[clang] [Webkit Checkers][SaferCpp] Detect base-to-derived downcasts laundered through void* in MemoryUnsafeCastChecker (PR #200294)

[Balázs Benics via cfe-commits]

================
@@ -122,17 +122,47 @@ void MemoryUnsafeCastChecker::checkASTCodeBody(const Decl 
*D,
                          .bind(DerivedNode)))))),
             unless(anyOf(hasSourceExpression(hasDescendant(cxxThisExpr())),
                          hasType(templateTypeParmDecl()))));
+  auto MatchExprPtrVoidCast = allOf(
+      anyOf(hasSourceExpression(explicitCastExpr(
+                hasType(pointerType(pointee(voidType()))),
+                hasSourceExpression(ignoringImpCasts(
+                    hasTypePointingTo(cxxRecordDecl().bind(BaseNode)))))),
+            hasSourceExpression(
+                callExpr(hasType(pointerType(pointee(voidType()))),
+                         hasAnyArgument(ignoringImpCasts(hasTypePointingTo(
+                             cxxRecordDecl().bind(BaseNode))))))),
+      hasTypePointingTo(cxxRecordDecl(isDerivedFrom(equalsBoundNode(BaseNode)))
+                            .bind(DerivedNode)));
 
-  auto ExplicitCast = explicitCastExpr(anyOf(MatchExprPtr, MatchExprRefTypeDef,
-                                             MatchExprPtrObjC))
-                          .bind(WarnRecordDecl);
+  auto ExplicitCast =
+      explicitCastExpr(anyOf(MatchExprPtr, MatchExprRefTypeDef,
+                             MatchExprPtrObjC, MatchExprPtrVoidCast))
+          .bind(WarnRecordDecl);
   auto Cast = stmt(ExplicitCast);
 
   auto Matches =
       match(stmt(forEachDescendant(Cast)), *D->getBody(), AM.getASTContext());
   for (BoundNodes Match : Matches)
     emitDiagnostics(Match, BR, ADC, this, BT);
 
+  // Match calls returning derived type where an argument is
+  // a void pointer
+  auto VoidPtrCast =
+      castExpr(hasType(pointerType(pointee(voidType()))),
+               hasSourceExpression(ignoringImpCasts(
+                   hasTypePointingTo(cxxRecordDecl().bind(BaseNode)))))
+          .bind(WarnRecordDecl);
+  auto MatchCallPtrVoidArgCast = callExpr(
+      hasAnyArgument(anyOf(VoidPtrCast,
+                           
explicitCastExpr(hasSourceExpression(VoidPtrCast)))),
+      hasTypePointingTo(cxxRecordDecl(isDerivedFrom(equalsBoundNode(BaseNode)))
+                            .bind(DerivedNode)));
+  auto CallArgCast = stmt(MatchCallPtrVoidArgCast);
+  auto MatchesCallArgCast = match(stmt(forEachDescendant(CallArgCast)),
+                                  *D->getBody(), AM.getASTContext());
+  for (BoundNodes Match : MatchesCallArgCast)
+    emitDiagnostics(Match, BR, ADC, this, BT);
----------------
steakhal wrote:

I'm pretty sure we could hoist things and restructure some of the matches - 
including these ones, but if it works, it works. I'm not complaining.

https://github.com/llvm/llvm-project/pull/200294
_______________________________________________
cfe-commits mailing list
cfe-commits@lists.llvm.org
https://lists.llvm.org/cgi-bin/mailman/listinfo/cfe-commits