CStringChecker.cpp revision c152586baf0fcdfd4c660e5dcd7b6857f13203d6
1//= CStringChecker.h - Checks calls to C string functions ----------*- C++ -*-// 2// 3// The LLVM Compiler Infrastructure 4// 5// This file is distributed under the University of Illinois Open Source 6// License. See LICENSE.TXT for details. 7// 8//===----------------------------------------------------------------------===// 9// 10// This defines CStringChecker, which is an assortment of checks on calls 11// to functions in <string.h>. 12// 13//===----------------------------------------------------------------------===// 14 15#include "ClangSACheckers.h" 16#include "clang/StaticAnalyzer/Core/Checker.h" 17#include "clang/StaticAnalyzer/Core/CheckerManager.h" 18#include "clang/StaticAnalyzer/Core/PathSensitive/CheckerContext.h" 19#include "clang/StaticAnalyzer/Core/BugReporter/BugType.h" 20#include "clang/StaticAnalyzer/Core/PathSensitive/GRStateTrait.h" 21#include "llvm/ADT/StringSwitch.h" 22 23using namespace clang; 24using namespace ento; 25 26namespace { 27class CStringChecker : public Checker< eval::Call, 28 check::PreStmt<DeclStmt>, 29 check::LiveSymbols, 30 check::DeadSymbols, 31 check::RegionChanges 32 > { 33 mutable llvm::OwningPtr<BugType> BT_Null, BT_Bounds, BT_BoundsWrite, 34 BT_Overlap, BT_NotCString; 35public: 36 static void *getTag() { static int tag; return &tag; } 37 38 bool evalCall(const CallExpr *CE, CheckerContext &C) const; 39 void checkPreStmt(const DeclStmt *DS, CheckerContext &C) const; 40 void checkLiveSymbols(const GRState *state, SymbolReaper &SR) const; 41 void checkDeadSymbols(SymbolReaper &SR, CheckerContext &C) const; 42 bool wantsRegionChangeUpdate(const GRState *state) const; 43 44 const GRState *checkRegionChanges(const GRState *state, 45 const StoreManager::InvalidatedSymbols *, 46 const MemRegion * const *Begin, 47 const MemRegion * const *End) const; 48 49 typedef void (CStringChecker::*FnCheck)(CheckerContext &, 50 const CallExpr *) const; 51 52 void evalMemcpy(CheckerContext &C, const CallExpr *CE) const; 53 void evalMempcpy(CheckerContext &C, const CallExpr *CE) const; 54 void evalMemmove(CheckerContext &C, const CallExpr *CE) const; 55 void evalBcopy(CheckerContext &C, const CallExpr *CE) const; 56 void evalCopyCommon(CheckerContext &C, const CallExpr *CE, 57 const GRState *state, 58 const Expr *Size, const Expr *Source, const Expr *Dest, 59 bool Restricted = false, 60 bool IsMempcpy = false) const; 61 62 void evalMemcmp(CheckerContext &C, const CallExpr *CE) const; 63 64 void evalstrLength(CheckerContext &C, const CallExpr *CE) const; 65 void evalstrnLength(CheckerContext &C, const CallExpr *CE) const; 66 void evalstrLengthCommon(CheckerContext &C, const CallExpr *CE, 67 bool IsStrnlen = false) const; 68 69 void evalStrcpy(CheckerContext &C, const CallExpr *CE) const; 70 void evalStrncpy(CheckerContext &C, const CallExpr *CE) const; 71 void evalStpcpy(CheckerContext &C, const CallExpr *CE) const; 72 void evalStrcpyCommon(CheckerContext &C, const CallExpr *CE, bool returnEnd, 73 bool isBounded, bool isAppending) const; 74 75 void evalStrcat(CheckerContext &C, const CallExpr *CE) const; 76 void evalStrncat(CheckerContext &C, const CallExpr *CE) const; 77 78 void evalStrcmp(CheckerContext &C, const CallExpr *CE) const; 79 void evalStrncmp(CheckerContext &C, const CallExpr *CE) const; 80 void evalStrcasecmp(CheckerContext &C, const CallExpr *CE) const; 81 void evalStrncasecmp(CheckerContext &C, const CallExpr *CE) const; 82 void evalStrcmpCommon(CheckerContext &C, const CallExpr *CE, 83 bool isBounded = false, bool ignoreCase = false) const; 84 85 // Utility methods 86 std::pair<const GRState*, const GRState*> 87 static assumeZero(CheckerContext &C, 88 const GRState *state, SVal V, QualType Ty); 89 90 static const GRState *setCStringLength(const GRState *state, 91 const MemRegion *MR, SVal strLength); 92 static SVal getCStringLengthForRegion(CheckerContext &C, 93 const GRState *&state, 94 const Expr *Ex, const MemRegion *MR); 95 SVal getCStringLength(CheckerContext &C, const GRState *&state, 96 const Expr *Ex, SVal Buf) const; 97 98 const StringLiteral *getCStringLiteral(CheckerContext &C, 99 const GRState *&state, 100 const Expr *expr, 101 SVal val) const; 102 103 static const GRState *InvalidateBuffer(CheckerContext &C, 104 const GRState *state, 105 const Expr *Ex, SVal V); 106 107 static bool SummarizeRegion(llvm::raw_ostream& os, ASTContext& Ctx, 108 const MemRegion *MR); 109 110 // Re-usable checks 111 const GRState *checkNonNull(CheckerContext &C, const GRState *state, 112 const Expr *S, SVal l) const; 113 const GRState *CheckLocation(CheckerContext &C, const GRState *state, 114 const Expr *S, SVal l, 115 bool IsDestination = false) const; 116 const GRState *CheckBufferAccess(CheckerContext &C, const GRState *state, 117 const Expr *Size, 118 const Expr *FirstBuf, 119 const Expr *SecondBuf = NULL, 120 bool FirstIsDestination = false) const; 121 const GRState *CheckOverlap(CheckerContext &C, const GRState *state, 122 const Expr *Size, const Expr *First, 123 const Expr *Second) const; 124 void emitOverlapBug(CheckerContext &C, const GRState *state, 125 const Stmt *First, const Stmt *Second) const; 126}; 127 128class CStringLength { 129public: 130 typedef llvm::ImmutableMap<const MemRegion *, SVal> EntryMap; 131}; 132} //end anonymous namespace 133 134namespace clang { 135namespace ento { 136 template <> 137 struct GRStateTrait<CStringLength> 138 : public GRStatePartialTrait<CStringLength::EntryMap> { 139 static void *GDMIndex() { return CStringChecker::getTag(); } 140 }; 141} 142} 143 144//===----------------------------------------------------------------------===// 145// Individual checks and utility methods. 146//===----------------------------------------------------------------------===// 147 148std::pair<const GRState*, const GRState*> 149CStringChecker::assumeZero(CheckerContext &C, const GRState *state, SVal V, 150 QualType Ty) { 151 DefinedSVal *val = dyn_cast<DefinedSVal>(&V); 152 if (!val) 153 return std::pair<const GRState*, const GRState *>(state, state); 154 155 SValBuilder &svalBuilder = C.getSValBuilder(); 156 DefinedOrUnknownSVal zero = svalBuilder.makeZeroVal(Ty); 157 return state->assume(svalBuilder.evalEQ(state, *val, zero)); 158} 159 160const GRState *CStringChecker::checkNonNull(CheckerContext &C, 161 const GRState *state, 162 const Expr *S, SVal l) const { 163 // If a previous check has failed, propagate the failure. 164 if (!state) 165 return NULL; 166 167 const GRState *stateNull, *stateNonNull; 168 llvm::tie(stateNull, stateNonNull) = assumeZero(C, state, l, S->getType()); 169 170 if (stateNull && !stateNonNull) { 171 ExplodedNode *N = C.generateSink(stateNull); 172 if (!N) 173 return NULL; 174 175 if (!BT_Null) 176 BT_Null.reset(new BuiltinBug("API", 177 "Null pointer argument in call to byte string function")); 178 179 // Generate a report for this bug. 180 BuiltinBug *BT = static_cast<BuiltinBug*>(BT_Null.get()); 181 EnhancedBugReport *report = new EnhancedBugReport(*BT, 182 BT->getDescription(), N); 183 184 report->addRange(S->getSourceRange()); 185 report->addVisitorCreator(bugreporter::registerTrackNullOrUndefValue, S); 186 C.EmitReport(report); 187 return NULL; 188 } 189 190 // From here on, assume that the value is non-null. 191 assert(stateNonNull); 192 return stateNonNull; 193} 194 195// FIXME: This was originally copied from ArrayBoundChecker.cpp. Refactor? 196const GRState *CStringChecker::CheckLocation(CheckerContext &C, 197 const GRState *state, 198 const Expr *S, SVal l, 199 bool IsDestination) const { 200 // If a previous check has failed, propagate the failure. 201 if (!state) 202 return NULL; 203 204 // Check for out of bound array element access. 205 const MemRegion *R = l.getAsRegion(); 206 if (!R) 207 return state; 208 209 const ElementRegion *ER = dyn_cast<ElementRegion>(R); 210 if (!ER) 211 return state; 212 213 assert(ER->getValueType() == C.getASTContext().CharTy && 214 "CheckLocation should only be called with char* ElementRegions"); 215 216 // Get the size of the array. 217 const SubRegion *superReg = cast<SubRegion>(ER->getSuperRegion()); 218 SValBuilder &svalBuilder = C.getSValBuilder(); 219 SVal Extent = svalBuilder.convertToArrayIndex(superReg->getExtent(svalBuilder)); 220 DefinedOrUnknownSVal Size = cast<DefinedOrUnknownSVal>(Extent); 221 222 // Get the index of the accessed element. 223 DefinedOrUnknownSVal Idx = cast<DefinedOrUnknownSVal>(ER->getIndex()); 224 225 const GRState *StInBound = state->assumeInBound(Idx, Size, true); 226 const GRState *StOutBound = state->assumeInBound(Idx, Size, false); 227 if (StOutBound && !StInBound) { 228 ExplodedNode *N = C.generateSink(StOutBound); 229 if (!N) 230 return NULL; 231 232 BuiltinBug *BT; 233 if (IsDestination) { 234 if (!BT_BoundsWrite) { 235 BT_BoundsWrite.reset(new BuiltinBug("Out-of-bound array access", 236 "Byte string function overflows destination buffer")); 237 } 238 BT = static_cast<BuiltinBug*>(BT_BoundsWrite.get()); 239 } else { 240 if (!BT_Bounds) { 241 BT_Bounds.reset(new BuiltinBug("Out-of-bound array access", 242 "Byte string function accesses out-of-bound array element")); 243 } 244 BT = static_cast<BuiltinBug*>(BT_Bounds.get()); 245 } 246 247 // FIXME: It would be nice to eventually make this diagnostic more clear, 248 // e.g., by referencing the original declaration or by saying *why* this 249 // reference is outside the range. 250 251 // Generate a report for this bug. 252 RangedBugReport *report = new RangedBugReport(*BT, BT->getDescription(), N); 253 254 report->addRange(S->getSourceRange()); 255 C.EmitReport(report); 256 return NULL; 257 } 258 259 // Array bound check succeeded. From this point forward the array bound 260 // should always succeed. 261 return StInBound; 262} 263 264const GRState *CStringChecker::CheckBufferAccess(CheckerContext &C, 265 const GRState *state, 266 const Expr *Size, 267 const Expr *FirstBuf, 268 const Expr *SecondBuf, 269 bool FirstIsDestination) const { 270 // If a previous check has failed, propagate the failure. 271 if (!state) 272 return NULL; 273 274 SValBuilder &svalBuilder = C.getSValBuilder(); 275 ASTContext &Ctx = C.getASTContext(); 276 277 QualType sizeTy = Size->getType(); 278 QualType PtrTy = Ctx.getPointerType(Ctx.CharTy); 279 280 // Check that the first buffer is non-null. 281 SVal BufVal = state->getSVal(FirstBuf); 282 state = checkNonNull(C, state, FirstBuf, BufVal); 283 if (!state) 284 return NULL; 285 286 // Get the access length and make sure it is known. 287 SVal LengthVal = state->getSVal(Size); 288 NonLoc *Length = dyn_cast<NonLoc>(&LengthVal); 289 if (!Length) 290 return state; 291 292 // Compute the offset of the last element to be accessed: size-1. 293 NonLoc One = cast<NonLoc>(svalBuilder.makeIntVal(1, sizeTy)); 294 NonLoc LastOffset = cast<NonLoc>(svalBuilder.evalBinOpNN(state, BO_Sub, 295 *Length, One, sizeTy)); 296 297 // Check that the first buffer is sufficiently long. 298 SVal BufStart = svalBuilder.evalCast(BufVal, PtrTy, FirstBuf->getType()); 299 if (Loc *BufLoc = dyn_cast<Loc>(&BufStart)) { 300 SVal BufEnd = svalBuilder.evalBinOpLN(state, BO_Add, *BufLoc, 301 LastOffset, PtrTy); 302 state = CheckLocation(C, state, FirstBuf, BufEnd, FirstIsDestination); 303 304 // If the buffer isn't large enough, abort. 305 if (!state) 306 return NULL; 307 } 308 309 // If there's a second buffer, check it as well. 310 if (SecondBuf) { 311 BufVal = state->getSVal(SecondBuf); 312 state = checkNonNull(C, state, SecondBuf, BufVal); 313 if (!state) 314 return NULL; 315 316 BufStart = svalBuilder.evalCast(BufVal, PtrTy, SecondBuf->getType()); 317 if (Loc *BufLoc = dyn_cast<Loc>(&BufStart)) { 318 SVal BufEnd = svalBuilder.evalBinOpLN(state, BO_Add, *BufLoc, 319 LastOffset, PtrTy); 320 state = CheckLocation(C, state, SecondBuf, BufEnd); 321 } 322 } 323 324 // Large enough or not, return this state! 325 return state; 326} 327 328const GRState *CStringChecker::CheckOverlap(CheckerContext &C, 329 const GRState *state, 330 const Expr *Size, 331 const Expr *First, 332 const Expr *Second) const { 333 // Do a simple check for overlap: if the two arguments are from the same 334 // buffer, see if the end of the first is greater than the start of the second 335 // or vice versa. 336 337 // If a previous check has failed, propagate the failure. 338 if (!state) 339 return NULL; 340 341 const GRState *stateTrue, *stateFalse; 342 343 // Get the buffer values and make sure they're known locations. 344 SVal firstVal = state->getSVal(First); 345 SVal secondVal = state->getSVal(Second); 346 347 Loc *firstLoc = dyn_cast<Loc>(&firstVal); 348 if (!firstLoc) 349 return state; 350 351 Loc *secondLoc = dyn_cast<Loc>(&secondVal); 352 if (!secondLoc) 353 return state; 354 355 // Are the two values the same? 356 SValBuilder &svalBuilder = C.getSValBuilder(); 357 llvm::tie(stateTrue, stateFalse) = 358 state->assume(svalBuilder.evalEQ(state, *firstLoc, *secondLoc)); 359 360 if (stateTrue && !stateFalse) { 361 // If the values are known to be equal, that's automatically an overlap. 362 emitOverlapBug(C, stateTrue, First, Second); 363 return NULL; 364 } 365 366 // assume the two expressions are not equal. 367 assert(stateFalse); 368 state = stateFalse; 369 370 // Which value comes first? 371 ASTContext &Ctx = svalBuilder.getContext(); 372 QualType cmpTy = Ctx.IntTy; 373 SVal reverse = svalBuilder.evalBinOpLL(state, BO_GT, 374 *firstLoc, *secondLoc, cmpTy); 375 DefinedOrUnknownSVal *reverseTest = dyn_cast<DefinedOrUnknownSVal>(&reverse); 376 if (!reverseTest) 377 return state; 378 379 llvm::tie(stateTrue, stateFalse) = state->assume(*reverseTest); 380 if (stateTrue) { 381 if (stateFalse) { 382 // If we don't know which one comes first, we can't perform this test. 383 return state; 384 } else { 385 // Switch the values so that firstVal is before secondVal. 386 Loc *tmpLoc = firstLoc; 387 firstLoc = secondLoc; 388 secondLoc = tmpLoc; 389 390 // Switch the Exprs as well, so that they still correspond. 391 const Expr *tmpExpr = First; 392 First = Second; 393 Second = tmpExpr; 394 } 395 } 396 397 // Get the length, and make sure it too is known. 398 SVal LengthVal = state->getSVal(Size); 399 NonLoc *Length = dyn_cast<NonLoc>(&LengthVal); 400 if (!Length) 401 return state; 402 403 // Convert the first buffer's start address to char*. 404 // Bail out if the cast fails. 405 QualType CharPtrTy = Ctx.getPointerType(Ctx.CharTy); 406 SVal FirstStart = svalBuilder.evalCast(*firstLoc, CharPtrTy, First->getType()); 407 Loc *FirstStartLoc = dyn_cast<Loc>(&FirstStart); 408 if (!FirstStartLoc) 409 return state; 410 411 // Compute the end of the first buffer. Bail out if THAT fails. 412 SVal FirstEnd = svalBuilder.evalBinOpLN(state, BO_Add, 413 *FirstStartLoc, *Length, CharPtrTy); 414 Loc *FirstEndLoc = dyn_cast<Loc>(&FirstEnd); 415 if (!FirstEndLoc) 416 return state; 417 418 // Is the end of the first buffer past the start of the second buffer? 419 SVal Overlap = svalBuilder.evalBinOpLL(state, BO_GT, 420 *FirstEndLoc, *secondLoc, cmpTy); 421 DefinedOrUnknownSVal *OverlapTest = dyn_cast<DefinedOrUnknownSVal>(&Overlap); 422 if (!OverlapTest) 423 return state; 424 425 llvm::tie(stateTrue, stateFalse) = state->assume(*OverlapTest); 426 427 if (stateTrue && !stateFalse) { 428 // Overlap! 429 emitOverlapBug(C, stateTrue, First, Second); 430 return NULL; 431 } 432 433 // assume the two expressions don't overlap. 434 assert(stateFalse); 435 return stateFalse; 436} 437 438void CStringChecker::emitOverlapBug(CheckerContext &C, const GRState *state, 439 const Stmt *First, const Stmt *Second) const { 440 ExplodedNode *N = C.generateSink(state); 441 if (!N) 442 return; 443 444 if (!BT_Overlap) 445 BT_Overlap.reset(new BugType("Unix API", "Improper arguments")); 446 447 // Generate a report for this bug. 448 RangedBugReport *report = 449 new RangedBugReport(*BT_Overlap, 450 "Arguments must not be overlapping buffers", N); 451 report->addRange(First->getSourceRange()); 452 report->addRange(Second->getSourceRange()); 453 454 C.EmitReport(report); 455} 456 457const GRState *CStringChecker::setCStringLength(const GRState *state, 458 const MemRegion *MR, 459 SVal strLength) { 460 assert(!strLength.isUndef() && "Attempt to set an undefined string length"); 461 if (strLength.isUnknown()) 462 return state; 463 464 MR = MR->StripCasts(); 465 466 switch (MR->getKind()) { 467 case MemRegion::StringRegionKind: 468 // FIXME: This can happen if we strcpy() into a string region. This is 469 // undefined [C99 6.4.5p6], but we should still warn about it. 470 return state; 471 472 case MemRegion::SymbolicRegionKind: 473 case MemRegion::AllocaRegionKind: 474 case MemRegion::VarRegionKind: 475 case MemRegion::FieldRegionKind: 476 case MemRegion::ObjCIvarRegionKind: 477 return state->set<CStringLength>(MR, strLength); 478 479 case MemRegion::ElementRegionKind: 480 // FIXME: Handle element regions by upper-bounding the parent region's 481 // string length. 482 return state; 483 484 default: 485 // Other regions (mostly non-data) can't have a reliable C string length. 486 // For now, just ignore the change. 487 // FIXME: These are rare but not impossible. We should output some kind of 488 // warning for things like strcpy((char[]){'a', 0}, "b"); 489 return state; 490 } 491} 492 493SVal CStringChecker::getCStringLengthForRegion(CheckerContext &C, 494 const GRState *&state, 495 const Expr *Ex, 496 const MemRegion *MR) { 497 // If there's a recorded length, go ahead and return it. 498 const SVal *Recorded = state->get<CStringLength>(MR); 499 if (Recorded) 500 return *Recorded; 501 502 // Otherwise, get a new symbol and update the state. 503 unsigned Count = C.getNodeBuilder().getCurrentBlockCount(); 504 SValBuilder &svalBuilder = C.getSValBuilder(); 505 QualType sizeTy = svalBuilder.getContext().getSizeType(); 506 SVal strLength = svalBuilder.getMetadataSymbolVal(CStringChecker::getTag(), 507 MR, Ex, sizeTy, Count); 508 state = state->set<CStringLength>(MR, strLength); 509 return strLength; 510} 511 512SVal CStringChecker::getCStringLength(CheckerContext &C, const GRState *&state, 513 const Expr *Ex, SVal Buf) const { 514 const MemRegion *MR = Buf.getAsRegion(); 515 if (!MR) { 516 // If we can't get a region, see if it's something we /know/ isn't a 517 // C string. In the context of locations, the only time we can issue such 518 // a warning is for labels. 519 if (loc::GotoLabel *Label = dyn_cast<loc::GotoLabel>(&Buf)) { 520 if (ExplodedNode *N = C.generateNode(state)) { 521 if (!BT_NotCString) 522 BT_NotCString.reset(new BuiltinBug("API", 523 "Argument is not a null-terminated string.")); 524 525 llvm::SmallString<120> buf; 526 llvm::raw_svector_ostream os(buf); 527 os << "Argument to byte string function is the address of the label '" 528 << Label->getLabel()->getName() 529 << "', which is not a null-terminated string"; 530 531 // Generate a report for this bug. 532 EnhancedBugReport *report = new EnhancedBugReport(*BT_NotCString, 533 os.str(), N); 534 535 report->addRange(Ex->getSourceRange()); 536 C.EmitReport(report); 537 } 538 539 return UndefinedVal(); 540 } 541 542 // If it's not a region and not a label, give up. 543 return UnknownVal(); 544 } 545 546 // If we have a region, strip casts from it and see if we can figure out 547 // its length. For anything we can't figure out, just return UnknownVal. 548 MR = MR->StripCasts(); 549 550 switch (MR->getKind()) { 551 case MemRegion::StringRegionKind: { 552 // Modifying the contents of string regions is undefined [C99 6.4.5p6], 553 // so we can assume that the byte length is the correct C string length. 554 SValBuilder &svalBuilder = C.getSValBuilder(); 555 QualType sizeTy = svalBuilder.getContext().getSizeType(); 556 const StringLiteral *strLit = cast<StringRegion>(MR)->getStringLiteral(); 557 return svalBuilder.makeIntVal(strLit->getByteLength(), sizeTy); 558 } 559 case MemRegion::SymbolicRegionKind: 560 case MemRegion::AllocaRegionKind: 561 case MemRegion::VarRegionKind: 562 case MemRegion::FieldRegionKind: 563 case MemRegion::ObjCIvarRegionKind: 564 return getCStringLengthForRegion(C, state, Ex, MR); 565 case MemRegion::CompoundLiteralRegionKind: 566 // FIXME: Can we track this? Is it necessary? 567 return UnknownVal(); 568 case MemRegion::ElementRegionKind: 569 // FIXME: How can we handle this? It's not good enough to subtract the 570 // offset from the base string length; consider "123\x00567" and &a[5]. 571 return UnknownVal(); 572 default: 573 // Other regions (mostly non-data) can't have a reliable C string length. 574 // In this case, an error is emitted and UndefinedVal is returned. 575 // The caller should always be prepared to handle this case. 576 if (ExplodedNode *N = C.generateNode(state)) { 577 if (!BT_NotCString) 578 BT_NotCString.reset(new BuiltinBug("API", 579 "Argument is not a null-terminated string.")); 580 581 llvm::SmallString<120> buf; 582 llvm::raw_svector_ostream os(buf); 583 584 os << "Argument to byte string function is "; 585 586 if (SummarizeRegion(os, C.getASTContext(), MR)) 587 os << ", which is not a null-terminated string"; 588 else 589 os << "not a null-terminated string"; 590 591 // Generate a report for this bug. 592 EnhancedBugReport *report = new EnhancedBugReport(*BT_NotCString, 593 os.str(), N); 594 595 report->addRange(Ex->getSourceRange()); 596 C.EmitReport(report); 597 } 598 599 return UndefinedVal(); 600 } 601} 602 603const StringLiteral *CStringChecker::getCStringLiteral(CheckerContext &C, 604 const GRState *&state, const Expr *expr, SVal val) const { 605 606 // Get the memory region pointed to by the val. 607 const MemRegion *bufRegion = val.getAsRegion(); 608 if (!bufRegion) 609 return NULL; 610 611 // Strip casts off the memory region. 612 bufRegion = bufRegion->StripCasts(); 613 614 // Cast the memory region to a string region. 615 const StringRegion *strRegion= dyn_cast<StringRegion>(bufRegion); 616 if (!strRegion) 617 return NULL; 618 619 // Return the actual string in the string region. 620 return strRegion->getStringLiteral(); 621} 622 623const GRState *CStringChecker::InvalidateBuffer(CheckerContext &C, 624 const GRState *state, 625 const Expr *E, SVal V) { 626 Loc *L = dyn_cast<Loc>(&V); 627 if (!L) 628 return state; 629 630 // FIXME: This is a simplified version of what's in CFRefCount.cpp -- it makes 631 // some assumptions about the value that CFRefCount can't. Even so, it should 632 // probably be refactored. 633 if (loc::MemRegionVal* MR = dyn_cast<loc::MemRegionVal>(L)) { 634 const MemRegion *R = MR->getRegion()->StripCasts(); 635 636 // Are we dealing with an ElementRegion? If so, we should be invalidating 637 // the super-region. 638 if (const ElementRegion *ER = dyn_cast<ElementRegion>(R)) { 639 R = ER->getSuperRegion(); 640 // FIXME: What about layers of ElementRegions? 641 } 642 643 // Invalidate this region. 644 unsigned Count = C.getNodeBuilder().getCurrentBlockCount(); 645 return state->invalidateRegion(R, E, Count, NULL); 646 } 647 648 // If we have a non-region value by chance, just remove the binding. 649 // FIXME: is this necessary or correct? This handles the non-Region 650 // cases. Is it ever valid to store to these? 651 return state->unbindLoc(*L); 652} 653 654bool CStringChecker::SummarizeRegion(llvm::raw_ostream& os, ASTContext& Ctx, 655 const MemRegion *MR) { 656 const TypedRegion *TR = dyn_cast<TypedRegion>(MR); 657 if (!TR) 658 return false; 659 660 switch (TR->getKind()) { 661 case MemRegion::FunctionTextRegionKind: { 662 const FunctionDecl *FD = cast<FunctionTextRegion>(TR)->getDecl(); 663 if (FD) 664 os << "the address of the function '" << FD << "'"; 665 else 666 os << "the address of a function"; 667 return true; 668 } 669 case MemRegion::BlockTextRegionKind: 670 os << "block text"; 671 return true; 672 case MemRegion::BlockDataRegionKind: 673 os << "a block"; 674 return true; 675 case MemRegion::CXXThisRegionKind: 676 case MemRegion::CXXTempObjectRegionKind: 677 os << "a C++ temp object of type " << TR->getValueType().getAsString(); 678 return true; 679 case MemRegion::VarRegionKind: 680 os << "a variable of type" << TR->getValueType().getAsString(); 681 return true; 682 case MemRegion::FieldRegionKind: 683 os << "a field of type " << TR->getValueType().getAsString(); 684 return true; 685 case MemRegion::ObjCIvarRegionKind: 686 os << "an instance variable of type " << TR->getValueType().getAsString(); 687 return true; 688 default: 689 return false; 690 } 691} 692 693//===----------------------------------------------------------------------===// 694// evaluation of individual function calls. 695//===----------------------------------------------------------------------===// 696 697void CStringChecker::evalCopyCommon(CheckerContext &C, 698 const CallExpr *CE, 699 const GRState *state, 700 const Expr *Size, const Expr *Dest, 701 const Expr *Source, bool Restricted, 702 bool IsMempcpy) const { 703 // See if the size argument is zero. 704 SVal sizeVal = state->getSVal(Size); 705 QualType sizeTy = Size->getType(); 706 707 const GRState *stateZeroSize, *stateNonZeroSize; 708 llvm::tie(stateZeroSize, stateNonZeroSize) = assumeZero(C, state, sizeVal, sizeTy); 709 710 // Get the value of the Dest. 711 SVal destVal = state->getSVal(Dest); 712 713 // If the size is zero, there won't be any actual memory access, so 714 // just bind the return value to the destination buffer and return. 715 if (stateZeroSize) { 716 stateZeroSize = stateZeroSize->BindExpr(CE, destVal); 717 C.addTransition(stateZeroSize); 718 } 719 720 // If the size can be nonzero, we have to check the other arguments. 721 if (stateNonZeroSize) { 722 state = stateNonZeroSize; 723 724 // Ensure the destination is not null. If it is NULL there will be a 725 // NULL pointer dereference. 726 state = checkNonNull(C, state, Dest, destVal); 727 if (!state) 728 return; 729 730 // Get the value of the Src. 731 SVal srcVal = state->getSVal(Source); 732 733 // Ensure the source is not null. If it is NULL there will be a 734 // NULL pointer dereference. 735 state = checkNonNull(C, state, Source, srcVal); 736 if (!state) 737 return; 738 739 // Ensure the buffers do not overlap. 740 state = stateNonZeroSize; 741 state = CheckBufferAccess(C, state, Size, Dest, Source, 742 /* FirstIsDst = */ true); 743 if (Restricted) 744 state = CheckOverlap(C, state, Size, Dest, Source); 745 746 if (state) { 747 748 // If this is mempcpy, get the byte after the last byte copied and 749 // bind the expr. 750 if (IsMempcpy) { 751 loc::MemRegionVal *destRegVal = dyn_cast<loc::MemRegionVal>(&destVal); 752 753 // Get the length to copy. 754 SVal lenVal = state->getSVal(Size); 755 NonLoc *lenValNonLoc = dyn_cast<NonLoc>(&lenVal); 756 757 // Get the byte after the last byte copied. 758 SVal lastElement = C.getSValBuilder().evalBinOpLN(state, BO_Add, 759 *destRegVal, 760 *lenValNonLoc, 761 Dest->getType()); 762 763 // The byte after the last byte copied is the return value. 764 state = state->BindExpr(CE, lastElement); 765 } 766 767 // Invalidate the destination. 768 // FIXME: Even if we can't perfectly model the copy, we should see if we 769 // can use LazyCompoundVals to copy the source values into the destination. 770 // This would probably remove any existing bindings past the end of the 771 // copied region, but that's still an improvement over blank invalidation. 772 state = InvalidateBuffer(C, state, Dest, state->getSVal(Dest)); 773 C.addTransition(state); 774 } 775 } 776} 777 778 779void CStringChecker::evalMemcpy(CheckerContext &C, const CallExpr *CE) const { 780 // void *memcpy(void *restrict dst, const void *restrict src, size_t n); 781 // The return value is the address of the destination buffer. 782 const Expr *Dest = CE->getArg(0); 783 const GRState *state = C.getState(); 784 state = state->BindExpr(CE, state->getSVal(Dest)); 785 evalCopyCommon(C, CE, state, CE->getArg(2), Dest, CE->getArg(1), true); 786} 787 788void CStringChecker::evalMempcpy(CheckerContext &C, const CallExpr *CE) const { 789 // void *mempcpy(void *restrict dst, const void *restrict src, size_t n); 790 // The return value is a pointer to the byte following the last written byte. 791 const Expr *Dest = CE->getArg(0); 792 const GRState *state = C.getState(); 793 794 evalCopyCommon(C, CE, state, CE->getArg(2), Dest, CE->getArg(1), true, true); 795} 796 797void CStringChecker::evalMemmove(CheckerContext &C, const CallExpr *CE) const { 798 // void *memmove(void *dst, const void *src, size_t n); 799 // The return value is the address of the destination buffer. 800 const Expr *Dest = CE->getArg(0); 801 const GRState *state = C.getState(); 802 state = state->BindExpr(CE, state->getSVal(Dest)); 803 evalCopyCommon(C, CE, state, CE->getArg(2), Dest, CE->getArg(1)); 804} 805 806void CStringChecker::evalBcopy(CheckerContext &C, const CallExpr *CE) const { 807 // void bcopy(const void *src, void *dst, size_t n); 808 evalCopyCommon(C, CE, C.getState(), 809 CE->getArg(2), CE->getArg(1), CE->getArg(0)); 810} 811 812void CStringChecker::evalMemcmp(CheckerContext &C, const CallExpr *CE) const { 813 // int memcmp(const void *s1, const void *s2, size_t n); 814 const Expr *Left = CE->getArg(0); 815 const Expr *Right = CE->getArg(1); 816 const Expr *Size = CE->getArg(2); 817 818 const GRState *state = C.getState(); 819 SValBuilder &svalBuilder = C.getSValBuilder(); 820 821 // See if the size argument is zero. 822 SVal sizeVal = state->getSVal(Size); 823 QualType sizeTy = Size->getType(); 824 825 const GRState *stateZeroSize, *stateNonZeroSize; 826 llvm::tie(stateZeroSize, stateNonZeroSize) = 827 assumeZero(C, state, sizeVal, sizeTy); 828 829 // If the size can be zero, the result will be 0 in that case, and we don't 830 // have to check either of the buffers. 831 if (stateZeroSize) { 832 state = stateZeroSize; 833 state = state->BindExpr(CE, svalBuilder.makeZeroVal(CE->getType())); 834 C.addTransition(state); 835 } 836 837 // If the size can be nonzero, we have to check the other arguments. 838 if (stateNonZeroSize) { 839 state = stateNonZeroSize; 840 // If we know the two buffers are the same, we know the result is 0. 841 // First, get the two buffers' addresses. Another checker will have already 842 // made sure they're not undefined. 843 DefinedOrUnknownSVal LV = cast<DefinedOrUnknownSVal>(state->getSVal(Left)); 844 DefinedOrUnknownSVal RV = cast<DefinedOrUnknownSVal>(state->getSVal(Right)); 845 846 // See if they are the same. 847 DefinedOrUnknownSVal SameBuf = svalBuilder.evalEQ(state, LV, RV); 848 const GRState *StSameBuf, *StNotSameBuf; 849 llvm::tie(StSameBuf, StNotSameBuf) = state->assume(SameBuf); 850 851 // If the two arguments might be the same buffer, we know the result is zero, 852 // and we only need to check one size. 853 if (StSameBuf) { 854 state = StSameBuf; 855 state = CheckBufferAccess(C, state, Size, Left); 856 if (state) { 857 state = StSameBuf->BindExpr(CE, svalBuilder.makeZeroVal(CE->getType())); 858 C.addTransition(state); 859 } 860 } 861 862 // If the two arguments might be different buffers, we have to check the 863 // size of both of them. 864 if (StNotSameBuf) { 865 state = StNotSameBuf; 866 state = CheckBufferAccess(C, state, Size, Left, Right); 867 if (state) { 868 // The return value is the comparison result, which we don't know. 869 unsigned Count = C.getNodeBuilder().getCurrentBlockCount(); 870 SVal CmpV = svalBuilder.getConjuredSymbolVal(NULL, CE, Count); 871 state = state->BindExpr(CE, CmpV); 872 C.addTransition(state); 873 } 874 } 875 } 876} 877 878void CStringChecker::evalstrLength(CheckerContext &C, 879 const CallExpr *CE) const { 880 // size_t strlen(const char *s); 881 evalstrLengthCommon(C, CE, /* IsStrnlen = */ false); 882} 883 884void CStringChecker::evalstrnLength(CheckerContext &C, 885 const CallExpr *CE) const { 886 // size_t strnlen(const char *s, size_t maxlen); 887 evalstrLengthCommon(C, CE, /* IsStrnlen = */ true); 888} 889 890void CStringChecker::evalstrLengthCommon(CheckerContext &C, const CallExpr *CE, 891 bool IsStrnlen) const { 892 const GRState *state = C.getState(); 893 const Expr *Arg = CE->getArg(0); 894 SVal ArgVal = state->getSVal(Arg); 895 896 // Check that the argument is non-null. 897 state = checkNonNull(C, state, Arg, ArgVal); 898 899 if (state) { 900 SVal strLength = getCStringLength(C, state, Arg, ArgVal); 901 902 // If the argument isn't a valid C string, there's no valid state to 903 // transition to. 904 if (strLength.isUndef()) 905 return; 906 907 // If the check is for strnlen() then bind the return value to no more than 908 // the maxlen value. 909 if (IsStrnlen) { 910 const Expr *maxlenExpr = CE->getArg(1); 911 SVal maxlenVal = state->getSVal(maxlenExpr); 912 913 NonLoc *strLengthNL = dyn_cast<NonLoc>(&strLength); 914 NonLoc *maxlenValNL = dyn_cast<NonLoc>(&maxlenVal); 915 916 QualType cmpTy = C.getSValBuilder().getContext().IntTy; 917 const GRState *stateTrue, *stateFalse; 918 919 // Check if the strLength is greater than or equal to the maxlen 920 llvm::tie(stateTrue, stateFalse) = 921 state->assume(cast<DefinedOrUnknownSVal> 922 (C.getSValBuilder().evalBinOpNN(state, BO_GE, 923 *strLengthNL, *maxlenValNL, 924 cmpTy))); 925 926 // If the strLength is greater than or equal to the maxlen, set strLength 927 // to maxlen 928 if (stateTrue && !stateFalse) { 929 strLength = maxlenVal; 930 } 931 } 932 933 // If getCStringLength couldn't figure out the length, conjure a return 934 // value, so it can be used in constraints, at least. 935 if (strLength.isUnknown()) { 936 unsigned Count = C.getNodeBuilder().getCurrentBlockCount(); 937 strLength = C.getSValBuilder().getConjuredSymbolVal(NULL, CE, Count); 938 } 939 940 // Bind the return value. 941 state = state->BindExpr(CE, strLength); 942 C.addTransition(state); 943 } 944} 945 946void CStringChecker::evalStrcpy(CheckerContext &C, const CallExpr *CE) const { 947 // char *strcpy(char *restrict dst, const char *restrict src); 948 evalStrcpyCommon(C, CE, 949 /* returnEnd = */ false, 950 /* isBounded = */ false, 951 /* isAppending = */ false); 952} 953 954void CStringChecker::evalStrncpy(CheckerContext &C, const CallExpr *CE) const { 955 // char *strncpy(char *restrict dst, const char *restrict src, size_t n); 956 evalStrcpyCommon(C, CE, 957 /* returnEnd = */ false, 958 /* isBounded = */ true, 959 /* isAppending = */ false); 960} 961 962void CStringChecker::evalStpcpy(CheckerContext &C, const CallExpr *CE) const { 963 // char *stpcpy(char *restrict dst, const char *restrict src); 964 evalStrcpyCommon(C, CE, 965 /* returnEnd = */ true, 966 /* isBounded = */ false, 967 /* isAppending = */ false); 968} 969 970void CStringChecker::evalStrcat(CheckerContext &C, const CallExpr *CE) const { 971 //char *strcat(char *restrict s1, const char *restrict s2); 972 evalStrcpyCommon(C, CE, 973 /* returnEnd = */ false, 974 /* isBounded = */ false, 975 /* isAppending = */ true); 976} 977 978void CStringChecker::evalStrncat(CheckerContext &C, const CallExpr *CE) const { 979 //char *strncat(char *restrict s1, const char *restrict s2, size_t n); 980 evalStrcpyCommon(C, CE, 981 /* returnEnd = */ false, 982 /* isBounded = */ true, 983 /* isAppending = */ true); 984} 985 986void CStringChecker::evalStrcpyCommon(CheckerContext &C, const CallExpr *CE, 987 bool returnEnd, bool isBounded, 988 bool isAppending) const { 989 const GRState *state = C.getState(); 990 991 // Check that the destination is non-null. 992 const Expr *Dst = CE->getArg(0); 993 SVal DstVal = state->getSVal(Dst); 994 995 state = checkNonNull(C, state, Dst, DstVal); 996 if (!state) 997 return; 998 999 // Check that the source is non-null. 1000 const Expr *srcExpr = CE->getArg(1); 1001 SVal srcVal = state->getSVal(srcExpr); 1002 state = checkNonNull(C, state, srcExpr, srcVal); 1003 if (!state) 1004 return; 1005 1006 // Get the string length of the source. 1007 SVal strLength = getCStringLength(C, state, srcExpr, srcVal); 1008 1009 // If the source isn't a valid C string, give up. 1010 if (strLength.isUndef()) 1011 return; 1012 1013 // If the function is strncpy, strncat, etc... it is bounded. 1014 if (isBounded) { 1015 // Get the max number of characters to copy. 1016 const Expr *lenExpr = CE->getArg(2); 1017 SVal lenVal = state->getSVal(lenExpr); 1018 1019 // Cast the length to a NonLoc SVal. If it is not a NonLoc then give up. 1020 NonLoc *strLengthNL = dyn_cast<NonLoc>(&strLength); 1021 if (!strLengthNL) 1022 return; 1023 1024 // Cast the max length to a NonLoc SVal. If it is not a NonLoc then give up. 1025 NonLoc *lenValNL = dyn_cast<NonLoc>(&lenVal); 1026 if (!lenValNL) 1027 return; 1028 1029 QualType cmpTy = C.getSValBuilder().getContext().IntTy; 1030 const GRState *stateTrue, *stateFalse; 1031 1032 // Check if the max number to copy is less than the length of the src. 1033 llvm::tie(stateTrue, stateFalse) = 1034 state->assume(cast<DefinedOrUnknownSVal> 1035 (C.getSValBuilder().evalBinOpNN(state, BO_GT, 1036 *strLengthNL, *lenValNL, 1037 cmpTy))); 1038 1039 if (stateTrue) { 1040 // Max number to copy is less than the length of the src, so the actual 1041 // strLength copied is the max number arg. 1042 strLength = lenVal; 1043 } 1044 } 1045 1046 // If this is an appending function (strcat, strncat...) then set the 1047 // string length to strlen(src) + strlen(dst) since the buffer will 1048 // ultimately contain both. 1049 if (isAppending) { 1050 // Get the string length of the destination, or give up. 1051 SVal dstStrLength = getCStringLength(C, state, Dst, DstVal); 1052 if (dstStrLength.isUndef()) 1053 return; 1054 1055 NonLoc *srcStrLengthNL = dyn_cast<NonLoc>(&strLength); 1056 NonLoc *dstStrLengthNL = dyn_cast<NonLoc>(&dstStrLength); 1057 1058 // If src or dst cast to NonLoc is NULL, give up. 1059 if ((!srcStrLengthNL) || (!dstStrLengthNL)) 1060 return; 1061 1062 QualType addTy = C.getSValBuilder().getContext().getSizeType(); 1063 1064 strLength = C.getSValBuilder().evalBinOpNN(state, BO_Add, 1065 *srcStrLengthNL, *dstStrLengthNL, 1066 addTy); 1067 } 1068 1069 SVal Result = (returnEnd ? UnknownVal() : DstVal); 1070 1071 // If the destination is a MemRegion, try to check for a buffer overflow and 1072 // record the new string length. 1073 if (loc::MemRegionVal *dstRegVal = dyn_cast<loc::MemRegionVal>(&DstVal)) { 1074 // If the length is known, we can check for an overflow. 1075 if (NonLoc *knownStrLength = dyn_cast<NonLoc>(&strLength)) { 1076 SVal lastElement = 1077 C.getSValBuilder().evalBinOpLN(state, BO_Add, *dstRegVal, 1078 *knownStrLength, Dst->getType()); 1079 1080 state = CheckLocation(C, state, Dst, lastElement, /* IsDst = */ true); 1081 if (!state) 1082 return; 1083 1084 // If this is a stpcpy-style copy, the last element is the return value. 1085 if (returnEnd) 1086 Result = lastElement; 1087 } 1088 1089 // Invalidate the destination. This must happen before we set the C string 1090 // length because invalidation will clear the length. 1091 // FIXME: Even if we can't perfectly model the copy, we should see if we 1092 // can use LazyCompoundVals to copy the source values into the destination. 1093 // This would probably remove any existing bindings past the end of the 1094 // string, but that's still an improvement over blank invalidation. 1095 state = InvalidateBuffer(C, state, Dst, *dstRegVal); 1096 1097 // Set the C string length of the destination. 1098 state = setCStringLength(state, dstRegVal->getRegion(), strLength); 1099 } 1100 1101 // If this is a stpcpy-style copy, but we were unable to check for a buffer 1102 // overflow, we still need a result. Conjure a return value. 1103 if (returnEnd && Result.isUnknown()) { 1104 SValBuilder &svalBuilder = C.getSValBuilder(); 1105 unsigned Count = C.getNodeBuilder().getCurrentBlockCount(); 1106 strLength = svalBuilder.getConjuredSymbolVal(NULL, CE, Count); 1107 } 1108 1109 // Set the return value. 1110 state = state->BindExpr(CE, Result); 1111 C.addTransition(state); 1112} 1113 1114void CStringChecker::evalStrcmp(CheckerContext &C, const CallExpr *CE) const { 1115 //int strcmp(const char *restrict s1, const char *restrict s2); 1116 evalStrcmpCommon(C, CE, /* isBounded = */ false, /* ignoreCase = */ false); 1117} 1118 1119void CStringChecker::evalStrncmp(CheckerContext &C, const CallExpr *CE) const { 1120 //int strncmp(const char *restrict s1, const char *restrict s2, size_t n); 1121 evalStrcmpCommon(C, CE, /* isBounded = */ true, /* ignoreCase = */ false); 1122} 1123 1124void CStringChecker::evalStrcasecmp(CheckerContext &C, 1125 const CallExpr *CE) const { 1126 //int strcasecmp(const char *restrict s1, const char *restrict s2); 1127 evalStrcmpCommon(C, CE, /* isBounded = */ false, /* ignoreCase = */ true); 1128} 1129 1130void CStringChecker::evalStrncasecmp(CheckerContext &C, 1131 const CallExpr *CE) const { 1132 //int strncasecmp(const char *restrict s1, const char *restrict s2, size_t n); 1133 evalStrcmpCommon(C, CE, /* isBounded = */ true, /* ignoreCase = */ true); 1134} 1135 1136void CStringChecker::evalStrcmpCommon(CheckerContext &C, const CallExpr *CE, 1137 bool isBounded, bool ignoreCase) const { 1138 const GRState *state = C.getState(); 1139 1140 // Check that the first string is non-null 1141 const Expr *s1 = CE->getArg(0); 1142 SVal s1Val = state->getSVal(s1); 1143 state = checkNonNull(C, state, s1, s1Val); 1144 if (!state) 1145 return; 1146 1147 // Check that the second string is non-null. 1148 const Expr *s2 = CE->getArg(1); 1149 SVal s2Val = state->getSVal(s2); 1150 state = checkNonNull(C, state, s2, s2Val); 1151 if (!state) 1152 return; 1153 1154 // Get the string length of the first string or give up. 1155 SVal s1Length = getCStringLength(C, state, s1, s1Val); 1156 if (s1Length.isUndef()) 1157 return; 1158 1159 // Get the string length of the second string or give up. 1160 SVal s2Length = getCStringLength(C, state, s2, s2Val); 1161 if (s2Length.isUndef()) 1162 return; 1163 1164 // Get the string literal of the first string. 1165 const StringLiteral *s1StrLiteral = getCStringLiteral(C, state, s1, s1Val); 1166 if (!s1StrLiteral) 1167 return; 1168 llvm::StringRef s1StrRef = s1StrLiteral->getString(); 1169 1170 // Get the string literal of the second string. 1171 const StringLiteral *s2StrLiteral = getCStringLiteral(C, state, s2, s2Val); 1172 if (!s2StrLiteral) 1173 return; 1174 llvm::StringRef s2StrRef = s2StrLiteral->getString(); 1175 1176 int result; 1177 if (isBounded) { 1178 // Get the max number of characters to compare. 1179 const Expr *lenExpr = CE->getArg(2); 1180 SVal lenVal = state->getSVal(lenExpr); 1181 1182 // Dynamically cast the length to a ConcreteInt. If it is not a ConcreteInt 1183 // then give up, otherwise get the value and use it as the bounds. 1184 nonloc::ConcreteInt *CI = dyn_cast<nonloc::ConcreteInt>(&lenVal); 1185 if (!CI) 1186 return; 1187 llvm::APSInt lenInt(CI->getValue()); 1188 1189 // Create substrings of each to compare the prefix. 1190 s1StrRef = s1StrRef.substr(0, (size_t)lenInt.getLimitedValue()); 1191 s2StrRef = s2StrRef.substr(0, (size_t)lenInt.getLimitedValue()); 1192 } 1193 1194 if (ignoreCase) { 1195 // Compare string 1 to string 2 the same way strcasecmp() does. 1196 result = s1StrRef.compare_lower(s2StrRef); 1197 } else { 1198 // Compare string 1 to string 2 the same way strcmp() does. 1199 result = s1StrRef.compare(s2StrRef); 1200 } 1201 1202 // Build the SVal of the comparison to bind the return value. 1203 SValBuilder &svalBuilder = C.getSValBuilder(); 1204 QualType intTy = svalBuilder.getContext().IntTy; 1205 SVal resultVal = svalBuilder.makeIntVal(result, intTy); 1206 1207 // Bind the return value of the expression. 1208 // Set the return value. 1209 state = state->BindExpr(CE, resultVal); 1210 C.addTransition(state); 1211} 1212 1213//===----------------------------------------------------------------------===// 1214// The driver method, and other Checker callbacks. 1215//===----------------------------------------------------------------------===// 1216 1217bool CStringChecker::evalCall(const CallExpr *CE, CheckerContext &C) const { 1218 // Get the callee. All the functions we care about are C functions 1219 // with simple identifiers. 1220 const GRState *state = C.getState(); 1221 const Expr *Callee = CE->getCallee(); 1222 const FunctionDecl *FD = state->getSVal(Callee).getAsFunctionDecl(); 1223 1224 if (!FD) 1225 return false; 1226 1227 // Get the name of the callee. If it's a builtin, strip off the prefix. 1228 IdentifierInfo *II = FD->getIdentifier(); 1229 if (!II) // if no identifier, not a simple C function 1230 return false; 1231 llvm::StringRef Name = II->getName(); 1232 if (Name.startswith("__builtin_")) 1233 Name = Name.substr(10); 1234 1235 FnCheck evalFunction = llvm::StringSwitch<FnCheck>(Name) 1236 .Cases("memcpy", "__memcpy_chk", &CStringChecker::evalMemcpy) 1237 .Cases("mempcpy", "__mempcpy_chk", &CStringChecker::evalMempcpy) 1238 .Cases("memcmp", "bcmp", &CStringChecker::evalMemcmp) 1239 .Cases("memmove", "__memmove_chk", &CStringChecker::evalMemmove) 1240 .Cases("strcpy", "__strcpy_chk", &CStringChecker::evalStrcpy) 1241 //.Cases("strncpy", "__strncpy_chk", &CStringChecker::evalStrncpy) 1242 .Cases("stpcpy", "__stpcpy_chk", &CStringChecker::evalStpcpy) 1243 .Cases("strcat", "__strcat_chk", &CStringChecker::evalStrcat) 1244 .Cases("strncat", "__strncat_chk", &CStringChecker::evalStrncat) 1245 .Case("strlen", &CStringChecker::evalstrLength) 1246 .Case("strnlen", &CStringChecker::evalstrnLength) 1247 .Case("strcmp", &CStringChecker::evalStrcmp) 1248 .Case("strncmp", &CStringChecker::evalStrncmp) 1249 .Case("strcasecmp", &CStringChecker::evalStrcasecmp) 1250 .Case("strncasecmp", &CStringChecker::evalStrncasecmp) 1251 .Case("bcopy", &CStringChecker::evalBcopy) 1252 .Default(NULL); 1253 1254 // If the callee isn't a string function, let another checker handle it. 1255 if (!evalFunction) 1256 return false; 1257 1258 // Check and evaluate the call. 1259 (this->*evalFunction)(C, CE); 1260 return true; 1261} 1262 1263void CStringChecker::checkPreStmt(const DeclStmt *DS, CheckerContext &C) const { 1264 // Record string length for char a[] = "abc"; 1265 const GRState *state = C.getState(); 1266 1267 for (DeclStmt::const_decl_iterator I = DS->decl_begin(), E = DS->decl_end(); 1268 I != E; ++I) { 1269 const VarDecl *D = dyn_cast<VarDecl>(*I); 1270 if (!D) 1271 continue; 1272 1273 // FIXME: Handle array fields of structs. 1274 if (!D->getType()->isArrayType()) 1275 continue; 1276 1277 const Expr *Init = D->getInit(); 1278 if (!Init) 1279 continue; 1280 if (!isa<StringLiteral>(Init)) 1281 continue; 1282 1283 Loc VarLoc = state->getLValue(D, C.getPredecessor()->getLocationContext()); 1284 const MemRegion *MR = VarLoc.getAsRegion(); 1285 if (!MR) 1286 continue; 1287 1288 SVal StrVal = state->getSVal(Init); 1289 assert(StrVal.isValid() && "Initializer string is unknown or undefined"); 1290 DefinedOrUnknownSVal strLength 1291 = cast<DefinedOrUnknownSVal>(getCStringLength(C, state, Init, StrVal)); 1292 1293 state = state->set<CStringLength>(MR, strLength); 1294 } 1295 1296 C.addTransition(state); 1297} 1298 1299bool CStringChecker::wantsRegionChangeUpdate(const GRState *state) const { 1300 CStringLength::EntryMap Entries = state->get<CStringLength>(); 1301 return !Entries.isEmpty(); 1302} 1303 1304const GRState * 1305CStringChecker::checkRegionChanges(const GRState *state, 1306 const StoreManager::InvalidatedSymbols *, 1307 const MemRegion * const *Begin, 1308 const MemRegion * const *End) const { 1309 CStringLength::EntryMap Entries = state->get<CStringLength>(); 1310 if (Entries.isEmpty()) 1311 return state; 1312 1313 llvm::SmallPtrSet<const MemRegion *, 8> Invalidated; 1314 llvm::SmallPtrSet<const MemRegion *, 32> SuperRegions; 1315 1316 // First build sets for the changed regions and their super-regions. 1317 for ( ; Begin != End; ++Begin) { 1318 const MemRegion *MR = *Begin; 1319 Invalidated.insert(MR); 1320 1321 SuperRegions.insert(MR); 1322 while (const SubRegion *SR = dyn_cast<SubRegion>(MR)) { 1323 MR = SR->getSuperRegion(); 1324 SuperRegions.insert(MR); 1325 } 1326 } 1327 1328 CStringLength::EntryMap::Factory &F = state->get_context<CStringLength>(); 1329 1330 // Then loop over the entries in the current state. 1331 for (CStringLength::EntryMap::iterator I = Entries.begin(), 1332 E = Entries.end(); I != E; ++I) { 1333 const MemRegion *MR = I.getKey(); 1334 1335 // Is this entry for a super-region of a changed region? 1336 if (SuperRegions.count(MR)) { 1337 Entries = F.remove(Entries, MR); 1338 continue; 1339 } 1340 1341 // Is this entry for a sub-region of a changed region? 1342 const MemRegion *Super = MR; 1343 while (const SubRegion *SR = dyn_cast<SubRegion>(Super)) { 1344 Super = SR->getSuperRegion(); 1345 if (Invalidated.count(Super)) { 1346 Entries = F.remove(Entries, MR); 1347 break; 1348 } 1349 } 1350 } 1351 1352 return state->set<CStringLength>(Entries); 1353} 1354 1355void CStringChecker::checkLiveSymbols(const GRState *state, 1356 SymbolReaper &SR) const { 1357 // Mark all symbols in our string length map as valid. 1358 CStringLength::EntryMap Entries = state->get<CStringLength>(); 1359 1360 for (CStringLength::EntryMap::iterator I = Entries.begin(), E = Entries.end(); 1361 I != E; ++I) { 1362 SVal Len = I.getData(); 1363 if (SymbolRef Sym = Len.getAsSymbol()) 1364 SR.markInUse(Sym); 1365 } 1366} 1367 1368void CStringChecker::checkDeadSymbols(SymbolReaper &SR, 1369 CheckerContext &C) const { 1370 if (!SR.hasDeadSymbols()) 1371 return; 1372 1373 const GRState *state = C.getState(); 1374 CStringLength::EntryMap Entries = state->get<CStringLength>(); 1375 if (Entries.isEmpty()) 1376 return; 1377 1378 CStringLength::EntryMap::Factory &F = state->get_context<CStringLength>(); 1379 for (CStringLength::EntryMap::iterator I = Entries.begin(), E = Entries.end(); 1380 I != E; ++I) { 1381 SVal Len = I.getData(); 1382 if (SymbolRef Sym = Len.getAsSymbol()) { 1383 if (SR.isDead(Sym)) 1384 Entries = F.remove(Entries, I.getKey()); 1385 } 1386 } 1387 1388 state = state->set<CStringLength>(Entries); 1389 C.generateNode(state); 1390} 1391 1392void ento::registerCStringChecker(CheckerManager &mgr) { 1393 mgr.registerChecker<CStringChecker>(); 1394} 1395