clippy_lints/src/transmuting_null.rs

   1 use crate::consts::{constant_context, Constant};
   2 use crate::utils::{match_qpath, paths, span_lint};
   3 use if_chain::if_chain;
   4 use rustc_ast::LitKind;
   5 use rustc_hir::{Expr, ExprKind};
   6 use rustc_lint::{LateContext, LateLintPass, LintContext};
   7 use rustc_middle::lint::in_external_macro;
   8 use rustc_session::{declare_lint_pass, declare_tool_lint};
   9
  10 declare_clippy_lint! {
  11     /// **What it does:** Checks for transmute calls which would receive a null pointer.
  12     ///
  13     /// **Why is this bad?** Transmuting a null pointer is undefined behavior.
  14     ///
  15     /// **Known problems:** Not all cases can be detected at the moment of this writing.
  16     /// For example, variables which hold a null pointer and are then fed to a `transmute`
  17     /// call, aren't detectable yet.
  18     ///
  19     /// **Example:**
  20     /// ```rust
  21     /// let null_ref: &u64 = unsafe { std::mem::transmute(0 as *const u64) };
  22     /// ```
  23     pub TRANSMUTING_NULL,
  24     correctness,
  25     "transmutes from a null pointer to a reference, which is undefined behavior"
  26 }
  27
  28 declare_lint_pass!(TransmutingNull => [TRANSMUTING_NULL]);
  29
  30 const LINT_MSG: &str = "transmuting a known null pointer into a reference";
  31
  32 impl<'tcx> LateLintPass<'tcx> for TransmutingNull {
  33     fn check_expr(&mut self, cx: &LateContext<'tcx>, expr: &'tcx Expr<'_>) {
  34         if in_external_macro(cx.sess(), expr.span) {
  35             return;
  36         }
  37
  38         if_chain! {
  39             if let ExprKind::Call(ref func, ref args) = expr.kind;
  40             if let ExprKind::Path(ref path) = func.kind;
  41             if match_qpath(path, &paths::STD_MEM_TRANSMUTE);
  42             if args.len() == 1;
  43
  44             then {
  45
  46                 // Catching transmute over constants that resolve to `null`.
  47                 let mut const_eval_context = constant_context(cx, cx.typeck_results());
  48                 if_chain! {
  49                     if let ExprKind::Path(ref _qpath) = args[0].kind;
  50                     let x = const_eval_context.expr(&args[0]);
  51                     if let Some(Constant::RawPtr(0)) = x;
  52                     then {
  53                         span_lint(cx, TRANSMUTING_NULL, expr.span, LINT_MSG)
  54                     }
  55                 }
  56
  57                 // Catching:
  58                 // `std::mem::transmute(0 as *const i32)`
  59                 if_chain! {
  60                     if let ExprKind::Cast(ref inner_expr, ref _cast_ty) = args[0].kind;
  61                     if let ExprKind::Lit(ref lit) = inner_expr.kind;
  62                     if let LitKind::Int(0, _) = lit.node;
  63                     then {
  64                         span_lint(cx, TRANSMUTING_NULL, expr.span, LINT_MSG)
  65                     }
  66                 }
  67
  68                 // Catching:
  69                 // `std::mem::transmute(std::ptr::null::<i32>())`
  70                 if_chain! {
  71                     if let ExprKind::Call(ref func1, ref args1) = args[0].kind;
  72                     if let ExprKind::Path(ref path1) = func1.kind;
  73                     if match_qpath(path1, &paths::STD_PTR_NULL);
  74                     if args1.is_empty();
  75                     then {
  76                         span_lint(cx, TRANSMUTING_NULL, expr.span, LINT_MSG)
  77                     }
  78                 }
  79
  80                 // FIXME:
  81                 // Also catch transmutations of variables which are known nulls.
  82                 // To do this, MIR const propagation seems to be the better tool.
  83                 // Whenever MIR const prop routines are more developed, this will
  84                 // become available. As of this writing (25/03/19) it is not yet.
  85             }
  86         }
  87     }
  88 }