1 //===--- NonNullParamChecker.cpp - Undefined arguments checker -*- C++ -*--===//
2 //
3 //                     The LLVM Compiler Infrastructure
4 //
5 // This file is distributed under the University of Illinois Open Source
6 // License. See LICENSE.TXT for details.
7 //
8 //===----------------------------------------------------------------------===//
9 //
10 // This defines NonNullParamChecker, which checks for arguments expected not to
11 // be null due to:
12 //   - the corresponding parameters being declared to have nonnull attribute
13 //   - the corresponding parameters being references; since the call would form
14 //     a reference to a null pointer
15 //
16 //===----------------------------------------------------------------------===//
17 
18 #include "ClangSACheckers.h"
19 #include "clang/AST/Attr.h"
20 #include "clang/StaticAnalyzer/Core/BugReporter/BugType.h"
21 #include "clang/StaticAnalyzer/Core/Checker.h"
22 #include "clang/StaticAnalyzer/Core/CheckerManager.h"
23 #include "clang/StaticAnalyzer/Core/PathSensitive/CallEvent.h"
24 #include "clang/StaticAnalyzer/Core/PathSensitive/CheckerContext.h"
25 
26 using namespace clang;
27 using namespace ento;
28 
29 namespace {
30 class NonNullParamChecker
31   : public Checker< check::PreCall > {
32   mutable std::unique_ptr<BugType> BTAttrNonNull;
33   mutable std::unique_ptr<BugType> BTNullRefArg;
34 
35 public:
36 
37   void checkPreCall(const CallEvent &Call, CheckerContext &C) const;
38 
39   BugReport *genReportNullAttrNonNull(const ExplodedNode *ErrorN,
40                                       const Expr *ArgE) const;
41   BugReport *genReportReferenceToNullPointer(const ExplodedNode *ErrorN,
42                                              const Expr *ArgE) const;
43 };
44 } // end anonymous namespace
45 
46 void NonNullParamChecker::checkPreCall(const CallEvent &Call,
47                                        CheckerContext &C) const {
48   const Decl *FD = Call.getDecl();
49   if (!FD)
50     return;
51 
52   // FIXME: This is wrong; there can be multiple attributes with different sets
53   // of non-null parameter indices.
54   const NonNullAttr *Att = FD->getAttr<NonNullAttr>();
55 
56   ProgramStateRef state = C.getState();
57 
58   CallEvent::param_type_iterator TyI = Call.param_type_begin(),
59                                  TyE = Call.param_type_end();
60 
61   for (unsigned idx = 0, count = Call.getNumArgs(); idx != count; ++idx){
62 
63     // Check if the parameter is a reference. We want to report when reference
64     // to a null pointer is passed as a paramter.
65     bool haveRefTypeParam = false;
66     if (TyI != TyE) {
67       haveRefTypeParam = (*TyI)->isReferenceType();
68       TyI++;
69     }
70 
71     bool haveAttrNonNull = Att && Att->isNonNull(idx);
72     if (!haveAttrNonNull) {
73       // Check if the parameter is also marked 'nonnull'.
74       ArrayRef<ParmVarDecl*> parms = Call.parameters();
75       if (idx < parms.size())
76         haveAttrNonNull = parms[idx]->hasAttr<NonNullAttr>();
77     }
78 
79     if (!haveRefTypeParam && !haveAttrNonNull)
80       continue;
81 
82     // If the value is unknown or undefined, we can't perform this check.
83     const Expr *ArgE = Call.getArgExpr(idx);
84     SVal V = Call.getArgSVal(idx);
85     Optional<DefinedSVal> DV = V.getAs<DefinedSVal>();
86     if (!DV)
87       continue;
88 
89     // Process the case when the argument is not a location.
90     assert(!haveRefTypeParam || DV->getAs<Loc>());
91 
92     if (haveAttrNonNull && !DV->getAs<Loc>()) {
93       // If the argument is a union type, we want to handle a potential
94       // transparent_union GCC extension.
95       if (!ArgE)
96         continue;
97 
98       QualType T = ArgE->getType();
99       const RecordType *UT = T->getAsUnionType();
100       if (!UT || !UT->getDecl()->hasAttr<TransparentUnionAttr>())
101         continue;
102 
103       if (Optional<nonloc::CompoundVal> CSV =
104               DV->getAs<nonloc::CompoundVal>()) {
105         nonloc::CompoundVal::iterator CSV_I = CSV->begin();
106         assert(CSV_I != CSV->end());
107         V = *CSV_I;
108         DV = V.getAs<DefinedSVal>();
109         assert(++CSV_I == CSV->end());
110         // FIXME: Handle (some_union){ some_other_union_val }, which turns into
111         // a LazyCompoundVal inside a CompoundVal.
112         if (!V.getAs<Loc>())
113           continue;
114         // Retrieve the corresponding expression.
115         if (const CompoundLiteralExpr *CE = dyn_cast<CompoundLiteralExpr>(ArgE))
116           if (const InitListExpr *IE =
117                 dyn_cast<InitListExpr>(CE->getInitializer()))
118              ArgE = dyn_cast<Expr>(*(IE->begin()));
119 
120       } else {
121         // FIXME: Handle LazyCompoundVals?
122         continue;
123       }
124     }
125 
126     ConstraintManager &CM = C.getConstraintManager();
127     ProgramStateRef stateNotNull, stateNull;
128     std::tie(stateNotNull, stateNull) = CM.assumeDual(state, *DV);
129 
130     if (stateNull && !stateNotNull) {
131       // Generate an error node.  Check for a null node in case
132       // we cache out.
133       if (ExplodedNode *errorNode = C.generateSink(stateNull)) {
134 
135         BugReport *R = nullptr;
136         if (haveAttrNonNull)
137           R = genReportNullAttrNonNull(errorNode, ArgE);
138         else if (haveRefTypeParam)
139           R = genReportReferenceToNullPointer(errorNode, ArgE);
140 
141         // Highlight the range of the argument that was null.
142         R->addRange(Call.getArgSourceRange(idx));
143 
144         // Emit the bug report.
145         C.emitReport(R);
146       }
147 
148       // Always return.  Either we cached out or we just emitted an error.
149       return;
150     }
151 
152     // If a pointer value passed the check we should assume that it is
153     // indeed not null from this point forward.
154     assert(stateNotNull);
155     state = stateNotNull;
156   }
157 
158   // If we reach here all of the arguments passed the nonnull check.
159   // If 'state' has been updated generated a new node.
160   C.addTransition(state);
161 }
162 
163 BugReport *NonNullParamChecker::genReportNullAttrNonNull(
164   const ExplodedNode *ErrorNode, const Expr *ArgE) const {
165   // Lazily allocate the BugType object if it hasn't already been
166   // created. Ownership is transferred to the BugReporter object once
167   // the BugReport is passed to 'EmitWarning'.
168   if (!BTAttrNonNull)
169     BTAttrNonNull.reset(new BugType(
170         this, "Argument with 'nonnull' attribute passed null", "API"));
171 
172   BugReport *R = new BugReport(*BTAttrNonNull,
173                   "Null pointer passed as an argument to a 'nonnull' parameter",
174                   ErrorNode);
175   if (ArgE)
176     bugreporter::trackNullOrUndefValue(ErrorNode, ArgE, *R);
177 
178   return R;
179 }
180 
181 BugReport *NonNullParamChecker::genReportReferenceToNullPointer(
182   const ExplodedNode *ErrorNode, const Expr *ArgE) const {
183   if (!BTNullRefArg)
184     BTNullRefArg.reset(new BuiltinBug(this, "Dereference of null pointer"));
185 
186   BugReport *R = new BugReport(*BTNullRefArg,
187                                "Forming reference to null pointer",
188                                ErrorNode);
189   if (ArgE) {
190     const Expr *ArgEDeref = bugreporter::getDerefExpr(ArgE);
191     if (!ArgEDeref)
192       ArgEDeref = ArgE;
193     bugreporter::trackNullOrUndefValue(ErrorNode,
194                                        ArgEDeref,
195                                        *R);
196   }
197   return R;
198 
199 }
200 
201 void ento::registerNonNullParamChecker(CheckerManager &mgr) {
202   mgr.registerChecker<NonNullParamChecker>();
203 }
204