1//=======- UncountedLocalVarsChecker.cpp -------------------------*- C++ -*-==//
2//
3// Part of the LLVM Project, under the Apache License v2.0 with LLVM Exceptions.
4// See https://llvm.org/LICENSE.txt for license information.
5// SPDX-License-Identifier: Apache-2.0 WITH LLVM-exception
6//
7//===----------------------------------------------------------------------===//
8
9#include "ASTUtils.h"
10#include "DiagOutputUtils.h"
11#include "PtrTypesSemantics.h"
12#include "RawPtrRefSafetyModel.h"
13#include "clang/AST/CXXInheritance.h"
14#include "clang/AST/Decl.h"
15#include "clang/AST/DeclCXX.h"
16#include "clang/AST/DynamicRecursiveASTVisitor.h"
17#include "clang/AST/ParentMapContext.h"
18#include "clang/Analysis/DomainSpecific/CocoaConventions.h"
19#include "clang/Basic/SourceLocation.h"
20#include "clang/StaticAnalyzer/Checkers/BuiltinCheckerRegistration.h"
21#include "clang/StaticAnalyzer/Core/BugReporter/BugReporter.h"
22#include "clang/StaticAnalyzer/Core/BugReporter/BugType.h"
23#include "clang/StaticAnalyzer/Core/Checker.h"
24#include <optional>
25
26using namespace clang;
27using namespace ento;
28
29namespace {
30
31// FIXME: should be defined by anotations in the future
32bool isRefcountedStringsHack(const VarDecl *V) {
33 assert(V);
34 auto safeClass = [](const std::string &className) {
35 return className == "String" || className == "AtomString" ||
36 className == "UniquedString" || className == "Identifier";
37 };
38 QualType QT = V->getType();
39 auto *T = QT.getTypePtr();
40 if (auto *CXXRD = T->getAsCXXRecordDecl()) {
41 if (safeClass(safeGetName(ASTNode: CXXRD)))
42 return true;
43 }
44 if (T->isPointerType() || T->isReferenceType()) {
45 if (auto *CXXRD = T->getPointeeCXXRecordDecl()) {
46 if (safeClass(safeGetName(ASTNode: CXXRD)))
47 return true;
48 }
49 }
50 return false;
51}
52
53struct GuardianVisitor : DynamicRecursiveASTVisitor {
54 const VarDecl *Guardian{nullptr};
55
56 explicit GuardianVisitor(const VarDecl *Guardian) : Guardian(Guardian) {
57 assert(Guardian);
58 }
59
60 bool VisitBinaryOperator(BinaryOperator *BO) override {
61 if (BO->isAssignmentOp()) {
62 if (auto *VarRef = dyn_cast<DeclRefExpr>(Val: BO->getLHS())) {
63 if (VarRef->getDecl() == Guardian)
64 return false;
65 }
66 }
67 return true;
68 }
69
70 bool VisitCXXConstructExpr(CXXConstructExpr *CE) override {
71 auto *Ctor = CE->getConstructor();
72 if (!Ctor)
73 return false;
74 unsigned ArgIndex = 0;
75 for (auto *Arg : CE->arguments()) {
76 ParmVarDecl *Parm = nullptr;
77 if (ArgIndex < Ctor->getNumParams())
78 Parm = Ctor->getParamDecl(i: ArgIndex);
79 if (mutatesGuardian(Arg, ParmDecl: Parm))
80 return false;
81 ArgIndex++;
82 }
83 return true;
84 }
85
86 bool VisitCallExpr(CallExpr *CE) override {
87 auto *Callee = CE->getDirectCallee();
88 if (!Callee)
89 return false;
90 if (isPtrConversion(F: Callee))
91 return true;
92 unsigned ArgIndex = 0;
93 unsigned ArgOffset = isa<CXXOperatorCallExpr>(Val: CE);
94 for (auto *Arg : CE->arguments()) {
95 ParmVarDecl *Parm = nullptr;
96 if (ArgIndex >= ArgOffset) {
97 unsigned ParmIndex = ArgIndex - ArgOffset;
98 if (ParmIndex < Callee->getNumParams())
99 Parm = Callee->getParamDecl(i: ParmIndex);
100 }
101 if (mutatesGuardian(Arg, ParmDecl: Parm))
102 return false;
103 ArgIndex++;
104 }
105 return true;
106 }
107
108 bool VisitCXXMemberCallExpr(CXXMemberCallExpr *MCE) override {
109 auto *Method = MCE->getMethodDecl();
110 auto ObjType = MCE->getObjectType();
111 if (ObjType.isConstQualified())
112 return true;
113 auto *ThisArg = MCE->getImplicitObjectArgument()->IgnoreParenCasts();
114 if (auto *VarRef = dyn_cast<DeclRefExpr>(Val: ThisArg)) {
115 if (!isa<CXXConversionDecl>(Val: Method) && VarRef->getDecl() == Guardian)
116 return false;
117 }
118 return true;
119 }
120
121private:
122 bool mutatesGuardian(const Expr *Arg, const ParmVarDecl *ParmDecl) {
123 Arg = Arg->IgnoreParenCasts();
124 if (auto *VarRef = dyn_cast<DeclRefExpr>(Val: Arg)) {
125 if (VarRef->getDecl() == Guardian) {
126 auto ArgType = ParmDecl ? ParmDecl->getType() : Arg->getType();
127 if (!ArgType.isConstQualified())
128 return true;
129 }
130 }
131 return false;
132 }
133};
134
135bool isGuardedScopeEmbeddedInGuardianScope(const VarDecl *Guarded,
136 const VarDecl *MaybeGuardian) {
137 assert(Guarded);
138 assert(MaybeGuardian);
139
140 if (!MaybeGuardian->isLocalVarDecl())
141 return false;
142
143 const CompoundStmt *guardiansClosestCompStmtAncestor = nullptr;
144
145 ASTContext &ctx = MaybeGuardian->getASTContext();
146
147 for (DynTypedNodeList guardianAncestors = ctx.getParents(Node: *MaybeGuardian);
148 !guardianAncestors.empty();
149 guardianAncestors = ctx.getParents(
150 Node: *guardianAncestors
151 .begin()) // FIXME - should we handle all of the parents?
152 ) {
153 for (auto &guardianAncestor : guardianAncestors) {
154 if (auto *CStmtParentAncestor = guardianAncestor.get<CompoundStmt>()) {
155 guardiansClosestCompStmtAncestor = CStmtParentAncestor;
156 break;
157 }
158 }
159 if (guardiansClosestCompStmtAncestor)
160 break;
161 }
162
163 if (!guardiansClosestCompStmtAncestor)
164 return false;
165
166 // We need to skip the first CompoundStmt to avoid situation when guardian is
167 // defined in the same scope as guarded variable.
168 const CompoundStmt *FirstCompondStmt = nullptr;
169 for (DynTypedNodeList guardedVarAncestors = ctx.getParents(Node: *Guarded);
170 !guardedVarAncestors.empty();
171 guardedVarAncestors = ctx.getParents(
172 Node: *guardedVarAncestors
173 .begin()) // FIXME - should we handle all of the parents?
174 ) {
175 for (auto &guardedVarAncestor : guardedVarAncestors) {
176 if (auto *CStmtAncestor = guardedVarAncestor.get<CompoundStmt>()) {
177 if (!FirstCompondStmt) {
178 FirstCompondStmt = CStmtAncestor;
179 continue;
180 }
181 if (CStmtAncestor == guardiansClosestCompStmtAncestor) {
182 GuardianVisitor guardianVisitor(MaybeGuardian);
183 auto *GuardedScope = const_cast<CompoundStmt *>(FirstCompondStmt);
184 return guardianVisitor.TraverseCompoundStmt(S: GuardedScope);
185 }
186 }
187 }
188 }
189
190 return false;
191}
192
193class RawPtrRefLocalVarsChecker
194 : public Checker<check::ASTDecl<TranslationUnitDecl>> {
195 BugType Bug;
196 EnsureFunctionAnalysis EFA;
197
198protected:
199 mutable BugReporter *BR;
200 const std::unique_ptr<PtrRefSafetyModel> Model;
201
202public:
203 RawPtrRefLocalVarsChecker(const char *description,
204 std::unique_ptr<PtrRefSafetyModel> Model)
205 : Bug(this, description, "WebKit coding guidelines"),
206 Model(std::move(Model)) {}
207
208 std::optional<bool> isUnsafePtr(QualType T) const {
209 return isUnsafePtrForStorage(Model: *Model, T);
210 }
211
212 void checkASTDecl(const TranslationUnitDecl *TUD, AnalysisManager &MGR,
213 BugReporter &BRArg) const {
214 BR = &BRArg;
215
216 // The calls to checkAST* from AnalysisConsumer don't
217 // visit template instantiations or lambda classes. We
218 // want to visit those, so we make our own RecursiveASTVisitor.
219 struct LocalVisitor : DynamicRecursiveASTVisitor {
220 const RawPtrRefLocalVarsChecker *Checker;
221 Decl *DeclWithIssue{nullptr};
222
223 TrivialFunctionAnalysis TFA;
224
225 explicit LocalVisitor(const RawPtrRefLocalVarsChecker *Checker)
226 : Checker(Checker) {
227 assert(Checker);
228 ShouldVisitTemplateInstantiations = true;
229 ShouldVisitImplicitCode = false;
230 }
231
232 bool TraverseDecl(Decl *D) override {
233 llvm::SaveAndRestore SavedDecl(DeclWithIssue);
234 if (D && (isa<FunctionDecl>(Val: D) || isa<ObjCMethodDecl>(Val: D)))
235 DeclWithIssue = D;
236 return DynamicRecursiveASTVisitor::TraverseDecl(D);
237 }
238
239 bool VisitTypedefDecl(TypedefDecl *TD) override {
240 if (auto *RTC = Checker->Model->retainTypeChecker())
241 RTC->visitTypedef(TD);
242 return true;
243 }
244
245 bool VisitVarDecl(VarDecl *V) override {
246 auto *Init = V->getInit();
247 if (V->isLocalVarDecl())
248 Checker->visitVarDecl(V, Value: Init, DeclWithIssue);
249 return true;
250 }
251
252 bool VisitBinaryOperator(BinaryOperator *BO) override {
253 if (BO->isAssignmentOp()) {
254 if (auto *VarRef = dyn_cast<DeclRefExpr>(Val: BO->getLHS())) {
255 if (auto *V = dyn_cast<VarDecl>(Val: VarRef->getDecl()))
256 Checker->visitVarDecl(V, Value: BO->getRHS(), DeclWithIssue);
257 }
258 }
259 return true;
260 }
261
262 bool TraverseIfStmt(IfStmt *IS) override {
263 if (IS->getConditionVariable()) {
264 // This code currently does not explicitly check the "else" statement
265 // since getConditionVariable returns nullptr when there is a
266 // condition defined after ";" as in "if (auto foo = ~; !foo)". If
267 // this semantics change, we should add an explicit check for "else".
268 if (auto *Then = IS->getThen(); !Then || TFA.isTrivial(S: Then))
269 return true;
270 }
271 if (!TFA.isTrivial(S: IS))
272 return DynamicRecursiveASTVisitor::TraverseIfStmt(S: IS);
273 return true;
274 }
275
276 bool TraverseForStmt(ForStmt *FS) override {
277 if (!TFA.isTrivial(S: FS))
278 return DynamicRecursiveASTVisitor::TraverseForStmt(S: FS);
279 return true;
280 }
281
282 bool TraverseCXXForRangeStmt(CXXForRangeStmt *FRS) override {
283 if (!TFA.isTrivial(S: FRS))
284 return DynamicRecursiveASTVisitor::TraverseCXXForRangeStmt(S: FRS);
285 return true;
286 }
287
288 bool TraverseWhileStmt(WhileStmt *WS) override {
289 if (!TFA.isTrivial(S: WS))
290 return DynamicRecursiveASTVisitor::TraverseWhileStmt(S: WS);
291 return true;
292 }
293
294 bool TraverseCompoundStmt(CompoundStmt *CS) override {
295 if (!TFA.isTrivial(S: CS))
296 return DynamicRecursiveASTVisitor::TraverseCompoundStmt(S: CS);
297 return true;
298 }
299
300 bool TraverseClassTemplateDecl(ClassTemplateDecl *Decl) override {
301 if (isSmartPtrClass(Name: safeGetName(ASTNode: Decl)))
302 return true;
303 return DynamicRecursiveASTVisitor::TraverseClassTemplateDecl(D: Decl);
304 }
305 };
306
307 LocalVisitor visitor(this);
308 if (auto *RTC = Model->retainTypeChecker())
309 RTC->visitTranslationUnitDecl(TUD);
310 visitor.TraverseDecl(D: const_cast<TranslationUnitDecl *>(TUD));
311 }
312
313 void visitVarDecl(const VarDecl *V, const Expr *Value,
314 const Decl *DeclWithIssue) const {
315 if (shouldSkipVarDecl(V))
316 return;
317
318 if (auto *DD = dyn_cast<DecompositionDecl>(Val: V)) {
319 for (auto *BD : DD->bindings()) {
320 auto *Binding = BD->getBinding();
321 if (!Binding)
322 continue;
323 std::optional<bool> IsUncountedPtr = isUnsafePtr(T: Binding->getType());
324 if (!IsUncountedPtr || !*IsUncountedPtr)
325 continue;
326 reportBug(V, Value: nullptr, BindingDecl: BD, DeclWithIssue);
327 }
328 }
329
330 std::optional<bool> IsUncountedPtr = isUnsafePtr(T: V->getType());
331 if (IsUncountedPtr && *IsUncountedPtr) {
332 if (Value && isPtrOriginSafe(V, Value, DeclWithIssue))
333 return;
334 reportBug(V, Value, BindingDecl: nullptr, DeclWithIssue);
335 }
336 }
337
338 bool isPtrOriginSafe(const VarDecl *V, const Expr *Value,
339 const Decl *DeclWithIssue) const {
340 return tryToFindPtrOrigin(
341 E: Value, /*StopAtFirstRefCountedObj=*/false,
342 isSafePtr: [&](const clang::CXXRecordDecl *Record) {
343 return Model->isSafePtr(Record);
344 },
345 isSafePtrType: [&](const clang::QualType Type) { return Model->isSafePtrType(T: Type); },
346 isSafeGlobalDecl: [&](const clang::Decl *D) {
347 return Model->isSafeDecl(D, BR->getSourceManager());
348 },
349 callback: [&](const clang::Expr *InitArgOrigin, bool IsSafe) {
350 if (!InitArgOrigin || IsSafe)
351 return true;
352
353 if (isa<CXXThisExpr>(Val: InitArgOrigin))
354 return true;
355
356 if (isNullPtr(E: InitArgOrigin))
357 return true;
358
359 if (isa<IntegerLiteral>(Val: InitArgOrigin))
360 return true;
361
362 if (isConstOwnerPtrMemberExpr(E: InitArgOrigin))
363 return true;
364
365 if (EFA.isACallToEnsureFn(E: InitArgOrigin))
366 return true;
367
368 if (Model->isSafeExpr(InitArgOrigin))
369 return true;
370
371 if (auto *Ref = llvm::dyn_cast<DeclRefExpr>(Val: InitArgOrigin)) {
372 if (auto *MaybeGuardian =
373 dyn_cast_or_null<VarDecl>(Val: Ref->getFoundDecl())) {
374 const auto *MaybeGuardianArgType =
375 MaybeGuardian->getType().getTypePtr();
376 if (MaybeGuardianArgType) {
377 const CXXRecordDecl *const MaybeGuardianArgCXXRecord =
378 MaybeGuardianArgType->getAsCXXRecordDecl();
379 if (MaybeGuardianArgCXXRecord) {
380 if (MaybeGuardian->isLocalVarDecl() &&
381 (Model->isSafePtr(Record: MaybeGuardianArgCXXRecord) ||
382 isRefcountedStringsHack(V: MaybeGuardian)) &&
383 isGuardedScopeEmbeddedInGuardianScope(Guarded: V, MaybeGuardian))
384 return true;
385 }
386 }
387
388 if (isa<ParmVarDecl>(Val: MaybeGuardian)) {
389 if (auto *FD = dyn_cast<FunctionDecl>(Val: DeclWithIssue)) {
390 if (GuardianVisitor{MaybeGuardian}.TraverseStmt(
391 S: FD->getBody()))
392 return true;
393 }
394 if (auto *MD = dyn_cast<ObjCMethodDecl>(Val: DeclWithIssue)) {
395 if (GuardianVisitor{MaybeGuardian}.TraverseStmt(
396 S: MD->getBody()))
397 return true;
398 }
399 }
400 }
401 }
402
403 return false;
404 });
405 }
406
407 bool shouldSkipVarDecl(const VarDecl *V) const {
408 assert(V);
409 if (isa<ImplicitParamDecl>(Val: V))
410 return true;
411 return BR->getSourceManager().isInSystemHeader(Loc: V->getLocation());
412 }
413
414 void reportBug(const VarDecl *V, const Expr *Value, const Decl *BindingDecl,
415 const Decl *DeclWithIssue) const {
416 assert(V);
417 SmallString<100> Buf;
418 llvm::raw_svector_ostream Os(Buf);
419
420 if (isa<ParmVarDecl>(Val: V)) {
421 Os << "Parameter ";
422 printQuotedQualifiedName(Os, D: V);
423 Os << " is a ";
424 printPointerTypeAndType(Os, QT: V->getType());
425
426 SourceLocation ExprLoc = (Value) ? Value->getExprLoc() : V->getLocation();
427 PathDiagnosticLocation BSLoc(ExprLoc, BR->getSourceManager());
428 auto Report = std::make_unique<BasicBugReport>(args: Bug, args: Os.str(), args&: BSLoc);
429 if (Value)
430 Report->addRange(R: Value->getSourceRange());
431 Report->setDeclWithIssue(DeclWithIssue);
432 BR->emitReport(R: std::move(Report));
433 } else {
434 if (V->hasLocalStorage())
435 Os << "Local variable ";
436 else if (V->isStaticLocal())
437 Os << "Static local variable ";
438 else if (V->hasGlobalStorage())
439 Os << "Global variable ";
440 else
441 Os << "Variable ";
442 if (BindingDecl)
443 Os << "'" << safeGetName(ASTNode: BindingDecl) << "'";
444 else
445 printQuotedQualifiedName(Os, D: V);
446 Os << " is a ";
447 printPointerTypeAndType(Os, QT: V->getType());
448
449 PathDiagnosticLocation BSLoc(V->getLocation(), BR->getSourceManager());
450 auto Report = std::make_unique<BasicBugReport>(args: Bug, args: Os.str(), args&: BSLoc);
451 Report->addRange(R: V->getSourceRange());
452 Report->setDeclWithIssue(DeclWithIssue);
453 BR->emitReport(R: std::move(Report));
454 }
455 }
456
457 void printPointerTypeAndType(llvm::raw_svector_ostream &Os,
458 QualType QT) const {
459 auto *VarType = QT.getTypePtr();
460 auto *RTC = Model->retainTypeChecker();
461 if (RTC && isa<TypedefType>(Val: VarType)) {
462 Os << Model->typeName() << " ";
463 if (auto *Decl = RTC->getCanonicalDecl(QT)) {
464 printQuotedQualifiedName(Os, D: Decl);
465 } else {
466 auto Typedef = VarType->getAs<TypedefType>();
467 assert(Typedef);
468 printQuotedQualifiedName(Os, D: Typedef->getDecl());
469 }
470 } else {
471 auto *DesugaredType = VarType->getUnqualifiedDesugaredType();
472 bool IsPtr = isa<PointerType, ObjCObjectPointerType>(Val: DesugaredType);
473 Os << "raw " << (IsPtr ? "pointer" : "reference") << " to ";
474 Os << Model->typeName() << " ";
475 printTypeName(Os, QT);
476 }
477 }
478};
479
480class UncountedLocalVarsChecker final : public RawPtrRefLocalVarsChecker {
481public:
482 UncountedLocalVarsChecker()
483 : RawPtrRefLocalVarsChecker("Uncounted raw pointer or reference not "
484 "provably backed by ref-counted variable",
485 makeRefPtrSafetyModel()) {}
486};
487
488class UncheckedLocalVarsChecker final : public RawPtrRefLocalVarsChecker {
489public:
490 UncheckedLocalVarsChecker()
491 : RawPtrRefLocalVarsChecker("Unchecked raw pointer or reference not "
492 "provably backed by checked variable",
493 makeCheckedPtrSafetyModel()) {}
494};
495
496class UnretainedLocalVarsChecker final : public RawPtrRefLocalVarsChecker {
497public:
498 UnretainedLocalVarsChecker()
499 : RawPtrRefLocalVarsChecker("Unretained raw pointer or reference not "
500 "provably backed by a RetainPtr",
501 makeRetainPtrSafetyModel()) {}
502};
503
504} // namespace
505
506void ento::registerUncountedLocalVarsChecker(CheckerManager &Mgr) {
507 Mgr.registerChecker<UncountedLocalVarsChecker>();
508}
509
510bool ento::shouldRegisterUncountedLocalVarsChecker(const CheckerManager &) {
511 return true;
512}
513
514void ento::registerUncheckedLocalVarsChecker(CheckerManager &Mgr) {
515 Mgr.registerChecker<UncheckedLocalVarsChecker>();
516}
517
518bool ento::shouldRegisterUncheckedLocalVarsChecker(const CheckerManager &) {
519 return true;
520}
521
522void ento::registerUnretainedLocalVarsChecker(CheckerManager &Mgr) {
523 Mgr.registerChecker<UnretainedLocalVarsChecker>();
524}
525
526bool ento::shouldRegisterUnretainedLocalVarsChecker(const CheckerManager &) {
527 return true;
528}
529