clang/lib/StaticAnalyzer/Checkers/DivZeroChecker.cpp

   1 //== DivZeroChecker.cpp - Division by zero checker --------------*- C++ -*--==//
   2 //
   3 // Part of the LLVM Project, under the Apache License v2.0 with LLVM Exceptions.
   4 // See https://llvm.org/LICENSE.txt for license information.
   5 // SPDX-License-Identifier: Apache-2.0 WITH LLVM-exception
   6 //
   7 //===----------------------------------------------------------------------===//
   8 //
   9 // This defines DivZeroChecker, a builtin check in ExprEngine that performs
  10 // checks for division by zeros.
  11 //
  12 //===----------------------------------------------------------------------===//
  13
  14 #include "clang/StaticAnalyzer/Checkers/BuiltinCheckerRegistration.h"
  15 #include "clang/StaticAnalyzer/Checkers/Taint.h"
  16 #include "clang/StaticAnalyzer/Core/BugReporter/BugType.h"
  17 #include "clang/StaticAnalyzer/Core/Checker.h"
  18 #include "clang/StaticAnalyzer/Core/CheckerManager.h"
  19 #include "clang/StaticAnalyzer/Core/PathSensitive/CheckerContext.h"
  20 #include <optional>
  21
  22 using namespace clang;
  23 using namespace ento;
  24 using namespace taint;
  25
  26 namespace {
  27 class DivZeroChecker : public Checker< check::PreStmt<BinaryOperator> > {
  28   mutable std::unique_ptr<BugType> BT;
  29   mutable std::unique_ptr<BugType> TaintBT;
  30   void reportBug(StringRef Msg, ProgramStateRef StateZero,
  31                  CheckerContext &C) const;
  32   void reportTaintBug(StringRef Msg, ProgramStateRef StateZero,
  33                       CheckerContext &C,
  34                       llvm::ArrayRef<SymbolRef> TaintedSyms) const;
  35
  36 public:
  37   void checkPreStmt(const BinaryOperator *B, CheckerContext &C) const;
  38 };
  39 } // end anonymous namespace
  40
  41 static const Expr *getDenomExpr(const ExplodedNode *N) {
  42   const Stmt *S = N->getLocationAs<PreStmt>()->getStmt();
  43   if (const auto *BE = dyn_cast<BinaryOperator>(S))
  44     return BE->getRHS();
  45   return nullptr;
  46 }
  47
  48 void DivZeroChecker::reportBug(StringRef Msg, ProgramStateRef StateZero,
  49                                CheckerContext &C) const {
  50   if (ExplodedNode *N = C.generateErrorNode(StateZero)) {
  51     if (!BT)
  52       BT.reset(new BugType(this, "Division by zero", categories::LogicError));
  53
  54     auto R = std::make_unique<PathSensitiveBugReport>(*BT, Msg, N);
  55     bugreporter::trackExpressionValue(N, getDenomExpr(N), *R);
  56     C.emitReport(std::move(R));
  57   }
  58 }
  59
  60 void DivZeroChecker::reportTaintBug(
  61     StringRef Msg, ProgramStateRef StateZero, CheckerContext &C,
  62     llvm::ArrayRef<SymbolRef> TaintedSyms) const {
  63   if (ExplodedNode *N = C.generateErrorNode(StateZero)) {
  64     if (!TaintBT)
  65       TaintBT.reset(
  66           new BugType(this, "Division by zero", categories::TaintedData));
  67
  68     auto R = std::make_unique<PathSensitiveBugReport>(*TaintBT, Msg, N);
  69     bugreporter::trackExpressionValue(N, getDenomExpr(N), *R);
  70     for (auto Sym : TaintedSyms)
  71       R->markInteresting(Sym);
  72     C.emitReport(std::move(R));
  73   }
  74 }
  75
  76 void DivZeroChecker::checkPreStmt(const BinaryOperator *B,
  77                                   CheckerContext &C) const {
  78   BinaryOperator::Opcode Op = B->getOpcode();
  79   if (Op != BO_Div &&
  80       Op != BO_Rem &&
  81       Op != BO_DivAssign &&
  82       Op != BO_RemAssign)
  83     return;
  84
  85   if (!B->getRHS()->getType()->isScalarType())
  86     return;
  87
  88   SVal Denom = C.getSVal(B->getRHS());
  89   std::optional<DefinedSVal> DV = Denom.getAs<DefinedSVal>();
  90
  91   // Divide-by-undefined handled in the generic checking for uses of
  92   // undefined values.
  93   if (!DV)
  94     return;
  95
  96   // Check for divide by zero.
  97   ConstraintManager &CM = C.getConstraintManager();
  98   ProgramStateRef stateNotZero, stateZero;
  99   std::tie(stateNotZero, stateZero) = CM.assumeDual(C.getState(), *DV);
 100
 101   if (!stateNotZero) {
 102     assert(stateZero);
 103     reportBug("Division by zero", stateZero, C);
 104     return;
 105   }
 106
 107   if ((stateNotZero && stateZero)) {
 108     std::vector<SymbolRef> taintedSyms = getTaintedSymbols(C.getState(), *DV);
 109     if (!taintedSyms.empty()) {
 110       reportTaintBug("Division by a tainted value, possibly zero", stateZero, C,
 111                      taintedSyms);
 112       return;
 113     }
 114   }
 115
 116   // If we get here, then the denom should not be zero. We abandon the implicit
 117   // zero denom case for now.
 118   C.addTransition(stateNotZero);
 119 }
 120
 121 void ento::registerDivZeroChecker(CheckerManager &mgr) {
 122   mgr.registerChecker<DivZeroChecker>();
 123 }
 124
 125 bool ento::shouldRegisterDivZeroChecker(const CheckerManager &mgr) {
 126   return true;
 127 }