1 //== ObjCContainersASTChecker.cpp - CoreFoundation containers API *- C++ -*-==//
2 //
3 //                     The LLVM Compiler Infrastructure
4 //
5 // This file is distributed under the University of Illinois Open Source
6 // License. See LICENSE.TXT for details.
7 //
8 //===----------------------------------------------------------------------===//
9 //
10 // An AST checker that looks for common pitfalls when using 'CFArray',
11 // 'CFDictionary', 'CFSet' APIs.
12 //
13 //===----------------------------------------------------------------------===//
14 #include "ClangSACheckers.h"
15 #include "clang/Analysis/AnalysisContext.h"
16 #include "clang/AST/StmtVisitor.h"
17 #include "clang/Basic/TargetInfo.h"
18 #include "clang/StaticAnalyzer/Core/Checker.h"
19 #include "clang/StaticAnalyzer/Core/BugReporter/BugReporter.h"
20 #include "clang/StaticAnalyzer/Core/PathSensitive/AnalysisManager.h"
21 #include "llvm/Support/raw_ostream.h"
22 
23 using namespace clang;
24 using namespace ento;
25 
26 namespace {
27 class WalkAST : public StmtVisitor<WalkAST> {
28   BugReporter &BR;
29   AnalysisDeclContext* AC;
30   ASTContext &ASTC;
31   uint64_t PtrWidth;
32 
33   static const unsigned InvalidArgIndex = UINT_MAX;
34 
35   /// Check if the type has pointer size (very conservative).
36   inline bool isPointerSize(const Type *T) {
37     if (!T)
38       return true;
39     if (T->isIncompleteType())
40       return true;
41     return (ASTC.getTypeSize(T) == PtrWidth);
42   }
43 
44   /// Check if the type is a pointer/array to pointer sized values.
45   inline bool hasPointerToPointerSizedType(const Expr *E) {
46     QualType T = E->getType();
47 
48     // The type could be either a pointer or array.
49     const Type *TP = T.getTypePtr();
50     QualType PointeeT = TP->getPointeeType();
51     if (!PointeeT.isNull())
52       return isPointerSize(PointeeT.getTypePtr());
53 
54     if (const Type *TElem = TP->getArrayElementTypeNoTypeQual())
55       return isPointerSize(TElem);
56 
57     // The type must be an array/pointer type.
58 
59     // This could be a null constant, which is allowed.
60     if (E->isNullPointerConstant(ASTC, Expr::NPC_ValueDependentIsNull))
61       return true;
62     return false;
63   }
64 
65 public:
66   WalkAST(BugReporter &br, AnalysisDeclContext* ac)
67   : BR(br), AC(ac), ASTC(AC->getASTContext()),
68     PtrWidth(ASTC.getTargetInfo().getPointerWidth(0)) {}
69 
70   // Statement visitor methods.
71   void VisitChildren(Stmt *S);
72   void VisitStmt(Stmt *S) { VisitChildren(S); }
73   void VisitCallExpr(CallExpr *CE);
74 };
75 } // end anonymous namespace
76 
77 static StringRef getCalleeName(CallExpr *CE) {
78   const FunctionDecl *FD = CE->getDirectCallee();
79   if (!FD)
80     return StringRef();
81 
82   IdentifierInfo *II = FD->getIdentifier();
83   if (!II)   // if no identifier, not a simple C function
84     return StringRef();
85 
86   return II->getName();
87 }
88 
89 void WalkAST::VisitCallExpr(CallExpr *CE) {
90   StringRef Name = getCalleeName(CE);
91   if (Name.empty())
92     return;
93 
94   const Expr *Arg = 0;
95   unsigned ArgNum = InvalidArgIndex;
96 
97   if (Name.equals("CFArrayCreate") || Name.equals("CFSetCreate")) {
98     ArgNum = 1;
99     Arg = CE->getArg(ArgNum)->IgnoreParenCasts();
100     if (hasPointerToPointerSizedType(Arg))
101         return;
102   }
103 
104   if (Arg == 0 && Name.equals("CFDictionaryCreate")) {
105     // Check first argument.
106     ArgNum = 1;
107     Arg = CE->getArg(ArgNum)->IgnoreParenCasts();
108     if (hasPointerToPointerSizedType(Arg)) {
109       // Check second argument.
110       ArgNum = 2;
111       Arg = CE->getArg(ArgNum)->IgnoreParenCasts();
112       if (hasPointerToPointerSizedType(Arg))
113         // Both are good, return.
114         return;
115     }
116   }
117 
118   if (ArgNum != InvalidArgIndex) {
119     assert(ArgNum == 1 || ArgNum == 2);
120 
121     llvm::SmallString<256> BufName;
122     llvm::raw_svector_ostream OsName(BufName);
123     assert(ArgNum == 1 || ArgNum == 2);
124     OsName << " Invalid use of '" << Name << "'" ;
125 
126     llvm::SmallString<256> Buf;
127     llvm::raw_svector_ostream Os(Buf);
128     Os << " The "<< ((ArgNum == 1) ? "first" : "second") << " argument to '"
129         << Name << "' must be a C array of pointer-sized values, not '"
130         << Arg->getType().getAsString() << "'";
131 
132     SourceRange R = Arg->getSourceRange();
133     PathDiagnosticLocation CELoc =
134         PathDiagnosticLocation::createBegin(CE, BR.getSourceManager(), AC);
135     BR.EmitBasicReport(OsName.str(), "Core Foundation/Objective-C API",
136                        Os.str(), CELoc, &R, 1);
137   }
138 
139   // Recurse and check children.
140   VisitChildren(CE);
141 }
142 
143 void WalkAST::VisitChildren(Stmt *S) {
144   for (Stmt::child_iterator I = S->child_begin(), E = S->child_end(); I!=E; ++I)
145     if (Stmt *child = *I)
146       Visit(child);
147 }
148 
149 namespace {
150 class ObjCContainersASTChecker : public Checker<check::ASTCodeBody> {
151 public:
152 
153   void checkASTCodeBody(const Decl *D, AnalysisManager& Mgr,
154                         BugReporter &BR) const {
155     WalkAST walker(BR, Mgr.getAnalysisDeclContext(D));
156     walker.Visit(D->getBody());
157   }
158 };
159 }
160 
161 void ento::registerObjCContainersASTChecker(CheckerManager &mgr) {
162   mgr.registerChecker<ObjCContainersASTChecker>();
163 }
164