21 using namespace clang;
25 class DivZeroChecker :
public Checker< check::PreStmt<BinaryOperator> > {
26 mutable std::unique_ptr<BuiltinBug> BT;
28 std::unique_ptr<BugReporterVisitor> Visitor =
nullptr)
const;
35 void DivZeroChecker::reportBug(
37 std::unique_ptr<BugReporterVisitor> Visitor)
const {
40 BT.reset(
new BuiltinBug(
this,
"Division by zero"));
42 auto R = llvm::make_unique<BugReport>(*BT, Msg, N);
43 R->addVisitor(std::move(Visitor));
44 bugreporter::trackNullOrUndefValue(N, bugreporter::GetDenomExpr(N), *R);
76 reportBug(
"Division by zero", stateZero, C);
80 bool TaintedD = C.
getState()->isTainted(*DV);
81 if ((stateNotZero && stateZero && TaintedD)) {
82 reportBug(
"Division by a tainted value, possibly zero", stateZero, C,
83 llvm::make_unique<TaintBugVisitor>(*DV));
ExplodedNode * generateErrorNode(ProgramStateRef State=nullptr, const ProgramPointTag *Tag=nullptr)
Generate a transition to a node that will be used to report an error.
ExplodedNode * addTransition(ProgramStateRef State=nullptr, const ProgramPointTag *Tag=nullptr)
Generates a new transition in the program state graph (ExplodedGraph).
SVal getSVal(const Stmt *S) const
Get the value of arbitrary expressions at this point in the path.
A builtin binary operation expression such as "x + y" or "x <= y".
bool isScalarType() const
ProgramStatePair assumeDual(ProgramStateRef State, DefinedSVal Cond)
Returns a pair of states (StTrue, StFalse) where the given condition is assumed to be true or false...
Optional< T > getAs() const
Convert to the specified SVal type, returning None if this SVal is not of the desired type...
CHECKER * registerChecker(AT... Args)
Used to register checkers.
ConstraintManager & getConstraintManager()
void emitReport(std::unique_ptr< BugReport > R)
Emit the diagnostics report.
SVal - This represents a symbolic expression, which can be either an L-value or an R-value...
Dataflow Directional Tag Classes.
const ProgramStateRef & getState() const