CStringChecker.cpp revision 793bff3fb7ca2a31e81aa7f4f3f21f921459010b
1//= CStringChecker.h - Checks calls to C string functions ----------*- C++ -*-// 2// 3// The LLVM Compiler Infrastructure 4// 5// This file is distributed under the University of Illinois Open Source 6// License. See LICENSE.TXT for details. 7// 8//===----------------------------------------------------------------------===// 9// 10// This defines CStringChecker, which is an assortment of checks on calls 11// to functions in <string.h>. 12// 13//===----------------------------------------------------------------------===// 14 15#include "ClangSACheckers.h" 16#include "clang/StaticAnalyzer/Core/Checker.h" 17#include "clang/StaticAnalyzer/Core/CheckerManager.h" 18#include "clang/StaticAnalyzer/Core/PathSensitive/CheckerContext.h" 19#include "clang/StaticAnalyzer/Core/BugReporter/BugType.h" 20#include "clang/StaticAnalyzer/Core/PathSensitive/GRStateTrait.h" 21#include "llvm/ADT/StringSwitch.h" 22 23using namespace clang; 24using namespace ento; 25 26namespace { 27class CStringChecker : public Checker< eval::Call, 28 check::PreStmt<DeclStmt>, 29 check::LiveSymbols, 30 check::DeadSymbols, 31 check::RegionChanges 32 > { 33 mutable llvm::OwningPtr<BugType> BT_Null, BT_Bounds, BT_BoundsWrite, 34 BT_Overlap, BT_NotCString; 35public: 36 static void *getTag() { static int tag; return &tag; } 37 38 bool evalCall(const CallExpr *CE, CheckerContext &C) const; 39 void checkPreStmt(const DeclStmt *DS, CheckerContext &C) const; 40 void checkLiveSymbols(const GRState *state, SymbolReaper &SR) const; 41 void checkDeadSymbols(SymbolReaper &SR, CheckerContext &C) const; 42 bool wantsRegionChangeUpdate(const GRState *state) const; 43 44 const GRState *checkRegionChanges(const GRState *state, 45 const StoreManager::InvalidatedSymbols *, 46 const MemRegion * const *Begin, 47 const MemRegion * const *End) const; 48 49 typedef void (CStringChecker::*FnCheck)(CheckerContext &, 50 const CallExpr *) const; 51 52 void evalMemcpy(CheckerContext &C, const CallExpr *CE) const; 53 void evalMempcpy(CheckerContext &C, const CallExpr *CE) const; 54 void evalMemmove(CheckerContext &C, const CallExpr *CE) const; 55 void evalBcopy(CheckerContext &C, const CallExpr *CE) const; 56 void evalCopyCommon(CheckerContext &C, const CallExpr *CE, 57 const GRState *state, 58 const Expr *Size, const Expr *Source, const Expr *Dest, 59 bool Restricted = false, 60 bool IsMempcpy = false) const; 61 62 void evalMemcmp(CheckerContext &C, const CallExpr *CE) const; 63 64 void evalstrLength(CheckerContext &C, const CallExpr *CE) const; 65 void evalstrnLength(CheckerContext &C, const CallExpr *CE) const; 66 void evalstrLengthCommon(CheckerContext &C, const CallExpr *CE, 67 bool IsStrnlen = false) const; 68 69 void evalStrcpy(CheckerContext &C, const CallExpr *CE) const; 70 void evalStrncpy(CheckerContext &C, const CallExpr *CE) const; 71 void evalStpcpy(CheckerContext &C, const CallExpr *CE) const; 72 void evalStrcpyCommon(CheckerContext &C, const CallExpr *CE, bool returnEnd, 73 bool isBounded, bool isAppending) const; 74 75 void evalStrcat(CheckerContext &C, const CallExpr *CE) const; 76 void evalStrncat(CheckerContext &C, const CallExpr *CE) const; 77 78 void evalStrcmp(CheckerContext &C, const CallExpr *CE) const; 79 void evalStrncmp(CheckerContext &C, const CallExpr *CE) const; 80 void evalStrcasecmp(CheckerContext &C, const CallExpr *CE) const; 81 void evalStrncasecmp(CheckerContext &C, const CallExpr *CE) const; 82 void evalStrcmpCommon(CheckerContext &C, const CallExpr *CE, 83 bool isBounded = false, bool ignoreCase = false) const; 84 85 // Utility methods 86 std::pair<const GRState*, const GRState*> 87 static assumeZero(CheckerContext &C, 88 const GRState *state, SVal V, QualType Ty); 89 90 static const GRState *setCStringLength(const GRState *state, 91 const MemRegion *MR, SVal strLength); 92 static SVal getCStringLengthForRegion(CheckerContext &C, 93 const GRState *&state, 94 const Expr *Ex, const MemRegion *MR); 95 SVal getCStringLength(CheckerContext &C, const GRState *&state, 96 const Expr *Ex, SVal Buf) const; 97 98 const StringLiteral *getCStringLiteral(CheckerContext &C, 99 const GRState *&state, 100 const Expr *expr, 101 SVal val) const; 102 103 static const GRState *InvalidateBuffer(CheckerContext &C, 104 const GRState *state, 105 const Expr *Ex, SVal V); 106 107 static bool SummarizeRegion(llvm::raw_ostream& os, ASTContext& Ctx, 108 const MemRegion *MR); 109 110 // Re-usable checks 111 const GRState *checkNonNull(CheckerContext &C, const GRState *state, 112 const Expr *S, SVal l) const; 113 const GRState *CheckLocation(CheckerContext &C, const GRState *state, 114 const Expr *S, SVal l, 115 bool IsDestination = false) const; 116 const GRState *CheckBufferAccess(CheckerContext &C, const GRState *state, 117 const Expr *Size, 118 const Expr *FirstBuf, 119 const Expr *SecondBuf = NULL, 120 bool FirstIsDestination = false) const; 121 const GRState *CheckOverlap(CheckerContext &C, const GRState *state, 122 const Expr *Size, const Expr *First, 123 const Expr *Second) const; 124 void emitOverlapBug(CheckerContext &C, const GRState *state, 125 const Stmt *First, const Stmt *Second) const; 126}; 127 128class CStringLength { 129public: 130 typedef llvm::ImmutableMap<const MemRegion *, SVal> EntryMap; 131}; 132} //end anonymous namespace 133 134namespace clang { 135namespace ento { 136 template <> 137 struct GRStateTrait<CStringLength> 138 : public GRStatePartialTrait<CStringLength::EntryMap> { 139 static void *GDMIndex() { return CStringChecker::getTag(); } 140 }; 141} 142} 143 144//===----------------------------------------------------------------------===// 145// Individual checks and utility methods. 146//===----------------------------------------------------------------------===// 147 148std::pair<const GRState*, const GRState*> 149CStringChecker::assumeZero(CheckerContext &C, const GRState *state, SVal V, 150 QualType Ty) { 151 DefinedSVal *val = dyn_cast<DefinedSVal>(&V); 152 if (!val) 153 return std::pair<const GRState*, const GRState *>(state, state); 154 155 SValBuilder &svalBuilder = C.getSValBuilder(); 156 DefinedOrUnknownSVal zero = svalBuilder.makeZeroVal(Ty); 157 return state->assume(svalBuilder.evalEQ(state, *val, zero)); 158} 159 160const GRState *CStringChecker::checkNonNull(CheckerContext &C, 161 const GRState *state, 162 const Expr *S, SVal l) const { 163 // If a previous check has failed, propagate the failure. 164 if (!state) 165 return NULL; 166 167 const GRState *stateNull, *stateNonNull; 168 llvm::tie(stateNull, stateNonNull) = assumeZero(C, state, l, S->getType()); 169 170 if (stateNull && !stateNonNull) { 171 ExplodedNode *N = C.generateSink(stateNull); 172 if (!N) 173 return NULL; 174 175 if (!BT_Null) 176 BT_Null.reset(new BuiltinBug("API", 177 "Null pointer argument in call to byte string function")); 178 179 // Generate a report for this bug. 180 BuiltinBug *BT = static_cast<BuiltinBug*>(BT_Null.get()); 181 EnhancedBugReport *report = new EnhancedBugReport(*BT, 182 BT->getDescription(), N); 183 184 report->addRange(S->getSourceRange()); 185 report->addVisitorCreator(bugreporter::registerTrackNullOrUndefValue, S); 186 C.EmitReport(report); 187 return NULL; 188 } 189 190 // From here on, assume that the value is non-null. 191 assert(stateNonNull); 192 return stateNonNull; 193} 194 195// FIXME: This was originally copied from ArrayBoundChecker.cpp. Refactor? 196const GRState *CStringChecker::CheckLocation(CheckerContext &C, 197 const GRState *state, 198 const Expr *S, SVal l, 199 bool IsDestination) const { 200 // If a previous check has failed, propagate the failure. 201 if (!state) 202 return NULL; 203 204 // Check for out of bound array element access. 205 const MemRegion *R = l.getAsRegion(); 206 if (!R) 207 return state; 208 209 const ElementRegion *ER = dyn_cast<ElementRegion>(R); 210 if (!ER) 211 return state; 212 213 assert(ER->getValueType() == C.getASTContext().CharTy && 214 "CheckLocation should only be called with char* ElementRegions"); 215 216 // Get the size of the array. 217 const SubRegion *superReg = cast<SubRegion>(ER->getSuperRegion()); 218 SValBuilder &svalBuilder = C.getSValBuilder(); 219 SVal Extent = svalBuilder.convertToArrayIndex(superReg->getExtent(svalBuilder)); 220 DefinedOrUnknownSVal Size = cast<DefinedOrUnknownSVal>(Extent); 221 222 // Get the index of the accessed element. 223 DefinedOrUnknownSVal Idx = cast<DefinedOrUnknownSVal>(ER->getIndex()); 224 225 const GRState *StInBound = state->assumeInBound(Idx, Size, true); 226 const GRState *StOutBound = state->assumeInBound(Idx, Size, false); 227 if (StOutBound && !StInBound) { 228 ExplodedNode *N = C.generateSink(StOutBound); 229 if (!N) 230 return NULL; 231 232 BuiltinBug *BT; 233 if (IsDestination) { 234 if (!BT_BoundsWrite) { 235 BT_BoundsWrite.reset(new BuiltinBug("Out-of-bound array access", 236 "Byte string function overflows destination buffer")); 237 } 238 BT = static_cast<BuiltinBug*>(BT_BoundsWrite.get()); 239 } else { 240 if (!BT_Bounds) { 241 BT_Bounds.reset(new BuiltinBug("Out-of-bound array access", 242 "Byte string function accesses out-of-bound array element")); 243 } 244 BT = static_cast<BuiltinBug*>(BT_Bounds.get()); 245 } 246 247 // FIXME: It would be nice to eventually make this diagnostic more clear, 248 // e.g., by referencing the original declaration or by saying *why* this 249 // reference is outside the range. 250 251 // Generate a report for this bug. 252 RangedBugReport *report = new RangedBugReport(*BT, BT->getDescription(), N); 253 254 report->addRange(S->getSourceRange()); 255 C.EmitReport(report); 256 return NULL; 257 } 258 259 // Array bound check succeeded. From this point forward the array bound 260 // should always succeed. 261 return StInBound; 262} 263 264const GRState *CStringChecker::CheckBufferAccess(CheckerContext &C, 265 const GRState *state, 266 const Expr *Size, 267 const Expr *FirstBuf, 268 const Expr *SecondBuf, 269 bool FirstIsDestination) const { 270 // If a previous check has failed, propagate the failure. 271 if (!state) 272 return NULL; 273 274 SValBuilder &svalBuilder = C.getSValBuilder(); 275 ASTContext &Ctx = C.getASTContext(); 276 277 QualType sizeTy = Size->getType(); 278 QualType PtrTy = Ctx.getPointerType(Ctx.CharTy); 279 280 // Check that the first buffer is non-null. 281 SVal BufVal = state->getSVal(FirstBuf); 282 state = checkNonNull(C, state, FirstBuf, BufVal); 283 if (!state) 284 return NULL; 285 286 // Get the access length and make sure it is known. 287 SVal LengthVal = state->getSVal(Size); 288 NonLoc *Length = dyn_cast<NonLoc>(&LengthVal); 289 if (!Length) 290 return state; 291 292 // Compute the offset of the last element to be accessed: size-1. 293 NonLoc One = cast<NonLoc>(svalBuilder.makeIntVal(1, sizeTy)); 294 NonLoc LastOffset = cast<NonLoc>(svalBuilder.evalBinOpNN(state, BO_Sub, 295 *Length, One, sizeTy)); 296 297 // Check that the first buffer is sufficiently long. 298 SVal BufStart = svalBuilder.evalCast(BufVal, PtrTy, FirstBuf->getType()); 299 if (Loc *BufLoc = dyn_cast<Loc>(&BufStart)) { 300 SVal BufEnd = svalBuilder.evalBinOpLN(state, BO_Add, *BufLoc, 301 LastOffset, PtrTy); 302 state = CheckLocation(C, state, FirstBuf, BufEnd, FirstIsDestination); 303 304 // If the buffer isn't large enough, abort. 305 if (!state) 306 return NULL; 307 } 308 309 // If there's a second buffer, check it as well. 310 if (SecondBuf) { 311 BufVal = state->getSVal(SecondBuf); 312 state = checkNonNull(C, state, SecondBuf, BufVal); 313 if (!state) 314 return NULL; 315 316 BufStart = svalBuilder.evalCast(BufVal, PtrTy, SecondBuf->getType()); 317 if (Loc *BufLoc = dyn_cast<Loc>(&BufStart)) { 318 SVal BufEnd = svalBuilder.evalBinOpLN(state, BO_Add, *BufLoc, 319 LastOffset, PtrTy); 320 state = CheckLocation(C, state, SecondBuf, BufEnd); 321 } 322 } 323 324 // Large enough or not, return this state! 325 return state; 326} 327 328const GRState *CStringChecker::CheckOverlap(CheckerContext &C, 329 const GRState *state, 330 const Expr *Size, 331 const Expr *First, 332 const Expr *Second) const { 333 // Do a simple check for overlap: if the two arguments are from the same 334 // buffer, see if the end of the first is greater than the start of the second 335 // or vice versa. 336 337 // If a previous check has failed, propagate the failure. 338 if (!state) 339 return NULL; 340 341 const GRState *stateTrue, *stateFalse; 342 343 // Get the buffer values and make sure they're known locations. 344 SVal firstVal = state->getSVal(First); 345 SVal secondVal = state->getSVal(Second); 346 347 Loc *firstLoc = dyn_cast<Loc>(&firstVal); 348 if (!firstLoc) 349 return state; 350 351 Loc *secondLoc = dyn_cast<Loc>(&secondVal); 352 if (!secondLoc) 353 return state; 354 355 // Are the two values the same? 356 SValBuilder &svalBuilder = C.getSValBuilder(); 357 llvm::tie(stateTrue, stateFalse) = 358 state->assume(svalBuilder.evalEQ(state, *firstLoc, *secondLoc)); 359 360 if (stateTrue && !stateFalse) { 361 // If the values are known to be equal, that's automatically an overlap. 362 emitOverlapBug(C, stateTrue, First, Second); 363 return NULL; 364 } 365 366 // assume the two expressions are not equal. 367 assert(stateFalse); 368 state = stateFalse; 369 370 // Which value comes first? 371 ASTContext &Ctx = svalBuilder.getContext(); 372 QualType cmpTy = Ctx.IntTy; 373 SVal reverse = svalBuilder.evalBinOpLL(state, BO_GT, 374 *firstLoc, *secondLoc, cmpTy); 375 DefinedOrUnknownSVal *reverseTest = dyn_cast<DefinedOrUnknownSVal>(&reverse); 376 if (!reverseTest) 377 return state; 378 379 llvm::tie(stateTrue, stateFalse) = state->assume(*reverseTest); 380 if (stateTrue) { 381 if (stateFalse) { 382 // If we don't know which one comes first, we can't perform this test. 383 return state; 384 } else { 385 // Switch the values so that firstVal is before secondVal. 386 Loc *tmpLoc = firstLoc; 387 firstLoc = secondLoc; 388 secondLoc = tmpLoc; 389 390 // Switch the Exprs as well, so that they still correspond. 391 const Expr *tmpExpr = First; 392 First = Second; 393 Second = tmpExpr; 394 } 395 } 396 397 // Get the length, and make sure it too is known. 398 SVal LengthVal = state->getSVal(Size); 399 NonLoc *Length = dyn_cast<NonLoc>(&LengthVal); 400 if (!Length) 401 return state; 402 403 // Convert the first buffer's start address to char*. 404 // Bail out if the cast fails. 405 QualType CharPtrTy = Ctx.getPointerType(Ctx.CharTy); 406 SVal FirstStart = svalBuilder.evalCast(*firstLoc, CharPtrTy, First->getType()); 407 Loc *FirstStartLoc = dyn_cast<Loc>(&FirstStart); 408 if (!FirstStartLoc) 409 return state; 410 411 // Compute the end of the first buffer. Bail out if THAT fails. 412 SVal FirstEnd = svalBuilder.evalBinOpLN(state, BO_Add, 413 *FirstStartLoc, *Length, CharPtrTy); 414 Loc *FirstEndLoc = dyn_cast<Loc>(&FirstEnd); 415 if (!FirstEndLoc) 416 return state; 417 418 // Is the end of the first buffer past the start of the second buffer? 419 SVal Overlap = svalBuilder.evalBinOpLL(state, BO_GT, 420 *FirstEndLoc, *secondLoc, cmpTy); 421 DefinedOrUnknownSVal *OverlapTest = dyn_cast<DefinedOrUnknownSVal>(&Overlap); 422 if (!OverlapTest) 423 return state; 424 425 llvm::tie(stateTrue, stateFalse) = state->assume(*OverlapTest); 426 427 if (stateTrue && !stateFalse) { 428 // Overlap! 429 emitOverlapBug(C, stateTrue, First, Second); 430 return NULL; 431 } 432 433 // assume the two expressions don't overlap. 434 assert(stateFalse); 435 return stateFalse; 436} 437 438void CStringChecker::emitOverlapBug(CheckerContext &C, const GRState *state, 439 const Stmt *First, const Stmt *Second) const { 440 ExplodedNode *N = C.generateSink(state); 441 if (!N) 442 return; 443 444 if (!BT_Overlap) 445 BT_Overlap.reset(new BugType("Unix API", "Improper arguments")); 446 447 // Generate a report for this bug. 448 RangedBugReport *report = 449 new RangedBugReport(*BT_Overlap, 450 "Arguments must not be overlapping buffers", N); 451 report->addRange(First->getSourceRange()); 452 report->addRange(Second->getSourceRange()); 453 454 C.EmitReport(report); 455} 456 457const GRState *CStringChecker::setCStringLength(const GRState *state, 458 const MemRegion *MR, 459 SVal strLength) { 460 assert(!strLength.isUndef() && "Attempt to set an undefined string length"); 461 if (strLength.isUnknown()) 462 return state; 463 464 MR = MR->StripCasts(); 465 466 switch (MR->getKind()) { 467 case MemRegion::StringRegionKind: 468 // FIXME: This can happen if we strcpy() into a string region. This is 469 // undefined [C99 6.4.5p6], but we should still warn about it. 470 return state; 471 472 case MemRegion::SymbolicRegionKind: 473 case MemRegion::AllocaRegionKind: 474 case MemRegion::VarRegionKind: 475 case MemRegion::FieldRegionKind: 476 case MemRegion::ObjCIvarRegionKind: 477 return state->set<CStringLength>(MR, strLength); 478 479 case MemRegion::ElementRegionKind: 480 // FIXME: Handle element regions by upper-bounding the parent region's 481 // string length. 482 return state; 483 484 default: 485 // Other regions (mostly non-data) can't have a reliable C string length. 486 // For now, just ignore the change. 487 // FIXME: These are rare but not impossible. We should output some kind of 488 // warning for things like strcpy((char[]){'a', 0}, "b"); 489 return state; 490 } 491} 492 493SVal CStringChecker::getCStringLengthForRegion(CheckerContext &C, 494 const GRState *&state, 495 const Expr *Ex, 496 const MemRegion *MR) { 497 // If there's a recorded length, go ahead and return it. 498 const SVal *Recorded = state->get<CStringLength>(MR); 499 if (Recorded) 500 return *Recorded; 501 502 // Otherwise, get a new symbol and update the state. 503 unsigned Count = C.getNodeBuilder().getCurrentBlockCount(); 504 SValBuilder &svalBuilder = C.getSValBuilder(); 505 QualType sizeTy = svalBuilder.getContext().getSizeType(); 506 SVal strLength = svalBuilder.getMetadataSymbolVal(CStringChecker::getTag(), 507 MR, Ex, sizeTy, Count); 508 state = state->set<CStringLength>(MR, strLength); 509 return strLength; 510} 511 512SVal CStringChecker::getCStringLength(CheckerContext &C, const GRState *&state, 513 const Expr *Ex, SVal Buf) const { 514 const MemRegion *MR = Buf.getAsRegion(); 515 if (!MR) { 516 // If we can't get a region, see if it's something we /know/ isn't a 517 // C string. In the context of locations, the only time we can issue such 518 // a warning is for labels. 519 if (loc::GotoLabel *Label = dyn_cast<loc::GotoLabel>(&Buf)) { 520 if (ExplodedNode *N = C.generateNode(state)) { 521 if (!BT_NotCString) 522 BT_NotCString.reset(new BuiltinBug("API", 523 "Argument is not a null-terminated string.")); 524 525 llvm::SmallString<120> buf; 526 llvm::raw_svector_ostream os(buf); 527 os << "Argument to byte string function is the address of the label '" 528 << Label->getLabel()->getName() 529 << "', which is not a null-terminated string"; 530 531 // Generate a report for this bug. 532 EnhancedBugReport *report = new EnhancedBugReport(*BT_NotCString, 533 os.str(), N); 534 535 report->addRange(Ex->getSourceRange()); 536 C.EmitReport(report); 537 } 538 539 return UndefinedVal(); 540 } 541 542 // If it's not a region and not a label, give up. 543 return UnknownVal(); 544 } 545 546 // If we have a region, strip casts from it and see if we can figure out 547 // its length. For anything we can't figure out, just return UnknownVal. 548 MR = MR->StripCasts(); 549 550 switch (MR->getKind()) { 551 case MemRegion::StringRegionKind: { 552 // Modifying the contents of string regions is undefined [C99 6.4.5p6], 553 // so we can assume that the byte length is the correct C string length. 554 SValBuilder &svalBuilder = C.getSValBuilder(); 555 QualType sizeTy = svalBuilder.getContext().getSizeType(); 556 const StringLiteral *strLit = cast<StringRegion>(MR)->getStringLiteral(); 557 return svalBuilder.makeIntVal(strLit->getByteLength(), sizeTy); 558 } 559 case MemRegion::SymbolicRegionKind: 560 case MemRegion::AllocaRegionKind: 561 case MemRegion::VarRegionKind: 562 case MemRegion::FieldRegionKind: 563 case MemRegion::ObjCIvarRegionKind: 564 return getCStringLengthForRegion(C, state, Ex, MR); 565 case MemRegion::CompoundLiteralRegionKind: 566 // FIXME: Can we track this? Is it necessary? 567 return UnknownVal(); 568 case MemRegion::ElementRegionKind: 569 // FIXME: How can we handle this? It's not good enough to subtract the 570 // offset from the base string length; consider "123\x00567" and &a[5]. 571 return UnknownVal(); 572 default: 573 // Other regions (mostly non-data) can't have a reliable C string length. 574 // In this case, an error is emitted and UndefinedVal is returned. 575 // The caller should always be prepared to handle this case. 576 if (ExplodedNode *N = C.generateNode(state)) { 577 if (!BT_NotCString) 578 BT_NotCString.reset(new BuiltinBug("API", 579 "Argument is not a null-terminated string.")); 580 581 llvm::SmallString<120> buf; 582 llvm::raw_svector_ostream os(buf); 583 584 os << "Argument to byte string function is "; 585 586 if (SummarizeRegion(os, C.getASTContext(), MR)) 587 os << ", which is not a null-terminated string"; 588 else 589 os << "not a null-terminated string"; 590 591 // Generate a report for this bug. 592 EnhancedBugReport *report = new EnhancedBugReport(*BT_NotCString, 593 os.str(), N); 594 595 report->addRange(Ex->getSourceRange()); 596 C.EmitReport(report); 597 } 598 599 return UndefinedVal(); 600 } 601} 602 603const StringLiteral *CStringChecker::getCStringLiteral(CheckerContext &C, 604 const GRState *&state, const Expr *expr, SVal val) const { 605 606 // Get the memory region pointed to by the val. 607 const MemRegion *bufRegion = val.getAsRegion(); 608 if (!bufRegion) 609 return NULL; 610 611 // Strip casts off the memory region. 612 bufRegion = bufRegion->StripCasts(); 613 614 // Cast the memory region to a string region. 615 const StringRegion *strRegion= dyn_cast<StringRegion>(bufRegion); 616 if (!strRegion) 617 return NULL; 618 619 // Return the actual string in the string region. 620 return strRegion->getStringLiteral(); 621} 622 623const GRState *CStringChecker::InvalidateBuffer(CheckerContext &C, 624 const GRState *state, 625 const Expr *E, SVal V) { 626 Loc *L = dyn_cast<Loc>(&V); 627 if (!L) 628 return state; 629 630 // FIXME: This is a simplified version of what's in CFRefCount.cpp -- it makes 631 // some assumptions about the value that CFRefCount can't. Even so, it should 632 // probably be refactored. 633 if (loc::MemRegionVal* MR = dyn_cast<loc::MemRegionVal>(L)) { 634 const MemRegion *R = MR->getRegion()->StripCasts(); 635 636 // Are we dealing with an ElementRegion? If so, we should be invalidating 637 // the super-region. 638 if (const ElementRegion *ER = dyn_cast<ElementRegion>(R)) { 639 R = ER->getSuperRegion(); 640 // FIXME: What about layers of ElementRegions? 641 } 642 643 // Invalidate this region. 644 unsigned Count = C.getNodeBuilder().getCurrentBlockCount(); 645 return state->invalidateRegion(R, E, Count, NULL); 646 } 647 648 // If we have a non-region value by chance, just remove the binding. 649 // FIXME: is this necessary or correct? This handles the non-Region 650 // cases. Is it ever valid to store to these? 651 return state->unbindLoc(*L); 652} 653 654bool CStringChecker::SummarizeRegion(llvm::raw_ostream& os, ASTContext& Ctx, 655 const MemRegion *MR) { 656 const TypedRegion *TR = dyn_cast<TypedRegion>(MR); 657 if (!TR) 658 return false; 659 660 switch (TR->getKind()) { 661 case MemRegion::FunctionTextRegionKind: { 662 const FunctionDecl *FD = cast<FunctionTextRegion>(TR)->getDecl(); 663 if (FD) 664 os << "the address of the function '" << FD << "'"; 665 else 666 os << "the address of a function"; 667 return true; 668 } 669 case MemRegion::BlockTextRegionKind: 670 os << "block text"; 671 return true; 672 case MemRegion::BlockDataRegionKind: 673 os << "a block"; 674 return true; 675 case MemRegion::CXXThisRegionKind: 676 case MemRegion::CXXTempObjectRegionKind: 677 os << "a C++ temp object of type " << TR->getValueType().getAsString(); 678 return true; 679 case MemRegion::VarRegionKind: 680 os << "a variable of type" << TR->getValueType().getAsString(); 681 return true; 682 case MemRegion::FieldRegionKind: 683 os << "a field of type " << TR->getValueType().getAsString(); 684 return true; 685 case MemRegion::ObjCIvarRegionKind: 686 os << "an instance variable of type " << TR->getValueType().getAsString(); 687 return true; 688 default: 689 return false; 690 } 691} 692 693//===----------------------------------------------------------------------===// 694// evaluation of individual function calls. 695//===----------------------------------------------------------------------===// 696 697void CStringChecker::evalCopyCommon(CheckerContext &C, 698 const CallExpr *CE, 699 const GRState *state, 700 const Expr *Size, const Expr *Dest, 701 const Expr *Source, bool Restricted, 702 bool IsMempcpy) const { 703 // See if the size argument is zero. 704 SVal sizeVal = state->getSVal(Size); 705 QualType sizeTy = Size->getType(); 706 707 const GRState *stateZeroSize, *stateNonZeroSize; 708 llvm::tie(stateZeroSize, stateNonZeroSize) = assumeZero(C, state, sizeVal, sizeTy); 709 710 // Get the value of the Dest. 711 SVal destVal = state->getSVal(Dest); 712 713 // If the size is zero, there won't be any actual memory access, so 714 // just bind the return value to the destination buffer and return. 715 if (stateZeroSize) { 716 stateZeroSize = stateZeroSize->BindExpr(CE, destVal); 717 C.addTransition(stateZeroSize); 718 } 719 720 // If the size can be nonzero, we have to check the other arguments. 721 if (stateNonZeroSize) { 722 state = stateNonZeroSize; 723 724 // Ensure the destination is not null. If it is NULL there will be a 725 // NULL pointer dereference. 726 state = checkNonNull(C, state, Dest, destVal); 727 if (!state) 728 return; 729 730 // Get the value of the Src. 731 SVal srcVal = state->getSVal(Source); 732 733 // Ensure the source is not null. If it is NULL there will be a 734 // NULL pointer dereference. 735 state = checkNonNull(C, state, Source, srcVal); 736 if (!state) 737 return; 738 739 // Ensure the accesses are valid and that the buffers do not overlap. 740 state = CheckBufferAccess(C, state, Size, Dest, Source, 741 /* FirstIsDst = */ true); 742 if (Restricted) 743 state = CheckOverlap(C, state, Size, Dest, Source); 744 745 if (!state) 746 return; 747 748 // If this is mempcpy, get the byte after the last byte copied and 749 // bind the expr. 750 if (IsMempcpy) { 751 loc::MemRegionVal *destRegVal = dyn_cast<loc::MemRegionVal>(&destVal); 752 assert(destRegVal && "Destination should be a known MemRegionVal here"); 753 754 // Get the length to copy. 755 NonLoc *lenValNonLoc = dyn_cast<NonLoc>(&sizeVal); 756 757 if (lenValNonLoc) { 758 // Get the byte after the last byte copied. 759 SVal lastElement = C.getSValBuilder().evalBinOpLN(state, BO_Add, 760 *destRegVal, 761 *lenValNonLoc, 762 Dest->getType()); 763 764 // The byte after the last byte copied is the return value. 765 state = state->BindExpr(CE, lastElement); 766 } else { 767 // If we don't know how much we copied, we can at least 768 // conjure a return value for later. 769 unsigned Count = C.getNodeBuilder().getCurrentBlockCount(); 770 SVal result = 771 C.getSValBuilder().getConjuredSymbolVal(NULL, CE, Count); 772 state = state->BindExpr(CE, result); 773 } 774 775 } else { 776 // All other copies return the destination buffer. 777 // (Well, bcopy() has a void return type, but this won't hurt.) 778 state = state->BindExpr(CE, destVal); 779 } 780 781 // Invalidate the destination. 782 // FIXME: Even if we can't perfectly model the copy, we should see if we 783 // can use LazyCompoundVals to copy the source values into the destination. 784 // This would probably remove any existing bindings past the end of the 785 // copied region, but that's still an improvement over blank invalidation. 786 state = InvalidateBuffer(C, state, Dest, state->getSVal(Dest)); 787 C.addTransition(state); 788 } 789} 790 791 792void CStringChecker::evalMemcpy(CheckerContext &C, const CallExpr *CE) const { 793 // void *memcpy(void *restrict dst, const void *restrict src, size_t n); 794 // The return value is the address of the destination buffer. 795 const Expr *Dest = CE->getArg(0); 796 const GRState *state = C.getState(); 797 798 evalCopyCommon(C, CE, state, CE->getArg(2), Dest, CE->getArg(1), true); 799} 800 801void CStringChecker::evalMempcpy(CheckerContext &C, const CallExpr *CE) const { 802 // void *mempcpy(void *restrict dst, const void *restrict src, size_t n); 803 // The return value is a pointer to the byte following the last written byte. 804 const Expr *Dest = CE->getArg(0); 805 const GRState *state = C.getState(); 806 807 evalCopyCommon(C, CE, state, CE->getArg(2), Dest, CE->getArg(1), true, true); 808} 809 810void CStringChecker::evalMemmove(CheckerContext &C, const CallExpr *CE) const { 811 // void *memmove(void *dst, const void *src, size_t n); 812 // The return value is the address of the destination buffer. 813 const Expr *Dest = CE->getArg(0); 814 const GRState *state = C.getState(); 815 816 evalCopyCommon(C, CE, state, CE->getArg(2), Dest, CE->getArg(1)); 817} 818 819void CStringChecker::evalBcopy(CheckerContext &C, const CallExpr *CE) const { 820 // void bcopy(const void *src, void *dst, size_t n); 821 evalCopyCommon(C, CE, C.getState(), 822 CE->getArg(2), CE->getArg(1), CE->getArg(0)); 823} 824 825void CStringChecker::evalMemcmp(CheckerContext &C, const CallExpr *CE) const { 826 // int memcmp(const void *s1, const void *s2, size_t n); 827 const Expr *Left = CE->getArg(0); 828 const Expr *Right = CE->getArg(1); 829 const Expr *Size = CE->getArg(2); 830 831 const GRState *state = C.getState(); 832 SValBuilder &svalBuilder = C.getSValBuilder(); 833 834 // See if the size argument is zero. 835 SVal sizeVal = state->getSVal(Size); 836 QualType sizeTy = Size->getType(); 837 838 const GRState *stateZeroSize, *stateNonZeroSize; 839 llvm::tie(stateZeroSize, stateNonZeroSize) = 840 assumeZero(C, state, sizeVal, sizeTy); 841 842 // If the size can be zero, the result will be 0 in that case, and we don't 843 // have to check either of the buffers. 844 if (stateZeroSize) { 845 state = stateZeroSize; 846 state = state->BindExpr(CE, svalBuilder.makeZeroVal(CE->getType())); 847 C.addTransition(state); 848 } 849 850 // If the size can be nonzero, we have to check the other arguments. 851 if (stateNonZeroSize) { 852 state = stateNonZeroSize; 853 // If we know the two buffers are the same, we know the result is 0. 854 // First, get the two buffers' addresses. Another checker will have already 855 // made sure they're not undefined. 856 DefinedOrUnknownSVal LV = cast<DefinedOrUnknownSVal>(state->getSVal(Left)); 857 DefinedOrUnknownSVal RV = cast<DefinedOrUnknownSVal>(state->getSVal(Right)); 858 859 // See if they are the same. 860 DefinedOrUnknownSVal SameBuf = svalBuilder.evalEQ(state, LV, RV); 861 const GRState *StSameBuf, *StNotSameBuf; 862 llvm::tie(StSameBuf, StNotSameBuf) = state->assume(SameBuf); 863 864 // If the two arguments might be the same buffer, we know the result is zero, 865 // and we only need to check one size. 866 if (StSameBuf) { 867 state = StSameBuf; 868 state = CheckBufferAccess(C, state, Size, Left); 869 if (state) { 870 state = StSameBuf->BindExpr(CE, svalBuilder.makeZeroVal(CE->getType())); 871 C.addTransition(state); 872 } 873 } 874 875 // If the two arguments might be different buffers, we have to check the 876 // size of both of them. 877 if (StNotSameBuf) { 878 state = StNotSameBuf; 879 state = CheckBufferAccess(C, state, Size, Left, Right); 880 if (state) { 881 // The return value is the comparison result, which we don't know. 882 unsigned Count = C.getNodeBuilder().getCurrentBlockCount(); 883 SVal CmpV = svalBuilder.getConjuredSymbolVal(NULL, CE, Count); 884 state = state->BindExpr(CE, CmpV); 885 C.addTransition(state); 886 } 887 } 888 } 889} 890 891void CStringChecker::evalstrLength(CheckerContext &C, 892 const CallExpr *CE) const { 893 // size_t strlen(const char *s); 894 evalstrLengthCommon(C, CE, /* IsStrnlen = */ false); 895} 896 897void CStringChecker::evalstrnLength(CheckerContext &C, 898 const CallExpr *CE) const { 899 // size_t strnlen(const char *s, size_t maxlen); 900 evalstrLengthCommon(C, CE, /* IsStrnlen = */ true); 901} 902 903void CStringChecker::evalstrLengthCommon(CheckerContext &C, const CallExpr *CE, 904 bool IsStrnlen) const { 905 const GRState *state = C.getState(); 906 907 if (IsStrnlen) { 908 const Expr *maxlenExpr = CE->getArg(1); 909 SVal maxlenVal = state->getSVal(maxlenExpr); 910 911 const GRState *stateZeroSize, *stateNonZeroSize; 912 llvm::tie(stateZeroSize, stateNonZeroSize) = 913 assumeZero(C, state, maxlenVal, maxlenExpr->getType()); 914 915 // If the size can be zero, the result will be 0 in that case, and we don't 916 // have to check the string itself. 917 if (stateZeroSize) { 918 SVal zero = C.getSValBuilder().makeZeroVal(CE->getType()); 919 stateZeroSize = stateZeroSize->BindExpr(CE, zero); 920 C.addTransition(stateZeroSize); 921 } 922 923 // If the size is GUARANTEED to be zero, we're done! 924 if (!stateNonZeroSize) 925 return; 926 927 // Otherwise, record the assumption that the size is nonzero. 928 state = stateNonZeroSize; 929 } 930 931 // Check that the string argument is non-null. 932 const Expr *Arg = CE->getArg(0); 933 SVal ArgVal = state->getSVal(Arg); 934 935 state = checkNonNull(C, state, Arg, ArgVal); 936 937 if (state) { 938 SVal strLength = getCStringLength(C, state, Arg, ArgVal); 939 940 // If the argument isn't a valid C string, there's no valid state to 941 // transition to. 942 if (strLength.isUndef()) 943 return; 944 945 DefinedOrUnknownSVal result = UnknownVal(); 946 947 // If the check is for strnlen() then bind the return value to no more than 948 // the maxlen value. 949 if (IsStrnlen) { 950 QualType cmpTy = C.getSValBuilder().getContext().IntTy; 951 952 // It's a little unfortunate to be getting this again, 953 // but it's not that expensive... 954 const Expr *maxlenExpr = CE->getArg(1); 955 SVal maxlenVal = state->getSVal(maxlenExpr); 956 957 NonLoc *strLengthNL = dyn_cast<NonLoc>(&strLength); 958 NonLoc *maxlenValNL = dyn_cast<NonLoc>(&maxlenVal); 959 960 if (strLengthNL && maxlenValNL) { 961 const GRState *stateStringTooLong, *stateStringNotTooLong; 962 963 // Check if the strLength is greater than the maxlen. 964 llvm::tie(stateStringTooLong, stateStringNotTooLong) = 965 state->assume(cast<DefinedOrUnknownSVal> 966 (C.getSValBuilder().evalBinOpNN(state, BO_GT, 967 *strLengthNL, 968 *maxlenValNL, 969 cmpTy))); 970 971 if (stateStringTooLong && !stateStringNotTooLong) { 972 // If the string is longer than maxlen, return maxlen. 973 result = *maxlenValNL; 974 } else if (stateStringNotTooLong && !stateStringTooLong) { 975 // If the string is shorter than maxlen, return its length. 976 result = *strLengthNL; 977 } 978 } 979 980 if (result.isUnknown()) { 981 // If we don't have enough information for a comparison, there's 982 // no guarantee the full string length will actually be returned. 983 // All we know is the return value is the min of the string length 984 // and the limit. This is better than nothing. 985 unsigned Count = C.getNodeBuilder().getCurrentBlockCount(); 986 result = C.getSValBuilder().getConjuredSymbolVal(NULL, CE, Count); 987 NonLoc *resultNL = cast<NonLoc>(&result); 988 989 if (strLengthNL) { 990 state = state->assume(cast<DefinedOrUnknownSVal> 991 (C.getSValBuilder().evalBinOpNN(state, BO_LE, 992 *resultNL, 993 *strLengthNL, 994 cmpTy)), true); 995 } 996 997 if (maxlenValNL) { 998 state = state->assume(cast<DefinedOrUnknownSVal> 999 (C.getSValBuilder().evalBinOpNN(state, BO_LE, 1000 *resultNL, 1001 *maxlenValNL, 1002 cmpTy)), true); 1003 } 1004 } 1005 1006 } else { 1007 // This is a plain strlen(), not strnlen(). 1008 result = cast<DefinedOrUnknownSVal>(strLength); 1009 1010 // If we don't know the length of the string, conjure a return 1011 // value, so it can be used in constraints, at least. 1012 if (result.isUnknown()) { 1013 unsigned Count = C.getNodeBuilder().getCurrentBlockCount(); 1014 result = C.getSValBuilder().getConjuredSymbolVal(NULL, CE, Count); 1015 } 1016 } 1017 1018 // Bind the return value. 1019 assert(!result.isUnknown() && "Should have conjured a value by now"); 1020 state = state->BindExpr(CE, result); 1021 C.addTransition(state); 1022 } 1023} 1024 1025void CStringChecker::evalStrcpy(CheckerContext &C, const CallExpr *CE) const { 1026 // char *strcpy(char *restrict dst, const char *restrict src); 1027 evalStrcpyCommon(C, CE, 1028 /* returnEnd = */ false, 1029 /* isBounded = */ false, 1030 /* isAppending = */ false); 1031} 1032 1033void CStringChecker::evalStrncpy(CheckerContext &C, const CallExpr *CE) const { 1034 // char *strncpy(char *restrict dst, const char *restrict src, size_t n); 1035 evalStrcpyCommon(C, CE, 1036 /* returnEnd = */ false, 1037 /* isBounded = */ true, 1038 /* isAppending = */ false); 1039} 1040 1041void CStringChecker::evalStpcpy(CheckerContext &C, const CallExpr *CE) const { 1042 // char *stpcpy(char *restrict dst, const char *restrict src); 1043 evalStrcpyCommon(C, CE, 1044 /* returnEnd = */ true, 1045 /* isBounded = */ false, 1046 /* isAppending = */ false); 1047} 1048 1049void CStringChecker::evalStrcat(CheckerContext &C, const CallExpr *CE) const { 1050 //char *strcat(char *restrict s1, const char *restrict s2); 1051 evalStrcpyCommon(C, CE, 1052 /* returnEnd = */ false, 1053 /* isBounded = */ false, 1054 /* isAppending = */ true); 1055} 1056 1057void CStringChecker::evalStrncat(CheckerContext &C, const CallExpr *CE) const { 1058 //char *strncat(char *restrict s1, const char *restrict s2, size_t n); 1059 evalStrcpyCommon(C, CE, 1060 /* returnEnd = */ false, 1061 /* isBounded = */ true, 1062 /* isAppending = */ true); 1063} 1064 1065void CStringChecker::evalStrcpyCommon(CheckerContext &C, const CallExpr *CE, 1066 bool returnEnd, bool isBounded, 1067 bool isAppending) const { 1068 const GRState *state = C.getState(); 1069 1070 // Check that the destination is non-null. 1071 const Expr *Dst = CE->getArg(0); 1072 SVal DstVal = state->getSVal(Dst); 1073 1074 state = checkNonNull(C, state, Dst, DstVal); 1075 if (!state) 1076 return; 1077 1078 // Check that the source is non-null. 1079 const Expr *srcExpr = CE->getArg(1); 1080 SVal srcVal = state->getSVal(srcExpr); 1081 state = checkNonNull(C, state, srcExpr, srcVal); 1082 if (!state) 1083 return; 1084 1085 // Get the string length of the source. 1086 SVal strLength = getCStringLength(C, state, srcExpr, srcVal); 1087 1088 // If the source isn't a valid C string, give up. 1089 if (strLength.isUndef()) 1090 return; 1091 1092 // If the function is strncpy, strncat, etc... it is bounded. 1093 if (isBounded) { 1094 // Get the max number of characters to copy. 1095 const Expr *lenExpr = CE->getArg(2); 1096 SVal lenVal = state->getSVal(lenExpr); 1097 1098 // Cast the length to a NonLoc SVal. If it is not a NonLoc then give up. 1099 NonLoc *strLengthNL = dyn_cast<NonLoc>(&strLength); 1100 if (!strLengthNL) 1101 return; 1102 1103 // Cast the max length to a NonLoc SVal. If it is not a NonLoc then give up. 1104 NonLoc *lenValNL = dyn_cast<NonLoc>(&lenVal); 1105 if (!lenValNL) 1106 return; 1107 1108 QualType cmpTy = C.getSValBuilder().getContext().IntTy; 1109 const GRState *stateTrue, *stateFalse; 1110 1111 // Check if the max number to copy is less than the length of the src. 1112 llvm::tie(stateTrue, stateFalse) = 1113 state->assume(cast<DefinedOrUnknownSVal> 1114 (C.getSValBuilder().evalBinOpNN(state, BO_GT, 1115 *strLengthNL, *lenValNL, 1116 cmpTy))); 1117 1118 if (stateTrue) { 1119 // Max number to copy is less than the length of the src, so the actual 1120 // strLength copied is the max number arg. 1121 strLength = lenVal; 1122 } 1123 } 1124 1125 // If this is an appending function (strcat, strncat...) then set the 1126 // string length to strlen(src) + strlen(dst) since the buffer will 1127 // ultimately contain both. 1128 if (isAppending) { 1129 // Get the string length of the destination, or give up. 1130 SVal dstStrLength = getCStringLength(C, state, Dst, DstVal); 1131 if (dstStrLength.isUndef()) 1132 return; 1133 1134 NonLoc *srcStrLengthNL = dyn_cast<NonLoc>(&strLength); 1135 NonLoc *dstStrLengthNL = dyn_cast<NonLoc>(&dstStrLength); 1136 1137 // If src or dst cast to NonLoc is NULL, give up. 1138 if ((!srcStrLengthNL) || (!dstStrLengthNL)) 1139 return; 1140 1141 QualType addTy = C.getSValBuilder().getContext().getSizeType(); 1142 1143 strLength = C.getSValBuilder().evalBinOpNN(state, BO_Add, 1144 *srcStrLengthNL, *dstStrLengthNL, 1145 addTy); 1146 } 1147 1148 SVal Result = (returnEnd ? UnknownVal() : DstVal); 1149 1150 // If the destination is a MemRegion, try to check for a buffer overflow and 1151 // record the new string length. 1152 if (loc::MemRegionVal *dstRegVal = dyn_cast<loc::MemRegionVal>(&DstVal)) { 1153 // If the length is known, we can check for an overflow. 1154 if (NonLoc *knownStrLength = dyn_cast<NonLoc>(&strLength)) { 1155 SVal lastElement = 1156 C.getSValBuilder().evalBinOpLN(state, BO_Add, *dstRegVal, 1157 *knownStrLength, Dst->getType()); 1158 1159 state = CheckLocation(C, state, Dst, lastElement, /* IsDst = */ true); 1160 if (!state) 1161 return; 1162 1163 // If this is a stpcpy-style copy, the last element is the return value. 1164 if (returnEnd) 1165 Result = lastElement; 1166 } 1167 1168 // Invalidate the destination. This must happen before we set the C string 1169 // length because invalidation will clear the length. 1170 // FIXME: Even if we can't perfectly model the copy, we should see if we 1171 // can use LazyCompoundVals to copy the source values into the destination. 1172 // This would probably remove any existing bindings past the end of the 1173 // string, but that's still an improvement over blank invalidation. 1174 state = InvalidateBuffer(C, state, Dst, *dstRegVal); 1175 1176 // Set the C string length of the destination. 1177 state = setCStringLength(state, dstRegVal->getRegion(), strLength); 1178 } 1179 1180 // If this is a stpcpy-style copy, but we were unable to check for a buffer 1181 // overflow, we still need a result. Conjure a return value. 1182 if (returnEnd && Result.isUnknown()) { 1183 SValBuilder &svalBuilder = C.getSValBuilder(); 1184 unsigned Count = C.getNodeBuilder().getCurrentBlockCount(); 1185 strLength = svalBuilder.getConjuredSymbolVal(NULL, CE, Count); 1186 } 1187 1188 // Set the return value. 1189 state = state->BindExpr(CE, Result); 1190 C.addTransition(state); 1191} 1192 1193void CStringChecker::evalStrcmp(CheckerContext &C, const CallExpr *CE) const { 1194 //int strcmp(const char *restrict s1, const char *restrict s2); 1195 evalStrcmpCommon(C, CE, /* isBounded = */ false, /* ignoreCase = */ false); 1196} 1197 1198void CStringChecker::evalStrncmp(CheckerContext &C, const CallExpr *CE) const { 1199 //int strncmp(const char *restrict s1, const char *restrict s2, size_t n); 1200 evalStrcmpCommon(C, CE, /* isBounded = */ true, /* ignoreCase = */ false); 1201} 1202 1203void CStringChecker::evalStrcasecmp(CheckerContext &C, 1204 const CallExpr *CE) const { 1205 //int strcasecmp(const char *restrict s1, const char *restrict s2); 1206 evalStrcmpCommon(C, CE, /* isBounded = */ false, /* ignoreCase = */ true); 1207} 1208 1209void CStringChecker::evalStrncasecmp(CheckerContext &C, 1210 const CallExpr *CE) const { 1211 //int strncasecmp(const char *restrict s1, const char *restrict s2, size_t n); 1212 evalStrcmpCommon(C, CE, /* isBounded = */ true, /* ignoreCase = */ true); 1213} 1214 1215void CStringChecker::evalStrcmpCommon(CheckerContext &C, const CallExpr *CE, 1216 bool isBounded, bool ignoreCase) const { 1217 const GRState *state = C.getState(); 1218 1219 // Check that the first string is non-null 1220 const Expr *s1 = CE->getArg(0); 1221 SVal s1Val = state->getSVal(s1); 1222 state = checkNonNull(C, state, s1, s1Val); 1223 if (!state) 1224 return; 1225 1226 // Check that the second string is non-null. 1227 const Expr *s2 = CE->getArg(1); 1228 SVal s2Val = state->getSVal(s2); 1229 state = checkNonNull(C, state, s2, s2Val); 1230 if (!state) 1231 return; 1232 1233 // Get the string length of the first string or give up. 1234 SVal s1Length = getCStringLength(C, state, s1, s1Val); 1235 if (s1Length.isUndef()) 1236 return; 1237 1238 // Get the string length of the second string or give up. 1239 SVal s2Length = getCStringLength(C, state, s2, s2Val); 1240 if (s2Length.isUndef()) 1241 return; 1242 1243 // Get the string literal of the first string. 1244 const StringLiteral *s1StrLiteral = getCStringLiteral(C, state, s1, s1Val); 1245 if (!s1StrLiteral) 1246 return; 1247 llvm::StringRef s1StrRef = s1StrLiteral->getString(); 1248 1249 // Get the string literal of the second string. 1250 const StringLiteral *s2StrLiteral = getCStringLiteral(C, state, s2, s2Val); 1251 if (!s2StrLiteral) 1252 return; 1253 llvm::StringRef s2StrRef = s2StrLiteral->getString(); 1254 1255 int result; 1256 if (isBounded) { 1257 // Get the max number of characters to compare. 1258 const Expr *lenExpr = CE->getArg(2); 1259 SVal lenVal = state->getSVal(lenExpr); 1260 1261 // Dynamically cast the length to a ConcreteInt. If it is not a ConcreteInt 1262 // then give up, otherwise get the value and use it as the bounds. 1263 nonloc::ConcreteInt *CI = dyn_cast<nonloc::ConcreteInt>(&lenVal); 1264 if (!CI) 1265 return; 1266 llvm::APSInt lenInt(CI->getValue()); 1267 1268 // Create substrings of each to compare the prefix. 1269 s1StrRef = s1StrRef.substr(0, (size_t)lenInt.getLimitedValue()); 1270 s2StrRef = s2StrRef.substr(0, (size_t)lenInt.getLimitedValue()); 1271 } 1272 1273 if (ignoreCase) { 1274 // Compare string 1 to string 2 the same way strcasecmp() does. 1275 result = s1StrRef.compare_lower(s2StrRef); 1276 } else { 1277 // Compare string 1 to string 2 the same way strcmp() does. 1278 result = s1StrRef.compare(s2StrRef); 1279 } 1280 1281 // Build the SVal of the comparison to bind the return value. 1282 SValBuilder &svalBuilder = C.getSValBuilder(); 1283 QualType intTy = svalBuilder.getContext().IntTy; 1284 SVal resultVal = svalBuilder.makeIntVal(result, intTy); 1285 1286 // Bind the return value of the expression. 1287 // Set the return value. 1288 state = state->BindExpr(CE, resultVal); 1289 C.addTransition(state); 1290} 1291 1292//===----------------------------------------------------------------------===// 1293// The driver method, and other Checker callbacks. 1294//===----------------------------------------------------------------------===// 1295 1296bool CStringChecker::evalCall(const CallExpr *CE, CheckerContext &C) const { 1297 // Get the callee. All the functions we care about are C functions 1298 // with simple identifiers. 1299 const GRState *state = C.getState(); 1300 const Expr *Callee = CE->getCallee(); 1301 const FunctionDecl *FD = state->getSVal(Callee).getAsFunctionDecl(); 1302 1303 if (!FD) 1304 return false; 1305 1306 // Get the name of the callee. If it's a builtin, strip off the prefix. 1307 IdentifierInfo *II = FD->getIdentifier(); 1308 if (!II) // if no identifier, not a simple C function 1309 return false; 1310 llvm::StringRef Name = II->getName(); 1311 if (Name.startswith("__builtin_")) 1312 Name = Name.substr(10); 1313 1314 FnCheck evalFunction = llvm::StringSwitch<FnCheck>(Name) 1315 .Cases("memcpy", "__memcpy_chk", &CStringChecker::evalMemcpy) 1316 .Cases("mempcpy", "__mempcpy_chk", &CStringChecker::evalMempcpy) 1317 .Cases("memcmp", "bcmp", &CStringChecker::evalMemcmp) 1318 .Cases("memmove", "__memmove_chk", &CStringChecker::evalMemmove) 1319 .Cases("strcpy", "__strcpy_chk", &CStringChecker::evalStrcpy) 1320 //.Cases("strncpy", "__strncpy_chk", &CStringChecker::evalStrncpy) 1321 .Cases("stpcpy", "__stpcpy_chk", &CStringChecker::evalStpcpy) 1322 .Cases("strcat", "__strcat_chk", &CStringChecker::evalStrcat) 1323 .Cases("strncat", "__strncat_chk", &CStringChecker::evalStrncat) 1324 .Case("strlen", &CStringChecker::evalstrLength) 1325 .Case("strnlen", &CStringChecker::evalstrnLength) 1326 .Case("strcmp", &CStringChecker::evalStrcmp) 1327 .Case("strncmp", &CStringChecker::evalStrncmp) 1328 .Case("strcasecmp", &CStringChecker::evalStrcasecmp) 1329 .Case("strncasecmp", &CStringChecker::evalStrncasecmp) 1330 .Case("bcopy", &CStringChecker::evalBcopy) 1331 .Default(NULL); 1332 1333 // If the callee isn't a string function, let another checker handle it. 1334 if (!evalFunction) 1335 return false; 1336 1337 // Check and evaluate the call. 1338 (this->*evalFunction)(C, CE); 1339 return true; 1340} 1341 1342void CStringChecker::checkPreStmt(const DeclStmt *DS, CheckerContext &C) const { 1343 // Record string length for char a[] = "abc"; 1344 const GRState *state = C.getState(); 1345 1346 for (DeclStmt::const_decl_iterator I = DS->decl_begin(), E = DS->decl_end(); 1347 I != E; ++I) { 1348 const VarDecl *D = dyn_cast<VarDecl>(*I); 1349 if (!D) 1350 continue; 1351 1352 // FIXME: Handle array fields of structs. 1353 if (!D->getType()->isArrayType()) 1354 continue; 1355 1356 const Expr *Init = D->getInit(); 1357 if (!Init) 1358 continue; 1359 if (!isa<StringLiteral>(Init)) 1360 continue; 1361 1362 Loc VarLoc = state->getLValue(D, C.getPredecessor()->getLocationContext()); 1363 const MemRegion *MR = VarLoc.getAsRegion(); 1364 if (!MR) 1365 continue; 1366 1367 SVal StrVal = state->getSVal(Init); 1368 assert(StrVal.isValid() && "Initializer string is unknown or undefined"); 1369 DefinedOrUnknownSVal strLength 1370 = cast<DefinedOrUnknownSVal>(getCStringLength(C, state, Init, StrVal)); 1371 1372 state = state->set<CStringLength>(MR, strLength); 1373 } 1374 1375 C.addTransition(state); 1376} 1377 1378bool CStringChecker::wantsRegionChangeUpdate(const GRState *state) const { 1379 CStringLength::EntryMap Entries = state->get<CStringLength>(); 1380 return !Entries.isEmpty(); 1381} 1382 1383const GRState * 1384CStringChecker::checkRegionChanges(const GRState *state, 1385 const StoreManager::InvalidatedSymbols *, 1386 const MemRegion * const *Begin, 1387 const MemRegion * const *End) const { 1388 CStringLength::EntryMap Entries = state->get<CStringLength>(); 1389 if (Entries.isEmpty()) 1390 return state; 1391 1392 llvm::SmallPtrSet<const MemRegion *, 8> Invalidated; 1393 llvm::SmallPtrSet<const MemRegion *, 32> SuperRegions; 1394 1395 // First build sets for the changed regions and their super-regions. 1396 for ( ; Begin != End; ++Begin) { 1397 const MemRegion *MR = *Begin; 1398 Invalidated.insert(MR); 1399 1400 SuperRegions.insert(MR); 1401 while (const SubRegion *SR = dyn_cast<SubRegion>(MR)) { 1402 MR = SR->getSuperRegion(); 1403 SuperRegions.insert(MR); 1404 } 1405 } 1406 1407 CStringLength::EntryMap::Factory &F = state->get_context<CStringLength>(); 1408 1409 // Then loop over the entries in the current state. 1410 for (CStringLength::EntryMap::iterator I = Entries.begin(), 1411 E = Entries.end(); I != E; ++I) { 1412 const MemRegion *MR = I.getKey(); 1413 1414 // Is this entry for a super-region of a changed region? 1415 if (SuperRegions.count(MR)) { 1416 Entries = F.remove(Entries, MR); 1417 continue; 1418 } 1419 1420 // Is this entry for a sub-region of a changed region? 1421 const MemRegion *Super = MR; 1422 while (const SubRegion *SR = dyn_cast<SubRegion>(Super)) { 1423 Super = SR->getSuperRegion(); 1424 if (Invalidated.count(Super)) { 1425 Entries = F.remove(Entries, MR); 1426 break; 1427 } 1428 } 1429 } 1430 1431 return state->set<CStringLength>(Entries); 1432} 1433 1434void CStringChecker::checkLiveSymbols(const GRState *state, 1435 SymbolReaper &SR) const { 1436 // Mark all symbols in our string length map as valid. 1437 CStringLength::EntryMap Entries = state->get<CStringLength>(); 1438 1439 for (CStringLength::EntryMap::iterator I = Entries.begin(), E = Entries.end(); 1440 I != E; ++I) { 1441 SVal Len = I.getData(); 1442 if (SymbolRef Sym = Len.getAsSymbol()) 1443 SR.markInUse(Sym); 1444 } 1445} 1446 1447void CStringChecker::checkDeadSymbols(SymbolReaper &SR, 1448 CheckerContext &C) const { 1449 if (!SR.hasDeadSymbols()) 1450 return; 1451 1452 const GRState *state = C.getState(); 1453 CStringLength::EntryMap Entries = state->get<CStringLength>(); 1454 if (Entries.isEmpty()) 1455 return; 1456 1457 CStringLength::EntryMap::Factory &F = state->get_context<CStringLength>(); 1458 for (CStringLength::EntryMap::iterator I = Entries.begin(), E = Entries.end(); 1459 I != E; ++I) { 1460 SVal Len = I.getData(); 1461 if (SymbolRef Sym = Len.getAsSymbol()) { 1462 if (SR.isDead(Sym)) 1463 Entries = F.remove(Entries, I.getKey()); 1464 } 1465 } 1466 1467 state = state->set<CStringLength>(Entries); 1468 C.generateNode(state); 1469} 1470 1471void ento::registerCStringChecker(CheckerManager &mgr) { 1472 mgr.registerChecker<CStringChecker>(); 1473} 1474