clippy_lints/src/transmuting_null.rs

   1 use clippy_utils::consts::{constant_context, Constant};
   2 use clippy_utils::diagnostics::span_lint;
   3 use clippy_utils::is_expr_diagnostic_item;
   4 use if_chain::if_chain;
   5 use rustc_ast::LitKind;
   6 use rustc_hir::{Expr, ExprKind};
   7 use rustc_lint::{LateContext, LateLintPass, LintContext};
   8 use rustc_middle::lint::in_external_macro;
   9 use rustc_session::{declare_lint_pass, declare_tool_lint};
  10 use rustc_span::symbol::sym;
  11
  12 declare_clippy_lint! {
  13     /// ### What it does
  14     /// Checks for transmute calls which would receive a null pointer.
  15     ///
  16     /// ### Why is this bad?
  17     /// Transmuting a null pointer is undefined behavior.
  18     ///
  19     /// ### Known problems
  20     /// Not all cases can be detected at the moment of this writing.
  21     /// For example, variables which hold a null pointer and are then fed to a `transmute`
  22     /// call, aren't detectable yet.
  23     ///
  24     /// ### Example
  25     /// ```rust
  26     /// let null_ref: &u64 = unsafe { std::mem::transmute(0 as *const u64) };
  27     /// ```
  28     #[clippy::version = "1.35.0"]
  29     pub TRANSMUTING_NULL,
  30     correctness,
  31     "transmutes from a null pointer to a reference, which is undefined behavior"
  32 }
  33
  34 declare_lint_pass!(TransmutingNull => [TRANSMUTING_NULL]);
  35
  36 const LINT_MSG: &str = "transmuting a known null pointer into a reference";
  37
  38 impl<'tcx> LateLintPass<'tcx> for TransmutingNull {
  39     fn check_expr(&mut self, cx: &LateContext<'tcx>, expr: &'tcx Expr<'_>) {
  40         if in_external_macro(cx.sess(), expr.span) {
  41             return;
  42         }
  43
  44         if_chain! {
  45             if let ExprKind::Call(func, [arg]) = expr.kind;
  46             if is_expr_diagnostic_item(cx, func, sym::transmute);
  47
  48             then {
  49                 // Catching transmute over constants that resolve to `null`.
  50                 let mut const_eval_context = constant_context(cx, cx.typeck_results());
  51                 if_chain! {
  52                     if let ExprKind::Path(ref _qpath) = arg.kind;
  53                     if let Some(Constant::RawPtr(x)) = const_eval_context.expr(arg);
  54                     if x == 0;
  55                     then {
  56                         span_lint(cx, TRANSMUTING_NULL, expr.span, LINT_MSG)
  57                     }
  58                 }
  59
  60                 // Catching:
  61                 // `std::mem::transmute(0 as *const i32)`
  62                 if_chain! {
  63                     if let ExprKind::Cast(inner_expr, _cast_ty) = arg.kind;
  64                     if let ExprKind::Lit(ref lit) = inner_expr.kind;
  65                     if let LitKind::Int(0, _) = lit.node;
  66                     then {
  67                         span_lint(cx, TRANSMUTING_NULL, expr.span, LINT_MSG)
  68                     }
  69                 }
  70
  71                 // Catching:
  72                 // `std::mem::transmute(std::ptr::null::<i32>())`
  73                 if_chain! {
  74                     if let ExprKind::Call(func1, []) = arg.kind;
  75                     if is_expr_diagnostic_item(cx, func1, sym::ptr_null);
  76                     then {
  77                         span_lint(cx, TRANSMUTING_NULL, expr.span, LINT_MSG)
  78                     }
  79                 }
  80
  81                 // FIXME:
  82                 // Also catch transmutations of variables which are known nulls.
  83                 // To do this, MIR const propagation seems to be the better tool.
  84                 // Whenever MIR const prop routines are more developed, this will
  85                 // become available. As of this writing (25/03/19) it is not yet.
  86             }
  87         }
  88     }
  89 }