bloomberg / clangmetatool

A framework for reusing code in Clang tools
https://bloomberg.github.io/clangmetatool/
Apache License 2.0
119 stars 25 forks source link

Fix bugs uncovered in the wild #26

Closed burz closed 5 years ago

burz commented 5 years ago
  1. It is possible that the subexpression is not a DeclRefExpr so a check is added similar to the original check for base.
  2. Since the if statements do not have an else case in VisitCallExpr, it is possible also that DR will end up undefined so there is an additional check to ensure it is not the nullptr before dereferencing it.
  3. getDirectCallee can return a nullptr.
  4. The equality operator for PropagationResult was technically incorrect. Before it would always check if the results were equal if the unresolveds were equal, but if both unresolveds are equal and false, then the value of the results is technically undefined and should not factor into the equality.
  5. In integer propagation, it was necessary to check the types of the parameters of the FunctionDecl of the callee, since this is the only way to find out if arguments are being passed as mutable references into the function as opposed to checking the type of the actual arguments, as is done in cstring propagation. However, in the case of a C-style variadic function, the number of parameters will not match the number of arguments which caused a segfault in this code. To address this problem, we check the types of the arguments only after we have exhausted the parameters in the case that there are more arguments than parameters. This is an adequate solution since it is not possible to pass references through a C-style variadic function.
  6. It is possible for QualTypes to be null.

@ruoso @vaibhav-y

envp commented 5 years ago

I hadn't considered this before. Interesting that unary operators can act on non-lvalues. I think the added check is good.