Skip to content

Commit 2b6160e

Browse files
committed
[analyzer] MmapWriteExecChecker: use getAs instead of castAs
Use 'getAs' instead of 'castAs' Reviewed By: steakhal Fixes llvm#62285 Differential Revision: https://reviews.llvm.org/D158953
1 parent fa1dc06 commit 2b6160e

File tree

2 files changed

+10
-2
lines changed

2 files changed

+10
-2
lines changed

clang/lib/StaticAnalyzer/Checkers/MmapWriteExecChecker.cpp

Lines changed: 4 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -48,8 +48,10 @@ void MmapWriteExecChecker::checkPreCall(const CallEvent &Call,
4848
CheckerContext &C) const {
4949
if (matchesAny(Call, MmapFn, MprotectFn)) {
5050
SVal ProtVal = Call.getArgSVal(2);
51-
auto ProtLoc = ProtVal.castAs<nonloc::ConcreteInt>();
52-
int64_t Prot = ProtLoc.getValue().getSExtValue();
51+
auto ProtLoc = ProtVal.getAs<nonloc::ConcreteInt>();
52+
if (!ProtLoc)
53+
return;
54+
int64_t Prot = ProtLoc->getValue().getSExtValue();
5355
if (ProtExecOv != ProtExec)
5456
ProtExec = ProtExecOv;
5557
if (ProtReadOv != ProtRead)

clang/test/Analysis/mmap-writeexec.c

Lines changed: 6 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -42,3 +42,9 @@ void f3(void)
4242
int m = mprotect(p, 1024, PROT_WRITE | PROT_EXEC); // expected-warning{{Both PROT_WRITE and PROT_EXEC flags are set. This can lead to exploitable memory regions, which could be overwritten with malicious code}}
4343
(void)m;
4444
}
45+
46+
// gh62285: no crash on non concrete arg 'prot'
47+
void *gh62285(void *addr, int prot)
48+
{
49+
return mmap(addr, 1, prot, 1, 1, 1);
50+
}

0 commit comments

Comments
 (0)