1//=- NSErrorChecker.cpp - Coding conventions for uses of NSError -*- C++ -*-==//
2//
3//                     The LLVM Compiler Infrastructure
4//
5// This file is distributed under the University of Illinois Open Source
6// License. See LICENSE.TXT for details.
7//
8//===----------------------------------------------------------------------===//
9//
10//  This file defines a CheckNSError, a flow-insenstive check
11//  that determines if an Objective-C class interface correctly returns
12//  a non-void return type.
13//
14//  File under feature request PR 2600.
15//
16//===----------------------------------------------------------------------===//
17
18#include "ClangSACheckers.h"
19#include "clang/AST/Decl.h"
20#include "clang/AST/DeclObjC.h"
21#include "clang/StaticAnalyzer/Core/BugReporter/BugType.h"
22#include "clang/StaticAnalyzer/Core/Checker.h"
23#include "clang/StaticAnalyzer/Core/CheckerManager.h"
24#include "clang/StaticAnalyzer/Core/PathSensitive/CheckerContext.h"
25#include "clang/StaticAnalyzer/Core/PathSensitive/ProgramStateTrait.h"
26#include "llvm/ADT/SmallString.h"
27#include "llvm/Support/raw_ostream.h"
28
29using namespace clang;
30using namespace ento;
31
32static bool IsNSError(QualType T, IdentifierInfo *II);
33static bool IsCFError(QualType T, IdentifierInfo *II);
34
35//===----------------------------------------------------------------------===//
36// NSErrorMethodChecker
37//===----------------------------------------------------------------------===//
38
39namespace {
40class NSErrorMethodChecker
41    : public Checker< check::ASTDecl<ObjCMethodDecl> > {
42  mutable IdentifierInfo *II;
43
44public:
45  NSErrorMethodChecker() : II(nullptr) {}
46
47  void checkASTDecl(const ObjCMethodDecl *D,
48                    AnalysisManager &mgr, BugReporter &BR) const;
49};
50}
51
52void NSErrorMethodChecker::checkASTDecl(const ObjCMethodDecl *D,
53                                        AnalysisManager &mgr,
54                                        BugReporter &BR) const {
55  if (!D->isThisDeclarationADefinition())
56    return;
57  if (!D->getReturnType()->isVoidType())
58    return;
59
60  if (!II)
61    II = &D->getASTContext().Idents.get("NSError");
62
63  bool hasNSError = false;
64  for (const auto *I : D->params())  {
65    if (IsNSError(I->getType(), II)) {
66      hasNSError = true;
67      break;
68    }
69  }
70
71  if (hasNSError) {
72    const char *err = "Method accepting NSError** "
73        "should have a non-void return value to indicate whether or not an "
74        "error occurred";
75    PathDiagnosticLocation L =
76      PathDiagnosticLocation::create(D, BR.getSourceManager());
77    BR.EmitBasicReport(D, this, "Bad return type when passing NSError**",
78                       "Coding conventions (Apple)", err, L);
79  }
80}
81
82//===----------------------------------------------------------------------===//
83// CFErrorFunctionChecker
84//===----------------------------------------------------------------------===//
85
86namespace {
87class CFErrorFunctionChecker
88    : public Checker< check::ASTDecl<FunctionDecl> > {
89  mutable IdentifierInfo *II;
90
91public:
92  CFErrorFunctionChecker() : II(nullptr) {}
93
94  void checkASTDecl(const FunctionDecl *D,
95                    AnalysisManager &mgr, BugReporter &BR) const;
96};
97}
98
99void CFErrorFunctionChecker::checkASTDecl(const FunctionDecl *D,
100                                        AnalysisManager &mgr,
101                                        BugReporter &BR) const {
102  if (!D->doesThisDeclarationHaveABody())
103    return;
104  if (!D->getReturnType()->isVoidType())
105    return;
106
107  if (!II)
108    II = &D->getASTContext().Idents.get("CFErrorRef");
109
110  bool hasCFError = false;
111  for (auto I : D->params())  {
112    if (IsCFError(I->getType(), II)) {
113      hasCFError = true;
114      break;
115    }
116  }
117
118  if (hasCFError) {
119    const char *err = "Function accepting CFErrorRef* "
120        "should have a non-void return value to indicate whether or not an "
121        "error occurred";
122    PathDiagnosticLocation L =
123      PathDiagnosticLocation::create(D, BR.getSourceManager());
124    BR.EmitBasicReport(D, this, "Bad return type when passing CFErrorRef*",
125                       "Coding conventions (Apple)", err, L);
126  }
127}
128
129//===----------------------------------------------------------------------===//
130// NSOrCFErrorDerefChecker
131//===----------------------------------------------------------------------===//
132
133namespace {
134
135class NSErrorDerefBug : public BugType {
136public:
137  NSErrorDerefBug(const CheckerBase *Checker)
138      : BugType(Checker, "NSError** null dereference",
139                "Coding conventions (Apple)") {}
140};
141
142class CFErrorDerefBug : public BugType {
143public:
144  CFErrorDerefBug(const CheckerBase *Checker)
145      : BugType(Checker, "CFErrorRef* null dereference",
146                "Coding conventions (Apple)") {}
147};
148
149}
150
151namespace {
152class NSOrCFErrorDerefChecker
153    : public Checker< check::Location,
154                        check::Event<ImplicitNullDerefEvent> > {
155  mutable IdentifierInfo *NSErrorII, *CFErrorII;
156  mutable std::unique_ptr<NSErrorDerefBug> NSBT;
157  mutable std::unique_ptr<CFErrorDerefBug> CFBT;
158public:
159  bool ShouldCheckNSError, ShouldCheckCFError;
160  NSOrCFErrorDerefChecker() : NSErrorII(nullptr), CFErrorII(nullptr),
161                              ShouldCheckNSError(0), ShouldCheckCFError(0) { }
162
163  void checkLocation(SVal loc, bool isLoad, const Stmt *S,
164                     CheckerContext &C) const;
165  void checkEvent(ImplicitNullDerefEvent event) const;
166};
167}
168
169typedef llvm::ImmutableMap<SymbolRef, unsigned> ErrorOutFlag;
170REGISTER_TRAIT_WITH_PROGRAMSTATE(NSErrorOut, ErrorOutFlag)
171REGISTER_TRAIT_WITH_PROGRAMSTATE(CFErrorOut, ErrorOutFlag)
172
173template <typename T>
174static bool hasFlag(SVal val, ProgramStateRef state) {
175  if (SymbolRef sym = val.getAsSymbol())
176    if (const unsigned *attachedFlags = state->get<T>(sym))
177      return *attachedFlags;
178  return false;
179}
180
181template <typename T>
182static void setFlag(ProgramStateRef state, SVal val, CheckerContext &C) {
183  // We tag the symbol that the SVal wraps.
184  if (SymbolRef sym = val.getAsSymbol())
185    C.addTransition(state->set<T>(sym, true));
186}
187
188static QualType parameterTypeFromSVal(SVal val, CheckerContext &C) {
189  const StackFrameContext *
190    SFC = C.getLocationContext()->getCurrentStackFrame();
191  if (Optional<loc::MemRegionVal> X = val.getAs<loc::MemRegionVal>()) {
192    const MemRegion* R = X->getRegion();
193    if (const VarRegion *VR = R->getAs<VarRegion>())
194      if (const StackArgumentsSpaceRegion *
195          stackReg = dyn_cast<StackArgumentsSpaceRegion>(VR->getMemorySpace()))
196        if (stackReg->getStackFrame() == SFC)
197          return VR->getValueType();
198  }
199
200  return QualType();
201}
202
203void NSOrCFErrorDerefChecker::checkLocation(SVal loc, bool isLoad,
204                                            const Stmt *S,
205                                            CheckerContext &C) const {
206  if (!isLoad)
207    return;
208  if (loc.isUndef() || !loc.getAs<Loc>())
209    return;
210
211  ASTContext &Ctx = C.getASTContext();
212  ProgramStateRef state = C.getState();
213
214  // If we are loading from NSError**/CFErrorRef* parameter, mark the resulting
215  // SVal so that we can later check it when handling the
216  // ImplicitNullDerefEvent event.
217  // FIXME: Cumbersome! Maybe add hook at construction of SVals at start of
218  // function ?
219
220  QualType parmT = parameterTypeFromSVal(loc, C);
221  if (parmT.isNull())
222    return;
223
224  if (!NSErrorII)
225    NSErrorII = &Ctx.Idents.get("NSError");
226  if (!CFErrorII)
227    CFErrorII = &Ctx.Idents.get("CFErrorRef");
228
229  if (ShouldCheckNSError && IsNSError(parmT, NSErrorII)) {
230    setFlag<NSErrorOut>(state, state->getSVal(loc.castAs<Loc>()), C);
231    return;
232  }
233
234  if (ShouldCheckCFError && IsCFError(parmT, CFErrorII)) {
235    setFlag<CFErrorOut>(state, state->getSVal(loc.castAs<Loc>()), C);
236    return;
237  }
238}
239
240void NSOrCFErrorDerefChecker::checkEvent(ImplicitNullDerefEvent event) const {
241  if (event.IsLoad)
242    return;
243
244  SVal loc = event.Location;
245  ProgramStateRef state = event.SinkNode->getState();
246  BugReporter &BR = *event.BR;
247
248  bool isNSError = hasFlag<NSErrorOut>(loc, state);
249  bool isCFError = false;
250  if (!isNSError)
251    isCFError = hasFlag<CFErrorOut>(loc, state);
252
253  if (!(isNSError || isCFError))
254    return;
255
256  // Storing to possible null NSError/CFErrorRef out parameter.
257  SmallString<128> Buf;
258  llvm::raw_svector_ostream os(Buf);
259
260  os << "Potential null dereference.  According to coding standards ";
261  os << (isNSError
262         ? "in 'Creating and Returning NSError Objects' the parameter"
263         : "documented in CoreFoundation/CFError.h the parameter");
264
265  os  << " may be null";
266
267  BugType *bug = nullptr;
268  if (isNSError) {
269    if (!NSBT)
270      NSBT.reset(new NSErrorDerefBug(this));
271    bug = NSBT.get();
272  }
273  else {
274    if (!CFBT)
275      CFBT.reset(new CFErrorDerefBug(this));
276    bug = CFBT.get();
277  }
278  BugReport *report = new BugReport(*bug, os.str(), event.SinkNode);
279  BR.emitReport(report);
280}
281
282static bool IsNSError(QualType T, IdentifierInfo *II) {
283
284  const PointerType* PPT = T->getAs<PointerType>();
285  if (!PPT)
286    return false;
287
288  const ObjCObjectPointerType* PT =
289    PPT->getPointeeType()->getAs<ObjCObjectPointerType>();
290
291  if (!PT)
292    return false;
293
294  const ObjCInterfaceDecl *ID = PT->getInterfaceDecl();
295
296  // FIXME: Can ID ever be NULL?
297  if (ID)
298    return II == ID->getIdentifier();
299
300  return false;
301}
302
303static bool IsCFError(QualType T, IdentifierInfo *II) {
304  const PointerType* PPT = T->getAs<PointerType>();
305  if (!PPT) return false;
306
307  const TypedefType* TT = PPT->getPointeeType()->getAs<TypedefType>();
308  if (!TT) return false;
309
310  return TT->getDecl()->getIdentifier() == II;
311}
312
313void ento::registerNSErrorChecker(CheckerManager &mgr) {
314  mgr.registerChecker<NSErrorMethodChecker>();
315  NSOrCFErrorDerefChecker *checker =
316      mgr.registerChecker<NSOrCFErrorDerefChecker>();
317  checker->ShouldCheckNSError = true;
318}
319
320void ento::registerCFErrorChecker(CheckerManager &mgr) {
321  mgr.registerChecker<CFErrorFunctionChecker>();
322  NSOrCFErrorDerefChecker *checker =
323      mgr.registerChecker<NSOrCFErrorDerefChecker>();
324  checker->ShouldCheckCFError = true;
325}
326