21 using namespace clang;
25 class DivZeroChecker :
public Checker< check::PreStmt<BinaryOperator> > {
26 mutable std::unique_ptr<BuiltinBug> BT;
27 void reportBug(
const char *Msg,
35 void DivZeroChecker::reportBug(
const char *Msg,
40 BT.reset(
new BuiltinBug(
this,
"Division by zero"));
42 auto R = llvm::make_unique<BugReport>(*BT, Msg, N);
75 reportBug(
"Division by zero", stateZero, C);
79 bool TaintedD = C.
getState()->isTainted(*DV);
80 if ((stateNotZero && stateZero && TaintedD)) {
81 reportBug(
"Division by a tainted value, possibly zero", stateZero, C);
ExplodedNode * generateErrorNode(ProgramStateRef State=nullptr, const ProgramPointTag *Tag=nullptr)
Generate a transition to a node that will be used to report an error.
ExplodedNode * addTransition(ProgramStateRef State=nullptr, const ProgramPointTag *Tag=nullptr)
Generates a new transition in the program state graph (ExplodedGraph).
const Stmt * GetDenomExpr(const ExplodedNode *N)
bool isScalarType() const
A builtin binary operation expression such as "x + y" or "x <= y".
ProgramStatePair assumeDual(ProgramStateRef State, DefinedSVal Cond)
Returns a pair of states (StTrue, StFalse) where the given condition is assumed to be true or false...
const ProgramStateRef & getState() const
Optional< T > getAs() const
Convert to the specified SVal type, returning None if this SVal is not of the desired type...
ConstraintManager & getConstraintManager()
void emitReport(std::unique_ptr< BugReport > R)
Emit the diagnostics report.
CHECKER * registerChecker()
Used to register checkers.
SVal - This represents a symbolic expression, which can be either an L-value or an R-value...
bool trackNullOrUndefValue(const ExplodedNode *N, const Stmt *S, BugReport &R, bool IsArg=false, bool EnableNullFPSuppression=true)
Attempts to add visitors to trace a null or undefined value back to its point of origin, whether it is a symbol constrained to null or an explicit assignment.
const LocationContext * getLocationContext() const