1//= UnixAPIChecker.h - Checks preconditions for various Unix APIs --*- C++ -*-// 2// 3// The LLVM Compiler Infrastructure 4// 5// This file is distributed under the University of Illinois Open Source 6// License. See LICENSE.TXT for details. 7// 8//===----------------------------------------------------------------------===// 9// 10// This defines UnixAPIChecker, which is an assortment of checks on calls 11// to various, widely used UNIX/Posix functions. 12// 13//===----------------------------------------------------------------------===// 14 15#include "ClangSACheckers.h" 16#include "clang/Basic/TargetInfo.h" 17#include "clang/StaticAnalyzer/Core/BugReporter/BugType.h" 18#include "clang/StaticAnalyzer/Core/Checker.h" 19#include "clang/StaticAnalyzer/Core/CheckerManager.h" 20#include "clang/StaticAnalyzer/Core/PathSensitive/CheckerContext.h" 21#include "llvm/ADT/Optional.h" 22#include "llvm/ADT/STLExtras.h" 23#include "llvm/ADT/SmallString.h" 24#include "llvm/ADT/StringSwitch.h" 25#include "llvm/Support/raw_ostream.h" 26#include <fcntl.h> 27 28using namespace clang; 29using namespace ento; 30 31namespace { 32class UnixAPIChecker : public Checker< check::PreStmt<CallExpr> > { 33 mutable OwningPtr<BugType> BT_open, BT_pthreadOnce, BT_mallocZero; 34 mutable Optional<uint64_t> Val_O_CREAT; 35 36public: 37 void checkPreStmt(const CallExpr *CE, CheckerContext &C) const; 38 39 void CheckOpen(CheckerContext &C, const CallExpr *CE) const; 40 void CheckPthreadOnce(CheckerContext &C, const CallExpr *CE) const; 41 void CheckCallocZero(CheckerContext &C, const CallExpr *CE) const; 42 void CheckMallocZero(CheckerContext &C, const CallExpr *CE) const; 43 void CheckReallocZero(CheckerContext &C, const CallExpr *CE) const; 44 void CheckReallocfZero(CheckerContext &C, const CallExpr *CE) const; 45 void CheckAllocaZero(CheckerContext &C, const CallExpr *CE) const; 46 void CheckVallocZero(CheckerContext &C, const CallExpr *CE) const; 47 48 typedef void (UnixAPIChecker::*SubChecker)(CheckerContext &, 49 const CallExpr *) const; 50private: 51 bool ReportZeroByteAllocation(CheckerContext &C, 52 ProgramStateRef falseState, 53 const Expr *arg, 54 const char *fn_name) const; 55 void BasicAllocationCheck(CheckerContext &C, 56 const CallExpr *CE, 57 const unsigned numArgs, 58 const unsigned sizeArg, 59 const char *fn) const; 60}; 61} //end anonymous namespace 62 63//===----------------------------------------------------------------------===// 64// Utility functions. 65//===----------------------------------------------------------------------===// 66 67static inline void LazyInitialize(OwningPtr<BugType> &BT, 68 const char *name) { 69 if (BT) 70 return; 71 BT.reset(new BugType(name, categories::UnixAPI)); 72} 73 74//===----------------------------------------------------------------------===// 75// "open" (man 2 open) 76//===----------------------------------------------------------------------===// 77 78void UnixAPIChecker::CheckOpen(CheckerContext &C, const CallExpr *CE) const { 79 // The definition of O_CREAT is platform specific. We need a better way 80 // of querying this information from the checking environment. 81 if (!Val_O_CREAT.hasValue()) { 82 if (C.getASTContext().getTargetInfo().getTriple().getVendor() 83 == llvm::Triple::Apple) 84 Val_O_CREAT = 0x0200; 85 else { 86 // FIXME: We need a more general way of getting the O_CREAT value. 87 // We could possibly grovel through the preprocessor state, but 88 // that would require passing the Preprocessor object to the ExprEngine. 89 return; 90 } 91 } 92 93 // Look at the 'oflags' argument for the O_CREAT flag. 94 ProgramStateRef state = C.getState(); 95 96 if (CE->getNumArgs() < 2) { 97 // The frontend should issue a warning for this case, so this is a sanity 98 // check. 99 return; 100 } 101 102 // Now check if oflags has O_CREAT set. 103 const Expr *oflagsEx = CE->getArg(1); 104 const SVal V = state->getSVal(oflagsEx, C.getLocationContext()); 105 if (!V.getAs<NonLoc>()) { 106 // The case where 'V' can be a location can only be due to a bad header, 107 // so in this case bail out. 108 return; 109 } 110 NonLoc oflags = V.castAs<NonLoc>(); 111 NonLoc ocreateFlag = C.getSValBuilder() 112 .makeIntVal(Val_O_CREAT.getValue(), oflagsEx->getType()).castAs<NonLoc>(); 113 SVal maskedFlagsUC = C.getSValBuilder().evalBinOpNN(state, BO_And, 114 oflags, ocreateFlag, 115 oflagsEx->getType()); 116 if (maskedFlagsUC.isUnknownOrUndef()) 117 return; 118 DefinedSVal maskedFlags = maskedFlagsUC.castAs<DefinedSVal>(); 119 120 // Check if maskedFlags is non-zero. 121 ProgramStateRef trueState, falseState; 122 llvm::tie(trueState, falseState) = state->assume(maskedFlags); 123 124 // Only emit an error if the value of 'maskedFlags' is properly 125 // constrained; 126 if (!(trueState && !falseState)) 127 return; 128 129 if (CE->getNumArgs() < 3) { 130 ExplodedNode *N = C.generateSink(trueState); 131 if (!N) 132 return; 133 134 LazyInitialize(BT_open, "Improper use of 'open'"); 135 136 BugReport *report = 137 new BugReport(*BT_open, 138 "Call to 'open' requires a third argument when " 139 "the 'O_CREAT' flag is set", N); 140 report->addRange(oflagsEx->getSourceRange()); 141 C.emitReport(report); 142 } 143} 144 145//===----------------------------------------------------------------------===// 146// pthread_once 147//===----------------------------------------------------------------------===// 148 149void UnixAPIChecker::CheckPthreadOnce(CheckerContext &C, 150 const CallExpr *CE) const { 151 152 // This is similar to 'CheckDispatchOnce' in the MacOSXAPIChecker. 153 // They can possibly be refactored. 154 155 if (CE->getNumArgs() < 1) 156 return; 157 158 // Check if the first argument is stack allocated. If so, issue a warning 159 // because that's likely to be bad news. 160 ProgramStateRef state = C.getState(); 161 const MemRegion *R = 162 state->getSVal(CE->getArg(0), C.getLocationContext()).getAsRegion(); 163 if (!R || !isa<StackSpaceRegion>(R->getMemorySpace())) 164 return; 165 166 ExplodedNode *N = C.generateSink(state); 167 if (!N) 168 return; 169 170 SmallString<256> S; 171 llvm::raw_svector_ostream os(S); 172 os << "Call to 'pthread_once' uses"; 173 if (const VarRegion *VR = dyn_cast<VarRegion>(R)) 174 os << " the local variable '" << VR->getDecl()->getName() << '\''; 175 else 176 os << " stack allocated memory"; 177 os << " for the \"control\" value. Using such transient memory for " 178 "the control value is potentially dangerous."; 179 if (isa<VarRegion>(R) && isa<StackLocalsSpaceRegion>(R->getMemorySpace())) 180 os << " Perhaps you intended to declare the variable as 'static'?"; 181 182 LazyInitialize(BT_pthreadOnce, "Improper use of 'pthread_once'"); 183 184 BugReport *report = new BugReport(*BT_pthreadOnce, os.str(), N); 185 report->addRange(CE->getArg(0)->getSourceRange()); 186 C.emitReport(report); 187} 188 189//===----------------------------------------------------------------------===// 190// "calloc", "malloc", "realloc", "reallocf", "alloca" and "valloc" 191// with allocation size 0 192//===----------------------------------------------------------------------===// 193// FIXME: Eventually these should be rolled into the MallocChecker, but right now 194// they're more basic and valuable for widespread use. 195 196// Returns true if we try to do a zero byte allocation, false otherwise. 197// Fills in trueState and falseState. 198static bool IsZeroByteAllocation(ProgramStateRef state, 199 const SVal argVal, 200 ProgramStateRef *trueState, 201 ProgramStateRef *falseState) { 202 llvm::tie(*trueState, *falseState) = 203 state->assume(argVal.castAs<DefinedSVal>()); 204 205 return (*falseState && !*trueState); 206} 207 208// Generates an error report, indicating that the function whose name is given 209// will perform a zero byte allocation. 210// Returns false if an error occured, true otherwise. 211bool UnixAPIChecker::ReportZeroByteAllocation(CheckerContext &C, 212 ProgramStateRef falseState, 213 const Expr *arg, 214 const char *fn_name) const { 215 ExplodedNode *N = C.generateSink(falseState); 216 if (!N) 217 return false; 218 219 LazyInitialize(BT_mallocZero, 220 "Undefined allocation of 0 bytes (CERT MEM04-C; CWE-131)"); 221 222 SmallString<256> S; 223 llvm::raw_svector_ostream os(S); 224 os << "Call to '" << fn_name << "' has an allocation size of 0 bytes"; 225 BugReport *report = new BugReport(*BT_mallocZero, os.str(), N); 226 227 report->addRange(arg->getSourceRange()); 228 bugreporter::trackNullOrUndefValue(N, arg, *report); 229 C.emitReport(report); 230 231 return true; 232} 233 234// Does a basic check for 0-sized allocations suitable for most of the below 235// functions (modulo "calloc") 236void UnixAPIChecker::BasicAllocationCheck(CheckerContext &C, 237 const CallExpr *CE, 238 const unsigned numArgs, 239 const unsigned sizeArg, 240 const char *fn) const { 241 // Sanity check for the correct number of arguments 242 if (CE->getNumArgs() != numArgs) 243 return; 244 245 // Check if the allocation size is 0. 246 ProgramStateRef state = C.getState(); 247 ProgramStateRef trueState = NULL, falseState = NULL; 248 const Expr *arg = CE->getArg(sizeArg); 249 SVal argVal = state->getSVal(arg, C.getLocationContext()); 250 251 if (argVal.isUnknownOrUndef()) 252 return; 253 254 // Is the value perfectly constrained to zero? 255 if (IsZeroByteAllocation(state, argVal, &trueState, &falseState)) { 256 (void) ReportZeroByteAllocation(C, falseState, arg, fn); 257 return; 258 } 259 // Assume the value is non-zero going forward. 260 assert(trueState); 261 if (trueState != state) 262 C.addTransition(trueState); 263} 264 265void UnixAPIChecker::CheckCallocZero(CheckerContext &C, 266 const CallExpr *CE) const { 267 unsigned int nArgs = CE->getNumArgs(); 268 if (nArgs != 2) 269 return; 270 271 ProgramStateRef state = C.getState(); 272 ProgramStateRef trueState = NULL, falseState = NULL; 273 274 unsigned int i; 275 for (i = 0; i < nArgs; i++) { 276 const Expr *arg = CE->getArg(i); 277 SVal argVal = state->getSVal(arg, C.getLocationContext()); 278 if (argVal.isUnknownOrUndef()) { 279 if (i == 0) 280 continue; 281 else 282 return; 283 } 284 285 if (IsZeroByteAllocation(state, argVal, &trueState, &falseState)) { 286 if (ReportZeroByteAllocation(C, falseState, arg, "calloc")) 287 return; 288 else if (i == 0) 289 continue; 290 else 291 return; 292 } 293 } 294 295 // Assume the value is non-zero going forward. 296 assert(trueState); 297 if (trueState != state) 298 C.addTransition(trueState); 299} 300 301void UnixAPIChecker::CheckMallocZero(CheckerContext &C, 302 const CallExpr *CE) const { 303 BasicAllocationCheck(C, CE, 1, 0, "malloc"); 304} 305 306void UnixAPIChecker::CheckReallocZero(CheckerContext &C, 307 const CallExpr *CE) const { 308 BasicAllocationCheck(C, CE, 2, 1, "realloc"); 309} 310 311void UnixAPIChecker::CheckReallocfZero(CheckerContext &C, 312 const CallExpr *CE) const { 313 BasicAllocationCheck(C, CE, 2, 1, "reallocf"); 314} 315 316void UnixAPIChecker::CheckAllocaZero(CheckerContext &C, 317 const CallExpr *CE) const { 318 BasicAllocationCheck(C, CE, 1, 0, "alloca"); 319} 320 321void UnixAPIChecker::CheckVallocZero(CheckerContext &C, 322 const CallExpr *CE) const { 323 BasicAllocationCheck(C, CE, 1, 0, "valloc"); 324} 325 326 327//===----------------------------------------------------------------------===// 328// Central dispatch function. 329//===----------------------------------------------------------------------===// 330 331void UnixAPIChecker::checkPreStmt(const CallExpr *CE, 332 CheckerContext &C) const { 333 const FunctionDecl *FD = C.getCalleeDecl(CE); 334 if (!FD || FD->getKind() != Decl::Function) 335 return; 336 337 StringRef FName = C.getCalleeName(FD); 338 if (FName.empty()) 339 return; 340 341 SubChecker SC = 342 llvm::StringSwitch<SubChecker>(FName) 343 .Case("open", &UnixAPIChecker::CheckOpen) 344 .Case("pthread_once", &UnixAPIChecker::CheckPthreadOnce) 345 .Case("calloc", &UnixAPIChecker::CheckCallocZero) 346 .Case("malloc", &UnixAPIChecker::CheckMallocZero) 347 .Case("realloc", &UnixAPIChecker::CheckReallocZero) 348 .Case("reallocf", &UnixAPIChecker::CheckReallocfZero) 349 .Cases("alloca", "__builtin_alloca", &UnixAPIChecker::CheckAllocaZero) 350 .Case("valloc", &UnixAPIChecker::CheckVallocZero) 351 .Default(NULL); 352 353 if (SC) 354 (this->*SC)(C, CE); 355} 356 357//===----------------------------------------------------------------------===// 358// Registration. 359//===----------------------------------------------------------------------===// 360 361void ento::registerUnixAPIChecker(CheckerManager &mgr) { 362 mgr.registerChecker<UnixAPIChecker>(); 363} 364