-
Notifications
You must be signed in to change notification settings - Fork 1.7k
Transmuting known null ptr to ref #3848
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
Merged
Merged
Changes from all commits
Commits
File filter
Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
There are no files selected for viewing
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,112 @@ | ||
| use crate::consts::{constant_context, Constant}; | ||
| use crate::utils::{match_qpath, span_lint}; | ||
| use if_chain::if_chain; | ||
| use rustc::hir::{Expr, ExprKind}; | ||
| use rustc::lint::{in_external_macro, LateContext, LateLintPass, LintArray, LintContext, LintPass}; | ||
| use rustc::{declare_tool_lint, lint_array}; | ||
| use syntax::ast::LitKind; | ||
|
|
||
| declare_clippy_lint! { | ||
| /// **What it does:** Checks for transmute calls which would receive a null pointer. | ||
| /// | ||
| /// **Why is this bad?** Transmuting a null pointer is undefined behavior. | ||
| /// | ||
| /// **Known problems:** Not all cases can be detected at the moment of this writing. | ||
| /// For example, variables which hold a null pointer and are then fed to a `transmute` | ||
| /// call, aren't detectable yet. | ||
| /// | ||
| /// **Example:** | ||
| /// ```rust | ||
| /// let null_ref: &u64 = unsafe { std::mem::transmute(0 as *const u64) }; | ||
| /// ``` | ||
| pub TRANSMUTING_NULL, | ||
| correctness, | ||
| "transmutes from a null pointer to a reference, which is undefined behavior" | ||
| } | ||
|
|
||
| #[derive(Copy, Clone)] | ||
| pub struct Pass; | ||
|
|
||
| impl LintPass for Pass { | ||
| fn get_lints(&self) -> LintArray { | ||
| lint_array!(TRANSMUTING_NULL,) | ||
| } | ||
|
|
||
| fn name(&self) -> &'static str { | ||
| "TransmutingNull" | ||
| } | ||
| } | ||
|
|
||
| const LINT_MSG: &str = "transmuting a known null pointer into a reference."; | ||
|
|
||
| impl<'a, 'tcx> LateLintPass<'a, 'tcx> for Pass { | ||
| fn check_expr(&mut self, cx: &LateContext<'a, 'tcx>, expr: &'tcx Expr) { | ||
| if in_external_macro(cx.sess(), expr.span) { | ||
| return; | ||
| } | ||
|
|
||
| if_chain! { | ||
felix91gr marked this conversation as resolved.
Show resolved
Hide resolved
|
||
| if let ExprKind::Call(ref func, ref args) = expr.node; | ||
| if let ExprKind::Path(ref path) = func.node; | ||
| if match_qpath(path, &["std", "mem", "transmute"]); | ||
| if args.len() == 1; | ||
|
|
||
| then { | ||
|
|
||
flip1995 marked this conversation as resolved.
Show resolved
Hide resolved
|
||
| // Catching transmute over constants that resolve to `null`. | ||
| let mut const_eval_context = constant_context(cx, cx.tables); | ||
| if_chain! { | ||
flip1995 marked this conversation as resolved.
Show resolved
Hide resolved
|
||
| if let ExprKind::Path(ref _qpath) = args[0].node; | ||
| let x = const_eval_context.expr(&args[0]); | ||
| if let Some(constant) = x; | ||
| if let Constant::RawPtr(ptr_value) = constant; | ||
| if ptr_value == 0; | ||
| then { | ||
| span_lint( | ||
| cx, | ||
| TRANSMUTING_NULL, | ||
| expr.span, | ||
| LINT_MSG) | ||
| } | ||
| } | ||
|
|
||
| // Catching: | ||
| // `std::mem::transmute(0 as *const i32)` | ||
| if_chain! { | ||
| if let ExprKind::Cast(ref inner_expr, ref _cast_ty) = args[0].node; | ||
| if let ExprKind::Lit(ref lit) = inner_expr.node; | ||
| if let LitKind::Int(0, _) = lit.node; | ||
| then { | ||
| span_lint( | ||
| cx, | ||
| TRANSMUTING_NULL, | ||
| expr.span, | ||
| LINT_MSG) | ||
| } | ||
| } | ||
|
|
||
| // Catching: | ||
| // `std::mem::transmute(std::ptr::null::<i32>())` | ||
| if_chain! { | ||
| if let ExprKind::Call(ref func1, ref args1) = args[0].node; | ||
| if let ExprKind::Path(ref path1) = func1.node; | ||
| if match_qpath(path1, &["std", "ptr", "null"]); | ||
| if args1.len() == 0; | ||
| then { | ||
| span_lint( | ||
| cx, | ||
| TRANSMUTING_NULL, | ||
| expr.span, | ||
| LINT_MSG) | ||
| } | ||
| } | ||
|
|
||
| // FIXME: | ||
| // Also catch transmutations of variables which are known nulls. | ||
| // To do this, MIR const propagation seems to be the better tool. | ||
| // Whenever MIR const prop routines are more developed, this will | ||
| // become available. As of this writing (25/03/19) it is not yet. | ||
| } | ||
| } | ||
| } | ||
| } | ||
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,30 @@ | ||
| #![allow(dead_code)] | ||
| #![warn(clippy::transmuting_null)] | ||
| #![allow(clippy::zero_ptr)] | ||
| #![allow(clippy::transmute_ptr_to_ref)] | ||
| #![allow(clippy::eq_op)] | ||
|
|
||
| // Easy to lint because these only span one line. | ||
| fn one_liners() { | ||
| unsafe { | ||
| let _: &u64 = std::mem::transmute(0 as *const u64); | ||
| let _: &u64 = std::mem::transmute(std::ptr::null::<u64>()); | ||
| } | ||
| } | ||
|
|
||
| pub const ZPTR: *const usize = 0 as *const _; | ||
| pub const NOT_ZPTR: *const usize = 1 as *const _; | ||
|
|
||
| fn transmute_const() { | ||
| unsafe { | ||
| // Should raise a lint. | ||
| let _: &u64 = std::mem::transmute(ZPTR); | ||
| // Should NOT raise a lint. | ||
| let _: &u64 = std::mem::transmute(NOT_ZPTR); | ||
| } | ||
| } | ||
|
|
||
| fn main() { | ||
| one_liners(); | ||
| transmute_const(); | ||
| } |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,22 @@ | ||
| error: transmuting a known null pointer into a reference. | ||
| --> $DIR/transmuting_null.rs:10:23 | ||
| | | ||
| LL | let _: &u64 = std::mem::transmute(0 as *const u64); | ||
| | ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^ | ||
| | | ||
| = note: `-D clippy::transmuting-null` implied by `-D warnings` | ||
|
|
||
| error: transmuting a known null pointer into a reference. | ||
| --> $DIR/transmuting_null.rs:11:23 | ||
| | | ||
| LL | let _: &u64 = std::mem::transmute(std::ptr::null::<u64>()); | ||
| | ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^ | ||
|
|
||
| error: transmuting a known null pointer into a reference. | ||
| --> $DIR/transmuting_null.rs:21:23 | ||
| | | ||
| LL | let _: &u64 = std::mem::transmute(ZPTR); | ||
| | ^^^^^^^^^^^^^^^^^^^^^^^^^ | ||
|
|
||
| error: aborting due to 3 previous errors | ||
|
|
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
Uh oh!
There was an error while loading. Please reload this page.