1 //== BasicObjCFoundationChecks.cpp - Simple Apple-Foundation checks -*- C++ -*--
3 // The LLVM Compiler Infrastructure
5 // This file is distributed under the University of Illinois Open Source
6 // License. See LICENSE.TXT for details.
8 //===----------------------------------------------------------------------===//
10 // This file defines BasicObjCFoundationChecks, a class that encapsulates
11 // a set of simple checks to run on Objective-C code using Apple's Foundation
14 //===----------------------------------------------------------------------===//
16 #include "BasicObjCFoundationChecks.h"
18 #include "clang/Checker/PathSensitive/ExplodedGraph.h"
19 #include "clang/Checker/PathSensitive/GRSimpleAPICheck.h"
20 #include "clang/Checker/PathSensitive/GRExprEngine.h"
21 #include "clang/Checker/PathSensitive/GRState.h"
22 #include "clang/Checker/BugReporter/BugReporter.h"
23 #include "clang/Checker/PathSensitive/MemRegion.h"
24 #include "clang/Checker/BugReporter/PathDiagnostic.h"
25 #include "clang/Checker/PathSensitive/CheckerVisitor.h"
26 #include "clang/Checker/Checkers/LocalCheckers.h"
27 #include "clang/AST/DeclObjC.h"
28 #include "clang/AST/Expr.h"
29 #include "clang/AST/ExprObjC.h"
30 #include "clang/AST/ASTContext.h"
32 using namespace clang;
34 static const ObjCInterfaceType* GetReceiverType(const ObjCMessageExpr* ME) {
35 const Expr* Receiver = ME->getReceiver();
40 if (const ObjCObjectPointerType *PT =
41 Receiver->getType()->getAs<ObjCObjectPointerType>())
42 return PT->getInterfaceType();
47 static const char* GetReceiverNameType(const ObjCMessageExpr* ME) {
48 if (const ObjCInterfaceType *ReceiverType = GetReceiverType(ME))
49 return ReceiverType->getDecl()->getIdentifier()->getNameStart();
55 class APIMisuse : public BugType {
57 APIMisuse(const char* name) : BugType(name, "API Misuse (Apple)") {}
60 class BasicObjCFoundationChecks : public GRSimpleAPICheck {
65 bool isNSString(const ObjCInterfaceType *T, llvm::StringRef suffix);
66 bool AuditNSString(ExplodedNode* N, const ObjCMessageExpr* ME);
68 void Warn(ExplodedNode* N, const Expr* E, const std::string& s);
69 void WarnNilArg(ExplodedNode* N, const Expr* E);
71 bool CheckNilArg(ExplodedNode* N, unsigned Arg);
74 BasicObjCFoundationChecks(ASTContext& ctx, BugReporter& br)
75 : BT(0), BR(br), Ctx(ctx) {}
77 bool Audit(ExplodedNode* N, GRStateManager&);
80 void WarnNilArg(ExplodedNode* N, const ObjCMessageExpr* ME, unsigned Arg) {
82 llvm::raw_string_ostream os(sbuf);
83 os << "Argument to '" << GetReceiverNameType(ME) << "' method '"
84 << ME->getSelector().getAsString() << "' cannot be nil.";
86 // Lazily create the BugType object for NilArg. This will be owned
87 // by the BugReporter object 'BR' once we call BR.EmitWarning.
88 if (!BT) BT = new APIMisuse("nil argument");
90 RangedBugReport *R = new RangedBugReport(*BT, os.str(), N);
91 R->addRange(ME->getArg(Arg)->getSourceRange());
96 } // end anonymous namespace
100 clang::CreateBasicObjCFoundationChecks(ASTContext& Ctx, BugReporter& BR) {
101 return new BasicObjCFoundationChecks(Ctx, BR);
106 bool BasicObjCFoundationChecks::Audit(ExplodedNode* N,
109 const ObjCMessageExpr* ME =
110 cast<ObjCMessageExpr>(cast<PostStmt>(N->getLocation()).getStmt());
112 const ObjCInterfaceType *ReceiverType = GetReceiverType(ME);
117 if (isNSString(ReceiverType,
118 ReceiverType->getDecl()->getIdentifier()->getName()))
119 return AuditNSString(N, ME);
124 static inline bool isNil(SVal X) {
125 return isa<loc::ConcreteInt>(X);
128 //===----------------------------------------------------------------------===//
130 //===----------------------------------------------------------------------===//
132 bool BasicObjCFoundationChecks::CheckNilArg(ExplodedNode* N, unsigned Arg) {
133 const ObjCMessageExpr* ME =
134 cast<ObjCMessageExpr>(cast<PostStmt>(N->getLocation()).getStmt());
136 const Expr * E = ME->getArg(Arg);
138 if (isNil(N->getState()->getSVal(E))) {
139 WarnNilArg(N, ME, Arg);
146 //===----------------------------------------------------------------------===//
147 // NSString checking.
148 //===----------------------------------------------------------------------===//
150 bool BasicObjCFoundationChecks::isNSString(const ObjCInterfaceType *T,
151 llvm::StringRef ClassName) {
152 return ClassName == "NSString" || ClassName == "NSMutableString";
155 bool BasicObjCFoundationChecks::AuditNSString(ExplodedNode* N,
156 const ObjCMessageExpr* ME) {
158 Selector S = ME->getSelector();
160 if (S.isUnarySelector())
163 // FIXME: This is going to be really slow doing these checks with
164 // lexical comparisons.
166 std::string NameStr = S.getAsString();
167 llvm::StringRef Name(NameStr);
168 assert(!Name.empty());
170 // FIXME: Checking for initWithFormat: will not work in most cases
171 // yet because [NSString alloc] returns id, not NSString*. We will
172 // need support for tracking expected-type information in the analyzer
173 // to find these errors.
174 if (Name == "caseInsensitiveCompare:" ||
175 Name == "compare:" ||
176 Name == "compare:options:" ||
177 Name == "compare:options:range:" ||
178 Name == "compare:options:range:locale:" ||
179 Name == "componentsSeparatedByCharactersInSet:" ||
180 Name == "initWithFormat:")
181 return CheckNilArg(N, 0);
186 //===----------------------------------------------------------------------===//
188 //===----------------------------------------------------------------------===//
192 class AuditCFNumberCreate : public GRSimpleAPICheck {
195 // FIXME: Either this should be refactored into GRSimpleAPICheck, or
196 // it should always be passed with a call to Audit. The latter
197 // approach makes this class more stateless.
203 AuditCFNumberCreate(ASTContext& ctx, BugReporter& br)
204 : BT(0), Ctx(ctx), II(&Ctx.Idents.get("CFNumberCreate")), BR(br){}
206 ~AuditCFNumberCreate() {}
208 bool Audit(ExplodedNode* N, GRStateManager&);
211 void AddError(const TypedRegion* R, const Expr* Ex, ExplodedNode *N,
212 uint64_t SourceSize, uint64_t TargetSize, uint64_t NumberKind);
214 } // end anonymous namespace
217 kCFNumberSInt8Type = 1,
218 kCFNumberSInt16Type = 2,
219 kCFNumberSInt32Type = 3,
220 kCFNumberSInt64Type = 4,
221 kCFNumberFloat32Type = 5,
222 kCFNumberFloat64Type = 6,
223 kCFNumberCharType = 7,
224 kCFNumberShortType = 8,
225 kCFNumberIntType = 9,
226 kCFNumberLongType = 10,
227 kCFNumberLongLongType = 11,
228 kCFNumberFloatType = 12,
229 kCFNumberDoubleType = 13,
230 kCFNumberCFIndexType = 14,
231 kCFNumberNSIntegerType = 15,
232 kCFNumberCGFloatType = 16
241 Optional() : IsKnown(false), Val(0) {}
242 Optional(const T& val) : IsKnown(true), Val(val) {}
244 bool isKnown() const { return IsKnown; }
246 const T& getValue() const {
251 operator const T&() const {
257 static Optional<uint64_t> GetCFNumberSize(ASTContext& Ctx, uint64_t i) {
258 static const unsigned char FixedSize[] = { 8, 16, 32, 64, 32, 64 };
260 if (i < kCFNumberCharType)
261 return FixedSize[i-1];
266 case kCFNumberCharType: T = Ctx.CharTy; break;
267 case kCFNumberShortType: T = Ctx.ShortTy; break;
268 case kCFNumberIntType: T = Ctx.IntTy; break;
269 case kCFNumberLongType: T = Ctx.LongTy; break;
270 case kCFNumberLongLongType: T = Ctx.LongLongTy; break;
271 case kCFNumberFloatType: T = Ctx.FloatTy; break;
272 case kCFNumberDoubleType: T = Ctx.DoubleTy; break;
273 case kCFNumberCFIndexType:
274 case kCFNumberNSIntegerType:
275 case kCFNumberCGFloatType:
276 // FIXME: We need a way to map from names to Type*.
278 return Optional<uint64_t>();
281 return Ctx.getTypeSize(T);
285 static const char* GetCFNumberTypeStr(uint64_t i) {
286 static const char* Names[] = {
287 "kCFNumberSInt8Type",
288 "kCFNumberSInt16Type",
289 "kCFNumberSInt32Type",
290 "kCFNumberSInt64Type",
291 "kCFNumberFloat32Type",
292 "kCFNumberFloat64Type",
294 "kCFNumberShortType",
297 "kCFNumberLongLongType",
298 "kCFNumberFloatType",
299 "kCFNumberDoubleType",
300 "kCFNumberCFIndexType",
301 "kCFNumberNSIntegerType",
302 "kCFNumberCGFloatType"
305 return i <= kCFNumberCGFloatType ? Names[i-1] : "Invalid CFNumberType";
309 bool AuditCFNumberCreate::Audit(ExplodedNode* N,GRStateManager&){
311 cast<CallExpr>(cast<PostStmt>(N->getLocation()).getStmt());
312 const Expr* Callee = CE->getCallee();
313 SVal CallV = N->getState()->getSVal(Callee);
314 const FunctionDecl* FD = CallV.getAsFunctionDecl();
316 if (!FD || FD->getIdentifier() != II || CE->getNumArgs()!=3)
319 // Get the value of the "theType" argument.
320 SVal TheTypeVal = N->getState()->getSVal(CE->getArg(1));
322 // FIXME: We really should allow ranges of valid theType values, and
323 // bifurcate the state appropriately.
324 nonloc::ConcreteInt* V = dyn_cast<nonloc::ConcreteInt>(&TheTypeVal);
329 uint64_t NumberKind = V->getValue().getLimitedValue();
330 Optional<uint64_t> TargetSize = GetCFNumberSize(Ctx, NumberKind);
332 // FIXME: In some cases we can emit an error.
333 if (!TargetSize.isKnown())
336 // Look at the value of the integer being passed by reference. Essentially
337 // we want to catch cases where the value passed in is not equal to the
338 // size of the type being created.
339 SVal TheValueExpr = N->getState()->getSVal(CE->getArg(2));
341 // FIXME: Eventually we should handle arbitrary locations. We can do this
342 // by having an enhanced memory model that does low-level typing.
343 loc::MemRegionVal* LV = dyn_cast<loc::MemRegionVal>(&TheValueExpr);
348 const TypedRegion* R = dyn_cast<TypedRegion>(LV->StripCasts());
353 QualType T = Ctx.getCanonicalType(R->getValueType(Ctx));
355 // FIXME: If the pointee isn't an integer type, should we flag a warning?
356 // People can do weird stuff with pointers.
358 if (!T->isIntegerType())
361 uint64_t SourceSize = Ctx.getTypeSize(T);
363 // CHECK: is SourceSize == TargetSize
365 if (SourceSize == TargetSize)
368 AddError(R, CE->getArg(2), N, SourceSize, TargetSize, NumberKind);
370 // FIXME: We can actually create an abstract "CFNumber" object that has
371 // the bits initialized to the provided values.
372 return SourceSize < TargetSize;
375 void AuditCFNumberCreate::AddError(const TypedRegion* R, const Expr* Ex,
377 uint64_t SourceSize, uint64_t TargetSize,
378 uint64_t NumberKind) {
381 llvm::raw_string_ostream os(sbuf);
383 os << (SourceSize == 8 ? "An " : "A ")
384 << SourceSize << " bit integer is used to initialize a CFNumber "
385 "object that represents "
386 << (TargetSize == 8 ? "an " : "a ")
387 << TargetSize << " bit integer. ";
389 if (SourceSize < TargetSize)
390 os << (TargetSize - SourceSize)
391 << " bits of the CFNumber value will be garbage." ;
393 os << (SourceSize - TargetSize)
394 << " bits of the input integer will be lost.";
396 // Lazily create the BugType object. This will be owned
397 // by the BugReporter object 'BR' once we call BR.EmitWarning.
398 if (!BT) BT = new APIMisuse("Bad use of CFNumberCreate");
399 RangedBugReport *report = new RangedBugReport(*BT, os.str(), N);
400 report->addRange(Ex->getSourceRange());
401 BR.EmitReport(report);
405 clang::CreateAuditCFNumberCreate(ASTContext& Ctx, BugReporter& BR) {
406 return new AuditCFNumberCreate(Ctx, BR);
409 //===----------------------------------------------------------------------===//
410 // CFRetain/CFRelease auditing for null arguments.
411 //===----------------------------------------------------------------------===//
414 class AuditCFRetainRelease : public GRSimpleAPICheck {
417 // FIXME: Either this should be refactored into GRSimpleAPICheck, or
418 // it should always be passed with a call to Audit. The latter
419 // approach makes this class more stateless.
421 IdentifierInfo *Retain, *Release;
425 AuditCFRetainRelease(ASTContext& ctx, BugReporter& br)
427 Retain(&Ctx.Idents.get("CFRetain")), Release(&Ctx.Idents.get("CFRelease")),
430 ~AuditCFRetainRelease() {}
432 bool Audit(ExplodedNode* N, GRStateManager&);
434 } // end anonymous namespace
437 bool AuditCFRetainRelease::Audit(ExplodedNode* N, GRStateManager&) {
438 const CallExpr* CE = cast<CallExpr>(cast<PostStmt>(N->getLocation()).getStmt());
440 // If the CallExpr doesn't have exactly 1 argument just give up checking.
441 if (CE->getNumArgs() != 1)
444 // Check if we called CFRetain/CFRelease.
445 const GRState* state = N->getState();
446 SVal X = state->getSVal(CE->getCallee());
447 const FunctionDecl* FD = X.getAsFunctionDecl();
452 const IdentifierInfo *FuncII = FD->getIdentifier();
453 if (!(FuncII == Retain || FuncII == Release))
456 // Finally, check if the argument is NULL.
457 // FIXME: We should be able to bifurcate the state here, as a successful
458 // check will result in the value not being NULL afterwards.
459 // FIXME: Need a way to register vistors for the BugReporter. Would like
460 // to benefit from the same diagnostics that regular null dereference
462 if (state->getStateManager().isEqual(state, CE->getArg(0), 0)) {
464 BT = new APIMisuse("null passed to CFRetain/CFRelease");
466 const char *description = (FuncII == Retain)
467 ? "Null pointer argument in call to CFRetain"
468 : "Null pointer argument in call to CFRelease";
470 RangedBugReport *report = new RangedBugReport(*BT, description, N);
471 report->addRange(CE->getArg(0)->getSourceRange());
472 BR.EmitReport(report);
481 clang::CreateAuditCFRetainRelease(ASTContext& Ctx, BugReporter& BR) {
482 return new AuditCFRetainRelease(Ctx, BR);
485 //===----------------------------------------------------------------------===//
486 // Check for sending 'retain', 'release', or 'autorelease' directly to a Class.
487 //===----------------------------------------------------------------------===//
490 class ClassReleaseChecker :
491 public CheckerVisitor<ClassReleaseChecker> {
494 Selector autoreleaseS;
498 ClassReleaseChecker(ASTContext &Ctx)
499 : releaseS(GetNullarySelector("release", Ctx)),
500 retainS(GetNullarySelector("retain", Ctx)),
501 autoreleaseS(GetNullarySelector("autorelease", Ctx)),
502 drainS(GetNullarySelector("drain", Ctx)),
505 static void *getTag() { static int x = 0; return &x; }
507 void PreVisitObjCMessageExpr(CheckerContext &C, const ObjCMessageExpr *ME);
511 void ClassReleaseChecker::PreVisitObjCMessageExpr(CheckerContext &C,
512 const ObjCMessageExpr *ME) {
514 const IdentifierInfo *ClsName = ME->getClassName();
518 Selector S = ME->getSelector();
519 if (!(S == releaseS || S == retainS || S == autoreleaseS || S == drainS))
523 BT = new APIMisuse("message incorrectly sent to class instead of class "
526 ExplodedNode *N = C.GenerateNode();
531 llvm::SmallString<200> buf;
532 llvm::raw_svector_ostream os(buf);
534 os << "The '" << S.getAsString() << "' message should be sent to instances "
535 "of class '" << ClsName->getName()
536 << "' and not the class directly";
538 RangedBugReport *report = new RangedBugReport(*BT, os.str(), N);
539 report->addRange(ME->getSourceRange());
540 C.EmitReport(report);
543 //===----------------------------------------------------------------------===//
544 // Check registration.
545 //===----------------------------------------------------------------------===//
547 void clang::RegisterAppleChecks(GRExprEngine& Eng, const Decl &D) {
548 ASTContext& Ctx = Eng.getContext();
549 BugReporter &BR = Eng.getBugReporter();
551 Eng.AddCheck(CreateBasicObjCFoundationChecks(Ctx, BR),
552 Stmt::ObjCMessageExprClass);
553 Eng.AddCheck(CreateAuditCFNumberCreate(Ctx, BR), Stmt::CallExprClass);
554 Eng.AddCheck(CreateAuditCFRetainRelease(Ctx, BR), Stmt::CallExprClass);
556 RegisterNSErrorChecks(BR, Eng, D);
557 RegisterNSAutoreleasePoolChecks(Eng);
558 Eng.registerCheck(new ClassReleaseChecker(Ctx));