1 //===--- NonNullParamChecker.cpp - Undefined arguments checker -*- C++ -*--===//
2 //
3 // The LLVM Compiler Infrastructure
4 //
5 // This file is distributed under the University of Illinois Open Source
6 // License. See LICENSE.TXT for details.
7 //
8 //===----------------------------------------------------------------------===//
9 //
10 // This defines NonNullParamChecker, which checks for arguments expected not to
11 // be null due to:
12 // - the corresponding parameters being declared to have nonnull attribute
13 // - the corresponding parameters being references; since the call would form
14 // a reference to a null pointer
15 //
16 //===----------------------------------------------------------------------===//
17
18 #include "ClangSACheckers.h"
19 #include "clang/AST/Attr.h"
20 #include "clang/StaticAnalyzer/Core/BugReporter/BugType.h"
21 #include "clang/StaticAnalyzer/Core/Checker.h"
22 #include "clang/StaticAnalyzer/Core/CheckerManager.h"
23 #include "clang/StaticAnalyzer/Core/PathSensitive/CallEvent.h"
24 #include "clang/StaticAnalyzer/Core/PathSensitive/CheckerContext.h"
25
26 using namespace clang;
27 using namespace ento;
28
29 namespace {
30 class NonNullParamChecker
31 : public Checker< check::PreCall, EventDispatcher<ImplicitNullDerefEvent> > {
32 mutable std::unique_ptr<BugType> BTAttrNonNull;
33 mutable std::unique_ptr<BugType> BTNullRefArg;
34
35 public:
36
37 void checkPreCall(const CallEvent &Call, CheckerContext &C) const;
38
39 std::unique_ptr<BugReport>
40 genReportNullAttrNonNull(const ExplodedNode *ErrorN, const Expr *ArgE) const;
41 std::unique_ptr<BugReport>
42 genReportReferenceToNullPointer(const ExplodedNode *ErrorN,
43 const Expr *ArgE) const;
44 };
45 } // end anonymous namespace
46
checkPreCall(const CallEvent & Call,CheckerContext & C) const47 void NonNullParamChecker::checkPreCall(const CallEvent &Call,
48 CheckerContext &C) const {
49 const Decl *FD = Call.getDecl();
50 if (!FD)
51 return;
52
53 // Merge all non-null attributes
54 unsigned NumArgs = Call.getNumArgs();
55 llvm::SmallBitVector AttrNonNull(NumArgs);
56 for (const auto *NonNull : FD->specific_attrs<NonNullAttr>()) {
57 if (!NonNull->args_size()) {
58 AttrNonNull.set(0, NumArgs);
59 break;
60 }
61 for (unsigned Val : NonNull->args()) {
62 if (Val >= NumArgs)
63 continue;
64 AttrNonNull.set(Val);
65 }
66 }
67
68 ProgramStateRef state = C.getState();
69
70 CallEvent::param_type_iterator TyI = Call.param_type_begin(),
71 TyE = Call.param_type_end();
72
73 for (unsigned idx = 0; idx < NumArgs; ++idx) {
74
75 // Check if the parameter is a reference. We want to report when reference
76 // to a null pointer is passed as a paramter.
77 bool haveRefTypeParam = false;
78 if (TyI != TyE) {
79 haveRefTypeParam = (*TyI)->isReferenceType();
80 TyI++;
81 }
82
83 bool haveAttrNonNull = AttrNonNull[idx];
84 if (!haveAttrNonNull) {
85 // Check if the parameter is also marked 'nonnull'.
86 ArrayRef<ParmVarDecl*> parms = Call.parameters();
87 if (idx < parms.size())
88 haveAttrNonNull = parms[idx]->hasAttr<NonNullAttr>();
89 }
90
91 if (!haveRefTypeParam && !haveAttrNonNull)
92 continue;
93
94 // If the value is unknown or undefined, we can't perform this check.
95 const Expr *ArgE = Call.getArgExpr(idx);
96 SVal V = Call.getArgSVal(idx);
97 Optional<DefinedSVal> DV = V.getAs<DefinedSVal>();
98 if (!DV)
99 continue;
100
101 // Process the case when the argument is not a location.
102 assert(!haveRefTypeParam || DV->getAs<Loc>());
103
104 if (haveAttrNonNull && !DV->getAs<Loc>()) {
105 // If the argument is a union type, we want to handle a potential
106 // transparent_union GCC extension.
107 if (!ArgE)
108 continue;
109
110 QualType T = ArgE->getType();
111 const RecordType *UT = T->getAsUnionType();
112 if (!UT || !UT->getDecl()->hasAttr<TransparentUnionAttr>())
113 continue;
114
115 if (Optional<nonloc::CompoundVal> CSV =
116 DV->getAs<nonloc::CompoundVal>()) {
117 nonloc::CompoundVal::iterator CSV_I = CSV->begin();
118 assert(CSV_I != CSV->end());
119 V = *CSV_I;
120 DV = V.getAs<DefinedSVal>();
121 assert(++CSV_I == CSV->end());
122 // FIXME: Handle (some_union){ some_other_union_val }, which turns into
123 // a LazyCompoundVal inside a CompoundVal.
124 if (!V.getAs<Loc>())
125 continue;
126 // Retrieve the corresponding expression.
127 if (const CompoundLiteralExpr *CE = dyn_cast<CompoundLiteralExpr>(ArgE))
128 if (const InitListExpr *IE =
129 dyn_cast<InitListExpr>(CE->getInitializer()))
130 ArgE = dyn_cast<Expr>(*(IE->begin()));
131
132 } else {
133 // FIXME: Handle LazyCompoundVals?
134 continue;
135 }
136 }
137
138 ConstraintManager &CM = C.getConstraintManager();
139 ProgramStateRef stateNotNull, stateNull;
140 std::tie(stateNotNull, stateNull) = CM.assumeDual(state, *DV);
141
142 if (stateNull) {
143 if (!stateNotNull) {
144 // Generate an error node. Check for a null node in case
145 // we cache out.
146 if (ExplodedNode *errorNode = C.generateErrorNode(stateNull)) {
147
148 std::unique_ptr<BugReport> R;
149 if (haveAttrNonNull)
150 R = genReportNullAttrNonNull(errorNode, ArgE);
151 else if (haveRefTypeParam)
152 R = genReportReferenceToNullPointer(errorNode, ArgE);
153
154 // Highlight the range of the argument that was null.
155 R->addRange(Call.getArgSourceRange(idx));
156
157 // Emit the bug report.
158 C.emitReport(std::move(R));
159 }
160
161 // Always return. Either we cached out or we just emitted an error.
162 return;
163 }
164 if (ExplodedNode *N = C.generateSink(stateNull, C.getPredecessor())) {
165 ImplicitNullDerefEvent event = {
166 V, false, N, &C.getBugReporter(),
167 /*IsDirectDereference=*/haveRefTypeParam};
168 dispatchEvent(event);
169 }
170 }
171
172 // If a pointer value passed the check we should assume that it is
173 // indeed not null from this point forward.
174 assert(stateNotNull);
175 state = stateNotNull;
176 }
177
178 // If we reach here all of the arguments passed the nonnull check.
179 // If 'state' has been updated generated a new node.
180 C.addTransition(state);
181 }
182
183 std::unique_ptr<BugReport>
genReportNullAttrNonNull(const ExplodedNode * ErrorNode,const Expr * ArgE) const184 NonNullParamChecker::genReportNullAttrNonNull(const ExplodedNode *ErrorNode,
185 const Expr *ArgE) const {
186 // Lazily allocate the BugType object if it hasn't already been
187 // created. Ownership is transferred to the BugReporter object once
188 // the BugReport is passed to 'EmitWarning'.
189 if (!BTAttrNonNull)
190 BTAttrNonNull.reset(new BugType(
191 this, "Argument with 'nonnull' attribute passed null", "API"));
192
193 auto R = llvm::make_unique<BugReport>(
194 *BTAttrNonNull,
195 "Null pointer passed as an argument to a 'nonnull' parameter", ErrorNode);
196 if (ArgE)
197 bugreporter::trackNullOrUndefValue(ErrorNode, ArgE, *R);
198
199 return R;
200 }
201
genReportReferenceToNullPointer(const ExplodedNode * ErrorNode,const Expr * ArgE) const202 std::unique_ptr<BugReport> NonNullParamChecker::genReportReferenceToNullPointer(
203 const ExplodedNode *ErrorNode, const Expr *ArgE) const {
204 if (!BTNullRefArg)
205 BTNullRefArg.reset(new BuiltinBug(this, "Dereference of null pointer"));
206
207 auto R = llvm::make_unique<BugReport>(
208 *BTNullRefArg, "Forming reference to null pointer", ErrorNode);
209 if (ArgE) {
210 const Expr *ArgEDeref = bugreporter::getDerefExpr(ArgE);
211 if (!ArgEDeref)
212 ArgEDeref = ArgE;
213 bugreporter::trackNullOrUndefValue(ErrorNode,
214 ArgEDeref,
215 *R);
216 }
217 return R;
218
219 }
220
registerNonNullParamChecker(CheckerManager & mgr)221 void ento::registerNonNullParamChecker(CheckerManager &mgr) {
222 mgr.registerChecker<NonNullParamChecker>();
223 }
224