NonNullParamChecker.cpp revision 280031 
1//===--- NonNullParamChecker.cpp - Undefined arguments checker -*- C++ -*--===//
2//
3//                     The LLVM Compiler Infrastructure
4//
5// This file is distributed under the University of Illinois Open Source
6// License. See LICENSE.TXT for details.
7//
8//===----------------------------------------------------------------------===//
9//
10// This defines NonNullParamChecker, which checks for arguments expected not to
11// be null due to:
12//   - the corresponding parameters being declared to have nonnull attribute
13//   - the corresponding parameters being references; since the call would form
14//     a reference to a null pointer
15//
16//===----------------------------------------------------------------------===//
17
18#include "ClangSACheckers.h"
19#include "clang/AST/Attr.h"
20#include "clang/StaticAnalyzer/Core/BugReporter/BugType.h"
21#include "clang/StaticAnalyzer/Core/Checker.h"
22#include "clang/StaticAnalyzer/Core/CheckerManager.h"
23#include "clang/StaticAnalyzer/Core/PathSensitive/CallEvent.h"
24#include "clang/StaticAnalyzer/Core/PathSensitive/CheckerContext.h"
25
26using namespace clang;
27using namespace ento;
28
29namespace {
30class NonNullParamChecker
31  : public Checker< check::PreCall > {
32  mutable std::unique_ptr<BugType> BTAttrNonNull;
33  mutable std::unique_ptr<BugType> BTNullRefArg;
34
35public:
36
37  void checkPreCall(const CallEvent &Call, CheckerContext &C) const;
38
39  BugReport *genReportNullAttrNonNull(const ExplodedNode *ErrorN,
40                                      const Expr *ArgE) const;
41  BugReport *genReportReferenceToNullPointer(const ExplodedNode *ErrorN,
42                                             const Expr *ArgE) const;
43};
44} // end anonymous namespace
45
46void NonNullParamChecker::checkPreCall(const CallEvent &Call,
47                                       CheckerContext &C) const {
48  const Decl *FD = Call.getDecl();
49  if (!FD)
50    return;
51
52  // Merge all non-null attributes
53  unsigned NumArgs = Call.getNumArgs();
54  llvm::SmallBitVector AttrNonNull(NumArgs);
55  for (const auto *NonNull : FD->specific_attrs<NonNullAttr>()) {
56    if (!NonNull->args_size()) {
57      AttrNonNull.set(0, NumArgs);
58      break;
59    }
60    for (unsigned Val : NonNull->args()) {
61      if (Val >= NumArgs)
62        continue;
63      AttrNonNull.set(Val);
64    }
65  }
66
67  ProgramStateRef state = C.getState();
68
69  CallEvent::param_type_iterator TyI = Call.param_type_begin(),
70                                 TyE = Call.param_type_end();
71
72  for (unsigned idx = 0; idx < NumArgs; ++idx) {
73
74    // Check if the parameter is a reference. We want to report when reference
75    // to a null pointer is passed as a paramter.
76    bool haveRefTypeParam = false;
77    if (TyI != TyE) {
78      haveRefTypeParam = (*TyI)->isReferenceType();
79      TyI++;
80    }
81
82    bool haveAttrNonNull = AttrNonNull[idx];
83    if (!haveAttrNonNull) {
84      // Check if the parameter is also marked 'nonnull'.
85      ArrayRef<ParmVarDecl*> parms = Call.parameters();
86      if (idx < parms.size())
87        haveAttrNonNull = parms[idx]->hasAttr<NonNullAttr>();
88    }
89
90    if (!haveRefTypeParam && !haveAttrNonNull)
91      continue;
92
93    // If the value is unknown or undefined, we can't perform this check.
94    const Expr *ArgE = Call.getArgExpr(idx);
95    SVal V = Call.getArgSVal(idx);
96    Optional<DefinedSVal> DV = V.getAs<DefinedSVal>();
97    if (!DV)
98      continue;
99
100    // Process the case when the argument is not a location.
101    assert(!haveRefTypeParam || DV->getAs<Loc>());
102
103    if (haveAttrNonNull && !DV->getAs<Loc>()) {
104      // If the argument is a union type, we want to handle a potential
105      // transparent_union GCC extension.
106      if (!ArgE)
107        continue;
108
109      QualType T = ArgE->getType();
110      const RecordType *UT = T->getAsUnionType();
111      if (!UT || !UT->getDecl()->hasAttr<TransparentUnionAttr>())
112        continue;
113
114      if (Optional<nonloc::CompoundVal> CSV =
115              DV->getAs<nonloc::CompoundVal>()) {
116        nonloc::CompoundVal::iterator CSV_I = CSV->begin();
117        assert(CSV_I != CSV->end());
118        V = *CSV_I;
119        DV = V.getAs<DefinedSVal>();
120        assert(++CSV_I == CSV->end());
121        // FIXME: Handle (some_union){ some_other_union_val }, which turns into
122        // a LazyCompoundVal inside a CompoundVal.
123        if (!V.getAs<Loc>())
124          continue;
125        // Retrieve the corresponding expression.
126        if (const CompoundLiteralExpr *CE = dyn_cast<CompoundLiteralExpr>(ArgE))
127          if (const InitListExpr *IE =
128                dyn_cast<InitListExpr>(CE->getInitializer()))
129             ArgE = dyn_cast<Expr>(*(IE->begin()));
130
131      } else {
132        // FIXME: Handle LazyCompoundVals?
133        continue;
134      }
135    }
136
137    ConstraintManager &CM = C.getConstraintManager();
138    ProgramStateRef stateNotNull, stateNull;
139    std::tie(stateNotNull, stateNull) = CM.assumeDual(state, *DV);
140
141    if (stateNull && !stateNotNull) {
142      // Generate an error node.  Check for a null node in case
143      // we cache out.
144      if (ExplodedNode *errorNode = C.generateSink(stateNull)) {
145
146        BugReport *R = nullptr;
147        if (haveAttrNonNull)
148          R = genReportNullAttrNonNull(errorNode, ArgE);
149        else if (haveRefTypeParam)
150          R = genReportReferenceToNullPointer(errorNode, ArgE);
151
152        // Highlight the range of the argument that was null.
153        R->addRange(Call.getArgSourceRange(idx));
154
155        // Emit the bug report.
156        C.emitReport(R);
157      }
158
159      // Always return.  Either we cached out or we just emitted an error.
160      return;
161    }
162
163    // If a pointer value passed the check we should assume that it is
164    // indeed not null from this point forward.
165    assert(stateNotNull);
166    state = stateNotNull;
167  }
168
169  // If we reach here all of the arguments passed the nonnull check.
170  // If 'state' has been updated generated a new node.
171  C.addTransition(state);
172}
173
174BugReport *NonNullParamChecker::genReportNullAttrNonNull(
175  const ExplodedNode *ErrorNode, const Expr *ArgE) const {
176  // Lazily allocate the BugType object if it hasn't already been
177  // created. Ownership is transferred to the BugReporter object once
178  // the BugReport is passed to 'EmitWarning'.
179  if (!BTAttrNonNull)
180    BTAttrNonNull.reset(new BugType(
181        this, "Argument with 'nonnull' attribute passed null", "API"));
182
183  BugReport *R = new BugReport(*BTAttrNonNull,
184                  "Null pointer passed as an argument to a 'nonnull' parameter",
185                  ErrorNode);
186  if (ArgE)
187    bugreporter::trackNullOrUndefValue(ErrorNode, ArgE, *R);
188
189  return R;
190}
191
192BugReport *NonNullParamChecker::genReportReferenceToNullPointer(
193  const ExplodedNode *ErrorNode, const Expr *ArgE) const {
194  if (!BTNullRefArg)
195    BTNullRefArg.reset(new BuiltinBug(this, "Dereference of null pointer"));
196
197  BugReport *R = new BugReport(*BTNullRefArg,
198                               "Forming reference to null pointer",
199                               ErrorNode);
200  if (ArgE) {
201    const Expr *ArgEDeref = bugreporter::getDerefExpr(ArgE);
202    if (!ArgEDeref)
203      ArgEDeref = ArgE;
204    bugreporter::trackNullOrUndefValue(ErrorNode,
205                                       ArgEDeref,
206                                       *R);
207  }
208  return R;
209
210}
211
212void ento::registerNonNullParamChecker(CheckerManager &mgr) {
213  mgr.registerChecker<NonNullParamChecker>();
214}
215