327 lines
11 KiB
C++
327 lines
11 KiB
C++
|
//===--- NonNullParamChecker.cpp - Undefined arguments checker -*- C++ -*--===//
|
||
|
|
//
|
||
|
|
// Part of the LLVM Project, under the Apache License v2.0 with LLVM Exceptions.
|
||
|
|
// See https://llvm.org/LICENSE.txt for license information.
|
||
|
|
// SPDX-License-Identifier: Apache-2.0 WITH LLVM-exception
|
||
|
|
//
|
||
|
|
//===----------------------------------------------------------------------===//
|
||
|
|
//
|
||
|
|
// This defines NonNullParamChecker, which checks for arguments expected not to
|
||
|
|
// be null due to:
|
||
|
|
// - the corresponding parameters being declared to have nonnull attribute
|
||
|
|
// - the corresponding parameters being references; since the call would form
|
||
|
|
// a reference to a null pointer
|
||
|
|
//
|
||
|
|
//===----------------------------------------------------------------------===//
|
||
|
|
|
||
|
|
#include "clang/AST/Attr.h"
|
||
|
|
#include "clang/Analysis/AnyCall.h"
|
||
|
|
#include "clang/StaticAnalyzer/Checkers/BuiltinCheckerRegistration.h"
|
||
|
|
#include "clang/StaticAnalyzer/Core/BugReporter/BugType.h"
|
||
|
|
#include "clang/StaticAnalyzer/Core/Checker.h"
|
||
|
|
#include "clang/StaticAnalyzer/Core/CheckerManager.h"
|
||
|
|
#include "clang/StaticAnalyzer/Core/PathSensitive/CallEvent.h"
|
||
|
|
#include "clang/StaticAnalyzer/Core/PathSensitive/CheckerContext.h"
|
||
|
|
#include "llvm/ADT/StringExtras.h"
|
||
|
|
|
||
|
|
using namespace clang;
|
||
|
|
using namespace ento;
|
||
|
|
|
||
|
|
namespace {
|
||
|
|
class NonNullParamChecker
|
||
|
|
: public Checker<check::PreCall, check::BeginFunction,
|
||
|
|
EventDispatcher<ImplicitNullDerefEvent>> {
|
||
|
|
mutable std::unique_ptr<BugType> BTAttrNonNull;
|
||
|
|
mutable std::unique_ptr<BugType> BTNullRefArg;
|
||
|
|
|
||
|
|
public:
|
||
|
|
void checkPreCall(const CallEvent &Call, CheckerContext &C) const;
|
||
|
|
void checkBeginFunction(CheckerContext &C) const;
|
||
|
|
|
||
|
|
std::unique_ptr<PathSensitiveBugReport>
|
||
|
|
genReportNullAttrNonNull(const ExplodedNode *ErrorN, const Expr *ArgE,
|
||
|
|
unsigned IdxOfArg) const;
|
||
|
|
std::unique_ptr<PathSensitiveBugReport>
|
||
|
|
genReportReferenceToNullPointer(const ExplodedNode *ErrorN,
|
||
|
|
const Expr *ArgE) const;
|
||
|
|
};
|
||
|
|
|
||
|
|
template <class CallType>
|
||
|
|
void setBitsAccordingToFunctionAttributes(const CallType &Call,
|
||
|
|
llvm::SmallBitVector &AttrNonNull) {
|
||
|
|
const Decl *FD = Call.getDecl();
|
||
|
|
|
||
|
|
for (const auto *NonNull : FD->specific_attrs<NonNullAttr>()) {
|
||
|
|
if (!NonNull->args_size()) {
|
||
|
|
// Lack of attribute parameters means that all of the parameters are
|
||
|
|
// implicitly marked as non-null.
|
||
|
|
AttrNonNull.set();
|
||
|
|
break;
|
||
|
|
}
|
||
|
|
|
||
|
|
for (const ParamIdx &Idx : NonNull->args()) {
|
||
|
|
// 'nonnull' attribute's parameters are 1-based and should be adjusted to
|
||
|
|
// match actual AST parameter/argument indices.
|
||
|
|
unsigned IdxAST = Idx.getASTIndex();
|
||
|
|
if (IdxAST >= AttrNonNull.size())
|
||
|
|
continue;
|
||
|
|
AttrNonNull.set(IdxAST);
|
||
|
|
}
|
||
|
|
}
|
||
|
|
}
|
||
|
|
|
||
|
|
template <class CallType>
|
||
|
|
void setBitsAccordingToParameterAttributes(const CallType &Call,
|
||
|
|
llvm::SmallBitVector &AttrNonNull) {
|
||
|
|
for (const ParmVarDecl *Parameter : Call.parameters()) {
|
||
|
|
unsigned ParameterIndex = Parameter->getFunctionScopeIndex();
|
||
|
|
if (ParameterIndex == AttrNonNull.size())
|
||
|
|
break;
|
||
|
|
|
||
|
|
if (Parameter->hasAttr<NonNullAttr>())
|
||
|
|
AttrNonNull.set(ParameterIndex);
|
||
|
|
}
|
||
|
|
}
|
||
|
|
|
||
|
|
template <class CallType>
|
||
|
|
llvm::SmallBitVector getNonNullAttrsImpl(const CallType &Call,
|
||
|
|
unsigned ExpectedSize) {
|
||
|
|
llvm::SmallBitVector AttrNonNull(ExpectedSize);
|
||
|
|
|
||
|
|
setBitsAccordingToFunctionAttributes(Call, AttrNonNull);
|
||
|
|
setBitsAccordingToParameterAttributes(Call, AttrNonNull);
|
||
|
|
|
||
|
|
return AttrNonNull;
|
||
|
|
}
|
||
|
|
|
||
|
|
/// \return Bitvector marking non-null attributes.
|
||
|
|
llvm::SmallBitVector getNonNullAttrs(const CallEvent &Call) {
|
||
|
|
return getNonNullAttrsImpl(Call, Call.getNumArgs());
|
||
|
|
}
|
||
|
|
|
||
|
|
/// \return Bitvector marking non-null attributes.
|
||
|
|
llvm::SmallBitVector getNonNullAttrs(const AnyCall &Call) {
|
||
|
|
return getNonNullAttrsImpl(Call, Call.param_size());
|
||
|
|
}
|
||
|
|
} // end anonymous namespace
|
||
|
|
|
||
|
|
void NonNullParamChecker::checkPreCall(const CallEvent &Call,
|
||
|
|
CheckerContext &C) const {
|
||
|
|
if (!Call.getDecl())
|
||
|
|
return;
|
||
|
|
|
||
|
|
llvm::SmallBitVector AttrNonNull = getNonNullAttrs(Call);
|
||
|
|
unsigned NumArgs = Call.getNumArgs();
|
||
|
|
|
||
|
|
ProgramStateRef state = C.getState();
|
||
|
|
ArrayRef<ParmVarDecl *> parms = Call.parameters();
|
||
|
|
|
||
|
|
for (unsigned idx = 0; idx < NumArgs; ++idx) {
|
||
|
|
// For vararg functions, a corresponding parameter decl may not exist.
|
||
|
|
bool HasParam = idx < parms.size();
|
||
|
|
|
||
|
|
// Check if the parameter is a reference. We want to report when reference
|
||
|
|
// to a null pointer is passed as a parameter.
|
||
|
|
bool HasRefTypeParam =
|
||
|
|
HasParam ? parms[idx]->getType()->isReferenceType() : false;
|
||
|
|
bool ExpectedToBeNonNull = AttrNonNull.test(idx);
|
||
|
|
|
||
|
|
if (!ExpectedToBeNonNull && !HasRefTypeParam)
|
||
|
|
continue;
|
||
|
|
|
||
|
|
// If the value is unknown or undefined, we can't perform this check.
|
||
|
|
const Expr *ArgE = Call.getArgExpr(idx);
|
||
|
|
SVal V = Call.getArgSVal(idx);
|
||
|
|
auto DV = V.getAs<DefinedSVal>();
|
||
|
|
if (!DV)
|
||
|
|
continue;
|
||
|
|
|
||
|
|
assert(!HasRefTypeParam || DV->getAs<Loc>());
|
||
|
|
|
||
|
|
// Process the case when the argument is not a location.
|
||
|
|
if (ExpectedToBeNonNull && !DV->getAs<Loc>()) {
|
||
|
|
// If the argument is a union type, we want to handle a potential
|
||
|
|
// transparent_union GCC extension.
|
||
|
|
if (!ArgE)
|
||
|
|
continue;
|
||
|
|
|
||
|
|
QualType T = ArgE->getType();
|
||
|
|
const RecordType *UT = T->getAsUnionType();
|
||
|
|
if (!UT || !UT->getDecl()->hasAttr<TransparentUnionAttr>())
|
||
|
|
continue;
|
||
|
|
|
||
|
|
auto CSV = DV->getAs<nonloc::CompoundVal>();
|
||
|
|
|
||
|
|
// FIXME: Handle LazyCompoundVals?
|
||
|
|
if (!CSV)
|
||
|
|
continue;
|
||
|
|
|
||
|
|
V = *(CSV->begin());
|
||
|
|
DV = V.getAs<DefinedSVal>();
|
||
|
|
assert(++CSV->begin() == CSV->end());
|
||
|
|
// FIXME: Handle (some_union){ some_other_union_val }, which turns into
|
||
|
|
// a LazyCompoundVal inside a CompoundVal.
|
||
|
|
if (!V.getAs<Loc>())
|
||
|
|
continue;
|
||
|
|
|
||
|
|
// Retrieve the corresponding expression.
|
||
|
|
if (const auto *CE = dyn_cast<CompoundLiteralExpr>(ArgE))
|
||
|
|
if (const auto *IE = dyn_cast<InitListExpr>(CE->getInitializer()))
|
||
|
|
ArgE = dyn_cast<Expr>(*(IE->begin()));
|
||
|
|
}
|
||
|
|
|
||
|
|
ConstraintManager &CM = C.getConstraintManager();
|
||
|
|
ProgramStateRef stateNotNull, stateNull;
|
||
|
|
std::tie(stateNotNull, stateNull) = CM.assumeDual(state, *DV);
|
||
|
|
|
||
|
|
// Generate an error node. Check for a null node in case
|
||
|
|
// we cache out.
|
||
|
|
if (stateNull && !stateNotNull) {
|
||
|
|
if (ExplodedNode *errorNode = C.generateErrorNode(stateNull)) {
|
||
|
|
|
||
|
|
std::unique_ptr<BugReport> R;
|
||
|
|
if (ExpectedToBeNonNull)
|
||
|
|
R = genReportNullAttrNonNull(errorNode, ArgE, idx + 1);
|
||
|
|
else if (HasRefTypeParam)
|
||
|
|
R = genReportReferenceToNullPointer(errorNode, ArgE);
|
||
|
|
|
||
|
|
// Highlight the range of the argument that was null.
|
||
|
|
R->addRange(Call.getArgSourceRange(idx));
|
||
|
|
|
||
|
|
// Emit the bug report.
|
||
|
|
C.emitReport(std::move(R));
|
||
|
|
}
|
||
|
|
|
||
|
|
// Always return. Either we cached out or we just emitted an error.
|
||
|
|
return;
|
||
|
|
}
|
||
|
|
|
||
|
|
if (stateNull) {
|
||
|
|
if (ExplodedNode *N = C.generateSink(stateNull, C.getPredecessor())) {
|
||
|
|
ImplicitNullDerefEvent event = {
|
||
|
|
V, false, N, &C.getBugReporter(),
|
||
|
|
/*IsDirectDereference=*/HasRefTypeParam};
|
||
|
|
dispatchEvent(event);
|
||
|
|
}
|
||
|
|
}
|
||
|
|
|
||
|
|
// If a pointer value passed the check we should assume that it is
|
||
|
|
// indeed not null from this point forward.
|
||
|
|
state = stateNotNull;
|
||
|
|
}
|
||
|
|
|
||
|
|
// If we reach here all of the arguments passed the nonnull check.
|
||
|
|
// If 'state' has been updated generated a new node.
|
||
|
|
C.addTransition(state);
|
||
|
|
}
|
||
|
|
|
||
|
|
/// We want to trust developer annotations and consider all 'nonnull' parameters
|
||
|
|
/// as non-null indeed. Each marked parameter will get a corresponding
|
||
|
|
/// constraint.
|
||
|
|
///
|
||
|
|
/// This approach will not only help us to get rid of some false positives, but
|
||
|
|
/// remove duplicates and shorten warning traces as well.
|
||
|
|
///
|
||
|
|
/// \code
|
||
|
|
/// void foo(int *x) [[gnu::nonnull]] {
|
||
|
|
/// // . . .
|
||
|
|
/// *x = 42; // we don't want to consider this as an error...
|
||
|
|
/// // . . .
|
||
|
|
/// }
|
||
|
|
///
|
||
|
|
/// foo(nullptr); // ...and report here instead
|
||
|
|
/// \endcode
|
||
|
|
void NonNullParamChecker::checkBeginFunction(CheckerContext &Context) const {
|
||
|
|
// Planned assumption makes sense only for top-level functions.
|
||
|
|
// Inlined functions will get similar constraints as part of 'checkPreCall'.
|
||
|
|
if (!Context.inTopFrame())
|
||
|
|
return;
|
||
|
|
|
||
|
|
const LocationContext *LocContext = Context.getLocationContext();
|
||
|
|
|
||
|
|
const Decl *FD = LocContext->getDecl();
|
||
|
|
// AnyCall helps us here to avoid checking for FunctionDecl and ObjCMethodDecl
|
||
|
|
// separately and aggregates interfaces of these classes.
|
||
|
|
auto AbstractCall = AnyCall::forDecl(FD);
|
||
|
|
if (!AbstractCall)
|
||
|
|
return;
|
||
|
|
|
||
|
|
ProgramStateRef State = Context.getState();
|
||
|
|
llvm::SmallBitVector ParameterNonNullMarks = getNonNullAttrs(*AbstractCall);
|
||
|
|
|
||
|
|
for (const ParmVarDecl *Parameter : AbstractCall->parameters()) {
|
||
|
|
// 1. Check parameter if it is annotated as non-null
|
||
|
|
if (!ParameterNonNullMarks.test(Parameter->getFunctionScopeIndex()))
|
||
|
|
continue;
|
||
|
|
|
||
|
|
// 2. Check that parameter is a pointer.
|
||
|
|
// Nonnull attribute can be applied to non-pointers (by default
|
||
|
|
// __attribute__(nonnull) implies "all parameters").
|
||
|
|
if (!Parameter->getType()->isPointerType())
|
||
|
|
continue;
|
||
|
|
|
||
|
|
Loc ParameterLoc = State->getLValue(Parameter, LocContext);
|
||
|
|
// We never consider top-level function parameters undefined.
|
||
|
|
auto StoredVal =
|
||
|
|
State->getSVal(ParameterLoc).castAs<DefinedOrUnknownSVal>();
|
||
|
|
|
||
|
|
// 3. Assume that it is indeed non-null
|
||
|
|
if (ProgramStateRef NewState = State->assume(StoredVal, true)) {
|
||
|
|
State = NewState;
|
||
|
|
}
|
||
|
|
}
|
||
|
|
|
||
|
|
Context.addTransition(State);
|
||
|
|
}
|
||
|
|
|
||
|
|
std::unique_ptr<PathSensitiveBugReport>
|
||
|
|
NonNullParamChecker::genReportNullAttrNonNull(const ExplodedNode *ErrorNode,
|
||
|
|
const Expr *ArgE,
|
||
|
|
unsigned IdxOfArg) const {
|
||
|
|
// Lazily allocate the BugType object if it hasn't already been
|
||
|
|
// created. Ownership is transferred to the BugReporter object once
|
||
|
|
// the BugReport is passed to 'EmitWarning'.
|
||
|
|
if (!BTAttrNonNull)
|
||
|
|
BTAttrNonNull.reset(new BugType(
|
||
|
|
this, "Argument with 'nonnull' attribute passed null", "API"));
|
||
|
|
|
||
|
|
llvm::SmallString<256> SBuf;
|
||
|
|
llvm::raw_svector_ostream OS(SBuf);
|
||
|
|
OS << "Null pointer passed to "
|
||
|
|
<< IdxOfArg << llvm::getOrdinalSuffix(IdxOfArg)
|
||
|
|
<< " parameter expecting 'nonnull'";
|
||
|
|
|
||
|
|
auto R =
|
||
|
|
std::make_unique<PathSensitiveBugReport>(*BTAttrNonNull, SBuf, ErrorNode);
|
||
|
|
if (ArgE)
|
||
|
|
bugreporter::trackExpressionValue(ErrorNode, ArgE, *R);
|
||
|
|
|
||
|
|
return R;
|
||
|
|
}
|
||
|
|
|
||
|
|
std::unique_ptr<PathSensitiveBugReport>
|
||
|
|
NonNullParamChecker::genReportReferenceToNullPointer(
|
||
|
|
const ExplodedNode *ErrorNode, const Expr *ArgE) const {
|
||
|
|
if (!BTNullRefArg)
|
||
|
|
BTNullRefArg.reset(new BuiltinBug(this, "Dereference of null pointer"));
|
||
|
|
|
||
|
|
auto R = std::make_unique<PathSensitiveBugReport>(
|
||
|
|
*BTNullRefArg, "Forming reference to null pointer", ErrorNode);
|
||
|
|
if (ArgE) {
|
||
|
|
const Expr *ArgEDeref = bugreporter::getDerefExpr(ArgE);
|
||
|
|
if (!ArgEDeref)
|
||
|
|
ArgEDeref = ArgE;
|
||
|
|
bugreporter::trackExpressionValue(ErrorNode, ArgEDeref, *R);
|
||
|
|
}
|
||
|
|
return R;
|
||
|
|
|
||
|
|
}
|
||
|
|
|
||
|
|
void ento::registerNonNullParamChecker(CheckerManager &mgr) {
|
||
|
|
mgr.registerChecker<NonNullParamChecker>();
|
||
|
|
}
|
||
|
|
|
||
|
|
bool ento::shouldRegisterNonNullParamChecker(const CheckerManager &mgr) {
|
||
|
|
return true;
|
||
|
|
}
|