blob: 747fcbe311f888f6c24974f746b8f06e37c4748c [file] [log] [blame]
Ted Kremenekbc3a0212009-10-30 17:24:47 +00001//== NullDerefChecker.cpp - Null dereference checker ------------*- C++ -*--==//
2//
3// The LLVM Compiler Infrastructure
4//
5// This file is distributed under the University of Illinois Open Source
6// License. See LICENSE.TXT for details.
7//
8//===----------------------------------------------------------------------===//
9//
10// This defines NullDerefChecker, a builtin check in GRExprEngine that performs
11// checks for null pointers at loads and stores.
12//
13//===----------------------------------------------------------------------===//
14
Benjamin Kramer5e2d2c22010-03-27 21:19:47 +000015#include "GRExprEngineInternalChecks.h"
16#include "clang/Checker/BugReporter/BugType.h"
Ted Kremenekf12d3192010-01-26 22:56:15 +000017#include "clang/Checker/Checkers/DereferenceChecker.h"
Ted Kremenek1309f9a2010-01-25 04:41:41 +000018#include "clang/Checker/PathSensitive/Checker.h"
19#include "clang/Checker/PathSensitive/GRExprEngine.h"
Ted Kremenekbc3a0212009-10-30 17:24:47 +000020
21using namespace clang;
22
Ted Kremenekb4b817d2009-11-11 03:26:34 +000023namespace {
Kovarththanan Rajaratnamba5fb5a2009-11-28 06:07:30 +000024class DereferenceChecker : public Checker {
Ted Kremenekb4b817d2009-11-11 03:26:34 +000025 BuiltinBug *BT_null;
26 BuiltinBug *BT_undef;
27 llvm::SmallVector<ExplodedNode*, 2> ImplicitNullDerefNodes;
28public:
29 DereferenceChecker() : BT_null(0), BT_undef(0) {}
30 static void *getTag() { static int tag = 0; return &tag; }
31 void VisitLocation(CheckerContext &C, const Stmt *S, SVal location);
Ted Kremenek452b84d2010-03-23 01:11:38 +000032
Ted Kremenekb4b817d2009-11-11 03:26:34 +000033 std::pair<ExplodedNode * const*, ExplodedNode * const*>
Ted Kremenek452b84d2010-03-23 01:11:38 +000034 getImplicitNodes() const {
Ted Kremenekb4b817d2009-11-11 03:26:34 +000035 return std::make_pair(ImplicitNullDerefNodes.data(),
36 ImplicitNullDerefNodes.data() +
37 ImplicitNullDerefNodes.size());
38 }
Ted Kremenek646c3c32010-10-26 00:06:13 +000039 void AddDerefSource(llvm::raw_ostream &os,
40 llvm::SmallVectorImpl<SourceRange> &Ranges,
41 const Expr *Ex, bool loadedFrom = false);
Ted Kremenekb4b817d2009-11-11 03:26:34 +000042};
43} // end anonymous namespace
44
45void clang::RegisterDereferenceChecker(GRExprEngine &Eng) {
46 Eng.registerCheck(new DereferenceChecker());
Ted Kremenekbc3a0212009-10-30 17:24:47 +000047}
48
Ted Kremenekb4b817d2009-11-11 03:26:34 +000049std::pair<ExplodedNode * const *, ExplodedNode * const *>
50clang::GetImplicitNullDereferences(GRExprEngine &Eng) {
51 DereferenceChecker *checker = Eng.getChecker<DereferenceChecker>();
52 if (!checker)
53 return std::make_pair((ExplodedNode * const *) 0,
54 (ExplodedNode * const *) 0);
55 return checker->getImplicitNodes();
56}
57
Ted Kremenek646c3c32010-10-26 00:06:13 +000058void DereferenceChecker::AddDerefSource(llvm::raw_ostream &os,
59 llvm::SmallVectorImpl<SourceRange> &Ranges,
60 const Expr *Ex,
61 bool loadedFrom) {
62 switch (Ex->getStmtClass()) {
63 default:
64 return;
65 case Stmt::DeclRefExprClass: {
66 const DeclRefExpr *DR = cast<DeclRefExpr>(Ex);
67 if (const VarDecl *VD = dyn_cast<VarDecl>(DR->getDecl())) {
68 os << " (" << (loadedFrom ? "loaded from" : "from")
69 << " variable '" << VD->getName() << "')";
70 Ranges.push_back(DR->getSourceRange());
71 }
72 return;
73 }
74 case Stmt::MemberExprClass: {
75 const MemberExpr *ME = cast<MemberExpr>(Ex);
76 os << " (" << (loadedFrom ? "loaded from" : "via")
77 << " field '" << ME->getMemberNameInfo() << "')";
78 SourceLocation L = ME->getMemberLoc();
79 Ranges.push_back(SourceRange(L, L));
80 break;
81 }
82 }
83}
84
Ted Kremenekb4b817d2009-11-11 03:26:34 +000085void DereferenceChecker::VisitLocation(CheckerContext &C, const Stmt *S,
86 SVal l) {
87 // Check for dereference of an undefined value.
88 if (l.isUndef()) {
Ted Kremenek19d67b52009-11-23 22:22:01 +000089 if (ExplodedNode *N = C.GenerateSink()) {
Ted Kremenekb4b817d2009-11-11 03:26:34 +000090 if (!BT_undef)
91 BT_undef = new BuiltinBug("Dereference of undefined pointer value");
Ted Kremenek452b84d2010-03-23 01:11:38 +000092
Ted Kremenekb4b817d2009-11-11 03:26:34 +000093 EnhancedBugReport *report =
Benjamin Kramerd02e2322009-11-14 12:08:24 +000094 new EnhancedBugReport(*BT_undef, BT_undef->getDescription(), N);
Ted Kremenekb4b817d2009-11-11 03:26:34 +000095 report->addVisitorCreator(bugreporter::registerTrackNullOrUndefValue,
96 bugreporter::GetDerefExpr(N));
97 C.EmitReport(report);
98 }
99 return;
100 }
Ted Kremenek452b84d2010-03-23 01:11:38 +0000101
Ted Kremenekb4b817d2009-11-11 03:26:34 +0000102 DefinedOrUnknownSVal location = cast<DefinedOrUnknownSVal>(l);
Ted Kremenek452b84d2010-03-23 01:11:38 +0000103
104 // Check for null dereferences.
Ted Kremenekb4b817d2009-11-11 03:26:34 +0000105 if (!isa<Loc>(location))
106 return;
Ted Kremenek452b84d2010-03-23 01:11:38 +0000107
Ted Kremenekb4b817d2009-11-11 03:26:34 +0000108 const GRState *state = C.getState();
109 const GRState *notNullState, *nullState;
Ted Kremenek28f47b92010-12-01 22:16:56 +0000110 llvm::tie(notNullState, nullState) = state->assume(location);
Ted Kremenek452b84d2010-03-23 01:11:38 +0000111
Ted Kremenekb4b817d2009-11-11 03:26:34 +0000112 // The explicit NULL case.
113 if (nullState) {
Ted Kremenek452b84d2010-03-23 01:11:38 +0000114 if (!notNullState) {
Ted Kremenek78d722f2009-11-21 01:50:48 +0000115 // Generate an error node.
Ted Kremenek19d67b52009-11-23 22:22:01 +0000116 ExplodedNode *N = C.GenerateSink(nullState);
Ted Kremenek78d722f2009-11-21 01:50:48 +0000117 if (!N)
Ted Kremenekb4b817d2009-11-11 03:26:34 +0000118 return;
Ted Kremenek452b84d2010-03-23 01:11:38 +0000119
Ted Kremenek78d722f2009-11-21 01:50:48 +0000120 // We know that 'location' cannot be non-null. This is what
Ted Kremenek452b84d2010-03-23 01:11:38 +0000121 // we call an "explicit" null dereference.
Ted Kremenek78d722f2009-11-21 01:50:48 +0000122 if (!BT_null)
Ted Kremeneke576af22009-11-24 01:33:10 +0000123 BT_null = new BuiltinBug("Dereference of null pointer");
Ted Kremenek452b84d2010-03-23 01:11:38 +0000124
Ted Kremeneke576af22009-11-24 01:33:10 +0000125 llvm::SmallString<100> buf;
Ted Kremenek452b84d2010-03-23 01:11:38 +0000126 llvm::SmallVector<SourceRange, 2> Ranges;
Ted Kremeneke576af22009-11-24 01:33:10 +0000127
128 switch (S->getStmtClass()) {
Ted Kremenek646c3c32010-10-26 00:06:13 +0000129 case Stmt::ArraySubscriptExprClass: {
130 llvm::raw_svector_ostream os(buf);
131 os << "Array access";
132 const ArraySubscriptExpr *AE = cast<ArraySubscriptExpr>(S);
133 AddDerefSource(os, Ranges, AE->getBase()->IgnoreParenCasts());
134 os << " results in a null pointer dereference";
135 break;
136 }
Ted Kremeneke576af22009-11-24 01:33:10 +0000137 case Stmt::UnaryOperatorClass: {
Ted Kremenek646c3c32010-10-26 00:06:13 +0000138 llvm::raw_svector_ostream os(buf);
139 os << "Dereference of null pointer";
Ted Kremeneke576af22009-11-24 01:33:10 +0000140 const UnaryOperator *U = cast<UnaryOperator>(S);
Ted Kremenek646c3c32010-10-26 00:06:13 +0000141 AddDerefSource(os, Ranges, U->getSubExpr()->IgnoreParens(), true);
Ted Kremenek452b84d2010-03-23 01:11:38 +0000142 break;
143 }
144 case Stmt::MemberExprClass: {
145 const MemberExpr *M = cast<MemberExpr>(S);
Ted Kremenek646c3c32010-10-26 00:06:13 +0000146 if (M->isArrow()) {
147 llvm::raw_svector_ostream os(buf);
148 os << "Access to field '" << M->getMemberNameInfo()
149 << "' results in a dereference of a null pointer";
150 AddDerefSource(os, Ranges, M->getBase()->IgnoreParenCasts(), true);
151 }
Ted Kremenek452b84d2010-03-23 01:11:38 +0000152 break;
Ted Kremeneke576af22009-11-24 01:33:10 +0000153 }
Ted Kremenek0853c7f2010-09-10 20:20:49 +0000154 case Stmt::ObjCIvarRefExprClass: {
155 const ObjCIvarRefExpr *IV = cast<ObjCIvarRefExpr>(S);
156 if (const DeclRefExpr *DR =
157 dyn_cast<DeclRefExpr>(IV->getBase()->IgnoreParenCasts())) {
158 if (const VarDecl *VD = dyn_cast<VarDecl>(DR->getDecl())) {
159 llvm::raw_svector_ostream os(buf);
160 os << "Instance variable access (via '" << VD->getName()
161 << "') results in a null pointer dereference";
162 }
163 }
164 Ranges.push_back(IV->getSourceRange());
165 break;
166 }
Ted Kremeneke576af22009-11-24 01:33:10 +0000167 default:
168 break;
169 }
Ted Kremenek2c791bd2009-11-06 00:44:32 +0000170
Ted Kremenek78d722f2009-11-21 01:50:48 +0000171 EnhancedBugReport *report =
Ted Kremeneke576af22009-11-24 01:33:10 +0000172 new EnhancedBugReport(*BT_null,
173 buf.empty() ? BT_null->getDescription():buf.str(),
174 N);
175
Ted Kremenek78d722f2009-11-21 01:50:48 +0000176 report->addVisitorCreator(bugreporter::registerTrackNullOrUndefValue,
177 bugreporter::GetDerefExpr(N));
Ted Kremenek452b84d2010-03-23 01:11:38 +0000178
179 for (llvm::SmallVectorImpl<SourceRange>::iterator
180 I = Ranges.begin(), E = Ranges.end(); I!=E; ++I)
181 report->addRange(*I);
182
Ted Kremenek78d722f2009-11-21 01:50:48 +0000183 C.EmitReport(report);
184 return;
185 }
186 else {
Ted Kremenekb4b817d2009-11-11 03:26:34 +0000187 // Otherwise, we have the case where the location could either be
188 // null or not-null. Record the error node as an "implicit" null
Ted Kremenek452b84d2010-03-23 01:11:38 +0000189 // dereference.
Ted Kremenek19d67b52009-11-23 22:22:01 +0000190 if (ExplodedNode *N = C.GenerateSink(nullState))
Ted Kremenek78d722f2009-11-21 01:50:48 +0000191 ImplicitNullDerefNodes.push_back(N);
Ted Kremenekbc3a0212009-10-30 17:24:47 +0000192 }
193 }
Ted Kremenek452b84d2010-03-23 01:11:38 +0000194
Ted Kremenekb4b817d2009-11-11 03:26:34 +0000195 // From this point forward, we know that the location is not null.
Ted Kremenek19d67b52009-11-23 22:22:01 +0000196 C.addTransition(notNullState);
Ted Kremenekbc3a0212009-10-30 17:24:47 +0000197}