Ted Kremenek | bc3a021 | 2009-10-30 17:24:47 +0000 | [diff] [blame] | 1 | //== NullDerefChecker.cpp - Null dereference checker ------------*- C++ -*--==// |
| 2 | // |
| 3 | // The LLVM Compiler Infrastructure |
| 4 | // |
| 5 | // This file is distributed under the University of Illinois Open Source |
| 6 | // License. See LICENSE.TXT for details. |
| 7 | // |
| 8 | //===----------------------------------------------------------------------===// |
| 9 | // |
| 10 | // This defines NullDerefChecker, a builtin check in GRExprEngine that performs |
| 11 | // checks for null pointers at loads and stores. |
| 12 | // |
| 13 | //===----------------------------------------------------------------------===// |
| 14 | |
Benjamin Kramer | 5e2d2c2 | 2010-03-27 21:19:47 +0000 | [diff] [blame] | 15 | #include "GRExprEngineInternalChecks.h" |
| 16 | #include "clang/Checker/BugReporter/BugType.h" |
Ted Kremenek | f12d319 | 2010-01-26 22:56:15 +0000 | [diff] [blame] | 17 | #include "clang/Checker/Checkers/DereferenceChecker.h" |
Ted Kremenek | 1309f9a | 2010-01-25 04:41:41 +0000 | [diff] [blame] | 18 | #include "clang/Checker/PathSensitive/Checker.h" |
| 19 | #include "clang/Checker/PathSensitive/GRExprEngine.h" |
Ted Kremenek | bc3a021 | 2009-10-30 17:24:47 +0000 | [diff] [blame] | 20 | |
| 21 | using namespace clang; |
| 22 | |
Ted Kremenek | b4b817d | 2009-11-11 03:26:34 +0000 | [diff] [blame] | 23 | namespace { |
Kovarththanan Rajaratnam | ba5fb5a | 2009-11-28 06:07:30 +0000 | [diff] [blame] | 24 | class DereferenceChecker : public Checker { |
Ted Kremenek | b4b817d | 2009-11-11 03:26:34 +0000 | [diff] [blame] | 25 | BuiltinBug *BT_null; |
| 26 | BuiltinBug *BT_undef; |
| 27 | llvm::SmallVector<ExplodedNode*, 2> ImplicitNullDerefNodes; |
| 28 | public: |
| 29 | DereferenceChecker() : BT_null(0), BT_undef(0) {} |
| 30 | static void *getTag() { static int tag = 0; return &tag; } |
| 31 | void VisitLocation(CheckerContext &C, const Stmt *S, SVal location); |
Ted Kremenek | 452b84d | 2010-03-23 01:11:38 +0000 | [diff] [blame] | 32 | |
Ted Kremenek | b4b817d | 2009-11-11 03:26:34 +0000 | [diff] [blame] | 33 | std::pair<ExplodedNode * const*, ExplodedNode * const*> |
Ted Kremenek | 452b84d | 2010-03-23 01:11:38 +0000 | [diff] [blame] | 34 | getImplicitNodes() const { |
Ted Kremenek | b4b817d | 2009-11-11 03:26:34 +0000 | [diff] [blame] | 35 | return std::make_pair(ImplicitNullDerefNodes.data(), |
| 36 | ImplicitNullDerefNodes.data() + |
| 37 | ImplicitNullDerefNodes.size()); |
| 38 | } |
Ted Kremenek | 646c3c3 | 2010-10-26 00:06:13 +0000 | [diff] [blame] | 39 | void AddDerefSource(llvm::raw_ostream &os, |
| 40 | llvm::SmallVectorImpl<SourceRange> &Ranges, |
| 41 | const Expr *Ex, bool loadedFrom = false); |
Ted Kremenek | b4b817d | 2009-11-11 03:26:34 +0000 | [diff] [blame] | 42 | }; |
| 43 | } // end anonymous namespace |
| 44 | |
| 45 | void clang::RegisterDereferenceChecker(GRExprEngine &Eng) { |
| 46 | Eng.registerCheck(new DereferenceChecker()); |
Ted Kremenek | bc3a021 | 2009-10-30 17:24:47 +0000 | [diff] [blame] | 47 | } |
| 48 | |
Ted Kremenek | b4b817d | 2009-11-11 03:26:34 +0000 | [diff] [blame] | 49 | std::pair<ExplodedNode * const *, ExplodedNode * const *> |
| 50 | clang::GetImplicitNullDereferences(GRExprEngine &Eng) { |
| 51 | DereferenceChecker *checker = Eng.getChecker<DereferenceChecker>(); |
| 52 | if (!checker) |
| 53 | return std::make_pair((ExplodedNode * const *) 0, |
| 54 | (ExplodedNode * const *) 0); |
| 55 | return checker->getImplicitNodes(); |
| 56 | } |
| 57 | |
Ted Kremenek | 646c3c3 | 2010-10-26 00:06:13 +0000 | [diff] [blame] | 58 | void DereferenceChecker::AddDerefSource(llvm::raw_ostream &os, |
| 59 | llvm::SmallVectorImpl<SourceRange> &Ranges, |
| 60 | const Expr *Ex, |
| 61 | bool loadedFrom) { |
| 62 | switch (Ex->getStmtClass()) { |
| 63 | default: |
| 64 | return; |
| 65 | case Stmt::DeclRefExprClass: { |
| 66 | const DeclRefExpr *DR = cast<DeclRefExpr>(Ex); |
| 67 | if (const VarDecl *VD = dyn_cast<VarDecl>(DR->getDecl())) { |
| 68 | os << " (" << (loadedFrom ? "loaded from" : "from") |
| 69 | << " variable '" << VD->getName() << "')"; |
| 70 | Ranges.push_back(DR->getSourceRange()); |
| 71 | } |
| 72 | return; |
| 73 | } |
| 74 | case Stmt::MemberExprClass: { |
| 75 | const MemberExpr *ME = cast<MemberExpr>(Ex); |
| 76 | os << " (" << (loadedFrom ? "loaded from" : "via") |
| 77 | << " field '" << ME->getMemberNameInfo() << "')"; |
| 78 | SourceLocation L = ME->getMemberLoc(); |
| 79 | Ranges.push_back(SourceRange(L, L)); |
| 80 | break; |
| 81 | } |
| 82 | } |
| 83 | } |
| 84 | |
Ted Kremenek | b4b817d | 2009-11-11 03:26:34 +0000 | [diff] [blame] | 85 | void DereferenceChecker::VisitLocation(CheckerContext &C, const Stmt *S, |
| 86 | SVal l) { |
| 87 | // Check for dereference of an undefined value. |
| 88 | if (l.isUndef()) { |
Ted Kremenek | 19d67b5 | 2009-11-23 22:22:01 +0000 | [diff] [blame] | 89 | if (ExplodedNode *N = C.GenerateSink()) { |
Ted Kremenek | b4b817d | 2009-11-11 03:26:34 +0000 | [diff] [blame] | 90 | if (!BT_undef) |
| 91 | BT_undef = new BuiltinBug("Dereference of undefined pointer value"); |
Ted Kremenek | 452b84d | 2010-03-23 01:11:38 +0000 | [diff] [blame] | 92 | |
Ted Kremenek | b4b817d | 2009-11-11 03:26:34 +0000 | [diff] [blame] | 93 | EnhancedBugReport *report = |
Benjamin Kramer | d02e232 | 2009-11-14 12:08:24 +0000 | [diff] [blame] | 94 | new EnhancedBugReport(*BT_undef, BT_undef->getDescription(), N); |
Ted Kremenek | b4b817d | 2009-11-11 03:26:34 +0000 | [diff] [blame] | 95 | report->addVisitorCreator(bugreporter::registerTrackNullOrUndefValue, |
| 96 | bugreporter::GetDerefExpr(N)); |
| 97 | C.EmitReport(report); |
| 98 | } |
| 99 | return; |
| 100 | } |
Ted Kremenek | 452b84d | 2010-03-23 01:11:38 +0000 | [diff] [blame] | 101 | |
Ted Kremenek | b4b817d | 2009-11-11 03:26:34 +0000 | [diff] [blame] | 102 | DefinedOrUnknownSVal location = cast<DefinedOrUnknownSVal>(l); |
Ted Kremenek | 452b84d | 2010-03-23 01:11:38 +0000 | [diff] [blame] | 103 | |
| 104 | // Check for null dereferences. |
Ted Kremenek | b4b817d | 2009-11-11 03:26:34 +0000 | [diff] [blame] | 105 | if (!isa<Loc>(location)) |
| 106 | return; |
Ted Kremenek | 452b84d | 2010-03-23 01:11:38 +0000 | [diff] [blame] | 107 | |
Ted Kremenek | b4b817d | 2009-11-11 03:26:34 +0000 | [diff] [blame] | 108 | const GRState *state = C.getState(); |
| 109 | const GRState *notNullState, *nullState; |
Ted Kremenek | 28f47b9 | 2010-12-01 22:16:56 +0000 | [diff] [blame^] | 110 | llvm::tie(notNullState, nullState) = state->assume(location); |
Ted Kremenek | 452b84d | 2010-03-23 01:11:38 +0000 | [diff] [blame] | 111 | |
Ted Kremenek | b4b817d | 2009-11-11 03:26:34 +0000 | [diff] [blame] | 112 | // The explicit NULL case. |
| 113 | if (nullState) { |
Ted Kremenek | 452b84d | 2010-03-23 01:11:38 +0000 | [diff] [blame] | 114 | if (!notNullState) { |
Ted Kremenek | 78d722f | 2009-11-21 01:50:48 +0000 | [diff] [blame] | 115 | // Generate an error node. |
Ted Kremenek | 19d67b5 | 2009-11-23 22:22:01 +0000 | [diff] [blame] | 116 | ExplodedNode *N = C.GenerateSink(nullState); |
Ted Kremenek | 78d722f | 2009-11-21 01:50:48 +0000 | [diff] [blame] | 117 | if (!N) |
Ted Kremenek | b4b817d | 2009-11-11 03:26:34 +0000 | [diff] [blame] | 118 | return; |
Ted Kremenek | 452b84d | 2010-03-23 01:11:38 +0000 | [diff] [blame] | 119 | |
Ted Kremenek | 78d722f | 2009-11-21 01:50:48 +0000 | [diff] [blame] | 120 | // We know that 'location' cannot be non-null. This is what |
Ted Kremenek | 452b84d | 2010-03-23 01:11:38 +0000 | [diff] [blame] | 121 | // we call an "explicit" null dereference. |
Ted Kremenek | 78d722f | 2009-11-21 01:50:48 +0000 | [diff] [blame] | 122 | if (!BT_null) |
Ted Kremenek | e576af2 | 2009-11-24 01:33:10 +0000 | [diff] [blame] | 123 | BT_null = new BuiltinBug("Dereference of null pointer"); |
Ted Kremenek | 452b84d | 2010-03-23 01:11:38 +0000 | [diff] [blame] | 124 | |
Ted Kremenek | e576af2 | 2009-11-24 01:33:10 +0000 | [diff] [blame] | 125 | llvm::SmallString<100> buf; |
Ted Kremenek | 452b84d | 2010-03-23 01:11:38 +0000 | [diff] [blame] | 126 | llvm::SmallVector<SourceRange, 2> Ranges; |
Ted Kremenek | e576af2 | 2009-11-24 01:33:10 +0000 | [diff] [blame] | 127 | |
| 128 | switch (S->getStmtClass()) { |
Ted Kremenek | 646c3c3 | 2010-10-26 00:06:13 +0000 | [diff] [blame] | 129 | case Stmt::ArraySubscriptExprClass: { |
| 130 | llvm::raw_svector_ostream os(buf); |
| 131 | os << "Array access"; |
| 132 | const ArraySubscriptExpr *AE = cast<ArraySubscriptExpr>(S); |
| 133 | AddDerefSource(os, Ranges, AE->getBase()->IgnoreParenCasts()); |
| 134 | os << " results in a null pointer dereference"; |
| 135 | break; |
| 136 | } |
Ted Kremenek | e576af2 | 2009-11-24 01:33:10 +0000 | [diff] [blame] | 137 | case Stmt::UnaryOperatorClass: { |
Ted Kremenek | 646c3c3 | 2010-10-26 00:06:13 +0000 | [diff] [blame] | 138 | llvm::raw_svector_ostream os(buf); |
| 139 | os << "Dereference of null pointer"; |
Ted Kremenek | e576af2 | 2009-11-24 01:33:10 +0000 | [diff] [blame] | 140 | const UnaryOperator *U = cast<UnaryOperator>(S); |
Ted Kremenek | 646c3c3 | 2010-10-26 00:06:13 +0000 | [diff] [blame] | 141 | AddDerefSource(os, Ranges, U->getSubExpr()->IgnoreParens(), true); |
Ted Kremenek | 452b84d | 2010-03-23 01:11:38 +0000 | [diff] [blame] | 142 | break; |
| 143 | } |
| 144 | case Stmt::MemberExprClass: { |
| 145 | const MemberExpr *M = cast<MemberExpr>(S); |
Ted Kremenek | 646c3c3 | 2010-10-26 00:06:13 +0000 | [diff] [blame] | 146 | if (M->isArrow()) { |
| 147 | llvm::raw_svector_ostream os(buf); |
| 148 | os << "Access to field '" << M->getMemberNameInfo() |
| 149 | << "' results in a dereference of a null pointer"; |
| 150 | AddDerefSource(os, Ranges, M->getBase()->IgnoreParenCasts(), true); |
| 151 | } |
Ted Kremenek | 452b84d | 2010-03-23 01:11:38 +0000 | [diff] [blame] | 152 | break; |
Ted Kremenek | e576af2 | 2009-11-24 01:33:10 +0000 | [diff] [blame] | 153 | } |
Ted Kremenek | 0853c7f | 2010-09-10 20:20:49 +0000 | [diff] [blame] | 154 | case Stmt::ObjCIvarRefExprClass: { |
| 155 | const ObjCIvarRefExpr *IV = cast<ObjCIvarRefExpr>(S); |
| 156 | if (const DeclRefExpr *DR = |
| 157 | dyn_cast<DeclRefExpr>(IV->getBase()->IgnoreParenCasts())) { |
| 158 | if (const VarDecl *VD = dyn_cast<VarDecl>(DR->getDecl())) { |
| 159 | llvm::raw_svector_ostream os(buf); |
| 160 | os << "Instance variable access (via '" << VD->getName() |
| 161 | << "') results in a null pointer dereference"; |
| 162 | } |
| 163 | } |
| 164 | Ranges.push_back(IV->getSourceRange()); |
| 165 | break; |
| 166 | } |
Ted Kremenek | e576af2 | 2009-11-24 01:33:10 +0000 | [diff] [blame] | 167 | default: |
| 168 | break; |
| 169 | } |
Ted Kremenek | 2c791bd | 2009-11-06 00:44:32 +0000 | [diff] [blame] | 170 | |
Ted Kremenek | 78d722f | 2009-11-21 01:50:48 +0000 | [diff] [blame] | 171 | EnhancedBugReport *report = |
Ted Kremenek | e576af2 | 2009-11-24 01:33:10 +0000 | [diff] [blame] | 172 | new EnhancedBugReport(*BT_null, |
| 173 | buf.empty() ? BT_null->getDescription():buf.str(), |
| 174 | N); |
| 175 | |
Ted Kremenek | 78d722f | 2009-11-21 01:50:48 +0000 | [diff] [blame] | 176 | report->addVisitorCreator(bugreporter::registerTrackNullOrUndefValue, |
| 177 | bugreporter::GetDerefExpr(N)); |
Ted Kremenek | 452b84d | 2010-03-23 01:11:38 +0000 | [diff] [blame] | 178 | |
| 179 | for (llvm::SmallVectorImpl<SourceRange>::iterator |
| 180 | I = Ranges.begin(), E = Ranges.end(); I!=E; ++I) |
| 181 | report->addRange(*I); |
| 182 | |
Ted Kremenek | 78d722f | 2009-11-21 01:50:48 +0000 | [diff] [blame] | 183 | C.EmitReport(report); |
| 184 | return; |
| 185 | } |
| 186 | else { |
Ted Kremenek | b4b817d | 2009-11-11 03:26:34 +0000 | [diff] [blame] | 187 | // Otherwise, we have the case where the location could either be |
| 188 | // null or not-null. Record the error node as an "implicit" null |
Ted Kremenek | 452b84d | 2010-03-23 01:11:38 +0000 | [diff] [blame] | 189 | // dereference. |
Ted Kremenek | 19d67b5 | 2009-11-23 22:22:01 +0000 | [diff] [blame] | 190 | if (ExplodedNode *N = C.GenerateSink(nullState)) |
Ted Kremenek | 78d722f | 2009-11-21 01:50:48 +0000 | [diff] [blame] | 191 | ImplicitNullDerefNodes.push_back(N); |
Ted Kremenek | bc3a021 | 2009-10-30 17:24:47 +0000 | [diff] [blame] | 192 | } |
| 193 | } |
Ted Kremenek | 452b84d | 2010-03-23 01:11:38 +0000 | [diff] [blame] | 194 | |
Ted Kremenek | b4b817d | 2009-11-11 03:26:34 +0000 | [diff] [blame] | 195 | // From this point forward, we know that the location is not null. |
Ted Kremenek | 19d67b5 | 2009-11-23 22:22:01 +0000 | [diff] [blame] | 196 | C.addTransition(notNullState); |
Ted Kremenek | bc3a021 | 2009-10-30 17:24:47 +0000 | [diff] [blame] | 197 | } |