Ted Kremenek | 99c6ad3 | 2008-03-27 07:25:52 +0000 | [diff] [blame] | 1 | //== BasicObjCFoundationChecks.cpp - Simple Apple-Foundation checks -*- C++ -*-- |
| 2 | // |
| 3 | // The LLVM Compiler Infrastructure |
| 4 | // |
| 5 | // This file is distributed under the University of Illinois Open Source |
| 6 | // License. See LICENSE.TXT for details. |
| 7 | // |
| 8 | //===----------------------------------------------------------------------===// |
| 9 | // |
| 10 | // This file defines BasicObjCFoundationChecks, a class that encapsulates |
| 11 | // a set of simple checks to run on Objective-C code using Apple's Foundation |
| 12 | // classes. |
| 13 | // |
| 14 | //===----------------------------------------------------------------------===// |
| 15 | |
Ted Kremenek | 5275561 | 2008-03-27 17:17:22 +0000 | [diff] [blame] | 16 | #include "BasicObjCFoundationChecks.h" |
| 17 | |
Ted Kremenek | 99c6ad3 | 2008-03-27 07:25:52 +0000 | [diff] [blame] | 18 | #include "clang/Analysis/PathSensitive/ExplodedGraph.h" |
| 19 | #include "clang/Analysis/PathSensitive/GRSimpleAPICheck.h" |
Ted Kremenek | 78d4624 | 2008-07-22 16:21:24 +0000 | [diff] [blame] | 20 | #include "clang/Analysis/PathSensitive/GRExprEngine.h" |
Ted Kremenek | 4adc81e | 2008-08-13 04:27:00 +0000 | [diff] [blame] | 21 | #include "clang/Analysis/PathSensitive/GRState.h" |
Ted Kremenek | f1ae705 | 2008-04-03 17:57:38 +0000 | [diff] [blame] | 22 | #include "clang/Analysis/PathSensitive/BugReporter.h" |
Ted Kremenek | 9e24049 | 2008-10-04 05:50:14 +0000 | [diff] [blame] | 23 | #include "clang/Analysis/PathSensitive/MemRegion.h" |
Ted Kremenek | 99c6ad3 | 2008-03-27 07:25:52 +0000 | [diff] [blame] | 24 | #include "clang/Analysis/PathDiagnostic.h" |
Ted Kremenek | 50e837b | 2009-11-20 05:27:05 +0000 | [diff] [blame] | 25 | #include "clang/Analysis/PathSensitive/CheckerVisitor.h" |
Ted Kremenek | 78d4624 | 2008-07-22 16:21:24 +0000 | [diff] [blame] | 26 | #include "clang/Analysis/LocalCheckers.h" |
Daniel Dunbar | c4a1dea | 2008-08-11 05:35:13 +0000 | [diff] [blame] | 27 | #include "clang/AST/DeclObjC.h" |
Ted Kremenek | 99c6ad3 | 2008-03-27 07:25:52 +0000 | [diff] [blame] | 28 | #include "clang/AST/Expr.h" |
Steve Naroff | f494b57 | 2008-05-29 21:12:08 +0000 | [diff] [blame] | 29 | #include "clang/AST/ExprObjC.h" |
Ted Kremenek | 99c6ad3 | 2008-03-27 07:25:52 +0000 | [diff] [blame] | 30 | #include "clang/AST/ASTContext.h" |
Ted Kremenek | 99c6ad3 | 2008-03-27 07:25:52 +0000 | [diff] [blame] | 31 | |
Ted Kremenek | 99c6ad3 | 2008-03-27 07:25:52 +0000 | [diff] [blame] | 32 | using namespace clang; |
Ted Kremenek | 5275561 | 2008-03-27 17:17:22 +0000 | [diff] [blame] | 33 | |
Steve Naroff | 14108da | 2009-07-10 23:34:53 +0000 | [diff] [blame] | 34 | static const ObjCInterfaceType* GetReceiverType(const ObjCMessageExpr* ME) { |
| 35 | const Expr* Receiver = ME->getReceiver(); |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 36 | |
Ted Kremenek | 4ba6283 | 2008-03-27 22:05:32 +0000 | [diff] [blame] | 37 | if (!Receiver) |
| 38 | return NULL; |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 39 | |
Steve Naroff | 14108da | 2009-07-10 23:34:53 +0000 | [diff] [blame] | 40 | if (const ObjCObjectPointerType *PT = |
John McCall | 183700f | 2009-09-21 23:43:11 +0000 | [diff] [blame] | 41 | Receiver->getType()->getAs<ObjCObjectPointerType>()) |
Steve Naroff | 14108da | 2009-07-10 23:34:53 +0000 | [diff] [blame] | 42 | return PT->getInterfaceType(); |
Ted Kremenek | c1ff3cd | 2008-04-30 22:48:21 +0000 | [diff] [blame] | 43 | |
Ted Kremenek | c1ff3cd | 2008-04-30 22:48:21 +0000 | [diff] [blame] | 44 | return NULL; |
Ted Kremenek | 4ba6283 | 2008-03-27 22:05:32 +0000 | [diff] [blame] | 45 | } |
| 46 | |
Steve Naroff | 14108da | 2009-07-10 23:34:53 +0000 | [diff] [blame] | 47 | static const char* GetReceiverNameType(const ObjCMessageExpr* ME) { |
Daniel Dunbar | e013d68 | 2009-10-18 20:26:12 +0000 | [diff] [blame] | 48 | if (const ObjCInterfaceType *ReceiverType = GetReceiverType(ME)) |
| 49 | return ReceiverType->getDecl()->getIdentifier()->getNameStart(); |
| 50 | return NULL; |
Ted Kremenek | 4ba6283 | 2008-03-27 22:05:32 +0000 | [diff] [blame] | 51 | } |
Ted Kremenek | 5275561 | 2008-03-27 17:17:22 +0000 | [diff] [blame] | 52 | |
Ted Kremenek | f1ae705 | 2008-04-03 17:57:38 +0000 | [diff] [blame] | 53 | namespace { |
Ted Kremenek | b344f91 | 2008-09-21 19:01:39 +0000 | [diff] [blame] | 54 | |
Kovarththanan Rajaratnam | ba5fb5a | 2009-11-28 06:07:30 +0000 | [diff] [blame] | 55 | class APIMisuse : public BugType { |
Ted Kremenek | f1ae705 | 2008-04-03 17:57:38 +0000 | [diff] [blame] | 56 | public: |
Ted Kremenek | cf118d4 | 2009-02-04 23:49:09 +0000 | [diff] [blame] | 57 | APIMisuse(const char* name) : BugType(name, "API Misuse (Apple)") {} |
Ted Kremenek | f1ae705 | 2008-04-03 17:57:38 +0000 | [diff] [blame] | 58 | }; |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 59 | |
Kovarththanan Rajaratnam | ba5fb5a | 2009-11-28 06:07:30 +0000 | [diff] [blame] | 60 | class BasicObjCFoundationChecks : public GRSimpleAPICheck { |
Ted Kremenek | cf118d4 | 2009-02-04 23:49:09 +0000 | [diff] [blame] | 61 | APIMisuse *BT; |
| 62 | BugReporter& BR; |
Ted Kremenek | f1ae705 | 2008-04-03 17:57:38 +0000 | [diff] [blame] | 63 | ASTContext &Ctx; |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 64 | |
Daniel Dunbar | d777d58 | 2009-10-17 18:12:21 +0000 | [diff] [blame] | 65 | bool isNSString(const ObjCInterfaceType *T, llvm::StringRef suffix); |
Zhongxing Xu | 031ccc0 | 2009-08-06 12:48:26 +0000 | [diff] [blame] | 66 | bool AuditNSString(ExplodedNode* N, const ObjCMessageExpr* ME); |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 67 | |
| 68 | void Warn(ExplodedNode* N, const Expr* E, const std::string& s); |
Zhongxing Xu | 031ccc0 | 2009-08-06 12:48:26 +0000 | [diff] [blame] | 69 | void WarnNilArg(ExplodedNode* N, const Expr* E); |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 70 | |
Zhongxing Xu | 031ccc0 | 2009-08-06 12:48:26 +0000 | [diff] [blame] | 71 | bool CheckNilArg(ExplodedNode* N, unsigned Arg); |
Ted Kremenek | f1ae705 | 2008-04-03 17:57:38 +0000 | [diff] [blame] | 72 | |
| 73 | public: |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 74 | BasicObjCFoundationChecks(ASTContext& ctx, BugReporter& br) |
Ted Kremenek | 23ec48c | 2009-06-18 23:58:37 +0000 | [diff] [blame] | 75 | : BT(0), BR(br), Ctx(ctx) {} |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 76 | |
Zhongxing Xu | c5619d9 | 2009-08-06 01:32:16 +0000 | [diff] [blame] | 77 | bool Audit(ExplodedNode* N, GRStateManager&); |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 78 | |
| 79 | private: |
| 80 | void WarnNilArg(ExplodedNode* N, const ObjCMessageExpr* ME, unsigned Arg) { |
Ted Kremenek | cf118d4 | 2009-02-04 23:49:09 +0000 | [diff] [blame] | 81 | std::string sbuf; |
| 82 | llvm::raw_string_ostream os(sbuf); |
| 83 | os << "Argument to '" << GetReceiverNameType(ME) << "' method '" |
| 84 | << ME->getSelector().getAsString() << "' cannot be nil."; |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 85 | |
Ted Kremenek | cf118d4 | 2009-02-04 23:49:09 +0000 | [diff] [blame] | 86 | // Lazily create the BugType object for NilArg. This will be owned |
| 87 | // by the BugReporter object 'BR' once we call BR.EmitWarning. |
| 88 | if (!BT) BT = new APIMisuse("nil argument"); |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 89 | |
Benjamin Kramer | 4988a9a | 2009-11-29 18:03:28 +0000 | [diff] [blame] | 90 | RangedBugReport *R = new RangedBugReport(*BT, os.str(), N); |
Ted Kremenek | cf118d4 | 2009-02-04 23:49:09 +0000 | [diff] [blame] | 91 | R->addRange(ME->getArg(Arg)->getSourceRange()); |
| 92 | BR.EmitReport(R); |
Ted Kremenek | f1ae705 | 2008-04-03 17:57:38 +0000 | [diff] [blame] | 93 | } |
| 94 | }; |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 95 | |
Ted Kremenek | f1ae705 | 2008-04-03 17:57:38 +0000 | [diff] [blame] | 96 | } // end anonymous namespace |
| 97 | |
| 98 | |
| 99 | GRSimpleAPICheck* |
Ted Kremenek | 23ec48c | 2009-06-18 23:58:37 +0000 | [diff] [blame] | 100 | clang::CreateBasicObjCFoundationChecks(ASTContext& Ctx, BugReporter& BR) { |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 101 | return new BasicObjCFoundationChecks(Ctx, BR); |
Ted Kremenek | f1ae705 | 2008-04-03 17:57:38 +0000 | [diff] [blame] | 102 | } |
| 103 | |
| 104 | |
| 105 | |
Zhongxing Xu | c5619d9 | 2009-08-06 01:32:16 +0000 | [diff] [blame] | 106 | bool BasicObjCFoundationChecks::Audit(ExplodedNode* N, |
Ted Kremenek | 4adc81e | 2008-08-13 04:27:00 +0000 | [diff] [blame] | 107 | GRStateManager&) { |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 108 | |
Ted Kremenek | 5f85e17 | 2009-07-22 22:35:28 +0000 | [diff] [blame] | 109 | const ObjCMessageExpr* ME = |
Ted Kremenek | 99c6ad3 | 2008-03-27 07:25:52 +0000 | [diff] [blame] | 110 | cast<ObjCMessageExpr>(cast<PostStmt>(N->getLocation()).getStmt()); |
Ted Kremenek | 99c6ad3 | 2008-03-27 07:25:52 +0000 | [diff] [blame] | 111 | |
Steve Naroff | 14108da | 2009-07-10 23:34:53 +0000 | [diff] [blame] | 112 | const ObjCInterfaceType *ReceiverType = GetReceiverType(ME); |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 113 | |
Ted Kremenek | 99c6ad3 | 2008-03-27 07:25:52 +0000 | [diff] [blame] | 114 | if (!ReceiverType) |
Nuno Lopes | f742794 | 2008-05-20 17:33:56 +0000 | [diff] [blame] | 115 | return false; |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 116 | |
Daniel Dunbar | d777d58 | 2009-10-17 18:12:21 +0000 | [diff] [blame] | 117 | if (isNSString(ReceiverType, |
Daniel Dunbar | 01eb9b9 | 2009-10-18 21:17:35 +0000 | [diff] [blame] | 118 | ReceiverType->getDecl()->getIdentifier()->getName())) |
Ted Kremenek | 99c6ad3 | 2008-03-27 07:25:52 +0000 | [diff] [blame] | 119 | return AuditNSString(N, ME); |
| 120 | |
Nuno Lopes | f742794 | 2008-05-20 17:33:56 +0000 | [diff] [blame] | 121 | return false; |
Ted Kremenek | 99c6ad3 | 2008-03-27 07:25:52 +0000 | [diff] [blame] | 122 | } |
| 123 | |
Zhongxing Xu | 1c96b24 | 2008-10-17 05:57:07 +0000 | [diff] [blame] | 124 | static inline bool isNil(SVal X) { |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 125 | return isa<loc::ConcreteInt>(X); |
Ted Kremenek | e5d5c20 | 2008-03-27 21:15:17 +0000 | [diff] [blame] | 126 | } |
| 127 | |
Ted Kremenek | 99c6ad3 | 2008-03-27 07:25:52 +0000 | [diff] [blame] | 128 | //===----------------------------------------------------------------------===// |
| 129 | // Error reporting. |
| 130 | //===----------------------------------------------------------------------===// |
| 131 | |
Zhongxing Xu | 031ccc0 | 2009-08-06 12:48:26 +0000 | [diff] [blame] | 132 | bool BasicObjCFoundationChecks::CheckNilArg(ExplodedNode* N, unsigned Arg) { |
Ted Kremenek | 5f85e17 | 2009-07-22 22:35:28 +0000 | [diff] [blame] | 133 | const ObjCMessageExpr* ME = |
Ted Kremenek | 4ba6283 | 2008-03-27 22:05:32 +0000 | [diff] [blame] | 134 | cast<ObjCMessageExpr>(cast<PostStmt>(N->getLocation()).getStmt()); |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 135 | |
Ted Kremenek | 5f85e17 | 2009-07-22 22:35:28 +0000 | [diff] [blame] | 136 | const Expr * E = ME->getArg(Arg); |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 137 | |
Ted Kremenek | 23ec48c | 2009-06-18 23:58:37 +0000 | [diff] [blame] | 138 | if (isNil(N->getState()->getSVal(E))) { |
Ted Kremenek | f1ae705 | 2008-04-03 17:57:38 +0000 | [diff] [blame] | 139 | WarnNilArg(N, ME, Arg); |
Ted Kremenek | 4ba6283 | 2008-03-27 22:05:32 +0000 | [diff] [blame] | 140 | return true; |
| 141 | } |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 142 | |
Ted Kremenek | 4ba6283 | 2008-03-27 22:05:32 +0000 | [diff] [blame] | 143 | return false; |
| 144 | } |
| 145 | |
Ted Kremenek | 99c6ad3 | 2008-03-27 07:25:52 +0000 | [diff] [blame] | 146 | //===----------------------------------------------------------------------===// |
| 147 | // NSString checking. |
| 148 | //===----------------------------------------------------------------------===// |
| 149 | |
Steve Naroff | 14108da | 2009-07-10 23:34:53 +0000 | [diff] [blame] | 150 | bool BasicObjCFoundationChecks::isNSString(const ObjCInterfaceType *T, |
Daniel Dunbar | d777d58 | 2009-10-17 18:12:21 +0000 | [diff] [blame] | 151 | llvm::StringRef ClassName) { |
| 152 | return ClassName == "NSString" || ClassName == "NSMutableString"; |
Ted Kremenek | 99c6ad3 | 2008-03-27 07:25:52 +0000 | [diff] [blame] | 153 | } |
| 154 | |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 155 | bool BasicObjCFoundationChecks::AuditNSString(ExplodedNode* N, |
Ted Kremenek | 5f85e17 | 2009-07-22 22:35:28 +0000 | [diff] [blame] | 156 | const ObjCMessageExpr* ME) { |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 157 | |
Ted Kremenek | 99c6ad3 | 2008-03-27 07:25:52 +0000 | [diff] [blame] | 158 | Selector S = ME->getSelector(); |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 159 | |
Ted Kremenek | 99c6ad3 | 2008-03-27 07:25:52 +0000 | [diff] [blame] | 160 | if (S.isUnarySelector()) |
| 161 | return false; |
| 162 | |
| 163 | // FIXME: This is going to be really slow doing these checks with |
| 164 | // lexical comparisons. |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 165 | |
Chris Lattner | 077bf5e | 2008-11-24 03:33:13 +0000 | [diff] [blame] | 166 | std::string name = S.getAsString(); |
Ted Kremenek | 9b3fdea | 2008-03-27 21:23:57 +0000 | [diff] [blame] | 167 | assert (!name.empty()); |
| 168 | const char* cstr = &name[0]; |
| 169 | unsigned len = name.size(); |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 170 | |
Ted Kremenek | 9b3fdea | 2008-03-27 21:23:57 +0000 | [diff] [blame] | 171 | switch (len) { |
| 172 | default: |
| 173 | break; |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 174 | case 8: |
Ted Kremenek | 4ba6283 | 2008-03-27 22:05:32 +0000 | [diff] [blame] | 175 | if (!strcmp(cstr, "compare:")) |
| 176 | return CheckNilArg(N, 0); |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 177 | |
Ted Kremenek | 4ba6283 | 2008-03-27 22:05:32 +0000 | [diff] [blame] | 178 | break; |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 179 | |
Ted Kremenek | 8730e13 | 2008-03-28 16:09:38 +0000 | [diff] [blame] | 180 | case 15: |
| 181 | // FIXME: Checking for initWithFormat: will not work in most cases |
| 182 | // yet because [NSString alloc] returns id, not NSString*. We will |
| 183 | // need support for tracking expected-type information in the analyzer |
| 184 | // to find these errors. |
| 185 | if (!strcmp(cstr, "initWithFormat:")) |
| 186 | return CheckNilArg(N, 0); |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 187 | |
Ted Kremenek | 8730e13 | 2008-03-28 16:09:38 +0000 | [diff] [blame] | 188 | break; |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 189 | |
Ted Kremenek | 4ba6283 | 2008-03-27 22:05:32 +0000 | [diff] [blame] | 190 | case 16: |
| 191 | if (!strcmp(cstr, "compare:options:")) |
| 192 | return CheckNilArg(N, 0); |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 193 | |
Ted Kremenek | 9b3fdea | 2008-03-27 21:23:57 +0000 | [diff] [blame] | 194 | break; |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 195 | |
Ted Kremenek | 4ba6283 | 2008-03-27 22:05:32 +0000 | [diff] [blame] | 196 | case 22: |
| 197 | if (!strcmp(cstr, "compare:options:range:")) |
| 198 | return CheckNilArg(N, 0); |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 199 | |
Ted Kremenek | 4ba6283 | 2008-03-27 22:05:32 +0000 | [diff] [blame] | 200 | break; |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 201 | |
Ted Kremenek | 4ba6283 | 2008-03-27 22:05:32 +0000 | [diff] [blame] | 202 | case 23: |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 203 | |
Ted Kremenek | 4ba6283 | 2008-03-27 22:05:32 +0000 | [diff] [blame] | 204 | if (!strcmp(cstr, "caseInsensitiveCompare:")) |
| 205 | return CheckNilArg(N, 0); |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 206 | |
Ted Kremenek | 4ba6283 | 2008-03-27 22:05:32 +0000 | [diff] [blame] | 207 | break; |
Ted Kremenek | 8730e13 | 2008-03-28 16:09:38 +0000 | [diff] [blame] | 208 | |
Ted Kremenek | 4ba6283 | 2008-03-27 22:05:32 +0000 | [diff] [blame] | 209 | case 29: |
| 210 | if (!strcmp(cstr, "compare:options:range:locale:")) |
| 211 | return CheckNilArg(N, 0); |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 212 | |
| 213 | break; |
| 214 | |
Ted Kremenek | 4ba6283 | 2008-03-27 22:05:32 +0000 | [diff] [blame] | 215 | case 37: |
| 216 | if (!strcmp(cstr, "componentsSeparatedByCharactersInSet:")) |
| 217 | return CheckNilArg(N, 0); |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 218 | |
| 219 | break; |
Ted Kremenek | 99c6ad3 | 2008-03-27 07:25:52 +0000 | [diff] [blame] | 220 | } |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 221 | |
Ted Kremenek | 99c6ad3 | 2008-03-27 07:25:52 +0000 | [diff] [blame] | 222 | return false; |
| 223 | } |
Ted Kremenek | 04bc876 | 2008-06-26 23:59:48 +0000 | [diff] [blame] | 224 | |
| 225 | //===----------------------------------------------------------------------===// |
| 226 | // Error reporting. |
| 227 | //===----------------------------------------------------------------------===// |
| 228 | |
| 229 | namespace { |
Ted Kremenek | 04bc876 | 2008-06-26 23:59:48 +0000 | [diff] [blame] | 230 | |
Kovarththanan Rajaratnam | ba5fb5a | 2009-11-28 06:07:30 +0000 | [diff] [blame] | 231 | class AuditCFNumberCreate : public GRSimpleAPICheck { |
Ted Kremenek | cf118d4 | 2009-02-04 23:49:09 +0000 | [diff] [blame] | 232 | APIMisuse* BT; |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 233 | |
Ted Kremenek | 04bc876 | 2008-06-26 23:59:48 +0000 | [diff] [blame] | 234 | // FIXME: Either this should be refactored into GRSimpleAPICheck, or |
| 235 | // it should always be passed with a call to Audit. The latter |
| 236 | // approach makes this class more stateless. |
| 237 | ASTContext& Ctx; |
| 238 | IdentifierInfo* II; |
Ted Kremenek | cf118d4 | 2009-02-04 23:49:09 +0000 | [diff] [blame] | 239 | BugReporter& BR; |
Ted Kremenek | 23ec48c | 2009-06-18 23:58:37 +0000 | [diff] [blame] | 240 | |
Ted Kremenek | 04bc876 | 2008-06-26 23:59:48 +0000 | [diff] [blame] | 241 | public: |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 242 | AuditCFNumberCreate(ASTContext& ctx, BugReporter& br) |
Ted Kremenek | 23ec48c | 2009-06-18 23:58:37 +0000 | [diff] [blame] | 243 | : BT(0), Ctx(ctx), II(&Ctx.Idents.get("CFNumberCreate")), BR(br){} |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 244 | |
Ted Kremenek | cf118d4 | 2009-02-04 23:49:09 +0000 | [diff] [blame] | 245 | ~AuditCFNumberCreate() {} |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 246 | |
Zhongxing Xu | c5619d9 | 2009-08-06 01:32:16 +0000 | [diff] [blame] | 247 | bool Audit(ExplodedNode* N, GRStateManager&); |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 248 | |
Ted Kremenek | 04bc876 | 2008-06-26 23:59:48 +0000 | [diff] [blame] | 249 | private: |
Zhongxing Xu | c5619d9 | 2009-08-06 01:32:16 +0000 | [diff] [blame] | 250 | void AddError(const TypedRegion* R, const Expr* Ex, ExplodedNode *N, |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 251 | uint64_t SourceSize, uint64_t TargetSize, uint64_t NumberKind); |
Ted Kremenek | 04bc876 | 2008-06-26 23:59:48 +0000 | [diff] [blame] | 252 | }; |
| 253 | } // end anonymous namespace |
| 254 | |
| 255 | enum CFNumberType { |
| 256 | kCFNumberSInt8Type = 1, |
| 257 | kCFNumberSInt16Type = 2, |
| 258 | kCFNumberSInt32Type = 3, |
| 259 | kCFNumberSInt64Type = 4, |
| 260 | kCFNumberFloat32Type = 5, |
| 261 | kCFNumberFloat64Type = 6, |
| 262 | kCFNumberCharType = 7, |
| 263 | kCFNumberShortType = 8, |
| 264 | kCFNumberIntType = 9, |
| 265 | kCFNumberLongType = 10, |
| 266 | kCFNumberLongLongType = 11, |
| 267 | kCFNumberFloatType = 12, |
| 268 | kCFNumberDoubleType = 13, |
| 269 | kCFNumberCFIndexType = 14, |
| 270 | kCFNumberNSIntegerType = 15, |
| 271 | kCFNumberCGFloatType = 16 |
| 272 | }; |
| 273 | |
| 274 | namespace { |
| 275 | template<typename T> |
| 276 | class Optional { |
| 277 | bool IsKnown; |
| 278 | T Val; |
| 279 | public: |
| 280 | Optional() : IsKnown(false), Val(0) {} |
| 281 | Optional(const T& val) : IsKnown(true), Val(val) {} |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 282 | |
Ted Kremenek | 04bc876 | 2008-06-26 23:59:48 +0000 | [diff] [blame] | 283 | bool isKnown() const { return IsKnown; } |
| 284 | |
| 285 | const T& getValue() const { |
| 286 | assert (isKnown()); |
| 287 | return Val; |
| 288 | } |
| 289 | |
| 290 | operator const T&() const { |
| 291 | return getValue(); |
| 292 | } |
| 293 | }; |
| 294 | } |
| 295 | |
| 296 | static Optional<uint64_t> GetCFNumberSize(ASTContext& Ctx, uint64_t i) { |
| 297 | static unsigned char FixedSize[] = { 8, 16, 32, 64, 32, 64 }; |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 298 | |
Ted Kremenek | 04bc876 | 2008-06-26 23:59:48 +0000 | [diff] [blame] | 299 | if (i < kCFNumberCharType) |
| 300 | return FixedSize[i-1]; |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 301 | |
Ted Kremenek | 04bc876 | 2008-06-26 23:59:48 +0000 | [diff] [blame] | 302 | QualType T; |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 303 | |
Ted Kremenek | 04bc876 | 2008-06-26 23:59:48 +0000 | [diff] [blame] | 304 | switch (i) { |
| 305 | case kCFNumberCharType: T = Ctx.CharTy; break; |
| 306 | case kCFNumberShortType: T = Ctx.ShortTy; break; |
| 307 | case kCFNumberIntType: T = Ctx.IntTy; break; |
| 308 | case kCFNumberLongType: T = Ctx.LongTy; break; |
| 309 | case kCFNumberLongLongType: T = Ctx.LongLongTy; break; |
| 310 | case kCFNumberFloatType: T = Ctx.FloatTy; break; |
| 311 | case kCFNumberDoubleType: T = Ctx.DoubleTy; break; |
| 312 | case kCFNumberCFIndexType: |
| 313 | case kCFNumberNSIntegerType: |
| 314 | case kCFNumberCGFloatType: |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 315 | // FIXME: We need a way to map from names to Type*. |
Ted Kremenek | 04bc876 | 2008-06-26 23:59:48 +0000 | [diff] [blame] | 316 | default: |
| 317 | return Optional<uint64_t>(); |
| 318 | } |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 319 | |
Ted Kremenek | 04bc876 | 2008-06-26 23:59:48 +0000 | [diff] [blame] | 320 | return Ctx.getTypeSize(T); |
| 321 | } |
| 322 | |
| 323 | #if 0 |
| 324 | static const char* GetCFNumberTypeStr(uint64_t i) { |
| 325 | static const char* Names[] = { |
| 326 | "kCFNumberSInt8Type", |
| 327 | "kCFNumberSInt16Type", |
| 328 | "kCFNumberSInt32Type", |
| 329 | "kCFNumberSInt64Type", |
| 330 | "kCFNumberFloat32Type", |
| 331 | "kCFNumberFloat64Type", |
| 332 | "kCFNumberCharType", |
| 333 | "kCFNumberShortType", |
| 334 | "kCFNumberIntType", |
| 335 | "kCFNumberLongType", |
| 336 | "kCFNumberLongLongType", |
| 337 | "kCFNumberFloatType", |
| 338 | "kCFNumberDoubleType", |
| 339 | "kCFNumberCFIndexType", |
| 340 | "kCFNumberNSIntegerType", |
| 341 | "kCFNumberCGFloatType" |
| 342 | }; |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 343 | |
Ted Kremenek | 04bc876 | 2008-06-26 23:59:48 +0000 | [diff] [blame] | 344 | return i <= kCFNumberCGFloatType ? Names[i-1] : "Invalid CFNumberType"; |
| 345 | } |
| 346 | #endif |
| 347 | |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 348 | bool AuditCFNumberCreate::Audit(ExplodedNode* N,GRStateManager&){ |
Ted Kremenek | 5f85e17 | 2009-07-22 22:35:28 +0000 | [diff] [blame] | 349 | const CallExpr* CE = |
| 350 | cast<CallExpr>(cast<PostStmt>(N->getLocation()).getStmt()); |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 351 | const Expr* Callee = CE->getCallee(); |
| 352 | SVal CallV = N->getState()->getSVal(Callee); |
Zhongxing Xu | 369f447 | 2009-04-20 05:24:46 +0000 | [diff] [blame] | 353 | const FunctionDecl* FD = CallV.getAsFunctionDecl(); |
Ted Kremenek | 04bc876 | 2008-06-26 23:59:48 +0000 | [diff] [blame] | 354 | |
Zhongxing Xu | 369f447 | 2009-04-20 05:24:46 +0000 | [diff] [blame] | 355 | if (!FD || FD->getIdentifier() != II || CE->getNumArgs()!=3) |
Ted Kremenek | 04bc876 | 2008-06-26 23:59:48 +0000 | [diff] [blame] | 356 | return false; |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 357 | |
Ted Kremenek | 04bc876 | 2008-06-26 23:59:48 +0000 | [diff] [blame] | 358 | // Get the value of the "theType" argument. |
Ted Kremenek | 23ec48c | 2009-06-18 23:58:37 +0000 | [diff] [blame] | 359 | SVal TheTypeVal = N->getState()->getSVal(CE->getArg(1)); |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 360 | |
Ted Kremenek | 04bc876 | 2008-06-26 23:59:48 +0000 | [diff] [blame] | 361 | // FIXME: We really should allow ranges of valid theType values, and |
| 362 | // bifurcate the state appropriately. |
Zhongxing Xu | 1c96b24 | 2008-10-17 05:57:07 +0000 | [diff] [blame] | 363 | nonloc::ConcreteInt* V = dyn_cast<nonloc::ConcreteInt>(&TheTypeVal); |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 364 | |
Ted Kremenek | 04bc876 | 2008-06-26 23:59:48 +0000 | [diff] [blame] | 365 | if (!V) |
| 366 | return false; |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 367 | |
Ted Kremenek | 04bc876 | 2008-06-26 23:59:48 +0000 | [diff] [blame] | 368 | uint64_t NumberKind = V->getValue().getLimitedValue(); |
| 369 | Optional<uint64_t> TargetSize = GetCFNumberSize(Ctx, NumberKind); |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 370 | |
Ted Kremenek | 04bc876 | 2008-06-26 23:59:48 +0000 | [diff] [blame] | 371 | // FIXME: In some cases we can emit an error. |
| 372 | if (!TargetSize.isKnown()) |
| 373 | return false; |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 374 | |
Ted Kremenek | 04bc876 | 2008-06-26 23:59:48 +0000 | [diff] [blame] | 375 | // Look at the value of the integer being passed by reference. Essentially |
| 376 | // we want to catch cases where the value passed in is not equal to the |
| 377 | // size of the type being created. |
Ted Kremenek | 23ec48c | 2009-06-18 23:58:37 +0000 | [diff] [blame] | 378 | SVal TheValueExpr = N->getState()->getSVal(CE->getArg(2)); |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 379 | |
Ted Kremenek | 04bc876 | 2008-06-26 23:59:48 +0000 | [diff] [blame] | 380 | // FIXME: Eventually we should handle arbitrary locations. We can do this |
| 381 | // by having an enhanced memory model that does low-level typing. |
Zhongxing Xu | 1c96b24 | 2008-10-17 05:57:07 +0000 | [diff] [blame] | 382 | loc::MemRegionVal* LV = dyn_cast<loc::MemRegionVal>(&TheValueExpr); |
Ted Kremenek | 04bc876 | 2008-06-26 23:59:48 +0000 | [diff] [blame] | 383 | |
| 384 | if (!LV) |
| 385 | return false; |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 386 | |
Zhongxing Xu | 479529e | 2009-11-10 02:17:20 +0000 | [diff] [blame] | 387 | const TypedRegion* R = dyn_cast<TypedRegion>(LV->StripCasts()); |
Ted Kremenek | 5e77eba | 2009-07-29 18:17:40 +0000 | [diff] [blame] | 388 | |
| 389 | if (!R) |
| 390 | return false; |
| 391 | |
Zhongxing Xu | a82d8aa | 2009-05-09 03:57:34 +0000 | [diff] [blame] | 392 | QualType T = Ctx.getCanonicalType(R->getValueType(Ctx)); |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 393 | |
Ted Kremenek | 04bc876 | 2008-06-26 23:59:48 +0000 | [diff] [blame] | 394 | // FIXME: If the pointee isn't an integer type, should we flag a warning? |
| 395 | // People can do weird stuff with pointers. |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 396 | |
| 397 | if (!T->isIntegerType()) |
Ted Kremenek | 04bc876 | 2008-06-26 23:59:48 +0000 | [diff] [blame] | 398 | return false; |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 399 | |
Ted Kremenek | 04bc876 | 2008-06-26 23:59:48 +0000 | [diff] [blame] | 400 | uint64_t SourceSize = Ctx.getTypeSize(T); |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 401 | |
Ted Kremenek | 04bc876 | 2008-06-26 23:59:48 +0000 | [diff] [blame] | 402 | // CHECK: is SourceSize == TargetSize |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 403 | |
Ted Kremenek | 04bc876 | 2008-06-26 23:59:48 +0000 | [diff] [blame] | 404 | if (SourceSize == TargetSize) |
| 405 | return false; |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 406 | |
Ted Kremenek | 9e24049 | 2008-10-04 05:50:14 +0000 | [diff] [blame] | 407 | AddError(R, CE->getArg(2), N, SourceSize, TargetSize, NumberKind); |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 408 | |
Ted Kremenek | 04bc876 | 2008-06-26 23:59:48 +0000 | [diff] [blame] | 409 | // FIXME: We can actually create an abstract "CFNumber" object that has |
| 410 | // the bits initialized to the provided values. |
| 411 | return SourceSize < TargetSize; |
| 412 | } |
| 413 | |
Ted Kremenek | 5f85e17 | 2009-07-22 22:35:28 +0000 | [diff] [blame] | 414 | void AuditCFNumberCreate::AddError(const TypedRegion* R, const Expr* Ex, |
Zhongxing Xu | c5619d9 | 2009-08-06 01:32:16 +0000 | [diff] [blame] | 415 | ExplodedNode *N, |
Ted Kremenek | 04bc876 | 2008-06-26 23:59:48 +0000 | [diff] [blame] | 416 | uint64_t SourceSize, uint64_t TargetSize, |
| 417 | uint64_t NumberKind) { |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 418 | |
Ted Kremenek | cf118d4 | 2009-02-04 23:49:09 +0000 | [diff] [blame] | 419 | std::string sbuf; |
| 420 | llvm::raw_string_ostream os(sbuf); |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 421 | |
Ted Kremenek | 04bc876 | 2008-06-26 23:59:48 +0000 | [diff] [blame] | 422 | os << (SourceSize == 8 ? "An " : "A ") |
| 423 | << SourceSize << " bit integer is used to initialize a CFNumber " |
| 424 | "object that represents " |
| 425 | << (TargetSize == 8 ? "an " : "a ") |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 426 | << TargetSize << " bit integer. "; |
Ted Kremenek | 04bc876 | 2008-06-26 23:59:48 +0000 | [diff] [blame] | 427 | |
| 428 | if (SourceSize < TargetSize) |
| 429 | os << (TargetSize - SourceSize) |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 430 | << " bits of the CFNumber value will be garbage." ; |
Ted Kremenek | 04bc876 | 2008-06-26 23:59:48 +0000 | [diff] [blame] | 431 | else |
| 432 | os << (SourceSize - TargetSize) |
| 433 | << " bits of the input integer will be lost."; |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 434 | |
Ted Kremenek | cf118d4 | 2009-02-04 23:49:09 +0000 | [diff] [blame] | 435 | // Lazily create the BugType object. This will be owned |
| 436 | // by the BugReporter object 'BR' once we call BR.EmitWarning. |
| 437 | if (!BT) BT = new APIMisuse("Bad use of CFNumberCreate"); |
Benjamin Kramer | 4988a9a | 2009-11-29 18:03:28 +0000 | [diff] [blame] | 438 | RangedBugReport *report = new RangedBugReport(*BT, os.str(), N); |
Ted Kremenek | cf118d4 | 2009-02-04 23:49:09 +0000 | [diff] [blame] | 439 | report->addRange(Ex->getSourceRange()); |
| 440 | BR.EmitReport(report); |
Ted Kremenek | 04bc876 | 2008-06-26 23:59:48 +0000 | [diff] [blame] | 441 | } |
| 442 | |
| 443 | GRSimpleAPICheck* |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 444 | clang::CreateAuditCFNumberCreate(ASTContext& Ctx, BugReporter& BR) { |
Ted Kremenek | 23ec48c | 2009-06-18 23:58:37 +0000 | [diff] [blame] | 445 | return new AuditCFNumberCreate(Ctx, BR); |
Ted Kremenek | 04bc876 | 2008-06-26 23:59:48 +0000 | [diff] [blame] | 446 | } |
| 447 | |
Ted Kremenek | 78d4624 | 2008-07-22 16:21:24 +0000 | [diff] [blame] | 448 | //===----------------------------------------------------------------------===// |
Ted Kremenek | 79b4f7d | 2009-07-14 00:43:42 +0000 | [diff] [blame] | 449 | // CFRetain/CFRelease auditing for null arguments. |
| 450 | //===----------------------------------------------------------------------===// |
| 451 | |
| 452 | namespace { |
Kovarththanan Rajaratnam | ba5fb5a | 2009-11-28 06:07:30 +0000 | [diff] [blame] | 453 | class AuditCFRetainRelease : public GRSimpleAPICheck { |
Ted Kremenek | 79b4f7d | 2009-07-14 00:43:42 +0000 | [diff] [blame] | 454 | APIMisuse *BT; |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 455 | |
Ted Kremenek | 79b4f7d | 2009-07-14 00:43:42 +0000 | [diff] [blame] | 456 | // FIXME: Either this should be refactored into GRSimpleAPICheck, or |
| 457 | // it should always be passed with a call to Audit. The latter |
| 458 | // approach makes this class more stateless. |
| 459 | ASTContext& Ctx; |
| 460 | IdentifierInfo *Retain, *Release; |
| 461 | BugReporter& BR; |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 462 | |
Ted Kremenek | 79b4f7d | 2009-07-14 00:43:42 +0000 | [diff] [blame] | 463 | public: |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 464 | AuditCFRetainRelease(ASTContext& ctx, BugReporter& br) |
Ted Kremenek | 79b4f7d | 2009-07-14 00:43:42 +0000 | [diff] [blame] | 465 | : BT(0), Ctx(ctx), |
| 466 | Retain(&Ctx.Idents.get("CFRetain")), Release(&Ctx.Idents.get("CFRelease")), |
| 467 | BR(br){} |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 468 | |
Ted Kremenek | 79b4f7d | 2009-07-14 00:43:42 +0000 | [diff] [blame] | 469 | ~AuditCFRetainRelease() {} |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 470 | |
Zhongxing Xu | c5619d9 | 2009-08-06 01:32:16 +0000 | [diff] [blame] | 471 | bool Audit(ExplodedNode* N, GRStateManager&); |
Ted Kremenek | 79b4f7d | 2009-07-14 00:43:42 +0000 | [diff] [blame] | 472 | }; |
| 473 | } // end anonymous namespace |
| 474 | |
| 475 | |
Zhongxing Xu | c5619d9 | 2009-08-06 01:32:16 +0000 | [diff] [blame] | 476 | bool AuditCFRetainRelease::Audit(ExplodedNode* N, GRStateManager&) { |
Ted Kremenek | 5f85e17 | 2009-07-22 22:35:28 +0000 | [diff] [blame] | 477 | const CallExpr* CE = cast<CallExpr>(cast<PostStmt>(N->getLocation()).getStmt()); |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 478 | |
Ted Kremenek | 79b4f7d | 2009-07-14 00:43:42 +0000 | [diff] [blame] | 479 | // If the CallExpr doesn't have exactly 1 argument just give up checking. |
| 480 | if (CE->getNumArgs() != 1) |
| 481 | return false; |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 482 | |
Ted Kremenek | 79b4f7d | 2009-07-14 00:43:42 +0000 | [diff] [blame] | 483 | // Check if we called CFRetain/CFRelease. |
| 484 | const GRState* state = N->getState(); |
| 485 | SVal X = state->getSVal(CE->getCallee()); |
| 486 | const FunctionDecl* FD = X.getAsFunctionDecl(); |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 487 | |
Ted Kremenek | 79b4f7d | 2009-07-14 00:43:42 +0000 | [diff] [blame] | 488 | if (!FD) |
| 489 | return false; |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 490 | |
| 491 | const IdentifierInfo *FuncII = FD->getIdentifier(); |
Ted Kremenek | 79b4f7d | 2009-07-14 00:43:42 +0000 | [diff] [blame] | 492 | if (!(FuncII == Retain || FuncII == Release)) |
| 493 | return false; |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 494 | |
Ted Kremenek | 79b4f7d | 2009-07-14 00:43:42 +0000 | [diff] [blame] | 495 | // Finally, check if the argument is NULL. |
| 496 | // FIXME: We should be able to bifurcate the state here, as a successful |
| 497 | // check will result in the value not being NULL afterwards. |
| 498 | // FIXME: Need a way to register vistors for the BugReporter. Would like |
| 499 | // to benefit from the same diagnostics that regular null dereference |
| 500 | // reporting has. |
| 501 | if (state->getStateManager().isEqual(state, CE->getArg(0), 0)) { |
| 502 | if (!BT) |
| 503 | BT = new APIMisuse("null passed to CFRetain/CFRelease"); |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 504 | |
Ted Kremenek | 79b4f7d | 2009-07-14 00:43:42 +0000 | [diff] [blame] | 505 | const char *description = (FuncII == Retain) |
| 506 | ? "Null pointer argument in call to CFRetain" |
| 507 | : "Null pointer argument in call to CFRelease"; |
| 508 | |
| 509 | RangedBugReport *report = new RangedBugReport(*BT, description, N); |
| 510 | report->addRange(CE->getArg(0)->getSourceRange()); |
| 511 | BR.EmitReport(report); |
| 512 | return true; |
| 513 | } |
| 514 | |
| 515 | return false; |
| 516 | } |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 517 | |
| 518 | |
Ted Kremenek | 79b4f7d | 2009-07-14 00:43:42 +0000 | [diff] [blame] | 519 | GRSimpleAPICheck* |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 520 | clang::CreateAuditCFRetainRelease(ASTContext& Ctx, BugReporter& BR) { |
Ted Kremenek | 79b4f7d | 2009-07-14 00:43:42 +0000 | [diff] [blame] | 521 | return new AuditCFRetainRelease(Ctx, BR); |
| 522 | } |
| 523 | |
| 524 | //===----------------------------------------------------------------------===// |
Ted Kremenek | 50e837b | 2009-11-20 05:27:05 +0000 | [diff] [blame] | 525 | // Check for sending 'retain', 'release', or 'autorelease' directly to a Class. |
| 526 | //===----------------------------------------------------------------------===// |
| 527 | |
| 528 | namespace { |
Kovarththanan Rajaratnam | ba5fb5a | 2009-11-28 06:07:30 +0000 | [diff] [blame] | 529 | class ClassReleaseChecker : |
Ted Kremenek | 50e837b | 2009-11-20 05:27:05 +0000 | [diff] [blame] | 530 | public CheckerVisitor<ClassReleaseChecker> { |
| 531 | Selector releaseS; |
| 532 | Selector retainS; |
| 533 | Selector autoreleaseS; |
| 534 | Selector drainS; |
| 535 | BugType *BT; |
| 536 | public: |
| 537 | ClassReleaseChecker(ASTContext &Ctx) |
| 538 | : releaseS(GetNullarySelector("release", Ctx)), |
| 539 | retainS(GetNullarySelector("retain", Ctx)), |
| 540 | autoreleaseS(GetNullarySelector("autorelease", Ctx)), |
| 541 | drainS(GetNullarySelector("drain", Ctx)), |
| 542 | BT(0) {} |
| 543 | |
| 544 | static void *getTag() { static int x = 0; return &x; } |
| 545 | |
| 546 | void PreVisitObjCMessageExpr(CheckerContext &C, const ObjCMessageExpr *ME); |
| 547 | }; |
| 548 | } |
| 549 | |
| 550 | void ClassReleaseChecker::PreVisitObjCMessageExpr(CheckerContext &C, |
| 551 | const ObjCMessageExpr *ME) { |
| 552 | |
| 553 | const IdentifierInfo *ClsName = ME->getClassName(); |
| 554 | if (!ClsName) |
| 555 | return; |
| 556 | |
| 557 | Selector S = ME->getSelector(); |
Benjamin Kramer | 921ddc4 | 2009-11-20 10:03:00 +0000 | [diff] [blame] | 558 | if (!(S == releaseS || S == retainS || S == autoreleaseS || S == drainS)) |
Ted Kremenek | 50e837b | 2009-11-20 05:27:05 +0000 | [diff] [blame] | 559 | return; |
| 560 | |
| 561 | if (!BT) |
| 562 | BT = new APIMisuse("message incorrectly sent to class instead of class " |
| 563 | "instance"); |
| 564 | |
Ted Kremenek | 19d67b5 | 2009-11-23 22:22:01 +0000 | [diff] [blame] | 565 | ExplodedNode *N = C.GenerateNode(); |
| 566 | |
Ted Kremenek | 50e837b | 2009-11-20 05:27:05 +0000 | [diff] [blame] | 567 | if (!N) |
| 568 | return; |
| 569 | |
Ted Kremenek | 50e837b | 2009-11-20 05:27:05 +0000 | [diff] [blame] | 570 | llvm::SmallString<200> buf; |
| 571 | llvm::raw_svector_ostream os(buf); |
| 572 | |
| 573 | os << "The '" << S.getAsString() << "' message should be sent to instances " |
| 574 | "of class '" << ClsName->getName() |
| 575 | << "' and not the class directly"; |
| 576 | |
| 577 | RangedBugReport *report = new RangedBugReport(*BT, os.str(), N); |
| 578 | report->addRange(ME->getSourceRange()); |
| 579 | C.EmitReport(report); |
| 580 | } |
| 581 | |
| 582 | //===----------------------------------------------------------------------===// |
Ted Kremenek | 78d4624 | 2008-07-22 16:21:24 +0000 | [diff] [blame] | 583 | // Check registration. |
Ted Kremenek | 79b4f7d | 2009-07-14 00:43:42 +0000 | [diff] [blame] | 584 | //===----------------------------------------------------------------------===// |
Ted Kremenek | 78d4624 | 2008-07-22 16:21:24 +0000 | [diff] [blame] | 585 | |
Zhongxing Xu | 5ab128b | 2009-08-21 02:18:44 +0000 | [diff] [blame] | 586 | void clang::RegisterAppleChecks(GRExprEngine& Eng, const Decl &D) { |
Ted Kremenek | 78d4624 | 2008-07-22 16:21:24 +0000 | [diff] [blame] | 587 | ASTContext& Ctx = Eng.getContext(); |
Ted Kremenek | cf118d4 | 2009-02-04 23:49:09 +0000 | [diff] [blame] | 588 | BugReporter &BR = Eng.getBugReporter(); |
Ted Kremenek | 78d4624 | 2008-07-22 16:21:24 +0000 | [diff] [blame] | 589 | |
Ted Kremenek | 23ec48c | 2009-06-18 23:58:37 +0000 | [diff] [blame] | 590 | Eng.AddCheck(CreateBasicObjCFoundationChecks(Ctx, BR), |
Ted Kremenek | 78d4624 | 2008-07-22 16:21:24 +0000 | [diff] [blame] | 591 | Stmt::ObjCMessageExprClass); |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 592 | Eng.AddCheck(CreateAuditCFNumberCreate(Ctx, BR), Stmt::CallExprClass); |
Ted Kremenek | 79b4f7d | 2009-07-14 00:43:42 +0000 | [diff] [blame] | 593 | Eng.AddCheck(CreateAuditCFRetainRelease(Ctx, BR), Stmt::CallExprClass); |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 594 | |
Zhongxing Xu | 5ab128b | 2009-08-21 02:18:44 +0000 | [diff] [blame] | 595 | RegisterNSErrorChecks(BR, Eng, D); |
Ted Kremenek | 54cb7cc | 2009-11-03 08:03:59 +0000 | [diff] [blame] | 596 | RegisterNSAutoreleasePoolChecks(Eng); |
Ted Kremenek | 50e837b | 2009-11-20 05:27:05 +0000 | [diff] [blame] | 597 | Eng.registerCheck(new ClassReleaseChecker(Ctx)); |
Ted Kremenek | 78d4624 | 2008-07-22 16:21:24 +0000 | [diff] [blame] | 598 | } |