diff --git a/clang/lib/StaticAnalyzer/Checkers/StreamChecker.cpp b/clang/lib/StaticAnalyzer/Checkers/StreamChecker.cpp index 1d53e59ca067c..8eca989d7bcde 100644 --- a/clang/lib/StaticAnalyzer/Checkers/StreamChecker.cpp +++ b/clang/lib/StaticAnalyzer/Checkers/StreamChecker.cpp @@ -250,9 +250,12 @@ class StreamChecker : public Checker PutVal = Call.getArgSVal(0).getAs(); - if (!PutVal) - return; - ProgramStateRef StateNotFailed = - State->BindExpr(CE, C.getLocationContext(), *PutVal); - StateNotFailed = - StateNotFailed->set(StreamSym, StreamState::getOpened(Desc)); - C.addTransition(StateNotFailed); + // Generate a transition for the success state of fputc. + if (!IsRead) { + std::optional PutVal = Call.getArgSVal(0).getAs(); + if (!PutVal) + return; + ProgramStateRef StateNotFailed = + State->BindExpr(CE, C.getLocationContext(), *PutVal); + StateNotFailed = + StateNotFailed->set(StreamSym, StreamState::getOpened(Desc)); + C.addTransition(StateNotFailed); + } + // Generate a transition for the success state of fgetc. + // If we know the state to be FEOF at fgetc, do not add a success state. + else if (OldSS->ErrorState != ErrorFEof) { + NonLoc RetVal = makeRetVal(C, CE).castAs(); + ProgramStateRef StateNotFailed = + State->BindExpr(CE, C.getLocationContext(), RetVal); + SValBuilder &SVB = C.getSValBuilder(); + auto &ASTC = C.getASTContext(); + // The returned 'unsigned char' of `fgetc` is converted to 'int', + // so we need to check if it is in range [0, 255]. + auto CondLow = + SVB.evalBinOp(State, BO_GE, RetVal, SVB.makeZeroVal(ASTC.IntTy), + SVB.getConditionType()) + .getAs(); + auto CondHigh = + SVB.evalBinOp(State, BO_LE, RetVal, + SVB.makeIntVal(SVB.getBasicValueFactory() + .getMaxValue(ASTC.UnsignedCharTy) + .getLimitedValue(), + ASTC.IntTy), + SVB.getConditionType()) + .getAs(); + if (!CondLow || !CondHigh) + return; + StateNotFailed = StateNotFailed->assume(*CondLow, true); + if (!StateNotFailed) + return; + StateNotFailed = StateNotFailed->assume(*CondHigh, true); + if (!StateNotFailed) + return; + C.addTransition(StateNotFailed); + } // Add transition for the failed state. + ProgramStateRef StateFailed = bindInt(*EofVal, State, C, CE); + // If a (non-EOF) error occurs, the resulting value of the file position // indicator for the stream is indeterminate. - ProgramStateRef StateFailed = bindInt(*EofVal, State, C, CE); - StreamState NewSS = StreamState::getOpened( - Desc, ErrorFError, /*IsFilePositionIndeterminate*/ true); + StreamErrorState NewES; + if (IsRead) + NewES = + OldSS->ErrorState == ErrorFEof ? ErrorFEof : ErrorFEof | ErrorFError; + else + NewES = ErrorFError; + StreamState NewSS = StreamState::getOpened(Desc, NewES, !NewES.isFEof()); StateFailed = StateFailed->set(StreamSym, NewSS); - C.addTransition(StateFailed); + if (IsRead && OldSS->ErrorState != ErrorFEof) + C.addTransition(StateFailed, constructSetEofNoteTag(C, StreamSym)); + else + C.addTransition(StateFailed); } void StreamChecker::preFseek(const FnDescription *Desc, const CallEvent &Call, diff --git a/clang/test/Analysis/Inputs/system-header-simulator.h b/clang/test/Analysis/Inputs/system-header-simulator.h index 8924103f5046e..fc57e8bdc3d30 100644 --- a/clang/test/Analysis/Inputs/system-header-simulator.h +++ b/clang/test/Analysis/Inputs/system-header-simulator.h @@ -48,6 +48,7 @@ FILE *freopen(const char *restrict pathname, const char *restrict mode, FILE *re int fclose(FILE *fp); size_t fread(void *restrict, size_t, size_t, FILE *restrict); size_t fwrite(const void *restrict, size_t, size_t, FILE *restrict); +int fgetc(FILE *stream); int fputc(int ch, FILE *stream); int fseek(FILE *__stream, long int __off, int __whence); long int ftell(FILE *__stream); diff --git a/clang/test/Analysis/stream-error.c b/clang/test/Analysis/stream-error.c index 5ebdc32bb1b92..38e6b77b9bb50 100644 --- a/clang/test/Analysis/stream-error.c +++ b/clang/test/Analysis/stream-error.c @@ -101,6 +101,28 @@ void error_fwrite(void) { Ret = fwrite(0, 1, 10, F); // expected-warning {{Stream might be already closed}} } +void error_fgetc(void) { + FILE *F = tmpfile(); + if (!F) + return; + int Ret = fgetc(F); + if (0 <= Ret && Ret <= 255) { + clang_analyzer_eval(feof(F) || ferror(F)); // expected-warning {{FALSE}} + } else { + clang_analyzer_eval(Ret == EOF); // expected-warning {{TRUE}} + clang_analyzer_eval(feof(F) || ferror(F)); // expected-warning {{TRUE}} + if (feof(F)) { + clang_analyzer_eval(ferror(F)); // expected-warning {{FALSE}} + fgetc(F); // expected-warning {{Read function called when stream is in EOF state}} + } else { + clang_analyzer_eval(ferror(F)); // expected-warning {{TRUE}} + fgetc(F); // expected-warning {{might be 'indeterminate'}} + } + } + fclose(F); + fgetc(F); // expected-warning {{Stream might be already closed}} +} + void error_fputc(void) { FILE *F = tmpfile(); if (!F) @@ -259,23 +281,6 @@ void error_indeterminate_clearerr(void) { fclose(F); } -void error_indeterminate_fputc(void) { - FILE *F = fopen("file", "r+"); - if (!F) - return; - int rc = fseek(F, 0, SEEK_SET); - if (rc) { - if (feof(F)) { - fputc('X', F); // no warning - } else if (ferror(F)) { - fputc('C', F); // expected-warning {{might be 'indeterminate'}} - } else { - fputc('E', F); // expected-warning {{might be 'indeterminate'}} - } - } - fclose(F); -} - void error_indeterminate_feof1(void) { FILE *F = fopen("file", "r+"); if (!F) diff --git a/clang/test/Analysis/stream.c b/clang/test/Analysis/stream.c index 9b6a31738d6e0..a7ee9982478bb 100644 --- a/clang/test/Analysis/stream.c +++ b/clang/test/Analysis/stream.c @@ -14,6 +14,12 @@ void check_fwrite(void) { fclose(fp); } +void check_fgetc(void) { + FILE *fp = tmpfile(); + fgetc(fp); // expected-warning {{Stream pointer might be NULL}} + fclose(fp); +} + void check_fputc(void) { FILE *fp = tmpfile(); fputc('A', fp); // expected-warning {{Stream pointer might be NULL}}