head 1.1; branch 1.1.1; access; symbols netbsd-11-0-RC4:1.1.1.2 netbsd-11-0-RC3:1.1.1.2 netbsd-11-0-RC2:1.1.1.2 netbsd-11-0-RC1:1.1.1.2 perseant-exfatfs-base-20250801:1.1.1.2 netbsd-11:1.1.1.2.0.10 netbsd-11-base:1.1.1.2 netbsd-10-1-RELEASE:1.1.1.2 perseant-exfatfs-base-20240630:1.1.1.2 perseant-exfatfs:1.1.1.2.0.8 perseant-exfatfs-base:1.1.1.2 netbsd-9-4-RELEASE:1.1.1.1 netbsd-10-0-RELEASE:1.1.1.2 netbsd-10-0-RC6:1.1.1.2 netbsd-10-0-RC5:1.1.1.2 netbsd-10-0-RC4:1.1.1.2 netbsd-10-0-RC3:1.1.1.2 netbsd-10-0-RC2:1.1.1.2 netbsd-10-0-RC1:1.1.1.2 netbsd-10:1.1.1.2.0.6 netbsd-10-base:1.1.1.2 netbsd-9-3-RELEASE:1.1.1.1 cjep_sun2x:1.1.1.2.0.4 cjep_sun2x-base:1.1.1.2 cjep_staticlib_x-base1:1.1.1.2 netbsd-9-2-RELEASE:1.1.1.1 cjep_staticlib_x:1.1.1.2.0.2 cjep_staticlib_x-base:1.1.1.2 netbsd-9-1-RELEASE:1.1.1.1 phil-wifi-20200421:1.1.1.2 phil-wifi-20200411:1.1.1.2 phil-wifi-20200406:1.1.1.2 netbsd-9-0-RELEASE:1.1.1.1 netbsd-9-0-RC2:1.1.1.1 netbsd-9-0-RC1:1.1.1.1 netbsd-9:1.1.1.1.0.6 netbsd-9-base:1.1.1.1 phil-wifi:1.1.1.1.0.4 phil-wifi-20190609:1.1.1.1 pgoyette-compat-merge-20190127:1.1.1.1.2.2 pgoyette-compat-20190127:1.1.1.1 pgoyette-compat-20190118:1.1.1.1 pgoyette-compat-1226:1.1.1.1 pgoyette-compat-1126:1.1.1.1 pgoyette-compat-1020:1.1.1.1 pgoyette-compat-0930:1.1.1.1 pgoyette-compat-0906:1.1.1.1 pgoyette-compat:1.1.1.1.0.2 pgoyette-compat-0728:1.1.1.1 clang-337282:1.1.1.1 LLVM:1.1.1; locks; strict; comment @// @; 1.1 date 2018.07.17.18.31.08; author joerg; state Exp; branches 1.1.1.1; next ; commitid wDzL46ALjrCZgwKA; 1.1.1.1 date 2018.07.17.18.31.08; author joerg; state Exp; branches 1.1.1.1.2.1 1.1.1.1.4.1; next 1.1.1.2; commitid wDzL46ALjrCZgwKA; 1.1.1.2 date 2019.11.13.22.19.28; author joerg; state dead; branches; next ; commitid QD8YATxuNG34YJKB; 1.1.1.1.2.1 date 2018.07.17.18.31.08; author pgoyette; state dead; branches; next 1.1.1.1.2.2; commitid 1UP1xAIUxv1ZgRLA; 1.1.1.1.2.2 date 2018.07.28.04.33.23; author pgoyette; state Exp; branches; next ; commitid 1UP1xAIUxv1ZgRLA; 1.1.1.1.4.1 date 2018.07.17.18.31.08; author christos; state dead; branches; next 1.1.1.1.4.2; commitid jtc8rnCzWiEEHGqB; 1.1.1.1.4.2 date 2019.06.10.21.45.28; author christos; state Exp; branches; next 1.1.1.1.4.3; commitid jtc8rnCzWiEEHGqB; 1.1.1.1.4.3 date 2020.04.13.07.46.38; author martin; state dead; branches; next ; commitid X01YhRUPVUDaec4C; desc @@ 1.1 log @Initial revision @ text @//===-- DeleteWithNonVirtualDtorChecker.cpp -----------------------*- C++ -*--// // // The LLVM Compiler Infrastructure // // This file is distributed under the University of Illinois Open Source // License. See LICENSE.TXT for details. // //===----------------------------------------------------------------------===// // // Defines a checker for the OOP52-CPP CERT rule: Do not delete a polymorphic // object without a virtual destructor. // // Diagnostic flags -Wnon-virtual-dtor and -Wdelete-non-virtual-dtor report if // an object with a virtual function but a non-virtual destructor exists or is // deleted, respectively. // // This check exceeds them by comparing the dynamic and static types of the // object at the point of destruction and only warns if it happens through a // pointer to a base type without a virtual destructor. The check places a note // at the last point where the conversion from derived to base happened. // //===----------------------------------------------------------------------===// #include "ClangSACheckers.h" #include "clang/StaticAnalyzer/Core/BugReporter/BugReporter.h" #include "clang/StaticAnalyzer/Core/BugReporter/BugType.h" #include "clang/StaticAnalyzer/Core/Checker.h" #include "clang/StaticAnalyzer/Core/CheckerManager.h" #include "clang/StaticAnalyzer/Core/PathSensitive/CallEvent.h" #include "clang/StaticAnalyzer/Core/PathSensitive/CheckerContext.h" #include "clang/StaticAnalyzer/Core/PathSensitive/DynamicTypeMap.h" #include "clang/StaticAnalyzer/Core/PathSensitive/ProgramStateTrait.h" using namespace clang; using namespace ento; namespace { class DeleteWithNonVirtualDtorChecker : public Checker> { mutable std::unique_ptr BT; class DeleteBugVisitor : public BugReporterVisitor { public: DeleteBugVisitor() : Satisfied(false) {} void Profile(llvm::FoldingSetNodeID &ID) const override { static int X = 0; ID.AddPointer(&X); } std::shared_ptr VisitNode(const ExplodedNode *N, const ExplodedNode *PrevN, BugReporterContext &BRC, BugReport &BR) override; private: bool Satisfied; }; public: void checkPreStmt(const CXXDeleteExpr *DE, CheckerContext &C) const; }; } // end anonymous namespace void DeleteWithNonVirtualDtorChecker::checkPreStmt(const CXXDeleteExpr *DE, CheckerContext &C) const { const Expr *DeletedObj = DE->getArgument(); const MemRegion *MR = C.getSVal(DeletedObj).getAsRegion(); if (!MR) return; const auto *BaseClassRegion = MR->getAs(); const auto *DerivedClassRegion = MR->getBaseRegion()->getAs(); if (!BaseClassRegion || !DerivedClassRegion) return; const auto *BaseClass = BaseClassRegion->getValueType()->getAsCXXRecordDecl(); const auto *DerivedClass = DerivedClassRegion->getSymbol()->getType()->getPointeeCXXRecordDecl(); if (!BaseClass || !DerivedClass) return; if (!BaseClass->hasDefinition() || !DerivedClass->hasDefinition()) return; if (BaseClass->getDestructor()->isVirtual()) return; if (!DerivedClass->isDerivedFrom(BaseClass)) return; if (!BT) BT.reset(new BugType(this, "Destruction of a polymorphic object with no " "virtual destructor", "Logic error")); ExplodedNode *N = C.generateNonFatalErrorNode(); auto R = llvm::make_unique(*BT, BT->getName(), N); // Mark region of problematic base class for later use in the BugVisitor. R->markInteresting(BaseClassRegion); R->addVisitor(llvm::make_unique()); C.emitReport(std::move(R)); } std::shared_ptr DeleteWithNonVirtualDtorChecker::DeleteBugVisitor::VisitNode( const ExplodedNode *N, const ExplodedNode *PrevN, BugReporterContext &BRC, BugReport &BR) { // Stop traversal after the first conversion was found on a path. if (Satisfied) return nullptr; const Stmt *S = PathDiagnosticLocation::getStmt(N); if (!S) return nullptr; const auto *CastE = dyn_cast(S); if (!CastE) return nullptr; // Only interested in DerivedToBase implicit casts. // Explicit casts can have different CastKinds. if (const auto *ImplCastE = dyn_cast(CastE)) { if (ImplCastE->getCastKind() != CK_DerivedToBase) return nullptr; } // Region associated with the current cast expression. const MemRegion *M = N->getSVal(CastE).getAsRegion(); if (!M) return nullptr; // Check if target region was marked as problematic previously. if (!BR.isInteresting(M)) return nullptr; // Stop traversal on this path. Satisfied = true; SmallString<256> Buf; llvm::raw_svector_ostream OS(Buf); OS << "Conversion from derived to base happened here"; PathDiagnosticLocation Pos(S, BRC.getSourceManager(), N->getLocationContext()); return std::make_shared(Pos, OS.str(), true, nullptr); } void ento::registerDeleteWithNonVirtualDtorChecker(CheckerManager &mgr) { mgr.registerChecker(); } @ 1.1.1.1 log @Import clang r337282 from trunk @ text @@ 1.1.1.2 log @Mark old LLVM instance as dead. @ text @@ 1.1.1.1.4.1 log @file DeleteWithNonVirtualDtorChecker.cpp was added on branch phil-wifi on 2019-06-10 21:45:28 +0000 @ text @d1 151 @ 1.1.1.1.4.2 log @Sync with HEAD @ text @a0 151 //===-- DeleteWithNonVirtualDtorChecker.cpp -----------------------*- C++ -*--// // // The LLVM Compiler Infrastructure // // This file is distributed under the University of Illinois Open Source // License. See LICENSE.TXT for details. // //===----------------------------------------------------------------------===// // // Defines a checker for the OOP52-CPP CERT rule: Do not delete a polymorphic // object without a virtual destructor. // // Diagnostic flags -Wnon-virtual-dtor and -Wdelete-non-virtual-dtor report if // an object with a virtual function but a non-virtual destructor exists or is // deleted, respectively. // // This check exceeds them by comparing the dynamic and static types of the // object at the point of destruction and only warns if it happens through a // pointer to a base type without a virtual destructor. The check places a note // at the last point where the conversion from derived to base happened. // //===----------------------------------------------------------------------===// #include "ClangSACheckers.h" #include "clang/StaticAnalyzer/Core/BugReporter/BugReporter.h" #include "clang/StaticAnalyzer/Core/BugReporter/BugType.h" #include "clang/StaticAnalyzer/Core/Checker.h" #include "clang/StaticAnalyzer/Core/CheckerManager.h" #include "clang/StaticAnalyzer/Core/PathSensitive/CallEvent.h" #include "clang/StaticAnalyzer/Core/PathSensitive/CheckerContext.h" #include "clang/StaticAnalyzer/Core/PathSensitive/DynamicTypeMap.h" #include "clang/StaticAnalyzer/Core/PathSensitive/ProgramStateTrait.h" using namespace clang; using namespace ento; namespace { class DeleteWithNonVirtualDtorChecker : public Checker> { mutable std::unique_ptr BT; class DeleteBugVisitor : public BugReporterVisitor { public: DeleteBugVisitor() : Satisfied(false) {} void Profile(llvm::FoldingSetNodeID &ID) const override { static int X = 0; ID.AddPointer(&X); } std::shared_ptr VisitNode(const ExplodedNode *N, const ExplodedNode *PrevN, BugReporterContext &BRC, BugReport &BR) override; private: bool Satisfied; }; public: void checkPreStmt(const CXXDeleteExpr *DE, CheckerContext &C) const; }; } // end anonymous namespace void DeleteWithNonVirtualDtorChecker::checkPreStmt(const CXXDeleteExpr *DE, CheckerContext &C) const { const Expr *DeletedObj = DE->getArgument(); const MemRegion *MR = C.getSVal(DeletedObj).getAsRegion(); if (!MR) return; const auto *BaseClassRegion = MR->getAs(); const auto *DerivedClassRegion = MR->getBaseRegion()->getAs(); if (!BaseClassRegion || !DerivedClassRegion) return; const auto *BaseClass = BaseClassRegion->getValueType()->getAsCXXRecordDecl(); const auto *DerivedClass = DerivedClassRegion->getSymbol()->getType()->getPointeeCXXRecordDecl(); if (!BaseClass || !DerivedClass) return; if (!BaseClass->hasDefinition() || !DerivedClass->hasDefinition()) return; if (BaseClass->getDestructor()->isVirtual()) return; if (!DerivedClass->isDerivedFrom(BaseClass)) return; if (!BT) BT.reset(new BugType(this, "Destruction of a polymorphic object with no " "virtual destructor", "Logic error")); ExplodedNode *N = C.generateNonFatalErrorNode(); auto R = llvm::make_unique(*BT, BT->getName(), N); // Mark region of problematic base class for later use in the BugVisitor. R->markInteresting(BaseClassRegion); R->addVisitor(llvm::make_unique()); C.emitReport(std::move(R)); } std::shared_ptr DeleteWithNonVirtualDtorChecker::DeleteBugVisitor::VisitNode( const ExplodedNode *N, const ExplodedNode *PrevN, BugReporterContext &BRC, BugReport &BR) { // Stop traversal after the first conversion was found on a path. if (Satisfied) return nullptr; const Stmt *S = PathDiagnosticLocation::getStmt(N); if (!S) return nullptr; const auto *CastE = dyn_cast(S); if (!CastE) return nullptr; // Only interested in DerivedToBase implicit casts. // Explicit casts can have different CastKinds. if (const auto *ImplCastE = dyn_cast(CastE)) { if (ImplCastE->getCastKind() != CK_DerivedToBase) return nullptr; } // Region associated with the current cast expression. const MemRegion *M = N->getSVal(CastE).getAsRegion(); if (!M) return nullptr; // Check if target region was marked as problematic previously. if (!BR.isInteresting(M)) return nullptr; // Stop traversal on this path. Satisfied = true; SmallString<256> Buf; llvm::raw_svector_ostream OS(Buf); OS << "Conversion from derived to base happened here"; PathDiagnosticLocation Pos(S, BRC.getSourceManager(), N->getLocationContext()); return std::make_shared(Pos, OS.str(), true, nullptr); } void ento::registerDeleteWithNonVirtualDtorChecker(CheckerManager &mgr) { mgr.registerChecker(); } @ 1.1.1.1.4.3 log @Mostly merge changes from HEAD upto 20200411 @ text @@ 1.1.1.1.2.1 log @file DeleteWithNonVirtualDtorChecker.cpp was added on branch pgoyette-compat on 2018-07-28 04:33:23 +0000 @ text @d1 151 @ 1.1.1.1.2.2 log @Sync with HEAD @ text @a0 151 //===-- DeleteWithNonVirtualDtorChecker.cpp -----------------------*- C++ -*--// // // The LLVM Compiler Infrastructure // // This file is distributed under the University of Illinois Open Source // License. See LICENSE.TXT for details. // //===----------------------------------------------------------------------===// // // Defines a checker for the OOP52-CPP CERT rule: Do not delete a polymorphic // object without a virtual destructor. // // Diagnostic flags -Wnon-virtual-dtor and -Wdelete-non-virtual-dtor report if // an object with a virtual function but a non-virtual destructor exists or is // deleted, respectively. // // This check exceeds them by comparing the dynamic and static types of the // object at the point of destruction and only warns if it happens through a // pointer to a base type without a virtual destructor. The check places a note // at the last point where the conversion from derived to base happened. // //===----------------------------------------------------------------------===// #include "ClangSACheckers.h" #include "clang/StaticAnalyzer/Core/BugReporter/BugReporter.h" #include "clang/StaticAnalyzer/Core/BugReporter/BugType.h" #include "clang/StaticAnalyzer/Core/Checker.h" #include "clang/StaticAnalyzer/Core/CheckerManager.h" #include "clang/StaticAnalyzer/Core/PathSensitive/CallEvent.h" #include "clang/StaticAnalyzer/Core/PathSensitive/CheckerContext.h" #include "clang/StaticAnalyzer/Core/PathSensitive/DynamicTypeMap.h" #include "clang/StaticAnalyzer/Core/PathSensitive/ProgramStateTrait.h" using namespace clang; using namespace ento; namespace { class DeleteWithNonVirtualDtorChecker : public Checker> { mutable std::unique_ptr BT; class DeleteBugVisitor : public BugReporterVisitor { public: DeleteBugVisitor() : Satisfied(false) {} void Profile(llvm::FoldingSetNodeID &ID) const override { static int X = 0; ID.AddPointer(&X); } std::shared_ptr VisitNode(const ExplodedNode *N, const ExplodedNode *PrevN, BugReporterContext &BRC, BugReport &BR) override; private: bool Satisfied; }; public: void checkPreStmt(const CXXDeleteExpr *DE, CheckerContext &C) const; }; } // end anonymous namespace void DeleteWithNonVirtualDtorChecker::checkPreStmt(const CXXDeleteExpr *DE, CheckerContext &C) const { const Expr *DeletedObj = DE->getArgument(); const MemRegion *MR = C.getSVal(DeletedObj).getAsRegion(); if (!MR) return; const auto *BaseClassRegion = MR->getAs(); const auto *DerivedClassRegion = MR->getBaseRegion()->getAs(); if (!BaseClassRegion || !DerivedClassRegion) return; const auto *BaseClass = BaseClassRegion->getValueType()->getAsCXXRecordDecl(); const auto *DerivedClass = DerivedClassRegion->getSymbol()->getType()->getPointeeCXXRecordDecl(); if (!BaseClass || !DerivedClass) return; if (!BaseClass->hasDefinition() || !DerivedClass->hasDefinition()) return; if (BaseClass->getDestructor()->isVirtual()) return; if (!DerivedClass->isDerivedFrom(BaseClass)) return; if (!BT) BT.reset(new BugType(this, "Destruction of a polymorphic object with no " "virtual destructor", "Logic error")); ExplodedNode *N = C.generateNonFatalErrorNode(); auto R = llvm::make_unique(*BT, BT->getName(), N); // Mark region of problematic base class for later use in the BugVisitor. R->markInteresting(BaseClassRegion); R->addVisitor(llvm::make_unique()); C.emitReport(std::move(R)); } std::shared_ptr DeleteWithNonVirtualDtorChecker::DeleteBugVisitor::VisitNode( const ExplodedNode *N, const ExplodedNode *PrevN, BugReporterContext &BRC, BugReport &BR) { // Stop traversal after the first conversion was found on a path. if (Satisfied) return nullptr; const Stmt *S = PathDiagnosticLocation::getStmt(N); if (!S) return nullptr; const auto *CastE = dyn_cast(S); if (!CastE) return nullptr; // Only interested in DerivedToBase implicit casts. // Explicit casts can have different CastKinds. if (const auto *ImplCastE = dyn_cast(CastE)) { if (ImplCastE->getCastKind() != CK_DerivedToBase) return nullptr; } // Region associated with the current cast expression. const MemRegion *M = N->getSVal(CastE).getAsRegion(); if (!M) return nullptr; // Check if target region was marked as problematic previously. if (!BR.isInteresting(M)) return nullptr; // Stop traversal on this path. Satisfied = true; SmallString<256> Buf; llvm::raw_svector_ostream OS(Buf); OS << "Conversion from derived to base happened here"; PathDiagnosticLocation Pos(S, BRC.getSourceManager(), N->getLocationContext()); return std::make_shared(Pos, OS.str(), true, nullptr); } void ento::registerDeleteWithNonVirtualDtorChecker(CheckerManager &mgr) { mgr.registerChecker(); } @