[-Wunsafe-buffer-usage] Fix false positives for constant cases #92432

jkorous-apple · 2024-05-16T17:23:15Z

addresses #92191

llvmbot · 2024-05-16T17:23:45Z

@llvm/pr-subscribers-clang

Author: None (jkorous-apple)

Changes

addresses #92191

Full diff: https://github.com/llvm/llvm-project/pull/92432.diff

2 Files Affected:

(modified) clang/lib/Analysis/UnsafeBufferUsage.cpp (+53-14)
(added) clang/test/SemaCXX/warn-unsafe-buffer-usage-constant-buffer-constant-index.cpp (+17)

diff --git a/clang/lib/Analysis/UnsafeBufferUsage.cpp b/clang/lib/Analysis/UnsafeBufferUsage.cpp
index c42e70d5b95ac..dc265b9039a5f 100644
--- a/clang/lib/Analysis/UnsafeBufferUsage.cpp
+++ b/clang/lib/Analysis/UnsafeBufferUsage.cpp
@@ -420,25 +420,64 @@ AST_MATCHER(ArraySubscriptExpr, isSafeArraySubscript) {
   //    already duplicated
   //  - call both from Sema and from here
 
-  const auto *BaseDRE =
-      dyn_cast<DeclRefExpr>(Node.getBase()->IgnoreParenImpCasts());
-  if (!BaseDRE)
+  if (const auto *BaseDRE =
+      dyn_cast<DeclRefExpr>(Node.getBase()->IgnoreParenImpCasts())) {
+    if (!BaseDRE->getDecl())
+      return false;
+    if (const auto *CATy = Finder->getASTContext().getAsConstantArrayType(
+      BaseDRE->getDecl()->getType())) {
+      if (const auto *IdxLit = dyn_cast<IntegerLiteral>(Node.getIdx())) {
+        const APInt ArrIdx = IdxLit->getValue();
+        // FIXME: ArrIdx.isNegative() we could immediately emit an error as that's a
+        // bug
+        if (ArrIdx.isNonNegative() &&
+            ArrIdx.getLimitedValue() < CATy->getLimitedSize())
+          return true;
+      }
+    }
+  }
+
+  if (const auto *BaseSL =
+      dyn_cast<StringLiteral>(Node.getBase()->IgnoreParenImpCasts())) {
+    if (const auto *CATy = Finder->getASTContext().getAsConstantArrayType(
+      BaseSL->getType())) {
+      if (const auto *IdxLit = dyn_cast<IntegerLiteral>(Node.getIdx())) {
+          const APInt ArrIdx = IdxLit->getValue();
+          // FIXME: ArrIdx.isNegative() we could immediately emit an error as that's a
+          // bug
+          if (ArrIdx.isNonNegative() &&
+              ArrIdx.getLimitedValue() < CATy->getLimitedSize())
+            return true;
+      }
+    }
+  }
+
+  return false;
+}
+
+AST_MATCHER(BinaryOperator, isSafePtrArithmetic) {
+  if (Node.getOpcode() != BinaryOperatorKind::BO_Add)
     return false;
-  if (!BaseDRE->getDecl())
+
+  const auto *LHSDRE =
+      dyn_cast<DeclRefExpr>(Node.getLHS()->IgnoreImpCasts());
+  if (!LHSDRE)
     return false;
+
   const auto *CATy = Finder->getASTContext().getAsConstantArrayType(
-      BaseDRE->getDecl()->getType());
+    LHSDRE->getDecl()->getType());
   if (!CATy)
     return false;
 
-  if (const auto *IdxLit = dyn_cast<IntegerLiteral>(Node.getIdx())) {
-    const APInt ArrIdx = IdxLit->getValue();
-    // FIXME: ArrIdx.isNegative() we could immediately emit an error as that's a
-    // bug
-    if (ArrIdx.isNonNegative() &&
-        ArrIdx.getLimitedValue() < CATy->getLimitedSize())
-      return true;
-  }
+  const auto *RHSIntLit = dyn_cast<IntegerLiteral>(Node.getRHS());
+  if (!RHSIntLit)
+    return false;
+
+  const APInt BufferOffset = RHSIntLit->getValue();
+
+  if (BufferOffset.isNonNegative() &&
+      BufferOffset.getLimitedValue() < CATy->getLimitedSize())
+    return true;
 
   return false;
 }
@@ -692,7 +731,7 @@ class PointerArithmeticGadget : public WarningGadget {
               hasLHS(expr(hasPointerType()).bind(PointerArithmeticPointerTag)),
               hasRHS(HasIntegerType));
 
-    return stmt(binaryOperator(anyOf(PtrAtLeft, PtrAtRight))
+    return stmt(binaryOperator(anyOf(PtrAtLeft, PtrAtRight), unless(isSafePtrArithmetic()))
                     .bind(PointerArithmeticTag));
   }
 
diff --git a/clang/test/SemaCXX/warn-unsafe-buffer-usage-constant-buffer-constant-index.cpp b/clang/test/SemaCXX/warn-unsafe-buffer-usage-constant-buffer-constant-index.cpp
new file mode 100644
index 0000000000000..abacfcfee0296
--- /dev/null
+++ b/clang/test/SemaCXX/warn-unsafe-buffer-usage-constant-buffer-constant-index.cpp
@@ -0,0 +1,17 @@
+// RUN: %clang_cc1 -std=c++20 -Wno-everything -Wunsafe-buffer-usage \
+// RUN:            -fsafe-buffer-usage-suggestions \
+// RUN:            -verify %s
+
+void char_literal() {
+  if ("abc"[2] == 'c')
+    return;
+  if ("def"[3] == '0')
+    return;
+}
+
+void const_size_buffer_arithmetic() {
+  char kBuf[64] = {};
+  const char* p = kBuf + 1;
+}
+
+// expected-no-diagnostics

llvmbot · 2024-05-16T17:23:46Z

@llvm/pr-subscribers-clang-analysis

Author: None (jkorous-apple)

Changes

addresses #92191

Full diff: https://github.com/llvm/llvm-project/pull/92432.diff

2 Files Affected:

(modified) clang/lib/Analysis/UnsafeBufferUsage.cpp (+53-14)
(added) clang/test/SemaCXX/warn-unsafe-buffer-usage-constant-buffer-constant-index.cpp (+17)

diff --git a/clang/lib/Analysis/UnsafeBufferUsage.cpp b/clang/lib/Analysis/UnsafeBufferUsage.cpp
index c42e70d5b95ac..dc265b9039a5f 100644
--- a/clang/lib/Analysis/UnsafeBufferUsage.cpp
+++ b/clang/lib/Analysis/UnsafeBufferUsage.cpp
@@ -420,25 +420,64 @@ AST_MATCHER(ArraySubscriptExpr, isSafeArraySubscript) {
   //    already duplicated
   //  - call both from Sema and from here
 
-  const auto *BaseDRE =
-      dyn_cast<DeclRefExpr>(Node.getBase()->IgnoreParenImpCasts());
-  if (!BaseDRE)
+  if (const auto *BaseDRE =
+      dyn_cast<DeclRefExpr>(Node.getBase()->IgnoreParenImpCasts())) {
+    if (!BaseDRE->getDecl())
+      return false;
+    if (const auto *CATy = Finder->getASTContext().getAsConstantArrayType(
+      BaseDRE->getDecl()->getType())) {
+      if (const auto *IdxLit = dyn_cast<IntegerLiteral>(Node.getIdx())) {
+        const APInt ArrIdx = IdxLit->getValue();
+        // FIXME: ArrIdx.isNegative() we could immediately emit an error as that's a
+        // bug
+        if (ArrIdx.isNonNegative() &&
+            ArrIdx.getLimitedValue() < CATy->getLimitedSize())
+          return true;
+      }
+    }
+  }
+
+  if (const auto *BaseSL =
+      dyn_cast<StringLiteral>(Node.getBase()->IgnoreParenImpCasts())) {
+    if (const auto *CATy = Finder->getASTContext().getAsConstantArrayType(
+      BaseSL->getType())) {
+      if (const auto *IdxLit = dyn_cast<IntegerLiteral>(Node.getIdx())) {
+          const APInt ArrIdx = IdxLit->getValue();
+          // FIXME: ArrIdx.isNegative() we could immediately emit an error as that's a
+          // bug
+          if (ArrIdx.isNonNegative() &&
+              ArrIdx.getLimitedValue() < CATy->getLimitedSize())
+            return true;
+      }
+    }
+  }
+
+  return false;
+}
+
+AST_MATCHER(BinaryOperator, isSafePtrArithmetic) {
+  if (Node.getOpcode() != BinaryOperatorKind::BO_Add)
     return false;
-  if (!BaseDRE->getDecl())
+
+  const auto *LHSDRE =
+      dyn_cast<DeclRefExpr>(Node.getLHS()->IgnoreImpCasts());
+  if (!LHSDRE)
     return false;
+
   const auto *CATy = Finder->getASTContext().getAsConstantArrayType(
-      BaseDRE->getDecl()->getType());
+    LHSDRE->getDecl()->getType());
   if (!CATy)
     return false;
 
-  if (const auto *IdxLit = dyn_cast<IntegerLiteral>(Node.getIdx())) {
-    const APInt ArrIdx = IdxLit->getValue();
-    // FIXME: ArrIdx.isNegative() we could immediately emit an error as that's a
-    // bug
-    if (ArrIdx.isNonNegative() &&
-        ArrIdx.getLimitedValue() < CATy->getLimitedSize())
-      return true;
-  }
+  const auto *RHSIntLit = dyn_cast<IntegerLiteral>(Node.getRHS());
+  if (!RHSIntLit)
+    return false;
+
+  const APInt BufferOffset = RHSIntLit->getValue();
+
+  if (BufferOffset.isNonNegative() &&
+      BufferOffset.getLimitedValue() < CATy->getLimitedSize())
+    return true;
 
   return false;
 }
@@ -692,7 +731,7 @@ class PointerArithmeticGadget : public WarningGadget {
               hasLHS(expr(hasPointerType()).bind(PointerArithmeticPointerTag)),
               hasRHS(HasIntegerType));
 
-    return stmt(binaryOperator(anyOf(PtrAtLeft, PtrAtRight))
+    return stmt(binaryOperator(anyOf(PtrAtLeft, PtrAtRight), unless(isSafePtrArithmetic()))
                     .bind(PointerArithmeticTag));
   }
 
diff --git a/clang/test/SemaCXX/warn-unsafe-buffer-usage-constant-buffer-constant-index.cpp b/clang/test/SemaCXX/warn-unsafe-buffer-usage-constant-buffer-constant-index.cpp
new file mode 100644
index 0000000000000..abacfcfee0296
--- /dev/null
+++ b/clang/test/SemaCXX/warn-unsafe-buffer-usage-constant-buffer-constant-index.cpp
@@ -0,0 +1,17 @@
+// RUN: %clang_cc1 -std=c++20 -Wno-everything -Wunsafe-buffer-usage \
+// RUN:            -fsafe-buffer-usage-suggestions \
+// RUN:            -verify %s
+
+void char_literal() {
+  if ("abc"[2] == 'c')
+    return;
+  if ("def"[3] == '0')
+    return;
+}
+
+void const_size_buffer_arithmetic() {
+  char kBuf[64] = {};
+  const char* p = kBuf + 1;
+}
+
+// expected-no-diagnostics

github-actions · 2024-05-16T17:25:59Z

✅ With the latest revision this PR passed the C/C++ code formatter.

pkasting · 2024-05-16T19:48:07Z

clang/lib/Analysis/UnsafeBufferUsage.cpp

+
+  const APInt BufferOffset = RHSIntLit->getValue();
+
+  if (BufferOffset.isNonNegative() &&


I don't speak AST, but does this still handle (i.e. not warn on) cases like constexpr char* p = (buf + 1) - 1;? Or is the presence of any subtraction enough to trigger a warning?

What about constexpr char* p = buf + 1; constexpr char* p2 = p - 1;? Should we be able to detect that this is safe, and not warn?

True, this is not covered - just like more complex arithmetic expressions with are not yet covered with fixits.
But I'd rather land the incomplete solution that possibly addresses majority of false positives in real code now and improve the solution later.

That seems reasonable, but if that's the route, I might want to file a bug pre-emptively on further cases that should, or should not, be considered for future work.

One of my thoughts with the refactor suggestion below was that if the arithmetic/detection got more complex, it would be easier to implement consistently in a single place.

This code is just a short-term solution until we get to do it properly. I don't want to invest effort into polishing the code because we should replace it.

See this FIXME:
https://github.com/llvm/llvm-project/blob/main/clang/lib/Analysis/UnsafeBufferUsage.cpp#L416

Feel free to file issues but at this point I think it's not a good use of our time because only the very trivial case gets recognized.
Ultimately the cases that should be supported are likely to be found in Sema tests for the functionality referred to by the FIXME above.

There's this whole Expr->EvaluateAsInt() thing which is arguably even simpler to use than your existing code, and it constant-folds pretty well. We should probably just use that, instead of matching integer literals.

But it still won't handle the case where there's nested layers of arithmetic over the base pointer, like (ptr + 1) - 1. It'll only handle like ptr + (1 - 1). We'll have to support that separately. I suspect that it's still relatively easy to do with plain old recursion but this probably doesn't need to block this patch.

pkasting · 2024-05-16T19:49:00Z

clang/lib/Analysis/UnsafeBufferUsage.cpp

+      return false;
+    if (const auto *CATy = Finder->getASTContext().getAsConstantArrayType(
+            BaseDRE->getDecl()->getType())) {
+      if (const auto *IdxLit = dyn_cast<IntegerLiteral>(Node.getIdx())) {


It feels like this block is repeated, more or less, several times. Is there a way to factor it?

True but the block is also trivial and I am not convinced factoring it out as a separate function is worth it or leads to better code.

I was thinking more a lambda. I don't know LLVM's coding conventions very well, though.

I don't think it's worth it.

I suspect that this could have been a:

const Expr *BaseE = Node.getBase()->IgnoreParenImpCasts(); if (isa<DeclRefExpr, StringLiteral>(BaseE)) { if (const auto *CATy = Finder->getASTContext().getAsConstantArrayType(BaseE->getType())) { ... } }

Which would also eliminate duplication. (Unless DeclRefExpr->getDecl()->getType() is somehow significantly different from DeclRefExpr->getType().)

Another thing we can try is to simply eliminate the isa entirely. Like, we know that it's "an" expression, and its type is a constant-size array type. Do we really need more? Why not simply trust the type system? (It's not like the C type system has ever lied to us right? 😅)

pkasting

Drive-by

ziqingluo-90 · 2024-05-20T18:58:18Z

clang/lib/Analysis/UnsafeBufferUsage.cpp

    return false;
-  if (!BaseDRE->getDecl())
+
+  const auto *LHSDRE =


For both the AST matchers, I'm just curious if we really need to make sure the left-hand side is a DRE? Could we just try to test if its' type is a constant array type regardless of its' expression kind?

haoNoQ

Overall looks great!

I think I see a couple easy improvements, this isn't blocking but let's take a moment to consider them 😊

haoNoQ · 2024-05-20T18:45:36Z

clang/lib/Analysis/UnsafeBufferUsage.cpp

+      return false;
+    if (const auto *CATy = Finder->getASTContext().getAsConstantArrayType(
+            BaseDRE->getDecl()->getType())) {
+      if (const auto *IdxLit = dyn_cast<IntegerLiteral>(Node.getIdx())) {


I suspect that this could have been a:

const Expr *BaseE = Node.getBase()->IgnoreParenImpCasts(); if (isa<DeclRefExpr, StringLiteral>(BaseE)) { if (const auto *CATy = Finder->getASTContext().getAsConstantArrayType(BaseE->getType())) { ... } }

Which would also eliminate duplication. (Unless DeclRefExpr->getDecl()->getType() is somehow significantly different from DeclRefExpr->getType().)

Another thing we can try is to simply eliminate the isa entirely. Like, we know that it's "an" expression, and its type is a constant-size array type. Do we really need more? Why not simply trust the type system? (It's not like the C type system has ever lied to us right? 😅)

haoNoQ · 2024-05-20T18:51:00Z

clang/lib/Analysis/UnsafeBufferUsage.cpp

+
+  const APInt BufferOffset = RHSIntLit->getValue();
+
+  if (BufferOffset.isNonNegative() &&


There's this whole Expr->EvaluateAsInt() thing which is arguably even simpler to use than your existing code, and it constant-folds pretty well. We should probably just use that, instead of matching integer literals.

But it still won't handle the case where there's nested layers of arithmetic over the base pointer, like (ptr + 1) - 1. It'll only handle like ptr + (1 - 1). We'll have to support that separately. I suspect that it's still relatively easy to do with plain old recursion but this probably doesn't need to block this patch.

haoNoQ · 2024-05-20T19:42:54Z

clang/test/SemaCXX/warn-unsafe-buffer-usage-constant-buffer-constant-index.cpp

+  const char* p = kBuf + 1;
+}
+
+// expected-no-diagnostics


Extreme nitpicking: I usually put those on top of the file because otherwise I'd be super confused where all those expected warnings are at. We also really don't want it to end up in the middle of the file if folks add more code at the bottom without reading the comment.

haoNoQ · 2024-05-20T19:44:32Z

clang/lib/Analysis/UnsafeBufferUsage.cpp

    return false;
-  if (!BaseDRE->getDecl())
+
+  const auto *LHSDRE = dyn_cast<DeclRefExpr>(Node.getLHS()->IgnoreImpCasts());


I guess we might as well support the "abc" + 3 case here. With the ultimate goal of ultimately supporting

static const char *const abc = "abc"; abc[3]; abc + 3;

But also arguably not urgent.

malavikasamak · 2025-04-30T18:19:32Z

Identifying safe operations on String literals has already landed as part of: #115552. However, identifying safe pointer arithmetic is not yet available. So, maybe we should revisit this PR once again.

[-Wunsafe-buffer-usage] Fix false positives for constant cases

4573531

jkorous-apple requested review from haoNoQ, malavikasamak, ziqingluo-90 and t-rasmud May 16, 2024 17:23

llvmbot added clang Clang issues not falling into any other category clang:analysis labels May 16, 2024

clang-format

7e2f59b

pkasting reviewed May 16, 2024

View reviewed changes

ziqingluo-90 reviewed May 20, 2024

View reviewed changes

haoNoQ reviewed May 20, 2024

View reviewed changes

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

[-Wunsafe-buffer-usage] Fix false positives for constant cases #92432

[-Wunsafe-buffer-usage] Fix false positives for constant cases #92432

jkorous-apple commented May 16, 2024

llvmbot commented May 16, 2024

llvmbot commented May 16, 2024

github-actions bot commented May 16, 2024 •

edited

Loading

pkasting May 16, 2024

jkorous-apple May 16, 2024

pkasting May 18, 2024

jkorous-apple May 20, 2024

jkorous-apple May 20, 2024

haoNoQ May 20, 2024

pkasting May 16, 2024

jkorous-apple May 16, 2024

pkasting May 18, 2024

jkorous-apple May 20, 2024

haoNoQ May 20, 2024

pkasting left a comment

ziqingluo-90 May 20, 2024

haoNoQ left a comment

haoNoQ May 20, 2024

haoNoQ May 20, 2024

haoNoQ May 20, 2024

haoNoQ May 20, 2024 •

edited

Loading

malavikasamak commented Apr 30, 2025


		const APInt BufferOffset = RHSIntLit->getValue();

		if (BufferOffset.isNonNegative() &&

[-Wunsafe-buffer-usage] Fix false positives for constant cases #92432

Are you sure you want to change the base?

[-Wunsafe-buffer-usage] Fix false positives for constant cases #92432

Conversation

jkorous-apple commented May 16, 2024

llvmbot commented May 16, 2024

llvmbot commented May 16, 2024

github-actions bot commented May 16, 2024 • edited Loading

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

pkasting left a comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

haoNoQ left a comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

haoNoQ May 20, 2024 • edited Loading

Choose a reason for hiding this comment

malavikasamak commented Apr 30, 2025

github-actions bot commented May 16, 2024 •

edited

Loading

haoNoQ May 20, 2024 •

edited

Loading