ReturnUndefChecker.cpp revision c236b7327f989c1e7fe6b08a188bfef86727513d
1//== ReturnUndefChecker.cpp -------------------------------------*- C++ -*--==// 2// 3// The LLVM Compiler Infrastructure 4// 5// This file is distributed under the University of Illinois Open Source 6// License. See LICENSE.TXT for details. 7// 8//===----------------------------------------------------------------------===// 9// 10// This file defines ReturnUndefChecker, which is a path-sensitive 11// check which looks for undefined or garbage values being returned to the 12// caller. 13// 14//===----------------------------------------------------------------------===// 15 16#include "ClangSACheckers.h" 17#include "clang/StaticAnalyzer/Core/BugReporter/BugType.h" 18#include "clang/StaticAnalyzer/Core/Checker.h" 19#include "clang/StaticAnalyzer/Core/CheckerManager.h" 20#include "clang/StaticAnalyzer/Core/PathSensitive/CallEvent.h" 21#include "clang/StaticAnalyzer/Core/PathSensitive/CheckerContext.h" 22 23using namespace clang; 24using namespace ento; 25 26namespace { 27class ReturnUndefChecker : public Checker< check::PreStmt<ReturnStmt> > { 28 mutable OwningPtr<BuiltinBug> BT_Undef; 29 mutable OwningPtr<BuiltinBug> BT_NullReference; 30 31 void emitUndef(CheckerContext &C, const Expr *RetE) const; 32 void checkReference(CheckerContext &C, const Expr *RetE, 33 DefinedOrUnknownSVal RetVal) const; 34public: 35 void checkPreStmt(const ReturnStmt *RS, CheckerContext &C) const; 36}; 37} 38 39void ReturnUndefChecker::checkPreStmt(const ReturnStmt *RS, 40 CheckerContext &C) const { 41 const Expr *RetE = RS->getRetValue(); 42 if (!RetE) 43 return; 44 SVal RetVal = C.getSVal(RetE); 45 46 const StackFrameContext *SFC = C.getStackFrame(); 47 QualType RT = CallEvent::getDeclaredResultType(SFC->getDecl()); 48 49 if (RetVal.isUndef()) { 50 // "return;" is modeled to evaluate to an UndefinedVal. Allow UndefinedVal 51 // to be returned in functions returning void to support this pattern: 52 // void foo() { 53 // return; 54 // } 55 // void test() { 56 // return foo(); 57 // } 58 if (RT.isNull() || !RT->isVoidType()) 59 emitUndef(C, RetE); 60 return; 61 } 62 63 if (RT.isNull()) 64 return; 65 66 if (RT->isReferenceType()) { 67 checkReference(C, RetE, RetVal.castAs<DefinedOrUnknownSVal>()); 68 return; 69 } 70} 71 72static void emitBug(CheckerContext &C, BuiltinBug &BT, const Expr *RetE, 73 const Expr *TrackingE = 0) { 74 ExplodedNode *N = C.generateSink(); 75 if (!N) 76 return; 77 78 BugReport *Report = new BugReport(BT, BT.getDescription(), N); 79 80 Report->addRange(RetE->getSourceRange()); 81 bugreporter::trackNullOrUndefValue(N, TrackingE ? TrackingE : RetE, *Report); 82 83 C.emitReport(Report); 84} 85 86void ReturnUndefChecker::emitUndef(CheckerContext &C, const Expr *RetE) const { 87 if (!BT_Undef) 88 BT_Undef.reset(new BuiltinBug("Garbage return value", 89 "Undefined or garbage value " 90 "returned to caller")); 91 emitBug(C, *BT_Undef, RetE); 92} 93 94void ReturnUndefChecker::checkReference(CheckerContext &C, const Expr *RetE, 95 DefinedOrUnknownSVal RetVal) const { 96 ProgramStateRef StNonNull, StNull; 97 llvm::tie(StNonNull, StNull) = C.getState()->assume(RetVal); 98 99 if (StNonNull) { 100 // Going forward, assume the location is non-null. 101 C.addTransition(StNonNull); 102 return; 103 } 104 105 // The return value is known to be null. Emit a bug report. 106 if (!BT_NullReference) 107 BT_NullReference.reset(new BuiltinBug("Returning null reference")); 108 109 emitBug(C, *BT_NullReference, RetE, bugreporter::getDerefExpr(RetE)); 110} 111 112void ento::registerReturnUndefChecker(CheckerManager &mgr) { 113 mgr.registerChecker<ReturnUndefChecker>(); 114} 115