GitHub Viewer
/*
* Cppcheck - A tool for static C/C++ code analysis
* Copyright (C) 2007-2026 Cppcheck team.
*
* This program is free software: you can redistribute it and/or modify
* it under the terms of the GNU General Public License as published by
* the Free Software Foundation, either version 3 of the License, or
* (at your option) any later version.
*
* This program is distributed in the hope that it will be useful,
* but WITHOUT ANY WARRANTY; without even the implied warranty of
* MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
* GNU General Public License for more details.
*
* You should have received a copy of the GNU General Public License
* along with this program. If not, see .
*/
//---------------------------------------------------------------------------
#include "checknullpointer.h"
#include "astutils.h"
#include "ctu.h"
#include "errorlogger.h"
#include "errortypes.h"
#include "findtoken.h"
#include "library.h"
#include "settings.h"
#include "symboldatabase.h"
#include "token.h"
#include "tokenize.h"
#include "tokenlist.h"
#include "valueflow.h"
#include "vfvalue.h"
#include
#include
#include
#include
#include
#include
//---------------------------------------------------------------------------
// CWE ids used:
static const CWE CWE_NULL_POINTER_DEREFERENCE(476U);
static const CWE CWE_INCORRECT_CALCULATION(682U);
//---------------------------------------------------------------------------
static bool checkNullpointerFunctionCallPlausibility(const Function* func, size_t arg)
{
return !func || (func->argCount() >= arg && func->getArgumentVar(arg - 1) && func->getArgumentVar(arg - 1)->isPointer());
}
std::list CheckNullPointerImpl::parseFunctionCall(const Token &tok, const Library &library, bool checkNullArg)
{
if (Token::Match(&tok, "%name% ( )") || !tok.tokAt(2))
return {};
const std::vector args = getArguments(&tok);
std::list var;
for (size_t argnr = 1; argnr getArgumentVar(argnr-1);
if (argVar && argVar->isStlStringType() && !argVar->isArrayOrPointer())
var.push_back(param);
}
}
if (library.formatstr_function(&tok)) {
const int formatStringArgNr = library.formatstr_argno(&tok);
if (formatStringArgNr < 0 || formatStringArgNr >= args.size())
return var;
// 1st parameter..
if (Token::Match(&tok, "snprintf|vsnprintf|fnprintf|vfnprintf") && args.size() > 1 && !(args[1] && args[1]->hasKnownIntValue() && args[1]->getKnownIntValue() == 0)) // Only if length (second parameter) is not zero
var.push_back(args[0]);
if (args[formatStringArgNr]->tokType() != Token::eString)
return var;
const std::string &formatString = args[formatStringArgNr]->strValue();
int argnr = formatStringArgNr + 1;
const bool scan = library.formatstr_scan(&tok);
bool percent = false;
for (auto i = formatString.cbegin(); i != formatString.cend(); ++i) {
if (*i == '%') {
percent = !percent;
} else if (percent) {
percent = false;
bool _continue = false;
while (!std::isalpha(static_cast(*i))) {
if (*i == '*') {
if (scan)
_continue = true;
else
argnr++;
}
++i;
if (i == formatString.end())
return var;
}
if (_continue)
continue;
if (argnr < args.size() && (*i == 'n' || *i == 's' || scan))
var.push_back(args[argnr]);
if (*i != 'm') // %m is a non-standard glibc extension that requires no parameter
argnr++;
}
}
}
return var;
}
namespace {
const std::set stl_stream = {
"fstream", "ifstream", "iostream", "istream",
"istringstream", "ofstream", "ostream", "ostringstream",
"stringstream", "wistringstream", "wostringstream", "wstringstream"
};
}
bool CheckNullPointerImpl::isPointerDeRef(const Token *tok, bool &unknown) const
{
return isPointerDeRef(tok, unknown, mSettings.library);
}
bool CheckNullPointerImpl::isPointerDeRef(const Token *tok, bool &unknown, const Library &library, bool checkNullArg)
{
unknown = false;
// Is pointer used as function parameter?
if (Token::Match(tok->previous(), "[(,] %name% [,)]")) {
const Token *ftok = tok->previous();
while (ftok && ftok->str() != "(") {
if (ftok->str() == ")")
ftok = ftok->link();
ftok = ftok->previous();
}
if (ftok && ftok->previous()) {
const std::list varlist = CheckNullPointerImpl::parseFunctionCall(*ftok->previous(), library, checkNullArg);
if (std::find(varlist.cbegin(), varlist.cend(), tok) != varlist.cend()) {
return true;
}
}
}
if (tok->str() == "(" && !tok->scope()->isExecutable())
return false;
const Token* parent = tok->astParent();
if (!parent)
return false;
const bool addressOf = parent->astParent() && parent->astParent()->str() == "&";
if (parent->str() == "." && astIsRHS(tok))
return isPointerDeRef(parent, unknown, library);
const bool firstOperand = parent->astOperand1() == tok;
parent = astParentSkipParens(tok);
if (!parent)
return false;
// Dereferencing pointer..
const Token* grandParent = parent->astParent();
if (parent->isUnaryOp("*") && !(grandParent && isUnevaluated(grandParent->previous()))) {
// declaration of function pointer
if (tok->variable() && tok->variable()->nameToken() == tok)
return false;
if ((tok->valueType() && tok->valueType()->pointer == 0) && !astIsIterator(tok) && !astIsSmartPointer(tok))
return false;
if (!addressOf)
return true;
}
// array access
if (firstOperand && parent->str() == "[" && !addressOf)
return true;
// address of member variable / array element
const Token *parent2 = parent;
while (Token::Match(parent2, "[|."))
parent2 = parent2->astParent();
if (parent2 != parent && parent2 && parent2->isUnaryOp("&"))
return false;
// read/write member variable
if (firstOperand && parent->originalName() == "->" && !addressOf)
return true;
// If its a function pointer then check if its called
if (tok->variable() && tok->variable()->isPointer() && Token::Match(tok->variable()->nameToken(), "%name% ) (") &&
Token::Match(tok, "%name% ("))
return true;
if (Token::Match(tok, "%var% = %var% .") &&
tok->varId() == tok->tokAt(2)->varId())
return true;
// std::string dereferences nullpointers
if (Token::Match(parent->tokAt(-3), "std :: string|wstring (|{"))
return true;
if (Token::Match(parent->previous(), "%name% (|{")) {
const Variable* var = parent->previous()->variable();
if (var && !var->isPointer() && !var->isArray() && var->isStlStringType())
return true;
}
// streams dereference nullpointers
if (Token::Match(parent, "") && !firstOperand) {
const Variable* var = tok->variable();
if (var && var->isPointer() && Token::Match(var->typeStartToken(), "char|wchar_t")) { // Only outputting or reading to char* can cause problems
const Token* tok2 = parent; // Find start of statement
for (; tok2; tok2 = tok2->previous()) {
if (Token::Match(tok2->previous(), ";|{|}|:"))
break;
}
if (Token::Match(tok2, "std :: cout|cin|cerr"))
return true;
if (tok2 && tok2->varId() != 0) {
const Variable* var2 = tok2->variable();
if (var2 && var2->isStlType(stl_stream))
return true;
}
}
}
const Variable *ovar = nullptr;
if (Token::Match(parent, "+|==|!=") || (parent->str() == "=" && !firstOperand)) {
if (parent->astOperand1() == tok && parent->astOperand2())
ovar = parent->astOperand2()->variable();
else if (parent->astOperand1() && parent->astOperand2() == tok)
ovar = parent->astOperand1()->variable();
}
if (ovar && !ovar->isPointer() && !ovar->isArray() && ovar->isStlStringType())
return true;
// assume that it's not a dereference (no false positives)
return false;
}
static bool isNullablePointer(const Token* tok)
{
if (!tok)
return false;
if (Token::simpleMatch(tok, "new") && tok->varId() == 0)
return false;
if (astIsPointer(tok))
return true;
if (astIsSmartPointer(tok))
return true;
if (Token::simpleMatch(tok, "."))
return isNullablePointer(tok->astOperand2());
if (const Variable* var = tok->variable()) {
return (var->isPointer() || var->isSmartPointer());
}
return false;
}
void CheckNullPointerImpl::nullPointerByDeRefAndCheck()
{
const bool printInconclusive = (mSettings.certainty.isEnabled(Certainty::inconclusive));
const SymbolDatabase *symbolDatabase = mTokenizer->getSymbolDatabase();
for (const Scope * scope : symbolDatabase->functionScopes) {
auto pred = [printInconclusive](const Token* tok) -> bool {
if (!tok)
return false;
if (Token::Match(tok, "%num%|%char%|%str%"))
return false;
if (!isNullablePointer(tok) ||
(tok->str() == "." && isNullablePointer(tok->astOperand2()) && tok->astOperand2()->getValue(0))) // avoid duplicate warning
return false;
// Can pointer be NULL?
const ValueFlow::Value *value = tok->getValue(0);
if (!value)
return false;
if (!printInconclusive && value->isInconclusive())
return false;
return true;
};
const Token* const start = (scope->function && scope->function->isConstructor()) ? scope->function->token : scope->bodyStart; // Check initialization list
std::vector tokens = findTokensSkipDeadAndUnevaluatedCode(mSettings.library, start, scope->bodyEnd, pred);
for (const Token *tok : tokens) {
const ValueFlow::Value *value = tok->getValue(0);
// Pointer dereference.
bool unknown = false;
if (!CheckNullPointerImpl::isPointerDeRef(tok, unknown, mSettings.library)) {
if (unknown)
nullPointerError(tok, tok->expressionString(), value, true);
continue;
}
nullPointerError(tok, tok->expressionString(), value, value->isInconclusive());
}
}
}
void CheckNullPointerImpl::nullPointer()
{
logChecker("CheckNullPointer::nullPointer");
nullPointerByDeRefAndCheck();
}
namespace {
const std::set stl_istream = {
"fstream", "ifstream", "iostream", "istream",
"istringstream", "stringstream", "wistringstream", "wstringstream"
};
}
/** Dereferencing null constant (simplified token list) */
void CheckNullPointerImpl::nullConstantDereference()
{
logChecker("CheckNullPointer::nullConstantDereference");
const SymbolDatabase *symbolDatabase = mTokenizer->getSymbolDatabase();
for (const Scope * scope : symbolDatabase->functionScopes) {
if (scope->function == nullptr || !scope->function->hasBody()) // We only look for functions with a body
continue;
const Token *tok = scope->bodyStart;
if (scope->function->isConstructor())
tok = scope->function->token; // Check initialization list
for (; tok != scope->bodyEnd; tok = tok->next()) {
if (isUnevaluated(tok))
tok = tok->linkAt(1);
else if (Token::simpleMatch(tok, "* 0")) {
if (Token::Match(tok->previous(), "return|throw|;|{|}|:|[|(|,") || tok->previous()->isOp()) {
nullPointerError(tok);
}
}
else if (Token::Match(tok, "0 [") && (tok->strAt(-1) != "&" || !Token::Match(tok->linkAt(1)->next(), "[.(]")))
nullPointerError(tok);
else if (Token::Match(tok->previous(), "!!. %name% (|{") && (tok->strAt(-1) != "::" || tok->strAt(-2) == "std")) {
if (Token::Match(tok->tokAt(2), "0|NULL|nullptr )|}") && tok->varId()) { // constructor call
const Variable *var = tok->variable();
if (var && !var->isPointer() && !var->isArray() && var->isStlStringType())
nullPointerError(tok);
} else { // function call
const std::list var = parseFunctionCall(*tok, mSettings.library);
// is one of the var items a NULL pointer?
for (const Token *vartok : var) {
if (vartok->hasKnownIntValue() && vartok->getKnownIntValue() == 0)
nullPointerError(vartok);
}
}
} else if (Token::Match(tok, "std :: string|wstring ( 0|NULL|nullptr )"))
nullPointerError(tok);
else if (Token::Match(tok->previous(), "::|. %name% (")) {
const std::vector &args = getArguments(tok);
for (size_t argnr = 0; argnr < args.size(); ++argnr) {
const Token *argtok = args[argnr];
if (!argtok->hasKnownIntValue())
continue;
if (argtok->getKnownIntValue() != 0)
continue;
if (mSettings.library.isnullargbad(tok, argnr+1))
nullPointerError(argtok);
}
}
else if (Token::Match(tok->previous(), ">> 0|NULL|nullptr")) { // Only checking input stream operations is safe here, because otherwise 0 can be an integer as well
const Token* tok2 = tok->previous(); // Find start of statement
for (; tok2; tok2 = tok2->previous()) {
if (Token::Match(tok2->previous(), ";|{|}|:|("))
break;
}
if (tok2 && tok2->previous() && tok2->strAt(-1)=="(")
continue;
if (Token::simpleMatch(tok2, "std :: cin"))
nullPointerError(tok);
if (tok2 && tok2->varId() != 0) {
const Variable *var = tok2->variable();
if (var && var->isStlType(stl_istream))
nullPointerError(tok);
}
}
const Variable *ovar = nullptr;
const Token *tokNull = nullptr;
if (Token::Match(tok, "0|NULL|nullptr ==|!=|>|>=||>=|