void StrCatAppendCheck::registerMatchers(MatchFinder *Finder) {
if (!getLangOpts().CPlusPlus)
return;
const auto StrCat = functionDecl(hasName("::absl::StrCat"));
// The arguments of absl::StrCat are implicitly converted to AlphaNum. This
// matches to the arguments because of that behavior.
const auto AlphaNum = IgnoringTemporaries(cxxConstructExpr(
argumentCountIs(1), hasType(cxxRecordDecl(hasName("::absl::AlphaNum"))),
hasArgument(0, ignoringImpCasts(declRefExpr(to(equalsBoundNode("LHS")),
expr().bind("Arg0"))))));
const auto HasAnotherReferenceToLhs =
callExpr(hasAnyArgument(expr(hasDescendant(declRefExpr(
to(equalsBoundNode("LHS")), unless(equalsBoundNode("Arg0")))))));
// Now look for calls to operator= with an object on the LHS and a call to
// StrCat on the RHS. The first argument of the StrCat call should be the same
// as the LHS. Ignore calls from template instantiations.
Finder->addMatcher(
cxxOperatorCallExpr(
unless(isInTemplateInstantiation()), hasOverloadedOperatorName("="),
hasArgument(0, declRefExpr(to(decl().bind("LHS")))),
hasArgument(1, IgnoringTemporaries(
callExpr(callee(StrCat), hasArgument(0, AlphaNum),
unless(HasAnotherReferenceToLhs))
.bind("Call"))))
.bind("Op"),
this);
}
void PassByValueCheck::registerMatchers(MatchFinder *Finder) {
// Only register the matchers for C++; the functionality currently does not
// provide any benefit to other languages, despite being benign.
if (!getLangOpts().CPlusPlus)
return;
Finder->addMatcher(
cxxConstructorDecl(
forEachConstructorInitializer(
cxxCtorInitializer(
// Clang builds a CXXConstructExpr only whin it knows which
// constructor will be called. In dependent contexts a
// ParenListExpr is generated instead of a CXXConstructExpr,
// filtering out templates automatically for us.
withInitializer(cxxConstructExpr(
has(ignoringParenImpCasts(declRefExpr(to(
parmVarDecl(
hasType(qualType(
// Match only const-ref or a non-const value
// parameters. Rvalues and const-values
// shouldn't be modified.
anyOf(constRefType(), nonConstValueType()))))
.bind("Param"))))),
hasDeclaration(cxxConstructorDecl(
isCopyConstructor(), unless(isDeleted()),
hasDeclContext(
cxxRecordDecl(isMoveConstructible())))))))
.bind("Initializer")))
.bind("Ctor"),
this);
}
void ShrinkToFitCheck::registerMatchers(MatchFinder *Finder) {
// Swap as a function need not to be considered, because rvalue can not
// be bound to a non-const reference.
const auto ShrinkableAsMember =
memberExpr(member(valueDecl().bind("ContainerDecl")));
const auto ShrinkableAsDecl =
declRefExpr(hasDeclaration(valueDecl().bind("ContainerDecl")));
const auto CopyCtorCall = constructExpr(
hasArgument(0, anyOf(ShrinkableAsMember, ShrinkableAsDecl,
unaryOperator(has(ShrinkableAsMember)),
unaryOperator(has(ShrinkableAsDecl)))));
const auto SwapParam = expr(anyOf(
memberExpr(member(equalsBoundNode("ContainerDecl"))),
declRefExpr(hasDeclaration(equalsBoundNode("ContainerDecl"))),
unaryOperator(has(memberExpr(member(equalsBoundNode("ContainerDecl"))))),
unaryOperator(
has(declRefExpr(hasDeclaration(equalsBoundNode("ContainerDecl")))))));
Finder->addMatcher(
memberCallExpr(on(hasType(namedDecl(stlShrinkableContainer()))),
callee(methodDecl(hasName("swap"))),
has(memberExpr(hasDescendant(CopyCtorCall))),
hasArgument(0, SwapParam.bind("ContainerToShrink")),
unless(isInTemplateInstantiation()))
.bind("CopyAndSwapTrick"),
this);
}
void MultiwayPathsCoveredCheck::registerMatchers(MatchFinder *Finder) {
Finder->addMatcher(
switchStmt(
hasCondition(allOf(
// Match on switch statements that have either a bit-field or
// an integer condition. The ordering in 'anyOf()' is
// important because the last condition is the most general.
anyOf(ignoringImpCasts(memberExpr(hasDeclaration(
fieldDecl(isBitField()).bind("bitfield")))),
ignoringImpCasts(declRefExpr().bind("non-enum-condition"))),
// 'unless()' must be the last match here and must be bound,
// otherwise the matcher does not work correctly, because it
// will not explicitly ignore enum conditions.
unless(ignoringImpCasts(
declRefExpr(hasType(enumType())).bind("enum-condition"))))))
.bind("switch"),
this);
// This option is noisy, therefore matching is configurable.
if (WarnOnMissingElse) {
Finder->addMatcher(
ifStmt(allOf(hasParent(ifStmt()), unless(hasElse(anything()))))
.bind("else-if"),
this);
}
}
void DeleteNullPointerCheck::registerMatchers(MatchFinder *Finder) {
const auto DeleteExpr =
cxxDeleteExpr(has(castExpr(has(declRefExpr(
to(decl(equalsBoundNode("deletedPointer"))))))))
.bind("deleteExpr");
const auto DeleteMemberExpr =
cxxDeleteExpr(has(castExpr(has(memberExpr(hasDeclaration(
fieldDecl(equalsBoundNode("deletedMemberPointer"))))))))
.bind("deleteMemberExpr");
const auto PointerExpr = ignoringImpCasts(anyOf(
declRefExpr(to(decl().bind("deletedPointer"))),
memberExpr(hasDeclaration(fieldDecl().bind("deletedMemberPointer")))));
const auto PointerCondition = castExpr(hasCastKind(CK_PointerToBoolean),
hasSourceExpression(PointerExpr));
const auto BinaryPointerCheckCondition =
binaryOperator(hasEitherOperand(castExpr(hasCastKind(CK_NullToPointer))),
hasEitherOperand(PointerExpr));
Finder->addMatcher(
ifStmt(hasCondition(anyOf(PointerCondition, BinaryPointerCheckCondition)),
hasThen(anyOf(
DeleteExpr, DeleteMemberExpr,
compoundStmt(anyOf(has(DeleteExpr), has(DeleteMemberExpr)),
statementCountIs(1))
.bind("compound"))))
.bind("ifWithDelete"),
this);
}
void InefficientAlgorithmCheck::registerMatchers(MatchFinder *Finder) {
// Only register the matchers for C++; the functionality currently does not
// provide any benefit to other languages, despite being benign.
if (!getLangOpts().CPlusPlus)
return;
const std::string Algorithms =
"^::std::(find|count|equal_range|lower_bound|upper_bound)$";
const auto ContainerMatcher = classTemplateSpecializationDecl(
matchesName("^::std::(unordered_)?(multi)?(set|map)$"));
const auto Matcher =
callExpr(
callee(functionDecl(matchesName(Algorithms))),
hasArgument(
0, constructExpr(has(memberCallExpr(
callee(methodDecl(hasName("begin"))),
on(declRefExpr(
hasDeclaration(decl().bind("IneffContObj")),
anyOf(hasType(ContainerMatcher.bind("IneffCont")),
hasType(pointsTo(
ContainerMatcher.bind("IneffContPtr")))))
.bind("IneffContExpr")))))),
hasArgument(1, constructExpr(has(memberCallExpr(
callee(methodDecl(hasName("end"))),
on(declRefExpr(hasDeclaration(
equalsBoundNode("IneffContObj")))))))),
hasArgument(2, expr().bind("AlgParam")),
unless(isInTemplateInstantiation()))
.bind("IneffAlg");
Finder->addMatcher(Matcher, this);
}
void MisplacedOperatorInStrlenInAllocCheck::registerMatchers(
MatchFinder *Finder) {
const auto StrLenFunc = functionDecl(anyOf(
hasName("::strlen"), hasName("::std::strlen"), hasName("::strnlen"),
hasName("::std::strnlen"), hasName("::strnlen_s"),
hasName("::std::strnlen_s"), hasName("::wcslen"),
hasName("::std::wcslen"), hasName("::wcsnlen"), hasName("::std::wcsnlen"),
hasName("::wcsnlen_s"), hasName("std::wcsnlen_s")));
const auto BadUse =
callExpr(callee(StrLenFunc),
hasAnyArgument(ignoringImpCasts(
binaryOperator(
hasOperatorName("+"),
hasRHS(ignoringParenImpCasts(integerLiteral(equals(1)))))
.bind("BinOp"))))
.bind("StrLen");
const auto BadArg = anyOf(
allOf(unless(binaryOperator(
hasOperatorName("+"), hasLHS(BadUse),
hasRHS(ignoringParenImpCasts(integerLiteral(equals(1)))))),
hasDescendant(BadUse)),
BadUse);
const auto Alloc0Func =
functionDecl(anyOf(hasName("::malloc"), hasName("std::malloc"),
hasName("::alloca"), hasName("std::alloca")));
const auto Alloc1Func =
functionDecl(anyOf(hasName("::calloc"), hasName("std::calloc"),
hasName("::realloc"), hasName("std::realloc")));
const auto Alloc0FuncPtr =
varDecl(hasType(isConstQualified()),
hasInitializer(ignoringParenImpCasts(
declRefExpr(hasDeclaration(Alloc0Func)))));
const auto Alloc1FuncPtr =
varDecl(hasType(isConstQualified()),
hasInitializer(ignoringParenImpCasts(
declRefExpr(hasDeclaration(Alloc1Func)))));
Finder->addMatcher(callExpr(callee(decl(anyOf(Alloc0Func, Alloc0FuncPtr))),
hasArgument(0, BadArg))
.bind("Alloc"),
this);
Finder->addMatcher(callExpr(callee(decl(anyOf(Alloc1Func, Alloc1FuncPtr))),
hasArgument(1, BadArg))
.bind("Alloc"),
this);
Finder->addMatcher(
cxxNewExpr(isArray(), hasArraySize(BadArg)).bind("Alloc"), this);
}
void UseUncaughtExceptionsCheck::registerMatchers(MatchFinder *Finder) {
if (!getLangOpts().CPlusPlus17)
return;
std::string MatchText = "::std::uncaught_exception";
// Using declaration: warning and fix-it.
Finder->addMatcher(
usingDecl(hasAnyUsingShadowDecl(hasTargetDecl(hasName(MatchText))))
.bind("using_decl"),
this);
// DeclRefExpr: warning, no fix-it.
Finder->addMatcher(declRefExpr(allOf(to(functionDecl(hasName(MatchText))),
unless(callExpr())))
.bind("decl_ref_expr"),
this);
// CallExpr: warning, fix-it.
Finder->addMatcher(
callExpr(allOf(hasDeclaration(functionDecl(hasName(MatchText))),
unless(hasAncestor(initListExpr()))))
.bind("call_expr"),
this);
// CallExpr in initialisation list: warning, fix-it with avoiding narrowing
// conversions.
Finder->addMatcher(
callExpr(allOf(hasAncestor(initListExpr()),
hasDeclaration(functionDecl(hasName(MatchText)))))
.bind("init_call_expr"),
this);
}
void ProBoundsPointerArithmeticCheck::registerMatchers(MatchFinder *Finder) {
if (!getLangOpts().CPlusPlus)
return;
// Flag all operators +, -, +=, -=, ++, -- that result in a pointer
Finder->addMatcher(
binaryOperator(
anyOf(hasOperatorName("+"), hasOperatorName("-"),
hasOperatorName("+="), hasOperatorName("-=")),
hasType(pointerType()),
unless(hasLHS(ignoringImpCasts(declRefExpr(to(isImplicit()))))))
.bind("expr"),
this);
Finder->addMatcher(
unaryOperator(anyOf(hasOperatorName("++"), hasOperatorName("--")),
hasType(pointerType()))
.bind("expr"),
this);
// Array subscript on a pointer (not an array) is also pointer arithmetic
Finder->addMatcher(
arraySubscriptExpr(
hasBase(ignoringImpCasts(
anyOf(hasType(pointerType()),
hasType(decayedType(hasDecayedType(pointerType())))))))
.bind("expr"),
this);
}
RelationConstructionVisitor::RelationConstructionVisitor(
SymbolsMapType &symbols) : mSymbols(symbols) {
Matcher.addMatcher(
functionDecl(
forEachDescendant(
declRefExpr().bind("declRefExpr"))).bind("functionDecl"),
&gDeclRefExprHandler);
}
void AvoidBindCheck::registerMatchers(MatchFinder *Finder) {
if (!getLangOpts().CPlusPlus14) // Need C++14 for generic lambdas.
return;
Finder->addMatcher(
callExpr(callee(namedDecl(hasName("::std::bind"))),
hasArgument(0, declRefExpr(to(functionDecl().bind("f")))))
.bind("bind"),
this);
}
void InefficientStringConcatenationCheck::registerMatchers(
MatchFinder *Finder) {
if (!getLangOpts().CPlusPlus)
return;
const auto BasicStringType =
hasType(qualType(hasUnqualifiedDesugaredType(recordType(
hasDeclaration(cxxRecordDecl(hasName("::std::basic_string")))))));
const auto BasicStringPlusOperator = cxxOperatorCallExpr(
hasOverloadedOperatorName("+"),
hasAnyArgument(ignoringImpCasts(declRefExpr(BasicStringType))));
const auto PlusOperator =
cxxOperatorCallExpr(
hasOverloadedOperatorName("+"),
hasAnyArgument(ignoringImpCasts(declRefExpr(BasicStringType))),
hasDescendant(BasicStringPlusOperator))
.bind("plusOperator");
const auto AssignOperator = cxxOperatorCallExpr(
hasOverloadedOperatorName("="),
hasArgument(0, declRefExpr(BasicStringType,
hasDeclaration(decl().bind("lhsStrT")))
.bind("lhsStr")),
hasArgument(1, stmt(hasDescendant(declRefExpr(
hasDeclaration(decl(equalsBoundNode("lhsStrT"))))))),
hasDescendant(BasicStringPlusOperator));
if (StrictMode) {
Finder->addMatcher(cxxOperatorCallExpr(anyOf(AssignOperator, PlusOperator)),
this);
} else {
Finder->addMatcher(
cxxOperatorCallExpr(anyOf(AssignOperator, PlusOperator),
hasAncestor(stmt(anyOf(cxxForRangeStmt(),
whileStmt(), forStmt())))),
this);
}
}
void
ExplicitMakePairCheck::registerMatchers(ast_matchers::MatchFinder *Finder) {
// Only register the matchers for C++; the functionality currently does not
// provide any benefit to other languages, despite being benign.
if (!getLangOpts().CPlusPlus)
return;
// Look for std::make_pair with explicit template args. Ignore calls in
// templates.
Finder->addMatcher(
callExpr(unless(isInTemplateInstantiation()),
callee(expr(ignoringParenImpCasts(
declRefExpr(hasExplicitTemplateArgs(),
to(functionDecl(hasName("::std::make_pair"))))
.bind("declref"))))).bind("call"),
this);
}
void InterfacesGlobalInitCheck::registerMatchers(MatchFinder *Finder) {
const auto IsGlobal =
allOf(hasGlobalStorage(),
hasDeclContext(anyOf(translationUnitDecl(), // Global scope.
namespaceDecl(), // Namespace scope.
recordDecl())), // Class scope.
unless(isConstexpr()));
const auto ReferencesUndefinedGlobalVar = declRefExpr(hasDeclaration(
varDecl(IsGlobal, unless(isDefinition())).bind("referencee")));
Finder->addMatcher(
varDecl(IsGlobal, isDefinition(),
hasInitializer(expr(hasDescendant(ReferencesUndefinedGlobalVar))))
.bind("var"),
this);
}
void SignedBitwiseCheck::registerMatchers(MatchFinder *Finder) {
const auto SignedIntegerOperand =
expr(ignoringImpCasts(hasType(isSignedInteger()))).bind("signed-operand");
// The standard [bitmask.types] allows some integral types to be implemented
// as signed types. Exclude these types from diagnosing for bitwise or(|) and
// bitwise and(&). Shifting and complementing such values is still not
// allowed.
const auto BitmaskType = namedDecl(anyOf(
hasName("::std::locale::category"), hasName("::std::ctype_base::mask"),
hasName("::std::ios_base::fmtflags"), hasName("::std::ios_base::iostate"),
hasName("::std::ios_base::openmode")));
const auto IsStdBitmask = ignoringImpCasts(declRefExpr(hasType(BitmaskType)));
// Match binary bitwise operations on signed integer arguments.
Finder->addMatcher(
binaryOperator(
allOf(anyOf(hasOperatorName("^"), hasOperatorName("|"),
hasOperatorName("&"), hasOperatorName("^="),
hasOperatorName("|="), hasOperatorName("&=")),
unless(allOf(hasLHS(IsStdBitmask), hasRHS(IsStdBitmask))),
hasEitherOperand(SignedIntegerOperand),
hasLHS(hasType(isInteger())), hasRHS(hasType(isInteger()))))
.bind("binary-no-sign-interference"),
this);
// Shifting and complement is not allowed for any signed integer type because
// the sign bit may corrupt the result.
Finder->addMatcher(
binaryOperator(
allOf(anyOf(hasOperatorName("<<"), hasOperatorName(">>"),
hasOperatorName("<<="), hasOperatorName(">>=")),
hasEitherOperand(SignedIntegerOperand),
hasLHS(hasType(isInteger())), hasRHS(hasType(isInteger()))))
.bind("binary-sign-interference"),
this);
// Match unary operations on signed integer types.
Finder->addMatcher(unaryOperator(allOf(hasOperatorName("~"),
hasUnaryOperand(SignedIntegerOperand)))
.bind("unary-signed"),
this);
}
void MoveConstructorInitCheck::registerMatchers(MatchFinder *Finder) {
// Only register the matchers for C++11; the functionality currently does not
// provide any benefit to other languages, despite being benign.
if (!getLangOpts().CPlusPlus11)
return;
Finder->addMatcher(
cxxConstructorDecl(
unless(isImplicit()),
allOf(isMoveConstructor(),
hasAnyConstructorInitializer(
cxxCtorInitializer(
withInitializer(cxxConstructExpr(hasDeclaration(
cxxConstructorDecl(isCopyConstructor())
.bind("ctor")))))
.bind("move-init")))),
this);
auto NonConstValueMovableAndExpensiveToCopy =
qualType(allOf(unless(pointerType()), unless(isConstQualified()),
hasDeclaration(cxxRecordDecl(hasMethod(cxxConstructorDecl(
isMoveConstructor(), unless(isDeleted()))))),
matchers::isExpensiveToCopy()));
// This checker is also used to implement cert-oop11-cpp, but when using that
// form of the checker, we do not want to diagnose movable parameters.
if (!UseCERTSemantics) {
Finder->addMatcher(
cxxConstructorDecl(
allOf(
unless(isMoveConstructor()),
hasAnyConstructorInitializer(withInitializer(cxxConstructExpr(
hasDeclaration(cxxConstructorDecl(isCopyConstructor())),
hasArgument(
0,
declRefExpr(
to(parmVarDecl(
hasType(
NonConstValueMovableAndExpensiveToCopy))
.bind("movable-param")))
.bind("init-arg")))))))
.bind("ctor-decl"),
this);
}
}
void ProperlySeededRandomGeneratorCheck::registerMatchers(MatchFinder *Finder) {
auto RandomGeneratorEngineDecl = cxxRecordDecl(hasAnyName(
"::std::linear_congruential_engine", "::std::mersenne_twister_engine",
"::std::subtract_with_carry_engine", "::std::discard_block_engine",
"::std::independent_bits_engine", "::std::shuffle_order_engine"));
auto RandomGeneratorEngineTypeMatcher = hasType(hasUnqualifiedDesugaredType(
recordType(hasDeclaration(RandomGeneratorEngineDecl))));
// std::mt19937 engine;
// engine.seed();
// ^
// engine.seed(1);
// ^
// const int x = 1;
// engine.seed(x);
// ^
Finder->addMatcher(
cxxMemberCallExpr(
has(memberExpr(has(declRefExpr(RandomGeneratorEngineTypeMatcher)),
member(hasName("seed")),
unless(hasDescendant(cxxThisExpr())))))
.bind("seed"),
this);
// std::mt19937 engine;
// ^
// std::mt19937 engine(1);
// ^
// const int x = 1;
// std::mt19937 engine(x);
// ^
Finder->addMatcher(
cxxConstructExpr(RandomGeneratorEngineTypeMatcher).bind("ctor"), this);
// srand();
// ^
// const int x = 1;
// srand(x);
// ^
Finder->addMatcher(
callExpr(callee(functionDecl(hasAnyName("::srand", "::std::srand"))))
.bind("srand"),
this);
}
void UnusedParametersCheck::warnOnUnusedParameter(
const MatchFinder::MatchResult &Result, const FunctionDecl *Function,
unsigned ParamIndex) {
const auto *Param = Function->getParamDecl(ParamIndex);
auto MyDiag = diag(Param->getLocation(), "parameter '%0' is unused")
<< Param->getName();
auto UsedByRef = [&] {
return !ast_matchers::match(
decl(hasDescendant(
declRefExpr(to(equalsNode(Function)),
unless(hasAncestor(
callExpr(callee(equalsNode(Function)))))))),
*Result.Context->getTranslationUnitDecl(), *Result.Context)
.empty();
};
// Comment out parameter name for non-local functions.
if (Function->isExternallyVisible() ||
!Result.SourceManager->isInMainFile(Function->getLocation()) ||
UsedByRef()) {
SourceRange RemovalRange(Param->getLocation(), Param->getLocEnd());
// Note: We always add a space before the '/*' to not accidentally create a
// '*/*' for pointer types, which doesn't start a comment. clang-format will
// clean this up afterwards.
MyDiag << FixItHint::CreateReplacement(
RemovalRange, (Twine(" /*") + Param->getName() + "*/").str());
return;
}
// Fix all redeclarations.
for (const FunctionDecl *FD : Function->redecls())
if (FD->param_size())
MyDiag << removeParameter(FD, ParamIndex);
// Fix all call sites.
auto CallMatches = ast_matchers::match(
decl(forEachDescendant(
callExpr(callee(functionDecl(equalsNode(Function)))).bind("x"))),
*Result.Context->getTranslationUnitDecl(), *Result.Context);
for (const auto &Match : CallMatches)
MyDiag << removeArgument(Match.getNodeAs<CallExpr>("x"), ParamIndex);
}
void NonConstParameterCheck::registerMatchers(MatchFinder *Finder) {
// Add parameters to Parameters.
Finder->addMatcher(parmVarDecl(unless(isInstantiated())).bind("Parm"), this);
// C++ constructor.
Finder->addMatcher(cxxConstructorDecl().bind("Ctor"), this);
// Track unused parameters, there is Wunused-parameter about unused
// parameters.
Finder->addMatcher(declRefExpr().bind("Ref"), this);
// Analyse parameter usage in function.
Finder->addMatcher(stmt(anyOf(unaryOperator(anyOf(hasOperatorName("++"),
hasOperatorName("--"))),
binaryOperator(), callExpr(), returnStmt(),
cxxConstructExpr()))
.bind("Mark"),
this);
Finder->addMatcher(varDecl(hasInitializer(anything())).bind("Mark"), this);
}
void UnusedParametersCheck::warnOnUnusedParameter(
const MatchFinder::MatchResult &Result, const FunctionDecl *Function,
unsigned ParamIndex) {
const auto *Param = Function->getParamDecl(ParamIndex);
auto MyDiag = diag(Param->getLocation(), "parameter '%0' is unused")
<< Param->getName();
auto UsedByRef = [&] {
return !ast_matchers::match(
decl(hasDescendant(
declRefExpr(to(equalsNode(Function)),
unless(hasAncestor(
callExpr(callee(equalsNode(Function)))))))),
*Result.Context->getTranslationUnitDecl(), *Result.Context)
.empty();
};
// Comment out parameter name for non-local functions.
if ((Function->isExternallyVisible() &&
Function->getStorageClass() != StorageClass::SC_Static) ||
UsedByRef()) {
SourceRange RemovalRange(Param->getLocation(), Param->getLocEnd());
MyDiag << FixItHint::CreateReplacement(
RemovalRange, (Twine(" /*") + Param->getName() + "*/").str());
return;
}
// Fix all redeclarations.
for (const FunctionDecl *FD : Function->redecls())
MyDiag << removeParameter(FD, ParamIndex);
// Fix all call sites.
auto CallMatches = ast_matchers::match(
decl(forEachDescendant(
callExpr(callee(functionDecl(equalsNode(Function)))).bind("x"))),
*Result.Context->getTranslationUnitDecl(), *Result.Context);
for (const auto &Match : CallMatches)
MyDiag << removeArgument(Match.getNodeAs<CallExpr>("x"), ParamIndex);
}
#include "ASTUtility.h"
//StatementMatcher callExprMatcher = callExpr().bind("callexpr");
StatementMatcher mallocMatcher = callExpr(callee(functionDecl(hasName("malloc")).bind("m"))).bind("mallocCall");
StatementMatcher freeMatcher = callExpr(callee(functionDecl(hasName("free")).bind("f"))).bind("freeCall");
StatementMatcher reallocMatcher = callExpr(callee(functionDecl(hasName("realloc")).bind("r"))).bind("reallocCall");
//memcpy arrayType non-builtin = pointer or user-defined
StatementMatcher memcpyAryMatcher = callExpr(
callee(functionDecl(hasName("memcpy")).bind("cpy")),
hasAnyArgument(ignoringImpCasts(declRefExpr(
to(declaratorDecl(hasType(arrayType(
unless(hasElementType(builtinType()))).bind("cpyParm")))))))
).bind("memcpyCall");
StatementMatcher memcpyPtrMatcher = callExpr(
callee(functionDecl(hasName("memcpy")).bind("cpy")),
hasAnyArgument(ignoringImpCasts(declRefExpr(
to(declaratorDecl(hasType(pointerType(
pointee(unless(builtinType()))).bind("cpyParmPtr")))))))
).bind("memcpyCall");
StatementMatcher memcmpAryMatcher = callExpr(
callee(functionDecl(hasName("memcmp")).bind("cmp")),
hasAnyArgument(ignoringImpCasts(declRefExpr(
to(declaratorDecl(hasType(arrayType(
unless(hasElementType(builtinType()))).bind("cmpParm")))))))
).bind("memcmpCall");
StatementMatcher memcmpPtrMatcher = callExpr(
callee(functionDecl(hasName("memcmp")).bind("cmp")),
hasAnyArgument(ignoringImpCasts(declRefExpr(
Finder::Impl::Impl() : helper(funcs) {
const auto funcDecl = functionDecl().bind("func");
matchFinder.addMatcher(funcDecl, &helper);
const auto funcRef = declRefExpr(to(functionDecl())).bind("ref");
matchFinder.addMatcher(funcRef, &helper);
}
#include "ASTUtility.h"
StatementMatcher FuncStmtMatcher = compoundStmt(
hasParent(functionDecl(returns(pointerType())).bind("functiondecl")),
hasDescendant(returnStmt(
hasDescendant(declRefExpr().bind("decl"))))
).bind("funcstmt");
class ReturnChecker : public MatchFinder::MatchCallback {
public:
virtual void run(const MatchFinder::MatchResult &Result)
{
clang::ASTContext *Context = Result.Context;
const clang::CompoundStmt *cs = Result.Nodes.getNodeAs<clang::CompoundStmt>("funcstmt");
const clang::FunctionDecl *fd = Result.Nodes.getNodeAs<clang::FunctionDecl>("functiondecl");
const clang::DeclRefExpr *decl = Result.Nodes.getNodeAs<clang::DeclRefExpr>("decl");
if(!cs || !fd || !decl || ASTUtility::IsStmtInSTDFile(cs, Context)) return;
if (!clang::VarDecl::classof(decl -> getDecl())) return;
const clang::VarDecl *var = static_cast<const clang::VarDecl*>(decl -> getDecl());
if (var -> hasLocalStorage())
ASTUtility::Print(decl, Context, "Rule65");
}
};
//@TestNeed
static llvm::cl::OptionCategory MyToolCategory("options");
void CanRunScriptChecker::registerMatchers(MatchFinder *AstMatcher) {
auto InvalidArg =
// We want to find any expression,
ignoreTrivials(expr(
// which has a refcounted pointer type,
hasType(pointerType(
pointee(hasDeclaration(cxxRecordDecl(isRefCounted()))))),
// and which is not this,
unless(cxxThisExpr()),
// and which is not a method call on a smart ptr,
unless(cxxMemberCallExpr(on(hasType(isSmartPtrToRefCounted())))),
// and which is not a parameter of the parent function,
unless(declRefExpr(to(parmVarDecl()))),
// and which is not a MOZ_KnownLive wrapped value.
unless(callExpr(callee(functionDecl(hasName("MOZ_KnownLive"))))),
expr().bind("invalidArg")));
auto OptionalInvalidExplicitArg = anyOf(
// We want to find any argument which is invalid.
hasAnyArgument(InvalidArg),
// This makes this matcher optional.
anything());
// Please not that the hasCanRunScriptAnnotation() matchers are not present
// directly in the cxxMemberCallExpr, callExpr and constructExpr matchers
// because we check that the corresponding functions can run script later in
// the checker code.
AstMatcher->addMatcher(
expr(
anyOf(
// We want to match a method call expression,
cxxMemberCallExpr(
// which optionally has an invalid arg,
OptionalInvalidExplicitArg,
// or which optionally has an invalid implicit this argument,
anyOf(
// which derefs into an invalid arg,
on(cxxOperatorCallExpr(
anyOf(hasAnyArgument(InvalidArg), anything()))),
// or is an invalid arg.
on(InvalidArg),
anything()),
expr().bind("callExpr")),
// or a regular call expression,
callExpr(
// which optionally has an invalid arg.
OptionalInvalidExplicitArg, expr().bind("callExpr")),
// or a construct expression,
cxxConstructExpr(
// which optionally has an invalid arg.
OptionalInvalidExplicitArg, expr().bind("constructExpr"))),
anyOf(
// We want to match the parent function.
forFunction(functionDecl().bind("nonCanRunScriptParentFunction")),
// ... optionally.
anything())),
this);
}
namespace EffectiveCPP {
const int usedDeclDistance = 2;
StatementMatcher varUseMatcherEC = declRefExpr().bind("def");
std::map<const std::string, int>varDefineTest; //<varName, diffLine>
}
