1 //== ObjCContainersASTChecker.cpp - CoreFoundation containers API *- C++ -*-==//
2 //
3 // The LLVM Compiler Infrastructure
4 //
5 // This file is distributed under the University of Illinois Open Source
6 // License. See LICENSE.TXT for details.
7 //
8 //===----------------------------------------------------------------------===//
9 //
10 // An AST checker that looks for common pitfalls when using 'CFArray',
11 // 'CFDictionary', 'CFSet' APIs.
12 //
13 //===----------------------------------------------------------------------===//
14 #include "ClangSACheckers.h"
15 #include "clang/Analysis/AnalysisContext.h"
16 #include "clang/AST/StmtVisitor.h"
17 #include "clang/Basic/TargetInfo.h"
18 #include "clang/StaticAnalyzer/Core/Checker.h"
19 #include "clang/StaticAnalyzer/Core/BugReporter/BugReporter.h"
20 #include "clang/StaticAnalyzer/Core/PathSensitive/AnalysisManager.h"
21 #include "llvm/ADT/SmallString.h"
22 #include "llvm/Support/raw_ostream.h"
23
24 using namespace clang;
25 using namespace ento;
26
27 namespace {
28 class WalkAST : public StmtVisitor<WalkAST> {
29 BugReporter &BR;
30 AnalysisDeclContext* AC;
31 ASTContext &ASTC;
32 uint64_t PtrWidth;
33
34 static const unsigned InvalidArgIndex = UINT_MAX;
35
36 /// Check if the type has pointer size (very conservative).
isPointerSize(const Type * T)37 inline bool isPointerSize(const Type *T) {
38 if (!T)
39 return true;
40 if (T->isIncompleteType())
41 return true;
42 return (ASTC.getTypeSize(T) == PtrWidth);
43 }
44
45 /// Check if the type is a pointer/array to pointer sized values.
hasPointerToPointerSizedType(const Expr * E)46 inline bool hasPointerToPointerSizedType(const Expr *E) {
47 QualType T = E->getType();
48
49 // The type could be either a pointer or array.
50 const Type *TP = T.getTypePtr();
51 QualType PointeeT = TP->getPointeeType();
52 if (!PointeeT.isNull()) {
53 // If the type is a pointer to an array, check the size of the array
54 // elements. To avoid false positives coming from assumption that the
55 // values x and &x are equal when x is an array.
56 if (const Type *TElem = PointeeT->getArrayElementTypeNoTypeQual())
57 if (isPointerSize(TElem))
58 return true;
59
60 // Else, check the pointee size.
61 return isPointerSize(PointeeT.getTypePtr());
62 }
63
64 if (const Type *TElem = TP->getArrayElementTypeNoTypeQual())
65 return isPointerSize(TElem);
66
67 // The type must be an array/pointer type.
68
69 // This could be a null constant, which is allowed.
70 if (E->isNullPointerConstant(ASTC, Expr::NPC_ValueDependentIsNull))
71 return true;
72 return false;
73 }
74
75 public:
WalkAST(BugReporter & br,AnalysisDeclContext * ac)76 WalkAST(BugReporter &br, AnalysisDeclContext* ac)
77 : BR(br), AC(ac), ASTC(AC->getASTContext()),
78 PtrWidth(ASTC.getTargetInfo().getPointerWidth(0)) {}
79
80 // Statement visitor methods.
81 void VisitChildren(Stmt *S);
VisitStmt(Stmt * S)82 void VisitStmt(Stmt *S) { VisitChildren(S); }
83 void VisitCallExpr(CallExpr *CE);
84 };
85 } // end anonymous namespace
86
getCalleeName(CallExpr * CE)87 static StringRef getCalleeName(CallExpr *CE) {
88 const FunctionDecl *FD = CE->getDirectCallee();
89 if (!FD)
90 return StringRef();
91
92 IdentifierInfo *II = FD->getIdentifier();
93 if (!II) // if no identifier, not a simple C function
94 return StringRef();
95
96 return II->getName();
97 }
98
VisitCallExpr(CallExpr * CE)99 void WalkAST::VisitCallExpr(CallExpr *CE) {
100 StringRef Name = getCalleeName(CE);
101 if (Name.empty())
102 return;
103
104 const Expr *Arg = 0;
105 unsigned ArgNum = InvalidArgIndex;
106
107 if (Name.equals("CFArrayCreate") || Name.equals("CFSetCreate")) {
108 ArgNum = 1;
109 Arg = CE->getArg(ArgNum)->IgnoreParenCasts();
110 if (hasPointerToPointerSizedType(Arg))
111 return;
112 }
113
114 if (Arg == 0 && Name.equals("CFDictionaryCreate")) {
115 // Check first argument.
116 ArgNum = 1;
117 Arg = CE->getArg(ArgNum)->IgnoreParenCasts();
118 if (hasPointerToPointerSizedType(Arg)) {
119 // Check second argument.
120 ArgNum = 2;
121 Arg = CE->getArg(ArgNum)->IgnoreParenCasts();
122 if (hasPointerToPointerSizedType(Arg))
123 // Both are good, return.
124 return;
125 }
126 }
127
128 if (ArgNum != InvalidArgIndex) {
129 assert(ArgNum == 1 || ArgNum == 2);
130
131 SmallString<256> BufName;
132 llvm::raw_svector_ostream OsName(BufName);
133 assert(ArgNum == 1 || ArgNum == 2);
134 OsName << " Invalid use of '" << Name << "'" ;
135
136 SmallString<256> Buf;
137 llvm::raw_svector_ostream Os(Buf);
138 // Use "second" and "third" since users will expect 1-based indexing
139 // for parameter names when mentioned in prose.
140 Os << " The "<< ((ArgNum == 1) ? "second" : "third") << " argument to '"
141 << Name << "' must be a C array of pointer-sized values, not '"
142 << Arg->getType().getAsString() << "'";
143
144 SourceRange R = Arg->getSourceRange();
145 PathDiagnosticLocation CELoc =
146 PathDiagnosticLocation::createBegin(CE, BR.getSourceManager(), AC);
147 BR.EmitBasicReport(AC->getDecl(),
148 OsName.str(), categories::CoreFoundationObjectiveC,
149 Os.str(), CELoc, &R, 1);
150 }
151
152 // Recurse and check children.
153 VisitChildren(CE);
154 }
155
VisitChildren(Stmt * S)156 void WalkAST::VisitChildren(Stmt *S) {
157 for (Stmt::child_iterator I = S->child_begin(), E = S->child_end(); I!=E; ++I)
158 if (Stmt *child = *I)
159 Visit(child);
160 }
161
162 namespace {
163 class ObjCContainersASTChecker : public Checker<check::ASTCodeBody> {
164 public:
165
checkASTCodeBody(const Decl * D,AnalysisManager & Mgr,BugReporter & BR) const166 void checkASTCodeBody(const Decl *D, AnalysisManager& Mgr,
167 BugReporter &BR) const {
168 WalkAST walker(BR, Mgr.getAnalysisDeclContext(D));
169 walker.Visit(D->getBody());
170 }
171 };
172 }
173
registerObjCContainersASTChecker(CheckerManager & mgr)174 void ento::registerObjCContainersASTChecker(CheckerManager &mgr) {
175 mgr.registerChecker<ObjCContainersASTChecker>();
176 }
177