[analyzer] Bifurcate on getenv() calls

The `getenv()` function might return `NULL` just like any other function.
However, in case of `getenv()` a state-split seems justified since the
programmer should expect the failure of this function.

`secure_getenv(const char *name)` behaves the same way but is not handled
right now.
Note that `std::getenv()` is also not handled.

Reviewed By: martong

Differential Revision: https://reviews.llvm.org/D111245

1 files changed, 8 insertions, 0 deletions

diff --git a/clang/lib/StaticAnalyzer/Checkers/StdLibraryFunctionsChecker.cpp b/clang/lib/StaticAnalyzer/Checkers/StdLibraryFunctionsChecker.cpp
index e758b46..74adc58 100644
--- a/clang/lib/StaticAnalyzer/Checkers/StdLibraryFunctionsChecker.cpp
+++ b/clang/lib/StaticAnalyzer/Checkers/StdLibraryFunctionsChecker.cpp
@@ -1433,6 +1433,14 @@ void StdLibraryFunctionsChecker::initFunctionSummaries(
                 RetType{Ssize_tTy}),
       GetLineSummary);
 
+  // char *getenv(const char *name);
+  addToFunctionSummaryMap(
+      "getenv", Signature(ArgTypes{ConstCharPtrTy}, RetType{CharPtrTy}),
+      Summary(NoEvalCall)
+          .Case({NotNull(Ret)})
+          .Case({NotNull(Ret)->negate()})
+          .ArgConstraint(NotNull(ArgNo(0))));
+
   if (ModelPOSIX) {
 
     // long a64l(const char *str64);