1// MacOSXAPIChecker.h - Checks proper use of various MacOS X APIs --*- C++ -*-//
2//
3// Part of the LLVM Project, under the Apache License v2.0 with LLVM Exceptions.
4// See https://llvm.org/LICENSE.txt for license information.
5// SPDX-License-Identifier: Apache-2.0 WITH LLVM-exception
6//
7//===----------------------------------------------------------------------===//
8//
9// This defines MacOSXAPIChecker, which is an assortment of checks on calls
10// to various, widely used Apple APIs.
11//
12// FIXME: What's currently in BasicObjCFoundationChecks.cpp should be migrated
13// to here, using the new Checker interface.
14//
15//===----------------------------------------------------------------------===//
16
17#include "clang/AST/Attr.h"
18#include "clang/StaticAnalyzer/Checkers/BuiltinCheckerRegistration.h"
19#include "clang/StaticAnalyzer/Core/BugReporter/BugType.h"
20#include "clang/StaticAnalyzer/Core/BugReporter/CommonBugCategories.h"
21#include "clang/StaticAnalyzer/Core/Checker.h"
22#include "clang/StaticAnalyzer/Core/CheckerManager.h"
23#include "clang/StaticAnalyzer/Core/PathSensitive/CheckerContext.h"
24#include "llvm/ADT/StringSwitch.h"
25#include "llvm/Support/raw_ostream.h"
26
27using namespace clang;
28using namespace ento;
29
30namespace {
31class MacOSXAPIChecker : public Checker< check::PreStmt<CallExpr> > {
32 const BugType BT_dispatchOnce{this, "Improper use of 'dispatch_once'",
33 categories::AppleAPIMisuse};
34
35 static const ObjCIvarRegion *getParentIvarRegion(const MemRegion *R);
36
37public:
38 void checkPreStmt(const CallExpr *CE, CheckerContext &C) const;
39
40 void CheckDispatchOnce(CheckerContext &C, const CallExpr *CE,
41 StringRef FName) const;
42
43 typedef void (MacOSXAPIChecker::*SubChecker)(CheckerContext &,
44 const CallExpr *,
45 StringRef FName) const;
46};
47} //end anonymous namespace
48
49//===----------------------------------------------------------------------===//
50// dispatch_once and dispatch_once_f
51//===----------------------------------------------------------------------===//
52
53const ObjCIvarRegion *
54MacOSXAPIChecker::getParentIvarRegion(const MemRegion *R) {
55 const SubRegion *SR = dyn_cast<SubRegion>(Val: R);
56 while (SR) {
57 if (const ObjCIvarRegion *IR = dyn_cast<ObjCIvarRegion>(Val: SR))
58 return IR;
59 SR = dyn_cast<SubRegion>(Val: SR->getSuperRegion());
60 }
61 return nullptr;
62}
63
64void MacOSXAPIChecker::CheckDispatchOnce(CheckerContext &C, const CallExpr *CE,
65 StringRef FName) const {
66 if (CE->getNumArgs() < 1)
67 return;
68
69 // Check if the first argument is improperly allocated. If so, issue a
70 // warning because that's likely to be bad news.
71 const MemRegion *R = C.getSVal(S: CE->getArg(Arg: 0)).getAsRegion();
72 if (!R)
73 return;
74
75 // Global variables are fine.
76 const MemSpaceRegion *Space = R->getMemorySpace(State: C.getState());
77 if (isa<GlobalsSpaceRegion>(Val: Space))
78 return;
79
80 // Handle _dispatch_once. In some versions of the OS X SDK we have the case
81 // that dispatch_once is a macro that wraps a call to _dispatch_once.
82 // _dispatch_once is then a function which then calls the real dispatch_once.
83 // Users do not care; they just want the warning at the top-level call.
84 if (CE->getBeginLoc().isMacroID()) {
85 StringRef TrimmedFName = FName.ltrim(Char: '_');
86 if (TrimmedFName != FName)
87 FName = TrimmedFName;
88 }
89
90 SmallString<256> S;
91 llvm::raw_svector_ostream os(S);
92 bool SuggestStatic = false;
93 os << "Call to '" << FName << "' uses";
94 if (const VarRegion *VR = dyn_cast<VarRegion>(Val: R->getBaseRegion())) {
95 const VarDecl *VD = VR->getDecl();
96 // FIXME: These should have correct memory space and thus should be filtered
97 // out earlier. This branch only fires when we're looking from a block,
98 // which we analyze as a top-level declaration, onto a static local
99 // in a function that contains the block.
100 if (VD->isStaticLocal())
101 return;
102 // We filtered out globals earlier, so it must be a local variable
103 // or a block variable which is under UnknownSpaceRegion.
104 if (VR != R)
105 os << " memory within";
106 if (VD->hasAttr<BlocksAttr>())
107 os << " the block variable '";
108 else
109 os << " the local variable '";
110 os << VR->getDecl()->getName() << '\'';
111 SuggestStatic = true;
112 } else if (const ObjCIvarRegion *IVR = getParentIvarRegion(R)) {
113 if (IVR != R)
114 os << " memory within";
115 os << " the instance variable '" << IVR->getDecl()->getName() << '\'';
116 } else if (isa<HeapSpaceRegion>(Val: Space)) {
117 os << " heap-allocated memory";
118 } else if (isa<UnknownSpaceRegion>(Val: Space)) {
119 // Presence of an IVar superregion has priority over this branch, because
120 // ObjC objects are on the heap even if the core doesn't realize this.
121 // Presence of a block variable base region has priority over this branch,
122 // because block variables are known to be either on stack or on heap
123 // (might actually move between the two, hence UnknownSpace).
124 return;
125 } else {
126 os << " stack allocated memory";
127 }
128 os << " for the predicate value. Using such transient memory for "
129 "the predicate is potentially dangerous.";
130 if (SuggestStatic)
131 os << " Perhaps you intended to declare the variable as 'static'?";
132
133 ExplodedNode *N = C.generateErrorNode();
134 if (!N)
135 return;
136
137 auto report =
138 std::make_unique<PathSensitiveBugReport>(args: BT_dispatchOnce, args: os.str(), args&: N);
139 report->addRange(R: CE->getArg(Arg: 0)->getSourceRange());
140 C.emitReport(R: std::move(report));
141}
142
143//===----------------------------------------------------------------------===//
144// Central dispatch function.
145//===----------------------------------------------------------------------===//
146
147void MacOSXAPIChecker::checkPreStmt(const CallExpr *CE,
148 CheckerContext &C) const {
149 StringRef Name = C.getCalleeName(CE);
150 if (Name.empty())
151 return;
152
153 SubChecker SC =
154 llvm::StringSwitch<SubChecker>(Name)
155 .Cases(S0: "dispatch_once",
156 S1: "_dispatch_once",
157 S2: "dispatch_once_f",
158 Value: &MacOSXAPIChecker::CheckDispatchOnce)
159 .Default(Value: nullptr);
160
161 if (SC)
162 (this->*SC)(C, CE, Name);
163}
164
165//===----------------------------------------------------------------------===//
166// Registration.
167//===----------------------------------------------------------------------===//
168
169void ento::registerMacOSXAPIChecker(CheckerManager &mgr) {
170 mgr.registerChecker<MacOSXAPIChecker>();
171}
172
173bool ento::shouldRegisterMacOSXAPIChecker(const CheckerManager &mgr) {
174 return true;
175}
176