clang
15.0.0git
lib
StaticAnalyzer
Checkers
CheckSizeofPointer.cpp
Go to the documentation of this file.
1
//==- CheckSizeofPointer.cpp - Check for sizeof on pointers ------*- C++ -*-==//
2
//
3
// Part of the LLVM Project, under the Apache License v2.0 with LLVM Exceptions.
4
// See https://llvm.org/LICENSE.txt for license information.
5
// SPDX-License-Identifier: Apache-2.0 WITH LLVM-exception
6
//
7
//===----------------------------------------------------------------------===//
8
//
9
// This file defines a check for unintended use of sizeof() on pointer
10
// expressions.
11
//
12
//===----------------------------------------------------------------------===//
13
14
#include "
clang/StaticAnalyzer/Checkers/BuiltinCheckerRegistration.h
"
15
#include "
clang/AST/StmtVisitor.h
"
16
#include "
clang/StaticAnalyzer/Core/BugReporter/BugReporter.h
"
17
#include "
clang/StaticAnalyzer/Core/Checker.h
"
18
#include "
clang/StaticAnalyzer/Core/PathSensitive/AnalysisManager.h
"
19
20
using namespace
clang
;
21
using namespace
ento;
22
23
namespace
{
24
class
WalkAST :
public
StmtVisitor
<WalkAST> {
25
BugReporter &BR;
26
const
CheckerBase *Checker;
27
AnalysisDeclContext
* AC;
28
29
public
:
30
WalkAST(BugReporter &br,
const
CheckerBase *checker,
AnalysisDeclContext
*ac)
31
: BR(br), Checker(checker), AC(ac) {}
32
void
VisitUnaryExprOrTypeTraitExpr(
UnaryExprOrTypeTraitExpr
*E);
33
void
VisitStmt(
Stmt
*S) { VisitChildren(S); }
34
void
VisitChildren(
Stmt
*S);
35
};
36
}
37
38
void
WalkAST::VisitChildren(
Stmt
*S) {
39
for
(
Stmt
*Child : S->children())
40
if
(Child)
41
Visit(Child);
42
}
43
44
// CWE-467: Use of sizeof() on a Pointer Type
45
void
WalkAST::VisitUnaryExprOrTypeTraitExpr(
UnaryExprOrTypeTraitExpr
*E) {
46
if
(E->
getKind
() != UETT_SizeOf)
47
return
;
48
49
// If an explicit type is used in the code, usually the coder knows what they are
50
// doing.
51
if
(E->
isArgumentType
())
52
return
;
53
54
QualType
T = E->
getTypeOfArgument
();
55
if
(T->
isPointerType
()) {
56
57
// Many false positives have the form 'sizeof *p'. This is reasonable
58
// because people know what they are doing when they intentionally
59
// dereference the pointer.
60
Expr
*ArgEx = E->
getArgumentExpr
();
61
if
(!isa<DeclRefExpr>(ArgEx->
IgnoreParens
()))
62
return
;
63
64
PathDiagnosticLocation ELoc =
65
PathDiagnosticLocation::createBegin
(E, BR.getSourceManager(), AC);
66
BR.EmitBasicReport(AC->getDecl(), Checker,
67
"Potential unintended use of sizeof() on pointer type"
,
68
categories::LogicError
,
69
"The code calls sizeof() on a pointer type. "
70
"This can produce an unexpected result."
,
71
ELoc, ArgEx->
getSourceRange
());
72
}
73
}
74
75
//===----------------------------------------------------------------------===//
76
// SizeofPointerChecker
77
//===----------------------------------------------------------------------===//
78
79
namespace
{
80
class
SizeofPointerChecker :
public
Checker<check::ASTCodeBody> {
81
public
:
82
void
checkASTCodeBody(
const
Decl
*D, AnalysisManager& mgr,
83
BugReporter &BR)
const
{
84
WalkAST walker(BR,
this
, mgr.getAnalysisDeclContext(D));
85
walker.Visit(D->
getBody
());
86
}
87
};
88
}
89
90
void
ento::registerSizeofPointerChecker(CheckerManager &mgr) {
91
mgr.registerChecker<SizeofPointerChecker>();
92
}
93
94
bool
ento::shouldRegisterSizeofPointerChecker(
const
CheckerManager &mgr) {
95
return
true
;
96
}
clang::StmtVisitor
StmtVisitor - This class implements a simple visitor for Stmt subclasses.
Definition:
StmtVisitor.h:183
clang::Stmt::getSourceRange
SourceRange getSourceRange() const LLVM_READONLY
SourceLocation tokens are not useful in isolation - they are low level value objects created/interpre...
Definition:
Stmt.cpp:324
clang::QualType
A (possibly-)qualified type.
Definition:
Type.h:675
clang::AnalysisDeclContext
AnalysisDeclContext contains the context data for the function, method or block under analysis.
Definition:
AnalysisDeclContext.h:72
clang::UnaryExprOrTypeTraitExpr::getArgumentExpr
Expr * getArgumentExpr()
Definition:
Expr.h:2599
clang::UnaryExprOrTypeTraitExpr
UnaryExprOrTypeTraitExpr - expression with either a type or (unevaluated) expression operand.
Definition:
Expr.h:2549
BuiltinCheckerRegistration.h
BugReporter.h
clang::UnaryExprOrTypeTraitExpr::isArgumentType
bool isArgumentType() const
Definition:
Expr.h:2591
clang::Type::isPointerType
bool isPointerType() const
Definition:
Type.h:6748
clang::Decl
Decl - This represents one declaration (or definition), e.g.
Definition:
DeclBase.h:83
clang::UnaryExprOrTypeTraitExpr::getTypeOfArgument
QualType getTypeOfArgument() const
Gets the argument type, or the type of the argument expression, whichever is appropriate.
Definition:
Expr.h:2618
StmtVisitor.h
clang::Decl::getBody
virtual Stmt * getBody() const
getBody - If this Decl represents a declaration for a body of code, such as a function or method defi...
Definition:
DeclBase.h:1019
Checker.h
clang::UnaryExprOrTypeTraitExpr::getKind
UnaryExprOrTypeTrait getKind() const
Definition:
Expr.h:2581
clang::ento::categories::LogicError
const char *const LogicError
Definition:
CommonBugCategories.cpp:17
clang::Expr::IgnoreParens
Expr * IgnoreParens() LLVM_READONLY
Skip past any parentheses which might surround this expression until reaching a fixed point.
Definition:
Expr.cpp:2943
clang
Definition:
CalledOnceCheck.h:17
clang::Stmt
Stmt - This represents one statement.
Definition:
Stmt.h:69
clang::ento::PathDiagnosticLocation::createBegin
static PathDiagnosticLocation createBegin(const Decl *D, const SourceManager &SM)
Create a location for the beginning of the declaration.
Definition:
PathDiagnostic.cpp:580
clang::Expr
This represents one expression.
Definition:
Expr.h:109
AnalysisManager.h
Generated on Tue May 17 2022 09:33:42 for clang by
1.8.17