clang  14.0.0git
CheckSizeofPointer.cpp
Go to the documentation of this file.
1 //==- CheckSizeofPointer.cpp - Check for sizeof on pointers ------*- C++ -*-==//
2 //
3 // Part of the LLVM Project, under the Apache License v2.0 with LLVM Exceptions.
4 // See https://llvm.org/LICENSE.txt for license information.
5 // SPDX-License-Identifier: Apache-2.0 WITH LLVM-exception
6 //
7 //===----------------------------------------------------------------------===//
8 //
9 // This file defines a check for unintended use of sizeof() on pointer
10 // expressions.
11 //
12 //===----------------------------------------------------------------------===//
13 
15 #include "clang/AST/StmtVisitor.h"
19 
20 using namespace clang;
21 using namespace ento;
22 
23 namespace {
24 class WalkAST : public StmtVisitor<WalkAST> {
25  BugReporter &BR;
26  const CheckerBase *Checker;
28 
29 public:
30  WalkAST(BugReporter &br, const CheckerBase *checker, AnalysisDeclContext *ac)
31  : BR(br), Checker(checker), AC(ac) {}
32  void VisitUnaryExprOrTypeTraitExpr(UnaryExprOrTypeTraitExpr *E);
33  void VisitStmt(Stmt *S) { VisitChildren(S); }
34  void VisitChildren(Stmt *S);
35 };
36 }
37 
38 void WalkAST::VisitChildren(Stmt *S) {
39  for (Stmt *Child : S->children())
40  if (Child)
41  Visit(Child);
42 }
43 
44 // CWE-467: Use of sizeof() on a Pointer Type
45 void WalkAST::VisitUnaryExprOrTypeTraitExpr(UnaryExprOrTypeTraitExpr *E) {
46  if (E->getKind() != UETT_SizeOf)
47  return;
48 
49  // If an explicit type is used in the code, usually the coder knows what they are
50  // doing.
51  if (E->isArgumentType())
52  return;
53 
54  QualType T = E->getTypeOfArgument();
55  if (T->isPointerType()) {
56 
57  // Many false positives have the form 'sizeof *p'. This is reasonable
58  // because people know what they are doing when they intentionally
59  // dereference the pointer.
60  Expr *ArgEx = E->getArgumentExpr();
61  if (!isa<DeclRefExpr>(ArgEx->IgnoreParens()))
62  return;
63 
64  PathDiagnosticLocation ELoc =
65  PathDiagnosticLocation::createBegin(E, BR.getSourceManager(), AC);
66  BR.EmitBasicReport(AC->getDecl(), Checker,
67  "Potential unintended use of sizeof() on pointer type",
69  "The code calls sizeof() on a pointer type. "
70  "This can produce an unexpected result.",
71  ELoc, ArgEx->getSourceRange());
72  }
73 }
74 
75 //===----------------------------------------------------------------------===//
76 // SizeofPointerChecker
77 //===----------------------------------------------------------------------===//
78 
79 namespace {
80 class SizeofPointerChecker : public Checker<check::ASTCodeBody> {
81 public:
82  void checkASTCodeBody(const Decl *D, AnalysisManager& mgr,
83  BugReporter &BR) const {
84  WalkAST walker(BR, this, mgr.getAnalysisDeclContext(D));
85  walker.Visit(D->getBody());
86  }
87 };
88 }
89 
90 void ento::registerSizeofPointerChecker(CheckerManager &mgr) {
91  mgr.registerChecker<SizeofPointerChecker>();
92 }
93 
94 bool ento::shouldRegisterSizeofPointerChecker(const CheckerManager &mgr) {
95  return true;
96 }
clang::StmtVisitor
StmtVisitor - This class implements a simple visitor for Stmt subclasses.
Definition: StmtVisitor.h:183
clang::Stmt::getSourceRange
SourceRange getSourceRange() const LLVM_READONLY
SourceLocation tokens are not useful in isolation - they are low level value objects created/interpre...
Definition: Stmt.cpp:324
clang::QualType
A (possibly-)qualified type.
Definition: Type.h:673
clang::AnalysisDeclContext
AnalysisDeclContext contains the context data for the function, method or block under analysis.
Definition: AnalysisDeclContext.h:72
clang::UnaryExprOrTypeTraitExpr::getArgumentExpr
Expr * getArgumentExpr()
Definition: Expr.h:2593
clang::UnaryExprOrTypeTraitExpr
UnaryExprOrTypeTraitExpr - expression with either a type or (unevaluated) expression operand.
Definition: Expr.h:2543
BuiltinCheckerRegistration.h
BugReporter.h
clang::UnaryExprOrTypeTraitExpr::isArgumentType
bool isArgumentType() const
Definition: Expr.h:2585
clang::Type::isPointerType
bool isPointerType() const
Definition: Type.h:6672
clang::Decl
Decl - This represents one declaration (or definition), e.g.
Definition: DeclBase.h:89
clang::UnaryExprOrTypeTraitExpr::getTypeOfArgument
QualType getTypeOfArgument() const
Gets the argument type, or the type of the argument expression, whichever is appropriate.
Definition: Expr.h:2612
StmtVisitor.h
clang::Decl::getBody
virtual Stmt * getBody() const
getBody - If this Decl represents a declaration for a body of code, such as a function or method defi...
Definition: DeclBase.h:1010
Checker.h
clang::UnaryExprOrTypeTraitExpr::getKind
UnaryExprOrTypeTrait getKind() const
Definition: Expr.h:2575
clang::ento::categories::LogicError
const char *const LogicError
Definition: CommonBugCategories.cpp:17
clang::Expr::IgnoreParens
Expr * IgnoreParens() LLVM_READONLY
Skip past any parentheses which might surround this expression until reaching a fixed point.
Definition: Expr.cpp:2915
clang
Definition: CalledOnceCheck.h:17
clang::Stmt
Stmt - This represents one statement.
Definition: Stmt.h:69
clang::ento::PathDiagnosticLocation::createBegin
static PathDiagnosticLocation createBegin(const Decl *D, const SourceManager &SM)
Create a location for the beginning of the declaration.
Definition: PathDiagnostic.cpp:580
clang::Expr
This represents one expression.
Definition: Expr.h:109
AnalysisManager.h