head 1.1; branch 1.1.1; access; symbols perseant-exfatfs-base-20261102:1.1.1.10 netbsd-11-1-RELEASE:1.1.1.10 netbsd-10-2-RELEASE:1.1.1.10 netbsd-9-5-RELEASE:1.1.1.9 netbsd-11-0-RELEASE:1.1.1.10 netbsd-11-0-RC7:1.1.1.10 netbsd-11-0-RC6:1.1.1.10 netbsd-11-0-RC5:1.1.1.10 netbsd-11-0-RC4:1.1.1.10 netbsd-11-0-RC3:1.1.1.10 netbsd-11-0-RC2:1.1.1.10 netbsd-11-0-RC1:1.1.1.10 perseant-exfatfs-base-20250801:1.1.1.10 netbsd-11:1.1.1.10.0.10 netbsd-11-base:1.1.1.10 netbsd-10-1-RELEASE:1.1.1.10 perseant-exfatfs-base-20240630:1.1.1.10 perseant-exfatfs:1.1.1.10.0.8 perseant-exfatfs-base:1.1.1.10 netbsd-8-3-RELEASE:1.1.1.7 netbsd-9-4-RELEASE:1.1.1.9 netbsd-10-0-RELEASE:1.1.1.10 netbsd-10-0-RC6:1.1.1.10 netbsd-10-0-RC5:1.1.1.10 netbsd-10-0-RC4:1.1.1.10 netbsd-10-0-RC3:1.1.1.10 netbsd-10-0-RC2:1.1.1.10 netbsd-10-0-RC1:1.1.1.10 netbsd-10:1.1.1.10.0.6 netbsd-10-base:1.1.1.10 netbsd-9-3-RELEASE:1.1.1.9 cjep_sun2x:1.1.1.10.0.4 cjep_sun2x-base:1.1.1.10 cjep_staticlib_x-base1:1.1.1.10 netbsd-9-2-RELEASE:1.1.1.9 cjep_staticlib_x:1.1.1.10.0.2 cjep_staticlib_x-base:1.1.1.10 netbsd-9-1-RELEASE:1.1.1.9 phil-wifi-20200421:1.1.1.10 phil-wifi-20200411:1.1.1.10 phil-wifi-20200406:1.1.1.10 netbsd-8-2-RELEASE:1.1.1.7 netbsd-9-0-RELEASE:1.1.1.9 netbsd-9-0-RC2:1.1.1.9 netbsd-9-0-RC1:1.1.1.9 netbsd-9:1.1.1.9.0.2 netbsd-9-base:1.1.1.9 phil-wifi-20190609:1.1.1.9 netbsd-8-1-RELEASE:1.1.1.7 netbsd-8-1-RC1:1.1.1.7 pgoyette-compat-merge-20190127:1.1.1.8.2.1 pgoyette-compat-20190127:1.1.1.9 pgoyette-compat-20190118:1.1.1.9 pgoyette-compat-1226:1.1.1.9 pgoyette-compat-1126:1.1.1.9 pgoyette-compat-1020:1.1.1.9 pgoyette-compat-0930:1.1.1.9 pgoyette-compat-0906:1.1.1.9 netbsd-7-2-RELEASE:1.1.1.4.2.1 pgoyette-compat-0728:1.1.1.9 clang-337282:1.1.1.9 netbsd-8-0-RELEASE:1.1.1.7 phil-wifi:1.1.1.8.0.4 phil-wifi-base:1.1.1.8 pgoyette-compat-0625:1.1.1.8 netbsd-8-0-RC2:1.1.1.7 pgoyette-compat-0521:1.1.1.8 pgoyette-compat-0502:1.1.1.8 pgoyette-compat-0422:1.1.1.8 netbsd-8-0-RC1:1.1.1.7 pgoyette-compat-0415:1.1.1.8 pgoyette-compat-0407:1.1.1.8 pgoyette-compat-0330:1.1.1.8 pgoyette-compat-0322:1.1.1.8 pgoyette-compat-0315:1.1.1.8 netbsd-7-1-2-RELEASE:1.1.1.4.2.1 pgoyette-compat:1.1.1.8.0.2 pgoyette-compat-base:1.1.1.8 netbsd-7-1-1-RELEASE:1.1.1.4.2.1 clang-319952:1.1.1.8 matt-nb8-mediatek:1.1.1.7.0.10 matt-nb8-mediatek-base:1.1.1.7 clang-309604:1.1.1.8 perseant-stdc-iso10646:1.1.1.7.0.8 perseant-stdc-iso10646-base:1.1.1.7 netbsd-8:1.1.1.7.0.6 netbsd-8-base:1.1.1.7 prg-localcount2-base3:1.1.1.7 prg-localcount2-base2:1.1.1.7 prg-localcount2-base1:1.1.1.7 prg-localcount2:1.1.1.7.0.4 prg-localcount2-base:1.1.1.7 pgoyette-localcount-20170426:1.1.1.7 bouyer-socketcan-base1:1.1.1.7 pgoyette-localcount-20170320:1.1.1.7 netbsd-7-1:1.1.1.4.2.1.0.6 netbsd-7-1-RELEASE:1.1.1.4.2.1 netbsd-7-1-RC2:1.1.1.4.2.1 clang-294123:1.1.1.7 netbsd-7-nhusb-base-20170116:1.1.1.4.2.1 bouyer-socketcan:1.1.1.7.0.2 bouyer-socketcan-base:1.1.1.7 clang-291444:1.1.1.7 pgoyette-localcount-20170107:1.1.1.6 netbsd-7-1-RC1:1.1.1.4.2.1 pgoyette-localcount-20161104:1.1.1.6 netbsd-7-0-2-RELEASE:1.1.1.4.2.1 localcount-20160914:1.1.1.6 netbsd-7-nhusb:1.1.1.4.2.1.0.4 netbsd-7-nhusb-base:1.1.1.4.2.1 clang-280599:1.1.1.6 pgoyette-localcount-20160806:1.1.1.6 pgoyette-localcount-20160726:1.1.1.6 pgoyette-localcount:1.1.1.6.0.2 pgoyette-localcount-base:1.1.1.6 netbsd-7-0-1-RELEASE:1.1.1.4.2.1 clang-261930:1.1.1.6 netbsd-7-0:1.1.1.4.2.1.0.2 netbsd-7-0-RELEASE:1.1.1.4.2.1 netbsd-7-0-RC3:1.1.1.4.2.1 netbsd-7-0-RC2:1.1.1.4.2.1 netbsd-7-0-RC1:1.1.1.4.2.1 clang-237755:1.1.1.5 clang-232565:1.1.1.5 clang-227398:1.1.1.5 tls-maxphys-base:1.1.1.4 tls-maxphys:1.1.1.4.0.4 netbsd-7:1.1.1.4.0.2 netbsd-7-base:1.1.1.4 clang-215315:1.1.1.4 clang-209886:1.1.1.4 yamt-pagecache:1.1.1.3.0.4 yamt-pagecache-base9:1.1.1.3 tls-earlyentropy:1.1.1.3.0.2 tls-earlyentropy-base:1.1.1.4 riastradh-xf86-video-intel-2-7-1-pre-2-21-15:1.1.1.3 riastradh-drm2-base3:1.1.1.3 clang-202566:1.1.1.3 clang-201163:1.1.1.2 clang-199312:1.1.1.2 clang-198450:1.1.1.2 clang-196603:1.1.1.1 clang-195771:1.1.1.1 LLVM:1.1.1; locks; strict; comment @// @; 1.1 date 2013.11.28.14.14.52; author joerg; state Exp; branches 1.1.1.1; next ; commitid ow8OybrawrB1f3fx; 1.1.1.1 date 2013.11.28.14.14.52; author joerg; state Exp; branches; next 1.1.1.2; commitid ow8OybrawrB1f3fx; 1.1.1.2 date 2014.01.05.15.39.30; author joerg; state Exp; branches; next 1.1.1.3; commitid wh3aCSIWykURqWjx; 1.1.1.3 date 2014.03.04.19.54.57; author joerg; state Exp; branches 1.1.1.3.2.1 1.1.1.3.4.1; next 1.1.1.4; commitid 29z1hJonZISIXprx; 1.1.1.4 date 2014.05.30.18.14.44; author joerg; state Exp; branches 1.1.1.4.2.1 1.1.1.4.4.1; next 1.1.1.5; commitid 8q0kdlBlCn09GACx; 1.1.1.5 date 2015.01.29.19.57.30; author joerg; state Exp; branches; next 1.1.1.6; commitid mlISSizlPKvepX7y; 1.1.1.6 date 2016.02.27.22.12.07; author joerg; state Exp; branches 1.1.1.6.2.1; next 1.1.1.7; commitid tIimz3oDlh1NpBWy; 1.1.1.7 date 2017.01.11.10.35.37; author joerg; state Exp; branches; next 1.1.1.8; commitid CNnUNfII1jgNmxBz; 1.1.1.8 date 2017.08.01.19.35.17; author joerg; state Exp; branches 1.1.1.8.2.1 1.1.1.8.4.1; next 1.1.1.9; commitid pMuDy65V0VicSx1A; 1.1.1.9 date 2018.07.17.18.31.07; author joerg; state Exp; branches; next 1.1.1.10; commitid wDzL46ALjrCZgwKA; 1.1.1.10 date 2019.11.13.22.19.28; author joerg; state dead; branches; next ; commitid QD8YATxuNG34YJKB; 1.1.1.3.2.1 date 2014.08.10.07.08.10; author tls; state Exp; branches; next ; commitid t01A1TLTYxkpGMLx; 1.1.1.3.4.1 date 2014.03.04.19.54.57; author yamt; state dead; branches; next 1.1.1.3.4.2; commitid WSrDtL5nYAUyiyBx; 1.1.1.3.4.2 date 2014.05.22.16.18.31; author yamt; state Exp; branches; next ; commitid WSrDtL5nYAUyiyBx; 1.1.1.4.2.1 date 2015.06.04.20.04.30; author snj; state Exp; branches; next ; commitid yRnjq9fueSo6n9oy; 1.1.1.4.4.1 date 2014.05.30.18.14.44; author tls; state dead; branches; next 1.1.1.4.4.2; commitid jTnpym9Qu0o4R1Nx; 1.1.1.4.4.2 date 2014.08.19.23.47.31; author tls; state Exp; branches; next ; commitid jTnpym9Qu0o4R1Nx; 1.1.1.6.2.1 date 2017.03.20.06.52.42; author pgoyette; state Exp; branches; next ; commitid jjw7cAwgyKq7RfKz; 1.1.1.8.2.1 date 2018.07.28.04.33.24; author pgoyette; state Exp; branches; next ; commitid 1UP1xAIUxv1ZgRLA; 1.1.1.8.4.1 date 2019.06.10.21.45.28; author christos; state Exp; branches; next 1.1.1.8.4.2; commitid jtc8rnCzWiEEHGqB; 1.1.1.8.4.2 date 2020.04.13.07.46.39; author martin; state dead; branches; next ; commitid X01YhRUPVUDaec4C; desc @@ 1.1 log @Initial revision @ text @//= UnixAPIChecker.h - Checks preconditions for various Unix APIs --*- C++ -*-// // // The LLVM Compiler Infrastructure // // This file is distributed under the University of Illinois Open Source // License. See LICENSE.TXT for details. // //===----------------------------------------------------------------------===// // // This defines UnixAPIChecker, which is an assortment of checks on calls // to various, widely used UNIX/Posix functions. // //===----------------------------------------------------------------------===// #include "ClangSACheckers.h" #include "clang/Basic/TargetInfo.h" #include "clang/StaticAnalyzer/Core/BugReporter/BugType.h" #include "clang/StaticAnalyzer/Core/Checker.h" #include "clang/StaticAnalyzer/Core/CheckerManager.h" #include "clang/StaticAnalyzer/Core/PathSensitive/CheckerContext.h" #include "llvm/ADT/Optional.h" #include "llvm/ADT/STLExtras.h" #include "llvm/ADT/SmallString.h" #include "llvm/ADT/StringSwitch.h" #include "llvm/Support/raw_ostream.h" #include using namespace clang; using namespace ento; namespace { class UnixAPIChecker : public Checker< check::PreStmt > { mutable OwningPtr BT_open, BT_pthreadOnce, BT_mallocZero; mutable Optional Val_O_CREAT; public: void checkPreStmt(const CallExpr *CE, CheckerContext &C) const; void CheckOpen(CheckerContext &C, const CallExpr *CE) const; void CheckPthreadOnce(CheckerContext &C, const CallExpr *CE) const; void CheckCallocZero(CheckerContext &C, const CallExpr *CE) const; void CheckMallocZero(CheckerContext &C, const CallExpr *CE) const; void CheckReallocZero(CheckerContext &C, const CallExpr *CE) const; void CheckReallocfZero(CheckerContext &C, const CallExpr *CE) const; void CheckAllocaZero(CheckerContext &C, const CallExpr *CE) const; void CheckVallocZero(CheckerContext &C, const CallExpr *CE) const; typedef void (UnixAPIChecker::*SubChecker)(CheckerContext &, const CallExpr *) const; private: bool ReportZeroByteAllocation(CheckerContext &C, ProgramStateRef falseState, const Expr *arg, const char *fn_name) const; void BasicAllocationCheck(CheckerContext &C, const CallExpr *CE, const unsigned numArgs, const unsigned sizeArg, const char *fn) const; }; } //end anonymous namespace //===----------------------------------------------------------------------===// // Utility functions. //===----------------------------------------------------------------------===// static inline void LazyInitialize(OwningPtr &BT, const char *name) { if (BT) return; BT.reset(new BugType(name, categories::UnixAPI)); } //===----------------------------------------------------------------------===// // "open" (man 2 open) //===----------------------------------------------------------------------===// void UnixAPIChecker::CheckOpen(CheckerContext &C, const CallExpr *CE) const { // The definition of O_CREAT is platform specific. We need a better way // of querying this information from the checking environment. if (!Val_O_CREAT.hasValue()) { if (C.getASTContext().getTargetInfo().getTriple().getVendor() == llvm::Triple::Apple) Val_O_CREAT = 0x0200; else { // FIXME: We need a more general way of getting the O_CREAT value. // We could possibly grovel through the preprocessor state, but // that would require passing the Preprocessor object to the ExprEngine. return; } } // Look at the 'oflags' argument for the O_CREAT flag. ProgramStateRef state = C.getState(); if (CE->getNumArgs() < 2) { // The frontend should issue a warning for this case, so this is a sanity // check. return; } // Now check if oflags has O_CREAT set. const Expr *oflagsEx = CE->getArg(1); const SVal V = state->getSVal(oflagsEx, C.getLocationContext()); if (!V.getAs()) { // The case where 'V' can be a location can only be due to a bad header, // so in this case bail out. return; } NonLoc oflags = V.castAs(); NonLoc ocreateFlag = C.getSValBuilder() .makeIntVal(Val_O_CREAT.getValue(), oflagsEx->getType()).castAs(); SVal maskedFlagsUC = C.getSValBuilder().evalBinOpNN(state, BO_And, oflags, ocreateFlag, oflagsEx->getType()); if (maskedFlagsUC.isUnknownOrUndef()) return; DefinedSVal maskedFlags = maskedFlagsUC.castAs(); // Check if maskedFlags is non-zero. ProgramStateRef trueState, falseState; llvm::tie(trueState, falseState) = state->assume(maskedFlags); // Only emit an error if the value of 'maskedFlags' is properly // constrained; if (!(trueState && !falseState)) return; if (CE->getNumArgs() < 3) { ExplodedNode *N = C.generateSink(trueState); if (!N) return; LazyInitialize(BT_open, "Improper use of 'open'"); BugReport *report = new BugReport(*BT_open, "Call to 'open' requires a third argument when " "the 'O_CREAT' flag is set", N); report->addRange(oflagsEx->getSourceRange()); C.emitReport(report); } } //===----------------------------------------------------------------------===// // pthread_once //===----------------------------------------------------------------------===// void UnixAPIChecker::CheckPthreadOnce(CheckerContext &C, const CallExpr *CE) const { // This is similar to 'CheckDispatchOnce' in the MacOSXAPIChecker. // They can possibly be refactored. if (CE->getNumArgs() < 1) return; // Check if the first argument is stack allocated. If so, issue a warning // because that's likely to be bad news. ProgramStateRef state = C.getState(); const MemRegion *R = state->getSVal(CE->getArg(0), C.getLocationContext()).getAsRegion(); if (!R || !isa(R->getMemorySpace())) return; ExplodedNode *N = C.generateSink(state); if (!N) return; SmallString<256> S; llvm::raw_svector_ostream os(S); os << "Call to 'pthread_once' uses"; if (const VarRegion *VR = dyn_cast(R)) os << " the local variable '" << VR->getDecl()->getName() << '\''; else os << " stack allocated memory"; os << " for the \"control\" value. Using such transient memory for " "the control value is potentially dangerous."; if (isa(R) && isa(R->getMemorySpace())) os << " Perhaps you intended to declare the variable as 'static'?"; LazyInitialize(BT_pthreadOnce, "Improper use of 'pthread_once'"); BugReport *report = new BugReport(*BT_pthreadOnce, os.str(), N); report->addRange(CE->getArg(0)->getSourceRange()); C.emitReport(report); } //===----------------------------------------------------------------------===// // "calloc", "malloc", "realloc", "reallocf", "alloca" and "valloc" // with allocation size 0 //===----------------------------------------------------------------------===// // FIXME: Eventually these should be rolled into the MallocChecker, but right now // they're more basic and valuable for widespread use. // Returns true if we try to do a zero byte allocation, false otherwise. // Fills in trueState and falseState. static bool IsZeroByteAllocation(ProgramStateRef state, const SVal argVal, ProgramStateRef *trueState, ProgramStateRef *falseState) { llvm::tie(*trueState, *falseState) = state->assume(argVal.castAs()); return (*falseState && !*trueState); } // Generates an error report, indicating that the function whose name is given // will perform a zero byte allocation. // Returns false if an error occured, true otherwise. bool UnixAPIChecker::ReportZeroByteAllocation(CheckerContext &C, ProgramStateRef falseState, const Expr *arg, const char *fn_name) const { ExplodedNode *N = C.generateSink(falseState); if (!N) return false; LazyInitialize(BT_mallocZero, "Undefined allocation of 0 bytes (CERT MEM04-C; CWE-131)"); SmallString<256> S; llvm::raw_svector_ostream os(S); os << "Call to '" << fn_name << "' has an allocation size of 0 bytes"; BugReport *report = new BugReport(*BT_mallocZero, os.str(), N); report->addRange(arg->getSourceRange()); bugreporter::trackNullOrUndefValue(N, arg, *report); C.emitReport(report); return true; } // Does a basic check for 0-sized allocations suitable for most of the below // functions (modulo "calloc") void UnixAPIChecker::BasicAllocationCheck(CheckerContext &C, const CallExpr *CE, const unsigned numArgs, const unsigned sizeArg, const char *fn) const { // Sanity check for the correct number of arguments if (CE->getNumArgs() != numArgs) return; // Check if the allocation size is 0. ProgramStateRef state = C.getState(); ProgramStateRef trueState = NULL, falseState = NULL; const Expr *arg = CE->getArg(sizeArg); SVal argVal = state->getSVal(arg, C.getLocationContext()); if (argVal.isUnknownOrUndef()) return; // Is the value perfectly constrained to zero? if (IsZeroByteAllocation(state, argVal, &trueState, &falseState)) { (void) ReportZeroByteAllocation(C, falseState, arg, fn); return; } // Assume the value is non-zero going forward. assert(trueState); if (trueState != state) C.addTransition(trueState); } void UnixAPIChecker::CheckCallocZero(CheckerContext &C, const CallExpr *CE) const { unsigned int nArgs = CE->getNumArgs(); if (nArgs != 2) return; ProgramStateRef state = C.getState(); ProgramStateRef trueState = NULL, falseState = NULL; unsigned int i; for (i = 0; i < nArgs; i++) { const Expr *arg = CE->getArg(i); SVal argVal = state->getSVal(arg, C.getLocationContext()); if (argVal.isUnknownOrUndef()) { if (i == 0) continue; else return; } if (IsZeroByteAllocation(state, argVal, &trueState, &falseState)) { if (ReportZeroByteAllocation(C, falseState, arg, "calloc")) return; else if (i == 0) continue; else return; } } // Assume the value is non-zero going forward. assert(trueState); if (trueState != state) C.addTransition(trueState); } void UnixAPIChecker::CheckMallocZero(CheckerContext &C, const CallExpr *CE) const { BasicAllocationCheck(C, CE, 1, 0, "malloc"); } void UnixAPIChecker::CheckReallocZero(CheckerContext &C, const CallExpr *CE) const { BasicAllocationCheck(C, CE, 2, 1, "realloc"); } void UnixAPIChecker::CheckReallocfZero(CheckerContext &C, const CallExpr *CE) const { BasicAllocationCheck(C, CE, 2, 1, "reallocf"); } void UnixAPIChecker::CheckAllocaZero(CheckerContext &C, const CallExpr *CE) const { BasicAllocationCheck(C, CE, 1, 0, "alloca"); } void UnixAPIChecker::CheckVallocZero(CheckerContext &C, const CallExpr *CE) const { BasicAllocationCheck(C, CE, 1, 0, "valloc"); } //===----------------------------------------------------------------------===// // Central dispatch function. //===----------------------------------------------------------------------===// void UnixAPIChecker::checkPreStmt(const CallExpr *CE, CheckerContext &C) const { const FunctionDecl *FD = C.getCalleeDecl(CE); if (!FD || FD->getKind() != Decl::Function) return; StringRef FName = C.getCalleeName(FD); if (FName.empty()) return; SubChecker SC = llvm::StringSwitch(FName) .Case("open", &UnixAPIChecker::CheckOpen) .Case("pthread_once", &UnixAPIChecker::CheckPthreadOnce) .Case("calloc", &UnixAPIChecker::CheckCallocZero) .Case("malloc", &UnixAPIChecker::CheckMallocZero) .Case("realloc", &UnixAPIChecker::CheckReallocZero) .Case("reallocf", &UnixAPIChecker::CheckReallocfZero) .Cases("alloca", "__builtin_alloca", &UnixAPIChecker::CheckAllocaZero) .Case("valloc", &UnixAPIChecker::CheckVallocZero) .Default(NULL); if (SC) (this->*SC)(C, CE); } //===----------------------------------------------------------------------===// // Registration. //===----------------------------------------------------------------------===// void ento::registerUnixAPIChecker(CheckerManager &mgr) { mgr.registerChecker(); } @ 1.1.1.1 log @Import Clang 3.4rc1 r195771. @ text @@ 1.1.1.2 log @Import clang 3.5svn r198450. @ text @d210 1 a210 1 // Returns false if an error occurred, true otherwise. @ 1.1.1.3 log @Import Clang 3.5svn r202566. @ text @a59 5 void LazyInitialize(OwningPtr &BT, const char *name) const { if (BT) return; BT.reset(new BugType(this, name, categories::UnixAPI)); } d64 11 d220 1 a220 1 "Undefined allocation of 0 bytes (CERT MEM04-C; CWE-131)"); @ 1.1.1.3.2.1 log @Rebase. @ text @d33 1 a33 1 mutable std::unique_ptr BT_open, BT_pthreadOnce, BT_mallocZero; d60 1 a60 1 void LazyInitialize(std::unique_ptr &BT, const char *name) const { a82 1 // See also: MallocChecker.cpp / M_ZERO. d116 1 a116 1 std::tie(trueState, falseState) = state->assume(maskedFlags); d196 1 a196 1 std::tie(*trueState, *falseState) = d241 1 a241 1 ProgramStateRef trueState = nullptr, falseState = nullptr; d266 1 a266 1 ProgramStateRef trueState = nullptr, falseState = nullptr; d345 1 a345 1 .Default(nullptr); @ 1.1.1.4 log @Import Clang 3.5svn r209886. @ text @d33 1 a33 1 mutable std::unique_ptr BT_open, BT_pthreadOnce, BT_mallocZero; d60 1 a60 1 void LazyInitialize(std::unique_ptr &BT, const char *name) const { a82 1 // See also: MallocChecker.cpp / M_ZERO. d116 1 a116 1 std::tie(trueState, falseState) = state->assume(maskedFlags); d196 1 a196 1 std::tie(*trueState, *falseState) = d241 1 a241 1 ProgramStateRef trueState = nullptr, falseState = nullptr; d266 1 a266 1 ProgramStateRef trueState = nullptr, falseState = nullptr; d345 1 a345 1 .Default(nullptr); @ 1.1.1.4.2.1 log @Update LLVM to 3.6.1, requested by joerg in ticket 824. @ text @a64 4 void ReportOpenBug(CheckerContext &C, ProgramStateRef State, const char *Msg, SourceRange SR) const; a71 15 void UnixAPIChecker::ReportOpenBug(CheckerContext &C, ProgramStateRef State, const char *Msg, SourceRange SR) const { ExplodedNode *N = C.generateSink(State); if (!N) return; LazyInitialize(BT_open, "Improper use of 'open'"); BugReport *Report = new BugReport(*BT_open, Msg, N); Report->addRange(SR); C.emitReport(Report); } a72 22 ProgramStateRef state = C.getState(); if (CE->getNumArgs() < 2) { // The frontend should issue a warning for this case, so this is a sanity // check. return; } else if (CE->getNumArgs() == 3) { const Expr *Arg = CE->getArg(2); QualType QT = Arg->getType(); if (!QT->isIntegerType()) { ReportOpenBug(C, state, "Third argument to 'open' is not an integer", Arg->getSourceRange()); return; } } else if (CE->getNumArgs() > 3) { ReportOpenBug(C, state, "Call to 'open' with more than three arguments", CE->getArg(3)->getSourceRange()); return; } d88 9 d125 12 a136 4 ReportOpenBug(C, trueState, "Call to 'open' requires a third argument when " "the 'O_CREAT' flag is set", oflagsEx->getSourceRange()); @ 1.1.1.5 log @Import Clang 3.6RC1 r227398. @ text @a64 4 void ReportOpenBug(CheckerContext &C, ProgramStateRef State, const char *Msg, SourceRange SR) const; a71 15 void UnixAPIChecker::ReportOpenBug(CheckerContext &C, ProgramStateRef State, const char *Msg, SourceRange SR) const { ExplodedNode *N = C.generateSink(State); if (!N) return; LazyInitialize(BT_open, "Improper use of 'open'"); BugReport *Report = new BugReport(*BT_open, Msg, N); Report->addRange(SR); C.emitReport(Report); } a72 22 ProgramStateRef state = C.getState(); if (CE->getNumArgs() < 2) { // The frontend should issue a warning for this case, so this is a sanity // check. return; } else if (CE->getNumArgs() == 3) { const Expr *Arg = CE->getArg(2); QualType QT = Arg->getType(); if (!QT->isIntegerType()) { ReportOpenBug(C, state, "Third argument to 'open' is not an integer", Arg->getSourceRange()); return; } } else if (CE->getNumArgs() > 3) { ReportOpenBug(C, state, "Call to 'open' with more than three arguments", CE->getArg(3)->getSourceRange()); return; } d88 9 d125 12 a136 4 ReportOpenBug(C, trueState, "Call to 'open' requires a third argument when " "the 'O_CREAT' flag is set", oflagsEx->getSourceRange()); @ 1.1.1.6 log @Import Clang 3.8.0rc3 r261930. @ text @d80 1 a80 1 ExplodedNode *N = C.generateErrorNode(State); d86 1 a86 1 auto Report = llvm::make_unique(*BT_open, Msg, N); d88 1 a88 1 C.emitReport(std::move(Report)); d117 1 a117 1 if (C.getASTContext().getTargetInfo().getTriple().getVendor() d185 1 a185 1 ExplodedNode *N = C.generateErrorNode(state); d203 1 a203 1 auto report = llvm::make_unique(*BT_pthreadOnce, os.str(), N); d205 1 a205 1 C.emitReport(std::move(report)); d223 1 a223 1 d234 1 a234 1 ExplodedNode *N = C.generateErrorNode(falseState); d242 1 a242 1 llvm::raw_svector_ostream os(S); d244 1 a244 1 auto report = llvm::make_unique(*BT_mallocZero, os.str(), N); d248 1 a248 1 C.emitReport(std::move(report)); d275 1 a275 1 (void) ReportZeroByteAllocation(C, falseState, arg, fn); d281 1 a281 1 C.addTransition(trueState); @ 1.1.1.6.2.1 log @Sync with HEAD @ text @a23 1 #include "llvm/ADT/StringExtras.h" a30 10 enum class OpenVariant { /// The standard open() call: /// int open(const char *path, int oflag, ...); Open, /// The variant taking a directory file descriptor and a relative path: /// int openat(int fd, const char *path, int oflag, ...); OpenAt }; a39 2 void CheckOpenAt(CheckerContext &C, const CallExpr *CE) const; a45 1 void CheckAllocaWithAlignZero(CheckerContext &C, const CallExpr *CE) const; a50 4 void CheckOpenVariant(CheckerContext &C, const CallExpr *CE, OpenVariant Variant) const; a91 35 CheckOpenVariant(C, CE, OpenVariant::Open); } void UnixAPIChecker::CheckOpenAt(CheckerContext &C, const CallExpr *CE) const { CheckOpenVariant(C, CE, OpenVariant::OpenAt); } void UnixAPIChecker::CheckOpenVariant(CheckerContext &C, const CallExpr *CE, OpenVariant Variant) const { // The index of the argument taking the flags open flags (O_RDONLY, // O_WRONLY, O_CREAT, etc.), unsigned int FlagsArgIndex; const char *VariantName; switch (Variant) { case OpenVariant::Open: FlagsArgIndex = 1; VariantName = "open"; break; case OpenVariant::OpenAt: FlagsArgIndex = 2; VariantName = "openat"; break; }; // All calls should at least provide arguments up to the 'flags' parameter. unsigned int MinArgCount = FlagsArgIndex + 1; // If the flags has O_CREAT set then open/openat() require an additional // argument specifying the file mode (permission bits) for the created file. unsigned int CreateModeArgIndex = FlagsArgIndex + 1; // The create mode argument should be the last argument. unsigned int MaxArgCount = CreateModeArgIndex + 1; d94 1 a94 1 if (CE->getNumArgs() < MinArgCount) { d98 2 a99 2 } else if (CE->getNumArgs() == MaxArgCount) { const Expr *Arg = CE->getArg(CreateModeArgIndex); a101 6 SmallString<256> SBuf; llvm::raw_svector_ostream OS(SBuf); OS << "The " << CreateModeArgIndex + 1 << llvm::getOrdinalSuffix(CreateModeArgIndex + 1) << " argument to '" << VariantName << "' is not an integer"; d103 1 a103 1 SBuf.c_str(), d107 1 a107 6 } else if (CE->getNumArgs() > MaxArgCount) { SmallString<256> SBuf; llvm::raw_svector_ostream OS(SBuf); OS << "Call to '" << VariantName << "' with more than " << MaxArgCount << " arguments"; d109 2 a110 2 SBuf.c_str(), CE->getArg(MaxArgCount)->getSourceRange()); d130 1 a130 1 const Expr *oflagsEx = CE->getArg(FlagsArgIndex); d156 1 a156 7 if (CE->getNumArgs() < MaxArgCount) { SmallString<256> SBuf; llvm::raw_svector_ostream OS(SBuf); OS << "Call to '" << VariantName << "' requires a " << CreateModeArgIndex + 1 << llvm::getOrdinalSuffix(CreateModeArgIndex + 1) << " argument when the 'O_CREAT' flag is set"; d158 2 a159 1 SBuf.c_str(), a339 5 void UnixAPIChecker::CheckAllocaWithAlignZero(CheckerContext &C, const CallExpr *CE) const { BasicAllocationCheck(C, CE, 2, 0, "__builtin_alloca_with_align"); } a355 6 // Don't treat functions in namespaces with the same name a Unix function // as a call to the Unix function. const DeclContext *NamespaceCtx = FD->getEnclosingNamespaceContext(); if (NamespaceCtx && isa(NamespaceCtx)) return; a362 1 .Case("openat", &UnixAPIChecker::CheckOpenAt) a368 2 .Case("__builtin_alloca_with_align", &UnixAPIChecker::CheckAllocaWithAlignZero) @ 1.1.1.7 log @Import Clang pre-4.0.0 r291444. @ text @a23 1 #include "llvm/ADT/StringExtras.h" a30 10 enum class OpenVariant { /// The standard open() call: /// int open(const char *path, int oflag, ...); Open, /// The variant taking a directory file descriptor and a relative path: /// int openat(int fd, const char *path, int oflag, ...); OpenAt }; a39 2 void CheckOpenAt(CheckerContext &C, const CallExpr *CE) const; a45 1 void CheckAllocaWithAlignZero(CheckerContext &C, const CallExpr *CE) const; a50 4 void CheckOpenVariant(CheckerContext &C, const CallExpr *CE, OpenVariant Variant) const; a91 35 CheckOpenVariant(C, CE, OpenVariant::Open); } void UnixAPIChecker::CheckOpenAt(CheckerContext &C, const CallExpr *CE) const { CheckOpenVariant(C, CE, OpenVariant::OpenAt); } void UnixAPIChecker::CheckOpenVariant(CheckerContext &C, const CallExpr *CE, OpenVariant Variant) const { // The index of the argument taking the flags open flags (O_RDONLY, // O_WRONLY, O_CREAT, etc.), unsigned int FlagsArgIndex; const char *VariantName; switch (Variant) { case OpenVariant::Open: FlagsArgIndex = 1; VariantName = "open"; break; case OpenVariant::OpenAt: FlagsArgIndex = 2; VariantName = "openat"; break; }; // All calls should at least provide arguments up to the 'flags' parameter. unsigned int MinArgCount = FlagsArgIndex + 1; // If the flags has O_CREAT set then open/openat() require an additional // argument specifying the file mode (permission bits) for the created file. unsigned int CreateModeArgIndex = FlagsArgIndex + 1; // The create mode argument should be the last argument. unsigned int MaxArgCount = CreateModeArgIndex + 1; d94 1 a94 1 if (CE->getNumArgs() < MinArgCount) { d98 2 a99 2 } else if (CE->getNumArgs() == MaxArgCount) { const Expr *Arg = CE->getArg(CreateModeArgIndex); a101 6 SmallString<256> SBuf; llvm::raw_svector_ostream OS(SBuf); OS << "The " << CreateModeArgIndex + 1 << llvm::getOrdinalSuffix(CreateModeArgIndex + 1) << " argument to '" << VariantName << "' is not an integer"; d103 1 a103 1 SBuf.c_str(), d107 1 a107 6 } else if (CE->getNumArgs() > MaxArgCount) { SmallString<256> SBuf; llvm::raw_svector_ostream OS(SBuf); OS << "Call to '" << VariantName << "' with more than " << MaxArgCount << " arguments"; d109 2 a110 2 SBuf.c_str(), CE->getArg(MaxArgCount)->getSourceRange()); d130 1 a130 1 const Expr *oflagsEx = CE->getArg(FlagsArgIndex); d156 1 a156 7 if (CE->getNumArgs() < MaxArgCount) { SmallString<256> SBuf; llvm::raw_svector_ostream OS(SBuf); OS << "Call to '" << VariantName << "' requires a " << CreateModeArgIndex + 1 << llvm::getOrdinalSuffix(CreateModeArgIndex + 1) << " argument when the 'O_CREAT' flag is set"; d158 2 a159 1 SBuf.c_str(), a339 5 void UnixAPIChecker::CheckAllocaWithAlignZero(CheckerContext &C, const CallExpr *CE) const { BasicAllocationCheck(C, CE, 2, 0, "__builtin_alloca_with_align"); } a355 6 // Don't treat functions in namespaces with the same name a Unix function // as a call to the Unix function. const DeclContext *NamespaceCtx = FD->getEnclosingNamespaceContext(); if (NamespaceCtx && isa(NamespaceCtx)) return; a362 1 .Case("openat", &UnixAPIChecker::CheckOpenAt) a368 2 .Case("__builtin_alloca_with_align", &UnixAPIChecker::CheckAllocaWithAlignZero) @ 1.1.1.8 log @Import clang r309604 from branches/release_50 @ text @a47 2 DefaultBool CheckMisuse, CheckPortability; d440 17 a456 26 if (CheckMisuse) { if (SubChecker SC = llvm::StringSwitch(FName) .Case("open", &UnixAPIChecker::CheckOpen) .Case("openat", &UnixAPIChecker::CheckOpenAt) .Case("pthread_once", &UnixAPIChecker::CheckPthreadOnce) .Default(nullptr)) { (this->*SC)(C, CE); } } if (CheckPortability) { if (SubChecker SC = llvm::StringSwitch(FName) .Case("calloc", &UnixAPIChecker::CheckCallocZero) .Case("malloc", &UnixAPIChecker::CheckMallocZero) .Case("realloc", &UnixAPIChecker::CheckReallocZero) .Case("reallocf", &UnixAPIChecker::CheckReallocfZero) .Cases("alloca", "__builtin_alloca", &UnixAPIChecker::CheckAllocaZero) .Case("__builtin_alloca_with_align", &UnixAPIChecker::CheckAllocaWithAlignZero) .Case("valloc", &UnixAPIChecker::CheckVallocZero) .Default(nullptr)) { (this->*SC)(C, CE); } } d463 3 a465 7 #define REGISTER_CHECKER(Name) \ void ento::registerUnixAPI##Name##Checker(CheckerManager &mgr) { \ mgr.registerChecker()->Check##Name = true; \ } REGISTER_CHECKER(Misuse) REGISTER_CHECKER(Portability) @ 1.1.1.8.4.1 log @Sync with HEAD @ text @d197 1 a197 1 const SVal V = C.getSVal(oflagsEx); d251 2 a252 1 const MemRegion *R = C.getSVal(CE->getArg(0)).getAsRegion(); d339 1 a339 1 SVal argVal = C.getSVal(arg); d367 1 a367 1 SVal argVal = C.getSVal(arg); @ 1.1.1.8.4.2 log @Mostly merge changes from HEAD upto 20200411 @ text @@ 1.1.1.8.2.1 log @Sync with HEAD @ text @d197 1 a197 1 const SVal V = C.getSVal(oflagsEx); d251 2 a252 1 const MemRegion *R = C.getSVal(CE->getArg(0)).getAsRegion(); d339 1 a339 1 SVal argVal = C.getSVal(arg); d367 1 a367 1 SVal argVal = C.getSVal(arg); @ 1.1.1.9 log @Import clang r337282 from trunk @ text @d197 1 a197 1 const SVal V = C.getSVal(oflagsEx); d251 2 a252 1 const MemRegion *R = C.getSVal(CE->getArg(0)).getAsRegion(); d339 1 a339 1 SVal argVal = C.getSVal(arg); d367 1 a367 1 SVal argVal = C.getSVal(arg); @ 1.1.1.10 log @Mark old LLVM instance as dead. @ text @@ 1.1.1.4.4.1 log @file UnixAPIChecker.cpp was added on branch tls-maxphys on 2014-08-19 23:47:31 +0000 @ text @d1 358 @ 1.1.1.4.4.2 log @Rebase to HEAD as of a few days ago. @ text @a0 358 //= UnixAPIChecker.h - Checks preconditions for various Unix APIs --*- C++ -*-// // // The LLVM Compiler Infrastructure // // This file is distributed under the University of Illinois Open Source // License. See LICENSE.TXT for details. // //===----------------------------------------------------------------------===// // // This defines UnixAPIChecker, which is an assortment of checks on calls // to various, widely used UNIX/Posix functions. // //===----------------------------------------------------------------------===// #include "ClangSACheckers.h" #include "clang/Basic/TargetInfo.h" #include "clang/StaticAnalyzer/Core/BugReporter/BugType.h" #include "clang/StaticAnalyzer/Core/Checker.h" #include "clang/StaticAnalyzer/Core/CheckerManager.h" #include "clang/StaticAnalyzer/Core/PathSensitive/CheckerContext.h" #include "llvm/ADT/Optional.h" #include "llvm/ADT/STLExtras.h" #include "llvm/ADT/SmallString.h" #include "llvm/ADT/StringSwitch.h" #include "llvm/Support/raw_ostream.h" #include using namespace clang; using namespace ento; namespace { class UnixAPIChecker : public Checker< check::PreStmt > { mutable std::unique_ptr BT_open, BT_pthreadOnce, BT_mallocZero; mutable Optional Val_O_CREAT; public: void checkPreStmt(const CallExpr *CE, CheckerContext &C) const; void CheckOpen(CheckerContext &C, const CallExpr *CE) const; void CheckPthreadOnce(CheckerContext &C, const CallExpr *CE) const; void CheckCallocZero(CheckerContext &C, const CallExpr *CE) const; void CheckMallocZero(CheckerContext &C, const CallExpr *CE) const; void CheckReallocZero(CheckerContext &C, const CallExpr *CE) const; void CheckReallocfZero(CheckerContext &C, const CallExpr *CE) const; void CheckAllocaZero(CheckerContext &C, const CallExpr *CE) const; void CheckVallocZero(CheckerContext &C, const CallExpr *CE) const; typedef void (UnixAPIChecker::*SubChecker)(CheckerContext &, const CallExpr *) const; private: bool ReportZeroByteAllocation(CheckerContext &C, ProgramStateRef falseState, const Expr *arg, const char *fn_name) const; void BasicAllocationCheck(CheckerContext &C, const CallExpr *CE, const unsigned numArgs, const unsigned sizeArg, const char *fn) const; void LazyInitialize(std::unique_ptr &BT, const char *name) const { if (BT) return; BT.reset(new BugType(this, name, categories::UnixAPI)); } }; } //end anonymous namespace //===----------------------------------------------------------------------===// // "open" (man 2 open) //===----------------------------------------------------------------------===// void UnixAPIChecker::CheckOpen(CheckerContext &C, const CallExpr *CE) const { // The definition of O_CREAT is platform specific. We need a better way // of querying this information from the checking environment. if (!Val_O_CREAT.hasValue()) { if (C.getASTContext().getTargetInfo().getTriple().getVendor() == llvm::Triple::Apple) Val_O_CREAT = 0x0200; else { // FIXME: We need a more general way of getting the O_CREAT value. // We could possibly grovel through the preprocessor state, but // that would require passing the Preprocessor object to the ExprEngine. // See also: MallocChecker.cpp / M_ZERO. return; } } // Look at the 'oflags' argument for the O_CREAT flag. ProgramStateRef state = C.getState(); if (CE->getNumArgs() < 2) { // The frontend should issue a warning for this case, so this is a sanity // check. return; } // Now check if oflags has O_CREAT set. const Expr *oflagsEx = CE->getArg(1); const SVal V = state->getSVal(oflagsEx, C.getLocationContext()); if (!V.getAs()) { // The case where 'V' can be a location can only be due to a bad header, // so in this case bail out. return; } NonLoc oflags = V.castAs(); NonLoc ocreateFlag = C.getSValBuilder() .makeIntVal(Val_O_CREAT.getValue(), oflagsEx->getType()).castAs(); SVal maskedFlagsUC = C.getSValBuilder().evalBinOpNN(state, BO_And, oflags, ocreateFlag, oflagsEx->getType()); if (maskedFlagsUC.isUnknownOrUndef()) return; DefinedSVal maskedFlags = maskedFlagsUC.castAs(); // Check if maskedFlags is non-zero. ProgramStateRef trueState, falseState; std::tie(trueState, falseState) = state->assume(maskedFlags); // Only emit an error if the value of 'maskedFlags' is properly // constrained; if (!(trueState && !falseState)) return; if (CE->getNumArgs() < 3) { ExplodedNode *N = C.generateSink(trueState); if (!N) return; LazyInitialize(BT_open, "Improper use of 'open'"); BugReport *report = new BugReport(*BT_open, "Call to 'open' requires a third argument when " "the 'O_CREAT' flag is set", N); report->addRange(oflagsEx->getSourceRange()); C.emitReport(report); } } //===----------------------------------------------------------------------===// // pthread_once //===----------------------------------------------------------------------===// void UnixAPIChecker::CheckPthreadOnce(CheckerContext &C, const CallExpr *CE) const { // This is similar to 'CheckDispatchOnce' in the MacOSXAPIChecker. // They can possibly be refactored. if (CE->getNumArgs() < 1) return; // Check if the first argument is stack allocated. If so, issue a warning // because that's likely to be bad news. ProgramStateRef state = C.getState(); const MemRegion *R = state->getSVal(CE->getArg(0), C.getLocationContext()).getAsRegion(); if (!R || !isa(R->getMemorySpace())) return; ExplodedNode *N = C.generateSink(state); if (!N) return; SmallString<256> S; llvm::raw_svector_ostream os(S); os << "Call to 'pthread_once' uses"; if (const VarRegion *VR = dyn_cast(R)) os << " the local variable '" << VR->getDecl()->getName() << '\''; else os << " stack allocated memory"; os << " for the \"control\" value. Using such transient memory for " "the control value is potentially dangerous."; if (isa(R) && isa(R->getMemorySpace())) os << " Perhaps you intended to declare the variable as 'static'?"; LazyInitialize(BT_pthreadOnce, "Improper use of 'pthread_once'"); BugReport *report = new BugReport(*BT_pthreadOnce, os.str(), N); report->addRange(CE->getArg(0)->getSourceRange()); C.emitReport(report); } //===----------------------------------------------------------------------===// // "calloc", "malloc", "realloc", "reallocf", "alloca" and "valloc" // with allocation size 0 //===----------------------------------------------------------------------===// // FIXME: Eventually these should be rolled into the MallocChecker, but right now // they're more basic and valuable for widespread use. // Returns true if we try to do a zero byte allocation, false otherwise. // Fills in trueState and falseState. static bool IsZeroByteAllocation(ProgramStateRef state, const SVal argVal, ProgramStateRef *trueState, ProgramStateRef *falseState) { std::tie(*trueState, *falseState) = state->assume(argVal.castAs()); return (*falseState && !*trueState); } // Generates an error report, indicating that the function whose name is given // will perform a zero byte allocation. // Returns false if an error occurred, true otherwise. bool UnixAPIChecker::ReportZeroByteAllocation(CheckerContext &C, ProgramStateRef falseState, const Expr *arg, const char *fn_name) const { ExplodedNode *N = C.generateSink(falseState); if (!N) return false; LazyInitialize(BT_mallocZero, "Undefined allocation of 0 bytes (CERT MEM04-C; CWE-131)"); SmallString<256> S; llvm::raw_svector_ostream os(S); os << "Call to '" << fn_name << "' has an allocation size of 0 bytes"; BugReport *report = new BugReport(*BT_mallocZero, os.str(), N); report->addRange(arg->getSourceRange()); bugreporter::trackNullOrUndefValue(N, arg, *report); C.emitReport(report); return true; } // Does a basic check for 0-sized allocations suitable for most of the below // functions (modulo "calloc") void UnixAPIChecker::BasicAllocationCheck(CheckerContext &C, const CallExpr *CE, const unsigned numArgs, const unsigned sizeArg, const char *fn) const { // Sanity check for the correct number of arguments if (CE->getNumArgs() != numArgs) return; // Check if the allocation size is 0. ProgramStateRef state = C.getState(); ProgramStateRef trueState = nullptr, falseState = nullptr; const Expr *arg = CE->getArg(sizeArg); SVal argVal = state->getSVal(arg, C.getLocationContext()); if (argVal.isUnknownOrUndef()) return; // Is the value perfectly constrained to zero? if (IsZeroByteAllocation(state, argVal, &trueState, &falseState)) { (void) ReportZeroByteAllocation(C, falseState, arg, fn); return; } // Assume the value is non-zero going forward. assert(trueState); if (trueState != state) C.addTransition(trueState); } void UnixAPIChecker::CheckCallocZero(CheckerContext &C, const CallExpr *CE) const { unsigned int nArgs = CE->getNumArgs(); if (nArgs != 2) return; ProgramStateRef state = C.getState(); ProgramStateRef trueState = nullptr, falseState = nullptr; unsigned int i; for (i = 0; i < nArgs; i++) { const Expr *arg = CE->getArg(i); SVal argVal = state->getSVal(arg, C.getLocationContext()); if (argVal.isUnknownOrUndef()) { if (i == 0) continue; else return; } if (IsZeroByteAllocation(state, argVal, &trueState, &falseState)) { if (ReportZeroByteAllocation(C, falseState, arg, "calloc")) return; else if (i == 0) continue; else return; } } // Assume the value is non-zero going forward. assert(trueState); if (trueState != state) C.addTransition(trueState); } void UnixAPIChecker::CheckMallocZero(CheckerContext &C, const CallExpr *CE) const { BasicAllocationCheck(C, CE, 1, 0, "malloc"); } void UnixAPIChecker::CheckReallocZero(CheckerContext &C, const CallExpr *CE) const { BasicAllocationCheck(C, CE, 2, 1, "realloc"); } void UnixAPIChecker::CheckReallocfZero(CheckerContext &C, const CallExpr *CE) const { BasicAllocationCheck(C, CE, 2, 1, "reallocf"); } void UnixAPIChecker::CheckAllocaZero(CheckerContext &C, const CallExpr *CE) const { BasicAllocationCheck(C, CE, 1, 0, "alloca"); } void UnixAPIChecker::CheckVallocZero(CheckerContext &C, const CallExpr *CE) const { BasicAllocationCheck(C, CE, 1, 0, "valloc"); } //===----------------------------------------------------------------------===// // Central dispatch function. //===----------------------------------------------------------------------===// void UnixAPIChecker::checkPreStmt(const CallExpr *CE, CheckerContext &C) const { const FunctionDecl *FD = C.getCalleeDecl(CE); if (!FD || FD->getKind() != Decl::Function) return; StringRef FName = C.getCalleeName(FD); if (FName.empty()) return; SubChecker SC = llvm::StringSwitch(FName) .Case("open", &UnixAPIChecker::CheckOpen) .Case("pthread_once", &UnixAPIChecker::CheckPthreadOnce) .Case("calloc", &UnixAPIChecker::CheckCallocZero) .Case("malloc", &UnixAPIChecker::CheckMallocZero) .Case("realloc", &UnixAPIChecker::CheckReallocZero) .Case("reallocf", &UnixAPIChecker::CheckReallocfZero) .Cases("alloca", "__builtin_alloca", &UnixAPIChecker::CheckAllocaZero) .Case("valloc", &UnixAPIChecker::CheckVallocZero) .Default(nullptr); if (SC) (this->*SC)(C, CE); } //===----------------------------------------------------------------------===// // Registration. //===----------------------------------------------------------------------===// void ento::registerUnixAPIChecker(CheckerManager &mgr) { mgr.registerChecker(); } @ 1.1.1.3.4.1 log @file UnixAPIChecker.cpp was added on branch yamt-pagecache on 2014-05-22 16:18:31 +0000 @ text @d1 357 @ 1.1.1.3.4.2 log @sync with head. for a reference, the tree before this commit was tagged as yamt-pagecache-tag8. this commit was splitted into small chunks to avoid a limitation of cvs. ("Protocol error: too many arguments") @ text @a0 357 //= UnixAPIChecker.h - Checks preconditions for various Unix APIs --*- C++ -*-// // // The LLVM Compiler Infrastructure // // This file is distributed under the University of Illinois Open Source // License. See LICENSE.TXT for details. // //===----------------------------------------------------------------------===// // // This defines UnixAPIChecker, which is an assortment of checks on calls // to various, widely used UNIX/Posix functions. // //===----------------------------------------------------------------------===// #include "ClangSACheckers.h" #include "clang/Basic/TargetInfo.h" #include "clang/StaticAnalyzer/Core/BugReporter/BugType.h" #include "clang/StaticAnalyzer/Core/Checker.h" #include "clang/StaticAnalyzer/Core/CheckerManager.h" #include "clang/StaticAnalyzer/Core/PathSensitive/CheckerContext.h" #include "llvm/ADT/Optional.h" #include "llvm/ADT/STLExtras.h" #include "llvm/ADT/SmallString.h" #include "llvm/ADT/StringSwitch.h" #include "llvm/Support/raw_ostream.h" #include using namespace clang; using namespace ento; namespace { class UnixAPIChecker : public Checker< check::PreStmt > { mutable OwningPtr BT_open, BT_pthreadOnce, BT_mallocZero; mutable Optional Val_O_CREAT; public: void checkPreStmt(const CallExpr *CE, CheckerContext &C) const; void CheckOpen(CheckerContext &C, const CallExpr *CE) const; void CheckPthreadOnce(CheckerContext &C, const CallExpr *CE) const; void CheckCallocZero(CheckerContext &C, const CallExpr *CE) const; void CheckMallocZero(CheckerContext &C, const CallExpr *CE) const; void CheckReallocZero(CheckerContext &C, const CallExpr *CE) const; void CheckReallocfZero(CheckerContext &C, const CallExpr *CE) const; void CheckAllocaZero(CheckerContext &C, const CallExpr *CE) const; void CheckVallocZero(CheckerContext &C, const CallExpr *CE) const; typedef void (UnixAPIChecker::*SubChecker)(CheckerContext &, const CallExpr *) const; private: bool ReportZeroByteAllocation(CheckerContext &C, ProgramStateRef falseState, const Expr *arg, const char *fn_name) const; void BasicAllocationCheck(CheckerContext &C, const CallExpr *CE, const unsigned numArgs, const unsigned sizeArg, const char *fn) const; void LazyInitialize(OwningPtr &BT, const char *name) const { if (BT) return; BT.reset(new BugType(this, name, categories::UnixAPI)); } }; } //end anonymous namespace //===----------------------------------------------------------------------===// // "open" (man 2 open) //===----------------------------------------------------------------------===// void UnixAPIChecker::CheckOpen(CheckerContext &C, const CallExpr *CE) const { // The definition of O_CREAT is platform specific. We need a better way // of querying this information from the checking environment. if (!Val_O_CREAT.hasValue()) { if (C.getASTContext().getTargetInfo().getTriple().getVendor() == llvm::Triple::Apple) Val_O_CREAT = 0x0200; else { // FIXME: We need a more general way of getting the O_CREAT value. // We could possibly grovel through the preprocessor state, but // that would require passing the Preprocessor object to the ExprEngine. return; } } // Look at the 'oflags' argument for the O_CREAT flag. ProgramStateRef state = C.getState(); if (CE->getNumArgs() < 2) { // The frontend should issue a warning for this case, so this is a sanity // check. return; } // Now check if oflags has O_CREAT set. const Expr *oflagsEx = CE->getArg(1); const SVal V = state->getSVal(oflagsEx, C.getLocationContext()); if (!V.getAs()) { // The case where 'V' can be a location can only be due to a bad header, // so in this case bail out. return; } NonLoc oflags = V.castAs(); NonLoc ocreateFlag = C.getSValBuilder() .makeIntVal(Val_O_CREAT.getValue(), oflagsEx->getType()).castAs(); SVal maskedFlagsUC = C.getSValBuilder().evalBinOpNN(state, BO_And, oflags, ocreateFlag, oflagsEx->getType()); if (maskedFlagsUC.isUnknownOrUndef()) return; DefinedSVal maskedFlags = maskedFlagsUC.castAs(); // Check if maskedFlags is non-zero. ProgramStateRef trueState, falseState; llvm::tie(trueState, falseState) = state->assume(maskedFlags); // Only emit an error if the value of 'maskedFlags' is properly // constrained; if (!(trueState && !falseState)) return; if (CE->getNumArgs() < 3) { ExplodedNode *N = C.generateSink(trueState); if (!N) return; LazyInitialize(BT_open, "Improper use of 'open'"); BugReport *report = new BugReport(*BT_open, "Call to 'open' requires a third argument when " "the 'O_CREAT' flag is set", N); report->addRange(oflagsEx->getSourceRange()); C.emitReport(report); } } //===----------------------------------------------------------------------===// // pthread_once //===----------------------------------------------------------------------===// void UnixAPIChecker::CheckPthreadOnce(CheckerContext &C, const CallExpr *CE) const { // This is similar to 'CheckDispatchOnce' in the MacOSXAPIChecker. // They can possibly be refactored. if (CE->getNumArgs() < 1) return; // Check if the first argument is stack allocated. If so, issue a warning // because that's likely to be bad news. ProgramStateRef state = C.getState(); const MemRegion *R = state->getSVal(CE->getArg(0), C.getLocationContext()).getAsRegion(); if (!R || !isa(R->getMemorySpace())) return; ExplodedNode *N = C.generateSink(state); if (!N) return; SmallString<256> S; llvm::raw_svector_ostream os(S); os << "Call to 'pthread_once' uses"; if (const VarRegion *VR = dyn_cast(R)) os << " the local variable '" << VR->getDecl()->getName() << '\''; else os << " stack allocated memory"; os << " for the \"control\" value. Using such transient memory for " "the control value is potentially dangerous."; if (isa(R) && isa(R->getMemorySpace())) os << " Perhaps you intended to declare the variable as 'static'?"; LazyInitialize(BT_pthreadOnce, "Improper use of 'pthread_once'"); BugReport *report = new BugReport(*BT_pthreadOnce, os.str(), N); report->addRange(CE->getArg(0)->getSourceRange()); C.emitReport(report); } //===----------------------------------------------------------------------===// // "calloc", "malloc", "realloc", "reallocf", "alloca" and "valloc" // with allocation size 0 //===----------------------------------------------------------------------===// // FIXME: Eventually these should be rolled into the MallocChecker, but right now // they're more basic and valuable for widespread use. // Returns true if we try to do a zero byte allocation, false otherwise. // Fills in trueState and falseState. static bool IsZeroByteAllocation(ProgramStateRef state, const SVal argVal, ProgramStateRef *trueState, ProgramStateRef *falseState) { llvm::tie(*trueState, *falseState) = state->assume(argVal.castAs()); return (*falseState && !*trueState); } // Generates an error report, indicating that the function whose name is given // will perform a zero byte allocation. // Returns false if an error occurred, true otherwise. bool UnixAPIChecker::ReportZeroByteAllocation(CheckerContext &C, ProgramStateRef falseState, const Expr *arg, const char *fn_name) const { ExplodedNode *N = C.generateSink(falseState); if (!N) return false; LazyInitialize(BT_mallocZero, "Undefined allocation of 0 bytes (CERT MEM04-C; CWE-131)"); SmallString<256> S; llvm::raw_svector_ostream os(S); os << "Call to '" << fn_name << "' has an allocation size of 0 bytes"; BugReport *report = new BugReport(*BT_mallocZero, os.str(), N); report->addRange(arg->getSourceRange()); bugreporter::trackNullOrUndefValue(N, arg, *report); C.emitReport(report); return true; } // Does a basic check for 0-sized allocations suitable for most of the below // functions (modulo "calloc") void UnixAPIChecker::BasicAllocationCheck(CheckerContext &C, const CallExpr *CE, const unsigned numArgs, const unsigned sizeArg, const char *fn) const { // Sanity check for the correct number of arguments if (CE->getNumArgs() != numArgs) return; // Check if the allocation size is 0. ProgramStateRef state = C.getState(); ProgramStateRef trueState = NULL, falseState = NULL; const Expr *arg = CE->getArg(sizeArg); SVal argVal = state->getSVal(arg, C.getLocationContext()); if (argVal.isUnknownOrUndef()) return; // Is the value perfectly constrained to zero? if (IsZeroByteAllocation(state, argVal, &trueState, &falseState)) { (void) ReportZeroByteAllocation(C, falseState, arg, fn); return; } // Assume the value is non-zero going forward. assert(trueState); if (trueState != state) C.addTransition(trueState); } void UnixAPIChecker::CheckCallocZero(CheckerContext &C, const CallExpr *CE) const { unsigned int nArgs = CE->getNumArgs(); if (nArgs != 2) return; ProgramStateRef state = C.getState(); ProgramStateRef trueState = NULL, falseState = NULL; unsigned int i; for (i = 0; i < nArgs; i++) { const Expr *arg = CE->getArg(i); SVal argVal = state->getSVal(arg, C.getLocationContext()); if (argVal.isUnknownOrUndef()) { if (i == 0) continue; else return; } if (IsZeroByteAllocation(state, argVal, &trueState, &falseState)) { if (ReportZeroByteAllocation(C, falseState, arg, "calloc")) return; else if (i == 0) continue; else return; } } // Assume the value is non-zero going forward. assert(trueState); if (trueState != state) C.addTransition(trueState); } void UnixAPIChecker::CheckMallocZero(CheckerContext &C, const CallExpr *CE) const { BasicAllocationCheck(C, CE, 1, 0, "malloc"); } void UnixAPIChecker::CheckReallocZero(CheckerContext &C, const CallExpr *CE) const { BasicAllocationCheck(C, CE, 2, 1, "realloc"); } void UnixAPIChecker::CheckReallocfZero(CheckerContext &C, const CallExpr *CE) const { BasicAllocationCheck(C, CE, 2, 1, "reallocf"); } void UnixAPIChecker::CheckAllocaZero(CheckerContext &C, const CallExpr *CE) const { BasicAllocationCheck(C, CE, 1, 0, "alloca"); } void UnixAPIChecker::CheckVallocZero(CheckerContext &C, const CallExpr *CE) const { BasicAllocationCheck(C, CE, 1, 0, "valloc"); } //===----------------------------------------------------------------------===// // Central dispatch function. //===----------------------------------------------------------------------===// void UnixAPIChecker::checkPreStmt(const CallExpr *CE, CheckerContext &C) const { const FunctionDecl *FD = C.getCalleeDecl(CE); if (!FD || FD->getKind() != Decl::Function) return; StringRef FName = C.getCalleeName(FD); if (FName.empty()) return; SubChecker SC = llvm::StringSwitch(FName) .Case("open", &UnixAPIChecker::CheckOpen) .Case("pthread_once", &UnixAPIChecker::CheckPthreadOnce) .Case("calloc", &UnixAPIChecker::CheckCallocZero) .Case("malloc", &UnixAPIChecker::CheckMallocZero) .Case("realloc", &UnixAPIChecker::CheckReallocZero) .Case("reallocf", &UnixAPIChecker::CheckReallocfZero) .Cases("alloca", "__builtin_alloca", &UnixAPIChecker::CheckAllocaZero) .Case("valloc", &UnixAPIChecker::CheckVallocZero) .Default(NULL); if (SC) (this->*SC)(C, CE); } //===----------------------------------------------------------------------===// // Registration. //===----------------------------------------------------------------------===// void ento::registerUnixAPIChecker(CheckerManager &mgr) { mgr.registerChecker(); } @