clang  6.0.0svn
CheckSizeofPointer.cpp
Go to the documentation of this file.
1 //==- CheckSizeofPointer.cpp - Check for sizeof on pointers ------*- C++ -*-==//
2 //
3 // The LLVM Compiler Infrastructure
4 //
5 // This file is distributed under the University of Illinois Open Source
6 // License. See LICENSE.TXT for details.
7 //
8 //===----------------------------------------------------------------------===//
9 //
10 // This file defines a check for unintended use of sizeof() on pointer
11 // expressions.
12 //
13 //===----------------------------------------------------------------------===//
14 
15 #include "ClangSACheckers.h"
16 #include "clang/AST/StmtVisitor.h"
20 
21 using namespace clang;
22 using namespace ento;
23 
24 namespace {
25 class WalkAST : public StmtVisitor<WalkAST> {
26  BugReporter &BR;
27  const CheckerBase *Checker;
29 
30 public:
31  WalkAST(BugReporter &br, const CheckerBase *checker, AnalysisDeclContext *ac)
32  : BR(br), Checker(checker), AC(ac) {}
33  void VisitUnaryExprOrTypeTraitExpr(UnaryExprOrTypeTraitExpr *E);
34  void VisitStmt(Stmt *S) { VisitChildren(S); }
35  void VisitChildren(Stmt *S);
36 };
37 }
38 
39 void WalkAST::VisitChildren(Stmt *S) {
40  for (Stmt *Child : S->children())
41  if (Child)
42  Visit(Child);
43 }
44 
45 // CWE-467: Use of sizeof() on a Pointer Type
46 void WalkAST::VisitUnaryExprOrTypeTraitExpr(UnaryExprOrTypeTraitExpr *E) {
47  if (E->getKind() != UETT_SizeOf)
48  return;
49 
50  // If an explicit type is used in the code, usually the coder knows what they are
51  // doing.
52  if (E->isArgumentType())
53  return;
54 
56  if (T->isPointerType()) {
57 
58  // Many false positives have the form 'sizeof *p'. This is reasonable
59  // because people know what they are doing when they intentionally
60  // dereference the pointer.
61  Expr *ArgEx = E->getArgumentExpr();
62  if (!isa<DeclRefExpr>(ArgEx->IgnoreParens()))
63  return;
64 
66  PathDiagnosticLocation::createBegin(E, BR.getSourceManager(), AC);
67  BR.EmitBasicReport(AC->getDecl(), Checker,
68  "Potential unintended use of sizeof() on pointer type",
70  "The code calls sizeof() on a pointer type. "
71  "This can produce an unexpected result.",
72  ELoc, ArgEx->getSourceRange());
73  }
74 }
75 
76 //===----------------------------------------------------------------------===//
77 // SizeofPointerChecker
78 //===----------------------------------------------------------------------===//
79 
80 namespace {
81 class SizeofPointerChecker : public Checker<check::ASTCodeBody> {
82 public:
83  void checkASTCodeBody(const Decl *D, AnalysisManager& mgr,
84  BugReporter &BR) const {
85  WalkAST walker(BR, this, mgr.getAnalysisDeclContext(D));
86  walker.Visit(D->getBody());
87  }
88 };
89 }
90 
91 void ento::registerSizeofPointerChecker(CheckerManager &mgr) {
92  mgr.registerChecker<SizeofPointerChecker>();
93 }
A (possibly-)qualified type.
Definition: Type.h:653
virtual Stmt * getBody() const
getBody - If this Decl represents a declaration for a body of code, such as a function or method defi...
Definition: DeclBase.h:974
Stmt - This represents one statement.
Definition: Stmt.h:66
Decl - This represents one declaration (or definition), e.g.
Definition: DeclBase.h:86
AnalysisDeclContext contains the context data for the function or method under analysis.
child_range children()
Definition: Stmt.cpp:226
AnalysisDeclContext * getAnalysisDeclContext(const Decl *D)
UnaryExprOrTypeTraitExpr - expression with either a type or (unevaluated) expression operand...
Definition: Expr.h:2031
Expr - This represents one expression.
Definition: Expr.h:106
const FunctionProtoType * T
QualType getTypeOfArgument() const
Gets the argument type, or the type of the argument expression, whichever is appropriate.
Definition: Expr.h:2094
BugReporter is a utility class for generating PathDiagnostics for analysis.
Definition: BugReporter.h:403
static PathDiagnosticLocation createBegin(const Decl *D, const SourceManager &SM)
Create a location for the beginning of the declaration.
CHECKER * registerChecker()
Used to register checkers.
StmtVisitor - This class implements a simple visitor for Stmt subclasses.
Definition: StmtVisitor.h:183
UnaryExprOrTypeTrait getKind() const
Definition: Expr.h:2062
bool isArgumentType() const
Definition: Expr.h:2067
Dataflow Directional Tag Classes.
SourceRange getSourceRange() const LLVM_READONLY
SourceLocation tokens are not useful in isolation - they are low level value objects created/interpre...
Definition: Stmt.cpp:265
bool isPointerType() const
Definition: Type.h:5944
Expr * IgnoreParens() LLVM_READONLY
IgnoreParens - Ignore parentheses.
Definition: Expr.cpp:2432