1 //=- NSErrorChecker.cpp - Coding conventions for uses of NSError -*- C++ -*-==//
2 //
3 // The LLVM Compiler Infrastructure
4 //
5 // This file is distributed under the University of Illinois Open Source
6 // License. See LICENSE.TXT for details.
7 //
8 //===----------------------------------------------------------------------===//
9 //
10 // This file defines a CheckNSError, a flow-insenstive check
11 // that determines if an Objective-C class interface correctly returns
12 // a non-void return type.
13 //
14 // File under feature request PR 2600.
15 //
16 //===----------------------------------------------------------------------===//
17
18 #include "ClangSACheckers.h"
19 #include "clang/AST/Decl.h"
20 #include "clang/AST/DeclObjC.h"
21 #include "clang/StaticAnalyzer/Core/BugReporter/BugType.h"
22 #include "clang/StaticAnalyzer/Core/Checker.h"
23 #include "clang/StaticAnalyzer/Core/CheckerManager.h"
24 #include "clang/StaticAnalyzer/Core/PathSensitive/CheckerContext.h"
25 #include "clang/StaticAnalyzer/Core/PathSensitive/ProgramStateTrait.h"
26 #include "llvm/ADT/SmallString.h"
27 #include "llvm/Support/raw_ostream.h"
28
29 using namespace clang;
30 using namespace ento;
31
32 static bool IsNSError(QualType T, IdentifierInfo *II);
33 static bool IsCFError(QualType T, IdentifierInfo *II);
34
35 //===----------------------------------------------------------------------===//
36 // NSErrorMethodChecker
37 //===----------------------------------------------------------------------===//
38
39 namespace {
40 class NSErrorMethodChecker
41 : public Checker< check::ASTDecl<ObjCMethodDecl> > {
42 mutable IdentifierInfo *II;
43
44 public:
NSErrorMethodChecker()45 NSErrorMethodChecker() : II(nullptr) {}
46
47 void checkASTDecl(const ObjCMethodDecl *D,
48 AnalysisManager &mgr, BugReporter &BR) const;
49 };
50 }
51
checkASTDecl(const ObjCMethodDecl * D,AnalysisManager & mgr,BugReporter & BR) const52 void NSErrorMethodChecker::checkASTDecl(const ObjCMethodDecl *D,
53 AnalysisManager &mgr,
54 BugReporter &BR) const {
55 if (!D->isThisDeclarationADefinition())
56 return;
57 if (!D->getReturnType()->isVoidType())
58 return;
59
60 if (!II)
61 II = &D->getASTContext().Idents.get("NSError");
62
63 bool hasNSError = false;
64 for (const auto *I : D->parameters()) {
65 if (IsNSError(I->getType(), II)) {
66 hasNSError = true;
67 break;
68 }
69 }
70
71 if (hasNSError) {
72 const char *err = "Method accepting NSError** "
73 "should have a non-void return value to indicate whether or not an "
74 "error occurred";
75 PathDiagnosticLocation L =
76 PathDiagnosticLocation::create(D, BR.getSourceManager());
77 BR.EmitBasicReport(D, this, "Bad return type when passing NSError**",
78 "Coding conventions (Apple)", err, L);
79 }
80 }
81
82 //===----------------------------------------------------------------------===//
83 // CFErrorFunctionChecker
84 //===----------------------------------------------------------------------===//
85
86 namespace {
87 class CFErrorFunctionChecker
88 : public Checker< check::ASTDecl<FunctionDecl> > {
89 mutable IdentifierInfo *II;
90
91 public:
CFErrorFunctionChecker()92 CFErrorFunctionChecker() : II(nullptr) {}
93
94 void checkASTDecl(const FunctionDecl *D,
95 AnalysisManager &mgr, BugReporter &BR) const;
96 };
97 }
98
checkASTDecl(const FunctionDecl * D,AnalysisManager & mgr,BugReporter & BR) const99 void CFErrorFunctionChecker::checkASTDecl(const FunctionDecl *D,
100 AnalysisManager &mgr,
101 BugReporter &BR) const {
102 if (!D->doesThisDeclarationHaveABody())
103 return;
104 if (!D->getReturnType()->isVoidType())
105 return;
106
107 if (!II)
108 II = &D->getASTContext().Idents.get("CFErrorRef");
109
110 bool hasCFError = false;
111 for (auto I : D->parameters()) {
112 if (IsCFError(I->getType(), II)) {
113 hasCFError = true;
114 break;
115 }
116 }
117
118 if (hasCFError) {
119 const char *err = "Function accepting CFErrorRef* "
120 "should have a non-void return value to indicate whether or not an "
121 "error occurred";
122 PathDiagnosticLocation L =
123 PathDiagnosticLocation::create(D, BR.getSourceManager());
124 BR.EmitBasicReport(D, this, "Bad return type when passing CFErrorRef*",
125 "Coding conventions (Apple)", err, L);
126 }
127 }
128
129 //===----------------------------------------------------------------------===//
130 // NSOrCFErrorDerefChecker
131 //===----------------------------------------------------------------------===//
132
133 namespace {
134
135 class NSErrorDerefBug : public BugType {
136 public:
NSErrorDerefBug(const CheckerBase * Checker)137 NSErrorDerefBug(const CheckerBase *Checker)
138 : BugType(Checker, "NSError** null dereference",
139 "Coding conventions (Apple)") {}
140 };
141
142 class CFErrorDerefBug : public BugType {
143 public:
CFErrorDerefBug(const CheckerBase * Checker)144 CFErrorDerefBug(const CheckerBase *Checker)
145 : BugType(Checker, "CFErrorRef* null dereference",
146 "Coding conventions (Apple)") {}
147 };
148
149 }
150
151 namespace {
152 class NSOrCFErrorDerefChecker
153 : public Checker< check::Location,
154 check::Event<ImplicitNullDerefEvent> > {
155 mutable IdentifierInfo *NSErrorII, *CFErrorII;
156 mutable std::unique_ptr<NSErrorDerefBug> NSBT;
157 mutable std::unique_ptr<CFErrorDerefBug> CFBT;
158 public:
159 bool ShouldCheckNSError, ShouldCheckCFError;
NSOrCFErrorDerefChecker()160 NSOrCFErrorDerefChecker() : NSErrorII(nullptr), CFErrorII(nullptr),
161 ShouldCheckNSError(0), ShouldCheckCFError(0) { }
162
163 void checkLocation(SVal loc, bool isLoad, const Stmt *S,
164 CheckerContext &C) const;
165 void checkEvent(ImplicitNullDerefEvent event) const;
166 };
167 }
168
169 typedef llvm::ImmutableMap<SymbolRef, unsigned> ErrorOutFlag;
REGISTER_TRAIT_WITH_PROGRAMSTATE(NSErrorOut,ErrorOutFlag)170 REGISTER_TRAIT_WITH_PROGRAMSTATE(NSErrorOut, ErrorOutFlag)
171 REGISTER_TRAIT_WITH_PROGRAMSTATE(CFErrorOut, ErrorOutFlag)
172
173 template <typename T>
174 static bool hasFlag(SVal val, ProgramStateRef state) {
175 if (SymbolRef sym = val.getAsSymbol())
176 if (const unsigned *attachedFlags = state->get<T>(sym))
177 return *attachedFlags;
178 return false;
179 }
180
181 template <typename T>
setFlag(ProgramStateRef state,SVal val,CheckerContext & C)182 static void setFlag(ProgramStateRef state, SVal val, CheckerContext &C) {
183 // We tag the symbol that the SVal wraps.
184 if (SymbolRef sym = val.getAsSymbol())
185 C.addTransition(state->set<T>(sym, true));
186 }
187
parameterTypeFromSVal(SVal val,CheckerContext & C)188 static QualType parameterTypeFromSVal(SVal val, CheckerContext &C) {
189 const StackFrameContext *
190 SFC = C.getLocationContext()->getCurrentStackFrame();
191 if (Optional<loc::MemRegionVal> X = val.getAs<loc::MemRegionVal>()) {
192 const MemRegion* R = X->getRegion();
193 if (const VarRegion *VR = R->getAs<VarRegion>())
194 if (const StackArgumentsSpaceRegion *
195 stackReg = dyn_cast<StackArgumentsSpaceRegion>(VR->getMemorySpace()))
196 if (stackReg->getStackFrame() == SFC)
197 return VR->getValueType();
198 }
199
200 return QualType();
201 }
202
checkLocation(SVal loc,bool isLoad,const Stmt * S,CheckerContext & C) const203 void NSOrCFErrorDerefChecker::checkLocation(SVal loc, bool isLoad,
204 const Stmt *S,
205 CheckerContext &C) const {
206 if (!isLoad)
207 return;
208 if (loc.isUndef() || !loc.getAs<Loc>())
209 return;
210
211 ASTContext &Ctx = C.getASTContext();
212 ProgramStateRef state = C.getState();
213
214 // If we are loading from NSError**/CFErrorRef* parameter, mark the resulting
215 // SVal so that we can later check it when handling the
216 // ImplicitNullDerefEvent event.
217 // FIXME: Cumbersome! Maybe add hook at construction of SVals at start of
218 // function ?
219
220 QualType parmT = parameterTypeFromSVal(loc, C);
221 if (parmT.isNull())
222 return;
223
224 if (!NSErrorII)
225 NSErrorII = &Ctx.Idents.get("NSError");
226 if (!CFErrorII)
227 CFErrorII = &Ctx.Idents.get("CFErrorRef");
228
229 if (ShouldCheckNSError && IsNSError(parmT, NSErrorII)) {
230 setFlag<NSErrorOut>(state, state->getSVal(loc.castAs<Loc>()), C);
231 return;
232 }
233
234 if (ShouldCheckCFError && IsCFError(parmT, CFErrorII)) {
235 setFlag<CFErrorOut>(state, state->getSVal(loc.castAs<Loc>()), C);
236 return;
237 }
238 }
239
checkEvent(ImplicitNullDerefEvent event) const240 void NSOrCFErrorDerefChecker::checkEvent(ImplicitNullDerefEvent event) const {
241 if (event.IsLoad)
242 return;
243
244 SVal loc = event.Location;
245 ProgramStateRef state = event.SinkNode->getState();
246 BugReporter &BR = *event.BR;
247
248 bool isNSError = hasFlag<NSErrorOut>(loc, state);
249 bool isCFError = false;
250 if (!isNSError)
251 isCFError = hasFlag<CFErrorOut>(loc, state);
252
253 if (!(isNSError || isCFError))
254 return;
255
256 // Storing to possible null NSError/CFErrorRef out parameter.
257 SmallString<128> Buf;
258 llvm::raw_svector_ostream os(Buf);
259
260 os << "Potential null dereference. According to coding standards ";
261 os << (isNSError
262 ? "in 'Creating and Returning NSError Objects' the parameter"
263 : "documented in CoreFoundation/CFError.h the parameter");
264
265 os << " may be null";
266
267 BugType *bug = nullptr;
268 if (isNSError) {
269 if (!NSBT)
270 NSBT.reset(new NSErrorDerefBug(this));
271 bug = NSBT.get();
272 }
273 else {
274 if (!CFBT)
275 CFBT.reset(new CFErrorDerefBug(this));
276 bug = CFBT.get();
277 }
278 BR.emitReport(llvm::make_unique<BugReport>(*bug, os.str(), event.SinkNode));
279 }
280
IsNSError(QualType T,IdentifierInfo * II)281 static bool IsNSError(QualType T, IdentifierInfo *II) {
282
283 const PointerType* PPT = T->getAs<PointerType>();
284 if (!PPT)
285 return false;
286
287 const ObjCObjectPointerType* PT =
288 PPT->getPointeeType()->getAs<ObjCObjectPointerType>();
289
290 if (!PT)
291 return false;
292
293 const ObjCInterfaceDecl *ID = PT->getInterfaceDecl();
294
295 // FIXME: Can ID ever be NULL?
296 if (ID)
297 return II == ID->getIdentifier();
298
299 return false;
300 }
301
IsCFError(QualType T,IdentifierInfo * II)302 static bool IsCFError(QualType T, IdentifierInfo *II) {
303 const PointerType* PPT = T->getAs<PointerType>();
304 if (!PPT) return false;
305
306 const TypedefType* TT = PPT->getPointeeType()->getAs<TypedefType>();
307 if (!TT) return false;
308
309 return TT->getDecl()->getIdentifier() == II;
310 }
311
registerNSErrorChecker(CheckerManager & mgr)312 void ento::registerNSErrorChecker(CheckerManager &mgr) {
313 mgr.registerChecker<NSErrorMethodChecker>();
314 NSOrCFErrorDerefChecker *checker =
315 mgr.registerChecker<NSOrCFErrorDerefChecker>();
316 checker->ShouldCheckNSError = true;
317 }
318
registerCFErrorChecker(CheckerManager & mgr)319 void ento::registerCFErrorChecker(CheckerManager &mgr) {
320 mgr.registerChecker<CFErrorFunctionChecker>();
321 NSOrCFErrorDerefChecker *checker =
322 mgr.registerChecker<NSOrCFErrorDerefChecker>();
323 checker->ShouldCheckCFError = true;
324 }
325