1 // MacOSXAPIChecker.h - Checks proper use of various MacOS X APIs --*- C++ -*-// 2 // 3 // The LLVM Compiler Infrastructure 4 // 5 // This file is distributed under the University of Illinois Open Source 6 // License. See LICENSE.TXT for details. 7 // 8 //===----------------------------------------------------------------------===// 9 // 10 // This defines MacOSXAPIChecker, which is an assortment of checks on calls 11 // to various, widely used Mac OS X functions. 12 // 13 // FIXME: What's currently in BasicObjCFoundationChecks.cpp should be migrated 14 // to here, using the new Checker interface. 15 // 16 //===----------------------------------------------------------------------===// 17 18 #include "ClangSACheckers.h" 19 #include "clang/StaticAnalyzer/Core/CheckerV2.h" 20 #include "clang/StaticAnalyzer/Core/CheckerManager.h" 21 #include "clang/StaticAnalyzer/Core/PathSensitive/CheckerContext.h" 22 #include "clang/StaticAnalyzer/Core/BugReporter/BugType.h" 23 #include "clang/StaticAnalyzer/Core/PathSensitive/GRStateTrait.h" 24 #include "clang/Basic/TargetInfo.h" 25 #include "llvm/ADT/SmallString.h" 26 #include "llvm/ADT/StringSwitch.h" 27 #include "llvm/Support/raw_ostream.h" 28 29 using namespace clang; 30 using namespace ento; 31 32 namespace { 33 class MacOSXAPIChecker : public CheckerV2< check::PreStmt<CallExpr> > { 34 enum SubChecks { 35 DispatchOnce = 0, 36 DispatchOnceF, 37 NumChecks 38 }; 39 40 mutable BugType *BTypes[NumChecks]; 41 42 public: 43 MacOSXAPIChecker() { memset(BTypes, 0, sizeof(*BTypes) * NumChecks); } 44 ~MacOSXAPIChecker() { 45 for (unsigned i=0; i != NumChecks; ++i) 46 delete BTypes[i]; 47 } 48 49 void checkPreStmt(const CallExpr *CE, CheckerContext &C) const; 50 }; 51 } //end anonymous namespace 52 53 //===----------------------------------------------------------------------===// 54 // dispatch_once and dispatch_once_f 55 //===----------------------------------------------------------------------===// 56 57 static void CheckDispatchOnce(CheckerContext &C, const CallExpr *CE, 58 BugType *&BT, const IdentifierInfo *FI) { 59 60 if (!BT) { 61 llvm::SmallString<128> S; 62 llvm::raw_svector_ostream os(S); 63 os << "Improper use of '" << FI->getName() << '\''; 64 BT = new BugType(os.str(), "Mac OS X API"); 65 } 66 67 if (CE->getNumArgs() < 1) 68 return; 69 70 // Check if the first argument is stack allocated. If so, issue a warning 71 // because that's likely to be bad news. 72 const GRState *state = C.getState(); 73 const MemRegion *R = state->getSVal(CE->getArg(0)).getAsRegion(); 74 if (!R || !isa<StackSpaceRegion>(R->getMemorySpace())) 75 return; 76 77 ExplodedNode *N = C.generateSink(state); 78 if (!N) 79 return; 80 81 llvm::SmallString<256> S; 82 llvm::raw_svector_ostream os(S); 83 os << "Call to '" << FI->getName() << "' uses"; 84 if (const VarRegion *VR = dyn_cast<VarRegion>(R)) 85 os << " the local variable '" << VR->getDecl()->getName() << '\''; 86 else 87 os << " stack allocated memory"; 88 os << " for the predicate value. Using such transient memory for " 89 "the predicate is potentially dangerous."; 90 if (isa<VarRegion>(R) && isa<StackLocalsSpaceRegion>(R->getMemorySpace())) 91 os << " Perhaps you intended to declare the variable as 'static'?"; 92 93 EnhancedBugReport *report = new EnhancedBugReport(*BT, os.str(), N); 94 report->addRange(CE->getArg(0)->getSourceRange()); 95 C.EmitReport(report); 96 } 97 98 //===----------------------------------------------------------------------===// 99 // Central dispatch function. 100 //===----------------------------------------------------------------------===// 101 102 typedef void (*SubChecker)(CheckerContext &C, const CallExpr *CE, BugType *&BT, 103 const IdentifierInfo *FI); 104 namespace { 105 class SubCheck { 106 SubChecker SC; 107 BugType **BT; 108 public: 109 SubCheck(SubChecker sc, BugType *& bt) : SC(sc), BT(&bt) {} 110 SubCheck() : SC(NULL), BT(NULL) {} 111 112 void run(CheckerContext &C, const CallExpr *CE, 113 const IdentifierInfo *FI) const { 114 if (SC) 115 SC(C, CE, *BT, FI); 116 } 117 }; 118 } // end anonymous namespace 119 120 void MacOSXAPIChecker::checkPreStmt(const CallExpr *CE, 121 CheckerContext &C) const { 122 // FIXME: Mostly copy and paste from UnixAPIChecker. Should refactor. 123 const GRState *state = C.getState(); 124 const Expr *Callee = CE->getCallee(); 125 const FunctionTextRegion *Fn = 126 dyn_cast_or_null<FunctionTextRegion>(state->getSVal(Callee).getAsRegion()); 127 128 if (!Fn) 129 return; 130 131 const IdentifierInfo *FI = Fn->getDecl()->getIdentifier(); 132 if (!FI) 133 return; 134 135 const SubCheck &SC = 136 llvm::StringSwitch<SubCheck>(FI->getName()) 137 .Case("dispatch_once", SubCheck(CheckDispatchOnce, BTypes[DispatchOnce])) 138 .Case("dispatch_once_f", SubCheck(CheckDispatchOnce, 139 BTypes[DispatchOnceF])) 140 .Default(SubCheck()); 141 142 SC.run(C, CE, FI); 143 } 144 145 //===----------------------------------------------------------------------===// 146 // Registration. 147 //===----------------------------------------------------------------------===// 148 149 void ento::registerMacOSXAPIChecker(CheckerManager &mgr) { 150 mgr.registerChecker<MacOSXAPIChecker>(); 151 } 152