MacOSXAPIChecker.cpp revision 219077 
1// MacOSXAPIChecker.h - Checks proper use of various MacOS X APIs --*- C++ -*-//
2//
3//                     The LLVM Compiler Infrastructure
4//
5// This file is distributed under the University of Illinois Open Source
6// License. See LICENSE.TXT for details.
7//
8//===----------------------------------------------------------------------===//
9//
10// This defines MacOSXAPIChecker, which is an assortment of checks on calls
11// to various, widely used Mac OS X functions.
12//
13// FIXME: What's currently in BasicObjCFoundationChecks.cpp should be migrated
14// to here, using the new Checker interface.
15//
16//===----------------------------------------------------------------------===//
17
18#include "ClangSACheckers.h"
19#include "clang/StaticAnalyzer/Core/CheckerV2.h"
20#include "clang/StaticAnalyzer/Core/CheckerManager.h"
21#include "clang/StaticAnalyzer/Core/PathSensitive/CheckerContext.h"
22#include "clang/StaticAnalyzer/Core/BugReporter/BugType.h"
23#include "clang/StaticAnalyzer/Core/PathSensitive/GRStateTrait.h"
24#include "clang/Basic/TargetInfo.h"
25#include "llvm/ADT/SmallString.h"
26#include "llvm/ADT/StringSwitch.h"
27#include "llvm/Support/raw_ostream.h"
28
29using namespace clang;
30using namespace ento;
31
32namespace {
33class MacOSXAPIChecker : public CheckerV2< check::PreStmt<CallExpr> > {
34  enum SubChecks {
35    DispatchOnce = 0,
36    DispatchOnceF,
37    NumChecks
38  };
39
40  mutable BugType *BTypes[NumChecks];
41
42public:
43  MacOSXAPIChecker() { memset(BTypes, 0, sizeof(*BTypes) * NumChecks); }
44  ~MacOSXAPIChecker() {
45    for (unsigned i=0; i != NumChecks; ++i)
46      delete BTypes[i];
47  }
48
49  void checkPreStmt(const CallExpr *CE, CheckerContext &C) const;
50};
51} //end anonymous namespace
52
53//===----------------------------------------------------------------------===//
54// dispatch_once and dispatch_once_f
55//===----------------------------------------------------------------------===//
56
57static void CheckDispatchOnce(CheckerContext &C, const CallExpr *CE,
58                              BugType *&BT, const IdentifierInfo *FI) {
59
60  if (!BT) {
61    llvm::SmallString<128> S;
62    llvm::raw_svector_ostream os(S);
63    os << "Improper use of '" << FI->getName() << '\'';
64    BT = new BugType(os.str(), "Mac OS X API");
65  }
66
67  if (CE->getNumArgs() < 1)
68    return;
69
70  // Check if the first argument is stack allocated.  If so, issue a warning
71  // because that's likely to be bad news.
72  const GRState *state = C.getState();
73  const MemRegion *R = state->getSVal(CE->getArg(0)).getAsRegion();
74  if (!R || !isa<StackSpaceRegion>(R->getMemorySpace()))
75    return;
76
77  ExplodedNode *N = C.generateSink(state);
78  if (!N)
79    return;
80
81  llvm::SmallString<256> S;
82  llvm::raw_svector_ostream os(S);
83  os << "Call to '" << FI->getName() << "' uses";
84  if (const VarRegion *VR = dyn_cast<VarRegion>(R))
85    os << " the local variable '" << VR->getDecl()->getName() << '\'';
86  else
87    os << " stack allocated memory";
88  os << " for the predicate value.  Using such transient memory for "
89        "the predicate is potentially dangerous.";
90  if (isa<VarRegion>(R) && isa<StackLocalsSpaceRegion>(R->getMemorySpace()))
91    os << "  Perhaps you intended to declare the variable as 'static'?";
92
93  EnhancedBugReport *report = new EnhancedBugReport(*BT, os.str(), N);
94  report->addRange(CE->getArg(0)->getSourceRange());
95  C.EmitReport(report);
96}
97
98//===----------------------------------------------------------------------===//
99// Central dispatch function.
100//===----------------------------------------------------------------------===//
101
102typedef void (*SubChecker)(CheckerContext &C, const CallExpr *CE, BugType *&BT,
103                           const IdentifierInfo *FI);
104namespace {
105  class SubCheck {
106    SubChecker SC;
107    BugType **BT;
108  public:
109    SubCheck(SubChecker sc, BugType *& bt) : SC(sc), BT(&bt) {}
110    SubCheck() : SC(NULL), BT(NULL) {}
111
112    void run(CheckerContext &C, const CallExpr *CE,
113             const IdentifierInfo *FI) const {
114      if (SC)
115        SC(C, CE, *BT, FI);
116    }
117  };
118} // end anonymous namespace
119
120void MacOSXAPIChecker::checkPreStmt(const CallExpr *CE,
121                                    CheckerContext &C) const {
122  // FIXME: Mostly copy and paste from UnixAPIChecker.  Should refactor.
123  const GRState *state = C.getState();
124  const Expr *Callee = CE->getCallee();
125  const FunctionTextRegion *Fn =
126    dyn_cast_or_null<FunctionTextRegion>(state->getSVal(Callee).getAsRegion());
127
128  if (!Fn)
129    return;
130
131  const IdentifierInfo *FI = Fn->getDecl()->getIdentifier();
132  if (!FI)
133    return;
134
135  const SubCheck &SC =
136    llvm::StringSwitch<SubCheck>(FI->getName())
137      .Case("dispatch_once", SubCheck(CheckDispatchOnce, BTypes[DispatchOnce]))
138      .Case("dispatch_once_f", SubCheck(CheckDispatchOnce,
139                                        BTypes[DispatchOnceF]))
140      .Default(SubCheck());
141
142  SC.run(C, CE, FI);
143}
144
145//===----------------------------------------------------------------------===//
146// Registration.
147//===----------------------------------------------------------------------===//
148
149void ento::registerMacOSXAPIChecker(CheckerManager &mgr) {
150  mgr.registerChecker<MacOSXAPIChecker>();
151}
152