diff --git a/clang/lib/StaticAnalyzer/Checkers/StreamChecker.cpp b/clang/lib/StaticAnalyzer/Checkers/StreamChecker.cpp index 8eca989d7bcde..eccb2063fad10 100644 --- a/clang/lib/StaticAnalyzer/Checkers/StreamChecker.cpp +++ b/clang/lib/StaticAnalyzer/Checkers/StreamChecker.cpp @@ -252,10 +252,13 @@ class StreamChecker : public Checker PutVal = Call.getArgSVal(0).getAs(); - if (!PutVal) - return; - ProgramStateRef StateNotFailed = - State->BindExpr(CE, C.getLocationContext(), *PutVal); - StateNotFailed = - StateNotFailed->set(StreamSym, StreamState::getOpened(Desc)); - C.addTransition(StateNotFailed); - } - // Generate a transition for the success state of fgetc. + // Generate a transition for the success state of `fgetc`. // If we know the state to be FEOF at fgetc, do not add a success state. - else if (OldSS->ErrorState != ErrorFEof) { + if (OldSS->ErrorState != ErrorFEof) { NonLoc RetVal = makeRetVal(C, CE).castAs(); ProgramStateRef StateNotFailed = State->BindExpr(CE, C.getLocationContext(), RetVal); SValBuilder &SVB = C.getSValBuilder(); - auto &ASTC = C.getASTContext(); + ASTContext &ASTC = C.getASTContext(); // The returned 'unsigned char' of `fgetc` is converted to 'int', // so we need to check if it is in range [0, 255]. auto CondLow = @@ -824,20 +817,74 @@ void StreamChecker::evalFgetcFputc(const FnDescription *Desc, // If a (non-EOF) error occurs, the resulting value of the file position // indicator for the stream is indeterminate. - StreamErrorState NewES; - if (IsRead) - NewES = - OldSS->ErrorState == ErrorFEof ? ErrorFEof : ErrorFEof | ErrorFError; - else - NewES = ErrorFError; + StreamErrorState NewES = + OldSS->ErrorState == ErrorFEof ? ErrorFEof : ErrorFEof | ErrorFError; StreamState NewSS = StreamState::getOpened(Desc, NewES, !NewES.isFEof()); StateFailed = StateFailed->set(StreamSym, NewSS); - if (IsRead && OldSS->ErrorState != ErrorFEof) + if (OldSS->ErrorState != ErrorFEof) C.addTransition(StateFailed, constructSetEofNoteTag(C, StreamSym)); else C.addTransition(StateFailed); } +void StreamChecker::evalFputx(const FnDescription *Desc, const CallEvent &Call, + CheckerContext &C, bool IsSingleChar) const { + ProgramStateRef State = C.getState(); + SymbolRef StreamSym = getStreamArg(Desc, Call).getAsSymbol(); + if (!StreamSym) + return; + + const CallExpr *CE = dyn_cast_or_null(Call.getOriginExpr()); + if (!CE) + return; + + const StreamState *OldSS = State->get(StreamSym); + if (!OldSS) + return; + + assertStreamStateOpened(OldSS); + + // `fputc` returns the written character on success, otherwise returns EOF. + // `fputs` returns a non negative value on sucecess, otherwise returns EOF. + + if (IsSingleChar) { + // Generate a transition for the success state of `fputc`. + std::optional PutVal = Call.getArgSVal(0).getAs(); + if (!PutVal) + return; + ProgramStateRef StateNotFailed = + State->BindExpr(CE, C.getLocationContext(), *PutVal); + StateNotFailed = + StateNotFailed->set(StreamSym, StreamState::getOpened(Desc)); + C.addTransition(StateNotFailed); + } else { + // Generate a transition for the success state of `fputs`. + NonLoc RetVal = makeRetVal(C, CE).castAs(); + ProgramStateRef StateNotFailed = + State->BindExpr(CE, C.getLocationContext(), RetVal); + SValBuilder &SVB = C.getSValBuilder(); + auto &ASTC = C.getASTContext(); + auto Cond = SVB.evalBinOp(State, BO_GE, RetVal, SVB.makeZeroVal(ASTC.IntTy), + SVB.getConditionType()) + .getAs(); + if (!Cond) + return; + StateNotFailed = StateNotFailed->assume(*Cond, true); + if (!StateNotFailed) + return; + StateNotFailed = + StateNotFailed->set(StreamSym, StreamState::getOpened(Desc)); + C.addTransition(StateNotFailed); + } + + // Add transition for the failed state. The resulting value of the file + // position indicator for the stream is indeterminate. + ProgramStateRef StateFailed = bindInt(*EofVal, State, C, CE); + StreamState NewSS = StreamState::getOpened(Desc, ErrorFError, true); + StateFailed = StateFailed->set(StreamSym, NewSS); + C.addTransition(StateFailed); +} + void StreamChecker::preFseek(const FnDescription *Desc, const CallEvent &Call, CheckerContext &C) const { ProgramStateRef State = C.getState(); diff --git a/clang/test/Analysis/Inputs/system-header-simulator.h b/clang/test/Analysis/Inputs/system-header-simulator.h index fc57e8bdc3d30..7ef5f29fbf42c 100644 --- a/clang/test/Analysis/Inputs/system-header-simulator.h +++ b/clang/test/Analysis/Inputs/system-header-simulator.h @@ -50,6 +50,7 @@ size_t fread(void *restrict, size_t, size_t, FILE *restrict); size_t fwrite(const void *restrict, size_t, size_t, FILE *restrict); int fgetc(FILE *stream); int fputc(int ch, FILE *stream); +int fputs(const char *restrict s, FILE *restrict stream); int fseek(FILE *__stream, long int __off, int __whence); long int ftell(FILE *__stream); void rewind(FILE *__stream); diff --git a/clang/test/Analysis/stream-error.c b/clang/test/Analysis/stream-error.c index 38e6b77b9bb50..c90d0cdc5742d 100644 --- a/clang/test/Analysis/stream-error.c +++ b/clang/test/Analysis/stream-error.c @@ -131,16 +131,50 @@ void error_fputc(void) { if (Ret == EOF) { clang_analyzer_eval(ferror(F)); // expected-warning {{TRUE}} clang_analyzer_eval(feof(F)); // expected-warning {{FALSE}} - fputc('Y', F); // expected-warning {{might be 'indeterminate'}} + fputc('Y', F); // expected-warning {{might be 'indeterminate'}} } else { - clang_analyzer_eval(Ret == 'X'); // expected-warning {{TRUE}} - clang_analyzer_eval(feof(F) || ferror(F)); // expected-warning {{FALSE}} - fputc('Y', F); // no-warning + clang_analyzer_eval(Ret == 'X'); // expected-warning {{TRUE}} + clang_analyzer_eval(feof(F) || ferror(F)); // expected-warning {{FALSE}} + fputc('Y', F); // no-warning } fclose(F); fputc('A', F); // expected-warning {{Stream might be already closed}} } +void error_fputs(void) { + FILE *F = tmpfile(); + if (!F) + return; + int Ret = fputs("XYZ", F); + if (Ret >= 0) { + clang_analyzer_eval(feof(F) || ferror(F)); // expected-warning {{FALSE}} + fputs("QWD", F); // no-warning + } else { + clang_analyzer_eval(Ret == EOF); // expected-warning {{TRUE}} + clang_analyzer_eval(ferror(F)); // expected-warning {{TRUE}} + clang_analyzer_eval(feof(F)); // expected-warning {{FALSE}} + fputs("QWD", F); // expected-warning {{might be 'indeterminate'}} + } + fclose(F); + fputs("ABC", F); // expected-warning {{Stream might be already closed}} +} + +void write_after_eof_is_allowed(void) { + FILE *F = tmpfile(); + if (!F) + return; + StreamTesterChecker_make_feof_stream(F); + if (fputs("QWD", F) >= 0) // no-warning + clang_analyzer_eval(feof(F) || ferror(F)); // expected-warning {{FALSE}} + StreamTesterChecker_make_feof_stream(F); + if (fputc('Q', F) == 'Q') // no-warning + clang_analyzer_eval(feof(F) || ferror(F)); // expected-warning {{FALSE}} + StreamTesterChecker_make_feof_stream(F); + if (fwrite("012345678", 1, 10, F) == 10) // no-warning + clang_analyzer_eval(feof(F) || ferror(F)); // expected-warning {{FALSE}} + fclose(F); +} + void freadwrite_zerosize(FILE *F) { size_t Ret; Ret = fwrite(0, 1, 0, F); diff --git a/clang/test/Analysis/stream.c b/clang/test/Analysis/stream.c index a7ee9982478bb..b0f39af8eb2f3 100644 --- a/clang/test/Analysis/stream.c +++ b/clang/test/Analysis/stream.c @@ -26,6 +26,12 @@ void check_fputc(void) { fclose(fp); } +void check_fputs(void) { + FILE *fp = tmpfile(); + fputs("ABC", fp); // expected-warning {{Stream pointer might be NULL}} + fclose(fp); +} + void check_fseek(void) { FILE *fp = tmpfile(); fseek(fp, 0, 0); // expected-warning {{Stream pointer might be NULL}}