[-Wunsafe-buffer-usage] Improve pointer match pattern

[ziqingluo-90]

Summary

This patch Improves the pointer-type matcher used by UnsafeBufferUsage checking by adding matchers for pointer types involving typedef, template instantiation, and decayed types. Corresponding tests are added.

[xazax.hun]

clang/lib/Analysis/UnsafeBufferUsage.cpp

31–39

Isn't it possible to reduce the number of cases by using hasCanonicalType?

[ziqingluo-90]

clang/lib/Analysis/UnsafeBufferUsage.cpp

31–39

aha, it simply works!

[aaron.ballman]

clang/lib/Analysis/UnsafeBufferUsage.cpp

31

I shudder to ask this question, but ... pointer to member types?

35

hmmm, do you need to check hasDecayedType(pointerType())? What decay type *isn't* a pointer type?

[ziqingluo-90]

clang/lib/Analysis/UnsafeBufferUsage.cpp

30–40

31

My understanding is that a pointer-to-member type pointer cannot be used to do buffer access, i.e., one cannot do pointer addition on it. So we do not warn pointer-to-member themselves. In cases where the member type is a pointer, it has been covered.

I have added a test involving pointer to member types.

35

you are right! Thanks for pointing this out.

clang/test/SemaCXX/warn-unsafe-buffer-usage.cpp

164

[ziqingluo-90]

Addressing comments.

[NoQ]

Great!

clang/lib/Analysis/UnsafeBufferUsage.cpp

 using FixItList = UnsafeBufferUsageHandler::FixItList;
 
 // Defined below.
 class Strategy;
 } // namespace
 
 // Because we're dealing with raw pointers, let's define what we mean by that.
 static auto hasPointerType() {
-  return anyOf(hasType(pointerType()),
-               hasType(autoType(hasDeducedType(
-                   hasUnqualifiedDesugaredType(pointerType())))));
+  return anyOf(
+    hasType(pointerType()),
+    hasType(autoType(
+            hasDeducedType(hasUnqualifiedDesugaredType(pointerType())))),
+    // DecayedType, e.g., array type in formal parameter decl
+    hasType(decayedType(hasDecayedType(pointerType()))),
+    // ElaboratedType, e.g., typedef
+    hasType(elaboratedType(hasUnqualifiedDesugaredType(pointerType()))),
+    // template instantiated types
+    hasType(substTemplateTypeParmType(hasReplacementType(pointerType()))));
 }
 
 namespace {
 /// Gadget is an individual operation in the code that may be of interest to
 /// this analysis. Each (non-abstract) subclass corresponds to a specific
 /// rigid AST structure that constitutes an operation on a pointer-type object.
 /// Discovery of a gadget in the code corresponds to claiming that we understand
 /// what this part of code is doing well enough to potentially improve it.
 /// Gadgets can be unsafe (immediately deserving a warning) or safe (not

clang/test/SemaCXX/warn-unsafe-buffer-usage.cpp

-// RUN: %clang_cc1 -std=c++20 -Wunsafe-buffer-usage -verify %s
+// RUN: %clang_cc1 -std=c++20 -Wunsafe-buffer-usage -include %s -verify %s
+#ifndef INCLUDED
+#define INCLUDED
+#pragma clang system_header
+
+// no spanification warnings for system headers
+void foo(...);
+void testAsSystemHeader(char *p) {
+  ++p;
+
+  auto ap1 = p;
+  auto ap2 = &p;
+
+  foo(p[1],
+      ap1[1],
+      ap2[2][3]);
+}
+
+#else
 
 void testIncrement(char *p) {
   ++p; // expected-warning{{unchecked operation on raw buffer in expression}}
   p++; // expected-warning{{unchecked operation on raw buffer in expression}}
   --p; // expected-warning{{unchecked operation on raw buffer in expression}}
   p--; // expected-warning{{unchecked operation on raw buffer in expression}}
 }
 
-void foo(...);
-
 void * bar(void);
 char * baz(void);
 
 void testArraySubscripts(int *p, int **pp) {
   foo(p[0],             // expected-warning{{unchecked operation on raw buffer in expression}}
       pp[0][0],         // expected-warning2{{unchecked operation on raw buffer in expression}}
       0[0[pp]],         // expected-warning2{{unchecked operation on raw buffer in expression}}
       0[pp][0]          // expected-warning2{{unchecked operation on raw buffer in expression}}
       );
 
   if (p[3]) {           // expected-warning{{unchecked operation on raw buffer in expression}}
     void * q = p;
 
     foo(((int*)q)[10]); // expected-warning{{unchecked operation on raw buffer in expression}}
   }
 
   foo(((int*)bar())[3], // expected-warning{{unchecked operation on raw buffer in expression}}
       3[(int*)bar()],   // expected-warning{{unchecked operation on raw buffer in expression}}
       baz()[3],         // expected-warning{{unchecked operation on raw buffer in expression}}
       3[baz()]          // expected-warning{{unchecked operation on raw buffer in expression}}
       );
 
   int a[10], b[10][10];
 
-  // not to warn subscripts on arrays
+  // Not to warn subscripts on arrays
   foo(a[0], a[1],
       0[a], 1[a],
       b[3][4],
       4[b][3],
       4[3[b]]);
 }
 
 void testArraySubscriptsWithAuto(int *p, int **pp) {
   int a[10];
 
   auto ap1 = a;
 
   foo(ap1[0]);  // expected-warning{{unchecked operation on raw buffer in expression}}
 
   auto ap2 = p;
 
   foo(ap2[0]);  // expected-warning{{unchecked operation on raw buffer in expression}}
 
   auto ap3 = pp;
 
-  foo(pp[0][0]); // expected-warning2{{unchecked operation on raw buffer in expression}}
+  foo(ap3[0][0]); // expected-warning2{{unchecked operation on raw buffer in expression}}
 
   auto ap4 = *pp;
 
   foo(ap4[0]);  // expected-warning{{unchecked operation on raw buffer in expression}}
 }
+
+void testQualifiedParameters(const int * p, const int * const q,
+           const int a[10], const int b[10][10]) {
+  foo(p[1], 1[p], p[-1],   // expected-warning3{{unchecked operation on raw buffer in expression}}
+      q[1], 1[q], q[-1],   // expected-warning3{{unchecked operation on raw buffer in expression}}
+      a[1],                // expected-warning{{unchecked operation on raw buffer in expression}}     `a` is of pointer type
+      b[1][2]              // expected-warning{{unchecked operation on raw buffer in expression}}     `b[1]` is of array type
+      );
+}
+
+struct T {
+  int a[10];
+  int * b;
+  struct {
+    int a[10];
+    int * b;
+  } c;
+};
+
+typedef struct T T_t;
+
+T_t funRetT();
+T_t * funRetTStar();
+
+void testStructMembers(struct T * sp, struct T s, T_t * sp2, T_t s2) {
+  foo(sp->a[1],
+      sp->b[1],     // expected-warning{{unchecked operation on raw buffer in expression}}
+      sp->c.a[1],
+      sp->c.b[1],   // expected-warning{{unchecked operation on raw buffer in expression}}
+      s.a[1],
+      s.b[1],       // expected-warning{{unchecked operation on raw buffer in expression}}
+      s.c.a[1],
+      s.c.b[1],     // expected-warning{{unchecked operation on raw buffer in expression}}
+      sp2->a[1],
+      sp2->b[1],    // expected-warning{{unchecked operation on raw buffer in expression}}
+      sp2->c.a[1],
+      sp2->c.b[1],  // expected-warning{{unchecked operation on raw buffer in expression}}
+      s2.a[1],
+      s2.b[1],      // expected-warning{{unchecked operation on raw buffer in expression}}
+      s2.c.a[1],
+      s2.c.b[1],           // expected-warning{{unchecked operation on raw buffer in expression}}
+      funRetT().a[1],
+      funRetT().b[1],      // expected-warning{{unchecked operation on raw buffer in expression}}
+      funRetTStar()->a[1],
+      funRetTStar()->b[1]  // expected-warning{{unchecked operation on raw buffer in expression}}
+      );
+}
+
+int garray[10];
+int * gp = garray;
+int gvar = gp[1];  // TODO: this is not warned
+
+void testLambdaCaptureAndGlobal(int * p) {
+  int a[10];
+
+  auto Lam = [p, a]() {
+    return p[1] // expected-warning2{{unchecked operation on raw buffer in expression}}
+      + a[1] + garray[1]
+      + gp[1];  // expected-warning2{{unchecked operation on raw buffer in expression}}
+  };
+}
+
+typedef T_t * T_ptr_t;
+
+void testTypedefs(T_ptr_t p) {
+  foo(p[1],      // expected-warning{{unchecked operation on raw buffer in expression}}
+      p[1].a[1], // expected-warning{{unchecked operation on raw buffer in expression}}
+      p[1].b[1]  // expected-warning2{{unchecked operation on raw buffer in expression}}
+      );
+}
+
+template<typename T> T f(T t) {
+  return &t[1]; // expected-warning{{unchecked operation on raw buffer in expression}}
+}
+
+void testTemplate(int * p) {
+  foo(f(p)[1]); // expected-warning{{unchecked operation on raw buffer in expression}}, \
+    expected-note{{in instantiation of function template specialization 'f<int *>' requested here}}
+}
+
+#endif