correctcomputation / checkedc-clang

This is the primary development repository for 3C, a tool for automatically converting legacy C code to the Checked C extension of C, which aims to enforce spatial memory safety. This repository is a fork of Checked C's.
14 stars 5 forks source link

`Rewriter::InsertText*` calls should use wrappers analogous to `rewriteSourceRange` #739

Open mattmccutchen-cci opened 2 years ago

mattmccutchen-cci commented 2 years ago

Currently, all of 3C's calls to Rewriter::ReplaceText go through a wrapper function named rewriteSourceRange, which (currently) adds two features: (1) better handling of certain edge cases involving macros and (2) failure reporting as diagnostics. However, 3C has several features that call the Rewriter::InsertText* methods directly, since we don't yet have analogous wrappers for them:

  1. Type argument addition
  2. Cast insertion
  3. Checked region addition (-addcr)
  4. Struct de-nesting (being added in #657)
  5. Base variable addition for range bounds (being added in #718; currently defines its own insertText wrapper that works in a hacky way, which may change)

We should define and use proper Rewriter::InsertText* wrappers. Even if we don't care about the macro edge cases, it's important to ensure that failures are reported appropriately. Currently, some of the call sites assert on failure while others silently ignore it. (Failure may be impossible at some of those call sites anyway due to checks previously performed by 3C, but that may not be obvious by reading the code, and we might unintentionally break things in the future.)

A simple example of what can currently go wrong with checked region addition:

void myvariadic(int x, ...) {}

#define myvariadic_macro myvariadic
#define RPAREN_SEMICOLON );

void caller(void) {
  myvariadic(1);
  myvariadic_macro(2);
  myvariadic(3 RPAREN_SEMICOLON
}

3c -addcr reports no errors or warnings but generates syntactically invalid output when it inserts the opening brace but silently fails to insert the closing brace or vice versa:

void caller(void) _Checked {
  _Unchecked { myvariadic(1); };
  myvariadic_macro(2); };
  _Unchecked { myvariadic(3 RPAREN_SEMICOLON
}