clang/lib/StaticAnalyzer/Checkers/NumberObjectConversionChecker.cpp

   1 //===- NumberObjectConversionChecker.cpp -------------------------*- C++ -*-==//
   2 //
   3 // Part of the LLVM Project, under the Apache License v2.0 with LLVM Exceptions.
   4 // See https://llvm.org/LICENSE.txt for license information.
   5 // SPDX-License-Identifier: Apache-2.0 WITH LLVM-exception
   6 //
   7 //===----------------------------------------------------------------------===//
   8 //
   9 // This file defines NumberObjectConversionChecker, which checks for a
  10 // particular common mistake when dealing with numbers represented as objects
  11 // passed around by pointers. Namely, the language allows to reinterpret the
  12 // pointer as a number directly, often without throwing any warnings,
  13 // but in most cases the result of such conversion is clearly unexpected,
  14 // as pointer value, rather than number value represented by the pointee object,
  15 // becomes the result of such operation.
  16 //
  17 // Currently the checker supports the Objective-C NSNumber class,
  18 // and the OSBoolean class found in macOS low-level code; the latter
  19 // can only hold boolean values.
  20 //
  21 // This checker has an option "Pedantic" (boolean), which enables detection of
  22 // more conversion patterns (which are most likely more harmless, and therefore
  23 // are more likely to produce false positives) - disabled by default,
  24 // enabled with `-analyzer-config osx.NumberObjectConversion:Pedantic=true'.
  25 //
  26 //===----------------------------------------------------------------------===//
  27
  28 #include "clang/StaticAnalyzer/Checkers/BuiltinCheckerRegistration.h"
  29 #include "clang/ASTMatchers/ASTMatchFinder.h"
  30 #include "clang/StaticAnalyzer/Core/BugReporter/BugReporter.h"
  31 #include "clang/StaticAnalyzer/Core/BugReporter/BugType.h"
  32 #include "clang/StaticAnalyzer/Core/Checker.h"
  33 #include "clang/StaticAnalyzer/Core/PathSensitive/AnalysisManager.h"
  34 #include "clang/Lex/Lexer.h"
  35 #include "llvm/ADT/APSInt.h"
  36
  37 using namespace clang;
  38 using namespace ento;
  39 using namespace ast_matchers;
  40
  41 namespace {
  42
  43 class NumberObjectConversionChecker : public Checker<check::ASTCodeBody> {
  44 public:
  45   bool Pedantic;
  46
  47   void checkASTCodeBody(const Decl *D, AnalysisManager &AM,
  48                         BugReporter &BR) const;
  49 };
  50
  51 class Callback : public MatchFinder::MatchCallback {
  52   const NumberObjectConversionChecker *C;
  53   BugReporter &BR;
  54   AnalysisDeclContext *ADC;
  55
  56 public:
  57   Callback(const NumberObjectConversionChecker *C,
  58            BugReporter &BR, AnalysisDeclContext *ADC)
  59       : C(C), BR(BR), ADC(ADC) {}
  60   void run(const MatchFinder::MatchResult &Result) override;
  61 };
  62 } // end of anonymous namespace
  63
  64 void Callback::run(const MatchFinder::MatchResult &Result) {
  65   bool IsPedanticMatch =
  66       (Result.Nodes.getNodeAs<Stmt>("pedantic") != nullptr);
  67   if (IsPedanticMatch && !C->Pedantic)
  68     return;
  69
  70   ASTContext &ACtx = ADC->getASTContext();
  71
  72   if (const Expr *CheckIfNull =
  73           Result.Nodes.getNodeAs<Expr>("check_if_null")) {
  74     // Unless the macro indicates that the intended type is clearly not
  75     // a pointer type, we should avoid warning on comparing pointers
  76     // to zero literals in non-pedantic mode.
  77     // FIXME: Introduce an AST matcher to implement the macro-related logic?
  78     bool MacroIndicatesWeShouldSkipTheCheck = false;
  79     SourceLocation Loc = CheckIfNull->getBeginLoc();
  80     if (Loc.isMacroID()) {
  81       StringRef MacroName = Lexer::getImmediateMacroName(
  82           Loc, ACtx.getSourceManager(), ACtx.getLangOpts());
  83       if (MacroName == "NULL" || MacroName == "nil")
  84         return;
  85       if (MacroName == "YES" || MacroName == "NO")
  86         MacroIndicatesWeShouldSkipTheCheck = true;
  87     }
  88     if (!MacroIndicatesWeShouldSkipTheCheck) {
  89       Expr::EvalResult EVResult;
  90       if (CheckIfNull->IgnoreParenCasts()->EvaluateAsInt(
  91               EVResult, ACtx, Expr::SE_AllowSideEffects)) {
  92         llvm::APSInt Result = EVResult.Val.getInt();
  93         if (Result == 0) {
  94           if (!C->Pedantic)
  95             return;
  96           IsPedanticMatch = true;
  97         }
  98       }
  99     }
 100   }
 101
 102   const Stmt *Conv = Result.Nodes.getNodeAs<Stmt>("conv");
 103   assert(Conv);
 104
 105   const Expr *ConvertedCObject = Result.Nodes.getNodeAs<Expr>("c_object");
 106   const Expr *ConvertedCppObject = Result.Nodes.getNodeAs<Expr>("cpp_object");
 107   const Expr *ConvertedObjCObject = Result.Nodes.getNodeAs<Expr>("objc_object");
 108   bool IsCpp = (ConvertedCppObject != nullptr);
 109   bool IsObjC = (ConvertedObjCObject != nullptr);
 110   const Expr *Obj = IsObjC ? ConvertedObjCObject
 111                   : IsCpp ? ConvertedCppObject
 112                   : ConvertedCObject;
 113   assert(Obj);
 114
 115   bool IsComparison =
 116       (Result.Nodes.getNodeAs<Stmt>("comparison") != nullptr);
 117
 118   bool IsOSNumber =
 119       (Result.Nodes.getNodeAs<Decl>("osnumber") != nullptr);
 120
 121   bool IsInteger =
 122       (Result.Nodes.getNodeAs<QualType>("int_type") != nullptr);
 123   bool IsObjCBool =
 124       (Result.Nodes.getNodeAs<QualType>("objc_bool_type") != nullptr);
 125   bool IsCppBool =
 126       (Result.Nodes.getNodeAs<QualType>("cpp_bool_type") != nullptr);
 127
 128   llvm::SmallString<64> Msg;
 129   llvm::raw_svector_ostream OS(Msg);
 130
 131   // Remove ObjC ARC qualifiers.
 132   QualType ObjT = Obj->getType().getUnqualifiedType();
 133
 134   // Remove consts from pointers.
 135   if (IsCpp) {
 136     assert(ObjT.getCanonicalType()->isPointerType());
 137     ObjT = ACtx.getPointerType(
 138         ObjT->getPointeeType().getCanonicalType().getUnqualifiedType());
 139   }
 140
 141   if (IsComparison)
 142     OS << "Comparing ";
 143   else
 144     OS << "Converting ";
 145
 146   OS << "a pointer value of type '" << ObjT << "' to a ";
 147
 148   std::string EuphemismForPlain = "primitive";
 149   std::string SuggestedApi = IsObjC ? (IsInteger ? "" : "-boolValue")
 150                            : IsCpp ? (IsOSNumber ? "" : "getValue()")
 151                            : "CFNumberGetValue()";
 152   if (SuggestedApi.empty()) {
 153     // A generic message if we're not sure what API should be called.
 154     // FIXME: Pattern-match the integer type to make a better guess?
 155     SuggestedApi =
 156         "a method on '" + ObjT.getAsString() + "' to get the scalar value";
 157     // "scalar" is not quite correct or common, but some documentation uses it
 158     // when describing object methods we suggest. For consistency, we use
 159     // "scalar" in the whole sentence when we need to use this word in at least
 160     // one place, otherwise we use "primitive".
 161     EuphemismForPlain = "scalar";
 162   }
 163
 164   if (IsInteger)
 165     OS << EuphemismForPlain << " integer value";
 166   else if (IsObjCBool)
 167     OS << EuphemismForPlain << " BOOL value";
 168   else if (IsCppBool)
 169     OS << EuphemismForPlain << " bool value";
 170   else // Branch condition?
 171     OS << EuphemismForPlain << " boolean value";
 172
 173
 174   if (IsPedanticMatch)
 175     OS << "; instead, either compare the pointer to "
 176        << (IsObjC ? "nil" : IsCpp ? "nullptr" : "NULL") << " or ";
 177   else
 178     OS << "; did you mean to ";
 179
 180   if (IsComparison)
 181     OS << "compare the result of calling " << SuggestedApi;
 182   else
 183     OS << "call " << SuggestedApi;
 184
 185   if (!IsPedanticMatch)
 186     OS << "?";
 187
 188   BR.EmitBasicReport(
 189       ADC->getDecl(), C, "Suspicious number object conversion", "Logic error",
 190       OS.str(),
 191       PathDiagnosticLocation::createBegin(Obj, BR.getSourceManager(), ADC),
 192       Conv->getSourceRange());
 193 }
 194
 195 void NumberObjectConversionChecker::checkASTCodeBody(const Decl *D,
 196                                                      AnalysisManager &AM,
 197                                                      BugReporter &BR) const {
 198   // Currently this matches CoreFoundation opaque pointer typedefs.
 199   auto CSuspiciousNumberObjectExprM = expr(ignoringParenImpCasts(
 200       expr(hasType(elaboratedType(namesType(typedefType(
 201                hasDeclaration(anyOf(typedefDecl(hasName("CFNumberRef")),
 202                                     typedefDecl(hasName("CFBooleanRef")))))))))
 203           .bind("c_object")));
 204
 205   // Currently this matches XNU kernel number-object pointers.
 206   auto CppSuspiciousNumberObjectExprM =
 207       expr(ignoringParenImpCasts(
 208           expr(hasType(hasCanonicalType(
 209               pointerType(pointee(hasCanonicalType(
 210                   recordType(hasDeclaration(
 211                       anyOf(
 212                         cxxRecordDecl(hasName("OSBoolean")),
 213                         cxxRecordDecl(hasName("OSNumber"))
 214                             .bind("osnumber"))))))))))
 215           .bind("cpp_object")));
 216
 217   // Currently this matches NeXTSTEP number objects.
 218   auto ObjCSuspiciousNumberObjectExprM =
 219       expr(ignoringParenImpCasts(
 220           expr(hasType(hasCanonicalType(
 221               objcObjectPointerType(pointee(
 222                   qualType(hasCanonicalType(
 223                       qualType(hasDeclaration(
 224                           objcInterfaceDecl(hasName("NSNumber")))))))))))
 225           .bind("objc_object")));
 226
 227   auto SuspiciousNumberObjectExprM = anyOf(
 228       CSuspiciousNumberObjectExprM,
 229       CppSuspiciousNumberObjectExprM,
 230       ObjCSuspiciousNumberObjectExprM);
 231
 232   // Useful for predicates like "Unless we've seen the same object elsewhere".
 233   auto AnotherSuspiciousNumberObjectExprM =
 234       expr(anyOf(
 235           equalsBoundNode("c_object"),
 236           equalsBoundNode("objc_object"),
 237           equalsBoundNode("cpp_object")));
 238
 239   // The .bind here is in order to compose the error message more accurately.
 240   auto ObjCSuspiciousScalarBooleanTypeM =
 241       qualType(elaboratedType(namesType(
 242                    typedefType(hasDeclaration(typedefDecl(hasName("BOOL")))))))
 243           .bind("objc_bool_type");
 244
 245   // The .bind here is in order to compose the error message more accurately.
 246   auto SuspiciousScalarBooleanTypeM =
 247       qualType(anyOf(qualType(booleanType()).bind("cpp_bool_type"),
 248                      ObjCSuspiciousScalarBooleanTypeM));
 249
 250   // The .bind here is in order to compose the error message more accurately.
 251   // Also avoid intptr_t and uintptr_t because they were specifically created
 252   // for storing pointers.
 253   auto SuspiciousScalarNumberTypeM =
 254       qualType(hasCanonicalType(isInteger()),
 255                unless(elaboratedType(namesType(typedefType(hasDeclaration(
 256                    typedefDecl(matchesName("^::u?intptr_t$"))))))))
 257           .bind("int_type");
 258
 259   auto SuspiciousScalarTypeM =
 260       qualType(anyOf(SuspiciousScalarBooleanTypeM,
 261                      SuspiciousScalarNumberTypeM));
 262
 263   auto SuspiciousScalarExprM =
 264       expr(ignoringParenImpCasts(expr(hasType(SuspiciousScalarTypeM))));
 265
 266   auto ConversionThroughAssignmentM =
 267       binaryOperator(allOf(hasOperatorName("="),
 268                            hasLHS(SuspiciousScalarExprM),
 269                            hasRHS(SuspiciousNumberObjectExprM)));
 270
 271   auto ConversionThroughBranchingM =
 272       ifStmt(allOf(
 273           hasCondition(SuspiciousNumberObjectExprM),
 274           unless(hasConditionVariableStatement(declStmt())
 275       ))).bind("pedantic");
 276
 277   auto ConversionThroughCallM =
 278       callExpr(hasAnyArgument(allOf(hasType(SuspiciousScalarTypeM),
 279                                     ignoringParenImpCasts(
 280                                         SuspiciousNumberObjectExprM))));
 281
 282   // We bind "check_if_null" to modify the warning message
 283   // in case it was intended to compare a pointer to 0 with a relatively-ok
 284   // construct "x == 0" or "x != 0".
 285   auto ConversionThroughEquivalenceM =
 286       binaryOperator(allOf(anyOf(hasOperatorName("=="), hasOperatorName("!=")),
 287                            hasEitherOperand(SuspiciousNumberObjectExprM),
 288                            hasEitherOperand(SuspiciousScalarExprM
 289                                             .bind("check_if_null"))))
 290       .bind("comparison");
 291
 292   auto ConversionThroughComparisonM =
 293       binaryOperator(allOf(anyOf(hasOperatorName(">="), hasOperatorName(">"),
 294                                  hasOperatorName("<="), hasOperatorName("<")),
 295                            hasEitherOperand(SuspiciousNumberObjectExprM),
 296                            hasEitherOperand(SuspiciousScalarExprM)))
 297       .bind("comparison");
 298
 299   auto ConversionThroughConditionalOperatorM =
 300       conditionalOperator(allOf(
 301           hasCondition(SuspiciousNumberObjectExprM),
 302           unless(hasTrueExpression(
 303               hasDescendant(AnotherSuspiciousNumberObjectExprM))),
 304           unless(hasFalseExpression(
 305               hasDescendant(AnotherSuspiciousNumberObjectExprM)))))
 306       .bind("pedantic");
 307
 308   auto ConversionThroughExclamationMarkM =
 309       unaryOperator(allOf(hasOperatorName("!"),
 310                           has(expr(SuspiciousNumberObjectExprM))))
 311       .bind("pedantic");
 312
 313   auto ConversionThroughExplicitBooleanCastM =
 314       explicitCastExpr(allOf(hasType(SuspiciousScalarBooleanTypeM),
 315                              has(expr(SuspiciousNumberObjectExprM))));
 316
 317   auto ConversionThroughExplicitNumberCastM =
 318       explicitCastExpr(allOf(hasType(SuspiciousScalarNumberTypeM),
 319                              has(expr(SuspiciousNumberObjectExprM))));
 320
 321   auto ConversionThroughInitializerM =
 322       declStmt(hasSingleDecl(
 323           varDecl(hasType(SuspiciousScalarTypeM),
 324                   hasInitializer(SuspiciousNumberObjectExprM))));
 325
 326   auto FinalM = stmt(anyOf(ConversionThroughAssignmentM,
 327                            ConversionThroughBranchingM,
 328                            ConversionThroughCallM,
 329                            ConversionThroughComparisonM,
 330                            ConversionThroughConditionalOperatorM,
 331                            ConversionThroughEquivalenceM,
 332                            ConversionThroughExclamationMarkM,
 333                            ConversionThroughExplicitBooleanCastM,
 334                            ConversionThroughExplicitNumberCastM,
 335                            ConversionThroughInitializerM)).bind("conv");
 336
 337   MatchFinder F;
 338   Callback CB(this, BR, AM.getAnalysisDeclContext(D));
 339
 340   F.addMatcher(traverse(TK_AsIs, stmt(forEachDescendant(FinalM))), &CB);
 341   F.match(*D->getBody(), AM.getASTContext());
 342 }
 343
 344 void ento::registerNumberObjectConversionChecker(CheckerManager &Mgr) {
 345   NumberObjectConversionChecker *Chk =
 346       Mgr.registerChecker<NumberObjectConversionChecker>();
 347   Chk->Pedantic =
 348       Mgr.getAnalyzerOptions().getCheckerBooleanOption(Chk, "Pedantic");
 349 }
 350
 351 bool ento::shouldRegisterNumberObjectConversionChecker(const CheckerManager &mgr) {
 352   return true;
 353 }