BasicObjCFoundationChecks.cpp revision 8bef8238181a30e52dea380789a7e2d760eac532
199c6ad3f22b865d0f4cce52bc36904403c9ed4c4Ted Kremenek//== BasicObjCFoundationChecks.cpp - Simple Apple-Foundation checks -*- C++ -*-- 299c6ad3f22b865d0f4cce52bc36904403c9ed4c4Ted Kremenek// 399c6ad3f22b865d0f4cce52bc36904403c9ed4c4Ted Kremenek// The LLVM Compiler Infrastructure 499c6ad3f22b865d0f4cce52bc36904403c9ed4c4Ted Kremenek// 599c6ad3f22b865d0f4cce52bc36904403c9ed4c4Ted Kremenek// This file is distributed under the University of Illinois Open Source 699c6ad3f22b865d0f4cce52bc36904403c9ed4c4Ted Kremenek// License. See LICENSE.TXT for details. 799c6ad3f22b865d0f4cce52bc36904403c9ed4c4Ted Kremenek// 899c6ad3f22b865d0f4cce52bc36904403c9ed4c4Ted Kremenek//===----------------------------------------------------------------------===// 999c6ad3f22b865d0f4cce52bc36904403c9ed4c4Ted Kremenek// 1099c6ad3f22b865d0f4cce52bc36904403c9ed4c4Ted Kremenek// This file defines BasicObjCFoundationChecks, a class that encapsulates 1199c6ad3f22b865d0f4cce52bc36904403c9ed4c4Ted Kremenek// a set of simple checks to run on Objective-C code using Apple's Foundation 1299c6ad3f22b865d0f4cce52bc36904403c9ed4c4Ted Kremenek// classes. 1399c6ad3f22b865d0f4cce52bc36904403c9ed4c4Ted Kremenek// 1499c6ad3f22b865d0f4cce52bc36904403c9ed4c4Ted Kremenek//===----------------------------------------------------------------------===// 1599c6ad3f22b865d0f4cce52bc36904403c9ed4c4Ted Kremenek 160b1ba6227c67d5e04b589ed8a08afa2345a40666Argyrios Kyrtzidis#include "ClangSACheckers.h" 17928c415d5dde89b7c01e41f0dfa8a782cbfa8e7dTed Kremenek#include "clang/Analysis/DomainSpecific/CocoaConventions.h" 18ec8605f1d7ec846dbf51047bfd5c56d32d1ff91cArgyrios Kyrtzidis#include "clang/StaticAnalyzer/Core/Checker.h" 19695fb502825a53ccd178ec1c85c77929d88acb71Argyrios Kyrtzidis#include "clang/StaticAnalyzer/Core/CheckerManager.h" 20983326f32c746f5e47161a73758e4d363263dd2cArgyrios Kyrtzidis#include "clang/StaticAnalyzer/Core/PathSensitive/CheckerContext.h" 219b663716449b618ba0390b1dbebc54fa8e971124Ted Kremenek#include "clang/StaticAnalyzer/Core/PathSensitive/ExplodedGraph.h" 229b663716449b618ba0390b1dbebc54fa8e971124Ted Kremenek#include "clang/StaticAnalyzer/Core/PathSensitive/ExprEngine.h" 23d1e5a89226da79f7e6f43d40facc46abda9e5245Jordy Rose#include "clang/StaticAnalyzer/Core/PathSensitive/ObjCMessage.h" 2418c66fdc3c4008d335885695fe36fb5353c5f672Ted Kremenek#include "clang/StaticAnalyzer/Core/PathSensitive/ProgramState.h" 259b663716449b618ba0390b1dbebc54fa8e971124Ted Kremenek#include "clang/StaticAnalyzer/Core/BugReporter/BugType.h" 269b663716449b618ba0390b1dbebc54fa8e971124Ted Kremenek#include "clang/StaticAnalyzer/Core/PathSensitive/MemRegion.h" 27c4a1dea2dc56bd1357ec91b829a0b9e68229a13eDaniel Dunbar#include "clang/AST/DeclObjC.h" 2899c6ad3f22b865d0f4cce52bc36904403c9ed4c4Ted Kremenek#include "clang/AST/Expr.h" 29f494b579b22f9950f5af021f0bf9879a91bb8b41Steve Naroff#include "clang/AST/ExprObjC.h" 3099c6ad3f22b865d0f4cce52bc36904403c9ed4c4Ted Kremenek#include "clang/AST/ASTContext.h" 3199c6ad3f22b865d0f4cce52bc36904403c9ed4c4Ted Kremenek 3299c6ad3f22b865d0f4cce52bc36904403c9ed4c4Ted Kremenekusing namespace clang; 339ef6537a894c33003359b1f9b9676e9178e028b7Ted Kremenekusing namespace ento; 34f1ae705460552655fe7275327804444c62e86baeTed Kremenek 352ce2baa81f1bdd5f1a2504bbf812d30f10e45bb5Ted Kremeneknamespace { 362ce2baa81f1bdd5f1a2504bbf812d30f10e45bb5Ted Kremenekclass APIMisuse : public BugType { 372ce2baa81f1bdd5f1a2504bbf812d30f10e45bb5Ted Kremenekpublic: 382ce2baa81f1bdd5f1a2504bbf812d30f10e45bb5Ted Kremenek APIMisuse(const char* name) : BugType(name, "API Misuse (Apple)") {} 392ce2baa81f1bdd5f1a2504bbf812d30f10e45bb5Ted Kremenek}; 402ce2baa81f1bdd5f1a2504bbf812d30f10e45bb5Ted Kremenek} // end anonymous namespace 412ce2baa81f1bdd5f1a2504bbf812d30f10e45bb5Ted Kremenek 422ce2baa81f1bdd5f1a2504bbf812d30f10e45bb5Ted Kremenek//===----------------------------------------------------------------------===// 432ce2baa81f1bdd5f1a2504bbf812d30f10e45bb5Ted Kremenek// Utility functions. 442ce2baa81f1bdd5f1a2504bbf812d30f10e45bb5Ted Kremenek//===----------------------------------------------------------------------===// 452ce2baa81f1bdd5f1a2504bbf812d30f10e45bb5Ted Kremenek 46b62bdce3e981ea4f357126bc391be1cbc1efa4dfAnders Carlssonstatic const char* GetReceiverNameType(const ObjCMessage &msg) { 47432424d67641d609e4990d791baa782fc161027eArgyrios Kyrtzidis if (const ObjCInterfaceDecl *ID = msg.getReceiverInterface()) 48b62bdce3e981ea4f357126bc391be1cbc1efa4dfAnders Carlsson return ID->getIdentifier()->getNameStart(); 49b62bdce3e981ea4f357126bc391be1cbc1efa4dfAnders Carlsson return 0; 50f1ae705460552655fe7275327804444c62e86baeTed Kremenek} 51f1ae705460552655fe7275327804444c62e86baeTed Kremenek 52b62bdce3e981ea4f357126bc391be1cbc1efa4dfAnders Carlssonstatic bool isReceiverClassOrSuperclass(const ObjCInterfaceDecl *ID, 535f9e272e632e951b1efe824cd16acb4d96077930Chris Lattner StringRef ClassName) { 54b62bdce3e981ea4f357126bc391be1cbc1efa4dfAnders Carlsson if (ID->getIdentifier()->getName() == ClassName) 55b62bdce3e981ea4f357126bc391be1cbc1efa4dfAnders Carlsson return true; 56b62bdce3e981ea4f357126bc391be1cbc1efa4dfAnders Carlsson 57b62bdce3e981ea4f357126bc391be1cbc1efa4dfAnders Carlsson if (const ObjCInterfaceDecl *Super = ID->getSuperClass()) 58b62bdce3e981ea4f357126bc391be1cbc1efa4dfAnders Carlsson return isReceiverClassOrSuperclass(Super, ClassName); 59f1ae705460552655fe7275327804444c62e86baeTed Kremenek 60b62bdce3e981ea4f357126bc391be1cbc1efa4dfAnders Carlsson return false; 612ce2baa81f1bdd5f1a2504bbf812d30f10e45bb5Ted Kremenek} 621eb4433ac451dc16f4133a88af2d002ac26c58efMike Stump 632ce2baa81f1bdd5f1a2504bbf812d30f10e45bb5Ted Kremenekstatic inline bool isNil(SVal X) { 642ce2baa81f1bdd5f1a2504bbf812d30f10e45bb5Ted Kremenek return isa<loc::ConcreteInt>(X); 652ce2baa81f1bdd5f1a2504bbf812d30f10e45bb5Ted Kremenek} 661eb4433ac451dc16f4133a88af2d002ac26c58efMike Stump 672ce2baa81f1bdd5f1a2504bbf812d30f10e45bb5Ted Kremenek//===----------------------------------------------------------------------===// 682ce2baa81f1bdd5f1a2504bbf812d30f10e45bb5Ted Kremenek// NilArgChecker - Check for prohibited nil arguments to ObjC method calls. 692ce2baa81f1bdd5f1a2504bbf812d30f10e45bb5Ted Kremenek//===----------------------------------------------------------------------===// 7099c6ad3f22b865d0f4cce52bc36904403c9ed4c4Ted Kremenek 71cb9c07418b699bd2b8384d31ff4392df7d76eb7cBenjamin Kramernamespace { 72ec8605f1d7ec846dbf51047bfd5c56d32d1ff91cArgyrios Kyrtzidis class NilArgChecker : public Checker<check::PreObjCMessage> { 7374eed0ea03598cc5ef58b72fd5ed929631a11631Argyrios Kyrtzidis mutable llvm::OwningPtr<APIMisuse> BT; 7474eed0ea03598cc5ef58b72fd5ed929631a11631Argyrios Kyrtzidis 7574eed0ea03598cc5ef58b72fd5ed929631a11631Argyrios Kyrtzidis void WarnNilArg(CheckerContext &C, 7674eed0ea03598cc5ef58b72fd5ed929631a11631Argyrios Kyrtzidis const ObjCMessage &msg, unsigned Arg) const; 7774eed0ea03598cc5ef58b72fd5ed929631a11631Argyrios Kyrtzidis 78cb9c07418b699bd2b8384d31ff4392df7d76eb7cBenjamin Kramer public: 7974eed0ea03598cc5ef58b72fd5ed929631a11631Argyrios Kyrtzidis void checkPreObjCMessage(ObjCMessage msg, CheckerContext &C) const; 80cb9c07418b699bd2b8384d31ff4392df7d76eb7cBenjamin Kramer }; 81cb9c07418b699bd2b8384d31ff4392df7d76eb7cBenjamin Kramer} 821eb4433ac451dc16f4133a88af2d002ac26c58efMike Stump 832ce2baa81f1bdd5f1a2504bbf812d30f10e45bb5Ted Kremenekvoid NilArgChecker::WarnNilArg(CheckerContext &C, 84432424d67641d609e4990d791baa782fc161027eArgyrios Kyrtzidis const ObjCMessage &msg, 8574eed0ea03598cc5ef58b72fd5ed929631a11631Argyrios Kyrtzidis unsigned int Arg) const 862ce2baa81f1bdd5f1a2504bbf812d30f10e45bb5Ted Kremenek{ 872ce2baa81f1bdd5f1a2504bbf812d30f10e45bb5Ted Kremenek if (!BT) 8874eed0ea03598cc5ef58b72fd5ed929631a11631Argyrios Kyrtzidis BT.reset(new APIMisuse("nil argument")); 892ce2baa81f1bdd5f1a2504bbf812d30f10e45bb5Ted Kremenek 90d048c6ef5b6cfaa0cecb8cc1d4bdace32ed21d07Ted Kremenek if (ExplodedNode *N = C.generateSink()) { 912ce2baa81f1bdd5f1a2504bbf812d30f10e45bb5Ted Kremenek llvm::SmallString<128> sbuf; 922ce2baa81f1bdd5f1a2504bbf812d30f10e45bb5Ted Kremenek llvm::raw_svector_ostream os(sbuf); 93432424d67641d609e4990d791baa782fc161027eArgyrios Kyrtzidis os << "Argument to '" << GetReceiverNameType(msg) << "' method '" 94432424d67641d609e4990d791baa782fc161027eArgyrios Kyrtzidis << msg.getSelector().getAsString() << "' cannot be nil"; 951eb4433ac451dc16f4133a88af2d002ac26c58efMike Stump 96e172e8b9e7fc67d7d03589af7e92fe777afcf33aAnna Zaks BugReport *R = new BugReport(*BT, os.str(), N); 97432424d67641d609e4990d791baa782fc161027eArgyrios Kyrtzidis R->addRange(msg.getArgSourceRange(Arg)); 982ce2baa81f1bdd5f1a2504bbf812d30f10e45bb5Ted Kremenek C.EmitReport(R); 99f1ae705460552655fe7275327804444c62e86baeTed Kremenek } 100527556184b276c545be1355ad596fce29a0400fbTed Kremenek} 101527556184b276c545be1355ad596fce29a0400fbTed Kremenek 10274eed0ea03598cc5ef58b72fd5ed929631a11631Argyrios Kyrtzidisvoid NilArgChecker::checkPreObjCMessage(ObjCMessage msg, 10374eed0ea03598cc5ef58b72fd5ed929631a11631Argyrios Kyrtzidis CheckerContext &C) const { 104b62bdce3e981ea4f357126bc391be1cbc1efa4dfAnders Carlsson const ObjCInterfaceDecl *ID = msg.getReceiverInterface(); 105b62bdce3e981ea4f357126bc391be1cbc1efa4dfAnders Carlsson if (!ID) 1062ce2baa81f1bdd5f1a2504bbf812d30f10e45bb5Ted Kremenek return; 1072ce2baa81f1bdd5f1a2504bbf812d30f10e45bb5Ted Kremenek 108b62bdce3e981ea4f357126bc391be1cbc1efa4dfAnders Carlsson if (isReceiverClassOrSuperclass(ID, "NSString")) { 109432424d67641d609e4990d791baa782fc161027eArgyrios Kyrtzidis Selector S = msg.getSelector(); 1102ce2baa81f1bdd5f1a2504bbf812d30f10e45bb5Ted Kremenek 1112ce2baa81f1bdd5f1a2504bbf812d30f10e45bb5Ted Kremenek if (S.isUnarySelector()) 1122ce2baa81f1bdd5f1a2504bbf812d30f10e45bb5Ted Kremenek return; 1132ce2baa81f1bdd5f1a2504bbf812d30f10e45bb5Ted Kremenek 1142ce2baa81f1bdd5f1a2504bbf812d30f10e45bb5Ted Kremenek // FIXME: This is going to be really slow doing these checks with 1152ce2baa81f1bdd5f1a2504bbf812d30f10e45bb5Ted Kremenek // lexical comparisons. 1162ce2baa81f1bdd5f1a2504bbf812d30f10e45bb5Ted Kremenek 1172ce2baa81f1bdd5f1a2504bbf812d30f10e45bb5Ted Kremenek std::string NameStr = S.getAsString(); 1185f9e272e632e951b1efe824cd16acb4d96077930Chris Lattner StringRef Name(NameStr); 1192ce2baa81f1bdd5f1a2504bbf812d30f10e45bb5Ted Kremenek assert(!Name.empty()); 1202ce2baa81f1bdd5f1a2504bbf812d30f10e45bb5Ted Kremenek 1212ce2baa81f1bdd5f1a2504bbf812d30f10e45bb5Ted Kremenek // FIXME: Checking for initWithFormat: will not work in most cases 1222ce2baa81f1bdd5f1a2504bbf812d30f10e45bb5Ted Kremenek // yet because [NSString alloc] returns id, not NSString*. We will 1232ce2baa81f1bdd5f1a2504bbf812d30f10e45bb5Ted Kremenek // need support for tracking expected-type information in the analyzer 1242ce2baa81f1bdd5f1a2504bbf812d30f10e45bb5Ted Kremenek // to find these errors. 1252ce2baa81f1bdd5f1a2504bbf812d30f10e45bb5Ted Kremenek if (Name == "caseInsensitiveCompare:" || 1262ce2baa81f1bdd5f1a2504bbf812d30f10e45bb5Ted Kremenek Name == "compare:" || 1272ce2baa81f1bdd5f1a2504bbf812d30f10e45bb5Ted Kremenek Name == "compare:options:" || 1282ce2baa81f1bdd5f1a2504bbf812d30f10e45bb5Ted Kremenek Name == "compare:options:range:" || 1292ce2baa81f1bdd5f1a2504bbf812d30f10e45bb5Ted Kremenek Name == "compare:options:range:locale:" || 1302ce2baa81f1bdd5f1a2504bbf812d30f10e45bb5Ted Kremenek Name == "componentsSeparatedByCharactersInSet:" || 1312ce2baa81f1bdd5f1a2504bbf812d30f10e45bb5Ted Kremenek Name == "initWithFormat:") { 1325eca482fe895ea57bc82410222e6426c09e63284Ted Kremenek if (isNil(msg.getArgSVal(0, C.getLocationContext(), C.getState()))) 133432424d67641d609e4990d791baa782fc161027eArgyrios Kyrtzidis WarnNilArg(C, msg, 0); 1342ce2baa81f1bdd5f1a2504bbf812d30f10e45bb5Ted Kremenek } 1354ba6283f9c7db4513ca2d9cbde7df3a58ba941f7Ted Kremenek } 13699c6ad3f22b865d0f4cce52bc36904403c9ed4c4Ted Kremenek} 13704bc87683acacce119967dfa5f7c35b4ecef012aTed Kremenek 13804bc87683acacce119967dfa5f7c35b4ecef012aTed Kremenek//===----------------------------------------------------------------------===// 13904bc87683acacce119967dfa5f7c35b4ecef012aTed Kremenek// Error reporting. 14004bc87683acacce119967dfa5f7c35b4ecef012aTed Kremenek//===----------------------------------------------------------------------===// 14104bc87683acacce119967dfa5f7c35b4ecef012aTed Kremenek 14204bc87683acacce119967dfa5f7c35b4ecef012aTed Kremeneknamespace { 143ec8605f1d7ec846dbf51047bfd5c56d32d1ff91cArgyrios Kyrtzidisclass CFNumberCreateChecker : public Checker< check::PreStmt<CallExpr> > { 14474eed0ea03598cc5ef58b72fd5ed929631a11631Argyrios Kyrtzidis mutable llvm::OwningPtr<APIMisuse> BT; 14574eed0ea03598cc5ef58b72fd5ed929631a11631Argyrios Kyrtzidis mutable IdentifierInfo* II; 14604bc87683acacce119967dfa5f7c35b4ecef012aTed Kremenekpublic: 14774eed0ea03598cc5ef58b72fd5ed929631a11631Argyrios Kyrtzidis CFNumberCreateChecker() : II(0) {} 14874eed0ea03598cc5ef58b72fd5ed929631a11631Argyrios Kyrtzidis 14974eed0ea03598cc5ef58b72fd5ed929631a11631Argyrios Kyrtzidis void checkPreStmt(const CallExpr *CE, CheckerContext &C) const; 15074eed0ea03598cc5ef58b72fd5ed929631a11631Argyrios Kyrtzidis 15104bc87683acacce119967dfa5f7c35b4ecef012aTed Kremenekprivate: 1529c378f705405d37f49795d5e915989de774fe11fTed Kremenek void EmitError(const TypedRegion* R, const Expr *Ex, 1531eb4433ac451dc16f4133a88af2d002ac26c58efMike Stump uint64_t SourceSize, uint64_t TargetSize, uint64_t NumberKind); 15404bc87683acacce119967dfa5f7c35b4ecef012aTed Kremenek}; 15504bc87683acacce119967dfa5f7c35b4ecef012aTed Kremenek} // end anonymous namespace 15604bc87683acacce119967dfa5f7c35b4ecef012aTed Kremenek 15704bc87683acacce119967dfa5f7c35b4ecef012aTed Kremenekenum CFNumberType { 15804bc87683acacce119967dfa5f7c35b4ecef012aTed Kremenek kCFNumberSInt8Type = 1, 15904bc87683acacce119967dfa5f7c35b4ecef012aTed Kremenek kCFNumberSInt16Type = 2, 16004bc87683acacce119967dfa5f7c35b4ecef012aTed Kremenek kCFNumberSInt32Type = 3, 16104bc87683acacce119967dfa5f7c35b4ecef012aTed Kremenek kCFNumberSInt64Type = 4, 16204bc87683acacce119967dfa5f7c35b4ecef012aTed Kremenek kCFNumberFloat32Type = 5, 16304bc87683acacce119967dfa5f7c35b4ecef012aTed Kremenek kCFNumberFloat64Type = 6, 16404bc87683acacce119967dfa5f7c35b4ecef012aTed Kremenek kCFNumberCharType = 7, 16504bc87683acacce119967dfa5f7c35b4ecef012aTed Kremenek kCFNumberShortType = 8, 16604bc87683acacce119967dfa5f7c35b4ecef012aTed Kremenek kCFNumberIntType = 9, 16704bc87683acacce119967dfa5f7c35b4ecef012aTed Kremenek kCFNumberLongType = 10, 16804bc87683acacce119967dfa5f7c35b4ecef012aTed Kremenek kCFNumberLongLongType = 11, 16904bc87683acacce119967dfa5f7c35b4ecef012aTed Kremenek kCFNumberFloatType = 12, 17004bc87683acacce119967dfa5f7c35b4ecef012aTed Kremenek kCFNumberDoubleType = 13, 17104bc87683acacce119967dfa5f7c35b4ecef012aTed Kremenek kCFNumberCFIndexType = 14, 17204bc87683acacce119967dfa5f7c35b4ecef012aTed Kremenek kCFNumberNSIntegerType = 15, 17304bc87683acacce119967dfa5f7c35b4ecef012aTed Kremenek kCFNumberCGFloatType = 16 17404bc87683acacce119967dfa5f7c35b4ecef012aTed Kremenek}; 17504bc87683acacce119967dfa5f7c35b4ecef012aTed Kremenek 17604bc87683acacce119967dfa5f7c35b4ecef012aTed Kremeneknamespace { 17704bc87683acacce119967dfa5f7c35b4ecef012aTed Kremenek template<typename T> 17804bc87683acacce119967dfa5f7c35b4ecef012aTed Kremenek class Optional { 17904bc87683acacce119967dfa5f7c35b4ecef012aTed Kremenek bool IsKnown; 18004bc87683acacce119967dfa5f7c35b4ecef012aTed Kremenek T Val; 18104bc87683acacce119967dfa5f7c35b4ecef012aTed Kremenek public: 18204bc87683acacce119967dfa5f7c35b4ecef012aTed Kremenek Optional() : IsKnown(false), Val(0) {} 18304bc87683acacce119967dfa5f7c35b4ecef012aTed Kremenek Optional(const T& val) : IsKnown(true), Val(val) {} 1841eb4433ac451dc16f4133a88af2d002ac26c58efMike Stump 18504bc87683acacce119967dfa5f7c35b4ecef012aTed Kremenek bool isKnown() const { return IsKnown; } 18604bc87683acacce119967dfa5f7c35b4ecef012aTed Kremenek 18704bc87683acacce119967dfa5f7c35b4ecef012aTed Kremenek const T& getValue() const { 18804bc87683acacce119967dfa5f7c35b4ecef012aTed Kremenek assert (isKnown()); 18904bc87683acacce119967dfa5f7c35b4ecef012aTed Kremenek return Val; 19004bc87683acacce119967dfa5f7c35b4ecef012aTed Kremenek } 19104bc87683acacce119967dfa5f7c35b4ecef012aTed Kremenek 19204bc87683acacce119967dfa5f7c35b4ecef012aTed Kremenek operator const T&() const { 19304bc87683acacce119967dfa5f7c35b4ecef012aTed Kremenek return getValue(); 19404bc87683acacce119967dfa5f7c35b4ecef012aTed Kremenek } 19504bc87683acacce119967dfa5f7c35b4ecef012aTed Kremenek }; 19604bc87683acacce119967dfa5f7c35b4ecef012aTed Kremenek} 19704bc87683acacce119967dfa5f7c35b4ecef012aTed Kremenek 1989c378f705405d37f49795d5e915989de774fe11fTed Kremenekstatic Optional<uint64_t> GetCFNumberSize(ASTContext &Ctx, uint64_t i) { 1992550d70aabb5f603e8f74cc5fb6a69a7af5b51f3Nuno Lopes static const unsigned char FixedSize[] = { 8, 16, 32, 64, 32, 64 }; 2001eb4433ac451dc16f4133a88af2d002ac26c58efMike Stump 20104bc87683acacce119967dfa5f7c35b4ecef012aTed Kremenek if (i < kCFNumberCharType) 20204bc87683acacce119967dfa5f7c35b4ecef012aTed Kremenek return FixedSize[i-1]; 2031eb4433ac451dc16f4133a88af2d002ac26c58efMike Stump 20404bc87683acacce119967dfa5f7c35b4ecef012aTed Kremenek QualType T; 2051eb4433ac451dc16f4133a88af2d002ac26c58efMike Stump 20604bc87683acacce119967dfa5f7c35b4ecef012aTed Kremenek switch (i) { 20704bc87683acacce119967dfa5f7c35b4ecef012aTed Kremenek case kCFNumberCharType: T = Ctx.CharTy; break; 20804bc87683acacce119967dfa5f7c35b4ecef012aTed Kremenek case kCFNumberShortType: T = Ctx.ShortTy; break; 20904bc87683acacce119967dfa5f7c35b4ecef012aTed Kremenek case kCFNumberIntType: T = Ctx.IntTy; break; 21004bc87683acacce119967dfa5f7c35b4ecef012aTed Kremenek case kCFNumberLongType: T = Ctx.LongTy; break; 21104bc87683acacce119967dfa5f7c35b4ecef012aTed Kremenek case kCFNumberLongLongType: T = Ctx.LongLongTy; break; 21204bc87683acacce119967dfa5f7c35b4ecef012aTed Kremenek case kCFNumberFloatType: T = Ctx.FloatTy; break; 21304bc87683acacce119967dfa5f7c35b4ecef012aTed Kremenek case kCFNumberDoubleType: T = Ctx.DoubleTy; break; 21404bc87683acacce119967dfa5f7c35b4ecef012aTed Kremenek case kCFNumberCFIndexType: 21504bc87683acacce119967dfa5f7c35b4ecef012aTed Kremenek case kCFNumberNSIntegerType: 21604bc87683acacce119967dfa5f7c35b4ecef012aTed Kremenek case kCFNumberCGFloatType: 2171eb4433ac451dc16f4133a88af2d002ac26c58efMike Stump // FIXME: We need a way to map from names to Type*. 21804bc87683acacce119967dfa5f7c35b4ecef012aTed Kremenek default: 21904bc87683acacce119967dfa5f7c35b4ecef012aTed Kremenek return Optional<uint64_t>(); 22004bc87683acacce119967dfa5f7c35b4ecef012aTed Kremenek } 2211eb4433ac451dc16f4133a88af2d002ac26c58efMike Stump 22204bc87683acacce119967dfa5f7c35b4ecef012aTed Kremenek return Ctx.getTypeSize(T); 22304bc87683acacce119967dfa5f7c35b4ecef012aTed Kremenek} 22404bc87683acacce119967dfa5f7c35b4ecef012aTed Kremenek 22504bc87683acacce119967dfa5f7c35b4ecef012aTed Kremenek#if 0 22604bc87683acacce119967dfa5f7c35b4ecef012aTed Kremenekstatic const char* GetCFNumberTypeStr(uint64_t i) { 22704bc87683acacce119967dfa5f7c35b4ecef012aTed Kremenek static const char* Names[] = { 22804bc87683acacce119967dfa5f7c35b4ecef012aTed Kremenek "kCFNumberSInt8Type", 22904bc87683acacce119967dfa5f7c35b4ecef012aTed Kremenek "kCFNumberSInt16Type", 23004bc87683acacce119967dfa5f7c35b4ecef012aTed Kremenek "kCFNumberSInt32Type", 23104bc87683acacce119967dfa5f7c35b4ecef012aTed Kremenek "kCFNumberSInt64Type", 23204bc87683acacce119967dfa5f7c35b4ecef012aTed Kremenek "kCFNumberFloat32Type", 23304bc87683acacce119967dfa5f7c35b4ecef012aTed Kremenek "kCFNumberFloat64Type", 23404bc87683acacce119967dfa5f7c35b4ecef012aTed Kremenek "kCFNumberCharType", 23504bc87683acacce119967dfa5f7c35b4ecef012aTed Kremenek "kCFNumberShortType", 23604bc87683acacce119967dfa5f7c35b4ecef012aTed Kremenek "kCFNumberIntType", 23704bc87683acacce119967dfa5f7c35b4ecef012aTed Kremenek "kCFNumberLongType", 23804bc87683acacce119967dfa5f7c35b4ecef012aTed Kremenek "kCFNumberLongLongType", 23904bc87683acacce119967dfa5f7c35b4ecef012aTed Kremenek "kCFNumberFloatType", 24004bc87683acacce119967dfa5f7c35b4ecef012aTed Kremenek "kCFNumberDoubleType", 24104bc87683acacce119967dfa5f7c35b4ecef012aTed Kremenek "kCFNumberCFIndexType", 24204bc87683acacce119967dfa5f7c35b4ecef012aTed Kremenek "kCFNumberNSIntegerType", 24304bc87683acacce119967dfa5f7c35b4ecef012aTed Kremenek "kCFNumberCGFloatType" 24404bc87683acacce119967dfa5f7c35b4ecef012aTed Kremenek }; 2451eb4433ac451dc16f4133a88af2d002ac26c58efMike Stump 24604bc87683acacce119967dfa5f7c35b4ecef012aTed Kremenek return i <= kCFNumberCGFloatType ? Names[i-1] : "Invalid CFNumberType"; 24704bc87683acacce119967dfa5f7c35b4ecef012aTed Kremenek} 24804bc87683acacce119967dfa5f7c35b4ecef012aTed Kremenek#endif 24904bc87683acacce119967dfa5f7c35b4ecef012aTed Kremenek 25074eed0ea03598cc5ef58b72fd5ed929631a11631Argyrios Kyrtzidisvoid CFNumberCreateChecker::checkPreStmt(const CallExpr *CE, 25174eed0ea03598cc5ef58b72fd5ed929631a11631Argyrios Kyrtzidis CheckerContext &C) const { 2528bef8238181a30e52dea380789a7e2d760eac532Ted Kremenek ProgramStateRef state = C.getState(); 253b805c8ff133ef0c62df032fa711d6b13c5afd7f4Anna Zaks const FunctionDecl *FD = C.getCalleeDecl(CE); 2542ce2baa81f1bdd5f1a2504bbf812d30f10e45bb5Ted Kremenek if (!FD) 2552ce2baa81f1bdd5f1a2504bbf812d30f10e45bb5Ted Kremenek return; 2562ce2baa81f1bdd5f1a2504bbf812d30f10e45bb5Ted Kremenek 2572ce2baa81f1bdd5f1a2504bbf812d30f10e45bb5Ted Kremenek ASTContext &Ctx = C.getASTContext(); 2582ce2baa81f1bdd5f1a2504bbf812d30f10e45bb5Ted Kremenek if (!II) 2592ce2baa81f1bdd5f1a2504bbf812d30f10e45bb5Ted Kremenek II = &Ctx.Idents.get("CFNumberCreate"); 2602ce2baa81f1bdd5f1a2504bbf812d30f10e45bb5Ted Kremenek 2612ce2baa81f1bdd5f1a2504bbf812d30f10e45bb5Ted Kremenek if (FD->getIdentifier() != II || CE->getNumArgs() != 3) 2622ce2baa81f1bdd5f1a2504bbf812d30f10e45bb5Ted Kremenek return; 2631eb4433ac451dc16f4133a88af2d002ac26c58efMike Stump 26404bc87683acacce119967dfa5f7c35b4ecef012aTed Kremenek // Get the value of the "theType" argument. 2655eca482fe895ea57bc82410222e6426c09e63284Ted Kremenek const LocationContext *LCtx = C.getLocationContext(); 2665eca482fe895ea57bc82410222e6426c09e63284Ted Kremenek SVal TheTypeVal = state->getSVal(CE->getArg(1), LCtx); 2671eb4433ac451dc16f4133a88af2d002ac26c58efMike Stump 2682ce2baa81f1bdd5f1a2504bbf812d30f10e45bb5Ted Kremenek // FIXME: We really should allow ranges of valid theType values, and 2692ce2baa81f1bdd5f1a2504bbf812d30f10e45bb5Ted Kremenek // bifurcate the state appropriately. 2701c96b24285d05c0eac455ae96d7c9ff43d42bc96Zhongxing Xu nonloc::ConcreteInt* V = dyn_cast<nonloc::ConcreteInt>(&TheTypeVal); 27104bc87683acacce119967dfa5f7c35b4ecef012aTed Kremenek if (!V) 2722ce2baa81f1bdd5f1a2504bbf812d30f10e45bb5Ted Kremenek return; 2731eb4433ac451dc16f4133a88af2d002ac26c58efMike Stump 27404bc87683acacce119967dfa5f7c35b4ecef012aTed Kremenek uint64_t NumberKind = V->getValue().getLimitedValue(); 27504bc87683acacce119967dfa5f7c35b4ecef012aTed Kremenek Optional<uint64_t> TargetSize = GetCFNumberSize(Ctx, NumberKind); 2761eb4433ac451dc16f4133a88af2d002ac26c58efMike Stump 27704bc87683acacce119967dfa5f7c35b4ecef012aTed Kremenek // FIXME: In some cases we can emit an error. 27804bc87683acacce119967dfa5f7c35b4ecef012aTed Kremenek if (!TargetSize.isKnown()) 2792ce2baa81f1bdd5f1a2504bbf812d30f10e45bb5Ted Kremenek return; 2801eb4433ac451dc16f4133a88af2d002ac26c58efMike Stump 28104bc87683acacce119967dfa5f7c35b4ecef012aTed Kremenek // Look at the value of the integer being passed by reference. Essentially 28204bc87683acacce119967dfa5f7c35b4ecef012aTed Kremenek // we want to catch cases where the value passed in is not equal to the 28304bc87683acacce119967dfa5f7c35b4ecef012aTed Kremenek // size of the type being created. 2845eca482fe895ea57bc82410222e6426c09e63284Ted Kremenek SVal TheValueExpr = state->getSVal(CE->getArg(2), LCtx); 2851eb4433ac451dc16f4133a88af2d002ac26c58efMike Stump 28604bc87683acacce119967dfa5f7c35b4ecef012aTed Kremenek // FIXME: Eventually we should handle arbitrary locations. We can do this 28704bc87683acacce119967dfa5f7c35b4ecef012aTed Kremenek // by having an enhanced memory model that does low-level typing. 2881c96b24285d05c0eac455ae96d7c9ff43d42bc96Zhongxing Xu loc::MemRegionVal* LV = dyn_cast<loc::MemRegionVal>(&TheValueExpr); 28904bc87683acacce119967dfa5f7c35b4ecef012aTed Kremenek if (!LV) 2902ce2baa81f1bdd5f1a2504bbf812d30f10e45bb5Ted Kremenek return; 2911eb4433ac451dc16f4133a88af2d002ac26c58efMike Stump 2929697934650354bed2e509d8e7e44f21a1fb00f76Ted Kremenek const TypedValueRegion* R = dyn_cast<TypedValueRegion>(LV->stripCasts()); 2935e77ebae47099d76020e84e604b33bb33c9006c3Ted Kremenek if (!R) 2942ce2baa81f1bdd5f1a2504bbf812d30f10e45bb5Ted Kremenek return; 2955e77ebae47099d76020e84e604b33bb33c9006c3Ted Kremenek 296018220c343c103b7dfaa117a7a474c7a7fd6d068Zhongxing Xu QualType T = Ctx.getCanonicalType(R->getValueType()); 2971eb4433ac451dc16f4133a88af2d002ac26c58efMike Stump 29804bc87683acacce119967dfa5f7c35b4ecef012aTed Kremenek // FIXME: If the pointee isn't an integer type, should we flag a warning? 29904bc87683acacce119967dfa5f7c35b4ecef012aTed Kremenek // People can do weird stuff with pointers. 3001eb4433ac451dc16f4133a88af2d002ac26c58efMike Stump 3011eb4433ac451dc16f4133a88af2d002ac26c58efMike Stump if (!T->isIntegerType()) 3022ce2baa81f1bdd5f1a2504bbf812d30f10e45bb5Ted Kremenek return; 3031eb4433ac451dc16f4133a88af2d002ac26c58efMike Stump 30404bc87683acacce119967dfa5f7c35b4ecef012aTed Kremenek uint64_t SourceSize = Ctx.getTypeSize(T); 3051eb4433ac451dc16f4133a88af2d002ac26c58efMike Stump 30604bc87683acacce119967dfa5f7c35b4ecef012aTed Kremenek // CHECK: is SourceSize == TargetSize 30704bc87683acacce119967dfa5f7c35b4ecef012aTed Kremenek if (SourceSize == TargetSize) 3082ce2baa81f1bdd5f1a2504bbf812d30f10e45bb5Ted Kremenek return; 3091eb4433ac451dc16f4133a88af2d002ac26c58efMike Stump 3102ce2baa81f1bdd5f1a2504bbf812d30f10e45bb5Ted Kremenek // Generate an error. Only generate a sink if 'SourceSize < TargetSize'; 3112ce2baa81f1bdd5f1a2504bbf812d30f10e45bb5Ted Kremenek // otherwise generate a regular node. 3122ce2baa81f1bdd5f1a2504bbf812d30f10e45bb5Ted Kremenek // 31304bc87683acacce119967dfa5f7c35b4ecef012aTed Kremenek // FIXME: We can actually create an abstract "CFNumber" object that has 31404bc87683acacce119967dfa5f7c35b4ecef012aTed Kremenek // the bits initialized to the provided values. 3152ce2baa81f1bdd5f1a2504bbf812d30f10e45bb5Ted Kremenek // 316d048c6ef5b6cfaa0cecb8cc1d4bdace32ed21d07Ted Kremenek if (ExplodedNode *N = SourceSize < TargetSize ? C.generateSink() 3170bd6b110e908892d4b5c8671a9f435a1d72ad16aAnna Zaks : C.addTransition()) { 3182ce2baa81f1bdd5f1a2504bbf812d30f10e45bb5Ted Kremenek llvm::SmallString<128> sbuf; 3192ce2baa81f1bdd5f1a2504bbf812d30f10e45bb5Ted Kremenek llvm::raw_svector_ostream os(sbuf); 3202ce2baa81f1bdd5f1a2504bbf812d30f10e45bb5Ted Kremenek 3212ce2baa81f1bdd5f1a2504bbf812d30f10e45bb5Ted Kremenek os << (SourceSize == 8 ? "An " : "A ") 3222ce2baa81f1bdd5f1a2504bbf812d30f10e45bb5Ted Kremenek << SourceSize << " bit integer is used to initialize a CFNumber " 3232ce2baa81f1bdd5f1a2504bbf812d30f10e45bb5Ted Kremenek "object that represents " 3242ce2baa81f1bdd5f1a2504bbf812d30f10e45bb5Ted Kremenek << (TargetSize == 8 ? "an " : "a ") 3252ce2baa81f1bdd5f1a2504bbf812d30f10e45bb5Ted Kremenek << TargetSize << " bit integer. "; 3262ce2baa81f1bdd5f1a2504bbf812d30f10e45bb5Ted Kremenek 3272ce2baa81f1bdd5f1a2504bbf812d30f10e45bb5Ted Kremenek if (SourceSize < TargetSize) 3282ce2baa81f1bdd5f1a2504bbf812d30f10e45bb5Ted Kremenek os << (TargetSize - SourceSize) 3292ce2baa81f1bdd5f1a2504bbf812d30f10e45bb5Ted Kremenek << " bits of the CFNumber value will be garbage." ; 3302ce2baa81f1bdd5f1a2504bbf812d30f10e45bb5Ted Kremenek else 3312ce2baa81f1bdd5f1a2504bbf812d30f10e45bb5Ted Kremenek os << (SourceSize - TargetSize) 3322ce2baa81f1bdd5f1a2504bbf812d30f10e45bb5Ted Kremenek << " bits of the input integer will be lost."; 33304bc87683acacce119967dfa5f7c35b4ecef012aTed Kremenek 3342ce2baa81f1bdd5f1a2504bbf812d30f10e45bb5Ted Kremenek if (!BT) 33574eed0ea03598cc5ef58b72fd5ed929631a11631Argyrios Kyrtzidis BT.reset(new APIMisuse("Bad use of CFNumberCreate")); 3362ce2baa81f1bdd5f1a2504bbf812d30f10e45bb5Ted Kremenek 337e172e8b9e7fc67d7d03589af7e92fe777afcf33aAnna Zaks BugReport *report = new BugReport(*BT, os.str(), N); 3382ce2baa81f1bdd5f1a2504bbf812d30f10e45bb5Ted Kremenek report->addRange(CE->getArg(2)->getSourceRange()); 3392ce2baa81f1bdd5f1a2504bbf812d30f10e45bb5Ted Kremenek C.EmitReport(report); 3402ce2baa81f1bdd5f1a2504bbf812d30f10e45bb5Ted Kremenek } 34104bc87683acacce119967dfa5f7c35b4ecef012aTed Kremenek} 34204bc87683acacce119967dfa5f7c35b4ecef012aTed Kremenek 34378d46242e3351484c2b773f5610beba5d316914bTed Kremenek//===----------------------------------------------------------------------===// 34461fb55c87909bd749a367f7c12b302e39aa3e392Jordy Rose// CFRetain/CFRelease checking for null arguments. 34579b4f7d37530a1c41df26b6ac3a159f7cd6388d6Ted Kremenek//===----------------------------------------------------------------------===// 34679b4f7d37530a1c41df26b6ac3a159f7cd6388d6Ted Kremenek 34779b4f7d37530a1c41df26b6ac3a159f7cd6388d6Ted Kremeneknamespace { 348ec8605f1d7ec846dbf51047bfd5c56d32d1ff91cArgyrios Kyrtzidisclass CFRetainReleaseChecker : public Checker< check::PreStmt<CallExpr> > { 34974eed0ea03598cc5ef58b72fd5ed929631a11631Argyrios Kyrtzidis mutable llvm::OwningPtr<APIMisuse> BT; 35074eed0ea03598cc5ef58b72fd5ed929631a11631Argyrios Kyrtzidis mutable IdentifierInfo *Retain, *Release; 35179b4f7d37530a1c41df26b6ac3a159f7cd6388d6Ted Kremenekpublic: 35274eed0ea03598cc5ef58b72fd5ed929631a11631Argyrios Kyrtzidis CFRetainReleaseChecker(): Retain(0), Release(0) {} 3539c378f705405d37f49795d5e915989de774fe11fTed Kremenek void checkPreStmt(const CallExpr *CE, CheckerContext &C) const; 35479b4f7d37530a1c41df26b6ac3a159f7cd6388d6Ted Kremenek}; 35579b4f7d37530a1c41df26b6ac3a159f7cd6388d6Ted Kremenek} // end anonymous namespace 35679b4f7d37530a1c41df26b6ac3a159f7cd6388d6Ted Kremenek 35779b4f7d37530a1c41df26b6ac3a159f7cd6388d6Ted Kremenek 3589c378f705405d37f49795d5e915989de774fe11fTed Kremenekvoid CFRetainReleaseChecker::checkPreStmt(const CallExpr *CE, 3599c378f705405d37f49795d5e915989de774fe11fTed Kremenek CheckerContext &C) const { 36079b4f7d37530a1c41df26b6ac3a159f7cd6388d6Ted Kremenek // If the CallExpr doesn't have exactly 1 argument just give up checking. 36179b4f7d37530a1c41df26b6ac3a159f7cd6388d6Ted Kremenek if (CE->getNumArgs() != 1) 36261fb55c87909bd749a367f7c12b302e39aa3e392Jordy Rose return; 3631eb4433ac451dc16f4133a88af2d002ac26c58efMike Stump 3648bef8238181a30e52dea380789a7e2d760eac532Ted Kremenek ProgramStateRef state = C.getState(); 365b805c8ff133ef0c62df032fa711d6b13c5afd7f4Anna Zaks const FunctionDecl *FD = C.getCalleeDecl(CE); 36679b4f7d37530a1c41df26b6ac3a159f7cd6388d6Ted Kremenek if (!FD) 36761fb55c87909bd749a367f7c12b302e39aa3e392Jordy Rose return; 3682ce2baa81f1bdd5f1a2504bbf812d30f10e45bb5Ted Kremenek 3692ce2baa81f1bdd5f1a2504bbf812d30f10e45bb5Ted Kremenek if (!BT) { 3702ce2baa81f1bdd5f1a2504bbf812d30f10e45bb5Ted Kremenek ASTContext &Ctx = C.getASTContext(); 3712ce2baa81f1bdd5f1a2504bbf812d30f10e45bb5Ted Kremenek Retain = &Ctx.Idents.get("CFRetain"); 3722ce2baa81f1bdd5f1a2504bbf812d30f10e45bb5Ted Kremenek Release = &Ctx.Idents.get("CFRelease"); 37374eed0ea03598cc5ef58b72fd5ed929631a11631Argyrios Kyrtzidis BT.reset(new APIMisuse("null passed to CFRetain/CFRelease")); 3742ce2baa81f1bdd5f1a2504bbf812d30f10e45bb5Ted Kremenek } 3751eb4433ac451dc16f4133a88af2d002ac26c58efMike Stump 37661fb55c87909bd749a367f7c12b302e39aa3e392Jordy Rose // Check if we called CFRetain/CFRelease. 3771eb4433ac451dc16f4133a88af2d002ac26c58efMike Stump const IdentifierInfo *FuncII = FD->getIdentifier(); 37879b4f7d37530a1c41df26b6ac3a159f7cd6388d6Ted Kremenek if (!(FuncII == Retain || FuncII == Release)) 37961fb55c87909bd749a367f7c12b302e39aa3e392Jordy Rose return; 38061fb55c87909bd749a367f7c12b302e39aa3e392Jordy Rose 38161fb55c87909bd749a367f7c12b302e39aa3e392Jordy Rose // FIXME: The rest of this just checks that the argument is non-null. 38261fb55c87909bd749a367f7c12b302e39aa3e392Jordy Rose // It should probably be refactored and combined with AttrNonNullChecker. 38361fb55c87909bd749a367f7c12b302e39aa3e392Jordy Rose 38461fb55c87909bd749a367f7c12b302e39aa3e392Jordy Rose // Get the argument's value. 38561fb55c87909bd749a367f7c12b302e39aa3e392Jordy Rose const Expr *Arg = CE->getArg(0); 3865eca482fe895ea57bc82410222e6426c09e63284Ted Kremenek SVal ArgVal = state->getSVal(Arg, C.getLocationContext()); 38761fb55c87909bd749a367f7c12b302e39aa3e392Jordy Rose DefinedSVal *DefArgVal = dyn_cast<DefinedSVal>(&ArgVal); 38861fb55c87909bd749a367f7c12b302e39aa3e392Jordy Rose if (!DefArgVal) 38961fb55c87909bd749a367f7c12b302e39aa3e392Jordy Rose return; 39061fb55c87909bd749a367f7c12b302e39aa3e392Jordy Rose 39161fb55c87909bd749a367f7c12b302e39aa3e392Jordy Rose // Get a NULL value. 392c8413fd03f73084a5c93028f8b4db619fc388087Ted Kremenek SValBuilder &svalBuilder = C.getSValBuilder(); 393c8413fd03f73084a5c93028f8b4db619fc388087Ted Kremenek DefinedSVal zero = cast<DefinedSVal>(svalBuilder.makeZeroVal(Arg->getType())); 39461fb55c87909bd749a367f7c12b302e39aa3e392Jordy Rose 39561fb55c87909bd749a367f7c12b302e39aa3e392Jordy Rose // Make an expression asserting that they're equal. 396c8413fd03f73084a5c93028f8b4db619fc388087Ted Kremenek DefinedOrUnknownSVal ArgIsNull = svalBuilder.evalEQ(state, zero, *DefArgVal); 39761fb55c87909bd749a367f7c12b302e39aa3e392Jordy Rose 39861fb55c87909bd749a367f7c12b302e39aa3e392Jordy Rose // Are they equal? 3998bef8238181a30e52dea380789a7e2d760eac532Ted Kremenek ProgramStateRef stateTrue, stateFalse; 40028f47b92e760ccf641ac91cb0fe1c12d9ca89795Ted Kremenek llvm::tie(stateTrue, stateFalse) = state->assume(ArgIsNull); 40161fb55c87909bd749a367f7c12b302e39aa3e392Jordy Rose 40261fb55c87909bd749a367f7c12b302e39aa3e392Jordy Rose if (stateTrue && !stateFalse) { 403d048c6ef5b6cfaa0cecb8cc1d4bdace32ed21d07Ted Kremenek ExplodedNode *N = C.generateSink(stateTrue); 40461fb55c87909bd749a367f7c12b302e39aa3e392Jordy Rose if (!N) 40561fb55c87909bd749a367f7c12b302e39aa3e392Jordy Rose return; 4061eb4433ac451dc16f4133a88af2d002ac26c58efMike Stump 40779b4f7d37530a1c41df26b6ac3a159f7cd6388d6Ted Kremenek const char *description = (FuncII == Retain) 40879b4f7d37530a1c41df26b6ac3a159f7cd6388d6Ted Kremenek ? "Null pointer argument in call to CFRetain" 40979b4f7d37530a1c41df26b6ac3a159f7cd6388d6Ted Kremenek : "Null pointer argument in call to CFRelease"; 41079b4f7d37530a1c41df26b6ac3a159f7cd6388d6Ted Kremenek 411e172e8b9e7fc67d7d03589af7e92fe777afcf33aAnna Zaks BugReport *report = new BugReport(*BT, description, N); 41261fb55c87909bd749a367f7c12b302e39aa3e392Jordy Rose report->addRange(Arg->getSourceRange()); 41350bbc165b063155cc23c360deb7b865502e068e2Anna Zaks report->addVisitor(bugreporter::getTrackNullOrUndefValueVisitor(N, Arg)); 41461fb55c87909bd749a367f7c12b302e39aa3e392Jordy Rose C.EmitReport(report); 41561fb55c87909bd749a367f7c12b302e39aa3e392Jordy Rose return; 41661fb55c87909bd749a367f7c12b302e39aa3e392Jordy Rose } 4171eb4433ac451dc16f4133a88af2d002ac26c58efMike Stump 41861fb55c87909bd749a367f7c12b302e39aa3e392Jordy Rose // From here on, we know the argument is non-null. 4190bd6b110e908892d4b5c8671a9f435a1d72ad16aAnna Zaks C.addTransition(stateFalse); 42079b4f7d37530a1c41df26b6ac3a159f7cd6388d6Ted Kremenek} 42179b4f7d37530a1c41df26b6ac3a159f7cd6388d6Ted Kremenek 42279b4f7d37530a1c41df26b6ac3a159f7cd6388d6Ted Kremenek//===----------------------------------------------------------------------===// 42350e837b3cbc9315b6808daabb96c5c7cccf11ea7Ted Kremenek// Check for sending 'retain', 'release', or 'autorelease' directly to a Class. 42450e837b3cbc9315b6808daabb96c5c7cccf11ea7Ted Kremenek//===----------------------------------------------------------------------===// 42550e837b3cbc9315b6808daabb96c5c7cccf11ea7Ted Kremenek 42650e837b3cbc9315b6808daabb96c5c7cccf11ea7Ted Kremeneknamespace { 427ec8605f1d7ec846dbf51047bfd5c56d32d1ff91cArgyrios Kyrtzidisclass ClassReleaseChecker : public Checker<check::PreObjCMessage> { 42874eed0ea03598cc5ef58b72fd5ed929631a11631Argyrios Kyrtzidis mutable Selector releaseS; 42974eed0ea03598cc5ef58b72fd5ed929631a11631Argyrios Kyrtzidis mutable Selector retainS; 43074eed0ea03598cc5ef58b72fd5ed929631a11631Argyrios Kyrtzidis mutable Selector autoreleaseS; 43174eed0ea03598cc5ef58b72fd5ed929631a11631Argyrios Kyrtzidis mutable Selector drainS; 43274eed0ea03598cc5ef58b72fd5ed929631a11631Argyrios Kyrtzidis mutable llvm::OwningPtr<BugType> BT; 43350e837b3cbc9315b6808daabb96c5c7cccf11ea7Ted Kremenek 43474eed0ea03598cc5ef58b72fd5ed929631a11631Argyrios Kyrtzidispublic: 43574eed0ea03598cc5ef58b72fd5ed929631a11631Argyrios Kyrtzidis void checkPreObjCMessage(ObjCMessage msg, CheckerContext &C) const; 43650e837b3cbc9315b6808daabb96c5c7cccf11ea7Ted Kremenek}; 43750e837b3cbc9315b6808daabb96c5c7cccf11ea7Ted Kremenek} 43850e837b3cbc9315b6808daabb96c5c7cccf11ea7Ted Kremenek 43974eed0ea03598cc5ef58b72fd5ed929631a11631Argyrios Kyrtzidisvoid ClassReleaseChecker::checkPreObjCMessage(ObjCMessage msg, 44074eed0ea03598cc5ef58b72fd5ed929631a11631Argyrios Kyrtzidis CheckerContext &C) const { 4412ce2baa81f1bdd5f1a2504bbf812d30f10e45bb5Ted Kremenek 4422ce2baa81f1bdd5f1a2504bbf812d30f10e45bb5Ted Kremenek if (!BT) { 44374eed0ea03598cc5ef58b72fd5ed929631a11631Argyrios Kyrtzidis BT.reset(new APIMisuse("message incorrectly sent to class instead of class " 44474eed0ea03598cc5ef58b72fd5ed929631a11631Argyrios Kyrtzidis "instance")); 4452ce2baa81f1bdd5f1a2504bbf812d30f10e45bb5Ted Kremenek 4462ce2baa81f1bdd5f1a2504bbf812d30f10e45bb5Ted Kremenek ASTContext &Ctx = C.getASTContext(); 4472ce2baa81f1bdd5f1a2504bbf812d30f10e45bb5Ted Kremenek releaseS = GetNullarySelector("release", Ctx); 4482ce2baa81f1bdd5f1a2504bbf812d30f10e45bb5Ted Kremenek retainS = GetNullarySelector("retain", Ctx); 4492ce2baa81f1bdd5f1a2504bbf812d30f10e45bb5Ted Kremenek autoreleaseS = GetNullarySelector("autorelease", Ctx); 4502ce2baa81f1bdd5f1a2504bbf812d30f10e45bb5Ted Kremenek drainS = GetNullarySelector("drain", Ctx); 4512ce2baa81f1bdd5f1a2504bbf812d30f10e45bb5Ted Kremenek } 4522ce2baa81f1bdd5f1a2504bbf812d30f10e45bb5Ted Kremenek 453432424d67641d609e4990d791baa782fc161027eArgyrios Kyrtzidis if (msg.isInstanceMessage()) 45450e837b3cbc9315b6808daabb96c5c7cccf11ea7Ted Kremenek return; 455432424d67641d609e4990d791baa782fc161027eArgyrios Kyrtzidis const ObjCInterfaceDecl *Class = msg.getReceiverInterface(); 456432424d67641d609e4990d791baa782fc161027eArgyrios Kyrtzidis assert(Class); 45704badcf84c8d504d8491c7c7e29b58f52cb16640Douglas Gregor 458432424d67641d609e4990d791baa782fc161027eArgyrios Kyrtzidis Selector S = msg.getSelector(); 459921ddc4e7ef35d77965205d91582c356cb54f5efBenjamin Kramer if (!(S == releaseS || S == retainS || S == autoreleaseS || S == drainS)) 46050e837b3cbc9315b6808daabb96c5c7cccf11ea7Ted Kremenek return; 46150e837b3cbc9315b6808daabb96c5c7cccf11ea7Ted Kremenek 4620bd6b110e908892d4b5c8671a9f435a1d72ad16aAnna Zaks if (ExplodedNode *N = C.addTransition()) { 4632ce2baa81f1bdd5f1a2504bbf812d30f10e45bb5Ted Kremenek llvm::SmallString<200> buf; 4642ce2baa81f1bdd5f1a2504bbf812d30f10e45bb5Ted Kremenek llvm::raw_svector_ostream os(buf); 46550e837b3cbc9315b6808daabb96c5c7cccf11ea7Ted Kremenek 4662ce2baa81f1bdd5f1a2504bbf812d30f10e45bb5Ted Kremenek os << "The '" << S.getAsString() << "' message should be sent to instances " 4672ce2baa81f1bdd5f1a2504bbf812d30f10e45bb5Ted Kremenek "of class '" << Class->getName() 4682ce2baa81f1bdd5f1a2504bbf812d30f10e45bb5Ted Kremenek << "' and not the class directly"; 46950e837b3cbc9315b6808daabb96c5c7cccf11ea7Ted Kremenek 470e172e8b9e7fc67d7d03589af7e92fe777afcf33aAnna Zaks BugReport *report = new BugReport(*BT, os.str(), N); 471432424d67641d609e4990d791baa782fc161027eArgyrios Kyrtzidis report->addRange(msg.getSourceRange()); 4722ce2baa81f1bdd5f1a2504bbf812d30f10e45bb5Ted Kremenek C.EmitReport(report); 4732ce2baa81f1bdd5f1a2504bbf812d30f10e45bb5Ted Kremenek } 47450e837b3cbc9315b6808daabb96c5c7cccf11ea7Ted Kremenek} 47550e837b3cbc9315b6808daabb96c5c7cccf11ea7Ted Kremenek 47650e837b3cbc9315b6808daabb96c5c7cccf11ea7Ted Kremenek//===----------------------------------------------------------------------===// 4774597b7b28e3a71f3c4f0ee3a3bd6a34423e6f885Anders Carlsson// Check for passing non-Objective-C types to variadic methods that expect 4784597b7b28e3a71f3c4f0ee3a3bd6a34423e6f885Anders Carlsson// only Objective-C types. 4794597b7b28e3a71f3c4f0ee3a3bd6a34423e6f885Anders Carlsson//===----------------------------------------------------------------------===// 4804597b7b28e3a71f3c4f0ee3a3bd6a34423e6f885Anders Carlsson 4814597b7b28e3a71f3c4f0ee3a3bd6a34423e6f885Anders Carlssonnamespace { 4824597b7b28e3a71f3c4f0ee3a3bd6a34423e6f885Anders Carlssonclass VariadicMethodTypeChecker : public Checker<check::PreObjCMessage> { 4834597b7b28e3a71f3c4f0ee3a3bd6a34423e6f885Anders Carlsson mutable Selector arrayWithObjectsS; 4844597b7b28e3a71f3c4f0ee3a3bd6a34423e6f885Anders Carlsson mutable Selector dictionaryWithObjectsAndKeysS; 4854597b7b28e3a71f3c4f0ee3a3bd6a34423e6f885Anders Carlsson mutable Selector setWithObjectsS; 4864597b7b28e3a71f3c4f0ee3a3bd6a34423e6f885Anders Carlsson mutable Selector initWithObjectsS; 4874597b7b28e3a71f3c4f0ee3a3bd6a34423e6f885Anders Carlsson mutable Selector initWithObjectsAndKeysS; 4884597b7b28e3a71f3c4f0ee3a3bd6a34423e6f885Anders Carlsson mutable llvm::OwningPtr<BugType> BT; 4894597b7b28e3a71f3c4f0ee3a3bd6a34423e6f885Anders Carlsson 4904597b7b28e3a71f3c4f0ee3a3bd6a34423e6f885Anders Carlsson bool isVariadicMessage(const ObjCMessage &msg) const; 4914597b7b28e3a71f3c4f0ee3a3bd6a34423e6f885Anders Carlsson 4924597b7b28e3a71f3c4f0ee3a3bd6a34423e6f885Anders Carlssonpublic: 4934597b7b28e3a71f3c4f0ee3a3bd6a34423e6f885Anders Carlsson void checkPreObjCMessage(ObjCMessage msg, CheckerContext &C) const; 4944597b7b28e3a71f3c4f0ee3a3bd6a34423e6f885Anders Carlsson}; 4954597b7b28e3a71f3c4f0ee3a3bd6a34423e6f885Anders Carlsson} 4964597b7b28e3a71f3c4f0ee3a3bd6a34423e6f885Anders Carlsson 4974597b7b28e3a71f3c4f0ee3a3bd6a34423e6f885Anders Carlsson/// isVariadicMessage - Returns whether the given message is a variadic message, 4984597b7b28e3a71f3c4f0ee3a3bd6a34423e6f885Anders Carlsson/// where all arguments must be Objective-C types. 4994597b7b28e3a71f3c4f0ee3a3bd6a34423e6f885Anders Carlssonbool 5004597b7b28e3a71f3c4f0ee3a3bd6a34423e6f885Anders CarlssonVariadicMethodTypeChecker::isVariadicMessage(const ObjCMessage &msg) const { 5014597b7b28e3a71f3c4f0ee3a3bd6a34423e6f885Anders Carlsson const ObjCMethodDecl *MD = msg.getMethodDecl(); 5029281efe614741f3742ebf8196a703f6c923c6ff0Ted Kremenek 5039281efe614741f3742ebf8196a703f6c923c6ff0Ted Kremenek if (!MD || !MD->isVariadic() || isa<ObjCProtocolDecl>(MD->getDeclContext())) 5044597b7b28e3a71f3c4f0ee3a3bd6a34423e6f885Anders Carlsson return false; 5054597b7b28e3a71f3c4f0ee3a3bd6a34423e6f885Anders Carlsson 5064597b7b28e3a71f3c4f0ee3a3bd6a34423e6f885Anders Carlsson Selector S = msg.getSelector(); 5074597b7b28e3a71f3c4f0ee3a3bd6a34423e6f885Anders Carlsson 5084597b7b28e3a71f3c4f0ee3a3bd6a34423e6f885Anders Carlsson if (msg.isInstanceMessage()) { 5094597b7b28e3a71f3c4f0ee3a3bd6a34423e6f885Anders Carlsson // FIXME: Ideally we'd look at the receiver interface here, but that's not 5104597b7b28e3a71f3c4f0ee3a3bd6a34423e6f885Anders Carlsson // useful for init, because alloc returns 'id'. In theory, this could lead 5114597b7b28e3a71f3c4f0ee3a3bd6a34423e6f885Anders Carlsson // to false positives, for example if there existed a class that had an 5124597b7b28e3a71f3c4f0ee3a3bd6a34423e6f885Anders Carlsson // initWithObjects: implementation that does accept non-Objective-C pointer 5134597b7b28e3a71f3c4f0ee3a3bd6a34423e6f885Anders Carlsson // types, but the chance of that happening is pretty small compared to the 5144597b7b28e3a71f3c4f0ee3a3bd6a34423e6f885Anders Carlsson // gains that this analysis gives. 5154597b7b28e3a71f3c4f0ee3a3bd6a34423e6f885Anders Carlsson const ObjCInterfaceDecl *Class = MD->getClassInterface(); 5164597b7b28e3a71f3c4f0ee3a3bd6a34423e6f885Anders Carlsson 5174597b7b28e3a71f3c4f0ee3a3bd6a34423e6f885Anders Carlsson // -[NSArray initWithObjects:] 5184597b7b28e3a71f3c4f0ee3a3bd6a34423e6f885Anders Carlsson if (isReceiverClassOrSuperclass(Class, "NSArray") && 5194597b7b28e3a71f3c4f0ee3a3bd6a34423e6f885Anders Carlsson S == initWithObjectsS) 5204597b7b28e3a71f3c4f0ee3a3bd6a34423e6f885Anders Carlsson return true; 5214597b7b28e3a71f3c4f0ee3a3bd6a34423e6f885Anders Carlsson 5224597b7b28e3a71f3c4f0ee3a3bd6a34423e6f885Anders Carlsson // -[NSDictionary initWithObjectsAndKeys:] 5234597b7b28e3a71f3c4f0ee3a3bd6a34423e6f885Anders Carlsson if (isReceiverClassOrSuperclass(Class, "NSDictionary") && 5244597b7b28e3a71f3c4f0ee3a3bd6a34423e6f885Anders Carlsson S == initWithObjectsAndKeysS) 5254597b7b28e3a71f3c4f0ee3a3bd6a34423e6f885Anders Carlsson return true; 5264597b7b28e3a71f3c4f0ee3a3bd6a34423e6f885Anders Carlsson 5274597b7b28e3a71f3c4f0ee3a3bd6a34423e6f885Anders Carlsson // -[NSSet initWithObjects:] 5284597b7b28e3a71f3c4f0ee3a3bd6a34423e6f885Anders Carlsson if (isReceiverClassOrSuperclass(Class, "NSSet") && 5294597b7b28e3a71f3c4f0ee3a3bd6a34423e6f885Anders Carlsson S == initWithObjectsS) 5304597b7b28e3a71f3c4f0ee3a3bd6a34423e6f885Anders Carlsson return true; 5314597b7b28e3a71f3c4f0ee3a3bd6a34423e6f885Anders Carlsson } else { 5324597b7b28e3a71f3c4f0ee3a3bd6a34423e6f885Anders Carlsson const ObjCInterfaceDecl *Class = msg.getReceiverInterface(); 5334597b7b28e3a71f3c4f0ee3a3bd6a34423e6f885Anders Carlsson 5344597b7b28e3a71f3c4f0ee3a3bd6a34423e6f885Anders Carlsson // -[NSArray arrayWithObjects:] 5354597b7b28e3a71f3c4f0ee3a3bd6a34423e6f885Anders Carlsson if (isReceiverClassOrSuperclass(Class, "NSArray") && 5364597b7b28e3a71f3c4f0ee3a3bd6a34423e6f885Anders Carlsson S == arrayWithObjectsS) 5374597b7b28e3a71f3c4f0ee3a3bd6a34423e6f885Anders Carlsson return true; 5384597b7b28e3a71f3c4f0ee3a3bd6a34423e6f885Anders Carlsson 5394597b7b28e3a71f3c4f0ee3a3bd6a34423e6f885Anders Carlsson // -[NSDictionary dictionaryWithObjectsAndKeys:] 5404597b7b28e3a71f3c4f0ee3a3bd6a34423e6f885Anders Carlsson if (isReceiverClassOrSuperclass(Class, "NSDictionary") && 5414597b7b28e3a71f3c4f0ee3a3bd6a34423e6f885Anders Carlsson S == dictionaryWithObjectsAndKeysS) 5424597b7b28e3a71f3c4f0ee3a3bd6a34423e6f885Anders Carlsson return true; 5434597b7b28e3a71f3c4f0ee3a3bd6a34423e6f885Anders Carlsson 5444597b7b28e3a71f3c4f0ee3a3bd6a34423e6f885Anders Carlsson // -[NSSet setWithObjects:] 5454597b7b28e3a71f3c4f0ee3a3bd6a34423e6f885Anders Carlsson if (isReceiverClassOrSuperclass(Class, "NSSet") && 5464597b7b28e3a71f3c4f0ee3a3bd6a34423e6f885Anders Carlsson S == setWithObjectsS) 5474597b7b28e3a71f3c4f0ee3a3bd6a34423e6f885Anders Carlsson return true; 5484597b7b28e3a71f3c4f0ee3a3bd6a34423e6f885Anders Carlsson } 5494597b7b28e3a71f3c4f0ee3a3bd6a34423e6f885Anders Carlsson 5504597b7b28e3a71f3c4f0ee3a3bd6a34423e6f885Anders Carlsson return false; 5514597b7b28e3a71f3c4f0ee3a3bd6a34423e6f885Anders Carlsson} 5524597b7b28e3a71f3c4f0ee3a3bd6a34423e6f885Anders Carlsson 5534597b7b28e3a71f3c4f0ee3a3bd6a34423e6f885Anders Carlssonvoid VariadicMethodTypeChecker::checkPreObjCMessage(ObjCMessage msg, 5544597b7b28e3a71f3c4f0ee3a3bd6a34423e6f885Anders Carlsson CheckerContext &C) const { 5554597b7b28e3a71f3c4f0ee3a3bd6a34423e6f885Anders Carlsson if (!BT) { 5564597b7b28e3a71f3c4f0ee3a3bd6a34423e6f885Anders Carlsson BT.reset(new APIMisuse("Arguments passed to variadic method aren't all " 5574597b7b28e3a71f3c4f0ee3a3bd6a34423e6f885Anders Carlsson "Objective-C pointer types")); 5584597b7b28e3a71f3c4f0ee3a3bd6a34423e6f885Anders Carlsson 5594597b7b28e3a71f3c4f0ee3a3bd6a34423e6f885Anders Carlsson ASTContext &Ctx = C.getASTContext(); 5604597b7b28e3a71f3c4f0ee3a3bd6a34423e6f885Anders Carlsson arrayWithObjectsS = GetUnarySelector("arrayWithObjects", Ctx); 5614597b7b28e3a71f3c4f0ee3a3bd6a34423e6f885Anders Carlsson dictionaryWithObjectsAndKeysS = 5624597b7b28e3a71f3c4f0ee3a3bd6a34423e6f885Anders Carlsson GetUnarySelector("dictionaryWithObjectsAndKeys", Ctx); 5634597b7b28e3a71f3c4f0ee3a3bd6a34423e6f885Anders Carlsson setWithObjectsS = GetUnarySelector("setWithObjects", Ctx); 5644597b7b28e3a71f3c4f0ee3a3bd6a34423e6f885Anders Carlsson 5654597b7b28e3a71f3c4f0ee3a3bd6a34423e6f885Anders Carlsson initWithObjectsS = GetUnarySelector("initWithObjects", Ctx); 5664597b7b28e3a71f3c4f0ee3a3bd6a34423e6f885Anders Carlsson initWithObjectsAndKeysS = GetUnarySelector("initWithObjectsAndKeys", Ctx); 5674597b7b28e3a71f3c4f0ee3a3bd6a34423e6f885Anders Carlsson } 5684597b7b28e3a71f3c4f0ee3a3bd6a34423e6f885Anders Carlsson 5694597b7b28e3a71f3c4f0ee3a3bd6a34423e6f885Anders Carlsson if (!isVariadicMessage(msg)) 5704597b7b28e3a71f3c4f0ee3a3bd6a34423e6f885Anders Carlsson return; 5714597b7b28e3a71f3c4f0ee3a3bd6a34423e6f885Anders Carlsson 5724597b7b28e3a71f3c4f0ee3a3bd6a34423e6f885Anders Carlsson // We are not interested in the selector arguments since they have 5734597b7b28e3a71f3c4f0ee3a3bd6a34423e6f885Anders Carlsson // well-defined types, so the compiler will issue a warning for them. 5744597b7b28e3a71f3c4f0ee3a3bd6a34423e6f885Anders Carlsson unsigned variadicArgsBegin = msg.getSelector().getNumArgs(); 5754597b7b28e3a71f3c4f0ee3a3bd6a34423e6f885Anders Carlsson 5764597b7b28e3a71f3c4f0ee3a3bd6a34423e6f885Anders Carlsson // We're not interested in the last argument since it has to be nil or the 5774597b7b28e3a71f3c4f0ee3a3bd6a34423e6f885Anders Carlsson // compiler would have issued a warning for it elsewhere. 5784597b7b28e3a71f3c4f0ee3a3bd6a34423e6f885Anders Carlsson unsigned variadicArgsEnd = msg.getNumArgs() - 1; 5794597b7b28e3a71f3c4f0ee3a3bd6a34423e6f885Anders Carlsson 5804597b7b28e3a71f3c4f0ee3a3bd6a34423e6f885Anders Carlsson if (variadicArgsEnd <= variadicArgsBegin) 5814597b7b28e3a71f3c4f0ee3a3bd6a34423e6f885Anders Carlsson return; 5824597b7b28e3a71f3c4f0ee3a3bd6a34423e6f885Anders Carlsson 5834597b7b28e3a71f3c4f0ee3a3bd6a34423e6f885Anders Carlsson // Verify that all arguments have Objective-C types. 5846fb5c1facaf36795a8c1050cd901e0e829ac1a64Ted Kremenek llvm::Optional<ExplodedNode*> errorNode; 5858bef8238181a30e52dea380789a7e2d760eac532Ted Kremenek ProgramStateRef state = C.getState(); 5866fb5c1facaf36795a8c1050cd901e0e829ac1a64Ted Kremenek 5874597b7b28e3a71f3c4f0ee3a3bd6a34423e6f885Anders Carlsson for (unsigned I = variadicArgsBegin; I != variadicArgsEnd; ++I) { 5884597b7b28e3a71f3c4f0ee3a3bd6a34423e6f885Anders Carlsson QualType ArgTy = msg.getArgType(I); 5894597b7b28e3a71f3c4f0ee3a3bd6a34423e6f885Anders Carlsson if (ArgTy->isObjCObjectPointerType()) 5904597b7b28e3a71f3c4f0ee3a3bd6a34423e6f885Anders Carlsson continue; 5914597b7b28e3a71f3c4f0ee3a3bd6a34423e6f885Anders Carlsson 592f05982b5f8f69a1d618c3bd844ab6efd3a6e2953Anders Carlsson // Block pointers are treaded as Objective-C pointers. 593f05982b5f8f69a1d618c3bd844ab6efd3a6e2953Anders Carlsson if (ArgTy->isBlockPointerType()) 594f05982b5f8f69a1d618c3bd844ab6efd3a6e2953Anders Carlsson continue; 595f05982b5f8f69a1d618c3bd844ab6efd3a6e2953Anders Carlsson 596d5fde2106af8e78cc1b97d6369ad0de5d0875491Ted Kremenek // Ignore pointer constants. 5975eca482fe895ea57bc82410222e6426c09e63284Ted Kremenek if (isa<loc::ConcreteInt>(msg.getArgSVal(I, C.getLocationContext(), 5985eca482fe895ea57bc82410222e6426c09e63284Ted Kremenek state))) 599d5fde2106af8e78cc1b97d6369ad0de5d0875491Ted Kremenek continue; 600928c415d5dde89b7c01e41f0dfa8a782cbfa8e7dTed Kremenek 601f3f929386254a53c398fa884848738113a73ca23Ted Kremenek // Ignore pointer types annotated with 'NSObject' attribute. 602f3f929386254a53c398fa884848738113a73ca23Ted Kremenek if (C.getASTContext().isObjCNSObjectType(ArgTy)) 603f3f929386254a53c398fa884848738113a73ca23Ted Kremenek continue; 604f3f929386254a53c398fa884848738113a73ca23Ted Kremenek 605928c415d5dde89b7c01e41f0dfa8a782cbfa8e7dTed Kremenek // Ignore CF references, which can be toll-free bridged. 6060556048ae8ff743d0abb9fa88a0d0ee8e9123742Ted Kremenek if (coreFoundation::isCFObjectRef(ArgTy)) 607928c415d5dde89b7c01e41f0dfa8a782cbfa8e7dTed Kremenek continue; 608d5fde2106af8e78cc1b97d6369ad0de5d0875491Ted Kremenek 6096fb5c1facaf36795a8c1050cd901e0e829ac1a64Ted Kremenek // Generate only one error node to use for all bug reports. 6106fb5c1facaf36795a8c1050cd901e0e829ac1a64Ted Kremenek if (!errorNode.hasValue()) { 6110bd6b110e908892d4b5c8671a9f435a1d72ad16aAnna Zaks errorNode = C.addTransition(); 6126fb5c1facaf36795a8c1050cd901e0e829ac1a64Ted Kremenek } 6136fb5c1facaf36795a8c1050cd901e0e829ac1a64Ted Kremenek 6146fb5c1facaf36795a8c1050cd901e0e829ac1a64Ted Kremenek if (!errorNode.getValue()) 6154597b7b28e3a71f3c4f0ee3a3bd6a34423e6f885Anders Carlsson continue; 6164597b7b28e3a71f3c4f0ee3a3bd6a34423e6f885Anders Carlsson 6174597b7b28e3a71f3c4f0ee3a3bd6a34423e6f885Anders Carlsson llvm::SmallString<128> sbuf; 6184597b7b28e3a71f3c4f0ee3a3bd6a34423e6f885Anders Carlsson llvm::raw_svector_ostream os(sbuf); 6194597b7b28e3a71f3c4f0ee3a3bd6a34423e6f885Anders Carlsson 6204597b7b28e3a71f3c4f0ee3a3bd6a34423e6f885Anders Carlsson if (const char *TypeName = GetReceiverNameType(msg)) 6214597b7b28e3a71f3c4f0ee3a3bd6a34423e6f885Anders Carlsson os << "Argument to '" << TypeName << "' method '"; 6224597b7b28e3a71f3c4f0ee3a3bd6a34423e6f885Anders Carlsson else 6234597b7b28e3a71f3c4f0ee3a3bd6a34423e6f885Anders Carlsson os << "Argument to method '"; 6244597b7b28e3a71f3c4f0ee3a3bd6a34423e6f885Anders Carlsson 6254597b7b28e3a71f3c4f0ee3a3bd6a34423e6f885Anders Carlsson os << msg.getSelector().getAsString() 6264597b7b28e3a71f3c4f0ee3a3bd6a34423e6f885Anders Carlsson << "' should be an Objective-C pointer type, not '" 6274597b7b28e3a71f3c4f0ee3a3bd6a34423e6f885Anders Carlsson << ArgTy.getAsString() << "'"; 6284597b7b28e3a71f3c4f0ee3a3bd6a34423e6f885Anders Carlsson 629e172e8b9e7fc67d7d03589af7e92fe777afcf33aAnna Zaks BugReport *R = new BugReport(*BT, os.str(), 6306fb5c1facaf36795a8c1050cd901e0e829ac1a64Ted Kremenek errorNode.getValue()); 6314597b7b28e3a71f3c4f0ee3a3bd6a34423e6f885Anders Carlsson R->addRange(msg.getArgSourceRange(I)); 6324597b7b28e3a71f3c4f0ee3a3bd6a34423e6f885Anders Carlsson C.EmitReport(R); 6334597b7b28e3a71f3c4f0ee3a3bd6a34423e6f885Anders Carlsson } 6344597b7b28e3a71f3c4f0ee3a3bd6a34423e6f885Anders Carlsson} 6354597b7b28e3a71f3c4f0ee3a3bd6a34423e6f885Anders Carlsson 6364597b7b28e3a71f3c4f0ee3a3bd6a34423e6f885Anders Carlsson//===----------------------------------------------------------------------===// 63778d46242e3351484c2b773f5610beba5d316914bTed Kremenek// Check registration. 63879b4f7d37530a1c41df26b6ac3a159f7cd6388d6Ted Kremenek//===----------------------------------------------------------------------===// 6390b1ba6227c67d5e04b589ed8a08afa2345a40666Argyrios Kyrtzidis 640695fb502825a53ccd178ec1c85c77929d88acb71Argyrios Kyrtzidisvoid ento::registerNilArgChecker(CheckerManager &mgr) { 64174eed0ea03598cc5ef58b72fd5ed929631a11631Argyrios Kyrtzidis mgr.registerChecker<NilArgChecker>(); 6420b1ba6227c67d5e04b589ed8a08afa2345a40666Argyrios Kyrtzidis} 6430b1ba6227c67d5e04b589ed8a08afa2345a40666Argyrios Kyrtzidis 644695fb502825a53ccd178ec1c85c77929d88acb71Argyrios Kyrtzidisvoid ento::registerCFNumberCreateChecker(CheckerManager &mgr) { 64574eed0ea03598cc5ef58b72fd5ed929631a11631Argyrios Kyrtzidis mgr.registerChecker<CFNumberCreateChecker>(); 6460b1ba6227c67d5e04b589ed8a08afa2345a40666Argyrios Kyrtzidis} 6470b1ba6227c67d5e04b589ed8a08afa2345a40666Argyrios Kyrtzidis 648695fb502825a53ccd178ec1c85c77929d88acb71Argyrios Kyrtzidisvoid ento::registerCFRetainReleaseChecker(CheckerManager &mgr) { 64974eed0ea03598cc5ef58b72fd5ed929631a11631Argyrios Kyrtzidis mgr.registerChecker<CFRetainReleaseChecker>(); 65078d46242e3351484c2b773f5610beba5d316914bTed Kremenek} 651695fb502825a53ccd178ec1c85c77929d88acb71Argyrios Kyrtzidis 652695fb502825a53ccd178ec1c85c77929d88acb71Argyrios Kyrtzidisvoid ento::registerClassReleaseChecker(CheckerManager &mgr) { 65374eed0ea03598cc5ef58b72fd5ed929631a11631Argyrios Kyrtzidis mgr.registerChecker<ClassReleaseChecker>(); 654695fb502825a53ccd178ec1c85c77929d88acb71Argyrios Kyrtzidis} 6554597b7b28e3a71f3c4f0ee3a3bd6a34423e6f885Anders Carlsson 6564597b7b28e3a71f3c4f0ee3a3bd6a34423e6f885Anders Carlssonvoid ento::registerVariadicMethodTypeChecker(CheckerManager &mgr) { 6574597b7b28e3a71f3c4f0ee3a3bd6a34423e6f885Anders Carlsson mgr.registerChecker<VariadicMethodTypeChecker>(); 6584597b7b28e3a71f3c4f0ee3a3bd6a34423e6f885Anders Carlsson} 659