1//===--- NonNullParamChecker.cpp - Undefined arguments checker -*- C++ -*--===//
2//
3// Part of the LLVM Project, under the Apache License v2.0 with LLVM Exceptions.
4// See https://llvm.org/LICENSE.txt for license information.
5// SPDX-License-Identifier: Apache-2.0 WITH LLVM-exception
6//
7//===----------------------------------------------------------------------===//
8//
9// This defines NonNullParamChecker, which checks for arguments expected not to
10// be null due to:
11// - the corresponding parameters being declared to have nonnull attribute
12// - the corresponding parameters being references; since the call would form
13// a reference to a null pointer
14//
15//===----------------------------------------------------------------------===//
16
17#include "clang/AST/Attr.h"
18#include "clang/Analysis/AnyCall.h"
19#include "clang/StaticAnalyzer/Checkers/BuiltinCheckerRegistration.h"
20#include "clang/StaticAnalyzer/Core/BugReporter/BugType.h"
21#include "clang/StaticAnalyzer/Core/Checker.h"
22#include "clang/StaticAnalyzer/Core/CheckerManager.h"
23#include "clang/StaticAnalyzer/Core/PathSensitive/CallEvent.h"
24#include "clang/StaticAnalyzer/Core/PathSensitive/CheckerContext.h"
25#include "llvm/ADT/StringExtras.h"
26
27using namespace clang;
28using namespace ento;
29
30namespace {
31class NonNullParamChecker
32 : public Checker<check::PreCall, check::BeginFunction,
33 EventDispatcher<ImplicitNullDerefEvent>> {
34 const BugType BTAttrNonNull{
35 this, "Argument with 'nonnull' attribute passed null", "API"};
36 const BugType BTNullRefArg{this, "Dereference of null pointer"};
37
38public:
39 void checkPreCall(const CallEvent &Call, CheckerContext &C) const;
40 void checkBeginFunction(CheckerContext &C) const;
41
42 std::unique_ptr<PathSensitiveBugReport>
43 genReportNullAttrNonNull(const ExplodedNode *ErrorN, const Expr *ArgE,
44 unsigned IdxOfArg) const;
45 std::unique_ptr<PathSensitiveBugReport>
46 genReportReferenceToNullPointer(const ExplodedNode *ErrorN,
47 const Expr *ArgE) const;
48};
49
50template <class CallType>
51void setBitsAccordingToFunctionAttributes(const CallType &Call,
52 llvm::SmallBitVector &AttrNonNull) {
53 const Decl *FD = Call.getDecl();
54
55 for (const auto *NonNull : FD->specific_attrs<NonNullAttr>()) {
56 if (!NonNull->args_size()) {
57 // Lack of attribute parameters means that all of the parameters are
58 // implicitly marked as non-null.
59 AttrNonNull.set();
60 break;
61 }
62
63 for (const ParamIdx &Idx : NonNull->args()) {
64 // 'nonnull' attribute's parameters are 1-based and should be adjusted to
65 // match actual AST parameter/argument indices.
66 unsigned IdxAST = Idx.getASTIndex();
67 if (IdxAST >= AttrNonNull.size())
68 continue;
69 AttrNonNull.set(IdxAST);
70 }
71 }
72}
73
74template <class CallType>
75void setBitsAccordingToParameterAttributes(const CallType &Call,
76 llvm::SmallBitVector &AttrNonNull) {
77 for (const ParmVarDecl *Parameter : Call.parameters()) {
78 unsigned ParameterIndex = Parameter->getFunctionScopeIndex();
79 if (ParameterIndex == AttrNonNull.size())
80 break;
81
82 if (Parameter->hasAttr<NonNullAttr>())
83 AttrNonNull.set(ParameterIndex);
84 }
85}
86
87template <class CallType>
88llvm::SmallBitVector getNonNullAttrsImpl(const CallType &Call,
89 unsigned ExpectedSize) {
90 llvm::SmallBitVector AttrNonNull(ExpectedSize);
91
92 setBitsAccordingToFunctionAttributes(Call, AttrNonNull);
93 setBitsAccordingToParameterAttributes(Call, AttrNonNull);
94
95 return AttrNonNull;
96}
97
98/// \return Bitvector marking non-null attributes.
99llvm::SmallBitVector getNonNullAttrs(const CallEvent &Call) {
100 return getNonNullAttrsImpl(Call, ExpectedSize: Call.getNumArgs());
101}
102
103/// \return Bitvector marking non-null attributes.
104llvm::SmallBitVector getNonNullAttrs(const AnyCall &Call) {
105 return getNonNullAttrsImpl(Call, ExpectedSize: Call.param_size());
106}
107} // end anonymous namespace
108
109void NonNullParamChecker::checkPreCall(const CallEvent &Call,
110 CheckerContext &C) const {
111 if (!Call.getDecl())
112 return;
113
114 llvm::SmallBitVector AttrNonNull = getNonNullAttrs(Call);
115 unsigned NumArgs = Call.getNumArgs();
116
117 ProgramStateRef state = C.getState();
118 ArrayRef<ParmVarDecl *> parms = Call.parameters();
119
120 for (unsigned idx = 0; idx < NumArgs; ++idx) {
121 // For vararg functions, a corresponding parameter decl may not exist.
122 bool HasParam = idx < parms.size();
123
124 // Check if the parameter is a reference. We want to report when reference
125 // to a null pointer is passed as a parameter.
126 bool HasRefTypeParam =
127 HasParam ? parms[idx]->getType()->isReferenceType() : false;
128 bool ExpectedToBeNonNull = AttrNonNull.test(Idx: idx);
129
130 if (!ExpectedToBeNonNull && !HasRefTypeParam)
131 continue;
132
133 // If the value is unknown or undefined, we can't perform this check.
134 const Expr *ArgE = Call.getArgExpr(Index: idx);
135 SVal V = Call.getArgSVal(Index: idx);
136 auto DV = V.getAs<DefinedSVal>();
137 if (!DV)
138 continue;
139
140 assert(!HasRefTypeParam || isa<Loc>(*DV));
141
142 // Process the case when the argument is not a location.
143 if (ExpectedToBeNonNull && !isa<Loc>(Val: *DV)) {
144 // If the argument is a union type, we want to handle a potential
145 // transparent_union GCC extension.
146 if (!ArgE)
147 continue;
148
149 QualType T = ArgE->getType();
150 const RecordType *UT = T->getAsUnionType();
151 if (!UT || !UT->getDecl()->hasAttr<TransparentUnionAttr>())
152 continue;
153
154 auto CSV = DV->getAs<nonloc::CompoundVal>();
155
156 // FIXME: Handle LazyCompoundVals?
157 if (!CSV)
158 continue;
159
160 V = *(CSV->begin());
161 DV = V.getAs<DefinedSVal>();
162 assert(++CSV->begin() == CSV->end());
163 // FIXME: Handle (some_union){ some_other_union_val }, which turns into
164 // a LazyCompoundVal inside a CompoundVal.
165 if (!isa<Loc>(Val: V))
166 continue;
167
168 // Retrieve the corresponding expression.
169 if (const auto *CE = dyn_cast<CompoundLiteralExpr>(Val: ArgE))
170 if (const auto *IE = dyn_cast<InitListExpr>(Val: CE->getInitializer()))
171 ArgE = dyn_cast<Expr>(Val: *(IE->begin()));
172 }
173
174 ConstraintManager &CM = C.getConstraintManager();
175 ProgramStateRef stateNotNull, stateNull;
176 std::tie(args&: stateNotNull, args&: stateNull) = CM.assumeDual(State: state, Cond: *DV);
177
178 // Generate an error node. Check for a null node in case
179 // we cache out.
180 if (stateNull && !stateNotNull) {
181 if (ExplodedNode *errorNode = C.generateErrorNode(State: stateNull)) {
182
183 std::unique_ptr<BugReport> R;
184 if (ExpectedToBeNonNull)
185 R = genReportNullAttrNonNull(ErrorN: errorNode, ArgE, IdxOfArg: idx + 1);
186 else if (HasRefTypeParam)
187 R = genReportReferenceToNullPointer(ErrorN: errorNode, ArgE);
188
189 // Highlight the range of the argument that was null.
190 R->addRange(R: Call.getArgSourceRange(Index: idx));
191
192 // Emit the bug report.
193 C.emitReport(R: std::move(R));
194 }
195
196 // Always return. Either we cached out or we just emitted an error.
197 return;
198 }
199
200 if (stateNull) {
201 if (ExplodedNode *N = C.generateSink(State: stateNull, Pred: C.getPredecessor())) {
202 ImplicitNullDerefEvent event = {
203 .Location: V, .IsLoad: false, .SinkNode: N, .BR: &C.getBugReporter(),
204 /*IsDirectDereference=*/HasRefTypeParam};
205 dispatchEvent(event);
206 }
207 }
208
209 // If a pointer value passed the check we should assume that it is
210 // indeed not null from this point forward.
211 state = stateNotNull;
212 }
213
214 // If we reach here all of the arguments passed the nonnull check.
215 // If 'state' has been updated generated a new node.
216 C.addTransition(State: state);
217}
218
219/// We want to trust developer annotations and consider all 'nonnull' parameters
220/// as non-null indeed. Each marked parameter will get a corresponding
221/// constraint.
222///
223/// This approach will not only help us to get rid of some false positives, but
224/// remove duplicates and shorten warning traces as well.
225///
226/// \code
227/// void foo(int *x) [[gnu::nonnull]] {
228/// // . . .
229/// *x = 42; // we don't want to consider this as an error...
230/// // . . .
231/// }
232///
233/// foo(nullptr); // ...and report here instead
234/// \endcode
235void NonNullParamChecker::checkBeginFunction(CheckerContext &Context) const {
236 // Planned assumption makes sense only for top-level functions.
237 // Inlined functions will get similar constraints as part of 'checkPreCall'.
238 if (!Context.inTopFrame())
239 return;
240
241 const LocationContext *LocContext = Context.getLocationContext();
242
243 const Decl *FD = LocContext->getDecl();
244 // AnyCall helps us here to avoid checking for FunctionDecl and ObjCMethodDecl
245 // separately and aggregates interfaces of these classes.
246 auto AbstractCall = AnyCall::forDecl(D: FD);
247 if (!AbstractCall)
248 return;
249
250 ProgramStateRef State = Context.getState();
251 llvm::SmallBitVector ParameterNonNullMarks = getNonNullAttrs(Call: *AbstractCall);
252
253 for (const ParmVarDecl *Parameter : AbstractCall->parameters()) {
254 // 1. Check parameter if it is annotated as non-null
255 if (!ParameterNonNullMarks.test(Idx: Parameter->getFunctionScopeIndex()))
256 continue;
257
258 // 2. Check that parameter is a pointer.
259 // Nonnull attribute can be applied to non-pointers (by default
260 // __attribute__(nonnull) implies "all parameters").
261 if (!Parameter->getType()->isPointerType())
262 continue;
263
264 Loc ParameterLoc = State->getLValue(VD: Parameter, LC: LocContext);
265 // We never consider top-level function parameters undefined.
266 auto StoredVal =
267 State->getSVal(LV: ParameterLoc).castAs<DefinedOrUnknownSVal>();
268
269 // 3. Assume that it is indeed non-null
270 if (ProgramStateRef NewState = State->assume(Cond: StoredVal, Assumption: true)) {
271 State = NewState;
272 }
273 }
274
275 Context.addTransition(State);
276}
277
278std::unique_ptr<PathSensitiveBugReport>
279NonNullParamChecker::genReportNullAttrNonNull(const ExplodedNode *ErrorNode,
280 const Expr *ArgE,
281 unsigned IdxOfArg) const {
282 llvm::SmallString<256> SBuf;
283 llvm::raw_svector_ostream OS(SBuf);
284 OS << "Null pointer passed to "
285 << IdxOfArg << llvm::getOrdinalSuffix(Val: IdxOfArg)
286 << " parameter expecting 'nonnull'";
287
288 auto R =
289 std::make_unique<PathSensitiveBugReport>(args: BTAttrNonNull, args&: SBuf, args&: ErrorNode);
290 if (ArgE)
291 bugreporter::trackExpressionValue(N: ErrorNode, E: ArgE, R&: *R);
292
293 return R;
294}
295
296std::unique_ptr<PathSensitiveBugReport>
297NonNullParamChecker::genReportReferenceToNullPointer(
298 const ExplodedNode *ErrorNode, const Expr *ArgE) const {
299 auto R = std::make_unique<PathSensitiveBugReport>(
300 args: BTNullRefArg, args: "Forming reference to null pointer", args&: ErrorNode);
301 if (ArgE) {
302 const Expr *ArgEDeref = bugreporter::getDerefExpr(S: ArgE);
303 if (!ArgEDeref)
304 ArgEDeref = ArgE;
305 bugreporter::trackExpressionValue(N: ErrorNode, E: ArgEDeref, R&: *R);
306 }
307 return R;
308}
309
310void ento::registerNonNullParamChecker(CheckerManager &mgr) {
311 mgr.registerChecker<NonNullParamChecker>();
312}
313
314bool ento::shouldRegisterNonNullParamChecker(const CheckerManager &mgr) {
315 return true;
316}
317