1//== ReturnUndefChecker.cpp -------------------------------------*- C++ -*--==// 2// 3// The LLVM Compiler Infrastructure 4// 5// This file is distributed under the University of Illinois Open Source 6// License. See LICENSE.TXT for details. 7// 8//===----------------------------------------------------------------------===// 9// 10// This file defines ReturnUndefChecker, which is a path-sensitive 11// check which looks for undefined or garbage values being returned to the 12// caller. 13// 14//===----------------------------------------------------------------------===// 15 16#include "ClangSACheckers.h" 17#include "clang/StaticAnalyzer/Core/BugReporter/BugType.h" 18#include "clang/StaticAnalyzer/Core/Checker.h" 19#include "clang/StaticAnalyzer/Core/CheckerManager.h" 20#include "clang/StaticAnalyzer/Core/PathSensitive/CallEvent.h" 21#include "clang/StaticAnalyzer/Core/PathSensitive/CheckerContext.h" 22 23using namespace clang; 24using namespace ento; 25 26namespace { 27class ReturnUndefChecker : public Checker< check::PreStmt<ReturnStmt> > { 28 mutable std::unique_ptr<BuiltinBug> BT_Undef; 29 mutable std::unique_ptr<BuiltinBug> BT_NullReference; 30 31 void emitUndef(CheckerContext &C, const Expr *RetE) const; 32 void checkReference(CheckerContext &C, const Expr *RetE, 33 DefinedOrUnknownSVal RetVal) const; 34public: 35 void checkPreStmt(const ReturnStmt *RS, CheckerContext &C) const; 36}; 37} 38 39void ReturnUndefChecker::checkPreStmt(const ReturnStmt *RS, 40 CheckerContext &C) const { 41 const Expr *RetE = RS->getRetValue(); 42 if (!RetE) 43 return; 44 SVal RetVal = C.getSVal(RetE); 45 46 const StackFrameContext *SFC = C.getStackFrame(); 47 QualType RT = CallEvent::getDeclaredResultType(SFC->getDecl()); 48 49 if (RetVal.isUndef()) { 50 // "return;" is modeled to evaluate to an UndefinedVal. Allow UndefinedVal 51 // to be returned in functions returning void to support this pattern: 52 // void foo() { 53 // return; 54 // } 55 // void test() { 56 // return foo(); 57 // } 58 if (!RT.isNull() && RT->isVoidType()) 59 return; 60 61 // Not all blocks have explicitly-specified return types; if the return type 62 // is not available, but the return value expression has 'void' type, assume 63 // Sema already checked it. 64 if (RT.isNull() && isa<BlockDecl>(SFC->getDecl()) && 65 RetE->getType()->isVoidType()) 66 return; 67 68 emitUndef(C, RetE); 69 return; 70 } 71 72 if (RT.isNull()) 73 return; 74 75 if (RT->isReferenceType()) { 76 checkReference(C, RetE, RetVal.castAs<DefinedOrUnknownSVal>()); 77 return; 78 } 79} 80 81static void emitBug(CheckerContext &C, BuiltinBug &BT, const Expr *RetE, 82 const Expr *TrackingE = nullptr) { 83 ExplodedNode *N = C.generateErrorNode(); 84 if (!N) 85 return; 86 87 auto Report = llvm::make_unique<BugReport>(BT, BT.getDescription(), N); 88 89 Report->addRange(RetE->getSourceRange()); 90 bugreporter::trackNullOrUndefValue(N, TrackingE ? TrackingE : RetE, *Report); 91 92 C.emitReport(std::move(Report)); 93} 94 95void ReturnUndefChecker::emitUndef(CheckerContext &C, const Expr *RetE) const { 96 if (!BT_Undef) 97 BT_Undef.reset( 98 new BuiltinBug(this, "Garbage return value", 99 "Undefined or garbage value returned to caller")); 100 emitBug(C, *BT_Undef, RetE); 101} 102 103void ReturnUndefChecker::checkReference(CheckerContext &C, const Expr *RetE, 104 DefinedOrUnknownSVal RetVal) const { 105 ProgramStateRef StNonNull, StNull; 106 std::tie(StNonNull, StNull) = C.getState()->assume(RetVal); 107 108 if (StNonNull) { 109 // Going forward, assume the location is non-null. 110 C.addTransition(StNonNull); 111 return; 112 } 113 114 // The return value is known to be null. Emit a bug report. 115 if (!BT_NullReference) 116 BT_NullReference.reset(new BuiltinBug(this, "Returning null reference")); 117 118 emitBug(C, *BT_NullReference, RetE, bugreporter::getDerefExpr(RetE)); 119} 120 121void ento::registerReturnUndefChecker(CheckerManager &mgr) { 122 mgr.registerChecker<ReturnUndefChecker>(); 123} 124