Home | History | Annotate | Line # | Download | only in Checkers 
      1 //=- NSErrorChecker.cpp - Coding conventions for uses of NSError -*- C++ -*-==//
      2 //
      3 // Part of the LLVM Project, under the Apache License v2.0 with LLVM Exceptions.
      4 // See https://llvm.org/LICENSE.txt for license information.
      5 // SPDX-License-Identifier: Apache-2.0 WITH LLVM-exception
      6 //
      7 //===----------------------------------------------------------------------===//
      8 //
      9 //  This file defines a CheckNSError, a flow-insenstive check
     10 //  that determines if an Objective-C class interface correctly returns
     11 //  a non-void return type.
     12 //
     13 //  File under feature request PR 2600.
     14 //
     15 //===----------------------------------------------------------------------===//
     16 
     17 #include "clang/StaticAnalyzer/Checkers/BuiltinCheckerRegistration.h"
     18 #include "clang/AST/Decl.h"
     19 #include "clang/AST/DeclObjC.h"
     20 #include "clang/StaticAnalyzer/Core/BugReporter/BugType.h"
     21 #include "clang/StaticAnalyzer/Core/Checker.h"
     22 #include "clang/StaticAnalyzer/Core/CheckerManager.h"
     23 #include "clang/StaticAnalyzer/Core/PathSensitive/CheckerContext.h"
     24 #include "clang/StaticAnalyzer/Core/PathSensitive/ProgramStateTrait.h"
     25 #include "llvm/ADT/SmallString.h"
     26 #include "llvm/Support/raw_ostream.h"
     27 
     28 using namespace clang;
     29 using namespace ento;
     30 
     31 static bool IsNSError(QualType T, IdentifierInfo *II);
     32 static bool IsCFError(QualType T, IdentifierInfo *II);
     33 
     34 //===----------------------------------------------------------------------===//
     35 // NSErrorMethodChecker
     36 //===----------------------------------------------------------------------===//
     37 
     38 namespace {
     39 class NSErrorMethodChecker
     40     : public Checker< check::ASTDecl<ObjCMethodDecl> > {
     41   mutable IdentifierInfo *II;
     42 
     43 public:
     44   NSErrorMethodChecker() : II(nullptr) {}
     45 
     46   void checkASTDecl(const ObjCMethodDecl *D,
     47                     AnalysisManager &mgr, BugReporter &BR) const;
     48 };
     49 }
     50 
     51 void NSErrorMethodChecker::checkASTDecl(const ObjCMethodDecl *D,
     52                                         AnalysisManager &mgr,
     53                                         BugReporter &BR) const {
     54   if (!D->isThisDeclarationADefinition())
     55     return;
     56   if (!D->getReturnType()->isVoidType())
     57     return;
     58 
     59   if (!II)
     60     II = &D->getASTContext().Idents.get("NSError");
     61 
     62   bool hasNSError = false;
     63   for (const auto *I : D->parameters())  {
     64     if (IsNSError(I->getType(), II)) {
     65       hasNSError = true;
     66       break;
     67     }
     68   }
     69 
     70   if (hasNSError) {
     71     const char *err = "Method accepting NSError** "
     72         "should have a non-void return value to indicate whether or not an "
     73         "error occurred";
     74     PathDiagnosticLocation L =
     75       PathDiagnosticLocation::create(D, BR.getSourceManager());
     76     BR.EmitBasicReport(D, this, "Bad return type when passing NSError**",
     77                        "Coding conventions (Apple)", err, L);
     78   }
     79 }
     80 
     81 //===----------------------------------------------------------------------===//
     82 // CFErrorFunctionChecker
     83 //===----------------------------------------------------------------------===//
     84 
     85 namespace {
     86 class CFErrorFunctionChecker
     87     : public Checker< check::ASTDecl<FunctionDecl> > {
     88   mutable IdentifierInfo *II;
     89 
     90 public:
     91   CFErrorFunctionChecker() : II(nullptr) {}
     92 
     93   void checkASTDecl(const FunctionDecl *D,
     94                     AnalysisManager &mgr, BugReporter &BR) const;
     95 };
     96 }
     97 
     98 static bool hasReservedReturnType(const FunctionDecl *D) {
     99   if (isa<CXXConstructorDecl>(D))
    100     return true;
    101 
    102   // operators delete and delete[] are required to have 'void' return type
    103   auto OperatorKind = D->getOverloadedOperator();
    104   return OperatorKind == OO_Delete || OperatorKind == OO_Array_Delete;
    105 }
    106 
    107 void CFErrorFunctionChecker::checkASTDecl(const FunctionDecl *D,
    108                                         AnalysisManager &mgr,
    109                                         BugReporter &BR) const {
    110   if (!D->doesThisDeclarationHaveABody())
    111     return;
    112   if (!D->getReturnType()->isVoidType())
    113     return;
    114   if (hasReservedReturnType(D))
    115     return;
    116 
    117   if (!II)
    118     II = &D->getASTContext().Idents.get("CFErrorRef");
    119 
    120   bool hasCFError = false;
    121   for (auto I : D->parameters())  {
    122     if (IsCFError(I->getType(), II)) {
    123       hasCFError = true;
    124       break;
    125     }
    126   }
    127 
    128   if (hasCFError) {
    129     const char *err = "Function accepting CFErrorRef* "
    130         "should have a non-void return value to indicate whether or not an "
    131         "error occurred";
    132     PathDiagnosticLocation L =
    133       PathDiagnosticLocation::create(D, BR.getSourceManager());
    134     BR.EmitBasicReport(D, this, "Bad return type when passing CFErrorRef*",
    135                        "Coding conventions (Apple)", err, L);
    136   }
    137 }
    138 
    139 //===----------------------------------------------------------------------===//
    140 // NSOrCFErrorDerefChecker
    141 //===----------------------------------------------------------------------===//
    142 
    143 namespace {
    144 
    145 class NSErrorDerefBug : public BugType {
    146 public:
    147   NSErrorDerefBug(const CheckerNameRef Checker)
    148       : BugType(Checker, "NSError** null dereference",
    149                 "Coding conventions (Apple)") {}
    150 };
    151 
    152 class CFErrorDerefBug : public BugType {
    153 public:
    154   CFErrorDerefBug(const CheckerNameRef Checker)
    155       : BugType(Checker, "CFErrorRef* null dereference",
    156                 "Coding conventions (Apple)") {}
    157 };
    158 
    159 }
    160 
    161 namespace {
    162 class NSOrCFErrorDerefChecker
    163     : public Checker< check::Location,
    164                         check::Event<ImplicitNullDerefEvent> > {
    165   mutable IdentifierInfo *NSErrorII, *CFErrorII;
    166   mutable std::unique_ptr<NSErrorDerefBug> NSBT;
    167   mutable std::unique_ptr<CFErrorDerefBug> CFBT;
    168 public:
    169   DefaultBool ShouldCheckNSError, ShouldCheckCFError;
    170   CheckerNameRef NSErrorName, CFErrorName;
    171   NSOrCFErrorDerefChecker() : NSErrorII(nullptr), CFErrorII(nullptr) {}
    172 
    173   void checkLocation(SVal loc, bool isLoad, const Stmt *S,
    174                      CheckerContext &C) const;
    175   void checkEvent(ImplicitNullDerefEvent event) const;
    176 };
    177 }
    178 
    179 typedef llvm::ImmutableMap<SymbolRef, unsigned> ErrorOutFlag;
    180 REGISTER_TRAIT_WITH_PROGRAMSTATE(NSErrorOut, ErrorOutFlag)
    181 REGISTER_TRAIT_WITH_PROGRAMSTATE(CFErrorOut, ErrorOutFlag)
    182 
    183 template <typename T>
    184 static bool hasFlag(SVal val, ProgramStateRef state) {
    185   if (SymbolRef sym = val.getAsSymbol())
    186     if (const unsigned *attachedFlags = state->get<T>(sym))
    187       return *attachedFlags;
    188   return false;
    189 }
    190 
    191 template <typename T>
    192 static void setFlag(ProgramStateRef state, SVal val, CheckerContext &C) {
    193   // We tag the symbol that the SVal wraps.
    194   if (SymbolRef sym = val.getAsSymbol())
    195     C.addTransition(state->set<T>(sym, true));
    196 }
    197 
    198 static QualType parameterTypeFromSVal(SVal val, CheckerContext &C) {
    199   const StackFrameContext * SFC = C.getStackFrame();
    200   if (Optional<loc::MemRegionVal> X = val.getAs<loc::MemRegionVal>()) {
    201     const MemRegion* R = X->getRegion();
    202     if (const VarRegion *VR = R->getAs<VarRegion>())
    203       if (const StackArgumentsSpaceRegion *
    204           stackReg = dyn_cast<StackArgumentsSpaceRegion>(VR->getMemorySpace()))
    205         if (stackReg->getStackFrame() == SFC)
    206           return VR->getValueType();
    207   }
    208 
    209   return QualType();
    210 }
    211 
    212 void NSOrCFErrorDerefChecker::checkLocation(SVal loc, bool isLoad,
    213                                             const Stmt *S,
    214                                             CheckerContext &C) const {
    215   if (!isLoad)
    216     return;
    217   if (loc.isUndef() || !loc.getAs<Loc>())
    218     return;
    219 
    220   ASTContext &Ctx = C.getASTContext();
    221   ProgramStateRef state = C.getState();
    222 
    223   // If we are loading from NSError**/CFErrorRef* parameter, mark the resulting
    224   // SVal so that we can later check it when handling the
    225   // ImplicitNullDerefEvent event.
    226   // FIXME: Cumbersome! Maybe add hook at construction of SVals at start of
    227   // function ?
    228 
    229   QualType parmT = parameterTypeFromSVal(loc, C);
    230   if (parmT.isNull())
    231     return;
    232 
    233   if (!NSErrorII)
    234     NSErrorII = &Ctx.Idents.get("NSError");
    235   if (!CFErrorII)
    236     CFErrorII = &Ctx.Idents.get("CFErrorRef");
    237 
    238   if (ShouldCheckNSError && IsNSError(parmT, NSErrorII)) {
    239     setFlag<NSErrorOut>(state, state->getSVal(loc.castAs<Loc>()), C);
    240     return;
    241   }
    242 
    243   if (ShouldCheckCFError && IsCFError(parmT, CFErrorII)) {
    244     setFlag<CFErrorOut>(state, state->getSVal(loc.castAs<Loc>()), C);
    245     return;
    246   }
    247 }
    248 
    249 void NSOrCFErrorDerefChecker::checkEvent(ImplicitNullDerefEvent event) const {
    250   if (event.IsLoad)
    251     return;
    252 
    253   SVal loc = event.Location;
    254   ProgramStateRef state = event.SinkNode->getState();
    255   BugReporter &BR = *event.BR;
    256 
    257   bool isNSError = hasFlag<NSErrorOut>(loc, state);
    258   bool isCFError = false;
    259   if (!isNSError)
    260     isCFError = hasFlag<CFErrorOut>(loc, state);
    261 
    262   if (!(isNSError || isCFError))
    263     return;
    264 
    265   // Storing to possible null NSError/CFErrorRef out parameter.
    266   SmallString<128> Buf;
    267   llvm::raw_svector_ostream os(Buf);
    268 
    269   os << "Potential null dereference.  According to coding standards ";
    270   os << (isNSError
    271          ? "in 'Creating and Returning NSError Objects' the parameter"
    272          : "documented in CoreFoundation/CFError.h the parameter");
    273 
    274   os  << " may be null";
    275 
    276   BugType *bug = nullptr;
    277   if (isNSError) {
    278     if (!NSBT)
    279       NSBT.reset(new NSErrorDerefBug(NSErrorName));
    280     bug = NSBT.get();
    281   }
    282   else {
    283     if (!CFBT)
    284       CFBT.reset(new CFErrorDerefBug(CFErrorName));
    285     bug = CFBT.get();
    286   }
    287   BR.emitReport(
    288       std::make_unique<PathSensitiveBugReport>(*bug, os.str(), event.SinkNode));
    289 }
    290 
    291 static bool IsNSError(QualType T, IdentifierInfo *II) {
    292 
    293   const PointerType* PPT = T->getAs<PointerType>();
    294   if (!PPT)
    295     return false;
    296 
    297   const ObjCObjectPointerType* PT =
    298     PPT->getPointeeType()->getAs<ObjCObjectPointerType>();
    299 
    300   if (!PT)
    301     return false;
    302 
    303   const ObjCInterfaceDecl *ID = PT->getInterfaceDecl();
    304 
    305   // FIXME: Can ID ever be NULL?
    306   if (ID)
    307     return II == ID->getIdentifier();
    308 
    309   return false;
    310 }
    311 
    312 static bool IsCFError(QualType T, IdentifierInfo *II) {
    313   const PointerType* PPT = T->getAs<PointerType>();
    314   if (!PPT) return false;
    315 
    316   const TypedefType* TT = PPT->getPointeeType()->getAs<TypedefType>();
    317   if (!TT) return false;
    318 
    319   return TT->getDecl()->getIdentifier() == II;
    320 }
    321 
    322 void ento::registerNSOrCFErrorDerefChecker(CheckerManager &mgr) {
    323   mgr.registerChecker<NSOrCFErrorDerefChecker>();
    324 }
    325 
    326 bool ento::shouldRegisterNSOrCFErrorDerefChecker(const CheckerManager &mgr) {
    327   return true;
    328 }
    329 
    330 void ento::registerNSErrorChecker(CheckerManager &mgr) {
    331   mgr.registerChecker<NSErrorMethodChecker>();
    332   NSOrCFErrorDerefChecker *checker = mgr.getChecker<NSOrCFErrorDerefChecker>();
    333   checker->ShouldCheckNSError = true;
    334   checker->NSErrorName = mgr.getCurrentCheckerName();
    335 }
    336 
    337 bool ento::shouldRegisterNSErrorChecker(const CheckerManager &mgr) {
    338   return true;
    339 }
    340 
    341 void ento::registerCFErrorChecker(CheckerManager &mgr) {
    342   mgr.registerChecker<CFErrorFunctionChecker>();
    343   NSOrCFErrorDerefChecker *checker = mgr.getChecker<NSOrCFErrorDerefChecker>();
    344   checker->ShouldCheckCFError = true;
    345   checker->CFErrorName = mgr.getCurrentCheckerName();
    346 }
    347 
    348 bool ento::shouldRegisterCFErrorChecker(const CheckerManager &mgr) {
    349   return true;
    350 }
    351