Check casts of function names to checked function pointer types. about checkedc-clang HOT 3 CLOSED

Tests of casts from function names with unchecked pointers to checked function pointer types were added as part of pull request #91. We still need to implement a check in the compiler that the source operand for the cast is actually a function name.

from checkedc-clang.

From an email from David:

The main motivation for the work is that C converts values with function types to pointers to function types. By default, these are unchecked pointers to function types. We need some way to create checked pointers to function types. Checked C allows implicit conversions from unchecked pointer types to checked pointer types, so we have a way of doing this in the extension already. However, Checked C relies on determining the actual bounds for the unchecked value. Of course, for function types, there is no bounds and no way to determine “the actual bounds”. We need some check to prevent implicit conversion of an unchecked function pointer value that does not match its declared “bounds” for arguments or the return value to a checked function pointer value. The check is to just to make sure that the actual source of the unchecked function pointer is a function name.

In other words, we want to prevent things like:

int bad_convert(int (*f)(int a)) {
  ptr<int (int)> safe_f = f;
}

If the programmer wants to do that, we want to require an explicit (unsafe) cast, not have this conversion happen implicitly.

from checkedc-clang.

So, by staring at some dumped ASTs, we need to do the following:

• check any ImplicitCasts (specifically, Bitcasts)
• if they contain another implicitcast (specifically a function to pointer decay) and that contains a declref to a function, then we're all good. This is really the only kind of assignment that's allowed.
• otherwise, they likely contain an implicitcast (specifically a LValue to RValue cast) and that contains a DeclRef of a ParmVar (or similar, I'm not sure what the ref is like of a local variable), which is explicitly not allowed.

We'll pick this back up when we have a centralized place for doing our bounds checking analysis, which should be in a day or two.

from checkedc-clang.