raw_ptr.qll

import cpp
import common

/**
 * General type that contains raw pointers, e.g. raw pointer fields,
 * pointers in collections etc.
 */
abstract class GeneralPointerType extends Type {
  /**
   * Gets the underlying raw pointer type.
   */
  abstract Type getPointerType();
}

/**
 * General field that are `GeneralPointerType`.
 */
abstract class GeneralPointerField extends Field {
  /**
   * Gets the underlying raw pointer type
   */
  abstract Type getPointerType();

  /**
   * Gets a clean up that will reset the raw pointer.
   */
  abstract Expr getACleanup();
}

/** Normal managed pointers. */
class RawPtr extends Class {
  RawPtr() { this.getName().matches("raw_ptr%") }
  Type getManagedType() { result = this.getTemplateArgument(0) }
}

/** Normal managed pointer fields. */
class RawPtrField extends GeneralPointerField {
  RawPtrField() { this.getType().stripType() instanceof RawPtr }

  override Type getPointerType() { result = getType().stripType().(RawPtr).getManagedType() }

  override Expr getACleanup() {
    exists(GeneralAssignment assign |
      assign.getLValue() = this.getAnAccess() and
      assign.getRValue() instanceof Zero and
      result = assign.getLValue()
    )
  }
}

/**
 * A normal raw pointer field.
 */
class PointerField extends GeneralPointerField {
  PointerField() {
    getType().getUnspecifiedType() instanceof PointerType and
    //Needs to exclude some types that are less interesting (mostly generated code)
    not getDeclaringType().getName().matches("ArrayDataViewImpl%") and
    not getDeclaringType().getName().matches("AllocatedData") and
    not getDeclaringType().getName().matches("AlignedUnion") and
    not getDeclaringType().getName().matches("ArrayViewBase%") and
    not getDeclaringType().getName().matches("AssociatedInterface%") and
    not hasName("receiver_") and
    (
      //Only interested in certain area of the code. Can tweak
      getFile().getAbsolutePath().matches("%/browser/%") or
      getFile().getAbsolutePath().matches("%/media/%") or
      getFile().getAbsolutePath().matches("%/components/%")
    )
  }

  override Type getPointerType() { result = this.getType().stripType() }

  override Expr getACleanup() {
    exists(GeneralAssignment assign |
      assign.getLValue() = this.getAnAccess() and
      assign.getRValue() instanceof Zero and
      result = assign.getLValue()
    )
  }
}

/**
 * A field that stores raw pointers in map.
 */
class PointerMapField extends MapField, GeneralPointerField {
  PointerMapField() { getType().(MapType).getComponentType() instanceof PointerType }

  override Type getPointerType() {
    exists(Type t |
      t = getType().(MapType).getComponentType() and
      t instanceof PointerType and
      result = t.stripType()
    )
  }

  override Expr getACleanup() {
    exists(FunctionCall fc |
      fc.getTarget().hasName("erase") or
      fc.getTarget().hasName("clear") or
      fc.getTarget().hasName("remove")
    |
      getQualifier(fc) = this.getAnAccess() and
      result = fc
    )
  }
}

/**
 * A field that stores raw pointers in list/vector.
 */
class PointerListField extends ListField, GeneralPointerField {
  PointerListField() { getType().(MapType).getComponentType() instanceof PointerType }

  override Type getPointerType() {
    exists(Type t |
      t = getType().(ListType).getComponentType() and
      t instanceof PointerType and
      result = t.stripType()
    )
  }

  override Expr getACleanup() {
    exists(FunctionCall fc |
      fc.getTarget().hasName("erase") or
      fc.getTarget().hasName("clear") or
      fc.getTarget().hasName("remove")
    |
      getQualifier(fc) = this.getAnAccess() and
      result = fc
    )
  }
}