39   void checkPostStmt(const CallExpr *CE, CheckerContext &C) const;
41   void checkPreStmt(const CallExpr *CE, CheckerContext &C) const;
56   bool checkPre(const CallExpr *CE, CheckerContext &C) const;
59   void addSourcesPre(const CallExpr *CE, CheckerContext &C) const;
62   bool propagateFromPre(const CallExpr *CE, CheckerContext &C) const;
65   void addSourcesPost(const CallExpr *CE, CheckerContext &C) const;
77   ProgramStateRef postScanf(const CallExpr *CE, CheckerContext &C) const;
78   ProgramStateRef postSocket(const CallExpr *CE, CheckerContext &C) const;
79   ProgramStateRef postRetTaint(const CallExpr *CE, CheckerContext &C) const;
82   ProgramStateRef preFscanf(const CallExpr *CE, CheckerContext &C) const;
86   bool checkUncontrolledFormatString(const CallExpr *CE,
93   bool checkSystemCall(const CallExpr *CE, StringRef Name,
99   bool checkTaintedBufferSize(const CallExpr *CE, const FunctionDecl *FDecl,
172     ProgramStateRef process(const CallExpr *CE, CheckerContext &C) const;
278 void GenericTaintChecker::checkPreStmt(const CallExpr *CE,  in checkPreStmt()  argument
281   if (checkPre(CE, C))  in checkPreStmt()
285   addSourcesPre(CE, C);  in checkPreStmt()
288 void GenericTaintChecker::checkPostStmt(const CallExpr *CE,  in checkPostStmt()  argument
290   if (propagateFromPre(CE, C))  in checkPostStmt()
292   addSourcesPost(CE, C);  in checkPostStmt()
295 void GenericTaintChecker::addSourcesPre(const CallExpr *CE,  in addSourcesPre()  argument
298   const FunctionDecl *FDecl = C.getCalleeDecl(CE);  in addSourcesPre()
310     State = Rule.process(CE, C);  in addSourcesPre()
323     State = (this->*evalFunction)(CE, C);  in addSourcesPre()
329 bool GenericTaintChecker::propagateFromPre(const CallExpr *CE,  in propagateFromPre()  argument
347       State = State->addTaint(CE, C.getLocationContext());  in propagateFromPre()
353     if (CE->getNumArgs() < (ArgNum + 1))  in propagateFromPre()
355     const Expr *Arg = CE->getArg(ArgNum);  in propagateFromPre()
371 void GenericTaintChecker::addSourcesPost(const CallExpr *CE,  in addSourcesPost()  argument
375   const FunctionDecl *FDecl = C.getCalleeDecl(CE);  in addSourcesPost()
401     State = (this->*evalFunction)(CE, C);  in addSourcesPost()
408 bool GenericTaintChecker::checkPre(const CallExpr *CE,  in checkPre()  argument
411   if (checkUncontrolledFormatString(CE, C))  in checkPre()
414   const FunctionDecl *FDecl = C.getCalleeDecl(CE);  in checkPre()
422   if (checkSystemCall(CE, Name, C))  in checkPre()
425   if (checkTaintedBufferSize(CE, FDecl, C))  in checkPre()
457 GenericTaintChecker::TaintPropagationRule::process(const CallExpr *CE,  in process()  argument
470       for (unsigned int i = 0; i < CE->getNumArgs(); ++i) {  in process()
473         if ((IsTainted = isTaintedOrPointsToTainted(CE->getArg(i), State, C)))  in process()
479     if (CE->getNumArgs() < (ArgNum + 1))  in process()
481     if ((IsTainted = isTaintedOrPointsToTainted(CE->getArg(ArgNum), State, C)))  in process()
498       for (unsigned int i = 0; i < CE->getNumArgs(); ++i) {  in process()
499         const Expr *Arg = CE->getArg(i);  in process()
517     assert(ArgNum < CE->getNumArgs());  in process()
526 ProgramStateRef GenericTaintChecker::preFscanf(const CallExpr *CE,  in preFscanf()  argument
528   assert(CE->getNumArgs() >= 2);  in preFscanf()
532   if (State->isTainted(CE->getArg(0), C.getLocationContext()) ||  in preFscanf()
533       isStdin(CE->getArg(0), C)) {  in preFscanf()
535     for (unsigned int i = 2; i < CE->getNumArgs(); ++i)  in preFscanf()
544 ProgramStateRef GenericTaintChecker::postSocket(const CallExpr *CE,  in postSocket()  argument
547   if (CE->getNumArgs() < 3)  in postSocket()
550   SourceLocation DomLoc = CE->getArg(0)->getExprLoc();  in postSocket()
556   State = State->addTaint(CE, C.getLocationContext());  in postSocket()
560 ProgramStateRef GenericTaintChecker::postScanf(const CallExpr *CE,  in postScanf()  argument
563   if (CE->getNumArgs() < 2)  in postScanf()
567   for (unsigned int i = 1; i < CE->getNumArgs(); ++i) {  in postScanf()
570     const Expr *Arg = CE->getArg(i);  in postScanf()
578 ProgramStateRef GenericTaintChecker::postRetTaint(const CallExpr *CE,  in postRetTaint()  argument
580   return C.getState()->addTaint(CE, C.getLocationContext());  in postRetTaint()
618 static bool getPrintfFormatArgumentNum(const CallExpr *CE,  in getPrintfFormatArgumentNum()  argument
624   const FunctionDecl *FDecl = C.getCalleeDecl(CE);  in getPrintfFormatArgumentNum()
629     if ((Format->getType()->getName() == "printf") && CE->getNumArgs() > ArgNum)  in getPrintfFormatArgumentNum()
634   if (C.getCalleeName(CE).find("setproctitle") != StringRef::npos) {  in getPrintfFormatArgumentNum()
671     const CallExpr *CE, CheckerContext &C) const {  in checkUncontrolledFormatString()  argument
674   if (!getPrintfFormatArgumentNum(CE, C, ArgNum))  in checkUncontrolledFormatString()
679   return generateReportIfTainted(CE->getArg(ArgNum),  in checkUncontrolledFormatString()
683 bool GenericTaintChecker::checkSystemCall(const CallExpr *CE, StringRef Name,  in checkSystemCall()  argument
701   if (ArgNum == UINT_MAX || CE->getNumArgs() < (ArgNum + 1))  in checkSystemCall()
704   return generateReportIfTainted(CE->getArg(ArgNum), MsgSanitizeSystemArgs, C);  in checkSystemCall()
709 bool GenericTaintChecker::checkTaintedBufferSize(const CallExpr *CE,  in checkTaintedBufferSize()  argument
742   return ArgNum != InvalidArgIndex && CE->getNumArgs() > ArgNum &&  in checkTaintedBufferSize()
743          generateReportIfTainted(CE->getArg(ArgNum), MsgTaintedBufferSize, C);  in checkTaintedBufferSize()