f86615ca5c
1) Create a header file to expose the predefined visitors. And move the parent(BugReporterVisitor) there as well. 2) Remove the registerXXXVisitor functions - the Visitor constructors/getters can be used now to create the object. One exception is registerVarDeclsLastStore(), which registers more then one visitor, so make it static member of FindLastStoreBRVisitor. 3) Modify all the checkers to use the new API. llvm-svn: 138126
134 lines
4.3 KiB
C++
134 lines
4.3 KiB
C++
//===--- AttrNonNullChecker.h - Undefined arguments checker ----*- C++ -*--===//
|
|
//
|
|
// The LLVM Compiler Infrastructure
|
|
//
|
|
// This file is distributed under the University of Illinois Open Source
|
|
// License. See LICENSE.TXT for details.
|
|
//
|
|
//===----------------------------------------------------------------------===//
|
|
//
|
|
// This defines AttrNonNullChecker, a builtin check in ExprEngine that
|
|
// performs checks for arguments declared to have nonnull attribute.
|
|
//
|
|
//===----------------------------------------------------------------------===//
|
|
|
|
#include "ClangSACheckers.h"
|
|
#include "clang/StaticAnalyzer/Core/Checker.h"
|
|
#include "clang/StaticAnalyzer/Core/CheckerManager.h"
|
|
#include "clang/StaticAnalyzer/Core/PathSensitive/CheckerContext.h"
|
|
#include "clang/StaticAnalyzer/Core/BugReporter/BugType.h"
|
|
|
|
using namespace clang;
|
|
using namespace ento;
|
|
|
|
namespace {
|
|
class AttrNonNullChecker
|
|
: public Checker< check::PreStmt<CallExpr> > {
|
|
mutable llvm::OwningPtr<BugType> BT;
|
|
public:
|
|
|
|
void checkPreStmt(const CallExpr *CE, CheckerContext &C) const;
|
|
};
|
|
} // end anonymous namespace
|
|
|
|
void AttrNonNullChecker::checkPreStmt(const CallExpr *CE,
|
|
CheckerContext &C) const {
|
|
const ProgramState *state = C.getState();
|
|
|
|
// Check if the callee has a 'nonnull' attribute.
|
|
SVal X = state->getSVal(CE->getCallee());
|
|
|
|
const FunctionDecl *FD = X.getAsFunctionDecl();
|
|
if (!FD)
|
|
return;
|
|
|
|
const NonNullAttr* Att = FD->getAttr<NonNullAttr>();
|
|
if (!Att)
|
|
return;
|
|
|
|
// Iterate through the arguments of CE and check them for null.
|
|
unsigned idx = 0;
|
|
|
|
for (CallExpr::const_arg_iterator I=CE->arg_begin(), E=CE->arg_end(); I!=E;
|
|
++I, ++idx) {
|
|
|
|
if (!Att->isNonNull(idx))
|
|
continue;
|
|
|
|
SVal V = state->getSVal(*I);
|
|
DefinedSVal *DV = dyn_cast<DefinedSVal>(&V);
|
|
|
|
// If the value is unknown or undefined, we can't perform this check.
|
|
if (!DV)
|
|
continue;
|
|
|
|
if (!isa<Loc>(*DV)) {
|
|
// If the argument is a union type, we want to handle a potential
|
|
// transparent_unoin GCC extension.
|
|
QualType T = (*I)->getType();
|
|
const RecordType *UT = T->getAsUnionType();
|
|
if (!UT || !UT->getDecl()->hasAttr<TransparentUnionAttr>())
|
|
continue;
|
|
if (nonloc::CompoundVal *CSV = dyn_cast<nonloc::CompoundVal>(DV)) {
|
|
nonloc::CompoundVal::iterator CSV_I = CSV->begin();
|
|
assert(CSV_I != CSV->end());
|
|
V = *CSV_I;
|
|
DV = dyn_cast<DefinedSVal>(&V);
|
|
assert(++CSV_I == CSV->end());
|
|
if (!DV)
|
|
continue;
|
|
}
|
|
else {
|
|
// FIXME: Handle LazyCompoundVals?
|
|
continue;
|
|
}
|
|
}
|
|
|
|
ConstraintManager &CM = C.getConstraintManager();
|
|
const ProgramState *stateNotNull, *stateNull;
|
|
llvm::tie(stateNotNull, stateNull) = CM.assumeDual(state, *DV);
|
|
|
|
if (stateNull && !stateNotNull) {
|
|
// Generate an error node. Check for a null node in case
|
|
// we cache out.
|
|
if (ExplodedNode *errorNode = C.generateSink(stateNull)) {
|
|
|
|
// Lazily allocate the BugType object if it hasn't already been
|
|
// created. Ownership is transferred to the BugReporter object once
|
|
// the BugReport is passed to 'EmitWarning'.
|
|
if (!BT)
|
|
BT.reset(new BugType("Argument with 'nonnull' attribute passed null",
|
|
"API"));
|
|
|
|
BugReport *R =
|
|
new BugReport(*BT, "Null pointer passed as an argument to a "
|
|
"'nonnull' parameter", errorNode);
|
|
|
|
// Highlight the range of the argument that was null.
|
|
const Expr *arg = *I;
|
|
R->addRange(arg->getSourceRange());
|
|
R->addVisitor(bugreporter::getTrackNullOrUndefValueVisitor(errorNode,
|
|
arg));
|
|
// Emit the bug report.
|
|
C.EmitReport(R);
|
|
}
|
|
|
|
// Always return. Either we cached out or we just emitted an error.
|
|
return;
|
|
}
|
|
|
|
// If a pointer value passed the check we should assume that it is
|
|
// indeed not null from this point forward.
|
|
assert(stateNotNull);
|
|
state = stateNotNull;
|
|
}
|
|
|
|
// If we reach here all of the arguments passed the nonnull check.
|
|
// If 'state' has been updated generated a new node.
|
|
C.addTransition(state);
|
|
}
|
|
|
|
void ento::registerAttrNonNullChecker(CheckerManager &mgr) {
|
|
mgr.registerChecker<AttrNonNullChecker>();
|
|
}
|