-
Notifications
You must be signed in to change notification settings - Fork 1.5k
Commit
This commit does not belong to any branch on this repository, and may belong to a fork outside of the repository.
Auto merge of #3848 - felix91gr:null_transmute, r=<try>
Transmuting known null ptr to ref Working on implementing #628
- Loading branch information
Showing
8 changed files
with
195 additions
and
14 deletions.
There are no files selected for viewing
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,112 @@ | ||
| use crate::consts::{constant_context, Constant}; | ||
| use crate::utils::{match_qpath, span_lint}; | ||
| use if_chain::if_chain; | ||
| use rustc::hir::{Expr, ExprKind}; | ||
| use rustc::lint::{in_external_macro, LateContext, LateLintPass, LintArray, LintContext, LintPass}; | ||
| use rustc::{declare_tool_lint, lint_array}; | ||
| use syntax::ast::LitKind; | ||
|
|
||
| declare_clippy_lint! { | ||
| /// **What it does:** Checks for transmute calls which would receive a null pointer. | ||
| /// | ||
| /// **Why is this bad?** Transmuting a null pointer is undefined behavior. | ||
| /// | ||
| /// **Known problems:** Not all cases can be detected at the moment of this writing. | ||
| /// For example, variables which hold a null pointer and are then fed to a `transmute` | ||
| /// call, aren't detectable yet. | ||
| /// | ||
| /// **Example:** | ||
| /// ```rust | ||
| /// let null_ref: &u64 = unsafe { std::mem::transmute(0 as *const u64) }; | ||
| /// ``` | ||
| pub TRANSMUTING_NULL, | ||
| correctness, | ||
| "transmutes from a null pointer to a reference, which is undefined behavior" | ||
| } | ||
|
|
||
| #[derive(Copy, Clone)] | ||
| pub struct Pass; | ||
|
|
||
| impl LintPass for Pass { | ||
| fn get_lints(&self) -> LintArray { | ||
| lint_array!(TRANSMUTING_NULL,) | ||
| } | ||
|
|
||
| fn name(&self) -> &'static str { | ||
| "TransmutingNull" | ||
| } | ||
| } | ||
|
|
||
| const LINT_MSG: &str = "transmuting a known null pointer into a reference."; | ||
|
|
||
| impl<'a, 'tcx> LateLintPass<'a, 'tcx> for Pass { | ||
| fn check_expr(&mut self, cx: &LateContext<'a, 'tcx>, expr: &'tcx Expr) { | ||
| if in_external_macro(cx.sess(), expr.span) { | ||
| return; | ||
| } | ||
|
|
||
| if_chain! { | ||
| if let ExprKind::Call(ref func, ref args) = expr.node; | ||
| if let ExprKind::Path(ref path) = func.node; | ||
| if match_qpath(path, &["std", "mem", "transmute"]); | ||
| if args.len() == 1; | ||
|
|
||
| then { | ||
|
|
||
| // Catching transmute over constants that resolve to `null`. | ||
| let mut const_eval_context = constant_context(cx, cx.tables); | ||
| if_chain! { | ||
| if let ExprKind::Path(ref _qpath) = args[0].node; | ||
| let x = const_eval_context.expr(&args[0]); | ||
| if let Some(constant) = x; | ||
| if let Constant::RawPtr(ptr_value) = constant; | ||
| if ptr_value == 0; | ||
| then { | ||
| span_lint( | ||
| cx, | ||
| TRANSMUTING_NULL, | ||
| expr.span, | ||
| LINT_MSG) | ||
| } | ||
| } | ||
|
|
||
| // Catching: | ||
| // `std::mem::transmute(0 as *const i32)` | ||
| if_chain! { | ||
| if let ExprKind::Cast(ref inner_expr, ref _cast_ty) = args[0].node; | ||
| if let ExprKind::Lit(ref lit) = inner_expr.node; | ||
| if let LitKind::Int(0, _) = lit.node; | ||
| then { | ||
| span_lint( | ||
| cx, | ||
| TRANSMUTING_NULL, | ||
| expr.span, | ||
| LINT_MSG) | ||
| } | ||
| } | ||
|
|
||
| // Catching: | ||
| // `std::mem::transmute(std::ptr::null::<i32>())` | ||
| if_chain! { | ||
| if let ExprKind::Call(ref func1, ref args1) = args[0].node; | ||
| if let ExprKind::Path(ref path1) = func1.node; | ||
| if match_qpath(path1, &["std", "ptr", "null"]); | ||
| if args1.len() == 0; | ||
| then { | ||
| span_lint( | ||
| cx, | ||
| TRANSMUTING_NULL, | ||
| expr.span, | ||
| LINT_MSG) | ||
| } | ||
| } | ||
|
|
||
| // FIXME: | ||
| // Also catch transmutations of variables which are known nulls. | ||
| // To do this, MIR const propagation seems to be the better tool. | ||
| // Whenever MIR const prop routines are more developed, this will | ||
| // become available. As of this writing (25/03/19) it is not yet. | ||
| } | ||
| } | ||
| } | ||
| } |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,30 @@ | ||
| #![allow(dead_code)] | ||
| #![warn(clippy::transmuting_null)] | ||
| #![allow(clippy::zero_ptr)] | ||
| #![allow(clippy::transmute_ptr_to_ref)] | ||
| #![allow(clippy::eq_op)] | ||
|
|
||
| // Easy to lint because these only span one line. | ||
| fn one_liners() { | ||
| unsafe { | ||
| let _: &u64 = std::mem::transmute(0 as *const u64); | ||
| let _: &u64 = std::mem::transmute(std::ptr::null::<u64>()); | ||
| } | ||
| } | ||
|
|
||
| pub const ZPTR: *const usize = 0 as *const _; | ||
| pub const NOT_ZPTR: *const usize = 1 as *const _; | ||
|
|
||
| fn transmute_const() { | ||
| unsafe { | ||
| // Should raise a lint. | ||
| let _: &u64 = std::mem::transmute(ZPTR); | ||
| // Should NOT raise a lint. | ||
| let _: &u64 = std::mem::transmute(NOT_ZPTR); | ||
| } | ||
| } | ||
|
|
||
| fn main() { | ||
| one_liners(); | ||
| transmute_const(); | ||
| } |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,22 @@ | ||
| error: transmuting a known null pointer into a reference. | ||
| --> $DIR/transmuting_null.rs:10:23 | ||
| | | ||
| LL | let _: &u64 = std::mem::transmute(0 as *const u64); | ||
| | ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^ | ||
| | | ||
| = note: `-D clippy::transmuting-null` implied by `-D warnings` | ||
|
|
||
| error: transmuting a known null pointer into a reference. | ||
| --> $DIR/transmuting_null.rs:11:23 | ||
| | | ||
| LL | let _: &u64 = std::mem::transmute(std::ptr::null::<u64>()); | ||
| | ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^ | ||
|
|
||
| error: transmuting a known null pointer into a reference. | ||
| --> $DIR/transmuting_null.rs:21:23 | ||
| | | ||
| LL | let _: &u64 = std::mem::transmute(ZPTR); | ||
| | ^^^^^^^^^^^^^^^^^^^^^^^^^ | ||
|
|
||
| error: aborting due to 3 previous errors | ||
|
|