clang  6.0.0svn
NSErrorChecker.cpp
Go to the documentation of this file.
1 //=- NSErrorChecker.cpp - Coding conventions for uses of NSError -*- C++ -*-==//
2 //
3 // The LLVM Compiler Infrastructure
4 //
5 // This file is distributed under the University of Illinois Open Source
6 // License. See LICENSE.TXT for details.
7 //
8 //===----------------------------------------------------------------------===//
9 //
10 // This file defines a CheckNSError, a flow-insenstive check
11 // that determines if an Objective-C class interface correctly returns
12 // a non-void return type.
13 //
14 // File under feature request PR 2600.
15 //
16 //===----------------------------------------------------------------------===//
17 
18 #include "ClangSACheckers.h"
19 #include "clang/AST/Decl.h"
20 #include "clang/AST/DeclObjC.h"
26 #include "llvm/ADT/SmallString.h"
27 #include "llvm/Support/raw_ostream.h"
28 
29 using namespace clang;
30 using namespace ento;
31 
32 static bool IsNSError(QualType T, IdentifierInfo *II);
33 static bool IsCFError(QualType T, IdentifierInfo *II);
34 
35 //===----------------------------------------------------------------------===//
36 // NSErrorMethodChecker
37 //===----------------------------------------------------------------------===//
38 
39 namespace {
40 class NSErrorMethodChecker
41  : public Checker< check::ASTDecl<ObjCMethodDecl> > {
42  mutable IdentifierInfo *II;
43 
44 public:
45  NSErrorMethodChecker() : II(nullptr) {}
46 
47  void checkASTDecl(const ObjCMethodDecl *D,
48  AnalysisManager &mgr, BugReporter &BR) const;
49 };
50 }
51 
52 void NSErrorMethodChecker::checkASTDecl(const ObjCMethodDecl *D,
53  AnalysisManager &mgr,
54  BugReporter &BR) const {
56  return;
57  if (!D->getReturnType()->isVoidType())
58  return;
59 
60  if (!II)
61  II = &D->getASTContext().Idents.get("NSError");
62 
63  bool hasNSError = false;
64  for (const auto *I : D->parameters()) {
65  if (IsNSError(I->getType(), II)) {
66  hasNSError = true;
67  break;
68  }
69  }
70 
71  if (hasNSError) {
72  const char *err = "Method accepting NSError** "
73  "should have a non-void return value to indicate whether or not an "
74  "error occurred";
77  BR.EmitBasicReport(D, this, "Bad return type when passing NSError**",
78  "Coding conventions (Apple)", err, L);
79  }
80 }
81 
82 //===----------------------------------------------------------------------===//
83 // CFErrorFunctionChecker
84 //===----------------------------------------------------------------------===//
85 
86 namespace {
87 class CFErrorFunctionChecker
88  : public Checker< check::ASTDecl<FunctionDecl> > {
89  mutable IdentifierInfo *II;
90 
91 public:
92  CFErrorFunctionChecker() : II(nullptr) {}
93 
94  void checkASTDecl(const FunctionDecl *D,
95  AnalysisManager &mgr, BugReporter &BR) const;
96 };
97 }
98 
99 void CFErrorFunctionChecker::checkASTDecl(const FunctionDecl *D,
100  AnalysisManager &mgr,
101  BugReporter &BR) const {
103  return;
104  if (!D->getReturnType()->isVoidType())
105  return;
106 
107  if (!II)
108  II = &D->getASTContext().Idents.get("CFErrorRef");
109 
110  bool hasCFError = false;
111  for (auto I : D->parameters()) {
112  if (IsCFError(I->getType(), II)) {
113  hasCFError = true;
114  break;
115  }
116  }
117 
118  if (hasCFError) {
119  const char *err = "Function accepting CFErrorRef* "
120  "should have a non-void return value to indicate whether or not an "
121  "error occurred";
124  BR.EmitBasicReport(D, this, "Bad return type when passing CFErrorRef*",
125  "Coding conventions (Apple)", err, L);
126  }
127 }
128 
129 //===----------------------------------------------------------------------===//
130 // NSOrCFErrorDerefChecker
131 //===----------------------------------------------------------------------===//
132 
133 namespace {
134 
135 class NSErrorDerefBug : public BugType {
136 public:
137  NSErrorDerefBug(const CheckerBase *Checker)
138  : BugType(Checker, "NSError** null dereference",
139  "Coding conventions (Apple)") {}
140 };
141 
142 class CFErrorDerefBug : public BugType {
143 public:
144  CFErrorDerefBug(const CheckerBase *Checker)
145  : BugType(Checker, "CFErrorRef* null dereference",
146  "Coding conventions (Apple)") {}
147 };
148 
149 }
150 
151 namespace {
152 class NSOrCFErrorDerefChecker
153  : public Checker< check::Location,
154  check::Event<ImplicitNullDerefEvent> > {
155  mutable IdentifierInfo *NSErrorII, *CFErrorII;
156  mutable std::unique_ptr<NSErrorDerefBug> NSBT;
157  mutable std::unique_ptr<CFErrorDerefBug> CFBT;
158 public:
159  bool ShouldCheckNSError, ShouldCheckCFError;
160  NSOrCFErrorDerefChecker() : NSErrorII(nullptr), CFErrorII(nullptr),
161  ShouldCheckNSError(0), ShouldCheckCFError(0) { }
162 
163  void checkLocation(SVal loc, bool isLoad, const Stmt *S,
164  CheckerContext &C) const;
165  void checkEvent(ImplicitNullDerefEvent event) const;
166 };
167 }
168 
170 REGISTER_TRAIT_WITH_PROGRAMSTATE(NSErrorOut, ErrorOutFlag)
171 REGISTER_TRAIT_WITH_PROGRAMSTATE(CFErrorOut, ErrorOutFlag)
172 
173 template <typename T>
174 static bool hasFlag(SVal val, ProgramStateRef state) {
175  if (SymbolRef sym = val.getAsSymbol())
176  if (const unsigned *attachedFlags = state->get<T>(sym))
177  return *attachedFlags;
178  return false;
179 }
180 
181 template <typename T>
183  // We tag the symbol that the SVal wraps.
184  if (SymbolRef sym = val.getAsSymbol())
185  C.addTransition(state->set<T>(sym, true));
186 }
187 
189  const StackFrameContext *
192  const MemRegion* R = X->getRegion();
193  if (const VarRegion *VR = R->getAs<VarRegion>())
194  if (const StackArgumentsSpaceRegion *
195  stackReg = dyn_cast<StackArgumentsSpaceRegion>(VR->getMemorySpace()))
196  if (stackReg->getStackFrame() == SFC)
197  return VR->getValueType();
198  }
199 
200  return QualType();
201 }
202 
203 void NSOrCFErrorDerefChecker::checkLocation(SVal loc, bool isLoad,
204  const Stmt *S,
205  CheckerContext &C) const {
206  if (!isLoad)
207  return;
208  if (loc.isUndef() || !loc.getAs<Loc>())
209  return;
210 
211  ASTContext &Ctx = C.getASTContext();
213 
214  // If we are loading from NSError**/CFErrorRef* parameter, mark the resulting
215  // SVal so that we can later check it when handling the
216  // ImplicitNullDerefEvent event.
217  // FIXME: Cumbersome! Maybe add hook at construction of SVals at start of
218  // function ?
219 
220  QualType parmT = parameterTypeFromSVal(loc, C);
221  if (parmT.isNull())
222  return;
223 
224  if (!NSErrorII)
225  NSErrorII = &Ctx.Idents.get("NSError");
226  if (!CFErrorII)
227  CFErrorII = &Ctx.Idents.get("CFErrorRef");
228 
229  if (ShouldCheckNSError && IsNSError(parmT, NSErrorII)) {
230  setFlag<NSErrorOut>(state, state->getSVal(loc.castAs<Loc>()), C);
231  return;
232  }
233 
234  if (ShouldCheckCFError && IsCFError(parmT, CFErrorII)) {
235  setFlag<CFErrorOut>(state, state->getSVal(loc.castAs<Loc>()), C);
236  return;
237  }
238 }
239 
240 void NSOrCFErrorDerefChecker::checkEvent(ImplicitNullDerefEvent event) const {
241  if (event.IsLoad)
242  return;
243 
244  SVal loc = event.Location;
245  ProgramStateRef state = event.SinkNode->getState();
246  BugReporter &BR = *event.BR;
247 
248  bool isNSError = hasFlag<NSErrorOut>(loc, state);
249  bool isCFError = false;
250  if (!isNSError)
251  isCFError = hasFlag<CFErrorOut>(loc, state);
252 
253  if (!(isNSError || isCFError))
254  return;
255 
256  // Storing to possible null NSError/CFErrorRef out parameter.
257  SmallString<128> Buf;
258  llvm::raw_svector_ostream os(Buf);
259 
260  os << "Potential null dereference. According to coding standards ";
261  os << (isNSError
262  ? "in 'Creating and Returning NSError Objects' the parameter"
263  : "documented in CoreFoundation/CFError.h the parameter");
264 
265  os << " may be null";
266 
267  BugType *bug = nullptr;
268  if (isNSError) {
269  if (!NSBT)
270  NSBT.reset(new NSErrorDerefBug(this));
271  bug = NSBT.get();
272  }
273  else {
274  if (!CFBT)
275  CFBT.reset(new CFErrorDerefBug(this));
276  bug = CFBT.get();
277  }
278  BR.emitReport(llvm::make_unique<BugReport>(*bug, os.str(), event.SinkNode));
279 }
280 
281 static bool IsNSError(QualType T, IdentifierInfo *II) {
282 
283  const PointerType* PPT = T->getAs<PointerType>();
284  if (!PPT)
285  return false;
286 
287  const ObjCObjectPointerType* PT =
289 
290  if (!PT)
291  return false;
292 
293  const ObjCInterfaceDecl *ID = PT->getInterfaceDecl();
294 
295  // FIXME: Can ID ever be NULL?
296  if (ID)
297  return II == ID->getIdentifier();
298 
299  return false;
300 }
301 
302 static bool IsCFError(QualType T, IdentifierInfo *II) {
303  const PointerType* PPT = T->getAs<PointerType>();
304  if (!PPT) return false;
305 
306  const TypedefType* TT = PPT->getPointeeType()->getAs<TypedefType>();
307  if (!TT) return false;
308 
309  return TT->getDecl()->getIdentifier() == II;
310 }
311 
312 void ento::registerNSErrorChecker(CheckerManager &mgr) {
313  mgr.registerChecker<NSErrorMethodChecker>();
314  NSOrCFErrorDerefChecker *checker =
315  mgr.registerChecker<NSOrCFErrorDerefChecker>();
316  checker->ShouldCheckNSError = true;
317 }
318 
319 void ento::registerCFErrorChecker(CheckerManager &mgr) {
320  mgr.registerChecker<CFErrorFunctionChecker>();
321  NSOrCFErrorDerefChecker *checker =
322  mgr.registerChecker<NSOrCFErrorDerefChecker>();
323  checker->ShouldCheckCFError = true;
324 }
FunctionDecl - An instance of this class is created to represent a function declaration or definition...
Definition: Decl.h:1629
bool isThisDeclarationADefinition() const
Returns whether this specific method is a definition.
Definition: DeclObjC.h:497
PointerType - C99 6.7.5.1 - Pointer Declarators.
Definition: Type.h:2221
QualType getPointeeType() const
Definition: Type.h:2235
A (possibly-)qualified type.
Definition: Type.h:614
MemRegion - The root abstract class for all memory regions.
Definition: MemRegion.h:79
Stmt - This represents one statement.
Definition: Stmt.h:60
ExplodedNode * addTransition(ProgramStateRef State=nullptr, const ProgramPointTag *Tag=nullptr)
Generates a new transition in the program state graph (ExplodedGraph).
static bool IsCFError(QualType T, IdentifierInfo *II)
QualType getReturnType() const
Definition: Decl.h:2117
const T * getAs() const
Member-template getAs<specific type>&#39;.
Definition: Type.h:6052
ObjCMethodDecl - Represents an instance or class method declaration.
Definition: DeclObjC.h:113
Symbolic value.
Definition: SymExpr.h:29
IdentifierInfo * getIdentifier() const
getIdentifier - Get the identifier that names this declaration, if there is one.
Definition: Decl.h:232
One of these records is kept for each identifier that is lexed.
Holds long-lived AST nodes (such as types and decls) that can be referred to throughout the semantic ...
Definition: ASTContext.h:128
i32 captured_struct **param SharedsTy A type which contains references the shared variables *param Shareds Context with the list of shared variables from the p *TaskFunction *param Data Additional data for task generation like final * state
IdentifierTable & Idents
Definition: ASTContext.h:513
ArrayRef< ParmVarDecl * > parameters() const
Definition: Decl.h:2077
const StackFrameContext * getCurrentStackFrame() const
static PathDiagnosticLocation create(const Decl *D, const SourceManager &SM)
Create a location corresponding to the given declaration.
llvm::ImmutableMap< SymbolRef, unsigned > ErrorOutFlag
Represents an ObjC class declaration.
Definition: DeclObjC.h:1108
QualType getReturnType() const
Definition: DeclObjC.h:330
We dereferenced a location that may be null.
Definition: Checker.h:536
SymbolRef getAsSymbol(bool IncludeBaseRegions=false) const
If this SVal wraps a symbol return that SymbolRef.
Definition: SVals.cpp:116
ID
Defines the address space values used by the address space qualifier of QualType. ...
Definition: AddressSpaces.h:26
const RegionTy * getAs() const
Definition: MemRegion.h:1174
static void setFlag(ProgramStateRef state, SVal val, CheckerContext &C)
bool isNull() const
Return true if this QualType doesn&#39;t point to a type yet.
Definition: Type.h:681
Optional< T > getAs() const
Convert to the specified SVal type, returning None if this SVal is not of the desired type...
Definition: SVals.h:100
BugReporter is a utility class for generating PathDiagnostics for analysis.
Definition: BugReporter.h:403
#define REGISTER_TRAIT_WITH_PROGRAMSTATE(Name, Type)
Declares a program state trait for type Type called Name, and introduce a typedef named NameTy...
CHECKER * registerChecker()
Used to register checkers.
IdentifierInfo & get(StringRef Name)
Return the identifier token info for the specified named identifier.
void EmitBasicReport(const Decl *DeclWithIssue, const CheckerBase *Checker, StringRef BugName, StringRef BugCategory, StringRef BugStr, PathDiagnosticLocation Loc, ArrayRef< SourceRange > Ranges=None)
void emitReport(std::unique_ptr< BugReport > R)
Add the given report to the set of reports tracked by BugReporter.
ASTContext & getASTContext() const LLVM_READONLY
Definition: DeclBase.cpp:347
SVal - This represents a symbolic expression, which can be either an L-value or an R-value...
Definition: SVals.h:63
static bool hasFlag(SVal val, ProgramStateRef state)
Dataflow Directional Tag Classes.
Represents a pointer to an Objective C object.
Definition: Type.h:5230
T castAs() const
Convert to the specified SVal type, asserting that this SVal is of the desired type.
Definition: SVals.h:92
ObjCInterfaceDecl * getInterfaceDecl() const
If this pointer points to an Objective @interface type, gets the declaration for that interface...
Definition: Type.h:5285
const ProgramStateRef & getState() const
TypedefNameDecl * getDecl() const
Definition: Type.h:3604
X
Add a minimal nested name specifier fixit hint to allow lookup of a tag name from an outer enclosing ...
Definition: SemaDecl.cpp:13065
SourceManager & getSourceManager()
Definition: BugReporter.h:463
bool isVoidType() const
Definition: Type.h:5916
bool isUndef() const
Definition: SVals.h:132
bool doesThisDeclarationHaveABody() const
doesThisDeclarationHaveABody - Returns whether this specific declaration of the function has a body -...
Definition: Decl.h:1893
static bool IsNSError(QualType T, IdentifierInfo *II)
const LocationContext * getLocationContext() const
static QualType parameterTypeFromSVal(SVal val, CheckerContext &C)
ArrayRef< ParmVarDecl * > parameters() const
Definition: DeclObjC.h:371