path: root/gcc/d/dmd/safe.d

/**
 * Checks whether member access or array casting is allowed in `@safe` code.
 *
 * Specification: $(LINK2 https://dlang.org/spec/function.html#function-safety, Function Safety)
 *
 * Copyright:   Copyright (C) 1999-2025 by The D Language Foundation, All Rights Reserved
 * Authors:     $(LINK2 https://www.digitalmars.com, Walter Bright)
 * License:     $(LINK2 https://www.boost.org/LICENSE_1_0.txt, Boost License 1.0)
 * Source:      $(LINK2 https://github.com/dlang/dmd/blob/master/compiler/src/dmd/safe.d, _safe.d)
 * Documentation:  https://dlang.org/phobos/dmd_safe.html
 * Coverage:    https://codecov.io/gh/dlang/dmd/src/master/compiler/src/dmd/safe.d
 */

module dmd.safe;

import core.stdc.stdio;

import dmd.aggregate;
import dmd.astenums;
import dmd.common.outbuffer;
import dmd.dcast : implicitConvTo;
import dmd.dclass;
import dmd.declaration;
import dmd.dscope;
import dmd.dsymbol;
import dmd.dsymbolsem : determineSize;
import dmd.errors;
import dmd.expression;
import dmd.func;
import dmd.funcsem : isRootTraitsCompilesScope;
import dmd.globals : FeatureState, global;
import dmd.id;
import dmd.identifier;
import dmd.location;
import dmd.mtype;
import dmd.rootobject;
import dmd.root.string : fTuple;
import dmd.target;
import dmd.tokens;
import dmd.typesem : hasPointers, arrayOf, size;

/*************************************************************
 * Check for unsafe access in @safe code:
 * 1. read overlapped pointers
 * 2. write misaligned pointers
 * 3. write overlapped storage classes
 * Print error if unsafe.
 * Params:
 *      sc = scope
 *      e = expression to check
 *      readonly = if access is read-only
 *      printmsg = print error message if true
 * Returns:
 *      true if error
 */

bool checkUnsafeAccess(Scope* sc, Expression e, bool readonly, bool printmsg)
{
    //printf("checkUnsafeAccess(e: '%s', readonly: %d, printmsg: %d)\n", e.toChars(), readonly, printmsg);
    if (e.op != EXP.dotVariable)
        return false;
    auto dve = cast(DotVarExp)e;
    VarDeclaration v = dve.var.isVarDeclaration();
    if (!v)
        return false;
    if (!sc.func)
        return false;
    auto ad = v.isMember2();
    if (!ad)
        return false;

    if (v.isSystem())
    {
        if (sc.setUnsafePreview(sc.previews.systemVariables, !printmsg, e.loc,
            "accessing `@system` field `%s.%s`", ad, v))
            return true;
    }

    // This branch shouldn't be here, but unfortunately calling `ad.determineSize`
    // breaks code with circular reference errors. Specifically, test23589.d fails
    if (ad.sizeok != Sizeok.done && !sc.func.isSafeBypassingInference())
        return false;

    // needed to set v.overlapped and v.overlapUnsafe
    if (ad.sizeok != Sizeok.done)
        ad.determineSize(ad.loc);

    import dmd.globals : FeatureState;
    const hasPointers = v.type.hasPointers();
    if (hasPointers)
    {
        if (v.overlapped)
        {
            if (sc.func.isSafeBypassingInference() && sc.setUnsafe(!printmsg, e.loc,
                "accessing overlapped field `%s.%s` with pointers", ad, v))
            {
                return true;
            }
            else
            {
                // @@@DEPRECATED_2.116@@@
                // https://issues.dlang.org/show_bug.cgi?id=20655
                // Inferring `@system` because of union access breaks code,
                // so make it a deprecation safety violation as of 2.106
                // To turn into an error, remove `isSafeBypassingInference` check in the
                // above if statement and remove the else branch
                sc.setUnsafePreview(FeatureState.default_, !printmsg, e.loc,
                    "accessing overlapped field `%s.%s` with pointers", ad, v);
            }
        }
    }

    if (v.type.hasInvariant())
    {
        if (v.overlapped)
        {
            if (sc.setUnsafe(!printmsg, e.loc,
                "accessing overlapped field `%s.%s` with a structs invariant",
                ad, v))
                return true;
        }
    }

    // @@@DEPRECATED_2.119@@@
    // https://issues.dlang.org/show_bug.cgi?id=24477
    // Should probably be turned into an error in a new edition
    if (v.type.hasUnsafeBitpatterns() && v.overlapped && sc.setUnsafePreview(
        FeatureState.default_, !printmsg, e.loc,
        "accessing overlapped field `%s.%s` with unsafe bit patterns", ad, v)
    )
    {
        return true;
    }

    if (readonly || !e.type.isMutable())
        return false;

    if (hasPointers && v.type.toBasetype().ty != Tstruct)
    {
        if ((!ad.type.alignment.isDefault() && ad.type.alignment.get() < target.ptrsize) ||
             (v.offset & (target.ptrsize - 1)))
        {
            if (sc.setUnsafe(!printmsg, e.loc,
                "modifying misaligned pointers through field `%s.%s`", ad, v))
                return true;
        }
    }

    if (v.overlapUnsafe)
    {
        if (sc.setUnsafe(!printmsg, e.loc,
            "modifying field `%s.%s` which overlaps with fields with other storage classes",
            ad, v))
        {
            return true;
        }
    }

    return false;
}


/**********************************************
 * Determine if it is @safe to cast e from tfrom to tto.
 * Params:
 *      e = expression to be cast
 *      tfrom = type of e
 *      tto = type to cast e to
 *      msg = reason why cast is unsafe or deprecated
 * Returns:
 *      true if @safe or deprecated
 */
bool isSafeCast(Expression e, Type tfrom, Type tto, ref string msg)
{
    // Implicit conversions are always safe
    if (tfrom.implicitConvTo(tto))
        return true;

    if (!tto.hasPointers())
        return true;

    auto tfromb = tfrom.toBasetype();
    auto ttob = tto.toBasetype();

    // Casting to void* is always safe, https://github.com/dlang/dmd/issues/20514
    if (ttob.isTypePointer() && ttob.nextOf().toBasetype().ty == Tvoid)
        return true;

    if (ttob.ty == Tclass && tfromb.ty == Tclass)
    {
        ClassDeclaration cdfrom = tfromb.isClassHandle();
        ClassDeclaration cdto = ttob.isClassHandle();
        int offset;

        if (cdfrom == cdto)
            goto Lsame;

        if (!cdfrom.isBaseOf(cdto, &offset) &&
            !((cdfrom.isInterfaceDeclaration() || cdto.isInterfaceDeclaration())
                && cdfrom.classKind == ClassKind.d && cdto.classKind == ClassKind.d))
        {
            msg = "Source object type is incompatible with target type";
            return false;
        }

        // no RTTI
        if (cdfrom.isCPPinterface() || cdto.isCPPinterface())
        {
            msg = "No dynamic type information for extern(C++) classes";
            return false;
        }
        if (cdfrom.classKind == ClassKind.cpp || cdto.classKind == ClassKind.cpp)
            msg = "No dynamic type information for extern(C++) classes";

    Lsame:
        if (!MODimplicitConv(tfromb.mod, ttob.mod))
        {
            msg = "Incompatible type qualifier";
            return false;
        }
        return true;
    }

    if (ttob.ty == Tarray && tfromb.ty == Tsarray) // https://issues.dlang.org/show_bug.cgi?id=12502
        tfromb = tfromb.nextOf().arrayOf();

    if (ttob.ty == Tarray   && tfromb.ty == Tarray ||
        ttob.ty == Tpointer && tfromb.ty == Tpointer)
    {
        Type ttobn = ttob.nextOf().toBasetype();
        Type tfromn = tfromb.nextOf().toBasetype();

        /* From void[] to anything mutable is unsafe because:
         *  int*[] api;
         *  void[] av = api;
         *  int[] ai = cast(int[]) av;
         *  ai[0] = 7;
         *  *api[0] crash!
         */
        if (tfromn.ty == Tvoid && ttobn.isMutable())
        {
            if (ttob.ty == Tarray && e.op == EXP.arrayLiteral)
                return true;
            msg = "`void` data may contain pointers and target element type is mutable";
            return false;
        }

        // If the struct is opaque we don't know about the struct members then the cast becomes unsafe
        if (ttobn.ty == Tstruct && !(cast(TypeStruct)ttobn).sym.members)
        {
            msg = "Target element type is opaque";
            return false;
        }
        if (tfromn.ty == Tstruct && !(cast(TypeStruct)tfromn).sym.members)
        {
            msg = "Source element type is opaque";
            return false;
        }

        if (e.op != EXP.arrayLiteral)
        {
            // For bool, only 0 and 1 are safe values
            // Runtime array cast reinterprets data
            if (ttobn.ty == Tbool && tfromn.ty != Tbool)
                msg = "Source element may have bytes which are not 0 or 1";
            else if (ttobn.hasUnsafeBitpatterns())
                msg = "Target element type has unsafe bit patterns";

            // Can't alias a bool pointer with a non-bool pointer
            if (ttobn.ty != Tbool && tfromn.ty == Tbool && ttobn.isMutable())
                msg = "Target element could be assigned a byte which is not 0 or 1";
            else if (tfromn.hasUnsafeBitpatterns() && ttobn.isMutable())
                msg = "Source element type has unsafe bit patterns and target element type is mutable";
        }

        const frompointers = tfromn.hasPointers();
        const topointers = ttobn.hasPointers();

        if (frompointers && !topointers && ttobn.isMutable())
        {
            msg = "Target element type is mutable and source element type contains a pointer";
            return false;
        }

        if (!frompointers && topointers)
        {
            msg = "Target element type contains a pointer";
            return false;
        }

        if (!topointers &&
            ttobn.ty != Tfunction && tfromn.ty != Tfunction &&
            (ttob.ty == Tarray || ttobn.size() <= tfromn.size()) &&
            MODimplicitConv(tfromn.mod, ttobn.mod))
        {
            return true;
        }
    }
    msg = "Source type is incompatible with target type containing a pointer";
    return false;
}

/*************************************************
 * Check for unsafe use of `.ptr` or `.funcptr`
 * Params:
 *      sc = context
 *      e = expression for error messages
 *      id = `ptr` or `funcptr`
 *      flag = DotExpFlag
 * Returns:
 *      true if error
 */
bool checkUnsafeDotExp(Scope* sc, Expression e, Identifier id, int flag)
{
    if (!(flag & DotExpFlag.noDeref)) // this use is attempting a dereference
    {
        if (id == Id.ptr)
            return sc.setUnsafe(false, e.loc, "using `%s.ptr` (instead of `&%s[0])`", e, e);
        return sc.setUnsafe(false, e.loc, "using `%s.%s`", e, id);
    }
    return false;
}

/**************************************
 * Safer D adds safety checks to functions with the default
 * trust setting.
 */
bool isSaferD(FuncDeclaration fd)
{
    return fd.type.toTypeFunction().trust == TRUST.default_ && fd.saferD;
}

bool isSafe(FuncDeclaration fd)
{
    if (fd.safetyInprocess)
        setFunctionToUnsafe(fd);
    return fd.type.toTypeFunction().trust == TRUST.safe;
}

extern (D) bool isSafeBypassingInference(FuncDeclaration fd)
{
    return !(fd.safetyInprocess) && fd.isSafe();
}

bool isTrusted(FuncDeclaration fd)
{
    if (fd.safetyInprocess)
        setFunctionToUnsafe(fd);
    return fd.type.toTypeFunction().trust == TRUST.trusted;
}

/*****************************************************
 * Report safety violation for function `fd`, or squirrel away
 * error message in fd.safetyViolation if needed later.
 * Call when `fd` was just inferred to be @system OR
 * `fd` was @safe and an tried something unsafe.
 * Params:
 *   fd    = function we're gonna rat on
 *   gag   = suppress error message (used in escape.d)
 *   loc   = location of error
 *   format = printf-style format string
 *   args  = arguments for %s format specifier
 */
extern (D) void reportSafeError(FuncDeclaration fd, bool gag, Loc loc,
    const(char)* format, RootObject[] args...)
{
    if (fd.type.toTypeFunction().trust == TRUST.system) // function was just inferred to be @system
    {
        if (format)
        {
            fd.safetyViolation = new AttributeViolation(loc, format, args);
        }
        else if (args.length > 0)
        {
            if (FuncDeclaration fd2 = (cast(Dsymbol) args[0]).isFuncDeclaration())
            {
                fd.safetyViolation = new AttributeViolation(loc, fd2); // call to non-@nogc function
            }
        }
    }
    else if (fd.isSafe() || fd.isSaferD())
    {
        if (!gag && format)
        {
            OutBuffer buf;
            buf.writestring(AttributeViolation(loc, format, args).action);
            if (fd.isSafe())
                buf.writestring(" is not allowed in a `@safe` function");
            else
            {
                version (IN_GCC)
                    buf.writestring(" is not allowed in a function with default safety with `-fpreview=safer`");
                else
                    buf.writestring(" is not allowed in a function with default safety with `-preview=safer`");
            }
            .error(loc, "%s", buf.extractChars());
        }
    }
}


/**********************************************
 * Function is doing something unsafe. If inference
 * is in process, commit the function to be @system.
 * Params:
 *      fd = the naughty function
 * Returns:
 *      true if this is a safe function and so an error OR is inferred to be @system,
 *      false otherwise.
 */
extern (D) bool setFunctionToUnsafe(FuncDeclaration fd)
{
    if (fd.safetyInprocess)
    {
        fd.safetyInprocess = false;
        fd.type.toTypeFunction().trust = TRUST.system;

        if (fd.fes)
            setFunctionToUnsafe(fd.fes.func);
        return true;
    }
    else if (fd.isSafe() || fd.isSaferD())
        return true;
    return false;
}


/**************************************
 * The function is calling `@system` function `f`, so mark it as unsafe.
 *
 * Params:
 *   fd = caller
 *   f = function being called (needed for diagnostic of inferred functions)
 * Returns: whether there's a safe error
 */
extern (D) bool setUnsafeCall(FuncDeclaration fd, FuncDeclaration f)
{
    if (setFunctionToUnsafe(fd))
    {
        reportSafeError(fd, false, f.loc, null, f, null);
        return fd.isSafe();
    }
    return false;
}

/**************************************
 * A statement / expression in this scope is not `@safe`,
 * so mark the enclosing function as `@system`
 *
 * Params:
 *   sc = scope that the unsafe statement / expression is in
 *   gag = surpress error message (used in escape.d)
 *   loc = location of error
 *   format = printf-style format string
 *   args  = arguments for format string
 * Returns: whether there is a safe error
 */
bool setUnsafe(Scope* sc, bool gag, Loc loc, const(char)* format, RootObject[] args...)
{
    if (sc.intypeof)
        return false; // typeof(cast(int*)0) is safe

    if (sc.debug_) // debug {} scopes are permissive
        return false;

    if (!sc.func)
    {
        if (sc.varDecl)
        {
            if (sc.varDecl.storage_class & STC.safe)
            {
                string action = AttributeViolation(loc, format, args).action;
                .error(loc, "%.*s can't initialize `@safe` variable `%s`", action.fTuple.expand, sc.varDecl.toChars());
                return true;
            }
            else if (!(sc.varDecl.storage_class & STC.trusted))
            {
                sc.varDecl.storage_class |= STC.system;
                sc.varDecl.systemInferred = true;
            }
        }
        return false;
    }


    if (isRootTraitsCompilesScope(sc)) // __traits(compiles, x)
    {
        if (sc.func.isSafeBypassingInference())
        {
            // Message wil be gagged, but still call error() to update global.errors and for
            // -verrors=spec
            string action = AttributeViolation(loc, format, args).action;
            .error(loc, "%.*s is not allowed in a `@safe` function", action.fTuple.expand);
            return true;
        }
        return false;
    }

    if (setFunctionToUnsafe(sc.func))
    {
        if (format || args.length > 0)
        {
            reportSafeError(sc.func, gag, loc, format, args);
        }
        return sc.func.isSafe(); // it is only an error if in an @safe function
    }
    return false;
}

/***************************************
 * Like `setUnsafe`, but for safety errors still behind preview switches
 *
 * Given a `FeatureState fs`, for example dip1000 / dip25 / systemVariables,
 * the behavior changes based on the setting:
 *
 * - In case of `-revert=fs`, it does nothing.
 * - In case of `-preview=fs`, it's the same as `setUnsafe`
 * - By default, print a deprecation in `@safe` functions, or store an attribute violation in inferred functions.
 *
 * Params:
 *   sc = used to find affected function/variable, and for checking whether we are in a deprecated / speculative scope
 *   fs = feature state from the preview flag
 *   gag = surpress error message
 *   loc = location of error
 *   format = printf-style format string
 *   args  = arguments for format string
 * Returns: whether an actual safe error (not deprecation) occured
 */
bool setUnsafePreview(Scope* sc, FeatureState fs, bool gag, Loc loc, const(char)* format, RootObject[] args...)
{
    //printf("setUnsafePreview() fs:%d %s\n", fs, fmt);
    assert(format);
    with (FeatureState) final switch (fs)
    {
      case disabled:
        return false;

      case enabled:
        return sc.setUnsafe(gag, loc, format, args);

      case default_:
        if (!sc.func)
            return false;
        if (sc.func.isSafeBypassingInference())
        {
            if (!gag && !sc.isDeprecated())
            {
                string action = AttributeViolation(loc, format, args).action;
                deprecation(loc, "%.*s will become `@system` in a future release", action.fTuple.expand);
            }
        }
        else if (!sc.func.safetyViolation)
        {
            import dmd.func : AttributeViolation;
            sc.func.safetyViolation = new AttributeViolation(loc, format, args);
        }
        return false;
    }
}