1 //== NullDerefChecker.cpp - Null dereference checker ------------*- C++ -*--==// 2 // 3 // The LLVM Compiler Infrastructure 4 // 5 // This file is distributed under the University of Illinois Open Source 6 // License. See LICENSE.TXT for details. 7 // 8 //===----------------------------------------------------------------------===// 9 // 10 // This defines NullDerefChecker, a builtin check in ExprEngine that performs 11 // checks for null pointers at loads and stores. 12 // 13 //===----------------------------------------------------------------------===// 14 15 #include "ClangSACheckers.h" 16 #include "clang/AST/ExprObjC.h" 17 #include "clang/StaticAnalyzer/Core/Checker.h" 18 #include "clang/StaticAnalyzer/Core/CheckerManager.h" 19 #include "clang/StaticAnalyzer/Core/PathSensitive/CheckerContext.h" 20 #include "clang/StaticAnalyzer/Core/BugReporter/BugType.h" 21 #include "llvm/ADT/SmallString.h" 22 23 using namespace clang; 24 using namespace ento; 25 26 namespace { 27 class DereferenceChecker 28 : public Checker< check::Location, 29 check::Bind, 30 EventDispatcher<ImplicitNullDerefEvent> > { 31 mutable OwningPtr<BuiltinBug> BT_null; 32 mutable OwningPtr<BuiltinBug> BT_undef; 33 34 void reportBug(ProgramStateRef State, const Stmt *S, CheckerContext &C, 35 bool IsBind = false) const; 36 37 public: 38 void checkLocation(SVal location, bool isLoad, const Stmt* S, 39 CheckerContext &C) const; 40 void checkBind(SVal L, SVal V, const Stmt *S, CheckerContext &C) const; 41 42 static void AddDerefSource(raw_ostream &os, 43 SmallVectorImpl<SourceRange> &Ranges, 44 const Expr *Ex, const ProgramState *state, 45 const LocationContext *LCtx, 46 bool loadedFrom = false); 47 }; 48 } // end anonymous namespace 49 50 void 51 DereferenceChecker::AddDerefSource(raw_ostream &os, 52 SmallVectorImpl<SourceRange> &Ranges, 53 const Expr *Ex, 54 const ProgramState *state, 55 const LocationContext *LCtx, 56 bool loadedFrom) { 57 Ex = Ex->IgnoreParenLValueCasts(); 58 switch (Ex->getStmtClass()) { 59 default: 60 break; 61 case Stmt::DeclRefExprClass: { 62 const DeclRefExpr *DR = cast<DeclRefExpr>(Ex); 63 if (const VarDecl *VD = dyn_cast<VarDecl>(DR->getDecl())) { 64 os << " (" << (loadedFrom ? "loaded from" : "from") 65 << " variable '" << VD->getName() << "')"; 66 Ranges.push_back(DR->getSourceRange()); 67 } 68 break; 69 } 70 case Stmt::MemberExprClass: { 71 const MemberExpr *ME = cast<MemberExpr>(Ex); 72 os << " (" << (loadedFrom ? "loaded from" : "via") 73 << " field '" << ME->getMemberNameInfo() << "')"; 74 SourceLocation L = ME->getMemberLoc(); 75 Ranges.push_back(SourceRange(L, L)); 76 break; 77 } 78 } 79 } 80 81 void DereferenceChecker::reportBug(ProgramStateRef State, const Stmt *S, 82 CheckerContext &C, bool IsBind) const { 83 // Generate an error node. 84 ExplodedNode *N = C.generateSink(State); 85 if (!N) 86 return; 87 88 // We know that 'location' cannot be non-null. This is what 89 // we call an "explicit" null dereference. 90 if (!BT_null) 91 BT_null.reset(new BuiltinBug("Dereference of null pointer")); 92 93 SmallString<100> buf; 94 SmallVector<SourceRange, 2> Ranges; 95 96 // Walk through lvalue casts to get the original expression 97 // that syntactically caused the load. 98 if (const Expr *expr = dyn_cast<Expr>(S)) 99 S = expr->IgnoreParenLValueCasts(); 100 101 if (IsBind) { 102 if (const BinaryOperator *BO = dyn_cast<BinaryOperator>(S)) { 103 if (BO->isAssignmentOp()) 104 S = BO->getRHS(); 105 } else if (const DeclStmt *DS = dyn_cast<DeclStmt>(S)) { 106 assert(DS->isSingleDecl() && "We process decls one by one"); 107 if (const VarDecl *VD = dyn_cast<VarDecl>(DS->getSingleDecl())) 108 if (const Expr *Init = VD->getAnyInitializer()) 109 S = Init; 110 } 111 } 112 113 switch (S->getStmtClass()) { 114 case Stmt::ArraySubscriptExprClass: { 115 llvm::raw_svector_ostream os(buf); 116 os << "Array access"; 117 const ArraySubscriptExpr *AE = cast<ArraySubscriptExpr>(S); 118 AddDerefSource(os, Ranges, AE->getBase()->IgnoreParenCasts(), 119 State.getPtr(), N->getLocationContext()); 120 os << " results in a null pointer dereference"; 121 break; 122 } 123 case Stmt::UnaryOperatorClass: { 124 llvm::raw_svector_ostream os(buf); 125 os << "Dereference of null pointer"; 126 const UnaryOperator *U = cast<UnaryOperator>(S); 127 AddDerefSource(os, Ranges, U->getSubExpr()->IgnoreParens(), 128 State.getPtr(), N->getLocationContext(), true); 129 break; 130 } 131 case Stmt::MemberExprClass: { 132 const MemberExpr *M = cast<MemberExpr>(S); 133 if (M->isArrow() || bugreporter::isDeclRefExprToReference(M->getBase())) { 134 llvm::raw_svector_ostream os(buf); 135 os << "Access to field '" << M->getMemberNameInfo() 136 << "' results in a dereference of a null pointer"; 137 AddDerefSource(os, Ranges, M->getBase()->IgnoreParenCasts(), 138 State.getPtr(), N->getLocationContext(), true); 139 } 140 break; 141 } 142 case Stmt::ObjCIvarRefExprClass: { 143 const ObjCIvarRefExpr *IV = cast<ObjCIvarRefExpr>(S); 144 if (const DeclRefExpr *DR = 145 dyn_cast<DeclRefExpr>(IV->getBase()->IgnoreParenCasts())) { 146 if (const VarDecl *VD = dyn_cast<VarDecl>(DR->getDecl())) { 147 llvm::raw_svector_ostream os(buf); 148 os << "Instance variable access (via '" << VD->getName() 149 << "') results in a null pointer dereference"; 150 } 151 } 152 Ranges.push_back(IV->getSourceRange()); 153 break; 154 } 155 default: 156 break; 157 } 158 159 BugReport *report = 160 new BugReport(*BT_null, 161 buf.empty() ? BT_null->getDescription() : buf.str(), 162 N); 163 164 bugreporter::trackNullOrUndefValue(N, bugreporter::GetDerefExpr(N), *report); 165 166 for (SmallVectorImpl<SourceRange>::iterator 167 I = Ranges.begin(), E = Ranges.end(); I!=E; ++I) 168 report->addRange(*I); 169 170 C.EmitReport(report); 171 } 172 173 void DereferenceChecker::checkLocation(SVal l, bool isLoad, const Stmt* S, 174 CheckerContext &C) const { 175 // Check for dereference of an undefined value. 176 if (l.isUndef()) { 177 if (ExplodedNode *N = C.generateSink()) { 178 if (!BT_undef) 179 BT_undef.reset(new BuiltinBug("Dereference of undefined pointer value")); 180 181 BugReport *report = 182 new BugReport(*BT_undef, BT_undef->getDescription(), N); 183 bugreporter::trackNullOrUndefValue(N, bugreporter::GetDerefExpr(N), 184 *report); 185 C.EmitReport(report); 186 } 187 return; 188 } 189 190 DefinedOrUnknownSVal location = cast<DefinedOrUnknownSVal>(l); 191 192 // Check for null dereferences. 193 if (!isa<Loc>(location)) 194 return; 195 196 ProgramStateRef state = C.getState(); 197 198 ProgramStateRef notNullState, nullState; 199 llvm::tie(notNullState, nullState) = state->assume(location); 200 201 // The explicit NULL case. 202 if (nullState) { 203 if (!notNullState) { 204 reportBug(nullState, S, C); 205 return; 206 } 207 208 // Otherwise, we have the case where the location could either be 209 // null or not-null. Record the error node as an "implicit" null 210 // dereference. 211 if (ExplodedNode *N = C.generateSink(nullState)) { 212 ImplicitNullDerefEvent event = { l, isLoad, N, &C.getBugReporter() }; 213 dispatchEvent(event); 214 } 215 } 216 217 // From this point forward, we know that the location is not null. 218 C.addTransition(notNullState); 219 } 220 221 void DereferenceChecker::checkBind(SVal L, SVal V, const Stmt *S, 222 CheckerContext &C) const { 223 // If we're binding to a reference, check if the value is known to be null. 224 if (V.isUndef()) 225 return; 226 227 const MemRegion *MR = L.getAsRegion(); 228 const TypedValueRegion *TVR = dyn_cast_or_null<TypedValueRegion>(MR); 229 if (!TVR) 230 return; 231 232 if (!TVR->getValueType()->isReferenceType()) 233 return; 234 235 ProgramStateRef State = C.getState(); 236 237 ProgramStateRef StNonNull, StNull; 238 llvm::tie(StNonNull, StNull) = State->assume(cast<DefinedOrUnknownSVal>(V)); 239 240 if (StNull) { 241 if (!StNonNull) { 242 reportBug(StNull, S, C, /*isBind=*/true); 243 return; 244 } 245 246 // At this point the value could be either null or non-null. 247 // Record this as an "implicit" null dereference. 248 if (ExplodedNode *N = C.generateSink(StNull)) { 249 ImplicitNullDerefEvent event = { V, /*isLoad=*/true, N, 250 &C.getBugReporter() }; 251 dispatchEvent(event); 252 } 253 } 254 255 // Unlike a regular null dereference, initializing a reference with a 256 // dereferenced null pointer does not actually cause a runtime exception in 257 // Clang's implementation of references. 258 // 259 // int &r = *p; // safe?? 260 // if (p != NULL) return; // uh-oh 261 // r = 5; // trap here 262 // 263 // The standard says this is invalid as soon as we try to create a "null 264 // reference" (there is no such thing), but turning this into an assumption 265 // that 'p' is never null will not match our actual runtime behavior. 266 // So we do not record this assumption, allowing us to warn on the last line 267 // of this example. 268 // 269 // We do need to add a transition because we may have generated a sink for 270 // the "implicit" null dereference. 271 C.addTransition(State, this); 272 } 273 274 void ento::registerDereferenceChecker(CheckerManager &mgr) { 275 mgr.registerChecker<DereferenceChecker>(); 276 } 277
