Ted Kremenek | 78d4624 | 2008-07-22 16:21:24 +0000 | [diff] [blame] | 1 | //=-- GRExprEngineInternalChecks.cpp - Builtin GRExprEngine Checks---*- C++ -*-= |
| 2 | // |
| 3 | // The LLVM Compiler Infrastructure |
| 4 | // |
| 5 | // This file is distributed under the University of Illinois Open Source |
| 6 | // License. See LICENSE.TXT for details. |
| 7 | // |
| 8 | //===----------------------------------------------------------------------===// |
| 9 | // |
| 10 | // This file defines the BugType classes used by GRExprEngine to report |
| 11 | // bugs derived from builtin checks in the path-sensitive engine. |
| 12 | // |
| 13 | //===----------------------------------------------------------------------===// |
| 14 | |
Ted Kremenek | 1053d24 | 2009-11-06 02:24:13 +0000 | [diff] [blame] | 15 | #include "GRExprEngineInternalChecks.h" |
Ted Kremenek | 78d4624 | 2008-07-22 16:21:24 +0000 | [diff] [blame] | 16 | #include "clang/Analysis/PathSensitive/BugReporter.h" |
| 17 | #include "clang/Analysis/PathSensitive/GRExprEngine.h" |
Ted Kremenek | c26a8b0 | 2009-07-22 21:46:56 +0000 | [diff] [blame] | 18 | #include "clang/Analysis/PathSensitive/CheckerVisitor.h" |
Zhongxing Xu | 4f64e5f | 2009-11-03 05:48:04 +0000 | [diff] [blame] | 19 | #include "clang/Analysis/PathSensitive/Checkers/BadCallChecker.h" |
Zhongxing Xu | 8958fff | 2009-11-03 06:46:03 +0000 | [diff] [blame] | 20 | #include "clang/Analysis/PathSensitive/Checkers/UndefinedArgChecker.h" |
Ted Kremenek | b107c4b | 2009-11-04 04:24:16 +0000 | [diff] [blame] | 21 | #include "clang/Analysis/PathSensitive/Checkers/UndefinedAssignmentChecker.h" |
Zhongxing Xu | 94943b6 | 2009-11-03 07:35:33 +0000 | [diff] [blame] | 22 | #include "clang/Analysis/PathSensitive/Checkers/AttrNonNullChecker.h" |
Ted Kremenek | dd986cc | 2009-05-07 00:45:33 +0000 | [diff] [blame] | 23 | #include "clang/Analysis/PathDiagnostic.h" |
Ted Kremenek | 8aed806 | 2008-10-31 00:13:20 +0000 | [diff] [blame] | 24 | #include "clang/Basic/SourceManager.h" |
Ted Kremenek | 78d4624 | 2008-07-22 16:21:24 +0000 | [diff] [blame] | 25 | #include "llvm/Support/Compiler.h" |
Ted Kremenek | ad51a60 | 2008-10-31 00:18:30 +0000 | [diff] [blame] | 26 | #include "llvm/Support/raw_ostream.h" |
Ted Kremenek | 78d4624 | 2008-07-22 16:21:24 +0000 | [diff] [blame] | 27 | |
| 28 | using namespace clang; |
Ted Kremenek | 5350066 | 2009-07-22 17:55:28 +0000 | [diff] [blame] | 29 | using namespace clang::bugreporter; |
Ted Kremenek | 78d4624 | 2008-07-22 16:21:24 +0000 | [diff] [blame] | 30 | |
| 31 | //===----------------------------------------------------------------------===// |
| 32 | // Utility functions. |
| 33 | //===----------------------------------------------------------------------===// |
| 34 | |
| 35 | template <typename ITERATOR> inline |
Zhongxing Xu | c5619d9 | 2009-08-06 01:32:16 +0000 | [diff] [blame] | 36 | ExplodedNode* GetNode(ITERATOR I) { |
Ted Kremenek | 78d4624 | 2008-07-22 16:21:24 +0000 | [diff] [blame] | 37 | return *I; |
| 38 | } |
| 39 | |
| 40 | template <> inline |
Zhongxing Xu | c5619d9 | 2009-08-06 01:32:16 +0000 | [diff] [blame] | 41 | ExplodedNode* GetNode(GRExprEngine::undef_arg_iterator I) { |
Ted Kremenek | 78d4624 | 2008-07-22 16:21:24 +0000 | [diff] [blame] | 42 | return I->first; |
| 43 | } |
| 44 | |
| 45 | //===----------------------------------------------------------------------===// |
| 46 | // Bug Descriptions. |
| 47 | //===----------------------------------------------------------------------===// |
Zhongxing Xu | ec9227f | 2009-10-29 02:09:30 +0000 | [diff] [blame] | 48 | namespace clang { |
| 49 | class BuiltinBugReport : public RangedBugReport { |
Ted Kremenek | dd986cc | 2009-05-07 00:45:33 +0000 | [diff] [blame] | 50 | public: |
| 51 | BuiltinBugReport(BugType& bt, const char* desc, |
Zhongxing Xu | c5619d9 | 2009-08-06 01:32:16 +0000 | [diff] [blame] | 52 | ExplodedNode *n) |
Ted Kremenek | 0c31317 | 2009-05-13 19:16:35 +0000 | [diff] [blame] | 53 | : RangedBugReport(bt, desc, n) {} |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 54 | |
Ted Kremenek | 85ac934 | 2009-05-15 05:25:09 +0000 | [diff] [blame] | 55 | BuiltinBugReport(BugType& bt, const char *shortDesc, const char *desc, |
Zhongxing Xu | c5619d9 | 2009-08-06 01:32:16 +0000 | [diff] [blame] | 56 | ExplodedNode *n) |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 57 | : RangedBugReport(bt, shortDesc, desc, n) {} |
| 58 | |
Ted Kremenek | dd986cc | 2009-05-07 00:45:33 +0000 | [diff] [blame] | 59 | void registerInitialVisitors(BugReporterContext& BRC, |
Zhongxing Xu | c5619d9 | 2009-08-06 01:32:16 +0000 | [diff] [blame] | 60 | const ExplodedNode* N); |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 61 | }; |
| 62 | |
Zhongxing Xu | ec9227f | 2009-10-29 02:09:30 +0000 | [diff] [blame] | 63 | void BuiltinBugReport::registerInitialVisitors(BugReporterContext& BRC, |
| 64 | const ExplodedNode* N) { |
| 65 | static_cast<BuiltinBug&>(getBugType()).registerInitialVisitors(BRC, N, this); |
| 66 | } |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 67 | |
Ted Kremenek | dd986cc | 2009-05-07 00:45:33 +0000 | [diff] [blame] | 68 | template <typename ITER> |
| 69 | void BuiltinBug::Emit(BugReporter& BR, ITER I, ITER E) { |
| 70 | for (; I != E; ++I) BR.EmitReport(new BuiltinBugReport(*this, desc.c_str(), |
| 71 | GetNode(I))); |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 72 | } |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 73 | |
Ted Kremenek | 0c31317 | 2009-05-13 19:16:35 +0000 | [diff] [blame] | 74 | class VISIBILITY_HIDDEN NilReceiverStructRet : public BuiltinBug { |
Ted Kremenek | 21fe837 | 2009-02-19 04:06:22 +0000 | [diff] [blame] | 75 | public: |
| 76 | NilReceiverStructRet(GRExprEngine* eng) : |
Ted Kremenek | 0c31317 | 2009-05-13 19:16:35 +0000 | [diff] [blame] | 77 | BuiltinBug(eng, "'nil' receiver with struct return type") {} |
Ted Kremenek | 21fe837 | 2009-02-19 04:06:22 +0000 | [diff] [blame] | 78 | |
Ted Kremenek | 0c31317 | 2009-05-13 19:16:35 +0000 | [diff] [blame] | 79 | void FlushReportsImpl(BugReporter& BR, GRExprEngine& Eng) { |
Ted Kremenek | 21fe837 | 2009-02-19 04:06:22 +0000 | [diff] [blame] | 80 | for (GRExprEngine::nil_receiver_struct_ret_iterator |
| 81 | I=Eng.nil_receiver_struct_ret_begin(), |
| 82 | E=Eng.nil_receiver_struct_ret_end(); I!=E; ++I) { |
| 83 | |
| 84 | std::string sbuf; |
| 85 | llvm::raw_string_ostream os(sbuf); |
| 86 | PostStmt P = cast<PostStmt>((*I)->getLocation()); |
Ted Kremenek | 5f85e17 | 2009-07-22 22:35:28 +0000 | [diff] [blame] | 87 | const ObjCMessageExpr *ME = cast<ObjCMessageExpr>(P.getStmt()); |
Ted Kremenek | 21fe837 | 2009-02-19 04:06:22 +0000 | [diff] [blame] | 88 | os << "The receiver in the message expression is 'nil' and results in the" |
| 89 | " returned value (of type '" |
| 90 | << ME->getType().getAsString() |
Ted Kremenek | 5b9bd21 | 2009-09-11 22:07:28 +0000 | [diff] [blame] | 91 | << "') to be garbage or otherwise undefined"; |
Ted Kremenek | 21fe837 | 2009-02-19 04:06:22 +0000 | [diff] [blame] | 92 | |
Ted Kremenek | 0c31317 | 2009-05-13 19:16:35 +0000 | [diff] [blame] | 93 | BuiltinBugReport *R = new BuiltinBugReport(*this, os.str().c_str(), *I); |
Ted Kremenek | 21fe837 | 2009-02-19 04:06:22 +0000 | [diff] [blame] | 94 | R->addRange(ME->getReceiver()->getSourceRange()); |
| 95 | BR.EmitReport(R); |
| 96 | } |
| 97 | } |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 98 | |
Ted Kremenek | 0c31317 | 2009-05-13 19:16:35 +0000 | [diff] [blame] | 99 | void registerInitialVisitors(BugReporterContext& BRC, |
Zhongxing Xu | c5619d9 | 2009-08-06 01:32:16 +0000 | [diff] [blame] | 100 | const ExplodedNode* N, |
Ted Kremenek | 0c31317 | 2009-05-13 19:16:35 +0000 | [diff] [blame] | 101 | BuiltinBugReport *R) { |
Ted Kremenek | 85ac934 | 2009-05-15 05:25:09 +0000 | [diff] [blame] | 102 | registerTrackNullOrUndefValue(BRC, GetReceiverExpr(N), N); |
Ted Kremenek | 0c31317 | 2009-05-13 19:16:35 +0000 | [diff] [blame] | 103 | } |
Ted Kremenek | 21fe837 | 2009-02-19 04:06:22 +0000 | [diff] [blame] | 104 | }; |
Ted Kremenek | 899b3de | 2009-04-08 03:07:17 +0000 | [diff] [blame] | 105 | |
Ted Kremenek | 0c31317 | 2009-05-13 19:16:35 +0000 | [diff] [blame] | 106 | class VISIBILITY_HIDDEN NilReceiverLargerThanVoidPtrRet : public BuiltinBug { |
Ted Kremenek | 899b3de | 2009-04-08 03:07:17 +0000 | [diff] [blame] | 107 | public: |
| 108 | NilReceiverLargerThanVoidPtrRet(GRExprEngine* eng) : |
Ted Kremenek | 0c31317 | 2009-05-13 19:16:35 +0000 | [diff] [blame] | 109 | BuiltinBug(eng, |
| 110 | "'nil' receiver with return type larger than sizeof(void *)") {} |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 111 | |
Ted Kremenek | 0c31317 | 2009-05-13 19:16:35 +0000 | [diff] [blame] | 112 | void FlushReportsImpl(BugReporter& BR, GRExprEngine& Eng) { |
Ted Kremenek | 899b3de | 2009-04-08 03:07:17 +0000 | [diff] [blame] | 113 | for (GRExprEngine::nil_receiver_larger_than_voidptr_ret_iterator |
| 114 | I=Eng.nil_receiver_larger_than_voidptr_ret_begin(), |
| 115 | E=Eng.nil_receiver_larger_than_voidptr_ret_end(); I!=E; ++I) { |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 116 | |
Ted Kremenek | 899b3de | 2009-04-08 03:07:17 +0000 | [diff] [blame] | 117 | std::string sbuf; |
| 118 | llvm::raw_string_ostream os(sbuf); |
| 119 | PostStmt P = cast<PostStmt>((*I)->getLocation()); |
Ted Kremenek | 5f85e17 | 2009-07-22 22:35:28 +0000 | [diff] [blame] | 120 | const ObjCMessageExpr *ME = cast<ObjCMessageExpr>(P.getStmt()); |
Ted Kremenek | 899b3de | 2009-04-08 03:07:17 +0000 | [diff] [blame] | 121 | os << "The receiver in the message expression is 'nil' and results in the" |
| 122 | " returned value (of type '" |
| 123 | << ME->getType().getAsString() |
| 124 | << "' and of size " |
| 125 | << Eng.getContext().getTypeSize(ME->getType()) / 8 |
Ted Kremenek | 5b9bd21 | 2009-09-11 22:07:28 +0000 | [diff] [blame] | 126 | << " bytes) to be garbage or otherwise undefined"; |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 127 | |
Ted Kremenek | 0c31317 | 2009-05-13 19:16:35 +0000 | [diff] [blame] | 128 | BuiltinBugReport *R = new BuiltinBugReport(*this, os.str().c_str(), *I); |
Ted Kremenek | 899b3de | 2009-04-08 03:07:17 +0000 | [diff] [blame] | 129 | R->addRange(ME->getReceiver()->getSourceRange()); |
| 130 | BR.EmitReport(R); |
| 131 | } |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 132 | } |
Ted Kremenek | 0c31317 | 2009-05-13 19:16:35 +0000 | [diff] [blame] | 133 | void registerInitialVisitors(BugReporterContext& BRC, |
Zhongxing Xu | c5619d9 | 2009-08-06 01:32:16 +0000 | [diff] [blame] | 134 | const ExplodedNode* N, |
Ted Kremenek | 0c31317 | 2009-05-13 19:16:35 +0000 | [diff] [blame] | 135 | BuiltinBugReport *R) { |
Ted Kremenek | 85ac934 | 2009-05-15 05:25:09 +0000 | [diff] [blame] | 136 | registerTrackNullOrUndefValue(BRC, GetReceiverExpr(N), N); |
Ted Kremenek | 899b3de | 2009-04-08 03:07:17 +0000 | [diff] [blame] | 137 | } |
| 138 | }; |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 139 | |
Ted Kremenek | 78d4624 | 2008-07-22 16:21:24 +0000 | [diff] [blame] | 140 | class VISIBILITY_HIDDEN UndefResult : public BuiltinBug { |
| 141 | public: |
Ted Kremenek | 5b9bd21 | 2009-09-11 22:07:28 +0000 | [diff] [blame] | 142 | UndefResult(GRExprEngine* eng) |
| 143 | : BuiltinBug(eng,"Undefined or garbage result", |
| 144 | "Result of operation is garbage or undefined") {} |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 145 | |
Ted Kremenek | cf118d4 | 2009-02-04 23:49:09 +0000 | [diff] [blame] | 146 | void FlushReportsImpl(BugReporter& BR, GRExprEngine& Eng) { |
Ted Kremenek | 5b9bd21 | 2009-09-11 22:07:28 +0000 | [diff] [blame] | 147 | for (GRExprEngine::undef_result_iterator I=Eng.undef_results_begin(), |
| 148 | E = Eng.undef_results_end(); I!=E; ++I) { |
| 149 | |
| 150 | ExplodedNode *N = *I; |
| 151 | const Stmt *S = N->getLocationAs<PostStmt>()->getStmt(); |
| 152 | BuiltinBugReport *report = NULL; |
| 153 | |
| 154 | if (const BinaryOperator *B = dyn_cast<BinaryOperator>(S)) { |
| 155 | llvm::SmallString<256> sbuf; |
| 156 | llvm::raw_svector_ostream OS(sbuf); |
| 157 | const GRState *ST = N->getState(); |
Ted Kremenek | 7c039bf | 2009-09-16 06:04:26 +0000 | [diff] [blame] | 158 | const Expr *Ex = NULL; |
| 159 | bool isLeft = true; |
Ted Kremenek | 5b9bd21 | 2009-09-11 22:07:28 +0000 | [diff] [blame] | 160 | |
| 161 | if (ST->getSVal(B->getLHS()).isUndef()) { |
| 162 | Ex = B->getLHS()->IgnoreParenCasts(); |
Ted Kremenek | 7c039bf | 2009-09-16 06:04:26 +0000 | [diff] [blame] | 163 | isLeft = true; |
Ted Kremenek | 5b9bd21 | 2009-09-11 22:07:28 +0000 | [diff] [blame] | 164 | } |
Ted Kremenek | 24c411b | 2009-09-15 17:43:54 +0000 | [diff] [blame] | 165 | else if (ST->getSVal(B->getRHS()).isUndef()) { |
Ted Kremenek | 5b9bd21 | 2009-09-11 22:07:28 +0000 | [diff] [blame] | 166 | Ex = B->getRHS()->IgnoreParenCasts(); |
Ted Kremenek | 7c039bf | 2009-09-16 06:04:26 +0000 | [diff] [blame] | 167 | isLeft = false; |
Ted Kremenek | 5b9bd21 | 2009-09-11 22:07:28 +0000 | [diff] [blame] | 168 | } |
Ted Kremenek | 7c039bf | 2009-09-16 06:04:26 +0000 | [diff] [blame] | 169 | |
| 170 | if (Ex) { |
| 171 | OS << "The " << (isLeft ? "left" : "right") |
Ted Kremenek | 112ba7e | 2009-09-24 00:44:26 +0000 | [diff] [blame] | 172 | << " operand of '" |
Ted Kremenek | 7c039bf | 2009-09-16 06:04:26 +0000 | [diff] [blame] | 173 | << BinaryOperator::getOpcodeStr(B->getOpcode()) |
Ted Kremenek | 112ba7e | 2009-09-24 00:44:26 +0000 | [diff] [blame] | 174 | << "' is a garbage value"; |
Ted Kremenek | 24c411b | 2009-09-15 17:43:54 +0000 | [diff] [blame] | 175 | } |
| 176 | else { |
Ted Kremenek | 7c039bf | 2009-09-16 06:04:26 +0000 | [diff] [blame] | 177 | // Neither operand was undefined, but the result is undefined. |
Ted Kremenek | 24c411b | 2009-09-15 17:43:54 +0000 | [diff] [blame] | 178 | OS << "The result of the '" |
| 179 | << BinaryOperator::getOpcodeStr(B->getOpcode()) |
| 180 | << "' expression is undefined"; |
| 181 | } |
| 182 | |
Ted Kremenek | 5b9bd21 | 2009-09-11 22:07:28 +0000 | [diff] [blame] | 183 | // FIXME: Use StringRefs to pass string information. |
| 184 | report = new BuiltinBugReport(*this, OS.str().str().c_str(), N); |
Ted Kremenek | 24c411b | 2009-09-15 17:43:54 +0000 | [diff] [blame] | 185 | if (Ex) report->addRange(Ex->getSourceRange()); |
Ted Kremenek | 5b9bd21 | 2009-09-11 22:07:28 +0000 | [diff] [blame] | 186 | } |
| 187 | else { |
| 188 | report = new BuiltinBugReport(*this, |
| 189 | "Expression evaluates to an uninitialized" |
| 190 | " or undefined value", N); |
| 191 | } |
| 192 | |
| 193 | BR.EmitReport(report); |
| 194 | } |
| 195 | } |
| 196 | |
| 197 | void registerInitialVisitors(BugReporterContext& BRC, |
| 198 | const ExplodedNode* N, |
| 199 | BuiltinBugReport *R) { |
| 200 | |
| 201 | const Stmt *S = N->getLocationAs<StmtPoint>()->getStmt(); |
| 202 | const Stmt *X = S; |
| 203 | |
| 204 | if (const BinaryOperator *B = dyn_cast<BinaryOperator>(S)) { |
| 205 | const GRState *ST = N->getState(); |
Ted Kremenek | 7c039bf | 2009-09-16 06:04:26 +0000 | [diff] [blame] | 206 | if (ST->getSVal(B->getLHS()).isUndef()) |
| 207 | X = B->getLHS(); |
| 208 | else if (ST->getSVal(B->getRHS()).isUndef()) |
| 209 | X = B->getRHS(); |
Ted Kremenek | 5b9bd21 | 2009-09-11 22:07:28 +0000 | [diff] [blame] | 210 | } |
| 211 | |
| 212 | registerTrackNullOrUndefValue(BRC, X, N); |
Ted Kremenek | 78d4624 | 2008-07-22 16:21:24 +0000 | [diff] [blame] | 213 | } |
| 214 | }; |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 215 | |
Ted Kremenek | 85ac934 | 2009-05-15 05:25:09 +0000 | [diff] [blame] | 216 | class VISIBILITY_HIDDEN ArgReport : public BuiltinBugReport { |
| 217 | const Stmt *Arg; |
| 218 | public: |
Zhongxing Xu | c5619d9 | 2009-08-06 01:32:16 +0000 | [diff] [blame] | 219 | ArgReport(BugType& bt, const char* desc, ExplodedNode *n, |
Ted Kremenek | 85ac934 | 2009-05-15 05:25:09 +0000 | [diff] [blame] | 220 | const Stmt *arg) |
| 221 | : BuiltinBugReport(bt, desc, n), Arg(arg) {} |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 222 | |
Ted Kremenek | 85ac934 | 2009-05-15 05:25:09 +0000 | [diff] [blame] | 223 | ArgReport(BugType& bt, const char *shortDesc, const char *desc, |
Zhongxing Xu | c5619d9 | 2009-08-06 01:32:16 +0000 | [diff] [blame] | 224 | ExplodedNode *n, const Stmt *arg) |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 225 | : BuiltinBugReport(bt, shortDesc, desc, n), Arg(arg) {} |
| 226 | |
| 227 | const Stmt *getArg() const { return Arg; } |
Ted Kremenek | 78d4624 | 2008-07-22 16:21:24 +0000 | [diff] [blame] | 228 | }; |
| 229 | |
| 230 | class VISIBILITY_HIDDEN BadArg : public BuiltinBug { |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 231 | public: |
| 232 | BadArg(GRExprEngine* eng=0) : BuiltinBug(eng,"Uninitialized argument", |
Ted Kremenek | 5b9bd21 | 2009-09-11 22:07:28 +0000 | [diff] [blame] | 233 | "Pass-by-value argument in function call is undefined") {} |
Ted Kremenek | 78d4624 | 2008-07-22 16:21:24 +0000 | [diff] [blame] | 234 | |
Ted Kremenek | cf118d4 | 2009-02-04 23:49:09 +0000 | [diff] [blame] | 235 | BadArg(GRExprEngine* eng, const char* d) |
Ted Kremenek | 5d88ff8 | 2009-04-02 02:40:26 +0000 | [diff] [blame] | 236 | : BuiltinBug(eng,"Uninitialized argument", d) {} |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 237 | |
Ted Kremenek | 85ac934 | 2009-05-15 05:25:09 +0000 | [diff] [blame] | 238 | void registerInitialVisitors(BugReporterContext& BRC, |
Zhongxing Xu | c5619d9 | 2009-08-06 01:32:16 +0000 | [diff] [blame] | 239 | const ExplodedNode* N, |
Ted Kremenek | 85ac934 | 2009-05-15 05:25:09 +0000 | [diff] [blame] | 240 | BuiltinBugReport *R) { |
| 241 | registerTrackNullOrUndefValue(BRC, static_cast<ArgReport*>(R)->getArg(), |
| 242 | N); |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 243 | } |
Ted Kremenek | 78d4624 | 2008-07-22 16:21:24 +0000 | [diff] [blame] | 244 | }; |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 245 | |
Ted Kremenek | 78d4624 | 2008-07-22 16:21:24 +0000 | [diff] [blame] | 246 | class VISIBILITY_HIDDEN BadMsgExprArg : public BadArg { |
| 247 | public: |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 248 | BadMsgExprArg(GRExprEngine* eng) |
Ted Kremenek | 5d88ff8 | 2009-04-02 02:40:26 +0000 | [diff] [blame] | 249 | : BadArg(eng,"Pass-by-value argument in message expression is undefined"){} |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 250 | |
Ted Kremenek | cf118d4 | 2009-02-04 23:49:09 +0000 | [diff] [blame] | 251 | void FlushReportsImpl(BugReporter& BR, GRExprEngine& Eng) { |
Ted Kremenek | 78d4624 | 2008-07-22 16:21:24 +0000 | [diff] [blame] | 252 | for (GRExprEngine::UndefArgsTy::iterator I=Eng.msg_expr_undef_arg_begin(), |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 253 | E = Eng.msg_expr_undef_arg_end(); I!=E; ++I) { |
Ted Kremenek | 78d4624 | 2008-07-22 16:21:24 +0000 | [diff] [blame] | 254 | // Generate a report for this bug. |
Ted Kremenek | 85ac934 | 2009-05-15 05:25:09 +0000 | [diff] [blame] | 255 | ArgReport *report = new ArgReport(*this, desc.c_str(), I->first, |
| 256 | I->second); |
Ted Kremenek | cf118d4 | 2009-02-04 23:49:09 +0000 | [diff] [blame] | 257 | report->addRange(I->second->getSourceRange()); |
| 258 | BR.EmitReport(report); |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 259 | } |
| 260 | } |
Ted Kremenek | 78d4624 | 2008-07-22 16:21:24 +0000 | [diff] [blame] | 261 | }; |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 262 | |
Ted Kremenek | 78d4624 | 2008-07-22 16:21:24 +0000 | [diff] [blame] | 263 | class VISIBILITY_HIDDEN BadReceiver : public BuiltinBug { |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 264 | public: |
Ted Kremenek | cf118d4 | 2009-02-04 23:49:09 +0000 | [diff] [blame] | 265 | BadReceiver(GRExprEngine* eng) |
Ted Kremenek | 5d88ff8 | 2009-04-02 02:40:26 +0000 | [diff] [blame] | 266 | : BuiltinBug(eng,"Uninitialized receiver", |
| 267 | "Receiver in message expression is an uninitialized value") {} |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 268 | |
Ted Kremenek | cf118d4 | 2009-02-04 23:49:09 +0000 | [diff] [blame] | 269 | void FlushReportsImpl(BugReporter& BR, GRExprEngine& Eng) { |
Ted Kremenek | efd5994 | 2008-12-08 22:47:34 +0000 | [diff] [blame] | 270 | for (GRExprEngine::ErrorNodes::iterator I=Eng.undef_receivers_begin(), |
Ted Kremenek | 78d4624 | 2008-07-22 16:21:24 +0000 | [diff] [blame] | 271 | End = Eng.undef_receivers_end(); I!=End; ++I) { |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 272 | |
Ted Kremenek | 78d4624 | 2008-07-22 16:21:24 +0000 | [diff] [blame] | 273 | // Generate a report for this bug. |
Ted Kremenek | 0c31317 | 2009-05-13 19:16:35 +0000 | [diff] [blame] | 274 | BuiltinBugReport *report = new BuiltinBugReport(*this, desc.c_str(), *I); |
Zhongxing Xu | c5619d9 | 2009-08-06 01:32:16 +0000 | [diff] [blame] | 275 | ExplodedNode* N = *I; |
Ted Kremenek | 5f85e17 | 2009-07-22 22:35:28 +0000 | [diff] [blame] | 276 | const Stmt *S = cast<PostStmt>(N->getLocation()).getStmt(); |
| 277 | const Expr* E = cast<ObjCMessageExpr>(S)->getReceiver(); |
Ted Kremenek | 78d4624 | 2008-07-22 16:21:24 +0000 | [diff] [blame] | 278 | assert (E && "Receiver cannot be NULL"); |
Ted Kremenek | cf118d4 | 2009-02-04 23:49:09 +0000 | [diff] [blame] | 279 | report->addRange(E->getSourceRange()); |
| 280 | BR.EmitReport(report); |
Ted Kremenek | 0c31317 | 2009-05-13 19:16:35 +0000 | [diff] [blame] | 281 | } |
| 282 | } |
Ted Kremenek | 85ac934 | 2009-05-15 05:25:09 +0000 | [diff] [blame] | 283 | |
Ted Kremenek | 0c31317 | 2009-05-13 19:16:35 +0000 | [diff] [blame] | 284 | void registerInitialVisitors(BugReporterContext& BRC, |
Zhongxing Xu | c5619d9 | 2009-08-06 01:32:16 +0000 | [diff] [blame] | 285 | const ExplodedNode* N, |
Ted Kremenek | 0c31317 | 2009-05-13 19:16:35 +0000 | [diff] [blame] | 286 | BuiltinBugReport *R) { |
Ted Kremenek | 85ac934 | 2009-05-15 05:25:09 +0000 | [diff] [blame] | 287 | registerTrackNullOrUndefValue(BRC, GetReceiverExpr(N), N); |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 288 | } |
Ted Kremenek | 78d4624 | 2008-07-22 16:21:24 +0000 | [diff] [blame] | 289 | }; |
Ted Kremenek | 5917d78 | 2008-11-21 00:27:44 +0000 | [diff] [blame] | 290 | |
Ted Kremenek | 78d4624 | 2008-07-22 16:21:24 +0000 | [diff] [blame] | 291 | class VISIBILITY_HIDDEN UndefBranch : public BuiltinBug { |
| 292 | struct VISIBILITY_HIDDEN FindUndefExpr { |
Ted Kremenek | 4adc81e | 2008-08-13 04:27:00 +0000 | [diff] [blame] | 293 | GRStateManager& VM; |
| 294 | const GRState* St; |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 295 | |
Ted Kremenek | 4adc81e | 2008-08-13 04:27:00 +0000 | [diff] [blame] | 296 | FindUndefExpr(GRStateManager& V, const GRState* S) : VM(V), St(S) {} |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 297 | |
| 298 | Expr* FindExpr(Expr* Ex) { |
Ted Kremenek | 78d4624 | 2008-07-22 16:21:24 +0000 | [diff] [blame] | 299 | if (!MatchesCriteria(Ex)) |
Ted Kremenek | b7714b2 | 2008-07-30 17:49:12 +0000 | [diff] [blame] | 300 | return 0; |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 301 | |
Ted Kremenek | b7714b2 | 2008-07-30 17:49:12 +0000 | [diff] [blame] | 302 | for (Stmt::child_iterator I=Ex->child_begin(), E=Ex->child_end();I!=E;++I) |
Ted Kremenek | 78d4624 | 2008-07-22 16:21:24 +0000 | [diff] [blame] | 303 | if (Expr* ExI = dyn_cast_or_null<Expr>(*I)) { |
| 304 | Expr* E2 = FindExpr(ExI); |
| 305 | if (E2) return E2; |
| 306 | } |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 307 | |
Ted Kremenek | 78d4624 | 2008-07-22 16:21:24 +0000 | [diff] [blame] | 308 | return Ex; |
| 309 | } |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 310 | |
Ted Kremenek | 23ec48c | 2009-06-18 23:58:37 +0000 | [diff] [blame] | 311 | bool MatchesCriteria(Expr* Ex) { return St->getSVal(Ex).isUndef(); } |
Ted Kremenek | 78d4624 | 2008-07-22 16:21:24 +0000 | [diff] [blame] | 312 | }; |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 313 | |
Ted Kremenek | 78d4624 | 2008-07-22 16:21:24 +0000 | [diff] [blame] | 314 | public: |
Ted Kremenek | cf118d4 | 2009-02-04 23:49:09 +0000 | [diff] [blame] | 315 | UndefBranch(GRExprEngine *eng) |
Ted Kremenek | 5b9bd21 | 2009-09-11 22:07:28 +0000 | [diff] [blame] | 316 | : BuiltinBug(eng,"Use of garbage value", |
| 317 | "Branch condition evaluates to an undefined or garbage value") |
| 318 | {} |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 319 | |
Ted Kremenek | cf118d4 | 2009-02-04 23:49:09 +0000 | [diff] [blame] | 320 | void FlushReportsImpl(BugReporter& BR, GRExprEngine& Eng) { |
Ted Kremenek | 78d4624 | 2008-07-22 16:21:24 +0000 | [diff] [blame] | 321 | for (GRExprEngine::undef_branch_iterator I=Eng.undef_branches_begin(), |
| 322 | E=Eng.undef_branches_end(); I!=E; ++I) { |
| 323 | |
| 324 | // What's going on here: we want to highlight the subexpression of the |
| 325 | // condition that is the most likely source of the "uninitialized |
| 326 | // branch condition." We do a recursive walk of the condition's |
| 327 | // subexpressions and roughly look for the most nested subexpression |
| 328 | // that binds to Undefined. We then highlight that expression's range. |
Ted Kremenek | 78d4624 | 2008-07-22 16:21:24 +0000 | [diff] [blame] | 329 | BlockEdge B = cast<BlockEdge>((*I)->getLocation()); |
| 330 | Expr* Ex = cast<Expr>(B.getSrc()->getTerminatorCondition()); |
| 331 | assert (Ex && "Block must have a terminator."); |
| 332 | |
| 333 | // Get the predecessor node and check if is a PostStmt with the Stmt |
| 334 | // being the terminator condition. We want to inspect the state |
| 335 | // of that node instead because it will contain main information about |
| 336 | // the subexpressions. |
Ted Kremenek | 78d4624 | 2008-07-22 16:21:24 +0000 | [diff] [blame] | 337 | assert (!(*I)->pred_empty()); |
| 338 | |
| 339 | // Note: any predecessor will do. They should have identical state, |
| 340 | // since all the BlockEdge did was act as an error sink since the value |
| 341 | // had to already be undefined. |
Zhongxing Xu | c5619d9 | 2009-08-06 01:32:16 +0000 | [diff] [blame] | 342 | ExplodedNode *N = *(*I)->pred_begin(); |
Ted Kremenek | 78d4624 | 2008-07-22 16:21:24 +0000 | [diff] [blame] | 343 | ProgramPoint P = N->getLocation(); |
Ted Kremenek | 4adc81e | 2008-08-13 04:27:00 +0000 | [diff] [blame] | 344 | const GRState* St = (*I)->getState(); |
Ted Kremenek | 78d4624 | 2008-07-22 16:21:24 +0000 | [diff] [blame] | 345 | |
| 346 | if (PostStmt* PS = dyn_cast<PostStmt>(&P)) |
| 347 | if (PS->getStmt() == Ex) |
| 348 | St = N->getState(); |
| 349 | |
| 350 | FindUndefExpr FindIt(Eng.getStateManager(), St); |
| 351 | Ex = FindIt.FindExpr(Ex); |
| 352 | |
Ted Kremenek | 85ac934 | 2009-05-15 05:25:09 +0000 | [diff] [blame] | 353 | ArgReport *R = new ArgReport(*this, desc.c_str(), *I, Ex); |
Ted Kremenek | cf118d4 | 2009-02-04 23:49:09 +0000 | [diff] [blame] | 354 | R->addRange(Ex->getSourceRange()); |
| 355 | BR.EmitReport(R); |
Ted Kremenek | 78d4624 | 2008-07-22 16:21:24 +0000 | [diff] [blame] | 356 | } |
| 357 | } |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 358 | |
Ted Kremenek | 85ac934 | 2009-05-15 05:25:09 +0000 | [diff] [blame] | 359 | void registerInitialVisitors(BugReporterContext& BRC, |
Zhongxing Xu | c5619d9 | 2009-08-06 01:32:16 +0000 | [diff] [blame] | 360 | const ExplodedNode* N, |
Ted Kremenek | 85ac934 | 2009-05-15 05:25:09 +0000 | [diff] [blame] | 361 | BuiltinBugReport *R) { |
| 362 | registerTrackNullOrUndefValue(BRC, static_cast<ArgReport*>(R)->getArg(), |
| 363 | N); |
| 364 | } |
Ted Kremenek | 78d4624 | 2008-07-22 16:21:24 +0000 | [diff] [blame] | 365 | }; |
| 366 | |
Zhongxing Xu | 1c0c233 | 2008-11-23 05:52:28 +0000 | [diff] [blame] | 367 | class VISIBILITY_HIDDEN OutOfBoundMemoryAccess : public BuiltinBug { |
| 368 | public: |
Ted Kremenek | cf118d4 | 2009-02-04 23:49:09 +0000 | [diff] [blame] | 369 | OutOfBoundMemoryAccess(GRExprEngine* eng) |
Ted Kremenek | 5d88ff8 | 2009-04-02 02:40:26 +0000 | [diff] [blame] | 370 | : BuiltinBug(eng,"Out-of-bounds memory access", |
Ted Kremenek | cf118d4 | 2009-02-04 23:49:09 +0000 | [diff] [blame] | 371 | "Load or store into an out-of-bound memory position.") {} |
Zhongxing Xu | 1c0c233 | 2008-11-23 05:52:28 +0000 | [diff] [blame] | 372 | |
Ted Kremenek | cf118d4 | 2009-02-04 23:49:09 +0000 | [diff] [blame] | 373 | void FlushReportsImpl(BugReporter& BR, GRExprEngine& Eng) { |
Zhongxing Xu | 1c0c233 | 2008-11-23 05:52:28 +0000 | [diff] [blame] | 374 | Emit(BR, Eng.explicit_oob_memacc_begin(), Eng.explicit_oob_memacc_end()); |
| 375 | } |
| 376 | }; |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 377 | |
Zhongxing Xu | ec9227f | 2009-10-29 02:09:30 +0000 | [diff] [blame] | 378 | } // end clang namespace |
Ted Kremenek | bc3a021 | 2009-10-30 17:24:47 +0000 | [diff] [blame] | 379 | |
Ted Kremenek | 78d4624 | 2008-07-22 16:21:24 +0000 | [diff] [blame] | 380 | //===----------------------------------------------------------------------===// |
| 381 | // Check registration. |
Ted Kremenek | cf118d4 | 2009-02-04 23:49:09 +0000 | [diff] [blame] | 382 | //===----------------------------------------------------------------------===// |
Ted Kremenek | 78d4624 | 2008-07-22 16:21:24 +0000 | [diff] [blame] | 383 | |
| 384 | void GRExprEngine::RegisterInternalChecks() { |
Ted Kremenek | cf118d4 | 2009-02-04 23:49:09 +0000 | [diff] [blame] | 385 | // Register internal "built-in" BugTypes with the BugReporter. These BugTypes |
| 386 | // are different than what probably many checks will do since they don't |
| 387 | // create BugReports on-the-fly but instead wait until GRExprEngine finishes |
| 388 | // analyzing a function. Generation of BugReport objects is done via a call |
| 389 | // to 'FlushReports' from BugReporter. |
Ted Kremenek | cf118d4 | 2009-02-04 23:49:09 +0000 | [diff] [blame] | 390 | BR.Register(new UndefBranch(this)); |
Ted Kremenek | cf118d4 | 2009-02-04 23:49:09 +0000 | [diff] [blame] | 391 | BR.Register(new UndefResult(this)); |
Ted Kremenek | cf118d4 | 2009-02-04 23:49:09 +0000 | [diff] [blame] | 392 | BR.Register(new BadMsgExprArg(this)); |
| 393 | BR.Register(new BadReceiver(this)); |
| 394 | BR.Register(new OutOfBoundMemoryAccess(this)); |
Ted Kremenek | 21fe837 | 2009-02-19 04:06:22 +0000 | [diff] [blame] | 395 | BR.Register(new NilReceiverStructRet(this)); |
Ted Kremenek | 899b3de | 2009-04-08 03:07:17 +0000 | [diff] [blame] | 396 | BR.Register(new NilReceiverLargerThanVoidPtrRet(this)); |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 397 | |
Ted Kremenek | cf118d4 | 2009-02-04 23:49:09 +0000 | [diff] [blame] | 398 | // The following checks do not need to have their associated BugTypes |
| 399 | // explicitly registered with the BugReporter. If they issue any BugReports, |
| 400 | // their associated BugType will get registered with the BugReporter |
| 401 | // automatically. Note that the check itself is owned by the GRExprEngine |
Ted Kremenek | 36df58a | 2009-11-06 20:47:51 +0000 | [diff] [blame] | 402 | // object. |
Ted Kremenek | b107c4b | 2009-11-04 04:24:16 +0000 | [diff] [blame] | 403 | registerCheck(new AttrNonNullChecker()); |
| 404 | registerCheck(new UndefinedArgChecker()); |
| 405 | registerCheck(new UndefinedAssignmentChecker()); |
| 406 | registerCheck(new BadCallChecker()); |
Ted Kremenek | 84b3595 | 2009-11-06 21:51:50 +0000 | [diff] [blame] | 407 | |
Ted Kremenek | b4b817d | 2009-11-11 03:26:34 +0000 | [diff] [blame^] | 408 | RegisterDereferenceChecker(*this); |
Ted Kremenek | 84b3595 | 2009-11-06 21:51:50 +0000 | [diff] [blame] | 409 | RegisterVLASizeChecker(*this); |
| 410 | RegisterDivZeroChecker(*this); |
| 411 | RegisterReturnStackAddressChecker(*this); |
| 412 | RegisterReturnUndefChecker(*this); |
Zhongxing Xu | 3ce2dc3 | 2009-11-09 05:34:10 +0000 | [diff] [blame] | 413 | RegisterPointerSubChecker(*this); |
Zhongxing Xu | ede7eb2 | 2009-11-09 13:23:31 +0000 | [diff] [blame] | 414 | RegisterPointerArithChecker(*this); |
Zhongxing Xu | b10a7c2 | 2009-11-09 06:52:44 +0000 | [diff] [blame] | 415 | RegisterFixedAddressChecker(*this); |
Ted Kremenek | 84b3595 | 2009-11-06 21:51:50 +0000 | [diff] [blame] | 416 | // Note that this must be registered after ReturnStackAddressChecker. |
| 417 | RegisterReturnPointerRangeChecker(*this); |
Zhongxing Xu | 4f3dc69 | 2009-11-09 08:07:38 +0000 | [diff] [blame] | 418 | |
| 419 | RegisterCastToStructChecker(*this); |
Ted Kremenek | 78d4624 | 2008-07-22 16:21:24 +0000 | [diff] [blame] | 420 | } |