1 //=======- UncountedLocalVarsChecker.cpp -------------------------*- C++ -*-==//
2 //
3 // Part of the LLVM Project, under the Apache License v2.0 with LLVM Exceptions.
4 // See https://llvm.org/LICENSE.txt for license information.
5 // SPDX-License-Identifier: Apache-2.0 WITH LLVM-exception
6 //
7 //===----------------------------------------------------------------------===//
8 
9 #include "ASTUtils.h"
10 #include "DiagOutputUtils.h"
11 #include "PtrTypesSemantics.h"
12 #include "clang/AST/CXXInheritance.h"
13 #include "clang/AST/Decl.h"
14 #include "clang/AST/DeclCXX.h"
15 #include "clang/AST/ParentMapContext.h"
16 #include "clang/AST/RecursiveASTVisitor.h"
17 #include "clang/Basic/SourceLocation.h"
18 #include "clang/StaticAnalyzer/Checkers/BuiltinCheckerRegistration.h"
19 #include "clang/StaticAnalyzer/Core/BugReporter/BugReporter.h"
20 #include "clang/StaticAnalyzer/Core/BugReporter/BugType.h"
21 #include "clang/StaticAnalyzer/Core/Checker.h"
22 #include "llvm/ADT/DenseSet.h"
23 
24 using namespace clang;
25 using namespace ento;
26 
27 namespace {
28 
29 // for ( int a = ...) ... true
30 // for ( int a : ...) ... true
31 // if ( int* a = ) ... true
32 // anything else ... false
33 bool isDeclaredInForOrIf(const VarDecl *Var) {
34   assert(Var);
35   auto &ASTCtx = Var->getASTContext();
36   auto parent = ASTCtx.getParents(*Var);
37 
38   if (parent.size() == 1) {
39     if (auto *DS = parent.begin()->get<DeclStmt>()) {
40       DynTypedNodeList grandParent = ASTCtx.getParents(*DS);
41       if (grandParent.size() == 1) {
42         return grandParent.begin()->get<ForStmt>() ||
43                grandParent.begin()->get<IfStmt>() ||
44                grandParent.begin()->get<CXXForRangeStmt>();
45       }
46     }
47   }
48   return false;
49 }
50 
51 // FIXME: should be defined by anotations in the future
52 bool isRefcountedStringsHack(const VarDecl *V) {
53   assert(V);
54   auto safeClass = [](const std::string &className) {
55     return className == "String" || className == "AtomString" ||
56            className == "UniquedString" || className == "Identifier";
57   };
58   QualType QT = V->getType();
59   auto *T = QT.getTypePtr();
60   if (auto *CXXRD = T->getAsCXXRecordDecl()) {
61     if (safeClass(safeGetName(CXXRD)))
62       return true;
63   }
64   if (T->isPointerType() || T->isReferenceType()) {
65     if (auto *CXXRD = T->getPointeeCXXRecordDecl()) {
66       if (safeClass(safeGetName(CXXRD)))
67         return true;
68     }
69   }
70   return false;
71 }
72 
73 bool isGuardedScopeEmbeddedInGuardianScope(const VarDecl *Guarded,
74                                            const VarDecl *MaybeGuardian) {
75   assert(Guarded);
76   assert(MaybeGuardian);
77 
78   if (!MaybeGuardian->isLocalVarDecl())
79     return false;
80 
81   const CompoundStmt *guardiansClosestCompStmtAncestor = nullptr;
82 
83   ASTContext &ctx = MaybeGuardian->getASTContext();
84 
85   for (DynTypedNodeList guardianAncestors = ctx.getParents(*MaybeGuardian);
86        !guardianAncestors.empty();
87        guardianAncestors = ctx.getParents(
88            *guardianAncestors
89                 .begin()) // FIXME - should we handle all of the parents?
90   ) {
91     for (auto &guardianAncestor : guardianAncestors) {
92       if (auto *CStmtParentAncestor = guardianAncestor.get<CompoundStmt>()) {
93         guardiansClosestCompStmtAncestor = CStmtParentAncestor;
94         break;
95       }
96     }
97     if (guardiansClosestCompStmtAncestor)
98       break;
99   }
100 
101   if (!guardiansClosestCompStmtAncestor)
102     return false;
103 
104   // We need to skip the first CompoundStmt to avoid situation when guardian is
105   // defined in the same scope as guarded variable.
106   bool HaveSkippedFirstCompoundStmt = false;
107   for (DynTypedNodeList guardedVarAncestors = ctx.getParents(*Guarded);
108        !guardedVarAncestors.empty();
109        guardedVarAncestors = ctx.getParents(
110            *guardedVarAncestors
111                 .begin()) // FIXME - should we handle all of the parents?
112   ) {
113     for (auto &guardedVarAncestor : guardedVarAncestors) {
114       if (auto *CStmtAncestor = guardedVarAncestor.get<CompoundStmt>()) {
115         if (!HaveSkippedFirstCompoundStmt) {
116           HaveSkippedFirstCompoundStmt = true;
117           continue;
118         }
119         if (CStmtAncestor == guardiansClosestCompStmtAncestor)
120           return true;
121       }
122     }
123   }
124 
125   return false;
126 }
127 
128 class UncountedLocalVarsChecker
129     : public Checker<check::ASTDecl<TranslationUnitDecl>> {
130   BugType Bug{this,
131               "Uncounted raw pointer or reference not provably backed by "
132               "ref-counted variable",
133               "WebKit coding guidelines"};
134   mutable BugReporter *BR;
135 
136 public:
137   void checkASTDecl(const TranslationUnitDecl *TUD, AnalysisManager &MGR,
138                     BugReporter &BRArg) const {
139     BR = &BRArg;
140 
141     // The calls to checkAST* from AnalysisConsumer don't
142     // visit template instantiations or lambda classes. We
143     // want to visit those, so we make our own RecursiveASTVisitor.
144     struct LocalVisitor : public RecursiveASTVisitor<LocalVisitor> {
145       const UncountedLocalVarsChecker *Checker;
146       explicit LocalVisitor(const UncountedLocalVarsChecker *Checker)
147           : Checker(Checker) {
148         assert(Checker);
149       }
150 
151       bool shouldVisitTemplateInstantiations() const { return true; }
152       bool shouldVisitImplicitCode() const { return false; }
153 
154       bool VisitVarDecl(VarDecl *V) {
155         Checker->visitVarDecl(V);
156         return true;
157       }
158     };
159 
160     LocalVisitor visitor(this);
161     visitor.TraverseDecl(const_cast<TranslationUnitDecl *>(TUD));
162   }
163 
164   void visitVarDecl(const VarDecl *V) const {
165     if (shouldSkipVarDecl(V))
166       return;
167 
168     const auto *ArgType = V->getType().getTypePtr();
169     if (!ArgType)
170       return;
171 
172     Optional<bool> IsUncountedPtr = isUncountedPtr(ArgType);
173     if (IsUncountedPtr && *IsUncountedPtr) {
174       const Expr *const InitExpr = V->getInit();
175       if (!InitExpr)
176         return; // FIXME: later on we might warn on uninitialized vars too
177 
178       const clang::Expr *const InitArgOrigin =
179           tryToFindPtrOrigin(InitExpr, /*StopAtFirstRefCountedObj=*/false)
180               .first;
181       if (!InitArgOrigin)
182         return;
183 
184       if (isa<CXXThisExpr>(InitArgOrigin))
185         return;
186 
187       if (auto *Ref = llvm::dyn_cast<DeclRefExpr>(InitArgOrigin)) {
188         if (auto *MaybeGuardian =
189                 dyn_cast_or_null<VarDecl>(Ref->getFoundDecl())) {
190           const auto *MaybeGuardianArgType =
191               MaybeGuardian->getType().getTypePtr();
192           if (!MaybeGuardianArgType)
193             return;
194           const CXXRecordDecl *const MaybeGuardianArgCXXRecord =
195               MaybeGuardianArgType->getAsCXXRecordDecl();
196           if (!MaybeGuardianArgCXXRecord)
197             return;
198 
199           if (MaybeGuardian->isLocalVarDecl() &&
200               (isRefCounted(MaybeGuardianArgCXXRecord) ||
201                isRefcountedStringsHack(MaybeGuardian)) &&
202               isGuardedScopeEmbeddedInGuardianScope(V, MaybeGuardian)) {
203             return;
204           }
205 
206           // Parameters are guaranteed to be safe for the duration of the call
207           // by another checker.
208           if (isa<ParmVarDecl>(MaybeGuardian))
209             return;
210         }
211       }
212 
213       reportBug(V);
214     }
215   }
216 
217   bool shouldSkipVarDecl(const VarDecl *V) const {
218     assert(V);
219     if (!V->isLocalVarDecl())
220       return true;
221 
222     if (isDeclaredInForOrIf(V))
223       return true;
224 
225     return false;
226   }
227 
228   void reportBug(const VarDecl *V) const {
229     assert(V);
230     SmallString<100> Buf;
231     llvm::raw_svector_ostream Os(Buf);
232 
233     Os << "Local variable ";
234     printQuotedQualifiedName(Os, V);
235     Os << " is uncounted and unsafe.";
236 
237     PathDiagnosticLocation BSLoc(V->getLocation(), BR->getSourceManager());
238     auto Report = std::make_unique<BasicBugReport>(Bug, Os.str(), BSLoc);
239     Report->addRange(V->getSourceRange());
240     BR->emitReport(std::move(Report));
241   }
242 };
243 } // namespace
244 
245 void ento::registerUncountedLocalVarsChecker(CheckerManager &Mgr) {
246   Mgr.registerChecker<UncountedLocalVarsChecker>();
247 }
248 
249 bool ento::shouldRegisterUncountedLocalVarsChecker(const CheckerManager &) {
250   return true;
251 }
252