ObjCAutoreleaseWriteChecker.cpp source code [clang_source_code/lib/StaticAnalyzer/Checkers/ObjCAutoreleaseWriteChecker.cpp]

1	//===- ObjCAutoreleaseWriteChecker.cpp ----------------------------- C++ --==//
2	//
3	// Part of the LLVM Project, under the Apache License v2.0 with LLVM Exceptions.
4	// See https://llvm.org/LICENSE.txt for license information.
5	// SPDX-License-Identifier: Apache-2.0 WITH LLVM-exception
6	//
7	//===----------------------------------------------------------------------===//
8	//
9	// This file defines ObjCAutoreleaseWriteChecker which warns against writes
10	// into autoreleased out parameters which cause crashes.
11	// An example of a problematic write is a write to {@code error} in the example
12	// below:
13	//
14	// - (BOOL) mymethod:(NSError __autoreleasing )error list:(NSArray*) list {
15	// [list enumerateObjectsUsingBlock:^(id obj, NSUInteger idx, BOOL *stop) {
16	// NSString *myString = obj;
17	// if ([myString isEqualToString:@"error"] && error)
18	// *error = [NSError errorWithDomain:@"MyDomain" code:-1];
19	// }];
20	// return false;
21	// }
22	//
23	// Such code will crash on read from `*error` due to the autorelease pool
24	// in `enumerateObjectsUsingBlock` implementation freeing the error object
25	// on exit from the function.
26	//
27	//===----------------------------------------------------------------------===//
28
29	#include "clang/StaticAnalyzer/Checkers/BuiltinCheckerRegistration.h"
30	#include "clang/ASTMatchers/ASTMatchFinder.h"
31	#include "clang/StaticAnalyzer/Core/BugReporter/BugReporter.h"
32	#include "clang/StaticAnalyzer/Core/BugReporter/BugType.h"
33	#include "clang/StaticAnalyzer/Core/Checker.h"
34	#include "clang/StaticAnalyzer/Core/PathSensitive/AnalysisManager.h"
35	#include "llvm/ADT/Twine.h"
36
37	using namespace clang;
38	using namespace ento;
39	using namespace ast_matchers;
40
41	namespace {
42
43	const char *ProblematicWriteBind = "problematicwrite";
44	const char *CapturedBind = "capturedbind";
45	const char *ParamBind = "parambind";
46	const char *IsMethodBind = "ismethodbind";
47
48	class ObjCAutoreleaseWriteChecker : public Checker<check::ASTCodeBody> {
49	public:
50	void checkASTCodeBody(const Decl *D,
51	AnalysisManager &AM,
52	BugReporter &BR) const;
53	private:
54	std::vector<std::string> SelectorsWithAutoreleasingPool = {
55	// Common to NSArray, NSSet, NSOrderedSet
56	"enumerateObjectsUsingBlock:",
57	"enumerateObjectsWithOptions:usingBlock:",
58
59	// Common to NSArray and NSOrderedSet
60	"enumerateObjectsAtIndexes:options:usingBlock:",
61	"indexOfObjectAtIndexes:options:passingTest:",
62	"indexesOfObjectsAtIndexes:options:passingTest:",
63	"indexOfObjectPassingTest:",
64	"indexOfObjectWithOptions:passingTest:",
65	"indexesOfObjectsPassingTest:",
66	"indexesOfObjectsWithOptions:passingTest:",
67
68	// NSDictionary
69	"enumerateKeysAndObjectsUsingBlock:",
70	"enumerateKeysAndObjectsWithOptions:usingBlock:",
71	"keysOfEntriesPassingTest:",
72	"keysOfEntriesWithOptions:passingTest:",
73
74	// NSSet
75	"objectsPassingTest:",
76	"objectsWithOptions:passingTest:",
77	"enumerateIndexPathsWithOptions:usingBlock:",
78
79	// NSIndexSet
80	"enumerateIndexesWithOptions:usingBlock:",
81	"enumerateIndexesUsingBlock:",
82	"enumerateIndexesInRange:options:usingBlock:",
83	"enumerateRangesUsingBlock:",
84	"enumerateRangesWithOptions:usingBlock:",
85	"enumerateRangesInRange:options:usingBlock:",
86	"indexPassingTest:",
87	"indexesPassingTest:",
88	"indexWithOptions:passingTest:",
89	"indexesWithOptions:passingTest:",
90	"indexInRange:options:passingTest:",
91	"indexesInRange:options:passingTest:"
92	};
93
94	std::vector<std::string> FunctionsWithAutoreleasingPool = {
95	"dispatch_async", "dispatch_group_async", "dispatch_barrier_async"};
96	};
97	}
98
99	static inline std::vector<llvm::StringRef> toRefs(std::vector<std::string> V) {
100	return std::vector<llvm::StringRef>(V.begin(), V.end());
101	}
102
103	static auto callsNames(std::vector<std::string> FunctionNames)
104	-> decltype(callee(functionDecl())) {
105	return callee(functionDecl(hasAnyName(toRefs(FunctionNames))));
106	}
107
108	static void emitDiagnostics(BoundNodes &Match, const Decl *D, BugReporter &BR,
109	AnalysisManager &AM,
110	const ObjCAutoreleaseWriteChecker *Checker) {
111	AnalysisDeclContext *ADC = AM.getAnalysisDeclContext(D);
112
113	const auto *PVD = Match.getNodeAs<ParmVarDecl>(ParamBind);
114	QualType Ty = PVD->getType();
115	if (Ty->getPointeeType().getObjCLifetime() != Qualifiers::OCL_Autoreleasing)
116	return;
117	const char *ActionMsg = "Write to";
118	const auto *MarkedStmt = Match.getNodeAs<Expr>(ProblematicWriteBind);
119	bool IsCapture = false;
120
121	// Prefer to warn on write, but if not available, warn on capture.
122	if (!MarkedStmt) {
123	MarkedStmt = Match.getNodeAs<Expr>(CapturedBind);
124	assert(MarkedStmt);
125	ActionMsg = "Capture of";
126	IsCapture = true;
127	}
128
129	SourceRange Range = MarkedStmt->getSourceRange();
130	PathDiagnosticLocation Location = PathDiagnosticLocation::createBegin(
131	MarkedStmt, BR.getSourceManager(), ADC);
132	bool IsMethod = Match.getNodeAs<ObjCMethodDecl>(IsMethodBind) != nullptr;
133	const char *Name = IsMethod ? "method" : "function";
134
135	BR.EmitBasicReport(
136	ADC->getDecl(), Checker,
137	/Name=/(llvm::Twine(ActionMsg)
138	+ " autoreleasing out parameter inside autorelease pool").str(),
139	/Category=/"Memory",
140	(llvm::Twine(ActionMsg) + " autoreleasing out parameter " +
141	(IsCapture ? "'" + PVD->getName() + "'" + " " : "") + "inside " +
142	"autorelease pool that may exit before " + Name + " returns; consider "
143	"writing first to a strong local variable declared outside of the block")
144	.str(),
145	Location,
146	Range);
147	}
148
149	void ObjCAutoreleaseWriteChecker::checkASTCodeBody(const Decl *D,
150	AnalysisManager &AM,
151	BugReporter &BR) const {
152
153	auto DoublePointerParamM =
154	parmVarDecl(hasType(hasCanonicalType(pointerType(
155	pointee(hasCanonicalType(objcObjectPointerType()))))))
156	.bind(ParamBind);
157
158	auto ReferencedParamM =
159	declRefExpr(to(parmVarDecl(DoublePointerParamM))).bind(CapturedBind);
160
161	// Write into a binded object, e.g. *ParamBind = X.
162	auto WritesIntoM = binaryOperator(
163	hasLHS(unaryOperator(
164	hasOperatorName("*"),
165	hasUnaryOperand(
166	ignoringParenImpCasts(ReferencedParamM))
167	)),
168	hasOperatorName("=")
169	).bind(ProblematicWriteBind);
170
171	auto ArgumentCaptureM = hasAnyArgument(
172	ignoringParenImpCasts(ReferencedParamM));
173	auto CapturedInParamM = stmt(anyOf(
174	callExpr(ArgumentCaptureM),
175	objcMessageExpr(ArgumentCaptureM)));
176
177	// WritesIntoM happens inside a block passed as an argument.
178	auto WritesOrCapturesInBlockM = hasAnyArgument(allOf(
179	hasType(hasCanonicalType(blockPointerType())),
180	forEachDescendant(
181	stmt(anyOf(WritesIntoM, CapturedInParamM))
182	)));
183
184	auto BlockPassedToMarkedFuncM = stmt(anyOf(
185	callExpr(allOf(
186	callsNames(FunctionsWithAutoreleasingPool), WritesOrCapturesInBlockM)),
187	objcMessageExpr(allOf(
188	hasAnySelector(toRefs(SelectorsWithAutoreleasingPool)),
189	WritesOrCapturesInBlockM))
190	));
191
192	auto HasParamAndWritesInMarkedFuncM = allOf(
193	hasAnyParameter(DoublePointerParamM),
194	forEachDescendant(BlockPassedToMarkedFuncM));
195
196	auto MatcherM = decl(anyOf(
197	objcMethodDecl(HasParamAndWritesInMarkedFuncM).bind(IsMethodBind),
198	functionDecl(HasParamAndWritesInMarkedFuncM),
199	blockDecl(HasParamAndWritesInMarkedFuncM)));
200
201	auto Matches = match(MatcherM, *D, AM.getASTContext());
202	for (BoundNodes Match : Matches)
203	emitDiagnostics(Match, D, BR, AM, this);
204	}
205
206	void ento::registerAutoreleaseWriteChecker(CheckerManager &Mgr) {
207	Mgr.registerChecker<ObjCAutoreleaseWriteChecker>();
208	}
209
210	bool ento::shouldRegisterAutoreleaseWriteChecker(const LangOptions &LO) {
211	return true;
212	}
213

Clang Project