1 //== ValistChecker.cpp - stdarg.h macro usage checker -----------*- C++ -*--==// 2 // 3 // The LLVM Compiler Infrastructure 4 // 5 // This file is distributed under the University of Illinois Open Source 6 // License. See LICENSE.TXT for details. 7 // 8 //===----------------------------------------------------------------------===// 9 // 10 // This defines checkers which detect usage of uninitialized va_list values 11 // and va_start calls with no matching va_end. 12 // 13 //===----------------------------------------------------------------------===// 14 15 #include "ClangSACheckers.h" 16 #include "clang/StaticAnalyzer/Core/BugReporter/BugType.h" 17 #include "clang/StaticAnalyzer/Core/Checker.h" 18 #include "clang/StaticAnalyzer/Core/CheckerManager.h" 19 #include "clang/StaticAnalyzer/Core/PathSensitive/CallEvent.h" 20 #include "clang/StaticAnalyzer/Core/PathSensitive/CheckerContext.h" 21 22 using namespace clang; 23 using namespace ento; 24 25 REGISTER_SET_WITH_PROGRAMSTATE(InitializedVALists, const MemRegion *) 26 27 namespace { 28 typedef SmallVector<const MemRegion *, 2> RegionVector; 29 30 class ValistChecker : public Checker<check::PreCall, check::PreStmt<VAArgExpr>, 31 check::DeadSymbols> { 32 mutable std::unique_ptr<BugType> BT_leakedvalist, BT_uninitaccess; 33 34 struct VAListAccepter { 35 CallDescription Func; 36 int VAListPos; 37 }; 38 static const SmallVector<VAListAccepter, 15> VAListAccepters; 39 static const CallDescription VaStart, VaEnd, VaCopy; 40 41 public: 42 enum CheckKind { 43 CK_Uninitialized, 44 CK_Unterminated, 45 CK_CopyToSelf, 46 CK_NumCheckKinds 47 }; 48 49 DefaultBool ChecksEnabled[CK_NumCheckKinds]; 50 CheckName CheckNames[CK_NumCheckKinds]; 51 52 void checkPreStmt(const VAArgExpr *VAA, CheckerContext &C) const; 53 void checkPreCall(const CallEvent &Call, CheckerContext &C) const; 54 void checkDeadSymbols(SymbolReaper &SR, CheckerContext &C) const; 55 56 private: 57 const MemRegion *getVAListAsRegion(SVal SV, const Expr *VAExpr, 58 bool &IsSymbolic, CheckerContext &C) const; 59 StringRef getVariableNameFromRegion(const MemRegion *Reg) const; 60 const ExplodedNode *getStartCallSite(const ExplodedNode *N, 61 const MemRegion *Reg) const; 62 63 void reportUninitializedAccess(const MemRegion *VAList, StringRef Msg, 64 CheckerContext &C) const; 65 void reportLeakedVALists(const RegionVector &LeakedVALists, StringRef Msg1, 66 StringRef Msg2, CheckerContext &C, ExplodedNode *N, 67 bool ForceReport = false) const; 68 69 void checkVAListStartCall(const CallEvent &Call, CheckerContext &C, 70 bool IsCopy) const; 71 void checkVAListEndCall(const CallEvent &Call, CheckerContext &C) const; 72 73 class ValistBugVisitor : public BugReporterVisitorImpl<ValistBugVisitor> { 74 public: 75 ValistBugVisitor(const MemRegion *Reg, bool IsLeak = false) 76 : Reg(Reg), IsLeak(IsLeak) {} 77 void Profile(llvm::FoldingSetNodeID &ID) const override { 78 static int X = 0; 79 ID.AddPointer(&X); 80 ID.AddPointer(Reg); 81 } 82 std::unique_ptr<PathDiagnosticPiece> 83 getEndPath(BugReporterContext &BRC, const ExplodedNode *EndPathNode, 84 BugReport &BR) override { 85 if (!IsLeak) 86 return nullptr; 87 88 PathDiagnosticLocation L = PathDiagnosticLocation::createEndOfPath( 89 EndPathNode, BRC.getSourceManager()); 90 // Do not add the statement itself as a range in case of leak. 91 return llvm::make_unique<PathDiagnosticEventPiece>(L, BR.getDescription(), 92 false); 93 } 94 std::shared_ptr<PathDiagnosticPiece> VisitNode(const ExplodedNode *N, 95 const ExplodedNode *PrevN, 96 BugReporterContext &BRC, 97 BugReport &BR) override; 98 99 private: 100 const MemRegion *Reg; 101 bool IsLeak; 102 }; 103 }; 104 105 const SmallVector<ValistChecker::VAListAccepter, 15> 106 ValistChecker::VAListAccepters = { 107 {{"vfprintf", 3}, 2}, 108 {{"vfscanf", 3}, 2}, 109 {{"vprintf", 2}, 1}, 110 {{"vscanf", 2}, 1}, 111 {{"vsnprintf", 4}, 3}, 112 {{"vsprintf", 3}, 2}, 113 {{"vsscanf", 3}, 2}, 114 {{"vfwprintf", 3}, 2}, 115 {{"vfwscanf", 3}, 2}, 116 {{"vwprintf", 2}, 1}, 117 {{"vwscanf", 2}, 1}, 118 {{"vswprintf", 4}, 3}, 119 // vswprintf is the wide version of vsnprintf, 120 // vsprintf has no wide version 121 {{"vswscanf", 3}, 2}}; 122 const CallDescription ValistChecker::VaStart("__builtin_va_start", 2), 123 ValistChecker::VaCopy("__builtin_va_copy", 2), 124 ValistChecker::VaEnd("__builtin_va_end", 1); 125 } // end anonymous namespace 126 127 void ValistChecker::checkPreCall(const CallEvent &Call, 128 CheckerContext &C) const { 129 if (!Call.isGlobalCFunction()) 130 return; 131 if (Call.isCalled(VaStart)) 132 checkVAListStartCall(Call, C, false); 133 else if (Call.isCalled(VaCopy)) 134 checkVAListStartCall(Call, C, true); 135 else if (Call.isCalled(VaEnd)) 136 checkVAListEndCall(Call, C); 137 else { 138 for (auto FuncInfo : VAListAccepters) { 139 if (!Call.isCalled(FuncInfo.Func)) 140 continue; 141 bool Symbolic; 142 const MemRegion *VAList = 143 getVAListAsRegion(Call.getArgSVal(FuncInfo.VAListPos), 144 Call.getArgExpr(FuncInfo.VAListPos), Symbolic, C); 145 if (!VAList) 146 return; 147 148 if (C.getState()->contains<InitializedVALists>(VAList)) 149 return; 150 151 // We did not see va_start call, but the source of the region is unknown. 152 // Be conservative and assume the best. 153 if (Symbolic) 154 return; 155 156 SmallString<80> Errmsg("Function '"); 157 Errmsg += FuncInfo.Func.getFunctionName(); 158 Errmsg += "' is called with an uninitialized va_list argument"; 159 reportUninitializedAccess(VAList, Errmsg.c_str(), C); 160 break; 161 } 162 } 163 } 164 165 const MemRegion *ValistChecker::getVAListAsRegion(SVal SV, const Expr *E, 166 bool &IsSymbolic, 167 CheckerContext &C) const { 168 const MemRegion *Reg = SV.getAsRegion(); 169 if (!Reg) 170 return nullptr; 171 // TODO: In the future this should be abstracted away by the analyzer. 172 bool VaListModelledAsArray = false; 173 if (const auto *Cast = dyn_cast<CastExpr>(E)) { 174 QualType Ty = Cast->getType(); 175 VaListModelledAsArray = 176 Ty->isPointerType() && Ty->getPointeeType()->isRecordType(); 177 } 178 if (const auto *DeclReg = Reg->getAs<DeclRegion>()) { 179 if (isa<ParmVarDecl>(DeclReg->getDecl())) 180 Reg = C.getState()->getSVal(SV.castAs<Loc>()).getAsRegion(); 181 } 182 IsSymbolic = Reg && Reg->getAs<SymbolicRegion>(); 183 // Some VarRegion based VA lists reach here as ElementRegions. 184 const auto *EReg = dyn_cast_or_null<ElementRegion>(Reg); 185 return (EReg && VaListModelledAsArray) ? EReg->getSuperRegion() : Reg; 186 } 187 188 void ValistChecker::checkPreStmt(const VAArgExpr *VAA, 189 CheckerContext &C) const { 190 ProgramStateRef State = C.getState(); 191 const Expr *VASubExpr = VAA->getSubExpr(); 192 SVal VAListSVal = State->getSVal(VASubExpr, C.getLocationContext()); 193 bool Symbolic; 194 const MemRegion *VAList = 195 getVAListAsRegion(VAListSVal, VASubExpr, Symbolic, C); 196 if (!VAList) 197 return; 198 if (Symbolic) 199 return; 200 if (!State->contains<InitializedVALists>(VAList)) 201 reportUninitializedAccess( 202 VAList, "va_arg() is called on an uninitialized va_list", C); 203 } 204 205 void ValistChecker::checkDeadSymbols(SymbolReaper &SR, 206 CheckerContext &C) const { 207 ProgramStateRef State = C.getState(); 208 InitializedVAListsTy TrackedVALists = State->get<InitializedVALists>(); 209 RegionVector LeakedVALists; 210 for (auto Reg : TrackedVALists) { 211 if (SR.isLiveRegion(Reg)) 212 continue; 213 LeakedVALists.push_back(Reg); 214 State = State->remove<InitializedVALists>(Reg); 215 } 216 if (ExplodedNode *N = C.addTransition(State)) 217 reportLeakedVALists(LeakedVALists, "Initialized va_list", " is leaked", C, 218 N); 219 } 220 221 // This function traverses the exploded graph backwards and finds the node where 222 // the va_list is initialized. That node is used for uniquing the bug paths. 223 // It is not likely that there are several different va_lists that belongs to 224 // different stack frames, so that case is not yet handled. 225 const ExplodedNode * 226 ValistChecker::getStartCallSite(const ExplodedNode *N, 227 const MemRegion *Reg) const { 228 const LocationContext *LeakContext = N->getLocationContext(); 229 const ExplodedNode *StartCallNode = N; 230 231 bool FoundInitializedState = false; 232 233 while (N) { 234 ProgramStateRef State = N->getState(); 235 if (!State->contains<InitializedVALists>(Reg)) { 236 if (FoundInitializedState) 237 break; 238 } else { 239 FoundInitializedState = true; 240 } 241 const LocationContext *NContext = N->getLocationContext(); 242 if (NContext == LeakContext || NContext->isParentOf(LeakContext)) 243 StartCallNode = N; 244 N = N->pred_empty() ? nullptr : *(N->pred_begin()); 245 } 246 247 return StartCallNode; 248 } 249 250 void ValistChecker::reportUninitializedAccess(const MemRegion *VAList, 251 StringRef Msg, 252 CheckerContext &C) const { 253 if (!ChecksEnabled[CK_Uninitialized]) 254 return; 255 if (ExplodedNode *N = C.generateErrorNode()) { 256 if (!BT_uninitaccess) 257 BT_uninitaccess.reset(new BugType(CheckNames[CK_Uninitialized], 258 "Uninitialized va_list", 259 "Memory Error")); 260 auto R = llvm::make_unique<BugReport>(*BT_uninitaccess, Msg, N); 261 R->markInteresting(VAList); 262 R->addVisitor(llvm::make_unique<ValistBugVisitor>(VAList)); 263 C.emitReport(std::move(R)); 264 } 265 } 266 267 void ValistChecker::reportLeakedVALists(const RegionVector &LeakedVALists, 268 StringRef Msg1, StringRef Msg2, 269 CheckerContext &C, ExplodedNode *N, 270 bool ForceReport) const { 271 if (!(ChecksEnabled[CK_Unterminated] || 272 (ChecksEnabled[CK_Uninitialized] && ForceReport))) 273 return; 274 for (auto Reg : LeakedVALists) { 275 if (!BT_leakedvalist) { 276 BT_leakedvalist.reset(new BugType(CheckNames[CK_Unterminated], 277 "Leaked va_list", "Memory Error")); 278 BT_leakedvalist->setSuppressOnSink(true); 279 } 280 281 const ExplodedNode *StartNode = getStartCallSite(N, Reg); 282 PathDiagnosticLocation LocUsedForUniqueing; 283 284 if (const Stmt *StartCallStmt = PathDiagnosticLocation::getStmt(StartNode)) 285 LocUsedForUniqueing = PathDiagnosticLocation::createBegin( 286 StartCallStmt, C.getSourceManager(), StartNode->getLocationContext()); 287 288 SmallString<100> Buf; 289 llvm::raw_svector_ostream OS(Buf); 290 OS << Msg1; 291 std::string VariableName = Reg->getDescriptiveName(); 292 if (!VariableName.empty()) 293 OS << " " << VariableName; 294 OS << Msg2; 295 296 auto R = llvm::make_unique<BugReport>( 297 *BT_leakedvalist, OS.str(), N, LocUsedForUniqueing, 298 StartNode->getLocationContext()->getDecl()); 299 R->markInteresting(Reg); 300 R->addVisitor(llvm::make_unique<ValistBugVisitor>(Reg, true)); 301 C.emitReport(std::move(R)); 302 } 303 } 304 305 void ValistChecker::checkVAListStartCall(const CallEvent &Call, 306 CheckerContext &C, bool IsCopy) const { 307 bool Symbolic; 308 const MemRegion *VAList = 309 getVAListAsRegion(Call.getArgSVal(0), Call.getArgExpr(0), Symbolic, C); 310 if (!VAList) 311 return; 312 313 ProgramStateRef State = C.getState(); 314 315 if (IsCopy) { 316 const MemRegion *Arg2 = 317 getVAListAsRegion(Call.getArgSVal(1), Call.getArgExpr(1), Symbolic, C); 318 if (Arg2) { 319 if (ChecksEnabled[CK_CopyToSelf] && VAList == Arg2) { 320 RegionVector LeakedVALists{VAList}; 321 if (ExplodedNode *N = C.addTransition(State)) 322 reportLeakedVALists(LeakedVALists, "va_list", 323 " is copied onto itself", C, N, true); 324 return; 325 } else if (!State->contains<InitializedVALists>(Arg2) && !Symbolic) { 326 if (State->contains<InitializedVALists>(VAList)) { 327 State = State->remove<InitializedVALists>(VAList); 328 RegionVector LeakedVALists{VAList}; 329 if (ExplodedNode *N = C.addTransition(State)) 330 reportLeakedVALists(LeakedVALists, "Initialized va_list", 331 " is overwritten by an uninitialized one", C, N, 332 true); 333 } else { 334 reportUninitializedAccess(Arg2, "Uninitialized va_list is copied", C); 335 } 336 return; 337 } 338 } 339 } 340 if (State->contains<InitializedVALists>(VAList)) { 341 RegionVector LeakedVALists{VAList}; 342 if (ExplodedNode *N = C.addTransition(State)) 343 reportLeakedVALists(LeakedVALists, "Initialized va_list", 344 " is initialized again", C, N); 345 return; 346 } 347 348 State = State->add<InitializedVALists>(VAList); 349 C.addTransition(State); 350 } 351 352 void ValistChecker::checkVAListEndCall(const CallEvent &Call, 353 CheckerContext &C) const { 354 bool Symbolic; 355 const MemRegion *VAList = 356 getVAListAsRegion(Call.getArgSVal(0), Call.getArgExpr(0), Symbolic, C); 357 if (!VAList) 358 return; 359 360 // We did not see va_start call, but the source of the region is unknown. 361 // Be conservative and assume the best. 362 if (Symbolic) 363 return; 364 365 if (!C.getState()->contains<InitializedVALists>(VAList)) { 366 reportUninitializedAccess( 367 VAList, "va_end() is called on an uninitialized va_list", C); 368 return; 369 } 370 ProgramStateRef State = C.getState(); 371 State = State->remove<InitializedVALists>(VAList); 372 C.addTransition(State); 373 } 374 375 std::shared_ptr<PathDiagnosticPiece> ValistChecker::ValistBugVisitor::VisitNode( 376 const ExplodedNode *N, const ExplodedNode *PrevN, BugReporterContext &BRC, 377 BugReport &BR) { 378 ProgramStateRef State = N->getState(); 379 ProgramStateRef StatePrev = PrevN->getState(); 380 381 const Stmt *S = PathDiagnosticLocation::getStmt(N); 382 if (!S) 383 return nullptr; 384 385 StringRef Msg; 386 if (State->contains<InitializedVALists>(Reg) && 387 !StatePrev->contains<InitializedVALists>(Reg)) 388 Msg = "Initialized va_list"; 389 else if (!State->contains<InitializedVALists>(Reg) && 390 StatePrev->contains<InitializedVALists>(Reg)) 391 Msg = "Ended va_list"; 392 393 if (Msg.empty()) 394 return nullptr; 395 396 PathDiagnosticLocation Pos(S, BRC.getSourceManager(), 397 N->getLocationContext()); 398 return std::make_shared<PathDiagnosticEventPiece>(Pos, Msg, true); 399 } 400 401 #define REGISTER_CHECKER(name) \ 402 void ento::register##name##Checker(CheckerManager &mgr) { \ 403 ValistChecker *checker = mgr.registerChecker<ValistChecker>(); \ 404 checker->ChecksEnabled[ValistChecker::CK_##name] = true; \ 405 checker->CheckNames[ValistChecker::CK_##name] = mgr.getCurrentCheckName(); \ 406 } 407 408 REGISTER_CHECKER(Uninitialized) 409 REGISTER_CHECKER(Unterminated) 410 REGISTER_CHECKER(CopyToSelf) 411