|
| 1 | +use rustc_ast::visit::{visit_opt, walk_list}; |
| 2 | +use rustc_hir::def_id::LocalDefId; |
| 3 | +use rustc_hir::intravisit::{FnKind, Visitor, walk_expr}; |
| 4 | +use rustc_hir::{Block, Body, Expr, ExprKind, FnDecl, LangItem}; |
| 5 | +use rustc_middle::ty::{Ty, TyCtxt}; |
| 6 | +use rustc_session::{declare_lint, impl_lint_pass}; |
| 7 | +use rustc_span::Span; |
| 8 | +use rustc_span::symbol::sym; |
| 9 | + |
| 10 | +use crate::lints::DanglingPointersFromTemporaries; |
| 11 | +use crate::{LateContext, LateLintPass}; |
| 12 | + |
| 13 | +declare_lint! { |
| 14 | + /// The `dangling_pointers_from_temporaries` lint detects getting a pointer to data |
| 15 | + /// of a temporary that will immediately get dropped. |
| 16 | + /// |
| 17 | + /// ### Example |
| 18 | + /// |
| 19 | + /// ```rust |
| 20 | + /// # #![allow(unused)] |
| 21 | + /// # unsafe fn use_data(ptr: *const u8) { } |
| 22 | + /// fn gather_and_use(bytes: impl Iterator<Item = u8>) { |
| 23 | + /// let x: *const u8 = bytes.collect::<Vec<u8>>().as_ptr(); |
| 24 | + /// unsafe { use_data(x) } |
| 25 | + /// } |
| 26 | + /// ``` |
| 27 | + /// |
| 28 | + /// {{produces}} |
| 29 | + /// |
| 30 | + /// ### Explanation |
| 31 | + /// |
| 32 | + /// Getting a pointer from a temporary value will not prolong its lifetime, |
| 33 | + /// which means that the value can be dropped and the allocation freed |
| 34 | + /// while the pointer still exists, making the pointer dangling. |
| 35 | + /// This is not an error (as far as the type system is concerned) |
| 36 | + /// but probably is not what the user intended either. |
| 37 | + /// |
| 38 | + /// If you need stronger guarantees, consider using references instead, |
| 39 | + /// as they are statically verified by the borrow-checker to never dangle. |
| 40 | + pub DANGLING_POINTERS_FROM_TEMPORARIES, |
| 41 | + Warn, |
| 42 | + "detects getting a pointer from a temporary" |
| 43 | +} |
| 44 | + |
| 45 | +/// FIXME: false negatives (i.e. the lint is not emitted when it should be) |
| 46 | +/// 1. Method calls that are not checked for: |
| 47 | +/// - [`temporary_unsafe_cell.get()`][`core::cell::UnsafeCell::get()`] |
| 48 | +/// - [`temporary_sync_unsafe_cell.get()`][`core::cell::SyncUnsafeCell::get()`] |
| 49 | +/// 2. Ways to get a temporary that are not recognized: |
| 50 | +/// - `owning_temporary.field` |
| 51 | +/// - `owning_temporary[index]` |
| 52 | +/// 3. No checks for ref-to-ptr conversions: |
| 53 | +/// - `&raw [mut] temporary` |
| 54 | +/// - `&temporary as *(const|mut) _` |
| 55 | +/// - `ptr::from_ref(&temporary)` and friends |
| 56 | +#[derive(Clone, Copy, Default)] |
| 57 | +pub(crate) struct DanglingPointers; |
| 58 | + |
| 59 | +impl_lint_pass!(DanglingPointers => [DANGLING_POINTERS_FROM_TEMPORARIES]); |
| 60 | + |
| 61 | +// This skips over const blocks, but they cannot use or return a dangling pointer anyways. |
| 62 | +impl<'tcx> LateLintPass<'tcx> for DanglingPointers { |
| 63 | + fn check_fn( |
| 64 | + &mut self, |
| 65 | + cx: &LateContext<'tcx>, |
| 66 | + _: FnKind<'tcx>, |
| 67 | + _: &'tcx FnDecl<'tcx>, |
| 68 | + body: &'tcx Body<'tcx>, |
| 69 | + _: Span, |
| 70 | + _: LocalDefId, |
| 71 | + ) { |
| 72 | + DanglingPointerSearcher { cx, inside_call_args: false }.visit_body(body) |
| 73 | + } |
| 74 | +} |
| 75 | + |
| 76 | +/// This produces a dangling pointer: |
| 77 | +/// ```ignore (example) |
| 78 | +/// let ptr = CString::new("hello").unwrap().as_ptr(); |
| 79 | +/// foo(ptr) |
| 80 | +/// ``` |
| 81 | +/// |
| 82 | +/// But this does not: |
| 83 | +/// ```ignore (example) |
| 84 | +/// foo(CString::new("hello").unwrap().as_ptr()) |
| 85 | +/// ``` |
| 86 | +/// |
| 87 | +/// But this does: |
| 88 | +/// ```ignore (example) |
| 89 | +/// foo({ let ptr = CString::new("hello").unwrap().as_ptr(); ptr }) |
| 90 | +/// ``` |
| 91 | +/// |
| 92 | +/// So we have to keep track of when we are inside of a function/method call argument. |
| 93 | +struct DanglingPointerSearcher<'lcx, 'tcx> { |
| 94 | + cx: &'lcx LateContext<'tcx>, |
| 95 | + /// Keeps track of whether we are inside of function/method call arguments, |
| 96 | + /// where this lint should not be emitted. |
| 97 | + /// |
| 98 | + /// See [the main doc][`Self`] for examples. |
| 99 | + inside_call_args: bool, |
| 100 | +} |
| 101 | + |
| 102 | +impl Visitor<'_> for DanglingPointerSearcher<'_, '_> { |
| 103 | + fn visit_expr(&mut self, expr: &Expr<'_>) -> Self::Result { |
| 104 | + if !self.inside_call_args { |
| 105 | + lint_expr(self.cx, expr) |
| 106 | + } |
| 107 | + match expr.kind { |
| 108 | + ExprKind::Call(lhs, args) | ExprKind::MethodCall(_, lhs, args, _) => { |
| 109 | + self.visit_expr(lhs); |
| 110 | + self.with_inside_call_args(true, |this| walk_list!(this, visit_expr, args)) |
| 111 | + } |
| 112 | + ExprKind::Block(&Block { stmts, expr, .. }, _) => { |
| 113 | + self.with_inside_call_args(false, |this| walk_list!(this, visit_stmt, stmts)); |
| 114 | + visit_opt!(self, visit_expr, expr) |
| 115 | + } |
| 116 | + _ => walk_expr(self, expr), |
| 117 | + } |
| 118 | + } |
| 119 | +} |
| 120 | + |
| 121 | +impl DanglingPointerSearcher<'_, '_> { |
| 122 | + fn with_inside_call_args<R>( |
| 123 | + &mut self, |
| 124 | + inside_call_args: bool, |
| 125 | + callback: impl FnOnce(&mut Self) -> R, |
| 126 | + ) -> R { |
| 127 | + let old = core::mem::replace(&mut self.inside_call_args, inside_call_args); |
| 128 | + let result = callback(self); |
| 129 | + self.inside_call_args = old; |
| 130 | + result |
| 131 | + } |
| 132 | +} |
| 133 | + |
| 134 | +fn lint_expr(cx: &LateContext<'_>, expr: &Expr<'_>) { |
| 135 | + if let ExprKind::MethodCall(method, receiver, _args, _span) = expr.kind |
| 136 | + && matches!(method.ident.name, sym::as_ptr | sym::as_mut_ptr) |
| 137 | + && is_temporary_rvalue(receiver) |
| 138 | + && let ty = cx.typeck_results().expr_ty(receiver) |
| 139 | + && is_interesting(cx.tcx, ty) |
| 140 | + { |
| 141 | + // FIXME: use `emit_node_lint` when `#[primary_span]` is added. |
| 142 | + cx.tcx.emit_node_span_lint( |
| 143 | + DANGLING_POINTERS_FROM_TEMPORARIES, |
| 144 | + expr.hir_id, |
| 145 | + method.ident.span, |
| 146 | + DanglingPointersFromTemporaries { |
| 147 | + callee: method.ident.name, |
| 148 | + ty, |
| 149 | + ptr_span: method.ident.span, |
| 150 | + temporary_span: receiver.span, |
| 151 | + }, |
| 152 | + ) |
| 153 | + } |
| 154 | +} |
| 155 | + |
| 156 | +fn is_temporary_rvalue(expr: &Expr<'_>) -> bool { |
| 157 | + match expr.kind { |
| 158 | + // Const is not temporary. |
| 159 | + ExprKind::ConstBlock(..) | ExprKind::Repeat(..) | ExprKind::Lit(..) => false, |
| 160 | + |
| 161 | + // This is literally lvalue. |
| 162 | + ExprKind::Path(..) => false, |
| 163 | + |
| 164 | + // Calls return rvalues. |
| 165 | + ExprKind::Call(..) | ExprKind::MethodCall(..) | ExprKind::Binary(..) => true, |
| 166 | + |
| 167 | + // Inner blocks are rvalues. |
| 168 | + ExprKind::If(..) | ExprKind::Loop(..) | ExprKind::Match(..) | ExprKind::Block(..) => true, |
| 169 | + |
| 170 | + // FIXME: these should probably recurse and typecheck along the way. |
| 171 | + // Some false negatives are possible for now. |
| 172 | + ExprKind::Index(..) | ExprKind::Field(..) | ExprKind::Unary(..) => false, |
| 173 | + |
| 174 | + ExprKind::Struct(..) => true, |
| 175 | + |
| 176 | + // FIXME: this has false negatives, but I do not want to deal with 'static/const promotion just yet. |
| 177 | + ExprKind::Array(..) => false, |
| 178 | + |
| 179 | + // These typecheck to `!` |
| 180 | + ExprKind::Break(..) | ExprKind::Continue(..) | ExprKind::Ret(..) | ExprKind::Become(..) => { |
| 181 | + false |
| 182 | + } |
| 183 | + |
| 184 | + // These typecheck to `()` |
| 185 | + ExprKind::Assign(..) | ExprKind::AssignOp(..) | ExprKind::Yield(..) => false, |
| 186 | + |
| 187 | + // Compiler-magic macros |
| 188 | + ExprKind::AddrOf(..) | ExprKind::OffsetOf(..) | ExprKind::InlineAsm(..) => false, |
| 189 | + |
| 190 | + // We are not interested in these |
| 191 | + ExprKind::Cast(..) |
| 192 | + | ExprKind::Closure(..) |
| 193 | + | ExprKind::Tup(..) |
| 194 | + | ExprKind::DropTemps(..) |
| 195 | + | ExprKind::Let(..) => false, |
| 196 | + |
| 197 | + // Not applicable |
| 198 | + ExprKind::Type(..) | ExprKind::Err(..) => false, |
| 199 | + } |
| 200 | +} |
| 201 | + |
| 202 | +// Array, Vec, String, CString, MaybeUninit, Cell, Box<[_]>, Box<str>, Box<CStr>, |
| 203 | +// or any of the above in arbitrary many nested Box'es. |
| 204 | +fn is_interesting(tcx: TyCtxt<'_>, ty: Ty<'_>) -> bool { |
| 205 | + if ty.is_array() { |
| 206 | + true |
| 207 | + } else if let Some(inner) = ty.boxed_ty() { |
| 208 | + inner.is_slice() |
| 209 | + || inner.is_str() |
| 210 | + || inner.ty_adt_def().is_some_and(|def| tcx.is_lang_item(def.did(), LangItem::CStr)) |
| 211 | + || is_interesting(tcx, inner) |
| 212 | + } else if let Some(def) = ty.ty_adt_def() { |
| 213 | + for lang_item in [LangItem::String, LangItem::MaybeUninit] { |
| 214 | + if tcx.is_lang_item(def.did(), lang_item) { |
| 215 | + return true; |
| 216 | + } |
| 217 | + } |
| 218 | + tcx.get_diagnostic_name(def.did()) |
| 219 | + .is_some_and(|name| matches!(name, sym::cstring_type | sym::Vec | sym::Cell)) |
| 220 | + } else { |
| 221 | + false |
| 222 | + } |
| 223 | +} |
0 commit comments