lib/GR/Checkers/CallAndMessageChecker.cpp

   1 //===--- CallAndMessageChecker.cpp ------------------------------*- C++ -*--==//
   2 //
   3 //                     The LLVM Compiler Infrastructure
   4 //
   5 // This file is distributed under the University of Illinois Open Source
   6 // License. See LICENSE.TXT for details.
   7 //
   8 //===----------------------------------------------------------------------===//
   9 //
  10 // This defines CallAndMessageChecker, a builtin checker that checks for various
  11 // errors of call and objc message expressions.
  12 //
  13 //===----------------------------------------------------------------------===//
  14
  15 #include "GRExprEngineInternalChecks.h"
  16 #include "clang/AST/ParentMap.h"
  17 #include "clang/Basic/TargetInfo.h"
  18 #include "clang/GR/BugReporter/BugType.h"
  19 #include "clang/GR/PathSensitive/CheckerVisitor.h"
  20
  21 using namespace clang;
  22 using namespace GR;
  23
  24 namespace {
  25 class CallAndMessageChecker
  26   : public CheckerVisitor<CallAndMessageChecker> {
  27   BugType *BT_call_null;
  28   BugType *BT_call_undef;
  29   BugType *BT_call_arg;
  30   BugType *BT_msg_undef;
  31   BugType *BT_msg_arg;
  32   BugType *BT_msg_ret;
  33 public:
  34   CallAndMessageChecker() :
  35     BT_call_null(0), BT_call_undef(0), BT_call_arg(0),
  36     BT_msg_undef(0), BT_msg_arg(0), BT_msg_ret(0) {}
  37
  38   static void *getTag() {
  39     static int x = 0;
  40     return &x;
  41   }
  42
  43   void PreVisitCallExpr(CheckerContext &C, const CallExpr *CE);
  44   void PreVisitObjCMessageExpr(CheckerContext &C, const ObjCMessageExpr *ME);
  45   bool evalNilReceiver(CheckerContext &C, const ObjCMessageExpr *ME);
  46
  47 private:
  48   bool PreVisitProcessArg(CheckerContext &C, const Expr *Ex,
  49                           const char *BT_desc, BugType *&BT);
  50
  51   void EmitBadCall(BugType *BT, CheckerContext &C, const CallExpr *CE);
  52   void emitNilReceiverBug(CheckerContext &C, const ObjCMessageExpr *ME,
  53                           ExplodedNode *N);
  54
  55   void HandleNilReceiver(CheckerContext &C, const GRState *state,
  56                          const ObjCMessageExpr *ME);
  57
  58   void LazyInit_BT(const char *desc, BugType *&BT) {
  59     if (!BT)
  60       BT = new BuiltinBug(desc);
  61   }
  62 };
  63 } // end anonymous namespace
  64
  65 void GR::RegisterCallAndMessageChecker(GRExprEngine &Eng) {
  66   Eng.registerCheck(new CallAndMessageChecker());
  67 }
  68
  69 void CallAndMessageChecker::EmitBadCall(BugType *BT, CheckerContext &C,
  70                                         const CallExpr *CE) {
  71   ExplodedNode *N = C.generateSink();
  72   if (!N)
  73     return;
  74
  75   EnhancedBugReport *R = new EnhancedBugReport(*BT, BT->getName(), N);
  76   R->addVisitorCreator(bugreporter::registerTrackNullOrUndefValue,
  77                        bugreporter::GetCalleeExpr(N));
  78   C.EmitReport(R);
  79 }
  80
  81 bool CallAndMessageChecker::PreVisitProcessArg(CheckerContext &C,
  82                                                const Expr *Ex,
  83                                                const char *BT_desc,
  84                                                BugType *&BT) {
  85
  86   const SVal &V = C.getState()->getSVal(Ex);
  87
  88   if (V.isUndef()) {
  89     if (ExplodedNode *N = C.generateSink()) {
  90       LazyInit_BT(BT_desc, BT);
  91
  92       // Generate a report for this bug.
  93       EnhancedBugReport *R = new EnhancedBugReport(*BT, BT->getName(), N);
  94       R->addRange(Ex->getSourceRange());
  95       R->addVisitorCreator(bugreporter::registerTrackNullOrUndefValue, Ex);
  96       C.EmitReport(R);
  97     }
  98     return true;
  99   }
 100
 101   if (const nonloc::LazyCompoundVal *LV =
 102         dyn_cast<nonloc::LazyCompoundVal>(&V)) {
 103
 104     class FindUninitializedField {
 105     public:
 106       llvm::SmallVector<const FieldDecl *, 10> FieldChain;
 107     private:
 108       ASTContext &C;
 109       StoreManager &StoreMgr;
 110       MemRegionManager &MrMgr;
 111       Store store;
 112     public:
 113       FindUninitializedField(ASTContext &c, StoreManager &storeMgr,
 114                              MemRegionManager &mrMgr, Store s)
 115       : C(c), StoreMgr(storeMgr), MrMgr(mrMgr), store(s) {}
 116
 117       bool Find(const TypedRegion *R) {
 118         QualType T = R->getValueType();
 119         if (const RecordType *RT = T->getAsStructureType()) {
 120           const RecordDecl *RD = RT->getDecl()->getDefinition();
 121           assert(RD && "Referred record has no definition");
 122           for (RecordDecl::field_iterator I =
 123                RD->field_begin(), E = RD->field_end(); I!=E; ++I) {
 124             const FieldRegion *FR = MrMgr.getFieldRegion(*I, R);
 125             FieldChain.push_back(*I);
 126             T = (*I)->getType();
 127             if (T->getAsStructureType()) {
 128               if (Find(FR))
 129                 return true;
 130             }
 131             else {
 132               const SVal &V = StoreMgr.Retrieve(store, loc::MemRegionVal(FR));
 133               if (V.isUndef())
 134                 return true;
 135             }
 136             FieldChain.pop_back();
 137           }
 138         }
 139
 140         return false;
 141       }
 142     };
 143
 144     const LazyCompoundValData *D = LV->getCVData();
 145     FindUninitializedField F(C.getASTContext(),
 146                              C.getState()->getStateManager().getStoreManager(),
 147                              C.getSValBuilder().getRegionManager(),
 148                              D->getStore());
 149
 150     if (F.Find(D->getRegion())) {
 151       if (ExplodedNode *N = C.generateSink()) {
 152         LazyInit_BT(BT_desc, BT);
 153         llvm::SmallString<512> Str;
 154         llvm::raw_svector_ostream os(Str);
 155         os << "Passed-by-value struct argument contains uninitialized data";
 156
 157         if (F.FieldChain.size() == 1)
 158           os << " (e.g., field: '" << F.FieldChain[0] << "')";
 159         else {
 160           os << " (e.g., via the field chain: '";
 161           bool first = true;
 162           for (llvm::SmallVectorImpl<const FieldDecl *>::iterator
 163                DI = F.FieldChain.begin(), DE = F.FieldChain.end(); DI!=DE;++DI){
 164             if (first)
 165               first = false;
 166             else
 167               os << '.';
 168             os << *DI;
 169           }
 170           os << "')";
 171         }
 172
 173         // Generate a report for this bug.
 174         EnhancedBugReport *R = new EnhancedBugReport(*BT, os.str(), N);
 175         R->addRange(Ex->getSourceRange());
 176
 177         // FIXME: enhance track back for uninitialized value for arbitrary
 178         // memregions
 179         C.EmitReport(R);
 180       }
 181       return true;
 182     }
 183   }
 184
 185   return false;
 186 }
 187
 188 void CallAndMessageChecker::PreVisitCallExpr(CheckerContext &C,
 189                                              const CallExpr *CE){
 190
 191   const Expr *Callee = CE->getCallee()->IgnoreParens();
 192   SVal L = C.getState()->getSVal(Callee);
 193
 194   if (L.isUndef()) {
 195     if (!BT_call_undef)
 196       BT_call_undef =
 197         new BuiltinBug("Called function pointer is an uninitalized pointer value");
 198     EmitBadCall(BT_call_undef, C, CE);
 199     return;
 200   }
 201
 202   if (isa<loc::ConcreteInt>(L)) {
 203     if (!BT_call_null)
 204       BT_call_null =
 205         new BuiltinBug("Called function pointer is null (null dereference)");
 206     EmitBadCall(BT_call_null, C, CE);
 207   }
 208
 209   for (CallExpr::const_arg_iterator I = CE->arg_begin(), E = CE->arg_end();
 210        I != E; ++I)
 211     if (PreVisitProcessArg(C, *I,
 212                            "Function call argument is an uninitialized value",
 213                            BT_call_arg))
 214       return;
 215 }
 216
 217 void CallAndMessageChecker::PreVisitObjCMessageExpr(CheckerContext &C,
 218                                                     const ObjCMessageExpr *ME) {
 219
 220   const GRState *state = C.getState();
 221
 222   // FIXME: Handle 'super'?
 223   if (const Expr *receiver = ME->getInstanceReceiver())
 224     if (state->getSVal(receiver).isUndef()) {
 225       if (ExplodedNode *N = C.generateSink()) {
 226         if (!BT_msg_undef)
 227           BT_msg_undef =
 228             new BuiltinBug("Receiver in message expression is an uninitialized value");
 229         EnhancedBugReport *R =
 230           new EnhancedBugReport(*BT_msg_undef, BT_msg_undef->getName(), N);
 231         R->addRange(receiver->getSourceRange());
 232         R->addVisitorCreator(bugreporter::registerTrackNullOrUndefValue,
 233                              receiver);
 234         C.EmitReport(R);
 235       }
 236       return;
 237     }
 238
 239   // Check for any arguments that are uninitialized/undefined.
 240   for (ObjCMessageExpr::const_arg_iterator I = ME->arg_begin(),
 241          E = ME->arg_end(); I != E; ++I)
 242     if (PreVisitProcessArg(C, *I,
 243                            "Argument in message expression "
 244                            "is an uninitialized value", BT_msg_arg))
 245         return;
 246 }
 247
 248 bool CallAndMessageChecker::evalNilReceiver(CheckerContext &C,
 249                                             const ObjCMessageExpr *ME) {
 250   HandleNilReceiver(C, C.getState(), ME);
 251   return true; // Nil receiver is not handled elsewhere.
 252 }
 253
 254 void CallAndMessageChecker::emitNilReceiverBug(CheckerContext &C,
 255                                                const ObjCMessageExpr *ME,
 256                                                ExplodedNode *N) {
 257
 258   if (!BT_msg_ret)
 259     BT_msg_ret =
 260       new BuiltinBug("Receiver in message expression is "
 261                      "'nil' and returns a garbage value");
 262
 263   llvm::SmallString<200> buf;
 264   llvm::raw_svector_ostream os(buf);
 265   os << "The receiver of message '" << ME->getSelector().getAsString()
 266      << "' is nil and returns a value of type '"
 267      << ME->getType().getAsString() << "' that will be garbage";
 268
 269   EnhancedBugReport *report = new EnhancedBugReport(*BT_msg_ret, os.str(), N);
 270   if (const Expr *receiver = ME->getInstanceReceiver()) {
 271     report->addRange(receiver->getSourceRange());
 272     report->addVisitorCreator(bugreporter::registerTrackNullOrUndefValue,
 273                               receiver);
 274   }
 275   C.EmitReport(report);
 276 }
 277
 278 static bool supportsNilWithFloatRet(const llvm::Triple &triple) {
 279   return triple.getVendor() == llvm::Triple::Apple &&
 280          (triple.getDarwinMajorNumber() >= 9 ||
 281           triple.getArch() == llvm::Triple::arm ||
 282           triple.getArch() == llvm::Triple::thumb);
 283 }
 284
 285 void CallAndMessageChecker::HandleNilReceiver(CheckerContext &C,
 286                                               const GRState *state,
 287                                               const ObjCMessageExpr *ME) {
 288
 289   // Check the return type of the message expression.  A message to nil will
 290   // return different values depending on the return type and the architecture.
 291   QualType RetTy = ME->getType();
 292
 293   ASTContext &Ctx = C.getASTContext();
 294   CanQualType CanRetTy = Ctx.getCanonicalType(RetTy);
 295
 296   if (CanRetTy->isStructureOrClassType()) {
 297     // FIXME: At some point we shouldn't rely on isConsumedExpr(), but instead
 298     // have the "use of undefined value" be smarter about where the
 299     // undefined value came from.
 300     if (C.getPredecessor()->getParentMap().isConsumedExpr(ME)) {
 301       if (ExplodedNode* N = C.generateSink(state))
 302         emitNilReceiverBug(C, ME, N);
 303       return;
 304     }
 305
 306     // The result is not consumed by a surrounding expression.  Just propagate
 307     // the current state.
 308     C.addTransition(state);
 309     return;
 310   }
 311
 312   // Other cases: check if the return type is smaller than void*.
 313   if (CanRetTy != Ctx.VoidTy &&
 314       C.getPredecessor()->getParentMap().isConsumedExpr(ME)) {
 315     // Compute: sizeof(void *) and sizeof(return type)
 316     const uint64_t voidPtrSize = Ctx.getTypeSize(Ctx.VoidPtrTy);
 317     const uint64_t returnTypeSize = Ctx.getTypeSize(CanRetTy);
 318
 319     if (voidPtrSize < returnTypeSize &&
 320         !(supportsNilWithFloatRet(Ctx.Target.getTriple()) &&
 321           (Ctx.FloatTy == CanRetTy ||
 322            Ctx.DoubleTy == CanRetTy ||
 323            Ctx.LongDoubleTy == CanRetTy ||
 324            Ctx.LongLongTy == CanRetTy ||
 325            Ctx.UnsignedLongLongTy == CanRetTy))) {
 326       if (ExplodedNode* N = C.generateSink(state))
 327         emitNilReceiverBug(C, ME, N);
 328       return;
 329     }
 330
 331     // Handle the safe cases where the return value is 0 if the
 332     // receiver is nil.
 333     //
 334     // FIXME: For now take the conservative approach that we only
 335     // return null values if we *know* that the receiver is nil.
 336     // This is because we can have surprises like:
 337     //
 338     //   ... = [[NSScreens screens] objectAtIndex:0];
 339     //
 340     // What can happen is that [... screens] could return nil, but
 341     // it most likely isn't nil.  We should assume the semantics
 342     // of this case unless we have *a lot* more knowledge.
 343     //
 344     SVal V = C.getSValBuilder().makeZeroVal(ME->getType());
 345     C.generateNode(state->BindExpr(ME, V));
 346     return;
 347   }
 348
 349   C.addTransition(state);
 350 }