NSErrorChecker.cpp revision 243830
1//=- NSErrorChecker.cpp - Coding conventions for uses of NSError -*- C++ -*-==// 2// 3// The LLVM Compiler Infrastructure 4// 5// This file is distributed under the University of Illinois Open Source 6// License. See LICENSE.TXT for details. 7// 8//===----------------------------------------------------------------------===// 9// 10// This file defines a CheckNSError, a flow-insenstive check 11// that determines if an Objective-C class interface correctly returns 12// a non-void return type. 13// 14// File under feature request PR 2600. 15// 16//===----------------------------------------------------------------------===// 17 18#include "ClangSACheckers.h" 19#include "clang/StaticAnalyzer/Core/Checker.h" 20#include "clang/StaticAnalyzer/Core/CheckerManager.h" 21#include "clang/StaticAnalyzer/Core/PathSensitive/CheckerContext.h" 22#include "clang/StaticAnalyzer/Core/PathSensitive/ProgramStateTrait.h" 23#include "clang/StaticAnalyzer/Core/BugReporter/BugType.h" 24#include "clang/AST/DeclObjC.h" 25#include "clang/AST/Decl.h" 26#include "llvm/ADT/SmallVector.h" 27 28using namespace clang; 29using namespace ento; 30 31static bool IsNSError(QualType T, IdentifierInfo *II); 32static bool IsCFError(QualType T, IdentifierInfo *II); 33 34//===----------------------------------------------------------------------===// 35// NSErrorMethodChecker 36//===----------------------------------------------------------------------===// 37 38namespace { 39class NSErrorMethodChecker 40 : public Checker< check::ASTDecl<ObjCMethodDecl> > { 41 mutable IdentifierInfo *II; 42 43public: 44 NSErrorMethodChecker() : II(0) { } 45 46 void checkASTDecl(const ObjCMethodDecl *D, 47 AnalysisManager &mgr, BugReporter &BR) const; 48}; 49} 50 51void NSErrorMethodChecker::checkASTDecl(const ObjCMethodDecl *D, 52 AnalysisManager &mgr, 53 BugReporter &BR) const { 54 if (!D->isThisDeclarationADefinition()) 55 return; 56 if (!D->getResultType()->isVoidType()) 57 return; 58 59 if (!II) 60 II = &D->getASTContext().Idents.get("NSError"); 61 62 bool hasNSError = false; 63 for (ObjCMethodDecl::param_const_iterator 64 I = D->param_begin(), E = D->param_end(); I != E; ++I) { 65 if (IsNSError((*I)->getType(), II)) { 66 hasNSError = true; 67 break; 68 } 69 } 70 71 if (hasNSError) { 72 const char *err = "Method accepting NSError** " 73 "should have a non-void return value to indicate whether or not an " 74 "error occurred"; 75 PathDiagnosticLocation L = 76 PathDiagnosticLocation::create(D, BR.getSourceManager()); 77 BR.EmitBasicReport(D, "Bad return type when passing NSError**", 78 "Coding conventions (Apple)", err, L); 79 } 80} 81 82//===----------------------------------------------------------------------===// 83// CFErrorFunctionChecker 84//===----------------------------------------------------------------------===// 85 86namespace { 87class CFErrorFunctionChecker 88 : public Checker< check::ASTDecl<FunctionDecl> > { 89 mutable IdentifierInfo *II; 90 91public: 92 CFErrorFunctionChecker() : II(0) { } 93 94 void checkASTDecl(const FunctionDecl *D, 95 AnalysisManager &mgr, BugReporter &BR) const; 96}; 97} 98 99void CFErrorFunctionChecker::checkASTDecl(const FunctionDecl *D, 100 AnalysisManager &mgr, 101 BugReporter &BR) const { 102 if (!D->doesThisDeclarationHaveABody()) 103 return; 104 if (!D->getResultType()->isVoidType()) 105 return; 106 107 if (!II) 108 II = &D->getASTContext().Idents.get("CFErrorRef"); 109 110 bool hasCFError = false; 111 for (FunctionDecl::param_const_iterator 112 I = D->param_begin(), E = D->param_end(); I != E; ++I) { 113 if (IsCFError((*I)->getType(), II)) { 114 hasCFError = true; 115 break; 116 } 117 } 118 119 if (hasCFError) { 120 const char *err = "Function accepting CFErrorRef* " 121 "should have a non-void return value to indicate whether or not an " 122 "error occurred"; 123 PathDiagnosticLocation L = 124 PathDiagnosticLocation::create(D, BR.getSourceManager()); 125 BR.EmitBasicReport(D, "Bad return type when passing CFErrorRef*", 126 "Coding conventions (Apple)", err, L); 127 } 128} 129 130//===----------------------------------------------------------------------===// 131// NSOrCFErrorDerefChecker 132//===----------------------------------------------------------------------===// 133 134namespace { 135 136class NSErrorDerefBug : public BugType { 137public: 138 NSErrorDerefBug() : BugType("NSError** null dereference", 139 "Coding conventions (Apple)") {} 140}; 141 142class CFErrorDerefBug : public BugType { 143public: 144 CFErrorDerefBug() : BugType("CFErrorRef* null dereference", 145 "Coding conventions (Apple)") {} 146}; 147 148} 149 150namespace { 151class NSOrCFErrorDerefChecker 152 : public Checker< check::Location, 153 check::Event<ImplicitNullDerefEvent> > { 154 mutable IdentifierInfo *NSErrorII, *CFErrorII; 155public: 156 bool ShouldCheckNSError, ShouldCheckCFError; 157 NSOrCFErrorDerefChecker() : NSErrorII(0), CFErrorII(0), 158 ShouldCheckNSError(0), ShouldCheckCFError(0) { } 159 160 void checkLocation(SVal loc, bool isLoad, const Stmt *S, 161 CheckerContext &C) const; 162 void checkEvent(ImplicitNullDerefEvent event) const; 163}; 164} 165 166typedef llvm::ImmutableMap<SymbolRef, unsigned> ErrorOutFlag; 167REGISTER_TRAIT_WITH_PROGRAMSTATE(NSErrorOut, ErrorOutFlag) 168REGISTER_TRAIT_WITH_PROGRAMSTATE(CFErrorOut, ErrorOutFlag) 169 170template <typename T> 171static bool hasFlag(SVal val, ProgramStateRef state) { 172 if (SymbolRef sym = val.getAsSymbol()) 173 if (const unsigned *attachedFlags = state->get<T>(sym)) 174 return *attachedFlags; 175 return false; 176} 177 178template <typename T> 179static void setFlag(ProgramStateRef state, SVal val, CheckerContext &C) { 180 // We tag the symbol that the SVal wraps. 181 if (SymbolRef sym = val.getAsSymbol()) 182 C.addTransition(state->set<T>(sym, true)); 183} 184 185static QualType parameterTypeFromSVal(SVal val, CheckerContext &C) { 186 const StackFrameContext * 187 SFC = C.getLocationContext()->getCurrentStackFrame(); 188 if (const loc::MemRegionVal* X = dyn_cast<loc::MemRegionVal>(&val)) { 189 const MemRegion* R = X->getRegion(); 190 if (const VarRegion *VR = R->getAs<VarRegion>()) 191 if (const StackArgumentsSpaceRegion * 192 stackReg = dyn_cast<StackArgumentsSpaceRegion>(VR->getMemorySpace())) 193 if (stackReg->getStackFrame() == SFC) 194 return VR->getValueType(); 195 } 196 197 return QualType(); 198} 199 200void NSOrCFErrorDerefChecker::checkLocation(SVal loc, bool isLoad, 201 const Stmt *S, 202 CheckerContext &C) const { 203 if (!isLoad) 204 return; 205 if (loc.isUndef() || !isa<Loc>(loc)) 206 return; 207 208 ASTContext &Ctx = C.getASTContext(); 209 ProgramStateRef state = C.getState(); 210 211 // If we are loading from NSError**/CFErrorRef* parameter, mark the resulting 212 // SVal so that we can later check it when handling the 213 // ImplicitNullDerefEvent event. 214 // FIXME: Cumbersome! Maybe add hook at construction of SVals at start of 215 // function ? 216 217 QualType parmT = parameterTypeFromSVal(loc, C); 218 if (parmT.isNull()) 219 return; 220 221 if (!NSErrorII) 222 NSErrorII = &Ctx.Idents.get("NSError"); 223 if (!CFErrorII) 224 CFErrorII = &Ctx.Idents.get("CFErrorRef"); 225 226 if (ShouldCheckNSError && IsNSError(parmT, NSErrorII)) { 227 setFlag<NSErrorOut>(state, state->getSVal(cast<Loc>(loc)), C); 228 return; 229 } 230 231 if (ShouldCheckCFError && IsCFError(parmT, CFErrorII)) { 232 setFlag<CFErrorOut>(state, state->getSVal(cast<Loc>(loc)), C); 233 return; 234 } 235} 236 237void NSOrCFErrorDerefChecker::checkEvent(ImplicitNullDerefEvent event) const { 238 if (event.IsLoad) 239 return; 240 241 SVal loc = event.Location; 242 ProgramStateRef state = event.SinkNode->getState(); 243 BugReporter &BR = *event.BR; 244 245 bool isNSError = hasFlag<NSErrorOut>(loc, state); 246 bool isCFError = false; 247 if (!isNSError) 248 isCFError = hasFlag<CFErrorOut>(loc, state); 249 250 if (!(isNSError || isCFError)) 251 return; 252 253 // Storing to possible null NSError/CFErrorRef out parameter. 254 255 // Emit an error. 256 std::string err; 257 llvm::raw_string_ostream os(err); 258 os << "Potential null dereference. According to coding standards "; 259 260 if (isNSError) 261 os << "in 'Creating and Returning NSError Objects' the parameter '"; 262 else 263 os << "documented in CoreFoundation/CFError.h the parameter '"; 264 265 os << "' may be null."; 266 267 BugType *bug = 0; 268 if (isNSError) 269 bug = new NSErrorDerefBug(); 270 else 271 bug = new CFErrorDerefBug(); 272 BugReport *report = new BugReport(*bug, os.str(), 273 event.SinkNode); 274 BR.emitReport(report); 275} 276 277static bool IsNSError(QualType T, IdentifierInfo *II) { 278 279 const PointerType* PPT = T->getAs<PointerType>(); 280 if (!PPT) 281 return false; 282 283 const ObjCObjectPointerType* PT = 284 PPT->getPointeeType()->getAs<ObjCObjectPointerType>(); 285 286 if (!PT) 287 return false; 288 289 const ObjCInterfaceDecl *ID = PT->getInterfaceDecl(); 290 291 // FIXME: Can ID ever be NULL? 292 if (ID) 293 return II == ID->getIdentifier(); 294 295 return false; 296} 297 298static bool IsCFError(QualType T, IdentifierInfo *II) { 299 const PointerType* PPT = T->getAs<PointerType>(); 300 if (!PPT) return false; 301 302 const TypedefType* TT = PPT->getPointeeType()->getAs<TypedefType>(); 303 if (!TT) return false; 304 305 return TT->getDecl()->getIdentifier() == II; 306} 307 308void ento::registerNSErrorChecker(CheckerManager &mgr) { 309 mgr.registerChecker<NSErrorMethodChecker>(); 310 NSOrCFErrorDerefChecker * 311 checker = mgr.registerChecker<NSOrCFErrorDerefChecker>(); 312 checker->ShouldCheckNSError = true; 313} 314 315void ento::registerCFErrorChecker(CheckerManager &mgr) { 316 mgr.registerChecker<CFErrorFunctionChecker>(); 317 NSOrCFErrorDerefChecker * 318 checker = mgr.registerChecker<NSOrCFErrorDerefChecker>(); 319 checker->ShouldCheckCFError = true; 320} 321