76a21502fd
ClangCheckerRegistry is a very non-obvious, poorly documented, weird concept. It derives from CheckerRegistry, and is placed in lib/StaticAnalyzer/Frontend, whereas it's base is located in lib/StaticAnalyzer/Core. It was, from what I can imagine, used to circumvent the problem that the registry functions of the checkers are located in the clangStaticAnalyzerCheckers library, but that library depends on clangStaticAnalyzerCore. However, clangStaticAnalyzerFrontend depends on both of those libraries. One can make the observation however, that CheckerRegistry has no place in Core, it isn't used there at all! The only place where it is used is Frontend, which is where it ultimately belongs. This move implies that since include/clang/StaticAnalyzer/Checkers/ClangCheckers.h only contained a single function: class CheckerRegistry; void registerBuiltinCheckers(CheckerRegistry ®istry); it had to re purposed, as CheckerRegistry is no longer available to clangStaticAnalyzerCheckers. It was renamed to BuiltinCheckerRegistration.h, which actually describes it a lot better -- it does not contain the registration functions for checkers, but only those generated by the tblgen files. Differential Revision: https://reviews.llvm.org/D54436 llvm-svn: 349275
123 lines
4.3 KiB
C++
123 lines
4.3 KiB
C++
//=== CastToStructChecker.cpp ----------------------------------*- C++ -*--===//
|
|
//
|
|
// The LLVM Compiler Infrastructure
|
|
//
|
|
// This file is distributed under the University of Illinois Open Source
|
|
// License. See LICENSE.TXT for details.
|
|
//
|
|
//===----------------------------------------------------------------------===//
|
|
//
|
|
// This files defines CastToStructChecker, a builtin checker that checks for
|
|
// cast from non-struct pointer to struct pointer and widening struct data cast.
|
|
// This check corresponds to CWE-588.
|
|
//
|
|
//===----------------------------------------------------------------------===//
|
|
|
|
#include "clang/StaticAnalyzer/Checkers/BuiltinCheckerRegistration.h"
|
|
#include "clang/AST/RecursiveASTVisitor.h"
|
|
#include "clang/StaticAnalyzer/Core/BugReporter/BugType.h"
|
|
#include "clang/StaticAnalyzer/Core/Checker.h"
|
|
#include "clang/StaticAnalyzer/Core/CheckerManager.h"
|
|
#include "clang/StaticAnalyzer/Core/PathSensitive/CheckerContext.h"
|
|
|
|
using namespace clang;
|
|
using namespace ento;
|
|
|
|
namespace {
|
|
class CastToStructVisitor : public RecursiveASTVisitor<CastToStructVisitor> {
|
|
BugReporter &BR;
|
|
const CheckerBase *Checker;
|
|
AnalysisDeclContext *AC;
|
|
|
|
public:
|
|
explicit CastToStructVisitor(BugReporter &B, const CheckerBase *Checker,
|
|
AnalysisDeclContext *A)
|
|
: BR(B), Checker(Checker), AC(A) {}
|
|
bool VisitCastExpr(const CastExpr *CE);
|
|
};
|
|
}
|
|
|
|
bool CastToStructVisitor::VisitCastExpr(const CastExpr *CE) {
|
|
const Expr *E = CE->getSubExpr();
|
|
ASTContext &Ctx = AC->getASTContext();
|
|
QualType OrigTy = Ctx.getCanonicalType(E->getType());
|
|
QualType ToTy = Ctx.getCanonicalType(CE->getType());
|
|
|
|
const PointerType *OrigPTy = dyn_cast<PointerType>(OrigTy.getTypePtr());
|
|
const PointerType *ToPTy = dyn_cast<PointerType>(ToTy.getTypePtr());
|
|
|
|
if (!ToPTy || !OrigPTy)
|
|
return true;
|
|
|
|
QualType OrigPointeeTy = OrigPTy->getPointeeType();
|
|
QualType ToPointeeTy = ToPTy->getPointeeType();
|
|
|
|
if (!ToPointeeTy->isStructureOrClassType())
|
|
return true;
|
|
|
|
// We allow cast from void*.
|
|
if (OrigPointeeTy->isVoidType())
|
|
return true;
|
|
|
|
// Now the cast-to-type is struct pointer, the original type is not void*.
|
|
if (!OrigPointeeTy->isRecordType()) {
|
|
SourceRange Sr[1] = {CE->getSourceRange()};
|
|
PathDiagnosticLocation Loc(CE, BR.getSourceManager(), AC);
|
|
BR.EmitBasicReport(
|
|
AC->getDecl(), Checker, "Cast from non-struct type to struct type",
|
|
categories::LogicError, "Casting a non-structure type to a structure "
|
|
"type and accessing a field can lead to memory "
|
|
"access errors or data corruption.",
|
|
Loc, Sr);
|
|
} else {
|
|
// Don't warn when size of data is unknown.
|
|
const auto *U = dyn_cast<UnaryOperator>(E);
|
|
if (!U || U->getOpcode() != UO_AddrOf)
|
|
return true;
|
|
|
|
// Don't warn for references
|
|
const ValueDecl *VD = nullptr;
|
|
if (const auto *SE = dyn_cast<DeclRefExpr>(U->getSubExpr()))
|
|
VD = SE->getDecl();
|
|
else if (const auto *SE = dyn_cast<MemberExpr>(U->getSubExpr()))
|
|
VD = SE->getMemberDecl();
|
|
if (!VD || VD->getType()->isReferenceType())
|
|
return true;
|
|
|
|
if (ToPointeeTy->isIncompleteType() ||
|
|
OrigPointeeTy->isIncompleteType())
|
|
return true;
|
|
|
|
// Warn when there is widening cast.
|
|
unsigned ToWidth = Ctx.getTypeInfo(ToPointeeTy).Width;
|
|
unsigned OrigWidth = Ctx.getTypeInfo(OrigPointeeTy).Width;
|
|
if (ToWidth <= OrigWidth)
|
|
return true;
|
|
|
|
PathDiagnosticLocation Loc(CE, BR.getSourceManager(), AC);
|
|
BR.EmitBasicReport(AC->getDecl(), Checker, "Widening cast to struct type",
|
|
categories::LogicError,
|
|
"Casting data to a larger structure type and accessing "
|
|
"a field can lead to memory access errors or data "
|
|
"corruption.",
|
|
Loc, CE->getSourceRange());
|
|
}
|
|
|
|
return true;
|
|
}
|
|
|
|
namespace {
|
|
class CastToStructChecker : public Checker<check::ASTCodeBody> {
|
|
public:
|
|
void checkASTCodeBody(const Decl *D, AnalysisManager &Mgr,
|
|
BugReporter &BR) const {
|
|
CastToStructVisitor Visitor(BR, this, Mgr.getAnalysisDeclContext(D));
|
|
Visitor.TraverseDecl(const_cast<Decl *>(D));
|
|
}
|
|
};
|
|
} // end anonymous namespace
|
|
|
|
void ento::registerCastToStructChecker(CheckerManager &mgr) {
|
|
mgr.registerChecker<CastToStructChecker>();
|
|
}
|