xref: /llvm-project/clang/lib/StaticAnalyzer/Checkers/CallAndMessageChecker.cpp (revision 6a61922239de8018239eef23328dba457874064c)
1 //===--- CallAndMessageChecker.cpp ------------------------------*- C++ -*--==//
2 //
3 //                     The LLVM Compiler Infrastructure
4 //
5 // This file is distributed under the University of Illinois Open Source
6 // License. See LICENSE.TXT for details.
7 //
8 //===----------------------------------------------------------------------===//
9 //
10 // This defines CallAndMessageChecker, a builtin checker that checks for various
11 // errors of call and objc message expressions.
12 //
13 //===----------------------------------------------------------------------===//
14 
15 #include "ClangSACheckers.h"
16 #include "clang/AST/ParentMap.h"
17 #include "clang/Basic/TargetInfo.h"
18 #include "clang/StaticAnalyzer/Core/BugReporter/BugType.h"
19 #include "clang/StaticAnalyzer/Core/Checker.h"
20 #include "clang/StaticAnalyzer/Core/CheckerManager.h"
21 #include "clang/StaticAnalyzer/Core/PathSensitive/CallEvent.h"
22 #include "clang/StaticAnalyzer/Core/PathSensitive/CheckerContext.h"
23 #include "llvm/ADT/SmallString.h"
24 #include "llvm/Support/raw_ostream.h"
25 
26 using namespace clang;
27 using namespace ento;
28 
29 namespace {
30 class CallAndMessageChecker
31   : public Checker< check::PreStmt<CallExpr>,
32                     check::PreStmt<CXXDeleteExpr>,
33                     check::PreObjCMessage,
34                     check::PreCall > {
35   mutable OwningPtr<BugType> BT_call_null;
36   mutable OwningPtr<BugType> BT_call_undef;
37   mutable OwningPtr<BugType> BT_cxx_call_null;
38   mutable OwningPtr<BugType> BT_cxx_call_undef;
39   mutable OwningPtr<BugType> BT_call_arg;
40   mutable OwningPtr<BugType> BT_cxx_delete_undef;
41   mutable OwningPtr<BugType> BT_msg_undef;
42   mutable OwningPtr<BugType> BT_objc_prop_undef;
43   mutable OwningPtr<BugType> BT_objc_subscript_undef;
44   mutable OwningPtr<BugType> BT_msg_arg;
45   mutable OwningPtr<BugType> BT_msg_ret;
46   mutable OwningPtr<BugType> BT_call_few_args;
47 public:
48 
49   void checkPreStmt(const CallExpr *CE, CheckerContext &C) const;
50   void checkPreStmt(const CXXDeleteExpr *DE, CheckerContext &C) const;
51   void checkPreObjCMessage(const ObjCMethodCall &msg, CheckerContext &C) const;
52   void checkPreCall(const CallEvent &Call, CheckerContext &C) const;
53 
54 private:
55   bool PreVisitProcessArg(CheckerContext &C, SVal V, SourceRange argRange,
56                           const Expr *argEx, bool IsFirstArgument,
57                           bool checkUninitFields, const CallEvent &Call,
58                           OwningPtr<BugType> &BT) const;
59 
60   static void emitBadCall(BugType *BT, CheckerContext &C, const Expr *BadE);
61   void emitNilReceiverBug(CheckerContext &C, const ObjCMethodCall &msg,
62                           ExplodedNode *N) const;
63 
64   void HandleNilReceiver(CheckerContext &C,
65                          ProgramStateRef state,
66                          const ObjCMethodCall &msg) const;
67 
68   void LazyInit_BT(const char *desc, OwningPtr<BugType> &BT) const {
69     if (!BT)
70       BT.reset(new BuiltinBug(this, desc));
71   }
72 };
73 } // end anonymous namespace
74 
75 void CallAndMessageChecker::emitBadCall(BugType *BT, CheckerContext &C,
76                                         const Expr *BadE) {
77   ExplodedNode *N = C.generateSink();
78   if (!N)
79     return;
80 
81   BugReport *R = new BugReport(*BT, BT->getName(), N);
82   if (BadE) {
83     R->addRange(BadE->getSourceRange());
84     if (BadE->isGLValue())
85       BadE = bugreporter::getDerefExpr(BadE);
86     bugreporter::trackNullOrUndefValue(N, BadE, *R);
87   }
88   C.emitReport(R);
89 }
90 
91 static StringRef describeUninitializedArgumentInCall(const CallEvent &Call,
92                                                      bool IsFirstArgument) {
93   switch (Call.getKind()) {
94   case CE_ObjCMessage: {
95     const ObjCMethodCall &Msg = cast<ObjCMethodCall>(Call);
96     switch (Msg.getMessageKind()) {
97     case OCM_Message:
98       return "Argument in message expression is an uninitialized value";
99     case OCM_PropertyAccess:
100       assert(Msg.isSetter() && "Getters have no args");
101       return "Argument for property setter is an uninitialized value";
102     case OCM_Subscript:
103       if (Msg.isSetter() && IsFirstArgument)
104         return "Argument for subscript setter is an uninitialized value";
105       return "Subscript index is an uninitialized value";
106     }
107     llvm_unreachable("Unknown message kind.");
108   }
109   case CE_Block:
110     return "Block call argument is an uninitialized value";
111   default:
112     return "Function call argument is an uninitialized value";
113   }
114 }
115 
116 bool CallAndMessageChecker::PreVisitProcessArg(CheckerContext &C,
117                                                SVal V, SourceRange argRange,
118                                                const Expr *argEx,
119                                                bool IsFirstArgument,
120                                                bool checkUninitFields,
121                                                const CallEvent &Call,
122                                                OwningPtr<BugType> &BT) const {
123   if (V.isUndef()) {
124     if (ExplodedNode *N = C.generateSink()) {
125       LazyInit_BT("Uninitialized argument value", BT);
126 
127       // Generate a report for this bug.
128       StringRef Desc = describeUninitializedArgumentInCall(Call,
129                                                            IsFirstArgument);
130       BugReport *R = new BugReport(*BT, Desc, N);
131       R->addRange(argRange);
132       if (argEx)
133         bugreporter::trackNullOrUndefValue(N, argEx, *R);
134       C.emitReport(R);
135     }
136     return true;
137   }
138 
139   if (!checkUninitFields)
140     return false;
141 
142   if (Optional<nonloc::LazyCompoundVal> LV =
143           V.getAs<nonloc::LazyCompoundVal>()) {
144 
145     class FindUninitializedField {
146     public:
147       SmallVector<const FieldDecl *, 10> FieldChain;
148     private:
149       StoreManager &StoreMgr;
150       MemRegionManager &MrMgr;
151       Store store;
152     public:
153       FindUninitializedField(StoreManager &storeMgr,
154                              MemRegionManager &mrMgr, Store s)
155       : StoreMgr(storeMgr), MrMgr(mrMgr), store(s) {}
156 
157       bool Find(const TypedValueRegion *R) {
158         QualType T = R->getValueType();
159         if (const RecordType *RT = T->getAsStructureType()) {
160           const RecordDecl *RD = RT->getDecl()->getDefinition();
161           assert(RD && "Referred record has no definition");
162           for (RecordDecl::field_iterator I =
163                RD->field_begin(), E = RD->field_end(); I!=E; ++I) {
164             const FieldRegion *FR = MrMgr.getFieldRegion(*I, R);
165             FieldChain.push_back(*I);
166             T = I->getType();
167             if (T->getAsStructureType()) {
168               if (Find(FR))
169                 return true;
170             }
171             else {
172               const SVal &V = StoreMgr.getBinding(store, loc::MemRegionVal(FR));
173               if (V.isUndef())
174                 return true;
175             }
176             FieldChain.pop_back();
177           }
178         }
179 
180         return false;
181       }
182     };
183 
184     const LazyCompoundValData *D = LV->getCVData();
185     FindUninitializedField F(C.getState()->getStateManager().getStoreManager(),
186                              C.getSValBuilder().getRegionManager(),
187                              D->getStore());
188 
189     if (F.Find(D->getRegion())) {
190       if (ExplodedNode *N = C.generateSink()) {
191         LazyInit_BT("Uninitialized argument value", BT);
192         SmallString<512> Str;
193         llvm::raw_svector_ostream os(Str);
194         os << "Passed-by-value struct argument contains uninitialized data";
195 
196         if (F.FieldChain.size() == 1)
197           os << " (e.g., field: '" << *F.FieldChain[0] << "')";
198         else {
199           os << " (e.g., via the field chain: '";
200           bool first = true;
201           for (SmallVectorImpl<const FieldDecl *>::iterator
202                DI = F.FieldChain.begin(), DE = F.FieldChain.end(); DI!=DE;++DI){
203             if (first)
204               first = false;
205             else
206               os << '.';
207             os << **DI;
208           }
209           os << "')";
210         }
211 
212         // Generate a report for this bug.
213         BugReport *R = new BugReport(*BT, os.str(), N);
214         R->addRange(argRange);
215 
216         // FIXME: enhance track back for uninitialized value for arbitrary
217         // memregions
218         C.emitReport(R);
219       }
220       return true;
221     }
222   }
223 
224   return false;
225 }
226 
227 void CallAndMessageChecker::checkPreStmt(const CallExpr *CE,
228                                          CheckerContext &C) const{
229 
230   const Expr *Callee = CE->getCallee()->IgnoreParens();
231   ProgramStateRef State = C.getState();
232   const LocationContext *LCtx = C.getLocationContext();
233   SVal L = State->getSVal(Callee, LCtx);
234 
235   if (L.isUndef()) {
236     if (!BT_call_undef)
237       BT_call_undef.reset(new BuiltinBug(
238           this, "Called function pointer is an uninitalized pointer value"));
239     emitBadCall(BT_call_undef.get(), C, Callee);
240     return;
241   }
242 
243   ProgramStateRef StNonNull, StNull;
244   llvm::tie(StNonNull, StNull) =
245       State->assume(L.castAs<DefinedOrUnknownSVal>());
246 
247   if (StNull && !StNonNull) {
248     if (!BT_call_null)
249       BT_call_null.reset(new BuiltinBug(
250           this, "Called function pointer is null (null dereference)"));
251     emitBadCall(BT_call_null.get(), C, Callee);
252     return;
253   }
254 
255   C.addTransition(StNonNull);
256 }
257 
258 void CallAndMessageChecker::checkPreStmt(const CXXDeleteExpr *DE,
259                                          CheckerContext &C) const {
260 
261   SVal Arg = C.getSVal(DE->getArgument());
262   if (Arg.isUndef()) {
263     StringRef Desc;
264     ExplodedNode *N = C.generateSink();
265     if (!N)
266       return;
267     if (!BT_cxx_delete_undef)
268       BT_cxx_delete_undef.reset(
269           new BuiltinBug(this, "Uninitialized argument value"));
270     if (DE->isArrayFormAsWritten())
271       Desc = "Argument to 'delete[]' is uninitialized";
272     else
273       Desc = "Argument to 'delete' is uninitialized";
274     BugType *BT = BT_cxx_delete_undef.get();
275     BugReport *R = new BugReport(*BT, Desc, N);
276     bugreporter::trackNullOrUndefValue(N, DE, *R);
277     C.emitReport(R);
278     return;
279   }
280 }
281 
282 
283 void CallAndMessageChecker::checkPreCall(const CallEvent &Call,
284                                          CheckerContext &C) const {
285   ProgramStateRef State = C.getState();
286 
287   // If this is a call to a C++ method, check if the callee is null or
288   // undefined.
289   if (const CXXInstanceCall *CC = dyn_cast<CXXInstanceCall>(&Call)) {
290     SVal V = CC->getCXXThisVal();
291     if (V.isUndef()) {
292       if (!BT_cxx_call_undef)
293         BT_cxx_call_undef.reset(
294             new BuiltinBug(this, "Called C++ object pointer is uninitialized"));
295       emitBadCall(BT_cxx_call_undef.get(), C, CC->getCXXThisExpr());
296       return;
297     }
298 
299     ProgramStateRef StNonNull, StNull;
300     llvm::tie(StNonNull, StNull) =
301         State->assume(V.castAs<DefinedOrUnknownSVal>());
302 
303     if (StNull && !StNonNull) {
304       if (!BT_cxx_call_null)
305         BT_cxx_call_null.reset(
306             new BuiltinBug(this, "Called C++ object pointer is null"));
307       emitBadCall(BT_cxx_call_null.get(), C, CC->getCXXThisExpr());
308       return;
309     }
310 
311     State = StNonNull;
312   }
313 
314   const Decl *D = Call.getDecl();
315   if (const FunctionDecl *FD = dyn_cast_or_null<FunctionDecl>(D)) {
316     // If we have a declaration, we can make sure we pass enough parameters to
317     // the function.
318     unsigned Params = FD->getNumParams();
319     if (Call.getNumArgs() < Params) {
320       ExplodedNode *N = C.generateSink();
321       if (!N)
322         return;
323 
324       LazyInit_BT("Function call with too few arguments", BT_call_few_args);
325 
326       SmallString<512> Str;
327       llvm::raw_svector_ostream os(Str);
328       os << "Function taking " << Params << " argument"
329          << (Params == 1 ? "" : "s") << " is called with less ("
330          << Call.getNumArgs() << ")";
331 
332       BugReport *R = new BugReport(*BT_call_few_args, os.str(), N);
333       C.emitReport(R);
334     }
335   }
336 
337   // Don't check for uninitialized field values in arguments if the
338   // caller has a body that is available and we have the chance to inline it.
339   // This is a hack, but is a reasonable compromise betweens sometimes warning
340   // and sometimes not depending on if we decide to inline a function.
341   const bool checkUninitFields =
342     !(C.getAnalysisManager().shouldInlineCall() && (D && D->getBody()));
343 
344   OwningPtr<BugType> *BT;
345   if (isa<ObjCMethodCall>(Call))
346     BT = &BT_msg_arg;
347   else
348     BT = &BT_call_arg;
349 
350   for (unsigned i = 0, e = Call.getNumArgs(); i != e; ++i)
351     if (PreVisitProcessArg(C, Call.getArgSVal(i), Call.getArgSourceRange(i),
352                            Call.getArgExpr(i), /*IsFirstArgument=*/i == 0,
353                            checkUninitFields, Call, *BT))
354       return;
355 
356   // If we make it here, record our assumptions about the callee.
357   C.addTransition(State);
358 }
359 
360 void CallAndMessageChecker::checkPreObjCMessage(const ObjCMethodCall &msg,
361                                                 CheckerContext &C) const {
362   SVal recVal = msg.getReceiverSVal();
363   if (recVal.isUndef()) {
364     if (ExplodedNode *N = C.generateSink()) {
365       BugType *BT = 0;
366       switch (msg.getMessageKind()) {
367       case OCM_Message:
368         if (!BT_msg_undef)
369           BT_msg_undef.reset(new BuiltinBug(this,
370                                             "Receiver in message expression "
371                                             "is an uninitialized value"));
372         BT = BT_msg_undef.get();
373         break;
374       case OCM_PropertyAccess:
375         if (!BT_objc_prop_undef)
376           BT_objc_prop_undef.reset(new BuiltinBug(
377               this, "Property access on an uninitialized object pointer"));
378         BT = BT_objc_prop_undef.get();
379         break;
380       case OCM_Subscript:
381         if (!BT_objc_subscript_undef)
382           BT_objc_subscript_undef.reset(new BuiltinBug(
383               this, "Subscript access on an uninitialized object pointer"));
384         BT = BT_objc_subscript_undef.get();
385         break;
386       }
387       assert(BT && "Unknown message kind.");
388 
389       BugReport *R = new BugReport(*BT, BT->getName(), N);
390       const ObjCMessageExpr *ME = msg.getOriginExpr();
391       R->addRange(ME->getReceiverRange());
392 
393       // FIXME: getTrackNullOrUndefValueVisitor can't handle "super" yet.
394       if (const Expr *ReceiverE = ME->getInstanceReceiver())
395         bugreporter::trackNullOrUndefValue(N, ReceiverE, *R);
396       C.emitReport(R);
397     }
398     return;
399   } else {
400     // Bifurcate the state into nil and non-nil ones.
401     DefinedOrUnknownSVal receiverVal = recVal.castAs<DefinedOrUnknownSVal>();
402 
403     ProgramStateRef state = C.getState();
404     ProgramStateRef notNilState, nilState;
405     llvm::tie(notNilState, nilState) = state->assume(receiverVal);
406 
407     // Handle receiver must be nil.
408     if (nilState && !notNilState) {
409       HandleNilReceiver(C, state, msg);
410       return;
411     }
412   }
413 }
414 
415 void CallAndMessageChecker::emitNilReceiverBug(CheckerContext &C,
416                                                const ObjCMethodCall &msg,
417                                                ExplodedNode *N) const {
418 
419   if (!BT_msg_ret)
420     BT_msg_ret.reset(
421         new BuiltinBug(this, "Receiver in message expression is 'nil'"));
422 
423   const ObjCMessageExpr *ME = msg.getOriginExpr();
424 
425   QualType ResTy = msg.getResultType();
426 
427   SmallString<200> buf;
428   llvm::raw_svector_ostream os(buf);
429   os << "The receiver of message '";
430   ME->getSelector().print(os);
431   os << "' is nil";
432   if (ResTy->isReferenceType()) {
433     os << ", which results in forming a null reference";
434   } else {
435     os << " and returns a value of type '";
436     msg.getResultType().print(os, C.getLangOpts());
437     os << "' that will be garbage";
438   }
439 
440   BugReport *report = new BugReport(*BT_msg_ret, os.str(), N);
441   report->addRange(ME->getReceiverRange());
442   // FIXME: This won't track "self" in messages to super.
443   if (const Expr *receiver = ME->getInstanceReceiver()) {
444     bugreporter::trackNullOrUndefValue(N, receiver, *report);
445   }
446   C.emitReport(report);
447 }
448 
449 static bool supportsNilWithFloatRet(const llvm::Triple &triple) {
450   return (triple.getVendor() == llvm::Triple::Apple &&
451           (triple.isiOS() || !triple.isMacOSXVersionLT(10,5)));
452 }
453 
454 void CallAndMessageChecker::HandleNilReceiver(CheckerContext &C,
455                                               ProgramStateRef state,
456                                               const ObjCMethodCall &Msg) const {
457   ASTContext &Ctx = C.getASTContext();
458   static CheckerProgramPointTag Tag(this, "NilReceiver");
459 
460   // Check the return type of the message expression.  A message to nil will
461   // return different values depending on the return type and the architecture.
462   QualType RetTy = Msg.getResultType();
463   CanQualType CanRetTy = Ctx.getCanonicalType(RetTy);
464   const LocationContext *LCtx = C.getLocationContext();
465 
466   if (CanRetTy->isStructureOrClassType()) {
467     // Structure returns are safe since the compiler zeroes them out.
468     SVal V = C.getSValBuilder().makeZeroVal(RetTy);
469     C.addTransition(state->BindExpr(Msg.getOriginExpr(), LCtx, V), &Tag);
470     return;
471   }
472 
473   // Other cases: check if sizeof(return type) > sizeof(void*)
474   if (CanRetTy != Ctx.VoidTy && C.getLocationContext()->getParentMap()
475                                   .isConsumedExpr(Msg.getOriginExpr())) {
476     // Compute: sizeof(void *) and sizeof(return type)
477     const uint64_t voidPtrSize = Ctx.getTypeSize(Ctx.VoidPtrTy);
478     const uint64_t returnTypeSize = Ctx.getTypeSize(CanRetTy);
479 
480     if (CanRetTy.getTypePtr()->isReferenceType()||
481         (voidPtrSize < returnTypeSize &&
482          !(supportsNilWithFloatRet(Ctx.getTargetInfo().getTriple()) &&
483            (Ctx.FloatTy == CanRetTy ||
484             Ctx.DoubleTy == CanRetTy ||
485             Ctx.LongDoubleTy == CanRetTy ||
486             Ctx.LongLongTy == CanRetTy ||
487             Ctx.UnsignedLongLongTy == CanRetTy)))) {
488       if (ExplodedNode *N = C.generateSink(state, 0 , &Tag))
489         emitNilReceiverBug(C, Msg, N);
490       return;
491     }
492 
493     // Handle the safe cases where the return value is 0 if the
494     // receiver is nil.
495     //
496     // FIXME: For now take the conservative approach that we only
497     // return null values if we *know* that the receiver is nil.
498     // This is because we can have surprises like:
499     //
500     //   ... = [[NSScreens screens] objectAtIndex:0];
501     //
502     // What can happen is that [... screens] could return nil, but
503     // it most likely isn't nil.  We should assume the semantics
504     // of this case unless we have *a lot* more knowledge.
505     //
506     SVal V = C.getSValBuilder().makeZeroVal(RetTy);
507     C.addTransition(state->BindExpr(Msg.getOriginExpr(), LCtx, V), &Tag);
508     return;
509   }
510 
511   C.addTransition(state);
512 }
513 
514 void ento::registerCallAndMessageChecker(CheckerManager &mgr) {
515   mgr.registerChecker<CallAndMessageChecker>();
516 }
517