[clang][analyzer] PointerSubChecker should not warn on pointers converted to numerical type

[balazske]

Pointer values casted to integer (non-pointer) type should be able to be subtracted as usual.

[llvmbot]

@llvm/pr-subscribers-clang

@llvm/pr-subscribers-clang-static-analyzer-1

Author: Balázs Kéri (balazske)

Changes

Pointer values casted to integer (non-pointer) type should be able to be subtracted as usual.

---

Full diff: https://github.com/llvm/llvm-project/pull/111846.diff

2 Files Affected:

• (modified) clang/lib/StaticAnalyzer/Checkers/PointerSubChecker.cpp (+4)
• (modified) clang/test/Analysis/pointer-sub.c (+7)

diff --git a/clang/lib/StaticAnalyzer/Checkers/PointerSubChecker.cpp b/clang/lib/StaticAnalyzer/Checkers/PointerSubChecker.cpp
index f0dc5efd75f7d6..7a85d9e2073068 100644
--- a/clang/lib/StaticAnalyzer/Checkers/PointerSubChecker.cpp
+++ b/clang/lib/StaticAnalyzer/Checkers/PointerSubChecker.cpp
@@ -61,6 +61,10 @@ void PointerSubChecker::checkPreStmt(const BinaryOperator *B,
   if (LR->getSymbolicBase() || RR->getSymbolicBase())
     return;
 
+  if (!B->getLHS()->getType()->isPointerType() ||
+      !B->getRHS()->getType()->isPointerType())
+    return;
+
   const auto *ElemLR = dyn_cast<ElementRegion>(LR);
   const auto *ElemRR = dyn_cast<ElementRegion>(RR);
 
diff --git a/clang/test/Analysis/pointer-sub.c b/clang/test/Analysis/pointer-sub.c
index 1c9d676ebb8f24..7a1dcb653a28c4 100644
--- a/clang/test/Analysis/pointer-sub.c
+++ b/clang/test/Analysis/pointer-sub.c
@@ -10,6 +10,9 @@ void f1(void) {
   d = &x - (&x + 1); // no-warning
   d = (&x + 0) - &x; // no-warning
   d = (z + 10) - z; // no-warning
+  d = (unsigned long)&y - (unsigned long)&x; // no-warning
+  unsigned long l = 1;
+  d = l - (unsigned long)&y; // no-warning
 }
 
 void f2(void) {
@@ -28,6 +31,10 @@ void f2(void) {
 
   d = (int *)((char *)(&a[4]) + sizeof(int)) - &a[4]; // no-warning (pointers into the same array data)
   d = (int *)((char *)(&a[4]) + 1) - &a[4]; // expected-warning{{Subtraction of two pointers that}}
+
+  long a1 = (long)&a[1];
+  long b1 = (long)&b[1];
+  d = a1 - b1;
 }
 
 void f3(void) {

[NagyDonat]

The change LGTM, I think we can merge it.

My only nitpick was that I tweaked the PR title to make it a bit more accurate. (Feel free to tweak it further / discuss this if you disagree with my choice.)

[karka228]

The change LGTM, I think we can merge it.

I guess the testcase pointer-sub.c have to be fixed to work on the windows buildbot, also. Right?

[NagyDonat]

The change LGTM, I think we can merge it.

I guess the testcase pointer-sub.c have to be fixed to work on the windows buildbot, also. Right?

Right, thanks for catching my mistake!