MacOSXAPIChecker.cpp revision 57964bda54c9b1e10090cae94d776a6b9b7eca33
1868fa2fe829687343ffae624259930155e16dbd8Torne (Richard Coles)// MacOSXAPIChecker.h - Checks proper use of various MacOS X APIs --*- C++ -*-// 2868fa2fe829687343ffae624259930155e16dbd8Torne (Richard Coles)// 3868fa2fe829687343ffae624259930155e16dbd8Torne (Richard Coles)// The LLVM Compiler Infrastructure 4868fa2fe829687343ffae624259930155e16dbd8Torne (Richard Coles)// 5868fa2fe829687343ffae624259930155e16dbd8Torne (Richard Coles)// This file is distributed under the University of Illinois Open Source 6868fa2fe829687343ffae624259930155e16dbd8Torne (Richard Coles)// License. See LICENSE.TXT for details. 7868fa2fe829687343ffae624259930155e16dbd8Torne (Richard Coles)// 8868fa2fe829687343ffae624259930155e16dbd8Torne (Richard Coles)//===----------------------------------------------------------------------===// 97dbb3d5cf0c15f500944d211057644d6a2f37371Ben Murdoch// 10868fa2fe829687343ffae624259930155e16dbd8Torne (Richard Coles)// This defines MacOSXAPIChecker, which is an assortment of checks on calls 11868fa2fe829687343ffae624259930155e16dbd8Torne (Richard Coles)// to various, widely used Mac OS X functions. 12868fa2fe829687343ffae624259930155e16dbd8Torne (Richard Coles)// 137dbb3d5cf0c15f500944d211057644d6a2f37371Ben Murdoch// FIXME: What's currently in BasicObjCFoundationChecks.cpp should be migrated 14868fa2fe829687343ffae624259930155e16dbd8Torne (Richard Coles)// to here, using the new Checker interface. 15868fa2fe829687343ffae624259930155e16dbd8Torne (Richard Coles)// 16868fa2fe829687343ffae624259930155e16dbd8Torne (Richard Coles)//===----------------------------------------------------------------------===// 17868fa2fe829687343ffae624259930155e16dbd8Torne (Richard Coles) 18868fa2fe829687343ffae624259930155e16dbd8Torne (Richard Coles)#include "ClangSACheckers.h" 19868fa2fe829687343ffae624259930155e16dbd8Torne (Richard Coles)#include "clang/StaticAnalyzer/Core/Checker.h" 20868fa2fe829687343ffae624259930155e16dbd8Torne (Richard Coles)#include "clang/StaticAnalyzer/Core/CheckerManager.h" 21868fa2fe829687343ffae624259930155e16dbd8Torne (Richard Coles)#include "clang/StaticAnalyzer/Core/PathSensitive/CheckerContext.h" 22868fa2fe829687343ffae624259930155e16dbd8Torne (Richard Coles)#include "clang/StaticAnalyzer/Core/BugReporter/BugType.h" 23868fa2fe829687343ffae624259930155e16dbd8Torne (Richard Coles)#include "clang/StaticAnalyzer/Core/PathSensitive/GRStateTrait.h" 24868fa2fe829687343ffae624259930155e16dbd8Torne (Richard Coles)#include "clang/Basic/TargetInfo.h" 25868fa2fe829687343ffae624259930155e16dbd8Torne (Richard Coles)#include "llvm/ADT/SmallString.h" 26868fa2fe829687343ffae624259930155e16dbd8Torne (Richard Coles)#include "llvm/ADT/StringSwitch.h" 27868fa2fe829687343ffae624259930155e16dbd8Torne (Richard Coles)#include "llvm/Support/raw_ostream.h" 28868fa2fe829687343ffae624259930155e16dbd8Torne (Richard Coles) 29868fa2fe829687343ffae624259930155e16dbd8Torne (Richard Coles)using namespace clang; 30868fa2fe829687343ffae624259930155e16dbd8Torne (Richard Coles)using namespace ento; 31868fa2fe829687343ffae624259930155e16dbd8Torne (Richard Coles) 32868fa2fe829687343ffae624259930155e16dbd8Torne (Richard Coles)namespace { 33868fa2fe829687343ffae624259930155e16dbd8Torne (Richard Coles)class MacOSXAPIChecker : public Checker< check::PreStmt<CallExpr> > { 347dbb3d5cf0c15f500944d211057644d6a2f37371Ben Murdoch mutable llvm::OwningPtr<BugType> BT_dispatchOnce; 357dbb3d5cf0c15f500944d211057644d6a2f37371Ben Murdoch 367dbb3d5cf0c15f500944d211057644d6a2f37371Ben Murdochpublic: 377dbb3d5cf0c15f500944d211057644d6a2f37371Ben Murdoch void checkPreStmt(const CallExpr *CE, CheckerContext &C) const; 387dbb3d5cf0c15f500944d211057644d6a2f37371Ben Murdoch 397dbb3d5cf0c15f500944d211057644d6a2f37371Ben Murdoch void CheckDispatchOnce(CheckerContext &C, const CallExpr *CE, 407dbb3d5cf0c15f500944d211057644d6a2f37371Ben Murdoch const IdentifierInfo *FI) const; 417dbb3d5cf0c15f500944d211057644d6a2f37371Ben Murdoch 427dbb3d5cf0c15f500944d211057644d6a2f37371Ben Murdoch typedef void (MacOSXAPIChecker::*SubChecker)(CheckerContext &, 437dbb3d5cf0c15f500944d211057644d6a2f37371Ben Murdoch const CallExpr *, 447dbb3d5cf0c15f500944d211057644d6a2f37371Ben Murdoch const IdentifierInfo *) const; 457dbb3d5cf0c15f500944d211057644d6a2f37371Ben Murdoch}; 467dbb3d5cf0c15f500944d211057644d6a2f37371Ben Murdoch} //end anonymous namespace 477dbb3d5cf0c15f500944d211057644d6a2f37371Ben Murdoch 487dbb3d5cf0c15f500944d211057644d6a2f37371Ben Murdoch//===----------------------------------------------------------------------===// 49868fa2fe829687343ffae624259930155e16dbd8Torne (Richard Coles)// dispatch_once and dispatch_once_f 50868fa2fe829687343ffae624259930155e16dbd8Torne (Richard Coles)//===----------------------------------------------------------------------===// 51868fa2fe829687343ffae624259930155e16dbd8Torne (Richard Coles) 52868fa2fe829687343ffae624259930155e16dbd8Torne (Richard Coles)void MacOSXAPIChecker::CheckDispatchOnce(CheckerContext &C, const CallExpr *CE, 53868fa2fe829687343ffae624259930155e16dbd8Torne (Richard Coles) const IdentifierInfo *FI) const { 54868fa2fe829687343ffae624259930155e16dbd8Torne (Richard Coles) if (CE->getNumArgs() < 1) 55868fa2fe829687343ffae624259930155e16dbd8Torne (Richard Coles) return; 56868fa2fe829687343ffae624259930155e16dbd8Torne (Richard Coles) 57868fa2fe829687343ffae624259930155e16dbd8Torne (Richard Coles) // Check if the first argument is stack allocated. If so, issue a warning 58868fa2fe829687343ffae624259930155e16dbd8Torne (Richard Coles) // because that's likely to be bad news. 59868fa2fe829687343ffae624259930155e16dbd8Torne (Richard Coles) const GRState *state = C.getState(); 60868fa2fe829687343ffae624259930155e16dbd8Torne (Richard Coles) const MemRegion *R = state->getSVal(CE->getArg(0)).getAsRegion(); 61868fa2fe829687343ffae624259930155e16dbd8Torne (Richard Coles) if (!R || !isa<StackSpaceRegion>(R->getMemorySpace())) 62868fa2fe829687343ffae624259930155e16dbd8Torne (Richard Coles) return; 63868fa2fe829687343ffae624259930155e16dbd8Torne (Richard Coles) 64868fa2fe829687343ffae624259930155e16dbd8Torne (Richard Coles) ExplodedNode *N = C.generateSink(state); 65868fa2fe829687343ffae624259930155e16dbd8Torne (Richard Coles) if (!N) 66868fa2fe829687343ffae624259930155e16dbd8Torne (Richard Coles) return; 67868fa2fe829687343ffae624259930155e16dbd8Torne (Richard Coles) 68868fa2fe829687343ffae624259930155e16dbd8Torne (Richard Coles) if (!BT_dispatchOnce) 69868fa2fe829687343ffae624259930155e16dbd8Torne (Richard Coles) BT_dispatchOnce.reset(new BugType("Improper use of 'dispatch_once'", 707dbb3d5cf0c15f500944d211057644d6a2f37371Ben Murdoch "Mac OS X API")); 71868fa2fe829687343ffae624259930155e16dbd8Torne (Richard Coles) 72868fa2fe829687343ffae624259930155e16dbd8Torne (Richard Coles) llvm::SmallString<256> S; 73868fa2fe829687343ffae624259930155e16dbd8Torne (Richard Coles) llvm::raw_svector_ostream os(S); 74868fa2fe829687343ffae624259930155e16dbd8Torne (Richard Coles) os << "Call to '" << FI->getName() << "' uses"; 75868fa2fe829687343ffae624259930155e16dbd8Torne (Richard Coles) if (const VarRegion *VR = dyn_cast<VarRegion>(R)) 76868fa2fe829687343ffae624259930155e16dbd8Torne (Richard Coles) os << " the local variable '" << VR->getDecl()->getName() << '\''; 77868fa2fe829687343ffae624259930155e16dbd8Torne (Richard Coles) else 78868fa2fe829687343ffae624259930155e16dbd8Torne (Richard Coles) os << " stack allocated memory"; 79868fa2fe829687343ffae624259930155e16dbd8Torne (Richard Coles) os << " for the predicate value. Using such transient memory for " 80868fa2fe829687343ffae624259930155e16dbd8Torne (Richard Coles) "the predicate is potentially dangerous."; 81868fa2fe829687343ffae624259930155e16dbd8Torne (Richard Coles) if (isa<VarRegion>(R) && isa<StackLocalsSpaceRegion>(R->getMemorySpace())) 82868fa2fe829687343ffae624259930155e16dbd8Torne (Richard Coles) os << " Perhaps you intended to declare the variable as 'static'?"; 83868fa2fe829687343ffae624259930155e16dbd8Torne (Richard Coles) 84868fa2fe829687343ffae624259930155e16dbd8Torne (Richard Coles) RangedBugReport *report = new RangedBugReport(*BT_dispatchOnce, os.str(), N); 85868fa2fe829687343ffae624259930155e16dbd8Torne (Richard Coles) report->addRange(CE->getArg(0)->getSourceRange()); 86868fa2fe829687343ffae624259930155e16dbd8Torne (Richard Coles) C.EmitReport(report); 87868fa2fe829687343ffae624259930155e16dbd8Torne (Richard Coles)} 88868fa2fe829687343ffae624259930155e16dbd8Torne (Richard Coles) 89868fa2fe829687343ffae624259930155e16dbd8Torne (Richard Coles)//===----------------------------------------------------------------------===// 90868fa2fe829687343ffae624259930155e16dbd8Torne (Richard Coles)// Central dispatch function. 91868fa2fe829687343ffae624259930155e16dbd8Torne (Richard Coles)//===----------------------------------------------------------------------===// 92868fa2fe829687343ffae624259930155e16dbd8Torne (Richard Coles) 93void MacOSXAPIChecker::checkPreStmt(const CallExpr *CE, 94 CheckerContext &C) const { 95 // FIXME: This sort of logic is common to several checkers, including 96 // UnixAPIChecker, PthreadLockChecker, and CStringChecker. Should refactor. 97 const GRState *state = C.getState(); 98 const Expr *Callee = CE->getCallee(); 99 const FunctionDecl *Fn = state->getSVal(Callee).getAsFunctionDecl(); 100 101 if (!Fn) 102 return; 103 104 const IdentifierInfo *FI = Fn->getIdentifier(); 105 if (!FI) 106 return; 107 108 SubChecker SC = 109 llvm::StringSwitch<SubChecker>(FI->getName()) 110 .Cases("dispatch_once", "dispatch_once_f", 111 &MacOSXAPIChecker::CheckDispatchOnce) 112 .Default(NULL); 113 114 if (SC) 115 (this->*SC)(C, CE, FI); 116} 117 118//===----------------------------------------------------------------------===// 119// Registration. 120//===----------------------------------------------------------------------===// 121 122void ento::registerMacOSXAPIChecker(CheckerManager &mgr) { 123 mgr.registerChecker<MacOSXAPIChecker>(); 124} 125