|
| 1 | +/** |
| 2 | + * @name Call to a function with one or more incompatible arguments |
| 3 | + * @description When the type of a function argument is not compatible |
| 4 | + * with the type of the corresponding parameter, it may lead to |
| 5 | + * unpredictable behavior. |
| 6 | + * @kind problem |
| 7 | + * @problem.severity warning |
| 8 | + * @precision medium |
| 9 | + * @id cpp/mistyped-function-arguments |
| 10 | + * @tags correctness |
| 11 | + * maintainability |
| 12 | + */ |
| 13 | + |
| 14 | +import cpp |
| 15 | + |
| 16 | +predicate arithTypesMatch(Type arg, Type parm) { |
| 17 | + arg = parm |
| 18 | + or |
| 19 | + arg.getSize() = parm.getSize() and |
| 20 | + ( |
| 21 | + arg instanceof IntegralOrEnumType and |
| 22 | + parm instanceof IntegralOrEnumType |
| 23 | + or |
| 24 | + arg instanceof FloatingPointType and |
| 25 | + parm instanceof FloatingPointType |
| 26 | + ) |
| 27 | +} |
| 28 | + |
| 29 | +pragma[inline] |
| 30 | +predicate nestedPointerArgTypeMayBeUsed(Type arg, Type parm) { |
| 31 | + // arithmetic types |
| 32 | + arithTypesMatch(arg, parm) |
| 33 | + or |
| 34 | + // conversion to/from pointers to void is allowed |
| 35 | + arg instanceof VoidType |
| 36 | + or |
| 37 | + parm instanceof VoidType |
| 38 | +} |
| 39 | + |
| 40 | +pragma[inline] |
| 41 | +predicate pointerArgTypeMayBeUsed(Type arg, Type parm) { |
| 42 | + nestedPointerArgTypeMayBeUsed(arg, parm) |
| 43 | + or |
| 44 | + // nested pointers |
| 45 | + nestedPointerArgTypeMayBeUsed(arg.(PointerType).getBaseType().getUnspecifiedType(), |
| 46 | + parm.(PointerType).getBaseType().getUnspecifiedType()) |
| 47 | + or |
| 48 | + nestedPointerArgTypeMayBeUsed(arg.(ArrayType).getBaseType().getUnspecifiedType(), |
| 49 | + parm.(PointerType).getBaseType().getUnspecifiedType()) |
| 50 | +} |
| 51 | + |
| 52 | +pragma[inline] |
| 53 | +predicate argTypeMayBeUsed(Type arg, Type parm) { |
| 54 | + // arithmetic types |
| 55 | + arithTypesMatch(arg, parm) |
| 56 | + or |
| 57 | + // pointers to compatible types |
| 58 | + pointerArgTypeMayBeUsed(arg.(PointerType).getBaseType().getUnspecifiedType(), |
| 59 | + parm.(PointerType).getBaseType().getUnspecifiedType()) |
| 60 | + or |
| 61 | + pointerArgTypeMayBeUsed(arg.(ArrayType).getBaseType().getUnspecifiedType(), |
| 62 | + parm.(PointerType).getBaseType().getUnspecifiedType()) |
| 63 | + or |
| 64 | + // C11 arrays |
| 65 | + pointerArgTypeMayBeUsed(arg.(PointerType).getBaseType().getUnspecifiedType(), |
| 66 | + parm.(ArrayType).getBaseType().getUnspecifiedType()) |
| 67 | + or |
| 68 | + pointerArgTypeMayBeUsed(arg.(ArrayType).getBaseType().getUnspecifiedType(), |
| 69 | + parm.(ArrayType).getBaseType().getUnspecifiedType()) |
| 70 | +} |
| 71 | + |
| 72 | +// This predicate holds whenever expression `arg` may be used to initialize |
| 73 | +// function parameter `parm` without need for run-time conversion. |
| 74 | +pragma[inline] |
| 75 | +predicate argMayBeUsed(Expr arg, Parameter parm) { |
| 76 | + argTypeMayBeUsed(arg.getFullyConverted().getType().getUnspecifiedType(), |
| 77 | + parm.getType().getUnspecifiedType()) |
| 78 | +} |
| 79 | + |
| 80 | +// True if function was ()-declared, but not (void)-declared or K&R-defined |
| 81 | +predicate hasZeroParamDecl(Function f) { |
| 82 | + exists(FunctionDeclarationEntry fde | fde = f.getADeclarationEntry() | |
| 83 | + not fde.hasVoidParamList() and fde.getNumberOfParameters() = 0 and not fde.isDefinition() |
| 84 | + ) |
| 85 | +} |
| 86 | + |
| 87 | +// True if this file (or header) was compiled as a C file |
| 88 | +predicate isCompiledAsC(Function f) { |
| 89 | + exists(File file | file.compiledAsC() | |
| 90 | + file = f.getFile() or file.getAnIncludedFile+() = f.getFile() |
| 91 | + ) |
| 92 | +} |
| 93 | + |
| 94 | +from FunctionCall fc, Function f, Parameter p |
| 95 | +where |
| 96 | + f = fc.getTarget() and |
| 97 | + p = f.getAParameter() and |
| 98 | + hasZeroParamDecl(f) and |
| 99 | + isCompiledAsC(f) and |
| 100 | + not f.isVarargs() and |
| 101 | + not f instanceof BuiltInFunction and |
| 102 | + p.getIndex() < fc.getNumberOfArguments() and |
| 103 | + // Parameter p and its corresponding call argument must have mismatched types |
| 104 | + not argMayBeUsed(fc.getArgument(p.getIndex()), p) |
| 105 | +select fc, "Calling $@: argument $@ of type $@ is incompatible with parameter $@.", f, f.toString(), |
| 106 | + fc.getArgument(p.getIndex()) as arg, arg.toString(), |
| 107 | + arg.getExplicitlyConverted().getType().getUnspecifiedType() as atype, atype.toString(), p, |
| 108 | + p.getTypedName() |
0 commit comments