1 use crate::consts::{constant_context, Constant};
2 use crate::utils::{match_qpath, paths};
3 use clippy_utils::diagnostics::span_lint;
4 use if_chain::if_chain;
5 use rustc_ast::LitKind;
6 use rustc_hir::{Expr, ExprKind};
7 use rustc_lint::{LateContext, LateLintPass, LintContext};
8 use rustc_middle::lint::in_external_macro;
9 use rustc_session::{declare_lint_pass, declare_tool_lint};
11 declare_clippy_lint! {
12 /// **What it does:** Checks for transmute calls which would receive a null pointer.
14 /// **Why is this bad?** Transmuting a null pointer is undefined behavior.
16 /// **Known problems:** Not all cases can be detected at the moment of this writing.
17 /// For example, variables which hold a null pointer and are then fed to a `transmute`
18 /// call, aren't detectable yet.
22 /// let null_ref: &u64 = unsafe { std::mem::transmute(0 as *const u64) };
26 "transmutes from a null pointer to a reference, which is undefined behavior"
29 declare_lint_pass!(TransmutingNull => [TRANSMUTING_NULL]);
31 const LINT_MSG: &str = "transmuting a known null pointer into a reference";
33 impl<'tcx> LateLintPass<'tcx> for TransmutingNull {
34 fn check_expr(&mut self, cx: &LateContext<'tcx>, expr: &'tcx Expr<'_>) {
35 if in_external_macro(cx.sess(), expr.span) {
40 if let ExprKind::Call(ref func, ref args) = expr.kind;
41 if let ExprKind::Path(ref path) = func.kind;
42 if match_qpath(path, &paths::STD_MEM_TRANSMUTE);
47 // Catching transmute over constants that resolve to `null`.
48 let mut const_eval_context = constant_context(cx, cx.typeck_results());
50 if let ExprKind::Path(ref _qpath) = args[0].kind;
51 let x = const_eval_context.expr(&args[0]);
52 if let Some(Constant::RawPtr(0)) = x;
54 span_lint(cx, TRANSMUTING_NULL, expr.span, LINT_MSG)
59 // `std::mem::transmute(0 as *const i32)`
61 if let ExprKind::Cast(ref inner_expr, ref _cast_ty) = args[0].kind;
62 if let ExprKind::Lit(ref lit) = inner_expr.kind;
63 if let LitKind::Int(0, _) = lit.node;
65 span_lint(cx, TRANSMUTING_NULL, expr.span, LINT_MSG)
70 // `std::mem::transmute(std::ptr::null::<i32>())`
72 if let ExprKind::Call(ref func1, ref args1) = args[0].kind;
73 if let ExprKind::Path(ref path1) = func1.kind;
74 if match_qpath(path1, &paths::STD_PTR_NULL);
77 span_lint(cx, TRANSMUTING_NULL, expr.span, LINT_MSG)
82 // Also catch transmutations of variables which are known nulls.
83 // To do this, MIR const propagation seems to be the better tool.
84 // Whenever MIR const prop routines are more developed, this will
85 // become available. As of this writing (25/03/19) it is not yet.