Index: clang/lib/StaticAnalyzer/Checkers/CallAndMessageChecker.cpp =================================================================== --- clang/lib/StaticAnalyzer/Checkers/CallAndMessageChecker.cpp +++ clang/lib/StaticAnalyzer/Checkers/CallAndMessageChecker.cpp @@ -20,9 +20,11 @@ #include "clang/StaticAnalyzer/Core/CheckerManager.h" #include "clang/StaticAnalyzer/Core/PathSensitive/CallEvent.h" #include "clang/StaticAnalyzer/Core/PathSensitive/CheckerContext.h" +#include "clang/StaticAnalyzer/Core/PathSensitive/ProgramState_Fwd.h" #include "llvm/ADT/SmallString.h" #include "llvm/ADT/StringExtras.h" #include "llvm/Support/Casting.h" +#include "llvm/Support/ErrorHandling.h" #include "llvm/Support/raw_ostream.h" using namespace clang; @@ -60,6 +62,25 @@ void checkPreCall(const CallEvent &Call, CheckerContext &C) const; + ProgramStateRef checkFunctionPointerCall(const CallExpr *CE, + CheckerContext &C, + ProgramStateRef State) const; + + ProgramStateRef checkCXXMethodCall(const CXXInstanceCall *CC, + CheckerContext &C, + ProgramStateRef State) const; + + ProgramStateRef checkParameterCount(const CallEvent &Call, CheckerContext &C, + ProgramStateRef State) const; + + ProgramStateRef checkCXXDeallocation(const CXXDeallocatorCall *DC, + CheckerContext &C, + ProgramStateRef State) const; + + ProgramStateRef checkArgInitializedness(const CallEvent &Call, + CheckerContext &C, + ProgramStateRef State) const; + private: bool PreVisitProcessArg(CheckerContext &C, SVal V, SourceRange ArgRange, const Expr *ArgEx, int ArgumentNumber, @@ -309,123 +330,131 @@ return false; } -void CallAndMessageChecker::checkPreCall(const CallEvent &Call, - CheckerContext &C) const { - ProgramStateRef State = C.getState(); - if (const CallExpr *CE = dyn_cast_or_null(Call.getOriginExpr())) { - const Expr *Callee = CE->getCallee()->IgnoreParens(); - const LocationContext *LCtx = C.getLocationContext(); - SVal L = State->getSVal(Callee, LCtx); - - if (L.isUndef()) { - if (!BT_call_undef) - BT_call_undef.reset(new BuiltinBug( - this, "Called function pointer is an uninitialized pointer value")); - emitBadCall(BT_call_undef.get(), C, Callee); - return; - } +ProgramStateRef CallAndMessageChecker::checkFunctionPointerCall( + const CallExpr *CE, CheckerContext &C, ProgramStateRef State) const { - ProgramStateRef StNonNull, StNull; - std::tie(StNonNull, StNull) = - State->assume(L.castAs()); + const Expr *Callee = CE->getCallee()->IgnoreParens(); + const LocationContext *LCtx = C.getLocationContext(); + SVal L = State->getSVal(Callee, LCtx); + + if (L.isUndef()) { + if (!BT_call_undef) + BT_call_undef.reset(new BuiltinBug( + this, "Called function pointer is an uninitialized pointer value")); + emitBadCall(BT_call_undef.get(), C, Callee); + return nullptr; + } - if (StNull && !StNonNull) { - if (!BT_call_null) - BT_call_null.reset(new BuiltinBug( - this, "Called function pointer is null (null dereference)")); - emitBadCall(BT_call_null.get(), C, Callee); - return; - } + ProgramStateRef StNonNull, StNull; + std::tie(StNonNull, StNull) = State->assume(L.castAs()); - State = StNonNull; + if (StNull && !StNonNull) { + if (!BT_call_null) + BT_call_null.reset(new BuiltinBug( + this, "Called function pointer is null (null dereference)")); + emitBadCall(BT_call_null.get(), C, Callee); + return nullptr; } - // If this is a call to a C++ method, check if the callee is null or - // undefined. - if (const CXXInstanceCall *CC = dyn_cast(&Call)) { - SVal V = CC->getCXXThisVal(); - if (V.isUndef()) { - if (!BT_cxx_call_undef) - BT_cxx_call_undef.reset( - new BuiltinBug(this, "Called C++ object pointer is uninitialized")); - emitBadCall(BT_cxx_call_undef.get(), C, CC->getCXXThisExpr()); - return; - } + return StNonNull; +} - ProgramStateRef StNonNull, StNull; - std::tie(StNonNull, StNull) = - State->assume(V.castAs()); +ProgramStateRef CallAndMessageChecker::checkParameterCount( + const CallEvent &Call, CheckerContext &C, ProgramStateRef State) const { - if (StNull && !StNonNull) { - if (!BT_cxx_call_null) - BT_cxx_call_null.reset( - new BuiltinBug(this, "Called C++ object pointer is null")); - emitBadCall(BT_cxx_call_null.get(), C, CC->getCXXThisExpr()); - return; - } + // If we have a function or block declaration, we can make sure we pass + // enough parameters. + unsigned Params = Call.parameters().size(); + if (Call.getNumArgs() >= Params) + return State; + + ExplodedNode *N = C.generateErrorNode(); + if (!N) + return nullptr; - State = StNonNull; + LazyInit_BT("Function call with too few arguments", BT_call_few_args); + + SmallString<512> Str; + llvm::raw_svector_ostream os(Str); + if (isa(Call)) { + os << "Function "; + } else { + assert(isa(Call)); + os << "Block "; } + os << "taking " << Params << " argument" << (Params == 1 ? "" : "s") + << " is called with fewer (" << Call.getNumArgs() << ")"; - const Decl *D = Call.getDecl(); - if (D && (isa(D) || isa(D))) { - // If we have a function or block declaration, we can make sure we pass - // enough parameters. - unsigned Params = Call.parameters().size(); - if (Call.getNumArgs() < Params) { - ExplodedNode *N = C.generateErrorNode(); - if (!N) - return; - - LazyInit_BT("Function call with too few arguments", BT_call_few_args); - - SmallString<512> Str; - llvm::raw_svector_ostream os(Str); - if (isa(D)) { - os << "Function "; - } else { - assert(isa(D)); - os << "Block "; - } - os << "taking " << Params << " argument" - << (Params == 1 ? "" : "s") << " is called with fewer (" - << Call.getNumArgs() << ")"; + C.emitReport( + std::make_unique(*BT_call_few_args, os.str(), N)); + return nullptr; +} - C.emitReport(std::make_unique(*BT_call_few_args, - os.str(), N)); - } +ProgramStateRef CallAndMessageChecker::checkCXXMethodCall( + const CXXInstanceCall *CC, CheckerContext &C, ProgramStateRef State) const { + + SVal V = CC->getCXXThisVal(); + if (V.isUndef()) { + if (!BT_cxx_call_undef) + BT_cxx_call_undef.reset( + new BuiltinBug(this, "Called C++ object pointer is uninitialized")); + emitBadCall(BT_cxx_call_undef.get(), C, CC->getCXXThisExpr()); + return nullptr; } - if (const auto *DC = dyn_cast(&Call)) { - const CXXDeleteExpr *DE = DC->getOriginExpr(); - assert(DE); - SVal Arg = C.getSVal(DE->getArgument()); - if (Arg.isUndef()) { - StringRef Desc; - ExplodedNode *N = C.generateErrorNode(); - if (!N) - return; - if (!BT_cxx_delete_undef) - BT_cxx_delete_undef.reset( - new BuiltinBug(this, "Uninitialized argument value")); - if (DE->isArrayFormAsWritten()) - Desc = "Argument to 'delete[]' is uninitialized"; - else - Desc = "Argument to 'delete' is uninitialized"; - BugType *BT = BT_cxx_delete_undef.get(); - auto R = std::make_unique(*BT, Desc, N); - bugreporter::trackExpressionValue(N, DE, *R); - C.emitReport(std::move(R)); - return; - } + ProgramStateRef StNonNull, StNull; + std::tie(StNonNull, StNull) = State->assume(V.castAs()); + + if (StNull && !StNonNull) { + if (!BT_cxx_call_null) + BT_cxx_call_null.reset( + new BuiltinBug(this, "Called C++ object pointer is null")); + emitBadCall(BT_cxx_call_null.get(), C, CC->getCXXThisExpr()); + return nullptr; } + return StNonNull; +} + +ProgramStateRef +CallAndMessageChecker::checkCXXDeallocation(const CXXDeallocatorCall *DC, + CheckerContext &C, + ProgramStateRef State) const { + const CXXDeleteExpr *DE = DC->getOriginExpr(); + assert(DE); + SVal Arg = C.getSVal(DE->getArgument()); + if (!Arg.isUndef()) + return State; + + StringRef Desc; + ExplodedNode *N = C.generateErrorNode(); + if (!N) + return nullptr; + if (!BT_cxx_delete_undef) + BT_cxx_delete_undef.reset( + new BuiltinBug(this, "Uninitialized argument value")); + if (DE->isArrayFormAsWritten()) + Desc = "Argument to 'delete[]' is uninitialized"; + else + Desc = "Argument to 'delete' is uninitialized"; + BugType *BT = BT_cxx_delete_undef.get(); + auto R = std::make_unique(*BT, Desc, N); + bugreporter::trackExpressionValue(N, DE, *R); + C.emitReport(std::move(R)); + return nullptr; +} + +ProgramStateRef CallAndMessageChecker::checkArgInitializedness( + const CallEvent &Call, CheckerContext &C, ProgramStateRef State) const { + + const Decl *D = Call.getDecl(); + // Don't check for uninitialized field values in arguments if the // caller has a body that is available and we have the chance to inline it. // This is a hack, but is a reasonable compromise betweens sometimes warning // and sometimes not depending on if we decide to inline a function. const bool checkUninitFields = - !(C.getAnalysisManager().shouldInlineCall() && (D && D->getBody())); + !(C.getAnalysisManager().shouldInlineCall() && (D && D->getBody())); std::unique_ptr *BT; if (isa(Call)) @@ -436,14 +465,48 @@ const FunctionDecl *FD = dyn_cast_or_null(D); for (unsigned i = 0, e = Call.getNumArgs(); i != e; ++i) { const ParmVarDecl *ParamDecl = nullptr; - if(FD && i < FD->getNumParams()) + if (FD && i < FD->getNumParams()) ParamDecl = FD->getParamDecl(i); if (PreVisitProcessArg(C, Call.getArgSVal(i), Call.getArgSourceRange(i), Call.getArgExpr(i), i, checkUninitFields, Call, *BT, ParamDecl)) + return nullptr; + } + return State; +} + +void CallAndMessageChecker::checkPreCall(const CallEvent &Call, + CheckerContext &C) const { + ProgramStateRef State = C.getState(); + if (isa(Call) || isa(Call)) { + + if (const CallExpr *CE = dyn_cast_or_null(Call.getOriginExpr())) + State = checkFunctionPointerCall(CE, C, State); + + if (!State) + return; + + if (Call.getDecl()) + State = checkParameterCount(Call, C, State); + + if (!State) + return; + + if (const auto *CC = dyn_cast(&Call)) + State = checkCXXMethodCall(CC, C, State); + + if (!State) + return; + + if (const auto *DC = dyn_cast(&Call)) + State = checkCXXDeallocation(DC, C, State); + + if (!State) return; } + State = checkArgInitializedness(Call, C, State); + // If we make it here, record our assumptions about the callee. C.addTransition(State); }