1 //=- NSErrorChecker.cpp - Coding conventions for uses of NSError -*- C++ -*-==// 2 // 3 // Part of the LLVM Project, under the Apache License v2.0 with LLVM Exceptions. 4 // See https://llvm.org/LICENSE.txt for license information. 5 // SPDX-License-Identifier: Apache-2.0 WITH LLVM-exception 6 // 7 //===----------------------------------------------------------------------===// 8 // 9 // This file defines a CheckNSError, a flow-insensitive check 10 // that determines if an Objective-C class interface correctly returns 11 // a non-void return type. 12 // 13 // File under feature request PR 2600. 14 // 15 //===----------------------------------------------------------------------===// 16 17 #include "clang/StaticAnalyzer/Checkers/BuiltinCheckerRegistration.h" 18 #include "clang/AST/Decl.h" 19 #include "clang/AST/DeclObjC.h" 20 #include "clang/StaticAnalyzer/Core/BugReporter/BugType.h" 21 #include "clang/StaticAnalyzer/Core/Checker.h" 22 #include "clang/StaticAnalyzer/Core/CheckerManager.h" 23 #include "clang/StaticAnalyzer/Core/PathSensitive/CheckerContext.h" 24 #include "clang/StaticAnalyzer/Core/PathSensitive/ProgramStateTrait.h" 25 #include "llvm/ADT/SmallString.h" 26 #include "llvm/Support/raw_ostream.h" 27 #include <optional> 28 29 using namespace clang; 30 using namespace ento; 31 32 static bool IsNSError(QualType T, IdentifierInfo *II); 33 static bool IsCFError(QualType T, IdentifierInfo *II); 34 35 //===----------------------------------------------------------------------===// 36 // NSErrorMethodChecker 37 //===----------------------------------------------------------------------===// 38 39 namespace { 40 class NSErrorMethodChecker 41 : public Checker< check::ASTDecl<ObjCMethodDecl> > { 42 mutable IdentifierInfo *II; 43 44 public: 45 NSErrorMethodChecker() : II(nullptr) {} 46 47 void checkASTDecl(const ObjCMethodDecl *D, 48 AnalysisManager &mgr, BugReporter &BR) const; 49 }; 50 } 51 52 void NSErrorMethodChecker::checkASTDecl(const ObjCMethodDecl *D, 53 AnalysisManager &mgr, 54 BugReporter &BR) const { 55 if (!D->isThisDeclarationADefinition()) 56 return; 57 if (!D->getReturnType()->isVoidType()) 58 return; 59 60 if (!II) 61 II = &D->getASTContext().Idents.get("NSError"); 62 63 bool hasNSError = false; 64 for (const auto *I : D->parameters()) { 65 if (IsNSError(I->getType(), II)) { 66 hasNSError = true; 67 break; 68 } 69 } 70 71 if (hasNSError) { 72 const char *err = "Method accepting NSError** " 73 "should have a non-void return value to indicate whether or not an " 74 "error occurred"; 75 PathDiagnosticLocation L = 76 PathDiagnosticLocation::create(D, BR.getSourceManager()); 77 BR.EmitBasicReport(D, this, "Bad return type when passing NSError**", 78 "Coding conventions (Apple)", err, L); 79 } 80 } 81 82 //===----------------------------------------------------------------------===// 83 // CFErrorFunctionChecker 84 //===----------------------------------------------------------------------===// 85 86 namespace { 87 class CFErrorFunctionChecker 88 : public Checker< check::ASTDecl<FunctionDecl> > { 89 mutable IdentifierInfo *II; 90 91 public: 92 CFErrorFunctionChecker() : II(nullptr) {} 93 94 void checkASTDecl(const FunctionDecl *D, 95 AnalysisManager &mgr, BugReporter &BR) const; 96 }; 97 } 98 99 static bool hasReservedReturnType(const FunctionDecl *D) { 100 if (isa<CXXConstructorDecl>(D)) 101 return true; 102 103 // operators delete and delete[] are required to have 'void' return type 104 auto OperatorKind = D->getOverloadedOperator(); 105 return OperatorKind == OO_Delete || OperatorKind == OO_Array_Delete; 106 } 107 108 void CFErrorFunctionChecker::checkASTDecl(const FunctionDecl *D, 109 AnalysisManager &mgr, 110 BugReporter &BR) const { 111 if (!D->doesThisDeclarationHaveABody()) 112 return; 113 if (!D->getReturnType()->isVoidType()) 114 return; 115 if (hasReservedReturnType(D)) 116 return; 117 118 if (!II) 119 II = &D->getASTContext().Idents.get("CFErrorRef"); 120 121 bool hasCFError = false; 122 for (auto *I : D->parameters()) { 123 if (IsCFError(I->getType(), II)) { 124 hasCFError = true; 125 break; 126 } 127 } 128 129 if (hasCFError) { 130 const char *err = "Function accepting CFErrorRef* " 131 "should have a non-void return value to indicate whether or not an " 132 "error occurred"; 133 PathDiagnosticLocation L = 134 PathDiagnosticLocation::create(D, BR.getSourceManager()); 135 BR.EmitBasicReport(D, this, "Bad return type when passing CFErrorRef*", 136 "Coding conventions (Apple)", err, L); 137 } 138 } 139 140 //===----------------------------------------------------------------------===// 141 // NSOrCFErrorDerefChecker 142 //===----------------------------------------------------------------------===// 143 144 namespace { 145 146 class NSErrorDerefBug : public BugType { 147 public: 148 NSErrorDerefBug(const CheckerNameRef Checker) 149 : BugType(Checker, "NSError** null dereference", 150 "Coding conventions (Apple)") {} 151 }; 152 153 class CFErrorDerefBug : public BugType { 154 public: 155 CFErrorDerefBug(const CheckerNameRef Checker) 156 : BugType(Checker, "CFErrorRef* null dereference", 157 "Coding conventions (Apple)") {} 158 }; 159 160 } 161 162 namespace { 163 class NSOrCFErrorDerefChecker 164 : public Checker< check::Location, 165 check::Event<ImplicitNullDerefEvent> > { 166 mutable IdentifierInfo *NSErrorII, *CFErrorII; 167 mutable std::unique_ptr<NSErrorDerefBug> NSBT; 168 mutable std::unique_ptr<CFErrorDerefBug> CFBT; 169 public: 170 bool ShouldCheckNSError = false, ShouldCheckCFError = false; 171 CheckerNameRef NSErrorName, CFErrorName; 172 NSOrCFErrorDerefChecker() : NSErrorII(nullptr), CFErrorII(nullptr) {} 173 174 void checkLocation(SVal loc, bool isLoad, const Stmt *S, 175 CheckerContext &C) const; 176 void checkEvent(ImplicitNullDerefEvent event) const; 177 }; 178 } 179 180 typedef llvm::ImmutableMap<SymbolRef, unsigned> ErrorOutFlag; 181 REGISTER_TRAIT_WITH_PROGRAMSTATE(NSErrorOut, ErrorOutFlag) 182 REGISTER_TRAIT_WITH_PROGRAMSTATE(CFErrorOut, ErrorOutFlag) 183 184 template <typename T> 185 static bool hasFlag(SVal val, ProgramStateRef state) { 186 if (SymbolRef sym = val.getAsSymbol()) 187 if (const unsigned *attachedFlags = state->get<T>(sym)) 188 return *attachedFlags; 189 return false; 190 } 191 192 template <typename T> 193 static void setFlag(ProgramStateRef state, SVal val, CheckerContext &C) { 194 // We tag the symbol that the SVal wraps. 195 if (SymbolRef sym = val.getAsSymbol()) 196 C.addTransition(state->set<T>(sym, true)); 197 } 198 199 static QualType parameterTypeFromSVal(SVal val, CheckerContext &C) { 200 const StackFrameContext * SFC = C.getStackFrame(); 201 if (std::optional<loc::MemRegionVal> X = val.getAs<loc::MemRegionVal>()) { 202 const MemRegion* R = X->getRegion(); 203 if (const VarRegion *VR = R->getAs<VarRegion>()) 204 if (const StackArgumentsSpaceRegion * 205 stackReg = dyn_cast<StackArgumentsSpaceRegion>(VR->getMemorySpace())) 206 if (stackReg->getStackFrame() == SFC) 207 return VR->getValueType(); 208 } 209 210 return QualType(); 211 } 212 213 void NSOrCFErrorDerefChecker::checkLocation(SVal loc, bool isLoad, 214 const Stmt *S, 215 CheckerContext &C) const { 216 if (!isLoad) 217 return; 218 if (loc.isUndef() || !isa<Loc>(loc)) 219 return; 220 221 ASTContext &Ctx = C.getASTContext(); 222 ProgramStateRef state = C.getState(); 223 224 // If we are loading from NSError**/CFErrorRef* parameter, mark the resulting 225 // SVal so that we can later check it when handling the 226 // ImplicitNullDerefEvent event. 227 // FIXME: Cumbersome! Maybe add hook at construction of SVals at start of 228 // function ? 229 230 QualType parmT = parameterTypeFromSVal(loc, C); 231 if (parmT.isNull()) 232 return; 233 234 if (!NSErrorII) 235 NSErrorII = &Ctx.Idents.get("NSError"); 236 if (!CFErrorII) 237 CFErrorII = &Ctx.Idents.get("CFErrorRef"); 238 239 if (ShouldCheckNSError && IsNSError(parmT, NSErrorII)) { 240 setFlag<NSErrorOut>(state, state->getSVal(loc.castAs<Loc>()), C); 241 return; 242 } 243 244 if (ShouldCheckCFError && IsCFError(parmT, CFErrorII)) { 245 setFlag<CFErrorOut>(state, state->getSVal(loc.castAs<Loc>()), C); 246 return; 247 } 248 } 249 250 void NSOrCFErrorDerefChecker::checkEvent(ImplicitNullDerefEvent event) const { 251 if (event.IsLoad) 252 return; 253 254 SVal loc = event.Location; 255 ProgramStateRef state = event.SinkNode->getState(); 256 BugReporter &BR = *event.BR; 257 258 bool isNSError = hasFlag<NSErrorOut>(loc, state); 259 bool isCFError = false; 260 if (!isNSError) 261 isCFError = hasFlag<CFErrorOut>(loc, state); 262 263 if (!(isNSError || isCFError)) 264 return; 265 266 // Storing to possible null NSError/CFErrorRef out parameter. 267 SmallString<128> Buf; 268 llvm::raw_svector_ostream os(Buf); 269 270 os << "Potential null dereference. According to coding standards "; 271 os << (isNSError 272 ? "in 'Creating and Returning NSError Objects' the parameter" 273 : "documented in CoreFoundation/CFError.h the parameter"); 274 275 os << " may be null"; 276 277 BugType *bug = nullptr; 278 if (isNSError) { 279 if (!NSBT) 280 NSBT.reset(new NSErrorDerefBug(NSErrorName)); 281 bug = NSBT.get(); 282 } 283 else { 284 if (!CFBT) 285 CFBT.reset(new CFErrorDerefBug(CFErrorName)); 286 bug = CFBT.get(); 287 } 288 BR.emitReport( 289 std::make_unique<PathSensitiveBugReport>(*bug, os.str(), event.SinkNode)); 290 } 291 292 static bool IsNSError(QualType T, IdentifierInfo *II) { 293 294 const PointerType* PPT = T->getAs<PointerType>(); 295 if (!PPT) 296 return false; 297 298 const ObjCObjectPointerType* PT = 299 PPT->getPointeeType()->getAs<ObjCObjectPointerType>(); 300 301 if (!PT) 302 return false; 303 304 const ObjCInterfaceDecl *ID = PT->getInterfaceDecl(); 305 306 // FIXME: Can ID ever be NULL? 307 if (ID) 308 return II == ID->getIdentifier(); 309 310 return false; 311 } 312 313 static bool IsCFError(QualType T, IdentifierInfo *II) { 314 const PointerType* PPT = T->getAs<PointerType>(); 315 if (!PPT) return false; 316 317 const TypedefType* TT = PPT->getPointeeType()->getAs<TypedefType>(); 318 if (!TT) return false; 319 320 return TT->getDecl()->getIdentifier() == II; 321 } 322 323 void ento::registerNSOrCFErrorDerefChecker(CheckerManager &mgr) { 324 mgr.registerChecker<NSOrCFErrorDerefChecker>(); 325 } 326 327 bool ento::shouldRegisterNSOrCFErrorDerefChecker(const CheckerManager &mgr) { 328 return true; 329 } 330 331 void ento::registerNSErrorChecker(CheckerManager &mgr) { 332 mgr.registerChecker<NSErrorMethodChecker>(); 333 NSOrCFErrorDerefChecker *checker = mgr.getChecker<NSOrCFErrorDerefChecker>(); 334 checker->ShouldCheckNSError = true; 335 checker->NSErrorName = mgr.getCurrentCheckerName(); 336 } 337 338 bool ento::shouldRegisterNSErrorChecker(const CheckerManager &mgr) { 339 return true; 340 } 341 342 void ento::registerCFErrorChecker(CheckerManager &mgr) { 343 mgr.registerChecker<CFErrorFunctionChecker>(); 344 NSOrCFErrorDerefChecker *checker = mgr.getChecker<NSOrCFErrorDerefChecker>(); 345 checker->ShouldCheckCFError = true; 346 checker->CFErrorName = mgr.getCurrentCheckerName(); 347 } 348 349 bool ento::shouldRegisterCFErrorChecker(const CheckerManager &mgr) { 350 return true; 351 } 352