23 using namespace clang;
29 const CheckerBase *Checker;
33 explicit CastToStructVisitor(BugReporter &B,
const CheckerBase *Checker,
35 : BR(B), Checker(Checker), AC(A) {}
36 bool VisitCastExpr(
const CastExpr *CE);
40 bool CastToStructVisitor::VisitCastExpr(
const CastExpr *CE) {
49 if (!ToPTy || !OrigPTy)
65 PathDiagnosticLocation Loc(CE, BR.getSourceManager(), AC);
67 AC->getDecl(), Checker,
"Cast from non-struct type to struct type",
69 "type and accessing a field can lead to memory " 70 "access errors or data corruption.",
75 if (!U || U->getOpcode() != UO_AddrOf)
80 if (
const auto *SE = dyn_cast<DeclRefExpr>(U->getSubExpr()))
82 else if (
const auto *SE = dyn_cast<MemberExpr>(U->getSubExpr()))
83 VD = SE->getMemberDecl();
94 if (ToWidth <= OrigWidth)
97 PathDiagnosticLocation Loc(CE, BR.getSourceManager(), AC);
98 BR.EmitBasicReport(AC->getDecl(), Checker,
"Widening cast to struct type",
100 "Casting data to a larger structure type and accessing " 101 "a field can lead to memory access errors or data " 110 class CastToStructChecker :
public Checker<check::ASTCodeBody> {
112 void checkASTCodeBody(
const Decl *D, AnalysisManager &Mgr,
113 BugReporter &BR)
const {
114 CastToStructVisitor Visitor(BR,
this, Mgr.getAnalysisDeclContext(D));
115 Visitor.TraverseDecl(const_cast<Decl *>(D));
120 void ento::registerCastToStructChecker(CheckerManager &mgr) {
121 mgr.registerChecker<CastToStructChecker>();
PointerType - C99 6.7.5.1 - Pointer Declarators.
QualType getPointeeType() const
A (possibly-)qualified type.
QualType getPointeeType() const
If this is a pointer, ObjC object pointer, or block pointer, this returns the respective pointee...
bool isRecordType() const
Decl - This represents one declaration (or definition), e.g.
Holds long-lived AST nodes (such as types and decls) that can be referred to throughout the semantic ...
AnalysisDeclContext contains the context data for the function or method under analysis.
bool isReferenceType() const
const char *const LogicError
const Type * getTypePtr() const
Retrieves a pointer to the underlying (unqualified) type.
CastExpr - Base class for type casts, including both implicit casts (ImplicitCastExpr) and explicit c...
A class that does preorder or postorder depth-first traversal on the entire Clang AST and visits each...
Represent the declaration of a variable (in which case it is an lvalue) a function (in which case it ...
This represents one expression.
UnaryOperator - This represents the unary-expression's (except sizeof and alignof), the postinc/postdec operators from postfix-expression, and various extensions.
bool isStructureOrClassType() const
Dataflow Directional Tag Classes.
bool isIncompleteType(NamedDecl **Def=nullptr) const
Types are partitioned into 3 broad categories (C99 6.2.5p1): object types, function types...
CanQualType getCanonicalType(QualType T) const
Return the canonical (structural) type corresponding to the specified potentially non-canonical type ...
TypeInfo getTypeInfo(const Type *T) const
Get the size and alignment of the specified complete type in bits.
SourceRange getSourceRange() const LLVM_READONLY
SourceLocation tokens are not useful in isolation - they are low level value objects created/interpre...
A trivial tuple used to represent a source range.