lib/Analysis/BasicObjCFoundationChecks.cpp - platform/external/clang - Gitiles

 //== BasicObjCFoundationChecks.cpp - Simple Apple-Foundation checks -*- C++ -*--
 //
 //                     The LLVM Compiler Infrastructure
 //
 // This file is distributed under the University of Illinois Open Source
 // License. See LICENSE.TXT for details.
 //
 //===----------------------------------------------------------------------===//
 //
 //  This file defines BasicObjCFoundationChecks, a class that encapsulates
 //  a set of simple checks to run on Objective-C code using Apple's Foundation
 //  classes.
 //
 //===----------------------------------------------------------------------===//

 #include "BasicObjCFoundationChecks.h"

 #include "clang/Analysis/PathSensitive/ExplodedGraph.h"
 #include "clang/Analysis/PathSensitive/GRSimpleAPICheck.h"
 #include "clang/Analysis/PathSensitive/GRExprEngine.h"
 #include "clang/Analysis/PathSensitive/GRState.h"
 #include "clang/Analysis/PathSensitive/BugReporter.h"
 #include "clang/Analysis/PathSensitive/MemRegion.h"
 #include "clang/Analysis/PathDiagnostic.h"
 #include "clang/Analysis/LocalCheckers.h"
 #include "clang/AST/DeclObjC.h"
 #include "clang/AST/Expr.h"
 #include "clang/AST/ExprObjC.h"
 #include "clang/AST/ASTContext.h"
 #include "llvm/Support/Compiler.h"

 using namespace clang;

 static const ObjCInterfaceType* GetReceiverType(const ObjCMessageExpr* ME) {
   const Expr* Receiver = ME->getReceiver();

   if (!Receiver)
     return NULL;

   if (const ObjCObjectPointerType *PT =
       Receiver->getType()->getAsObjCObjectPointerType())
     return PT->getInterfaceType();

   return NULL;
 }

 static const char* GetReceiverNameType(const ObjCMessageExpr* ME) {
   const ObjCInterfaceType *ReceiverType = GetReceiverType(ME);
   return ReceiverType ? ReceiverType->getDecl()->getIdentifier()->getName()
                       : NULL;
 }

 namespace {

 class VISIBILITY_HIDDEN APIMisuse : public BugType {
 public:
   APIMisuse(const char* name) : BugType(name, "API Misuse (Apple)") {}
 };

 class VISIBILITY_HIDDEN BasicObjCFoundationChecks : public GRSimpleAPICheck {
   APIMisuse *BT;
   BugReporter& BR;
   ASTContext &Ctx;

   bool isNSString(const ObjCInterfaceType *T, const char* suffix);
   bool AuditNSString(NodeTy* N, ObjCMessageExpr* ME);

   void Warn(NodeTy* N, Expr* E, const std::string& s);
   void WarnNilArg(NodeTy* N, Expr* E);

   bool CheckNilArg(NodeTy* N, unsigned Arg);

 public:
   BasicObjCFoundationChecks(ASTContext& ctx, BugReporter& br)
     : BT(0), BR(br), Ctx(ctx) {}

   bool Audit(ExplodedNode<GRState>* N, GRStateManager&);

 private:
   void WarnNilArg(NodeTy* N, ObjCMessageExpr* ME, unsigned Arg) {
     std::string sbuf;
     llvm::raw_string_ostream os(sbuf);
     os << "Argument to '" << GetReceiverNameType(ME) << "' method '"
        << ME->getSelector().getAsString() << "' cannot be nil.";

     // Lazily create the BugType object for NilArg.  This will be owned
     // by the BugReporter object 'BR' once we call BR.EmitWarning.
     if (!BT) BT = new APIMisuse("nil argument");

     RangedBugReport *R = new RangedBugReport(*BT, os.str().c_str(), N);
     R->addRange(ME->getArg(Arg)->getSourceRange());
     BR.EmitReport(R);
   }
 };

 } // end anonymous namespace


 GRSimpleAPICheck*
 clang::CreateBasicObjCFoundationChecks(ASTContext& Ctx, BugReporter& BR) {
   return new BasicObjCFoundationChecks(Ctx, BR);
 }


 bool BasicObjCFoundationChecks::Audit(ExplodedNode<GRState>* N,
                                       GRStateManager&) {

   ObjCMessageExpr* ME =
     cast<ObjCMessageExpr>(cast<PostStmt>(N->getLocation()).getStmt());

   const ObjCInterfaceType *ReceiverType = GetReceiverType(ME);

   if (!ReceiverType)
     return false;

   const char* name = ReceiverType->getDecl()->getIdentifier()->getName();

   if (!name)
     return false;

   if (name[0] != 'N' || name[1] != 'S')
     return false;

   name += 2;

   // FIXME: Make all of this faster.
   if (isNSString(ReceiverType, name))
     return AuditNSString(N, ME);

   return false;
 }

 static inline bool isNil(SVal X) {
   return isa<loc::ConcreteInt>(X);
 }

 //===----------------------------------------------------------------------===//
 // Error reporting.
 //===----------------------------------------------------------------------===//

 bool BasicObjCFoundationChecks::CheckNilArg(NodeTy* N, unsigned Arg) {
   ObjCMessageExpr* ME =
     cast<ObjCMessageExpr>(cast<PostStmt>(N->getLocation()).getStmt());

   Expr * E = ME->getArg(Arg);

   if (isNil(N->getState()->getSVal(E))) {
     WarnNilArg(N, ME, Arg);
     return true;
   }

   return false;
 }

 //===----------------------------------------------------------------------===//
 // NSString checking.
 //===----------------------------------------------------------------------===//

 bool BasicObjCFoundationChecks::isNSString(const ObjCInterfaceType *T,
                                            const char* suffix) {
   return !strcmp("String", suffix) || !strcmp("MutableString", suffix);
 }

 bool BasicObjCFoundationChecks::AuditNSString(NodeTy* N,
                                               ObjCMessageExpr* ME) {

   Selector S = ME->getSelector();

   if (S.isUnarySelector())
     return false;

   // FIXME: This is going to be really slow doing these checks with
   //  lexical comparisons.

   std::string name = S.getAsString();
   assert (!name.empty());
   const char* cstr = &name[0];
   unsigned len = name.size();

   switch (len) {
     default:
       break;
     case 8:
       if (!strcmp(cstr, "compare:"))
         return CheckNilArg(N, 0);

       break;

     case 15:
       // FIXME: Checking for initWithFormat: will not work in most cases
       //  yet because [NSString alloc] returns id, not NSString*.  We will
       //  need support for tracking expected-type information in the analyzer
       //  to find these errors.
       if (!strcmp(cstr, "initWithFormat:"))
         return CheckNilArg(N, 0);

       break;

     case 16:
       if (!strcmp(cstr, "compare:options:"))
         return CheckNilArg(N, 0);

       break;

     case 22:
       if (!strcmp(cstr, "compare:options:range:"))
         return CheckNilArg(N, 0);

       break;

     case 23:

       if (!strcmp(cstr, "caseInsensitiveCompare:"))
         return CheckNilArg(N, 0);

       break;

     case 29:
       if (!strcmp(cstr, "compare:options:range:locale:"))
         return CheckNilArg(N, 0);

       break;

     case 37:
     if (!strcmp(cstr, "componentsSeparatedByCharactersInSet:"))
       return CheckNilArg(N, 0);

     break;
   }

   return false;
 }

 //===----------------------------------------------------------------------===//
 // Error reporting.
 //===----------------------------------------------------------------------===//

 namespace {

 class VISIBILITY_HIDDEN AuditCFNumberCreate : public GRSimpleAPICheck {
   APIMisuse* BT;

   // FIXME: Either this should be refactored into GRSimpleAPICheck, or
   //   it should always be passed with a call to Audit.  The latter
   //   approach makes this class more stateless.
   ASTContext& Ctx;
   IdentifierInfo* II;
   BugReporter& BR;

 public:
   AuditCFNumberCreate(ASTContext& ctx, BugReporter& br)
   : BT(0), Ctx(ctx), II(&Ctx.Idents.get("CFNumberCreate")), BR(br){}

   ~AuditCFNumberCreate() {}

   bool Audit(ExplodedNode<GRState>* N, GRStateManager&);

 private:
   void AddError(const TypedRegion* R, Expr* Ex, ExplodedNode<GRState> *N,
                 uint64_t SourceSize, uint64_t TargetSize, uint64_t NumberKind);
 };
 } // end anonymous namespace

 enum CFNumberType {
   kCFNumberSInt8Type = 1,
   kCFNumberSInt16Type = 2,
   kCFNumberSInt32Type = 3,
   kCFNumberSInt64Type = 4,
   kCFNumberFloat32Type = 5,
   kCFNumberFloat64Type = 6,
   kCFNumberCharType = 7,
   kCFNumberShortType = 8,
   kCFNumberIntType = 9,
   kCFNumberLongType = 10,
   kCFNumberLongLongType = 11,
   kCFNumberFloatType = 12,
   kCFNumberDoubleType = 13,
   kCFNumberCFIndexType = 14,
   kCFNumberNSIntegerType = 15,
   kCFNumberCGFloatType = 16
 };

 namespace {
   template<typename T>
   class Optional {
     bool IsKnown;
     T Val;
   public:
     Optional() : IsKnown(false), Val(0) {}
     Optional(const T& val) : IsKnown(true), Val(val) {}

     bool isKnown() const { return IsKnown; }

     const T& getValue() const {
       assert (isKnown());
       return Val;
     }

     operator const T&() const {
       return getValue();
     }
   };
 }

 static Optional<uint64_t> GetCFNumberSize(ASTContext& Ctx, uint64_t i) {
   static unsigned char FixedSize[] = { 8, 16, 32, 64, 32, 64 };

   if (i < kCFNumberCharType)
     return FixedSize[i-1];

   QualType T;

   switch (i) {
     case kCFNumberCharType:     T = Ctx.CharTy;     break;
     case kCFNumberShortType:    T = Ctx.ShortTy;    break;
     case kCFNumberIntType:      T = Ctx.IntTy;      break;
     case kCFNumberLongType:     T = Ctx.LongTy;     break;
     case kCFNumberLongLongType: T = Ctx.LongLongTy; break;
     case kCFNumberFloatType:    T = Ctx.FloatTy;    break;
     case kCFNumberDoubleType:   T = Ctx.DoubleTy;   break;
     case kCFNumberCFIndexType:
     case kCFNumberNSIntegerType:
     case kCFNumberCGFloatType:
       // FIXME: We need a way to map from names to Type*.
     default:
       return Optional<uint64_t>();
   }

   return Ctx.getTypeSize(T);
 }

 #if 0
 static const char* GetCFNumberTypeStr(uint64_t i) {
   static const char* Names[] = {
     "kCFNumberSInt8Type",
     "kCFNumberSInt16Type",
     "kCFNumberSInt32Type",
     "kCFNumberSInt64Type",
     "kCFNumberFloat32Type",
     "kCFNumberFloat64Type",
     "kCFNumberCharType",
     "kCFNumberShortType",
     "kCFNumberIntType",
     "kCFNumberLongType",
     "kCFNumberLongLongType",
     "kCFNumberFloatType",
     "kCFNumberDoubleType",
     "kCFNumberCFIndexType",
     "kCFNumberNSIntegerType",
     "kCFNumberCGFloatType"
   };

   return i <= kCFNumberCGFloatType ? Names[i-1] : "Invalid CFNumberType";
 }
 #endif

 bool AuditCFNumberCreate::Audit(ExplodedNode<GRState>* N,GRStateManager&){
   CallExpr* CE = cast<CallExpr>(cast<PostStmt>(N->getLocation()).getStmt());
   Expr* Callee = CE->getCallee();
   SVal CallV = N->getState()->getSVal(Callee);
   const FunctionDecl* FD = CallV.getAsFunctionDecl();

   if (!FD || FD->getIdentifier() != II || CE->getNumArgs()!=3)
     return false;

   // Get the value of the "theType" argument.
   SVal TheTypeVal = N->getState()->getSVal(CE->getArg(1));

     // FIXME: We really should allow ranges of valid theType values, and
     //   bifurcate the state appropriately.
   nonloc::ConcreteInt* V = dyn_cast<nonloc::ConcreteInt>(&TheTypeVal);

   if (!V)
     return false;

   uint64_t NumberKind = V->getValue().getLimitedValue();
   Optional<uint64_t> TargetSize = GetCFNumberSize(Ctx, NumberKind);

   // FIXME: In some cases we can emit an error.
   if (!TargetSize.isKnown())
     return false;

   // Look at the value of the integer being passed by reference.  Essentially
   // we want to catch cases where the value passed in is not equal to the
   // size of the type being created.
   SVal TheValueExpr = N->getState()->getSVal(CE->getArg(2));

   // FIXME: Eventually we should handle arbitrary locations.  We can do this
   //  by having an enhanced memory model that does low-level typing.
   loc::MemRegionVal* LV = dyn_cast<loc::MemRegionVal>(&TheValueExpr);

   if (!LV)
     return false;

   const TypedRegion* R = dyn_cast<TypedRegion>(LV->getRegion());
   if (!R) return false;

   while (const TypedViewRegion* ATR = dyn_cast<TypedViewRegion>(R)) {
     R = dyn_cast<TypedRegion>(ATR->getSuperRegion());
     if (!R) return false;
   }

   QualType T = Ctx.getCanonicalType(R->getValueType(Ctx));

   // FIXME: If the pointee isn't an integer type, should we flag a warning?
   //  People can do weird stuff with pointers.

   if (!T->isIntegerType())
     return false;

   uint64_t SourceSize = Ctx.getTypeSize(T);

   // CHECK: is SourceSize == TargetSize

   if (SourceSize == TargetSize)
     return false;

   AddError(R, CE->getArg(2), N, SourceSize, TargetSize, NumberKind);

   // FIXME: We can actually create an abstract "CFNumber" object that has
   //  the bits initialized to the provided values.
   return SourceSize < TargetSize;
 }

 void AuditCFNumberCreate::AddError(const TypedRegion* R, Expr* Ex,
                                    ExplodedNode<GRState> *N,
                                    uint64_t SourceSize, uint64_t TargetSize,
                                    uint64_t NumberKind) {

   std::string sbuf;
   llvm::raw_string_ostream os(sbuf);

   os << (SourceSize == 8 ? "An " : "A ")
      << SourceSize << " bit integer is used to initialize a CFNumber "
         "object that represents "
      << (TargetSize == 8 ? "an " : "a ")
      << TargetSize << " bit integer. ";

   if (SourceSize < TargetSize)
     os << (TargetSize - SourceSize)
        << " bits of the CFNumber value will be garbage." ;
   else
     os << (SourceSize - TargetSize)
        << " bits of the input integer will be lost.";

   // Lazily create the BugType object.  This will be owned
   // by the BugReporter object 'BR' once we call BR.EmitWarning.
   if (!BT) BT = new APIMisuse("Bad use of CFNumberCreate");
   RangedBugReport *report = new RangedBugReport(*BT, os.str().c_str(), N);
   report->addRange(Ex->getSourceRange());
   BR.EmitReport(report);
 }

 GRSimpleAPICheck*
 clang::CreateAuditCFNumberCreate(ASTContext& Ctx, BugReporter& BR) {
   return new AuditCFNumberCreate(Ctx, BR);
 }

 //===----------------------------------------------------------------------===//
 // CFRetain/CFRelease auditing for null arguments.
 //===----------------------------------------------------------------------===//

 namespace {
 class VISIBILITY_HIDDEN AuditCFRetainRelease : public GRSimpleAPICheck {
   APIMisuse *BT;

   // FIXME: Either this should be refactored into GRSimpleAPICheck, or
   //   it should always be passed with a call to Audit.  The latter
   //   approach makes this class more stateless.
   ASTContext& Ctx;
   IdentifierInfo *Retain, *Release;
   BugReporter& BR;

 public:
   AuditCFRetainRelease(ASTContext& ctx, BugReporter& br)
   : BT(0), Ctx(ctx),
     Retain(&Ctx.Idents.get("CFRetain")), Release(&Ctx.Idents.get("CFRelease")),
     BR(br){}

   ~AuditCFRetainRelease() {}

   bool Audit(ExplodedNode<GRState>* N, GRStateManager&);
 };
 } // end anonymous namespace


 bool AuditCFRetainRelease::Audit(ExplodedNode<GRState>* N, GRStateManager&) {
   CallExpr* CE = cast<CallExpr>(cast<PostStmt>(N->getLocation()).getStmt());

   // If the CallExpr doesn't have exactly 1 argument just give up checking.
   if (CE->getNumArgs() != 1)
     return false;

   // Check if we called CFRetain/CFRelease.
   const GRState* state = N->getState();
   SVal X = state->getSVal(CE->getCallee());
   const FunctionDecl* FD = X.getAsFunctionDecl();

   if (!FD)
     return false;

   const IdentifierInfo *FuncII = FD->getIdentifier();
   if (!(FuncII == Retain || FuncII == Release))
     return false;

   // Finally, check if the argument is NULL.
   // FIXME: We should be able to bifurcate the state here, as a successful
   // check will result in the value not being NULL afterwards.
   // FIXME: Need a way to register vistors for the BugReporter.  Would like
   // to benefit from the same diagnostics that regular null dereference
   // reporting has.
   if (state->getStateManager().isEqual(state, CE->getArg(0), 0)) {
     if (!BT)
       BT = new APIMisuse("null passed to CFRetain/CFRelease");

     const char *description = (FuncII == Retain)
                             ? "Null pointer argument in call to CFRetain"
                             : "Null pointer argument in call to CFRelease";

     RangedBugReport *report = new RangedBugReport(*BT, description, N);
     report->addRange(CE->getArg(0)->getSourceRange());
     BR.EmitReport(report);
     return true;
   }

   return false;
 }


 GRSimpleAPICheck*
 clang::CreateAuditCFRetainRelease(ASTContext& Ctx, BugReporter& BR) {
   return new AuditCFRetainRelease(Ctx, BR);
 }

 //===----------------------------------------------------------------------===//
 // Check registration.
 //===----------------------------------------------------------------------===//

 void clang::RegisterAppleChecks(GRExprEngine& Eng) {
   ASTContext& Ctx = Eng.getContext();
   BugReporter &BR = Eng.getBugReporter();

   Eng.AddCheck(CreateBasicObjCFoundationChecks(Ctx, BR),
                Stmt::ObjCMessageExprClass);
   Eng.AddCheck(CreateAuditCFNumberCreate(Ctx, BR), Stmt::CallExprClass);
   Eng.AddCheck(CreateAuditCFRetainRelease(Ctx, BR), Stmt::CallExprClass);

   RegisterNSErrorChecks(BR, Eng);
 }
	//== BasicObjCFoundationChecks.cpp - Simple Apple-Foundation checks -- C++ ---
	//
	// The LLVM Compiler Infrastructure
	//
	// This file is distributed under the University of Illinois Open Source
	// License. See LICENSE.TXT for details.
	//
	//===----------------------------------------------------------------------===//
	//
	// This file defines BasicObjCFoundationChecks, a class that encapsulates
	// a set of simple checks to run on Objective-C code using Apple's Foundation
	// classes.
	//
	//===----------------------------------------------------------------------===//

	#include "BasicObjCFoundationChecks.h"

	#include "clang/Analysis/PathSensitive/ExplodedGraph.h"
	#include "clang/Analysis/PathSensitive/GRSimpleAPICheck.h"
	#include "clang/Analysis/PathSensitive/GRExprEngine.h"
	#include "clang/Analysis/PathSensitive/GRState.h"
	#include "clang/Analysis/PathSensitive/BugReporter.h"
	#include "clang/Analysis/PathSensitive/MemRegion.h"
	#include "clang/Analysis/PathDiagnostic.h"
	#include "clang/Analysis/LocalCheckers.h"
	#include "clang/AST/DeclObjC.h"
	#include "clang/AST/Expr.h"
	#include "clang/AST/ExprObjC.h"
	#include "clang/AST/ASTContext.h"
	#include "llvm/Support/Compiler.h"

	using namespace clang;

	static const ObjCInterfaceType* GetReceiverType(const ObjCMessageExpr* ME) {
	const Expr* Receiver = ME->getReceiver();

	if (!Receiver)
	return NULL;

	if (const ObjCObjectPointerType *PT =
	Receiver->getType()->getAsObjCObjectPointerType())
	return PT->getInterfaceType();

	return NULL;
	}

	static const char* GetReceiverNameType(const ObjCMessageExpr* ME) {
	const ObjCInterfaceType *ReceiverType = GetReceiverType(ME);
	return ReceiverType ? ReceiverType->getDecl()->getIdentifier()->getName()
	: NULL;
	}

	namespace {

	class VISIBILITY_HIDDEN APIMisuse : public BugType {
	public:
	APIMisuse(const char* name) : BugType(name, "API Misuse (Apple)") {}
	};

	class VISIBILITY_HIDDEN BasicObjCFoundationChecks : public GRSimpleAPICheck {
	APIMisuse *BT;
	BugReporter& BR;
	ASTContext &Ctx;

	bool isNSString(const ObjCInterfaceType T, const char suffix);
	bool AuditNSString(NodeTy* N, ObjCMessageExpr* ME);

	void Warn(NodeTy* N, Expr* E, const std::string& s);
	void WarnNilArg(NodeTy* N, Expr* E);

	bool CheckNilArg(NodeTy* N, unsigned Arg);

	public:
	BasicObjCFoundationChecks(ASTContext& ctx, BugReporter& br)
	: BT(0), BR(br), Ctx(ctx) {}

	bool Audit(ExplodedNode<GRState>* N, GRStateManager&);

	private:
	void WarnNilArg(NodeTy* N, ObjCMessageExpr* ME, unsigned Arg) {
	std::string sbuf;
	llvm::raw_string_ostream os(sbuf);
	os << "Argument to '" << GetReceiverNameType(ME) << "' method '"
	<< ME->getSelector().getAsString() << "' cannot be nil.";

	// Lazily create the BugType object for NilArg. This will be owned
	// by the BugReporter object 'BR' once we call BR.EmitWarning.
	if (!BT) BT = new APIMisuse("nil argument");

	RangedBugReport R = new RangedBugReport(BT, os.str().c_str(), N);
	R->addRange(ME->getArg(Arg)->getSourceRange());
	BR.EmitReport(R);
	}
	};

	} // end anonymous namespace


	GRSimpleAPICheck*
	clang::CreateBasicObjCFoundationChecks(ASTContext& Ctx, BugReporter& BR) {
	return new BasicObjCFoundationChecks(Ctx, BR);
	}



	bool BasicObjCFoundationChecks::Audit(ExplodedNode<GRState>* N,
	GRStateManager&) {

	ObjCMessageExpr* ME =
	cast<ObjCMessageExpr>(cast<PostStmt>(N->getLocation()).getStmt());

	const ObjCInterfaceType *ReceiverType = GetReceiverType(ME);

	if (!ReceiverType)
	return false;

	const char* name = ReceiverType->getDecl()->getIdentifier()->getName();

	if (!name)
	return false;

	if (name[0] != 'N' \|\| name[1] != 'S')
	return false;

	name += 2;

	// FIXME: Make all of this faster.
	if (isNSString(ReceiverType, name))
	return AuditNSString(N, ME);

	return false;
	}

	static inline bool isNil(SVal X) {
	return isa<loc::ConcreteInt>(X);
	}

	//===----------------------------------------------------------------------===//
	// Error reporting.
	//===----------------------------------------------------------------------===//

	bool BasicObjCFoundationChecks::CheckNilArg(NodeTy* N, unsigned Arg) {
	ObjCMessageExpr* ME =
	cast<ObjCMessageExpr>(cast<PostStmt>(N->getLocation()).getStmt());

	Expr * E = ME->getArg(Arg);

	if (isNil(N->getState()->getSVal(E))) {
	WarnNilArg(N, ME, Arg);
	return true;
	}

	return false;
	}

	//===----------------------------------------------------------------------===//
	// NSString checking.
	//===----------------------------------------------------------------------===//

	bool BasicObjCFoundationChecks::isNSString(const ObjCInterfaceType *T,
	const char* suffix) {
	return !strcmp("String", suffix) \|\| !strcmp("MutableString", suffix);
	}

	bool BasicObjCFoundationChecks::AuditNSString(NodeTy* N,
	ObjCMessageExpr* ME) {

	Selector S = ME->getSelector();

	if (S.isUnarySelector())
	return false;

	// FIXME: This is going to be really slow doing these checks with
	// lexical comparisons.

	std::string name = S.getAsString();
	assert (!name.empty());
	const char* cstr = &name[0];
	unsigned len = name.size();

	switch (len) {
	default:
	break;
	case 8:
	if (!strcmp(cstr, "compare:"))
	return CheckNilArg(N, 0);

	break;

	case 15:
	// FIXME: Checking for initWithFormat: will not work in most cases
	// yet because [NSString alloc] returns id, not NSString*. We will
	// need support for tracking expected-type information in the analyzer
	// to find these errors.
	if (!strcmp(cstr, "initWithFormat:"))
	return CheckNilArg(N, 0);

	break;

	case 16:
	if (!strcmp(cstr, "compare:options:"))
	return CheckNilArg(N, 0);

	break;

	case 22:
	if (!strcmp(cstr, "compare:options:range:"))
	return CheckNilArg(N, 0);

	break;

	case 23:

	if (!strcmp(cstr, "caseInsensitiveCompare:"))
	return CheckNilArg(N, 0);

	break;

	case 29:
	if (!strcmp(cstr, "compare:options:range:locale:"))
	return CheckNilArg(N, 0);

	break;

	case 37:
	if (!strcmp(cstr, "componentsSeparatedByCharactersInSet:"))
	return CheckNilArg(N, 0);

	break;
	}

	return false;
	}

	//===----------------------------------------------------------------------===//
	// Error reporting.
	//===----------------------------------------------------------------------===//

	namespace {

	class VISIBILITY_HIDDEN AuditCFNumberCreate : public GRSimpleAPICheck {
	APIMisuse* BT;

	// FIXME: Either this should be refactored into GRSimpleAPICheck, or
	// it should always be passed with a call to Audit. The latter
	// approach makes this class more stateless.
	ASTContext& Ctx;
	IdentifierInfo* II;
	BugReporter& BR;

	public:
	AuditCFNumberCreate(ASTContext& ctx, BugReporter& br)
	: BT(0), Ctx(ctx), II(&Ctx.Idents.get("CFNumberCreate")), BR(br){}

	~AuditCFNumberCreate() {}

	bool Audit(ExplodedNode<GRState>* N, GRStateManager&);

	private:
	void AddError(const TypedRegion* R, Expr* Ex, ExplodedNode<GRState> *N,
	uint64_t SourceSize, uint64_t TargetSize, uint64_t NumberKind);
	};
	} // end anonymous namespace

	enum CFNumberType {
	kCFNumberSInt8Type = 1,
	kCFNumberSInt16Type = 2,
	kCFNumberSInt32Type = 3,
	kCFNumberSInt64Type = 4,
	kCFNumberFloat32Type = 5,
	kCFNumberFloat64Type = 6,
	kCFNumberCharType = 7,
	kCFNumberShortType = 8,
	kCFNumberIntType = 9,
	kCFNumberLongType = 10,
	kCFNumberLongLongType = 11,
	kCFNumberFloatType = 12,
	kCFNumberDoubleType = 13,
	kCFNumberCFIndexType = 14,
	kCFNumberNSIntegerType = 15,
	kCFNumberCGFloatType = 16
	};

	namespace {
	template<typename T>
	class Optional {
	bool IsKnown;
	T Val;
	public:
	Optional() : IsKnown(false), Val(0) {}
	Optional(const T& val) : IsKnown(true), Val(val) {}

	bool isKnown() const { return IsKnown; }

	const T& getValue() const {
	assert (isKnown());
	return Val;
	}

	operator const T&() const {
	return getValue();
	}
	};
	}

	static Optional<uint64_t> GetCFNumberSize(ASTContext& Ctx, uint64_t i) {
	static unsigned char FixedSize[] = { 8, 16, 32, 64, 32, 64 };

	if (i < kCFNumberCharType)
	return FixedSize[i-1];

	QualType T;

	switch (i) {
	case kCFNumberCharType: T = Ctx.CharTy; break;
	case kCFNumberShortType: T = Ctx.ShortTy; break;
	case kCFNumberIntType: T = Ctx.IntTy; break;
	case kCFNumberLongType: T = Ctx.LongTy; break;
	case kCFNumberLongLongType: T = Ctx.LongLongTy; break;
	case kCFNumberFloatType: T = Ctx.FloatTy; break;
	case kCFNumberDoubleType: T = Ctx.DoubleTy; break;
	case kCFNumberCFIndexType:
	case kCFNumberNSIntegerType:
	case kCFNumberCGFloatType:
	// FIXME: We need a way to map from names to Type*.
	default:
	return Optional<uint64_t>();
	}

	return Ctx.getTypeSize(T);
	}

	#if 0
	static const char* GetCFNumberTypeStr(uint64_t i) {
	static const char* Names[] = {
	"kCFNumberSInt8Type",
	"kCFNumberSInt16Type",
	"kCFNumberSInt32Type",
	"kCFNumberSInt64Type",
	"kCFNumberFloat32Type",
	"kCFNumberFloat64Type",
	"kCFNumberCharType",
	"kCFNumberShortType",
	"kCFNumberIntType",
	"kCFNumberLongType",
	"kCFNumberLongLongType",
	"kCFNumberFloatType",
	"kCFNumberDoubleType",
	"kCFNumberCFIndexType",
	"kCFNumberNSIntegerType",
	"kCFNumberCGFloatType"
	};

	return i <= kCFNumberCGFloatType ? Names[i-1] : "Invalid CFNumberType";
	}
	#endif

	bool AuditCFNumberCreate::Audit(ExplodedNode<GRState>* N,GRStateManager&){
	CallExpr* CE = cast<CallExpr>(cast<PostStmt>(N->getLocation()).getStmt());
	Expr* Callee = CE->getCallee();
	SVal CallV = N->getState()->getSVal(Callee);
	const FunctionDecl* FD = CallV.getAsFunctionDecl();

	if (!FD \|\| FD->getIdentifier() != II \|\| CE->getNumArgs()!=3)
	return false;

	// Get the value of the "theType" argument.
	SVal TheTypeVal = N->getState()->getSVal(CE->getArg(1));

	// FIXME: We really should allow ranges of valid theType values, and
	// bifurcate the state appropriately.
	nonloc::ConcreteInt* V = dyn_cast<nonloc::ConcreteInt>(&TheTypeVal);

	if (!V)
	return false;

	uint64_t NumberKind = V->getValue().getLimitedValue();
	Optional<uint64_t> TargetSize = GetCFNumberSize(Ctx, NumberKind);

	// FIXME: In some cases we can emit an error.
	if (!TargetSize.isKnown())
	return false;

	// Look at the value of the integer being passed by reference. Essentially
	// we want to catch cases where the value passed in is not equal to the
	// size of the type being created.
	SVal TheValueExpr = N->getState()->getSVal(CE->getArg(2));

	// FIXME: Eventually we should handle arbitrary locations. We can do this
	// by having an enhanced memory model that does low-level typing.
	loc::MemRegionVal* LV = dyn_cast<loc::MemRegionVal>(&TheValueExpr);

	if (!LV)
	return false;

	const TypedRegion* R = dyn_cast<TypedRegion>(LV->getRegion());
	if (!R) return false;

	while (const TypedViewRegion* ATR = dyn_cast<TypedViewRegion>(R)) {
	R = dyn_cast<TypedRegion>(ATR->getSuperRegion());
	if (!R) return false;
	}

	QualType T = Ctx.getCanonicalType(R->getValueType(Ctx));

	// FIXME: If the pointee isn't an integer type, should we flag a warning?
	// People can do weird stuff with pointers.

	if (!T->isIntegerType())
	return false;

	uint64_t SourceSize = Ctx.getTypeSize(T);

	// CHECK: is SourceSize == TargetSize

	if (SourceSize == TargetSize)
	return false;

	AddError(R, CE->getArg(2), N, SourceSize, TargetSize, NumberKind);

	// FIXME: We can actually create an abstract "CFNumber" object that has
	// the bits initialized to the provided values.
	return SourceSize < TargetSize;
	}

	void AuditCFNumberCreate::AddError(const TypedRegion* R, Expr* Ex,
	ExplodedNode<GRState> *N,
	uint64_t SourceSize, uint64_t TargetSize,
	uint64_t NumberKind) {

	std::string sbuf;
	llvm::raw_string_ostream os(sbuf);

	os << (SourceSize == 8 ? "An " : "A ")
	<< SourceSize << " bit integer is used to initialize a CFNumber "
	"object that represents "
	<< (TargetSize == 8 ? "an " : "a ")
	<< TargetSize << " bit integer. ";

	if (SourceSize < TargetSize)
	os << (TargetSize - SourceSize)
	<< " bits of the CFNumber value will be garbage." ;
	else
	os << (SourceSize - TargetSize)
	<< " bits of the input integer will be lost.";

	// Lazily create the BugType object. This will be owned
	// by the BugReporter object 'BR' once we call BR.EmitWarning.
	if (!BT) BT = new APIMisuse("Bad use of CFNumberCreate");
	RangedBugReport report = new RangedBugReport(BT, os.str().c_str(), N);
	report->addRange(Ex->getSourceRange());
	BR.EmitReport(report);
	}

	GRSimpleAPICheck*
	clang::CreateAuditCFNumberCreate(ASTContext& Ctx, BugReporter& BR) {
	return new AuditCFNumberCreate(Ctx, BR);
	}

	//===----------------------------------------------------------------------===//
	// CFRetain/CFRelease auditing for null arguments.
	//===----------------------------------------------------------------------===//

	namespace {
	class VISIBILITY_HIDDEN AuditCFRetainRelease : public GRSimpleAPICheck {
	APIMisuse *BT;

	// FIXME: Either this should be refactored into GRSimpleAPICheck, or
	// it should always be passed with a call to Audit. The latter
	// approach makes this class more stateless.
	ASTContext& Ctx;
	IdentifierInfo Retain, Release;
	BugReporter& BR;

	public:
	AuditCFRetainRelease(ASTContext& ctx, BugReporter& br)
	: BT(0), Ctx(ctx),
	Retain(&Ctx.Idents.get("CFRetain")), Release(&Ctx.Idents.get("CFRelease")),
	BR(br){}

	~AuditCFRetainRelease() {}

	bool Audit(ExplodedNode<GRState>* N, GRStateManager&);
	};
	} // end anonymous namespace


	bool AuditCFRetainRelease::Audit(ExplodedNode<GRState>* N, GRStateManager&) {
	CallExpr* CE = cast<CallExpr>(cast<PostStmt>(N->getLocation()).getStmt());

	// If the CallExpr doesn't have exactly 1 argument just give up checking.
	if (CE->getNumArgs() != 1)
	return false;

	// Check if we called CFRetain/CFRelease.
	const GRState* state = N->getState();
	SVal X = state->getSVal(CE->getCallee());
	const FunctionDecl* FD = X.getAsFunctionDecl();

	if (!FD)
	return false;

	const IdentifierInfo *FuncII = FD->getIdentifier();
	if (!(FuncII == Retain \|\| FuncII == Release))
	return false;

	// Finally, check if the argument is NULL.
	// FIXME: We should be able to bifurcate the state here, as a successful
	// check will result in the value not being NULL afterwards.
	// FIXME: Need a way to register vistors for the BugReporter. Would like
	// to benefit from the same diagnostics that regular null dereference
	// reporting has.
	if (state->getStateManager().isEqual(state, CE->getArg(0), 0)) {
	if (!BT)
	BT = new APIMisuse("null passed to CFRetain/CFRelease");

	const char *description = (FuncII == Retain)
	? "Null pointer argument in call to CFRetain"
	: "Null pointer argument in call to CFRelease";

	RangedBugReport report = new RangedBugReport(BT, description, N);
	report->addRange(CE->getArg(0)->getSourceRange());
	BR.EmitReport(report);
	return true;
	}

	return false;
	}


	GRSimpleAPICheck*
	clang::CreateAuditCFRetainRelease(ASTContext& Ctx, BugReporter& BR) {
	return new AuditCFRetainRelease(Ctx, BR);
	}

	//===----------------------------------------------------------------------===//
	// Check registration.
	//===----------------------------------------------------------------------===//

	void clang::RegisterAppleChecks(GRExprEngine& Eng) {
	ASTContext& Ctx = Eng.getContext();
	BugReporter &BR = Eng.getBugReporter();

	Eng.AddCheck(CreateBasicObjCFoundationChecks(Ctx, BR),
	Stmt::ObjCMessageExprClass);
	Eng.AddCheck(CreateAuditCFNumberCreate(Ctx, BR), Stmt::CallExprClass);
	Eng.AddCheck(CreateAuditCFRetainRelease(Ctx, BR), Stmt::CallExprClass);

	RegisterNSErrorChecks(BR, Eng);
	}