clang/lib/StaticAnalyzer/Checkers/NSErrorChecker.cpp

   1 //=- NSErrorChecker.cpp - Coding conventions for uses of NSError -*- C++ -*-==//
   2 //
   3 // Part of the LLVM Project, under the Apache License v2.0 with LLVM Exceptions.
   4 // See https://llvm.org/LICENSE.txt for license information.
   5 // SPDX-License-Identifier: Apache-2.0 WITH LLVM-exception
   6 //
   7 //===----------------------------------------------------------------------===//
   8 //
   9 //  This file defines a CheckNSError, a flow-insensitive check
  10 //  that determines if an Objective-C class interface correctly returns
  11 //  a non-void return type.
  12 //
  13 //  File under feature request PR 2600.
  14 //
  15 //===----------------------------------------------------------------------===//
  16
  17 #include "clang/StaticAnalyzer/Checkers/BuiltinCheckerRegistration.h"
  18 #include "clang/AST/Decl.h"
  19 #include "clang/AST/DeclObjC.h"
  20 #include "clang/StaticAnalyzer/Core/BugReporter/BugType.h"
  21 #include "clang/StaticAnalyzer/Core/Checker.h"
  22 #include "clang/StaticAnalyzer/Core/CheckerManager.h"
  23 #include "clang/StaticAnalyzer/Core/PathSensitive/CheckerContext.h"
  24 #include "clang/StaticAnalyzer/Core/PathSensitive/ProgramStateTrait.h"
  25 #include "llvm/ADT/SmallString.h"
  26 #include "llvm/Support/raw_ostream.h"
  27 #include <optional>
  28
  29 using namespace clang;
  30 using namespace ento;
  31
  32 static bool IsNSError(QualType T, IdentifierInfo *II);
  33 static bool IsCFError(QualType T, IdentifierInfo *II);
  34
  35 //===----------------------------------------------------------------------===//
  36 // NSErrorMethodChecker
  37 //===----------------------------------------------------------------------===//
  38
  39 namespace {
  40 class NSErrorMethodChecker
  41     : public Checker< check::ASTDecl<ObjCMethodDecl> > {
  42   mutable IdentifierInfo *II = nullptr;
  43
  44 public:
  45   NSErrorMethodChecker() = default;
  46
  47   void checkASTDecl(const ObjCMethodDecl *D,
  48                     AnalysisManager &mgr, BugReporter &BR) const;
  49 };
  50 }
  51
  52 void NSErrorMethodChecker::checkASTDecl(const ObjCMethodDecl *D,
  53                                         AnalysisManager &mgr,
  54                                         BugReporter &BR) const {
  55   if (!D->isThisDeclarationADefinition())
  56     return;
  57   if (!D->getReturnType()->isVoidType())
  58     return;
  59
  60   if (!II)
  61     II = &D->getASTContext().Idents.get("NSError");
  62
  63   bool hasNSError = false;
  64   for (const auto *I : D->parameters())  {
  65     if (IsNSError(I->getType(), II)) {
  66       hasNSError = true;
  67       break;
  68     }
  69   }
  70
  71   if (hasNSError) {
  72     const char *err = "Method accepting NSError** "
  73         "should have a non-void return value to indicate whether or not an "
  74         "error occurred";
  75     PathDiagnosticLocation L =
  76       PathDiagnosticLocation::create(D, BR.getSourceManager());
  77     BR.EmitBasicReport(D, this, "Bad return type when passing NSError**",
  78                        "Coding conventions (Apple)", err, L);
  79   }
  80 }
  81
  82 //===----------------------------------------------------------------------===//
  83 // CFErrorFunctionChecker
  84 //===----------------------------------------------------------------------===//
  85
  86 namespace {
  87 class CFErrorFunctionChecker
  88     : public Checker< check::ASTDecl<FunctionDecl> > {
  89   mutable IdentifierInfo *II;
  90
  91 public:
  92   CFErrorFunctionChecker() : II(nullptr) {}
  93
  94   void checkASTDecl(const FunctionDecl *D,
  95                     AnalysisManager &mgr, BugReporter &BR) const;
  96 };
  97 }
  98
  99 static bool hasReservedReturnType(const FunctionDecl *D) {
 100   if (isa<CXXConstructorDecl>(D))
 101     return true;
 102
 103   // operators delete and delete[] are required to have 'void' return type
 104   auto OperatorKind = D->getOverloadedOperator();
 105   return OperatorKind == OO_Delete || OperatorKind == OO_Array_Delete;
 106 }
 107
 108 void CFErrorFunctionChecker::checkASTDecl(const FunctionDecl *D,
 109                                         AnalysisManager &mgr,
 110                                         BugReporter &BR) const {
 111   if (!D->doesThisDeclarationHaveABody())
 112     return;
 113   if (!D->getReturnType()->isVoidType())
 114     return;
 115   if (hasReservedReturnType(D))
 116     return;
 117
 118   if (!II)
 119     II = &D->getASTContext().Idents.get("CFErrorRef");
 120
 121   bool hasCFError = false;
 122   for (auto *I : D->parameters())  {
 123     if (IsCFError(I->getType(), II)) {
 124       hasCFError = true;
 125       break;
 126     }
 127   }
 128
 129   if (hasCFError) {
 130     const char *err = "Function accepting CFErrorRef* "
 131         "should have a non-void return value to indicate whether or not an "
 132         "error occurred";
 133     PathDiagnosticLocation L =
 134       PathDiagnosticLocation::create(D, BR.getSourceManager());
 135     BR.EmitBasicReport(D, this, "Bad return type when passing CFErrorRef*",
 136                        "Coding conventions (Apple)", err, L);
 137   }
 138 }
 139
 140 //===----------------------------------------------------------------------===//
 141 // NSOrCFErrorDerefChecker
 142 //===----------------------------------------------------------------------===//
 143
 144 namespace {
 145
 146 class NSErrorDerefBug : public BugType {
 147 public:
 148   NSErrorDerefBug(const CheckerNameRef Checker)
 149       : BugType(Checker, "NSError** null dereference",
 150                 "Coding conventions (Apple)") {}
 151 };
 152
 153 class CFErrorDerefBug : public BugType {
 154 public:
 155   CFErrorDerefBug(const CheckerNameRef Checker)
 156       : BugType(Checker, "CFErrorRef* null dereference",
 157                 "Coding conventions (Apple)") {}
 158 };
 159
 160 }
 161
 162 namespace {
 163 class NSOrCFErrorDerefChecker
 164     : public Checker< check::Location,
 165                         check::Event<ImplicitNullDerefEvent> > {
 166   mutable IdentifierInfo *NSErrorII, *CFErrorII;
 167   mutable std::unique_ptr<NSErrorDerefBug> NSBT;
 168   mutable std::unique_ptr<CFErrorDerefBug> CFBT;
 169 public:
 170   bool ShouldCheckNSError = false, ShouldCheckCFError = false;
 171   CheckerNameRef NSErrorName, CFErrorName;
 172   NSOrCFErrorDerefChecker() : NSErrorII(nullptr), CFErrorII(nullptr) {}
 173
 174   void checkLocation(SVal loc, bool isLoad, const Stmt *S,
 175                      CheckerContext &C) const;
 176   void checkEvent(ImplicitNullDerefEvent event) const;
 177 };
 178 }
 179
 180 typedef llvm::ImmutableMap<SymbolRef, unsigned> ErrorOutFlag;
 181 REGISTER_TRAIT_WITH_PROGRAMSTATE(NSErrorOut, ErrorOutFlag)
 182 REGISTER_TRAIT_WITH_PROGRAMSTATE(CFErrorOut, ErrorOutFlag)
 183
 184 template <typename T>
 185 static bool hasFlag(SVal val, ProgramStateRef state) {
 186   if (SymbolRef sym = val.getAsSymbol())
 187     if (const unsigned *attachedFlags = state->get<T>(sym))
 188       return *attachedFlags;
 189   return false;
 190 }
 191
 192 template <typename T>
 193 static void setFlag(ProgramStateRef state, SVal val, CheckerContext &C) {
 194   // We tag the symbol that the SVal wraps.
 195   if (SymbolRef sym = val.getAsSymbol())
 196     C.addTransition(state->set<T>(sym, true));
 197 }
 198
 199 static QualType parameterTypeFromSVal(SVal val, CheckerContext &C) {
 200   const StackFrameContext * SFC = C.getStackFrame();
 201   if (std::optional<loc::MemRegionVal> X = val.getAs<loc::MemRegionVal>()) {
 202     const MemRegion* R = X->getRegion();
 203     if (const VarRegion *VR = R->getAs<VarRegion>())
 204       if (const StackArgumentsSpaceRegion *
 205           stackReg = dyn_cast<StackArgumentsSpaceRegion>(VR->getMemorySpace()))
 206         if (stackReg->getStackFrame() == SFC)
 207           return VR->getValueType();
 208   }
 209
 210   return QualType();
 211 }
 212
 213 void NSOrCFErrorDerefChecker::checkLocation(SVal loc, bool isLoad,
 214                                             const Stmt *S,
 215                                             CheckerContext &C) const {
 216   if (!isLoad)
 217     return;
 218   if (loc.isUndef() || !isa<Loc>(loc))
 219     return;
 220
 221   ASTContext &Ctx = C.getASTContext();
 222   ProgramStateRef state = C.getState();
 223
 224   // If we are loading from NSError**/CFErrorRef* parameter, mark the resulting
 225   // SVal so that we can later check it when handling the
 226   // ImplicitNullDerefEvent event.
 227   // FIXME: Cumbersome! Maybe add hook at construction of SVals at start of
 228   // function ?
 229
 230   QualType parmT = parameterTypeFromSVal(loc, C);
 231   if (parmT.isNull())
 232     return;
 233
 234   if (!NSErrorII)
 235     NSErrorII = &Ctx.Idents.get("NSError");
 236   if (!CFErrorII)
 237     CFErrorII = &Ctx.Idents.get("CFErrorRef");
 238
 239   if (ShouldCheckNSError && IsNSError(parmT, NSErrorII)) {
 240     setFlag<NSErrorOut>(state, state->getSVal(loc.castAs<Loc>()), C);
 241     return;
 242   }
 243
 244   if (ShouldCheckCFError && IsCFError(parmT, CFErrorII)) {
 245     setFlag<CFErrorOut>(state, state->getSVal(loc.castAs<Loc>()), C);
 246     return;
 247   }
 248 }
 249
 250 void NSOrCFErrorDerefChecker::checkEvent(ImplicitNullDerefEvent event) const {
 251   if (event.IsLoad)
 252     return;
 253
 254   SVal loc = event.Location;
 255   ProgramStateRef state = event.SinkNode->getState();
 256   BugReporter &BR = *event.BR;
 257
 258   bool isNSError = hasFlag<NSErrorOut>(loc, state);
 259   bool isCFError = false;
 260   if (!isNSError)
 261     isCFError = hasFlag<CFErrorOut>(loc, state);
 262
 263   if (!(isNSError || isCFError))
 264     return;
 265
 266   // Storing to possible null NSError/CFErrorRef out parameter.
 267   SmallString<128> Buf;
 268   llvm::raw_svector_ostream os(Buf);
 269
 270   os << "Potential null dereference. According to coding standards ";
 271   os << (isNSError
 272          ? "in 'Creating and Returning NSError Objects' the parameter"
 273          : "documented in CoreFoundation/CFError.h the parameter");
 274
 275   os  << " may be null";
 276
 277   BugType *bug = nullptr;
 278   if (isNSError) {
 279     if (!NSBT)
 280       NSBT.reset(new NSErrorDerefBug(NSErrorName));
 281     bug = NSBT.get();
 282   }
 283   else {
 284     if (!CFBT)
 285       CFBT.reset(new CFErrorDerefBug(CFErrorName));
 286     bug = CFBT.get();
 287   }
 288   BR.emitReport(
 289       std::make_unique<PathSensitiveBugReport>(*bug, os.str(), event.SinkNode));
 290 }
 291
 292 static bool IsNSError(QualType T, IdentifierInfo *II) {
 293
 294   const PointerType* PPT = T->getAs<PointerType>();
 295   if (!PPT)
 296     return false;
 297
 298   const ObjCObjectPointerType* PT =
 299     PPT->getPointeeType()->getAs<ObjCObjectPointerType>();
 300
 301   if (!PT)
 302     return false;
 303
 304   const ObjCInterfaceDecl *ID = PT->getInterfaceDecl();
 305
 306   // FIXME: Can ID ever be NULL?
 307   if (ID)
 308     return II == ID->getIdentifier();
 309
 310   return false;
 311 }
 312
 313 static bool IsCFError(QualType T, IdentifierInfo *II) {
 314   const PointerType* PPT = T->getAs<PointerType>();
 315   if (!PPT) return false;
 316
 317   const TypedefType* TT = PPT->getPointeeType()->getAs<TypedefType>();
 318   if (!TT) return false;
 319
 320   return TT->getDecl()->getIdentifier() == II;
 321 }
 322
 323 void ento::registerNSOrCFErrorDerefChecker(CheckerManager &mgr) {
 324   mgr.registerChecker<NSOrCFErrorDerefChecker>();
 325 }
 326
 327 bool ento::shouldRegisterNSOrCFErrorDerefChecker(const CheckerManager &mgr) {
 328   return true;
 329 }
 330
 331 void ento::registerNSErrorChecker(CheckerManager &mgr) {
 332   mgr.registerChecker<NSErrorMethodChecker>();
 333   NSOrCFErrorDerefChecker *checker = mgr.getChecker<NSOrCFErrorDerefChecker>();
 334   checker->ShouldCheckNSError = true;
 335   checker->NSErrorName = mgr.getCurrentCheckerName();
 336 }
 337
 338 bool ento::shouldRegisterNSErrorChecker(const CheckerManager &mgr) {
 339   return true;
 340 }
 341
 342 void ento::registerCFErrorChecker(CheckerManager &mgr) {
 343   mgr.registerChecker<CFErrorFunctionChecker>();
 344   NSOrCFErrorDerefChecker *checker = mgr.getChecker<NSOrCFErrorDerefChecker>();
 345   checker->ShouldCheckCFError = true;
 346   checker->CFErrorName = mgr.getCurrentCheckerName();
 347 }
 348
 349 bool ento::shouldRegisterCFErrorChecker(const CheckerManager &mgr) {
 350   return true;
 351 }