1 //=== NoReturnFunctionChecker.cpp -------------------------------*- C++ -*-===// 2 // 3 // The LLVM Compiler Infrastructure 4 // 5 // This file is distributed under the University of Illinois Open Source 6 // License. See LICENSE.TXT for details. 7 // 8 //===----------------------------------------------------------------------===// 9 // 10 // This defines NoReturnFunctionChecker, which evaluates functions that do not 11 // return to the caller. 12 // 13 //===----------------------------------------------------------------------===// 14 15 #include "ClangSACheckers.h" 16 #include "clang/StaticAnalyzer/Core/Checker.h" 17 #include "clang/StaticAnalyzer/Core/CheckerManager.h" 18 #include "clang/StaticAnalyzer/Core/PathSensitive/CheckerContext.h" 19 #include "clang/StaticAnalyzer/Core/PathSensitive/ObjCMessage.h" 20 #include "llvm/ADT/StringSwitch.h" 21 #include <cstdarg> 22 23 using namespace clang; 24 using namespace ento; 25 26 namespace { 27 28 class NoReturnFunctionChecker : public Checker< check::PostStmt<CallExpr>, 29 check::PostObjCMessage > { 30 public: 31 void checkPostStmt(const CallExpr *CE, CheckerContext &C) const; 32 void checkPostObjCMessage(const ObjCMessage &msg, CheckerContext &C) const; 33 }; 34 35 } 36 37 void NoReturnFunctionChecker::checkPostStmt(const CallExpr *CE, 38 CheckerContext &C) const { 39 ProgramStateRef state = C.getState(); 40 const Expr *Callee = CE->getCallee(); 41 42 bool BuildSinks = getFunctionExtInfo(Callee->getType()).getNoReturn(); 43 44 if (!BuildSinks) { 45 SVal L = state->getSVal(Callee, C.getLocationContext()); 46 const FunctionDecl *FD = L.getAsFunctionDecl(); 47 if (!FD) 48 return; 49 50 if (FD->getAttr<AnalyzerNoReturnAttr>()) 51 BuildSinks = true; 52 else if (const IdentifierInfo *II = FD->getIdentifier()) { 53 // HACK: Some functions are not marked noreturn, and don't return. 54 // Here are a few hardwired ones. If this takes too long, we can 55 // potentially cache these results. 56 BuildSinks 57 = llvm::StringSwitch<bool>(StringRef(II->getName())) 58 .Case("exit", true) 59 .Case("panic", true) 60 .Case("error", true) 61 .Case("Assert", true) 62 // FIXME: This is just a wrapper around throwing an exception. 63 // Eventually inter-procedural analysis should handle this easily. 64 .Case("ziperr", true) 65 .Case("assfail", true) 66 .Case("db_error", true) 67 .Case("__assert", true) 68 .Case("__assert_rtn", true) 69 .Case("__assert_fail", true) 70 .Case("dtrace_assfail", true) 71 .Case("yy_fatal_error", true) 72 .Case("_XCAssertionFailureHandler", true) 73 .Case("_DTAssertionFailureHandler", true) 74 .Case("_TSAssertionFailureHandler", true) 75 .Default(false); 76 } 77 } 78 79 if (BuildSinks) 80 C.generateSink(); 81 } 82 83 static bool END_WITH_NULL isMultiArgSelector(const Selector *Sel, ...) { 84 va_list argp; 85 va_start(argp, Sel); 86 87 unsigned Slot = 0; 88 const char *Arg; 89 while ((Arg = va_arg(argp, const char *))) { 90 if (!Sel->getNameForSlot(Slot).equals(Arg)) 91 break; // still need to va_end! 92 ++Slot; 93 } 94 95 va_end(argp); 96 97 // We only succeeded if we made it to the end of the argument list. 98 return (Arg == NULL); 99 } 100 101 void NoReturnFunctionChecker::checkPostObjCMessage(const ObjCMessage &Msg, 102 CheckerContext &C) const { 103 // HACK: This entire check is to handle two messages in the Cocoa frameworks: 104 // -[NSAssertionHandler 105 // handleFailureInMethod:object:file:lineNumber:description:] 106 // -[NSAssertionHandler 107 // handleFailureInFunction:file:lineNumber:description:] 108 // Eventually these should be annotated with __attribute__((noreturn)). 109 // Because ObjC messages use dynamic dispatch, it is not generally safe to 110 // assume certain methods can't return. In cases where it is definitely valid, 111 // see if you can mark the methods noreturn or analyzer_noreturn instead of 112 // adding more explicit checks to this method. 113 114 if (!Msg.isInstanceMessage()) 115 return; 116 117 const ObjCInterfaceDecl *Receiver = Msg.getReceiverInterface(); 118 if (!Receiver) 119 return; 120 if (!Receiver->getIdentifier()->isStr("NSAssertionHandler")) 121 return; 122 123 Selector Sel = Msg.getSelector(); 124 switch (Sel.getNumArgs()) { 125 default: 126 return; 127 case 4: 128 if (!isMultiArgSelector(&Sel, "handleFailureInFunction", "file", 129 "lineNumber", "description", NULL)) 130 return; 131 break; 132 case 5: 133 if (!isMultiArgSelector(&Sel, "handleFailureInMethod", "object", "file", 134 "lineNumber", "description", NULL)) 135 return; 136 break; 137 } 138 139 // If we got here, it's one of the messages we care about. 140 C.generateSink(); 141 } 142 143 144 void ento::registerNoReturnFunctionChecker(CheckerManager &mgr) { 145 mgr.registerChecker<NoReturnFunctionChecker>(); 146 } 147