25 using namespace clang;
35 class InnerPointerChecker
36 :
public Checker<check::DeadSymbols, check::PostCall> {
38 CallDescription AppendFn, AssignFn, AddressofFn, AddressofFn_, ClearFn,
39 CStrFn, DataFn, DataMemberFn, EraseFn, InsertFn, PopBackFn, PushBackFn,
40 ReplaceFn, ReserveFn, ResizeFn, ShrinkToFitFn, SwapFn;
43 class InnerPointerBRVisitor :
public BugReporterVisitor {
47 InnerPointerBRVisitor(
SymbolRef Sym) : PtrToBuf(Sym) {}
49 static void *getTag() {
54 void Profile(llvm::FoldingSetNodeID &
ID)
const override {
55 ID.AddPointer(getTag());
59 VisitNode(
const ExplodedNode *N, BugReporterContext &BRC,
60 PathSensitiveBugReport &BR)
override;
65 RawPtrMapTy Map =
State->get<RawPtrMap>();
66 for (
const auto &Entry : Map) {
67 if (Entry.second.contains(Sym))
75 : AppendFn({
"std",
"basic_string",
"append"}),
76 AssignFn({
"std",
"basic_string",
"assign"}),
77 AddressofFn({
"std",
"addressof"}), AddressofFn_({
"std",
"__addressof"}),
78 ClearFn({
"std",
"basic_string",
"clear"}),
79 CStrFn({
"std",
"basic_string",
"c_str"}), DataFn({
"std",
"data"}, 1),
80 DataMemberFn({
"std",
"basic_string",
"data"}),
81 EraseFn({
"std",
"basic_string",
"erase"}),
82 InsertFn({
"std",
"basic_string",
"insert"}),
83 PopBackFn({
"std",
"basic_string",
"pop_back"}),
84 PushBackFn({
"std",
"basic_string",
"push_back"}),
85 ReplaceFn({
"std",
"basic_string",
"replace"}),
86 ReserveFn({
"std",
"basic_string",
"reserve"}),
87 ResizeFn({
"std",
"basic_string",
"resize"}),
88 ShrinkToFitFn({
"std",
"basic_string",
"shrink_to_fit"}),
89 SwapFn({
"std",
"basic_string",
"swap"}) {}
93 bool isInvalidatingMemberFunction(
const CallEvent &Call)
const;
96 bool isInnerPointerAccessFunction(
const CallEvent &Call)
const;
101 const MemRegion *ObjRegion,
102 CheckerContext &C)
const;
108 CheckerContext &C)
const;
113 void checkPostCall(
const CallEvent &Call, CheckerContext &C)
const;
116 void checkDeadSymbols(SymbolReaper &SymReaper, CheckerContext &C)
const;
121 bool InnerPointerChecker::isInvalidatingMemberFunction(
122 const CallEvent &Call)
const {
123 if (
const auto *MemOpCall = dyn_cast<CXXMemberOperatorCall>(&Call)) {
125 if (Opc == OO_Equal || Opc == OO_PlusEqual)
129 return isa<CXXDestructorCall>(Call) ||
130 matchesAny(Call, AppendFn, AssignFn, ClearFn, EraseFn, InsertFn,
131 PopBackFn, PushBackFn, ReplaceFn, ReserveFn, ResizeFn,
132 ShrinkToFitFn, SwapFn);
135 bool InnerPointerChecker::isInnerPointerAccessFunction(
136 const CallEvent &Call)
const {
137 return matchesAny(Call, CStrFn, DataFn, DataMemberFn);
140 void InnerPointerChecker::markPtrSymbolsReleased(
const CallEvent &Call,
143 CheckerContext &C)
const {
144 if (
const PtrSet *PS =
State->get<RawPtrMap>(MR)) {
145 const Expr *Origin =
Call.getOriginExpr();
146 for (
const auto Symbol : *PS) {
157 void InnerPointerChecker::checkFunctionArguments(
const CallEvent &Call,
159 CheckerContext &C)
const {
160 if (
const auto *FC = dyn_cast<AnyFunctionCall>(&Call)) {
165 for (
unsigned I = 0, E = FD->
getNumParams(); I != E; ++I) {
173 bool isaMemberOpCall = isa<CXXMemberOperatorCall>(FC);
174 unsigned ArgI = isaMemberOpCall ? I+1 : I;
176 SVal Arg = FC->getArgSVal(ArgI);
177 const auto *ArgRegion =
178 dyn_cast_or_null<TypedValueRegion>(Arg.getAsRegion());
184 if (matchesAny(Call, AddressofFn, AddressofFn_))
187 markPtrSymbolsReleased(Call,
State, ArgRegion, C);
206 void InnerPointerChecker::checkPostCall(
const CallEvent &Call,
207 CheckerContext &C)
const {
211 const TypedValueRegion *ObjRegion =
nullptr;
213 if (
const auto *ICall = dyn_cast<CXXInstanceCall>(&Call)) {
214 ObjRegion = dyn_cast_or_null<TypedValueRegion>(
215 ICall->getCXXThisVal().getAsRegion());
218 if (isInvalidatingMemberFunction(Call)) {
219 markPtrSymbolsReleased(Call,
State, ObjRegion, C);
224 if (isInnerPointerAccessFunction(Call)) {
226 if (isa<SimpleFunctionCall>(Call)) {
231 dyn_cast_or_null<TypedValueRegion>(
Call.getArgSVal(0).getAsRegion());
237 SVal RawPtr =
Call.getReturnValue();
238 if (
SymbolRef Sym = RawPtr.getAsSymbol(
true)) {
242 PtrSet::Factory &F =
State->getStateManager().get_context<PtrSet>();
243 const PtrSet *SetPtr =
State->get<RawPtrMap>(ObjRegion);
244 PtrSet Set = SetPtr ? *SetPtr : F.getEmptySet();
245 assert(
C.wasInlined || !Set.contains(Sym));
246 Set = F.add(Set, Sym);
248 State =
State->set<RawPtrMap>(ObjRegion, Set);
256 checkFunctionArguments(Call,
State, C);
259 void InnerPointerChecker::checkDeadSymbols(SymbolReaper &SymReaper,
260 CheckerContext &C)
const {
262 PtrSet::Factory &F =
State->getStateManager().get_context<PtrSet>();
263 RawPtrMapTy RPM =
State->get<RawPtrMap>();
264 for (
const auto &Entry : RPM) {
265 if (!SymReaper.isLiveRegion(Entry.first)) {
268 State =
State->remove<RawPtrMap>(Entry.first);
270 if (
const PtrSet *OldSet =
State->get<RawPtrMap>(Entry.first)) {
271 PtrSet CleanedUpSet = *OldSet;
272 for (
const auto Symbol : Entry.second) {
273 if (!SymReaper.isLive(Symbol))
274 CleanedUpSet = F.remove(CleanedUpSet, Symbol);
276 State = CleanedUpSet.isEmpty()
277 ?
State->remove<RawPtrMap>(Entry.first)
278 :
State->set<RawPtrMap>(Entry.first, CleanedUpSet);
286 namespace allocation_state {
289 return std::make_unique<InnerPointerChecker::InnerPointerBRVisitor>(Sym);
293 RawPtrMapTy Map =
State->get<RawPtrMap>();
294 for (
const auto &Entry : Map) {
295 if (Entry.second.contains(Sym)) {
307 const ExplodedNode *N, BugReporterContext &BRC, PathSensitiveBugReport &) {
308 if (!isSymbolTracked(N->getState(), PtrToBuf) ||
309 isSymbolTracked(N->getFirstPred()->getState(), PtrToBuf))
312 const Stmt *S = N->getStmtForDiagnostics();
316 const MemRegion *ObjRegion =
318 const auto *TypedRegion = cast<TypedValueRegion>(ObjRegion);
319 QualType ObjTy = TypedRegion->getValueType();
322 llvm::raw_svector_ostream
OS(Buf);
323 OS <<
"Pointer to inner buffer of '" << ObjTy <<
"' obtained here";
324 PathDiagnosticLocation Pos(S, BRC.getSourceManager(),
325 N->getLocationContext());
326 return std::make_shared<PathDiagnosticEventPiece>(Pos,
OS.str(),
true);
329 void ento::registerInnerPointerChecker(CheckerManager &Mgr) {
331 Mgr.registerChecker<InnerPointerChecker>();
334 bool ento::shouldRegisterInnerPointerChecker(
const CheckerManager &mgr) {