1 //===--- AttrNonNullChecker.h - Undefined arguments checker ----*- C++ -*--===// 2 // 3 // The LLVM Compiler Infrastructure 4 // 5 // This file is distributed under the University of Illinois Open Source 6 // License. See LICENSE.TXT for details. 7 // 8 //===----------------------------------------------------------------------===// 9 // 10 // This defines AttrNonNullChecker, a builtin check in ExprEngine that 11 // performs checks for arguments declared to have nonnull attribute. 12 // 13 //===----------------------------------------------------------------------===// 14 15 #include "ClangSACheckers.h" 16 #include "clang/StaticAnalyzer/Core/Checker.h" 17 #include "clang/StaticAnalyzer/Core/CheckerManager.h" 18 #include "clang/StaticAnalyzer/Core/PathSensitive/CheckerContext.h" 19 #include "clang/StaticAnalyzer/Core/BugReporter/BugType.h" 20 21 using namespace clang; 22 using namespace ento; 23 24 namespace { 25 class AttrNonNullChecker 26 : public Checker< check::PreStmt<CallExpr> > { 27 mutable llvm::OwningPtr<BugType> BT; 28 public: 29 30 void checkPreStmt(const CallExpr *CE, CheckerContext &C) const; 31 }; 32 } // end anonymous namespace 33 34 void AttrNonNullChecker::checkPreStmt(const CallExpr *CE, 35 CheckerContext &C) const { 36 const ProgramState *state = C.getState(); 37 38 // Check if the callee has a 'nonnull' attribute. 39 SVal X = state->getSVal(CE->getCallee()); 40 41 const FunctionDecl *FD = X.getAsFunctionDecl(); 42 if (!FD) 43 return; 44 45 const NonNullAttr* Att = FD->getAttr<NonNullAttr>(); 46 if (!Att) 47 return; 48 49 // Iterate through the arguments of CE and check them for null. 50 unsigned idx = 0; 51 52 for (CallExpr::const_arg_iterator I=CE->arg_begin(), E=CE->arg_end(); I!=E; 53 ++I, ++idx) { 54 55 if (!Att->isNonNull(idx)) 56 continue; 57 58 SVal V = state->getSVal(*I); 59 DefinedSVal *DV = dyn_cast<DefinedSVal>(&V); 60 61 // If the value is unknown or undefined, we can't perform this check. 62 if (!DV) 63 continue; 64 65 if (!isa<Loc>(*DV)) { 66 // If the argument is a union type, we want to handle a potential 67 // transparent_unoin GCC extension. 68 QualType T = (*I)->getType(); 69 const RecordType *UT = T->getAsUnionType(); 70 if (!UT || !UT->getDecl()->hasAttr<TransparentUnionAttr>()) 71 continue; 72 if (nonloc::CompoundVal *CSV = dyn_cast<nonloc::CompoundVal>(DV)) { 73 nonloc::CompoundVal::iterator CSV_I = CSV->begin(); 74 assert(CSV_I != CSV->end()); 75 V = *CSV_I; 76 DV = dyn_cast<DefinedSVal>(&V); 77 assert(++CSV_I == CSV->end()); 78 if (!DV) 79 continue; 80 } 81 else { 82 // FIXME: Handle LazyCompoundVals? 83 continue; 84 } 85 } 86 87 ConstraintManager &CM = C.getConstraintManager(); 88 const ProgramState *stateNotNull, *stateNull; 89 llvm::tie(stateNotNull, stateNull) = CM.assumeDual(state, *DV); 90 91 if (stateNull && !stateNotNull) { 92 // Generate an error node. Check for a null node in case 93 // we cache out. 94 if (ExplodedNode *errorNode = C.generateSink(stateNull)) { 95 96 // Lazily allocate the BugType object if it hasn't already been 97 // created. Ownership is transferred to the BugReporter object once 98 // the BugReport is passed to 'EmitWarning'. 99 if (!BT) 100 BT.reset(new BugType("Argument with 'nonnull' attribute passed null", 101 "API")); 102 103 BugReport *R = 104 new BugReport(*BT, "Null pointer passed as an argument to a " 105 "'nonnull' parameter", errorNode); 106 107 // Highlight the range of the argument that was null. 108 const Expr *arg = *I; 109 R->addRange(arg->getSourceRange()); 110 R->addVisitor(bugreporter::getTrackNullOrUndefValueVisitor(errorNode, 111 arg)); 112 // Emit the bug report. 113 C.EmitReport(R); 114 } 115 116 // Always return. Either we cached out or we just emitted an error. 117 return; 118 } 119 120 // If a pointer value passed the check we should assume that it is 121 // indeed not null from this point forward. 122 assert(stateNotNull); 123 state = stateNotNull; 124 } 125 126 // If we reach here all of the arguments passed the nonnull check. 127 // If 'state' has been updated generated a new node. 128 C.addTransition(state); 129 } 130 131 void ento::registerAttrNonNullChecker(CheckerManager &mgr) { 132 mgr.registerChecker<AttrNonNullChecker>(); 133 } 134