/Users/buildslave/jenkins/workspace/coverage/llvm-project/clang/lib/StaticAnalyzer/Checkers/OSObjectCStyleCast.cpp
Line | Count | Source |
1 | | //===- OSObjectCStyleCast.cpp ------------------------------------*- C++ -*-==// |
2 | | // |
3 | | // Part of the LLVM Project, under the Apache License v2.0 with LLVM Exceptions. |
4 | | // See https://llvm.org/LICENSE.txt for license information. |
5 | | // SPDX-License-Identifier: Apache-2.0 WITH LLVM-exception |
6 | | // |
7 | | //===----------------------------------------------------------------------===// |
8 | | // |
9 | | // This file defines OSObjectCStyleCast checker, which checks for C-style casts |
10 | | // of OSObjects. Such casts almost always indicate a code smell, |
11 | | // as an explicit static or dynamic cast should be used instead. |
12 | | //===----------------------------------------------------------------------===// |
13 | | |
14 | | #include "clang/StaticAnalyzer/Checkers/BuiltinCheckerRegistration.h" |
15 | | #include "clang/ASTMatchers/ASTMatchFinder.h" |
16 | | #include "clang/StaticAnalyzer/Core/BugReporter/BugReporter.h" |
17 | | #include "clang/StaticAnalyzer/Core/BugReporter/BugType.h" |
18 | | #include "clang/StaticAnalyzer/Core/Checker.h" |
19 | | #include "clang/StaticAnalyzer/Core/PathSensitive/AnalysisManager.h" |
20 | | #include "llvm/Support/Debug.h" |
21 | | |
22 | | using namespace clang; |
23 | | using namespace ento; |
24 | | using namespace ast_matchers; |
25 | | |
26 | | namespace { |
27 | | static constexpr const char *const WarnAtNode = "WarnAtNode"; |
28 | | static constexpr const char *const WarnRecordDecl = "WarnRecordDecl"; |
29 | | |
30 | | class OSObjectCStyleCastChecker : public Checker<check::ASTCodeBody> { |
31 | | public: |
32 | | void checkASTCodeBody(const Decl *D, AnalysisManager &AM, |
33 | | BugReporter &BR) const; |
34 | | }; |
35 | | } |
36 | | |
37 | | static void emitDiagnostics(const BoundNodes &Nodes, |
38 | | BugReporter &BR, |
39 | | AnalysisDeclContext *ADC, |
40 | 1 | const OSObjectCStyleCastChecker *Checker) { |
41 | 1 | const auto *CE = Nodes.getNodeAs<CastExpr>(WarnAtNode); |
42 | 1 | const CXXRecordDecl *RD = Nodes.getNodeAs<CXXRecordDecl>(WarnRecordDecl); |
43 | 1 | assert(CE && RD); |
44 | | |
45 | 1 | std::string Diagnostics; |
46 | 1 | llvm::raw_string_ostream OS(Diagnostics); |
47 | 1 | OS << "C-style cast of an OSObject is prone to type confusion attacks; " |
48 | 1 | << "use 'OSRequiredCast' if the object is definitely of type '" |
49 | 1 | << RD->getNameAsString() << "', or 'OSDynamicCast' followed by " |
50 | 1 | << "a null check if unsure", |
51 | | |
52 | 1 | BR.EmitBasicReport( |
53 | 1 | ADC->getDecl(), |
54 | 1 | Checker, |
55 | 1 | /*Name=*/"OSObject C-Style Cast", |
56 | 1 | categories::SecurityError, |
57 | 1 | OS.str(), |
58 | 1 | PathDiagnosticLocation::createBegin(CE, BR.getSourceManager(), ADC), |
59 | 1 | CE->getSourceRange()); |
60 | 1 | } |
61 | | |
62 | 18 | static decltype(auto) hasTypePointingTo(DeclarationMatcher DeclM) { |
63 | 18 | return hasType(pointerType(pointee(hasDeclaration(DeclM)))); |
64 | 18 | } |
65 | | |
66 | | void OSObjectCStyleCastChecker::checkASTCodeBody(const Decl *D, AnalysisManager &AM, |
67 | 9 | BugReporter &BR) const { |
68 | | |
69 | 9 | AnalysisDeclContext *ADC = AM.getAnalysisDeclContext(D); |
70 | | |
71 | 9 | auto DynamicCastM = callExpr(callee(functionDecl(hasName("safeMetaCast")))); |
72 | | |
73 | 9 | auto OSObjTypeM = hasTypePointingTo(cxxRecordDecl(isDerivedFrom("OSMetaClassBase"))); |
74 | 9 | auto OSObjSubclassM = hasTypePointingTo( |
75 | 9 | cxxRecordDecl(isDerivedFrom("OSObject")).bind(WarnRecordDecl)); |
76 | | |
77 | 9 | auto CastM = cStyleCastExpr( |
78 | 9 | allOf(hasSourceExpression(allOf(OSObjTypeM, unless(DynamicCastM))), |
79 | 9 | OSObjSubclassM)).bind(WarnAtNode); |
80 | | |
81 | 9 | auto Matches = match(stmt(forEachDescendant(CastM)), *D->getBody(), AM.getASTContext()); |
82 | 9 | for (BoundNodes Match : Matches) |
83 | 1 | emitDiagnostics(Match, BR, ADC, this); |
84 | 9 | } |
85 | | |
86 | 1 | void ento::registerOSObjectCStyleCast(CheckerManager &Mgr) { |
87 | 1 | Mgr.registerChecker<OSObjectCStyleCastChecker>(); |
88 | 1 | } |
89 | | |
90 | 2 | bool ento::shouldRegisterOSObjectCStyleCast(const CheckerManager &mgr) { |
91 | 2 | return true; |
92 | 2 | } |