1 //== DivZeroChecker.cpp - Division by zero checker --------------*- C++ -*--==// 2 // 3 // Part of the LLVM Project, under the Apache License v2.0 with LLVM Exceptions. 4 // See https://llvm.org/LICENSE.txt for license information. 5 // SPDX-License-Identifier: Apache-2.0 WITH LLVM-exception 6 // 7 //===----------------------------------------------------------------------===// 8 // 9 // This defines DivZeroChecker, a builtin check in ExprEngine that performs 10 // checks for division by zeros. 11 // 12 //===----------------------------------------------------------------------===// 13 14 #include "clang/StaticAnalyzer/Checkers/BuiltinCheckerRegistration.h" 15 #include "clang/StaticAnalyzer/Checkers/Taint.h" 16 #include "clang/StaticAnalyzer/Core/BugReporter/BugType.h" 17 #include "clang/StaticAnalyzer/Core/Checker.h" 18 #include "clang/StaticAnalyzer/Core/CheckerManager.h" 19 #include "clang/StaticAnalyzer/Core/PathSensitive/CheckerContext.h" 20 #include <optional> 21 22 using namespace clang; 23 using namespace ento; 24 using namespace taint; 25 26 namespace { 27 class DivZeroChecker : public Checker< check::PreStmt<BinaryOperator> > { 28 mutable std::unique_ptr<BuiltinBug> BT; 29 void reportBug(const char *Msg, ProgramStateRef StateZero, CheckerContext &C, 30 std::unique_ptr<BugReporterVisitor> Visitor = nullptr) const; 31 32 public: 33 void checkPreStmt(const BinaryOperator *B, CheckerContext &C) const; 34 }; 35 } // end anonymous namespace 36 37 static const Expr *getDenomExpr(const ExplodedNode *N) { 38 const Stmt *S = N->getLocationAs<PreStmt>()->getStmt(); 39 if (const auto *BE = dyn_cast<BinaryOperator>(S)) 40 return BE->getRHS(); 41 return nullptr; 42 } 43 44 void DivZeroChecker::reportBug( 45 const char *Msg, ProgramStateRef StateZero, CheckerContext &C, 46 std::unique_ptr<BugReporterVisitor> Visitor) const { 47 if (ExplodedNode *N = C.generateErrorNode(StateZero)) { 48 if (!BT) 49 BT.reset(new BuiltinBug(this, "Division by zero")); 50 51 auto R = std::make_unique<PathSensitiveBugReport>(*BT, Msg, N); 52 R->addVisitor(std::move(Visitor)); 53 bugreporter::trackExpressionValue(N, getDenomExpr(N), *R); 54 C.emitReport(std::move(R)); 55 } 56 } 57 58 void DivZeroChecker::checkPreStmt(const BinaryOperator *B, 59 CheckerContext &C) const { 60 BinaryOperator::Opcode Op = B->getOpcode(); 61 if (Op != BO_Div && 62 Op != BO_Rem && 63 Op != BO_DivAssign && 64 Op != BO_RemAssign) 65 return; 66 67 if (!B->getRHS()->getType()->isScalarType()) 68 return; 69 70 SVal Denom = C.getSVal(B->getRHS()); 71 std::optional<DefinedSVal> DV = Denom.getAs<DefinedSVal>(); 72 73 // Divide-by-undefined handled in the generic checking for uses of 74 // undefined values. 75 if (!DV) 76 return; 77 78 // Check for divide by zero. 79 ConstraintManager &CM = C.getConstraintManager(); 80 ProgramStateRef stateNotZero, stateZero; 81 std::tie(stateNotZero, stateZero) = CM.assumeDual(C.getState(), *DV); 82 83 if (!stateNotZero) { 84 assert(stateZero); 85 reportBug("Division by zero", stateZero, C); 86 return; 87 } 88 89 bool TaintedD = isTainted(C.getState(), *DV); 90 if ((stateNotZero && stateZero && TaintedD)) { 91 reportBug("Division by a tainted value, possibly zero", stateZero, C, 92 std::make_unique<taint::TaintBugVisitor>(*DV)); 93 return; 94 } 95 96 // If we get here, then the denom should not be zero. We abandon the implicit 97 // zero denom case for now. 98 C.addTransition(stateNotZero); 99 } 100 101 void ento::registerDivZeroChecker(CheckerManager &mgr) { 102 mgr.registerChecker<DivZeroChecker>(); 103 } 104 105 bool ento::shouldRegisterDivZeroChecker(const CheckerManager &mgr) { 106 return true; 107 } 108