document pulse issue types

Summary: As per title

Reviewed By: ngorogiannis

Differential Revision: D22019569

fbshipit-source-id: c9b7dbeac

infer/documentation/issues/CONSTANT_ADDRESS_DEREFERENCE.md

@@ -0,0 +1,6 @@
+This is reported when an address obtained via a non-zero constant is
+dereferenced. If the address is zero then
+[`NULLPTR_DEREFERENCE`](#nullptr_dereference) is reported instead.
+
+For example, `int *p = (int *) 123; *p = 42;` generates this issue
+type.

infer/documentation/issues/NULLPTR_DEREFERENCE.md

@@ -0,0 +1 @@
+

infer/documentation/issues/STACK_VARIABLE_ADDRESS_ESCAPE.md

@@ -0,0 +1,13 @@
+Reported when an address pointing into the stack of the current
+function will escape to its calling context. Such addresses will
+become invalid by the time the function actually returns so are
+potentially dangerous.
+
+For example, directly returning a pointer to a local variable:
+
+```C
+int* foo() {
+   int x = 42;
+   return &x; // <-- warn here that "&x" will escape
+}
+```

infer/documentation/issues/USE_AFTER_DELETE.md

@@ -0,0 +1 @@
+An address that was invalidated by a call to `delete` in C++ is dereferenced.

infer/documentation/issues/USE_AFTER_FREE.md

@@ -0,0 +1 @@
+An address that was invalidated by a call to `free` in C is dereferenced.

infer/documentation/issues/USE_AFTER_LIFETIME.md

@@ -0,0 +1,14 @@
+The lifetime of an object has ended but that object is being
+accessed. For example, the address of a variable holding a C++ object
+is accessed after the variable has gone out of scope:
+
+```C++
+void foo() {
+     X* p;
+     { // new scope
+       X x = X();
+       p = &x;
+     } // x has gone out of scope
+     p->method(); // ERROR: you should not access *p after x has gone out of scope
+}
+```

infer/documentation/issues/VECTOR_INVALIDATION.md

@@ -0,0 +1,18 @@
+An address pointing into a C++ `std::vector` might have become
+invalid. This can happen when an address is taken into a vector, then
+the vector is mutated in a way that might invalidate the address, for
+example by adding elements to the vector, which might trigger a
+re-allocation of the entire vector contents (thereby invalidating the
+pointers into the previous location of the contents).
+
+For example:
+
+```C++
+void deref_vector_element_after_push_back_bad(std::vector<int>& vec) {
+  int* elt = &vec[1];
+  vec.push_back(42); // if the array backing the vector was full already, this
+                     // will re-allocate it and copy the previous contents
+                     // into the new array, then delete the previous array
+  std::cout << *y << "\n"; // bad: elt might be invalid
+}
+```

infer/src/base/IssueType.ml

@@ -370,6 +370,7 @@ let condition_always_true =
 
 let constant_address_dereference =
   register_from_string ~enabled:false ~id:"CONSTANT_ADDRESS_DEREFERENCE" Warning Pulse
+    ~user_documentation:[%blob "../../documentation/issues/CONSTANT_ADDRESS_DEREFERENCE.md"]
 
 
 let create_intent_from_uri = register_from_string ~id:"CREATE_INTENT_FROM_URI" Error Quandary
@@ -709,7 +710,10 @@ let null_test_after_dereference =
   register_from_string ~enabled:false ~id:"NULL_TEST_AFTER_DEREFERENCE" Warning Biabduction
 
 
-let nullptr_dereference = register_from_string ~enabled:false ~id:"NULLPTR_DEREFERENCE" Error Pulse
+let nullptr_dereference =
+  register_from_string ~enabled:false ~id:"NULLPTR_DEREFERENCE" Error Pulse
+    ~user_documentation:"See [NULL_DEREFERENCE](#null_dereference)."
+
 
 let parameter_not_null_checked =
   register_from_string ~id:"PARAMETER_NOT_NULL_CHECKED" Warning Biabduction
@@ -781,6 +785,7 @@ let sql_injection_risk = register_from_string ~id:"SQL_INJECTION_RISK" Error Qua
 
 let stack_variable_address_escape =
   register_from_string ~id:"STACK_VARIABLE_ADDRESS_ESCAPE" Error Pulse
+    ~user_documentation:[%blob "../../documentation/issues/STACK_VARIABLE_ADDRESS_ESCAPE.md"]
 
 
 let starvation =
@@ -838,11 +843,20 @@ let uninitialized_value = register_from_string ~id:"UNINITIALIZED_VALUE" Error U
 
 let unreachable_code_after = register_from_string ~id:"UNREACHABLE_CODE" Error BufferOverrunChecker
 
-let use_after_delete = register_from_string ~id:"USE_AFTER_DELETE" Error Pulse
+let use_after_delete =
+  register_from_string ~id:"USE_AFTER_DELETE" Error Pulse
+    ~user_documentation:[%blob "../../documentation/issues/USE_AFTER_DELETE.md"]
+
+
+let use_after_free =
+  register_from_string ~id:"USE_AFTER_FREE" Error Pulse
+    ~user_documentation:[%blob "../../documentation/issues/USE_AFTER_FREE.md"]
+
 
-let use_after_free = register_from_string ~id:"USE_AFTER_FREE" Error Pulse
+let use_after_lifetime =
+  register_from_string ~id:"USE_AFTER_LIFETIME" Error Pulse
+    ~user_documentation:[%blob "../../documentation/issues/USE_AFTER_LIFETIME.md"]
 
-let use_after_lifetime = register_from_string ~id:"USE_AFTER_LIFETIME" Error Pulse
 
 let user_controlled_sql_risk = register_from_string ~id:"USER_CONTROLLED_SQL_RISK" Error Quandary