Ted Kremenek | 94fd0b8 | 2010-02-16 08:33:59 +0000 | [diff] [blame] | 1 | // UndefCapturedBlockVarChecker.cpp - Uninitialized captured vars -*- C++ -*-=// |
| 2 | // |
| 3 | // The LLVM Compiler Infrastructure |
| 4 | // |
| 5 | // This file is distributed under the University of Illinois Open Source |
| 6 | // License. See LICENSE.TXT for details. |
| 7 | // |
| 8 | //===----------------------------------------------------------------------===// |
| 9 | // |
| 10 | // This checker detects blocks that capture uninitialized values. |
| 11 | // |
| 12 | //===----------------------------------------------------------------------===// |
| 13 | |
Argyrios Kyrtzidis | 265c674 | 2011-02-28 01:27:26 +0000 | [diff] [blame] | 14 | #include "ClangSACheckers.h" |
Argyrios Kyrtzidis | ec8605f | 2011-03-01 01:16:21 +0000 | [diff] [blame] | 15 | #include "clang/StaticAnalyzer/Core/Checker.h" |
Argyrios Kyrtzidis | 265c674 | 2011-02-28 01:27:26 +0000 | [diff] [blame] | 16 | #include "clang/StaticAnalyzer/Core/CheckerManager.h" |
| 17 | #include "clang/StaticAnalyzer/Core/PathSensitive/CheckerContext.h" |
Ted Kremenek | 9b66371 | 2011-02-10 01:03:03 +0000 | [diff] [blame] | 18 | #include "clang/StaticAnalyzer/Core/PathSensitive/ExprEngine.h" |
| 19 | #include "clang/StaticAnalyzer/Core/BugReporter/BugType.h" |
Ted Kremenek | 94fd0b8 | 2010-02-16 08:33:59 +0000 | [diff] [blame] | 20 | #include "llvm/Support/raw_ostream.h" |
| 21 | |
| 22 | using namespace clang; |
Ted Kremenek | 9ef6537 | 2010-12-23 07:20:52 +0000 | [diff] [blame] | 23 | using namespace ento; |
Ted Kremenek | 94fd0b8 | 2010-02-16 08:33:59 +0000 | [diff] [blame] | 24 | |
| 25 | namespace { |
| 26 | class UndefCapturedBlockVarChecker |
Argyrios Kyrtzidis | ec8605f | 2011-03-01 01:16:21 +0000 | [diff] [blame] | 27 | : public Checker< check::PostStmt<BlockExpr> > { |
Argyrios Kyrtzidis | 265c674 | 2011-02-28 01:27:26 +0000 | [diff] [blame] | 28 | mutable llvm::OwningPtr<BugType> BT; |
Ted Kremenek | 94fd0b8 | 2010-02-16 08:33:59 +0000 | [diff] [blame] | 29 | |
| 30 | public: |
Argyrios Kyrtzidis | 265c674 | 2011-02-28 01:27:26 +0000 | [diff] [blame] | 31 | void checkPostStmt(const BlockExpr *BE, CheckerContext &C) const; |
Ted Kremenek | 94fd0b8 | 2010-02-16 08:33:59 +0000 | [diff] [blame] | 32 | }; |
| 33 | } // end anonymous namespace |
| 34 | |
Ted Kremenek | 94fd0b8 | 2010-02-16 08:33:59 +0000 | [diff] [blame] | 35 | static const BlockDeclRefExpr *FindBlockDeclRefExpr(const Stmt *S, |
| 36 | const VarDecl *VD){ |
| 37 | if (const BlockDeclRefExpr *BR = dyn_cast<BlockDeclRefExpr>(S)) |
| 38 | if (BR->getDecl() == VD) |
| 39 | return BR; |
| 40 | |
| 41 | for (Stmt::const_child_iterator I = S->child_begin(), E = S->child_end(); |
| 42 | I!=E; ++I) |
| 43 | if (const Stmt *child = *I) { |
| 44 | const BlockDeclRefExpr *BR = FindBlockDeclRefExpr(child, VD); |
| 45 | if (BR) |
| 46 | return BR; |
| 47 | } |
| 48 | |
| 49 | return NULL; |
| 50 | } |
| 51 | |
| 52 | void |
Argyrios Kyrtzidis | 265c674 | 2011-02-28 01:27:26 +0000 | [diff] [blame] | 53 | UndefCapturedBlockVarChecker::checkPostStmt(const BlockExpr *BE, |
| 54 | CheckerContext &C) const { |
John McCall | 469a1eb | 2011-02-02 13:00:07 +0000 | [diff] [blame] | 55 | if (!BE->getBlockDecl()->hasCaptures()) |
Ted Kremenek | 94fd0b8 | 2010-02-16 08:33:59 +0000 | [diff] [blame] | 56 | return; |
| 57 | |
Ted Kremenek | 18c66fd | 2011-08-15 22:09:50 +0000 | [diff] [blame] | 58 | const ProgramState *state = C.getState(); |
Ted Kremenek | 94fd0b8 | 2010-02-16 08:33:59 +0000 | [diff] [blame] | 59 | const BlockDataRegion *R = |
| 60 | cast<BlockDataRegion>(state->getSVal(BE).getAsRegion()); |
| 61 | |
| 62 | BlockDataRegion::referenced_vars_iterator I = R->referenced_vars_begin(), |
| 63 | E = R->referenced_vars_end(); |
| 64 | |
| 65 | for (; I != E; ++I) { |
| 66 | // This VarRegion is the region associated with the block; we need |
| 67 | // the one associated with the encompassing context. |
| 68 | const VarRegion *VR = *I; |
| 69 | const VarDecl *VD = VR->getDecl(); |
| 70 | |
| 71 | if (VD->getAttr<BlocksAttr>() || !VD->hasLocalStorage()) |
| 72 | continue; |
| 73 | |
| 74 | // Get the VarRegion associated with VD in the local stack frame. |
Anna Zaks | 39ac187 | 2011-10-26 21:06:44 +0000 | [diff] [blame^] | 75 | const LocationContext *LC = C.getLocationContext(); |
Ted Kremenek | c8413fd | 2010-12-02 07:49:45 +0000 | [diff] [blame] | 76 | VR = C.getSValBuilder().getRegionManager().getVarRegion(VD, LC); |
Anna Zaks | 50bbc16 | 2011-08-19 22:33:38 +0000 | [diff] [blame] | 77 | SVal VRVal = state->getSVal(VR); |
Ted Kremenek | 94fd0b8 | 2010-02-16 08:33:59 +0000 | [diff] [blame] | 78 | |
Anna Zaks | 50bbc16 | 2011-08-19 22:33:38 +0000 | [diff] [blame] | 79 | if (VRVal.isUndef()) |
Ted Kremenek | d048c6e | 2010-12-20 21:19:09 +0000 | [diff] [blame] | 80 | if (ExplodedNode *N = C.generateSink()) { |
Ted Kremenek | 94fd0b8 | 2010-02-16 08:33:59 +0000 | [diff] [blame] | 81 | if (!BT) |
Argyrios Kyrtzidis | 265c674 | 2011-02-28 01:27:26 +0000 | [diff] [blame] | 82 | BT.reset(new BuiltinBug("uninitialized variable captured by block")); |
Ted Kremenek | 94fd0b8 | 2010-02-16 08:33:59 +0000 | [diff] [blame] | 83 | |
| 84 | // Generate a bug report. |
| 85 | llvm::SmallString<128> buf; |
| 86 | llvm::raw_svector_ostream os(buf); |
| 87 | |
Ted Kremenek | 937596f | 2011-01-25 19:13:42 +0000 | [diff] [blame] | 88 | os << "Variable '" << VD->getName() |
| 89 | << "' is uninitialized when captured by block"; |
Ted Kremenek | 94fd0b8 | 2010-02-16 08:33:59 +0000 | [diff] [blame] | 90 | |
Anna Zaks | e172e8b | 2011-08-17 23:00:25 +0000 | [diff] [blame] | 91 | BugReport *R = new BugReport(*BT, os.str(), N); |
Ted Kremenek | 94fd0b8 | 2010-02-16 08:33:59 +0000 | [diff] [blame] | 92 | if (const Expr *Ex = FindBlockDeclRefExpr(BE->getBody(), VD)) |
| 93 | R->addRange(Ex->getSourceRange()); |
Anna Zaks | 50bbc16 | 2011-08-19 22:33:38 +0000 | [diff] [blame] | 94 | R->addVisitor(new FindLastStoreBRVisitor(VRVal, VR)); |
Ted Kremenek | 94fd0b8 | 2010-02-16 08:33:59 +0000 | [diff] [blame] | 95 | // need location of block |
| 96 | C.EmitReport(R); |
| 97 | } |
| 98 | } |
| 99 | } |
Argyrios Kyrtzidis | 265c674 | 2011-02-28 01:27:26 +0000 | [diff] [blame] | 100 | |
| 101 | void ento::registerUndefCapturedBlockVarChecker(CheckerManager &mgr) { |
| 102 | mgr.registerChecker<UndefCapturedBlockVarChecker>(); |
| 103 | } |