35class InnerPointerChecker
36 :
public Checker<check::DeadSymbols, check::PostCall> {
39 CStrFn, DataFn, DataMemberFn, EraseFn, InsertFn, PopBackFn, PushBackFn,
40 ReplaceFn, ReserveFn, ResizeFn, ShrinkToFitFn, SwapFn;
47 InnerPointerBRVisitor(
SymbolRef Sym) : PtrToBuf(Sym) {}
49 static void *getTag() {
54 void Profile(llvm::FoldingSetNodeID &ID)
const override {
55 ID.AddPointer(getTag());
65 RawPtrMapTy Map = State->get<RawPtrMap>();
66 for (
const auto &Entry : Map) {
67 if (Entry.second.contains(Sym))
75 : AppendFn({
"std",
"basic_string",
"append"}),
76 AssignFn({
"std",
"basic_string",
"assign"}),
77 AddressofFn({
"std",
"addressof"}), AddressofFn_({
"std",
"__addressof"}),
78 ClearFn({
"std",
"basic_string",
"clear"}),
79 CStrFn({
"std",
"basic_string",
"c_str"}), DataFn({
"std",
"data"}, 1),
80 DataMemberFn({
"std",
"basic_string",
"data"}),
81 EraseFn({
"std",
"basic_string",
"erase"}),
82 InsertFn({
"std",
"basic_string",
"insert"}),
83 PopBackFn({
"std",
"basic_string",
"pop_back"}),
84 PushBackFn({
"std",
"basic_string",
"push_back"}),
85 ReplaceFn({
"std",
"basic_string",
"replace"}),
86 ReserveFn({
"std",
"basic_string",
"reserve"}),
87 ResizeFn({
"std",
"basic_string",
"resize"}),
88 ShrinkToFitFn({
"std",
"basic_string",
"shrink_to_fit"}),
89 SwapFn({
"std",
"basic_string",
"swap"}) {}
93 bool isInvalidatingMemberFunction(
const CallEvent &
Call)
const;
96 bool isInnerPointerAccessFunction(
const CallEvent &
Call)
const;
121bool InnerPointerChecker::isInvalidatingMemberFunction(
123 if (
const auto *MemOpCall = dyn_cast<CXXMemberOperatorCall>(&
Call)) {
125 if (Opc == OO_Equal || Opc == OO_PlusEqual)
129 return isa<CXXDestructorCall>(
Call) ||
130 matchesAny(
Call, AppendFn, AssignFn, ClearFn, EraseFn, InsertFn,
131 PopBackFn, PushBackFn, ReplaceFn, ReserveFn, ResizeFn,
132 ShrinkToFitFn, SwapFn);
135bool InnerPointerChecker::isInnerPointerAccessFunction(
137 return matchesAny(
Call, CStrFn, DataFn, DataMemberFn);
140void InnerPointerChecker::markPtrSymbolsReleased(
const CallEvent &
Call,
144 if (
const PtrSet *PS = State->get<RawPtrMap>(MR)) {
145 const Expr *Origin =
Call.getOriginExpr();
146 for (
const auto Symbol : *PS) {
151 State = State->remove<RawPtrMap>(MR);
152 C.addTransition(State);
157void InnerPointerChecker::checkFunctionArguments(
const CallEvent &
Call,
160 if (
const auto *FC = dyn_cast<AnyFunctionCall>(&
Call)) {
165 for (
unsigned I = 0, E = FD->
getNumParams(); I != E; ++I) {
173 bool isaMemberOpCall = isa<CXXMemberOperatorCall>(FC);
174 unsigned ArgI = isaMemberOpCall ? I+1 : I;
176 SVal Arg = FC->getArgSVal(ArgI);
177 const auto *ArgRegion =
178 dyn_cast_or_null<TypedValueRegion>(Arg.
getAsRegion());
184 if (matchesAny(
Call, AddressofFn, AddressofFn_))
187 markPtrSymbolsReleased(
Call, State, ArgRegion,
C);
206void InnerPointerChecker::checkPostCall(
const CallEvent &
Call,
213 if (
const auto *ICall = dyn_cast<CXXInstanceCall>(&
Call)) {
214 ObjRegion = dyn_cast_or_null<TypedValueRegion>(
215 ICall->getCXXThisVal().getAsRegion());
218 if (isInvalidatingMemberFunction(
Call)) {
219 markPtrSymbolsReleased(
Call, State, ObjRegion,
C);
224 if (isInnerPointerAccessFunction(
Call)) {
226 if (isa<SimpleFunctionCall>(
Call)) {
231 dyn_cast_or_null<TypedValueRegion>(
Call.getArgSVal(0).getAsRegion());
237 SVal RawPtr =
Call.getReturnValue();
242 PtrSet::Factory &F = State->getStateManager().get_context<PtrSet>();
243 const PtrSet *SetPtr = State->get<RawPtrMap>(ObjRegion);
244 PtrSet
Set = SetPtr ? *SetPtr : F.getEmptySet();
245 assert(
C.wasInlined || !
Set.contains(Sym));
248 State = State->set<RawPtrMap>(ObjRegion,
Set);
249 C.addTransition(State);
256 checkFunctionArguments(
Call, State,
C);
259void InnerPointerChecker::checkDeadSymbols(
SymbolReaper &SymReaper,
262 PtrSet::Factory &F = State->getStateManager().get_context<PtrSet>();
263 RawPtrMapTy RPM = State->get<RawPtrMap>();
264 for (
const auto &Entry : RPM) {
268 State = State->remove<RawPtrMap>(Entry.first);
270 if (
const PtrSet *OldSet = State->get<RawPtrMap>(Entry.first)) {
271 PtrSet CleanedUpSet = *OldSet;
272 for (
const auto Symbol : Entry.second) {
273 if (!SymReaper.
isLive(Symbol))
274 CleanedUpSet = F.remove(CleanedUpSet, Symbol);
276 State = CleanedUpSet.isEmpty()
277 ? State->remove<RawPtrMap>(Entry.first)
278 : State->set<RawPtrMap>(Entry.first, CleanedUpSet);
281 C.addTransition(State);
286namespace allocation_state {
289 return std::make_unique<InnerPointerChecker::InnerPointerBRVisitor>(Sym);
293 RawPtrMapTy Map = State->get<RawPtrMap>();
294 for (
const auto &Entry : Map) {
295 if (Entry.second.contains(Sym)) {
308 if (!isSymbolTracked(N->
getState(), PtrToBuf) ||
318 const auto *
TypedRegion = cast<TypedValueRegion>(ObjRegion);
322 llvm::raw_svector_ostream OS(Buf);
323 OS <<
"Pointer to inner buffer of '" << ObjTy <<
"' obtained here";
326 return std::make_shared<PathDiagnosticEventPiece>(Pos, OS.str(),
true);
334bool ento::shouldRegisterInnerPointerChecker(
const CheckerManager &mgr) {
#define REGISTER_MAP_WITH_PROGRAMSTATE(Name, Key, Value)
Declares an immutable map of type NameTy, suitable for placement into the ProgramState.
#define REGISTER_SET_FACTORY_WITH_PROGRAMSTATE(Name, Elem)
Declares an immutable set type Name and registers the factory for such sets in the program state,...
bool isInStdNamespace() const
This represents one expression.
Represents a function declaration or definition.
const ParmVarDecl * getParamDecl(unsigned i) const
unsigned getNumParams() const
Return the number of parameters this function must have based on its FunctionType.
A (possibly-)qualified type.
bool isConstQualified() const
Determine whether this type is const-qualified.
Stmt - This represents one statement.
bool isReferenceType() const
QualType getPointeeType() const
If this is a pointer, ObjC object pointer, or block pointer, this returns the respective pointee.
const SourceManager & getSourceManager() const
BugReporterVisitors are used to add custom diagnostics along a path.
This class represents a description of a function call using the number of arguments and the name of ...
Represents an abstract call to a function or method along a particular path.
CHECKER * registerChecker(AT &&... Args)
Used to register checkers.
const ProgramStateRef & getState() const
const Stmt * getStmtForDiagnostics() const
If the node's program point corresponds to a statement, retrieve that statement.
const LocationContext * getLocationContext() const
ExplodedNode * getFirstPred()
MemRegion - The root abstract class for all memory regions.
SVal - This represents a symbolic expression, which can be either an L-value or an R-value.
SymbolRef getAsSymbol(bool IncludeBaseRegions=false) const
If this SVal wraps a symbol return that SymbolRef.
const MemRegion * getAsRegion() const
A class responsible for cleaning up unused symbols.
bool isLiveRegion(const MemRegion *region)
bool isLive(SymbolRef sym)
TypedRegion - An abstract class representing regions that are typed.
TypedValueRegion - An abstract class representing regions having a typed value.
ProgramStateRef markReleased(ProgramStateRef State, SymbolRef Sym, const Expr *Origin)
std::unique_ptr< BugReporterVisitor > getInnerPointerBRVisitor(SymbolRef Sym)
This function provides an additional visitor that augments the bug report with information relevant t...
const MemRegion * getContainerObjRegion(ProgramStateRef State, SymbolRef Sym)
'Sym' represents a pointer to the inner buffer of a container object.
void registerInnerPointerCheckerAux(CheckerManager &Mgr)
Register the part of MallocChecker connected to InnerPointerChecker.
std::shared_ptr< PathDiagnosticPiece > PathDiagnosticPieceRef
OverloadedOperatorKind
Enumeration specifying the different kinds of C++ overloaded operators.