1 //=== FixedAddressChecker.cpp - Fixed address usage checker ----*- C++ -*--===//
3 // The LLVM Compiler Infrastructure
5 // This file is distributed under the University of Illinois Open Source
6 // License. See LICENSE.TXT for details.
8 //===----------------------------------------------------------------------===//
10 // This files defines FixedAddressChecker, a builtin checker that checks for
11 // assignment of a fixed address to a pointer.
12 // This check corresponds to CWE-587.
14 //===----------------------------------------------------------------------===//
16 #include "GRExprEngineInternalChecks.h"
17 #include "clang/GR/BugReporter/BugType.h"
18 #include "clang/GR/PathSensitive/CheckerVisitor.h"
20 using namespace clang
;
23 class FixedAddressChecker
24 : public CheckerVisitor
<FixedAddressChecker
> {
27 FixedAddressChecker() : BT(0) {}
28 static void *getTag();
29 void PreVisitBinaryOperator(CheckerContext
&C
, const BinaryOperator
*B
);
33 void *FixedAddressChecker::getTag() {
38 void FixedAddressChecker::PreVisitBinaryOperator(CheckerContext
&C
,
39 const BinaryOperator
*B
) {
40 // Using a fixed address is not portable because that address will probably
41 // not be valid in all environments or platforms.
43 if (B
->getOpcode() != BO_Assign
)
46 QualType T
= B
->getType();
47 if (!T
->isPointerType())
50 const GRState
*state
= C
.getState();
52 SVal RV
= state
->getSVal(B
->getRHS());
54 if (!RV
.isConstant() || RV
.isZeroConstant())
57 if (ExplodedNode
*N
= C
.generateNode()) {
59 BT
= new BuiltinBug("Use fixed address",
60 "Using a fixed address is not portable because that "
61 "address will probably not be valid in all "
62 "environments or platforms.");
63 RangedBugReport
*R
= new RangedBugReport(*BT
, BT
->getDescription(), N
);
64 R
->addRange(B
->getRHS()->getSourceRange());
69 void clang::RegisterFixedAddressChecker(GRExprEngine
&Eng
) {
70 Eng
.registerCheck(new FixedAddressChecker());