1 | //== DivZeroChecker.cpp - Division by zero checker --------------*- C++ -*--==// |
2 | // |
3 | // Part of the LLVM Project, under the Apache License v2.0 with LLVM Exceptions. |
4 | // See https://llvm.org/LICENSE.txt for license information. |
5 | // SPDX-License-Identifier: Apache-2.0 WITH LLVM-exception |
6 | // |
7 | //===----------------------------------------------------------------------===// |
8 | // |
9 | // This defines DivZeroChecker, a builtin check in ExprEngine that performs |
10 | // checks for division by zeros. |
11 | // |
12 | //===----------------------------------------------------------------------===// |
13 | |
14 | #include "clang/StaticAnalyzer/Checkers/BuiltinCheckerRegistration.h" |
15 | #include "clang/StaticAnalyzer/Checkers/Taint.h" |
16 | #include "clang/StaticAnalyzer/Core/BugReporter/BugType.h" |
17 | #include "clang/StaticAnalyzer/Core/BugReporter/CommonBugCategories.h" |
18 | #include "clang/StaticAnalyzer/Core/Checker.h" |
19 | #include "clang/StaticAnalyzer/Core/CheckerManager.h" |
20 | #include "clang/StaticAnalyzer/Core/PathSensitive/CheckerContext.h" |
21 | #include <optional> |
22 | |
23 | using namespace clang; |
24 | using namespace ento; |
25 | using namespace taint; |
26 | |
27 | namespace { |
28 | class DivZeroChecker : public Checker< check::PreStmt<BinaryOperator> > { |
29 | const BugType BT{this, "Division by zero" }; |
30 | const BugType TaintBT{this, "Division by zero" , categories::TaintedData}; |
31 | void reportBug(StringRef Msg, ProgramStateRef StateZero, |
32 | CheckerContext &C) const; |
33 | void reportTaintBug(StringRef Msg, ProgramStateRef StateZero, |
34 | CheckerContext &C, |
35 | llvm::ArrayRef<SymbolRef> TaintedSyms) const; |
36 | |
37 | public: |
38 | void checkPreStmt(const BinaryOperator *B, CheckerContext &C) const; |
39 | }; |
40 | } // end anonymous namespace |
41 | |
42 | static const Expr *getDenomExpr(const ExplodedNode *N) { |
43 | const Stmt *S = N->getLocationAs<PreStmt>()->getStmt(); |
44 | if (const auto *BE = dyn_cast<BinaryOperator>(Val: S)) |
45 | return BE->getRHS(); |
46 | return nullptr; |
47 | } |
48 | |
49 | void DivZeroChecker::reportBug(StringRef Msg, ProgramStateRef StateZero, |
50 | CheckerContext &C) const { |
51 | if (ExplodedNode *N = C.generateErrorNode(State: StateZero)) { |
52 | auto R = std::make_unique<PathSensitiveBugReport>(args: BT, args&: Msg, args&: N); |
53 | bugreporter::trackExpressionValue(N, E: getDenomExpr(N), R&: *R); |
54 | C.emitReport(R: std::move(R)); |
55 | } |
56 | } |
57 | |
58 | void DivZeroChecker::reportTaintBug( |
59 | StringRef Msg, ProgramStateRef StateZero, CheckerContext &C, |
60 | llvm::ArrayRef<SymbolRef> TaintedSyms) const { |
61 | if (ExplodedNode *N = C.generateErrorNode(State: StateZero)) { |
62 | auto R = std::make_unique<PathSensitiveBugReport>(args: TaintBT, args&: Msg, args&: N); |
63 | bugreporter::trackExpressionValue(N, E: getDenomExpr(N), R&: *R); |
64 | for (auto Sym : TaintedSyms) |
65 | R->markInteresting(sym: Sym); |
66 | C.emitReport(R: std::move(R)); |
67 | } |
68 | } |
69 | |
70 | void DivZeroChecker::checkPreStmt(const BinaryOperator *B, |
71 | CheckerContext &C) const { |
72 | BinaryOperator::Opcode Op = B->getOpcode(); |
73 | if (Op != BO_Div && |
74 | Op != BO_Rem && |
75 | Op != BO_DivAssign && |
76 | Op != BO_RemAssign) |
77 | return; |
78 | |
79 | if (!B->getRHS()->getType()->isScalarType()) |
80 | return; |
81 | |
82 | SVal Denom = C.getSVal(B->getRHS()); |
83 | std::optional<DefinedSVal> DV = Denom.getAs<DefinedSVal>(); |
84 | |
85 | // Divide-by-undefined handled in the generic checking for uses of |
86 | // undefined values. |
87 | if (!DV) |
88 | return; |
89 | |
90 | // Check for divide by zero. |
91 | ConstraintManager &CM = C.getConstraintManager(); |
92 | ProgramStateRef stateNotZero, stateZero; |
93 | std::tie(args&: stateNotZero, args&: stateZero) = CM.assumeDual(State: C.getState(), Cond: *DV); |
94 | |
95 | if (!stateNotZero) { |
96 | assert(stateZero); |
97 | reportBug(Msg: "Division by zero" , StateZero: stateZero, C); |
98 | return; |
99 | } |
100 | |
101 | if ((stateNotZero && stateZero)) { |
102 | std::vector<SymbolRef> taintedSyms = getTaintedSymbols(State: C.getState(), V: *DV); |
103 | if (!taintedSyms.empty()) { |
104 | reportTaintBug(Msg: "Division by a tainted value, possibly zero" , StateZero: stateZero, C, |
105 | TaintedSyms: taintedSyms); |
106 | return; |
107 | } |
108 | } |
109 | |
110 | // If we get here, then the denom should not be zero. We abandon the implicit |
111 | // zero denom case for now. |
112 | C.addTransition(State: stateNotZero); |
113 | } |
114 | |
115 | void ento::registerDivZeroChecker(CheckerManager &mgr) { |
116 | mgr.registerChecker<DivZeroChecker>(); |
117 | } |
118 | |
119 | bool ento::shouldRegisterDivZeroChecker(const CheckerManager &mgr) { |
120 | return true; |
121 | } |
122 | |