blob: 54ce078c1d878d36a994cd21a95015a58df0fef8 (
plain)
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
|
//===----------------------------------------------------------------------===//
// Random notes for the static analysis module.
//===----------------------------------------------------------------------===//
Currently the analyzer with basic store will report false alarm for such code:
p[0] = "/bin/sh";
p[1] = NULL;
execv(p[0], argv);
This is because BasicStore "collapses" all elements of an array into their base
region. BasicStore should return UnknownVal() when getLValueElement. But that
way will break current test in null-deref-ps.c.
//===----------------------------------------------------------------------===//
Investigate what classes of exprs are passed silently in GRExprEngine::Visit().
One is PredefinedExpr.
//===----------------------------------------------------------------------===//
Remove PersistentSValPairs and PersistentSVals?
//===----------------------------------------------------------------------===//
If the pointer is symbolic, we should expand it to a full region with symbolic
values. This can eliminate the following false warning.
struct file {
int lineno;
};
struct file *fileinfo;
void f10() {
int i;
int *p = 0;
if (fileinfo->lineno)
p = &i;
if (fileinfo->lineno)
*p = 3; // false warning
}
Now we return a symbolic region for fileinfo->lineno in RegionStore. Loading
from it returns an UnknownVal. Therefore the path condition is not recorded.
Where should we call this ExpandSymbolicPointer method? Perhaps in
GRExprEngine::VisitMemberExpr().
Problem: The base expr of MemberExpr can be in various form. How do we get the
pointer varregion(or other kind of region) to be changed?
|
