forked from OSchip/llvm-project
135 lines
4.3 KiB
C++
135 lines
4.3 KiB
C++
//===--- AttrNonNullChecker.h - Undefined arguments checker ----*- C++ -*--===//
|
|
//
|
|
// The LLVM Compiler Infrastructure
|
|
//
|
|
// This file is distributed under the University of Illinois Open Source
|
|
// License. See LICENSE.TXT for details.
|
|
//
|
|
//===----------------------------------------------------------------------===//
|
|
//
|
|
// This defines AttrNonNullChecker, a builtin check in ExprEngine that
|
|
// performs checks for arguments declared to have nonnull attribute.
|
|
//
|
|
//===----------------------------------------------------------------------===//
|
|
|
|
#include "ClangSACheckers.h"
|
|
#include "clang/StaticAnalyzer/Core/CheckerV2.h"
|
|
#include "clang/StaticAnalyzer/Core/CheckerManager.h"
|
|
#include "clang/StaticAnalyzer/Core/PathSensitive/CheckerContext.h"
|
|
#include "clang/StaticAnalyzer/Core/BugReporter/BugType.h"
|
|
|
|
using namespace clang;
|
|
using namespace ento;
|
|
|
|
namespace {
|
|
class AttrNonNullChecker
|
|
: public CheckerV2< check::PreStmt<CallExpr> > {
|
|
mutable llvm::OwningPtr<BugType> BT;
|
|
public:
|
|
|
|
void checkPreStmt(const CallExpr *CE, CheckerContext &C) const;
|
|
};
|
|
} // end anonymous namespace
|
|
|
|
void AttrNonNullChecker::checkPreStmt(const CallExpr *CE,
|
|
CheckerContext &C) const {
|
|
const GRState *state = C.getState();
|
|
|
|
// Check if the callee has a 'nonnull' attribute.
|
|
SVal X = state->getSVal(CE->getCallee());
|
|
|
|
const FunctionDecl* FD = X.getAsFunctionDecl();
|
|
if (!FD)
|
|
return;
|
|
|
|
const NonNullAttr* Att = FD->getAttr<NonNullAttr>();
|
|
if (!Att)
|
|
return;
|
|
|
|
// Iterate through the arguments of CE and check them for null.
|
|
unsigned idx = 0;
|
|
|
|
for (CallExpr::const_arg_iterator I=CE->arg_begin(), E=CE->arg_end(); I!=E;
|
|
++I, ++idx) {
|
|
|
|
if (!Att->isNonNull(idx))
|
|
continue;
|
|
|
|
SVal V = state->getSVal(*I);
|
|
DefinedSVal *DV = dyn_cast<DefinedSVal>(&V);
|
|
|
|
// If the value is unknown or undefined, we can't perform this check.
|
|
if (!DV)
|
|
continue;
|
|
|
|
if (!isa<Loc>(*DV)) {
|
|
// If the argument is a union type, we want to handle a potential
|
|
// transparent_unoin GCC extension.
|
|
QualType T = (*I)->getType();
|
|
const RecordType *UT = T->getAsUnionType();
|
|
if (!UT || !UT->getDecl()->hasAttr<TransparentUnionAttr>())
|
|
continue;
|
|
if (nonloc::CompoundVal *CSV = dyn_cast<nonloc::CompoundVal>(DV)) {
|
|
nonloc::CompoundVal::iterator CSV_I = CSV->begin();
|
|
assert(CSV_I != CSV->end());
|
|
V = *CSV_I;
|
|
DV = dyn_cast<DefinedSVal>(&V);
|
|
assert(++CSV_I == CSV->end());
|
|
if (!DV)
|
|
continue;
|
|
}
|
|
else {
|
|
// FIXME: Handle LazyCompoundVals?
|
|
continue;
|
|
}
|
|
}
|
|
|
|
ConstraintManager &CM = C.getConstraintManager();
|
|
const GRState *stateNotNull, *stateNull;
|
|
llvm::tie(stateNotNull, stateNull) = CM.assumeDual(state, *DV);
|
|
|
|
if (stateNull && !stateNotNull) {
|
|
// Generate an error node. Check for a null node in case
|
|
// we cache out.
|
|
if (ExplodedNode *errorNode = C.generateSink(stateNull)) {
|
|
|
|
// Lazily allocate the BugType object if it hasn't already been
|
|
// created. Ownership is transferred to the BugReporter object once
|
|
// the BugReport is passed to 'EmitWarning'.
|
|
if (!BT)
|
|
BT.reset(new BugType("Argument with 'nonnull' attribute passed null",
|
|
"API"));
|
|
|
|
EnhancedBugReport *R =
|
|
new EnhancedBugReport(*BT,
|
|
"Null pointer passed as an argument to a "
|
|
"'nonnull' parameter", errorNode);
|
|
|
|
// Highlight the range of the argument that was null.
|
|
const Expr *arg = *I;
|
|
R->addRange(arg->getSourceRange());
|
|
R->addVisitorCreator(bugreporter::registerTrackNullOrUndefValue, arg);
|
|
|
|
// Emit the bug report.
|
|
C.EmitReport(R);
|
|
}
|
|
|
|
// Always return. Either we cached out or we just emitted an error.
|
|
return;
|
|
}
|
|
|
|
// If a pointer value passed the check we should assume that it is
|
|
// indeed not null from this point forward.
|
|
assert(stateNotNull);
|
|
state = stateNotNull;
|
|
}
|
|
|
|
// If we reach here all of the arguments passed the nonnull check.
|
|
// If 'state' has been updated generated a new node.
|
|
C.addTransition(state);
|
|
}
|
|
|
|
void ento::registerAttrNonNullChecker(CheckerManager &mgr) {
|
|
mgr.registerChecker<AttrNonNullChecker>();
|
|
}
|