1//== Nullabilityhecker.cpp - Nullability checker ----------------*- C++ -*--==// 2// 3// The LLVM Compiler Infrastructure 4// 5// This file is distributed under the University of Illinois Open Source 6// License. See LICENSE.TXT for details. 7// 8//===----------------------------------------------------------------------===// 9// 10// This checker tries to find nullability violations. There are several kinds of 11// possible violations: 12// * Null pointer is passed to a pointer which has a _Nonnull type. 13// * Null pointer is returned from a function which has a _Nonnull return type. 14// * Nullable pointer is passed to a pointer which has a _Nonnull type. 15// * Nullable pointer is returned from a function which has a _Nonnull return 16// type. 17// * Nullable pointer is dereferenced. 18// 19// This checker propagates the nullability information of the pointers and looks 20// for the patterns that are described above. Explicit casts are trusted and are 21// considered a way to suppress false positives for this checker. The other way 22// to suppress warnings would be to add asserts or guarding if statements to the 23// code. In addition to the nullability propagation this checker also uses some 24// heuristics to suppress potential false positives. 25// 26//===----------------------------------------------------------------------===// 27 28#include "ClangSACheckers.h" 29#include "llvm/Support/Path.h" 30#include "clang/StaticAnalyzer/Core/BugReporter/BugType.h" 31#include "clang/StaticAnalyzer/Core/Checker.h" 32#include "clang/StaticAnalyzer/Core/CheckerManager.h" 33#include "clang/StaticAnalyzer/Core/PathSensitive/CheckerContext.h" 34#include "clang/StaticAnalyzer/Core/PathSensitive/CallEvent.h" 35 36using namespace clang; 37using namespace ento; 38 39namespace { 40// Do not reorder! The getMostNullable method relies on the order. 41// Optimization: Most pointers expected to be unspecified. When a symbol has an 42// unspecified or nonnull type non of the rules would indicate any problem for 43// that symbol. For this reason only nullable and contradicted nullability are 44// stored for a symbol. When a symbol is already contradicted, it can not be 45// casted back to nullable. 46enum class Nullability : char { 47 Contradicted, // Tracked nullability is contradicted by an explicit cast. Do 48 // not report any nullability related issue for this symbol. 49 // This nullability is propagated agressively to avoid false 50 // positive results. See the comment on getMostNullable method. 51 Nullable, 52 Unspecified, 53 Nonnull 54}; 55 56/// Returns the most nullable nullability. This is used for message expressions 57/// like [reciever method], where the nullability of this expression is either 58/// the nullability of the receiver or the nullability of the return type of the 59/// method, depending on which is more nullable. Contradicted is considered to 60/// be the most nullable, to avoid false positive results. 61Nullability getMostNullable(Nullability Lhs, Nullability Rhs) { 62 return static_cast<Nullability>( 63 std::min(static_cast<char>(Lhs), static_cast<char>(Rhs))); 64} 65 66const char *getNullabilityString(Nullability Nullab) { 67 switch (Nullab) { 68 case Nullability::Contradicted: 69 return "contradicted"; 70 case Nullability::Nullable: 71 return "nullable"; 72 case Nullability::Unspecified: 73 return "unspecified"; 74 case Nullability::Nonnull: 75 return "nonnull"; 76 } 77 llvm_unreachable("Unexpected enumeration."); 78 return ""; 79} 80 81// These enums are used as an index to ErrorMessages array. 82enum class ErrorKind : int { 83 NilAssignedToNonnull, 84 NilPassedToNonnull, 85 NilReturnedToNonnull, 86 NullableAssignedToNonnull, 87 NullableReturnedToNonnull, 88 NullableDereferenced, 89 NullablePassedToNonnull 90}; 91 92const char *const ErrorMessages[] = { 93 "Null is assigned to a pointer which is expected to have non-null value", 94 "Null passed to a callee that requires a non-null argument", 95 "Null is returned from a function that is expected to return a non-null " 96 "value", 97 "Nullable pointer is assigned to a pointer which is expected to have " 98 "non-null value", 99 "Nullable pointer is returned from a function that is expected to return a " 100 "non-null value", 101 "Nullable pointer is dereferenced", 102 "Nullable pointer is passed to a callee that requires a non-null argument"}; 103 104class NullabilityChecker 105 : public Checker<check::Bind, check::PreCall, check::PreStmt<ReturnStmt>, 106 check::PostCall, check::PostStmt<ExplicitCastExpr>, 107 check::PostObjCMessage, check::DeadSymbols, 108 check::Event<ImplicitNullDerefEvent>> { 109 mutable std::unique_ptr<BugType> BT; 110 111public: 112 void checkBind(SVal L, SVal V, const Stmt *S, CheckerContext &C) const; 113 void checkPostStmt(const ExplicitCastExpr *CE, CheckerContext &C) const; 114 void checkPreStmt(const ReturnStmt *S, CheckerContext &C) const; 115 void checkPostObjCMessage(const ObjCMethodCall &M, CheckerContext &C) const; 116 void checkPostCall(const CallEvent &Call, CheckerContext &C) const; 117 void checkPreCall(const CallEvent &Call, CheckerContext &C) const; 118 void checkDeadSymbols(SymbolReaper &SR, CheckerContext &C) const; 119 void checkEvent(ImplicitNullDerefEvent Event) const; 120 121 void printState(raw_ostream &Out, ProgramStateRef State, const char *NL, 122 const char *Sep) const override; 123 124 struct NullabilityChecksFilter { 125 DefaultBool CheckNullPassedToNonnull; 126 DefaultBool CheckNullReturnedFromNonnull; 127 DefaultBool CheckNullableDereferenced; 128 DefaultBool CheckNullablePassedToNonnull; 129 DefaultBool CheckNullableReturnedFromNonnull; 130 131 CheckName CheckNameNullPassedToNonnull; 132 CheckName CheckNameNullReturnedFromNonnull; 133 CheckName CheckNameNullableDereferenced; 134 CheckName CheckNameNullablePassedToNonnull; 135 CheckName CheckNameNullableReturnedFromNonnull; 136 }; 137 138 NullabilityChecksFilter Filter; 139 // When set to false no nullability information will be tracked in 140 // NullabilityMap. It is possible to catch errors like passing a null pointer 141 // to a callee that expects nonnull argument without the information that is 142 // stroed in the NullabilityMap. This is an optimization. 143 DefaultBool NeedTracking; 144 145private: 146 class NullabilityBugVisitor 147 : public BugReporterVisitorImpl<NullabilityBugVisitor> { 148 public: 149 NullabilityBugVisitor(const MemRegion *M) : Region(M) {} 150 151 void Profile(llvm::FoldingSetNodeID &ID) const override { 152 static int X = 0; 153 ID.AddPointer(&X); 154 ID.AddPointer(Region); 155 } 156 157 PathDiagnosticPiece *VisitNode(const ExplodedNode *N, 158 const ExplodedNode *PrevN, 159 BugReporterContext &BRC, 160 BugReport &BR) override; 161 162 private: 163 // The tracked region. 164 const MemRegion *Region; 165 }; 166 167 /// When any of the nonnull arguments of the analyzed function is null, do not 168 /// report anything and turn off the check. 169 /// 170 /// When \p SuppressPath is set to true, no more bugs will be reported on this 171 /// path by this checker. 172 void reportBugIfPreconditionHolds(ErrorKind Error, ExplodedNode *N, 173 const MemRegion *Region, CheckerContext &C, 174 const Stmt *ValueExpr = nullptr, 175 bool SuppressPath = false) const; 176 177 void reportBug(ErrorKind Error, ExplodedNode *N, const MemRegion *Region, 178 BugReporter &BR, const Stmt *ValueExpr = nullptr) const { 179 if (!BT) 180 BT.reset(new BugType(this, "Nullability", "Memory error")); 181 const char *Msg = ErrorMessages[static_cast<int>(Error)]; 182 std::unique_ptr<BugReport> R(new BugReport(*BT, Msg, N)); 183 if (Region) { 184 R->markInteresting(Region); 185 R->addVisitor(llvm::make_unique<NullabilityBugVisitor>(Region)); 186 } 187 if (ValueExpr) { 188 R->addRange(ValueExpr->getSourceRange()); 189 if (Error == ErrorKind::NilAssignedToNonnull || 190 Error == ErrorKind::NilPassedToNonnull || 191 Error == ErrorKind::NilReturnedToNonnull) 192 bugreporter::trackNullOrUndefValue(N, ValueExpr, *R); 193 } 194 BR.emitReport(std::move(R)); 195 } 196 197 /// If an SVal wraps a region that should be tracked, it will return a pointer 198 /// to the wrapped region. Otherwise it will return a nullptr. 199 const SymbolicRegion *getTrackRegion(SVal Val, 200 bool CheckSuperRegion = false) const; 201}; 202 203class NullabilityState { 204public: 205 NullabilityState(Nullability Nullab, const Stmt *Source = nullptr) 206 : Nullab(Nullab), Source(Source) {} 207 208 const Stmt *getNullabilitySource() const { return Source; } 209 210 Nullability getValue() const { return Nullab; } 211 212 void Profile(llvm::FoldingSetNodeID &ID) const { 213 ID.AddInteger(static_cast<char>(Nullab)); 214 ID.AddPointer(Source); 215 } 216 217 void print(raw_ostream &Out) const { 218 Out << getNullabilityString(Nullab) << "\n"; 219 } 220 221private: 222 Nullability Nullab; 223 // Source is the expression which determined the nullability. For example in a 224 // message like [nullable nonnull_returning] has nullable nullability, because 225 // the receiver is nullable. Here the receiver will be the source of the 226 // nullability. This is useful information when the diagnostics are generated. 227 const Stmt *Source; 228}; 229 230bool operator==(NullabilityState Lhs, NullabilityState Rhs) { 231 return Lhs.getValue() == Rhs.getValue() && 232 Lhs.getNullabilitySource() == Rhs.getNullabilitySource(); 233} 234 235} // end anonymous namespace 236 237REGISTER_MAP_WITH_PROGRAMSTATE(NullabilityMap, const MemRegion *, 238 NullabilityState) 239 240// If the nullability precondition of a function is violated, we should not 241// report nullability related issues on that path. For this reason once a 242// precondition is not met on a path, this checker will be esentially turned off 243// for the rest of the analysis. We do not want to generate a sink node however, 244// so this checker would not lead to reduced coverage. 245REGISTER_TRAIT_WITH_PROGRAMSTATE(PreconditionViolated, bool) 246 247enum class NullConstraint { IsNull, IsNotNull, Unknown }; 248 249static NullConstraint getNullConstraint(DefinedOrUnknownSVal Val, 250 ProgramStateRef State) { 251 ConditionTruthVal Nullness = State->isNull(Val); 252 if (Nullness.isConstrainedFalse()) 253 return NullConstraint::IsNotNull; 254 if (Nullness.isConstrainedTrue()) 255 return NullConstraint::IsNull; 256 return NullConstraint::Unknown; 257} 258 259const SymbolicRegion * 260NullabilityChecker::getTrackRegion(SVal Val, bool CheckSuperRegion) const { 261 if (!NeedTracking) 262 return nullptr; 263 264 auto RegionSVal = Val.getAs<loc::MemRegionVal>(); 265 if (!RegionSVal) 266 return nullptr; 267 268 const MemRegion *Region = RegionSVal->getRegion(); 269 270 if (CheckSuperRegion) { 271 if (auto FieldReg = Region->getAs<FieldRegion>()) 272 return dyn_cast<SymbolicRegion>(FieldReg->getSuperRegion()); 273 if (auto ElementReg = Region->getAs<ElementRegion>()) 274 return dyn_cast<SymbolicRegion>(ElementReg->getSuperRegion()); 275 } 276 277 return dyn_cast<SymbolicRegion>(Region); 278} 279 280PathDiagnosticPiece *NullabilityChecker::NullabilityBugVisitor::VisitNode( 281 const ExplodedNode *N, const ExplodedNode *PrevN, BugReporterContext &BRC, 282 BugReport &BR) { 283 ProgramStateRef State = N->getState(); 284 ProgramStateRef StatePrev = PrevN->getState(); 285 286 const NullabilityState *TrackedNullab = State->get<NullabilityMap>(Region); 287 const NullabilityState *TrackedNullabPrev = 288 StatePrev->get<NullabilityMap>(Region); 289 if (!TrackedNullab) 290 return nullptr; 291 292 if (TrackedNullabPrev && 293 TrackedNullabPrev->getValue() == TrackedNullab->getValue()) 294 return nullptr; 295 296 // Retrieve the associated statement. 297 const Stmt *S = TrackedNullab->getNullabilitySource(); 298 if (!S) { 299 ProgramPoint ProgLoc = N->getLocation(); 300 if (Optional<StmtPoint> SP = ProgLoc.getAs<StmtPoint>()) { 301 S = SP->getStmt(); 302 } 303 } 304 305 if (!S) 306 return nullptr; 307 308 std::string InfoText = 309 (llvm::Twine("Nullability '") + 310 getNullabilityString(TrackedNullab->getValue()) + "' is infered") 311 .str(); 312 313 // Generate the extra diagnostic. 314 PathDiagnosticLocation Pos(S, BRC.getSourceManager(), 315 N->getLocationContext()); 316 return new PathDiagnosticEventPiece(Pos, InfoText, true, nullptr); 317} 318 319static Nullability getNullabilityAnnotation(QualType Type) { 320 const auto *AttrType = Type->getAs<AttributedType>(); 321 if (!AttrType) 322 return Nullability::Unspecified; 323 if (AttrType->getAttrKind() == AttributedType::attr_nullable) 324 return Nullability::Nullable; 325 else if (AttrType->getAttrKind() == AttributedType::attr_nonnull) 326 return Nullability::Nonnull; 327 return Nullability::Unspecified; 328} 329 330template <typename ParamVarDeclRange> 331static bool 332checkParamsForPreconditionViolation(const ParamVarDeclRange &Params, 333 ProgramStateRef State, 334 const LocationContext *LocCtxt) { 335 for (const auto *ParamDecl : Params) { 336 if (ParamDecl->isParameterPack()) 337 break; 338 339 if (getNullabilityAnnotation(ParamDecl->getType()) != Nullability::Nonnull) 340 continue; 341 342 auto RegVal = State->getLValue(ParamDecl, LocCtxt) 343 .template getAs<loc::MemRegionVal>(); 344 if (!RegVal) 345 continue; 346 347 auto ParamValue = State->getSVal(RegVal->getRegion()) 348 .template getAs<DefinedOrUnknownSVal>(); 349 if (!ParamValue) 350 continue; 351 352 if (getNullConstraint(*ParamValue, State) == NullConstraint::IsNull) { 353 return true; 354 } 355 } 356 return false; 357} 358 359static bool checkPreconditionViolation(ProgramStateRef State, ExplodedNode *N, 360 CheckerContext &C) { 361 if (State->get<PreconditionViolated>()) 362 return true; 363 364 const LocationContext *LocCtxt = C.getLocationContext(); 365 const Decl *D = LocCtxt->getDecl(); 366 if (!D) 367 return false; 368 369 if (const auto *BlockD = dyn_cast<BlockDecl>(D)) { 370 if (checkParamsForPreconditionViolation(BlockD->parameters(), State, 371 LocCtxt)) { 372 if (!N->isSink()) 373 C.addTransition(State->set<PreconditionViolated>(true), N); 374 return true; 375 } 376 return false; 377 } 378 379 if (const auto *FuncDecl = dyn_cast<FunctionDecl>(D)) { 380 if (checkParamsForPreconditionViolation(FuncDecl->parameters(), State, 381 LocCtxt)) { 382 if (!N->isSink()) 383 C.addTransition(State->set<PreconditionViolated>(true), N); 384 return true; 385 } 386 return false; 387 } 388 return false; 389} 390 391void NullabilityChecker::reportBugIfPreconditionHolds( 392 ErrorKind Error, ExplodedNode *N, const MemRegion *Region, 393 CheckerContext &C, const Stmt *ValueExpr, bool SuppressPath) const { 394 ProgramStateRef OriginalState = N->getState(); 395 396 if (checkPreconditionViolation(OriginalState, N, C)) 397 return; 398 if (SuppressPath) { 399 OriginalState = OriginalState->set<PreconditionViolated>(true); 400 N = C.addTransition(OriginalState, N); 401 } 402 403 reportBug(Error, N, Region, C.getBugReporter(), ValueExpr); 404} 405 406/// Cleaning up the program state. 407void NullabilityChecker::checkDeadSymbols(SymbolReaper &SR, 408 CheckerContext &C) const { 409 if (!SR.hasDeadSymbols()) 410 return; 411 412 ProgramStateRef State = C.getState(); 413 NullabilityMapTy Nullabilities = State->get<NullabilityMap>(); 414 for (NullabilityMapTy::iterator I = Nullabilities.begin(), 415 E = Nullabilities.end(); 416 I != E; ++I) { 417 const auto *Region = I->first->getAs<SymbolicRegion>(); 418 assert(Region && "Non-symbolic region is tracked."); 419 if (SR.isDead(Region->getSymbol())) { 420 State = State->remove<NullabilityMap>(I->first); 421 } 422 } 423 // When one of the nonnull arguments are constrained to be null, nullability 424 // preconditions are violated. It is not enough to check this only when we 425 // actually report an error, because at that time interesting symbols might be 426 // reaped. 427 if (checkPreconditionViolation(State, C.getPredecessor(), C)) 428 return; 429 C.addTransition(State); 430} 431 432/// This callback triggers when a pointer is dereferenced and the analyzer does 433/// not know anything about the value of that pointer. When that pointer is 434/// nullable, this code emits a warning. 435void NullabilityChecker::checkEvent(ImplicitNullDerefEvent Event) const { 436 if (Event.SinkNode->getState()->get<PreconditionViolated>()) 437 return; 438 439 const MemRegion *Region = 440 getTrackRegion(Event.Location, /*CheckSuperregion=*/true); 441 if (!Region) 442 return; 443 444 ProgramStateRef State = Event.SinkNode->getState(); 445 const NullabilityState *TrackedNullability = 446 State->get<NullabilityMap>(Region); 447 448 if (!TrackedNullability) 449 return; 450 451 if (Filter.CheckNullableDereferenced && 452 TrackedNullability->getValue() == Nullability::Nullable) { 453 BugReporter &BR = *Event.BR; 454 // Do not suppress errors on defensive code paths, because dereferencing 455 // a nullable pointer is always an error. 456 if (Event.IsDirectDereference) 457 reportBug(ErrorKind::NullableDereferenced, Event.SinkNode, Region, BR); 458 else 459 reportBug(ErrorKind::NullablePassedToNonnull, Event.SinkNode, Region, BR); 460 } 461} 462 463/// This method check when nullable pointer or null value is returned from a 464/// function that has nonnull return type. 465/// 466/// TODO: when nullability preconditons are violated, it is ok to violate the 467/// nullability postconditons (i.e.: when one of the nonnull parameters are null 468/// this check should not report any nullability related issue). 469void NullabilityChecker::checkPreStmt(const ReturnStmt *S, 470 CheckerContext &C) const { 471 auto RetExpr = S->getRetValue(); 472 if (!RetExpr) 473 return; 474 475 if (!RetExpr->getType()->isAnyPointerType()) 476 return; 477 478 ProgramStateRef State = C.getState(); 479 if (State->get<PreconditionViolated>()) 480 return; 481 482 auto RetSVal = 483 State->getSVal(S, C.getLocationContext()).getAs<DefinedOrUnknownSVal>(); 484 if (!RetSVal) 485 return; 486 487 AnalysisDeclContext *DeclCtxt = 488 C.getLocationContext()->getAnalysisDeclContext(); 489 const FunctionType *FuncType = DeclCtxt->getDecl()->getFunctionType(); 490 if (!FuncType) 491 return; 492 493 NullConstraint Nullness = getNullConstraint(*RetSVal, State); 494 495 Nullability StaticNullability = 496 getNullabilityAnnotation(FuncType->getReturnType()); 497 498 if (Filter.CheckNullReturnedFromNonnull && 499 Nullness == NullConstraint::IsNull && 500 StaticNullability == Nullability::Nonnull) { 501 static CheckerProgramPointTag Tag(this, "NullReturnedFromNonnull"); 502 ExplodedNode *N = C.generateErrorNode(State, &Tag); 503 if (!N) 504 return; 505 reportBugIfPreconditionHolds(ErrorKind::NilReturnedToNonnull, N, nullptr, C, 506 RetExpr); 507 return; 508 } 509 510 const MemRegion *Region = getTrackRegion(*RetSVal); 511 if (!Region) 512 return; 513 514 const NullabilityState *TrackedNullability = 515 State->get<NullabilityMap>(Region); 516 if (TrackedNullability) { 517 Nullability TrackedNullabValue = TrackedNullability->getValue(); 518 if (Filter.CheckNullableReturnedFromNonnull && 519 Nullness != NullConstraint::IsNotNull && 520 TrackedNullabValue == Nullability::Nullable && 521 StaticNullability == Nullability::Nonnull) { 522 static CheckerProgramPointTag Tag(this, "NullableReturnedFromNonnull"); 523 ExplodedNode *N = C.addTransition(State, C.getPredecessor(), &Tag); 524 reportBugIfPreconditionHolds(ErrorKind::NullableReturnedToNonnull, N, 525 Region, C); 526 } 527 return; 528 } 529 if (StaticNullability == Nullability::Nullable) { 530 State = State->set<NullabilityMap>(Region, 531 NullabilityState(StaticNullability, S)); 532 C.addTransition(State); 533 } 534} 535 536/// This callback warns when a nullable pointer or a null value is passed to a 537/// function that expects its argument to be nonnull. 538void NullabilityChecker::checkPreCall(const CallEvent &Call, 539 CheckerContext &C) const { 540 if (!Call.getDecl()) 541 return; 542 543 ProgramStateRef State = C.getState(); 544 if (State->get<PreconditionViolated>()) 545 return; 546 547 ProgramStateRef OrigState = State; 548 549 unsigned Idx = 0; 550 for (const ParmVarDecl *Param : Call.parameters()) { 551 if (Param->isParameterPack()) 552 break; 553 554 const Expr *ArgExpr = nullptr; 555 if (Idx < Call.getNumArgs()) 556 ArgExpr = Call.getArgExpr(Idx); 557 auto ArgSVal = Call.getArgSVal(Idx++).getAs<DefinedOrUnknownSVal>(); 558 if (!ArgSVal) 559 continue; 560 561 if (!Param->getType()->isAnyPointerType() && 562 !Param->getType()->isReferenceType()) 563 continue; 564 565 NullConstraint Nullness = getNullConstraint(*ArgSVal, State); 566 567 Nullability ParamNullability = getNullabilityAnnotation(Param->getType()); 568 Nullability ArgStaticNullability = 569 getNullabilityAnnotation(ArgExpr->getType()); 570 571 if (Filter.CheckNullPassedToNonnull && Nullness == NullConstraint::IsNull && 572 ArgStaticNullability != Nullability::Nonnull && 573 ParamNullability == Nullability::Nonnull) { 574 ExplodedNode *N = C.generateErrorNode(State); 575 if (!N) 576 return; 577 reportBugIfPreconditionHolds(ErrorKind::NilPassedToNonnull, N, nullptr, C, 578 ArgExpr); 579 return; 580 } 581 582 const MemRegion *Region = getTrackRegion(*ArgSVal); 583 if (!Region) 584 continue; 585 586 const NullabilityState *TrackedNullability = 587 State->get<NullabilityMap>(Region); 588 589 if (TrackedNullability) { 590 if (Nullness == NullConstraint::IsNotNull || 591 TrackedNullability->getValue() != Nullability::Nullable) 592 continue; 593 594 if (Filter.CheckNullablePassedToNonnull && 595 ParamNullability == Nullability::Nonnull) { 596 ExplodedNode *N = C.addTransition(State); 597 reportBugIfPreconditionHolds(ErrorKind::NullablePassedToNonnull, N, 598 Region, C, ArgExpr, /*SuppressPath=*/true); 599 return; 600 } 601 if (Filter.CheckNullableDereferenced && 602 Param->getType()->isReferenceType()) { 603 ExplodedNode *N = C.addTransition(State); 604 reportBugIfPreconditionHolds(ErrorKind::NullableDereferenced, N, Region, 605 C, ArgExpr, /*SuppressPath=*/true); 606 return; 607 } 608 continue; 609 } 610 // No tracked nullability yet. 611 if (ArgStaticNullability != Nullability::Nullable) 612 continue; 613 State = State->set<NullabilityMap>( 614 Region, NullabilityState(ArgStaticNullability, ArgExpr)); 615 } 616 if (State != OrigState) 617 C.addTransition(State); 618} 619 620/// Suppress the nullability warnings for some functions. 621void NullabilityChecker::checkPostCall(const CallEvent &Call, 622 CheckerContext &C) const { 623 auto Decl = Call.getDecl(); 624 if (!Decl) 625 return; 626 // ObjC Messages handles in a different callback. 627 if (Call.getKind() == CE_ObjCMessage) 628 return; 629 const FunctionType *FuncType = Decl->getFunctionType(); 630 if (!FuncType) 631 return; 632 QualType ReturnType = FuncType->getReturnType(); 633 if (!ReturnType->isAnyPointerType()) 634 return; 635 ProgramStateRef State = C.getState(); 636 if (State->get<PreconditionViolated>()) 637 return; 638 639 const MemRegion *Region = getTrackRegion(Call.getReturnValue()); 640 if (!Region) 641 return; 642 643 // CG headers are misannotated. Do not warn for symbols that are the results 644 // of CG calls. 645 const SourceManager &SM = C.getSourceManager(); 646 StringRef FilePath = SM.getFilename(SM.getSpellingLoc(Decl->getLocStart())); 647 if (llvm::sys::path::filename(FilePath).startswith("CG")) { 648 State = State->set<NullabilityMap>(Region, Nullability::Contradicted); 649 C.addTransition(State); 650 return; 651 } 652 653 const NullabilityState *TrackedNullability = 654 State->get<NullabilityMap>(Region); 655 656 if (!TrackedNullability && 657 getNullabilityAnnotation(ReturnType) == Nullability::Nullable) { 658 State = State->set<NullabilityMap>(Region, Nullability::Nullable); 659 C.addTransition(State); 660 } 661} 662 663static Nullability getReceiverNullability(const ObjCMethodCall &M, 664 ProgramStateRef State) { 665 if (M.isReceiverSelfOrSuper()) { 666 // For super and super class receivers we assume that the receiver is 667 // nonnull. 668 return Nullability::Nonnull; 669 } 670 // Otherwise look up nullability in the state. 671 SVal Receiver = M.getReceiverSVal(); 672 if (auto DefOrUnknown = Receiver.getAs<DefinedOrUnknownSVal>()) { 673 // If the receiver is constrained to be nonnull, assume that it is nonnull 674 // regardless of its type. 675 NullConstraint Nullness = getNullConstraint(*DefOrUnknown, State); 676 if (Nullness == NullConstraint::IsNotNull) 677 return Nullability::Nonnull; 678 } 679 auto ValueRegionSVal = Receiver.getAs<loc::MemRegionVal>(); 680 if (ValueRegionSVal) { 681 const MemRegion *SelfRegion = ValueRegionSVal->getRegion(); 682 assert(SelfRegion); 683 684 const NullabilityState *TrackedSelfNullability = 685 State->get<NullabilityMap>(SelfRegion); 686 if (TrackedSelfNullability) 687 return TrackedSelfNullability->getValue(); 688 } 689 return Nullability::Unspecified; 690} 691 692/// Calculate the nullability of the result of a message expr based on the 693/// nullability of the receiver, the nullability of the return value, and the 694/// constraints. 695void NullabilityChecker::checkPostObjCMessage(const ObjCMethodCall &M, 696 CheckerContext &C) const { 697 auto Decl = M.getDecl(); 698 if (!Decl) 699 return; 700 QualType RetType = Decl->getReturnType(); 701 if (!RetType->isAnyPointerType()) 702 return; 703 704 ProgramStateRef State = C.getState(); 705 if (State->get<PreconditionViolated>()) 706 return; 707 708 const MemRegion *ReturnRegion = getTrackRegion(M.getReturnValue()); 709 if (!ReturnRegion) 710 return; 711 712 auto Interface = Decl->getClassInterface(); 713 auto Name = Interface ? Interface->getName() : ""; 714 // In order to reduce the noise in the diagnostics generated by this checker, 715 // some framework and programming style based heuristics are used. These 716 // heuristics are for Cocoa APIs which have NS prefix. 717 if (Name.startswith("NS")) { 718 // Developers rely on dynamic invariants such as an item should be available 719 // in a collection, or a collection is not empty often. Those invariants can 720 // not be inferred by any static analysis tool. To not to bother the users 721 // with too many false positives, every item retrieval function should be 722 // ignored for collections. The instance methods of dictionaries in Cocoa 723 // are either item retrieval related or not interesting nullability wise. 724 // Using this fact, to keep the code easier to read just ignore the return 725 // value of every instance method of dictionaries. 726 if (M.isInstanceMessage() && Name.find("Dictionary") != StringRef::npos) { 727 State = 728 State->set<NullabilityMap>(ReturnRegion, Nullability::Contradicted); 729 C.addTransition(State); 730 return; 731 } 732 // For similar reasons ignore some methods of Cocoa arrays. 733 StringRef FirstSelectorSlot = M.getSelector().getNameForSlot(0); 734 if (Name.find("Array") != StringRef::npos && 735 (FirstSelectorSlot == "firstObject" || 736 FirstSelectorSlot == "lastObject")) { 737 State = 738 State->set<NullabilityMap>(ReturnRegion, Nullability::Contradicted); 739 C.addTransition(State); 740 return; 741 } 742 743 // Encoding related methods of string should not fail when lossless 744 // encodings are used. Using lossless encodings is so frequent that ignoring 745 // this class of methods reduced the emitted diagnostics by about 30% on 746 // some projects (and all of that was false positives). 747 if (Name.find("String") != StringRef::npos) { 748 for (auto Param : M.parameters()) { 749 if (Param->getName() == "encoding") { 750 State = State->set<NullabilityMap>(ReturnRegion, 751 Nullability::Contradicted); 752 C.addTransition(State); 753 return; 754 } 755 } 756 } 757 } 758 759 const ObjCMessageExpr *Message = M.getOriginExpr(); 760 Nullability SelfNullability = getReceiverNullability(M, State); 761 762 const NullabilityState *NullabilityOfReturn = 763 State->get<NullabilityMap>(ReturnRegion); 764 765 if (NullabilityOfReturn) { 766 // When we have a nullability tracked for the return value, the nullability 767 // of the expression will be the most nullable of the receiver and the 768 // return value. 769 Nullability RetValTracked = NullabilityOfReturn->getValue(); 770 Nullability ComputedNullab = 771 getMostNullable(RetValTracked, SelfNullability); 772 if (ComputedNullab != RetValTracked && 773 ComputedNullab != Nullability::Unspecified) { 774 const Stmt *NullabilitySource = 775 ComputedNullab == RetValTracked 776 ? NullabilityOfReturn->getNullabilitySource() 777 : Message->getInstanceReceiver(); 778 State = State->set<NullabilityMap>( 779 ReturnRegion, NullabilityState(ComputedNullab, NullabilitySource)); 780 C.addTransition(State); 781 } 782 return; 783 } 784 785 // No tracked information. Use static type information for return value. 786 Nullability RetNullability = getNullabilityAnnotation(RetType); 787 788 // Properties might be computed. For this reason the static analyzer creates a 789 // new symbol each time an unknown property is read. To avoid false pozitives 790 // do not treat unknown properties as nullable, even when they explicitly 791 // marked nullable. 792 if (M.getMessageKind() == OCM_PropertyAccess && !C.wasInlined) 793 RetNullability = Nullability::Nonnull; 794 795 Nullability ComputedNullab = getMostNullable(RetNullability, SelfNullability); 796 if (ComputedNullab == Nullability::Nullable) { 797 const Stmt *NullabilitySource = ComputedNullab == RetNullability 798 ? Message 799 : Message->getInstanceReceiver(); 800 State = State->set<NullabilityMap>( 801 ReturnRegion, NullabilityState(ComputedNullab, NullabilitySource)); 802 C.addTransition(State); 803 } 804} 805 806/// Explicit casts are trusted. If there is a disagreement in the nullability 807/// annotations in the destination and the source or '0' is casted to nonnull 808/// track the value as having contraditory nullability. This will allow users to 809/// suppress warnings. 810void NullabilityChecker::checkPostStmt(const ExplicitCastExpr *CE, 811 CheckerContext &C) const { 812 QualType OriginType = CE->getSubExpr()->getType(); 813 QualType DestType = CE->getType(); 814 if (!OriginType->isAnyPointerType()) 815 return; 816 if (!DestType->isAnyPointerType()) 817 return; 818 819 ProgramStateRef State = C.getState(); 820 if (State->get<PreconditionViolated>()) 821 return; 822 823 Nullability DestNullability = getNullabilityAnnotation(DestType); 824 825 // No explicit nullability in the destination type, so this cast does not 826 // change the nullability. 827 if (DestNullability == Nullability::Unspecified) 828 return; 829 830 auto RegionSVal = 831 State->getSVal(CE, C.getLocationContext()).getAs<DefinedOrUnknownSVal>(); 832 const MemRegion *Region = getTrackRegion(*RegionSVal); 833 if (!Region) 834 return; 835 836 // When 0 is converted to nonnull mark it as contradicted. 837 if (DestNullability == Nullability::Nonnull) { 838 NullConstraint Nullness = getNullConstraint(*RegionSVal, State); 839 if (Nullness == NullConstraint::IsNull) { 840 State = State->set<NullabilityMap>(Region, Nullability::Contradicted); 841 C.addTransition(State); 842 return; 843 } 844 } 845 846 const NullabilityState *TrackedNullability = 847 State->get<NullabilityMap>(Region); 848 849 if (!TrackedNullability) { 850 if (DestNullability != Nullability::Nullable) 851 return; 852 State = State->set<NullabilityMap>(Region, 853 NullabilityState(DestNullability, CE)); 854 C.addTransition(State); 855 return; 856 } 857 858 if (TrackedNullability->getValue() != DestNullability && 859 TrackedNullability->getValue() != Nullability::Contradicted) { 860 State = State->set<NullabilityMap>(Region, Nullability::Contradicted); 861 C.addTransition(State); 862 } 863} 864 865/// For a given statement performing a bind, attempt to syntactically 866/// match the expression resulting in the bound value. 867static const Expr * matchValueExprForBind(const Stmt *S) { 868 // For `x = e` the value expression is the right-hand side. 869 if (auto *BinOp = dyn_cast<BinaryOperator>(S)) { 870 if (BinOp->getOpcode() == BO_Assign) 871 return BinOp->getRHS(); 872 } 873 874 // For `int x = e` the value expression is the initializer. 875 if (auto *DS = dyn_cast<DeclStmt>(S)) { 876 if (DS->isSingleDecl()) { 877 auto *VD = dyn_cast<VarDecl>(DS->getSingleDecl()); 878 if (!VD) 879 return nullptr; 880 881 if (const Expr *Init = VD->getInit()) 882 return Init; 883 } 884 } 885 886 return nullptr; 887} 888 889/// Propagate the nullability information through binds and warn when nullable 890/// pointer or null symbol is assigned to a pointer with a nonnull type. 891void NullabilityChecker::checkBind(SVal L, SVal V, const Stmt *S, 892 CheckerContext &C) const { 893 const TypedValueRegion *TVR = 894 dyn_cast_or_null<TypedValueRegion>(L.getAsRegion()); 895 if (!TVR) 896 return; 897 898 QualType LocType = TVR->getValueType(); 899 if (!LocType->isAnyPointerType()) 900 return; 901 902 ProgramStateRef State = C.getState(); 903 if (State->get<PreconditionViolated>()) 904 return; 905 906 auto ValDefOrUnknown = V.getAs<DefinedOrUnknownSVal>(); 907 if (!ValDefOrUnknown) 908 return; 909 910 NullConstraint RhsNullness = getNullConstraint(*ValDefOrUnknown, State); 911 912 Nullability ValNullability = Nullability::Unspecified; 913 if (SymbolRef Sym = ValDefOrUnknown->getAsSymbol()) 914 ValNullability = getNullabilityAnnotation(Sym->getType()); 915 916 Nullability LocNullability = getNullabilityAnnotation(LocType); 917 if (Filter.CheckNullPassedToNonnull && 918 RhsNullness == NullConstraint::IsNull && 919 ValNullability != Nullability::Nonnull && 920 LocNullability == Nullability::Nonnull) { 921 static CheckerProgramPointTag Tag(this, "NullPassedToNonnull"); 922 ExplodedNode *N = C.generateErrorNode(State, &Tag); 923 if (!N) 924 return; 925 926 const Stmt *ValueExpr = matchValueExprForBind(S); 927 if (!ValueExpr) 928 ValueExpr = S; 929 930 reportBugIfPreconditionHolds(ErrorKind::NilAssignedToNonnull, N, nullptr, C, 931 ValueExpr); 932 return; 933 } 934 // Intentionally missing case: '0' is bound to a reference. It is handled by 935 // the DereferenceChecker. 936 937 const MemRegion *ValueRegion = getTrackRegion(*ValDefOrUnknown); 938 if (!ValueRegion) 939 return; 940 941 const NullabilityState *TrackedNullability = 942 State->get<NullabilityMap>(ValueRegion); 943 944 if (TrackedNullability) { 945 if (RhsNullness == NullConstraint::IsNotNull || 946 TrackedNullability->getValue() != Nullability::Nullable) 947 return; 948 if (Filter.CheckNullablePassedToNonnull && 949 LocNullability == Nullability::Nonnull) { 950 static CheckerProgramPointTag Tag(this, "NullablePassedToNonnull"); 951 ExplodedNode *N = C.addTransition(State, C.getPredecessor(), &Tag); 952 reportBugIfPreconditionHolds(ErrorKind::NullableAssignedToNonnull, N, 953 ValueRegion, C); 954 } 955 return; 956 } 957 958 const auto *BinOp = dyn_cast<BinaryOperator>(S); 959 960 if (ValNullability == Nullability::Nullable) { 961 // Trust the static information of the value more than the static 962 // information on the location. 963 const Stmt *NullabilitySource = BinOp ? BinOp->getRHS() : S; 964 State = State->set<NullabilityMap>( 965 ValueRegion, NullabilityState(ValNullability, NullabilitySource)); 966 C.addTransition(State); 967 return; 968 } 969 970 if (LocNullability == Nullability::Nullable) { 971 const Stmt *NullabilitySource = BinOp ? BinOp->getLHS() : S; 972 State = State->set<NullabilityMap>( 973 ValueRegion, NullabilityState(LocNullability, NullabilitySource)); 974 C.addTransition(State); 975 } 976} 977 978void NullabilityChecker::printState(raw_ostream &Out, ProgramStateRef State, 979 const char *NL, const char *Sep) const { 980 981 NullabilityMapTy B = State->get<NullabilityMap>(); 982 983 if (B.isEmpty()) 984 return; 985 986 Out << Sep << NL; 987 988 for (NullabilityMapTy::iterator I = B.begin(), E = B.end(); I != E; ++I) { 989 Out << I->first << " : "; 990 I->second.print(Out); 991 Out << NL; 992 } 993} 994 995#define REGISTER_CHECKER(name, trackingRequired) \ 996 void ento::register##name##Checker(CheckerManager &mgr) { \ 997 NullabilityChecker *checker = mgr.registerChecker<NullabilityChecker>(); \ 998 checker->Filter.Check##name = true; \ 999 checker->Filter.CheckName##name = mgr.getCurrentCheckName(); \ 1000 checker->NeedTracking = checker->NeedTracking || trackingRequired; \ 1001 } 1002 1003// The checks are likely to be turned on by default and it is possible to do 1004// them without tracking any nullability related information. As an optimization 1005// no nullability information will be tracked when only these two checks are 1006// enables. 1007REGISTER_CHECKER(NullPassedToNonnull, false) 1008REGISTER_CHECKER(NullReturnedFromNonnull, false) 1009 1010REGISTER_CHECKER(NullableDereferenced, true) 1011REGISTER_CHECKER(NullablePassedToNonnull, true) 1012REGISTER_CHECKER(NullableReturnedFromNonnull, true) 1013