lib/Analysis/DereferenceChecker.cpp

//== NullDerefChecker.cpp - Null dereference checker ------------*- C++ -*--==//
//
//                     The LLVM Compiler Infrastructure
//
// This file is distributed under the University of Illinois Open Source
// License. See LICENSE.TXT for details.
//
//===----------------------------------------------------------------------===//
//
// This defines NullDerefChecker, a builtin check in GRExprEngine that performs
// checks for null pointers at loads and stores.
//
//===----------------------------------------------------------------------===//

#include "clang/Analysis/PathSensitive/Checkers/DereferenceChecker.h"
#include "clang/Analysis/PathSensitive/GRExprEngine.h"
#include "clang/Analysis/PathSensitive/BugReporter.h"

using namespace clang;

void *NullDerefChecker::getTag() {
  static int x = 0;
  return &x;
}

ExplodedNode *NullDerefChecker::CheckLocation(const Stmt *S, ExplodedNode *Pred,
                                              const GRState *state, SVal V,
                                              GRExprEngine &Eng) {
  Loc *LV = dyn_cast<Loc>(&V);
  
    // If the value is not a location, don't touch the node.
  if (!LV)
    return Pred;
  
  const GRState *NotNullState = state->Assume(*LV, true);
  const GRState *NullState = state->Assume(*LV, false);
  
  GRStmtNodeBuilder &Builder = Eng.getBuilder();
  BugReporter &BR = Eng.getBugReporter();
  
    // The explicit NULL case.
  if (NullState) {
      // Use the GDM to mark in the state what lval was null.
    const SVal *PersistentLV = Eng.getBasicVals().getPersistentSVal(*LV);
    NullState = NullState->set<GRState::NullDerefTag>(PersistentLV);
    
    ExplodedNode *N = Builder.generateNode(S, NullState, Pred,
                                         ProgramPoint::PostNullCheckFailedKind);
    if (N) {
      N->markAsSink();
      
      if (!NotNullState) { // Explicit null case.
        if (!BT)
          BT = new BuiltinBug("Null dereference","Dereference of null pointer");

        EnhancedBugReport *R =
          new EnhancedBugReport(*BT, BT->getDescription().c_str(), N);

        R->addVisitorCreator(bugreporter::registerTrackNullOrUndefValue,
                             bugreporter::GetDerefExpr(N));
        
        BR.EmitReport(R);
        
        return 0;
      } else // Implicit null case.
        ImplicitNullDerefNodes.push_back(N);
    }
  }
  
  if (!NotNullState)
    return 0;

  return Builder.generateNode(S, NotNullState, Pred, 
                              ProgramPoint::PostLocationChecksSucceedKind);
}


void *UndefDerefChecker::getTag() {
  static int x = 0;
  return &x;
}

ExplodedNode *UndefDerefChecker::CheckLocation(const Stmt *S, 
                                               ExplodedNode *Pred,
                                               const GRState *state, SVal V,
                                               GRExprEngine &Eng) {
  GRStmtNodeBuilder &Builder = Eng.getBuilder();
  BugReporter &BR = Eng.getBugReporter();

  if (V.isUndef()) {
    ExplodedNode *N = Builder.generateNode(S, state, Pred, 
                               ProgramPoint::PostUndefLocationCheckFailedKind);
    if (N) {
      N->markAsSink();

      if (!BT)
        BT = new BuiltinBug(0, "Undefined dereference", 
                            "Dereference of undefined pointer value");

      EnhancedBugReport *R =
        new EnhancedBugReport(*BT, BT->getDescription().c_str(), N);
      R->addVisitorCreator(bugreporter::registerTrackNullOrUndefValue,
                           bugreporter::GetDerefExpr(N));
      BR.EmitReport(R);
    }
    return 0;
  }

  return Pred;
}