1 //===--- AttrNonNullChecker.h - Undefined arguments checker ----*- C++ -*--===//
2 //
3 // The LLVM Compiler Infrastructure
4 //
5 // This file is distributed under the University of Illinois Open Source
6 // License. See LICENSE.TXT for details.
7 //
8 //===----------------------------------------------------------------------===//
9 //
10 // This defines AttrNonNullChecker, a builtin check in ExprEngine that
11 // performs checks for arguments declared to have nonnull attribute.
12 //
13 //===----------------------------------------------------------------------===//
14
15 #include "ClangSACheckers.h"
16 #include "clang/StaticAnalyzer/Core/Checker.h"
17 #include "clang/StaticAnalyzer/Core/CheckerManager.h"
18 #include "clang/StaticAnalyzer/Core/PathSensitive/CheckerContext.h"
19 #include "clang/StaticAnalyzer/Core/BugReporter/BugType.h"
20
21 using namespace clang;
22 using namespace ento;
23
24 namespace {
25 class AttrNonNullChecker
26 : public Checker< check::PreStmt<CallExpr> > {
27 mutable llvm::OwningPtr<BugType> BT;
28 public:
29
30 void checkPreStmt(const CallExpr *CE, CheckerContext &C) const;
31 };
32 } // end anonymous namespace
33
checkPreStmt(const CallExpr * CE,CheckerContext & C) const34 void AttrNonNullChecker::checkPreStmt(const CallExpr *CE,
35 CheckerContext &C) const {
36 const GRState *state = C.getState();
37
38 // Check if the callee has a 'nonnull' attribute.
39 SVal X = state->getSVal(CE->getCallee());
40
41 const FunctionDecl* FD = X.getAsFunctionDecl();
42 if (!FD)
43 return;
44
45 const NonNullAttr* Att = FD->getAttr<NonNullAttr>();
46 if (!Att)
47 return;
48
49 // Iterate through the arguments of CE and check them for null.
50 unsigned idx = 0;
51
52 for (CallExpr::const_arg_iterator I=CE->arg_begin(), E=CE->arg_end(); I!=E;
53 ++I, ++idx) {
54
55 if (!Att->isNonNull(idx))
56 continue;
57
58 SVal V = state->getSVal(*I);
59 DefinedSVal *DV = dyn_cast<DefinedSVal>(&V);
60
61 // If the value is unknown or undefined, we can't perform this check.
62 if (!DV)
63 continue;
64
65 if (!isa<Loc>(*DV)) {
66 // If the argument is a union type, we want to handle a potential
67 // transparent_unoin GCC extension.
68 QualType T = (*I)->getType();
69 const RecordType *UT = T->getAsUnionType();
70 if (!UT || !UT->getDecl()->hasAttr<TransparentUnionAttr>())
71 continue;
72 if (nonloc::CompoundVal *CSV = dyn_cast<nonloc::CompoundVal>(DV)) {
73 nonloc::CompoundVal::iterator CSV_I = CSV->begin();
74 assert(CSV_I != CSV->end());
75 V = *CSV_I;
76 DV = dyn_cast<DefinedSVal>(&V);
77 assert(++CSV_I == CSV->end());
78 if (!DV)
79 continue;
80 }
81 else {
82 // FIXME: Handle LazyCompoundVals?
83 continue;
84 }
85 }
86
87 ConstraintManager &CM = C.getConstraintManager();
88 const GRState *stateNotNull, *stateNull;
89 llvm::tie(stateNotNull, stateNull) = CM.assumeDual(state, *DV);
90
91 if (stateNull && !stateNotNull) {
92 // Generate an error node. Check for a null node in case
93 // we cache out.
94 if (ExplodedNode *errorNode = C.generateSink(stateNull)) {
95
96 // Lazily allocate the BugType object if it hasn't already been
97 // created. Ownership is transferred to the BugReporter object once
98 // the BugReport is passed to 'EmitWarning'.
99 if (!BT)
100 BT.reset(new BugType("Argument with 'nonnull' attribute passed null",
101 "API"));
102
103 EnhancedBugReport *R =
104 new EnhancedBugReport(*BT,
105 "Null pointer passed as an argument to a "
106 "'nonnull' parameter", errorNode);
107
108 // Highlight the range of the argument that was null.
109 const Expr *arg = *I;
110 R->addRange(arg->getSourceRange());
111 R->addVisitorCreator(bugreporter::registerTrackNullOrUndefValue, arg);
112
113 // Emit the bug report.
114 C.EmitReport(R);
115 }
116
117 // Always return. Either we cached out or we just emitted an error.
118 return;
119 }
120
121 // If a pointer value passed the check we should assume that it is
122 // indeed not null from this point forward.
123 assert(stateNotNull);
124 state = stateNotNull;
125 }
126
127 // If we reach here all of the arguments passed the nonnull check.
128 // If 'state' has been updated generated a new node.
129 C.addTransition(state);
130 }
131
registerAttrNonNullChecker(CheckerManager & mgr)132 void ento::registerAttrNonNullChecker(CheckerManager &mgr) {
133 mgr.registerChecker<AttrNonNullChecker>();
134 }
135