From: Csaba Dabis <dabis.csaba98@gmail.com>
Date: Tue, 25 Jun 2019 00:44:33 +0000 (+0000)
Subject: [analyzer] ExprEngine: Escape pointers in bitwise operations
X-Git-Url: https://granicus.if.org/sourcecode?a=commitdiff_plain;h=eac1ce71474f1b32bcb3aa4cdc11fc9cc3161e40;p=clang

[analyzer] ExprEngine: Escape pointers in bitwise operations

Summary:
After evaluation it would be an Unknown value and tracking would be lost.

Reviewers: NoQ, xazax.hun, ravikandhadai, baloghadamsoftware, Szelethus

Reviewed By: NoQ

Subscribers: szepet, rnkovacs, a.sidorin, mikhail.ramalho, donat.nagy,
             dkrupp, cfe-commits

Tags: #clang

Differential Revision: https://reviews.llvm.org/D63720

git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@364259 91177308-0d34-0410-b5e6-96231b3b80d8
---

diff --git a/lib/StaticAnalyzer/Core/ExprEngineC.cpp b/lib/StaticAnalyzer/Core/ExprEngineC.cpp
index cc62cf1048..3b5a437e3c 100644
--- a/lib/StaticAnalyzer/Core/ExprEngineC.cpp
+++ b/lib/StaticAnalyzer/Core/ExprEngineC.cpp
@@ -100,6 +100,10 @@ void ExprEngine::VisitBinaryOperator(const BinaryOperator* B,
       SVal Result = evalBinOp(state, Op, LeftV, RightV, B->getType());
       if (!Result.isUnknown()) {
         state = state->BindExpr(B, LCtx, Result);
+      } else {
+        // If we cannot evaluate the operation escape the operands.
+        state = escapeValue(state, LeftV, PSK_EscapeOther);
+        state = escapeValue(state, RightV, PSK_EscapeOther);
       }
 
       Bldr.generateNode(B, *it, state);
diff --git a/test/Analysis/symbol-escape.cpp b/test/Analysis/symbol-escape.cpp
new file mode 100644
index 0000000000..be5dfbcd9e
--- /dev/null
+++ b/test/Analysis/symbol-escape.cpp
@@ -0,0 +1,33 @@
+// RUN: %clang_analyze_cc1 \
+// RUN:  -analyzer-checker=core,cplusplus.NewDeleteLeaks \
+// RUN:  -verify %s
+
+// expected-no-diagnostics: Whenever we cannot evaluate an operation we escape
+//                          the operands. After the evaluation it would be an
+//                          Unknown value and the tracking would be lost.
+
+typedef unsigned __INTPTR_TYPE__ uintptr_t;
+
+class C {};
+
+C *simple_escape_in_bitwise_op(C *Foo) {
+  C *Bar = new C();
+  Bar = reinterpret_cast<C *>(reinterpret_cast<uintptr_t>(Bar) & 0x1);
+  (void)Bar;
+  // no-warning: "Potential leak of memory pointed to by 'Bar'" was here.
+
+  return Bar;
+}
+
+C **indirect_escape_in_bitwise_op() {
+  C *Qux = new C();
+  C **Baz = &Qux;
+  Baz = reinterpret_cast<C **>(reinterpret_cast<uintptr_t>(Baz) | 0x1);
+  Baz = reinterpret_cast<C **>(reinterpret_cast<uintptr_t>(Baz) &
+		               ~static_cast<uintptr_t>(0x1));
+  // no-warning: "Potential leak of memory pointed to by 'Qux'" was here.
+
+  delete *Baz;
+  return Baz;
+}
+