1 //=- NSErrorChecker.cpp - Coding conventions for uses of NSError -*- C++ -*-==//
2 //
3 //                     The LLVM Compiler Infrastructure
4 //
5 // This file is distributed under the University of Illinois Open Source
6 // License. See LICENSE.TXT for details.
7 //
8 //===----------------------------------------------------------------------===//
9 //
10 //  This file defines a CheckNSError, a flow-insenstive check
11 //  that determines if an Objective-C class interface correctly returns
12 //  a non-void return type.
13 //
14 //  File under feature request PR 2600.
15 //
16 //===----------------------------------------------------------------------===//
17 
18 #include "ClangSACheckers.h"
19 #include "clang/StaticAnalyzer/Core/Checker.h"
20 #include "clang/StaticAnalyzer/Core/CheckerManager.h"
21 #include "clang/StaticAnalyzer/Core/PathSensitive/CheckerContext.h"
22 #include "clang/StaticAnalyzer/Core/PathSensitive/ProgramStateTrait.h"
23 #include "clang/StaticAnalyzer/Core/BugReporter/BugType.h"
24 #include "clang/AST/DeclObjC.h"
25 #include "clang/AST/Decl.h"
26 #include "llvm/ADT/SmallVector.h"
27 
28 using namespace clang;
29 using namespace ento;
30 
31 static bool IsNSError(QualType T, IdentifierInfo *II);
32 static bool IsCFError(QualType T, IdentifierInfo *II);
33 
34 //===----------------------------------------------------------------------===//
35 // NSErrorMethodChecker
36 //===----------------------------------------------------------------------===//
37 
38 namespace {
39 class NSErrorMethodChecker
40     : public Checker< check::ASTDecl<ObjCMethodDecl> > {
41   mutable IdentifierInfo *II;
42 
43 public:
44   NSErrorMethodChecker() : II(0) { }
45 
46   void checkASTDecl(const ObjCMethodDecl *D,
47                     AnalysisManager &mgr, BugReporter &BR) const;
48 };
49 }
50 
51 void NSErrorMethodChecker::checkASTDecl(const ObjCMethodDecl *D,
52                                         AnalysisManager &mgr,
53                                         BugReporter &BR) const {
54   if (!D->isThisDeclarationADefinition())
55     return;
56   if (!D->getResultType()->isVoidType())
57     return;
58 
59   if (!II)
60     II = &D->getASTContext().Idents.get("NSError");
61 
62   bool hasNSError = false;
63   for (ObjCMethodDecl::param_const_iterator
64          I = D->param_begin(), E = D->param_end(); I != E; ++I)  {
65     if (IsNSError((*I)->getType(), II)) {
66       hasNSError = true;
67       break;
68     }
69   }
70 
71   if (hasNSError) {
72     const char *err = "Method accepting NSError** "
73         "should have a non-void return value to indicate whether or not an "
74         "error occurred";
75     PathDiagnosticLocation L =
76       PathDiagnosticLocation::create(D, BR.getSourceManager());
77     BR.EmitBasicReport("Bad return type when passing NSError**",
78                        "Coding conventions (Apple)", err, L);
79   }
80 }
81 
82 //===----------------------------------------------------------------------===//
83 // CFErrorFunctionChecker
84 //===----------------------------------------------------------------------===//
85 
86 namespace {
87 class CFErrorFunctionChecker
88     : public Checker< check::ASTDecl<FunctionDecl> > {
89   mutable IdentifierInfo *II;
90 
91 public:
92   CFErrorFunctionChecker() : II(0) { }
93 
94   void checkASTDecl(const FunctionDecl *D,
95                     AnalysisManager &mgr, BugReporter &BR) const;
96 };
97 }
98 
99 void CFErrorFunctionChecker::checkASTDecl(const FunctionDecl *D,
100                                         AnalysisManager &mgr,
101                                         BugReporter &BR) const {
102   if (!D->doesThisDeclarationHaveABody())
103     return;
104   if (!D->getResultType()->isVoidType())
105     return;
106 
107   if (!II)
108     II = &D->getASTContext().Idents.get("CFErrorRef");
109 
110   bool hasCFError = false;
111   for (FunctionDecl::param_const_iterator
112          I = D->param_begin(), E = D->param_end(); I != E; ++I)  {
113     if (IsCFError((*I)->getType(), II)) {
114       hasCFError = true;
115       break;
116     }
117   }
118 
119   if (hasCFError) {
120     const char *err = "Function accepting CFErrorRef* "
121         "should have a non-void return value to indicate whether or not an "
122         "error occurred";
123     PathDiagnosticLocation L =
124       PathDiagnosticLocation::create(D, BR.getSourceManager());
125     BR.EmitBasicReport("Bad return type when passing CFErrorRef*",
126                        "Coding conventions (Apple)", err, L);
127   }
128 }
129 
130 //===----------------------------------------------------------------------===//
131 // NSOrCFErrorDerefChecker
132 //===----------------------------------------------------------------------===//
133 
134 namespace {
135 
136 class NSErrorDerefBug : public BugType {
137 public:
138   NSErrorDerefBug() : BugType("NSError** null dereference",
139                               "Coding conventions (Apple)") {}
140 };
141 
142 class CFErrorDerefBug : public BugType {
143 public:
144   CFErrorDerefBug() : BugType("CFErrorRef* null dereference",
145                               "Coding conventions (Apple)") {}
146 };
147 
148 }
149 
150 namespace {
151 class NSOrCFErrorDerefChecker
152     : public Checker< check::Location,
153                         check::Event<ImplicitNullDerefEvent> > {
154   mutable IdentifierInfo *NSErrorII, *CFErrorII;
155 public:
156   bool ShouldCheckNSError, ShouldCheckCFError;
157   NSOrCFErrorDerefChecker() : NSErrorII(0), CFErrorII(0),
158                               ShouldCheckNSError(0), ShouldCheckCFError(0) { }
159 
160   void checkLocation(SVal loc, bool isLoad, CheckerContext &C) const;
161   void checkEvent(ImplicitNullDerefEvent event) const;
162 };
163 }
164 
165 namespace { struct NSErrorOut {}; }
166 namespace { struct CFErrorOut {}; }
167 
168 typedef llvm::ImmutableMap<SymbolRef, unsigned> ErrorOutFlag;
169 
170 namespace clang {
171 namespace ento {
172   template <>
173   struct ProgramStateTrait<NSErrorOut> : public ProgramStatePartialTrait<ErrorOutFlag> {
174     static void *GDMIndex() { static int index = 0; return &index; }
175   };
176   template <>
177   struct ProgramStateTrait<CFErrorOut> : public ProgramStatePartialTrait<ErrorOutFlag> {
178     static void *GDMIndex() { static int index = 0; return &index; }
179   };
180 }
181 }
182 
183 template <typename T>
184 static bool hasFlag(SVal val, const ProgramState *state) {
185   if (SymbolRef sym = val.getAsSymbol())
186     if (const unsigned *attachedFlags = state->get<T>(sym))
187       return *attachedFlags;
188   return false;
189 }
190 
191 template <typename T>
192 static void setFlag(const ProgramState *state, SVal val, CheckerContext &C) {
193   // We tag the symbol that the SVal wraps.
194   if (SymbolRef sym = val.getAsSymbol())
195     C.addTransition(state->set<T>(sym, true));
196 }
197 
198 static QualType parameterTypeFromSVal(SVal val, CheckerContext &C) {
199   const StackFrameContext *
200     SFC = C.getPredecessor()->getLocationContext()->getCurrentStackFrame();
201   if (const loc::MemRegionVal* X = dyn_cast<loc::MemRegionVal>(&val)) {
202     const MemRegion* R = X->getRegion();
203     if (const VarRegion *VR = R->getAs<VarRegion>())
204       if (const StackArgumentsSpaceRegion *
205           stackReg = dyn_cast<StackArgumentsSpaceRegion>(VR->getMemorySpace()))
206         if (stackReg->getStackFrame() == SFC)
207           return VR->getValueType();
208   }
209 
210   return QualType();
211 }
212 
213 void NSOrCFErrorDerefChecker::checkLocation(SVal loc, bool isLoad,
214                                             CheckerContext &C) const {
215   if (!isLoad)
216     return;
217   if (loc.isUndef() || !isa<Loc>(loc))
218     return;
219 
220   ASTContext &Ctx = C.getASTContext();
221   const ProgramState *state = C.getState();
222 
223   // If we are loading from NSError**/CFErrorRef* parameter, mark the resulting
224   // SVal so that we can later check it when handling the
225   // ImplicitNullDerefEvent event.
226   // FIXME: Cumbersome! Maybe add hook at construction of SVals at start of
227   // function ?
228 
229   QualType parmT = parameterTypeFromSVal(loc, C);
230   if (parmT.isNull())
231     return;
232 
233   if (!NSErrorII)
234     NSErrorII = &Ctx.Idents.get("NSError");
235   if (!CFErrorII)
236     CFErrorII = &Ctx.Idents.get("CFErrorRef");
237 
238   if (ShouldCheckNSError && IsNSError(parmT, NSErrorII)) {
239     setFlag<NSErrorOut>(state, state->getSVal(cast<Loc>(loc)), C);
240     return;
241   }
242 
243   if (ShouldCheckCFError && IsCFError(parmT, CFErrorII)) {
244     setFlag<CFErrorOut>(state, state->getSVal(cast<Loc>(loc)), C);
245     return;
246   }
247 }
248 
249 void NSOrCFErrorDerefChecker::checkEvent(ImplicitNullDerefEvent event) const {
250   if (event.IsLoad)
251     return;
252 
253   SVal loc = event.Location;
254   const ProgramState *state = event.SinkNode->getState();
255   BugReporter &BR = *event.BR;
256 
257   bool isNSError = hasFlag<NSErrorOut>(loc, state);
258   bool isCFError = false;
259   if (!isNSError)
260     isCFError = hasFlag<CFErrorOut>(loc, state);
261 
262   if (!(isNSError || isCFError))
263     return;
264 
265   // Storing to possible null NSError/CFErrorRef out parameter.
266 
267   // Emit an error.
268   std::string err;
269   llvm::raw_string_ostream os(err);
270     os << "Potential null dereference.  According to coding standards ";
271 
272   if (isNSError)
273     os << "in 'Creating and Returning NSError Objects' the parameter '";
274   else
275     os << "documented in CoreFoundation/CFError.h the parameter '";
276 
277   os  << "' may be null.";
278 
279   BugType *bug = 0;
280   if (isNSError)
281     bug = new NSErrorDerefBug();
282   else
283     bug = new CFErrorDerefBug();
284   BugReport *report = new BugReport(*bug, os.str(),
285                                                     event.SinkNode);
286   BR.EmitReport(report);
287 }
288 
289 static bool IsNSError(QualType T, IdentifierInfo *II) {
290 
291   const PointerType* PPT = T->getAs<PointerType>();
292   if (!PPT)
293     return false;
294 
295   const ObjCObjectPointerType* PT =
296     PPT->getPointeeType()->getAs<ObjCObjectPointerType>();
297 
298   if (!PT)
299     return false;
300 
301   const ObjCInterfaceDecl *ID = PT->getInterfaceDecl();
302 
303   // FIXME: Can ID ever be NULL?
304   if (ID)
305     return II == ID->getIdentifier();
306 
307   return false;
308 }
309 
310 static bool IsCFError(QualType T, IdentifierInfo *II) {
311   const PointerType* PPT = T->getAs<PointerType>();
312   if (!PPT) return false;
313 
314   const TypedefType* TT = PPT->getPointeeType()->getAs<TypedefType>();
315   if (!TT) return false;
316 
317   return TT->getDecl()->getIdentifier() == II;
318 }
319 
320 void ento::registerNSErrorChecker(CheckerManager &mgr) {
321   mgr.registerChecker<NSErrorMethodChecker>();
322   NSOrCFErrorDerefChecker *
323     checker = mgr.registerChecker<NSOrCFErrorDerefChecker>();
324   checker->ShouldCheckNSError = true;
325 }
326 
327 void ento::registerCFErrorChecker(CheckerManager &mgr) {
328   mgr.registerChecker<CFErrorFunctionChecker>();
329   NSOrCFErrorDerefChecker *
330     checker = mgr.registerChecker<NSOrCFErrorDerefChecker>();
331   checker->ShouldCheckCFError = true;
332 }
333