1 //= UnixAPIChecker.h - Checks preconditions for various Unix APIs --*- C++ -*-// 2 // 3 // The LLVM Compiler Infrastructure 4 // 5 // This file is distributed under the University of Illinois Open Source 6 // License. See LICENSE.TXT for details. 7 // 8 //===----------------------------------------------------------------------===// 9 // 10 // This defines UnixAPIChecker, which is an assortment of checks on calls 11 // to various, widely used UNIX/Posix functions. 12 // 13 //===----------------------------------------------------------------------===// 14 15 #include "ClangSACheckers.h" 16 #include "clang/StaticAnalyzer/Core/Checker.h" 17 #include "clang/StaticAnalyzer/Core/CheckerManager.h" 18 #include "clang/StaticAnalyzer/Core/PathSensitive/CheckerContext.h" 19 #include "clang/StaticAnalyzer/Core/BugReporter/BugType.h" 20 #include "clang/Basic/TargetInfo.h" 21 #include "llvm/ADT/Optional.h" 22 #include "llvm/ADT/StringSwitch.h" 23 #include <fcntl.h> 24 25 using namespace clang; 26 using namespace ento; 27 using llvm::Optional; 28 29 namespace { 30 class UnixAPIChecker : public Checker< check::PreStmt<CallExpr> > { 31 mutable llvm::OwningPtr<BugType> BT_open, BT_pthreadOnce, BT_mallocZero; 32 mutable Optional<uint64_t> Val_O_CREAT; 33 34 public: 35 void checkPreStmt(const CallExpr *CE, CheckerContext &C) const; 36 37 void CheckOpen(CheckerContext &C, const CallExpr *CE) const; 38 void CheckPthreadOnce(CheckerContext &C, const CallExpr *CE) const; 39 void CheckCallocZero(CheckerContext &C, const CallExpr *CE) const; 40 void CheckMallocZero(CheckerContext &C, const CallExpr *CE) const; 41 void CheckReallocZero(CheckerContext &C, const CallExpr *CE) const; 42 43 typedef void (UnixAPIChecker::*SubChecker)(CheckerContext &, 44 const CallExpr *) const; 45 private: 46 bool ReportZeroByteAllocation(CheckerContext &C, 47 const ProgramState *falseState, 48 const Expr *arg, 49 const char *fn_name) const; 50 }; 51 } //end anonymous namespace 52 53 //===----------------------------------------------------------------------===// 54 // Utility functions. 55 //===----------------------------------------------------------------------===// 56 57 static inline void LazyInitialize(llvm::OwningPtr<BugType> &BT, 58 const char *name) { 59 if (BT) 60 return; 61 BT.reset(new BugType(name, "Unix API")); 62 } 63 64 //===----------------------------------------------------------------------===// 65 // "open" (man 2 open) 66 //===----------------------------------------------------------------------===// 67 68 void UnixAPIChecker::CheckOpen(CheckerContext &C, const CallExpr *CE) const { 69 // The definition of O_CREAT is platform specific. We need a better way 70 // of querying this information from the checking environment. 71 if (!Val_O_CREAT.hasValue()) { 72 if (C.getASTContext().getTargetInfo().getTriple().getVendor() 73 == llvm::Triple::Apple) 74 Val_O_CREAT = 0x0200; 75 else { 76 // FIXME: We need a more general way of getting the O_CREAT value. 77 // We could possibly grovel through the preprocessor state, but 78 // that would require passing the Preprocessor object to the ExprEngine. 79 return; 80 } 81 } 82 83 // Look at the 'oflags' argument for the O_CREAT flag. 84 const ProgramState *state = C.getState(); 85 86 if (CE->getNumArgs() < 2) { 87 // The frontend should issue a warning for this case, so this is a sanity 88 // check. 89 return; 90 } 91 92 // Now check if oflags has O_CREAT set. 93 const Expr *oflagsEx = CE->getArg(1); 94 const SVal V = state->getSVal(oflagsEx, C.getLocationContext()); 95 if (!isa<NonLoc>(V)) { 96 // The case where 'V' can be a location can only be due to a bad header, 97 // so in this case bail out. 98 return; 99 } 100 NonLoc oflags = cast<NonLoc>(V); 101 NonLoc ocreateFlag = 102 cast<NonLoc>(C.getSValBuilder().makeIntVal(Val_O_CREAT.getValue(), 103 oflagsEx->getType())); 104 SVal maskedFlagsUC = C.getSValBuilder().evalBinOpNN(state, BO_And, 105 oflags, ocreateFlag, 106 oflagsEx->getType()); 107 if (maskedFlagsUC.isUnknownOrUndef()) 108 return; 109 DefinedSVal maskedFlags = cast<DefinedSVal>(maskedFlagsUC); 110 111 // Check if maskedFlags is non-zero. 112 const ProgramState *trueState, *falseState; 113 llvm::tie(trueState, falseState) = state->assume(maskedFlags); 114 115 // Only emit an error if the value of 'maskedFlags' is properly 116 // constrained; 117 if (!(trueState && !falseState)) 118 return; 119 120 if (CE->getNumArgs() < 3) { 121 ExplodedNode *N = C.generateSink(trueState); 122 if (!N) 123 return; 124 125 LazyInitialize(BT_open, "Improper use of 'open'"); 126 127 BugReport *report = 128 new BugReport(*BT_open, 129 "Call to 'open' requires a third argument when " 130 "the 'O_CREAT' flag is set", N); 131 report->addRange(oflagsEx->getSourceRange()); 132 C.EmitReport(report); 133 } 134 } 135 136 //===----------------------------------------------------------------------===// 137 // pthread_once 138 //===----------------------------------------------------------------------===// 139 140 void UnixAPIChecker::CheckPthreadOnce(CheckerContext &C, 141 const CallExpr *CE) const { 142 143 // This is similar to 'CheckDispatchOnce' in the MacOSXAPIChecker. 144 // They can possibly be refactored. 145 146 if (CE->getNumArgs() < 1) 147 return; 148 149 // Check if the first argument is stack allocated. If so, issue a warning 150 // because that's likely to be bad news. 151 const ProgramState *state = C.getState(); 152 const MemRegion *R = 153 state->getSVal(CE->getArg(0), C.getLocationContext()).getAsRegion(); 154 if (!R || !isa<StackSpaceRegion>(R->getMemorySpace())) 155 return; 156 157 ExplodedNode *N = C.generateSink(state); 158 if (!N) 159 return; 160 161 llvm::SmallString<256> S; 162 llvm::raw_svector_ostream os(S); 163 os << "Call to 'pthread_once' uses"; 164 if (const VarRegion *VR = dyn_cast<VarRegion>(R)) 165 os << " the local variable '" << VR->getDecl()->getName() << '\''; 166 else 167 os << " stack allocated memory"; 168 os << " for the \"control\" value. Using such transient memory for " 169 "the control value is potentially dangerous."; 170 if (isa<VarRegion>(R) && isa<StackLocalsSpaceRegion>(R->getMemorySpace())) 171 os << " Perhaps you intended to declare the variable as 'static'?"; 172 173 LazyInitialize(BT_pthreadOnce, "Improper use of 'pthread_once'"); 174 175 BugReport *report = new BugReport(*BT_pthreadOnce, os.str(), N); 176 report->addRange(CE->getArg(0)->getSourceRange()); 177 C.EmitReport(report); 178 } 179 180 //===----------------------------------------------------------------------===// 181 // "calloc", "malloc" and "realloc" with allocation size 0 182 //===----------------------------------------------------------------------===// 183 184 // Returns true if we try to do a zero byte allocation, false otherwise. 185 // Fills in trueState and falseState. 186 static bool IsZeroByteAllocation(const ProgramState *state, 187 const SVal argVal, 188 const ProgramState **trueState, 189 const ProgramState **falseState) { 190 llvm::tie(*trueState, *falseState) = state->assume(cast<DefinedSVal>(argVal)); 191 return (*falseState && !*trueState); 192 } 193 194 // Generates an error report, indicating that the function whose name is given 195 // will perform a zero byte allocation. 196 // Returns false if an error occured, true otherwise. 197 bool UnixAPIChecker::ReportZeroByteAllocation(CheckerContext &C, 198 const ProgramState *falseState, 199 const Expr *arg, 200 const char *fn_name) const { 201 ExplodedNode *N = C.generateSink(falseState); 202 if (!N) 203 return false; 204 205 // FIXME: Add reference to CERT advisory, and/or C99 standard in bug 206 // output. 207 LazyInitialize(BT_mallocZero, "Undefined allocation of 0 bytes"); 208 209 llvm::SmallString<256> S; 210 llvm::raw_svector_ostream os(S); 211 os << "Call to '" << fn_name << "' has an allocation size of 0 bytes"; 212 BugReport *report = new BugReport(*BT_mallocZero, os.str(), N); 213 214 report->addRange(arg->getSourceRange()); 215 report->addVisitor(bugreporter::getTrackNullOrUndefValueVisitor(N, arg)); 216 C.EmitReport(report); 217 218 return true; 219 } 220 221 void UnixAPIChecker::CheckCallocZero(CheckerContext &C, 222 const CallExpr *CE) const { 223 unsigned int nArgs = CE->getNumArgs(); 224 if (nArgs != 2) 225 return; 226 227 const ProgramState *state = C.getState(); 228 const ProgramState *trueState = NULL, *falseState = NULL; 229 230 unsigned int i; 231 for (i = 0; i < nArgs; i++) { 232 const Expr *arg = CE->getArg(i); 233 SVal argVal = state->getSVal(arg, C.getLocationContext()); 234 if (argVal.isUnknownOrUndef()) { 235 if (i == 0) 236 continue; 237 else 238 return; 239 } 240 241 if (IsZeroByteAllocation(state, argVal, &trueState, &falseState)) { 242 if (ReportZeroByteAllocation(C, falseState, arg, "calloc")) 243 return; 244 else if (i == 0) 245 continue; 246 else 247 return; 248 } 249 } 250 251 // Assume the the value is non-zero going forward. 252 assert(trueState); 253 if (trueState != state) 254 C.addTransition(trueState); 255 } 256 257 // FIXME: Eventually this should be rolled into the MallocChecker, but this 258 // check is more basic and is valuable for widespread use. 259 void UnixAPIChecker::CheckMallocZero(CheckerContext &C, 260 const CallExpr *CE) const { 261 // Sanity check that malloc takes one argument. 262 if (CE->getNumArgs() != 1) 263 return; 264 265 // Check if the allocation size is 0. 266 const ProgramState *state = C.getState(); 267 const ProgramState *trueState = NULL, *falseState = NULL; 268 const Expr *arg = CE->getArg(0); 269 SVal argVal = state->getSVal(arg, C.getLocationContext()); 270 271 if (argVal.isUnknownOrUndef()) 272 return; 273 274 // Is the value perfectly constrained to zero? 275 if (IsZeroByteAllocation(state, argVal, &trueState, &falseState)) { 276 (void) ReportZeroByteAllocation(C, falseState, arg, "malloc"); 277 return; 278 } 279 // Assume the the value is non-zero going forward. 280 assert(trueState); 281 if (trueState != state) 282 C.addTransition(trueState); 283 } 284 285 void UnixAPIChecker::CheckReallocZero(CheckerContext &C, 286 const CallExpr *CE) const { 287 if (CE->getNumArgs() != 2) 288 return; 289 290 const ProgramState *state = C.getState(); 291 const ProgramState *trueState = NULL, *falseState = NULL; 292 const Expr *arg = CE->getArg(1); 293 SVal argVal = state->getSVal(arg, C.getLocationContext()); 294 295 if (argVal.isUnknownOrUndef()) 296 return; 297 298 if (IsZeroByteAllocation(state, argVal, &trueState, &falseState)) { 299 ReportZeroByteAllocation(C, falseState, arg, "realloc"); 300 return; 301 } 302 303 // Assume the the value is non-zero going forward. 304 assert(trueState); 305 if (trueState != state) 306 C.addTransition(trueState); 307 } 308 309 //===----------------------------------------------------------------------===// 310 // Central dispatch function. 311 //===----------------------------------------------------------------------===// 312 313 void UnixAPIChecker::checkPreStmt(const CallExpr *CE, CheckerContext &C) const { 314 StringRef FName = C.getCalleeName(CE); 315 if (FName.empty()) 316 return; 317 318 SubChecker SC = 319 llvm::StringSwitch<SubChecker>(FName) 320 .Case("open", &UnixAPIChecker::CheckOpen) 321 .Case("pthread_once", &UnixAPIChecker::CheckPthreadOnce) 322 .Case("calloc", &UnixAPIChecker::CheckCallocZero) 323 .Case("malloc", &UnixAPIChecker::CheckMallocZero) 324 .Case("realloc", &UnixAPIChecker::CheckReallocZero) 325 .Default(NULL); 326 327 if (SC) 328 (this->*SC)(C, CE); 329 } 330 331 //===----------------------------------------------------------------------===// 332 // Registration. 333 //===----------------------------------------------------------------------===// 334 335 void ento::registerUnixAPIChecker(CheckerManager &mgr) { 336 mgr.registerChecker<UnixAPIChecker>(); 337 } 338