitors.h.

Browse Source 
Summary: `TaintBugVisitor` is a universal visitor, and many checkers rely on it, such as `ArrayBoundCheckerV2.cpp`, `DivZeroChecker.cpp` and `VLASizeChecker.cpp`. Moving `TaintBugVisitor` to `BugReporterVisitors.h` enables other checker can also track where `tainted` value came from.

Reviewers: NoQ, george.karpenkov, xazax.hun

Reviewed By: george.karpenkov

Subscribers: szepet, rnkovacs, a.sidorin, cfe-commits, MTC

Differential Revision: https://reviews.llvm.org/D45682

llvm-svn: 330596
This commit is contained in:
Henry Wong
2018-04-23 14:41:17 +00:00
parent 6f33fca7ec
commit 29204c2dfa
3 changed files with 37 additions and 39 deletions
Download Patch File Download Diff File Expand all files Collapse all files

16
clang/include/clang/StaticAnalyzer/Core/BugReporter/BugReporterVisitors.h
View File

@@ -343,6 +343,22 @@ public:
BugReport &BR) override;
};
/// The bug visitor prints a diagnostic message at the location where a given
/// variable was tainted.
class TaintBugVisitor final : public BugReporterVisitorImpl<TaintBugVisitor> {
private:
const SVal V;
public:
TaintBugVisitor(const SVal V) : V(V) {}
void Profile(llvm::FoldingSetNodeID &ID) const override { ID.Add(V); }
std::shared_ptr<PathDiagnosticPiece> VisitNode(const ExplodedNode *N,
const ExplodedNode *PrevN,
BugReporterContext &BRC,
BugReport &BR) override;
};
namespace bugreporter {
/// Attempts to add visitors to trace a null or undefined value back to its

39
clang/lib/StaticAnalyzer/Checkers/GenericTaintChecker.cpp
View File

@@ -100,23 +100,6 @@ private:
bool generateReportIfTainted(const Expr *E, const char Msg[],
CheckerContext &C) const;
/// The bug visitor prints a diagnostic message at the location where a given
/// variable was tainted.
class TaintBugVisitor
: public BugReporterVisitorImpl<TaintBugVisitor> {
private:
const SVal V;
public:
TaintBugVisitor(const SVal V) : V(V) {}
void Profile(llvm::FoldingSetNodeID &ID) const override { ID.Add(V); }
std::shared_ptr<PathDiagnosticPiece> VisitNode(const ExplodedNode *N,
const ExplodedNode *PrevN,
BugReporterContext &BRC,
BugReport &BR) override;
};
typedef SmallVector<unsigned, 2> ArgVector;
/// \brief A struct used to specify taint propagation rules for a function.
@@ -214,28 +197,6 @@ const char GenericTaintChecker::MsgTaintedBufferSize[] =
/// points to data, which should be tainted on return.
REGISTER_SET_WITH_PROGRAMSTATE(TaintArgsOnPostVisit, unsigned)
std::shared_ptr<PathDiagnosticPiece>
GenericTaintChecker::TaintBugVisitor::VisitNode(const ExplodedNode *N,
const ExplodedNode *PrevN, BugReporterContext &BRC, BugReport &BR) {
// Find the ExplodedNode where the taint was first introduced
if (!N->getState()->isTainted(V) || PrevN->getState()->isTainted(V))
return nullptr;
const Stmt *S = PathDiagnosticLocation::getStmt(N);
if (!S)
return nullptr;
const LocationContext *NCtx = N->getLocationContext();
PathDiagnosticLocation L =
PathDiagnosticLocation::createBegin(S, BRC.getSourceManager(), NCtx);
if (!L.isValid() || !L.asLocation().isValid())
return nullptr;
return std::make_shared<PathDiagnosticEventPiece>(
L, "Taint originated here");
}
GenericTaintChecker::TaintPropagationRule
GenericTaintChecker::TaintPropagationRule::getTaintPropagationRule(
const FunctionDecl *FDecl,

21
clang/lib/StaticAnalyzer/Core/BugReporterVisitors.cpp
View File

@@ -2333,3 +2333,24 @@ CXXSelfAssignmentBRVisitor::VisitNode(const ExplodedNode *Succ,
return std::move(Piece);
}
std::shared_ptr<PathDiagnosticPiece>
TaintBugVisitor::VisitNode(const ExplodedNode *N, const ExplodedNode *PrevN,
BugReporterContext &BRC, BugReport &BR) {
// Find the ExplodedNode where the taint was first introduced
if (!N->getState()->isTainted(V) || PrevN->getState()->isTainted(V))
return nullptr;
const Stmt *S = PathDiagnosticLocation::getStmt(N);
if (!S)
return nullptr;
const LocationContext *NCtx = N->getLocationContext();
PathDiagnosticLocation L =
PathDiagnosticLocation::createBegin(S, BRC.getSourceManager(), NCtx);
if (!L.isValid() || !L.asLocation().isValid())
return nullptr;
return std::make_shared<PathDiagnosticEventPiece>(L, "Taint originated here");
}