|
| 1 | +use rustc_index::IndexVec; |
| 2 | +use rustc_middle::mir::interpret::Scalar; |
| 3 | +use rustc_middle::mir::*; |
| 4 | +use rustc_middle::ty::{Ty, TyCtxt}; |
| 5 | +use rustc_session::Session; |
| 6 | + |
| 7 | +use crate::check_pointers::{BorrowCheckMode, PointerCheck, check_pointers}; |
| 8 | + |
| 9 | +pub(super) struct CheckNull; |
| 10 | + |
| 11 | +impl<'tcx> crate::MirPass<'tcx> for CheckNull { |
| 12 | + fn is_enabled(&self, sess: &Session) -> bool { |
| 13 | + sess.ub_checks() |
| 14 | + } |
| 15 | + |
| 16 | + fn run_pass(&self, tcx: TyCtxt<'tcx>, body: &mut Body<'tcx>) { |
| 17 | + check_pointers(tcx, body, &[], insert_null_check, BorrowCheckMode::IncludeBorrows); |
| 18 | + } |
| 19 | + |
| 20 | + fn is_required(&self) -> bool { |
| 21 | + true |
| 22 | + } |
| 23 | +} |
| 24 | + |
| 25 | +fn insert_null_check<'tcx>( |
| 26 | + tcx: TyCtxt<'tcx>, |
| 27 | + pointer: Place<'tcx>, |
| 28 | + pointee_ty: Ty<'tcx>, |
| 29 | + local_decls: &mut IndexVec<Local, LocalDecl<'tcx>>, |
| 30 | + stmts: &mut Vec<Statement<'tcx>>, |
| 31 | + source_info: SourceInfo, |
| 32 | +) -> PointerCheck<'tcx> { |
| 33 | + // Cast the pointer to a *const (). |
| 34 | + let const_raw_ptr = Ty::new_imm_ptr(tcx, tcx.types.unit); |
| 35 | + let rvalue = Rvalue::Cast(CastKind::PtrToPtr, Operand::Copy(pointer), const_raw_ptr); |
| 36 | + let thin_ptr = local_decls.push(LocalDecl::with_source_info(const_raw_ptr, source_info)).into(); |
| 37 | + stmts |
| 38 | + .push(Statement { source_info, kind: StatementKind::Assign(Box::new((thin_ptr, rvalue))) }); |
| 39 | + |
| 40 | + // Transmute the pointer to a usize (equivalent to `ptr.addr()`). |
| 41 | + let rvalue = Rvalue::Cast(CastKind::Transmute, Operand::Copy(thin_ptr), tcx.types.usize); |
| 42 | + let addr = local_decls.push(LocalDecl::with_source_info(tcx.types.usize, source_info)).into(); |
| 43 | + stmts.push(Statement { source_info, kind: StatementKind::Assign(Box::new((addr, rvalue))) }); |
| 44 | + |
| 45 | + // Get size of the pointee (zero-sized reads and writes are allowed). |
| 46 | + let rvalue = Rvalue::NullaryOp(NullOp::SizeOf, pointee_ty); |
| 47 | + let sizeof_pointee = |
| 48 | + local_decls.push(LocalDecl::with_source_info(tcx.types.usize, source_info)).into(); |
| 49 | + stmts.push(Statement { |
| 50 | + source_info, |
| 51 | + kind: StatementKind::Assign(Box::new((sizeof_pointee, rvalue))), |
| 52 | + }); |
| 53 | + |
| 54 | + // Check that the pointee is not a ZST. |
| 55 | + let zero = Operand::Constant(Box::new(ConstOperand { |
| 56 | + span: source_info.span, |
| 57 | + user_ty: None, |
| 58 | + const_: Const::Val(ConstValue::Scalar(Scalar::from_target_usize(0, &tcx)), tcx.types.usize), |
| 59 | + })); |
| 60 | + let is_pointee_no_zst = |
| 61 | + local_decls.push(LocalDecl::with_source_info(tcx.types.bool, source_info)).into(); |
| 62 | + stmts.push(Statement { |
| 63 | + source_info, |
| 64 | + kind: StatementKind::Assign(Box::new(( |
| 65 | + is_pointee_no_zst, |
| 66 | + Rvalue::BinaryOp(BinOp::Ne, Box::new((Operand::Copy(sizeof_pointee), zero.clone()))), |
| 67 | + ))), |
| 68 | + }); |
| 69 | + |
| 70 | + // Check whether the pointer is null. |
| 71 | + let is_null = local_decls.push(LocalDecl::with_source_info(tcx.types.bool, source_info)).into(); |
| 72 | + stmts.push(Statement { |
| 73 | + source_info, |
| 74 | + kind: StatementKind::Assign(Box::new(( |
| 75 | + is_null, |
| 76 | + Rvalue::BinaryOp(BinOp::Eq, Box::new((Operand::Copy(addr), zero))), |
| 77 | + ))), |
| 78 | + }); |
| 79 | + |
| 80 | + // We want to throw an exception if the pointer is null and doesn't point to a ZST. |
| 81 | + let should_throw_exception = |
| 82 | + local_decls.push(LocalDecl::with_source_info(tcx.types.bool, source_info)).into(); |
| 83 | + stmts.push(Statement { |
| 84 | + source_info, |
| 85 | + kind: StatementKind::Assign(Box::new(( |
| 86 | + should_throw_exception, |
| 87 | + Rvalue::BinaryOp( |
| 88 | + BinOp::BitAnd, |
| 89 | + Box::new((Operand::Copy(is_null), Operand::Copy(is_pointee_no_zst))), |
| 90 | + ), |
| 91 | + ))), |
| 92 | + }); |
| 93 | + |
| 94 | + // The final condition whether this pointer usage is ok or not. |
| 95 | + let is_ok = local_decls.push(LocalDecl::with_source_info(tcx.types.bool, source_info)).into(); |
| 96 | + stmts.push(Statement { |
| 97 | + source_info, |
| 98 | + kind: StatementKind::Assign(Box::new(( |
| 99 | + is_ok, |
| 100 | + Rvalue::UnaryOp(UnOp::Not, Operand::Copy(should_throw_exception)), |
| 101 | + ))), |
| 102 | + }); |
| 103 | + |
| 104 | + // Emit a PointerCheck that asserts on the condition and otherwise triggers |
| 105 | + // a AssertKind::NullPointerDereference. |
| 106 | + PointerCheck { |
| 107 | + cond: Operand::Copy(is_ok), |
| 108 | + assert_kind: Box::new(AssertKind::NullPointerDereference), |
| 109 | + } |
| 110 | +} |
0 commit comments