1 //===-- StreamChecker.cpp -----------------------------------------*- C++ -*--// 2 // 3 // Part of the LLVM Project, under the Apache License v2.0 with LLVM Exceptions. 4 // See https://llvm.org/LICENSE.txt for license information. 5 // SPDX-License-Identifier: Apache-2.0 WITH LLVM-exception 6 // 7 //===----------------------------------------------------------------------===// 8 // 9 // This file defines checkers that model and check stream handling functions. 10 // 11 //===----------------------------------------------------------------------===// 12 13 #include "NoOwnershipChangeVisitor.h" 14 #include "clang/ASTMatchers/ASTMatchFinder.h" 15 #include "clang/ASTMatchers/ASTMatchers.h" 16 #include "clang/StaticAnalyzer/Checkers/BuiltinCheckerRegistration.h" 17 #include "clang/StaticAnalyzer/Core/BugReporter/BugType.h" 18 #include "clang/StaticAnalyzer/Core/Checker.h" 19 #include "clang/StaticAnalyzer/Core/CheckerManager.h" 20 #include "clang/StaticAnalyzer/Core/PathSensitive/CallDescription.h" 21 #include "clang/StaticAnalyzer/Core/PathSensitive/CallEvent.h" 22 #include "clang/StaticAnalyzer/Core/PathSensitive/CheckerContext.h" 23 #include "clang/StaticAnalyzer/Core/PathSensitive/CheckerHelpers.h" 24 #include "clang/StaticAnalyzer/Core/PathSensitive/ProgramState.h" 25 #include "clang/StaticAnalyzer/Core/PathSensitive/ProgramStateTrait.h" 26 #include "clang/StaticAnalyzer/Core/PathSensitive/SymbolManager.h" 27 #include "llvm/ADT/Sequence.h" 28 #include <functional> 29 #include <optional> 30 31 using namespace clang; 32 using namespace ento; 33 using namespace std::placeholders; 34 35 //===----------------------------------------------------------------------===// 36 // Definition of state data structures. 37 //===----------------------------------------------------------------------===// 38 39 namespace { 40 41 struct FnDescription; 42 43 /// State of the stream error flags. 44 /// Sometimes it is not known to the checker what error flags are set. 45 /// This is indicated by setting more than one flag to true. 46 /// This is an optimization to avoid state splits. 47 /// A stream can either be in FEOF or FERROR but not both at the same time. 48 /// Multiple flags are set to handle the corresponding states together. 49 struct StreamErrorState { 50 /// The stream can be in state where none of the error flags set. 51 bool NoError = true; 52 /// The stream can be in state where the EOF indicator is set. 53 bool FEof = false; 54 /// The stream can be in state where the error indicator is set. 55 bool FError = false; 56 57 bool isNoError() const { return NoError && !FEof && !FError; } 58 bool isFEof() const { return !NoError && FEof && !FError; } 59 bool isFError() const { return !NoError && !FEof && FError; } 60 61 bool operator==(const StreamErrorState &ES) const { 62 return NoError == ES.NoError && FEof == ES.FEof && FError == ES.FError; 63 } 64 65 bool operator!=(const StreamErrorState &ES) const { return !(*this == ES); } 66 67 StreamErrorState operator|(const StreamErrorState &E) const { 68 return {NoError || E.NoError, FEof || E.FEof, FError || E.FError}; 69 } 70 71 StreamErrorState operator&(const StreamErrorState &E) const { 72 return {NoError && E.NoError, FEof && E.FEof, FError && E.FError}; 73 } 74 75 StreamErrorState operator~() const { return {!NoError, !FEof, !FError}; } 76 77 /// Returns if the StreamErrorState is a valid object. 78 operator bool() const { return NoError || FEof || FError; } 79 80 LLVM_DUMP_METHOD void dump() const { dumpToStream(llvm::errs()); } 81 LLVM_DUMP_METHOD void dumpToStream(llvm::raw_ostream &os) const { 82 os << "NoError: " << NoError << ", FEof: " << FEof 83 << ", FError: " << FError; 84 } 85 86 void Profile(llvm::FoldingSetNodeID &ID) const { 87 ID.AddBoolean(NoError); 88 ID.AddBoolean(FEof); 89 ID.AddBoolean(FError); 90 } 91 }; 92 93 const StreamErrorState ErrorNone{true, false, false}; 94 const StreamErrorState ErrorFEof{false, true, false}; 95 const StreamErrorState ErrorFError{false, false, true}; 96 97 /// Full state information about a stream pointer. 98 struct StreamState { 99 /// The last file operation called in the stream. 100 /// Can be nullptr. 101 const FnDescription *LastOperation; 102 103 /// State of a stream symbol. 104 enum KindTy { 105 Opened, /// Stream is opened. 106 Closed, /// Closed stream (an invalid stream pointer after it was closed). 107 OpenFailed /// The last open operation has failed. 108 } State; 109 110 StringRef getKindStr() const { 111 switch (State) { 112 case Opened: 113 return "Opened"; 114 case Closed: 115 return "Closed"; 116 case OpenFailed: 117 return "OpenFailed"; 118 } 119 llvm_unreachable("Unknown StreamState!"); 120 } 121 122 /// State of the error flags. 123 /// Ignored in non-opened stream state but must be NoError. 124 StreamErrorState const ErrorState; 125 126 /// Indicate if the file has an "indeterminate file position indicator". 127 /// This can be set at a failing read or write or seek operation. 128 /// If it is set no more read or write is allowed. 129 /// This value is not dependent on the stream error flags: 130 /// The error flag may be cleared with `clearerr` but the file position 131 /// remains still indeterminate. 132 /// This value applies to all error states in ErrorState except FEOF. 133 /// An EOF+indeterminate state is the same as EOF state. 134 bool const FilePositionIndeterminate = false; 135 136 StreamState(const FnDescription *L, KindTy S, const StreamErrorState &ES, 137 bool IsFilePositionIndeterminate) 138 : LastOperation(L), State(S), ErrorState(ES), 139 FilePositionIndeterminate(IsFilePositionIndeterminate) { 140 assert((!ES.isFEof() || !IsFilePositionIndeterminate) && 141 "FilePositionIndeterminate should be false in FEof case."); 142 assert((State == Opened || ErrorState.isNoError()) && 143 "ErrorState should be None in non-opened stream state."); 144 } 145 146 bool isOpened() const { return State == Opened; } 147 bool isClosed() const { return State == Closed; } 148 bool isOpenFailed() const { return State == OpenFailed; } 149 150 bool operator==(const StreamState &X) const { 151 // In not opened state error state should always NoError, so comparison 152 // here is no problem. 153 return LastOperation == X.LastOperation && State == X.State && 154 ErrorState == X.ErrorState && 155 FilePositionIndeterminate == X.FilePositionIndeterminate; 156 } 157 158 static StreamState getOpened(const FnDescription *L, 159 const StreamErrorState &ES = ErrorNone, 160 bool IsFilePositionIndeterminate = false) { 161 return StreamState{L, Opened, ES, IsFilePositionIndeterminate}; 162 } 163 static StreamState getClosed(const FnDescription *L) { 164 return StreamState{L, Closed, {}, false}; 165 } 166 static StreamState getOpenFailed(const FnDescription *L) { 167 return StreamState{L, OpenFailed, {}, false}; 168 } 169 170 LLVM_DUMP_METHOD void dump() const { dumpToStream(llvm::errs()); } 171 LLVM_DUMP_METHOD void dumpToStream(llvm::raw_ostream &os) const; 172 173 void Profile(llvm::FoldingSetNodeID &ID) const { 174 ID.AddPointer(LastOperation); 175 ID.AddInteger(State); 176 ErrorState.Profile(ID); 177 ID.AddBoolean(FilePositionIndeterminate); 178 } 179 }; 180 181 } // namespace 182 183 // This map holds the state of a stream. 184 // The stream is identified with a SymbolRef that is created when a stream 185 // opening function is modeled by the checker. 186 REGISTER_MAP_WITH_PROGRAMSTATE(StreamMap, SymbolRef, StreamState) 187 188 //===----------------------------------------------------------------------===// 189 // StreamChecker class and utility functions. 190 //===----------------------------------------------------------------------===// 191 192 namespace { 193 194 class StreamChecker; 195 using FnCheck = std::function<void(const StreamChecker *, const FnDescription *, 196 const CallEvent &, CheckerContext &)>; 197 198 using ArgNoTy = unsigned int; 199 static const ArgNoTy ArgNone = std::numeric_limits<ArgNoTy>::max(); 200 201 const char *FeofNote = "Assuming stream reaches end-of-file here"; 202 const char *FerrorNote = "Assuming this stream operation fails"; 203 204 struct FnDescription { 205 FnCheck PreFn; 206 FnCheck EvalFn; 207 ArgNoTy StreamArgNo; 208 }; 209 210 LLVM_DUMP_METHOD void StreamState::dumpToStream(llvm::raw_ostream &os) const { 211 os << "{Kind: " << getKindStr() << ", Last operation: " << LastOperation 212 << ", ErrorState: "; 213 ErrorState.dumpToStream(os); 214 os << ", FilePos: " << (FilePositionIndeterminate ? "Indeterminate" : "OK") 215 << '}'; 216 } 217 218 /// Get the value of the stream argument out of the passed call event. 219 /// The call should contain a function that is described by Desc. 220 SVal getStreamArg(const FnDescription *Desc, const CallEvent &Call) { 221 assert(Desc && Desc->StreamArgNo != ArgNone && 222 "Try to get a non-existing stream argument."); 223 return Call.getArgSVal(Desc->StreamArgNo); 224 } 225 226 /// Create a conjured symbol return value for a call expression. 227 DefinedSVal makeRetVal(CheckerContext &C, const CallExpr *CE) { 228 assert(CE && "Expecting a call expression."); 229 230 const LocationContext *LCtx = C.getLocationContext(); 231 return C.getSValBuilder() 232 .conjureSymbolVal(nullptr, CE, LCtx, C.blockCount()) 233 .castAs<DefinedSVal>(); 234 } 235 236 ProgramStateRef bindAndAssumeTrue(ProgramStateRef State, CheckerContext &C, 237 const CallExpr *CE) { 238 DefinedSVal RetVal = makeRetVal(C, CE); 239 State = State->BindExpr(CE, C.getLocationContext(), RetVal); 240 State = State->assume(RetVal, true); 241 assert(State && "Assumption on new value should not fail."); 242 return State; 243 } 244 245 ProgramStateRef bindInt(uint64_t Value, ProgramStateRef State, 246 CheckerContext &C, const CallExpr *CE) { 247 State = State->BindExpr(CE, C.getLocationContext(), 248 C.getSValBuilder().makeIntVal(Value, CE->getType())); 249 return State; 250 } 251 252 inline void assertStreamStateOpened(const StreamState *SS) { 253 assert(SS->isOpened() && "Stream is expected to be opened"); 254 } 255 256 class StreamChecker : public Checker<check::PreCall, eval::Call, 257 check::DeadSymbols, check::PointerEscape> { 258 BugType BT_FileNull{this, "NULL stream pointer", "Stream handling error"}; 259 BugType BT_UseAfterClose{this, "Closed stream", "Stream handling error"}; 260 BugType BT_UseAfterOpenFailed{this, "Invalid stream", 261 "Stream handling error"}; 262 BugType BT_IndeterminatePosition{this, "Invalid stream state", 263 "Stream handling error"}; 264 BugType BT_IllegalWhence{this, "Illegal whence argument", 265 "Stream handling error"}; 266 BugType BT_StreamEof{this, "Stream already in EOF", "Stream handling error"}; 267 BugType BT_ResourceLeak{this, "Resource leak", "Stream handling error", 268 /*SuppressOnSink =*/true}; 269 270 public: 271 void checkPreCall(const CallEvent &Call, CheckerContext &C) const; 272 bool evalCall(const CallEvent &Call, CheckerContext &C) const; 273 void checkDeadSymbols(SymbolReaper &SymReaper, CheckerContext &C) const; 274 ProgramStateRef checkPointerEscape(ProgramStateRef State, 275 const InvalidatedSymbols &Escaped, 276 const CallEvent *Call, 277 PointerEscapeKind Kind) const; 278 279 const BugType *getBT_StreamEof() const { return &BT_StreamEof; } 280 const BugType *getBT_IndeterminatePosition() const { 281 return &BT_IndeterminatePosition; 282 } 283 284 const NoteTag *constructSetEofNoteTag(CheckerContext &C, 285 SymbolRef StreamSym) const { 286 return C.getNoteTag([this, StreamSym](PathSensitiveBugReport &BR) { 287 if (!BR.isInteresting(StreamSym) || 288 &BR.getBugType() != this->getBT_StreamEof()) 289 return ""; 290 291 BR.markNotInteresting(StreamSym); 292 293 return FeofNote; 294 }); 295 } 296 297 const NoteTag *constructSetErrorNoteTag(CheckerContext &C, 298 SymbolRef StreamSym) const { 299 return C.getNoteTag([this, StreamSym](PathSensitiveBugReport &BR) { 300 if (!BR.isInteresting(StreamSym) || 301 &BR.getBugType() != this->getBT_IndeterminatePosition()) 302 return ""; 303 304 BR.markNotInteresting(StreamSym); 305 306 return FerrorNote; 307 }); 308 } 309 310 const NoteTag *constructSetEofOrErrorNoteTag(CheckerContext &C, 311 SymbolRef StreamSym) const { 312 return C.getNoteTag([this, StreamSym](PathSensitiveBugReport &BR) { 313 if (!BR.isInteresting(StreamSym)) 314 return ""; 315 316 if (&BR.getBugType() == this->getBT_StreamEof()) { 317 BR.markNotInteresting(StreamSym); 318 return FeofNote; 319 } 320 if (&BR.getBugType() == this->getBT_IndeterminatePosition()) { 321 BR.markNotInteresting(StreamSym); 322 return FerrorNote; 323 } 324 325 return ""; 326 }); 327 } 328 329 /// If true, evaluate special testing stream functions. 330 bool TestMode = false; 331 332 /// If true, generate failure branches for cases that are often not checked. 333 bool PedanticMode = false; 334 335 const CallDescription FCloseDesc = {CDM::CLibrary, {"fclose"}, 1}; 336 337 private: 338 CallDescriptionMap<FnDescription> FnDescriptions = { 339 {{CDM::CLibrary, {"fopen"}, 2}, 340 {nullptr, &StreamChecker::evalFopen, ArgNone}}, 341 {{CDM::CLibrary, {"fdopen"}, 2}, 342 {nullptr, &StreamChecker::evalFopen, ArgNone}}, 343 {{CDM::CLibrary, {"freopen"}, 3}, 344 {&StreamChecker::preFreopen, &StreamChecker::evalFreopen, 2}}, 345 {{CDM::CLibrary, {"tmpfile"}, 0}, 346 {nullptr, &StreamChecker::evalFopen, ArgNone}}, 347 {FCloseDesc, {&StreamChecker::preDefault, &StreamChecker::evalFclose, 0}}, 348 {{CDM::CLibrary, {"fread"}, 4}, 349 {&StreamChecker::preRead, 350 std::bind(&StreamChecker::evalFreadFwrite, _1, _2, _3, _4, true), 3}}, 351 {{CDM::CLibrary, {"fwrite"}, 4}, 352 {&StreamChecker::preWrite, 353 std::bind(&StreamChecker::evalFreadFwrite, _1, _2, _3, _4, false), 3}}, 354 {{CDM::CLibrary, {"fgetc"}, 1}, 355 {&StreamChecker::preRead, 356 std::bind(&StreamChecker::evalFgetx, _1, _2, _3, _4, true), 0}}, 357 {{CDM::CLibrary, {"fgets"}, 3}, 358 {&StreamChecker::preRead, 359 std::bind(&StreamChecker::evalFgetx, _1, _2, _3, _4, false), 2}}, 360 {{CDM::CLibrary, {"getc"}, 1}, 361 {&StreamChecker::preRead, 362 std::bind(&StreamChecker::evalFgetx, _1, _2, _3, _4, true), 0}}, 363 {{CDM::CLibrary, {"fputc"}, 2}, 364 {&StreamChecker::preWrite, 365 std::bind(&StreamChecker::evalFputx, _1, _2, _3, _4, true), 1}}, 366 {{CDM::CLibrary, {"fputs"}, 2}, 367 {&StreamChecker::preWrite, 368 std::bind(&StreamChecker::evalFputx, _1, _2, _3, _4, false), 1}}, 369 {{CDM::CLibrary, {"putc"}, 2}, 370 {&StreamChecker::preWrite, 371 std::bind(&StreamChecker::evalFputx, _1, _2, _3, _4, true), 1}}, 372 {{CDM::CLibrary, {"fprintf"}}, 373 {&StreamChecker::preWrite, 374 std::bind(&StreamChecker::evalFprintf, _1, _2, _3, _4), 0}}, 375 {{CDM::CLibrary, {"vfprintf"}, 3}, 376 {&StreamChecker::preWrite, 377 std::bind(&StreamChecker::evalFprintf, _1, _2, _3, _4), 0}}, 378 {{CDM::CLibrary, {"fscanf"}}, 379 {&StreamChecker::preRead, 380 std::bind(&StreamChecker::evalFscanf, _1, _2, _3, _4), 0}}, 381 {{CDM::CLibrary, {"vfscanf"}, 3}, 382 {&StreamChecker::preRead, 383 std::bind(&StreamChecker::evalFscanf, _1, _2, _3, _4), 0}}, 384 {{CDM::CLibrary, {"ungetc"}, 2}, 385 {&StreamChecker::preWrite, 386 std::bind(&StreamChecker::evalUngetc, _1, _2, _3, _4), 1}}, 387 {{CDM::CLibrary, {"getdelim"}, 4}, 388 {&StreamChecker::preRead, 389 std::bind(&StreamChecker::evalGetdelim, _1, _2, _3, _4), 3}}, 390 {{CDM::CLibrary, {"getline"}, 3}, 391 {&StreamChecker::preRead, 392 std::bind(&StreamChecker::evalGetdelim, _1, _2, _3, _4), 2}}, 393 {{CDM::CLibrary, {"fseek"}, 3}, 394 {&StreamChecker::preFseek, &StreamChecker::evalFseek, 0}}, 395 {{CDM::CLibrary, {"fseeko"}, 3}, 396 {&StreamChecker::preFseek, &StreamChecker::evalFseek, 0}}, 397 {{CDM::CLibrary, {"ftell"}, 1}, 398 {&StreamChecker::preWrite, &StreamChecker::evalFtell, 0}}, 399 {{CDM::CLibrary, {"ftello"}, 1}, 400 {&StreamChecker::preWrite, &StreamChecker::evalFtell, 0}}, 401 {{CDM::CLibrary, {"fflush"}, 1}, 402 {&StreamChecker::preFflush, &StreamChecker::evalFflush, 0}}, 403 {{CDM::CLibrary, {"rewind"}, 1}, 404 {&StreamChecker::preDefault, &StreamChecker::evalRewind, 0}}, 405 {{CDM::CLibrary, {"fgetpos"}, 2}, 406 {&StreamChecker::preWrite, &StreamChecker::evalFgetpos, 0}}, 407 {{CDM::CLibrary, {"fsetpos"}, 2}, 408 {&StreamChecker::preDefault, &StreamChecker::evalFsetpos, 0}}, 409 {{CDM::CLibrary, {"clearerr"}, 1}, 410 {&StreamChecker::preDefault, &StreamChecker::evalClearerr, 0}}, 411 {{CDM::CLibrary, {"feof"}, 1}, 412 {&StreamChecker::preDefault, 413 std::bind(&StreamChecker::evalFeofFerror, _1, _2, _3, _4, ErrorFEof), 414 0}}, 415 {{CDM::CLibrary, {"ferror"}, 1}, 416 {&StreamChecker::preDefault, 417 std::bind(&StreamChecker::evalFeofFerror, _1, _2, _3, _4, ErrorFError), 418 0}}, 419 {{CDM::CLibrary, {"fileno"}, 1}, 420 {&StreamChecker::preDefault, &StreamChecker::evalFileno, 0}}, 421 }; 422 423 CallDescriptionMap<FnDescription> FnTestDescriptions = { 424 {{CDM::SimpleFunc, {"StreamTesterChecker_make_feof_stream"}, 1}, 425 {nullptr, 426 std::bind(&StreamChecker::evalSetFeofFerror, _1, _2, _3, _4, ErrorFEof, 427 false), 428 0}}, 429 {{CDM::SimpleFunc, {"StreamTesterChecker_make_ferror_stream"}, 1}, 430 {nullptr, 431 std::bind(&StreamChecker::evalSetFeofFerror, _1, _2, _3, _4, 432 ErrorFError, false), 433 0}}, 434 {{CDM::SimpleFunc, 435 {"StreamTesterChecker_make_ferror_indeterminate_stream"}, 436 1}, 437 {nullptr, 438 std::bind(&StreamChecker::evalSetFeofFerror, _1, _2, _3, _4, 439 ErrorFError, true), 440 0}}, 441 }; 442 443 /// Expanded value of EOF, empty before initialization. 444 mutable std::optional<int> EofVal; 445 /// Expanded value of SEEK_SET, 0 if not found. 446 mutable int SeekSetVal = 0; 447 /// Expanded value of SEEK_CUR, 1 if not found. 448 mutable int SeekCurVal = 1; 449 /// Expanded value of SEEK_END, 2 if not found. 450 mutable int SeekEndVal = 2; 451 /// The built-in va_list type is platform-specific 452 mutable QualType VaListType; 453 454 void evalFopen(const FnDescription *Desc, const CallEvent &Call, 455 CheckerContext &C) const; 456 457 void preFreopen(const FnDescription *Desc, const CallEvent &Call, 458 CheckerContext &C) const; 459 void evalFreopen(const FnDescription *Desc, const CallEvent &Call, 460 CheckerContext &C) const; 461 462 void evalFclose(const FnDescription *Desc, const CallEvent &Call, 463 CheckerContext &C) const; 464 465 void preRead(const FnDescription *Desc, const CallEvent &Call, 466 CheckerContext &C) const; 467 468 void preWrite(const FnDescription *Desc, const CallEvent &Call, 469 CheckerContext &C) const; 470 471 void evalFreadFwrite(const FnDescription *Desc, const CallEvent &Call, 472 CheckerContext &C, bool IsFread) const; 473 474 void evalFgetx(const FnDescription *Desc, const CallEvent &Call, 475 CheckerContext &C, bool SingleChar) const; 476 477 void evalFputx(const FnDescription *Desc, const CallEvent &Call, 478 CheckerContext &C, bool IsSingleChar) const; 479 480 void evalFprintf(const FnDescription *Desc, const CallEvent &Call, 481 CheckerContext &C) const; 482 483 void evalFscanf(const FnDescription *Desc, const CallEvent &Call, 484 CheckerContext &C) const; 485 486 void evalUngetc(const FnDescription *Desc, const CallEvent &Call, 487 CheckerContext &C) const; 488 489 void evalGetdelim(const FnDescription *Desc, const CallEvent &Call, 490 CheckerContext &C) const; 491 492 void preFseek(const FnDescription *Desc, const CallEvent &Call, 493 CheckerContext &C) const; 494 void evalFseek(const FnDescription *Desc, const CallEvent &Call, 495 CheckerContext &C) const; 496 497 void evalFgetpos(const FnDescription *Desc, const CallEvent &Call, 498 CheckerContext &C) const; 499 500 void evalFsetpos(const FnDescription *Desc, const CallEvent &Call, 501 CheckerContext &C) const; 502 503 void evalFtell(const FnDescription *Desc, const CallEvent &Call, 504 CheckerContext &C) const; 505 506 void evalRewind(const FnDescription *Desc, const CallEvent &Call, 507 CheckerContext &C) const; 508 509 void preDefault(const FnDescription *Desc, const CallEvent &Call, 510 CheckerContext &C) const; 511 512 void evalClearerr(const FnDescription *Desc, const CallEvent &Call, 513 CheckerContext &C) const; 514 515 void evalFeofFerror(const FnDescription *Desc, const CallEvent &Call, 516 CheckerContext &C, 517 const StreamErrorState &ErrorKind) const; 518 519 void evalSetFeofFerror(const FnDescription *Desc, const CallEvent &Call, 520 CheckerContext &C, const StreamErrorState &ErrorKind, 521 bool Indeterminate) const; 522 523 void preFflush(const FnDescription *Desc, const CallEvent &Call, 524 CheckerContext &C) const; 525 526 void evalFflush(const FnDescription *Desc, const CallEvent &Call, 527 CheckerContext &C) const; 528 529 void evalFileno(const FnDescription *Desc, const CallEvent &Call, 530 CheckerContext &C) const; 531 532 /// Check that the stream (in StreamVal) is not NULL. 533 /// If it can only be NULL a fatal error is emitted and nullptr returned. 534 /// Otherwise the return value is a new state where the stream is constrained 535 /// to be non-null. 536 ProgramStateRef ensureStreamNonNull(SVal StreamVal, const Expr *StreamE, 537 CheckerContext &C, 538 ProgramStateRef State) const; 539 540 /// Check that the stream is the opened state. 541 /// If the stream is known to be not opened an error is generated 542 /// and nullptr returned, otherwise the original state is returned. 543 ProgramStateRef ensureStreamOpened(SVal StreamVal, CheckerContext &C, 544 ProgramStateRef State) const; 545 546 /// Check that the stream has not an invalid ("indeterminate") file position, 547 /// generate warning for it. 548 /// (EOF is not an invalid position.) 549 /// The returned state can be nullptr if a fatal error was generated. 550 /// It can return non-null state if the stream has not an invalid position or 551 /// there is execution path with non-invalid position. 552 ProgramStateRef 553 ensureNoFilePositionIndeterminate(SVal StreamVal, CheckerContext &C, 554 ProgramStateRef State) const; 555 556 /// Check the legality of the 'whence' argument of 'fseek'. 557 /// Generate error and return nullptr if it is found to be illegal. 558 /// Otherwise returns the state. 559 /// (State is not changed here because the "whence" value is already known.) 560 ProgramStateRef ensureFseekWhenceCorrect(SVal WhenceVal, CheckerContext &C, 561 ProgramStateRef State) const; 562 563 /// Generate warning about stream in EOF state. 564 /// There will be always a state transition into the passed State, 565 /// by the new non-fatal error node or (if failed) a normal transition, 566 /// to ensure uniform handling. 567 void reportFEofWarning(SymbolRef StreamSym, CheckerContext &C, 568 ProgramStateRef State) const; 569 570 /// Emit resource leak warnings for the given symbols. 571 /// Createn a non-fatal error node for these, and returns it (if any warnings 572 /// were generated). Return value is non-null. 573 ExplodedNode *reportLeaks(const SmallVector<SymbolRef, 2> &LeakedSyms, 574 CheckerContext &C, ExplodedNode *Pred) const; 575 576 /// Find the description data of the function called by a call event. 577 /// Returns nullptr if no function is recognized. 578 const FnDescription *lookupFn(const CallEvent &Call) const { 579 // Recognize "global C functions" with only integral or pointer arguments 580 // (and matching name) as stream functions. 581 for (auto *P : Call.parameters()) { 582 QualType T = P->getType(); 583 if (!T->isIntegralOrEnumerationType() && !T->isPointerType() && 584 T.getCanonicalType() != VaListType) 585 return nullptr; 586 } 587 588 return FnDescriptions.lookup(Call); 589 } 590 591 /// Generate a message for BugReporterVisitor if the stored symbol is 592 /// marked as interesting by the actual bug report. 593 const NoteTag *constructLeakNoteTag(CheckerContext &C, SymbolRef StreamSym, 594 const std::string &Message) const { 595 return C.getNoteTag([this, StreamSym, 596 Message](PathSensitiveBugReport &BR) -> std::string { 597 if (BR.isInteresting(StreamSym) && &BR.getBugType() == &BT_ResourceLeak) 598 return Message; 599 return ""; 600 }); 601 } 602 603 void initMacroValues(CheckerContext &C) const { 604 if (EofVal) 605 return; 606 607 if (const std::optional<int> OptInt = 608 tryExpandAsInteger("EOF", C.getPreprocessor())) 609 EofVal = *OptInt; 610 else 611 EofVal = -1; 612 if (const std::optional<int> OptInt = 613 tryExpandAsInteger("SEEK_SET", C.getPreprocessor())) 614 SeekSetVal = *OptInt; 615 if (const std::optional<int> OptInt = 616 tryExpandAsInteger("SEEK_END", C.getPreprocessor())) 617 SeekEndVal = *OptInt; 618 if (const std::optional<int> OptInt = 619 tryExpandAsInteger("SEEK_CUR", C.getPreprocessor())) 620 SeekCurVal = *OptInt; 621 } 622 623 void initVaListType(CheckerContext &C) const { 624 VaListType = C.getASTContext().getBuiltinVaListType().getCanonicalType(); 625 } 626 627 /// Searches for the ExplodedNode where the file descriptor was acquired for 628 /// StreamSym. 629 static const ExplodedNode *getAcquisitionSite(const ExplodedNode *N, 630 SymbolRef StreamSym, 631 CheckerContext &C); 632 }; 633 634 struct StreamOperationEvaluator { 635 SValBuilder &SVB; 636 const ASTContext &ACtx; 637 638 SymbolRef StreamSym = nullptr; 639 const StreamState *SS = nullptr; 640 const CallExpr *CE = nullptr; 641 StreamErrorState NewES; 642 643 StreamOperationEvaluator(CheckerContext &C) 644 : SVB(C.getSValBuilder()), ACtx(C.getASTContext()) { 645 ; 646 } 647 648 bool Init(const FnDescription *Desc, const CallEvent &Call, CheckerContext &C, 649 ProgramStateRef State) { 650 StreamSym = getStreamArg(Desc, Call).getAsSymbol(); 651 if (!StreamSym) 652 return false; 653 SS = State->get<StreamMap>(StreamSym); 654 if (!SS) 655 return false; 656 NewES = SS->ErrorState; 657 CE = dyn_cast_or_null<CallExpr>(Call.getOriginExpr()); 658 if (!CE) 659 return false; 660 661 assertStreamStateOpened(SS); 662 663 return true; 664 } 665 666 bool isStreamEof() const { return SS->ErrorState == ErrorFEof; } 667 668 NonLoc getZeroVal(const CallEvent &Call) { 669 return *SVB.makeZeroVal(Call.getResultType()).getAs<NonLoc>(); 670 } 671 672 ProgramStateRef setStreamState(ProgramStateRef State, 673 const StreamState &NewSS) { 674 NewES = NewSS.ErrorState; 675 return State->set<StreamMap>(StreamSym, NewSS); 676 } 677 678 ProgramStateRef makeAndBindRetVal(ProgramStateRef State, CheckerContext &C) { 679 NonLoc RetVal = makeRetVal(C, CE).castAs<NonLoc>(); 680 return State->BindExpr(CE, C.getLocationContext(), RetVal); 681 } 682 683 ProgramStateRef bindReturnValue(ProgramStateRef State, CheckerContext &C, 684 uint64_t Val) { 685 return State->BindExpr(CE, C.getLocationContext(), 686 SVB.makeIntVal(Val, CE->getCallReturnType(ACtx))); 687 } 688 689 ProgramStateRef bindReturnValue(ProgramStateRef State, CheckerContext &C, 690 SVal Val) { 691 return State->BindExpr(CE, C.getLocationContext(), Val); 692 } 693 694 ProgramStateRef bindNullReturnValue(ProgramStateRef State, 695 CheckerContext &C) { 696 return State->BindExpr(CE, C.getLocationContext(), 697 C.getSValBuilder().makeNullWithType(CE->getType())); 698 } 699 700 ProgramStateRef assumeBinOpNN(ProgramStateRef State, 701 BinaryOperator::Opcode Op, NonLoc LHS, 702 NonLoc RHS) { 703 auto Cond = SVB.evalBinOpNN(State, Op, LHS, RHS, SVB.getConditionType()) 704 .getAs<DefinedOrUnknownSVal>(); 705 if (!Cond) 706 return nullptr; 707 return State->assume(*Cond, true); 708 } 709 710 ConstraintManager::ProgramStatePair 711 makeRetValAndAssumeDual(ProgramStateRef State, CheckerContext &C) { 712 DefinedSVal RetVal = makeRetVal(C, CE); 713 State = State->BindExpr(CE, C.getLocationContext(), RetVal); 714 return C.getConstraintManager().assumeDual(State, RetVal); 715 } 716 717 const NoteTag *getFailureNoteTag(const StreamChecker *Ch, CheckerContext &C) { 718 bool SetFeof = NewES.FEof && !SS->ErrorState.FEof; 719 bool SetFerror = NewES.FError && !SS->ErrorState.FError; 720 if (SetFeof && !SetFerror) 721 return Ch->constructSetEofNoteTag(C, StreamSym); 722 if (!SetFeof && SetFerror) 723 return Ch->constructSetErrorNoteTag(C, StreamSym); 724 if (SetFeof && SetFerror) 725 return Ch->constructSetEofOrErrorNoteTag(C, StreamSym); 726 return nullptr; 727 } 728 }; 729 730 } // end anonymous namespace 731 732 //===----------------------------------------------------------------------===// 733 // Definition of NoStreamStateChangeVisitor. 734 //===----------------------------------------------------------------------===// 735 736 namespace { 737 class NoStreamStateChangeVisitor final : public NoOwnershipChangeVisitor { 738 protected: 739 /// Syntactically checks whether the callee is a closing function. Since 740 /// we have no path-sensitive information on this call (we would need a 741 /// CallEvent instead of a CallExpr for that), its possible that a 742 /// closing function was called indirectly through a function pointer, 743 /// but we are not able to tell, so this is a best effort analysis. 744 bool isClosingCallAsWritten(const CallExpr &Call) const { 745 const auto *StreamChk = static_cast<const StreamChecker *>(&Checker); 746 return StreamChk->FCloseDesc.matchesAsWritten(Call); 747 } 748 749 bool doesFnIntendToHandleOwnership(const Decl *Callee, 750 ASTContext &ACtx) final { 751 using namespace clang::ast_matchers; 752 const FunctionDecl *FD = dyn_cast<FunctionDecl>(Callee); 753 754 auto Matches = 755 match(findAll(callExpr().bind("call")), *FD->getBody(), ACtx); 756 for (BoundNodes Match : Matches) { 757 if (const auto *Call = Match.getNodeAs<CallExpr>("call")) 758 if (isClosingCallAsWritten(*Call)) 759 return true; 760 } 761 // TODO: Ownership might change with an attempt to store stream object, not 762 // only through closing it. Check for attempted stores as well. 763 return false; 764 } 765 766 bool hasResourceStateChanged(ProgramStateRef CallEnterState, 767 ProgramStateRef CallExitEndState) final { 768 return CallEnterState->get<StreamMap>(Sym) != 769 CallExitEndState->get<StreamMap>(Sym); 770 } 771 772 PathDiagnosticPieceRef emitNote(const ExplodedNode *N) override { 773 PathDiagnosticLocation L = PathDiagnosticLocation::create( 774 N->getLocation(), 775 N->getState()->getStateManager().getContext().getSourceManager()); 776 return std::make_shared<PathDiagnosticEventPiece>( 777 L, "Returning without closing stream object or storing it for later " 778 "release"); 779 } 780 781 public: 782 NoStreamStateChangeVisitor(SymbolRef Sym, const StreamChecker *Checker) 783 : NoOwnershipChangeVisitor(Sym, Checker) {} 784 }; 785 786 } // end anonymous namespace 787 788 const ExplodedNode *StreamChecker::getAcquisitionSite(const ExplodedNode *N, 789 SymbolRef StreamSym, 790 CheckerContext &C) { 791 ProgramStateRef State = N->getState(); 792 // When bug type is resource leak, exploded node N may not have state info 793 // for leaked file descriptor, but predecessor should have it. 794 if (!State->get<StreamMap>(StreamSym)) 795 N = N->getFirstPred(); 796 797 const ExplodedNode *Pred = N; 798 while (N) { 799 State = N->getState(); 800 if (!State->get<StreamMap>(StreamSym)) 801 return Pred; 802 Pred = N; 803 N = N->getFirstPred(); 804 } 805 806 return nullptr; 807 } 808 809 static std::optional<int64_t> getKnownValue(ProgramStateRef State, SVal V) { 810 SValBuilder &SVB = State->getStateManager().getSValBuilder(); 811 if (const llvm::APSInt *Int = SVB.getKnownValue(State, V)) 812 return Int->tryExtValue(); 813 return std::nullopt; 814 } 815 816 /// Invalidate only the requested elements instead of the whole buffer. 817 /// This is basically a refinement of the more generic 'escapeArgs' or 818 /// the plain old 'invalidateRegions'. 819 static ProgramStateRef 820 escapeByStartIndexAndCount(ProgramStateRef State, const CallEvent &Call, 821 unsigned BlockCount, const SubRegion *Buffer, 822 QualType ElemType, int64_t StartIndex, 823 int64_t ElementCount) { 824 constexpr auto DoNotInvalidateSuperRegion = 825 RegionAndSymbolInvalidationTraits::InvalidationKinds:: 826 TK_DoNotInvalidateSuperRegion; 827 828 const LocationContext *LCtx = Call.getLocationContext(); 829 const ASTContext &Ctx = State->getStateManager().getContext(); 830 SValBuilder &SVB = State->getStateManager().getSValBuilder(); 831 auto &RegionManager = Buffer->getMemRegionManager(); 832 833 SmallVector<SVal> EscapingVals; 834 EscapingVals.reserve(ElementCount); 835 836 RegionAndSymbolInvalidationTraits ITraits; 837 for (auto Idx : llvm::seq(StartIndex, StartIndex + ElementCount)) { 838 NonLoc Index = SVB.makeArrayIndex(Idx); 839 const auto *Element = 840 RegionManager.getElementRegion(ElemType, Index, Buffer, Ctx); 841 EscapingVals.push_back(loc::MemRegionVal(Element)); 842 ITraits.setTrait(Element, DoNotInvalidateSuperRegion); 843 } 844 return State->invalidateRegions( 845 EscapingVals, Call.getOriginExpr(), BlockCount, LCtx, 846 /*CausesPointerEscape=*/false, 847 /*InvalidatedSymbols=*/nullptr, &Call, &ITraits); 848 } 849 850 static ProgramStateRef escapeArgs(ProgramStateRef State, CheckerContext &C, 851 const CallEvent &Call, 852 ArrayRef<unsigned int> EscapingArgs) { 853 auto GetArgSVal = [&Call](int Idx) { return Call.getArgSVal(Idx); }; 854 auto EscapingVals = to_vector(map_range(EscapingArgs, GetArgSVal)); 855 State = State->invalidateRegions(EscapingVals, Call.getOriginExpr(), 856 C.blockCount(), C.getLocationContext(), 857 /*CausesPointerEscape=*/false, 858 /*InvalidatedSymbols=*/nullptr); 859 return State; 860 } 861 862 //===----------------------------------------------------------------------===// 863 // Methods of StreamChecker. 864 //===----------------------------------------------------------------------===// 865 866 void StreamChecker::checkPreCall(const CallEvent &Call, 867 CheckerContext &C) const { 868 initMacroValues(C); 869 initVaListType(C); 870 871 const FnDescription *Desc = lookupFn(Call); 872 if (!Desc || !Desc->PreFn) 873 return; 874 875 Desc->PreFn(this, Desc, Call, C); 876 } 877 878 bool StreamChecker::evalCall(const CallEvent &Call, CheckerContext &C) const { 879 const FnDescription *Desc = lookupFn(Call); 880 if (!Desc && TestMode) 881 Desc = FnTestDescriptions.lookup(Call); 882 if (!Desc || !Desc->EvalFn) 883 return false; 884 885 Desc->EvalFn(this, Desc, Call, C); 886 887 return C.isDifferent(); 888 } 889 890 void StreamChecker::evalFopen(const FnDescription *Desc, const CallEvent &Call, 891 CheckerContext &C) const { 892 ProgramStateRef State = C.getState(); 893 const CallExpr *CE = dyn_cast_or_null<CallExpr>(Call.getOriginExpr()); 894 if (!CE) 895 return; 896 897 DefinedSVal RetVal = makeRetVal(C, CE); 898 SymbolRef RetSym = RetVal.getAsSymbol(); 899 assert(RetSym && "RetVal must be a symbol here."); 900 901 State = State->BindExpr(CE, C.getLocationContext(), RetVal); 902 903 // Bifurcate the state into two: one with a valid FILE* pointer, the other 904 // with a NULL. 905 ProgramStateRef StateNotNull, StateNull; 906 std::tie(StateNotNull, StateNull) = 907 C.getConstraintManager().assumeDual(State, RetVal); 908 909 StateNotNull = 910 StateNotNull->set<StreamMap>(RetSym, StreamState::getOpened(Desc)); 911 StateNull = 912 StateNull->set<StreamMap>(RetSym, StreamState::getOpenFailed(Desc)); 913 914 C.addTransition(StateNotNull, 915 constructLeakNoteTag(C, RetSym, "Stream opened here")); 916 C.addTransition(StateNull); 917 } 918 919 void StreamChecker::preFreopen(const FnDescription *Desc, const CallEvent &Call, 920 CheckerContext &C) const { 921 // Do not allow NULL as passed stream pointer but allow a closed stream. 922 ProgramStateRef State = C.getState(); 923 State = ensureStreamNonNull(getStreamArg(Desc, Call), 924 Call.getArgExpr(Desc->StreamArgNo), C, State); 925 if (!State) 926 return; 927 928 C.addTransition(State); 929 } 930 931 void StreamChecker::evalFreopen(const FnDescription *Desc, 932 const CallEvent &Call, 933 CheckerContext &C) const { 934 ProgramStateRef State = C.getState(); 935 936 auto *CE = dyn_cast_or_null<CallExpr>(Call.getOriginExpr()); 937 if (!CE) 938 return; 939 940 std::optional<DefinedSVal> StreamVal = 941 getStreamArg(Desc, Call).getAs<DefinedSVal>(); 942 if (!StreamVal) 943 return; 944 945 SymbolRef StreamSym = StreamVal->getAsSymbol(); 946 // Do not care about concrete values for stream ("(FILE *)0x12345"?). 947 // FIXME: Can be stdin, stdout, stderr such values? 948 if (!StreamSym) 949 return; 950 951 // Do not handle untracked stream. It is probably escaped. 952 if (!State->get<StreamMap>(StreamSym)) 953 return; 954 955 // Generate state for non-failed case. 956 // Return value is the passed stream pointer. 957 // According to the documentations, the stream is closed first 958 // but any close error is ignored. The state changes to (or remains) opened. 959 ProgramStateRef StateRetNotNull = 960 State->BindExpr(CE, C.getLocationContext(), *StreamVal); 961 // Generate state for NULL return value. 962 // Stream switches to OpenFailed state. 963 ProgramStateRef StateRetNull = 964 State->BindExpr(CE, C.getLocationContext(), 965 C.getSValBuilder().makeNullWithType(CE->getType())); 966 967 StateRetNotNull = 968 StateRetNotNull->set<StreamMap>(StreamSym, StreamState::getOpened(Desc)); 969 StateRetNull = 970 StateRetNull->set<StreamMap>(StreamSym, StreamState::getOpenFailed(Desc)); 971 972 C.addTransition(StateRetNotNull, 973 constructLeakNoteTag(C, StreamSym, "Stream reopened here")); 974 C.addTransition(StateRetNull); 975 } 976 977 void StreamChecker::evalFclose(const FnDescription *Desc, const CallEvent &Call, 978 CheckerContext &C) const { 979 ProgramStateRef State = C.getState(); 980 StreamOperationEvaluator E(C); 981 if (!E.Init(Desc, Call, C, State)) 982 return; 983 984 // Close the File Descriptor. 985 // Regardless if the close fails or not, stream becomes "closed" 986 // and can not be used any more. 987 State = E.setStreamState(State, StreamState::getClosed(Desc)); 988 989 // Return 0 on success, EOF on failure. 990 C.addTransition(E.bindReturnValue(State, C, 0)); 991 C.addTransition(E.bindReturnValue(State, C, *EofVal)); 992 } 993 994 void StreamChecker::preRead(const FnDescription *Desc, const CallEvent &Call, 995 CheckerContext &C) const { 996 ProgramStateRef State = C.getState(); 997 SVal StreamVal = getStreamArg(Desc, Call); 998 State = ensureStreamNonNull(StreamVal, Call.getArgExpr(Desc->StreamArgNo), C, 999 State); 1000 if (!State) 1001 return; 1002 State = ensureStreamOpened(StreamVal, C, State); 1003 if (!State) 1004 return; 1005 State = ensureNoFilePositionIndeterminate(StreamVal, C, State); 1006 if (!State) 1007 return; 1008 1009 SymbolRef Sym = StreamVal.getAsSymbol(); 1010 if (Sym && State->get<StreamMap>(Sym)) { 1011 const StreamState *SS = State->get<StreamMap>(Sym); 1012 if (SS->ErrorState & ErrorFEof) 1013 reportFEofWarning(Sym, C, State); 1014 } else { 1015 C.addTransition(State); 1016 } 1017 } 1018 1019 void StreamChecker::preWrite(const FnDescription *Desc, const CallEvent &Call, 1020 CheckerContext &C) const { 1021 ProgramStateRef State = C.getState(); 1022 SVal StreamVal = getStreamArg(Desc, Call); 1023 State = ensureStreamNonNull(StreamVal, Call.getArgExpr(Desc->StreamArgNo), C, 1024 State); 1025 if (!State) 1026 return; 1027 State = ensureStreamOpened(StreamVal, C, State); 1028 if (!State) 1029 return; 1030 State = ensureNoFilePositionIndeterminate(StreamVal, C, State); 1031 if (!State) 1032 return; 1033 1034 C.addTransition(State); 1035 } 1036 1037 static std::optional<QualType> getPointeeType(const MemRegion *R) { 1038 if (!R) 1039 return std::nullopt; 1040 if (const auto *ER = dyn_cast<ElementRegion>(R)) 1041 return ER->getElementType(); 1042 if (const auto *TR = dyn_cast<TypedValueRegion>(R)) 1043 return TR->getValueType(); 1044 if (const auto *SR = dyn_cast<SymbolicRegion>(R)) 1045 return SR->getPointeeStaticType(); 1046 return std::nullopt; 1047 } 1048 1049 static std::optional<NonLoc> getStartIndex(SValBuilder &SVB, 1050 const MemRegion *R) { 1051 if (!R) 1052 return std::nullopt; 1053 1054 auto Zero = [&SVB] { 1055 BasicValueFactory &BVF = SVB.getBasicValueFactory(); 1056 return nonloc::ConcreteInt(BVF.getIntValue(0, /*isUnsigned=*/false)); 1057 }; 1058 1059 if (const auto *ER = dyn_cast<ElementRegion>(R)) 1060 return ER->getIndex(); 1061 if (isa<TypedValueRegion>(R)) 1062 return Zero(); 1063 if (isa<SymbolicRegion>(R)) 1064 return Zero(); 1065 return std::nullopt; 1066 } 1067 1068 static ProgramStateRef 1069 tryToInvalidateFReadBufferByElements(ProgramStateRef State, CheckerContext &C, 1070 const CallEvent &Call, NonLoc SizeVal, 1071 NonLoc NMembVal) { 1072 // Try to invalidate the individual elements. 1073 const auto *Buffer = 1074 dyn_cast_or_null<SubRegion>(Call.getArgSVal(0).getAsRegion()); 1075 1076 std::optional<QualType> ElemTy = getPointeeType(Buffer); 1077 std::optional<SVal> StartElementIndex = 1078 getStartIndex(C.getSValBuilder(), Buffer); 1079 1080 // Drop the outermost ElementRegion to get the buffer. 1081 if (const auto *ER = dyn_cast_or_null<ElementRegion>(Buffer)) 1082 Buffer = dyn_cast<SubRegion>(ER->getSuperRegion()); 1083 1084 std::optional<int64_t> CountVal = getKnownValue(State, NMembVal); 1085 std::optional<int64_t> Size = getKnownValue(State, SizeVal); 1086 std::optional<int64_t> StartIndexVal = 1087 getKnownValue(State, StartElementIndex.value_or(UnknownVal())); 1088 1089 if (ElemTy && CountVal && Size && StartIndexVal) { 1090 int64_t NumBytesRead = Size.value() * CountVal.value(); 1091 int64_t ElemSizeInChars = 1092 C.getASTContext().getTypeSizeInChars(*ElemTy).getQuantity(); 1093 bool IncompleteLastElement = (NumBytesRead % ElemSizeInChars) != 0; 1094 int64_t NumCompleteOrIncompleteElementsRead = 1095 NumBytesRead / ElemSizeInChars + IncompleteLastElement; 1096 1097 constexpr int MaxInvalidatedElementsLimit = 64; 1098 if (NumCompleteOrIncompleteElementsRead <= MaxInvalidatedElementsLimit) { 1099 return escapeByStartIndexAndCount(State, Call, C.blockCount(), Buffer, 1100 *ElemTy, *StartIndexVal, 1101 NumCompleteOrIncompleteElementsRead); 1102 } 1103 } 1104 return nullptr; 1105 } 1106 1107 void StreamChecker::evalFreadFwrite(const FnDescription *Desc, 1108 const CallEvent &Call, CheckerContext &C, 1109 bool IsFread) const { 1110 ProgramStateRef State = C.getState(); 1111 StreamOperationEvaluator E(C); 1112 if (!E.Init(Desc, Call, C, State)) 1113 return; 1114 1115 std::optional<NonLoc> SizeVal = Call.getArgSVal(1).getAs<NonLoc>(); 1116 if (!SizeVal) 1117 return; 1118 std::optional<NonLoc> NMembVal = Call.getArgSVal(2).getAs<NonLoc>(); 1119 if (!NMembVal) 1120 return; 1121 1122 // C'99 standard, §7.19.8.1.3, the return value of fread: 1123 // The fread function returns the number of elements successfully read, which 1124 // may be less than nmemb if a read error or end-of-file is encountered. If 1125 // size or nmemb is zero, fread returns zero and the contents of the array and 1126 // the state of the stream remain unchanged. 1127 if (State->isNull(*SizeVal).isConstrainedTrue() || 1128 State->isNull(*NMembVal).isConstrainedTrue()) { 1129 // This is the "size or nmemb is zero" case. 1130 // Just return 0, do nothing more (not clear the error flags). 1131 C.addTransition(E.bindReturnValue(State, C, 0)); 1132 return; 1133 } 1134 1135 // At read, invalidate the buffer in any case of error or success, 1136 // except if EOF was already present. 1137 if (IsFread && !E.isStreamEof()) { 1138 // Try to invalidate the individual elements. 1139 // Otherwise just fall back to invalidating the whole buffer. 1140 ProgramStateRef InvalidatedState = tryToInvalidateFReadBufferByElements( 1141 State, C, Call, *SizeVal, *NMembVal); 1142 State = 1143 InvalidatedState ? InvalidatedState : escapeArgs(State, C, Call, {0}); 1144 } 1145 1146 // Generate a transition for the success state. 1147 // If we know the state to be FEOF at fread, do not add a success state. 1148 if (!IsFread || !E.isStreamEof()) { 1149 ProgramStateRef StateNotFailed = 1150 State->BindExpr(E.CE, C.getLocationContext(), *NMembVal); 1151 StateNotFailed = 1152 E.setStreamState(StateNotFailed, StreamState::getOpened(Desc)); 1153 C.addTransition(StateNotFailed); 1154 } 1155 1156 // Add transition for the failed state. 1157 // At write, add failure case only if "pedantic mode" is on. 1158 if (!IsFread && !PedanticMode) 1159 return; 1160 1161 NonLoc RetVal = makeRetVal(C, E.CE).castAs<NonLoc>(); 1162 ProgramStateRef StateFailed = 1163 State->BindExpr(E.CE, C.getLocationContext(), RetVal); 1164 StateFailed = E.assumeBinOpNN(StateFailed, BO_LT, RetVal, *NMembVal); 1165 if (!StateFailed) 1166 return; 1167 1168 StreamErrorState NewES; 1169 if (IsFread) 1170 NewES = E.isStreamEof() ? ErrorFEof : ErrorFEof | ErrorFError; 1171 else 1172 NewES = ErrorFError; 1173 // If a (non-EOF) error occurs, the resulting value of the file position 1174 // indicator for the stream is indeterminate. 1175 StateFailed = E.setStreamState( 1176 StateFailed, StreamState::getOpened(Desc, NewES, !NewES.isFEof())); 1177 C.addTransition(StateFailed, E.getFailureNoteTag(this, C)); 1178 } 1179 1180 void StreamChecker::evalFgetx(const FnDescription *Desc, const CallEvent &Call, 1181 CheckerContext &C, bool SingleChar) const { 1182 // `fgetc` returns the read character on success, otherwise returns EOF. 1183 // `fgets` returns the read buffer address on success, otherwise returns NULL. 1184 1185 ProgramStateRef State = C.getState(); 1186 StreamOperationEvaluator E(C); 1187 if (!E.Init(Desc, Call, C, State)) 1188 return; 1189 1190 if (!E.isStreamEof()) { 1191 // If there was already EOF, assume that read buffer is not changed. 1192 // Otherwise it may change at success or failure. 1193 State = escapeArgs(State, C, Call, {0}); 1194 if (SingleChar) { 1195 // Generate a transition for the success state of `fgetc`. 1196 NonLoc RetVal = makeRetVal(C, E.CE).castAs<NonLoc>(); 1197 ProgramStateRef StateNotFailed = 1198 State->BindExpr(E.CE, C.getLocationContext(), RetVal); 1199 // The returned 'unsigned char' of `fgetc` is converted to 'int', 1200 // so we need to check if it is in range [0, 255]. 1201 StateNotFailed = StateNotFailed->assumeInclusiveRange( 1202 RetVal, 1203 E.SVB.getBasicValueFactory().getValue(0, E.ACtx.UnsignedCharTy), 1204 E.SVB.getBasicValueFactory().getMaxValue(E.ACtx.UnsignedCharTy), 1205 true); 1206 if (!StateNotFailed) 1207 return; 1208 C.addTransition(StateNotFailed); 1209 } else { 1210 // Generate a transition for the success state of `fgets`. 1211 std::optional<DefinedSVal> GetBuf = 1212 Call.getArgSVal(0).getAs<DefinedSVal>(); 1213 if (!GetBuf) 1214 return; 1215 ProgramStateRef StateNotFailed = 1216 State->BindExpr(E.CE, C.getLocationContext(), *GetBuf); 1217 StateNotFailed = 1218 E.setStreamState(StateNotFailed, StreamState::getOpened(Desc)); 1219 C.addTransition(StateNotFailed); 1220 } 1221 } 1222 1223 // Add transition for the failed state. 1224 ProgramStateRef StateFailed; 1225 if (SingleChar) 1226 StateFailed = E.bindReturnValue(State, C, *EofVal); 1227 else 1228 StateFailed = E.bindNullReturnValue(State, C); 1229 1230 // If a (non-EOF) error occurs, the resulting value of the file position 1231 // indicator for the stream is indeterminate. 1232 StreamErrorState NewES = 1233 E.isStreamEof() ? ErrorFEof : ErrorFEof | ErrorFError; 1234 StateFailed = E.setStreamState( 1235 StateFailed, StreamState::getOpened(Desc, NewES, !NewES.isFEof())); 1236 C.addTransition(StateFailed, E.getFailureNoteTag(this, C)); 1237 } 1238 1239 void StreamChecker::evalFputx(const FnDescription *Desc, const CallEvent &Call, 1240 CheckerContext &C, bool IsSingleChar) const { 1241 // `fputc` returns the written character on success, otherwise returns EOF. 1242 // `fputs` returns a nonnegative value on success, otherwise returns EOF. 1243 1244 ProgramStateRef State = C.getState(); 1245 StreamOperationEvaluator E(C); 1246 if (!E.Init(Desc, Call, C, State)) 1247 return; 1248 1249 if (IsSingleChar) { 1250 // Generate a transition for the success state of `fputc`. 1251 std::optional<NonLoc> PutVal = Call.getArgSVal(0).getAs<NonLoc>(); 1252 if (!PutVal) 1253 return; 1254 ProgramStateRef StateNotFailed = 1255 State->BindExpr(E.CE, C.getLocationContext(), *PutVal); 1256 StateNotFailed = 1257 E.setStreamState(StateNotFailed, StreamState::getOpened(Desc)); 1258 C.addTransition(StateNotFailed); 1259 } else { 1260 // Generate a transition for the success state of `fputs`. 1261 NonLoc RetVal = makeRetVal(C, E.CE).castAs<NonLoc>(); 1262 ProgramStateRef StateNotFailed = 1263 State->BindExpr(E.CE, C.getLocationContext(), RetVal); 1264 StateNotFailed = 1265 E.assumeBinOpNN(StateNotFailed, BO_GE, RetVal, E.getZeroVal(Call)); 1266 if (!StateNotFailed) 1267 return; 1268 StateNotFailed = 1269 E.setStreamState(StateNotFailed, StreamState::getOpened(Desc)); 1270 C.addTransition(StateNotFailed); 1271 } 1272 1273 if (!PedanticMode) 1274 return; 1275 1276 // Add transition for the failed state. The resulting value of the file 1277 // position indicator for the stream is indeterminate. 1278 ProgramStateRef StateFailed = E.bindReturnValue(State, C, *EofVal); 1279 StateFailed = E.setStreamState( 1280 StateFailed, StreamState::getOpened(Desc, ErrorFError, true)); 1281 C.addTransition(StateFailed, E.getFailureNoteTag(this, C)); 1282 } 1283 1284 void StreamChecker::evalFprintf(const FnDescription *Desc, 1285 const CallEvent &Call, 1286 CheckerContext &C) const { 1287 if (Call.getNumArgs() < 2) 1288 return; 1289 1290 ProgramStateRef State = C.getState(); 1291 StreamOperationEvaluator E(C); 1292 if (!E.Init(Desc, Call, C, State)) 1293 return; 1294 1295 NonLoc RetVal = makeRetVal(C, E.CE).castAs<NonLoc>(); 1296 State = State->BindExpr(E.CE, C.getLocationContext(), RetVal); 1297 auto Cond = 1298 E.SVB 1299 .evalBinOp(State, BO_GE, RetVal, E.SVB.makeZeroVal(E.ACtx.IntTy), 1300 E.SVB.getConditionType()) 1301 .getAs<DefinedOrUnknownSVal>(); 1302 if (!Cond) 1303 return; 1304 ProgramStateRef StateNotFailed, StateFailed; 1305 std::tie(StateNotFailed, StateFailed) = State->assume(*Cond); 1306 1307 StateNotFailed = 1308 E.setStreamState(StateNotFailed, StreamState::getOpened(Desc)); 1309 C.addTransition(StateNotFailed); 1310 1311 if (!PedanticMode) 1312 return; 1313 1314 // Add transition for the failed state. The resulting value of the file 1315 // position indicator for the stream is indeterminate. 1316 StateFailed = E.setStreamState( 1317 StateFailed, StreamState::getOpened(Desc, ErrorFError, true)); 1318 C.addTransition(StateFailed, E.getFailureNoteTag(this, C)); 1319 } 1320 1321 void StreamChecker::evalFscanf(const FnDescription *Desc, const CallEvent &Call, 1322 CheckerContext &C) const { 1323 if (Call.getNumArgs() < 2) 1324 return; 1325 1326 ProgramStateRef State = C.getState(); 1327 StreamOperationEvaluator E(C); 1328 if (!E.Init(Desc, Call, C, State)) 1329 return; 1330 1331 // Add the success state. 1332 // In this context "success" means there is not an EOF or other read error 1333 // before any item is matched in 'fscanf'. But there may be match failure, 1334 // therefore return value can be 0 or greater. 1335 // It is not specified what happens if some items (not all) are matched and 1336 // then EOF or read error happens. Now this case is handled like a "success" 1337 // case, and no error flags are set on the stream. This is probably not 1338 // accurate, and the POSIX documentation does not tell more. 1339 if (!E.isStreamEof()) { 1340 NonLoc RetVal = makeRetVal(C, E.CE).castAs<NonLoc>(); 1341 ProgramStateRef StateNotFailed = 1342 State->BindExpr(E.CE, C.getLocationContext(), RetVal); 1343 StateNotFailed = 1344 E.assumeBinOpNN(StateNotFailed, BO_GE, RetVal, E.getZeroVal(Call)); 1345 if (!StateNotFailed) 1346 return; 1347 1348 if (auto const *Callee = Call.getCalleeIdentifier(); 1349 !Callee || Callee->getName() != "vfscanf") { 1350 SmallVector<unsigned int> EscArgs; 1351 for (auto EscArg : llvm::seq(2u, Call.getNumArgs())) 1352 EscArgs.push_back(EscArg); 1353 StateNotFailed = escapeArgs(StateNotFailed, C, Call, EscArgs); 1354 } 1355 1356 if (StateNotFailed) 1357 C.addTransition(StateNotFailed); 1358 } 1359 1360 // Add transition for the failed state. 1361 // Error occurs if nothing is matched yet and reading the input fails. 1362 // Error can be EOF, or other error. At "other error" FERROR or 'errno' can 1363 // be set but it is not further specified if all are required to be set. 1364 // Documentation does not mention, but file position will be set to 1365 // indeterminate similarly as at 'fread'. 1366 ProgramStateRef StateFailed = E.bindReturnValue(State, C, *EofVal); 1367 StreamErrorState NewES = 1368 E.isStreamEof() ? ErrorFEof : ErrorNone | ErrorFEof | ErrorFError; 1369 StateFailed = E.setStreamState( 1370 StateFailed, StreamState::getOpened(Desc, NewES, !NewES.isFEof())); 1371 C.addTransition(StateFailed, E.getFailureNoteTag(this, C)); 1372 } 1373 1374 void StreamChecker::evalUngetc(const FnDescription *Desc, const CallEvent &Call, 1375 CheckerContext &C) const { 1376 ProgramStateRef State = C.getState(); 1377 StreamOperationEvaluator E(C); 1378 if (!E.Init(Desc, Call, C, State)) 1379 return; 1380 1381 // Generate a transition for the success state. 1382 std::optional<NonLoc> PutVal = Call.getArgSVal(0).getAs<NonLoc>(); 1383 if (!PutVal) 1384 return; 1385 ProgramStateRef StateNotFailed = E.bindReturnValue(State, C, *PutVal); 1386 StateNotFailed = 1387 E.setStreamState(StateNotFailed, StreamState::getOpened(Desc)); 1388 C.addTransition(StateNotFailed); 1389 1390 // Add transition for the failed state. 1391 // Failure of 'ungetc' does not result in feof or ferror state. 1392 // If the PutVal has value of EofVal the function should "fail", but this is 1393 // the same transition as the success state. 1394 // In this case only one state transition is added by the analyzer (the two 1395 // new states may be similar). 1396 ProgramStateRef StateFailed = E.bindReturnValue(State, C, *EofVal); 1397 StateFailed = E.setStreamState(StateFailed, StreamState::getOpened(Desc)); 1398 C.addTransition(StateFailed); 1399 } 1400 1401 void StreamChecker::evalGetdelim(const FnDescription *Desc, 1402 const CallEvent &Call, 1403 CheckerContext &C) const { 1404 ProgramStateRef State = C.getState(); 1405 StreamOperationEvaluator E(C); 1406 if (!E.Init(Desc, Call, C, State)) 1407 return; 1408 1409 // Upon successful completion, the getline() and getdelim() functions shall 1410 // return the number of bytes written into the buffer. 1411 // If the end-of-file indicator for the stream is set, the function shall 1412 // return -1. 1413 // If an error occurs, the function shall return -1 and set 'errno'. 1414 1415 if (!E.isStreamEof()) { 1416 // Escape buffer and size (may change by the call). 1417 // May happen even at error (partial read?). 1418 State = escapeArgs(State, C, Call, {0, 1}); 1419 1420 // Add transition for the successful state. 1421 NonLoc RetVal = makeRetVal(C, E.CE).castAs<NonLoc>(); 1422 ProgramStateRef StateNotFailed = E.bindReturnValue(State, C, RetVal); 1423 StateNotFailed = 1424 E.assumeBinOpNN(StateNotFailed, BO_GE, RetVal, E.getZeroVal(Call)); 1425 1426 // On success, a buffer is allocated. 1427 auto NewLinePtr = getPointeeVal(Call.getArgSVal(0), State); 1428 if (NewLinePtr && isa<DefinedOrUnknownSVal>(*NewLinePtr)) 1429 StateNotFailed = StateNotFailed->assume( 1430 NewLinePtr->castAs<DefinedOrUnknownSVal>(), true); 1431 1432 // The buffer size `*n` must be enough to hold the whole line, and 1433 // greater than the return value, since it has to account for '\0'. 1434 SVal SizePtrSval = Call.getArgSVal(1); 1435 auto NVal = getPointeeVal(SizePtrSval, State); 1436 if (NVal && isa<NonLoc>(*NVal)) { 1437 StateNotFailed = E.assumeBinOpNN(StateNotFailed, BO_GT, 1438 NVal->castAs<NonLoc>(), RetVal); 1439 StateNotFailed = E.bindReturnValue(StateNotFailed, C, RetVal); 1440 } 1441 if (!StateNotFailed) 1442 return; 1443 C.addTransition(StateNotFailed); 1444 } 1445 1446 // Add transition for the failed state. 1447 // If a (non-EOF) error occurs, the resulting value of the file position 1448 // indicator for the stream is indeterminate. 1449 ProgramStateRef StateFailed = E.bindReturnValue(State, C, -1); 1450 StreamErrorState NewES = 1451 E.isStreamEof() ? ErrorFEof : ErrorFEof | ErrorFError; 1452 StateFailed = E.setStreamState( 1453 StateFailed, StreamState::getOpened(Desc, NewES, !NewES.isFEof())); 1454 // On failure, the content of the buffer is undefined. 1455 if (auto NewLinePtr = getPointeeVal(Call.getArgSVal(0), State)) 1456 StateFailed = StateFailed->bindLoc(*NewLinePtr, UndefinedVal(), 1457 C.getLocationContext()); 1458 C.addTransition(StateFailed, E.getFailureNoteTag(this, C)); 1459 } 1460 1461 void StreamChecker::preFseek(const FnDescription *Desc, const CallEvent &Call, 1462 CheckerContext &C) const { 1463 ProgramStateRef State = C.getState(); 1464 SVal StreamVal = getStreamArg(Desc, Call); 1465 State = ensureStreamNonNull(StreamVal, Call.getArgExpr(Desc->StreamArgNo), C, 1466 State); 1467 if (!State) 1468 return; 1469 State = ensureStreamOpened(StreamVal, C, State); 1470 if (!State) 1471 return; 1472 State = ensureFseekWhenceCorrect(Call.getArgSVal(2), C, State); 1473 if (!State) 1474 return; 1475 1476 C.addTransition(State); 1477 } 1478 1479 void StreamChecker::evalFseek(const FnDescription *Desc, const CallEvent &Call, 1480 CheckerContext &C) const { 1481 ProgramStateRef State = C.getState(); 1482 StreamOperationEvaluator E(C); 1483 if (!E.Init(Desc, Call, C, State)) 1484 return; 1485 1486 // Add success state. 1487 ProgramStateRef StateNotFailed = E.bindReturnValue(State, C, 0); 1488 // No failure: Reset the state to opened with no error. 1489 StateNotFailed = 1490 E.setStreamState(StateNotFailed, StreamState::getOpened(Desc)); 1491 C.addTransition(StateNotFailed); 1492 1493 if (!PedanticMode) 1494 return; 1495 1496 // Add failure state. 1497 // At error it is possible that fseek fails but sets none of the error flags. 1498 // If fseek failed, assume that the file position becomes indeterminate in any 1499 // case. 1500 // It is allowed to set the position beyond the end of the file. EOF error 1501 // should not occur. 1502 ProgramStateRef StateFailed = E.bindReturnValue(State, C, -1); 1503 StateFailed = E.setStreamState( 1504 StateFailed, StreamState::getOpened(Desc, ErrorNone | ErrorFError, true)); 1505 C.addTransition(StateFailed, E.getFailureNoteTag(this, C)); 1506 } 1507 1508 void StreamChecker::evalFgetpos(const FnDescription *Desc, 1509 const CallEvent &Call, 1510 CheckerContext &C) const { 1511 ProgramStateRef State = C.getState(); 1512 StreamOperationEvaluator E(C); 1513 if (!E.Init(Desc, Call, C, State)) 1514 return; 1515 1516 ProgramStateRef StateNotFailed, StateFailed; 1517 std::tie(StateFailed, StateNotFailed) = E.makeRetValAndAssumeDual(State, C); 1518 StateNotFailed = escapeArgs(StateNotFailed, C, Call, {1}); 1519 1520 // This function does not affect the stream state. 1521 // Still we add success and failure state with the appropriate return value. 1522 // StdLibraryFunctionsChecker can change these states (set the 'errno' state). 1523 C.addTransition(StateNotFailed); 1524 C.addTransition(StateFailed); 1525 } 1526 1527 void StreamChecker::evalFsetpos(const FnDescription *Desc, 1528 const CallEvent &Call, 1529 CheckerContext &C) const { 1530 ProgramStateRef State = C.getState(); 1531 StreamOperationEvaluator E(C); 1532 if (!E.Init(Desc, Call, C, State)) 1533 return; 1534 1535 ProgramStateRef StateNotFailed, StateFailed; 1536 std::tie(StateFailed, StateNotFailed) = E.makeRetValAndAssumeDual(State, C); 1537 1538 StateNotFailed = E.setStreamState( 1539 StateNotFailed, StreamState::getOpened(Desc, ErrorNone, false)); 1540 C.addTransition(StateNotFailed); 1541 1542 if (!PedanticMode) 1543 return; 1544 1545 // At failure ferror could be set. 1546 // The standards do not tell what happens with the file position at failure. 1547 // But we can assume that it is dangerous to make a next I/O operation after 1548 // the position was not set correctly (similar to 'fseek'). 1549 StateFailed = E.setStreamState( 1550 StateFailed, StreamState::getOpened(Desc, ErrorNone | ErrorFError, true)); 1551 1552 C.addTransition(StateFailed, E.getFailureNoteTag(this, C)); 1553 } 1554 1555 void StreamChecker::evalFtell(const FnDescription *Desc, const CallEvent &Call, 1556 CheckerContext &C) const { 1557 ProgramStateRef State = C.getState(); 1558 StreamOperationEvaluator E(C); 1559 if (!E.Init(Desc, Call, C, State)) 1560 return; 1561 1562 NonLoc RetVal = makeRetVal(C, E.CE).castAs<NonLoc>(); 1563 ProgramStateRef StateNotFailed = 1564 State->BindExpr(E.CE, C.getLocationContext(), RetVal); 1565 StateNotFailed = 1566 E.assumeBinOpNN(StateNotFailed, BO_GE, RetVal, E.getZeroVal(Call)); 1567 if (!StateNotFailed) 1568 return; 1569 1570 ProgramStateRef StateFailed = E.bindReturnValue(State, C, -1); 1571 1572 // This function does not affect the stream state. 1573 // Still we add success and failure state with the appropriate return value. 1574 // StdLibraryFunctionsChecker can change these states (set the 'errno' state). 1575 C.addTransition(StateNotFailed); 1576 C.addTransition(StateFailed); 1577 } 1578 1579 void StreamChecker::evalRewind(const FnDescription *Desc, const CallEvent &Call, 1580 CheckerContext &C) const { 1581 ProgramStateRef State = C.getState(); 1582 StreamOperationEvaluator E(C); 1583 if (!E.Init(Desc, Call, C, State)) 1584 return; 1585 1586 State = 1587 E.setStreamState(State, StreamState::getOpened(Desc, ErrorNone, false)); 1588 C.addTransition(State); 1589 } 1590 1591 void StreamChecker::preFflush(const FnDescription *Desc, const CallEvent &Call, 1592 CheckerContext &C) const { 1593 ProgramStateRef State = C.getState(); 1594 SVal StreamVal = getStreamArg(Desc, Call); 1595 std::optional<DefinedSVal> Stream = StreamVal.getAs<DefinedSVal>(); 1596 if (!Stream) 1597 return; 1598 1599 ProgramStateRef StateNotNull, StateNull; 1600 std::tie(StateNotNull, StateNull) = 1601 C.getConstraintManager().assumeDual(State, *Stream); 1602 if (StateNotNull && !StateNull) 1603 ensureStreamOpened(StreamVal, C, StateNotNull); 1604 } 1605 1606 void StreamChecker::evalFflush(const FnDescription *Desc, const CallEvent &Call, 1607 CheckerContext &C) const { 1608 ProgramStateRef State = C.getState(); 1609 SVal StreamVal = getStreamArg(Desc, Call); 1610 std::optional<DefinedSVal> Stream = StreamVal.getAs<DefinedSVal>(); 1611 if (!Stream) 1612 return; 1613 1614 // Skip if the stream can be both NULL and non-NULL. 1615 ProgramStateRef StateNotNull, StateNull; 1616 std::tie(StateNotNull, StateNull) = 1617 C.getConstraintManager().assumeDual(State, *Stream); 1618 if (StateNotNull && StateNull) 1619 return; 1620 if (StateNotNull && !StateNull) 1621 State = StateNotNull; 1622 else 1623 State = StateNull; 1624 1625 const CallExpr *CE = dyn_cast_or_null<CallExpr>(Call.getOriginExpr()); 1626 if (!CE) 1627 return; 1628 1629 // `fflush` returns EOF on failure, otherwise returns 0. 1630 ProgramStateRef StateFailed = bindInt(*EofVal, State, C, CE); 1631 ProgramStateRef StateNotFailed = bindInt(0, State, C, CE); 1632 1633 // Clear error states if `fflush` returns 0, but retain their EOF flags. 1634 auto ClearErrorInNotFailed = [&StateNotFailed, Desc](SymbolRef Sym, 1635 const StreamState *SS) { 1636 if (SS->ErrorState & ErrorFError) { 1637 StreamErrorState NewES = 1638 (SS->ErrorState & ErrorFEof) ? ErrorFEof : ErrorNone; 1639 StreamState NewSS = StreamState::getOpened(Desc, NewES, false); 1640 StateNotFailed = StateNotFailed->set<StreamMap>(Sym, NewSS); 1641 } 1642 }; 1643 1644 if (StateNotNull && !StateNull) { 1645 // Skip if the input stream's state is unknown, open-failed or closed. 1646 if (SymbolRef StreamSym = StreamVal.getAsSymbol()) { 1647 const StreamState *SS = State->get<StreamMap>(StreamSym); 1648 if (SS) { 1649 assert(SS->isOpened() && "Stream is expected to be opened"); 1650 ClearErrorInNotFailed(StreamSym, SS); 1651 } else 1652 return; 1653 } 1654 } else { 1655 // Clear error states for all streams. 1656 const StreamMapTy &Map = StateNotFailed->get<StreamMap>(); 1657 for (const auto &I : Map) { 1658 SymbolRef Sym = I.first; 1659 const StreamState &SS = I.second; 1660 if (SS.isOpened()) 1661 ClearErrorInNotFailed(Sym, &SS); 1662 } 1663 } 1664 1665 C.addTransition(StateNotFailed); 1666 C.addTransition(StateFailed); 1667 } 1668 1669 void StreamChecker::evalClearerr(const FnDescription *Desc, 1670 const CallEvent &Call, 1671 CheckerContext &C) const { 1672 ProgramStateRef State = C.getState(); 1673 StreamOperationEvaluator E(C); 1674 if (!E.Init(Desc, Call, C, State)) 1675 return; 1676 1677 // FilePositionIndeterminate is not cleared. 1678 State = E.setStreamState( 1679 State, 1680 StreamState::getOpened(Desc, ErrorNone, E.SS->FilePositionIndeterminate)); 1681 C.addTransition(State); 1682 } 1683 1684 void StreamChecker::evalFeofFerror(const FnDescription *Desc, 1685 const CallEvent &Call, CheckerContext &C, 1686 const StreamErrorState &ErrorKind) const { 1687 ProgramStateRef State = C.getState(); 1688 StreamOperationEvaluator E(C); 1689 if (!E.Init(Desc, Call, C, State)) 1690 return; 1691 1692 if (E.SS->ErrorState & ErrorKind) { 1693 // Execution path with error of ErrorKind. 1694 // Function returns true. 1695 // From now on it is the only one error state. 1696 ProgramStateRef TrueState = bindAndAssumeTrue(State, C, E.CE); 1697 C.addTransition(E.setStreamState( 1698 TrueState, StreamState::getOpened(Desc, ErrorKind, 1699 E.SS->FilePositionIndeterminate && 1700 !ErrorKind.isFEof()))); 1701 } 1702 if (StreamErrorState NewES = E.SS->ErrorState & (~ErrorKind)) { 1703 // Execution path(s) with ErrorKind not set. 1704 // Function returns false. 1705 // New error state is everything before minus ErrorKind. 1706 ProgramStateRef FalseState = E.bindReturnValue(State, C, 0); 1707 C.addTransition(E.setStreamState( 1708 FalseState, 1709 StreamState::getOpened( 1710 Desc, NewES, E.SS->FilePositionIndeterminate && !NewES.isFEof()))); 1711 } 1712 } 1713 1714 void StreamChecker::evalFileno(const FnDescription *Desc, const CallEvent &Call, 1715 CheckerContext &C) const { 1716 // Fileno should fail only if the passed pointer is invalid. 1717 // Some of the preconditions are checked already in preDefault. 1718 // Here we can assume that the operation does not fail, because if we 1719 // introduced a separate branch where fileno() returns -1, then it would cause 1720 // many unexpected and unwanted warnings in situations where fileno() is 1721 // called on valid streams. 1722 // The stream error states are not modified by 'fileno', and 'errno' is also 1723 // left unchanged (so this evalCall does not invalidate it, but we have a 1724 // custom evalCall instead of the default that would invalidate it). 1725 ProgramStateRef State = C.getState(); 1726 StreamOperationEvaluator E(C); 1727 if (!E.Init(Desc, Call, C, State)) 1728 return; 1729 1730 NonLoc RetVal = makeRetVal(C, E.CE).castAs<NonLoc>(); 1731 State = State->BindExpr(E.CE, C.getLocationContext(), RetVal); 1732 State = E.assumeBinOpNN(State, BO_GE, RetVal, E.getZeroVal(Call)); 1733 if (!State) 1734 return; 1735 1736 C.addTransition(State); 1737 } 1738 1739 void StreamChecker::preDefault(const FnDescription *Desc, const CallEvent &Call, 1740 CheckerContext &C) const { 1741 ProgramStateRef State = C.getState(); 1742 SVal StreamVal = getStreamArg(Desc, Call); 1743 State = ensureStreamNonNull(StreamVal, Call.getArgExpr(Desc->StreamArgNo), C, 1744 State); 1745 if (!State) 1746 return; 1747 State = ensureStreamOpened(StreamVal, C, State); 1748 if (!State) 1749 return; 1750 1751 C.addTransition(State); 1752 } 1753 1754 void StreamChecker::evalSetFeofFerror(const FnDescription *Desc, 1755 const CallEvent &Call, CheckerContext &C, 1756 const StreamErrorState &ErrorKind, 1757 bool Indeterminate) const { 1758 ProgramStateRef State = C.getState(); 1759 SymbolRef StreamSym = getStreamArg(Desc, Call).getAsSymbol(); 1760 assert(StreamSym && "Operation not permitted on non-symbolic stream value."); 1761 const StreamState *SS = State->get<StreamMap>(StreamSym); 1762 assert(SS && "Stream should be tracked by the checker."); 1763 State = State->set<StreamMap>( 1764 StreamSym, 1765 StreamState::getOpened(SS->LastOperation, ErrorKind, Indeterminate)); 1766 C.addTransition(State); 1767 } 1768 1769 ProgramStateRef 1770 StreamChecker::ensureStreamNonNull(SVal StreamVal, const Expr *StreamE, 1771 CheckerContext &C, 1772 ProgramStateRef State) const { 1773 auto Stream = StreamVal.getAs<DefinedSVal>(); 1774 if (!Stream) 1775 return State; 1776 1777 ConstraintManager &CM = C.getConstraintManager(); 1778 1779 ProgramStateRef StateNotNull, StateNull; 1780 std::tie(StateNotNull, StateNull) = CM.assumeDual(State, *Stream); 1781 1782 if (!StateNotNull && StateNull) { 1783 if (ExplodedNode *N = C.generateErrorNode(StateNull)) { 1784 auto R = std::make_unique<PathSensitiveBugReport>( 1785 BT_FileNull, "Stream pointer might be NULL.", N); 1786 if (StreamE) 1787 bugreporter::trackExpressionValue(N, StreamE, *R); 1788 C.emitReport(std::move(R)); 1789 } 1790 return nullptr; 1791 } 1792 1793 return StateNotNull; 1794 } 1795 1796 ProgramStateRef StreamChecker::ensureStreamOpened(SVal StreamVal, 1797 CheckerContext &C, 1798 ProgramStateRef State) const { 1799 SymbolRef Sym = StreamVal.getAsSymbol(); 1800 if (!Sym) 1801 return State; 1802 1803 const StreamState *SS = State->get<StreamMap>(Sym); 1804 if (!SS) 1805 return State; 1806 1807 if (SS->isClosed()) { 1808 // Using a stream pointer after 'fclose' causes undefined behavior 1809 // according to cppreference.com . 1810 ExplodedNode *N = C.generateErrorNode(); 1811 if (N) { 1812 C.emitReport(std::make_unique<PathSensitiveBugReport>( 1813 BT_UseAfterClose, 1814 "Stream might be already closed. Causes undefined behaviour.", N)); 1815 return nullptr; 1816 } 1817 1818 return State; 1819 } 1820 1821 if (SS->isOpenFailed()) { 1822 // Using a stream that has failed to open is likely to cause problems. 1823 // This should usually not occur because stream pointer is NULL. 1824 // But freopen can cause a state when stream pointer remains non-null but 1825 // failed to open. 1826 ExplodedNode *N = C.generateErrorNode(); 1827 if (N) { 1828 C.emitReport(std::make_unique<PathSensitiveBugReport>( 1829 BT_UseAfterOpenFailed, 1830 "Stream might be invalid after " 1831 "(re-)opening it has failed. " 1832 "Can cause undefined behaviour.", 1833 N)); 1834 return nullptr; 1835 } 1836 } 1837 1838 return State; 1839 } 1840 1841 ProgramStateRef StreamChecker::ensureNoFilePositionIndeterminate( 1842 SVal StreamVal, CheckerContext &C, ProgramStateRef State) const { 1843 static const char *BugMessage = 1844 "File position of the stream might be 'indeterminate' " 1845 "after a failed operation. " 1846 "Can cause undefined behavior."; 1847 1848 SymbolRef Sym = StreamVal.getAsSymbol(); 1849 if (!Sym) 1850 return State; 1851 1852 const StreamState *SS = State->get<StreamMap>(Sym); 1853 if (!SS) 1854 return State; 1855 1856 assert(SS->isOpened() && "First ensure that stream is opened."); 1857 1858 if (SS->FilePositionIndeterminate) { 1859 if (SS->ErrorState & ErrorFEof) { 1860 // The error is unknown but may be FEOF. 1861 // Continue analysis with the FEOF error state. 1862 // Report warning because the other possible error states. 1863 ExplodedNode *N = C.generateNonFatalErrorNode(State); 1864 if (!N) 1865 return nullptr; 1866 1867 auto R = std::make_unique<PathSensitiveBugReport>( 1868 BT_IndeterminatePosition, BugMessage, N); 1869 R->markInteresting(Sym); 1870 C.emitReport(std::move(R)); 1871 return State->set<StreamMap>( 1872 Sym, StreamState::getOpened(SS->LastOperation, ErrorFEof, false)); 1873 } 1874 1875 // Known or unknown error state without FEOF possible. 1876 // Stop analysis, report error. 1877 if (ExplodedNode *N = C.generateErrorNode(State)) { 1878 auto R = std::make_unique<PathSensitiveBugReport>( 1879 BT_IndeterminatePosition, BugMessage, N); 1880 R->markInteresting(Sym); 1881 C.emitReport(std::move(R)); 1882 } 1883 1884 return nullptr; 1885 } 1886 1887 return State; 1888 } 1889 1890 ProgramStateRef 1891 StreamChecker::ensureFseekWhenceCorrect(SVal WhenceVal, CheckerContext &C, 1892 ProgramStateRef State) const { 1893 std::optional<nonloc::ConcreteInt> CI = 1894 WhenceVal.getAs<nonloc::ConcreteInt>(); 1895 if (!CI) 1896 return State; 1897 1898 int64_t X = CI->getValue().getSExtValue(); 1899 if (X == SeekSetVal || X == SeekCurVal || X == SeekEndVal) 1900 return State; 1901 1902 if (ExplodedNode *N = C.generateNonFatalErrorNode(State)) { 1903 C.emitReport(std::make_unique<PathSensitiveBugReport>( 1904 BT_IllegalWhence, 1905 "The whence argument to fseek() should be " 1906 "SEEK_SET, SEEK_END, or SEEK_CUR.", 1907 N)); 1908 return nullptr; 1909 } 1910 1911 return State; 1912 } 1913 1914 void StreamChecker::reportFEofWarning(SymbolRef StreamSym, CheckerContext &C, 1915 ProgramStateRef State) const { 1916 if (ExplodedNode *N = C.generateNonFatalErrorNode(State)) { 1917 auto R = std::make_unique<PathSensitiveBugReport>( 1918 BT_StreamEof, 1919 "Read function called when stream is in EOF state. " 1920 "Function has no effect.", 1921 N); 1922 R->markInteresting(StreamSym); 1923 C.emitReport(std::move(R)); 1924 return; 1925 } 1926 C.addTransition(State); 1927 } 1928 1929 ExplodedNode * 1930 StreamChecker::reportLeaks(const SmallVector<SymbolRef, 2> &LeakedSyms, 1931 CheckerContext &C, ExplodedNode *Pred) const { 1932 ExplodedNode *Err = C.generateNonFatalErrorNode(C.getState(), Pred); 1933 if (!Err) 1934 return Pred; 1935 1936 for (SymbolRef LeakSym : LeakedSyms) { 1937 // Resource leaks can result in multiple warning that describe the same kind 1938 // of programming error: 1939 // void f() { 1940 // FILE *F = fopen("a.txt"); 1941 // if (rand()) // state split 1942 // return; // warning 1943 // } // warning 1944 // While this isn't necessarily true (leaking the same stream could result 1945 // from a different kinds of errors), the reduction in redundant reports 1946 // makes this a worthwhile heuristic. 1947 // FIXME: Add a checker option to turn this uniqueing feature off. 1948 const ExplodedNode *StreamOpenNode = getAcquisitionSite(Err, LeakSym, C); 1949 assert(StreamOpenNode && "Could not find place of stream opening."); 1950 1951 PathDiagnosticLocation LocUsedForUniqueing; 1952 if (const Stmt *StreamStmt = StreamOpenNode->getStmtForDiagnostics()) 1953 LocUsedForUniqueing = PathDiagnosticLocation::createBegin( 1954 StreamStmt, C.getSourceManager(), 1955 StreamOpenNode->getLocationContext()); 1956 1957 std::unique_ptr<PathSensitiveBugReport> R = 1958 std::make_unique<PathSensitiveBugReport>( 1959 BT_ResourceLeak, 1960 "Opened stream never closed. Potential resource leak.", Err, 1961 LocUsedForUniqueing, 1962 StreamOpenNode->getLocationContext()->getDecl()); 1963 R->markInteresting(LeakSym); 1964 R->addVisitor<NoStreamStateChangeVisitor>(LeakSym, this); 1965 C.emitReport(std::move(R)); 1966 } 1967 1968 return Err; 1969 } 1970 1971 void StreamChecker::checkDeadSymbols(SymbolReaper &SymReaper, 1972 CheckerContext &C) const { 1973 ProgramStateRef State = C.getState(); 1974 1975 llvm::SmallVector<SymbolRef, 2> LeakedSyms; 1976 1977 const StreamMapTy &Map = State->get<StreamMap>(); 1978 for (const auto &I : Map) { 1979 SymbolRef Sym = I.first; 1980 const StreamState &SS = I.second; 1981 if (!SymReaper.isDead(Sym)) 1982 continue; 1983 if (SS.isOpened()) 1984 LeakedSyms.push_back(Sym); 1985 State = State->remove<StreamMap>(Sym); 1986 } 1987 1988 ExplodedNode *N = C.getPredecessor(); 1989 if (!LeakedSyms.empty()) 1990 N = reportLeaks(LeakedSyms, C, N); 1991 1992 C.addTransition(State, N); 1993 } 1994 1995 ProgramStateRef StreamChecker::checkPointerEscape( 1996 ProgramStateRef State, const InvalidatedSymbols &Escaped, 1997 const CallEvent *Call, PointerEscapeKind Kind) const { 1998 // Check for file-handling system call that is not handled by the checker. 1999 // FIXME: The checker should be updated to handle all system calls that take 2000 // 'FILE*' argument. These are now ignored. 2001 if (Kind == PSK_DirectEscapeOnCall && Call->isInSystemHeader()) 2002 return State; 2003 2004 for (SymbolRef Sym : Escaped) { 2005 // The symbol escaped. 2006 // From now the stream can be manipulated in unknown way to the checker, 2007 // it is not possible to handle it any more. 2008 // Optimistically, assume that the corresponding file handle will be closed 2009 // somewhere else. 2010 // Remove symbol from state so the following stream calls on this symbol are 2011 // not handled by the checker. 2012 State = State->remove<StreamMap>(Sym); 2013 } 2014 return State; 2015 } 2016 2017 //===----------------------------------------------------------------------===// 2018 // Checker registration. 2019 //===----------------------------------------------------------------------===// 2020 2021 void ento::registerStreamChecker(CheckerManager &Mgr) { 2022 auto *Checker = Mgr.registerChecker<StreamChecker>(); 2023 Checker->PedanticMode = 2024 Mgr.getAnalyzerOptions().getCheckerBooleanOption(Checker, "Pedantic"); 2025 } 2026 2027 bool ento::shouldRegisterStreamChecker(const CheckerManager &Mgr) { 2028 return true; 2029 } 2030 2031 void ento::registerStreamTesterChecker(CheckerManager &Mgr) { 2032 auto *Checker = Mgr.getChecker<StreamChecker>(); 2033 Checker->TestMode = true; 2034 } 2035 2036 bool ento::shouldRegisterStreamTesterChecker(const CheckerManager &Mgr) { 2037 return true; 2038 } 2039