25 using namespace clang;
35 class InnerPointerChecker
36 :
public Checker<check::DeadSymbols, check::PostCall> {
66 InnerPointerBRVisitor(
SymbolRef Sym) : PtrToBuf(Sym) {}
68 static void *getTag() {
73 void Profile(llvm::FoldingSetNodeID &
ID)
const override {
74 ID.AddPointer(getTag());
84 RawPtrMapTy Map =
State->get<RawPtrMap>();
85 for (
const auto &Entry : Map) {
86 if (Entry.second.contains(Sym))
95 bool isInvalidatingMemberFunction(
const CallEvent &Call)
const;
120 bool InnerPointerChecker::isInvalidatingMemberFunction(
122 if (
const auto *MemOpCall = dyn_cast<CXXMemberOperatorCall>(&Call)) {
124 if (Opc == OO_Equal || Opc == OO_PlusEqual)
128 return isa<CXXDestructorCall>(Call) ||
129 InvalidatingMemberFunctions.contains(Call);
132 void InnerPointerChecker::markPtrSymbolsReleased(
const CallEvent &Call,
136 if (
const PtrSet *PS =
State->get<RawPtrMap>(MR)) {
137 const Expr *Origin =
Call.getOriginExpr();
138 for (
const auto Symbol : *PS) {
149 void InnerPointerChecker::checkFunctionArguments(
const CallEvent &Call,
152 if (
const auto *FC = dyn_cast<AnyFunctionCall>(&Call)) {
157 for (
unsigned I = 0, E = FD->
getNumParams(); I != E; ++I) {
165 bool isaMemberOpCall = isa<CXXMemberOperatorCall>(FC);
166 unsigned ArgI = isaMemberOpCall ? I+1 : I;
168 SVal Arg = FC->getArgSVal(ArgI);
169 const auto *ArgRegion =
170 dyn_cast_or_null<TypedValueRegion>(Arg.
getAsRegion());
176 if (AddressofFunctions.contains(Call))
179 markPtrSymbolsReleased(Call,
State, ArgRegion, C);
198 void InnerPointerChecker::checkPostCall(
const CallEvent &Call,
205 if (
const auto *ICall = dyn_cast<CXXInstanceCall>(&Call)) {
206 ObjRegion = dyn_cast_or_null<TypedValueRegion>(
207 ICall->getCXXThisVal().getAsRegion());
210 if (isInvalidatingMemberFunction(Call)) {
211 markPtrSymbolsReleased(Call,
State, ObjRegion, C);
216 if (InnerPointerAccessFunctions.contains(Call)) {
218 if (isa<SimpleFunctionCall>(Call)) {
223 dyn_cast_or_null<TypedValueRegion>(
Call.getArgSVal(0).getAsRegion());
229 SVal RawPtr =
Call.getReturnValue();
234 PtrSet::Factory &F =
State->getStateManager().get_context<PtrSet>();
235 const PtrSet *SetPtr =
State->get<RawPtrMap>(ObjRegion);
236 PtrSet
Set = SetPtr ? *SetPtr : F.getEmptySet();
237 assert(
C.wasInlined || !
Set.contains(Sym));
238 Set = F.add(Set, Sym);
248 checkFunctionArguments(Call,
State, C);
251 void InnerPointerChecker::checkDeadSymbols(
SymbolReaper &SymReaper,
254 PtrSet::Factory &F =
State->getStateManager().get_context<PtrSet>();
255 RawPtrMapTy RPM =
State->get<RawPtrMap>();
256 for (
const auto &Entry : RPM) {
260 State =
State->remove<RawPtrMap>(Entry.first);
262 if (
const PtrSet *OldSet =
State->get<RawPtrMap>(Entry.first)) {
263 PtrSet CleanedUpSet = *OldSet;
264 for (
const auto Symbol : Entry.second) {
265 if (!SymReaper.
isLive(Symbol))
266 CleanedUpSet = F.remove(CleanedUpSet, Symbol);
268 State = CleanedUpSet.isEmpty()
269 ?
State->remove<RawPtrMap>(Entry.first)
270 :
State->set<RawPtrMap>(Entry.first, CleanedUpSet);
278 namespace allocation_state {
281 return std::make_unique<InnerPointerChecker::InnerPointerBRVisitor>(Sym);
285 RawPtrMapTy Map =
State->get<RawPtrMap>();
286 for (
const auto &Entry : Map) {
287 if (Entry.second.contains(Sym)) {
300 if (!isSymbolTracked(N->
getState(), PtrToBuf) ||
310 const auto *
TypedRegion = cast<TypedValueRegion>(ObjRegion);
314 llvm::raw_svector_ostream OS(Buf);
315 OS <<
"Pointer to inner buffer of '" << ObjTy <<
"' obtained here";
318 return std::make_shared<PathDiagnosticEventPiece>(Pos, OS.str(),
true);
326 bool ento::shouldRegisterInnerPointerChecker(
const CheckerManager &mgr) {
#define REGISTER_MAP_WITH_PROGRAMSTATE(Name, Key, Value)
Declares an immutable map of type NameTy, suitable for placement into the ProgramState.
#define REGISTER_SET_FACTORY_WITH_PROGRAMSTATE(Name, Elem)
Declares an immutable set type Name and registers the factory for such sets in the program state,...
bool isInStdNamespace() const
This represents one expression.
Represents a function declaration or definition.
unsigned getNumParams() const
Return the number of parameters this function must have based on its FunctionType.
const ParmVarDecl * getParamDecl(unsigned i) const
A (possibly-)qualified type.
bool isConstQualified() const
Determine whether this type is const-qualified.
Stmt - This represents one statement.
bool isReferenceType() const
QualType getPointeeType() const
If this is a pointer, ObjC object pointer, or block pointer, this returns the respective pointee.
const SourceManager & getSourceManager() const
BugReporterVisitors are used to add custom diagnostics along a path.
An immutable set of CallDescriptions.
A CallDescription is a pattern that can be used to match calls based on the qualified name and the ar...
@ CXXMethod
Matches a C++ method (may be static, may be virtual, may be an overloaded operator,...
@ SimpleFunc
Matches "simple" functions that are not methods.
Represents an abstract call to a function or method along a particular path.
CHECKER * registerChecker(AT &&... Args)
Used to register checkers.
ExplodedNode * getFirstPred()
const ProgramStateRef & getState() const
const LocationContext * getLocationContext() const
const Stmt * getStmtForDiagnostics() const
If the node's program point corresponds to a statement, retrieve that statement.
MemRegion - The root abstract class for all memory regions.
SVal - This represents a symbolic expression, which can be either an L-value or an R-value.
SymbolRef getAsSymbol(bool IncludeBaseRegions=false) const
If this SVal wraps a symbol return that SymbolRef.
const MemRegion * getAsRegion() const
A class responsible for cleaning up unused symbols.
bool isLiveRegion(const MemRegion *region)
bool isLive(SymbolRef sym)
TypedRegion - An abstract class representing regions that are typed.
TypedValueRegion - An abstract class representing regions having a typed value.
ProgramStateRef markReleased(ProgramStateRef State, SymbolRef Sym, const Expr *Origin)
std::unique_ptr< BugReporterVisitor > getInnerPointerBRVisitor(SymbolRef Sym)
This function provides an additional visitor that augments the bug report with information relevant t...
const MemRegion * getContainerObjRegion(ProgramStateRef State, SymbolRef Sym)
'Sym' represents a pointer to the inner buffer of a container object.
void registerInnerPointerCheckerAux(CheckerManager &Mgr)
Register the part of MallocChecker connected to InnerPointerChecker.
std::shared_ptr< PathDiagnosticPiece > PathDiagnosticPieceRef
bool Call(InterpState &S, CodePtr OpPC, const Function *Func, uint32_t VarArgSize)
The JSON file list parser is used to communicate input to InstallAPI.
OverloadedOperatorKind
Enumeration specifying the different kinds of C++ overloaded operators.