aboutsummaryrefslogtreecommitdiff
diff options
context:
space:
mode:
authorAnna Zaks <ganna@apple.com>2012-01-13 00:56:48 +0000
committerAnna Zaks <ganna@apple.com>2012-01-13 00:56:48 +0000
commitce8ef16b1c58a304b7b59fad9836ad32d6ed020c (patch)
tree72a19372eb9ff11e10a9077ffd712299e0fa7b4d
parentdba241df071c4a15ac97e5cadd2d581998662809 (diff)
[analyzer] RegionStoreManager::getBinding() should not crash when
looking up value at a CodeTextRegion even when the type is not provided. git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@148079 91177308-0d34-0410-b5e6-96231b3b80d8
-rw-r--r--lib/StaticAnalyzer/Core/RegionStore.cpp8
-rw-r--r--test/Analysis/string.c4
2 files changed, 10 insertions, 2 deletions
diff --git a/lib/StaticAnalyzer/Core/RegionStore.cpp b/lib/StaticAnalyzer/Core/RegionStore.cpp
index 5bd7d72675..f27c51880b 100644
--- a/lib/StaticAnalyzer/Core/RegionStore.cpp
+++ b/lib/StaticAnalyzer/Core/RegionStore.cpp
@@ -918,8 +918,12 @@ SVal RegionStoreManager::getBinding(Store store, Loc L, QualType T) {
isa<SymbolicRegion>(MR) ||
isa<CodeTextRegion>(MR)) {
if (T.isNull()) {
- const SymbolicRegion *SR = cast<SymbolicRegion>(MR);
- T = SR->getSymbol()->getType(Ctx);
+ if (const TypedRegion *TR = dyn_cast<TypedRegion>(MR))
+ T = TR->getLocationType();
+ else {
+ const SymbolicRegion *SR = cast<SymbolicRegion>(MR);
+ T = SR->getSymbol()->getType(Ctx);
+ }
}
MR = GetElementZeroRegion(MR, T);
}
diff --git a/test/Analysis/string.c b/test/Analysis/string.c
index fcbe298a8f..d72abb349a 100644
--- a/test/Analysis/string.c
+++ b/test/Analysis/string.c
@@ -297,6 +297,10 @@ void strcpy_fn(char *x) {
strcpy(x, (char*)&strcpy_fn); // expected-warning{{Argument to string copy function is the address of the function 'strcpy_fn', which is not a null-terminated string}}
}
+void strcpy_fn_const(char *x) {
+ strcpy(x, (const char*)&strcpy_fn); // expected-warning{{Argument to string copy function is the address of the function 'strcpy_fn', which is not a null-terminated string}}
+}
+
void strcpy_effects(char *x, char *y) {
char a = x[0];