1 //===- OSObjectCStyleCast.cpp ------------------------------------*- C++ -*-==// 2 // 3 // Part of the LLVM Project, under the Apache License v2.0 with LLVM Exceptions. 4 // See https://llvm.org/LICENSE.txt for license information. 5 // SPDX-License-Identifier: Apache-2.0 WITH LLVM-exception 6 // 7 //===----------------------------------------------------------------------===// 8 // 9 // This file defines OSObjectCStyleCast checker, which checks for C-style casts 10 // of OSObjects. Such casts almost always indicate a code smell, 11 // as an explicit static or dynamic cast should be used instead. 12 //===----------------------------------------------------------------------===// 13 14 #include "clang/StaticAnalyzer/Checkers/BuiltinCheckerRegistration.h" 15 #include "clang/ASTMatchers/ASTMatchFinder.h" 16 #include "clang/StaticAnalyzer/Core/BugReporter/BugReporter.h" 17 #include "clang/StaticAnalyzer/Core/BugReporter/BugType.h" 18 #include "clang/StaticAnalyzer/Core/Checker.h" 19 #include "clang/StaticAnalyzer/Core/PathSensitive/AnalysisManager.h" 20 #include "llvm/Support/Debug.h" 21 22 using namespace clang; 23 using namespace ento; 24 using namespace ast_matchers; 25 26 namespace { 27 static constexpr const char *const WarnAtNode = "WarnAtNode"; 28 static constexpr const char *const WarnRecordDecl = "WarnRecordDecl"; 29 30 class OSObjectCStyleCastChecker : public Checker<check::ASTCodeBody> { 31 public: 32 void checkASTCodeBody(const Decl *D, AnalysisManager &AM, 33 BugReporter &BR) const; 34 }; 35 } 36 37 static void emitDiagnostics(const BoundNodes &Nodes, 38 BugReporter &BR, 39 AnalysisDeclContext *ADC, 40 const OSObjectCStyleCastChecker *Checker) { 41 const auto *CE = Nodes.getNodeAs<CastExpr>(WarnAtNode); 42 const CXXRecordDecl *RD = Nodes.getNodeAs<CXXRecordDecl>(WarnRecordDecl); 43 assert(CE && RD); 44 45 std::string Diagnostics; 46 llvm::raw_string_ostream OS(Diagnostics); 47 OS << "C-style cast of an OSObject is prone to type confusion attacks; " 48 << "use 'OSRequiredCast' if the object is definitely of type '" 49 << RD->getNameAsString() << "', or 'OSDynamicCast' followed by " 50 << "a null check if unsure", 51 52 BR.EmitBasicReport( 53 ADC->getDecl(), 54 Checker, 55 /*Name=*/"OSObject C-Style Cast", 56 categories::SecurityError, 57 OS.str(), 58 PathDiagnosticLocation::createBegin(CE, BR.getSourceManager(), ADC), 59 CE->getSourceRange()); 60 } 61 62 static decltype(auto) hasTypePointingTo(DeclarationMatcher DeclM) { 63 return hasType(pointerType(pointee(hasDeclaration(DeclM)))); 64 } 65 66 void OSObjectCStyleCastChecker::checkASTCodeBody(const Decl *D, AnalysisManager &AM, 67 BugReporter &BR) const { 68 69 AnalysisDeclContext *ADC = AM.getAnalysisDeclContext(D); 70 71 auto DynamicCastM = callExpr(callee(functionDecl(hasName("safeMetaCast")))); 72 73 auto OSObjTypeM = hasTypePointingTo(cxxRecordDecl(isDerivedFrom("OSMetaClassBase"))); 74 auto OSObjSubclassM = hasTypePointingTo( 75 cxxRecordDecl(isDerivedFrom("OSObject")).bind(WarnRecordDecl)); 76 77 auto CastM = cStyleCastExpr( 78 allOf(hasSourceExpression(allOf(OSObjTypeM, unless(DynamicCastM))), 79 OSObjSubclassM)).bind(WarnAtNode); 80 81 auto Matches = match(stmt(forEachDescendant(CastM)), *D->getBody(), AM.getASTContext()); 82 for (BoundNodes Match : Matches) 83 emitDiagnostics(Match, BR, ADC, this); 84 } 85 86 void ento::registerOSObjectCStyleCast(CheckerManager &Mgr) { 87 Mgr.registerChecker<OSObjectCStyleCastChecker>(); 88 } 89 90 bool ento::shouldRegisterOSObjectCStyleCast(const CheckerManager &mgr) { 91 return true; 92 } 93