Home | History | Annotate | Download | only in Checkers 
      1 //===--- AttrNonNullChecker.h - Undefined arguments checker ----*- C++ -*--===//
      2 //
      3 //                     The LLVM Compiler Infrastructure
      4 //
      5 // This file is distributed under the University of Illinois Open Source
      6 // License. See LICENSE.TXT for details.
      7 //
      8 //===----------------------------------------------------------------------===//
      9 //
     10 // This defines AttrNonNullChecker, a builtin check in ExprEngine that
     11 // performs checks for arguments declared to have nonnull attribute.
     12 //
     13 //===----------------------------------------------------------------------===//
     14 
     15 #include "ClangSACheckers.h"
     16 #include "clang/StaticAnalyzer/Core/Checker.h"
     17 #include "clang/StaticAnalyzer/Core/CheckerManager.h"
     18 #include "clang/StaticAnalyzer/Core/PathSensitive/CheckerContext.h"
     19 #include "clang/StaticAnalyzer/Core/BugReporter/BugType.h"
     20 
     21 using namespace clang;
     22 using namespace ento;
     23 
     24 namespace {
     25 class AttrNonNullChecker
     26   : public Checker< check::PreStmt<CallExpr> > {
     27   mutable OwningPtr<BugType> BT;
     28 public:
     29 
     30   void checkPreStmt(const CallExpr *CE, CheckerContext &C) const;
     31 };
     32 } // end anonymous namespace
     33 
     34 void AttrNonNullChecker::checkPreStmt(const CallExpr *CE,
     35                                       CheckerContext &C) const {
     36   ProgramStateRef state = C.getState();
     37   const LocationContext *LCtx = C.getLocationContext();
     38 
     39   // Check if the callee has a 'nonnull' attribute.
     40   SVal X = state->getSVal(CE->getCallee(), LCtx);
     41 
     42   const FunctionDecl *FD = X.getAsFunctionDecl();
     43   if (!FD)
     44     return;
     45 
     46   const NonNullAttr* Att = FD->getAttr<NonNullAttr>();
     47   if (!Att)
     48     return;
     49 
     50   // Iterate through the arguments of CE and check them for null.
     51   unsigned idx = 0;
     52 
     53   for (CallExpr::const_arg_iterator I=CE->arg_begin(), E=CE->arg_end(); I!=E;
     54        ++I, ++idx) {
     55 
     56     if (!Att->isNonNull(idx))
     57       continue;
     58 
     59     SVal V = state->getSVal(*I, LCtx);
     60     DefinedSVal *DV = dyn_cast<DefinedSVal>(&V);
     61 
     62     // If the value is unknown or undefined, we can't perform this check.
     63     if (!DV)
     64       continue;
     65 
     66     if (!isa<Loc>(*DV)) {
     67       // If the argument is a union type, we want to handle a potential
     68       // transparent_unoin GCC extension.
     69       QualType T = (*I)->getType();
     70       const RecordType *UT = T->getAsUnionType();
     71       if (!UT || !UT->getDecl()->hasAttr<TransparentUnionAttr>())
     72         continue;
     73       if (nonloc::CompoundVal *CSV = dyn_cast<nonloc::CompoundVal>(DV)) {
     74         nonloc::CompoundVal::iterator CSV_I = CSV->begin();
     75         assert(CSV_I != CSV->end());
     76         V = *CSV_I;
     77         DV = dyn_cast<DefinedSVal>(&V);
     78         assert(++CSV_I == CSV->end());
     79         if (!DV)
     80           continue;
     81       }
     82       else {
     83         // FIXME: Handle LazyCompoundVals?
     84         continue;
     85       }
     86     }
     87 
     88     ConstraintManager &CM = C.getConstraintManager();
     89     ProgramStateRef stateNotNull, stateNull;
     90     llvm::tie(stateNotNull, stateNull) = CM.assumeDual(state, *DV);
     91 
     92     if (stateNull && !stateNotNull) {
     93       // Generate an error node.  Check for a null node in case
     94       // we cache out.
     95       if (ExplodedNode *errorNode = C.generateSink(stateNull)) {
     96 
     97         // Lazily allocate the BugType object if it hasn't already been
     98         // created. Ownership is transferred to the BugReporter object once
     99         // the BugReport is passed to 'EmitWarning'.
    100         if (!BT)
    101           BT.reset(new BugType("Argument with 'nonnull' attribute passed null",
    102                                "API"));
    103 
    104         BugReport *R =
    105           new BugReport(*BT, "Null pointer passed as an argument to a "
    106                              "'nonnull' parameter", errorNode);
    107 
    108         // Highlight the range of the argument that was null.
    109         const Expr *arg = *I;
    110         R->addRange(arg->getSourceRange());
    111         R->addVisitor(bugreporter::getTrackNullOrUndefValueVisitor(errorNode,
    112                                                                    arg, R));
    113         // Emit the bug report.
    114         C.EmitReport(R);
    115       }
    116 
    117       // Always return.  Either we cached out or we just emitted an error.
    118       return;
    119     }
    120 
    121     // If a pointer value passed the check we should assume that it is
    122     // indeed not null from this point forward.
    123     assert(stateNotNull);
    124     state = stateNotNull;
    125   }
    126 
    127   // If we reach here all of the arguments passed the nonnull check.
    128   // If 'state' has been updated generated a new node.
    129   C.addTransition(state);
    130 }
    131 
    132 void ento::registerAttrNonNullChecker(CheckerManager &mgr) {
    133   mgr.registerChecker<AttrNonNullChecker>();
    134 }
    135