diff --git a/clang/docs/analyzer/checkers.rst b/clang/docs/analyzer/checkers.rst --- a/clang/docs/analyzer/checkers.rst +++ b/clang/docs/analyzer/checkers.rst @@ -698,6 +698,13 @@ Finds implementation-defined behavior in UNIX/Posix functions. +.. _optin-portabilityMinor-UnixAPI: + +optin.portabilityMinor.UnixAPI +""""""""""""""""""""""""" +Finds non-severe implementation-defined behavior in UNIX/Posix functions. + + .. _security-checkers: security diff --git a/clang/include/clang/StaticAnalyzer/Checkers/Checkers.td b/clang/include/clang/StaticAnalyzer/Checkers/Checkers.td --- a/clang/include/clang/StaticAnalyzer/Checkers/Checkers.td +++ b/clang/include/clang/StaticAnalyzer/Checkers/Checkers.td @@ -42,6 +42,12 @@ // development, but unwanted for developers who target only a single platform. def PortabilityOptIn : Package<"portability">, ParentPackage; +// The PortabilityMinor package is for checkers that find non-severe portability +// issues (see also the Portability package). Such checks may be unwanted for +// developers who want to ignore minor portability issues, hence they are put in +// a separate package. +def PortabilityMinorOptIn : Package<"portabilityMinor">, ParentPackage; + def Nullability : Package<"nullability">, PackageOptions<[ CmdLineOption, + HelpText<"Finds non-severe implementation-defined behavior in UNIX/Posix functions">, + Documentation; + +} // end optin.portabilityMinor + //===----------------------------------------------------------------------===// // NonDeterminism checkers. //===----------------------------------------------------------------------===// diff --git a/clang/lib/StaticAnalyzer/Checkers/UnixAPIChecker.cpp b/clang/lib/StaticAnalyzer/Checkers/UnixAPIChecker.cpp --- a/clang/lib/StaticAnalyzer/Checkers/UnixAPIChecker.cpp +++ b/clang/lib/StaticAnalyzer/Checkers/UnixAPIChecker.cpp @@ -85,6 +85,25 @@ const char *fn) const; }; +class UnixAPIPortabilityMinorChecker + : public Checker> { +public: + void checkPreStmt(const CallExpr *CE, CheckerContext &C) const; + +private: + mutable std::unique_ptr BT_printfPointerConversionSpecifierNULL; + + void + CheckPrintfPointerConversionSpecifierNULL(CheckerContext &C, + const CallExpr *CE, + unsigned int data_args_index) const; + + void + ReportPrintfPointerConversionSpecifierNULL(clang::ento::CheckerContext &C, + ProgramStateRef nullState, + const clang::Expr *arg) const; +}; + } //end anonymous namespace static void LazyInitialize(const CheckerBase *Checker, @@ -493,6 +512,94 @@ CheckVallocZero(C, CE); } +//===----------------------------------------------------------------------===// +// printf family of functions with null pointer passed to pointer +// conversion specifier +//===----------------------------------------------------------------------===// + +// Generates an error report, indicating that the result of passing a null +// pointer to pointer conversion specifier of printf family of functions is +// implementation defined. +void UnixAPIPortabilityMinorChecker::ReportPrintfPointerConversionSpecifierNULL( + clang::ento::CheckerContext &C, ProgramStateRef nullState, + const clang::Expr *arg) const { + ExplodedNode *N = + C.generateNonFatalErrorNode(nullState ? nullState : C.getState()); + if (!N) + return; + LazyInitialize( + this, BT_printfPointerConversionSpecifierNULL, + "Passing a null pointer to the pointer conversion specifier of " + "the printf family of functions"); + auto report = std::make_unique( + *BT_printfPointerConversionSpecifierNULL, + "The result of passing a null pointer to the pointer conversion " + "specifier of " + "the printf family of functions is implementation defined", + N); + report->addRange(arg->getSourceRange()); + bugreporter::trackExpressionValue(N, arg, *report); + C.emitReport(std::move(report)); +} + +// Checks data arguments of printf family of functions for a null pointer, +// assuming it is passed to a pointer conversion specifier (%p), i.e. without +// checking the format string. +void UnixAPIPortabilityMinorChecker::CheckPrintfPointerConversionSpecifierNULL( + CheckerContext &C, const CallExpr *CE, unsigned int data_args_index) const { + ProgramStateRef state = C.getState(); + ConstraintManager &CM = state->getConstraintManager(); + + for (unsigned int i = data_args_index; i < CE->getNumArgs(); i++) { + const Expr *arg = CE->getArg(i); + if (!arg) + continue; + + if (!arg->getType()->isPointerType()) + continue; + + SVal argVal = C.getSVal(arg); + if (argVal.isUnknownOrUndef()) + continue; + + auto argDefinedVal = argVal.getAs(); + + ProgramStateRef notNullState, nullState; + std::tie(notNullState, nullState) = + CM.assumeDual(C.getState(), *argDefinedVal); + if (!notNullState && nullState) { + ReportPrintfPointerConversionSpecifierNULL(C, nullState, arg); + return; + } + } +} + +void UnixAPIPortabilityMinorChecker::checkPreStmt(const CallExpr *CE, + CheckerContext &C) const { + const FunctionDecl *FD = C.getCalleeDecl(CE); + if (!FD || FD->getKind() != Decl::Function) + return; + + // Don't treat functions in namespaces with the same name a Unix function + // as a call to the Unix function. + const DeclContext *NamespaceCtx = FD->getEnclosingNamespaceContext(); + if (isa_and_nonnull(NamespaceCtx)) + return; + + StringRef FName = C.getCalleeName(FD); + if (FName.empty()) + return; + + if (FName == "printf") + CheckPrintfPointerConversionSpecifierNULL(C, CE, 1); + + else if (FName == "fprintf" || FName == "sprintf") + CheckPrintfPointerConversionSpecifierNULL(C, CE, 2); + + else if (FName == "snprintf") + CheckPrintfPointerConversionSpecifierNULL(C, CE, 3); +} + //===----------------------------------------------------------------------===// // Registration. //===----------------------------------------------------------------------===// @@ -508,3 +615,4 @@ REGISTER_CHECKER(UnixAPIMisuseChecker) REGISTER_CHECKER(UnixAPIPortabilityChecker) +REGISTER_CHECKER(UnixAPIPortabilityMinorChecker) diff --git a/clang/test/Analysis/Inputs/expected-plists/unix-fns.c.plist b/clang/test/Analysis/Inputs/expected-plists/unix-fns.c.plist --- a/clang/test/Analysis/Inputs/expected-plists/unix-fns.c.plist +++ b/clang/test/Analysis/Inputs/expected-plists/unix-fns.c.plist @@ -16,12 +16,12 @@ start - line82 + line94 col3 file0 - line82 + line94 col5 file0 @@ -29,12 +29,12 @@ end - line84 + line96 col3 file0 - line84 + line96 col4 file0 @@ -50,12 +50,12 @@ start - line84 + line96 col3 file0 - line84 + line96 col4 file0 @@ -63,12 +63,12 @@ end - line84 + line96 col7 file0 - line84 + line96 col7 file0 @@ -80,7 +80,7 @@ kindevent location - line84 + line96 col7 file0 @@ -88,12 +88,12 @@ - line84 + line96 col7 file0 - line84 + line96 col9 file0 @@ -113,12 +113,12 @@ start - line84 + line96 col7 file0 - line84 + line96 col7 file0 @@ -126,12 +126,12 @@ end - line87 + line99 col3 file0 - line87 + line99 col4 file0 @@ -147,12 +147,12 @@ start - line87 + line99 col3 file0 - line87 + line99 col4 file0 @@ -160,12 +160,12 @@ end - line87 + line99 col8 file0 - line87 + line99 col11 file0 @@ -177,7 +177,7 @@ kindevent location - line87 + line99 col8 file0 @@ -185,12 +185,12 @@ - line87 + line99 col19 file0 - line87 + line99 col25 file0 @@ -214,7 +214,7 @@ issue_hash_function_offset6 location - line87 + line99 col8 file0 @@ -222,11 +222,11 @@ 0 - 81 - 82 - 83 - 84 - 87 + 93 + 94 + 95 + 96 + 99 @@ -241,12 +241,12 @@ start - line93 + line105 col3 file0 - line93 + line105 col5 file0 @@ -254,12 +254,12 @@ end - line95 + line107 col3 file0 - line95 + line107 col4 file0 @@ -275,12 +275,12 @@ start - line95 + line107 col3 file0 - line95 + line107 col4 file0 @@ -288,12 +288,12 @@ end - line95 + line107 col7 file0 - line95 + line107 col7 file0 @@ -305,7 +305,7 @@ kindevent location - line95 + line107 col7 file0 @@ -313,12 +313,12 @@ - line95 + line107 col7 file0 - line95 + line107 col9 file0 @@ -338,12 +338,12 @@ start - line95 + line107 col7 file0 - line95 + line107 col7 file0 @@ -351,12 +351,12 @@ end - line98 + line110 col3 file0 - line98 + line110 col4 file0 @@ -372,12 +372,12 @@ start - line98 + line110 col3 file0 - line98 + line110 col4 file0 @@ -385,12 +385,12 @@ end - line98 + line110 col8 file0 - line98 + line110 col13 file0 @@ -402,7 +402,7 @@ kindevent location - line98 + line110 col8 file0 @@ -410,12 +410,12 @@ - line98 + line110 col44 file0 - line98 + line110 col50 file0 @@ -439,7 +439,7 @@ issue_hash_function_offset6 location - line98 + line110 col8 file0 @@ -447,11 +447,11 @@ 0 - 92 - 93 - 94 - 95 - 98 + 104 + 105 + 106 + 107 + 110 @@ -466,12 +466,12 @@ start - line104 + line116 col3 file0 - line104 + line116 col17 file0 @@ -479,12 +479,12 @@ end - line105 + line117 col8 file0 - line105 + line117 col9 file0 @@ -500,12 +500,12 @@ start - line105 + line117 col8 file0 - line105 + line117 col9 file0 @@ -513,12 +513,12 @@ end - line105 + line117 col52 file0 - line105 + line117 col64 file0 @@ -530,7 +530,7 @@ kindevent location - line105 + line117 col52 file0 @@ -538,12 +538,12 @@ - line105 + line117 col66 file0 - line105 + line117 col72 file0 @@ -567,7 +567,7 @@ issue_hash_function_offset2 location - line105 + line117 col52 file0 @@ -575,9 +575,9 @@ 0 - 103 - 104 - 105 + 115 + 116 + 117 @@ -592,12 +592,12 @@ start - line115 + line127 col3 file0 - line115 + line127 col16 file0 @@ -605,12 +605,12 @@ end - line116 + line128 col3 file0 - line116 + line128 col14 file0 @@ -622,7 +622,7 @@ kindevent location - line116 + line128 col3 file0 @@ -630,12 +630,12 @@ - line116 + line128 col16 file0 - line116 + line128 col20 file0 @@ -659,7 +659,7 @@ issue_hash_function_offset2 location - line116 + line128 col3 file0 @@ -667,9 +667,9 @@ 0 - 114 - 115 - 116 + 126 + 127 + 128 @@ -684,12 +684,12 @@ start - line125 + line137 col3 file0 - line125 + line137 col6 file0 @@ -697,12 +697,12 @@ end - line125 + line137 col15 file0 - line125 + line137 col20 file0 @@ -714,7 +714,7 @@ kindevent location - line125 + line137 col15 file0 @@ -722,12 +722,12 @@ - line125 + line137 col22 file0 - line125 + line137 col22 file0 @@ -751,7 +751,7 @@ issue_hash_function_offset1 location - line125 + line137 col15 file0 @@ -759,8 +759,8 @@ 0 - 124 - 125 + 136 + 137 @@ -775,12 +775,12 @@ start - line137 + line149 col3 file0 - line137 + line149 col6 file0 @@ -788,12 +788,12 @@ end - line137 + line149 col15 file0 - line137 + line149 col20 file0 @@ -805,7 +805,7 @@ kindevent location - line137 + line149 col15 file0 @@ -813,12 +813,12 @@ - line137 + line149 col22 file0 - line137 + line149 col22 file0 @@ -842,7 +842,7 @@ issue_hash_function_offset1 location - line137 + line149 col15 file0 @@ -850,8 +850,8 @@ 0 - 136 - 137 + 148 + 149 @@ -866,12 +866,12 @@ start - line143 + line155 col3 file0 - line143 + line155 col6 file0 @@ -879,12 +879,12 @@ end - line143 + line155 col15 file0 - line143 + line155 col20 file0 @@ -896,7 +896,7 @@ kindevent location - line143 + line155 col15 file0 @@ -904,12 +904,12 @@ - line143 + line155 col26 file0 - line143 + line155 col26 file0 @@ -933,7 +933,7 @@ issue_hash_function_offset1 location - line143 + line155 col15 file0 @@ -941,8 +941,8 @@ 0 - 142 - 143 + 154 + 155 @@ -957,12 +957,12 @@ start - line155 + line167 col3 file0 - line155 + line167 col6 file0 @@ -970,12 +970,12 @@ end - line155 + line167 col15 file0 - line155 + line167 col21 file0 @@ -987,7 +987,7 @@ kindevent location - line155 + line167 col15 file0 @@ -995,12 +995,12 @@ - line155 + line167 col28 file0 - line155 + line167 col28 file0 @@ -1024,7 +1024,7 @@ issue_hash_function_offset1 location - line155 + line167 col15 file0 @@ -1032,8 +1032,8 @@ 0 - 154 - 155 + 166 + 167 @@ -1048,12 +1048,12 @@ start - line161 + line173 col3 file0 - line161 + line173 col6 file0 @@ -1061,12 +1061,12 @@ end - line161 + line173 col15 file0 - line161 + line173 col22 file0 @@ -1078,7 +1078,7 @@ kindevent location - line161 + line173 col15 file0 @@ -1086,12 +1086,12 @@ - line161 + line173 col29 file0 - line161 + line173 col29 file0 @@ -1115,7 +1115,7 @@ issue_hash_function_offset1 location - line161 + line173 col15 file0 @@ -1123,8 +1123,8 @@ 0 - 160 - 161 + 172 + 173 @@ -1139,12 +1139,12 @@ start - line179 + line191 col3 file0 - line179 + line191 col6 file0 @@ -1152,12 +1152,12 @@ end - line179 + line191 col15 file0 - line179 + line191 col20 file0 @@ -1169,7 +1169,7 @@ kindevent location - line179 + line191 col15 file0 @@ -1177,12 +1177,12 @@ - line179 + line191 col22 file0 - line179 + line191 col22 file0 @@ -1206,7 +1206,7 @@ issue_hash_function_offset1 location - line179 + line191 col15 file0 @@ -1214,8 +1214,8 @@ 0 - 178 - 179 + 190 + 191 @@ -1230,12 +1230,12 @@ start - line191 + line203 col3 file0 - line191 + line203 col6 file0 @@ -1243,12 +1243,12 @@ end - line191 + line203 col16 file0 - line191 + line203 col31 file0 @@ -1260,7 +1260,7 @@ kindevent location - line191 + line203 col16 file0 @@ -1268,12 +1268,12 @@ - line191 + line203 col33 file0 - line191 + line203 col33 file0 @@ -1297,7 +1297,7 @@ issue_hash_function_offset1 location - line191 + line203 col16 file0 @@ -1305,8 +1305,8 @@ 0 - 190 - 191 + 202 + 203 @@ -1321,12 +1321,12 @@ start - line203 + line215 col3 file0 - line203 + line215 col6 file0 @@ -1334,12 +1334,12 @@ end - line203 + line215 col15 file0 - line203 + line215 col20 file0 @@ -1351,7 +1351,7 @@ kindevent location - line203 + line215 col15 file0 @@ -1359,12 +1359,12 @@ - line203 + line215 col22 file0 - line203 + line215 col22 file0 @@ -1388,7 +1388,7 @@ issue_hash_function_offset1 location - line203 + line215 col15 file0 @@ -1396,8 +1396,8 @@ 0 - 202 - 203 + 214 + 215 @@ -1412,12 +1412,12 @@ start - line216 + line228 col3 file0 - line216 + line228 col17 file0 @@ -1425,12 +1425,12 @@ end - line217 + line229 col3 file0 - line217 + line229 col15 file0 @@ -1442,7 +1442,7 @@ kindevent location - line217 + line229 col3 file0 @@ -1450,12 +1450,12 @@ - line217 + line229 col17 file0 - line217 + line229 col21 file0 @@ -1479,7 +1479,7 @@ issue_hash_function_offset2 location - line217 + line229 col3 file0 @@ -1487,9 +1487,9 @@ 0 - 215 - 216 - 217 + 227 + 228 + 229 @@ -1500,7 +1500,7 @@ kindevent location - line222 + line234 col3 file0 @@ -1508,12 +1508,12 @@ - line222 + line234 col3 file0 - line222 + line234 col8 file0 @@ -1533,12 +1533,12 @@ start - line222 + line234 col3 file0 - line222 + line234 col5 file0 @@ -1546,12 +1546,12 @@ end - line223 + line235 col3 file0 - line223 + line235 col15 file0 @@ -1567,12 +1567,12 @@ start - line223 + line235 col3 file0 - line223 + line235 col15 file0 @@ -1580,12 +1580,12 @@ end - line223 + line235 col24 file0 - line223 + line235 col24 file0 @@ -1597,7 +1597,7 @@ kindevent location - line223 + line235 col24 file0 @@ -1605,12 +1605,12 @@ - line223 + line235 col24 file0 - line227 + line239 col3 file0 @@ -1630,12 +1630,12 @@ start - line223 + line235 col24 file0 - line223 + line235 col24 file0 @@ -1643,12 +1643,12 @@ end - line223 + line235 col3 file0 - line223 + line235 col15 file0 @@ -1660,7 +1660,7 @@ kindevent location - line223 + line235 col3 file0 @@ -1668,12 +1668,12 @@ - line223 + line235 col3 file0 - line227 + line239 col4 file0 @@ -1689,7 +1689,7 @@ kindevent location - line223 + line235 col3 file0 @@ -1697,12 +1697,12 @@ - line223 + line235 col3 file0 - line227 + line239 col4 file0 @@ -1718,7 +1718,7 @@ kindevent location - line223 + line235 col24 file0 @@ -1736,12 +1736,12 @@ start - line223 + line235 col24 file0 - line223 + line235 col24 file0 @@ -1749,12 +1749,12 @@ end - line224 + line236 col4 file0 - line224 + line236 col5 file0 @@ -1770,12 +1770,12 @@ start - line224 + line236 col4 file0 - line224 + line236 col5 file0 @@ -1783,12 +1783,12 @@ end - line224 + line236 col8 file0 - line224 + line236 col8 file0 @@ -1800,7 +1800,7 @@ kindevent location - line224 + line236 col8 file0 @@ -1808,12 +1808,12 @@ - line224 + line236 col8 file0 - line224 + line236 col8 file0 @@ -1833,12 +1833,12 @@ start - line224 + line236 col8 file0 - line224 + line236 col8 file0 @@ -1846,12 +1846,12 @@ end - line225 + line237 col3 file0 - line225 + line237 col3 file0 @@ -1867,12 +1867,12 @@ start - line225 + line237 col3 file0 - line225 + line237 col3 file0 @@ -1880,12 +1880,12 @@ end - line225 + line237 col6 file0 - line225 + line237 col6 file0 @@ -1897,7 +1897,7 @@ kindevent location - line225 + line237 col6 file0 @@ -1905,12 +1905,12 @@ - line225 + line237 col4 file0 - line225 + line237 col4 file0 @@ -1931,7 +1931,7 @@ issue_hash_content_of_line_in_context5d3f4c433004c7a6d4a06aa30cc3ea85 location - line225 + line237 col6 file0 @@ -1940,11 +1940,11 @@ 0 40 - 221 - 222 - 223 - 224 - 225 + 233 + 234 + 235 + 236 + 237 @@ -1959,12 +1959,12 @@ start - line232 + line244 col3 file0 - line232 + line244 col8 file0 @@ -1972,12 +1972,12 @@ end - line233 + line245 col3 file0 - line233 + line245 col5 file0 @@ -1989,7 +1989,7 @@ kindevent location - line233 + line245 col3 file0 @@ -1997,12 +1997,12 @@ - line233 + line245 col3 file0 - line233 + line245 col8 file0 @@ -2022,12 +2022,12 @@ start - line233 + line245 col3 file0 - line233 + line245 col5 file0 @@ -2035,12 +2035,12 @@ end - line234 + line246 col3 file0 - line234 + line246 col15 file0 @@ -2056,12 +2056,12 @@ start - line234 + line246 col3 file0 - line234 + line246 col15 file0 @@ -2069,12 +2069,12 @@ end - line234 + line246 col24 file0 - line234 + line246 col24 file0 @@ -2086,7 +2086,7 @@ kindevent location - line234 + line246 col24 file0 @@ -2094,12 +2094,12 @@ - line234 + line246 col24 file0 - line236 + line248 col3 file0 @@ -2119,12 +2119,12 @@ start - line234 + line246 col24 file0 - line234 + line246 col24 file0 @@ -2132,12 +2132,12 @@ end - line234 + line246 col3 file0 - line234 + line246 col15 file0 @@ -2149,7 +2149,7 @@ kindevent location - line234 + line246 col3 file0 @@ -2157,12 +2157,12 @@ - line234 + line246 col3 file0 - line236 + line248 col4 file0 @@ -2318,7 +2318,7 @@ kindevent location - line234 + line246 col24 file0 @@ -2336,12 +2336,12 @@ start - line234 + line246 col24 file0 - line234 + line246 col24 file0 @@ -2349,12 +2349,12 @@ end - line235 + line247 col4 file0 - line235 + line247 col4 file0 @@ -2370,12 +2370,12 @@ start - line235 + line247 col4 file0 - line235 + line247 col4 file0 @@ -2383,12 +2383,12 @@ end - line235 + line247 col7 file0 - line235 + line247 col7 file0 @@ -2400,7 +2400,7 @@ kindevent location - line235 + line247 col7 file0 @@ -2408,12 +2408,12 @@ - line235 + line247 col5 file0 - line235 + line247 col5 file0 @@ -2434,7 +2434,7 @@ issue_hash_content_of_line_in_context265c4fd608dafee211bfa93d21c28866 location - line235 + line247 col7 file0 @@ -2457,11 +2457,11 @@ 59 60 61 - 231 - 232 - 233 - 234 - 235 + 243 + 244 + 245 + 246 + 247 @@ -2476,12 +2476,12 @@ start - line241 + line253 col3 file0 - line241 + line253 col8 file0 @@ -2489,12 +2489,12 @@ end - line243 + line255 col3 file0 - line243 + line255 col15 file0 @@ -2506,7 +2506,7 @@ kindevent location - line243 + line255 col3 file0 @@ -2514,12 +2514,12 @@ - line243 + line255 col3 file0 - line245 + line257 col4 file0 @@ -2675,7 +2675,7 @@ kindevent location - line243 + line255 col24 file0 @@ -2693,12 +2693,12 @@ start - line243 + line255 col24 file0 - line243 + line255 col24 file0 @@ -2706,12 +2706,12 @@ end - line244 + line256 col7 file0 - line244 + line256 col7 file0 @@ -2723,7 +2723,7 @@ kindevent location - line244 + line256 col7 file0 @@ -2731,12 +2731,12 @@ - line244 + line256 col7 file0 - line244 + line256 col11 file0 @@ -2844,7 +2844,7 @@ kindevent location - line243 + line255 col3 file0 @@ -2852,12 +2852,12 @@ - line243 + line255 col3 file0 - line245 + line257 col4 file0 @@ -2877,12 +2877,12 @@ start - line243 + line255 col3 file0 - line243 + line255 col15 file0 @@ -2890,12 +2890,12 @@ end - line247 + line259 col3 file0 - line247 + line259 col3 file0 @@ -2911,12 +2911,12 @@ start - line247 + line259 col3 file0 - line247 + line259 col3 file0 @@ -2924,12 +2924,12 @@ end - line247 + line259 col6 file0 - line247 + line259 col6 file0 @@ -2941,7 +2941,7 @@ kindevent location - line247 + line259 col6 file0 @@ -2949,12 +2949,12 @@ - line247 + line259 col4 file0 - line247 + line259 col4 file0 @@ -2978,7 +2978,7 @@ issue_hash_function_offset7 location - line247 + line259 col6 file0 @@ -3002,12 +3002,1091 @@ 60 61 65 - 240 - 241 - 242 - 243 - 244 - 247 + 252 + 253 + 254 + 255 + 256 + 259 + + + + + path + + + kindevent + location + + line264 + col3 + file0 + + ranges + + + + line264 + col18 + file0 + + + line264 + col21 + file0 + + + + depth0 + extended_message + The result of passing a null pointer to the pointer conversion specifier of the printf family of functions is implementation defined + message + The result of passing a null pointer to the pointer conversion specifier of the printf family of functions is implementation defined + + + descriptionThe result of passing a null pointer to the pointer conversion specifier of the printf family of functions is implementation defined + categoryUnix API + typePassing a null pointer to the pointer conversion specifier of the printf family of functions + check_nameoptin.portabilityMinor.UnixAPI + + issue_hash_content_of_line_in_contextdb94ddef9279d52c58cc50cec30cd2af + issue_context_kindfunction + issue_contexttest_printf_family_pointer_conversion_specifier_null + issue_hash_function_offset1 + location + + line264 + col3 + file0 + + ExecutedLines + + 0 + + 263 + 264 + + + + + path + + + kindcontrol + edges + + + start + + + line264 + col3 + file0 + + + line264 + col8 + file0 + + + end + + + line265 + col3 + file0 + + + line265 + col9 + file0 + + + + + + + kindevent + location + + line265 + col3 + file0 + + ranges + + + + line265 + col25 + file0 + + + line265 + col28 + file0 + + + + depth0 + extended_message + The result of passing a null pointer to the pointer conversion specifier of the printf family of functions is implementation defined + message + The result of passing a null pointer to the pointer conversion specifier of the printf family of functions is implementation defined + + + descriptionThe result of passing a null pointer to the pointer conversion specifier of the printf family of functions is implementation defined + categoryUnix API + typePassing a null pointer to the pointer conversion specifier of the printf family of functions + check_nameoptin.portabilityMinor.UnixAPI + + issue_hash_content_of_line_in_context576efe98089160335d4a3bcd10b1b181 + issue_context_kindfunction + issue_contexttest_printf_family_pointer_conversion_specifier_null + issue_hash_function_offset2 + location + + line265 + col3 + file0 + + ExecutedLines + + 0 + + 263 + 264 + 265 + + + + + path + + + kindcontrol + edges + + + start + + + line264 + col3 + file0 + + + line264 + col8 + file0 + + + end + + + line266 + col3 + file0 + + + line266 + col9 + file0 + + + + + + + kindevent + location + + line266 + col3 + file0 + + ranges + + + + line266 + col24 + file0 + + + line266 + col27 + file0 + + + + depth0 + extended_message + The result of passing a null pointer to the pointer conversion specifier of the printf family of functions is implementation defined + message + The result of passing a null pointer to the pointer conversion specifier of the printf family of functions is implementation defined + + + descriptionThe result of passing a null pointer to the pointer conversion specifier of the printf family of functions is implementation defined + categoryUnix API + typePassing a null pointer to the pointer conversion specifier of the printf family of functions + check_nameoptin.portabilityMinor.UnixAPI + + issue_hash_content_of_line_in_contextad6749525605b28b32e53acc8b1e18b9 + issue_context_kindfunction + issue_contexttest_printf_family_pointer_conversion_specifier_null + issue_hash_function_offset3 + location + + line266 + col3 + file0 + + ExecutedLines + + 0 + + 263 + 264 + 265 + 266 + + + + + path + + + kindcontrol + edges + + + start + + + line264 + col3 + file0 + + + line264 + col8 + file0 + + + end + + + line267 + col3 + file0 + + + line267 + col10 + file0 + + + + + + + kindevent + location + + line267 + col3 + file0 + + ranges + + + + line267 + col35 + file0 + + + line267 + col38 + file0 + + + + depth0 + extended_message + The result of passing a null pointer to the pointer conversion specifier of the printf family of functions is implementation defined + message + The result of passing a null pointer to the pointer conversion specifier of the printf family of functions is implementation defined + + + descriptionThe result of passing a null pointer to the pointer conversion specifier of the printf family of functions is implementation defined + categoryUnix API + typePassing a null pointer to the pointer conversion specifier of the printf family of functions + check_nameoptin.portabilityMinor.UnixAPI + + issue_hash_content_of_line_in_context54fb0a45df1429bd887168e981f3e75f + issue_context_kindfunction + issue_contexttest_printf_family_pointer_conversion_specifier_null + issue_hash_function_offset4 + location + + line267 + col3 + file0 + + ExecutedLines + + 0 + + 263 + 264 + 265 + 266 + 267 + + + + + path + + + kindevent + location + + line272 + col3 + file0 + + ranges + + + + line272 + col18 + file0 + + + line272 + col21 + file0 + + + + depth0 + extended_message + The result of passing a null pointer to the pointer conversion specifier of the printf family of functions is implementation defined + message + The result of passing a null pointer to the pointer conversion specifier of the printf family of functions is implementation defined + + + descriptionThe result of passing a null pointer to the pointer conversion specifier of the printf family of functions is implementation defined + categoryUnix API + typePassing a null pointer to the pointer conversion specifier of the printf family of functions + check_nameoptin.portabilityMinor.UnixAPI + + issue_hash_content_of_line_in_contextf48edcbad59cb35eb96d9f91e45b5ee2 + issue_context_kindfunction + issue_contexttest_printf_pointer_conversion_specifier_null_various_arguments + issue_hash_function_offset1 + location + + line272 + col3 + file0 + + ExecutedLines + + 0 + + 271 + 272 + + + + + path + + + kindcontrol + edges + + + start + + + line272 + col3 + file0 + + + line272 + col8 + file0 + + + end + + + line273 + col3 + file0 + + + line273 + col8 + file0 + + + + + + + kindevent + location + + line273 + col3 + file0 + + ranges + + + + line273 + col21 + file0 + + + line273 + col24 + file0 + + + + depth0 + extended_message + The result of passing a null pointer to the pointer conversion specifier of the printf family of functions is implementation defined + message + The result of passing a null pointer to the pointer conversion specifier of the printf family of functions is implementation defined + + + descriptionThe result of passing a null pointer to the pointer conversion specifier of the printf family of functions is implementation defined + categoryUnix API + typePassing a null pointer to the pointer conversion specifier of the printf family of functions + check_nameoptin.portabilityMinor.UnixAPI + + issue_hash_content_of_line_in_context2c8f205bfd645b95e654822583484bbc + issue_context_kindfunction + issue_contexttest_printf_pointer_conversion_specifier_null_various_arguments + issue_hash_function_offset2 + location + + line273 + col3 + file0 + + ExecutedLines + + 0 + + 271 + 272 + 273 + + + + + path + + + kindcontrol + edges + + + start + + + line272 + col3 + file0 + + + line272 + col8 + file0 + + + end + + + line274 + col3 + file0 + + + line274 + col8 + file0 + + + + + + + kindevent + location + + line274 + col3 + file0 + + ranges + + + + line274 + col21 + file0 + + + line274 + col24 + file0 + + + + depth0 + extended_message + The result of passing a null pointer to the pointer conversion specifier of the printf family of functions is implementation defined + message + The result of passing a null pointer to the pointer conversion specifier of the printf family of functions is implementation defined + + + descriptionThe result of passing a null pointer to the pointer conversion specifier of the printf family of functions is implementation defined + categoryUnix API + typePassing a null pointer to the pointer conversion specifier of the printf family of functions + check_nameoptin.portabilityMinor.UnixAPI + + issue_hash_content_of_line_in_contextb30cf691d57223d55a8659a6d0f15ea4 + issue_context_kindfunction + issue_contexttest_printf_pointer_conversion_specifier_null_various_arguments + issue_hash_function_offset3 + location + + line274 + col3 + file0 + + ExecutedLines + + 0 + + 271 + 272 + 273 + 274 + + + + + path + + + kindcontrol + edges + + + start + + + line272 + col3 + file0 + + + line272 + col8 + file0 + + + end + + + line275 + col3 + file0 + + + line275 + col8 + file0 + + + + + + + kindevent + location + + line275 + col3 + file0 + + ranges + + + + line275 + col18 + file0 + + + line275 + col21 + file0 + + + + depth0 + extended_message + The result of passing a null pointer to the pointer conversion specifier of the printf family of functions is implementation defined + message + The result of passing a null pointer to the pointer conversion specifier of the printf family of functions is implementation defined + + + descriptionThe result of passing a null pointer to the pointer conversion specifier of the printf family of functions is implementation defined + categoryUnix API + typePassing a null pointer to the pointer conversion specifier of the printf family of functions + check_nameoptin.portabilityMinor.UnixAPI + + issue_hash_content_of_line_in_context16c983c9812d1806a931464062665c99 + issue_context_kindfunction + issue_contexttest_printf_pointer_conversion_specifier_null_various_arguments + issue_hash_function_offset4 + location + + line275 + col3 + file0 + + ExecutedLines + + 0 + + 271 + 272 + 273 + 274 + 275 + + + + + path + + + kindcontrol + edges + + + start + + + line272 + col3 + file0 + + + line272 + col8 + file0 + + + end + + + line276 + col3 + file0 + + + line276 + col8 + file0 + + + + + + + kindevent + location + + line276 + col3 + file0 + + ranges + + + + line276 + col18 + file0 + + + line276 + col21 + file0 + + + + depth0 + extended_message + The result of passing a null pointer to the pointer conversion specifier of the printf family of functions is implementation defined + message + The result of passing a null pointer to the pointer conversion specifier of the printf family of functions is implementation defined + + + descriptionThe result of passing a null pointer to the pointer conversion specifier of the printf family of functions is implementation defined + categoryUnix API + typePassing a null pointer to the pointer conversion specifier of the printf family of functions + check_nameoptin.portabilityMinor.UnixAPI + + issue_hash_content_of_line_in_context7ee86631018956410c3010d7d3583032 + issue_context_kindfunction + issue_contexttest_printf_pointer_conversion_specifier_null_various_arguments + issue_hash_function_offset5 + location + + line276 + col3 + file0 + + ExecutedLines + + 0 + + 271 + 272 + 273 + 274 + 275 + 276 + + + + + path + + + kindevent + location + + line282 + col3 + file0 + + ranges + + + + line282 + col3 + file0 + + + line282 + col16 + file0 + + + + depth0 + extended_message + 'pointer2' initialized to a null pointer value + message + 'pointer2' initialized to a null pointer value + + + kindcontrol + edges + + + start + + + line282 + col3 + file0 + + + line282 + col6 + file0 + + + end + + + line283 + col3 + file0 + + + line283 + col8 + file0 + + + + + + + kindevent + location + + line283 + col3 + file0 + + ranges + + + + line283 + col18 + file0 + + + line283 + col25 + file0 + + + + depth0 + extended_message + The result of passing a null pointer to the pointer conversion specifier of the printf family of functions is implementation defined + message + The result of passing a null pointer to the pointer conversion specifier of the printf family of functions is implementation defined + + + descriptionThe result of passing a null pointer to the pointer conversion specifier of the printf family of functions is implementation defined + categoryUnix API + typePassing a null pointer to the pointer conversion specifier of the printf family of functions + check_nameoptin.portabilityMinor.UnixAPI + + issue_hash_content_of_line_in_context980fc6a365f71e954883763d651b1879 + issue_context_kindfunction + issue_contextprintf_pointer_conversion_specifier_null_pointer_constraint + issue_hash_function_offset2 + location + + line283 + col3 + file0 + + ExecutedLines + + 0 + + 281 + 282 + 283 + + + + + path + + + kindcontrol + edges + + + start + + + line282 + col3 + file0 + + + line282 + col6 + file0 + + + end + + + line284 + col3 + file0 + + + line284 + col4 + file0 + + + + + + + kindcontrol + edges + + + start + + + line284 + col3 + file0 + + + line284 + col4 + file0 + + + end + + + line284 + col7 + file0 + + + line284 + col14 + file0 + + + + + + + kindevent + location + + line284 + col7 + file0 + + ranges + + + + line284 + col7 + file0 + + + line284 + col22 + file0 + + + + depth0 + extended_message + Assuming 'pointer1' is equal to NULL + message + Assuming 'pointer1' is equal to NULL + + + kindcontrol + edges + + + start + + + line284 + col7 + file0 + + + line284 + col14 + file0 + + + end + + + line288 + col3 + file0 + + + line288 + col8 + file0 + + + + + + + kindevent + location + + line288 + col3 + file0 + + ranges + + + + line288 + col18 + file0 + + + line288 + col25 + file0 + + + + depth0 + extended_message + The result of passing a null pointer to the pointer conversion specifier of the printf family of functions is implementation defined + message + The result of passing a null pointer to the pointer conversion specifier of the printf family of functions is implementation defined + + + descriptionThe result of passing a null pointer to the pointer conversion specifier of the printf family of functions is implementation defined + categoryUnix API + typePassing a null pointer to the pointer conversion specifier of the printf family of functions + check_nameoptin.portabilityMinor.UnixAPI + + issue_hash_content_of_line_in_contextbf97b4481244b16eb8e34e9ce629c3a6 + issue_context_kindfunction + issue_contextprintf_pointer_conversion_specifier_null_pointer_constraint + issue_hash_function_offset7 + location + + line288 + col3 + file0 + + ExecutedLines + + 0 + + 281 + 282 + 283 + 284 + 288 diff --git a/clang/test/Analysis/unix-fns.c b/clang/test/Analysis/unix-fns.c --- a/clang/test/Analysis/unix-fns.c +++ b/clang/test/Analysis/unix-fns.c @@ -1,4 +1,4 @@ -// RUN: %clang_analyze_cc1 -triple x86_64-apple-darwin10 -analyzer-checker=core,unix.API,osx.API,optin.portability %s -analyzer-output=plist -analyzer-config faux-bodies=true -fblocks -verify -o %t.plist +// RUN: %clang_analyze_cc1 -triple x86_64-apple-darwin10 -analyzer-checker=core,unix.API,osx.API,optin.portability,optin.portabilityMinor %s -analyzer-output=plist -analyzer-config faux-bodies=true -fblocks -verify -o %t.plist // RUN: %normalize_plist <%t.plist | diff -ub %S/Inputs/expected-plists/unix-fns.c.plist - // RUN: mkdir -p %t.dir // RUN: %clang_analyze_cc1 -analyzer-checker=core,unix.API,osx.API,optin.portability -analyzer-output=html -analyzer-config faux-bodies=true -fblocks -o %t.dir %s @@ -78,6 +78,18 @@ int openat(int, const char *, int, ...); int close(int fildes); +#ifndef NULL +#define NULL ((void*) 0) +#endif + +struct FILE_t; +typedef struct FILE_t FILE; + +int printf( const char *, ... ); +int fprintf(FILE *, const char *, ...); +int sprintf(char *, const char *, ...); +int snprintf(char *, size_t, const char *, ...); + void test_open(const char *path) { int fd; fd = open(path, O_RDONLY); // no-warning @@ -246,3 +258,32 @@ *p = 7; // expected-warning {{Dereference of null pointer (loaded from variable 'p')}} } + +// Test basic case for the whole print family. +void test_printf_family_pointer_conversion_specifier_null(FILE *file, char *buf, size_t buf_size, char *format) { + printf(format, NULL); // expected-warning{{The result of passing a null pointer to the pointer conversion specifier of the printf family of functions is implementation defined}} + fprintf(file, format, NULL); // expected-warning{{The result of passing a null pointer to the pointer conversion specifier of the printf family of functions is implementation defined}} + sprintf(buf, format, NULL); // expected-warning{{The result of passing a null pointer to the pointer conversion specifier of the printf family of functions is implementation defined}} + snprintf(buf, buf_size, format, NULL); // expected-warning{{The result of passing a null pointer to the pointer conversion specifier of the printf family of functions is implementation defined}} +} + +// Test various arguments. +void test_printf_pointer_conversion_specifier_null_various_arguments(char *format) { + printf(format, NULL); // expected-warning{{The result of passing a null pointer to the pointer conversion specifier of the printf family of functions is implementation defined}} + printf(format, 1, NULL); // expected-warning{{The result of passing a null pointer to the pointer conversion specifier of the printf family of functions is implementation defined}} + printf(format, 1, NULL, 2); // expected-warning{{The result of passing a null pointer to the pointer conversion specifier of the printf family of functions is implementation defined}} + printf(format, NULL, NULL); // expected-warning{{The result of passing a null pointer to the pointer conversion specifier of the printf family of functions is implementation defined}} + printf(format, NULL, 1, NULL); // expected-warning{{The result of passing a null pointer to the pointer conversion specifier of the printf family of functions is implementation defined}} + printf(format, 0); // no-warning +} + +// Test pointer constraint. +void printf_pointer_conversion_specifier_null_pointer_constraint(char *format, void *pointer1) { + void *pointer2 = NULL; + printf(format, pointer2); // expected-warning{{The result of passing a null pointer to the pointer conversion specifier of the printf family of functions is implementation defined}} + if (pointer1 != NULL) { + printf(format, pointer1); // no-warning + return; + } + printf(format, pointer1); // expected-warning{{The result of passing a null pointer to the pointer conversion specifier of the printf family of functions is implementation defined}} +}