1 //===--- NonNullParamChecker.cpp - Undefined arguments checker -*- C++ -*--===//
3 // The LLVM Compiler Infrastructure
5 // This file is distributed under the University of Illinois Open Source
6 // License. See LICENSE.TXT for details.
8 //===----------------------------------------------------------------------===//
10 // This defines NonNullParamChecker, which checks for arguments expected not to
12 // - the corresponding parameters being declared to have nonnull attribute
13 // - the corresponding parameters being references; since the call would form
14 // a reference to a null pointer
16 //===----------------------------------------------------------------------===//
18 #include "clang/StaticAnalyzer/Checkers/BuiltinCheckerRegistration.h"
19 #include "clang/AST/Attr.h"
20 #include "clang/StaticAnalyzer/Core/BugReporter/BugType.h"
21 #include "clang/StaticAnalyzer/Core/Checker.h"
22 #include "clang/StaticAnalyzer/Core/CheckerManager.h"
23 #include "clang/StaticAnalyzer/Core/PathSensitive/CallEvent.h"
24 #include "clang/StaticAnalyzer/Core/PathSensitive/CheckerContext.h"
26 using namespace clang;
30 class NonNullParamChecker
31 : public Checker< check::PreCall, EventDispatcher<ImplicitNullDerefEvent> > {
32 mutable std::unique_ptr<BugType> BTAttrNonNull;
33 mutable std::unique_ptr<BugType> BTNullRefArg;
37 void checkPreCall(const CallEvent &Call, CheckerContext &C) const;
39 std::unique_ptr<BugReport>
40 genReportNullAttrNonNull(const ExplodedNode *ErrorN, const Expr *ArgE) const;
41 std::unique_ptr<BugReport>
42 genReportReferenceToNullPointer(const ExplodedNode *ErrorN,
43 const Expr *ArgE) const;
45 } // end anonymous namespace
47 /// \return Bitvector marking non-null attributes.
48 static llvm::SmallBitVector getNonNullAttrs(const CallEvent &Call) {
49 const Decl *FD = Call.getDecl();
50 unsigned NumArgs = Call.getNumArgs();
51 llvm::SmallBitVector AttrNonNull(NumArgs);
52 for (const auto *NonNull : FD->specific_attrs<NonNullAttr>()) {
53 if (!NonNull->args_size()) {
54 AttrNonNull.set(0, NumArgs);
57 for (const ParamIdx &Idx : NonNull->args()) {
58 unsigned IdxAST = Idx.getASTIndex();
59 if (IdxAST >= NumArgs)
61 AttrNonNull.set(IdxAST);
67 void NonNullParamChecker::checkPreCall(const CallEvent &Call,
68 CheckerContext &C) const {
72 llvm::SmallBitVector AttrNonNull = getNonNullAttrs(Call);
73 unsigned NumArgs = Call.getNumArgs();
75 ProgramStateRef state = C.getState();
76 ArrayRef<ParmVarDecl*> parms = Call.parameters();
78 for (unsigned idx = 0; idx < NumArgs; ++idx) {
79 // For vararg functions, a corresponding parameter decl may not exist.
80 bool HasParam = idx < parms.size();
82 // Check if the parameter is a reference. We want to report when reference
83 // to a null pointer is passed as a parameter.
84 bool haveRefTypeParam =
85 HasParam ? parms[idx]->getType()->isReferenceType() : false;
86 bool haveAttrNonNull = AttrNonNull[idx];
88 // Check if the parameter is also marked 'nonnull'.
89 if (!haveAttrNonNull && HasParam)
90 haveAttrNonNull = parms[idx]->hasAttr<NonNullAttr>();
92 if (!haveAttrNonNull && !haveRefTypeParam)
95 // If the value is unknown or undefined, we can't perform this check.
96 const Expr *ArgE = Call.getArgExpr(idx);
97 SVal V = Call.getArgSVal(idx);
98 auto DV = V.getAs<DefinedSVal>();
102 assert(!haveRefTypeParam || DV->getAs<Loc>());
104 // Process the case when the argument is not a location.
105 if (haveAttrNonNull && !DV->getAs<Loc>()) {
106 // If the argument is a union type, we want to handle a potential
107 // transparent_union GCC extension.
111 QualType T = ArgE->getType();
112 const RecordType *UT = T->getAsUnionType();
113 if (!UT || !UT->getDecl()->hasAttr<TransparentUnionAttr>())
116 auto CSV = DV->getAs<nonloc::CompoundVal>();
118 // FIXME: Handle LazyCompoundVals?
123 DV = V.getAs<DefinedSVal>();
124 assert(++CSV->begin() == CSV->end());
125 // FIXME: Handle (some_union){ some_other_union_val }, which turns into
126 // a LazyCompoundVal inside a CompoundVal.
130 // Retrieve the corresponding expression.
131 if (const auto *CE = dyn_cast<CompoundLiteralExpr>(ArgE))
132 if (const auto *IE = dyn_cast<InitListExpr>(CE->getInitializer()))
133 ArgE = dyn_cast<Expr>(*(IE->begin()));
136 ConstraintManager &CM = C.getConstraintManager();
137 ProgramStateRef stateNotNull, stateNull;
138 std::tie(stateNotNull, stateNull) = CM.assumeDual(state, *DV);
140 // Generate an error node. Check for a null node in case
142 if (stateNull && !stateNotNull) {
143 if (ExplodedNode *errorNode = C.generateErrorNode(stateNull)) {
145 std::unique_ptr<BugReport> R;
147 R = genReportNullAttrNonNull(errorNode, ArgE);
148 else if (haveRefTypeParam)
149 R = genReportReferenceToNullPointer(errorNode, ArgE);
151 // Highlight the range of the argument that was null.
152 R->addRange(Call.getArgSourceRange(idx));
154 // Emit the bug report.
155 C.emitReport(std::move(R));
158 // Always return. Either we cached out or we just emitted an error.
163 if (ExplodedNode *N = C.generateSink(stateNull, C.getPredecessor())) {
164 ImplicitNullDerefEvent event = {
165 V, false, N, &C.getBugReporter(),
166 /*IsDirectDereference=*/haveRefTypeParam};
167 dispatchEvent(event);
171 // If a pointer value passed the check we should assume that it is
172 // indeed not null from this point forward.
173 state = stateNotNull;
176 // If we reach here all of the arguments passed the nonnull check.
177 // If 'state' has been updated generated a new node.
178 C.addTransition(state);
181 std::unique_ptr<BugReport>
182 NonNullParamChecker::genReportNullAttrNonNull(const ExplodedNode *ErrorNode,
183 const Expr *ArgE) const {
184 // Lazily allocate the BugType object if it hasn't already been
185 // created. Ownership is transferred to the BugReporter object once
186 // the BugReport is passed to 'EmitWarning'.
188 BTAttrNonNull.reset(new BugType(
189 this, "Argument with 'nonnull' attribute passed null", "API"));
191 auto R = llvm::make_unique<BugReport>(
193 "Null pointer passed as an argument to a 'nonnull' parameter", ErrorNode);
195 bugreporter::trackExpressionValue(ErrorNode, ArgE, *R);
200 std::unique_ptr<BugReport> NonNullParamChecker::genReportReferenceToNullPointer(
201 const ExplodedNode *ErrorNode, const Expr *ArgE) const {
203 BTNullRefArg.reset(new BuiltinBug(this, "Dereference of null pointer"));
205 auto R = llvm::make_unique<BugReport>(
206 *BTNullRefArg, "Forming reference to null pointer", ErrorNode);
208 const Expr *ArgEDeref = bugreporter::getDerefExpr(ArgE);
211 bugreporter::trackExpressionValue(ErrorNode, ArgEDeref, *R);
217 void ento::registerNonNullParamChecker(CheckerManager &mgr) {
218 mgr.registerChecker<NonNullParamChecker>();