Ted Kremenek | bc3a021 | 2009-10-30 17:24:47 +0000 | [diff] [blame] | 1 | //== NullDerefChecker.cpp - Null dereference checker ------------*- C++ -*--==// |
| 2 | // |
| 3 | // The LLVM Compiler Infrastructure |
| 4 | // |
| 5 | // This file is distributed under the University of Illinois Open Source |
| 6 | // License. See LICENSE.TXT for details. |
| 7 | // |
| 8 | //===----------------------------------------------------------------------===// |
| 9 | // |
Argyrios Kyrtzidis | d2592a3 | 2010-12-22 18:53:44 +0000 | [diff] [blame] | 10 | // This defines NullDerefChecker, a builtin check in ExprEngine that performs |
Ted Kremenek | bc3a021 | 2009-10-30 17:24:47 +0000 | [diff] [blame] | 11 | // checks for null pointers at loads and stores. |
| 12 | // |
| 13 | //===----------------------------------------------------------------------===// |
| 14 | |
Argyrios Kyrtzidis | b3d74da | 2011-02-28 17:36:18 +0000 | [diff] [blame] | 15 | #include "ClangSACheckers.h" |
Argyrios Kyrtzidis | ec8605f | 2011-03-01 01:16:21 +0000 | [diff] [blame] | 16 | #include "clang/StaticAnalyzer/Core/Checker.h" |
Argyrios Kyrtzidis | b3d74da | 2011-02-28 17:36:18 +0000 | [diff] [blame] | 17 | #include "clang/StaticAnalyzer/Core/CheckerManager.h" |
| 18 | #include "clang/StaticAnalyzer/Core/PathSensitive/CheckerContext.h" |
Ted Kremenek | 9b66371 | 2011-02-10 01:03:03 +0000 | [diff] [blame] | 19 | #include "clang/StaticAnalyzer/Core/BugReporter/BugType.h" |
Ted Kremenek | bc3a021 | 2009-10-30 17:24:47 +0000 | [diff] [blame] | 20 | |
| 21 | using namespace clang; |
Ted Kremenek | 9ef6537 | 2010-12-23 07:20:52 +0000 | [diff] [blame] | 22 | using namespace ento; |
Ted Kremenek | bc3a021 | 2009-10-30 17:24:47 +0000 | [diff] [blame] | 23 | |
Ted Kremenek | b4b817d | 2009-11-11 03:26:34 +0000 | [diff] [blame] | 24 | namespace { |
Argyrios Kyrtzidis | b3d74da | 2011-02-28 17:36:18 +0000 | [diff] [blame] | 25 | class DereferenceChecker |
Argyrios Kyrtzidis | ec8605f | 2011-03-01 01:16:21 +0000 | [diff] [blame] | 26 | : public Checker< check::Location, |
Argyrios Kyrtzidis | b3d74da | 2011-02-28 17:36:18 +0000 | [diff] [blame] | 27 | EventDispatcher<ImplicitNullDerefEvent> > { |
| 28 | mutable llvm::OwningPtr<BuiltinBug> BT_null; |
| 29 | mutable llvm::OwningPtr<BuiltinBug> BT_undef; |
Ted Kremenek | 452b84d | 2010-03-23 01:11:38 +0000 | [diff] [blame] | 30 | |
Argyrios Kyrtzidis | b3d74da | 2011-02-28 17:36:18 +0000 | [diff] [blame] | 31 | public: |
Anna Zaks | 390909c | 2011-10-06 00:43:15 +0000 | [diff] [blame] | 32 | void checkLocation(SVal location, bool isLoad, const Stmt* S, |
| 33 | CheckerContext &C) const; |
Argyrios Kyrtzidis | b3d74da | 2011-02-28 17:36:18 +0000 | [diff] [blame] | 34 | |
Chris Lattner | 5f9e272 | 2011-07-23 10:55:15 +0000 | [diff] [blame] | 35 | static void AddDerefSource(raw_ostream &os, |
| 36 | SmallVectorImpl<SourceRange> &Ranges, |
Argyrios Kyrtzidis | b3d74da | 2011-02-28 17:36:18 +0000 | [diff] [blame] | 37 | const Expr *Ex, bool loadedFrom = false); |
Ted Kremenek | b4b817d | 2009-11-11 03:26:34 +0000 | [diff] [blame] | 38 | }; |
| 39 | } // end anonymous namespace |
| 40 | |
Chris Lattner | 5f9e272 | 2011-07-23 10:55:15 +0000 | [diff] [blame] | 41 | void DereferenceChecker::AddDerefSource(raw_ostream &os, |
Anna Zaks | 390909c | 2011-10-06 00:43:15 +0000 | [diff] [blame] | 42 | SmallVectorImpl<SourceRange> &Ranges, |
Ted Kremenek | 646c3c3 | 2010-10-26 00:06:13 +0000 | [diff] [blame] | 43 | const Expr *Ex, |
| 44 | bool loadedFrom) { |
John McCall | f6a1648 | 2010-12-04 03:47:34 +0000 | [diff] [blame] | 45 | Ex = Ex->IgnoreParenLValueCasts(); |
Ted Kremenek | 646c3c3 | 2010-10-26 00:06:13 +0000 | [diff] [blame] | 46 | switch (Ex->getStmtClass()) { |
| 47 | default: |
| 48 | return; |
| 49 | case Stmt::DeclRefExprClass: { |
| 50 | const DeclRefExpr *DR = cast<DeclRefExpr>(Ex); |
| 51 | if (const VarDecl *VD = dyn_cast<VarDecl>(DR->getDecl())) { |
| 52 | os << " (" << (loadedFrom ? "loaded from" : "from") |
| 53 | << " variable '" << VD->getName() << "')"; |
| 54 | Ranges.push_back(DR->getSourceRange()); |
| 55 | } |
| 56 | return; |
| 57 | } |
| 58 | case Stmt::MemberExprClass: { |
| 59 | const MemberExpr *ME = cast<MemberExpr>(Ex); |
| 60 | os << " (" << (loadedFrom ? "loaded from" : "via") |
| 61 | << " field '" << ME->getMemberNameInfo() << "')"; |
| 62 | SourceLocation L = ME->getMemberLoc(); |
| 63 | Ranges.push_back(SourceRange(L, L)); |
| 64 | break; |
| 65 | } |
| 66 | } |
| 67 | } |
| 68 | |
Anna Zaks | 390909c | 2011-10-06 00:43:15 +0000 | [diff] [blame] | 69 | void DereferenceChecker::checkLocation(SVal l, bool isLoad, const Stmt* S, |
Argyrios Kyrtzidis | b3d74da | 2011-02-28 17:36:18 +0000 | [diff] [blame] | 70 | CheckerContext &C) const { |
Ted Kremenek | b4b817d | 2009-11-11 03:26:34 +0000 | [diff] [blame] | 71 | // Check for dereference of an undefined value. |
| 72 | if (l.isUndef()) { |
Ted Kremenek | d048c6e | 2010-12-20 21:19:09 +0000 | [diff] [blame] | 73 | if (ExplodedNode *N = C.generateSink()) { |
Ted Kremenek | b4b817d | 2009-11-11 03:26:34 +0000 | [diff] [blame] | 74 | if (!BT_undef) |
Argyrios Kyrtzidis | b3d74da | 2011-02-28 17:36:18 +0000 | [diff] [blame] | 75 | BT_undef.reset(new BuiltinBug("Dereference of undefined pointer value")); |
Ted Kremenek | 452b84d | 2010-03-23 01:11:38 +0000 | [diff] [blame] | 76 | |
Anna Zaks | e172e8b | 2011-08-17 23:00:25 +0000 | [diff] [blame] | 77 | BugReport *report = |
| 78 | new BugReport(*BT_undef, BT_undef->getDescription(), N); |
Anna Zaks | 50bbc16 | 2011-08-19 22:33:38 +0000 | [diff] [blame] | 79 | report->addVisitor(bugreporter::getTrackNullOrUndefValueVisitor(N, |
| 80 | bugreporter::GetDerefExpr(N))); |
Ted Kremenek | b4b817d | 2009-11-11 03:26:34 +0000 | [diff] [blame] | 81 | C.EmitReport(report); |
| 82 | } |
| 83 | return; |
| 84 | } |
Ted Kremenek | 452b84d | 2010-03-23 01:11:38 +0000 | [diff] [blame] | 85 | |
Ted Kremenek | b4b817d | 2009-11-11 03:26:34 +0000 | [diff] [blame] | 86 | DefinedOrUnknownSVal location = cast<DefinedOrUnknownSVal>(l); |
Ted Kremenek | 452b84d | 2010-03-23 01:11:38 +0000 | [diff] [blame] | 87 | |
| 88 | // Check for null dereferences. |
Ted Kremenek | b4b817d | 2009-11-11 03:26:34 +0000 | [diff] [blame] | 89 | if (!isa<Loc>(location)) |
| 90 | return; |
Ted Kremenek | 452b84d | 2010-03-23 01:11:38 +0000 | [diff] [blame] | 91 | |
Ted Kremenek | 18c66fd | 2011-08-15 22:09:50 +0000 | [diff] [blame] | 92 | const ProgramState *state = C.getState(); |
| 93 | const ProgramState *notNullState, *nullState; |
Ted Kremenek | 28f47b9 | 2010-12-01 22:16:56 +0000 | [diff] [blame] | 94 | llvm::tie(notNullState, nullState) = state->assume(location); |
Ted Kremenek | 452b84d | 2010-03-23 01:11:38 +0000 | [diff] [blame] | 95 | |
Ted Kremenek | b4b817d | 2009-11-11 03:26:34 +0000 | [diff] [blame] | 96 | // The explicit NULL case. |
| 97 | if (nullState) { |
Ted Kremenek | 452b84d | 2010-03-23 01:11:38 +0000 | [diff] [blame] | 98 | if (!notNullState) { |
Ted Kremenek | 78d722f | 2009-11-21 01:50:48 +0000 | [diff] [blame] | 99 | // Generate an error node. |
Ted Kremenek | d048c6e | 2010-12-20 21:19:09 +0000 | [diff] [blame] | 100 | ExplodedNode *N = C.generateSink(nullState); |
Ted Kremenek | 78d722f | 2009-11-21 01:50:48 +0000 | [diff] [blame] | 101 | if (!N) |
Ted Kremenek | b4b817d | 2009-11-11 03:26:34 +0000 | [diff] [blame] | 102 | return; |
Ted Kremenek | 452b84d | 2010-03-23 01:11:38 +0000 | [diff] [blame] | 103 | |
Ted Kremenek | 78d722f | 2009-11-21 01:50:48 +0000 | [diff] [blame] | 104 | // We know that 'location' cannot be non-null. This is what |
Ted Kremenek | 452b84d | 2010-03-23 01:11:38 +0000 | [diff] [blame] | 105 | // we call an "explicit" null dereference. |
Ted Kremenek | 78d722f | 2009-11-21 01:50:48 +0000 | [diff] [blame] | 106 | if (!BT_null) |
Argyrios Kyrtzidis | b3d74da | 2011-02-28 17:36:18 +0000 | [diff] [blame] | 107 | BT_null.reset(new BuiltinBug("Dereference of null pointer")); |
Ted Kremenek | 452b84d | 2010-03-23 01:11:38 +0000 | [diff] [blame] | 108 | |
Ted Kremenek | e576af2 | 2009-11-24 01:33:10 +0000 | [diff] [blame] | 109 | llvm::SmallString<100> buf; |
Chris Lattner | 5f9e272 | 2011-07-23 10:55:15 +0000 | [diff] [blame] | 110 | SmallVector<SourceRange, 2> Ranges; |
Ted Kremenek | 892697d | 2010-12-16 07:46:53 +0000 | [diff] [blame] | 111 | |
| 112 | // Walk through lvalue casts to get the original expression |
| 113 | // that syntactically caused the load. |
| 114 | if (const Expr *expr = dyn_cast<Expr>(S)) |
| 115 | S = expr->IgnoreParenLValueCasts(); |
Ted Kremenek | e576af2 | 2009-11-24 01:33:10 +0000 | [diff] [blame] | 116 | |
| 117 | switch (S->getStmtClass()) { |
Ted Kremenek | 646c3c3 | 2010-10-26 00:06:13 +0000 | [diff] [blame] | 118 | case Stmt::ArraySubscriptExprClass: { |
| 119 | llvm::raw_svector_ostream os(buf); |
| 120 | os << "Array access"; |
| 121 | const ArraySubscriptExpr *AE = cast<ArraySubscriptExpr>(S); |
| 122 | AddDerefSource(os, Ranges, AE->getBase()->IgnoreParenCasts()); |
| 123 | os << " results in a null pointer dereference"; |
| 124 | break; |
| 125 | } |
Ted Kremenek | e576af2 | 2009-11-24 01:33:10 +0000 | [diff] [blame] | 126 | case Stmt::UnaryOperatorClass: { |
Ted Kremenek | 646c3c3 | 2010-10-26 00:06:13 +0000 | [diff] [blame] | 127 | llvm::raw_svector_ostream os(buf); |
| 128 | os << "Dereference of null pointer"; |
Ted Kremenek | e576af2 | 2009-11-24 01:33:10 +0000 | [diff] [blame] | 129 | const UnaryOperator *U = cast<UnaryOperator>(S); |
Ted Kremenek | 646c3c3 | 2010-10-26 00:06:13 +0000 | [diff] [blame] | 130 | AddDerefSource(os, Ranges, U->getSubExpr()->IgnoreParens(), true); |
Ted Kremenek | 452b84d | 2010-03-23 01:11:38 +0000 | [diff] [blame] | 131 | break; |
| 132 | } |
| 133 | case Stmt::MemberExprClass: { |
| 134 | const MemberExpr *M = cast<MemberExpr>(S); |
Ted Kremenek | 646c3c3 | 2010-10-26 00:06:13 +0000 | [diff] [blame] | 135 | if (M->isArrow()) { |
| 136 | llvm::raw_svector_ostream os(buf); |
| 137 | os << "Access to field '" << M->getMemberNameInfo() |
| 138 | << "' results in a dereference of a null pointer"; |
| 139 | AddDerefSource(os, Ranges, M->getBase()->IgnoreParenCasts(), true); |
| 140 | } |
Ted Kremenek | 452b84d | 2010-03-23 01:11:38 +0000 | [diff] [blame] | 141 | break; |
Ted Kremenek | e576af2 | 2009-11-24 01:33:10 +0000 | [diff] [blame] | 142 | } |
Ted Kremenek | 0853c7f | 2010-09-10 20:20:49 +0000 | [diff] [blame] | 143 | case Stmt::ObjCIvarRefExprClass: { |
| 144 | const ObjCIvarRefExpr *IV = cast<ObjCIvarRefExpr>(S); |
| 145 | if (const DeclRefExpr *DR = |
| 146 | dyn_cast<DeclRefExpr>(IV->getBase()->IgnoreParenCasts())) { |
| 147 | if (const VarDecl *VD = dyn_cast<VarDecl>(DR->getDecl())) { |
| 148 | llvm::raw_svector_ostream os(buf); |
| 149 | os << "Instance variable access (via '" << VD->getName() |
| 150 | << "') results in a null pointer dereference"; |
| 151 | } |
| 152 | } |
| 153 | Ranges.push_back(IV->getSourceRange()); |
| 154 | break; |
| 155 | } |
Ted Kremenek | e576af2 | 2009-11-24 01:33:10 +0000 | [diff] [blame] | 156 | default: |
| 157 | break; |
| 158 | } |
Ted Kremenek | 2c791bd | 2009-11-06 00:44:32 +0000 | [diff] [blame] | 159 | |
Anna Zaks | e172e8b | 2011-08-17 23:00:25 +0000 | [diff] [blame] | 160 | BugReport *report = |
| 161 | new BugReport(*BT_null, |
Ted Kremenek | e576af2 | 2009-11-24 01:33:10 +0000 | [diff] [blame] | 162 | buf.empty() ? BT_null->getDescription():buf.str(), |
| 163 | N); |
| 164 | |
Anna Zaks | 50bbc16 | 2011-08-19 22:33:38 +0000 | [diff] [blame] | 165 | report->addVisitor(bugreporter::getTrackNullOrUndefValueVisitor(N, |
| 166 | bugreporter::GetDerefExpr(N))); |
Ted Kremenek | 452b84d | 2010-03-23 01:11:38 +0000 | [diff] [blame] | 167 | |
Chris Lattner | 5f9e272 | 2011-07-23 10:55:15 +0000 | [diff] [blame] | 168 | for (SmallVectorImpl<SourceRange>::iterator |
Ted Kremenek | 452b84d | 2010-03-23 01:11:38 +0000 | [diff] [blame] | 169 | I = Ranges.begin(), E = Ranges.end(); I!=E; ++I) |
| 170 | report->addRange(*I); |
| 171 | |
Ted Kremenek | 78d722f | 2009-11-21 01:50:48 +0000 | [diff] [blame] | 172 | C.EmitReport(report); |
| 173 | return; |
| 174 | } |
| 175 | else { |
Ted Kremenek | b4b817d | 2009-11-11 03:26:34 +0000 | [diff] [blame] | 176 | // Otherwise, we have the case where the location could either be |
| 177 | // null or not-null. Record the error node as an "implicit" null |
Ted Kremenek | 452b84d | 2010-03-23 01:11:38 +0000 | [diff] [blame] | 178 | // dereference. |
Argyrios Kyrtzidis | b3d74da | 2011-02-28 17:36:18 +0000 | [diff] [blame] | 179 | if (ExplodedNode *N = C.generateSink(nullState)) { |
| 180 | ImplicitNullDerefEvent event = { l, isLoad, N, &C.getBugReporter() }; |
| 181 | dispatchEvent(event); |
| 182 | } |
Ted Kremenek | bc3a021 | 2009-10-30 17:24:47 +0000 | [diff] [blame] | 183 | } |
| 184 | } |
Ted Kremenek | 452b84d | 2010-03-23 01:11:38 +0000 | [diff] [blame] | 185 | |
Ted Kremenek | b4b817d | 2009-11-11 03:26:34 +0000 | [diff] [blame] | 186 | // From this point forward, we know that the location is not null. |
Anna Zaks | 063e088 | 2011-10-25 19:57:06 +0000 | [diff] [blame^] | 187 | C.generateNode(notNullState); |
Ted Kremenek | bc3a021 | 2009-10-30 17:24:47 +0000 | [diff] [blame] | 188 | } |
Argyrios Kyrtzidis | b3d74da | 2011-02-28 17:36:18 +0000 | [diff] [blame] | 189 | |
| 190 | void ento::registerDereferenceChecker(CheckerManager &mgr) { |
| 191 | mgr.registerChecker<DereferenceChecker>(); |
| 192 | } |