xref: /freebsd/contrib/llvm-project/clang/lib/StaticAnalyzer/Checkers/NSErrorChecker.cpp (revision ec0ea6efa1ad229d75c394c1a9b9cac33af2b1d3) 
1 //=- NSErrorChecker.cpp - Coding conventions for uses of NSError -*- C++ -*-==//
2 //
3 // Part of the LLVM Project, under the Apache License v2.0 with LLVM Exceptions.
4 // See https://llvm.org/LICENSE.txt for license information.
5 // SPDX-License-Identifier: Apache-2.0 WITH LLVM-exception
6 //
7 //===----------------------------------------------------------------------===//
8 //
9 //  This file defines a CheckNSError, a flow-insenstive check
10 //  that determines if an Objective-C class interface correctly returns
11 //  a non-void return type.
12 //
13 //  File under feature request PR 2600.
14 //
15 //===----------------------------------------------------------------------===//
16 
17 #include "clang/StaticAnalyzer/Checkers/BuiltinCheckerRegistration.h"
18 #include "clang/AST/Decl.h"
19 #include "clang/AST/DeclObjC.h"
20 #include "clang/StaticAnalyzer/Core/BugReporter/BugType.h"
21 #include "clang/StaticAnalyzer/Core/Checker.h"
22 #include "clang/StaticAnalyzer/Core/CheckerManager.h"
23 #include "clang/StaticAnalyzer/Core/PathSensitive/CheckerContext.h"
24 #include "clang/StaticAnalyzer/Core/PathSensitive/ProgramStateTrait.h"
25 #include "llvm/ADT/SmallString.h"
26 #include "llvm/Support/raw_ostream.h"
27 
28 using namespace clang;
29 using namespace ento;
30 
31 static bool IsNSError(QualType T, IdentifierInfo *II);
32 static bool IsCFError(QualType T, IdentifierInfo *II);
33 
34 //===----------------------------------------------------------------------===//
35 // NSErrorMethodChecker
36 //===----------------------------------------------------------------------===//
37 
38 namespace {
39 class NSErrorMethodChecker
40     : public Checker< check::ASTDecl<ObjCMethodDecl> > {
41   mutable IdentifierInfo *II;
42 
43 public:
44   NSErrorMethodChecker() : II(nullptr) {}
45 
46   void checkASTDecl(const ObjCMethodDecl *D,
47                     AnalysisManager &mgr, BugReporter &BR) const;
48 };
49 }
50 
51 void NSErrorMethodChecker::checkASTDecl(const ObjCMethodDecl *D,
52                                         AnalysisManager &mgr,
53                                         BugReporter &BR) const {
54   if (!D->isThisDeclarationADefinition())
55     return;
56   if (!D->getReturnType()->isVoidType())
57     return;
58 
59   if (!II)
60     II = &D->getASTContext().Idents.get("NSError");
61 
62   bool hasNSError = false;
63   for (const auto *I : D->parameters())  {
64     if (IsNSError(I->getType(), II)) {
65       hasNSError = true;
66       break;
67     }
68   }
69 
70   if (hasNSError) {
71     const char *err = "Method accepting NSError** "
72         "should have a non-void return value to indicate whether or not an "
73         "error occurred";
74     PathDiagnosticLocation L =
75       PathDiagnosticLocation::create(D, BR.getSourceManager());
76     BR.EmitBasicReport(D, this, "Bad return type when passing NSError**",
77                        "Coding conventions (Apple)", err, L);
78   }
79 }
80 
81 //===----------------------------------------------------------------------===//
82 // CFErrorFunctionChecker
83 //===----------------------------------------------------------------------===//
84 
85 namespace {
86 class CFErrorFunctionChecker
87     : public Checker< check::ASTDecl<FunctionDecl> > {
88   mutable IdentifierInfo *II;
89 
90 public:
91   CFErrorFunctionChecker() : II(nullptr) {}
92 
93   void checkASTDecl(const FunctionDecl *D,
94                     AnalysisManager &mgr, BugReporter &BR) const;
95 };
96 }
97 
98 static bool hasReservedReturnType(const FunctionDecl *D) {
99   if (isa<CXXConstructorDecl>(D))
100     return true;
101 
102   // operators delete and delete[] are required to have 'void' return type
103   auto OperatorKind = D->getOverloadedOperator();
104   return OperatorKind == OO_Delete || OperatorKind == OO_Array_Delete;
105 }
106 
107 void CFErrorFunctionChecker::checkASTDecl(const FunctionDecl *D,
108                                         AnalysisManager &mgr,
109                                         BugReporter &BR) const {
110   if (!D->doesThisDeclarationHaveABody())
111     return;
112   if (!D->getReturnType()->isVoidType())
113     return;
114   if (hasReservedReturnType(D))
115     return;
116 
117   if (!II)
118     II = &D->getASTContext().Idents.get("CFErrorRef");
119 
120   bool hasCFError = false;
121   for (auto I : D->parameters())  {
122     if (IsCFError(I->getType(), II)) {
123       hasCFError = true;
124       break;
125     }
126   }
127 
128   if (hasCFError) {
129     const char *err = "Function accepting CFErrorRef* "
130         "should have a non-void return value to indicate whether or not an "
131         "error occurred";
132     PathDiagnosticLocation L =
133       PathDiagnosticLocation::create(D, BR.getSourceManager());
134     BR.EmitBasicReport(D, this, "Bad return type when passing CFErrorRef*",
135                        "Coding conventions (Apple)", err, L);
136   }
137 }
138 
139 //===----------------------------------------------------------------------===//
140 // NSOrCFErrorDerefChecker
141 //===----------------------------------------------------------------------===//
142 
143 namespace {
144 
145 class NSErrorDerefBug : public BugType {
146 public:
147   NSErrorDerefBug(const CheckerNameRef Checker)
148       : BugType(Checker, "NSError** null dereference",
149                 "Coding conventions (Apple)") {}
150 };
151 
152 class CFErrorDerefBug : public BugType {
153 public:
154   CFErrorDerefBug(const CheckerNameRef Checker)
155       : BugType(Checker, "CFErrorRef* null dereference",
156                 "Coding conventions (Apple)") {}
157 };
158 
159 }
160 
161 namespace {
162 class NSOrCFErrorDerefChecker
163     : public Checker< check::Location,
164                         check::Event<ImplicitNullDerefEvent> > {
165   mutable IdentifierInfo *NSErrorII, *CFErrorII;
166   mutable std::unique_ptr<NSErrorDerefBug> NSBT;
167   mutable std::unique_ptr<CFErrorDerefBug> CFBT;
168 public:
169   DefaultBool ShouldCheckNSError, ShouldCheckCFError;
170   CheckerNameRef NSErrorName, CFErrorName;
171   NSOrCFErrorDerefChecker() : NSErrorII(nullptr), CFErrorII(nullptr) {}
172 
173   void checkLocation(SVal loc, bool isLoad, const Stmt *S,
174                      CheckerContext &C) const;
175   void checkEvent(ImplicitNullDerefEvent event) const;
176 };
177 }
178 
179 typedef llvm::ImmutableMap<SymbolRef, unsigned> ErrorOutFlag;
180 REGISTER_TRAIT_WITH_PROGRAMSTATE(NSErrorOut, ErrorOutFlag)
181 REGISTER_TRAIT_WITH_PROGRAMSTATE(CFErrorOut, ErrorOutFlag)
182 
183 template <typename T>
184 static bool hasFlag(SVal val, ProgramStateRef state) {
185   if (SymbolRef sym = val.getAsSymbol())
186     if (const unsigned *attachedFlags = state->get<T>(sym))
187       return *attachedFlags;
188   return false;
189 }
190 
191 template <typename T>
192 static void setFlag(ProgramStateRef state, SVal val, CheckerContext &C) {
193   // We tag the symbol that the SVal wraps.
194   if (SymbolRef sym = val.getAsSymbol())
195     C.addTransition(state->set<T>(sym, true));
196 }
197 
198 static QualType parameterTypeFromSVal(SVal val, CheckerContext &C) {
199   const StackFrameContext * SFC = C.getStackFrame();
200   if (Optional<loc::MemRegionVal> X = val.getAs<loc::MemRegionVal>()) {
201     const MemRegion* R = X->getRegion();
202     if (const VarRegion *VR = R->getAs<VarRegion>())
203       if (const StackArgumentsSpaceRegion *
204           stackReg = dyn_cast<StackArgumentsSpaceRegion>(VR->getMemorySpace()))
205         if (stackReg->getStackFrame() == SFC)
206           return VR->getValueType();
207   }
208 
209   return QualType();
210 }
211 
212 void NSOrCFErrorDerefChecker::checkLocation(SVal loc, bool isLoad,
213                                             const Stmt *S,
214                                             CheckerContext &C) const {
215   if (!isLoad)
216     return;
217   if (loc.isUndef() || !loc.getAs<Loc>())
218     return;
219 
220   ASTContext &Ctx = C.getASTContext();
221   ProgramStateRef state = C.getState();
222 
223   // If we are loading from NSError**/CFErrorRef* parameter, mark the resulting
224   // SVal so that we can later check it when handling the
225   // ImplicitNullDerefEvent event.
226   // FIXME: Cumbersome! Maybe add hook at construction of SVals at start of
227   // function ?
228 
229   QualType parmT = parameterTypeFromSVal(loc, C);
230   if (parmT.isNull())
231     return;
232 
233   if (!NSErrorII)
234     NSErrorII = &Ctx.Idents.get("NSError");
235   if (!CFErrorII)
236     CFErrorII = &Ctx.Idents.get("CFErrorRef");
237 
238   if (ShouldCheckNSError && IsNSError(parmT, NSErrorII)) {
239     setFlag<NSErrorOut>(state, state->getSVal(loc.castAs<Loc>()), C);
240     return;
241   }
242 
243   if (ShouldCheckCFError && IsCFError(parmT, CFErrorII)) {
244     setFlag<CFErrorOut>(state, state->getSVal(loc.castAs<Loc>()), C);
245     return;
246   }
247 }
248 
249 void NSOrCFErrorDerefChecker::checkEvent(ImplicitNullDerefEvent event) const {
250   if (event.IsLoad)
251     return;
252 
253   SVal loc = event.Location;
254   ProgramStateRef state = event.SinkNode->getState();
255   BugReporter &BR = *event.BR;
256 
257   bool isNSError = hasFlag<NSErrorOut>(loc, state);
258   bool isCFError = false;
259   if (!isNSError)
260     isCFError = hasFlag<CFErrorOut>(loc, state);
261 
262   if (!(isNSError || isCFError))
263     return;
264 
265   // Storing to possible null NSError/CFErrorRef out parameter.
266   SmallString<128> Buf;
267   llvm::raw_svector_ostream os(Buf);
268 
269   os << "Potential null dereference.  According to coding standards ";
270   os << (isNSError
271          ? "in 'Creating and Returning NSError Objects' the parameter"
272          : "documented in CoreFoundation/CFError.h the parameter");
273 
274   os  << " may be null";
275 
276   BugType *bug = nullptr;
277   if (isNSError) {
278     if (!NSBT)
279       NSBT.reset(new NSErrorDerefBug(NSErrorName));
280     bug = NSBT.get();
281   }
282   else {
283     if (!CFBT)
284       CFBT.reset(new CFErrorDerefBug(CFErrorName));
285     bug = CFBT.get();
286   }
287   BR.emitReport(
288       std::make_unique<PathSensitiveBugReport>(*bug, os.str(), event.SinkNode));
289 }
290 
291 static bool IsNSError(QualType T, IdentifierInfo *II) {
292 
293   const PointerType* PPT = T->getAs<PointerType>();
294   if (!PPT)
295     return false;
296 
297   const ObjCObjectPointerType* PT =
298     PPT->getPointeeType()->getAs<ObjCObjectPointerType>();
299 
300   if (!PT)
301     return false;
302 
303   const ObjCInterfaceDecl *ID = PT->getInterfaceDecl();
304 
305   // FIXME: Can ID ever be NULL?
306   if (ID)
307     return II == ID->getIdentifier();
308 
309   return false;
310 }
311 
312 static bool IsCFError(QualType T, IdentifierInfo *II) {
313   const PointerType* PPT = T->getAs<PointerType>();
314   if (!PPT) return false;
315 
316   const TypedefType* TT = PPT->getPointeeType()->getAs<TypedefType>();
317   if (!TT) return false;
318 
319   return TT->getDecl()->getIdentifier() == II;
320 }
321 
322 void ento::registerNSOrCFErrorDerefChecker(CheckerManager &mgr) {
323   mgr.registerChecker<NSOrCFErrorDerefChecker>();
324 }
325 
326 bool ento::shouldRegisterNSOrCFErrorDerefChecker(const CheckerManager &mgr) {
327   return true;
328 }
329 
330 void ento::registerNSErrorChecker(CheckerManager &mgr) {
331   mgr.registerChecker<NSErrorMethodChecker>();
332   NSOrCFErrorDerefChecker *checker = mgr.getChecker<NSOrCFErrorDerefChecker>();
333   checker->ShouldCheckNSError = true;
334   checker->NSErrorName = mgr.getCurrentCheckerName();
335 }
336 
337 bool ento::shouldRegisterNSErrorChecker(const CheckerManager &mgr) {
338   return true;
339 }
340 
341 void ento::registerCFErrorChecker(CheckerManager &mgr) {
342   mgr.registerChecker<CFErrorFunctionChecker>();
343   NSOrCFErrorDerefChecker *checker = mgr.getChecker<NSOrCFErrorDerefChecker>();
344   checker->ShouldCheckCFError = true;
345   checker->CFErrorName = mgr.getCurrentCheckerName();
346 }
347 
348 bool ento::shouldRegisterCFErrorChecker(const CheckerManager &mgr) {
349   return true;
350 }
351