1 //== DynamicTypeChecker.cpp ------------------------------------ -*- C++ -*--=//
2 //
3 // Part of the LLVM Project, under the Apache License v2.0 with LLVM Exceptions.
4 // See https://llvm.org/LICENSE.txt for license information.
5 // SPDX-License-Identifier: Apache-2.0 WITH LLVM-exception
6 //
7 //===----------------------------------------------------------------------===//
8 //
9 // This checker looks for cases where the dynamic type of an object is unrelated
10 // to its static type. The type information utilized by this check is collected
11 // by the DynamicTypePropagation checker. This check does not report any type
12 // error for ObjC Generic types, in order to avoid duplicate erros from the
13 // ObjC Generics checker. This checker is not supposed to modify the program
14 // state, it is just the observer of the type information provided by other
15 // checkers.
16 //
17 //===----------------------------------------------------------------------===//
18 
19 #include "clang/StaticAnalyzer/Checkers/BuiltinCheckerRegistration.h"
20 #include "clang/StaticAnalyzer/Core/BugReporter/BugType.h"
21 #include "clang/StaticAnalyzer/Core/Checker.h"
22 #include "clang/StaticAnalyzer/Core/CheckerManager.h"
23 #include "clang/StaticAnalyzer/Core/PathSensitive/CallEvent.h"
24 #include "clang/StaticAnalyzer/Core/PathSensitive/DynamicType.h"
25 #include "clang/StaticAnalyzer/Core/PathSensitive/CheckerContext.h"
26 #include "clang/StaticAnalyzer/Core/PathSensitive/ProgramStateTrait.h"
27 
28 using namespace clang;
29 using namespace ento;
30 
31 namespace {
32 class DynamicTypeChecker : public Checker<check::PostStmt<ImplicitCastExpr>> {
33   mutable std::unique_ptr<BugType> BT;
34   void initBugType() const {
35     if (!BT)
36       BT.reset(
37           new BugType(this, "Dynamic and static type mismatch", "Type Error"));
38   }
39 
40   class DynamicTypeBugVisitor : public BugReporterVisitor {
41   public:
42     DynamicTypeBugVisitor(const MemRegion *Reg) : Reg(Reg) {}
43 
44     void Profile(llvm::FoldingSetNodeID &ID) const override {
45       static int X = 0;
46       ID.AddPointer(&X);
47       ID.AddPointer(Reg);
48     }
49 
50     PathDiagnosticPieceRef VisitNode(const ExplodedNode *N,
51                                      BugReporterContext &BRC,
52                                      PathSensitiveBugReport &BR) override;
53 
54   private:
55     // The tracked region.
56     const MemRegion *Reg;
57   };
58 
59   void reportTypeError(QualType DynamicType, QualType StaticType,
60                        const MemRegion *Reg, const Stmt *ReportedNode,
61                        CheckerContext &C) const;
62 
63 public:
64   void checkPostStmt(const ImplicitCastExpr *CE, CheckerContext &C) const;
65 };
66 }
67 
68 void DynamicTypeChecker::reportTypeError(QualType DynamicType,
69                                          QualType StaticType,
70                                          const MemRegion *Reg,
71                                          const Stmt *ReportedNode,
72                                          CheckerContext &C) const {
73   initBugType();
74   SmallString<192> Buf;
75   llvm::raw_svector_ostream OS(Buf);
76   OS << "Object has a dynamic type '";
77   QualType::print(DynamicType.getTypePtr(), Qualifiers(), OS, C.getLangOpts(),
78                   llvm::Twine());
79   OS << "' which is incompatible with static type '";
80   QualType::print(StaticType.getTypePtr(), Qualifiers(), OS, C.getLangOpts(),
81                   llvm::Twine());
82   OS << "'";
83   auto R = std::make_unique<PathSensitiveBugReport>(
84       *BT, OS.str(), C.generateNonFatalErrorNode());
85   R->markInteresting(Reg);
86   R->addVisitor(std::make_unique<DynamicTypeBugVisitor>(Reg));
87   R->addRange(ReportedNode->getSourceRange());
88   C.emitReport(std::move(R));
89 }
90 
91 PathDiagnosticPieceRef DynamicTypeChecker::DynamicTypeBugVisitor::VisitNode(
92     const ExplodedNode *N, BugReporterContext &BRC, PathSensitiveBugReport &) {
93   ProgramStateRef State = N->getState();
94   ProgramStateRef StatePrev = N->getFirstPred()->getState();
95 
96   DynamicTypeInfo TrackedType = getDynamicTypeInfo(State, Reg);
97   DynamicTypeInfo TrackedTypePrev = getDynamicTypeInfo(StatePrev, Reg);
98   if (!TrackedType.isValid())
99     return nullptr;
100 
101   if (TrackedTypePrev.isValid() &&
102       TrackedTypePrev.getType() == TrackedType.getType())
103     return nullptr;
104 
105   // Retrieve the associated statement.
106   const Stmt *S = N->getStmtForDiagnostics();
107   if (!S)
108     return nullptr;
109 
110   const LangOptions &LangOpts = BRC.getASTContext().getLangOpts();
111 
112   SmallString<256> Buf;
113   llvm::raw_svector_ostream OS(Buf);
114   OS << "Type '";
115   QualType::print(TrackedType.getType().getTypePtr(), Qualifiers(), OS,
116                   LangOpts, llvm::Twine());
117   OS << "' is inferred from ";
118 
119   if (const auto *ExplicitCast = dyn_cast<ExplicitCastExpr>(S)) {
120     OS << "explicit cast (from '";
121     QualType::print(ExplicitCast->getSubExpr()->getType().getTypePtr(),
122                     Qualifiers(), OS, LangOpts, llvm::Twine());
123     OS << "' to '";
124     QualType::print(ExplicitCast->getType().getTypePtr(), Qualifiers(), OS,
125                     LangOpts, llvm::Twine());
126     OS << "')";
127   } else if (const auto *ImplicitCast = dyn_cast<ImplicitCastExpr>(S)) {
128     OS << "implicit cast (from '";
129     QualType::print(ImplicitCast->getSubExpr()->getType().getTypePtr(),
130                     Qualifiers(), OS, LangOpts, llvm::Twine());
131     OS << "' to '";
132     QualType::print(ImplicitCast->getType().getTypePtr(), Qualifiers(), OS,
133                     LangOpts, llvm::Twine());
134     OS << "')";
135   } else {
136     OS << "this context";
137   }
138 
139   // Generate the extra diagnostic.
140   PathDiagnosticLocation Pos(S, BRC.getSourceManager(),
141                              N->getLocationContext());
142   return std::make_shared<PathDiagnosticEventPiece>(Pos, OS.str(), true);
143 }
144 
145 static bool hasDefinition(const ObjCObjectPointerType *ObjPtr) {
146   const ObjCInterfaceDecl *Decl = ObjPtr->getInterfaceDecl();
147   if (!Decl)
148     return false;
149 
150   return Decl->getDefinition();
151 }
152 
153 // TODO: consider checking explicit casts?
154 void DynamicTypeChecker::checkPostStmt(const ImplicitCastExpr *CE,
155                                        CheckerContext &C) const {
156   // TODO: C++ support.
157   if (CE->getCastKind() != CK_BitCast)
158     return;
159 
160   const MemRegion *Region = C.getSVal(CE).getAsRegion();
161   if (!Region)
162     return;
163 
164   ProgramStateRef State = C.getState();
165   DynamicTypeInfo DynTypeInfo = getDynamicTypeInfo(State, Region);
166 
167   if (!DynTypeInfo.isValid())
168     return;
169 
170   QualType DynType = DynTypeInfo.getType();
171   QualType StaticType = CE->getType();
172 
173   const auto *DynObjCType = DynType->getAs<ObjCObjectPointerType>();
174   const auto *StaticObjCType = StaticType->getAs<ObjCObjectPointerType>();
175 
176   if (!DynObjCType || !StaticObjCType)
177     return;
178 
179   if (!hasDefinition(DynObjCType) || !hasDefinition(StaticObjCType))
180     return;
181 
182   ASTContext &ASTCtxt = C.getASTContext();
183 
184   // Strip kindeofness to correctly detect subtyping relationships.
185   DynObjCType = DynObjCType->stripObjCKindOfTypeAndQuals(ASTCtxt);
186   StaticObjCType = StaticObjCType->stripObjCKindOfTypeAndQuals(ASTCtxt);
187 
188   // Specialized objects are handled by the generics checker.
189   if (StaticObjCType->isSpecialized())
190     return;
191 
192   if (ASTCtxt.canAssignObjCInterfaces(StaticObjCType, DynObjCType))
193     return;
194 
195   if (DynTypeInfo.canBeASubClass() &&
196       ASTCtxt.canAssignObjCInterfaces(DynObjCType, StaticObjCType))
197     return;
198 
199   reportTypeError(DynType, StaticType, Region, CE, C);
200 }
201 
202 void ento::registerDynamicTypeChecker(CheckerManager &mgr) {
203   mgr.registerChecker<DynamicTypeChecker>();
204 }
205 
206 bool ento::shouldRegisterDynamicTypeChecker(const CheckerManager &mgr) {
207   return true;
208 }
209