[clang][analyzer] Add StoreToImmutable checker

clang/docs/analyzer/checkers.rst

@@ -3077,6 +3077,23 @@ Either the comparison is useless or there is division by zero.
    if (x == 0) { } // warn
  }
 
+.. _alpha-core-StoreToImmutable:
+
+alpha.core.StoreToImmutable (C, C++)
+""""""""""""""""""""""""""""""""""""
+Check for writes to immutable memory regions. This implements part of SEI CERT Rule ENV30-C.
+
+This checker detects attempts to write to memory regions that are marked as immutable,
+including const variables, string literals, and other const-qualified memory.
+
+.. literalinclude:: checkers/storetoimmutable_example.cpp
+    :language: cpp
+
+**Solution**
+
+Avoid writing to const-qualified memory regions. If you need to modify the data,
+remove the const qualifier from the original declaration or use a mutable copy.
+
 alpha.cplusplus
 ^^^^^^^^^^^^^^^
 

clang/docs/analyzer/checkers/storetoimmutable_example.cpp

@@ -0,0 +1,30 @@
+// RUN: %clang_analyze_cc1 -analyzer-checker=alpha.core.StoreToImmutable %s
+
+// Global const variable
+const int global_const = 42;
+
+void test_global_const() {
+  *(int *)&global_const = 100; // warn: Writing to immutable memory
+}
+
+// String literal
+void test_string_literal() {
+  char *str = (char *)"hello";
+  str[0] = 'H'; // warn: Writing to immutable memory
+}
+
+// Const parameter
+void test_const_param(const int param) {
+  *(int *)&param = 100; // warn: Writing to immutable memory
+}
+
+// Const struct member
+struct TestStruct {
+  const int x;
+  int y;
+};
+
+void test_const_member() {
+  TestStruct s = {1, 2};
+  *(int *)&s.x = 10; // warn: Writing to immutable memory
+}

clang/include/clang/StaticAnalyzer/Checkers/Checkers.td

@@ -306,6 +306,11 @@ def StackAddrAsyncEscapeChecker : Checker<"StackAddressAsyncEscape">,
   Dependencies<[StackAddrEscapeBase]>,
   Documentation<HasDocumentation>;
 
+def StoreToImmutableChecker : Checker<"StoreToImmutable">,
+  HelpText<"Check for writes to immutable memory regions. "
+           "This implements part of SEI CERT Rule ENV30-C.">,
+  Documentation<HasDocumentation>;
+
 def PthreadLockBase : Checker<"PthreadLockBase">,
   HelpText<"Helper registering multiple checks.">,
   Documentation<NotDocumented>,

clang/include/clang/StaticAnalyzer/Core/PathSensitive/MemRegion.h

@@ -819,7 +819,7 @@ class SymbolicRegion : public SubRegion {
            s->getType()->isReferenceType() ||
            s->getType()->isBlockPointerType());
     assert(isa<UnknownSpaceRegion>(sreg) || isa<HeapSpaceRegion>(sreg) ||
-           isa<GlobalSystemSpaceRegion>(sreg));
+           isa<GlobalSystemSpaceRegion>(sreg) || isa<GlobalImmutableSpaceRegion>(sreg));
   }
 
 public:

clang/lib/StaticAnalyzer/Checkers/CMakeLists.txt

@@ -104,6 +104,7 @@ add_clang_library(clangStaticAnalyzerCheckers
   SmartPtrChecker.cpp
   SmartPtrModeling.cpp
   StackAddrEscapeChecker.cpp
+  StoreToImmutableChecker.cpp
   StdLibraryFunctionsChecker.cpp
   StdVariantChecker.cpp
   STLAlgorithmModeling.cpp

clang/lib/StaticAnalyzer/Checkers/StoreToImmutableChecker.cpp

@@ -0,0 +1,146 @@
+//=== StoreToImmutableChecker.cpp - Store to immutable memory checker -*- C++
+//-*-===//
+//
+// Part of the LLVM Project, under the Apache License v2.0 with LLVM Exceptions.
+// See https://llvm.org/LICENSE.txt for license information.
+// SPDX-License-Identifier: Apache-2.0 WITH LLVM-exception
+//
+//===----------------------------------------------------------------------===//
+//
+// This file defines StoreToImmutableChecker, a checker that detects writes
+// to immutable memory regions. This implements part of SEI CERT Rule ENV30-C.
+//
+//===----------------------------------------------------------------------===//
+
+#include "clang/StaticAnalyzer/Checkers/BuiltinCheckerRegistration.h"
+#include "clang/StaticAnalyzer/Core/BugReporter/BugType.h"
+#include "clang/StaticAnalyzer/Core/Checker.h"
+#include "clang/StaticAnalyzer/Core/CheckerManager.h"
+#include "clang/StaticAnalyzer/Core/PathSensitive/CheckerContext.h"
+#include "clang/StaticAnalyzer/Core/PathSensitive/MemRegion.h"
+
+using namespace clang;
+using namespace ento;
+
+namespace {
+class StoreToImmutableChecker : public Checker<check::Bind> {
+  const BugType BT{this, "Write to immutable memory", "CERT Environment (ENV)"};
+
+public:
+  void checkBind(SVal Loc, SVal Val, const Stmt *S, CheckerContext &C) const;
+
+private:
+  bool isConstVariable(const MemRegion *MR, CheckerContext &C) const;
+  bool isConstQualifiedType(const MemRegion *MR, CheckerContext &C) const;
+};
+} // end anonymous namespace
+
+bool StoreToImmutableChecker::isConstVariable(const MemRegion *MR,
+                                              CheckerContext &C) const {
+  // Check if the region is in the global immutable space
+  const MemSpaceRegion *MS = MR->getMemorySpace(C.getState());
+  if (isa<GlobalImmutableSpaceRegion>(MS))
+    return true;
+
+  // Check if this is a VarRegion with a const-qualified type
+  if (const VarRegion *VR = dyn_cast<VarRegion>(MR)) {
+    const VarDecl *VD = VR->getDecl();
+    if (VD && VD->getType().isConstQualified())
+      return true;
+  }
+
+  // Check if this is a ParamVarRegion with a const-qualified type
+  if (const ParamVarRegion *PVR = dyn_cast<ParamVarRegion>(MR)) {
+    const ParmVarDecl *PVD = PVR->getDecl();
+    if (PVD && PVD->getType().isConstQualified())
+      return true;
+  }
+
+  // Check if this is a FieldRegion with a const-qualified type
+  if (const FieldRegion *FR = dyn_cast<FieldRegion>(MR)) {
+    const FieldDecl *FD = FR->getDecl();
+    if (FD && FD->getType().isConstQualified())
+      return true;
+  }
+
+  // Check if this is a StringRegion (string literals are const)
+  if (isa<StringRegion>(MR))
+    return true;
+
+  // Check if this is a SymbolicRegion with a const-qualified pointee type
+  if (const SymbolicRegion *SR = dyn_cast<SymbolicRegion>(MR)) {
+    QualType PointeeType = SR->getPointeeStaticType();
+    if (PointeeType.isConstQualified())
+      return true;
+  }
+
+  // Check if this is an ElementRegion accessing a const array
+  if (const ElementRegion *ER = dyn_cast<ElementRegion>(MR)) {
+    return isConstQualifiedType(ER->getSuperRegion(), C);
+  }
+
+  return false;
+}
+
+bool StoreToImmutableChecker::isConstQualifiedType(const MemRegion *MR,
+                                                   CheckerContext &C) const {
+  // Check if the region has a const-qualified type
+  if (const TypedValueRegion *TVR = dyn_cast<TypedValueRegion>(MR)) {
+    QualType Ty = TVR->getValueType();
+    return Ty.isConstQualified();
+  }
+  return false;
+}
+
+void StoreToImmutableChecker::checkBind(SVal Loc, SVal Val, const Stmt *S,
+                                        CheckerContext &C) const {
+  // We are only interested in stores to memory regions
+  const MemRegion *MR = Loc.getAsRegion();
+  if (!MR)
+    return;
+
+  // Skip variable declarations and initializations - we only want to catch
+  // actual writes
+  if (isa<DeclStmt>(S) || isa<DeclRefExpr>(S))
+    return;
+
+  // Check if the region corresponds to a const variable
+  if (!isConstVariable(MR, C))
+    return;
+
+  const SourceManager &SM = C.getSourceManager();
+  // Skip if this is a system macro (likely from system headers)
+  if (SM.isInSystemMacro(S->getBeginLoc()))
+    return;
+
+  // Generate the bug report
+  ExplodedNode *N = C.generateNonFatalErrorNode();
+  if (!N)
+    return;
+
+  constexpr llvm::StringLiteral Msg =
+      "Writing to immutable memory is undefined behavior. "
+      "This memory region is marked as immutable and should not be modified.";
+
+  auto R = std::make_unique<PathSensitiveBugReport>(BT, Msg, N);
+  R->addRange(S->getSourceRange());
+
+  // If the location that is being written to has a declaration, place a note.
+  if (const DeclRegion *DR = dyn_cast<DeclRegion>(MR)) {
+    R->addNote("Memory region is in immutable space",
+               PathDiagnosticLocation::create(DR->getDecl(), SM));
+  }
+
+  // For this checker, we are only interested in the value being written, no
+  // need to mark the value being assigned interesting.
+
+  C.emitReport(std::move(R));
+}
+
+void ento::registerStoreToImmutableChecker(CheckerManager &mgr) {
+  mgr.registerChecker<StoreToImmutableChecker>();
+}
+
+bool ento::shouldRegisterStoreToImmutableChecker(const CheckerManager &mgr) {
+  return true;
+}