1 //== ReturnPointerRangeChecker.cpp ------------------------------*- C++ -*--==// 2 // 3 // The LLVM Compiler Infrastructure 4 // 5 // This file is distributed under the University of Illinois Open Source 6 // License. See LICENSE.TXT for details. 7 // 8 //===----------------------------------------------------------------------===// 9 // 10 // This file defines ReturnPointerRangeChecker, which is a path-sensitive check 11 // which looks for an out-of-bound pointer being returned to callers. 12 // 13 //===----------------------------------------------------------------------===// 14 15 #include "ClangSACheckers.h" 16 #include "clang/StaticAnalyzer/Core/BugReporter/BugType.h" 17 #include "clang/StaticAnalyzer/Core/Checker.h" 18 #include "clang/StaticAnalyzer/Core/CheckerManager.h" 19 #include "clang/StaticAnalyzer/Core/PathSensitive/CheckerContext.h" 20 #include "clang/StaticAnalyzer/Core/PathSensitive/ExprEngine.h" 21 22 using namespace clang; 23 using namespace ento; 24 25 namespace { 26 class ReturnPointerRangeChecker : 27 public Checker< check::PreStmt<ReturnStmt> > { 28 mutable OwningPtr<BuiltinBug> BT; 29 public: 30 void checkPreStmt(const ReturnStmt *RS, CheckerContext &C) const; 31 }; 32 } 33 34 void ReturnPointerRangeChecker::checkPreStmt(const ReturnStmt *RS, 35 CheckerContext &C) const { 36 ProgramStateRef state = C.getState(); 37 38 const Expr *RetE = RS->getRetValue(); 39 if (!RetE) 40 return; 41 42 SVal V = state->getSVal(RetE, C.getLocationContext()); 43 const MemRegion *R = V.getAsRegion(); 44 45 const ElementRegion *ER = dyn_cast_or_null<ElementRegion>(R); 46 if (!ER) 47 return; 48 49 DefinedOrUnknownSVal Idx = ER->getIndex().castAs<DefinedOrUnknownSVal>(); 50 // Zero index is always in bound, this also passes ElementRegions created for 51 // pointer casts. 52 if (Idx.isZeroConstant()) 53 return; 54 // FIXME: All of this out-of-bounds checking should eventually be refactored 55 // into a common place. 56 57 DefinedOrUnknownSVal NumElements 58 = C.getStoreManager().getSizeInElements(state, ER->getSuperRegion(), 59 ER->getValueType()); 60 61 ProgramStateRef StInBound = state->assumeInBound(Idx, NumElements, true); 62 ProgramStateRef StOutBound = state->assumeInBound(Idx, NumElements, false); 63 if (StOutBound && !StInBound) { 64 ExplodedNode *N = C.generateSink(StOutBound); 65 66 if (!N) 67 return; 68 69 // FIXME: This bug correspond to CWE-466. Eventually we should have bug 70 // types explicitly reference such exploit categories (when applicable). 71 if (!BT) 72 BT.reset(new BuiltinBug( 73 this, "Return of pointer value outside of expected range", 74 "Returned pointer value points outside the original object " 75 "(potential buffer overflow)")); 76 77 // FIXME: It would be nice to eventually make this diagnostic more clear, 78 // e.g., by referencing the original declaration or by saying *why* this 79 // reference is outside the range. 80 81 // Generate a report for this bug. 82 BugReport *report = 83 new BugReport(*BT, BT->getDescription(), N); 84 85 report->addRange(RetE->getSourceRange()); 86 C.emitReport(report); 87 } 88 } 89 90 void ento::registerReturnPointerRangeChecker(CheckerManager &mgr) { 91 mgr.registerChecker<ReturnPointerRangeChecker>(); 92 } 93