1 //== ObjCContainersASTChecker.cpp - CoreFoundation containers API *- C++ -*-==//
3 // The LLVM Compiler Infrastructure
5 // This file is distributed under the University of Illinois Open Source
6 // License. See LICENSE.TXT for details.
8 //===----------------------------------------------------------------------===//
10 // An AST checker that looks for common pitfalls when using 'CFArray',
11 // 'CFDictionary', 'CFSet' APIs.
13 //===----------------------------------------------------------------------===//
14 #include "ClangSACheckers.h"
15 #include "clang/AST/StmtVisitor.h"
16 #include "clang/Analysis/AnalysisContext.h"
17 #include "clang/Basic/TargetInfo.h"
18 #include "clang/StaticAnalyzer/Core/BugReporter/BugReporter.h"
19 #include "clang/StaticAnalyzer/Core/Checker.h"
20 #include "clang/StaticAnalyzer/Core/PathSensitive/AnalysisManager.h"
21 #include "llvm/ADT/SmallString.h"
22 #include "llvm/Support/raw_ostream.h"
24 using namespace clang;
28 class WalkAST : public StmtVisitor<WalkAST> {
30 const CheckerBase *Checker;
31 AnalysisDeclContext* AC;
35 /// Check if the type has pointer size (very conservative).
36 inline bool isPointerSize(const Type *T) {
39 if (T->isIncompleteType())
41 return (ASTC.getTypeSize(T) == PtrWidth);
44 /// Check if the type is a pointer/array to pointer sized values.
45 inline bool hasPointerToPointerSizedType(const Expr *E) {
46 QualType T = E->getType();
48 // The type could be either a pointer or array.
49 const Type *TP = T.getTypePtr();
50 QualType PointeeT = TP->getPointeeType();
51 if (!PointeeT.isNull()) {
52 // If the type is a pointer to an array, check the size of the array
53 // elements. To avoid false positives coming from assumption that the
54 // values x and &x are equal when x is an array.
55 if (const Type *TElem = PointeeT->getArrayElementTypeNoTypeQual())
56 if (isPointerSize(TElem))
59 // Else, check the pointee size.
60 return isPointerSize(PointeeT.getTypePtr());
63 if (const Type *TElem = TP->getArrayElementTypeNoTypeQual())
64 return isPointerSize(TElem);
66 // The type must be an array/pointer type.
68 // This could be a null constant, which is allowed.
69 return static_cast<bool>(
70 E->isNullPointerConstant(ASTC, Expr::NPC_ValueDependentIsNull));
74 WalkAST(BugReporter &br, const CheckerBase *checker, AnalysisDeclContext *ac)
75 : BR(br), Checker(checker), AC(ac), ASTC(AC->getASTContext()),
76 PtrWidth(ASTC.getTargetInfo().getPointerWidth(0)) {}
78 // Statement visitor methods.
79 void VisitChildren(Stmt *S);
80 void VisitStmt(Stmt *S) { VisitChildren(S); }
81 void VisitCallExpr(CallExpr *CE);
83 } // end anonymous namespace
85 static StringRef getCalleeName(CallExpr *CE) {
86 const FunctionDecl *FD = CE->getDirectCallee();
90 IdentifierInfo *II = FD->getIdentifier();
91 if (!II) // if no identifier, not a simple C function
97 void WalkAST::VisitCallExpr(CallExpr *CE) {
98 StringRef Name = getCalleeName(CE);
102 const Expr *Arg = nullptr;
105 if (Name.equals("CFArrayCreate") || Name.equals("CFSetCreate")) {
106 if (CE->getNumArgs() != 4)
109 Arg = CE->getArg(ArgNum)->IgnoreParenCasts();
110 if (hasPointerToPointerSizedType(Arg))
112 } else if (Name.equals("CFDictionaryCreate")) {
113 if (CE->getNumArgs() != 6)
115 // Check first argument.
117 Arg = CE->getArg(ArgNum)->IgnoreParenCasts();
118 if (hasPointerToPointerSizedType(Arg)) {
119 // Check second argument.
121 Arg = CE->getArg(ArgNum)->IgnoreParenCasts();
122 if (hasPointerToPointerSizedType(Arg))
123 // Both are good, return.
129 assert(ArgNum == 1 || ArgNum == 2);
131 SmallString<64> BufName;
132 llvm::raw_svector_ostream OsName(BufName);
133 OsName << " Invalid use of '" << Name << "'" ;
135 SmallString<256> Buf;
136 llvm::raw_svector_ostream Os(Buf);
137 // Use "second" and "third" since users will expect 1-based indexing
138 // for parameter names when mentioned in prose.
139 Os << " The "<< ((ArgNum == 1) ? "second" : "third") << " argument to '"
140 << Name << "' must be a C array of pointer-sized values, not '"
141 << Arg->getType().getAsString() << "'";
143 PathDiagnosticLocation CELoc =
144 PathDiagnosticLocation::createBegin(CE, BR.getSourceManager(), AC);
145 BR.EmitBasicReport(AC->getDecl(), Checker, OsName.str(),
146 categories::CoreFoundationObjectiveC, Os.str(), CELoc,
147 Arg->getSourceRange());
150 // Recurse and check children.
154 void WalkAST::VisitChildren(Stmt *S) {
155 for (Stmt *Child : S->children())
161 class ObjCContainersASTChecker : public Checker<check::ASTCodeBody> {
164 void checkASTCodeBody(const Decl *D, AnalysisManager& Mgr,
165 BugReporter &BR) const {
166 WalkAST walker(BR, this, Mgr.getAnalysisDeclContext(D));
167 walker.Visit(D->getBody());
172 void ento::registerObjCContainersASTChecker(CheckerManager &mgr) {
173 mgr.registerChecker<ObjCContainersASTChecker>();