• Home
  • Line#
  • Scopes#
  • Navigate#
  • Raw
  • Download
1 //== ObjCContainersASTChecker.cpp - CoreFoundation containers API *- C++ -*-==//
2 //
3 //                     The LLVM Compiler Infrastructure
4 //
5 // This file is distributed under the University of Illinois Open Source
6 // License. See LICENSE.TXT for details.
7 //
8 //===----------------------------------------------------------------------===//
9 //
10 // An AST checker that looks for common pitfalls when using 'CFArray',
11 // 'CFDictionary', 'CFSet' APIs.
12 //
13 //===----------------------------------------------------------------------===//
14 #include "ClangSACheckers.h"
15 #include "clang/AST/StmtVisitor.h"
16 #include "clang/Analysis/AnalysisContext.h"
17 #include "clang/Basic/TargetInfo.h"
18 #include "clang/StaticAnalyzer/Core/BugReporter/BugReporter.h"
19 #include "clang/StaticAnalyzer/Core/Checker.h"
20 #include "clang/StaticAnalyzer/Core/PathSensitive/AnalysisManager.h"
21 #include "llvm/ADT/SmallString.h"
22 #include "llvm/Support/raw_ostream.h"
23 
24 using namespace clang;
25 using namespace ento;
26 
27 namespace {
28 class WalkAST : public StmtVisitor<WalkAST> {
29   BugReporter &BR;
30   const CheckerBase *Checker;
31   AnalysisDeclContext* AC;
32   ASTContext &ASTC;
33   uint64_t PtrWidth;
34 
35   /// Check if the type has pointer size (very conservative).
isPointerSize(const Type * T)36   inline bool isPointerSize(const Type *T) {
37     if (!T)
38       return true;
39     if (T->isIncompleteType())
40       return true;
41     return (ASTC.getTypeSize(T) == PtrWidth);
42   }
43 
44   /// Check if the type is a pointer/array to pointer sized values.
hasPointerToPointerSizedType(const Expr * E)45   inline bool hasPointerToPointerSizedType(const Expr *E) {
46     QualType T = E->getType();
47 
48     // The type could be either a pointer or array.
49     const Type *TP = T.getTypePtr();
50     QualType PointeeT = TP->getPointeeType();
51     if (!PointeeT.isNull()) {
52       // If the type is a pointer to an array, check the size of the array
53       // elements. To avoid false positives coming from assumption that the
54       // values x and &x are equal when x is an array.
55       if (const Type *TElem = PointeeT->getArrayElementTypeNoTypeQual())
56         if (isPointerSize(TElem))
57           return true;
58 
59       // Else, check the pointee size.
60       return isPointerSize(PointeeT.getTypePtr());
61     }
62 
63     if (const Type *TElem = TP->getArrayElementTypeNoTypeQual())
64       return isPointerSize(TElem);
65 
66     // The type must be an array/pointer type.
67 
68     // This could be a null constant, which is allowed.
69     return static_cast<bool>(
70         E->isNullPointerConstant(ASTC, Expr::NPC_ValueDependentIsNull));
71   }
72 
73 public:
WalkAST(BugReporter & br,const CheckerBase * checker,AnalysisDeclContext * ac)74   WalkAST(BugReporter &br, const CheckerBase *checker, AnalysisDeclContext *ac)
75       : BR(br), Checker(checker), AC(ac), ASTC(AC->getASTContext()),
76         PtrWidth(ASTC.getTargetInfo().getPointerWidth(0)) {}
77 
78   // Statement visitor methods.
79   void VisitChildren(Stmt *S);
VisitStmt(Stmt * S)80   void VisitStmt(Stmt *S) { VisitChildren(S); }
81   void VisitCallExpr(CallExpr *CE);
82 };
83 } // end anonymous namespace
84 
getCalleeName(CallExpr * CE)85 static StringRef getCalleeName(CallExpr *CE) {
86   const FunctionDecl *FD = CE->getDirectCallee();
87   if (!FD)
88     return StringRef();
89 
90   IdentifierInfo *II = FD->getIdentifier();
91   if (!II)   // if no identifier, not a simple C function
92     return StringRef();
93 
94   return II->getName();
95 }
96 
VisitCallExpr(CallExpr * CE)97 void WalkAST::VisitCallExpr(CallExpr *CE) {
98   StringRef Name = getCalleeName(CE);
99   if (Name.empty())
100     return;
101 
102   const Expr *Arg = nullptr;
103   unsigned ArgNum;
104 
105   if (Name.equals("CFArrayCreate") || Name.equals("CFSetCreate")) {
106     if (CE->getNumArgs() != 4)
107       return;
108     ArgNum = 1;
109     Arg = CE->getArg(ArgNum)->IgnoreParenCasts();
110     if (hasPointerToPointerSizedType(Arg))
111         return;
112   } else if (Name.equals("CFDictionaryCreate")) {
113     if (CE->getNumArgs() != 6)
114       return;
115     // Check first argument.
116     ArgNum = 1;
117     Arg = CE->getArg(ArgNum)->IgnoreParenCasts();
118     if (hasPointerToPointerSizedType(Arg)) {
119       // Check second argument.
120       ArgNum = 2;
121       Arg = CE->getArg(ArgNum)->IgnoreParenCasts();
122       if (hasPointerToPointerSizedType(Arg))
123         // Both are good, return.
124         return;
125     }
126   }
127 
128   if (Arg) {
129     assert(ArgNum == 1 || ArgNum == 2);
130 
131     SmallString<64> BufName;
132     llvm::raw_svector_ostream OsName(BufName);
133     OsName << " Invalid use of '" << Name << "'" ;
134 
135     SmallString<256> Buf;
136     llvm::raw_svector_ostream Os(Buf);
137     // Use "second" and "third" since users will expect 1-based indexing
138     // for parameter names when mentioned in prose.
139     Os << " The "<< ((ArgNum == 1) ? "second" : "third") << " argument to '"
140         << Name << "' must be a C array of pointer-sized values, not '"
141         << Arg->getType().getAsString() << "'";
142 
143     PathDiagnosticLocation CELoc =
144         PathDiagnosticLocation::createBegin(CE, BR.getSourceManager(), AC);
145     BR.EmitBasicReport(AC->getDecl(), Checker, OsName.str(),
146                        categories::CoreFoundationObjectiveC, Os.str(), CELoc,
147                        Arg->getSourceRange());
148   }
149 
150   // Recurse and check children.
151   VisitChildren(CE);
152 }
153 
VisitChildren(Stmt * S)154 void WalkAST::VisitChildren(Stmt *S) {
155   for (Stmt *Child : S->children())
156     if (Child)
157       Visit(Child);
158 }
159 
160 namespace {
161 class ObjCContainersASTChecker : public Checker<check::ASTCodeBody> {
162 public:
163 
checkASTCodeBody(const Decl * D,AnalysisManager & Mgr,BugReporter & BR) const164   void checkASTCodeBody(const Decl *D, AnalysisManager& Mgr,
165                         BugReporter &BR) const {
166     WalkAST walker(BR, this, Mgr.getAnalysisDeclContext(D));
167     walker.Visit(D->getBody());
168   }
169 };
170 }
171 
registerObjCContainersASTChecker(CheckerManager & mgr)172 void ento::registerObjCContainersASTChecker(CheckerManager &mgr) {
173   mgr.registerChecker<ObjCContainersASTChecker>();
174 }
175