1 //== CheckerContext.h - Context info for path-sensitive checkers--*- C++ -*--=// 2 // 3 // The LLVM Compiler Infrastructure 4 // 5 // This file is distributed under the University of Illinois Open Source 6 // License. See LICENSE.TXT for details. 7 // 8 //===----------------------------------------------------------------------===// 9 // 10 // This file defines CheckerContext that provides contextual info for 11 // path-sensitive checkers. 12 // 13 //===----------------------------------------------------------------------===// 14 15 #ifndef LLVM_CLANG_STATICANALYZER_CORE_PATHSENSITIVE_CHECKERCONTEXT_H 16 #define LLVM_CLANG_STATICANALYZER_CORE_PATHSENSITIVE_CHECKERCONTEXT_H 17 18 #include "clang/StaticAnalyzer/Core/PathSensitive/ExprEngine.h" 19 #include "clang/StaticAnalyzer/Core/PathSensitive/ProgramStateTrait.h" 20 21 namespace clang { 22 namespace ento { 23 24 /// Declares an immutable map of type \p NameTy, suitable for placement into 25 /// the ProgramState. This is implementing using llvm::ImmutableMap. 26 /// 27 /// \code 28 /// State = State->set<Name>(K, V); 29 /// const Value *V = State->get<Name>(K); // Returns NULL if not in the map. 30 /// State = State->remove<Name>(K); 31 /// NameTy Map = State->get<Name>(); 32 /// \endcode 33 /// 34 /// The macro should not be used inside namespaces, or for traits that must 35 /// be accessible from more than one translation unit. 36 #define REGISTER_MAP_WITH_PROGRAMSTATE(Name, Key, Value) \ 37 REGISTER_TRAIT_WITH_PROGRAMSTATE(Name, \ 38 CLANG_ENTO_PROGRAMSTATE_MAP(Key, Value)) 39 40 /// Declares an immutable set of type \p NameTy, suitable for placement into 41 /// the ProgramState. This is implementing using llvm::ImmutableSet. 42 /// 43 /// \code 44 /// State = State->add<Name>(E); 45 /// State = State->remove<Name>(E); 46 /// bool Present = State->contains<Name>(E); 47 /// NameTy Set = State->get<Name>(); 48 /// \endcode 49 /// 50 /// The macro should not be used inside namespaces, or for traits that must 51 /// be accessible from more than one translation unit. 52 #define REGISTER_SET_WITH_PROGRAMSTATE(Name, Elem) \ 53 REGISTER_TRAIT_WITH_PROGRAMSTATE(Name, llvm::ImmutableSet<Elem>) 54 55 /// Declares an immutable list of type \p NameTy, suitable for placement into 56 /// the ProgramState. This is implementing using llvm::ImmutableList. 57 /// 58 /// \code 59 /// State = State->add<Name>(E); // Adds to the /end/ of the list. 60 /// bool Present = State->contains<Name>(E); 61 /// NameTy List = State->get<Name>(); 62 /// \endcode 63 /// 64 /// The macro should not be used inside namespaces, or for traits that must 65 /// be accessible from more than one translation unit. 66 #define REGISTER_LIST_WITH_PROGRAMSTATE(Name, Elem) \ 67 REGISTER_TRAIT_WITH_PROGRAMSTATE(Name, llvm::ImmutableList<Elem>) 68 69 70 class CheckerContext { 71 ExprEngine &Eng; 72 /// The current exploded(symbolic execution) graph node. 73 ExplodedNode *Pred; 74 /// The flag is true if the (state of the execution) has been modified 75 /// by the checker using this context. For example, a new transition has been 76 /// added or a bug report issued. 77 bool Changed; 78 /// The tagged location, which is used to generate all new nodes. 79 const ProgramPoint Location; 80 NodeBuilder &NB; 81 82 public: 83 /// If we are post visiting a call, this flag will be set if the 84 /// call was inlined. In all other cases it will be false. 85 const bool wasInlined; 86 87 CheckerContext(NodeBuilder &builder, 88 ExprEngine &eng, 89 ExplodedNode *pred, 90 const ProgramPoint &loc, 91 bool wasInlined = false) Eng(eng)92 : Eng(eng), 93 Pred(pred), 94 Changed(false), 95 Location(loc), 96 NB(builder), 97 wasInlined(wasInlined) { 98 assert(Pred->getState() && 99 "We should not call the checkers on an empty state."); 100 } 101 getAnalysisManager()102 AnalysisManager &getAnalysisManager() { 103 return Eng.getAnalysisManager(); 104 } 105 getConstraintManager()106 ConstraintManager &getConstraintManager() { 107 return Eng.getConstraintManager(); 108 } 109 getStoreManager()110 StoreManager &getStoreManager() { 111 return Eng.getStoreManager(); 112 } 113 114 /// \brief Returns the previous node in the exploded graph, which includes 115 /// the state of the program before the checker ran. Note, checkers should 116 /// not retain the node in their state since the nodes might get invalidated. getPredecessor()117 ExplodedNode *getPredecessor() { return Pred; } getState()118 const ProgramStateRef &getState() const { return Pred->getState(); } 119 120 /// \brief Check if the checker changed the state of the execution; ex: added 121 /// a new transition or a bug report. isDifferent()122 bool isDifferent() { return Changed; } 123 124 /// \brief Returns the number of times the current block has been visited 125 /// along the analyzed path. blockCount()126 unsigned blockCount() const { 127 return NB.getContext().blockCount(); 128 } 129 getASTContext()130 ASTContext &getASTContext() { 131 return Eng.getContext(); 132 } 133 getLangOpts()134 const LangOptions &getLangOpts() const { 135 return Eng.getContext().getLangOpts(); 136 } 137 getLocationContext()138 const LocationContext *getLocationContext() const { 139 return Pred->getLocationContext(); 140 } 141 getStackFrame()142 const StackFrameContext *getStackFrame() const { 143 return Pred->getStackFrame(); 144 } 145 146 /// Return true if the current LocationContext has no caller context. inTopFrame()147 bool inTopFrame() const { return getLocationContext()->inTopFrame(); } 148 getBugReporter()149 BugReporter &getBugReporter() { 150 return Eng.getBugReporter(); 151 } 152 getSourceManager()153 SourceManager &getSourceManager() { 154 return getBugReporter().getSourceManager(); 155 } 156 getSValBuilder()157 SValBuilder &getSValBuilder() { 158 return Eng.getSValBuilder(); 159 } 160 getSymbolManager()161 SymbolManager &getSymbolManager() { 162 return getSValBuilder().getSymbolManager(); 163 } 164 isObjCGCEnabled()165 bool isObjCGCEnabled() const { 166 return Eng.isObjCGCEnabled(); 167 } 168 getStateManager()169 ProgramStateManager &getStateManager() { 170 return Eng.getStateManager(); 171 } 172 getCurrentAnalysisDeclContext()173 AnalysisDeclContext *getCurrentAnalysisDeclContext() const { 174 return Pred->getLocationContext()->getAnalysisDeclContext(); 175 } 176 177 /// \brief Get the blockID. getBlockID()178 unsigned getBlockID() const { 179 return NB.getContext().getBlock()->getBlockID(); 180 } 181 182 /// \brief If the given node corresponds to a PostStore program point, 183 /// retrieve the location region as it was uttered in the code. 184 /// 185 /// This utility can be useful for generating extensive diagnostics, for 186 /// example, for finding variables that the given symbol was assigned to. getLocationRegionIfPostStore(const ExplodedNode * N)187 static const MemRegion *getLocationRegionIfPostStore(const ExplodedNode *N) { 188 ProgramPoint L = N->getLocation(); 189 if (Optional<PostStore> PSL = L.getAs<PostStore>()) 190 return reinterpret_cast<const MemRegion*>(PSL->getLocationValue()); 191 return nullptr; 192 } 193 194 /// \brief Get the value of arbitrary expressions at this point in the path. getSVal(const Stmt * S)195 SVal getSVal(const Stmt *S) const { 196 return getState()->getSVal(S, getLocationContext()); 197 } 198 199 /// \brief Generates a new transition in the program state graph 200 /// (ExplodedGraph). Uses the default CheckerContext predecessor node. 201 /// 202 /// @param State The state of the generated node. If not specified, the state 203 /// will not be changed, but the new node will have the checker's tag. 204 /// @param Tag The tag is used to uniquely identify the creation site. If no 205 /// tag is specified, a default tag, unique to the given checker, 206 /// will be used. Tags are used to prevent states generated at 207 /// different sites from caching out. 208 ExplodedNode *addTransition(ProgramStateRef State = nullptr, 209 const ProgramPointTag *Tag = nullptr) { 210 return addTransitionImpl(State ? State : getState(), false, nullptr, Tag); 211 } 212 213 /// \brief Generates a new transition with the given predecessor. 214 /// Allows checkers to generate a chain of nodes. 215 /// 216 /// @param State The state of the generated node. 217 /// @param Pred The transition will be generated from the specified Pred node 218 /// to the newly generated node. 219 /// @param Tag The tag to uniquely identify the creation site. 220 ExplodedNode *addTransition(ProgramStateRef State, 221 ExplodedNode *Pred, 222 const ProgramPointTag *Tag = nullptr) { 223 return addTransitionImpl(State, false, Pred, Tag); 224 } 225 226 /// \brief Generate a sink node. Generating a sink stops exploration of the 227 /// given path. To create a sink node for the purpose of reporting an error, 228 /// checkers should use generateErrorNode() instead. 229 ExplodedNode *generateSink(ProgramStateRef State, ExplodedNode *Pred, 230 const ProgramPointTag *Tag = nullptr) { 231 return addTransitionImpl(State ? State : getState(), true, Pred, Tag); 232 } 233 234 /// \brief Generate a transition to a node that will be used to report 235 /// an error. This node will be a sink. That is, it will stop exploration of 236 /// the given path. 237 /// 238 /// @param State The state of the generated node. 239 /// @param Tag The tag to uniquely identify the creation site. If null, 240 /// the default tag for the checker will be used. 241 ExplodedNode *generateErrorNode(ProgramStateRef State = nullptr, 242 const ProgramPointTag *Tag = nullptr) { 243 return generateSink(State, Pred, 244 (Tag ? Tag : Location.getTag())); 245 } 246 247 /// \brief Generate a transition to a node that will be used to report 248 /// an error. This node will not be a sink. That is, exploration will 249 /// continue along this path. 250 /// 251 /// @param State The state of the generated node. 252 /// @param Tag The tag to uniquely identify the creation site. If null, 253 /// the default tag for the checker will be used. 254 ExplodedNode * 255 generateNonFatalErrorNode(ProgramStateRef State = nullptr, 256 const ProgramPointTag *Tag = nullptr) { 257 return addTransition(State, (Tag ? Tag : Location.getTag())); 258 } 259 260 /// \brief Emit the diagnostics report. emitReport(std::unique_ptr<BugReport> R)261 void emitReport(std::unique_ptr<BugReport> R) { 262 Changed = true; 263 Eng.getBugReporter().emitReport(std::move(R)); 264 } 265 266 /// \brief Get the declaration of the called function (path-sensitive). 267 const FunctionDecl *getCalleeDecl(const CallExpr *CE) const; 268 269 /// \brief Get the name of the called function (path-sensitive). 270 StringRef getCalleeName(const FunctionDecl *FunDecl) const; 271 272 /// \brief Get the identifier of the called function (path-sensitive). getCalleeIdentifier(const CallExpr * CE)273 const IdentifierInfo *getCalleeIdentifier(const CallExpr *CE) const { 274 const FunctionDecl *FunDecl = getCalleeDecl(CE); 275 if (FunDecl) 276 return FunDecl->getIdentifier(); 277 else 278 return nullptr; 279 } 280 281 /// \brief Get the name of the called function (path-sensitive). getCalleeName(const CallExpr * CE)282 StringRef getCalleeName(const CallExpr *CE) const { 283 const FunctionDecl *FunDecl = getCalleeDecl(CE); 284 return getCalleeName(FunDecl); 285 } 286 287 /// \brief Returns true if the callee is an externally-visible function in the 288 /// top-level namespace, such as \c malloc. 289 /// 290 /// If a name is provided, the function must additionally match the given 291 /// name. 292 /// 293 /// Note that this deliberately excludes C++ library functions in the \c std 294 /// namespace, but will include C library functions accessed through the 295 /// \c std namespace. This also does not check if the function is declared 296 /// as 'extern "C"', or if it uses C++ name mangling. 297 static bool isCLibraryFunction(const FunctionDecl *FD, 298 StringRef Name = StringRef()); 299 300 /// \brief Depending on wither the location corresponds to a macro, return 301 /// either the macro name or the token spelling. 302 /// 303 /// This could be useful when checkers' logic depends on whether a function 304 /// is called with a given macro argument. For example: 305 /// s = socket(AF_INET,..) 306 /// If AF_INET is a macro, the result should be treated as a source of taint. 307 /// 308 /// \sa clang::Lexer::getSpelling(), clang::Lexer::getImmediateMacroName(). 309 StringRef getMacroNameOrSpelling(SourceLocation &Loc); 310 311 private: 312 ExplodedNode *addTransitionImpl(ProgramStateRef State, 313 bool MarkAsSink, 314 ExplodedNode *P = nullptr, 315 const ProgramPointTag *Tag = nullptr) { 316 // The analyzer may stop exploring if it sees a state it has previously 317 // visited ("cache out"). The early return here is a defensive check to 318 // prevent accidental caching out by checker API clients. Unless there is a 319 // tag or the client checker has requested that the generated node be 320 // marked as a sink, we assume that a client requesting a transition to a 321 // state that is the same as the predecessor state has made a mistake. We 322 // return the predecessor rather than cache out. 323 // 324 // TODO: We could potentially change the return to an assertion to alert 325 // clients to their mistake, but several checkers (including 326 // DereferenceChecker, CallAndMessageChecker, and DynamicTypePropagation) 327 // rely upon the defensive behavior and would need to be updated. 328 if (!State || (State == Pred->getState() && !Tag && !MarkAsSink)) 329 return Pred; 330 331 Changed = true; 332 const ProgramPoint &LocalLoc = (Tag ? Location.withTag(Tag) : Location); 333 if (!P) 334 P = Pred; 335 336 ExplodedNode *node; 337 if (MarkAsSink) 338 node = NB.generateSink(LocalLoc, State, P); 339 else 340 node = NB.generateNode(LocalLoc, State, P); 341 return node; 342 } 343 }; 344 345 } // end GR namespace 346 347 } // end clang namespace 348 349 #endif 350