1 //=== StdLibraryFunctionsChecker.cpp - Model standard functions -*- C++ -*-===// 2 // 3 // Part of the LLVM Project, under the Apache License v2.0 with LLVM Exceptions. 4 // See https://llvm.org/LICENSE.txt for license information. 5 // SPDX-License-Identifier: Apache-2.0 WITH LLVM-exception 6 // 7 //===----------------------------------------------------------------------===// 8 // 9 // This checker improves modeling of a few simple library functions. 10 // 11 // This checker provides a specification format - `Summary' - and 12 // contains descriptions of some library functions in this format. Each 13 // specification contains a list of branches for splitting the program state 14 // upon call, and range constraints on argument and return-value symbols that 15 // are satisfied on each branch. This spec can be expanded to include more 16 // items, like external effects of the function. 17 // 18 // The main difference between this approach and the body farms technique is 19 // in more explicit control over how many branches are produced. For example, 20 // consider standard C function `ispunct(int x)', which returns a non-zero value 21 // iff `x' is a punctuation character, that is, when `x' is in range 22 // ['!', '/'] [':', '@'] U ['[', '\`'] U ['{', '~']. 23 // `Summary' provides only two branches for this function. However, 24 // any attempt to describe this range with if-statements in the body farm 25 // would result in many more branches. Because each branch needs to be analyzed 26 // independently, this significantly reduces performance. Additionally, 27 // once we consider a branch on which `x' is in range, say, ['!', '/'], 28 // we assume that such branch is an important separate path through the program, 29 // which may lead to false positives because considering this particular path 30 // was not consciously intended, and therefore it might have been unreachable. 31 // 32 // This checker uses eval::Call for modeling pure functions (functions without 33 // side effets), for which their `Summary' is a precise model. This avoids 34 // unnecessary invalidation passes. Conflicts with other checkers are unlikely 35 // because if the function has no other effects, other checkers would probably 36 // never want to improve upon the modeling done by this checker. 37 // 38 // Non-pure functions, for which only partial improvement over the default 39 // behavior is expected, are modeled via check::PostCall, non-intrusively. 40 // 41 //===----------------------------------------------------------------------===// 42 43 #include "ErrnoModeling.h" 44 #include "clang/StaticAnalyzer/Checkers/BuiltinCheckerRegistration.h" 45 #include "clang/StaticAnalyzer/Core/BugReporter/BugType.h" 46 #include "clang/StaticAnalyzer/Core/Checker.h" 47 #include "clang/StaticAnalyzer/Core/CheckerManager.h" 48 #include "clang/StaticAnalyzer/Core/PathSensitive/CallEvent.h" 49 #include "clang/StaticAnalyzer/Core/PathSensitive/CheckerContext.h" 50 #include "clang/StaticAnalyzer/Core/PathSensitive/CheckerHelpers.h" 51 #include "clang/StaticAnalyzer/Core/PathSensitive/DynamicExtent.h" 52 #include "llvm/ADT/STLExtras.h" 53 #include "llvm/ADT/SmallString.h" 54 #include "llvm/ADT/StringExtras.h" 55 #include "llvm/Support/FormatVariadic.h" 56 57 #include <optional> 58 #include <string> 59 60 using namespace clang; 61 using namespace clang::ento; 62 63 namespace { 64 class StdLibraryFunctionsChecker 65 : public Checker<check::PreCall, check::PostCall, eval::Call> { 66 67 class Summary; 68 69 /// Specify how much the analyzer engine should entrust modeling this function 70 /// to us. 71 enum InvalidationKind { 72 /// No \c eval::Call for the function, it can be modeled elsewhere. 73 /// This checker checks only pre and post conditions. 74 NoEvalCall, 75 /// The function is modeled completely in this checker. 76 EvalCallAsPure 77 }; 78 79 /// Given a range, should the argument stay inside or outside this range? 80 enum RangeKind { OutOfRange, WithinRange }; 81 82 static RangeKind negateKind(RangeKind K) { 83 switch (K) { 84 case OutOfRange: 85 return WithinRange; 86 case WithinRange: 87 return OutOfRange; 88 } 89 llvm_unreachable("Unknown range kind"); 90 } 91 92 /// The universal integral type to use in value range descriptions. 93 /// Unsigned to make sure overflows are well-defined. 94 typedef uint64_t RangeInt; 95 96 /// Describes a single range constraint. Eg. {{0, 1}, {3, 4}} is 97 /// a non-negative integer, which less than 5 and not equal to 2. 98 typedef std::vector<std::pair<RangeInt, RangeInt>> IntRangeVector; 99 100 /// A reference to an argument or return value by its number. 101 /// ArgNo in CallExpr and CallEvent is defined as Unsigned, but 102 /// obviously uint32_t should be enough for all practical purposes. 103 typedef uint32_t ArgNo; 104 /// Special argument number for specifying the return value. 105 static const ArgNo Ret; 106 107 /// Get a string representation of an argument index. 108 /// E.g.: (1) -> '1st arg', (2) - > '2nd arg' 109 static void printArgDesc(ArgNo, llvm::raw_ostream &Out); 110 /// Print value X of the argument in form " (which is X)", 111 /// if the value is a fixed known value, otherwise print nothing. 112 /// This is used as simple explanation of values if possible. 113 static void printArgValueInfo(ArgNo ArgN, ProgramStateRef State, 114 const CallEvent &Call, llvm::raw_ostream &Out); 115 /// Append textual description of a numeric range [RMin,RMax] to 116 /// \p Out. 117 static void appendInsideRangeDesc(llvm::APSInt RMin, llvm::APSInt RMax, 118 QualType ArgT, BasicValueFactory &BVF, 119 llvm::raw_ostream &Out); 120 /// Append textual description of a numeric range out of [RMin,RMax] to 121 /// \p Out. 122 static void appendOutOfRangeDesc(llvm::APSInt RMin, llvm::APSInt RMax, 123 QualType ArgT, BasicValueFactory &BVF, 124 llvm::raw_ostream &Out); 125 126 class ValueConstraint; 127 128 /// Pointer to the ValueConstraint. We need a copyable, polymorphic and 129 /// default initializable type (vector needs that). A raw pointer was good, 130 /// however, we cannot default initialize that. unique_ptr makes the Summary 131 /// class non-copyable, therefore not an option. Releasing the copyability 132 /// requirement would render the initialization of the Summary map infeasible. 133 /// Mind that a pointer to a new value constraint is created when the negate 134 /// function is used. 135 using ValueConstraintPtr = std::shared_ptr<ValueConstraint>; 136 137 /// Polymorphic base class that represents a constraint on a given argument 138 /// (or return value) of a function. Derived classes implement different kind 139 /// of constraints, e.g range constraints or correlation between two 140 /// arguments. 141 /// These are used as argument constraints (preconditions) of functions, in 142 /// which case a bug report may be emitted if the constraint is not satisfied. 143 /// Another use is as conditions for summary cases, to create different 144 /// classes of behavior for a function. In this case no description of the 145 /// constraint is needed because the summary cases have an own (not generated) 146 /// description string. 147 class ValueConstraint { 148 public: 149 ValueConstraint(ArgNo ArgN) : ArgN(ArgN) {} 150 virtual ~ValueConstraint() {} 151 152 /// Apply the effects of the constraint on the given program state. If null 153 /// is returned then the constraint is not feasible. 154 virtual ProgramStateRef apply(ProgramStateRef State, const CallEvent &Call, 155 const Summary &Summary, 156 CheckerContext &C) const = 0; 157 158 /// Represents that in which context do we require a description of the 159 /// constraint. 160 enum DescriptionKind { 161 /// Describe a constraint that was violated. 162 /// Description should start with something like "should be". 163 Violation, 164 /// Describe a constraint that was assumed to be true. 165 /// This can be used when a precondition is satisfied, or when a summary 166 /// case is applied. 167 /// Description should start with something like "is". 168 Assumption 169 }; 170 171 /// Give a description that explains the constraint to the user. Used when 172 /// a bug is reported or when the constraint is applied and displayed as a 173 /// note. The description should not mention the argument (getArgNo). 174 /// See StdLibraryFunctionsChecker::reportBug about how this function is 175 /// used (this function is used not only there). 176 virtual void describe(DescriptionKind DK, const CallEvent &Call, 177 ProgramStateRef State, const Summary &Summary, 178 llvm::raw_ostream &Out) const { 179 // There are some descendant classes that are not used as argument 180 // constraints, e.g. ComparisonConstraint. In that case we can safely 181 // ignore the implementation of this function. 182 llvm_unreachable( 183 "Description not implemented for summary case constraints"); 184 } 185 186 /// Give a description that explains the actual argument value (where the 187 /// current ValueConstraint applies to) to the user. This function should be 188 /// called only when the current constraint is satisfied by the argument. 189 /// It should produce a more precise description than the constraint itself. 190 /// The actual value of the argument and the program state can be used to 191 /// make the description more precise. In the most simple case, if the 192 /// argument has a fixed known value this value can be printed into \p Out, 193 /// this is done by default. 194 /// The function should return true if a description was printed to \p Out, 195 /// otherwise false. 196 /// See StdLibraryFunctionsChecker::reportBug about how this function is 197 /// used. 198 virtual bool describeArgumentValue(const CallEvent &Call, 199 ProgramStateRef State, 200 const Summary &Summary, 201 llvm::raw_ostream &Out) const { 202 if (auto N = getArgSVal(Call, getArgNo()).getAs<NonLoc>()) { 203 if (const llvm::APSInt *Int = N->getAsInteger()) { 204 Out << *Int; 205 return true; 206 } 207 } 208 return false; 209 } 210 211 /// Return those arguments that should be tracked when we report a bug about 212 /// argument constraint violation. By default it is the argument that is 213 /// constrained, however, in some special cases we need to track other 214 /// arguments as well. E.g. a buffer size might be encoded in another 215 /// argument. 216 /// The "return value" argument number can not occur as returned value. 217 virtual std::vector<ArgNo> getArgsToTrack() const { return {ArgN}; } 218 219 /// Get a constraint that represents exactly the opposite of the current. 220 virtual ValueConstraintPtr negate() const { 221 llvm_unreachable("Not implemented"); 222 }; 223 224 /// Check whether the constraint is malformed or not. It is malformed if the 225 /// specified argument has a mismatch with the given FunctionDecl (e.g. the 226 /// arg number is out-of-range of the function's argument list). 227 /// This condition can indicate if a probably wrong or unexpected function 228 /// was found where the constraint is to be applied. 229 bool checkValidity(const FunctionDecl *FD) const { 230 const bool ValidArg = ArgN == Ret || ArgN < FD->getNumParams(); 231 assert(ValidArg && "Arg out of range!"); 232 if (!ValidArg) 233 return false; 234 // Subclasses may further refine the validation. 235 return checkSpecificValidity(FD); 236 } 237 238 /// Return the argument number (may be placeholder for "return value"). 239 ArgNo getArgNo() const { return ArgN; } 240 241 protected: 242 /// Argument to which to apply the constraint. It can be a real argument of 243 /// the function to check, or a special value to indicate the return value 244 /// of the function. 245 /// Every constraint is assigned to one main argument, even if other 246 /// arguments are involved. 247 ArgNo ArgN; 248 249 /// Do constraint-specific validation check. 250 virtual bool checkSpecificValidity(const FunctionDecl *FD) const { 251 return true; 252 } 253 }; 254 255 /// Check if a single argument falls into a specific "range". 256 /// A range is formed as a set of intervals. 257 /// E.g. \code {['A', 'Z'], ['a', 'z'], ['_', '_']} \endcode 258 /// The intervals are closed intervals that contain one or more values. 259 /// 260 /// The default constructed RangeConstraint has an empty range, applying 261 /// such constraint does not involve any assumptions, thus the State remains 262 /// unchanged. This is meaningful, if the range is dependent on a looked up 263 /// type (e.g. [0, Socklen_tMax]). If the type is not found, then the range 264 /// is default initialized to be empty. 265 class RangeConstraint : public ValueConstraint { 266 /// The constraint can be specified by allowing or disallowing the range. 267 /// WithinRange indicates allowing the range, OutOfRange indicates 268 /// disallowing it (allowing the complementary range). 269 RangeKind Kind; 270 271 /// A set of intervals. 272 IntRangeVector Ranges; 273 274 /// A textual description of this constraint for the specific case where the 275 /// constraint is used. If empty a generated description will be used that 276 /// is built from the range of the constraint. 277 StringRef Description; 278 279 public: 280 RangeConstraint(ArgNo ArgN, RangeKind Kind, const IntRangeVector &Ranges, 281 StringRef Desc = "") 282 : ValueConstraint(ArgN), Kind(Kind), Ranges(Ranges), Description(Desc) { 283 } 284 285 const IntRangeVector &getRanges() const { return Ranges; } 286 287 ProgramStateRef apply(ProgramStateRef State, const CallEvent &Call, 288 const Summary &Summary, 289 CheckerContext &C) const override; 290 291 void describe(DescriptionKind DK, const CallEvent &Call, 292 ProgramStateRef State, const Summary &Summary, 293 llvm::raw_ostream &Out) const override; 294 295 bool describeArgumentValue(const CallEvent &Call, ProgramStateRef State, 296 const Summary &Summary, 297 llvm::raw_ostream &Out) const override; 298 299 ValueConstraintPtr negate() const override { 300 RangeConstraint Tmp(*this); 301 Tmp.Kind = negateKind(Kind); 302 return std::make_shared<RangeConstraint>(Tmp); 303 } 304 305 protected: 306 bool checkSpecificValidity(const FunctionDecl *FD) const override { 307 const bool ValidArg = 308 getArgType(FD, ArgN)->isIntegralType(FD->getASTContext()); 309 assert(ValidArg && 310 "This constraint should be applied on an integral type"); 311 return ValidArg; 312 } 313 314 private: 315 /// A callback function that is used when iterating over the range 316 /// intervals. It gets the begin and end (inclusive) of one interval. 317 /// This is used to make any kind of task possible that needs an iteration 318 /// over the intervals. 319 using RangeApplyFunction = 320 std::function<bool(const llvm::APSInt &Min, const llvm::APSInt &Max)>; 321 322 /// Call a function on the intervals of the range. 323 /// The function is called with all intervals in the range. 324 void applyOnWithinRange(BasicValueFactory &BVF, QualType ArgT, 325 const RangeApplyFunction &F) const; 326 /// Call a function on all intervals in the complementary range. 327 /// The function is called with all intervals that fall out of the range. 328 /// E.g. consider an interval list [A, B] and [C, D] 329 /// \code 330 /// -------+--------+------------------+------------+-----------> 331 /// A B C D 332 /// \endcode 333 /// We get the ranges [-inf, A - 1], [D + 1, +inf], [B + 1, C - 1]. 334 /// The \p ArgT is used to determine the min and max of the type that is 335 /// used as "-inf" and "+inf". 336 void applyOnOutOfRange(BasicValueFactory &BVF, QualType ArgT, 337 const RangeApplyFunction &F) const; 338 /// Call a function on the intervals of the range or the complementary 339 /// range. 340 void applyOnRange(RangeKind Kind, BasicValueFactory &BVF, QualType ArgT, 341 const RangeApplyFunction &F) const { 342 switch (Kind) { 343 case OutOfRange: 344 applyOnOutOfRange(BVF, ArgT, F); 345 break; 346 case WithinRange: 347 applyOnWithinRange(BVF, ArgT, F); 348 break; 349 }; 350 } 351 }; 352 353 /// Check relation of an argument to another. 354 class ComparisonConstraint : public ValueConstraint { 355 BinaryOperator::Opcode Opcode; 356 ArgNo OtherArgN; 357 358 public: 359 ComparisonConstraint(ArgNo ArgN, BinaryOperator::Opcode Opcode, 360 ArgNo OtherArgN) 361 : ValueConstraint(ArgN), Opcode(Opcode), OtherArgN(OtherArgN) {} 362 ArgNo getOtherArgNo() const { return OtherArgN; } 363 BinaryOperator::Opcode getOpcode() const { return Opcode; } 364 ProgramStateRef apply(ProgramStateRef State, const CallEvent &Call, 365 const Summary &Summary, 366 CheckerContext &C) const override; 367 }; 368 369 /// Check null or non-null-ness of an argument that is of pointer type. 370 class NotNullConstraint : public ValueConstraint { 371 using ValueConstraint::ValueConstraint; 372 // This variable has a role when we negate the constraint. 373 bool CannotBeNull = true; 374 375 public: 376 NotNullConstraint(ArgNo ArgN, bool CannotBeNull = true) 377 : ValueConstraint(ArgN), CannotBeNull(CannotBeNull) {} 378 379 ProgramStateRef apply(ProgramStateRef State, const CallEvent &Call, 380 const Summary &Summary, 381 CheckerContext &C) const override; 382 383 void describe(DescriptionKind DK, const CallEvent &Call, 384 ProgramStateRef State, const Summary &Summary, 385 llvm::raw_ostream &Out) const override; 386 387 bool describeArgumentValue(const CallEvent &Call, ProgramStateRef State, 388 const Summary &Summary, 389 llvm::raw_ostream &Out) const override; 390 391 ValueConstraintPtr negate() const override { 392 NotNullConstraint Tmp(*this); 393 Tmp.CannotBeNull = !this->CannotBeNull; 394 return std::make_shared<NotNullConstraint>(Tmp); 395 } 396 397 protected: 398 bool checkSpecificValidity(const FunctionDecl *FD) const override { 399 const bool ValidArg = getArgType(FD, ArgN)->isPointerType(); 400 assert(ValidArg && 401 "This constraint should be applied only on a pointer type"); 402 return ValidArg; 403 } 404 }; 405 406 /// Check null or non-null-ness of an argument that is of pointer type. 407 /// The argument is meant to be a buffer that has a size constraint, and it 408 /// is allowed to have a NULL value if the size is 0. The size can depend on 409 /// 1 or 2 additional arguments, if one of these is 0 the buffer is allowed to 410 /// be NULL. This is useful for functions like `fread` which have this special 411 /// property. 412 class NotNullBufferConstraint : public ValueConstraint { 413 using ValueConstraint::ValueConstraint; 414 ArgNo SizeArg1N; 415 std::optional<ArgNo> SizeArg2N; 416 // This variable has a role when we negate the constraint. 417 bool CannotBeNull = true; 418 419 public: 420 NotNullBufferConstraint(ArgNo ArgN, ArgNo SizeArg1N, 421 std::optional<ArgNo> SizeArg2N, 422 bool CannotBeNull = true) 423 : ValueConstraint(ArgN), SizeArg1N(SizeArg1N), SizeArg2N(SizeArg2N), 424 CannotBeNull(CannotBeNull) {} 425 426 ProgramStateRef apply(ProgramStateRef State, const CallEvent &Call, 427 const Summary &Summary, 428 CheckerContext &C) const override; 429 430 void describe(DescriptionKind DK, const CallEvent &Call, 431 ProgramStateRef State, const Summary &Summary, 432 llvm::raw_ostream &Out) const override; 433 434 bool describeArgumentValue(const CallEvent &Call, ProgramStateRef State, 435 const Summary &Summary, 436 llvm::raw_ostream &Out) const override; 437 438 ValueConstraintPtr negate() const override { 439 NotNullBufferConstraint Tmp(*this); 440 Tmp.CannotBeNull = !this->CannotBeNull; 441 return std::make_shared<NotNullBufferConstraint>(Tmp); 442 } 443 444 protected: 445 bool checkSpecificValidity(const FunctionDecl *FD) const override { 446 const bool ValidArg = getArgType(FD, ArgN)->isPointerType(); 447 assert(ValidArg && 448 "This constraint should be applied only on a pointer type"); 449 return ValidArg; 450 } 451 }; 452 453 // Represents a buffer argument with an additional size constraint. The 454 // constraint may be a concrete value, or a symbolic value in an argument. 455 // Example 1. Concrete value as the minimum buffer size. 456 // char *asctime_r(const struct tm *restrict tm, char *restrict buf); 457 // // `buf` size must be at least 26 bytes according the POSIX standard. 458 // Example 2. Argument as a buffer size. 459 // ctime_s(char *buffer, rsize_t bufsz, const time_t *time); 460 // Example 3. The size is computed as a multiplication of other args. 461 // size_t fread(void *ptr, size_t size, size_t nmemb, FILE *stream); 462 // // Here, ptr is the buffer, and its minimum size is `size * nmemb`. 463 class BufferSizeConstraint : public ValueConstraint { 464 // The concrete value which is the minimum size for the buffer. 465 std::optional<llvm::APSInt> ConcreteSize; 466 // The argument which holds the size of the buffer. 467 std::optional<ArgNo> SizeArgN; 468 // The argument which is a multiplier to size. This is set in case of 469 // `fread` like functions where the size is computed as a multiplication of 470 // two arguments. 471 std::optional<ArgNo> SizeMultiplierArgN; 472 // The operator we use in apply. This is negated in negate(). 473 BinaryOperator::Opcode Op = BO_LE; 474 475 public: 476 BufferSizeConstraint(ArgNo Buffer, llvm::APSInt BufMinSize) 477 : ValueConstraint(Buffer), ConcreteSize(BufMinSize) {} 478 BufferSizeConstraint(ArgNo Buffer, ArgNo BufSize) 479 : ValueConstraint(Buffer), SizeArgN(BufSize) {} 480 BufferSizeConstraint(ArgNo Buffer, ArgNo BufSize, ArgNo BufSizeMultiplier) 481 : ValueConstraint(Buffer), SizeArgN(BufSize), 482 SizeMultiplierArgN(BufSizeMultiplier) {} 483 484 ProgramStateRef apply(ProgramStateRef State, const CallEvent &Call, 485 const Summary &Summary, 486 CheckerContext &C) const override; 487 488 void describe(DescriptionKind DK, const CallEvent &Call, 489 ProgramStateRef State, const Summary &Summary, 490 llvm::raw_ostream &Out) const override; 491 492 bool describeArgumentValue(const CallEvent &Call, ProgramStateRef State, 493 const Summary &Summary, 494 llvm::raw_ostream &Out) const override; 495 496 std::vector<ArgNo> getArgsToTrack() const override { 497 std::vector<ArgNo> Result{ArgN}; 498 if (SizeArgN) 499 Result.push_back(*SizeArgN); 500 if (SizeMultiplierArgN) 501 Result.push_back(*SizeMultiplierArgN); 502 return Result; 503 } 504 505 ValueConstraintPtr negate() const override { 506 BufferSizeConstraint Tmp(*this); 507 Tmp.Op = BinaryOperator::negateComparisonOp(Op); 508 return std::make_shared<BufferSizeConstraint>(Tmp); 509 } 510 511 protected: 512 bool checkSpecificValidity(const FunctionDecl *FD) const override { 513 const bool ValidArg = getArgType(FD, ArgN)->isPointerType(); 514 assert(ValidArg && 515 "This constraint should be applied only on a pointer type"); 516 return ValidArg; 517 } 518 }; 519 520 /// The complete list of constraints that defines a single branch. 521 using ConstraintSet = std::vector<ValueConstraintPtr>; 522 523 /// Define how a function affects the system variable 'errno'. 524 /// This works together with the \c ErrnoModeling and \c ErrnoChecker classes. 525 /// Currently 3 use cases exist: success, failure, irrelevant. 526 /// In the future the failure case can be customized to set \c errno to a 527 /// more specific constraint (for example > 0), or new case can be added 528 /// for functions which require check of \c errno in both success and failure 529 /// case. 530 class ErrnoConstraintBase { 531 public: 532 /// Apply specific state changes related to the errno variable. 533 virtual ProgramStateRef apply(ProgramStateRef State, const CallEvent &Call, 534 const Summary &Summary, 535 CheckerContext &C) const = 0; 536 /// Get a description about what happens with 'errno' here and how it causes 537 /// a later bug report created by ErrnoChecker. 538 /// Empty return value means that 'errno' related bug may not happen from 539 /// the current analyzed function. 540 virtual const std::string describe(CheckerContext &C) const { return ""; } 541 542 virtual ~ErrnoConstraintBase() {} 543 544 protected: 545 ErrnoConstraintBase() = default; 546 547 /// This is used for conjure symbol for errno to differentiate from the 548 /// original call expression (same expression is used for the errno symbol). 549 static int Tag; 550 }; 551 552 /// Reset errno constraints to irrelevant. 553 /// This is applicable to functions that may change 'errno' and are not 554 /// modeled elsewhere. 555 class ResetErrnoConstraint : public ErrnoConstraintBase { 556 public: 557 ProgramStateRef apply(ProgramStateRef State, const CallEvent &Call, 558 const Summary &Summary, 559 CheckerContext &C) const override { 560 return errno_modeling::setErrnoState(State, errno_modeling::Irrelevant); 561 } 562 }; 563 564 /// Do not change errno constraints. 565 /// This is applicable to functions that are modeled in another checker 566 /// and the already set errno constraints should not be changed in the 567 /// post-call event. 568 class NoErrnoConstraint : public ErrnoConstraintBase { 569 public: 570 ProgramStateRef apply(ProgramStateRef State, const CallEvent &Call, 571 const Summary &Summary, 572 CheckerContext &C) const override { 573 return State; 574 } 575 }; 576 577 /// Set errno constraint at failure cases of standard functions. 578 /// Failure case: 'errno' becomes not equal to 0 and may or may not be checked 579 /// by the program. \c ErrnoChecker does not emit a bug report after such a 580 /// function call. 581 class FailureErrnoConstraint : public ErrnoConstraintBase { 582 public: 583 ProgramStateRef apply(ProgramStateRef State, const CallEvent &Call, 584 const Summary &Summary, 585 CheckerContext &C) const override { 586 SValBuilder &SVB = C.getSValBuilder(); 587 NonLoc ErrnoSVal = 588 SVB.conjureSymbolVal(&Tag, Call.getOriginExpr(), 589 C.getLocationContext(), C.getASTContext().IntTy, 590 C.blockCount()) 591 .castAs<NonLoc>(); 592 return errno_modeling::setErrnoForStdFailure(State, C, ErrnoSVal); 593 } 594 }; 595 596 /// Set errno constraint at success cases of standard functions. 597 /// Success case: 'errno' is not allowed to be used because the value is 598 /// undefined after successful call. 599 /// \c ErrnoChecker can emit bug report after such a function call if errno 600 /// is used. 601 class SuccessErrnoConstraint : public ErrnoConstraintBase { 602 public: 603 ProgramStateRef apply(ProgramStateRef State, const CallEvent &Call, 604 const Summary &Summary, 605 CheckerContext &C) const override { 606 return errno_modeling::setErrnoForStdSuccess(State, C); 607 } 608 609 const std::string describe(CheckerContext &C) const override { 610 return "'errno' becomes undefined after the call"; 611 } 612 }; 613 614 /// Set errno constraint at functions that indicate failure only with 'errno'. 615 /// In this case 'errno' is required to be observed. 616 /// \c ErrnoChecker can emit bug report after such a function call if errno 617 /// is overwritten without a read before. 618 class ErrnoMustBeCheckedConstraint : public ErrnoConstraintBase { 619 public: 620 ProgramStateRef apply(ProgramStateRef State, const CallEvent &Call, 621 const Summary &Summary, 622 CheckerContext &C) const override { 623 return errno_modeling::setErrnoStdMustBeChecked(State, C, 624 Call.getOriginExpr()); 625 } 626 627 const std::string describe(CheckerContext &C) const override { 628 return "reading 'errno' is required to find out if the call has failed"; 629 } 630 }; 631 632 /// A single branch of a function summary. 633 /// 634 /// A branch is defined by a series of constraints - "assumptions" - 635 /// that together form a single possible outcome of invoking the function. 636 /// When static analyzer considers a branch, it tries to introduce 637 /// a child node in the Exploded Graph. The child node has to include 638 /// constraints that define the branch. If the constraints contradict 639 /// existing constraints in the state, the node is not created and the branch 640 /// is dropped; otherwise it's queued for future exploration. 641 /// The branch is accompanied by a note text that may be displayed 642 /// to the user when a bug is found on a path that takes this branch. 643 /// 644 /// For example, consider the branches in `isalpha(x)`: 645 /// Branch 1) 646 /// x is in range ['A', 'Z'] or in ['a', 'z'] 647 /// then the return value is not 0. (I.e. out-of-range [0, 0]) 648 /// and the note may say "Assuming the character is alphabetical" 649 /// Branch 2) 650 /// x is out-of-range ['A', 'Z'] and out-of-range ['a', 'z'] 651 /// then the return value is 0 652 /// and the note may say "Assuming the character is non-alphabetical". 653 class SummaryCase { 654 ConstraintSet Constraints; 655 const ErrnoConstraintBase &ErrnoConstraint; 656 StringRef Note; 657 658 public: 659 SummaryCase(ConstraintSet &&Constraints, const ErrnoConstraintBase &ErrnoC, 660 StringRef Note) 661 : Constraints(std::move(Constraints)), ErrnoConstraint(ErrnoC), 662 Note(Note) {} 663 664 SummaryCase(const ConstraintSet &Constraints, 665 const ErrnoConstraintBase &ErrnoC, StringRef Note) 666 : Constraints(Constraints), ErrnoConstraint(ErrnoC), Note(Note) {} 667 668 const ConstraintSet &getConstraints() const { return Constraints; } 669 const ErrnoConstraintBase &getErrnoConstraint() const { 670 return ErrnoConstraint; 671 } 672 StringRef getNote() const { return Note; } 673 }; 674 675 using ArgTypes = std::vector<std::optional<QualType>>; 676 using RetType = std::optional<QualType>; 677 678 // A placeholder type, we use it whenever we do not care about the concrete 679 // type in a Signature. 680 const QualType Irrelevant{}; 681 bool static isIrrelevant(QualType T) { return T.isNull(); } 682 683 // The signature of a function we want to describe with a summary. This is a 684 // concessive signature, meaning there may be irrelevant types in the 685 // signature which we do not check against a function with concrete types. 686 // All types in the spec need to be canonical. 687 class Signature { 688 using ArgQualTypes = std::vector<QualType>; 689 ArgQualTypes ArgTys; 690 QualType RetTy; 691 // True if any component type is not found by lookup. 692 bool Invalid = false; 693 694 public: 695 // Construct a signature from optional types. If any of the optional types 696 // are not set then the signature will be invalid. 697 Signature(ArgTypes ArgTys, RetType RetTy) { 698 for (std::optional<QualType> Arg : ArgTys) { 699 if (!Arg) { 700 Invalid = true; 701 return; 702 } else { 703 assertArgTypeSuitableForSignature(*Arg); 704 this->ArgTys.push_back(*Arg); 705 } 706 } 707 if (!RetTy) { 708 Invalid = true; 709 return; 710 } else { 711 assertRetTypeSuitableForSignature(*RetTy); 712 this->RetTy = *RetTy; 713 } 714 } 715 716 bool isInvalid() const { return Invalid; } 717 bool matches(const FunctionDecl *FD) const; 718 719 private: 720 static void assertArgTypeSuitableForSignature(QualType T) { 721 assert((T.isNull() || !T->isVoidType()) && 722 "We should have no void types in the spec"); 723 assert((T.isNull() || T.isCanonical()) && 724 "We should only have canonical types in the spec"); 725 } 726 static void assertRetTypeSuitableForSignature(QualType T) { 727 assert((T.isNull() || T.isCanonical()) && 728 "We should only have canonical types in the spec"); 729 } 730 }; 731 732 static QualType getArgType(const FunctionDecl *FD, ArgNo ArgN) { 733 assert(FD && "Function must be set"); 734 QualType T = (ArgN == Ret) 735 ? FD->getReturnType().getCanonicalType() 736 : FD->getParamDecl(ArgN)->getType().getCanonicalType(); 737 return T; 738 } 739 740 using SummaryCases = std::vector<SummaryCase>; 741 742 /// A summary includes information about 743 /// * function prototype (signature) 744 /// * approach to invalidation, 745 /// * a list of branches - so, a list of list of ranges, 746 /// * a list of argument constraints, that must be true on every branch. 747 /// If these constraints are not satisfied that means a fatal error 748 /// usually resulting in undefined behaviour. 749 /// 750 /// Application of a summary: 751 /// The signature and argument constraints together contain information 752 /// about which functions are handled by the summary. The signature can use 753 /// "wildcards", i.e. Irrelevant types. Irrelevant type of a parameter in 754 /// a signature means that type is not compared to the type of the parameter 755 /// in the found FunctionDecl. Argument constraints may specify additional 756 /// rules for the given parameter's type, those rules are checked once the 757 /// signature is matched. 758 class Summary { 759 const InvalidationKind InvalidationKd; 760 SummaryCases Cases; 761 ConstraintSet ArgConstraints; 762 763 // The function to which the summary applies. This is set after lookup and 764 // match to the signature. 765 const FunctionDecl *FD = nullptr; 766 767 public: 768 Summary(InvalidationKind InvalidationKd) : InvalidationKd(InvalidationKd) {} 769 770 Summary &Case(ConstraintSet &&CS, const ErrnoConstraintBase &ErrnoC, 771 StringRef Note = "") { 772 Cases.push_back(SummaryCase(std::move(CS), ErrnoC, Note)); 773 return *this; 774 } 775 Summary &Case(const ConstraintSet &CS, const ErrnoConstraintBase &ErrnoC, 776 StringRef Note = "") { 777 Cases.push_back(SummaryCase(CS, ErrnoC, Note)); 778 return *this; 779 } 780 Summary &ArgConstraint(ValueConstraintPtr VC) { 781 assert(VC->getArgNo() != Ret && 782 "Arg constraint should not refer to the return value"); 783 ArgConstraints.push_back(VC); 784 return *this; 785 } 786 787 InvalidationKind getInvalidationKd() const { return InvalidationKd; } 788 const SummaryCases &getCases() const { return Cases; } 789 const ConstraintSet &getArgConstraints() const { return ArgConstraints; } 790 791 QualType getArgType(ArgNo ArgN) const { 792 return StdLibraryFunctionsChecker::getArgType(FD, ArgN); 793 } 794 795 // Returns true if the summary should be applied to the given function. 796 // And if yes then store the function declaration. 797 bool matchesAndSet(const Signature &Sign, const FunctionDecl *FD) { 798 bool Result = Sign.matches(FD) && validateByConstraints(FD); 799 if (Result) { 800 assert(!this->FD && "FD must not be set more than once"); 801 this->FD = FD; 802 } 803 return Result; 804 } 805 806 private: 807 // Once we know the exact type of the function then do validation check on 808 // all the given constraints. 809 bool validateByConstraints(const FunctionDecl *FD) const { 810 for (const SummaryCase &Case : Cases) 811 for (const ValueConstraintPtr &Constraint : Case.getConstraints()) 812 if (!Constraint->checkValidity(FD)) 813 return false; 814 for (const ValueConstraintPtr &Constraint : ArgConstraints) 815 if (!Constraint->checkValidity(FD)) 816 return false; 817 return true; 818 } 819 }; 820 821 // The map of all functions supported by the checker. It is initialized 822 // lazily, and it doesn't change after initialization. 823 using FunctionSummaryMapType = llvm::DenseMap<const FunctionDecl *, Summary>; 824 mutable FunctionSummaryMapType FunctionSummaryMap; 825 826 const BugType BT_InvalidArg{this, "Function call with invalid argument"}; 827 mutable bool SummariesInitialized = false; 828 829 static SVal getArgSVal(const CallEvent &Call, ArgNo ArgN) { 830 return ArgN == Ret ? Call.getReturnValue() : Call.getArgSVal(ArgN); 831 } 832 static std::string getFunctionName(const CallEvent &Call) { 833 assert(Call.getDecl() && 834 "Call was found by a summary, should have declaration"); 835 return cast<NamedDecl>(Call.getDecl())->getNameAsString(); 836 } 837 838 public: 839 void checkPreCall(const CallEvent &Call, CheckerContext &C) const; 840 void checkPostCall(const CallEvent &Call, CheckerContext &C) const; 841 bool evalCall(const CallEvent &Call, CheckerContext &C) const; 842 843 CheckerNameRef CheckName; 844 bool AddTestFunctions = false; 845 846 bool DisplayLoadedSummaries = false; 847 bool ModelPOSIX = false; 848 bool ShouldAssumeControlledEnvironment = false; 849 850 private: 851 std::optional<Summary> findFunctionSummary(const FunctionDecl *FD, 852 CheckerContext &C) const; 853 std::optional<Summary> findFunctionSummary(const CallEvent &Call, 854 CheckerContext &C) const; 855 856 void initFunctionSummaries(CheckerContext &C) const; 857 858 void reportBug(const CallEvent &Call, ExplodedNode *N, 859 const ValueConstraint *VC, const ValueConstraint *NegatedVC, 860 const Summary &Summary, CheckerContext &C) const { 861 assert(Call.getDecl() && 862 "Function found in summary must have a declaration available"); 863 SmallString<256> Msg; 864 llvm::raw_svector_ostream MsgOs(Msg); 865 866 MsgOs << "The "; 867 printArgDesc(VC->getArgNo(), MsgOs); 868 MsgOs << " to '" << getFunctionName(Call) << "' "; 869 bool ValuesPrinted = 870 NegatedVC->describeArgumentValue(Call, N->getState(), Summary, MsgOs); 871 if (ValuesPrinted) 872 MsgOs << " but "; 873 else 874 MsgOs << "is out of the accepted range; It "; 875 VC->describe(ValueConstraint::Violation, Call, C.getState(), Summary, 876 MsgOs); 877 Msg[0] = toupper(Msg[0]); 878 auto R = std::make_unique<PathSensitiveBugReport>(BT_InvalidArg, Msg, N); 879 880 for (ArgNo ArgN : VC->getArgsToTrack()) { 881 bugreporter::trackExpressionValue(N, Call.getArgExpr(ArgN), *R); 882 R->markInteresting(Call.getArgSVal(ArgN)); 883 // All tracked arguments are important, highlight them. 884 R->addRange(Call.getArgSourceRange(ArgN)); 885 } 886 887 C.emitReport(std::move(R)); 888 } 889 890 /// These are the errno constraints that can be passed to summary cases. 891 /// One of these should fit for a single summary case. 892 /// Usually if a failure return value exists for function, that function 893 /// needs different cases for success and failure with different errno 894 /// constraints (and different return value constraints). 895 const NoErrnoConstraint ErrnoUnchanged{}; 896 const ResetErrnoConstraint ErrnoIrrelevant{}; 897 const ErrnoMustBeCheckedConstraint ErrnoMustBeChecked{}; 898 const SuccessErrnoConstraint ErrnoMustNotBeChecked{}; 899 const FailureErrnoConstraint ErrnoNEZeroIrrelevant{}; 900 }; 901 902 int StdLibraryFunctionsChecker::ErrnoConstraintBase::Tag = 0; 903 904 const StdLibraryFunctionsChecker::ArgNo StdLibraryFunctionsChecker::Ret = 905 std::numeric_limits<ArgNo>::max(); 906 907 static BasicValueFactory &getBVF(ProgramStateRef State) { 908 ProgramStateManager &Mgr = State->getStateManager(); 909 SValBuilder &SVB = Mgr.getSValBuilder(); 910 return SVB.getBasicValueFactory(); 911 } 912 913 } // end of anonymous namespace 914 915 void StdLibraryFunctionsChecker::printArgDesc( 916 StdLibraryFunctionsChecker::ArgNo ArgN, llvm::raw_ostream &Out) { 917 Out << std::to_string(ArgN + 1); 918 Out << llvm::getOrdinalSuffix(ArgN + 1); 919 Out << " argument"; 920 } 921 922 void StdLibraryFunctionsChecker::printArgValueInfo(ArgNo ArgN, 923 ProgramStateRef State, 924 const CallEvent &Call, 925 llvm::raw_ostream &Out) { 926 if (const llvm::APSInt *Val = 927 State->getStateManager().getSValBuilder().getKnownValue( 928 State, getArgSVal(Call, ArgN))) 929 Out << " (which is " << *Val << ")"; 930 } 931 932 void StdLibraryFunctionsChecker::appendInsideRangeDesc(llvm::APSInt RMin, 933 llvm::APSInt RMax, 934 QualType ArgT, 935 BasicValueFactory &BVF, 936 llvm::raw_ostream &Out) { 937 if (RMin.isZero() && RMax.isZero()) 938 Out << "zero"; 939 else if (RMin == RMax) 940 Out << RMin; 941 else if (RMin == BVF.getMinValue(ArgT)) { 942 if (RMax == -1) 943 Out << "< 0"; 944 else 945 Out << "<= " << RMax; 946 } else if (RMax == BVF.getMaxValue(ArgT)) { 947 if (RMin.isOne()) 948 Out << "> 0"; 949 else 950 Out << ">= " << RMin; 951 } else if (RMin.isNegative() == RMax.isNegative() && 952 RMin.getLimitedValue() == RMax.getLimitedValue() - 1) { 953 Out << RMin << " or " << RMax; 954 } else { 955 Out << "between " << RMin << " and " << RMax; 956 } 957 } 958 959 void StdLibraryFunctionsChecker::appendOutOfRangeDesc(llvm::APSInt RMin, 960 llvm::APSInt RMax, 961 QualType ArgT, 962 BasicValueFactory &BVF, 963 llvm::raw_ostream &Out) { 964 if (RMin.isZero() && RMax.isZero()) 965 Out << "nonzero"; 966 else if (RMin == RMax) { 967 Out << "not equal to " << RMin; 968 } else if (RMin == BVF.getMinValue(ArgT)) { 969 if (RMax == -1) 970 Out << ">= 0"; 971 else 972 Out << "> " << RMax; 973 } else if (RMax == BVF.getMaxValue(ArgT)) { 974 if (RMin.isOne()) 975 Out << "<= 0"; 976 else 977 Out << "< " << RMin; 978 } else if (RMin.isNegative() == RMax.isNegative() && 979 RMin.getLimitedValue() == RMax.getLimitedValue() - 1) { 980 Out << "not " << RMin << " and not " << RMax; 981 } else { 982 Out << "not between " << RMin << " and " << RMax; 983 } 984 } 985 986 void StdLibraryFunctionsChecker::RangeConstraint::applyOnWithinRange( 987 BasicValueFactory &BVF, QualType ArgT, const RangeApplyFunction &F) const { 988 if (Ranges.empty()) 989 return; 990 991 for (auto [Start, End] : getRanges()) { 992 const llvm::APSInt &Min = BVF.getValue(Start, ArgT); 993 const llvm::APSInt &Max = BVF.getValue(End, ArgT); 994 assert(Min <= Max); 995 if (!F(Min, Max)) 996 return; 997 } 998 } 999 1000 void StdLibraryFunctionsChecker::RangeConstraint::applyOnOutOfRange( 1001 BasicValueFactory &BVF, QualType ArgT, const RangeApplyFunction &F) const { 1002 if (Ranges.empty()) 1003 return; 1004 1005 const IntRangeVector &R = getRanges(); 1006 size_t E = R.size(); 1007 1008 const llvm::APSInt &MinusInf = BVF.getMinValue(ArgT); 1009 const llvm::APSInt &PlusInf = BVF.getMaxValue(ArgT); 1010 1011 const llvm::APSInt &RangeLeft = BVF.getValue(R[0].first - 1ULL, ArgT); 1012 const llvm::APSInt &RangeRight = BVF.getValue(R[E - 1].second + 1ULL, ArgT); 1013 1014 // Iterate over the "holes" between intervals. 1015 for (size_t I = 1; I != E; ++I) { 1016 const llvm::APSInt &Min = BVF.getValue(R[I - 1].second + 1ULL, ArgT); 1017 const llvm::APSInt &Max = BVF.getValue(R[I].first - 1ULL, ArgT); 1018 if (Min <= Max) { 1019 if (!F(Min, Max)) 1020 return; 1021 } 1022 } 1023 // Check the interval [T_MIN, min(R) - 1]. 1024 if (RangeLeft != PlusInf) { 1025 assert(MinusInf <= RangeLeft); 1026 if (!F(MinusInf, RangeLeft)) 1027 return; 1028 } 1029 // Check the interval [max(R) + 1, T_MAX], 1030 if (RangeRight != MinusInf) { 1031 assert(RangeRight <= PlusInf); 1032 if (!F(RangeRight, PlusInf)) 1033 return; 1034 } 1035 } 1036 1037 ProgramStateRef StdLibraryFunctionsChecker::RangeConstraint::apply( 1038 ProgramStateRef State, const CallEvent &Call, const Summary &Summary, 1039 CheckerContext &C) const { 1040 ConstraintManager &CM = C.getConstraintManager(); 1041 SVal V = getArgSVal(Call, getArgNo()); 1042 QualType T = Summary.getArgType(getArgNo()); 1043 1044 if (auto N = V.getAs<NonLoc>()) { 1045 auto ExcludeRangeFromArg = [&](const llvm::APSInt &Min, 1046 const llvm::APSInt &Max) { 1047 State = CM.assumeInclusiveRange(State, *N, Min, Max, false); 1048 return static_cast<bool>(State); 1049 }; 1050 // "OutOfRange R" is handled by excluding all ranges in R. 1051 // "WithinRange R" is treated as "OutOfRange [T_MIN, T_MAX] \ R". 1052 applyOnRange(negateKind(Kind), C.getSValBuilder().getBasicValueFactory(), T, 1053 ExcludeRangeFromArg); 1054 } 1055 1056 return State; 1057 } 1058 1059 void StdLibraryFunctionsChecker::RangeConstraint::describe( 1060 DescriptionKind DK, const CallEvent &Call, ProgramStateRef State, 1061 const Summary &Summary, llvm::raw_ostream &Out) const { 1062 1063 BasicValueFactory &BVF = getBVF(State); 1064 QualType T = Summary.getArgType(getArgNo()); 1065 1066 Out << ((DK == Violation) ? "should be " : "is "); 1067 if (!Description.empty()) { 1068 Out << Description; 1069 } else { 1070 unsigned I = Ranges.size(); 1071 if (Kind == WithinRange) { 1072 for (const std::pair<RangeInt, RangeInt> &R : Ranges) { 1073 appendInsideRangeDesc(BVF.getValue(R.first, T), 1074 BVF.getValue(R.second, T), T, BVF, Out); 1075 if (--I > 0) 1076 Out << " or "; 1077 } 1078 } else { 1079 for (const std::pair<RangeInt, RangeInt> &R : Ranges) { 1080 appendOutOfRangeDesc(BVF.getValue(R.first, T), 1081 BVF.getValue(R.second, T), T, BVF, Out); 1082 if (--I > 0) 1083 Out << " and "; 1084 } 1085 } 1086 } 1087 } 1088 1089 bool StdLibraryFunctionsChecker::RangeConstraint::describeArgumentValue( 1090 const CallEvent &Call, ProgramStateRef State, const Summary &Summary, 1091 llvm::raw_ostream &Out) const { 1092 unsigned int NRanges = 0; 1093 bool HaveAllRanges = true; 1094 1095 ProgramStateManager &Mgr = State->getStateManager(); 1096 BasicValueFactory &BVF = Mgr.getSValBuilder().getBasicValueFactory(); 1097 ConstraintManager &CM = Mgr.getConstraintManager(); 1098 SVal V = getArgSVal(Call, getArgNo()); 1099 1100 if (auto N = V.getAs<NonLoc>()) { 1101 if (const llvm::APSInt *Int = N->getAsInteger()) { 1102 Out << "is "; 1103 Out << *Int; 1104 return true; 1105 } 1106 QualType T = Summary.getArgType(getArgNo()); 1107 SmallString<128> MoreInfo; 1108 llvm::raw_svector_ostream MoreInfoOs(MoreInfo); 1109 auto ApplyF = [&](const llvm::APSInt &Min, const llvm::APSInt &Max) { 1110 if (CM.assumeInclusiveRange(State, *N, Min, Max, true)) { 1111 if (NRanges > 0) 1112 MoreInfoOs << " or "; 1113 appendInsideRangeDesc(Min, Max, T, BVF, MoreInfoOs); 1114 ++NRanges; 1115 } else { 1116 HaveAllRanges = false; 1117 } 1118 return true; 1119 }; 1120 1121 applyOnRange(Kind, BVF, T, ApplyF); 1122 assert(NRanges > 0); 1123 if (!HaveAllRanges || NRanges == 1) { 1124 Out << "is "; 1125 Out << MoreInfo; 1126 return true; 1127 } 1128 } 1129 return false; 1130 } 1131 1132 ProgramStateRef StdLibraryFunctionsChecker::ComparisonConstraint::apply( 1133 ProgramStateRef State, const CallEvent &Call, const Summary &Summary, 1134 CheckerContext &C) const { 1135 1136 ProgramStateManager &Mgr = State->getStateManager(); 1137 SValBuilder &SVB = Mgr.getSValBuilder(); 1138 QualType CondT = SVB.getConditionType(); 1139 QualType T = Summary.getArgType(getArgNo()); 1140 SVal V = getArgSVal(Call, getArgNo()); 1141 1142 BinaryOperator::Opcode Op = getOpcode(); 1143 ArgNo OtherArg = getOtherArgNo(); 1144 SVal OtherV = getArgSVal(Call, OtherArg); 1145 QualType OtherT = Summary.getArgType(OtherArg); 1146 // Note: we avoid integral promotion for comparison. 1147 OtherV = SVB.evalCast(OtherV, T, OtherT); 1148 if (auto CompV = SVB.evalBinOp(State, Op, V, OtherV, CondT) 1149 .getAs<DefinedOrUnknownSVal>()) 1150 State = State->assume(*CompV, true); 1151 return State; 1152 } 1153 1154 ProgramStateRef StdLibraryFunctionsChecker::NotNullConstraint::apply( 1155 ProgramStateRef State, const CallEvent &Call, const Summary &Summary, 1156 CheckerContext &C) const { 1157 SVal V = getArgSVal(Call, getArgNo()); 1158 if (V.isUndef()) 1159 return State; 1160 1161 DefinedOrUnknownSVal L = V.castAs<DefinedOrUnknownSVal>(); 1162 if (!isa<Loc>(L)) 1163 return State; 1164 1165 return State->assume(L, CannotBeNull); 1166 } 1167 1168 void StdLibraryFunctionsChecker::NotNullConstraint::describe( 1169 DescriptionKind DK, const CallEvent &Call, ProgramStateRef State, 1170 const Summary &Summary, llvm::raw_ostream &Out) const { 1171 assert(CannotBeNull && 1172 "Describe should not be used when the value must be NULL"); 1173 if (DK == Violation) 1174 Out << "should not be NULL"; 1175 else 1176 Out << "is not NULL"; 1177 } 1178 1179 bool StdLibraryFunctionsChecker::NotNullConstraint::describeArgumentValue( 1180 const CallEvent &Call, ProgramStateRef State, const Summary &Summary, 1181 llvm::raw_ostream &Out) const { 1182 assert(!CannotBeNull && "This function is used when the value is NULL"); 1183 Out << "is NULL"; 1184 return true; 1185 } 1186 1187 ProgramStateRef StdLibraryFunctionsChecker::NotNullBufferConstraint::apply( 1188 ProgramStateRef State, const CallEvent &Call, const Summary &Summary, 1189 CheckerContext &C) const { 1190 SVal V = getArgSVal(Call, getArgNo()); 1191 if (V.isUndef()) 1192 return State; 1193 DefinedOrUnknownSVal L = V.castAs<DefinedOrUnknownSVal>(); 1194 if (!isa<Loc>(L)) 1195 return State; 1196 1197 std::optional<DefinedOrUnknownSVal> SizeArg1 = 1198 getArgSVal(Call, SizeArg1N).getAs<DefinedOrUnknownSVal>(); 1199 std::optional<DefinedOrUnknownSVal> SizeArg2; 1200 if (SizeArg2N) 1201 SizeArg2 = getArgSVal(Call, *SizeArg2N).getAs<DefinedOrUnknownSVal>(); 1202 1203 auto IsArgZero = [State](std::optional<DefinedOrUnknownSVal> Val) { 1204 if (!Val) 1205 return false; 1206 auto [IsNonNull, IsNull] = State->assume(*Val); 1207 return IsNull && !IsNonNull; 1208 }; 1209 1210 if (IsArgZero(SizeArg1) || IsArgZero(SizeArg2)) 1211 return State; 1212 1213 return State->assume(L, CannotBeNull); 1214 } 1215 1216 void StdLibraryFunctionsChecker::NotNullBufferConstraint::describe( 1217 DescriptionKind DK, const CallEvent &Call, ProgramStateRef State, 1218 const Summary &Summary, llvm::raw_ostream &Out) const { 1219 assert(CannotBeNull && 1220 "Describe should not be used when the value must be NULL"); 1221 if (DK == Violation) 1222 Out << "should not be NULL"; 1223 else 1224 Out << "is not NULL"; 1225 } 1226 1227 bool StdLibraryFunctionsChecker::NotNullBufferConstraint::describeArgumentValue( 1228 const CallEvent &Call, ProgramStateRef State, const Summary &Summary, 1229 llvm::raw_ostream &Out) const { 1230 assert(!CannotBeNull && "This function is used when the value is NULL"); 1231 Out << "is NULL"; 1232 return true; 1233 } 1234 1235 ProgramStateRef StdLibraryFunctionsChecker::BufferSizeConstraint::apply( 1236 ProgramStateRef State, const CallEvent &Call, const Summary &Summary, 1237 CheckerContext &C) const { 1238 SValBuilder &SvalBuilder = C.getSValBuilder(); 1239 // The buffer argument. 1240 SVal BufV = getArgSVal(Call, getArgNo()); 1241 1242 // Get the size constraint. 1243 const SVal SizeV = [this, &State, &Call, &Summary, &SvalBuilder]() { 1244 if (ConcreteSize) { 1245 return SVal(SvalBuilder.makeIntVal(*ConcreteSize)); 1246 } 1247 assert(SizeArgN && "The constraint must be either a concrete value or " 1248 "encoded in an argument."); 1249 // The size argument. 1250 SVal SizeV = getArgSVal(Call, *SizeArgN); 1251 // Multiply with another argument if given. 1252 if (SizeMultiplierArgN) { 1253 SVal SizeMulV = getArgSVal(Call, *SizeMultiplierArgN); 1254 SizeV = SvalBuilder.evalBinOp(State, BO_Mul, SizeV, SizeMulV, 1255 Summary.getArgType(*SizeArgN)); 1256 } 1257 return SizeV; 1258 }(); 1259 1260 // The dynamic size of the buffer argument, got from the analyzer engine. 1261 SVal BufDynSize = getDynamicExtentWithOffset(State, BufV); 1262 1263 SVal Feasible = SvalBuilder.evalBinOp(State, Op, SizeV, BufDynSize, 1264 SvalBuilder.getContext().BoolTy); 1265 if (auto F = Feasible.getAs<DefinedOrUnknownSVal>()) 1266 return State->assume(*F, true); 1267 1268 // We can get here only if the size argument or the dynamic size is 1269 // undefined. But the dynamic size should never be undefined, only 1270 // unknown. So, here, the size of the argument is undefined, i.e. we 1271 // cannot apply the constraint. Actually, other checkers like 1272 // CallAndMessage should catch this situation earlier, because we call a 1273 // function with an uninitialized argument. 1274 llvm_unreachable("Size argument or the dynamic size is Undefined"); 1275 } 1276 1277 void StdLibraryFunctionsChecker::BufferSizeConstraint::describe( 1278 DescriptionKind DK, const CallEvent &Call, ProgramStateRef State, 1279 const Summary &Summary, llvm::raw_ostream &Out) const { 1280 Out << ((DK == Violation) ? "should be " : "is "); 1281 Out << "a buffer with size equal to or greater than "; 1282 if (ConcreteSize) { 1283 Out << *ConcreteSize; 1284 } else if (SizeArgN) { 1285 Out << "the value of the "; 1286 printArgDesc(*SizeArgN, Out); 1287 printArgValueInfo(*SizeArgN, State, Call, Out); 1288 if (SizeMultiplierArgN) { 1289 Out << " times the "; 1290 printArgDesc(*SizeMultiplierArgN, Out); 1291 printArgValueInfo(*SizeMultiplierArgN, State, Call, Out); 1292 } 1293 } 1294 } 1295 1296 bool StdLibraryFunctionsChecker::BufferSizeConstraint::describeArgumentValue( 1297 const CallEvent &Call, ProgramStateRef State, const Summary &Summary, 1298 llvm::raw_ostream &Out) const { 1299 SVal BufV = getArgSVal(Call, getArgNo()); 1300 SVal BufDynSize = getDynamicExtentWithOffset(State, BufV); 1301 if (const llvm::APSInt *Val = 1302 State->getStateManager().getSValBuilder().getKnownValue(State, 1303 BufDynSize)) { 1304 Out << "is a buffer with size " << *Val; 1305 return true; 1306 } 1307 return false; 1308 } 1309 1310 void StdLibraryFunctionsChecker::checkPreCall(const CallEvent &Call, 1311 CheckerContext &C) const { 1312 std::optional<Summary> FoundSummary = findFunctionSummary(Call, C); 1313 if (!FoundSummary) 1314 return; 1315 1316 const Summary &Summary = *FoundSummary; 1317 ProgramStateRef State = C.getState(); 1318 1319 ProgramStateRef NewState = State; 1320 ExplodedNode *NewNode = C.getPredecessor(); 1321 for (const ValueConstraintPtr &Constraint : Summary.getArgConstraints()) { 1322 ValueConstraintPtr NegatedConstraint = Constraint->negate(); 1323 ProgramStateRef SuccessSt = Constraint->apply(NewState, Call, Summary, C); 1324 ProgramStateRef FailureSt = 1325 NegatedConstraint->apply(NewState, Call, Summary, C); 1326 // The argument constraint is not satisfied. 1327 if (FailureSt && !SuccessSt) { 1328 if (ExplodedNode *N = C.generateErrorNode(State, NewNode)) 1329 reportBug(Call, N, Constraint.get(), NegatedConstraint.get(), Summary, 1330 C); 1331 break; 1332 } 1333 // We will apply the constraint even if we cannot reason about the 1334 // argument. This means both SuccessSt and FailureSt can be true. If we 1335 // weren't applying the constraint that would mean that symbolic 1336 // execution continues on a code whose behaviour is undefined. 1337 assert(SuccessSt); 1338 NewState = SuccessSt; 1339 if (NewState != State) { 1340 SmallString<128> Msg; 1341 llvm::raw_svector_ostream Os(Msg); 1342 Os << "Assuming that the "; 1343 printArgDesc(Constraint->getArgNo(), Os); 1344 Os << " to '"; 1345 Os << getFunctionName(Call); 1346 Os << "' "; 1347 Constraint->describe(ValueConstraint::Assumption, Call, NewState, Summary, 1348 Os); 1349 const auto ArgSVal = Call.getArgSVal(Constraint->getArgNo()); 1350 NewNode = C.addTransition( 1351 NewState, NewNode, 1352 C.getNoteTag([Msg = std::move(Msg), ArgSVal]( 1353 PathSensitiveBugReport &BR, llvm::raw_ostream &OS) { 1354 if (BR.isInteresting(ArgSVal)) 1355 OS << Msg; 1356 })); 1357 } 1358 } 1359 } 1360 1361 void StdLibraryFunctionsChecker::checkPostCall(const CallEvent &Call, 1362 CheckerContext &C) const { 1363 std::optional<Summary> FoundSummary = findFunctionSummary(Call, C); 1364 if (!FoundSummary) 1365 return; 1366 1367 // Now apply the constraints. 1368 const Summary &Summary = *FoundSummary; 1369 ProgramStateRef State = C.getState(); 1370 ExplodedNode *Node = C.getPredecessor(); 1371 1372 // Apply case/branch specifications. 1373 for (const SummaryCase &Case : Summary.getCases()) { 1374 ProgramStateRef NewState = State; 1375 for (const ValueConstraintPtr &Constraint : Case.getConstraints()) { 1376 NewState = Constraint->apply(NewState, Call, Summary, C); 1377 if (!NewState) 1378 break; 1379 } 1380 1381 if (NewState) 1382 NewState = Case.getErrnoConstraint().apply(NewState, Call, Summary, C); 1383 1384 if (!NewState) 1385 continue; 1386 1387 // Here it's possible that NewState == State, e.g. when other checkers 1388 // already applied the same constraints (or stricter ones). 1389 // Still add these note tags, the other checker should add only its 1390 // specialized note tags. These general note tags are handled always by 1391 // StdLibraryFunctionsChecker. 1392 1393 ExplodedNode *Pred = Node; 1394 DeclarationName FunctionName = 1395 cast<NamedDecl>(Call.getDecl())->getDeclName(); 1396 1397 std::string ErrnoNote = Case.getErrnoConstraint().describe(C); 1398 std::string CaseNote; 1399 if (Case.getNote().empty()) { 1400 if (!ErrnoNote.empty()) 1401 ErrnoNote = 1402 llvm::formatv("After calling '{0}' {1}", FunctionName, ErrnoNote); 1403 } else { 1404 CaseNote = llvm::formatv(Case.getNote().str().c_str(), FunctionName); 1405 } 1406 const SVal RV = Call.getReturnValue(); 1407 1408 if (Summary.getInvalidationKd() == EvalCallAsPure) { 1409 // Do not expect that errno is interesting (the "pure" functions do not 1410 // affect it). 1411 if (!CaseNote.empty()) { 1412 const NoteTag *Tag = C.getNoteTag( 1413 [Node, CaseNote, RV](PathSensitiveBugReport &BR) -> std::string { 1414 // Try to omit the note if we know in advance which branch is 1415 // taken (this means, only one branch exists). 1416 // This check is performed inside the lambda, after other 1417 // (or this) checkers had a chance to add other successors. 1418 // Dereferencing the saved node object is valid because it's part 1419 // of a bug report call sequence. 1420 // FIXME: This check is not exact. We may be here after a state 1421 // split that was performed by another checker (and can not find 1422 // the successors). This is why this check is only used in the 1423 // EvalCallAsPure case. 1424 if (BR.isInteresting(RV) && Node->succ_size() > 1) 1425 return CaseNote; 1426 return ""; 1427 }); 1428 Pred = C.addTransition(NewState, Pred, Tag); 1429 } 1430 } else { 1431 if (!CaseNote.empty() || !ErrnoNote.empty()) { 1432 const NoteTag *Tag = 1433 C.getNoteTag([CaseNote, ErrnoNote, 1434 RV](PathSensitiveBugReport &BR) -> std::string { 1435 // If 'errno' is interesting, show the user a note about the case 1436 // (what happened at the function call) and about how 'errno' 1437 // causes the problem. ErrnoChecker sets the errno (but not RV) to 1438 // interesting. 1439 // If only the return value is interesting, show only the case 1440 // note. 1441 std::optional<Loc> ErrnoLoc = 1442 errno_modeling::getErrnoLoc(BR.getErrorNode()->getState()); 1443 bool ErrnoImportant = !ErrnoNote.empty() && ErrnoLoc && 1444 BR.isInteresting(ErrnoLoc->getAsRegion()); 1445 if (ErrnoImportant) { 1446 BR.markNotInteresting(ErrnoLoc->getAsRegion()); 1447 if (CaseNote.empty()) 1448 return ErrnoNote; 1449 return llvm::formatv("{0}; {1}", CaseNote, ErrnoNote); 1450 } else { 1451 if (BR.isInteresting(RV)) 1452 return CaseNote; 1453 } 1454 return ""; 1455 }); 1456 Pred = C.addTransition(NewState, Pred, Tag); 1457 } 1458 } 1459 1460 // Add the transition if no note tag was added. 1461 if (Pred == Node && NewState != State) 1462 C.addTransition(NewState); 1463 } 1464 } 1465 1466 bool StdLibraryFunctionsChecker::evalCall(const CallEvent &Call, 1467 CheckerContext &C) const { 1468 std::optional<Summary> FoundSummary = findFunctionSummary(Call, C); 1469 if (!FoundSummary) 1470 return false; 1471 1472 const Summary &Summary = *FoundSummary; 1473 switch (Summary.getInvalidationKd()) { 1474 case EvalCallAsPure: { 1475 ProgramStateRef State = C.getState(); 1476 const LocationContext *LC = C.getLocationContext(); 1477 const auto *CE = cast<CallExpr>(Call.getOriginExpr()); 1478 SVal V = C.getSValBuilder().conjureSymbolVal( 1479 CE, LC, CE->getType().getCanonicalType(), C.blockCount()); 1480 State = State->BindExpr(CE, LC, V); 1481 1482 C.addTransition(State); 1483 1484 return true; 1485 } 1486 case NoEvalCall: 1487 // Summary tells us to avoid performing eval::Call. The function is possibly 1488 // evaluated by another checker, or evaluated conservatively. 1489 return false; 1490 } 1491 llvm_unreachable("Unknown invalidation kind!"); 1492 } 1493 1494 bool StdLibraryFunctionsChecker::Signature::matches( 1495 const FunctionDecl *FD) const { 1496 assert(!isInvalid()); 1497 // Check the number of arguments. 1498 if (FD->param_size() != ArgTys.size()) 1499 return false; 1500 1501 // The "restrict" keyword is illegal in C++, however, many libc 1502 // implementations use the "__restrict" compiler intrinsic in functions 1503 // prototypes. The "__restrict" keyword qualifies a type as a restricted type 1504 // even in C++. 1505 // In case of any non-C99 languages, we don't want to match based on the 1506 // restrict qualifier because we cannot know if the given libc implementation 1507 // qualifies the paramter type or not. 1508 auto RemoveRestrict = [&FD](QualType T) { 1509 if (!FD->getASTContext().getLangOpts().C99) 1510 T.removeLocalRestrict(); 1511 return T; 1512 }; 1513 1514 // Check the return type. 1515 if (!isIrrelevant(RetTy)) { 1516 QualType FDRetTy = RemoveRestrict(FD->getReturnType().getCanonicalType()); 1517 if (RetTy != FDRetTy) 1518 return false; 1519 } 1520 1521 // Check the argument types. 1522 for (auto [Idx, ArgTy] : llvm::enumerate(ArgTys)) { 1523 if (isIrrelevant(ArgTy)) 1524 continue; 1525 QualType FDArgTy = 1526 RemoveRestrict(FD->getParamDecl(Idx)->getType().getCanonicalType()); 1527 if (ArgTy != FDArgTy) 1528 return false; 1529 } 1530 1531 return true; 1532 } 1533 1534 std::optional<StdLibraryFunctionsChecker::Summary> 1535 StdLibraryFunctionsChecker::findFunctionSummary(const FunctionDecl *FD, 1536 CheckerContext &C) const { 1537 if (!FD) 1538 return std::nullopt; 1539 1540 initFunctionSummaries(C); 1541 1542 auto FSMI = FunctionSummaryMap.find(FD->getCanonicalDecl()); 1543 if (FSMI == FunctionSummaryMap.end()) 1544 return std::nullopt; 1545 return FSMI->second; 1546 } 1547 1548 std::optional<StdLibraryFunctionsChecker::Summary> 1549 StdLibraryFunctionsChecker::findFunctionSummary(const CallEvent &Call, 1550 CheckerContext &C) const { 1551 const FunctionDecl *FD = dyn_cast_or_null<FunctionDecl>(Call.getDecl()); 1552 if (!FD) 1553 return std::nullopt; 1554 return findFunctionSummary(FD, C); 1555 } 1556 1557 void StdLibraryFunctionsChecker::initFunctionSummaries( 1558 CheckerContext &C) const { 1559 if (SummariesInitialized) 1560 return; 1561 SummariesInitialized = true; 1562 1563 SValBuilder &SVB = C.getSValBuilder(); 1564 BasicValueFactory &BVF = SVB.getBasicValueFactory(); 1565 const ASTContext &ACtx = BVF.getContext(); 1566 Preprocessor &PP = C.getPreprocessor(); 1567 1568 // Helper class to lookup a type by its name. 1569 class LookupType { 1570 const ASTContext &ACtx; 1571 1572 public: 1573 LookupType(const ASTContext &ACtx) : ACtx(ACtx) {} 1574 1575 // Find the type. If not found then the optional is not set. 1576 std::optional<QualType> operator()(StringRef Name) { 1577 IdentifierInfo &II = ACtx.Idents.get(Name); 1578 auto LookupRes = ACtx.getTranslationUnitDecl()->lookup(&II); 1579 if (LookupRes.empty()) 1580 return std::nullopt; 1581 1582 // Prioritze typedef declarations. 1583 // This is needed in case of C struct typedefs. E.g.: 1584 // typedef struct FILE FILE; 1585 // In this case, we have a RecordDecl 'struct FILE' with the name 'FILE' 1586 // and we have a TypedefDecl with the name 'FILE'. 1587 for (Decl *D : LookupRes) 1588 if (auto *TD = dyn_cast<TypedefNameDecl>(D)) 1589 return ACtx.getTypeDeclType(TD).getCanonicalType(); 1590 1591 // Find the first TypeDecl. 1592 // There maybe cases when a function has the same name as a struct. 1593 // E.g. in POSIX: `struct stat` and the function `stat()`: 1594 // int stat(const char *restrict path, struct stat *restrict buf); 1595 for (Decl *D : LookupRes) 1596 if (auto *TD = dyn_cast<TypeDecl>(D)) 1597 return ACtx.getTypeDeclType(TD).getCanonicalType(); 1598 return std::nullopt; 1599 } 1600 } lookupTy(ACtx); 1601 1602 // Below are auxiliary classes to handle optional types that we get as a 1603 // result of the lookup. 1604 class GetRestrictTy { 1605 const ASTContext &ACtx; 1606 1607 public: 1608 GetRestrictTy(const ASTContext &ACtx) : ACtx(ACtx) {} 1609 QualType operator()(QualType Ty) { 1610 return ACtx.getLangOpts().C99 ? ACtx.getRestrictType(Ty) : Ty; 1611 } 1612 std::optional<QualType> operator()(std::optional<QualType> Ty) { 1613 if (Ty) 1614 return operator()(*Ty); 1615 return std::nullopt; 1616 } 1617 } getRestrictTy(ACtx); 1618 class GetPointerTy { 1619 const ASTContext &ACtx; 1620 1621 public: 1622 GetPointerTy(const ASTContext &ACtx) : ACtx(ACtx) {} 1623 QualType operator()(QualType Ty) { return ACtx.getPointerType(Ty); } 1624 std::optional<QualType> operator()(std::optional<QualType> Ty) { 1625 if (Ty) 1626 return operator()(*Ty); 1627 return std::nullopt; 1628 } 1629 } getPointerTy(ACtx); 1630 class { 1631 public: 1632 std::optional<QualType> operator()(std::optional<QualType> Ty) { 1633 return Ty ? std::optional<QualType>(Ty->withConst()) : std::nullopt; 1634 } 1635 QualType operator()(QualType Ty) { return Ty.withConst(); } 1636 } getConstTy; 1637 class GetMaxValue { 1638 BasicValueFactory &BVF; 1639 1640 public: 1641 GetMaxValue(BasicValueFactory &BVF) : BVF(BVF) {} 1642 std::optional<RangeInt> operator()(QualType Ty) { 1643 return BVF.getMaxValue(Ty).getLimitedValue(); 1644 } 1645 std::optional<RangeInt> operator()(std::optional<QualType> Ty) { 1646 if (Ty) { 1647 return operator()(*Ty); 1648 } 1649 return std::nullopt; 1650 } 1651 } getMaxValue(BVF); 1652 1653 // These types are useful for writing specifications quickly, 1654 // New specifications should probably introduce more types. 1655 // Some types are hard to obtain from the AST, eg. "ssize_t". 1656 // In such cases it should be possible to provide multiple variants 1657 // of function summary for common cases (eg. ssize_t could be int or long 1658 // or long long, so three summary variants would be enough). 1659 // Of course, function variants are also useful for C++ overloads. 1660 const QualType VoidTy = ACtx.VoidTy; 1661 const QualType CharTy = ACtx.CharTy; 1662 const QualType WCharTy = ACtx.WCharTy; 1663 const QualType IntTy = ACtx.IntTy; 1664 const QualType UnsignedIntTy = ACtx.UnsignedIntTy; 1665 const QualType LongTy = ACtx.LongTy; 1666 const QualType SizeTy = ACtx.getSizeType(); 1667 1668 const QualType VoidPtrTy = getPointerTy(VoidTy); // void * 1669 const QualType IntPtrTy = getPointerTy(IntTy); // int * 1670 const QualType UnsignedIntPtrTy = 1671 getPointerTy(UnsignedIntTy); // unsigned int * 1672 const QualType VoidPtrRestrictTy = getRestrictTy(VoidPtrTy); 1673 const QualType ConstVoidPtrTy = 1674 getPointerTy(getConstTy(VoidTy)); // const void * 1675 const QualType CharPtrTy = getPointerTy(CharTy); // char * 1676 const QualType CharPtrRestrictTy = getRestrictTy(CharPtrTy); 1677 const QualType ConstCharPtrTy = 1678 getPointerTy(getConstTy(CharTy)); // const char * 1679 const QualType ConstCharPtrRestrictTy = getRestrictTy(ConstCharPtrTy); 1680 const QualType Wchar_tPtrTy = getPointerTy(WCharTy); // wchar_t * 1681 const QualType ConstWchar_tPtrTy = 1682 getPointerTy(getConstTy(WCharTy)); // const wchar_t * 1683 const QualType ConstVoidPtrRestrictTy = getRestrictTy(ConstVoidPtrTy); 1684 const QualType SizePtrTy = getPointerTy(SizeTy); 1685 const QualType SizePtrRestrictTy = getRestrictTy(SizePtrTy); 1686 1687 const RangeInt IntMax = BVF.getMaxValue(IntTy).getLimitedValue(); 1688 const RangeInt UnsignedIntMax = 1689 BVF.getMaxValue(UnsignedIntTy).getLimitedValue(); 1690 const RangeInt LongMax = BVF.getMaxValue(LongTy).getLimitedValue(); 1691 const RangeInt SizeMax = BVF.getMaxValue(SizeTy).getLimitedValue(); 1692 1693 // Set UCharRangeMax to min of int or uchar maximum value. 1694 // The C standard states that the arguments of functions like isalpha must 1695 // be representable as an unsigned char. Their type is 'int', so the max 1696 // value of the argument should be min(UCharMax, IntMax). This just happen 1697 // to be true for commonly used and well tested instruction set 1698 // architectures, but not for others. 1699 const RangeInt UCharRangeMax = 1700 std::min(BVF.getMaxValue(ACtx.UnsignedCharTy).getLimitedValue(), IntMax); 1701 1702 // Get platform dependent values of some macros. 1703 // Try our best to parse this from the Preprocessor, otherwise fallback to a 1704 // default value (what is found in a library header). 1705 const auto EOFv = tryExpandAsInteger("EOF", PP).value_or(-1); 1706 const auto AT_FDCWDv = tryExpandAsInteger("AT_FDCWD", PP).value_or(-100); 1707 1708 // Auxiliary class to aid adding summaries to the summary map. 1709 struct AddToFunctionSummaryMap { 1710 const ASTContext &ACtx; 1711 FunctionSummaryMapType ⤅ 1712 bool DisplayLoadedSummaries; 1713 AddToFunctionSummaryMap(const ASTContext &ACtx, FunctionSummaryMapType &FSM, 1714 bool DisplayLoadedSummaries) 1715 : ACtx(ACtx), Map(FSM), DisplayLoadedSummaries(DisplayLoadedSummaries) { 1716 } 1717 1718 // Add a summary to a FunctionDecl found by lookup. The lookup is performed 1719 // by the given Name, and in the global scope. The summary will be attached 1720 // to the found FunctionDecl only if the signatures match. 1721 // 1722 // Returns true if the summary has been added, false otherwise. 1723 bool operator()(StringRef Name, Signature Sign, Summary Sum) { 1724 if (Sign.isInvalid()) 1725 return false; 1726 IdentifierInfo &II = ACtx.Idents.get(Name); 1727 auto LookupRes = ACtx.getTranslationUnitDecl()->lookup(&II); 1728 if (LookupRes.empty()) 1729 return false; 1730 for (Decl *D : LookupRes) { 1731 if (auto *FD = dyn_cast<FunctionDecl>(D)) { 1732 if (Sum.matchesAndSet(Sign, FD)) { 1733 auto Res = Map.insert({FD->getCanonicalDecl(), Sum}); 1734 assert(Res.second && "Function already has a summary set!"); 1735 (void)Res; 1736 if (DisplayLoadedSummaries) { 1737 llvm::errs() << "Loaded summary for: "; 1738 FD->print(llvm::errs()); 1739 llvm::errs() << "\n"; 1740 } 1741 return true; 1742 } 1743 } 1744 } 1745 return false; 1746 } 1747 // Add the same summary for different names with the Signature explicitly 1748 // given. 1749 void operator()(std::vector<StringRef> Names, Signature Sign, Summary Sum) { 1750 for (StringRef Name : Names) 1751 operator()(Name, Sign, Sum); 1752 } 1753 } addToFunctionSummaryMap(ACtx, FunctionSummaryMap, DisplayLoadedSummaries); 1754 1755 // Below are helpers functions to create the summaries. 1756 auto ArgumentCondition = [](ArgNo ArgN, RangeKind Kind, IntRangeVector Ranges, 1757 StringRef Desc = "") { 1758 return std::make_shared<RangeConstraint>(ArgN, Kind, Ranges, Desc); 1759 }; 1760 auto BufferSize = [](auto... Args) { 1761 return std::make_shared<BufferSizeConstraint>(Args...); 1762 }; 1763 struct { 1764 auto operator()(RangeKind Kind, IntRangeVector Ranges) { 1765 return std::make_shared<RangeConstraint>(Ret, Kind, Ranges); 1766 } 1767 auto operator()(BinaryOperator::Opcode Op, ArgNo OtherArgN) { 1768 return std::make_shared<ComparisonConstraint>(Ret, Op, OtherArgN); 1769 } 1770 } ReturnValueCondition; 1771 struct { 1772 auto operator()(RangeInt b, RangeInt e) { 1773 return IntRangeVector{std::pair<RangeInt, RangeInt>{b, e}}; 1774 } 1775 auto operator()(RangeInt b, std::optional<RangeInt> e) { 1776 if (e) 1777 return IntRangeVector{std::pair<RangeInt, RangeInt>{b, *e}}; 1778 return IntRangeVector{}; 1779 } 1780 auto operator()(std::pair<RangeInt, RangeInt> i0, 1781 std::pair<RangeInt, std::optional<RangeInt>> i1) { 1782 if (i1.second) 1783 return IntRangeVector{i0, {i1.first, *(i1.second)}}; 1784 return IntRangeVector{i0}; 1785 } 1786 } Range; 1787 auto SingleValue = [](RangeInt v) { 1788 return IntRangeVector{std::pair<RangeInt, RangeInt>{v, v}}; 1789 }; 1790 auto LessThanOrEq = BO_LE; 1791 auto NotNull = [&](ArgNo ArgN) { 1792 return std::make_shared<NotNullConstraint>(ArgN); 1793 }; 1794 auto IsNull = [&](ArgNo ArgN) { 1795 return std::make_shared<NotNullConstraint>(ArgN, false); 1796 }; 1797 auto NotNullBuffer = [&](ArgNo ArgN, ArgNo SizeArg1N, ArgNo SizeArg2N) { 1798 return std::make_shared<NotNullBufferConstraint>(ArgN, SizeArg1N, 1799 SizeArg2N); 1800 }; 1801 1802 std::optional<QualType> FileTy = lookupTy("FILE"); 1803 std::optional<QualType> FilePtrTy = getPointerTy(FileTy); 1804 std::optional<QualType> FilePtrRestrictTy = getRestrictTy(FilePtrTy); 1805 1806 std::optional<QualType> FPosTTy = lookupTy("fpos_t"); 1807 std::optional<QualType> FPosTPtrTy = getPointerTy(FPosTTy); 1808 std::optional<QualType> ConstFPosTPtrTy = getPointerTy(getConstTy(FPosTTy)); 1809 std::optional<QualType> FPosTPtrRestrictTy = getRestrictTy(FPosTPtrTy); 1810 1811 constexpr llvm::StringLiteral GenericSuccessMsg( 1812 "Assuming that '{0}' is successful"); 1813 constexpr llvm::StringLiteral GenericFailureMsg("Assuming that '{0}' fails"); 1814 1815 // We are finally ready to define specifications for all supported functions. 1816 // 1817 // Argument ranges should always cover all variants. If return value 1818 // is completely unknown, omit it from the respective range set. 1819 // 1820 // Every item in the list of range sets represents a particular 1821 // execution path the analyzer would need to explore once 1822 // the call is modeled - a new program state is constructed 1823 // for every range set, and each range line in the range set 1824 // corresponds to a specific constraint within this state. 1825 1826 // The isascii() family of functions. 1827 // The behavior is undefined if the value of the argument is not 1828 // representable as unsigned char or is not equal to EOF. See e.g. C99 1829 // 7.4.1.2 The isalpha function (p: 181-182). 1830 addToFunctionSummaryMap( 1831 "isalnum", Signature(ArgTypes{IntTy}, RetType{IntTy}), 1832 Summary(EvalCallAsPure) 1833 // Boils down to isupper() or islower() or isdigit(). 1834 .Case({ArgumentCondition(0U, WithinRange, 1835 {{'0', '9'}, {'A', 'Z'}, {'a', 'z'}}), 1836 ReturnValueCondition(OutOfRange, SingleValue(0))}, 1837 ErrnoIrrelevant, "Assuming the character is alphanumeric") 1838 // The locale-specific range. 1839 // No post-condition. We are completely unaware of 1840 // locale-specific return values. 1841 .Case({ArgumentCondition(0U, WithinRange, {{128, UCharRangeMax}})}, 1842 ErrnoIrrelevant) 1843 .Case( 1844 {ArgumentCondition( 1845 0U, OutOfRange, 1846 {{'0', '9'}, {'A', 'Z'}, {'a', 'z'}, {128, UCharRangeMax}}), 1847 ReturnValueCondition(WithinRange, SingleValue(0))}, 1848 ErrnoIrrelevant, "Assuming the character is non-alphanumeric") 1849 .ArgConstraint(ArgumentCondition(0U, WithinRange, 1850 {{EOFv, EOFv}, {0, UCharRangeMax}}, 1851 "an unsigned char value or EOF"))); 1852 addToFunctionSummaryMap( 1853 "isalpha", Signature(ArgTypes{IntTy}, RetType{IntTy}), 1854 Summary(EvalCallAsPure) 1855 .Case({ArgumentCondition(0U, WithinRange, {{'A', 'Z'}, {'a', 'z'}}), 1856 ReturnValueCondition(OutOfRange, SingleValue(0))}, 1857 ErrnoIrrelevant, "Assuming the character is alphabetical") 1858 // The locale-specific range. 1859 .Case({ArgumentCondition(0U, WithinRange, {{128, UCharRangeMax}})}, 1860 ErrnoIrrelevant) 1861 .Case({ArgumentCondition( 1862 0U, OutOfRange, 1863 {{'A', 'Z'}, {'a', 'z'}, {128, UCharRangeMax}}), 1864 ReturnValueCondition(WithinRange, SingleValue(0))}, 1865 ErrnoIrrelevant, "Assuming the character is non-alphabetical")); 1866 addToFunctionSummaryMap( 1867 "isascii", Signature(ArgTypes{IntTy}, RetType{IntTy}), 1868 Summary(EvalCallAsPure) 1869 .Case({ArgumentCondition(0U, WithinRange, Range(0, 127)), 1870 ReturnValueCondition(OutOfRange, SingleValue(0))}, 1871 ErrnoIrrelevant, "Assuming the character is an ASCII character") 1872 .Case({ArgumentCondition(0U, OutOfRange, Range(0, 127)), 1873 ReturnValueCondition(WithinRange, SingleValue(0))}, 1874 ErrnoIrrelevant, 1875 "Assuming the character is not an ASCII character")); 1876 addToFunctionSummaryMap( 1877 "isblank", Signature(ArgTypes{IntTy}, RetType{IntTy}), 1878 Summary(EvalCallAsPure) 1879 .Case({ArgumentCondition(0U, WithinRange, {{'\t', '\t'}, {' ', ' '}}), 1880 ReturnValueCondition(OutOfRange, SingleValue(0))}, 1881 ErrnoIrrelevant, "Assuming the character is a blank character") 1882 .Case({ArgumentCondition(0U, OutOfRange, {{'\t', '\t'}, {' ', ' '}}), 1883 ReturnValueCondition(WithinRange, SingleValue(0))}, 1884 ErrnoIrrelevant, 1885 "Assuming the character is not a blank character")); 1886 addToFunctionSummaryMap( 1887 "iscntrl", Signature(ArgTypes{IntTy}, RetType{IntTy}), 1888 Summary(EvalCallAsPure) 1889 .Case({ArgumentCondition(0U, WithinRange, {{0, 32}, {127, 127}}), 1890 ReturnValueCondition(OutOfRange, SingleValue(0))}, 1891 ErrnoIrrelevant, 1892 "Assuming the character is a control character") 1893 .Case({ArgumentCondition(0U, OutOfRange, {{0, 32}, {127, 127}}), 1894 ReturnValueCondition(WithinRange, SingleValue(0))}, 1895 ErrnoIrrelevant, 1896 "Assuming the character is not a control character")); 1897 addToFunctionSummaryMap( 1898 "isdigit", Signature(ArgTypes{IntTy}, RetType{IntTy}), 1899 Summary(EvalCallAsPure) 1900 .Case({ArgumentCondition(0U, WithinRange, Range('0', '9')), 1901 ReturnValueCondition(OutOfRange, SingleValue(0))}, 1902 ErrnoIrrelevant, "Assuming the character is a digit") 1903 .Case({ArgumentCondition(0U, OutOfRange, Range('0', '9')), 1904 ReturnValueCondition(WithinRange, SingleValue(0))}, 1905 ErrnoIrrelevant, "Assuming the character is not a digit")); 1906 addToFunctionSummaryMap( 1907 "isgraph", Signature(ArgTypes{IntTy}, RetType{IntTy}), 1908 Summary(EvalCallAsPure) 1909 .Case({ArgumentCondition(0U, WithinRange, Range(33, 126)), 1910 ReturnValueCondition(OutOfRange, SingleValue(0))}, 1911 ErrnoIrrelevant, 1912 "Assuming the character has graphical representation") 1913 .Case( 1914 {ArgumentCondition(0U, OutOfRange, Range(33, 126)), 1915 ReturnValueCondition(WithinRange, SingleValue(0))}, 1916 ErrnoIrrelevant, 1917 "Assuming the character does not have graphical representation")); 1918 addToFunctionSummaryMap( 1919 "islower", Signature(ArgTypes{IntTy}, RetType{IntTy}), 1920 Summary(EvalCallAsPure) 1921 // Is certainly lowercase. 1922 .Case({ArgumentCondition(0U, WithinRange, Range('a', 'z')), 1923 ReturnValueCondition(OutOfRange, SingleValue(0))}, 1924 ErrnoIrrelevant, "Assuming the character is a lowercase letter") 1925 // Is ascii but not lowercase. 1926 .Case({ArgumentCondition(0U, WithinRange, Range(0, 127)), 1927 ArgumentCondition(0U, OutOfRange, Range('a', 'z')), 1928 ReturnValueCondition(WithinRange, SingleValue(0))}, 1929 ErrnoIrrelevant, 1930 "Assuming the character is not a lowercase letter") 1931 // The locale-specific range. 1932 .Case({ArgumentCondition(0U, WithinRange, {{128, UCharRangeMax}})}, 1933 ErrnoIrrelevant) 1934 // Is not an unsigned char. 1935 .Case({ArgumentCondition(0U, OutOfRange, Range(0, UCharRangeMax)), 1936 ReturnValueCondition(WithinRange, SingleValue(0))}, 1937 ErrnoIrrelevant)); 1938 addToFunctionSummaryMap( 1939 "isprint", Signature(ArgTypes{IntTy}, RetType{IntTy}), 1940 Summary(EvalCallAsPure) 1941 .Case({ArgumentCondition(0U, WithinRange, Range(32, 126)), 1942 ReturnValueCondition(OutOfRange, SingleValue(0))}, 1943 ErrnoIrrelevant, "Assuming the character is printable") 1944 .Case({ArgumentCondition(0U, OutOfRange, Range(32, 126)), 1945 ReturnValueCondition(WithinRange, SingleValue(0))}, 1946 ErrnoIrrelevant, "Assuming the character is non-printable")); 1947 addToFunctionSummaryMap( 1948 "ispunct", Signature(ArgTypes{IntTy}, RetType{IntTy}), 1949 Summary(EvalCallAsPure) 1950 .Case({ArgumentCondition( 1951 0U, WithinRange, 1952 {{'!', '/'}, {':', '@'}, {'[', '`'}, {'{', '~'}}), 1953 ReturnValueCondition(OutOfRange, SingleValue(0))}, 1954 ErrnoIrrelevant, "Assuming the character is a punctuation mark") 1955 .Case({ArgumentCondition( 1956 0U, OutOfRange, 1957 {{'!', '/'}, {':', '@'}, {'[', '`'}, {'{', '~'}}), 1958 ReturnValueCondition(WithinRange, SingleValue(0))}, 1959 ErrnoIrrelevant, 1960 "Assuming the character is not a punctuation mark")); 1961 addToFunctionSummaryMap( 1962 "isspace", Signature(ArgTypes{IntTy}, RetType{IntTy}), 1963 Summary(EvalCallAsPure) 1964 // Space, '\f', '\n', '\r', '\t', '\v'. 1965 .Case({ArgumentCondition(0U, WithinRange, {{9, 13}, {' ', ' '}}), 1966 ReturnValueCondition(OutOfRange, SingleValue(0))}, 1967 ErrnoIrrelevant, 1968 "Assuming the character is a whitespace character") 1969 // The locale-specific range. 1970 .Case({ArgumentCondition(0U, WithinRange, {{128, UCharRangeMax}})}, 1971 ErrnoIrrelevant) 1972 .Case({ArgumentCondition(0U, OutOfRange, 1973 {{9, 13}, {' ', ' '}, {128, UCharRangeMax}}), 1974 ReturnValueCondition(WithinRange, SingleValue(0))}, 1975 ErrnoIrrelevant, 1976 "Assuming the character is not a whitespace character")); 1977 addToFunctionSummaryMap( 1978 "isupper", Signature(ArgTypes{IntTy}, RetType{IntTy}), 1979 Summary(EvalCallAsPure) 1980 // Is certainly uppercase. 1981 .Case({ArgumentCondition(0U, WithinRange, Range('A', 'Z')), 1982 ReturnValueCondition(OutOfRange, SingleValue(0))}, 1983 ErrnoIrrelevant, 1984 "Assuming the character is an uppercase letter") 1985 // The locale-specific range. 1986 .Case({ArgumentCondition(0U, WithinRange, {{128, UCharRangeMax}})}, 1987 ErrnoIrrelevant) 1988 // Other. 1989 .Case({ArgumentCondition(0U, OutOfRange, 1990 {{'A', 'Z'}, {128, UCharRangeMax}}), 1991 ReturnValueCondition(WithinRange, SingleValue(0))}, 1992 ErrnoIrrelevant, 1993 "Assuming the character is not an uppercase letter")); 1994 addToFunctionSummaryMap( 1995 "isxdigit", Signature(ArgTypes{IntTy}, RetType{IntTy}), 1996 Summary(EvalCallAsPure) 1997 .Case({ArgumentCondition(0U, WithinRange, 1998 {{'0', '9'}, {'A', 'F'}, {'a', 'f'}}), 1999 ReturnValueCondition(OutOfRange, SingleValue(0))}, 2000 ErrnoIrrelevant, 2001 "Assuming the character is a hexadecimal digit") 2002 .Case({ArgumentCondition(0U, OutOfRange, 2003 {{'0', '9'}, {'A', 'F'}, {'a', 'f'}}), 2004 ReturnValueCondition(WithinRange, SingleValue(0))}, 2005 ErrnoIrrelevant, 2006 "Assuming the character is not a hexadecimal digit")); 2007 addToFunctionSummaryMap( 2008 "toupper", Signature(ArgTypes{IntTy}, RetType{IntTy}), 2009 Summary(EvalCallAsPure) 2010 .ArgConstraint(ArgumentCondition(0U, WithinRange, 2011 {{EOFv, EOFv}, {0, UCharRangeMax}}, 2012 "an unsigned char value or EOF"))); 2013 addToFunctionSummaryMap( 2014 "tolower", Signature(ArgTypes{IntTy}, RetType{IntTy}), 2015 Summary(EvalCallAsPure) 2016 .ArgConstraint(ArgumentCondition(0U, WithinRange, 2017 {{EOFv, EOFv}, {0, UCharRangeMax}}, 2018 "an unsigned char value or EOF"))); 2019 addToFunctionSummaryMap( 2020 "toascii", Signature(ArgTypes{IntTy}, RetType{IntTy}), 2021 Summary(EvalCallAsPure) 2022 .ArgConstraint(ArgumentCondition(0U, WithinRange, 2023 {{EOFv, EOFv}, {0, UCharRangeMax}}, 2024 "an unsigned char value or EOF"))); 2025 2026 addToFunctionSummaryMap( 2027 "getchar", Signature(ArgTypes{}, RetType{IntTy}), 2028 Summary(NoEvalCall) 2029 .Case({ReturnValueCondition(WithinRange, 2030 {{EOFv, EOFv}, {0, UCharRangeMax}})}, 2031 ErrnoIrrelevant)); 2032 2033 // read()-like functions that never return more than buffer size. 2034 auto FreadSummary = 2035 Summary(NoEvalCall) 2036 .Case({ArgumentCondition(1U, WithinRange, Range(1, SizeMax)), 2037 ArgumentCondition(2U, WithinRange, Range(1, SizeMax)), 2038 ReturnValueCondition(BO_LT, ArgNo(2)), 2039 ReturnValueCondition(WithinRange, Range(0, SizeMax))}, 2040 ErrnoNEZeroIrrelevant, GenericFailureMsg) 2041 .Case({ArgumentCondition(1U, WithinRange, Range(1, SizeMax)), 2042 ReturnValueCondition(BO_EQ, ArgNo(2)), 2043 ReturnValueCondition(WithinRange, Range(0, SizeMax))}, 2044 ErrnoMustNotBeChecked, GenericSuccessMsg) 2045 .Case({ArgumentCondition(1U, WithinRange, SingleValue(0)), 2046 ReturnValueCondition(WithinRange, SingleValue(0))}, 2047 ErrnoMustNotBeChecked, 2048 "Assuming that argument 'size' to '{0}' is 0") 2049 .ArgConstraint(NotNullBuffer(ArgNo(0), ArgNo(1), ArgNo(2))) 2050 .ArgConstraint(NotNull(ArgNo(3))) 2051 .ArgConstraint(BufferSize(/*Buffer=*/ArgNo(0), /*BufSize=*/ArgNo(1), 2052 /*BufSizeMultiplier=*/ArgNo(2))); 2053 2054 // size_t fread(void *restrict ptr, size_t size, size_t nitems, 2055 // FILE *restrict stream); 2056 addToFunctionSummaryMap( 2057 "fread", 2058 Signature(ArgTypes{VoidPtrRestrictTy, SizeTy, SizeTy, FilePtrRestrictTy}, 2059 RetType{SizeTy}), 2060 FreadSummary); 2061 // size_t fwrite(const void *restrict ptr, size_t size, size_t nitems, 2062 // FILE *restrict stream); 2063 addToFunctionSummaryMap("fwrite", 2064 Signature(ArgTypes{ConstVoidPtrRestrictTy, SizeTy, 2065 SizeTy, FilePtrRestrictTy}, 2066 RetType{SizeTy}), 2067 FreadSummary); 2068 2069 std::optional<QualType> Ssize_tTy = lookupTy("ssize_t"); 2070 std::optional<RangeInt> Ssize_tMax = getMaxValue(Ssize_tTy); 2071 2072 auto ReadSummary = 2073 Summary(NoEvalCall) 2074 .Case({ReturnValueCondition(LessThanOrEq, ArgNo(2)), 2075 ReturnValueCondition(WithinRange, Range(-1, Ssize_tMax))}, 2076 ErrnoIrrelevant); 2077 2078 // FIXME these are actually defined by POSIX and not by the C standard, we 2079 // should handle them together with the rest of the POSIX functions. 2080 // ssize_t read(int fildes, void *buf, size_t nbyte); 2081 addToFunctionSummaryMap( 2082 "read", Signature(ArgTypes{IntTy, VoidPtrTy, SizeTy}, RetType{Ssize_tTy}), 2083 ReadSummary); 2084 // ssize_t write(int fildes, const void *buf, size_t nbyte); 2085 addToFunctionSummaryMap( 2086 "write", 2087 Signature(ArgTypes{IntTy, ConstVoidPtrTy, SizeTy}, RetType{Ssize_tTy}), 2088 ReadSummary); 2089 2090 auto GetLineSummary = 2091 Summary(NoEvalCall) 2092 .Case({ReturnValueCondition(WithinRange, 2093 Range({-1, -1}, {1, Ssize_tMax}))}, 2094 ErrnoIrrelevant); 2095 2096 QualType CharPtrPtrRestrictTy = getRestrictTy(getPointerTy(CharPtrTy)); 2097 2098 // getline()-like functions either fail or read at least the delimiter. 2099 // FIXME these are actually defined by POSIX and not by the C standard, we 2100 // should handle them together with the rest of the POSIX functions. 2101 // ssize_t getline(char **restrict lineptr, size_t *restrict n, 2102 // FILE *restrict stream); 2103 addToFunctionSummaryMap( 2104 "getline", 2105 Signature( 2106 ArgTypes{CharPtrPtrRestrictTy, SizePtrRestrictTy, FilePtrRestrictTy}, 2107 RetType{Ssize_tTy}), 2108 GetLineSummary); 2109 // ssize_t getdelim(char **restrict lineptr, size_t *restrict n, 2110 // int delimiter, FILE *restrict stream); 2111 addToFunctionSummaryMap( 2112 "getdelim", 2113 Signature(ArgTypes{CharPtrPtrRestrictTy, SizePtrRestrictTy, IntTy, 2114 FilePtrRestrictTy}, 2115 RetType{Ssize_tTy}), 2116 GetLineSummary); 2117 2118 { 2119 Summary GetenvSummary = 2120 Summary(NoEvalCall) 2121 .ArgConstraint(NotNull(ArgNo(0))) 2122 .Case({NotNull(Ret)}, ErrnoIrrelevant, 2123 "Assuming the environment variable exists"); 2124 // In untrusted environments the envvar might not exist. 2125 if (!ShouldAssumeControlledEnvironment) 2126 GetenvSummary.Case({NotNull(Ret)->negate()}, ErrnoIrrelevant, 2127 "Assuming the environment variable does not exist"); 2128 2129 // char *getenv(const char *name); 2130 addToFunctionSummaryMap( 2131 "getenv", Signature(ArgTypes{ConstCharPtrTy}, RetType{CharPtrTy}), 2132 std::move(GetenvSummary)); 2133 } 2134 2135 if (!ModelPOSIX) { 2136 // Without POSIX use of 'errno' is not specified (in these cases). 2137 // Add these functions without 'errno' checks. 2138 addToFunctionSummaryMap( 2139 {"getc", "fgetc"}, Signature(ArgTypes{FilePtrTy}, RetType{IntTy}), 2140 Summary(NoEvalCall) 2141 .Case({ReturnValueCondition(WithinRange, 2142 {{EOFv, EOFv}, {0, UCharRangeMax}})}, 2143 ErrnoIrrelevant) 2144 .ArgConstraint(NotNull(ArgNo(0)))); 2145 } else { 2146 const auto ReturnsZeroOrMinusOne = 2147 ConstraintSet{ReturnValueCondition(WithinRange, Range(-1, 0))}; 2148 const auto ReturnsZero = 2149 ConstraintSet{ReturnValueCondition(WithinRange, SingleValue(0))}; 2150 const auto ReturnsMinusOne = 2151 ConstraintSet{ReturnValueCondition(WithinRange, SingleValue(-1))}; 2152 const auto ReturnsEOF = 2153 ConstraintSet{ReturnValueCondition(WithinRange, SingleValue(EOFv))}; 2154 const auto ReturnsNonnegative = 2155 ConstraintSet{ReturnValueCondition(WithinRange, Range(0, IntMax))}; 2156 const auto ReturnsNonZero = 2157 ConstraintSet{ReturnValueCondition(OutOfRange, SingleValue(0))}; 2158 const auto ReturnsFileDescriptor = 2159 ConstraintSet{ReturnValueCondition(WithinRange, Range(-1, IntMax))}; 2160 const auto &ReturnsValidFileDescriptor = ReturnsNonnegative; 2161 2162 auto ValidFileDescriptorOrAtFdcwd = [&](ArgNo ArgN) { 2163 return std::make_shared<RangeConstraint>( 2164 ArgN, WithinRange, Range({AT_FDCWDv, AT_FDCWDv}, {0, IntMax}), 2165 "a valid file descriptor or AT_FDCWD"); 2166 }; 2167 2168 // FILE *fopen(const char *restrict pathname, const char *restrict mode); 2169 addToFunctionSummaryMap( 2170 "fopen", 2171 Signature(ArgTypes{ConstCharPtrRestrictTy, ConstCharPtrRestrictTy}, 2172 RetType{FilePtrTy}), 2173 Summary(NoEvalCall) 2174 .Case({NotNull(Ret)}, ErrnoMustNotBeChecked, GenericSuccessMsg) 2175 .Case({IsNull(Ret)}, ErrnoNEZeroIrrelevant, GenericFailureMsg) 2176 .ArgConstraint(NotNull(ArgNo(0))) 2177 .ArgConstraint(NotNull(ArgNo(1)))); 2178 2179 // FILE *fdopen(int fd, const char *mode); 2180 addToFunctionSummaryMap( 2181 "fdopen", 2182 Signature(ArgTypes{IntTy, ConstCharPtrTy}, RetType{FilePtrTy}), 2183 Summary(NoEvalCall) 2184 .Case({NotNull(Ret)}, ErrnoMustNotBeChecked, GenericSuccessMsg) 2185 .Case({IsNull(Ret)}, ErrnoNEZeroIrrelevant, GenericFailureMsg) 2186 .ArgConstraint(ArgumentCondition(0, WithinRange, Range(0, IntMax))) 2187 .ArgConstraint(NotNull(ArgNo(1)))); 2188 2189 // FILE *tmpfile(void); 2190 addToFunctionSummaryMap( 2191 "tmpfile", Signature(ArgTypes{}, RetType{FilePtrTy}), 2192 Summary(NoEvalCall) 2193 .Case({NotNull(Ret)}, ErrnoMustNotBeChecked, GenericSuccessMsg) 2194 .Case({IsNull(Ret)}, ErrnoNEZeroIrrelevant, GenericFailureMsg)); 2195 2196 // FILE *freopen(const char *restrict pathname, const char *restrict mode, 2197 // FILE *restrict stream); 2198 addToFunctionSummaryMap( 2199 "freopen", 2200 Signature(ArgTypes{ConstCharPtrRestrictTy, ConstCharPtrRestrictTy, 2201 FilePtrRestrictTy}, 2202 RetType{FilePtrTy}), 2203 Summary(NoEvalCall) 2204 .Case({ReturnValueCondition(BO_EQ, ArgNo(2))}, 2205 ErrnoMustNotBeChecked, GenericSuccessMsg) 2206 .Case({IsNull(Ret)}, ErrnoNEZeroIrrelevant, GenericFailureMsg) 2207 .ArgConstraint(NotNull(ArgNo(1))) 2208 .ArgConstraint(NotNull(ArgNo(2)))); 2209 2210 // FILE *popen(const char *command, const char *type); 2211 addToFunctionSummaryMap( 2212 "popen", 2213 Signature(ArgTypes{ConstCharPtrTy, ConstCharPtrTy}, RetType{FilePtrTy}), 2214 Summary(NoEvalCall) 2215 .Case({NotNull(Ret)}, ErrnoMustNotBeChecked, GenericSuccessMsg) 2216 .Case({IsNull(Ret)}, ErrnoNEZeroIrrelevant, GenericFailureMsg) 2217 .ArgConstraint(NotNull(ArgNo(0))) 2218 .ArgConstraint(NotNull(ArgNo(1)))); 2219 2220 // int fclose(FILE *stream); 2221 addToFunctionSummaryMap( 2222 "fclose", Signature(ArgTypes{FilePtrTy}, RetType{IntTy}), 2223 Summary(NoEvalCall) 2224 .Case(ReturnsZero, ErrnoMustNotBeChecked, GenericSuccessMsg) 2225 .Case(ReturnsEOF, ErrnoNEZeroIrrelevant, GenericFailureMsg) 2226 .ArgConstraint(NotNull(ArgNo(0)))); 2227 2228 // int pclose(FILE *stream); 2229 addToFunctionSummaryMap( 2230 "pclose", Signature(ArgTypes{FilePtrTy}, RetType{IntTy}), 2231 Summary(NoEvalCall) 2232 .Case({ReturnValueCondition(WithinRange, {{0, IntMax}})}, 2233 ErrnoMustNotBeChecked, GenericSuccessMsg) 2234 .Case(ReturnsMinusOne, ErrnoNEZeroIrrelevant, GenericFailureMsg) 2235 .ArgConstraint(NotNull(ArgNo(0)))); 2236 2237 std::optional<QualType> Off_tTy = lookupTy("off_t"); 2238 std::optional<RangeInt> Off_tMax = getMaxValue(Off_tTy); 2239 2240 // int fgetc(FILE *stream); 2241 // 'getc' is the same as 'fgetc' but may be a macro 2242 addToFunctionSummaryMap( 2243 {"getc", "fgetc"}, Signature(ArgTypes{FilePtrTy}, RetType{IntTy}), 2244 Summary(NoEvalCall) 2245 .Case({ReturnValueCondition(WithinRange, {{0, UCharRangeMax}})}, 2246 ErrnoMustNotBeChecked, GenericSuccessMsg) 2247 .Case({ReturnValueCondition(WithinRange, SingleValue(EOFv))}, 2248 ErrnoIrrelevant, GenericFailureMsg) 2249 .ArgConstraint(NotNull(ArgNo(0)))); 2250 2251 // int fputc(int c, FILE *stream); 2252 // 'putc' is the same as 'fputc' but may be a macro 2253 addToFunctionSummaryMap( 2254 {"putc", "fputc"}, 2255 Signature(ArgTypes{IntTy, FilePtrTy}, RetType{IntTy}), 2256 Summary(NoEvalCall) 2257 .Case({ArgumentCondition(0, WithinRange, Range(0, UCharRangeMax)), 2258 ReturnValueCondition(BO_EQ, ArgNo(0))}, 2259 ErrnoMustNotBeChecked, GenericSuccessMsg) 2260 .Case({ArgumentCondition(0, OutOfRange, Range(0, UCharRangeMax)), 2261 ReturnValueCondition(WithinRange, Range(0, UCharRangeMax))}, 2262 ErrnoMustNotBeChecked, GenericSuccessMsg) 2263 .Case({ReturnValueCondition(WithinRange, SingleValue(EOFv))}, 2264 ErrnoNEZeroIrrelevant, GenericFailureMsg) 2265 .ArgConstraint(NotNull(ArgNo(1)))); 2266 2267 // char *fgets(char *restrict s, int n, FILE *restrict stream); 2268 addToFunctionSummaryMap( 2269 "fgets", 2270 Signature(ArgTypes{CharPtrRestrictTy, IntTy, FilePtrRestrictTy}, 2271 RetType{CharPtrTy}), 2272 Summary(NoEvalCall) 2273 .Case({ReturnValueCondition(BO_EQ, ArgNo(0))}, 2274 ErrnoMustNotBeChecked, GenericSuccessMsg) 2275 .Case({IsNull(Ret)}, ErrnoIrrelevant, GenericFailureMsg) 2276 .ArgConstraint(NotNull(ArgNo(0))) 2277 .ArgConstraint(ArgumentCondition(1, WithinRange, Range(0, IntMax))) 2278 .ArgConstraint( 2279 BufferSize(/*Buffer=*/ArgNo(0), /*BufSize=*/ArgNo(1))) 2280 .ArgConstraint(NotNull(ArgNo(2)))); 2281 2282 // int fputs(const char *restrict s, FILE *restrict stream); 2283 addToFunctionSummaryMap( 2284 "fputs", 2285 Signature(ArgTypes{ConstCharPtrRestrictTy, FilePtrRestrictTy}, 2286 RetType{IntTy}), 2287 Summary(NoEvalCall) 2288 .Case(ReturnsNonnegative, ErrnoMustNotBeChecked, GenericSuccessMsg) 2289 .Case({ReturnValueCondition(WithinRange, SingleValue(EOFv))}, 2290 ErrnoNEZeroIrrelevant, GenericFailureMsg) 2291 .ArgConstraint(NotNull(ArgNo(0))) 2292 .ArgConstraint(NotNull(ArgNo(1)))); 2293 2294 // int ungetc(int c, FILE *stream); 2295 addToFunctionSummaryMap( 2296 "ungetc", Signature(ArgTypes{IntTy, FilePtrTy}, RetType{IntTy}), 2297 Summary(NoEvalCall) 2298 .Case({ReturnValueCondition(BO_EQ, ArgNo(0)), 2299 ArgumentCondition(0, WithinRange, {{0, UCharRangeMax}})}, 2300 ErrnoMustNotBeChecked, GenericSuccessMsg) 2301 .Case({ReturnValueCondition(WithinRange, SingleValue(EOFv)), 2302 ArgumentCondition(0, WithinRange, SingleValue(EOFv))}, 2303 ErrnoNEZeroIrrelevant, 2304 "Assuming that 'ungetc' fails because EOF was passed as " 2305 "character") 2306 .Case({ReturnValueCondition(WithinRange, SingleValue(EOFv)), 2307 ArgumentCondition(0, WithinRange, {{0, UCharRangeMax}})}, 2308 ErrnoNEZeroIrrelevant, GenericFailureMsg) 2309 .ArgConstraint(ArgumentCondition( 2310 0, WithinRange, {{EOFv, EOFv}, {0, UCharRangeMax}})) 2311 .ArgConstraint(NotNull(ArgNo(1)))); 2312 2313 // int fseek(FILE *stream, long offset, int whence); 2314 // FIXME: It can be possible to get the 'SEEK_' values (like EOFv) and use 2315 // these for condition of arg 2. 2316 // Now the range [0,2] is used (the `SEEK_*` constants are usually 0,1,2). 2317 addToFunctionSummaryMap( 2318 "fseek", Signature(ArgTypes{FilePtrTy, LongTy, IntTy}, RetType{IntTy}), 2319 Summary(NoEvalCall) 2320 .Case(ReturnsZero, ErrnoMustNotBeChecked, GenericSuccessMsg) 2321 .Case(ReturnsMinusOne, ErrnoNEZeroIrrelevant, GenericFailureMsg) 2322 .ArgConstraint(NotNull(ArgNo(0))) 2323 .ArgConstraint(ArgumentCondition(2, WithinRange, {{0, 2}}))); 2324 2325 // int fseeko(FILE *stream, off_t offset, int whence); 2326 addToFunctionSummaryMap( 2327 "fseeko", 2328 Signature(ArgTypes{FilePtrTy, Off_tTy, IntTy}, RetType{IntTy}), 2329 Summary(NoEvalCall) 2330 .Case(ReturnsZero, ErrnoMustNotBeChecked, GenericSuccessMsg) 2331 .Case(ReturnsMinusOne, ErrnoNEZeroIrrelevant, GenericFailureMsg) 2332 .ArgConstraint(NotNull(ArgNo(0))) 2333 .ArgConstraint(ArgumentCondition(2, WithinRange, {{0, 2}}))); 2334 2335 // int fgetpos(FILE *restrict stream, fpos_t *restrict pos); 2336 // From 'The Open Group Base Specifications Issue 7, 2018 edition': 2337 // "The fgetpos() function shall not change the setting of errno if 2338 // successful." 2339 addToFunctionSummaryMap( 2340 "fgetpos", 2341 Signature(ArgTypes{FilePtrRestrictTy, FPosTPtrRestrictTy}, 2342 RetType{IntTy}), 2343 Summary(NoEvalCall) 2344 .Case(ReturnsZero, ErrnoUnchanged, GenericSuccessMsg) 2345 .Case(ReturnsNonZero, ErrnoNEZeroIrrelevant, GenericFailureMsg) 2346 .ArgConstraint(NotNull(ArgNo(0))) 2347 .ArgConstraint(NotNull(ArgNo(1)))); 2348 2349 // int fsetpos(FILE *stream, const fpos_t *pos); 2350 // From 'The Open Group Base Specifications Issue 7, 2018 edition': 2351 // "The fsetpos() function shall not change the setting of errno if 2352 // successful." 2353 addToFunctionSummaryMap( 2354 "fsetpos", 2355 Signature(ArgTypes{FilePtrTy, ConstFPosTPtrTy}, RetType{IntTy}), 2356 Summary(NoEvalCall) 2357 .Case(ReturnsZero, ErrnoUnchanged, GenericSuccessMsg) 2358 .Case(ReturnsNonZero, ErrnoNEZeroIrrelevant, GenericFailureMsg) 2359 .ArgConstraint(NotNull(ArgNo(0))) 2360 .ArgConstraint(NotNull(ArgNo(1)))); 2361 2362 // int fflush(FILE *stream); 2363 addToFunctionSummaryMap( 2364 "fflush", Signature(ArgTypes{FilePtrTy}, RetType{IntTy}), 2365 Summary(NoEvalCall) 2366 .Case(ReturnsZero, ErrnoMustNotBeChecked, GenericSuccessMsg) 2367 .Case(ReturnsEOF, ErrnoNEZeroIrrelevant, GenericFailureMsg)); 2368 2369 // long ftell(FILE *stream); 2370 // From 'The Open Group Base Specifications Issue 7, 2018 edition': 2371 // "The ftell() function shall not change the setting of errno if 2372 // successful." 2373 addToFunctionSummaryMap( 2374 "ftell", Signature(ArgTypes{FilePtrTy}, RetType{LongTy}), 2375 Summary(NoEvalCall) 2376 .Case({ReturnValueCondition(WithinRange, Range(0, LongMax))}, 2377 ErrnoUnchanged, GenericSuccessMsg) 2378 .Case(ReturnsMinusOne, ErrnoNEZeroIrrelevant, GenericFailureMsg) 2379 .ArgConstraint(NotNull(ArgNo(0)))); 2380 2381 // off_t ftello(FILE *stream); 2382 addToFunctionSummaryMap( 2383 "ftello", Signature(ArgTypes{FilePtrTy}, RetType{Off_tTy}), 2384 Summary(NoEvalCall) 2385 .Case({ReturnValueCondition(WithinRange, Range(0, Off_tMax))}, 2386 ErrnoMustNotBeChecked, GenericSuccessMsg) 2387 .Case(ReturnsMinusOne, ErrnoNEZeroIrrelevant, GenericFailureMsg) 2388 .ArgConstraint(NotNull(ArgNo(0)))); 2389 2390 // int fileno(FILE *stream); 2391 addToFunctionSummaryMap( 2392 "fileno", Signature(ArgTypes{FilePtrTy}, RetType{IntTy}), 2393 Summary(NoEvalCall) 2394 .Case(ReturnsValidFileDescriptor, ErrnoMustNotBeChecked, 2395 GenericSuccessMsg) 2396 .Case(ReturnsMinusOne, ErrnoNEZeroIrrelevant, GenericFailureMsg) 2397 .ArgConstraint(NotNull(ArgNo(0)))); 2398 2399 // void rewind(FILE *stream); 2400 // This function indicates error only by setting of 'errno'. 2401 addToFunctionSummaryMap("rewind", 2402 Signature(ArgTypes{FilePtrTy}, RetType{VoidTy}), 2403 Summary(NoEvalCall) 2404 .Case({}, ErrnoMustBeChecked) 2405 .ArgConstraint(NotNull(ArgNo(0)))); 2406 2407 // void clearerr(FILE *stream); 2408 addToFunctionSummaryMap( 2409 "clearerr", Signature(ArgTypes{FilePtrTy}, RetType{VoidTy}), 2410 Summary(NoEvalCall).ArgConstraint(NotNull(ArgNo(0)))); 2411 2412 // int feof(FILE *stream); 2413 addToFunctionSummaryMap( 2414 "feof", Signature(ArgTypes{FilePtrTy}, RetType{IntTy}), 2415 Summary(NoEvalCall).ArgConstraint(NotNull(ArgNo(0)))); 2416 2417 // int ferror(FILE *stream); 2418 addToFunctionSummaryMap( 2419 "ferror", Signature(ArgTypes{FilePtrTy}, RetType{IntTy}), 2420 Summary(NoEvalCall).ArgConstraint(NotNull(ArgNo(0)))); 2421 2422 // long a64l(const char *str64); 2423 addToFunctionSummaryMap( 2424 "a64l", Signature(ArgTypes{ConstCharPtrTy}, RetType{LongTy}), 2425 Summary(NoEvalCall).ArgConstraint(NotNull(ArgNo(0)))); 2426 2427 // char *l64a(long value); 2428 addToFunctionSummaryMap("l64a", 2429 Signature(ArgTypes{LongTy}, RetType{CharPtrTy}), 2430 Summary(NoEvalCall) 2431 .ArgConstraint(ArgumentCondition( 2432 0, WithinRange, Range(0, LongMax)))); 2433 2434 // int open(const char *path, int oflag, ...); 2435 addToFunctionSummaryMap( 2436 "open", Signature(ArgTypes{ConstCharPtrTy, IntTy}, RetType{IntTy}), 2437 Summary(NoEvalCall) 2438 .Case(ReturnsValidFileDescriptor, ErrnoMustNotBeChecked, 2439 GenericSuccessMsg) 2440 .Case(ReturnsMinusOne, ErrnoNEZeroIrrelevant, GenericFailureMsg) 2441 .ArgConstraint(NotNull(ArgNo(0)))); 2442 2443 // int openat(int fd, const char *path, int oflag, ...); 2444 addToFunctionSummaryMap( 2445 "openat", 2446 Signature(ArgTypes{IntTy, ConstCharPtrTy, IntTy}, RetType{IntTy}), 2447 Summary(NoEvalCall) 2448 .Case(ReturnsValidFileDescriptor, ErrnoMustNotBeChecked, 2449 GenericSuccessMsg) 2450 .Case(ReturnsMinusOne, ErrnoNEZeroIrrelevant, GenericFailureMsg) 2451 .ArgConstraint(ValidFileDescriptorOrAtFdcwd(ArgNo(0))) 2452 .ArgConstraint(NotNull(ArgNo(1)))); 2453 2454 // int access(const char *pathname, int amode); 2455 addToFunctionSummaryMap( 2456 "access", Signature(ArgTypes{ConstCharPtrTy, IntTy}, RetType{IntTy}), 2457 Summary(NoEvalCall) 2458 .Case(ReturnsZero, ErrnoMustNotBeChecked, GenericSuccessMsg) 2459 .Case(ReturnsMinusOne, ErrnoNEZeroIrrelevant, GenericFailureMsg) 2460 .ArgConstraint(NotNull(ArgNo(0)))); 2461 2462 // int faccessat(int dirfd, const char *pathname, int mode, int flags); 2463 addToFunctionSummaryMap( 2464 "faccessat", 2465 Signature(ArgTypes{IntTy, ConstCharPtrTy, IntTy, IntTy}, 2466 RetType{IntTy}), 2467 Summary(NoEvalCall) 2468 .Case(ReturnsZero, ErrnoMustNotBeChecked, GenericSuccessMsg) 2469 .Case(ReturnsMinusOne, ErrnoNEZeroIrrelevant, GenericFailureMsg) 2470 .ArgConstraint(ValidFileDescriptorOrAtFdcwd(ArgNo(0))) 2471 .ArgConstraint(NotNull(ArgNo(1)))); 2472 2473 // int dup(int fildes); 2474 addToFunctionSummaryMap( 2475 "dup", Signature(ArgTypes{IntTy}, RetType{IntTy}), 2476 Summary(NoEvalCall) 2477 .Case(ReturnsValidFileDescriptor, ErrnoMustNotBeChecked, 2478 GenericSuccessMsg) 2479 .Case(ReturnsMinusOne, ErrnoNEZeroIrrelevant, GenericFailureMsg) 2480 .ArgConstraint( 2481 ArgumentCondition(0, WithinRange, Range(0, IntMax)))); 2482 2483 // int dup2(int fildes1, int filedes2); 2484 addToFunctionSummaryMap( 2485 "dup2", Signature(ArgTypes{IntTy, IntTy}, RetType{IntTy}), 2486 Summary(NoEvalCall) 2487 .Case(ReturnsValidFileDescriptor, ErrnoMustNotBeChecked, 2488 GenericSuccessMsg) 2489 .Case(ReturnsMinusOne, ErrnoNEZeroIrrelevant, GenericFailureMsg) 2490 .ArgConstraint(ArgumentCondition(0, WithinRange, Range(0, IntMax))) 2491 .ArgConstraint( 2492 ArgumentCondition(1, WithinRange, Range(0, IntMax)))); 2493 2494 // int fdatasync(int fildes); 2495 addToFunctionSummaryMap( 2496 "fdatasync", Signature(ArgTypes{IntTy}, RetType{IntTy}), 2497 Summary(NoEvalCall) 2498 .Case(ReturnsZero, ErrnoMustNotBeChecked, GenericSuccessMsg) 2499 .Case(ReturnsMinusOne, ErrnoNEZeroIrrelevant, GenericFailureMsg) 2500 .ArgConstraint( 2501 ArgumentCondition(0, WithinRange, Range(0, IntMax)))); 2502 2503 // int fnmatch(const char *pattern, const char *string, int flags); 2504 addToFunctionSummaryMap( 2505 "fnmatch", 2506 Signature(ArgTypes{ConstCharPtrTy, ConstCharPtrTy, IntTy}, 2507 RetType{IntTy}), 2508 Summary(NoEvalCall) 2509 .ArgConstraint(NotNull(ArgNo(0))) 2510 .ArgConstraint(NotNull(ArgNo(1)))); 2511 2512 // int fsync(int fildes); 2513 addToFunctionSummaryMap( 2514 "fsync", Signature(ArgTypes{IntTy}, RetType{IntTy}), 2515 Summary(NoEvalCall) 2516 .Case(ReturnsZero, ErrnoMustNotBeChecked, GenericSuccessMsg) 2517 .Case(ReturnsMinusOne, ErrnoNEZeroIrrelevant, GenericFailureMsg) 2518 .ArgConstraint( 2519 ArgumentCondition(0, WithinRange, Range(0, IntMax)))); 2520 2521 // int truncate(const char *path, off_t length); 2522 addToFunctionSummaryMap( 2523 "truncate", 2524 Signature(ArgTypes{ConstCharPtrTy, Off_tTy}, RetType{IntTy}), 2525 Summary(NoEvalCall) 2526 .Case(ReturnsZero, ErrnoMustNotBeChecked, GenericSuccessMsg) 2527 .Case(ReturnsMinusOne, ErrnoNEZeroIrrelevant, GenericFailureMsg) 2528 .ArgConstraint(NotNull(ArgNo(0)))); 2529 2530 // int symlink(const char *oldpath, const char *newpath); 2531 addToFunctionSummaryMap( 2532 "symlink", 2533 Signature(ArgTypes{ConstCharPtrTy, ConstCharPtrTy}, RetType{IntTy}), 2534 Summary(NoEvalCall) 2535 .Case(ReturnsZero, ErrnoMustNotBeChecked, GenericSuccessMsg) 2536 .Case(ReturnsMinusOne, ErrnoNEZeroIrrelevant, GenericFailureMsg) 2537 .ArgConstraint(NotNull(ArgNo(0))) 2538 .ArgConstraint(NotNull(ArgNo(1)))); 2539 2540 // int symlinkat(const char *oldpath, int newdirfd, const char *newpath); 2541 addToFunctionSummaryMap( 2542 "symlinkat", 2543 Signature(ArgTypes{ConstCharPtrTy, IntTy, ConstCharPtrTy}, 2544 RetType{IntTy}), 2545 Summary(NoEvalCall) 2546 .Case(ReturnsZero, ErrnoMustNotBeChecked, GenericSuccessMsg) 2547 .Case(ReturnsMinusOne, ErrnoNEZeroIrrelevant, GenericFailureMsg) 2548 .ArgConstraint(NotNull(ArgNo(0))) 2549 .ArgConstraint(ValidFileDescriptorOrAtFdcwd(ArgNo(1))) 2550 .ArgConstraint(NotNull(ArgNo(2)))); 2551 2552 // int lockf(int fd, int cmd, off_t len); 2553 addToFunctionSummaryMap( 2554 "lockf", Signature(ArgTypes{IntTy, IntTy, Off_tTy}, RetType{IntTy}), 2555 Summary(NoEvalCall) 2556 .Case(ReturnsZero, ErrnoMustNotBeChecked, GenericSuccessMsg) 2557 .Case(ReturnsMinusOne, ErrnoNEZeroIrrelevant, GenericFailureMsg) 2558 .ArgConstraint( 2559 ArgumentCondition(0, WithinRange, Range(0, IntMax)))); 2560 2561 std::optional<QualType> Mode_tTy = lookupTy("mode_t"); 2562 2563 // int creat(const char *pathname, mode_t mode); 2564 addToFunctionSummaryMap( 2565 "creat", Signature(ArgTypes{ConstCharPtrTy, Mode_tTy}, RetType{IntTy}), 2566 Summary(NoEvalCall) 2567 .Case(ReturnsValidFileDescriptor, ErrnoMustNotBeChecked, 2568 GenericSuccessMsg) 2569 .Case(ReturnsMinusOne, ErrnoNEZeroIrrelevant, GenericFailureMsg) 2570 .ArgConstraint(NotNull(ArgNo(0)))); 2571 2572 // unsigned int sleep(unsigned int seconds); 2573 addToFunctionSummaryMap( 2574 "sleep", Signature(ArgTypes{UnsignedIntTy}, RetType{UnsignedIntTy}), 2575 Summary(NoEvalCall) 2576 .ArgConstraint( 2577 ArgumentCondition(0, WithinRange, Range(0, UnsignedIntMax)))); 2578 2579 std::optional<QualType> DirTy = lookupTy("DIR"); 2580 std::optional<QualType> DirPtrTy = getPointerTy(DirTy); 2581 2582 // int dirfd(DIR *dirp); 2583 addToFunctionSummaryMap( 2584 "dirfd", Signature(ArgTypes{DirPtrTy}, RetType{IntTy}), 2585 Summary(NoEvalCall) 2586 .Case(ReturnsValidFileDescriptor, ErrnoMustNotBeChecked, 2587 GenericSuccessMsg) 2588 .Case(ReturnsMinusOne, ErrnoNEZeroIrrelevant, GenericFailureMsg) 2589 .ArgConstraint(NotNull(ArgNo(0)))); 2590 2591 // unsigned int alarm(unsigned int seconds); 2592 addToFunctionSummaryMap( 2593 "alarm", Signature(ArgTypes{UnsignedIntTy}, RetType{UnsignedIntTy}), 2594 Summary(NoEvalCall) 2595 .ArgConstraint( 2596 ArgumentCondition(0, WithinRange, Range(0, UnsignedIntMax)))); 2597 2598 // int closedir(DIR *dir); 2599 addToFunctionSummaryMap( 2600 "closedir", Signature(ArgTypes{DirPtrTy}, RetType{IntTy}), 2601 Summary(NoEvalCall) 2602 .Case(ReturnsZero, ErrnoMustNotBeChecked, GenericSuccessMsg) 2603 .Case(ReturnsMinusOne, ErrnoNEZeroIrrelevant, GenericFailureMsg) 2604 .ArgConstraint(NotNull(ArgNo(0)))); 2605 2606 // char *strdup(const char *s); 2607 addToFunctionSummaryMap( 2608 "strdup", Signature(ArgTypes{ConstCharPtrTy}, RetType{CharPtrTy}), 2609 Summary(NoEvalCall).ArgConstraint(NotNull(ArgNo(0)))); 2610 2611 // char *strndup(const char *s, size_t n); 2612 addToFunctionSummaryMap( 2613 "strndup", 2614 Signature(ArgTypes{ConstCharPtrTy, SizeTy}, RetType{CharPtrTy}), 2615 Summary(NoEvalCall) 2616 .ArgConstraint(NotNull(ArgNo(0))) 2617 .ArgConstraint( 2618 ArgumentCondition(1, WithinRange, Range(0, SizeMax)))); 2619 2620 // wchar_t *wcsdup(const wchar_t *s); 2621 addToFunctionSummaryMap( 2622 "wcsdup", Signature(ArgTypes{ConstWchar_tPtrTy}, RetType{Wchar_tPtrTy}), 2623 Summary(NoEvalCall).ArgConstraint(NotNull(ArgNo(0)))); 2624 2625 // int mkstemp(char *template); 2626 addToFunctionSummaryMap( 2627 "mkstemp", Signature(ArgTypes{CharPtrTy}, RetType{IntTy}), 2628 Summary(NoEvalCall) 2629 .Case(ReturnsValidFileDescriptor, ErrnoMustNotBeChecked, 2630 GenericSuccessMsg) 2631 .Case(ReturnsMinusOne, ErrnoNEZeroIrrelevant, GenericFailureMsg) 2632 .ArgConstraint(NotNull(ArgNo(0)))); 2633 2634 // char *mkdtemp(char *template); 2635 addToFunctionSummaryMap( 2636 "mkdtemp", Signature(ArgTypes{CharPtrTy}, RetType{CharPtrTy}), 2637 Summary(NoEvalCall) 2638 .Case({ReturnValueCondition(BO_EQ, ArgNo(0))}, 2639 ErrnoMustNotBeChecked, GenericSuccessMsg) 2640 .Case({IsNull(Ret)}, ErrnoNEZeroIrrelevant, GenericFailureMsg) 2641 .ArgConstraint(NotNull(ArgNo(0)))); 2642 2643 // char *getcwd(char *buf, size_t size); 2644 addToFunctionSummaryMap( 2645 "getcwd", Signature(ArgTypes{CharPtrTy, SizeTy}, RetType{CharPtrTy}), 2646 Summary(NoEvalCall) 2647 .Case({ArgumentCondition(1, WithinRange, Range(1, SizeMax)), 2648 ReturnValueCondition(BO_EQ, ArgNo(0))}, 2649 ErrnoMustNotBeChecked, GenericSuccessMsg) 2650 .Case({ArgumentCondition(1, WithinRange, SingleValue(0)), 2651 IsNull(Ret)}, 2652 ErrnoNEZeroIrrelevant, "Assuming that argument 'size' is 0") 2653 .Case({ArgumentCondition(1, WithinRange, Range(1, SizeMax)), 2654 IsNull(Ret)}, 2655 ErrnoNEZeroIrrelevant, GenericFailureMsg) 2656 .ArgConstraint(NotNull(ArgNo(0))) 2657 .ArgConstraint( 2658 BufferSize(/*Buffer*/ ArgNo(0), /*BufSize*/ ArgNo(1))) 2659 .ArgConstraint( 2660 ArgumentCondition(1, WithinRange, Range(0, SizeMax)))); 2661 2662 // int mkdir(const char *pathname, mode_t mode); 2663 addToFunctionSummaryMap( 2664 "mkdir", Signature(ArgTypes{ConstCharPtrTy, Mode_tTy}, RetType{IntTy}), 2665 Summary(NoEvalCall) 2666 .Case(ReturnsZero, ErrnoMustNotBeChecked, GenericSuccessMsg) 2667 .Case(ReturnsMinusOne, ErrnoNEZeroIrrelevant, GenericFailureMsg) 2668 .ArgConstraint(NotNull(ArgNo(0)))); 2669 2670 // int mkdirat(int dirfd, const char *pathname, mode_t mode); 2671 addToFunctionSummaryMap( 2672 "mkdirat", 2673 Signature(ArgTypes{IntTy, ConstCharPtrTy, Mode_tTy}, RetType{IntTy}), 2674 Summary(NoEvalCall) 2675 .Case(ReturnsZero, ErrnoMustNotBeChecked, GenericSuccessMsg) 2676 .Case(ReturnsMinusOne, ErrnoNEZeroIrrelevant, GenericFailureMsg) 2677 .ArgConstraint(ValidFileDescriptorOrAtFdcwd(ArgNo(0))) 2678 .ArgConstraint(NotNull(ArgNo(1)))); 2679 2680 std::optional<QualType> Dev_tTy = lookupTy("dev_t"); 2681 2682 // int mknod(const char *pathname, mode_t mode, dev_t dev); 2683 addToFunctionSummaryMap( 2684 "mknod", 2685 Signature(ArgTypes{ConstCharPtrTy, Mode_tTy, Dev_tTy}, RetType{IntTy}), 2686 Summary(NoEvalCall) 2687 .Case(ReturnsZero, ErrnoMustNotBeChecked, GenericSuccessMsg) 2688 .Case(ReturnsMinusOne, ErrnoNEZeroIrrelevant, GenericFailureMsg) 2689 .ArgConstraint(NotNull(ArgNo(0)))); 2690 2691 // int mknodat(int dirfd, const char *pathname, mode_t mode, dev_t dev); 2692 addToFunctionSummaryMap( 2693 "mknodat", 2694 Signature(ArgTypes{IntTy, ConstCharPtrTy, Mode_tTy, Dev_tTy}, 2695 RetType{IntTy}), 2696 Summary(NoEvalCall) 2697 .Case(ReturnsZero, ErrnoMustNotBeChecked, GenericSuccessMsg) 2698 .Case(ReturnsMinusOne, ErrnoNEZeroIrrelevant, GenericFailureMsg) 2699 .ArgConstraint(ValidFileDescriptorOrAtFdcwd(ArgNo(0))) 2700 .ArgConstraint(NotNull(ArgNo(1)))); 2701 2702 // int chmod(const char *path, mode_t mode); 2703 addToFunctionSummaryMap( 2704 "chmod", Signature(ArgTypes{ConstCharPtrTy, Mode_tTy}, RetType{IntTy}), 2705 Summary(NoEvalCall) 2706 .Case(ReturnsZero, ErrnoMustNotBeChecked, GenericSuccessMsg) 2707 .Case(ReturnsMinusOne, ErrnoNEZeroIrrelevant, GenericFailureMsg) 2708 .ArgConstraint(NotNull(ArgNo(0)))); 2709 2710 // int fchmodat(int dirfd, const char *pathname, mode_t mode, int flags); 2711 addToFunctionSummaryMap( 2712 "fchmodat", 2713 Signature(ArgTypes{IntTy, ConstCharPtrTy, Mode_tTy, IntTy}, 2714 RetType{IntTy}), 2715 Summary(NoEvalCall) 2716 .Case(ReturnsZero, ErrnoMustNotBeChecked, GenericSuccessMsg) 2717 .Case(ReturnsMinusOne, ErrnoNEZeroIrrelevant, GenericFailureMsg) 2718 .ArgConstraint(ValidFileDescriptorOrAtFdcwd(ArgNo(0))) 2719 .ArgConstraint(NotNull(ArgNo(1)))); 2720 2721 // int fchmod(int fildes, mode_t mode); 2722 addToFunctionSummaryMap( 2723 "fchmod", Signature(ArgTypes{IntTy, Mode_tTy}, RetType{IntTy}), 2724 Summary(NoEvalCall) 2725 .Case(ReturnsZero, ErrnoMustNotBeChecked, GenericSuccessMsg) 2726 .Case(ReturnsMinusOne, ErrnoNEZeroIrrelevant, GenericFailureMsg) 2727 .ArgConstraint( 2728 ArgumentCondition(0, WithinRange, Range(0, IntMax)))); 2729 2730 std::optional<QualType> Uid_tTy = lookupTy("uid_t"); 2731 std::optional<QualType> Gid_tTy = lookupTy("gid_t"); 2732 2733 // int fchownat(int dirfd, const char *pathname, uid_t owner, gid_t group, 2734 // int flags); 2735 addToFunctionSummaryMap( 2736 "fchownat", 2737 Signature(ArgTypes{IntTy, ConstCharPtrTy, Uid_tTy, Gid_tTy, IntTy}, 2738 RetType{IntTy}), 2739 Summary(NoEvalCall) 2740 .Case(ReturnsZero, ErrnoMustNotBeChecked, GenericSuccessMsg) 2741 .Case(ReturnsMinusOne, ErrnoNEZeroIrrelevant, GenericFailureMsg) 2742 .ArgConstraint(ValidFileDescriptorOrAtFdcwd(ArgNo(0))) 2743 .ArgConstraint(NotNull(ArgNo(1)))); 2744 2745 // int chown(const char *path, uid_t owner, gid_t group); 2746 addToFunctionSummaryMap( 2747 "chown", 2748 Signature(ArgTypes{ConstCharPtrTy, Uid_tTy, Gid_tTy}, RetType{IntTy}), 2749 Summary(NoEvalCall) 2750 .Case(ReturnsZero, ErrnoMustNotBeChecked, GenericSuccessMsg) 2751 .Case(ReturnsMinusOne, ErrnoNEZeroIrrelevant, GenericFailureMsg) 2752 .ArgConstraint(NotNull(ArgNo(0)))); 2753 2754 // int lchown(const char *path, uid_t owner, gid_t group); 2755 addToFunctionSummaryMap( 2756 "lchown", 2757 Signature(ArgTypes{ConstCharPtrTy, Uid_tTy, Gid_tTy}, RetType{IntTy}), 2758 Summary(NoEvalCall) 2759 .Case(ReturnsZero, ErrnoMustNotBeChecked, GenericSuccessMsg) 2760 .Case(ReturnsMinusOne, ErrnoNEZeroIrrelevant, GenericFailureMsg) 2761 .ArgConstraint(NotNull(ArgNo(0)))); 2762 2763 // int fchown(int fildes, uid_t owner, gid_t group); 2764 addToFunctionSummaryMap( 2765 "fchown", Signature(ArgTypes{IntTy, Uid_tTy, Gid_tTy}, RetType{IntTy}), 2766 Summary(NoEvalCall) 2767 .Case(ReturnsZero, ErrnoMustNotBeChecked, GenericSuccessMsg) 2768 .Case(ReturnsMinusOne, ErrnoNEZeroIrrelevant, GenericFailureMsg) 2769 .ArgConstraint( 2770 ArgumentCondition(0, WithinRange, Range(0, IntMax)))); 2771 2772 // int rmdir(const char *pathname); 2773 addToFunctionSummaryMap( 2774 "rmdir", Signature(ArgTypes{ConstCharPtrTy}, RetType{IntTy}), 2775 Summary(NoEvalCall) 2776 .Case(ReturnsZero, ErrnoMustNotBeChecked, GenericSuccessMsg) 2777 .Case(ReturnsMinusOne, ErrnoNEZeroIrrelevant, GenericFailureMsg) 2778 .ArgConstraint(NotNull(ArgNo(0)))); 2779 2780 // int chdir(const char *path); 2781 addToFunctionSummaryMap( 2782 "chdir", Signature(ArgTypes{ConstCharPtrTy}, RetType{IntTy}), 2783 Summary(NoEvalCall) 2784 .Case(ReturnsZero, ErrnoMustNotBeChecked, GenericSuccessMsg) 2785 .Case(ReturnsMinusOne, ErrnoNEZeroIrrelevant, GenericFailureMsg) 2786 .ArgConstraint(NotNull(ArgNo(0)))); 2787 2788 // int link(const char *oldpath, const char *newpath); 2789 addToFunctionSummaryMap( 2790 "link", 2791 Signature(ArgTypes{ConstCharPtrTy, ConstCharPtrTy}, RetType{IntTy}), 2792 Summary(NoEvalCall) 2793 .Case(ReturnsZero, ErrnoMustNotBeChecked, GenericSuccessMsg) 2794 .Case(ReturnsMinusOne, ErrnoNEZeroIrrelevant, GenericFailureMsg) 2795 .ArgConstraint(NotNull(ArgNo(0))) 2796 .ArgConstraint(NotNull(ArgNo(1)))); 2797 2798 // int linkat(int fd1, const char *path1, int fd2, const char *path2, 2799 // int flag); 2800 addToFunctionSummaryMap( 2801 "linkat", 2802 Signature(ArgTypes{IntTy, ConstCharPtrTy, IntTy, ConstCharPtrTy, IntTy}, 2803 RetType{IntTy}), 2804 Summary(NoEvalCall) 2805 .Case(ReturnsZero, ErrnoMustNotBeChecked, GenericSuccessMsg) 2806 .Case(ReturnsMinusOne, ErrnoNEZeroIrrelevant, GenericFailureMsg) 2807 .ArgConstraint(ValidFileDescriptorOrAtFdcwd(ArgNo(0))) 2808 .ArgConstraint(NotNull(ArgNo(1))) 2809 .ArgConstraint(ValidFileDescriptorOrAtFdcwd(ArgNo(2))) 2810 .ArgConstraint(NotNull(ArgNo(3)))); 2811 2812 // int unlink(const char *pathname); 2813 addToFunctionSummaryMap( 2814 "unlink", Signature(ArgTypes{ConstCharPtrTy}, RetType{IntTy}), 2815 Summary(NoEvalCall) 2816 .Case(ReturnsZero, ErrnoMustNotBeChecked, GenericSuccessMsg) 2817 .Case(ReturnsMinusOne, ErrnoNEZeroIrrelevant, GenericFailureMsg) 2818 .ArgConstraint(NotNull(ArgNo(0)))); 2819 2820 // int unlinkat(int fd, const char *path, int flag); 2821 addToFunctionSummaryMap( 2822 "unlinkat", 2823 Signature(ArgTypes{IntTy, ConstCharPtrTy, IntTy}, RetType{IntTy}), 2824 Summary(NoEvalCall) 2825 .Case(ReturnsZero, ErrnoMustNotBeChecked, GenericSuccessMsg) 2826 .Case(ReturnsMinusOne, ErrnoNEZeroIrrelevant, GenericFailureMsg) 2827 .ArgConstraint(ValidFileDescriptorOrAtFdcwd(ArgNo(0))) 2828 .ArgConstraint(NotNull(ArgNo(1)))); 2829 2830 std::optional<QualType> StructStatTy = lookupTy("stat"); 2831 std::optional<QualType> StructStatPtrTy = getPointerTy(StructStatTy); 2832 std::optional<QualType> StructStatPtrRestrictTy = 2833 getRestrictTy(StructStatPtrTy); 2834 2835 // int fstat(int fd, struct stat *statbuf); 2836 addToFunctionSummaryMap( 2837 "fstat", Signature(ArgTypes{IntTy, StructStatPtrTy}, RetType{IntTy}), 2838 Summary(NoEvalCall) 2839 .Case(ReturnsZero, ErrnoMustNotBeChecked, GenericSuccessMsg) 2840 .Case(ReturnsMinusOne, ErrnoNEZeroIrrelevant, GenericFailureMsg) 2841 .ArgConstraint(ArgumentCondition(0, WithinRange, Range(0, IntMax))) 2842 .ArgConstraint(NotNull(ArgNo(1)))); 2843 2844 // int stat(const char *restrict path, struct stat *restrict buf); 2845 addToFunctionSummaryMap( 2846 "stat", 2847 Signature(ArgTypes{ConstCharPtrRestrictTy, StructStatPtrRestrictTy}, 2848 RetType{IntTy}), 2849 Summary(NoEvalCall) 2850 .Case(ReturnsZero, ErrnoMustNotBeChecked, GenericSuccessMsg) 2851 .Case(ReturnsMinusOne, ErrnoNEZeroIrrelevant, GenericFailureMsg) 2852 .ArgConstraint(NotNull(ArgNo(0))) 2853 .ArgConstraint(NotNull(ArgNo(1)))); 2854 2855 // int lstat(const char *restrict path, struct stat *restrict buf); 2856 addToFunctionSummaryMap( 2857 "lstat", 2858 Signature(ArgTypes{ConstCharPtrRestrictTy, StructStatPtrRestrictTy}, 2859 RetType{IntTy}), 2860 Summary(NoEvalCall) 2861 .Case(ReturnsZero, ErrnoMustNotBeChecked, GenericSuccessMsg) 2862 .Case(ReturnsMinusOne, ErrnoNEZeroIrrelevant, GenericFailureMsg) 2863 .ArgConstraint(NotNull(ArgNo(0))) 2864 .ArgConstraint(NotNull(ArgNo(1)))); 2865 2866 // int fstatat(int fd, const char *restrict path, 2867 // struct stat *restrict buf, int flag); 2868 addToFunctionSummaryMap( 2869 "fstatat", 2870 Signature(ArgTypes{IntTy, ConstCharPtrRestrictTy, 2871 StructStatPtrRestrictTy, IntTy}, 2872 RetType{IntTy}), 2873 Summary(NoEvalCall) 2874 .Case(ReturnsZero, ErrnoMustNotBeChecked, GenericSuccessMsg) 2875 .Case(ReturnsMinusOne, ErrnoNEZeroIrrelevant, GenericFailureMsg) 2876 .ArgConstraint(ValidFileDescriptorOrAtFdcwd(ArgNo(0))) 2877 .ArgConstraint(NotNull(ArgNo(1))) 2878 .ArgConstraint(NotNull(ArgNo(2)))); 2879 2880 // DIR *opendir(const char *name); 2881 addToFunctionSummaryMap( 2882 "opendir", Signature(ArgTypes{ConstCharPtrTy}, RetType{DirPtrTy}), 2883 Summary(NoEvalCall) 2884 .Case({NotNull(Ret)}, ErrnoMustNotBeChecked, GenericSuccessMsg) 2885 .Case({IsNull(Ret)}, ErrnoNEZeroIrrelevant, GenericFailureMsg) 2886 .ArgConstraint(NotNull(ArgNo(0)))); 2887 2888 // DIR *fdopendir(int fd); 2889 addToFunctionSummaryMap( 2890 "fdopendir", Signature(ArgTypes{IntTy}, RetType{DirPtrTy}), 2891 Summary(NoEvalCall) 2892 .Case({NotNull(Ret)}, ErrnoMustNotBeChecked, GenericSuccessMsg) 2893 .Case({IsNull(Ret)}, ErrnoNEZeroIrrelevant, GenericFailureMsg) 2894 .ArgConstraint( 2895 ArgumentCondition(0, WithinRange, Range(0, IntMax)))); 2896 2897 // int isatty(int fildes); 2898 addToFunctionSummaryMap( 2899 "isatty", Signature(ArgTypes{IntTy}, RetType{IntTy}), 2900 Summary(NoEvalCall) 2901 .Case({ReturnValueCondition(WithinRange, Range(0, 1))}, 2902 ErrnoIrrelevant) 2903 .ArgConstraint( 2904 ArgumentCondition(0, WithinRange, Range(0, IntMax)))); 2905 2906 // int close(int fildes); 2907 addToFunctionSummaryMap( 2908 "close", Signature(ArgTypes{IntTy}, RetType{IntTy}), 2909 Summary(NoEvalCall) 2910 .Case(ReturnsZero, ErrnoMustNotBeChecked, GenericSuccessMsg) 2911 .Case(ReturnsMinusOne, ErrnoNEZeroIrrelevant, GenericFailureMsg) 2912 .ArgConstraint( 2913 ArgumentCondition(0, WithinRange, Range(-1, IntMax)))); 2914 2915 // long fpathconf(int fildes, int name); 2916 addToFunctionSummaryMap("fpathconf", 2917 Signature(ArgTypes{IntTy, IntTy}, RetType{LongTy}), 2918 Summary(NoEvalCall) 2919 .ArgConstraint(ArgumentCondition( 2920 0, WithinRange, Range(0, IntMax)))); 2921 2922 // long pathconf(const char *path, int name); 2923 addToFunctionSummaryMap( 2924 "pathconf", Signature(ArgTypes{ConstCharPtrTy, IntTy}, RetType{LongTy}), 2925 Summary(NoEvalCall).ArgConstraint(NotNull(ArgNo(0)))); 2926 2927 // void rewinddir(DIR *dir); 2928 addToFunctionSummaryMap( 2929 "rewinddir", Signature(ArgTypes{DirPtrTy}, RetType{VoidTy}), 2930 Summary(NoEvalCall).ArgConstraint(NotNull(ArgNo(0)))); 2931 2932 // void seekdir(DIR *dirp, long loc); 2933 addToFunctionSummaryMap( 2934 "seekdir", Signature(ArgTypes{DirPtrTy, LongTy}, RetType{VoidTy}), 2935 Summary(NoEvalCall).ArgConstraint(NotNull(ArgNo(0)))); 2936 2937 // int rand_r(unsigned int *seedp); 2938 addToFunctionSummaryMap( 2939 "rand_r", Signature(ArgTypes{UnsignedIntPtrTy}, RetType{IntTy}), 2940 Summary(NoEvalCall).ArgConstraint(NotNull(ArgNo(0)))); 2941 2942 // void *mmap(void *addr, size_t length, int prot, int flags, int fd, 2943 // off_t offset); 2944 // FIXME: Improve for errno modeling. 2945 addToFunctionSummaryMap( 2946 "mmap", 2947 Signature(ArgTypes{VoidPtrTy, SizeTy, IntTy, IntTy, IntTy, Off_tTy}, 2948 RetType{VoidPtrTy}), 2949 Summary(NoEvalCall) 2950 .ArgConstraint(ArgumentCondition(1, WithinRange, Range(1, SizeMax))) 2951 .ArgConstraint( 2952 ArgumentCondition(4, WithinRange, Range(-1, IntMax)))); 2953 2954 std::optional<QualType> Off64_tTy = lookupTy("off64_t"); 2955 // void *mmap64(void *addr, size_t length, int prot, int flags, int fd, 2956 // off64_t offset); 2957 // FIXME: Improve for errno modeling. 2958 addToFunctionSummaryMap( 2959 "mmap64", 2960 Signature(ArgTypes{VoidPtrTy, SizeTy, IntTy, IntTy, IntTy, Off64_tTy}, 2961 RetType{VoidPtrTy}), 2962 Summary(NoEvalCall) 2963 .ArgConstraint(ArgumentCondition(1, WithinRange, Range(1, SizeMax))) 2964 .ArgConstraint( 2965 ArgumentCondition(4, WithinRange, Range(-1, IntMax)))); 2966 2967 // int pipe(int fildes[2]); 2968 addToFunctionSummaryMap( 2969 "pipe", Signature(ArgTypes{IntPtrTy}, RetType{IntTy}), 2970 Summary(NoEvalCall) 2971 .Case(ReturnsZero, ErrnoMustNotBeChecked, GenericSuccessMsg) 2972 .Case(ReturnsMinusOne, ErrnoNEZeroIrrelevant, GenericFailureMsg) 2973 .ArgConstraint(NotNull(ArgNo(0)))); 2974 2975 // off_t lseek(int fildes, off_t offset, int whence); 2976 // In the first case we can not tell for sure if it failed or not. 2977 // A return value different from of the expected offset (that is unknown 2978 // here) may indicate failure. For this reason we do not enforce the errno 2979 // check (can cause false positive). 2980 addToFunctionSummaryMap( 2981 "lseek", Signature(ArgTypes{IntTy, Off_tTy, IntTy}, RetType{Off_tTy}), 2982 Summary(NoEvalCall) 2983 .Case(ReturnsNonnegative, ErrnoIrrelevant) 2984 .Case(ReturnsMinusOne, ErrnoNEZeroIrrelevant, GenericFailureMsg) 2985 .ArgConstraint( 2986 ArgumentCondition(0, WithinRange, Range(0, IntMax)))); 2987 2988 // ssize_t readlink(const char *restrict path, char *restrict buf, 2989 // size_t bufsize); 2990 addToFunctionSummaryMap( 2991 "readlink", 2992 Signature(ArgTypes{ConstCharPtrRestrictTy, CharPtrRestrictTy, SizeTy}, 2993 RetType{Ssize_tTy}), 2994 Summary(NoEvalCall) 2995 .Case({ArgumentCondition(2, WithinRange, Range(1, IntMax)), 2996 ReturnValueCondition(LessThanOrEq, ArgNo(2)), 2997 ReturnValueCondition(WithinRange, Range(1, Ssize_tMax))}, 2998 ErrnoMustNotBeChecked, GenericSuccessMsg) 2999 .Case({ArgumentCondition(2, WithinRange, SingleValue(0)), 3000 ReturnValueCondition(WithinRange, SingleValue(0))}, 3001 ErrnoMustNotBeChecked, 3002 "Assuming that argument 'bufsize' is 0") 3003 .Case(ReturnsMinusOne, ErrnoNEZeroIrrelevant, GenericFailureMsg) 3004 .ArgConstraint(NotNull(ArgNo(0))) 3005 .ArgConstraint(NotNull(ArgNo(1))) 3006 .ArgConstraint(BufferSize(/*Buffer=*/ArgNo(1), 3007 /*BufSize=*/ArgNo(2))) 3008 .ArgConstraint( 3009 ArgumentCondition(2, WithinRange, Range(0, SizeMax)))); 3010 3011 // ssize_t readlinkat(int fd, const char *restrict path, 3012 // char *restrict buf, size_t bufsize); 3013 addToFunctionSummaryMap( 3014 "readlinkat", 3015 Signature( 3016 ArgTypes{IntTy, ConstCharPtrRestrictTy, CharPtrRestrictTy, SizeTy}, 3017 RetType{Ssize_tTy}), 3018 Summary(NoEvalCall) 3019 .Case({ArgumentCondition(3, WithinRange, Range(1, IntMax)), 3020 ReturnValueCondition(LessThanOrEq, ArgNo(3)), 3021 ReturnValueCondition(WithinRange, Range(1, Ssize_tMax))}, 3022 ErrnoMustNotBeChecked, GenericSuccessMsg) 3023 .Case({ArgumentCondition(3, WithinRange, SingleValue(0)), 3024 ReturnValueCondition(WithinRange, SingleValue(0))}, 3025 ErrnoMustNotBeChecked, 3026 "Assuming that argument 'bufsize' is 0") 3027 .Case(ReturnsMinusOne, ErrnoNEZeroIrrelevant, GenericFailureMsg) 3028 .ArgConstraint(ValidFileDescriptorOrAtFdcwd(ArgNo(0))) 3029 .ArgConstraint(NotNull(ArgNo(1))) 3030 .ArgConstraint(NotNull(ArgNo(2))) 3031 .ArgConstraint(BufferSize(/*Buffer=*/ArgNo(2), 3032 /*BufSize=*/ArgNo(3))) 3033 .ArgConstraint( 3034 ArgumentCondition(3, WithinRange, Range(0, SizeMax)))); 3035 3036 // int renameat(int olddirfd, const char *oldpath, int newdirfd, const char 3037 // *newpath); 3038 addToFunctionSummaryMap( 3039 "renameat", 3040 Signature(ArgTypes{IntTy, ConstCharPtrTy, IntTy, ConstCharPtrTy}, 3041 RetType{IntTy}), 3042 Summary(NoEvalCall) 3043 .Case(ReturnsZero, ErrnoMustNotBeChecked, GenericSuccessMsg) 3044 .Case(ReturnsMinusOne, ErrnoNEZeroIrrelevant, GenericFailureMsg) 3045 .ArgConstraint(ValidFileDescriptorOrAtFdcwd(ArgNo(0))) 3046 .ArgConstraint(NotNull(ArgNo(1))) 3047 .ArgConstraint(ValidFileDescriptorOrAtFdcwd(ArgNo(2))) 3048 .ArgConstraint(NotNull(ArgNo(3)))); 3049 3050 // char *realpath(const char *restrict file_name, 3051 // char *restrict resolved_name); 3052 // FIXME: If the argument 'resolved_name' is not NULL, macro 'PATH_MAX' 3053 // should be defined in "limits.h" to guarrantee a success. 3054 addToFunctionSummaryMap( 3055 "realpath", 3056 Signature(ArgTypes{ConstCharPtrRestrictTy, CharPtrRestrictTy}, 3057 RetType{CharPtrTy}), 3058 Summary(NoEvalCall) 3059 .Case({NotNull(Ret)}, ErrnoMustNotBeChecked, GenericSuccessMsg) 3060 .Case({IsNull(Ret)}, ErrnoNEZeroIrrelevant, GenericFailureMsg) 3061 .ArgConstraint(NotNull(ArgNo(0)))); 3062 3063 QualType CharPtrConstPtr = getPointerTy(getConstTy(CharPtrTy)); 3064 3065 // int execv(const char *path, char *const argv[]); 3066 addToFunctionSummaryMap( 3067 "execv", 3068 Signature(ArgTypes{ConstCharPtrTy, CharPtrConstPtr}, RetType{IntTy}), 3069 Summary(NoEvalCall) 3070 .Case(ReturnsMinusOne, ErrnoNEZeroIrrelevant) 3071 .ArgConstraint(NotNull(ArgNo(0)))); 3072 3073 // int execvp(const char *file, char *const argv[]); 3074 addToFunctionSummaryMap( 3075 "execvp", 3076 Signature(ArgTypes{ConstCharPtrTy, CharPtrConstPtr}, RetType{IntTy}), 3077 Summary(NoEvalCall) 3078 .Case(ReturnsMinusOne, ErrnoNEZeroIrrelevant) 3079 .ArgConstraint(NotNull(ArgNo(0)))); 3080 3081 // int getopt(int argc, char * const argv[], const char *optstring); 3082 addToFunctionSummaryMap( 3083 "getopt", 3084 Signature(ArgTypes{IntTy, CharPtrConstPtr, ConstCharPtrTy}, 3085 RetType{IntTy}), 3086 Summary(NoEvalCall) 3087 .Case({ReturnValueCondition(WithinRange, Range(-1, UCharRangeMax))}, 3088 ErrnoIrrelevant) 3089 .ArgConstraint(ArgumentCondition(0, WithinRange, Range(0, IntMax))) 3090 .ArgConstraint(NotNull(ArgNo(1))) 3091 .ArgConstraint(NotNull(ArgNo(2)))); 3092 3093 std::optional<QualType> StructSockaddrTy = lookupTy("sockaddr"); 3094 std::optional<QualType> StructSockaddrPtrTy = 3095 getPointerTy(StructSockaddrTy); 3096 std::optional<QualType> ConstStructSockaddrPtrTy = 3097 getPointerTy(getConstTy(StructSockaddrTy)); 3098 std::optional<QualType> StructSockaddrPtrRestrictTy = 3099 getRestrictTy(StructSockaddrPtrTy); 3100 std::optional<QualType> ConstStructSockaddrPtrRestrictTy = 3101 getRestrictTy(ConstStructSockaddrPtrTy); 3102 std::optional<QualType> Socklen_tTy = lookupTy("socklen_t"); 3103 std::optional<QualType> Socklen_tPtrTy = getPointerTy(Socklen_tTy); 3104 std::optional<QualType> Socklen_tPtrRestrictTy = 3105 getRestrictTy(Socklen_tPtrTy); 3106 std::optional<RangeInt> Socklen_tMax = getMaxValue(Socklen_tTy); 3107 3108 // In 'socket.h' of some libc implementations with C99, sockaddr parameter 3109 // is a transparent union of the underlying sockaddr_ family of pointers 3110 // instead of being a pointer to struct sockaddr. In these cases, the 3111 // standardized signature will not match, thus we try to match with another 3112 // signature that has the joker Irrelevant type. We also remove those 3113 // constraints which require pointer types for the sockaddr param. 3114 3115 // int socket(int domain, int type, int protocol); 3116 addToFunctionSummaryMap( 3117 "socket", Signature(ArgTypes{IntTy, IntTy, IntTy}, RetType{IntTy}), 3118 Summary(NoEvalCall) 3119 .Case(ReturnsValidFileDescriptor, ErrnoMustNotBeChecked, 3120 GenericSuccessMsg) 3121 .Case(ReturnsMinusOne, ErrnoNEZeroIrrelevant, GenericFailureMsg)); 3122 3123 auto Accept = 3124 Summary(NoEvalCall) 3125 .Case(ReturnsValidFileDescriptor, ErrnoMustNotBeChecked, 3126 GenericSuccessMsg) 3127 .Case(ReturnsMinusOne, ErrnoNEZeroIrrelevant, GenericFailureMsg) 3128 .ArgConstraint(ArgumentCondition(0, WithinRange, Range(0, IntMax))); 3129 if (!addToFunctionSummaryMap( 3130 "accept", 3131 // int accept(int socket, struct sockaddr *restrict address, 3132 // socklen_t *restrict address_len); 3133 Signature(ArgTypes{IntTy, StructSockaddrPtrRestrictTy, 3134 Socklen_tPtrRestrictTy}, 3135 RetType{IntTy}), 3136 Accept)) 3137 addToFunctionSummaryMap( 3138 "accept", 3139 Signature(ArgTypes{IntTy, Irrelevant, Socklen_tPtrRestrictTy}, 3140 RetType{IntTy}), 3141 Accept); 3142 3143 // int bind(int socket, const struct sockaddr *address, socklen_t 3144 // address_len); 3145 if (!addToFunctionSummaryMap( 3146 "bind", 3147 Signature(ArgTypes{IntTy, ConstStructSockaddrPtrTy, Socklen_tTy}, 3148 RetType{IntTy}), 3149 Summary(NoEvalCall) 3150 .Case(ReturnsZero, ErrnoMustNotBeChecked, GenericSuccessMsg) 3151 .Case(ReturnsMinusOne, ErrnoNEZeroIrrelevant, GenericFailureMsg) 3152 .ArgConstraint( 3153 ArgumentCondition(0, WithinRange, Range(0, IntMax))) 3154 .ArgConstraint(NotNull(ArgNo(1))) 3155 .ArgConstraint( 3156 BufferSize(/*Buffer=*/ArgNo(1), /*BufSize=*/ArgNo(2))) 3157 .ArgConstraint( 3158 ArgumentCondition(2, WithinRange, Range(0, Socklen_tMax))))) 3159 // Do not add constraints on sockaddr. 3160 addToFunctionSummaryMap( 3161 "bind", 3162 Signature(ArgTypes{IntTy, Irrelevant, Socklen_tTy}, RetType{IntTy}), 3163 Summary(NoEvalCall) 3164 .Case(ReturnsZero, ErrnoMustNotBeChecked, GenericSuccessMsg) 3165 .Case(ReturnsMinusOne, ErrnoNEZeroIrrelevant, GenericFailureMsg) 3166 .ArgConstraint( 3167 ArgumentCondition(0, WithinRange, Range(0, IntMax))) 3168 .ArgConstraint( 3169 ArgumentCondition(2, WithinRange, Range(0, Socklen_tMax)))); 3170 3171 // int getpeername(int socket, struct sockaddr *restrict address, 3172 // socklen_t *restrict address_len); 3173 if (!addToFunctionSummaryMap( 3174 "getpeername", 3175 Signature(ArgTypes{IntTy, StructSockaddrPtrRestrictTy, 3176 Socklen_tPtrRestrictTy}, 3177 RetType{IntTy}), 3178 Summary(NoEvalCall) 3179 .Case(ReturnsZero, ErrnoMustNotBeChecked, GenericSuccessMsg) 3180 .Case(ReturnsMinusOne, ErrnoNEZeroIrrelevant, GenericFailureMsg) 3181 .ArgConstraint( 3182 ArgumentCondition(0, WithinRange, Range(0, IntMax))) 3183 .ArgConstraint(NotNull(ArgNo(1))) 3184 .ArgConstraint(NotNull(ArgNo(2))))) 3185 addToFunctionSummaryMap( 3186 "getpeername", 3187 Signature(ArgTypes{IntTy, Irrelevant, Socklen_tPtrRestrictTy}, 3188 RetType{IntTy}), 3189 Summary(NoEvalCall) 3190 .Case(ReturnsZero, ErrnoMustNotBeChecked, GenericSuccessMsg) 3191 .Case(ReturnsMinusOne, ErrnoNEZeroIrrelevant, GenericFailureMsg) 3192 .ArgConstraint( 3193 ArgumentCondition(0, WithinRange, Range(0, IntMax)))); 3194 3195 // int getsockname(int socket, struct sockaddr *restrict address, 3196 // socklen_t *restrict address_len); 3197 if (!addToFunctionSummaryMap( 3198 "getsockname", 3199 Signature(ArgTypes{IntTy, StructSockaddrPtrRestrictTy, 3200 Socklen_tPtrRestrictTy}, 3201 RetType{IntTy}), 3202 Summary(NoEvalCall) 3203 .Case(ReturnsZero, ErrnoMustNotBeChecked, GenericSuccessMsg) 3204 .Case(ReturnsMinusOne, ErrnoNEZeroIrrelevant, GenericFailureMsg) 3205 .ArgConstraint( 3206 ArgumentCondition(0, WithinRange, Range(0, IntMax))) 3207 .ArgConstraint(NotNull(ArgNo(1))) 3208 .ArgConstraint(NotNull(ArgNo(2))))) 3209 addToFunctionSummaryMap( 3210 "getsockname", 3211 Signature(ArgTypes{IntTy, Irrelevant, Socklen_tPtrRestrictTy}, 3212 RetType{IntTy}), 3213 Summary(NoEvalCall) 3214 .Case(ReturnsZero, ErrnoMustNotBeChecked, GenericSuccessMsg) 3215 .Case(ReturnsMinusOne, ErrnoNEZeroIrrelevant, GenericFailureMsg) 3216 .ArgConstraint( 3217 ArgumentCondition(0, WithinRange, Range(0, IntMax)))); 3218 3219 // int connect(int socket, const struct sockaddr *address, socklen_t 3220 // address_len); 3221 if (!addToFunctionSummaryMap( 3222 "connect", 3223 Signature(ArgTypes{IntTy, ConstStructSockaddrPtrTy, Socklen_tTy}, 3224 RetType{IntTy}), 3225 Summary(NoEvalCall) 3226 .Case(ReturnsZero, ErrnoMustNotBeChecked, GenericSuccessMsg) 3227 .Case(ReturnsMinusOne, ErrnoNEZeroIrrelevant, GenericFailureMsg) 3228 .ArgConstraint( 3229 ArgumentCondition(0, WithinRange, Range(0, IntMax))) 3230 .ArgConstraint(NotNull(ArgNo(1))))) 3231 addToFunctionSummaryMap( 3232 "connect", 3233 Signature(ArgTypes{IntTy, Irrelevant, Socklen_tTy}, RetType{IntTy}), 3234 Summary(NoEvalCall) 3235 .Case(ReturnsZero, ErrnoMustNotBeChecked, GenericSuccessMsg) 3236 .Case(ReturnsMinusOne, ErrnoNEZeroIrrelevant, GenericFailureMsg) 3237 .ArgConstraint( 3238 ArgumentCondition(0, WithinRange, Range(0, IntMax)))); 3239 3240 auto Recvfrom = 3241 Summary(NoEvalCall) 3242 .Case({ReturnValueCondition(LessThanOrEq, ArgNo(2)), 3243 ReturnValueCondition(WithinRange, Range(1, Ssize_tMax))}, 3244 ErrnoMustNotBeChecked, GenericSuccessMsg) 3245 .Case({ReturnValueCondition(WithinRange, SingleValue(0)), 3246 ArgumentCondition(2, WithinRange, SingleValue(0))}, 3247 ErrnoMustNotBeChecked, GenericSuccessMsg) 3248 .Case(ReturnsMinusOne, ErrnoNEZeroIrrelevant, GenericFailureMsg) 3249 .ArgConstraint(ArgumentCondition(0, WithinRange, Range(0, IntMax))) 3250 .ArgConstraint(BufferSize(/*Buffer=*/ArgNo(1), 3251 /*BufSize=*/ArgNo(2))); 3252 if (!addToFunctionSummaryMap( 3253 "recvfrom", 3254 // ssize_t recvfrom(int socket, void *restrict buffer, 3255 // size_t length, 3256 // int flags, struct sockaddr *restrict address, 3257 // socklen_t *restrict address_len); 3258 Signature(ArgTypes{IntTy, VoidPtrRestrictTy, SizeTy, IntTy, 3259 StructSockaddrPtrRestrictTy, 3260 Socklen_tPtrRestrictTy}, 3261 RetType{Ssize_tTy}), 3262 Recvfrom)) 3263 addToFunctionSummaryMap( 3264 "recvfrom", 3265 Signature(ArgTypes{IntTy, VoidPtrRestrictTy, SizeTy, IntTy, 3266 Irrelevant, Socklen_tPtrRestrictTy}, 3267 RetType{Ssize_tTy}), 3268 Recvfrom); 3269 3270 auto Sendto = 3271 Summary(NoEvalCall) 3272 .Case({ReturnValueCondition(LessThanOrEq, ArgNo(2)), 3273 ReturnValueCondition(WithinRange, Range(1, Ssize_tMax))}, 3274 ErrnoMustNotBeChecked, GenericSuccessMsg) 3275 .Case({ReturnValueCondition(WithinRange, SingleValue(0)), 3276 ArgumentCondition(2, WithinRange, SingleValue(0))}, 3277 ErrnoMustNotBeChecked, GenericSuccessMsg) 3278 .Case(ReturnsMinusOne, ErrnoNEZeroIrrelevant, GenericFailureMsg) 3279 .ArgConstraint(ArgumentCondition(0, WithinRange, Range(0, IntMax))) 3280 .ArgConstraint(BufferSize(/*Buffer=*/ArgNo(1), 3281 /*BufSize=*/ArgNo(2))); 3282 if (!addToFunctionSummaryMap( 3283 "sendto", 3284 // ssize_t sendto(int socket, const void *message, size_t length, 3285 // int flags, const struct sockaddr *dest_addr, 3286 // socklen_t dest_len); 3287 Signature(ArgTypes{IntTy, ConstVoidPtrTy, SizeTy, IntTy, 3288 ConstStructSockaddrPtrTy, Socklen_tTy}, 3289 RetType{Ssize_tTy}), 3290 Sendto)) 3291 addToFunctionSummaryMap( 3292 "sendto", 3293 Signature(ArgTypes{IntTy, ConstVoidPtrTy, SizeTy, IntTy, Irrelevant, 3294 Socklen_tTy}, 3295 RetType{Ssize_tTy}), 3296 Sendto); 3297 3298 // int listen(int sockfd, int backlog); 3299 addToFunctionSummaryMap( 3300 "listen", Signature(ArgTypes{IntTy, IntTy}, RetType{IntTy}), 3301 Summary(NoEvalCall) 3302 .Case(ReturnsZero, ErrnoMustNotBeChecked, GenericSuccessMsg) 3303 .Case(ReturnsMinusOne, ErrnoNEZeroIrrelevant, GenericFailureMsg) 3304 .ArgConstraint( 3305 ArgumentCondition(0, WithinRange, Range(0, IntMax)))); 3306 3307 // ssize_t recv(int sockfd, void *buf, size_t len, int flags); 3308 addToFunctionSummaryMap( 3309 "recv", 3310 Signature(ArgTypes{IntTy, VoidPtrTy, SizeTy, IntTy}, 3311 RetType{Ssize_tTy}), 3312 Summary(NoEvalCall) 3313 .Case({ReturnValueCondition(LessThanOrEq, ArgNo(2)), 3314 ReturnValueCondition(WithinRange, Range(1, Ssize_tMax))}, 3315 ErrnoMustNotBeChecked, GenericSuccessMsg) 3316 .Case({ReturnValueCondition(WithinRange, SingleValue(0)), 3317 ArgumentCondition(2, WithinRange, SingleValue(0))}, 3318 ErrnoMustNotBeChecked, GenericSuccessMsg) 3319 .Case(ReturnsMinusOne, ErrnoNEZeroIrrelevant, GenericFailureMsg) 3320 .ArgConstraint(ArgumentCondition(0, WithinRange, Range(0, IntMax))) 3321 .ArgConstraint(BufferSize(/*Buffer=*/ArgNo(1), 3322 /*BufSize=*/ArgNo(2)))); 3323 3324 std::optional<QualType> StructMsghdrTy = lookupTy("msghdr"); 3325 std::optional<QualType> StructMsghdrPtrTy = getPointerTy(StructMsghdrTy); 3326 std::optional<QualType> ConstStructMsghdrPtrTy = 3327 getPointerTy(getConstTy(StructMsghdrTy)); 3328 3329 // ssize_t recvmsg(int sockfd, struct msghdr *msg, int flags); 3330 addToFunctionSummaryMap( 3331 "recvmsg", 3332 Signature(ArgTypes{IntTy, StructMsghdrPtrTy, IntTy}, 3333 RetType{Ssize_tTy}), 3334 Summary(NoEvalCall) 3335 .Case({ReturnValueCondition(WithinRange, Range(1, Ssize_tMax))}, 3336 ErrnoMustNotBeChecked, GenericSuccessMsg) 3337 .Case(ReturnsMinusOne, ErrnoNEZeroIrrelevant, GenericFailureMsg) 3338 .ArgConstraint( 3339 ArgumentCondition(0, WithinRange, Range(0, IntMax)))); 3340 3341 // ssize_t sendmsg(int sockfd, const struct msghdr *msg, int flags); 3342 addToFunctionSummaryMap( 3343 "sendmsg", 3344 Signature(ArgTypes{IntTy, ConstStructMsghdrPtrTy, IntTy}, 3345 RetType{Ssize_tTy}), 3346 Summary(NoEvalCall) 3347 .Case({ReturnValueCondition(WithinRange, Range(1, Ssize_tMax))}, 3348 ErrnoMustNotBeChecked, GenericSuccessMsg) 3349 .Case(ReturnsMinusOne, ErrnoNEZeroIrrelevant, GenericFailureMsg) 3350 .ArgConstraint( 3351 ArgumentCondition(0, WithinRange, Range(0, IntMax)))); 3352 3353 // int setsockopt(int socket, int level, int option_name, 3354 // const void *option_value, socklen_t option_len); 3355 addToFunctionSummaryMap( 3356 "setsockopt", 3357 Signature(ArgTypes{IntTy, IntTy, IntTy, ConstVoidPtrTy, Socklen_tTy}, 3358 RetType{IntTy}), 3359 Summary(NoEvalCall) 3360 .Case(ReturnsZero, ErrnoMustNotBeChecked, GenericSuccessMsg) 3361 .Case(ReturnsMinusOne, ErrnoNEZeroIrrelevant, GenericFailureMsg) 3362 .ArgConstraint(NotNull(ArgNo(3))) 3363 .ArgConstraint( 3364 BufferSize(/*Buffer=*/ArgNo(3), /*BufSize=*/ArgNo(4))) 3365 .ArgConstraint( 3366 ArgumentCondition(4, WithinRange, Range(0, Socklen_tMax)))); 3367 3368 // int getsockopt(int socket, int level, int option_name, 3369 // void *restrict option_value, 3370 // socklen_t *restrict option_len); 3371 addToFunctionSummaryMap( 3372 "getsockopt", 3373 Signature(ArgTypes{IntTy, IntTy, IntTy, VoidPtrRestrictTy, 3374 Socklen_tPtrRestrictTy}, 3375 RetType{IntTy}), 3376 Summary(NoEvalCall) 3377 .Case(ReturnsZero, ErrnoMustNotBeChecked, GenericSuccessMsg) 3378 .Case(ReturnsMinusOne, ErrnoNEZeroIrrelevant, GenericFailureMsg) 3379 .ArgConstraint(NotNull(ArgNo(3))) 3380 .ArgConstraint(NotNull(ArgNo(4)))); 3381 3382 // ssize_t send(int sockfd, const void *buf, size_t len, int flags); 3383 addToFunctionSummaryMap( 3384 "send", 3385 Signature(ArgTypes{IntTy, ConstVoidPtrTy, SizeTy, IntTy}, 3386 RetType{Ssize_tTy}), 3387 Summary(NoEvalCall) 3388 .Case({ReturnValueCondition(LessThanOrEq, ArgNo(2)), 3389 ReturnValueCondition(WithinRange, Range(1, Ssize_tMax))}, 3390 ErrnoMustNotBeChecked, GenericSuccessMsg) 3391 .Case({ReturnValueCondition(WithinRange, SingleValue(0)), 3392 ArgumentCondition(2, WithinRange, SingleValue(0))}, 3393 ErrnoMustNotBeChecked, GenericSuccessMsg) 3394 .Case(ReturnsMinusOne, ErrnoNEZeroIrrelevant, GenericFailureMsg) 3395 .ArgConstraint(ArgumentCondition(0, WithinRange, Range(0, IntMax))) 3396 .ArgConstraint(BufferSize(/*Buffer=*/ArgNo(1), 3397 /*BufSize=*/ArgNo(2)))); 3398 3399 // int socketpair(int domain, int type, int protocol, int sv[2]); 3400 addToFunctionSummaryMap( 3401 "socketpair", 3402 Signature(ArgTypes{IntTy, IntTy, IntTy, IntPtrTy}, RetType{IntTy}), 3403 Summary(NoEvalCall) 3404 .Case(ReturnsZero, ErrnoMustNotBeChecked, GenericSuccessMsg) 3405 .Case(ReturnsMinusOne, ErrnoNEZeroIrrelevant, GenericFailureMsg) 3406 .ArgConstraint(NotNull(ArgNo(3)))); 3407 3408 // int shutdown(int socket, int how); 3409 addToFunctionSummaryMap( 3410 "shutdown", Signature(ArgTypes{IntTy, IntTy}, RetType{IntTy}), 3411 Summary(NoEvalCall) 3412 .Case(ReturnsZero, ErrnoMustNotBeChecked, GenericSuccessMsg) 3413 .Case(ReturnsMinusOne, ErrnoNEZeroIrrelevant, GenericFailureMsg) 3414 .ArgConstraint( 3415 ArgumentCondition(0, WithinRange, Range(0, IntMax)))); 3416 3417 // int getnameinfo(const struct sockaddr *restrict sa, socklen_t salen, 3418 // char *restrict node, socklen_t nodelen, 3419 // char *restrict service, 3420 // socklen_t servicelen, int flags); 3421 // 3422 // This is defined in netdb.h. And contrary to 'socket.h', the sockaddr 3423 // parameter is never handled as a transparent union in netdb.h 3424 addToFunctionSummaryMap( 3425 "getnameinfo", 3426 Signature(ArgTypes{ConstStructSockaddrPtrRestrictTy, Socklen_tTy, 3427 CharPtrRestrictTy, Socklen_tTy, CharPtrRestrictTy, 3428 Socklen_tTy, IntTy}, 3429 RetType{IntTy}), 3430 Summary(NoEvalCall) 3431 .ArgConstraint( 3432 BufferSize(/*Buffer=*/ArgNo(0), /*BufSize=*/ArgNo(1))) 3433 .ArgConstraint( 3434 ArgumentCondition(1, WithinRange, Range(0, Socklen_tMax))) 3435 .ArgConstraint( 3436 BufferSize(/*Buffer=*/ArgNo(2), /*BufSize=*/ArgNo(3))) 3437 .ArgConstraint( 3438 ArgumentCondition(3, WithinRange, Range(0, Socklen_tMax))) 3439 .ArgConstraint( 3440 BufferSize(/*Buffer=*/ArgNo(4), /*BufSize=*/ArgNo(5))) 3441 .ArgConstraint( 3442 ArgumentCondition(5, WithinRange, Range(0, Socklen_tMax)))); 3443 3444 std::optional<QualType> StructUtimbufTy = lookupTy("utimbuf"); 3445 std::optional<QualType> StructUtimbufPtrTy = getPointerTy(StructUtimbufTy); 3446 3447 // int utime(const char *filename, struct utimbuf *buf); 3448 addToFunctionSummaryMap( 3449 "utime", 3450 Signature(ArgTypes{ConstCharPtrTy, StructUtimbufPtrTy}, RetType{IntTy}), 3451 Summary(NoEvalCall) 3452 .Case(ReturnsZero, ErrnoMustNotBeChecked, GenericSuccessMsg) 3453 .Case(ReturnsMinusOne, ErrnoNEZeroIrrelevant, GenericFailureMsg) 3454 .ArgConstraint(NotNull(ArgNo(0)))); 3455 3456 std::optional<QualType> StructTimespecTy = lookupTy("timespec"); 3457 std::optional<QualType> StructTimespecPtrTy = 3458 getPointerTy(StructTimespecTy); 3459 std::optional<QualType> ConstStructTimespecPtrTy = 3460 getPointerTy(getConstTy(StructTimespecTy)); 3461 3462 // int futimens(int fd, const struct timespec times[2]); 3463 addToFunctionSummaryMap( 3464 "futimens", 3465 Signature(ArgTypes{IntTy, ConstStructTimespecPtrTy}, RetType{IntTy}), 3466 Summary(NoEvalCall) 3467 .Case(ReturnsZero, ErrnoMustNotBeChecked, GenericSuccessMsg) 3468 .Case(ReturnsMinusOne, ErrnoNEZeroIrrelevant, GenericFailureMsg) 3469 .ArgConstraint( 3470 ArgumentCondition(0, WithinRange, Range(0, IntMax)))); 3471 3472 // int utimensat(int dirfd, const char *pathname, 3473 // const struct timespec times[2], int flags); 3474 addToFunctionSummaryMap( 3475 "utimensat", 3476 Signature( 3477 ArgTypes{IntTy, ConstCharPtrTy, ConstStructTimespecPtrTy, IntTy}, 3478 RetType{IntTy}), 3479 Summary(NoEvalCall) 3480 .Case(ReturnsZero, ErrnoMustNotBeChecked, GenericSuccessMsg) 3481 .Case(ReturnsMinusOne, ErrnoNEZeroIrrelevant, GenericFailureMsg) 3482 .ArgConstraint(NotNull(ArgNo(1)))); 3483 3484 std::optional<QualType> StructTimevalTy = lookupTy("timeval"); 3485 std::optional<QualType> ConstStructTimevalPtrTy = 3486 getPointerTy(getConstTy(StructTimevalTy)); 3487 3488 // int utimes(const char *filename, const struct timeval times[2]); 3489 addToFunctionSummaryMap( 3490 "utimes", 3491 Signature(ArgTypes{ConstCharPtrTy, ConstStructTimevalPtrTy}, 3492 RetType{IntTy}), 3493 Summary(NoEvalCall) 3494 .Case(ReturnsZero, ErrnoMustNotBeChecked, GenericSuccessMsg) 3495 .Case(ReturnsMinusOne, ErrnoNEZeroIrrelevant, GenericFailureMsg) 3496 .ArgConstraint(NotNull(ArgNo(0)))); 3497 3498 // int nanosleep(const struct timespec *rqtp, struct timespec *rmtp); 3499 addToFunctionSummaryMap( 3500 "nanosleep", 3501 Signature(ArgTypes{ConstStructTimespecPtrTy, StructTimespecPtrTy}, 3502 RetType{IntTy}), 3503 Summary(NoEvalCall) 3504 .Case(ReturnsZero, ErrnoMustNotBeChecked, GenericSuccessMsg) 3505 .Case(ReturnsMinusOne, ErrnoNEZeroIrrelevant, GenericFailureMsg) 3506 .ArgConstraint(NotNull(ArgNo(0)))); 3507 3508 std::optional<QualType> Time_tTy = lookupTy("time_t"); 3509 std::optional<QualType> ConstTime_tPtrTy = 3510 getPointerTy(getConstTy(Time_tTy)); 3511 std::optional<QualType> ConstTime_tPtrRestrictTy = 3512 getRestrictTy(ConstTime_tPtrTy); 3513 3514 std::optional<QualType> StructTmTy = lookupTy("tm"); 3515 std::optional<QualType> StructTmPtrTy = getPointerTy(StructTmTy); 3516 std::optional<QualType> StructTmPtrRestrictTy = 3517 getRestrictTy(StructTmPtrTy); 3518 std::optional<QualType> ConstStructTmPtrTy = 3519 getPointerTy(getConstTy(StructTmTy)); 3520 std::optional<QualType> ConstStructTmPtrRestrictTy = 3521 getRestrictTy(ConstStructTmPtrTy); 3522 3523 // struct tm * localtime(const time_t *tp); 3524 addToFunctionSummaryMap( 3525 "localtime", 3526 Signature(ArgTypes{ConstTime_tPtrTy}, RetType{StructTmPtrTy}), 3527 Summary(NoEvalCall).ArgConstraint(NotNull(ArgNo(0)))); 3528 3529 // struct tm *localtime_r(const time_t *restrict timer, 3530 // struct tm *restrict result); 3531 addToFunctionSummaryMap( 3532 "localtime_r", 3533 Signature(ArgTypes{ConstTime_tPtrRestrictTy, StructTmPtrRestrictTy}, 3534 RetType{StructTmPtrTy}), 3535 Summary(NoEvalCall) 3536 .ArgConstraint(NotNull(ArgNo(0))) 3537 .ArgConstraint(NotNull(ArgNo(1)))); 3538 3539 // char *asctime_r(const struct tm *restrict tm, char *restrict buf); 3540 addToFunctionSummaryMap( 3541 "asctime_r", 3542 Signature(ArgTypes{ConstStructTmPtrRestrictTy, CharPtrRestrictTy}, 3543 RetType{CharPtrTy}), 3544 Summary(NoEvalCall) 3545 .ArgConstraint(NotNull(ArgNo(0))) 3546 .ArgConstraint(NotNull(ArgNo(1))) 3547 .ArgConstraint(BufferSize(/*Buffer=*/ArgNo(1), 3548 /*MinBufSize=*/BVF.getValue(26, IntTy)))); 3549 3550 // char *ctime_r(const time_t *timep, char *buf); 3551 addToFunctionSummaryMap( 3552 "ctime_r", 3553 Signature(ArgTypes{ConstTime_tPtrTy, CharPtrTy}, RetType{CharPtrTy}), 3554 Summary(NoEvalCall) 3555 .ArgConstraint(NotNull(ArgNo(0))) 3556 .ArgConstraint(NotNull(ArgNo(1))) 3557 .ArgConstraint(BufferSize( 3558 /*Buffer=*/ArgNo(1), 3559 /*MinBufSize=*/BVF.getValue(26, IntTy)))); 3560 3561 // struct tm *gmtime_r(const time_t *restrict timer, 3562 // struct tm *restrict result); 3563 addToFunctionSummaryMap( 3564 "gmtime_r", 3565 Signature(ArgTypes{ConstTime_tPtrRestrictTy, StructTmPtrRestrictTy}, 3566 RetType{StructTmPtrTy}), 3567 Summary(NoEvalCall) 3568 .ArgConstraint(NotNull(ArgNo(0))) 3569 .ArgConstraint(NotNull(ArgNo(1)))); 3570 3571 // struct tm * gmtime(const time_t *tp); 3572 addToFunctionSummaryMap( 3573 "gmtime", Signature(ArgTypes{ConstTime_tPtrTy}, RetType{StructTmPtrTy}), 3574 Summary(NoEvalCall).ArgConstraint(NotNull(ArgNo(0)))); 3575 3576 std::optional<QualType> Clockid_tTy = lookupTy("clockid_t"); 3577 3578 // int clock_gettime(clockid_t clock_id, struct timespec *tp); 3579 addToFunctionSummaryMap( 3580 "clock_gettime", 3581 Signature(ArgTypes{Clockid_tTy, StructTimespecPtrTy}, RetType{IntTy}), 3582 Summary(NoEvalCall) 3583 .Case(ReturnsZero, ErrnoMustNotBeChecked, GenericSuccessMsg) 3584 .Case(ReturnsMinusOne, ErrnoNEZeroIrrelevant, GenericFailureMsg) 3585 .ArgConstraint(NotNull(ArgNo(1)))); 3586 3587 std::optional<QualType> StructItimervalTy = lookupTy("itimerval"); 3588 std::optional<QualType> StructItimervalPtrTy = 3589 getPointerTy(StructItimervalTy); 3590 3591 // int getitimer(int which, struct itimerval *curr_value); 3592 addToFunctionSummaryMap( 3593 "getitimer", 3594 Signature(ArgTypes{IntTy, StructItimervalPtrTy}, RetType{IntTy}), 3595 Summary(NoEvalCall) 3596 .Case(ReturnsZero, ErrnoMustNotBeChecked, GenericSuccessMsg) 3597 .Case(ReturnsMinusOne, ErrnoNEZeroIrrelevant, GenericFailureMsg) 3598 .ArgConstraint(NotNull(ArgNo(1)))); 3599 3600 std::optional<QualType> Pthread_cond_tTy = lookupTy("pthread_cond_t"); 3601 std::optional<QualType> Pthread_cond_tPtrTy = 3602 getPointerTy(Pthread_cond_tTy); 3603 std::optional<QualType> Pthread_tTy = lookupTy("pthread_t"); 3604 std::optional<QualType> Pthread_tPtrTy = getPointerTy(Pthread_tTy); 3605 std::optional<QualType> Pthread_tPtrRestrictTy = 3606 getRestrictTy(Pthread_tPtrTy); 3607 std::optional<QualType> Pthread_mutex_tTy = lookupTy("pthread_mutex_t"); 3608 std::optional<QualType> Pthread_mutex_tPtrTy = 3609 getPointerTy(Pthread_mutex_tTy); 3610 std::optional<QualType> Pthread_mutex_tPtrRestrictTy = 3611 getRestrictTy(Pthread_mutex_tPtrTy); 3612 std::optional<QualType> Pthread_attr_tTy = lookupTy("pthread_attr_t"); 3613 std::optional<QualType> Pthread_attr_tPtrTy = 3614 getPointerTy(Pthread_attr_tTy); 3615 std::optional<QualType> ConstPthread_attr_tPtrTy = 3616 getPointerTy(getConstTy(Pthread_attr_tTy)); 3617 std::optional<QualType> ConstPthread_attr_tPtrRestrictTy = 3618 getRestrictTy(ConstPthread_attr_tPtrTy); 3619 std::optional<QualType> Pthread_mutexattr_tTy = 3620 lookupTy("pthread_mutexattr_t"); 3621 std::optional<QualType> ConstPthread_mutexattr_tPtrTy = 3622 getPointerTy(getConstTy(Pthread_mutexattr_tTy)); 3623 std::optional<QualType> ConstPthread_mutexattr_tPtrRestrictTy = 3624 getRestrictTy(ConstPthread_mutexattr_tPtrTy); 3625 3626 QualType PthreadStartRoutineTy = getPointerTy( 3627 ACtx.getFunctionType(/*ResultTy=*/VoidPtrTy, /*Args=*/VoidPtrTy, 3628 FunctionProtoType::ExtProtoInfo())); 3629 3630 // int pthread_cond_signal(pthread_cond_t *cond); 3631 // int pthread_cond_broadcast(pthread_cond_t *cond); 3632 addToFunctionSummaryMap( 3633 {"pthread_cond_signal", "pthread_cond_broadcast"}, 3634 Signature(ArgTypes{Pthread_cond_tPtrTy}, RetType{IntTy}), 3635 Summary(NoEvalCall).ArgConstraint(NotNull(ArgNo(0)))); 3636 3637 // int pthread_create(pthread_t *restrict thread, 3638 // const pthread_attr_t *restrict attr, 3639 // void *(*start_routine)(void*), void *restrict arg); 3640 addToFunctionSummaryMap( 3641 "pthread_create", 3642 Signature(ArgTypes{Pthread_tPtrRestrictTy, 3643 ConstPthread_attr_tPtrRestrictTy, 3644 PthreadStartRoutineTy, VoidPtrRestrictTy}, 3645 RetType{IntTy}), 3646 Summary(NoEvalCall) 3647 .ArgConstraint(NotNull(ArgNo(0))) 3648 .ArgConstraint(NotNull(ArgNo(2)))); 3649 3650 // int pthread_attr_destroy(pthread_attr_t *attr); 3651 // int pthread_attr_init(pthread_attr_t *attr); 3652 addToFunctionSummaryMap( 3653 {"pthread_attr_destroy", "pthread_attr_init"}, 3654 Signature(ArgTypes{Pthread_attr_tPtrTy}, RetType{IntTy}), 3655 Summary(NoEvalCall).ArgConstraint(NotNull(ArgNo(0)))); 3656 3657 // int pthread_attr_getstacksize(const pthread_attr_t *restrict attr, 3658 // size_t *restrict stacksize); 3659 // int pthread_attr_getguardsize(const pthread_attr_t *restrict attr, 3660 // size_t *restrict guardsize); 3661 addToFunctionSummaryMap( 3662 {"pthread_attr_getstacksize", "pthread_attr_getguardsize"}, 3663 Signature(ArgTypes{ConstPthread_attr_tPtrRestrictTy, SizePtrRestrictTy}, 3664 RetType{IntTy}), 3665 Summary(NoEvalCall) 3666 .ArgConstraint(NotNull(ArgNo(0))) 3667 .ArgConstraint(NotNull(ArgNo(1)))); 3668 3669 // int pthread_attr_setstacksize(pthread_attr_t *attr, size_t stacksize); 3670 // int pthread_attr_setguardsize(pthread_attr_t *attr, size_t guardsize); 3671 addToFunctionSummaryMap( 3672 {"pthread_attr_setstacksize", "pthread_attr_setguardsize"}, 3673 Signature(ArgTypes{Pthread_attr_tPtrTy, SizeTy}, RetType{IntTy}), 3674 Summary(NoEvalCall) 3675 .ArgConstraint(NotNull(ArgNo(0))) 3676 .ArgConstraint( 3677 ArgumentCondition(1, WithinRange, Range(0, SizeMax)))); 3678 3679 // int pthread_mutex_init(pthread_mutex_t *restrict mutex, const 3680 // pthread_mutexattr_t *restrict attr); 3681 addToFunctionSummaryMap( 3682 "pthread_mutex_init", 3683 Signature(ArgTypes{Pthread_mutex_tPtrRestrictTy, 3684 ConstPthread_mutexattr_tPtrRestrictTy}, 3685 RetType{IntTy}), 3686 Summary(NoEvalCall).ArgConstraint(NotNull(ArgNo(0)))); 3687 3688 // int pthread_mutex_destroy(pthread_mutex_t *mutex); 3689 // int pthread_mutex_lock(pthread_mutex_t *mutex); 3690 // int pthread_mutex_trylock(pthread_mutex_t *mutex); 3691 // int pthread_mutex_unlock(pthread_mutex_t *mutex); 3692 addToFunctionSummaryMap( 3693 {"pthread_mutex_destroy", "pthread_mutex_lock", "pthread_mutex_trylock", 3694 "pthread_mutex_unlock"}, 3695 Signature(ArgTypes{Pthread_mutex_tPtrTy}, RetType{IntTy}), 3696 Summary(NoEvalCall).ArgConstraint(NotNull(ArgNo(0)))); 3697 } 3698 3699 // Functions for testing. 3700 if (AddTestFunctions) { 3701 const RangeInt IntMin = BVF.getMinValue(IntTy).getLimitedValue(); 3702 3703 addToFunctionSummaryMap( 3704 "__not_null", Signature(ArgTypes{IntPtrTy}, RetType{IntTy}), 3705 Summary(EvalCallAsPure).ArgConstraint(NotNull(ArgNo(0)))); 3706 3707 addToFunctionSummaryMap( 3708 "__not_null_buffer", 3709 Signature(ArgTypes{VoidPtrTy, IntTy, IntTy}, RetType{IntTy}), 3710 Summary(EvalCallAsPure) 3711 .ArgConstraint(NotNullBuffer(ArgNo(0), ArgNo(1), ArgNo(2)))); 3712 3713 // Test inside range constraints. 3714 addToFunctionSummaryMap( 3715 "__single_val_0", Signature(ArgTypes{IntTy}, RetType{IntTy}), 3716 Summary(EvalCallAsPure) 3717 .ArgConstraint(ArgumentCondition(0U, WithinRange, SingleValue(0)))); 3718 addToFunctionSummaryMap( 3719 "__single_val_1", Signature(ArgTypes{IntTy}, RetType{IntTy}), 3720 Summary(EvalCallAsPure) 3721 .ArgConstraint(ArgumentCondition(0U, WithinRange, SingleValue(1)))); 3722 addToFunctionSummaryMap( 3723 "__range_1_2", Signature(ArgTypes{IntTy}, RetType{IntTy}), 3724 Summary(EvalCallAsPure) 3725 .ArgConstraint(ArgumentCondition(0U, WithinRange, Range(1, 2)))); 3726 addToFunctionSummaryMap( 3727 "__range_m1_1", Signature(ArgTypes{IntTy}, RetType{IntTy}), 3728 Summary(EvalCallAsPure) 3729 .ArgConstraint(ArgumentCondition(0U, WithinRange, Range(-1, 1)))); 3730 addToFunctionSummaryMap( 3731 "__range_m2_m1", Signature(ArgTypes{IntTy}, RetType{IntTy}), 3732 Summary(EvalCallAsPure) 3733 .ArgConstraint(ArgumentCondition(0U, WithinRange, Range(-2, -1)))); 3734 addToFunctionSummaryMap( 3735 "__range_m10_10", Signature(ArgTypes{IntTy}, RetType{IntTy}), 3736 Summary(EvalCallAsPure) 3737 .ArgConstraint(ArgumentCondition(0U, WithinRange, Range(-10, 10)))); 3738 addToFunctionSummaryMap("__range_m1_inf", 3739 Signature(ArgTypes{IntTy}, RetType{IntTy}), 3740 Summary(EvalCallAsPure) 3741 .ArgConstraint(ArgumentCondition( 3742 0U, WithinRange, Range(-1, IntMax)))); 3743 addToFunctionSummaryMap("__range_0_inf", 3744 Signature(ArgTypes{IntTy}, RetType{IntTy}), 3745 Summary(EvalCallAsPure) 3746 .ArgConstraint(ArgumentCondition( 3747 0U, WithinRange, Range(0, IntMax)))); 3748 addToFunctionSummaryMap("__range_1_inf", 3749 Signature(ArgTypes{IntTy}, RetType{IntTy}), 3750 Summary(EvalCallAsPure) 3751 .ArgConstraint(ArgumentCondition( 3752 0U, WithinRange, Range(1, IntMax)))); 3753 addToFunctionSummaryMap("__range_minf_m1", 3754 Signature(ArgTypes{IntTy}, RetType{IntTy}), 3755 Summary(EvalCallAsPure) 3756 .ArgConstraint(ArgumentCondition( 3757 0U, WithinRange, Range(IntMin, -1)))); 3758 addToFunctionSummaryMap("__range_minf_0", 3759 Signature(ArgTypes{IntTy}, RetType{IntTy}), 3760 Summary(EvalCallAsPure) 3761 .ArgConstraint(ArgumentCondition( 3762 0U, WithinRange, Range(IntMin, 0)))); 3763 addToFunctionSummaryMap("__range_minf_1", 3764 Signature(ArgTypes{IntTy}, RetType{IntTy}), 3765 Summary(EvalCallAsPure) 3766 .ArgConstraint(ArgumentCondition( 3767 0U, WithinRange, Range(IntMin, 1)))); 3768 addToFunctionSummaryMap("__range_1_2__4_6", 3769 Signature(ArgTypes{IntTy}, RetType{IntTy}), 3770 Summary(EvalCallAsPure) 3771 .ArgConstraint(ArgumentCondition( 3772 0U, WithinRange, Range({1, 2}, {4, 6})))); 3773 addToFunctionSummaryMap( 3774 "__range_1_2__4_inf", Signature(ArgTypes{IntTy}, RetType{IntTy}), 3775 Summary(EvalCallAsPure) 3776 .ArgConstraint(ArgumentCondition(0U, WithinRange, 3777 Range({1, 2}, {4, IntMax})))); 3778 3779 // Test out of range constraints. 3780 addToFunctionSummaryMap( 3781 "__single_val_out_0", Signature(ArgTypes{IntTy}, RetType{IntTy}), 3782 Summary(EvalCallAsPure) 3783 .ArgConstraint(ArgumentCondition(0U, OutOfRange, SingleValue(0)))); 3784 addToFunctionSummaryMap( 3785 "__single_val_out_1", Signature(ArgTypes{IntTy}, RetType{IntTy}), 3786 Summary(EvalCallAsPure) 3787 .ArgConstraint(ArgumentCondition(0U, OutOfRange, SingleValue(1)))); 3788 addToFunctionSummaryMap( 3789 "__range_out_1_2", Signature(ArgTypes{IntTy}, RetType{IntTy}), 3790 Summary(EvalCallAsPure) 3791 .ArgConstraint(ArgumentCondition(0U, OutOfRange, Range(1, 2)))); 3792 addToFunctionSummaryMap( 3793 "__range_out_m1_1", Signature(ArgTypes{IntTy}, RetType{IntTy}), 3794 Summary(EvalCallAsPure) 3795 .ArgConstraint(ArgumentCondition(0U, OutOfRange, Range(-1, 1)))); 3796 addToFunctionSummaryMap( 3797 "__range_out_m2_m1", Signature(ArgTypes{IntTy}, RetType{IntTy}), 3798 Summary(EvalCallAsPure) 3799 .ArgConstraint(ArgumentCondition(0U, OutOfRange, Range(-2, -1)))); 3800 addToFunctionSummaryMap( 3801 "__range_out_m10_10", Signature(ArgTypes{IntTy}, RetType{IntTy}), 3802 Summary(EvalCallAsPure) 3803 .ArgConstraint(ArgumentCondition(0U, OutOfRange, Range(-10, 10)))); 3804 addToFunctionSummaryMap("__range_out_m1_inf", 3805 Signature(ArgTypes{IntTy}, RetType{IntTy}), 3806 Summary(EvalCallAsPure) 3807 .ArgConstraint(ArgumentCondition( 3808 0U, OutOfRange, Range(-1, IntMax)))); 3809 addToFunctionSummaryMap("__range_out_0_inf", 3810 Signature(ArgTypes{IntTy}, RetType{IntTy}), 3811 Summary(EvalCallAsPure) 3812 .ArgConstraint(ArgumentCondition( 3813 0U, OutOfRange, Range(0, IntMax)))); 3814 addToFunctionSummaryMap("__range_out_1_inf", 3815 Signature(ArgTypes{IntTy}, RetType{IntTy}), 3816 Summary(EvalCallAsPure) 3817 .ArgConstraint(ArgumentCondition( 3818 0U, OutOfRange, Range(1, IntMax)))); 3819 addToFunctionSummaryMap("__range_out_minf_m1", 3820 Signature(ArgTypes{IntTy}, RetType{IntTy}), 3821 Summary(EvalCallAsPure) 3822 .ArgConstraint(ArgumentCondition( 3823 0U, OutOfRange, Range(IntMin, -1)))); 3824 addToFunctionSummaryMap("__range_out_minf_0", 3825 Signature(ArgTypes{IntTy}, RetType{IntTy}), 3826 Summary(EvalCallAsPure) 3827 .ArgConstraint(ArgumentCondition( 3828 0U, OutOfRange, Range(IntMin, 0)))); 3829 addToFunctionSummaryMap("__range_out_minf_1", 3830 Signature(ArgTypes{IntTy}, RetType{IntTy}), 3831 Summary(EvalCallAsPure) 3832 .ArgConstraint(ArgumentCondition( 3833 0U, OutOfRange, Range(IntMin, 1)))); 3834 addToFunctionSummaryMap("__range_out_1_2__4_6", 3835 Signature(ArgTypes{IntTy}, RetType{IntTy}), 3836 Summary(EvalCallAsPure) 3837 .ArgConstraint(ArgumentCondition( 3838 0U, OutOfRange, Range({1, 2}, {4, 6})))); 3839 addToFunctionSummaryMap( 3840 "__range_out_1_2__4_inf", Signature(ArgTypes{IntTy}, RetType{IntTy}), 3841 Summary(EvalCallAsPure) 3842 .ArgConstraint( 3843 ArgumentCondition(0U, OutOfRange, Range({1, 2}, {4, IntMax})))); 3844 3845 // Test range kind. 3846 addToFunctionSummaryMap( 3847 "__within", Signature(ArgTypes{IntTy}, RetType{IntTy}), 3848 Summary(EvalCallAsPure) 3849 .ArgConstraint(ArgumentCondition(0U, WithinRange, SingleValue(1)))); 3850 addToFunctionSummaryMap( 3851 "__out_of", Signature(ArgTypes{IntTy}, RetType{IntTy}), 3852 Summary(EvalCallAsPure) 3853 .ArgConstraint(ArgumentCondition(0U, OutOfRange, SingleValue(1)))); 3854 3855 addToFunctionSummaryMap( 3856 "__two_constrained_args", 3857 Signature(ArgTypes{IntTy, IntTy}, RetType{IntTy}), 3858 Summary(EvalCallAsPure) 3859 .ArgConstraint(ArgumentCondition(0U, WithinRange, SingleValue(1))) 3860 .ArgConstraint(ArgumentCondition(1U, WithinRange, SingleValue(1)))); 3861 addToFunctionSummaryMap( 3862 "__arg_constrained_twice", Signature(ArgTypes{IntTy}, RetType{IntTy}), 3863 Summary(EvalCallAsPure) 3864 .ArgConstraint(ArgumentCondition(0U, OutOfRange, SingleValue(1))) 3865 .ArgConstraint(ArgumentCondition(0U, OutOfRange, SingleValue(2)))); 3866 addToFunctionSummaryMap( 3867 "__defaultparam", 3868 Signature(ArgTypes{Irrelevant, IntTy}, RetType{IntTy}), 3869 Summary(EvalCallAsPure).ArgConstraint(NotNull(ArgNo(0)))); 3870 addToFunctionSummaryMap( 3871 "__variadic", 3872 Signature(ArgTypes{VoidPtrTy, ConstCharPtrTy}, RetType{IntTy}), 3873 Summary(EvalCallAsPure) 3874 .ArgConstraint(NotNull(ArgNo(0))) 3875 .ArgConstraint(NotNull(ArgNo(1)))); 3876 addToFunctionSummaryMap( 3877 "__buf_size_arg_constraint", 3878 Signature(ArgTypes{ConstVoidPtrTy, SizeTy}, RetType{IntTy}), 3879 Summary(EvalCallAsPure) 3880 .ArgConstraint( 3881 BufferSize(/*Buffer=*/ArgNo(0), /*BufSize=*/ArgNo(1)))); 3882 addToFunctionSummaryMap( 3883 "__buf_size_arg_constraint_mul", 3884 Signature(ArgTypes{ConstVoidPtrTy, SizeTy, SizeTy}, RetType{IntTy}), 3885 Summary(EvalCallAsPure) 3886 .ArgConstraint(BufferSize(/*Buffer=*/ArgNo(0), /*BufSize=*/ArgNo(1), 3887 /*BufSizeMultiplier=*/ArgNo(2)))); 3888 addToFunctionSummaryMap( 3889 "__buf_size_arg_constraint_concrete", 3890 Signature(ArgTypes{ConstVoidPtrTy}, RetType{IntTy}), 3891 Summary(EvalCallAsPure) 3892 .ArgConstraint(BufferSize(/*Buffer=*/ArgNo(0), 3893 /*BufSize=*/BVF.getValue(10, IntTy)))); 3894 addToFunctionSummaryMap( 3895 {"__test_restrict_param_0", "__test_restrict_param_1", 3896 "__test_restrict_param_2"}, 3897 Signature(ArgTypes{VoidPtrRestrictTy}, RetType{VoidTy}), 3898 Summary(EvalCallAsPure)); 3899 3900 // Test the application of cases. 3901 addToFunctionSummaryMap( 3902 "__test_case_note", Signature(ArgTypes{}, RetType{IntTy}), 3903 Summary(EvalCallAsPure) 3904 .Case({ReturnValueCondition(WithinRange, SingleValue(0))}, 3905 ErrnoIrrelevant, "Function returns 0") 3906 .Case({ReturnValueCondition(WithinRange, SingleValue(1))}, 3907 ErrnoIrrelevant, "Function returns 1")); 3908 addToFunctionSummaryMap( 3909 "__test_case_range_1_2__4_6", 3910 Signature(ArgTypes{IntTy}, RetType{IntTy}), 3911 Summary(EvalCallAsPure) 3912 .Case({ArgumentCondition(0U, WithinRange, 3913 IntRangeVector{{IntMin, 0}, {3, 3}}), 3914 ReturnValueCondition(WithinRange, SingleValue(1))}, 3915 ErrnoIrrelevant) 3916 .Case({ArgumentCondition(0U, WithinRange, 3917 IntRangeVector{{3, 3}, {7, IntMax}}), 3918 ReturnValueCondition(WithinRange, SingleValue(2))}, 3919 ErrnoIrrelevant) 3920 .Case({ArgumentCondition(0U, WithinRange, 3921 IntRangeVector{{IntMin, 0}, {7, IntMax}}), 3922 ReturnValueCondition(WithinRange, SingleValue(3))}, 3923 ErrnoIrrelevant) 3924 .Case({ArgumentCondition( 3925 0U, WithinRange, 3926 IntRangeVector{{IntMin, 0}, {3, 3}, {7, IntMax}}), 3927 ReturnValueCondition(WithinRange, SingleValue(4))}, 3928 ErrnoIrrelevant)); 3929 } 3930 } 3931 3932 void ento::registerStdCLibraryFunctionsChecker(CheckerManager &mgr) { 3933 auto *Checker = mgr.registerChecker<StdLibraryFunctionsChecker>(); 3934 Checker->CheckName = mgr.getCurrentCheckerName(); 3935 const AnalyzerOptions &Opts = mgr.getAnalyzerOptions(); 3936 Checker->DisplayLoadedSummaries = 3937 Opts.getCheckerBooleanOption(Checker, "DisplayLoadedSummaries"); 3938 Checker->ModelPOSIX = Opts.getCheckerBooleanOption(Checker, "ModelPOSIX"); 3939 Checker->ShouldAssumeControlledEnvironment = 3940 Opts.ShouldAssumeControlledEnvironment; 3941 } 3942 3943 bool ento::shouldRegisterStdCLibraryFunctionsChecker( 3944 const CheckerManager &mgr) { 3945 return true; 3946 } 3947 3948 void ento::registerStdCLibraryFunctionsTesterChecker(CheckerManager &mgr) { 3949 auto *Checker = mgr.getChecker<StdLibraryFunctionsChecker>(); 3950 Checker->AddTestFunctions = true; 3951 } 3952 3953 bool ento::shouldRegisterStdCLibraryFunctionsTesterChecker( 3954 const CheckerManager &mgr) { 3955 return true; 3956 } 3957