48   ProgramStateRef checkVLA(CheckerContext &C, ProgramStateRef State,
51   ProgramStateRef checkVLAIndexSize(CheckerContext &C, ProgramStateRef State,
54   void reportBug(VLASize_Kind Kind, const Expr *SizeE, ProgramStateRef State,
57   void reportTaintBug(const Expr *SizeE, ProgramStateRef State,
68                                          ProgramStateRef State,  in checkVLA()  argument
85     State = checkVLAIndexSize(C, State, SizeE);  in checkVLA()
86     if (!State)  in checkVLA()
108   if (const llvm::APSInt *KV = SVB.getKnownValue(State, ArrSize))  in checkVLA()
117     SVal Mul = SVB.evalBinOpNN(State, BO_Mul, ArrSize, IndexLength, SizeTy);  in checkVLA()
122       return State;  in checkVLA()
124     if (const llvm::APSInt *IndexLVal = SVB.getKnownValue(State, IndexLength)) {  in checkVLA()
139         reportBug(VLA_Overflow, SizeE, State, C);  in checkVLA()
149   return State;  in checkVLA()
153                                                   ProgramStateRef State,  in checkVLAIndexSize()  argument
158     reportBug(VLA_Garbage, SizeE, State, C);  in checkVLAIndexSize()
168   if (isTainted(State, SizeV)) {  in checkVLAIndexSize()
169     reportTaintBug(SizeE, State, C, SizeV);  in checkVLAIndexSize()
177   std::tie(StateNotZero, StateZero) = State->assume(SizeD);  in checkVLAIndexSize()
185   State = StateNotZero;  in checkVLAIndexSize()
194       SVB.evalBinOp(State, BO_LT, SizeD, Zero, SVB.getConditionType());  in checkVLAIndexSize()
200     std::tie(StateNeg, StatePos) = CM.assumeDual(State, *LessThanZeroDVal);  in checkVLAIndexSize()
202       reportBug(VLA_Negative, SizeE, State, C);  in checkVLAIndexSize()
205     State = StatePos;  in checkVLAIndexSize()
208   return State;  in checkVLAIndexSize()
211 void VLASizeChecker::reportTaintBug(const Expr *SizeE, ProgramStateRef State,  in reportTaintBug()  argument
214   ExplodedNode *N = C.generateErrorNode(State);  in reportTaintBug()
228   for (auto Sym : getTaintedSymbols(State, TaintedSVal))  in reportTaintBug()
234                                ProgramStateRef State, CheckerContext &C) const {  in reportBug()  argument
236   ExplodedNode *N = C.generateErrorNode(State);  in reportBug()
270   ProgramStateRef State = C.getState();  in checkPreStmt()  local
290   State = checkVLA(C, State, VLA, ArraySize);  in checkPreStmt()
291   if (!State)  in checkPreStmt()
296     C.addTransition(State);  in checkPreStmt()
302     State =  in checkPreStmt()
303         setDynamicExtent(State, State->getRegion(VD, C.getLocationContext()),  in checkPreStmt()
308   C.addTransition(State);  in checkPreStmt()
327   ProgramStateRef State = C.getState();  in checkPreStmt()  local
329   State = checkVLA(C, State, VLA, ArraySize);  in checkPreStmt()
330   if (!State)  in checkPreStmt()
333   C.addTransition(State);  in checkPreStmt()