[analyzer] Refine invalidation caused by fread

clang/include/clang/StaticAnalyzer/Core/PathSensitive/MemRegion.h

@@ -1503,7 +1503,7 @@ class MemRegionManager {
   ///  associated element type, index, and super region.
   const ElementRegion *getElementRegion(QualType elementType, NonLoc Idx,
                                         const SubRegion *superRegion,
-                                        ASTContext &Ctx);
+                                        const ASTContext &Ctx);
 
   const ElementRegion *getElementRegionWithSuper(const ElementRegion *ER,
                                                  const SubRegion *superRegion) {

clang/lib/StaticAnalyzer/Checkers/StreamChecker.cpp

@@ -717,18 +717,56 @@ const ExplodedNode *StreamChecker::getAcquisitionSite(const ExplodedNode *N,
   return nullptr;
 }
 
+static std::optional<int64_t> getKnownValue(ProgramStateRef State, SVal V) {
+  SValBuilder &SVB = State->getStateManager().getSValBuilder();
+  if (const llvm::APSInt *Int = SVB.getKnownValue(State, V))
+    return Int->tryExtValue();
+  return std::nullopt;
+}
+
+/// Invalidate only the requested elements instead of the whole buffer.
+/// This is basically a refinement of the more generic 'escapeArgs' or
+/// the plain old 'invalidateRegions'.
+static ProgramStateRef
+escapeByStartIndexAndCount(ProgramStateRef State, const CallEvent &Call,
+                           unsigned BlockCount, const SubRegion *Buffer,
+                           QualType ElemType, int64_t StartIndex,
+                           int64_t ElementCount) {
+  constexpr auto DoNotInvalidateSuperRegion =
+      RegionAndSymbolInvalidationTraits::InvalidationKinds::
+          TK_DoNotInvalidateSuperRegion;
+
+  const LocationContext *LCtx = Call.getLocationContext();
+  const ASTContext &Ctx = State->getStateManager().getContext();
+  SValBuilder &SVB = State->getStateManager().getSValBuilder();
+  auto &RegionManager = Buffer->getMemRegionManager();
+
+  SmallVector<SVal> EscapingVals;
+  EscapingVals.reserve(ElementCount);
+
+  RegionAndSymbolInvalidationTraits ITraits;
+  for (auto Idx : llvm::seq(StartIndex, StartIndex + ElementCount)) {
+    NonLoc Index = SVB.makeArrayIndex(Idx);
+    const auto *Element =
+        RegionManager.getElementRegion(ElemType, Index, Buffer, Ctx);
+    EscapingVals.push_back(loc::MemRegionVal(Element));
+    ITraits.setTrait(Element, DoNotInvalidateSuperRegion);
+  }
+  return State->invalidateRegions(
+      EscapingVals, Call.getOriginExpr(), BlockCount, LCtx,
+      /*CausesPointerEscape=*/false,
+      /*InvalidatedSymbols=*/nullptr, &Call, &ITraits);
+}
+
 static ProgramStateRef escapeArgs(ProgramStateRef State, CheckerContext &C,
                                   const CallEvent &Call,
                                   ArrayRef<unsigned int> EscapingArgs) {
-  const auto *CE = Call.getOriginExpr();
-
-  SmallVector<SVal> EscapingVals;
-  EscapingVals.reserve(EscapingArgs.size());
-  for (auto EscArgIdx : EscapingArgs)
-    EscapingVals.push_back(Call.getArgSVal(EscArgIdx));
-  State = State->invalidateRegions(EscapingVals, CE, C.blockCount(),
-                                   C.getLocationContext(),
-                                   /*CausesPointerEscape=*/false);
+  auto GetArgSVal = [&Call](int Idx) { return Call.getArgSVal(Idx); };
+  auto EscapingVals = to_vector(map_range(EscapingArgs, GetArgSVal));
+  State = State->invalidateRegions(EscapingVals, Call.getOriginExpr(),
+                                   C.blockCount(), C.getLocationContext(),
+                                   /*CausesPointerEscape=*/false,
+                                   /*InvalidatedSymbols=*/nullptr);
   return State;
 }
 
@@ -907,6 +945,76 @@ void StreamChecker::preWrite(const FnDescription *Desc, const CallEvent &Call,
   C.addTransition(State);
 }
 
+static std::optional<QualType> getPointeeType(const MemRegion *R) {
+  if (!R)
+    return std::nullopt;
+  if (const auto *ER = dyn_cast<ElementRegion>(R))
+    return ER->getElementType();
+  if (const auto *TR = dyn_cast<TypedValueRegion>(R))
+    return TR->getValueType();
+  if (const auto *SR = dyn_cast<SymbolicRegion>(R))
+    return SR->getPointeeStaticType();
+  return std::nullopt;
+}
+
+static std::optional<NonLoc> getStartIndex(SValBuilder &SVB,
+                                           const MemRegion *R) {
+  if (!R)
+    return std::nullopt;
+
+  auto Zero = [&SVB] {
+    BasicValueFactory &BVF = SVB.getBasicValueFactory();
+    return nonloc::ConcreteInt(BVF.getIntValue(0, /*isUnsigned=*/false));
+  };
+
+  if (const auto *ER = dyn_cast<ElementRegion>(R))
+    return ER->getIndex();
+  if (const auto *TR = dyn_cast<TypedValueRegion>(R))
+    return Zero();
+  if (const auto *SR = dyn_cast<SymbolicRegion>(R))
+    return Zero();
+  return std::nullopt;
+}
+
+static ProgramStateRef
+tryToInvalidateFReadBufferByElements(ProgramStateRef State, CheckerContext &C,
+                                     const CallEvent &Call, NonLoc SizeVal,
+                                     NonLoc NMembVal) {
+  // Try to invalidate the individual elements.
+  const auto *Buffer =
+      dyn_cast_or_null<SubRegion>(Call.getArgSVal(0).getAsRegion());
+
+  std::optional<QualType> ElemTy = getPointeeType(Buffer);
+  std::optional<SVal> StartElementIndex =
+      getStartIndex(C.getSValBuilder(), Buffer);
+
+  // Drop the outermost ElementRegion to get the buffer.
+  if (const auto *ER = dyn_cast_or_null<ElementRegion>(Buffer))
+    Buffer = dyn_cast<SubRegion>(ER->getSuperRegion());
+
+  std::optional<int64_t> CountVal = getKnownValue(State, NMembVal);
+  std::optional<int64_t> Size = getKnownValue(State, SizeVal);
+  std::optional<int64_t> StartIndexVal =
+      getKnownValue(State, StartElementIndex.value_or(UnknownVal()));
+
+  if (ElemTy && CountVal && Size && StartIndexVal) {
+    int64_t NumBytesRead = Size.value() * CountVal.value();
+    int64_t ElemSizeInChars =
+        C.getASTContext().getTypeSizeInChars(*ElemTy).getQuantity();
+    bool IncompleteLastElement = (NumBytesRead % ElemSizeInChars) != 0;
+    int64_t NumCompleteOrIncompleteElementsRead =
+        NumBytesRead / ElemSizeInChars + IncompleteLastElement;
+
+    constexpr int MaxInvalidatedElementsLimit = 64;
+    if (NumCompleteOrIncompleteElementsRead <= MaxInvalidatedElementsLimit) {
+      return escapeByStartIndexAndCount(State, Call, C.blockCount(), Buffer,
+                                        *ElemTy, *StartIndexVal,
+                                        NumCompleteOrIncompleteElementsRead);
+    }
+  }
+  return nullptr;
+}
+
 void StreamChecker::evalFreadFwrite(const FnDescription *Desc,
                                     const CallEvent &Call, CheckerContext &C,
                                     bool IsFread) const {
@@ -937,8 +1045,14 @@ void StreamChecker::evalFreadFwrite(const FnDescription *Desc,
 
   // At read, invalidate the buffer in any case of error or success,
   // except if EOF was already present.
-  if (IsFread && !E.isStreamEof())
-    State = escapeArgs(State, C, Call, {0});
+  if (IsFread && !E.isStreamEof()) {
+    // Try to invalidate the individual elements.
+    // Otherwise just fall back to invalidating the whole buffer.
+    ProgramStateRef InvalidatedState = tryToInvalidateFReadBufferByElements(
+        State, C, Call, *SizeVal, *NMembVal);
+    State =
+        InvalidatedState ? InvalidatedState : escapeArgs(State, C, Call, {0});
+  }
 
   // Generate a transition for the success state.
   // If we know the state to be FEOF at fread, do not add a success state.

clang/lib/StaticAnalyzer/Core/MemRegion.cpp

@@ -1155,10 +1155,10 @@ MemRegionManager::getCompoundLiteralRegion(const CompoundLiteralExpr *CL,
   return getSubRegion<CompoundLiteralRegion>(CL, sReg);
 }
 
-const ElementRegion*
+const ElementRegion *
 MemRegionManager::getElementRegion(QualType elementType, NonLoc Idx,
-                                   const SubRegion* superRegion,
-                                   ASTContext &Ctx){
+                                   const SubRegion *superRegion,
+                                   const ASTContext &Ctx) {
   QualType T = Ctx.getCanonicalType(elementType).getUnqualifiedType();
 
   llvm::FoldingSetNodeID ID;

clang/test/Analysis/Inputs/system-header-simulator-for-simple-stream.h

@@ -5,12 +5,15 @@
 // suppressed.
 #pragma clang system_header
 
+typedef __typeof(sizeof(int)) size_t;
 typedef struct _FILE {
   unsigned char *_p;
 } FILE;
 FILE *fopen(const char *restrict, const char *restrict) __asm("_" "fopen" );
 int fputc(int, FILE *);
 int fputs(const char *restrict, FILE *restrict) __asm("_" "fputs" );
+size_t fread(void *buffer, size_t size, size_t count, FILE *stream);
+int fgetc(FILE *stream);
 int fclose(FILE *);
 void exit(int);