MacOSXAPIChecker.cpp revision 04291a7c76e16a2dc5433c80c3d13c826bf372dc 
1// MacOSXAPIChecker.h - Checks proper use of various MacOS X APIs --*- C++ -*-//
2//
3//                     The LLVM Compiler Infrastructure
4//
5// This file is distributed under the University of Illinois Open Source
6// License. See LICENSE.TXT for details.
7//
8//===----------------------------------------------------------------------===//
9//
10// This defines MacOSXAPIChecker, which is an assortment of checks on calls
11// to various, widely used Mac OS X functions.
12//
13// FIXME: What's currently in BasicObjCFoundationChecks.cpp should be migrated
14// to here, using the new Checker interface.
15//
16//===----------------------------------------------------------------------===//
17
18#include "InternalChecks.h"
19#include "clang/Basic/TargetInfo.h"
20#include "clang/StaticAnalyzer/BugReporter/BugType.h"
21#include "clang/StaticAnalyzer/PathSensitive/CheckerVisitor.h"
22#include "clang/StaticAnalyzer/PathSensitive/GRStateTrait.h"
23#include "llvm/ADT/SmallString.h"
24#include "llvm/ADT/StringSwitch.h"
25#include "llvm/Support/raw_ostream.h"
26
27using namespace clang;
28using namespace ento;
29
30namespace {
31class MacOSXAPIChecker : public CheckerVisitor<MacOSXAPIChecker> {
32  enum SubChecks {
33    DispatchOnce = 0,
34    DispatchOnceF,
35    NumChecks
36  };
37
38  BugType *BTypes[NumChecks];
39
40public:
41  MacOSXAPIChecker() { memset(BTypes, 0, sizeof(*BTypes) * NumChecks); }
42  static void *getTag() { static unsigned tag = 0; return &tag; }
43
44  void PreVisitCallExpr(CheckerContext &C, const CallExpr *CE);
45};
46} //end anonymous namespace
47
48void ento::RegisterMacOSXAPIChecker(ExprEngine &Eng) {
49  if (Eng.getContext().Target.getTriple().getVendor() == llvm::Triple::Apple)
50    Eng.registerCheck(new MacOSXAPIChecker());
51}
52
53//===----------------------------------------------------------------------===//
54// dispatch_once and dispatch_once_f
55//===----------------------------------------------------------------------===//
56
57static void CheckDispatchOnce(CheckerContext &C, const CallExpr *CE,
58                              BugType *&BT, const IdentifierInfo *FI) {
59
60  if (!BT) {
61    llvm::SmallString<128> S;
62    llvm::raw_svector_ostream os(S);
63    os << "Improper use of '" << FI->getName() << '\'';
64    BT = new BugType(os.str(), "Mac OS X API");
65  }
66
67  if (CE->getNumArgs() < 1)
68    return;
69
70  // Check if the first argument is stack allocated.  If so, issue a warning
71  // because that's likely to be bad news.
72  const GRState *state = C.getState();
73  const MemRegion *R = state->getSVal(CE->getArg(0)).getAsRegion();
74  if (!R || !isa<StackSpaceRegion>(R->getMemorySpace()))
75    return;
76
77  ExplodedNode *N = C.generateSink(state);
78  if (!N)
79    return;
80
81  llvm::SmallString<256> S;
82  llvm::raw_svector_ostream os(S);
83  os << "Call to '" << FI->getName() << "' uses";
84  if (const VarRegion *VR = dyn_cast<VarRegion>(R))
85    os << " the local variable '" << VR->getDecl()->getName() << '\'';
86  else
87    os << " stack allocated memory";
88  os << " for the predicate value.  Using such transient memory for "
89        "the predicate is potentially dangerous.";
90  if (isa<VarRegion>(R) && isa<StackLocalsSpaceRegion>(R->getMemorySpace()))
91    os << "  Perhaps you intended to declare the variable as 'static'?";
92
93  EnhancedBugReport *report = new EnhancedBugReport(*BT, os.str(), N);
94  report->addRange(CE->getArg(0)->getSourceRange());
95  C.EmitReport(report);
96}
97
98//===----------------------------------------------------------------------===//
99// Central dispatch function.
100//===----------------------------------------------------------------------===//
101
102typedef void (*SubChecker)(CheckerContext &C, const CallExpr *CE, BugType *&BT,
103                           const IdentifierInfo *FI);
104namespace {
105  class SubCheck {
106    SubChecker SC;
107    BugType **BT;
108  public:
109    SubCheck(SubChecker sc, BugType *& bt) : SC(sc), BT(&bt) {}
110    SubCheck() : SC(NULL), BT(NULL) {}
111
112    void run(CheckerContext &C, const CallExpr *CE,
113             const IdentifierInfo *FI) const {
114      if (SC)
115        SC(C, CE, *BT, FI);
116    }
117  };
118} // end anonymous namespace
119
120void MacOSXAPIChecker::PreVisitCallExpr(CheckerContext &C, const CallExpr *CE) {
121  // FIXME: Mostly copy and paste from UnixAPIChecker.  Should refactor.
122  const GRState *state = C.getState();
123  const Expr *Callee = CE->getCallee();
124  const FunctionTextRegion *Fn =
125    dyn_cast_or_null<FunctionTextRegion>(state->getSVal(Callee).getAsRegion());
126
127  if (!Fn)
128    return;
129
130  const IdentifierInfo *FI = Fn->getDecl()->getIdentifier();
131  if (!FI)
132    return;
133
134  const SubCheck &SC =
135    llvm::StringSwitch<SubCheck>(FI->getName())
136      .Case("dispatch_once", SubCheck(CheckDispatchOnce, BTypes[DispatchOnce]))
137      .Case("dispatch_once_f", SubCheck(CheckDispatchOnce,
138                                        BTypes[DispatchOnceF]))
139      .Default(SubCheck());
140
141  SC.run(C, CE, FI);
142}
143