Index: clang/include/clang/StaticAnalyzer/Checkers/Checkers.td =================================================================== --- clang/include/clang/StaticAnalyzer/Checkers/Checkers.td +++ clang/include/clang/StaticAnalyzer/Checkers/Checkers.td @@ -274,6 +274,10 @@ let ParentPackage = APIModeling in { +def CastValueChecker : Checker<"CastValue">, + HelpText<"Model casts">, + Documentation; + def ReturnValueChecker : Checker<"ReturnValue">, HelpText<"Model the guaranteed boolean return value of function calls">, Documentation; Index: clang/lib/StaticAnalyzer/Checkers/CMakeLists.txt =================================================================== --- clang/lib/StaticAnalyzer/Checkers/CMakeLists.txt +++ clang/lib/StaticAnalyzer/Checkers/CMakeLists.txt @@ -16,6 +16,7 @@ CallAndMessageChecker.cpp CastSizeChecker.cpp CastToStructChecker.cpp + CastValueChecker.cpp CheckObjCDealloc.cpp CheckObjCInstMethSignature.cpp CheckSecuritySyntaxOnly.cpp Index: clang/lib/StaticAnalyzer/Checkers/CastValueChecker.cpp =================================================================== --- /dev/null +++ clang/lib/StaticAnalyzer/Checkers/CastValueChecker.cpp @@ -0,0 +1,192 @@ +//===- CastValueChecker - Applies casts -------------------------*- C++ -*-===// +// +// Part of the LLVM Project, under the Apache License v2.0 with LLVM Exceptions. +// See https://llvm.org/LICENSE.txt for license information. +// SPDX-License-Identifier: Apache-2.0 WITH LLVM-exception +// +//===----------------------------------------------------------------------===// +// +// This defines CastValueChecker which models casts. +// +//===----------------------------------------------------------------------===// + +#include "clang/StaticAnalyzer/Checkers/BuiltinCheckerRegistration.h" +#include "clang/StaticAnalyzer/Core/Checker.h" +#include "clang/StaticAnalyzer/Core/CheckerManager.h" +#include "clang/StaticAnalyzer/Core/PathSensitive/CallEvent.h" +#include "clang/StaticAnalyzer/Core/PathSensitive/CheckerContext.h" +#include "llvm/ADT/Optional.h" + +using namespace clang; +using namespace ento; + +namespace { +class CastValueChecker : public Checker { + using CastCheck = + std::function; + +public: + // We have three cases to evaluate a cast: + // 1) The parameter is non-null, the return value is non-null + // 2) The parameter is non-null, the return value is null + // 3) The parameter is null, the return value is null + // + // cast: 1; dyn_cast: 1, 2; cast_or_null: 1, 3; dyn_cast_or_null: 1, 2, 3. + bool evalCall(const CallEvent &Call, CheckerContext &C) const; + +private: + const CallDescriptionMap CDM = { + {{{"cast"}}, &CastValueChecker::evalCast}, + {{{"dyn_cast"}}, &CastValueChecker::evalDynCast}, + {{{"cast_or_null"}}, &CastValueChecker::evalCastOrNull}, + {{{"dyn_cast_or_null"}}, &CastValueChecker::evalDynCastOrNull}}; + + void evalCast(const CallExpr *CE, DefinedOrUnknownSVal ParamDV, + CheckerContext &C) const; + void evalDynCast(const CallExpr *CE, DefinedOrUnknownSVal ParamDV, + CheckerContext &C) const; + void evalCastOrNull(const CallExpr *CE, DefinedOrUnknownSVal ParamDV, + CheckerContext &C) const; + void evalDynCastOrNull(const CallExpr *CE, DefinedOrUnknownSVal ParamDV, + CheckerContext &C) const; +}; +} // namespace + +static void evalNonNullParamNonNullReturn(const CallExpr *CE, + DefinedOrUnknownSVal ParamDV, + CheckerContext &C) { + ProgramStateRef State = C.getState(); + if (!State->assume(ParamDV, true)) + return; + + State = State->assume(ParamDV, true); + State = State->BindExpr(CE, C.getLocationContext(), ParamDV, + /*Invalidate=*/false); + + std::string CastToName = CE->getType().getAsString(); + std::string CastFromName = CE->getArg(0)->getType().getAsString(); + + const NoteTag *CastTag = C.getNoteTag( + [CastToName, CastFromName](BugReport &) -> std::string { + SmallString<128> Msg; + llvm::raw_svector_ostream Out(Msg); + + Out << "Cast to '" << CastToName << "' (from '" << CastFromName << "')"; + return Out.str(); + }, + /*IsPrunable=*/false); + + C.addTransition(State, CastTag); +} + +static void evalNonNullParamNullReturn(const CallExpr *CE, + DefinedOrUnknownSVal ParamDV, + CheckerContext &C) { + ProgramStateRef State = C.getState(); + if (!State->assume(ParamDV, true)) + return; + + State = State->assume(ParamDV, true); + State = State->BindExpr(CE, C.getLocationContext(), + C.getSValBuilder().makeNull(), /*Invalidate=*/false); + + std::string CastToName = CE->getType().getAsString(); + const NoteTag *CastTag = C.getNoteTag( + [CastToName](BugReport &) -> std::string { + SmallString<128> Msg; + llvm::raw_svector_ostream Out(Msg); + + Out << "Cast to '" << CastToName << "' results in a null pointer"; + return Out.str(); + }, + /*IsPrunable=*/false); + + C.addTransition(State, CastTag); +} + +static void evalNullParamNullReturn(const CallExpr *CE, + DefinedOrUnknownSVal ParamDV, + CheckerContext &C) { + ProgramStateRef State = C.getState(); + if (!State->assume(ParamDV, false)) + return; + + State = State->assume(ParamDV, false); + State = State->BindExpr(CE, C.getLocationContext(), + C.getSValBuilder().makeNull(), /*Invalidate=*/false); + + const NoteTag *CastTag = C.getNoteTag( + [](BugReport &) -> std::string { + SmallString<128> Msg; + llvm::raw_svector_ostream Out(Msg); + + Out << "Cast from a null pointer results in a null pointer"; + return Out.str(); + }, + /*IsPrunable=*/false); + + C.addTransition(State, CastTag); +} + +void CastValueChecker::evalCast(const CallExpr *CE, + DefinedOrUnknownSVal ParamDV, + CheckerContext &C) const { + evalNonNullParamNonNullReturn(CE, ParamDV, C); +} + +void CastValueChecker::evalDynCast(const CallExpr *CE, + DefinedOrUnknownSVal ParamDV, + CheckerContext &C) const { + evalNonNullParamNonNullReturn(CE, ParamDV, C); + evalNonNullParamNullReturn(CE, ParamDV, C); +} + +void CastValueChecker::evalCastOrNull(const CallExpr *CE, + DefinedOrUnknownSVal ParamDV, + CheckerContext &C) const { + evalNonNullParamNonNullReturn(CE, ParamDV, C); + evalNullParamNullReturn(CE, ParamDV, C); +} + +void CastValueChecker::evalDynCastOrNull(const CallExpr *CE, + DefinedOrUnknownSVal ParamDV, + CheckerContext &C) const { + evalNonNullParamNonNullReturn(CE, ParamDV, C); + evalNonNullParamNullReturn(CE, ParamDV, C); + evalNullParamNullReturn(CE, ParamDV, C); +} + +bool CastValueChecker::evalCall(const CallEvent &Call, + CheckerContext &C) const { + const CastCheck *Check = CDM.lookup(Call); + if (!Check) + return false; + + const auto *CE = cast(Call.getOriginExpr()); + if (!CE) + return false; + + const Expr *Param = nullptr; + /* TODO: measure 'MCE'. + if (const auto *MCE = dyn_cast(CE->IgnoreParenImpCasts())) + Param = MCE->getImplicitObjectArgument(); + else*/ + Param = CE->getArg(0); + + SVal ParamV = C.getState()->getSVal(Param, C.getLocationContext()); + auto ParamDV = ParamV.getAs(); + if (!ParamDV) + return false; + + (*Check)(this, CE, *ParamDV, C); + return true; +} + +void ento::registerCastValueChecker(CheckerManager &Mgr) { + Mgr.registerChecker(); +} + +bool ento::shouldRegisterCastValueChecker(const LangOptions &LO) { + return true; +} Index: clang/test/Analysis/cast-value.cpp =================================================================== --- /dev/null +++ clang/test/Analysis/cast-value.cpp @@ -0,0 +1,40 @@ +// RUN: %clang_analyze_cc1 \ +// RUN: -analyzer-checker=core,apiModeling.CastValue \ +// RUN: -analyzer-output=text -verify %s + +template +const X *dyn_cast_or_null(Y Value); + +class Shape {}; +class Square : public Shape {}; +class Circle : public Shape {}; + +namespace test_dyn_cast_or_null { +void different_type(const Shape *C) { + if (const auto *Foo = dyn_cast_or_null(nullptr)) { + // expected-note@-1 {{Cast from a null pointer results in a null pointer}} + // expected-note@-2 {{'Foo' is null}} + // expected-note@-3 {{Taking false branch}} + (void)Foo; + } + + if (const auto *Bar = dyn_cast_or_null(C)) { + // expected-note@-1 {{Cast to 'const class Square *' results in a null pointer}} + // expected-note@-2 {{Assuming pointer value is null}} + // expected-note@-3 {{'Bar' is null}} + // expected-note@-4 {{Taking false branch}} + (void)Bar; + } + + if (const auto *Baz = dyn_cast_or_null(C)) { + // expected-note@-1 {{Cast to 'const class Circle *' (from 'const class Shape *')}} + // expected-note@-2 {{'Baz' initialized here}} + // expected-note@-3 {{'Baz' is non-null}} + // expected-note@-4 {{Taking true branch}} + (void)(1 / !Baz); + // expected-note@-1 {{'Baz' is non-null}} + // expected-note@-2 {{Division by zero}} + // expected-warning@-3 {{Division by zero}} + } +} +} // namespace test_dyn_cast_or_null