lib/Checker/CallAndMessageChecker.cpp

   1 //===--- CallAndMessageChecker.cpp ------------------------------*- C++ -*--==//
   2 //
   3 //                     The LLVM Compiler Infrastructure
   4 //
   5 // This file is distributed under the University of Illinois Open Source
   6 // License. See LICENSE.TXT for details.
   7 //
   8 //===----------------------------------------------------------------------===//
   9 //
  10 // This defines CallAndMessageChecker, a builtin checker that checks for various
  11 // errors of call and objc message expressions.
  12 //
  13 //===----------------------------------------------------------------------===//
  14
  15 #include "GRExprEngineInternalChecks.h"
  16 #include "clang/AST/ParentMap.h"
  17 #include "clang/Basic/TargetInfo.h"
  18 #include "clang/GR/BugReporter/BugType.h"
  19 #include "clang/GR/PathSensitive/CheckerVisitor.h"
  20
  21 using namespace clang;
  22
  23 namespace {
  24 class CallAndMessageChecker
  25   : public CheckerVisitor<CallAndMessageChecker> {
  26   BugType *BT_call_null;
  27   BugType *BT_call_undef;
  28   BugType *BT_call_arg;
  29   BugType *BT_msg_undef;
  30   BugType *BT_msg_arg;
  31   BugType *BT_msg_ret;
  32 public:
  33   CallAndMessageChecker() :
  34     BT_call_null(0), BT_call_undef(0), BT_call_arg(0),
  35     BT_msg_undef(0), BT_msg_arg(0), BT_msg_ret(0) {}
  36
  37   static void *getTag() {
  38     static int x = 0;
  39     return &x;
  40   }
  41
  42   void PreVisitCallExpr(CheckerContext &C, const CallExpr *CE);
  43   void PreVisitObjCMessageExpr(CheckerContext &C, const ObjCMessageExpr *ME);
  44   bool evalNilReceiver(CheckerContext &C, const ObjCMessageExpr *ME);
  45
  46 private:
  47   bool PreVisitProcessArg(CheckerContext &C, const Expr *Ex,
  48                           const char *BT_desc, BugType *&BT);
  49
  50   void EmitBadCall(BugType *BT, CheckerContext &C, const CallExpr *CE);
  51   void emitNilReceiverBug(CheckerContext &C, const ObjCMessageExpr *ME,
  52                           ExplodedNode *N);
  53
  54   void HandleNilReceiver(CheckerContext &C, const GRState *state,
  55                          const ObjCMessageExpr *ME);
  56
  57   void LazyInit_BT(const char *desc, BugType *&BT) {
  58     if (!BT)
  59       BT = new BuiltinBug(desc);
  60   }
  61 };
  62 } // end anonymous namespace
  63
  64 void clang::RegisterCallAndMessageChecker(GRExprEngine &Eng) {
  65   Eng.registerCheck(new CallAndMessageChecker());
  66 }
  67
  68 void CallAndMessageChecker::EmitBadCall(BugType *BT, CheckerContext &C,
  69                                         const CallExpr *CE) {
  70   ExplodedNode *N = C.generateSink();
  71   if (!N)
  72     return;
  73
  74   EnhancedBugReport *R = new EnhancedBugReport(*BT, BT->getName(), N);
  75   R->addVisitorCreator(bugreporter::registerTrackNullOrUndefValue,
  76                        bugreporter::GetCalleeExpr(N));
  77   C.EmitReport(R);
  78 }
  79
  80 bool CallAndMessageChecker::PreVisitProcessArg(CheckerContext &C,
  81                                                const Expr *Ex,
  82                                                const char *BT_desc,
  83                                                BugType *&BT) {
  84
  85   const SVal &V = C.getState()->getSVal(Ex);
  86
  87   if (V.isUndef()) {
  88     if (ExplodedNode *N = C.generateSink()) {
  89       LazyInit_BT(BT_desc, BT);
  90
  91       // Generate a report for this bug.
  92       EnhancedBugReport *R = new EnhancedBugReport(*BT, BT->getName(), N);
  93       R->addRange(Ex->getSourceRange());
  94       R->addVisitorCreator(bugreporter::registerTrackNullOrUndefValue, Ex);
  95       C.EmitReport(R);
  96     }
  97     return true;
  98   }
  99
 100   if (const nonloc::LazyCompoundVal *LV =
 101         dyn_cast<nonloc::LazyCompoundVal>(&V)) {
 102
 103     class FindUninitializedField {
 104     public:
 105       llvm::SmallVector<const FieldDecl *, 10> FieldChain;
 106     private:
 107       ASTContext &C;
 108       StoreManager &StoreMgr;
 109       MemRegionManager &MrMgr;
 110       Store store;
 111     public:
 112       FindUninitializedField(ASTContext &c, StoreManager &storeMgr,
 113                              MemRegionManager &mrMgr, Store s)
 114       : C(c), StoreMgr(storeMgr), MrMgr(mrMgr), store(s) {}
 115
 116       bool Find(const TypedRegion *R) {
 117         QualType T = R->getValueType();
 118         if (const RecordType *RT = T->getAsStructureType()) {
 119           const RecordDecl *RD = RT->getDecl()->getDefinition();
 120           assert(RD && "Referred record has no definition");
 121           for (RecordDecl::field_iterator I =
 122                RD->field_begin(), E = RD->field_end(); I!=E; ++I) {
 123             const FieldRegion *FR = MrMgr.getFieldRegion(*I, R);
 124             FieldChain.push_back(*I);
 125             T = (*I)->getType();
 126             if (T->getAsStructureType()) {
 127               if (Find(FR))
 128                 return true;
 129             }
 130             else {
 131               const SVal &V = StoreMgr.Retrieve(store, loc::MemRegionVal(FR));
 132               if (V.isUndef())
 133                 return true;
 134             }
 135             FieldChain.pop_back();
 136           }
 137         }
 138
 139         return false;
 140       }
 141     };
 142
 143     const LazyCompoundValData *D = LV->getCVData();
 144     FindUninitializedField F(C.getASTContext(),
 145                              C.getState()->getStateManager().getStoreManager(),
 146                              C.getSValBuilder().getRegionManager(),
 147                              D->getStore());
 148
 149     if (F.Find(D->getRegion())) {
 150       if (ExplodedNode *N = C.generateSink()) {
 151         LazyInit_BT(BT_desc, BT);
 152         llvm::SmallString<512> Str;
 153         llvm::raw_svector_ostream os(Str);
 154         os << "Passed-by-value struct argument contains uninitialized data";
 155
 156         if (F.FieldChain.size() == 1)
 157           os << " (e.g., field: '" << F.FieldChain[0] << "')";
 158         else {
 159           os << " (e.g., via the field chain: '";
 160           bool first = true;
 161           for (llvm::SmallVectorImpl<const FieldDecl *>::iterator
 162                DI = F.FieldChain.begin(), DE = F.FieldChain.end(); DI!=DE;++DI){
 163             if (first)
 164               first = false;
 165             else
 166               os << '.';
 167             os << *DI;
 168           }
 169           os << "')";
 170         }
 171
 172         // Generate a report for this bug.
 173         EnhancedBugReport *R = new EnhancedBugReport(*BT, os.str(), N);
 174         R->addRange(Ex->getSourceRange());
 175
 176         // FIXME: enhance track back for uninitialized value for arbitrary
 177         // memregions
 178         C.EmitReport(R);
 179       }
 180       return true;
 181     }
 182   }
 183
 184   return false;
 185 }
 186
 187 void CallAndMessageChecker::PreVisitCallExpr(CheckerContext &C,
 188                                              const CallExpr *CE){
 189
 190   const Expr *Callee = CE->getCallee()->IgnoreParens();
 191   SVal L = C.getState()->getSVal(Callee);
 192
 193   if (L.isUndef()) {
 194     if (!BT_call_undef)
 195       BT_call_undef =
 196         new BuiltinBug("Called function pointer is an uninitalized pointer value");
 197     EmitBadCall(BT_call_undef, C, CE);
 198     return;
 199   }
 200
 201   if (isa<loc::ConcreteInt>(L)) {
 202     if (!BT_call_null)
 203       BT_call_null =
 204         new BuiltinBug("Called function pointer is null (null dereference)");
 205     EmitBadCall(BT_call_null, C, CE);
 206   }
 207
 208   for (CallExpr::const_arg_iterator I = CE->arg_begin(), E = CE->arg_end();
 209        I != E; ++I)
 210     if (PreVisitProcessArg(C, *I,
 211                            "Function call argument is an uninitialized value",
 212                            BT_call_arg))
 213       return;
 214 }
 215
 216 void CallAndMessageChecker::PreVisitObjCMessageExpr(CheckerContext &C,
 217                                                     const ObjCMessageExpr *ME) {
 218
 219   const GRState *state = C.getState();
 220
 221   // FIXME: Handle 'super'?
 222   if (const Expr *receiver = ME->getInstanceReceiver())
 223     if (state->getSVal(receiver).isUndef()) {
 224       if (ExplodedNode *N = C.generateSink()) {
 225         if (!BT_msg_undef)
 226           BT_msg_undef =
 227             new BuiltinBug("Receiver in message expression is an uninitialized value");
 228         EnhancedBugReport *R =
 229           new EnhancedBugReport(*BT_msg_undef, BT_msg_undef->getName(), N);
 230         R->addRange(receiver->getSourceRange());
 231         R->addVisitorCreator(bugreporter::registerTrackNullOrUndefValue,
 232                              receiver);
 233         C.EmitReport(R);
 234       }
 235       return;
 236     }
 237
 238   // Check for any arguments that are uninitialized/undefined.
 239   for (ObjCMessageExpr::const_arg_iterator I = ME->arg_begin(),
 240          E = ME->arg_end(); I != E; ++I)
 241     if (PreVisitProcessArg(C, *I,
 242                            "Argument in message expression "
 243                            "is an uninitialized value", BT_msg_arg))
 244         return;
 245 }
 246
 247 bool CallAndMessageChecker::evalNilReceiver(CheckerContext &C,
 248                                             const ObjCMessageExpr *ME) {
 249   HandleNilReceiver(C, C.getState(), ME);
 250   return true; // Nil receiver is not handled elsewhere.
 251 }
 252
 253 void CallAndMessageChecker::emitNilReceiverBug(CheckerContext &C,
 254                                                const ObjCMessageExpr *ME,
 255                                                ExplodedNode *N) {
 256
 257   if (!BT_msg_ret)
 258     BT_msg_ret =
 259       new BuiltinBug("Receiver in message expression is "
 260                      "'nil' and returns a garbage value");
 261
 262   llvm::SmallString<200> buf;
 263   llvm::raw_svector_ostream os(buf);
 264   os << "The receiver of message '" << ME->getSelector().getAsString()
 265      << "' is nil and returns a value of type '"
 266      << ME->getType().getAsString() << "' that will be garbage";
 267
 268   EnhancedBugReport *report = new EnhancedBugReport(*BT_msg_ret, os.str(), N);
 269   if (const Expr *receiver = ME->getInstanceReceiver()) {
 270     report->addRange(receiver->getSourceRange());
 271     report->addVisitorCreator(bugreporter::registerTrackNullOrUndefValue,
 272                               receiver);
 273   }
 274   C.EmitReport(report);
 275 }
 276
 277 static bool supportsNilWithFloatRet(const llvm::Triple &triple) {
 278   return triple.getVendor() == llvm::Triple::Apple &&
 279          (triple.getDarwinMajorNumber() >= 9 ||
 280           triple.getArch() == llvm::Triple::arm ||
 281           triple.getArch() == llvm::Triple::thumb);
 282 }
 283
 284 void CallAndMessageChecker::HandleNilReceiver(CheckerContext &C,
 285                                               const GRState *state,
 286                                               const ObjCMessageExpr *ME) {
 287
 288   // Check the return type of the message expression.  A message to nil will
 289   // return different values depending on the return type and the architecture.
 290   QualType RetTy = ME->getType();
 291
 292   ASTContext &Ctx = C.getASTContext();
 293   CanQualType CanRetTy = Ctx.getCanonicalType(RetTy);
 294
 295   if (CanRetTy->isStructureOrClassType()) {
 296     // FIXME: At some point we shouldn't rely on isConsumedExpr(), but instead
 297     // have the "use of undefined value" be smarter about where the
 298     // undefined value came from.
 299     if (C.getPredecessor()->getParentMap().isConsumedExpr(ME)) {
 300       if (ExplodedNode* N = C.generateSink(state))
 301         emitNilReceiverBug(C, ME, N);
 302       return;
 303     }
 304
 305     // The result is not consumed by a surrounding expression.  Just propagate
 306     // the current state.
 307     C.addTransition(state);
 308     return;
 309   }
 310
 311   // Other cases: check if the return type is smaller than void*.
 312   if (CanRetTy != Ctx.VoidTy &&
 313       C.getPredecessor()->getParentMap().isConsumedExpr(ME)) {
 314     // Compute: sizeof(void *) and sizeof(return type)
 315     const uint64_t voidPtrSize = Ctx.getTypeSize(Ctx.VoidPtrTy);
 316     const uint64_t returnTypeSize = Ctx.getTypeSize(CanRetTy);
 317
 318     if (voidPtrSize < returnTypeSize &&
 319         !(supportsNilWithFloatRet(Ctx.Target.getTriple()) &&
 320           (Ctx.FloatTy == CanRetTy ||
 321            Ctx.DoubleTy == CanRetTy ||
 322            Ctx.LongDoubleTy == CanRetTy ||
 323            Ctx.LongLongTy == CanRetTy ||
 324            Ctx.UnsignedLongLongTy == CanRetTy))) {
 325       if (ExplodedNode* N = C.generateSink(state))
 326         emitNilReceiverBug(C, ME, N);
 327       return;
 328     }
 329
 330     // Handle the safe cases where the return value is 0 if the
 331     // receiver is nil.
 332     //
 333     // FIXME: For now take the conservative approach that we only
 334     // return null values if we *know* that the receiver is nil.
 335     // This is because we can have surprises like:
 336     //
 337     //   ... = [[NSScreens screens] objectAtIndex:0];
 338     //
 339     // What can happen is that [... screens] could return nil, but
 340     // it most likely isn't nil.  We should assume the semantics
 341     // of this case unless we have *a lot* more knowledge.
 342     //
 343     SVal V = C.getSValBuilder().makeZeroVal(ME->getType());
 344     C.generateNode(state->BindExpr(ME, V));
 345     return;
 346   }
 347
 348   C.addTransition(state);
 349 }