1 //== CheckerContext.h - Context info for path-sensitive checkers--*- C++ -*--=// 2 // 3 // Part of the LLVM Project, under the Apache License v2.0 with LLVM Exceptions. 4 // See https://llvm.org/LICENSE.txt for license information. 5 // SPDX-License-Identifier: Apache-2.0 WITH LLVM-exception 6 // 7 //===----------------------------------------------------------------------===// 8 // 9 // This file defines CheckerContext that provides contextual info for 10 // path-sensitive checkers. 11 // 12 //===----------------------------------------------------------------------===// 13 14 #ifndef LLVM_CLANG_STATICANALYZER_CORE_PATHSENSITIVE_CHECKERCONTEXT_H 15 #define LLVM_CLANG_STATICANALYZER_CORE_PATHSENSITIVE_CHECKERCONTEXT_H 16 17 #include "clang/StaticAnalyzer/Core/PathSensitive/ExprEngine.h" 18 #include "clang/StaticAnalyzer/Core/PathSensitive/ProgramStateTrait.h" 19 20 namespace clang { 21 namespace ento { 22 23 class CheckerContext { 24 ExprEngine &Eng; 25 /// The current exploded(symbolic execution) graph node. 26 ExplodedNode *Pred; 27 /// The flag is true if the (state of the execution) has been modified 28 /// by the checker using this context. For example, a new transition has been 29 /// added or a bug report issued. 30 bool Changed; 31 /// The tagged location, which is used to generate all new nodes. 32 const ProgramPoint Location; 33 NodeBuilder &NB; 34 35 public: 36 /// If we are post visiting a call, this flag will be set if the 37 /// call was inlined. In all other cases it will be false. 38 const bool wasInlined; 39 40 CheckerContext(NodeBuilder &builder, 41 ExprEngine &eng, 42 ExplodedNode *pred, 43 const ProgramPoint &loc, 44 bool wasInlined = false) 45 : Eng(eng), 46 Pred(pred), 47 Changed(false), 48 Location(loc), 49 NB(builder), 50 wasInlined(wasInlined) { 51 assert(Pred->getState() && 52 "We should not call the checkers on an empty state."); 53 } 54 55 AnalysisManager &getAnalysisManager() { 56 return Eng.getAnalysisManager(); 57 } 58 59 ConstraintManager &getConstraintManager() { 60 return Eng.getConstraintManager(); 61 } 62 63 StoreManager &getStoreManager() { 64 return Eng.getStoreManager(); 65 } 66 67 /// Returns the previous node in the exploded graph, which includes 68 /// the state of the program before the checker ran. Note, checkers should 69 /// not retain the node in their state since the nodes might get invalidated. 70 ExplodedNode *getPredecessor() { return Pred; } 71 const ProgramStateRef &getState() const { return Pred->getState(); } 72 73 /// Check if the checker changed the state of the execution; ex: added 74 /// a new transition or a bug report. 75 bool isDifferent() { return Changed; } 76 77 /// Returns the number of times the current block has been visited 78 /// along the analyzed path. 79 unsigned blockCount() const { 80 return NB.getContext().blockCount(); 81 } 82 83 ASTContext &getASTContext() { 84 return Eng.getContext(); 85 } 86 87 const ASTContext &getASTContext() const { return Eng.getContext(); } 88 89 const LangOptions &getLangOpts() const { 90 return Eng.getContext().getLangOpts(); 91 } 92 93 const LocationContext *getLocationContext() const { 94 return Pred->getLocationContext(); 95 } 96 97 const StackFrameContext *getStackFrame() const { 98 return Pred->getStackFrame(); 99 } 100 101 /// Return true if the current LocationContext has no caller context. 102 bool inTopFrame() const { return getLocationContext()->inTopFrame(); } 103 104 BugReporter &getBugReporter() { 105 return Eng.getBugReporter(); 106 } 107 108 const SourceManager &getSourceManager() { 109 return getBugReporter().getSourceManager(); 110 } 111 112 Preprocessor &getPreprocessor() { return getBugReporter().getPreprocessor(); } 113 114 SValBuilder &getSValBuilder() { 115 return Eng.getSValBuilder(); 116 } 117 118 SymbolManager &getSymbolManager() { 119 return getSValBuilder().getSymbolManager(); 120 } 121 122 ProgramStateManager &getStateManager() { 123 return Eng.getStateManager(); 124 } 125 126 AnalysisDeclContext *getCurrentAnalysisDeclContext() const { 127 return Pred->getLocationContext()->getAnalysisDeclContext(); 128 } 129 130 /// Get the blockID. 131 unsigned getBlockID() const { 132 return NB.getContext().getBlock()->getBlockID(); 133 } 134 135 /// If the given node corresponds to a PostStore program point, 136 /// retrieve the location region as it was uttered in the code. 137 /// 138 /// This utility can be useful for generating extensive diagnostics, for 139 /// example, for finding variables that the given symbol was assigned to. 140 static const MemRegion *getLocationRegionIfPostStore(const ExplodedNode *N) { 141 ProgramPoint L = N->getLocation(); 142 if (Optional<PostStore> PSL = L.getAs<PostStore>()) 143 return reinterpret_cast<const MemRegion*>(PSL->getLocationValue()); 144 return nullptr; 145 } 146 147 /// Get the value of arbitrary expressions at this point in the path. 148 SVal getSVal(const Stmt *S) const { 149 return Pred->getSVal(S); 150 } 151 152 /// Returns true if the value of \p E is greater than or equal to \p 153 /// Val under unsigned comparison 154 bool isGreaterOrEqual(const Expr *E, unsigned long long Val); 155 156 /// Returns true if the value of \p E is negative. 157 bool isNegative(const Expr *E); 158 159 /// Generates a new transition in the program state graph 160 /// (ExplodedGraph). Uses the default CheckerContext predecessor node. 161 /// 162 /// @param State The state of the generated node. If not specified, the state 163 /// will not be changed, but the new node will have the checker's tag. 164 /// @param Tag The tag is used to uniquely identify the creation site. If no 165 /// tag is specified, a default tag, unique to the given checker, 166 /// will be used. Tags are used to prevent states generated at 167 /// different sites from caching out. 168 ExplodedNode *addTransition(ProgramStateRef State = nullptr, 169 const ProgramPointTag *Tag = nullptr) { 170 return addTransitionImpl(State ? State : getState(), false, nullptr, Tag); 171 } 172 173 /// Generates a new transition with the given predecessor. 174 /// Allows checkers to generate a chain of nodes. 175 /// 176 /// @param State The state of the generated node. 177 /// @param Pred The transition will be generated from the specified Pred node 178 /// to the newly generated node. 179 /// @param Tag The tag to uniquely identify the creation site. 180 ExplodedNode *addTransition(ProgramStateRef State, ExplodedNode *Pred, 181 const ProgramPointTag *Tag = nullptr) { 182 return addTransitionImpl(State, false, Pred, Tag); 183 } 184 185 /// Generate a sink node. Generating a sink stops exploration of the 186 /// given path. To create a sink node for the purpose of reporting an error, 187 /// checkers should use generateErrorNode() instead. 188 ExplodedNode *generateSink(ProgramStateRef State, ExplodedNode *Pred, 189 const ProgramPointTag *Tag = nullptr) { 190 return addTransitionImpl(State ? State : getState(), true, Pred, Tag); 191 } 192 193 /// Add a sink node to the current path of execution, halting analysis. 194 void addSink(ProgramStateRef State = nullptr, 195 const ProgramPointTag *Tag = nullptr) { 196 if (!State) 197 State = getState(); 198 addTransition(State, generateSink(State, getPredecessor())); 199 } 200 201 /// Generate a transition to a node that will be used to report 202 /// an error. This node will be a sink. That is, it will stop exploration of 203 /// the given path. 204 /// 205 /// @param State The state of the generated node. 206 /// @param Tag The tag to uniquely identify the creation site. If null, 207 /// the default tag for the checker will be used. 208 ExplodedNode *generateErrorNode(ProgramStateRef State = nullptr, 209 const ProgramPointTag *Tag = nullptr) { 210 return generateSink(State, Pred, 211 (Tag ? Tag : Location.getTag())); 212 } 213 214 /// Generate a transition to a node that will be used to report 215 /// an error. This node will not be a sink. That is, exploration will 216 /// continue along this path. 217 /// 218 /// @param State The state of the generated node. 219 /// @param Tag The tag to uniquely identify the creation site. If null, 220 /// the default tag for the checker will be used. 221 ExplodedNode * 222 generateNonFatalErrorNode(ProgramStateRef State = nullptr, 223 const ProgramPointTag *Tag = nullptr) { 224 return addTransition(State, (Tag ? Tag : Location.getTag())); 225 } 226 227 /// Generate a transition to a node that will be used to report 228 /// an error. This node will not be a sink. That is, exploration will 229 /// continue along this path. 230 /// 231 /// @param State The state of the generated node. 232 /// @param Pred The transition will be generated from the specified Pred node 233 /// to the newly generated node. 234 /// @param Tag The tag to uniquely identify the creation site. If null, 235 /// the default tag for the checker will be used. 236 ExplodedNode * 237 generateNonFatalErrorNode(ProgramStateRef State, 238 ExplodedNode *Pred, 239 const ProgramPointTag *Tag = nullptr) { 240 return addTransition(State, Pred, (Tag ? Tag : Location.getTag())); 241 } 242 243 /// Emit the diagnostics report. 244 void emitReport(std::unique_ptr<BugReport> R) { 245 Changed = true; 246 Eng.getBugReporter().emitReport(std::move(R)); 247 } 248 249 /// Produce a program point tag that displays an additional path note 250 /// to the user. This is a lightweight alternative to the 251 /// BugReporterVisitor mechanism: instead of visiting the bug report 252 /// node-by-node to restore the sequence of events that led to discovering 253 /// a bug, you can add notes as you add your transitions. 254 /// 255 /// @param Cb Callback with 'BugReporterContext &, BugReport &' parameters. 256 /// @param IsPrunable Whether the note is prunable. It allows BugReporter 257 /// to omit the note from the report if it would make the displayed 258 /// bug path significantly shorter. 259 LLVM_ATTRIBUTE_RETURNS_NONNULL 260 const NoteTag *getNoteTag(NoteTag::Callback &&Cb, bool IsPrunable = false) { 261 return Eng.getDataTags().make<NoteTag>(std::move(Cb), IsPrunable); 262 } 263 264 /// A shorthand version of getNoteTag that doesn't require you to accept 265 /// the 'BugReporterContext' argument when you don't need it. 266 /// 267 /// @param Cb Callback only with 'BugReport &' parameter. 268 /// @param IsPrunable Whether the note is prunable. It allows BugReporter 269 /// to omit the note from the report if it would make the displayed 270 /// bug path significantly shorter. 271 const NoteTag 272 *getNoteTag(std::function<std::string(PathSensitiveBugReport &)> &&Cb, 273 bool IsPrunable = false) { 274 return getNoteTag( 275 [Cb](BugReporterContext &, 276 PathSensitiveBugReport &BR) { return Cb(BR); }, 277 IsPrunable); 278 } 279 280 /// A shorthand version of getNoteTag that doesn't require you to accept 281 /// the arguments when you don't need it. 282 /// 283 /// @param Cb Callback without parameters. 284 /// @param IsPrunable Whether the note is prunable. It allows BugReporter 285 /// to omit the note from the report if it would make the displayed 286 /// bug path significantly shorter. 287 const NoteTag *getNoteTag(std::function<std::string()> &&Cb, 288 bool IsPrunable = false) { 289 return getNoteTag([Cb](BugReporterContext &, 290 PathSensitiveBugReport &) { return Cb(); }, 291 IsPrunable); 292 } 293 294 /// A shorthand version of getNoteTag that accepts a plain note. 295 /// 296 /// @param Note The note. 297 /// @param IsPrunable Whether the note is prunable. It allows BugReporter 298 /// to omit the note from the report if it would make the displayed 299 /// bug path significantly shorter. 300 const NoteTag *getNoteTag(StringRef Note, bool IsPrunable = false) { 301 return getNoteTag( 302 [Note](BugReporterContext &, 303 PathSensitiveBugReport &) { return std::string(Note); }, 304 IsPrunable); 305 } 306 307 /// A shorthand version of getNoteTag that accepts a lambda with stream for 308 /// note. 309 /// 310 /// @param Cb Callback with 'BugReport &' and 'llvm::raw_ostream &'. 311 /// @param IsPrunable Whether the note is prunable. It allows BugReporter 312 /// to omit the note from the report if it would make the displayed 313 /// bug path significantly shorter. 314 const NoteTag *getNoteTag( 315 std::function<void(PathSensitiveBugReport &BR, llvm::raw_ostream &OS)> &&Cb, 316 bool IsPrunable = false) { 317 return getNoteTag( 318 [Cb](PathSensitiveBugReport &BR) -> std::string { 319 llvm::SmallString<128> Str; 320 llvm::raw_svector_ostream OS(Str); 321 Cb(BR, OS); 322 return std::string(OS.str()); 323 }, 324 IsPrunable); 325 } 326 327 /// Returns the word that should be used to refer to the declaration 328 /// in the report. 329 StringRef getDeclDescription(const Decl *D); 330 331 /// Get the declaration of the called function (path-sensitive). 332 const FunctionDecl *getCalleeDecl(const CallExpr *CE) const; 333 334 /// Get the name of the called function (path-sensitive). 335 StringRef getCalleeName(const FunctionDecl *FunDecl) const; 336 337 /// Get the identifier of the called function (path-sensitive). 338 const IdentifierInfo *getCalleeIdentifier(const CallExpr *CE) const { 339 const FunctionDecl *FunDecl = getCalleeDecl(CE); 340 if (FunDecl) 341 return FunDecl->getIdentifier(); 342 else 343 return nullptr; 344 } 345 346 /// Get the name of the called function (path-sensitive). 347 StringRef getCalleeName(const CallExpr *CE) const { 348 const FunctionDecl *FunDecl = getCalleeDecl(CE); 349 return getCalleeName(FunDecl); 350 } 351 352 /// Returns true if the callee is an externally-visible function in the 353 /// top-level namespace, such as \c malloc. 354 /// 355 /// If a name is provided, the function must additionally match the given 356 /// name. 357 /// 358 /// Note that this deliberately excludes C++ library functions in the \c std 359 /// namespace, but will include C library functions accessed through the 360 /// \c std namespace. This also does not check if the function is declared 361 /// as 'extern "C"', or if it uses C++ name mangling. 362 static bool isCLibraryFunction(const FunctionDecl *FD, 363 StringRef Name = StringRef()); 364 365 /// Depending on wither the location corresponds to a macro, return 366 /// either the macro name or the token spelling. 367 /// 368 /// This could be useful when checkers' logic depends on whether a function 369 /// is called with a given macro argument. For example: 370 /// s = socket(AF_INET,..) 371 /// If AF_INET is a macro, the result should be treated as a source of taint. 372 /// 373 /// \sa clang::Lexer::getSpelling(), clang::Lexer::getImmediateMacroName(). 374 StringRef getMacroNameOrSpelling(SourceLocation &Loc); 375 376 private: 377 ExplodedNode *addTransitionImpl(ProgramStateRef State, 378 bool MarkAsSink, 379 ExplodedNode *P = nullptr, 380 const ProgramPointTag *Tag = nullptr) { 381 // The analyzer may stop exploring if it sees a state it has previously 382 // visited ("cache out"). The early return here is a defensive check to 383 // prevent accidental caching out by checker API clients. Unless there is a 384 // tag or the client checker has requested that the generated node be 385 // marked as a sink, we assume that a client requesting a transition to a 386 // state that is the same as the predecessor state has made a mistake. We 387 // return the predecessor rather than cache out. 388 // 389 // TODO: We could potentially change the return to an assertion to alert 390 // clients to their mistake, but several checkers (including 391 // DereferenceChecker, CallAndMessageChecker, and DynamicTypePropagation) 392 // rely upon the defensive behavior and would need to be updated. 393 if (!State || (State == Pred->getState() && !Tag && !MarkAsSink)) 394 return Pred; 395 396 Changed = true; 397 const ProgramPoint &LocalLoc = (Tag ? Location.withTag(Tag) : Location); 398 if (!P) 399 P = Pred; 400 401 ExplodedNode *node; 402 if (MarkAsSink) 403 node = NB.generateSink(LocalLoc, State, P); 404 else 405 node = NB.generateNode(LocalLoc, State, P); 406 return node; 407 } 408 }; 409 410 } // end GR namespace 411 412 } // end clang namespace 413 414 #endif 415