494 lines
21 KiB
C++
494 lines
21 KiB
C++
/*
|
|
* Cppcheck - A tool for static C/C++ code analysis
|
|
* Copyright (C) 2007-2023 Cppcheck team.
|
|
*
|
|
* This program is free software: you can redistribute it and/or modify
|
|
* it under the terms of the GNU General Public License as published by
|
|
* the Free Software Foundation, either version 3 of the License, or
|
|
* (at your option) any later version.
|
|
*
|
|
* This program is distributed in the hope that it will be useful,
|
|
* but WITHOUT ANY WARRANTY; without even the implied warranty of
|
|
* MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
|
|
* GNU General Public License for more details.
|
|
*
|
|
* You should have received a copy of the GNU General Public License
|
|
* along with this program. If not, see <http://www.gnu.org/licenses/>.
|
|
*/
|
|
|
|
|
|
//---------------------------------------------------------------------------
|
|
#include "checktype.h"
|
|
|
|
#include "errortypes.h"
|
|
#include "mathlib.h"
|
|
#include "platform.h"
|
|
#include "settings.h"
|
|
#include "standards.h"
|
|
#include "symboldatabase.h"
|
|
#include "token.h"
|
|
#include "tokenize.h"
|
|
#include "valueflow.h"
|
|
|
|
#include <cmath>
|
|
#include <list>
|
|
#include <sstream>
|
|
#include <vector>
|
|
|
|
//---------------------------------------------------------------------------
|
|
|
|
// Register this check class (by creating a static instance of it)
|
|
namespace {
|
|
CheckType instance;
|
|
}
|
|
|
|
//---------------------------------------------------------------------------
|
|
// Checking for shift by too many bits
|
|
//---------------------------------------------------------------------------
|
|
//
|
|
|
|
// CWE ids used:
|
|
static const struct CWE CWE195(195U); // Signed to Unsigned Conversion Error
|
|
static const struct CWE CWE197(197U); // Numeric Truncation Error
|
|
static const struct CWE CWE758(758U); // Reliance on Undefined, Unspecified, or Implementation-Defined Behavior
|
|
static const struct CWE CWE190(190U); // Integer Overflow or Wraparound
|
|
|
|
|
|
void CheckType::checkTooBigBitwiseShift()
|
|
{
|
|
// unknown sizeof(int) => can't run this checker
|
|
if (mSettings->platform.type == cppcheck::Platform::Type::Unspecified)
|
|
return;
|
|
|
|
for (const Token *tok = mTokenizer->tokens(); tok; tok = tok->next()) {
|
|
// C++ and macro: OUT(x<<y)
|
|
if (mTokenizer->isCPP() && Token::Match(tok, "[;{}] %name% (") && Token::simpleMatch(tok->linkAt(2), ") ;") && tok->next()->isUpperCaseName() && !tok->next()->function())
|
|
tok = tok->linkAt(2);
|
|
|
|
if (!tok->astOperand1() || !tok->astOperand2())
|
|
continue;
|
|
|
|
if (!Token::Match(tok, "<<|>>|<<=|>>="))
|
|
continue;
|
|
|
|
// get number of bits of lhs
|
|
const ValueType * const lhstype = tok->astOperand1()->valueType();
|
|
if (!lhstype || !lhstype->isIntegral() || lhstype->pointer >= 1)
|
|
continue;
|
|
// C11 Standard, section 6.5.7 Bitwise shift operators, states:
|
|
// The integer promotions are performed on each of the operands.
|
|
// The type of the result is that of the promoted left operand.
|
|
int lhsbits;
|
|
if ((lhstype->type == ValueType::Type::CHAR) ||
|
|
(lhstype->type == ValueType::Type::SHORT) ||
|
|
(lhstype->type == ValueType::Type::WCHAR_T) ||
|
|
(lhstype->type == ValueType::Type::BOOL) ||
|
|
(lhstype->type == ValueType::Type::INT))
|
|
lhsbits = mSettings->platform.int_bit;
|
|
else if (lhstype->type == ValueType::Type::LONG)
|
|
lhsbits = mSettings->platform.long_bit;
|
|
else if (lhstype->type == ValueType::Type::LONGLONG)
|
|
lhsbits = mSettings->platform.long_long_bit;
|
|
else
|
|
continue;
|
|
|
|
// Get biggest rhs value. preferably a value which doesn't have 'condition'.
|
|
const ValueFlow::Value * value = tok->astOperand2()->getValueGE(lhsbits, mSettings);
|
|
if (value && mSettings->isEnabled(value, false))
|
|
tooBigBitwiseShiftError(tok, lhsbits, *value);
|
|
else if (lhstype->sign == ValueType::Sign::SIGNED) {
|
|
value = tok->astOperand2()->getValueGE(lhsbits-1, mSettings);
|
|
if (value && mSettings->isEnabled(value, false))
|
|
tooBigSignedBitwiseShiftError(tok, lhsbits, *value);
|
|
}
|
|
}
|
|
}
|
|
|
|
void CheckType::tooBigBitwiseShiftError(const Token *tok, int lhsbits, const ValueFlow::Value &rhsbits)
|
|
{
|
|
const char id[] = "shiftTooManyBits";
|
|
|
|
if (!tok) {
|
|
reportError(tok, Severity::error, id, "Shifting 32-bit value by 40 bits is undefined behaviour", CWE758, Certainty::normal);
|
|
return;
|
|
}
|
|
|
|
const ErrorPath errorPath = getErrorPath(tok, &rhsbits, "Shift");
|
|
|
|
std::ostringstream errmsg;
|
|
errmsg << "Shifting " << lhsbits << "-bit value by " << rhsbits.intvalue << " bits is undefined behaviour";
|
|
if (rhsbits.condition)
|
|
errmsg << ". See condition at line " << rhsbits.condition->linenr() << ".";
|
|
|
|
reportError(errorPath, rhsbits.errorSeverity() ? Severity::error : Severity::warning, id, errmsg.str(), CWE758, rhsbits.isInconclusive() ? Certainty::inconclusive : Certainty::normal);
|
|
}
|
|
|
|
void CheckType::tooBigSignedBitwiseShiftError(const Token *tok, int lhsbits, const ValueFlow::Value &rhsbits)
|
|
{
|
|
const char id[] = "shiftTooManyBitsSigned";
|
|
|
|
const bool cpp14 = mSettings->standards.cpp >= Standards::CPP14;
|
|
|
|
std::string behaviour = "undefined";
|
|
if (cpp14)
|
|
behaviour = "implementation-defined";
|
|
if (!tok) {
|
|
reportError(tok, Severity::error, id, "Shifting signed 32-bit value by 31 bits is " + behaviour + " behaviour", CWE758, Certainty::normal);
|
|
return;
|
|
}
|
|
|
|
|
|
Severity::SeverityType severity = rhsbits.errorSeverity() ? Severity::error : Severity::warning;
|
|
if (cpp14)
|
|
severity = Severity::portability;
|
|
|
|
if ((severity == Severity::portability) && !mSettings->severity.isEnabled(Severity::portability))
|
|
return;
|
|
const ErrorPath errorPath = getErrorPath(tok, &rhsbits, "Shift");
|
|
|
|
std::ostringstream errmsg;
|
|
errmsg << "Shifting signed " << lhsbits << "-bit value by " << rhsbits.intvalue << " bits is " + behaviour + " behaviour";
|
|
if (rhsbits.condition)
|
|
errmsg << ". See condition at line " << rhsbits.condition->linenr() << ".";
|
|
|
|
reportError(errorPath, severity, id, errmsg.str(), CWE758, rhsbits.isInconclusive() ? Certainty::inconclusive : Certainty::normal);
|
|
}
|
|
|
|
//---------------------------------------------------------------------------
|
|
// Checking for integer overflow
|
|
//---------------------------------------------------------------------------
|
|
|
|
void CheckType::checkIntegerOverflow()
|
|
{
|
|
// unknown sizeof(int) => can't run this checker
|
|
if (mSettings->platform.type == cppcheck::Platform::Type::Unspecified || mSettings->platform.int_bit >= MathLib::bigint_bits)
|
|
return;
|
|
|
|
for (const Token *tok = mTokenizer->tokens(); tok; tok = tok->next()) {
|
|
if (!tok->isArithmeticalOp())
|
|
continue;
|
|
|
|
// is result signed integer?
|
|
const ValueType *vt = tok->valueType();
|
|
if (!vt || !vt->isIntegral() || vt->sign != ValueType::Sign::SIGNED)
|
|
continue;
|
|
|
|
unsigned int bits;
|
|
if (vt->type == ValueType::Type::INT)
|
|
bits = mSettings->platform.int_bit;
|
|
else if (vt->type == ValueType::Type::LONG)
|
|
bits = mSettings->platform.long_bit;
|
|
else if (vt->type == ValueType::Type::LONGLONG)
|
|
bits = mSettings->platform.long_long_bit;
|
|
else
|
|
continue;
|
|
|
|
if (bits >= MathLib::bigint_bits)
|
|
continue;
|
|
|
|
// max value according to platform settings.
|
|
const MathLib::bigint maxvalue = (((MathLib::biguint)1) << (bits - 1)) - 1;
|
|
|
|
// is there a overflow result value
|
|
const ValueFlow::Value *value = tok->getValueGE(maxvalue + 1, mSettings);
|
|
if (!value)
|
|
value = tok->getValueLE(-maxvalue - 2, mSettings);
|
|
if (!value || !mSettings->isEnabled(value,false))
|
|
continue;
|
|
|
|
// For left shift, it's common practice to shift into the sign bit
|
|
//if (tok->str() == "<<" && value->intvalue > 0 && value->intvalue < (((MathLib::bigint)1) << bits))
|
|
// continue;
|
|
|
|
integerOverflowError(tok, *value);
|
|
}
|
|
}
|
|
|
|
void CheckType::integerOverflowError(const Token *tok, const ValueFlow::Value &value)
|
|
{
|
|
const std::string expr(tok ? tok->expressionString() : "");
|
|
|
|
std::string msg;
|
|
if (value.condition)
|
|
msg = ValueFlow::eitherTheConditionIsRedundant(value.condition) +
|
|
" or there is signed integer overflow for expression '" + expr + "'.";
|
|
else
|
|
msg = "Signed integer overflow for expression '" + expr + "'.";
|
|
|
|
if (value.safe)
|
|
msg = "Safe checks: " + msg;
|
|
|
|
reportError(getErrorPath(tok, &value, "Integer overflow"),
|
|
value.errorSeverity() ? Severity::error : Severity::warning,
|
|
getMessageId(value, "integerOverflow").c_str(),
|
|
msg,
|
|
CWE190,
|
|
value.isInconclusive() ? Certainty::inconclusive : Certainty::normal);
|
|
}
|
|
|
|
//---------------------------------------------------------------------------
|
|
// Checking for sign conversion when operand can be negative
|
|
//---------------------------------------------------------------------------
|
|
|
|
void CheckType::checkSignConversion()
|
|
{
|
|
if (!mSettings->severity.isEnabled(Severity::warning))
|
|
return;
|
|
|
|
for (const Token *tok = mTokenizer->tokens(); tok; tok = tok->next()) {
|
|
if (!tok->isArithmeticalOp() || Token::Match(tok,"+|-"))
|
|
continue;
|
|
|
|
// Is result unsigned?
|
|
if (!(tok->valueType() && tok->valueType()->sign == ValueType::Sign::UNSIGNED))
|
|
continue;
|
|
|
|
// Check if an operand can be negative..
|
|
const Token * astOperands[] = { tok->astOperand1(), tok->astOperand2() };
|
|
for (const Token * tok1 : astOperands) {
|
|
if (!tok1)
|
|
continue;
|
|
const ValueFlow::Value* negativeValue =
|
|
ValueFlow::findValue(tok1->values(), mSettings, [&](const ValueFlow::Value& v) {
|
|
return !v.isImpossible() && v.isIntValue() && (v.intvalue <= -1 || v.wideintvalue <= -1);
|
|
});
|
|
if (!negativeValue)
|
|
continue;
|
|
if (tok1->valueType() && tok1->valueType()->sign != ValueType::Sign::UNSIGNED)
|
|
signConversionError(tok1, negativeValue, tok1->isNumber());
|
|
}
|
|
}
|
|
}
|
|
|
|
void CheckType::signConversionError(const Token *tok, const ValueFlow::Value *negativeValue, const bool constvalue)
|
|
{
|
|
const std::string expr(tok ? tok->expressionString() : "var");
|
|
|
|
std::ostringstream msg;
|
|
if (tok && tok->isName())
|
|
msg << "$symbol:" << expr << "\n";
|
|
if (constvalue)
|
|
msg << "Expression '" << expr << "' has a negative value. That is converted to an unsigned value and used in an unsigned calculation.";
|
|
else
|
|
msg << "Expression '" << expr << "' can have a negative value. That is converted to an unsigned value and used in an unsigned calculation.";
|
|
|
|
if (!negativeValue)
|
|
reportError(tok, Severity::warning, "signConversion", msg.str(), CWE195, Certainty::normal);
|
|
else {
|
|
const ErrorPath &errorPath = getErrorPath(tok,negativeValue,"Negative value is converted to an unsigned value");
|
|
reportError(errorPath,
|
|
Severity::warning,
|
|
Check::getMessageId(*negativeValue, "signConversion").c_str(),
|
|
msg.str(),
|
|
CWE195,
|
|
negativeValue->isInconclusive() ? Certainty::inconclusive : Certainty::normal);
|
|
}
|
|
}
|
|
|
|
|
|
//---------------------------------------------------------------------------
|
|
// Checking for long cast of int result const long x = var1 * var2;
|
|
//---------------------------------------------------------------------------
|
|
static bool checkTypeCombination(const ValueType& src, const ValueType& tgt, const Settings* settings)
|
|
{
|
|
static const std::pair<ValueType::Type, ValueType::Type> typeCombinations[] = {
|
|
{ ValueType::Type::INT, ValueType::Type::LONG },
|
|
{ ValueType::Type::INT, ValueType::Type::LONGLONG },
|
|
{ ValueType::Type::LONG, ValueType::Type::LONGLONG },
|
|
{ ValueType::Type::FLOAT, ValueType::Type::DOUBLE },
|
|
{ ValueType::Type::FLOAT, ValueType::Type::LONGDOUBLE },
|
|
{ ValueType::Type::DOUBLE, ValueType::Type::LONGDOUBLE },
|
|
};
|
|
|
|
const std::size_t sizeSrc = ValueFlow::getSizeOf(src, settings);
|
|
const std::size_t sizeTgt = ValueFlow::getSizeOf(tgt, settings);
|
|
if (!(sizeSrc > 0 && sizeTgt > 0 && sizeSrc < sizeTgt))
|
|
return false;
|
|
|
|
return std::any_of(std::begin(typeCombinations), std::end(typeCombinations), [&](const std::pair<ValueType::Type, ValueType::Type>& p) {
|
|
return src.type == p.first && tgt.type == p.second;
|
|
});
|
|
}
|
|
|
|
void CheckType::checkLongCast()
|
|
{
|
|
if (!mSettings->severity.isEnabled(Severity::style))
|
|
return;
|
|
|
|
// Assignments..
|
|
for (const Token *tok = mTokenizer->tokens(); tok; tok = tok->next()) {
|
|
if (tok->str() != "=" || !Token::Match(tok->astOperand2(), "*|<<") || tok->astOperand2()->isUnaryOp("*"))
|
|
continue;
|
|
|
|
if (tok->astOperand2()->hasKnownIntValue()) {
|
|
const ValueFlow::Value &v = tok->astOperand2()->values().front();
|
|
if (mSettings->platform.isIntValue(v.intvalue))
|
|
continue;
|
|
}
|
|
|
|
const ValueType *lhstype = tok->astOperand1() ? tok->astOperand1()->valueType() : nullptr;
|
|
const ValueType *rhstype = tok->astOperand2()->valueType();
|
|
|
|
if (!lhstype || !rhstype)
|
|
continue;
|
|
if (!checkTypeCombination(*rhstype, *lhstype, mSettings))
|
|
continue;
|
|
|
|
// assign int result to long/longlong const nonpointer?
|
|
if (rhstype->pointer == 0U &&
|
|
rhstype->originalTypeName.empty() &&
|
|
lhstype->pointer == 0U &&
|
|
lhstype->originalTypeName.empty())
|
|
longCastAssignError(tok, rhstype, lhstype);
|
|
}
|
|
|
|
// Return..
|
|
const SymbolDatabase *symbolDatabase = mTokenizer->getSymbolDatabase();
|
|
for (const Scope * scope : symbolDatabase->functionScopes) {
|
|
|
|
// function must return long data
|
|
const Token * def = scope->classDef;
|
|
if (!Token::Match(def, "%name% (") || !def->next()->valueType())
|
|
continue;
|
|
const ValueType* retVt = def->next()->valueType();
|
|
|
|
// return statements
|
|
const Token *ret = nullptr;
|
|
for (const Token *tok = scope->bodyStart; tok != scope->bodyEnd; tok = tok->next()) {
|
|
if (tok->str() == "return") {
|
|
if (Token::Match(tok->astOperand1(), "<<|*")) {
|
|
const ValueType *type = tok->astOperand1()->valueType();
|
|
if (type && checkTypeCombination(*type, *retVt, mSettings) &&
|
|
type->pointer == 0U &&
|
|
type->originalTypeName.empty())
|
|
ret = tok;
|
|
}
|
|
// All return statements must have problem otherwise no warning
|
|
if (ret != tok) {
|
|
ret = nullptr;
|
|
break;
|
|
}
|
|
}
|
|
}
|
|
|
|
if (ret)
|
|
longCastReturnError(ret, ret->astOperand1()->valueType(), retVt);
|
|
}
|
|
}
|
|
|
|
static void makeBaseTypeString(std::string& typeStr)
|
|
{
|
|
const auto pos = typeStr.find("signed");
|
|
if (pos != std::string::npos)
|
|
typeStr.erase(typeStr.begin(), typeStr.begin() + pos + 6 + 1);
|
|
}
|
|
|
|
void CheckType::longCastAssignError(const Token *tok, const ValueType* src, const ValueType* tgt)
|
|
{
|
|
std::string srcStr = src ? src->str() : "int";
|
|
makeBaseTypeString(srcStr);
|
|
std::string tgtStr = tgt ? tgt->str() : "long";
|
|
makeBaseTypeString(tgtStr);
|
|
reportError(tok,
|
|
Severity::style,
|
|
"truncLongCastAssignment",
|
|
srcStr + " result is assigned to " + tgtStr + " variable. If the variable is " + tgtStr + " to avoid loss of information, then you have loss of information.\n" +
|
|
srcStr + " result is assigned to " + tgtStr + " variable. If the variable is " + tgtStr + " to avoid loss of information, then there is loss of information. To avoid loss of information you must cast a calculation operand to " + tgtStr + ", for example 'l = a * b;' => 'l = (" + tgtStr + ")a * b;'.", CWE197, Certainty::normal);
|
|
}
|
|
|
|
void CheckType::longCastReturnError(const Token *tok, const ValueType* src, const ValueType* tgt)
|
|
{
|
|
std::string srcStr = src ? src->str() : "int";
|
|
makeBaseTypeString(srcStr);
|
|
std::string tgtStr = tgt ? tgt->str() : "long";
|
|
makeBaseTypeString(tgtStr);
|
|
reportError(tok,
|
|
Severity::style,
|
|
"truncLongCastReturn",
|
|
srcStr +" result is returned as " + tgtStr + " value. If the return value is " + tgtStr + " to avoid loss of information, then you have loss of information.\n" +
|
|
srcStr +" result is returned as " + tgtStr + " value. If the return value is " + tgtStr + " to avoid loss of information, then there is loss of information. To avoid loss of information you must cast a calculation operand to long, for example 'return a*b;' => 'return (long)a*b'.", CWE197, Certainty::normal);
|
|
}
|
|
|
|
//---------------------------------------------------------------------------
|
|
// Checking for float to integer overflow
|
|
//---------------------------------------------------------------------------
|
|
|
|
void CheckType::checkFloatToIntegerOverflow()
|
|
{
|
|
for (const Token *tok = mTokenizer->tokens(); tok; tok = tok->next()) {
|
|
const ValueType *vtint, *vtfloat;
|
|
|
|
// Explicit cast
|
|
if (Token::Match(tok, "( %name%") && tok->astOperand1() && !tok->astOperand2()) {
|
|
vtint = tok->valueType();
|
|
vtfloat = tok->astOperand1()->valueType();
|
|
checkFloatToIntegerOverflow(tok, vtint, vtfloat, tok->astOperand1()->values());
|
|
}
|
|
|
|
// Assignment
|
|
else if (tok->str() == "=" && tok->astOperand1() && tok->astOperand2()) {
|
|
vtint = tok->astOperand1()->valueType();
|
|
vtfloat = tok->astOperand2()->valueType();
|
|
checkFloatToIntegerOverflow(tok, vtint, vtfloat, tok->astOperand2()->values());
|
|
}
|
|
|
|
else if (tok->str() == "return" && tok->astOperand1() && tok->astOperand1()->valueType() && tok->astOperand1()->valueType()->isFloat()) {
|
|
const Scope *scope = tok->scope();
|
|
while (scope && scope->type != Scope::ScopeType::eLambda && scope->type != Scope::ScopeType::eFunction)
|
|
scope = scope->nestedIn;
|
|
if (scope && scope->type == Scope::ScopeType::eFunction && scope->function && scope->function->retDef) {
|
|
const ValueType &valueType = ValueType::parseDecl(scope->function->retDef, *mSettings);
|
|
vtfloat = tok->astOperand1()->valueType();
|
|
checkFloatToIntegerOverflow(tok, &valueType, vtfloat, tok->astOperand1()->values());
|
|
}
|
|
}
|
|
}
|
|
}
|
|
|
|
void CheckType::checkFloatToIntegerOverflow(const Token *tok, const ValueType *vtint, const ValueType *vtfloat, const std::list<ValueFlow::Value> &floatValues)
|
|
{
|
|
// Conversion of float to integer?
|
|
if (!vtint || !vtint->isIntegral())
|
|
return;
|
|
if (!vtfloat || !vtfloat->isFloat())
|
|
return;
|
|
|
|
for (const ValueFlow::Value &f : floatValues) {
|
|
if (f.valueType != ValueFlow::Value::ValueType::FLOAT)
|
|
continue;
|
|
if (!mSettings->isEnabled(&f, false))
|
|
continue;
|
|
if (f.floatValue >= std::exp2(mSettings->platform.long_long_bit))
|
|
floatToIntegerOverflowError(tok, f);
|
|
else if ((-f.floatValue) > std::exp2(mSettings->platform.long_long_bit - 1))
|
|
floatToIntegerOverflowError(tok, f);
|
|
else if (mSettings->platform.type != cppcheck::Platform::Type::Unspecified) {
|
|
int bits = 0;
|
|
if (vtint->type == ValueType::Type::CHAR)
|
|
bits = mSettings->platform.char_bit;
|
|
else if (vtint->type == ValueType::Type::SHORT)
|
|
bits = mSettings->platform.short_bit;
|
|
else if (vtint->type == ValueType::Type::INT)
|
|
bits = mSettings->platform.int_bit;
|
|
else if (vtint->type == ValueType::Type::LONG)
|
|
bits = mSettings->platform.long_bit;
|
|
else if (vtint->type == ValueType::Type::LONGLONG)
|
|
bits = mSettings->platform.long_long_bit;
|
|
else
|
|
continue;
|
|
if (bits < MathLib::bigint_bits && f.floatValue >= (((MathLib::biguint)1) << bits))
|
|
floatToIntegerOverflowError(tok, f);
|
|
}
|
|
}
|
|
}
|
|
|
|
void CheckType::floatToIntegerOverflowError(const Token *tok, const ValueFlow::Value &value)
|
|
{
|
|
std::ostringstream errmsg;
|
|
errmsg << "Undefined behaviour: float (" << value.floatValue << ") to integer conversion overflow.";
|
|
reportError(getErrorPath(tok, &value, "float to integer conversion"),
|
|
value.errorSeverity() ? Severity::error : Severity::warning,
|
|
"floatConversionOverflow",
|
|
errmsg.str(), CWE190, value.isInconclusive() ? Certainty::inconclusive : Certainty::normal);
|
|
}
|