1// MacOSXAPIChecker.h - Checks proper use of various MacOS X APIs --*- C++ -*-//
2//
3// Part of the LLVM Project, under the Apache License v2.0 with LLVM Exceptions.
4// See https://llvm.org/LICENSE.txt for license information.
5// SPDX-License-Identifier: Apache-2.0 WITH LLVM-exception
6//
7//===----------------------------------------------------------------------===//
8//
9// This defines MacOSXAPIChecker, which is an assortment of checks on calls
10// to various, widely used Apple APIs.
11//
12// FIXME: What's currently in BasicObjCFoundationChecks.cpp should be migrated
13// to here, using the new Checker interface.
14//
15//===----------------------------------------------------------------------===//
16
17#include "clang/AST/Attr.h"
18#include "clang/Basic/TargetInfo.h"
19#include "clang/StaticAnalyzer/Checkers/BuiltinCheckerRegistration.h"
20#include "clang/StaticAnalyzer/Core/BugReporter/BugType.h"
21#include "clang/StaticAnalyzer/Core/BugReporter/CommonBugCategories.h"
22#include "clang/StaticAnalyzer/Core/Checker.h"
23#include "clang/StaticAnalyzer/Core/CheckerManager.h"
24#include "clang/StaticAnalyzer/Core/PathSensitive/CheckerContext.h"
25#include "clang/StaticAnalyzer/Core/PathSensitive/ProgramStateTrait.h"
26#include "llvm/ADT/SmallString.h"
27#include "llvm/ADT/StringSwitch.h"
28#include "llvm/Support/raw_ostream.h"
29
30using namespace clang;
31using namespace ento;
32
33namespace {
34class MacOSXAPIChecker : public Checker< check::PreStmt<CallExpr> > {
35 const BugType BT_dispatchOnce{this, "Improper use of 'dispatch_once'",
36 categories::AppleAPIMisuse};
37
38 static const ObjCIvarRegion *getParentIvarRegion(const MemRegion *R);
39
40public:
41 void checkPreStmt(const CallExpr *CE, CheckerContext &C) const;
42
43 void CheckDispatchOnce(CheckerContext &C, const CallExpr *CE,
44 StringRef FName) const;
45
46 typedef void (MacOSXAPIChecker::*SubChecker)(CheckerContext &,
47 const CallExpr *,
48 StringRef FName) const;
49};
50} //end anonymous namespace
51
52//===----------------------------------------------------------------------===//
53// dispatch_once and dispatch_once_f
54//===----------------------------------------------------------------------===//
55
56const ObjCIvarRegion *
57MacOSXAPIChecker::getParentIvarRegion(const MemRegion *R) {
58 const SubRegion *SR = dyn_cast<SubRegion>(Val: R);
59 while (SR) {
60 if (const ObjCIvarRegion *IR = dyn_cast<ObjCIvarRegion>(Val: SR))
61 return IR;
62 SR = dyn_cast<SubRegion>(Val: SR->getSuperRegion());
63 }
64 return nullptr;
65}
66
67void MacOSXAPIChecker::CheckDispatchOnce(CheckerContext &C, const CallExpr *CE,
68 StringRef FName) const {
69 if (CE->getNumArgs() < 1)
70 return;
71
72 // Check if the first argument is improperly allocated. If so, issue a
73 // warning because that's likely to be bad news.
74 const MemRegion *R = C.getSVal(S: CE->getArg(Arg: 0)).getAsRegion();
75 if (!R)
76 return;
77
78 // Global variables are fine.
79 const MemRegion *RB = R->getBaseRegion();
80 const MemSpaceRegion *RS = RB->getMemorySpace();
81 if (isa<GlobalsSpaceRegion>(Val: RS))
82 return;
83
84 // Handle _dispatch_once. In some versions of the OS X SDK we have the case
85 // that dispatch_once is a macro that wraps a call to _dispatch_once.
86 // _dispatch_once is then a function which then calls the real dispatch_once.
87 // Users do not care; they just want the warning at the top-level call.
88 if (CE->getBeginLoc().isMacroID()) {
89 StringRef TrimmedFName = FName.ltrim(Char: '_');
90 if (TrimmedFName != FName)
91 FName = TrimmedFName;
92 }
93
94 SmallString<256> S;
95 llvm::raw_svector_ostream os(S);
96 bool SuggestStatic = false;
97 os << "Call to '" << FName << "' uses";
98 if (const VarRegion *VR = dyn_cast<VarRegion>(Val: RB)) {
99 const VarDecl *VD = VR->getDecl();
100 // FIXME: These should have correct memory space and thus should be filtered
101 // out earlier. This branch only fires when we're looking from a block,
102 // which we analyze as a top-level declaration, onto a static local
103 // in a function that contains the block.
104 if (VD->isStaticLocal())
105 return;
106 // We filtered out globals earlier, so it must be a local variable
107 // or a block variable which is under UnknownSpaceRegion.
108 if (VR != R)
109 os << " memory within";
110 if (VD->hasAttr<BlocksAttr>())
111 os << " the block variable '";
112 else
113 os << " the local variable '";
114 os << VR->getDecl()->getName() << '\'';
115 SuggestStatic = true;
116 } else if (const ObjCIvarRegion *IVR = getParentIvarRegion(R)) {
117 if (IVR != R)
118 os << " memory within";
119 os << " the instance variable '" << IVR->getDecl()->getName() << '\'';
120 } else if (isa<HeapSpaceRegion>(Val: RS)) {
121 os << " heap-allocated memory";
122 } else if (isa<UnknownSpaceRegion>(Val: RS)) {
123 // Presence of an IVar superregion has priority over this branch, because
124 // ObjC objects are on the heap even if the core doesn't realize this.
125 // Presence of a block variable base region has priority over this branch,
126 // because block variables are known to be either on stack or on heap
127 // (might actually move between the two, hence UnknownSpace).
128 return;
129 } else {
130 os << " stack allocated memory";
131 }
132 os << " for the predicate value. Using such transient memory for "
133 "the predicate is potentially dangerous.";
134 if (SuggestStatic)
135 os << " Perhaps you intended to declare the variable as 'static'?";
136
137 ExplodedNode *N = C.generateErrorNode();
138 if (!N)
139 return;
140
141 auto report =
142 std::make_unique<PathSensitiveBugReport>(args: BT_dispatchOnce, args: os.str(), args&: N);
143 report->addRange(R: CE->getArg(Arg: 0)->getSourceRange());
144 C.emitReport(R: std::move(report));
145}
146
147//===----------------------------------------------------------------------===//
148// Central dispatch function.
149//===----------------------------------------------------------------------===//
150
151void MacOSXAPIChecker::checkPreStmt(const CallExpr *CE,
152 CheckerContext &C) const {
153 StringRef Name = C.getCalleeName(CE);
154 if (Name.empty())
155 return;
156
157 SubChecker SC =
158 llvm::StringSwitch<SubChecker>(Name)
159 .Cases(S0: "dispatch_once",
160 S1: "_dispatch_once",
161 S2: "dispatch_once_f",
162 Value: &MacOSXAPIChecker::CheckDispatchOnce)
163 .Default(Value: nullptr);
164
165 if (SC)
166 (this->*SC)(C, CE, Name);
167}
168
169//===----------------------------------------------------------------------===//
170// Registration.
171//===----------------------------------------------------------------------===//
172
173void ento::registerMacOSXAPIChecker(CheckerManager &mgr) {
174 mgr.registerChecker<MacOSXAPIChecker>();
175}
176
177bool ento::shouldRegisterMacOSXAPIChecker(const CheckerManager &mgr) {
178 return true;
179}
180