Home | History | Annotate | Download | only in PathSensitive
      1 //== CheckerContext.h - Context info for path-sensitive checkers--*- C++ -*--=//
      2 //
      3 //                     The LLVM Compiler Infrastructure
      4 //
      5 // This file is distributed under the University of Illinois Open Source
      6 // License. See LICENSE.TXT for details.
      7 //
      8 //===----------------------------------------------------------------------===//
      9 //
     10 //  This file defines CheckerContext that provides contextual info for
     11 // path-sensitive checkers.
     12 //
     13 //===----------------------------------------------------------------------===//
     14 
     15 #ifndef LLVM_CLANG_STATICANALYZER_CORE_PATHSENSITIVE_CHECKERCONTEXT_H
     16 #define LLVM_CLANG_STATICANALYZER_CORE_PATHSENSITIVE_CHECKERCONTEXT_H
     17 
     18 #include "clang/StaticAnalyzer/Core/PathSensitive/ExprEngine.h"
     19 #include "clang/StaticAnalyzer/Core/PathSensitive/ProgramStateTrait.h"
     20 
     21 namespace clang {
     22 namespace ento {
     23 
     24   /// Declares an immutable map of type \p NameTy, suitable for placement into
     25   /// the ProgramState. This is implementing using llvm::ImmutableMap.
     26   ///
     27   /// \code
     28   /// State = State->set<Name>(K, V);
     29   /// const Value *V = State->get<Name>(K); // Returns NULL if not in the map.
     30   /// State = State->remove<Name>(K);
     31   /// NameTy Map = State->get<Name>();
     32   /// \endcode
     33   ///
     34   /// The macro should not be used inside namespaces, or for traits that must
     35   /// be accessible from more than one translation unit.
     36   #define REGISTER_MAP_WITH_PROGRAMSTATE(Name, Key, Value) \
     37     REGISTER_TRAIT_WITH_PROGRAMSTATE(Name, \
     38                                      CLANG_ENTO_PROGRAMSTATE_MAP(Key, Value))
     39 
     40   /// Declares an immutable set of type \p NameTy, suitable for placement into
     41   /// the ProgramState. This is implementing using llvm::ImmutableSet.
     42   ///
     43   /// \code
     44   /// State = State->add<Name>(E);
     45   /// State = State->remove<Name>(E);
     46   /// bool Present = State->contains<Name>(E);
     47   /// NameTy Set = State->get<Name>();
     48   /// \endcode
     49   ///
     50   /// The macro should not be used inside namespaces, or for traits that must
     51   /// be accessible from more than one translation unit.
     52   #define REGISTER_SET_WITH_PROGRAMSTATE(Name, Elem) \
     53     REGISTER_TRAIT_WITH_PROGRAMSTATE(Name, llvm::ImmutableSet<Elem>)
     54 
     55   /// Declares an immutable list of type \p NameTy, suitable for placement into
     56   /// the ProgramState. This is implementing using llvm::ImmutableList.
     57   ///
     58   /// \code
     59   /// State = State->add<Name>(E); // Adds to the /end/ of the list.
     60   /// bool Present = State->contains<Name>(E);
     61   /// NameTy List = State->get<Name>();
     62   /// \endcode
     63   ///
     64   /// The macro should not be used inside namespaces, or for traits that must
     65   /// be accessible from more than one translation unit.
     66   #define REGISTER_LIST_WITH_PROGRAMSTATE(Name, Elem) \
     67     REGISTER_TRAIT_WITH_PROGRAMSTATE(Name, llvm::ImmutableList<Elem>)
     68 
     69 
     70 class CheckerContext {
     71   ExprEngine &Eng;
     72   /// The current exploded(symbolic execution) graph node.
     73   ExplodedNode *Pred;
     74   /// The flag is true if the (state of the execution) has been modified
     75   /// by the checker using this context. For example, a new transition has been
     76   /// added or a bug report issued.
     77   bool Changed;
     78   /// The tagged location, which is used to generate all new nodes.
     79   const ProgramPoint Location;
     80   NodeBuilder &NB;
     81 
     82 public:
     83   /// If we are post visiting a call, this flag will be set if the
     84   /// call was inlined.  In all other cases it will be false.
     85   const bool wasInlined;
     86 
     87   CheckerContext(NodeBuilder &builder,
     88                  ExprEngine &eng,
     89                  ExplodedNode *pred,
     90                  const ProgramPoint &loc,
     91                  bool wasInlined = false)
     92     : Eng(eng),
     93       Pred(pred),
     94       Changed(false),
     95       Location(loc),
     96       NB(builder),
     97       wasInlined(wasInlined) {
     98     assert(Pred->getState() &&
     99            "We should not call the checkers on an empty state.");
    100   }
    101 
    102   AnalysisManager &getAnalysisManager() {
    103     return Eng.getAnalysisManager();
    104   }
    105 
    106   ConstraintManager &getConstraintManager() {
    107     return Eng.getConstraintManager();
    108   }
    109 
    110   StoreManager &getStoreManager() {
    111     return Eng.getStoreManager();
    112   }
    113 
    114   /// \brief Returns the previous node in the exploded graph, which includes
    115   /// the state of the program before the checker ran. Note, checkers should
    116   /// not retain the node in their state since the nodes might get invalidated.
    117   ExplodedNode *getPredecessor() { return Pred; }
    118   const ProgramStateRef &getState() const { return Pred->getState(); }
    119 
    120   /// \brief Check if the checker changed the state of the execution; ex: added
    121   /// a new transition or a bug report.
    122   bool isDifferent() { return Changed; }
    123 
    124   /// \brief Returns the number of times the current block has been visited
    125   /// along the analyzed path.
    126   unsigned blockCount() const {
    127     return NB.getContext().blockCount();
    128   }
    129 
    130   ASTContext &getASTContext() {
    131     return Eng.getContext();
    132   }
    133 
    134   const LangOptions &getLangOpts() const {
    135     return Eng.getContext().getLangOpts();
    136   }
    137 
    138   const LocationContext *getLocationContext() const {
    139     return Pred->getLocationContext();
    140   }
    141 
    142   const StackFrameContext *getStackFrame() const {
    143     return Pred->getStackFrame();
    144   }
    145 
    146   /// Return true if the current LocationContext has no caller context.
    147   bool inTopFrame() const { return getLocationContext()->inTopFrame();  }
    148 
    149   BugReporter &getBugReporter() {
    150     return Eng.getBugReporter();
    151   }
    152 
    153   SourceManager &getSourceManager() {
    154     return getBugReporter().getSourceManager();
    155   }
    156 
    157   SValBuilder &getSValBuilder() {
    158     return Eng.getSValBuilder();
    159   }
    160 
    161   SymbolManager &getSymbolManager() {
    162     return getSValBuilder().getSymbolManager();
    163   }
    164 
    165   bool isObjCGCEnabled() const {
    166     return Eng.isObjCGCEnabled();
    167   }
    168 
    169   ProgramStateManager &getStateManager() {
    170     return Eng.getStateManager();
    171   }
    172 
    173   AnalysisDeclContext *getCurrentAnalysisDeclContext() const {
    174     return Pred->getLocationContext()->getAnalysisDeclContext();
    175   }
    176 
    177   /// \brief Get the blockID.
    178   unsigned getBlockID() const {
    179     return NB.getContext().getBlock()->getBlockID();
    180   }
    181 
    182   /// \brief If the given node corresponds to a PostStore program point,
    183   /// retrieve the location region as it was uttered in the code.
    184   ///
    185   /// This utility can be useful for generating extensive diagnostics, for
    186   /// example, for finding variables that the given symbol was assigned to.
    187   static const MemRegion *getLocationRegionIfPostStore(const ExplodedNode *N) {
    188     ProgramPoint L = N->getLocation();
    189     if (Optional<PostStore> PSL = L.getAs<PostStore>())
    190       return reinterpret_cast<const MemRegion*>(PSL->getLocationValue());
    191     return nullptr;
    192   }
    193 
    194   /// \brief Get the value of arbitrary expressions at this point in the path.
    195   SVal getSVal(const Stmt *S) const {
    196     return getState()->getSVal(S, getLocationContext());
    197   }
    198 
    199   /// \brief Generates a new transition in the program state graph
    200   /// (ExplodedGraph). Uses the default CheckerContext predecessor node.
    201   ///
    202   /// @param State The state of the generated node. If not specified, the state
    203   ///        will not be changed, but the new node will have the checker's tag.
    204   /// @param Tag The tag is used to uniquely identify the creation site. If no
    205   ///        tag is specified, a default tag, unique to the given checker,
    206   ///        will be used. Tags are used to prevent states generated at
    207   ///        different sites from caching out.
    208   ExplodedNode *addTransition(ProgramStateRef State = nullptr,
    209                               const ProgramPointTag *Tag = nullptr) {
    210     return addTransitionImpl(State ? State : getState(), false, nullptr, Tag);
    211   }
    212 
    213   /// \brief Generates a new transition with the given predecessor.
    214   /// Allows checkers to generate a chain of nodes.
    215   ///
    216   /// @param State The state of the generated node.
    217   /// @param Pred The transition will be generated from the specified Pred node
    218   ///             to the newly generated node.
    219   /// @param Tag The tag to uniquely identify the creation site.
    220   ExplodedNode *addTransition(ProgramStateRef State,
    221                               ExplodedNode *Pred,
    222                               const ProgramPointTag *Tag = nullptr) {
    223     return addTransitionImpl(State, false, Pred, Tag);
    224   }
    225 
    226   /// \brief Generate a sink node. Generating a sink stops exploration of the
    227   /// given path. To create a sink node for the purpose of reporting an error,
    228   /// checkers should use generateErrorNode() instead.
    229   ExplodedNode *generateSink(ProgramStateRef State, ExplodedNode *Pred,
    230                              const ProgramPointTag *Tag = nullptr) {
    231     return addTransitionImpl(State ? State : getState(), true, Pred, Tag);
    232   }
    233 
    234   /// \brief Generate a transition to a node that will be used to report
    235   /// an error. This node will be a sink. That is, it will stop exploration of
    236   /// the given path.
    237   ///
    238   /// @param State The state of the generated node.
    239   /// @param Tag The tag to uniquely identify the creation site. If null,
    240   ///        the default tag for the checker will be used.
    241   ExplodedNode *generateErrorNode(ProgramStateRef State = nullptr,
    242                                   const ProgramPointTag *Tag = nullptr) {
    243     return generateSink(State, Pred,
    244                        (Tag ? Tag : Location.getTag()));
    245   }
    246 
    247   /// \brief Generate a transition to a node that will be used to report
    248   /// an error. This node will not be a sink. That is, exploration will
    249   /// continue along this path.
    250   ///
    251   /// @param State The state of the generated node.
    252   /// @param Tag The tag to uniquely identify the creation site. If null,
    253   ///        the default tag for the checker will be used.
    254   ExplodedNode *
    255   generateNonFatalErrorNode(ProgramStateRef State = nullptr,
    256                             const ProgramPointTag *Tag = nullptr) {
    257     return addTransition(State, (Tag ? Tag : Location.getTag()));
    258   }
    259 
    260   /// \brief Emit the diagnostics report.
    261   void emitReport(std::unique_ptr<BugReport> R) {
    262     Changed = true;
    263     Eng.getBugReporter().emitReport(std::move(R));
    264   }
    265 
    266   /// \brief Get the declaration of the called function (path-sensitive).
    267   const FunctionDecl *getCalleeDecl(const CallExpr *CE) const;
    268 
    269   /// \brief Get the name of the called function (path-sensitive).
    270   StringRef getCalleeName(const FunctionDecl *FunDecl) const;
    271 
    272   /// \brief Get the identifier of the called function (path-sensitive).
    273   const IdentifierInfo *getCalleeIdentifier(const CallExpr *CE) const {
    274     const FunctionDecl *FunDecl = getCalleeDecl(CE);
    275     if (FunDecl)
    276       return FunDecl->getIdentifier();
    277     else
    278       return nullptr;
    279   }
    280 
    281   /// \brief Get the name of the called function (path-sensitive).
    282   StringRef getCalleeName(const CallExpr *CE) const {
    283     const FunctionDecl *FunDecl = getCalleeDecl(CE);
    284     return getCalleeName(FunDecl);
    285   }
    286 
    287   /// \brief Returns true if the callee is an externally-visible function in the
    288   /// top-level namespace, such as \c malloc.
    289   ///
    290   /// If a name is provided, the function must additionally match the given
    291   /// name.
    292   ///
    293   /// Note that this deliberately excludes C++ library functions in the \c std
    294   /// namespace, but will include C library functions accessed through the
    295   /// \c std namespace. This also does not check if the function is declared
    296   /// as 'extern "C"', or if it uses C++ name mangling.
    297   static bool isCLibraryFunction(const FunctionDecl *FD,
    298                                  StringRef Name = StringRef());
    299 
    300   /// \brief Depending on wither the location corresponds to a macro, return
    301   /// either the macro name or the token spelling.
    302   ///
    303   /// This could be useful when checkers' logic depends on whether a function
    304   /// is called with a given macro argument. For example:
    305   ///   s = socket(AF_INET,..)
    306   /// If AF_INET is a macro, the result should be treated as a source of taint.
    307   ///
    308   /// \sa clang::Lexer::getSpelling(), clang::Lexer::getImmediateMacroName().
    309   StringRef getMacroNameOrSpelling(SourceLocation &Loc);
    310 
    311 private:
    312   ExplodedNode *addTransitionImpl(ProgramStateRef State,
    313                                  bool MarkAsSink,
    314                                  ExplodedNode *P = nullptr,
    315                                  const ProgramPointTag *Tag = nullptr) {
    316     // The analyzer may stop exploring if it sees a state it has previously
    317     // visited ("cache out"). The early return here is a defensive check to
    318     // prevent accidental caching out by checker API clients. Unless there is a
    319     // tag or the client checker has requested that the generated node be
    320     // marked as a sink, we assume that a client requesting a transition to a
    321     // state that is the same as the predecessor state has made a mistake. We
    322     // return the predecessor rather than cache out.
    323     //
    324     // TODO: We could potentially change the return to an assertion to alert
    325     // clients to their mistake, but several checkers (including
    326     // DereferenceChecker, CallAndMessageChecker, and DynamicTypePropagation)
    327     // rely upon the defensive behavior and would need to be updated.
    328     if (!State || (State == Pred->getState() && !Tag && !MarkAsSink))
    329       return Pred;
    330 
    331     Changed = true;
    332     const ProgramPoint &LocalLoc = (Tag ? Location.withTag(Tag) : Location);
    333     if (!P)
    334       P = Pred;
    335 
    336     ExplodedNode *node;
    337     if (MarkAsSink)
    338       node = NB.generateSink(LocalLoc, State, P);
    339     else
    340       node = NB.generateNode(LocalLoc, State, P);
    341     return node;
    342   }
    343 };
    344 
    345 } // end GR namespace
    346 
    347 } // end clang namespace
    348 
    349 #endif
    350