|
| 1 | +/** |
| 2 | + * @id cpp/misra/dynamic-memory-should-not-be-used |
| 3 | + * @name RULE-21-6-1: Dynamic memory should not be used |
| 4 | + * @description Heap allocation is prohibited unless explicitly justified. |
| 5 | + * @kind problem |
| 6 | + * @precision very-high |
| 7 | + * @problem.severity warning |
| 8 | + * @tags external/misra/id/rule-21-6-1 |
| 9 | + * scope/single-translation-unit |
| 10 | + * correctness |
| 11 | + * maintainability |
| 12 | + * external/misra/enforcement/undecidable |
| 13 | + * external/misra/obligation/advisory |
| 14 | + */ |
| 15 | + |
| 16 | +import cpp |
| 17 | +import codingstandards.cpp.misra |
| 18 | + |
| 19 | +class PlacementNewOrNewArrayAllocationFunction extends AllocationFunction { |
| 20 | + /* NOTE: Duplicate with RULE-21-6-2 */ |
| 21 | + PlacementNewOrNewArrayAllocationFunction() { |
| 22 | + this.getName() in ["operator new", "operator new[]"] and |
| 23 | + this.getParameter(0).getType().resolveTypedefs*() instanceof Size_t and |
| 24 | + this.getAParameter().getUnderlyingType() instanceof VoidPointerType |
| 25 | + } |
| 26 | +} |
| 27 | + |
| 28 | +/** |
| 29 | + * A function that has namespace `std` and has name `allocate` or `deallocate`, including but not limited to: |
| 30 | + * - `std::allocator<T>::allocate(std::size_t)` |
| 31 | + * - `std::allocator<T>::dellocate(T*, std::size_t)` |
| 32 | + * - `std::pmr::memory_resource::allocate(std::size_t, std::size_t)` |
| 33 | + * - `std::pmr::memory_resource::deallocate(void*, std::size_t, std::size_t)` |
| 34 | + */ |
| 35 | +class AllocateOrDeallocateStdlibMemberFunction extends MemberFunction { |
| 36 | + /* NOTE: Duplicate with RULE-21-6-2 */ |
| 37 | + AllocateOrDeallocateStdlibMemberFunction() { |
| 38 | + this.getName() in ["allocate", "deallocate"] and |
| 39 | + this.getNamespace().getParentNamespace*() instanceof StdNamespace |
| 40 | + } |
| 41 | +} |
| 42 | + |
| 43 | +/** |
| 44 | + * A function that directly or indirectly allocates dynamic memory. |
| 45 | + */ |
| 46 | +abstract class DynamicMemoryAllocatingFunction extends Function { } |
| 47 | + |
| 48 | +/** |
| 49 | + * A function that directly allocates dynamic memory. |
| 50 | + * Includes C allocation functions (malloc, calloc, realloc, aligned_alloc) |
| 51 | + * and C++ allocation functions (operator new, operator new[]). |
| 52 | + * |
| 53 | + * This excludes placement-new operators, as they do not allocate memory themselves. |
| 54 | + */ |
| 55 | +class DirectDynamicMemoryAllocatingFunction extends DynamicMemoryAllocatingFunction { |
| 56 | + DirectDynamicMemoryAllocatingFunction() { |
| 57 | + this instanceof AllocationFunction and |
| 58 | + not this instanceof PlacementNewOrNewArrayAllocationFunction |
| 59 | + } |
| 60 | +} |
| 61 | + |
| 62 | +/** |
| 63 | + * A function that indirectly allocates dynamic memory through |
| 64 | + * standard library types that use `std::allocator` or operator new internally. |
| 65 | + * Includes constructors of containers, strings, streams, regex, and other |
| 66 | + * allocating standard library types. |
| 67 | + */ |
| 68 | +abstract class IndirectDynamicMemoryAllocatingFunction extends DynamicMemoryAllocatingFunction { } |
| 69 | + |
| 70 | +/** |
| 71 | + * A constructor of a standard library container that uses `std::allocator` directly |
| 72 | + * as template argument or under the hood as the default value of the template argument. |
| 73 | + * Includes `vector`, `deque`, `list`, `forward_list`, `set`, `map`, `multiset`, `multimap`, |
| 74 | + * `unordered_set`, `unordered_map`, `unordered_multiset`, `unordered_multimap`, and `valarray`. |
| 75 | + */ |
| 76 | +class AllocatorContainerConstructor extends IndirectDynamicMemoryAllocatingFunction { |
| 77 | + AllocatorContainerConstructor() { |
| 78 | + this instanceof Constructor and |
| 79 | + this.getDeclaringType() |
| 80 | + .hasQualifiedName("std", |
| 81 | + [ |
| 82 | + "vector", "deque", "list", "forward_list", "set", "map", "multiset", "multimap", |
| 83 | + "unordered_set", "unordered_map", "unordered_multiset", "unordered_multimap", "valarray" |
| 84 | + ]) |
| 85 | + } |
| 86 | +} |
| 87 | + |
| 88 | +/** |
| 89 | + * A constructor of a standard library string type that uses std::allocator. |
| 90 | + * Includes basic_string and its aliases (string, wstring, u16string, u32string). |
| 91 | + */ |
| 92 | +class AllocatorStringConstructor extends IndirectDynamicMemoryAllocatingFunction { |
| 93 | + AllocatorStringConstructor() { |
| 94 | + this instanceof Constructor and |
| 95 | + this.getDeclaringType() |
| 96 | + .hasQualifiedName("std", ["basic_string", "string", "wstring", "u16string", "u32string"]) |
| 97 | + } |
| 98 | +} |
| 99 | + |
| 100 | +/** |
| 101 | + * A constructor of a container adaptor that contains an allocating container by default. |
| 102 | + * Includes stack (contains deque), queue (contains deque), and priority_queue (contains vector). |
| 103 | + */ |
| 104 | +class ContainerAdaptorConstructor extends IndirectDynamicMemoryAllocatingFunction { |
| 105 | + ContainerAdaptorConstructor() { |
| 106 | + this instanceof Constructor and |
| 107 | + this.getDeclaringType().hasQualifiedName("std", ["stack", "queue", "priority_queue"]) |
| 108 | + } |
| 109 | +} |
| 110 | + |
| 111 | +/** |
| 112 | + * A constructor of a string stream that contains std::basic_string for buffer storage. |
| 113 | + * Includes `basic_stringstream`, `stringstream`, `wstringstream`, |
| 114 | + * `basic_istringstream`, `istringstream`, `wistringstream`, |
| 115 | + * `basic_ostringstream`, `ostringstream`, `wostringstream`. |
| 116 | + */ |
| 117 | +class StringStreamConstructor extends IndirectDynamicMemoryAllocatingFunction { |
| 118 | + StringStreamConstructor() { |
| 119 | + this instanceof Constructor and |
| 120 | + this.getDeclaringType() |
| 121 | + .hasQualifiedName("std", |
| 122 | + [ |
| 123 | + "basic_stringstream", "stringstream", "wstringstream", "basic_istringstream", |
| 124 | + "istringstream", "wistringstream", "basic_ostringstream", "ostringstream", |
| 125 | + "wostringstream" |
| 126 | + ]) |
| 127 | + } |
| 128 | +} |
| 129 | + |
| 130 | +/** |
| 131 | + * A constructor of a file stream that allocates an internal I/O buffer via `std::basic_filebuf`. |
| 132 | + * Includes `basic_fstream`, `fstream`, `wfstream`, |
| 133 | + * `basic_ifstream`, `ifstream`, `wifstream`, |
| 134 | + * `basic_ofstream`, `ofstream`, `wofstream`. |
| 135 | + */ |
| 136 | +class FileStreamConstructor extends IndirectDynamicMemoryAllocatingFunction { |
| 137 | + FileStreamConstructor() { |
| 138 | + this instanceof Constructor and |
| 139 | + this.getDeclaringType() |
| 140 | + .hasQualifiedName("std", |
| 141 | + [ |
| 142 | + "basic_fstream", "fstream", "wfstream", "basic_ifstream", "ifstream", "wifstream", |
| 143 | + "basic_ofstream", "ofstream", "wofstream" |
| 144 | + ]) |
| 145 | + } |
| 146 | +} |
| 147 | + |
| 148 | +/** |
| 149 | + * A constructor of a regex type that allocates for compiled pattern representation. |
| 150 | + * Includes `basic_regex`, `regex`, `wregex`. |
| 151 | + */ |
| 152 | +class RegexConstructor extends IndirectDynamicMemoryAllocatingFunction { |
| 153 | + RegexConstructor() { |
| 154 | + this instanceof Constructor and |
| 155 | + this.getDeclaringType().hasQualifiedName("std", ["basic_regex", "regex", "wregex"]) |
| 156 | + } |
| 157 | +} |
| 158 | + |
| 159 | +/** |
| 160 | + * A constructor of a type-erasing wrapper that may allocate via operator new. |
| 161 | + * SBO (small buffer optimization) is not guaranteed by the standard. |
| 162 | + * Includes `std::function` and `std::any`. |
| 163 | + */ |
| 164 | +class TypeErasureConstructor extends IndirectDynamicMemoryAllocatingFunction { |
| 165 | + TypeErasureConstructor() { |
| 166 | + this instanceof Constructor and |
| 167 | + this.getDeclaringType().hasQualifiedName("std", ["function", "any"]) |
| 168 | + } |
| 169 | +} |
| 170 | + |
| 171 | +/** |
| 172 | + * A constructor of a type that heap-allocates shared state for |
| 173 | + * cross-object or cross-thread communication. |
| 174 | + * Includes promise, future, shared_future, packaged_task, and locale. |
| 175 | + */ |
| 176 | +class SharedStateConstructor extends IndirectDynamicMemoryAllocatingFunction { |
| 177 | + SharedStateConstructor() { |
| 178 | + this instanceof Constructor and |
| 179 | + this.getDeclaringType() |
| 180 | + .hasQualifiedName("std", ["promise", "future", "shared_future", "packaged_task", "locale"]) |
| 181 | + } |
| 182 | +} |
| 183 | + |
| 184 | +/** |
| 185 | + * A constructor of `std::thread` that heap-allocates callable and arguments |
| 186 | + * for transfer to the new thread. |
| 187 | + */ |
| 188 | +class ThreadConstructor extends IndirectDynamicMemoryAllocatingFunction { |
| 189 | + ThreadConstructor() { |
| 190 | + this instanceof Constructor and |
| 191 | + this.getDeclaringType().hasQualifiedName("std", "thread") |
| 192 | + } |
| 193 | +} |
| 194 | + |
| 195 | +/** |
| 196 | + * A constructor of `std::filesystem::path` that contains `std::basic_string` for path storage. |
| 197 | + */ |
| 198 | +class FilesystemPathConstructor extends IndirectDynamicMemoryAllocatingFunction { |
| 199 | + FilesystemPathConstructor() { |
| 200 | + this instanceof Constructor and |
| 201 | + this.getDeclaringType().hasQualifiedName("std::filesystem", "path") |
| 202 | + } |
| 203 | +} |
| 204 | + |
| 205 | +/** |
| 206 | + * A smart pointer factory function that allocates dynamic memory. |
| 207 | + * Includes `make_unique`, `make_shared`, and `allocate_shared`. |
| 208 | + */ |
| 209 | +class SmartPointerFactoryFunction extends IndirectDynamicMemoryAllocatingFunction { |
| 210 | + SmartPointerFactoryFunction() { |
| 211 | + this.hasQualifiedName("std", ["make_unique", "make_shared", "allocate_shared"]) |
| 212 | + } |
| 213 | +} |
| 214 | + |
| 215 | +/** |
| 216 | + * The `std::async` function that allocates callable storage and shared state for the future. |
| 217 | + */ |
| 218 | +class AsyncFunction extends IndirectDynamicMemoryAllocatingFunction { |
| 219 | + AsyncFunction() { this.hasQualifiedName("std", "async") } |
| 220 | +} |
| 221 | + |
| 222 | +/** |
| 223 | + * A function that directly or indirectly deallocates dynamic memory. |
| 224 | + */ |
| 225 | +abstract class DynamicMemoryDeallocatingFunction extends Function { } |
| 226 | + |
| 227 | +/** |
| 228 | + * A function that directly deallocates dynamic memory. |
| 229 | + * Includes C allocation functions (`free`) |
| 230 | + * and C++ allocation functions (`operator delete`, `operator delete[]`). |
| 231 | + */ |
| 232 | +class DirectDynamicMemoryDeallocatingFunction extends DynamicMemoryDeallocatingFunction { } |
| 233 | + |
| 234 | +/** |
| 235 | + * A function that indirectly allocates dynamic memory through |
| 236 | + * standard library classes and their member functions (e.g. `std::allocator::deallocate`). |
| 237 | + */ |
| 238 | +class IndirectDynamicMemoryDeallocatingFunction extends DynamicMemoryDeallocatingFunction { } |
| 239 | + |
| 240 | +from FunctionCall call |
| 241 | +where |
| 242 | + not isExcluded(call, Banned7Package::dynamicMemoryShouldNotBeUsedQuery()) and |
| 243 | + call.getTarget() instanceof DynamicMemoryAllocatingFunction |
| 244 | +select call, call.getTarget().toString() |
0 commit comments