MallocChecker.cpp revision 393f98b5b7f7c950d2b0a7d84501b5dfd00ad780
1//=== MallocChecker.cpp - A malloc/free checker -------------------*- C++ -*--// 2// 3// The LLVM Compiler Infrastructure 4// 5// This file is distributed under the University of Illinois Open Source 6// License. See LICENSE.TXT for details. 7// 8//===----------------------------------------------------------------------===// 9// 10// This file defines malloc/free checker, which checks for potential memory 11// leaks, double free, and use-after-free problems. 12// 13//===----------------------------------------------------------------------===// 14 15#include "ClangSACheckers.h" 16#include "InterCheckerAPI.h" 17#include "clang/StaticAnalyzer/Core/Checker.h" 18#include "clang/StaticAnalyzer/Core/CheckerManager.h" 19#include "clang/StaticAnalyzer/Core/PathSensitive/CheckerContext.h" 20#include "clang/StaticAnalyzer/Core/BugReporter/BugType.h" 21#include "clang/StaticAnalyzer/Core/PathSensitive/ObjCMessage.h" 22#include "clang/StaticAnalyzer/Core/PathSensitive/ProgramState.h" 23#include "clang/StaticAnalyzer/Core/PathSensitive/ProgramStateTrait.h" 24#include "clang/StaticAnalyzer/Core/PathSensitive/SymbolManager.h" 25#include "clang/Basic/SourceManager.h" 26#include "llvm/ADT/ImmutableMap.h" 27#include "llvm/ADT/SmallString.h" 28#include "llvm/ADT/STLExtras.h" 29#include <climits> 30 31using namespace clang; 32using namespace ento; 33 34namespace { 35 36class RefState { 37 enum Kind { AllocateUnchecked, AllocateFailed, Released, Escaped, 38 Relinquished } K; 39 const Stmt *S; 40 41public: 42 RefState(Kind k, const Stmt *s) : K(k), S(s) {} 43 44 bool isAllocated() const { return K == AllocateUnchecked; } 45 bool isReleased() const { return K == Released; } 46 47 const Stmt *getStmt() const { return S; } 48 49 bool operator==(const RefState &X) const { 50 return K == X.K && S == X.S; 51 } 52 53 static RefState getAllocateUnchecked(const Stmt *s) { 54 return RefState(AllocateUnchecked, s); 55 } 56 static RefState getAllocateFailed() { 57 return RefState(AllocateFailed, 0); 58 } 59 static RefState getReleased(const Stmt *s) { return RefState(Released, s); } 60 static RefState getEscaped(const Stmt *s) { return RefState(Escaped, s); } 61 static RefState getRelinquished(const Stmt *s) { 62 return RefState(Relinquished, s); 63 } 64 65 void Profile(llvm::FoldingSetNodeID &ID) const { 66 ID.AddInteger(K); 67 ID.AddPointer(S); 68 } 69}; 70 71struct ReallocPair { 72 SymbolRef ReallocatedSym; 73 bool IsFreeOnFailure; 74 ReallocPair(SymbolRef S, bool F) : ReallocatedSym(S), IsFreeOnFailure(F) {} 75 void Profile(llvm::FoldingSetNodeID &ID) const { 76 ID.AddInteger(IsFreeOnFailure); 77 ID.AddPointer(ReallocatedSym); 78 } 79 bool operator==(const ReallocPair &X) const { 80 return ReallocatedSym == X.ReallocatedSym && 81 IsFreeOnFailure == X.IsFreeOnFailure; 82 } 83}; 84 85class MallocChecker : public Checker<check::DeadSymbols, 86 check::EndPath, 87 check::PreStmt<ReturnStmt>, 88 check::PreStmt<CallExpr>, 89 check::PostStmt<CallExpr>, 90 check::Location, 91 check::Bind, 92 eval::Assume, 93 check::RegionChanges> 94{ 95 mutable OwningPtr<BugType> BT_DoubleFree; 96 mutable OwningPtr<BugType> BT_Leak; 97 mutable OwningPtr<BugType> BT_UseFree; 98 mutable OwningPtr<BugType> BT_BadFree; 99 mutable IdentifierInfo *II_malloc, *II_free, *II_realloc, *II_calloc, 100 *II_valloc, *II_reallocf, *II_strndup, *II_strdup; 101 102public: 103 MallocChecker() : II_malloc(0), II_free(0), II_realloc(0), II_calloc(0), 104 II_valloc(0), II_reallocf(0), II_strndup(0), II_strdup(0) {} 105 106 /// In pessimistic mode, the checker assumes that it does not know which 107 /// functions might free the memory. 108 struct ChecksFilter { 109 DefaultBool CMallocPessimistic; 110 DefaultBool CMallocOptimistic; 111 }; 112 113 ChecksFilter Filter; 114 115 void checkPreStmt(const CallExpr *S, CheckerContext &C) const; 116 void checkPostStmt(const CallExpr *CE, CheckerContext &C) const; 117 void checkDeadSymbols(SymbolReaper &SymReaper, CheckerContext &C) const; 118 void checkEndPath(CheckerContext &C) const; 119 void checkPreStmt(const ReturnStmt *S, CheckerContext &C) const; 120 ProgramStateRef evalAssume(ProgramStateRef state, SVal Cond, 121 bool Assumption) const; 122 void checkLocation(SVal l, bool isLoad, const Stmt *S, 123 CheckerContext &C) const; 124 void checkBind(SVal location, SVal val, const Stmt*S, 125 CheckerContext &C) const; 126 ProgramStateRef 127 checkRegionChanges(ProgramStateRef state, 128 const StoreManager::InvalidatedSymbols *invalidated, 129 ArrayRef<const MemRegion *> ExplicitRegions, 130 ArrayRef<const MemRegion *> Regions, 131 const CallOrObjCMessage *Call) const; 132 bool wantsRegionChangeUpdate(ProgramStateRef state) const { 133 return true; 134 } 135 136private: 137 void initIdentifierInfo(ASTContext &C) const; 138 139 /// Check if this is one of the functions which can allocate/reallocate memory 140 /// pointed to by one of its arguments. 141 bool isMemFunction(const FunctionDecl *FD, ASTContext &C) const; 142 143 static ProgramStateRef MallocMemReturnsAttr(CheckerContext &C, 144 const CallExpr *CE, 145 const OwnershipAttr* Att); 146 static ProgramStateRef MallocMemAux(CheckerContext &C, const CallExpr *CE, 147 const Expr *SizeEx, SVal Init, 148 ProgramStateRef state) { 149 return MallocMemAux(C, CE, 150 state->getSVal(SizeEx, C.getLocationContext()), 151 Init, state); 152 } 153 154 static ProgramStateRef MallocMemAux(CheckerContext &C, const CallExpr *CE, 155 SVal SizeEx, SVal Init, 156 ProgramStateRef state); 157 158 /// Update the RefState to reflect the new memory allocation. 159 static ProgramStateRef MallocUpdateRefState(CheckerContext &C, 160 const CallExpr *CE, 161 ProgramStateRef state); 162 163 ProgramStateRef FreeMemAttr(CheckerContext &C, const CallExpr *CE, 164 const OwnershipAttr* Att) const; 165 ProgramStateRef FreeMemAux(CheckerContext &C, const CallExpr *CE, 166 ProgramStateRef state, unsigned Num, 167 bool Hold) const; 168 169 ProgramStateRef ReallocMem(CheckerContext &C, const CallExpr *CE, 170 bool FreesMemOnFailure) const; 171 static ProgramStateRef CallocMem(CheckerContext &C, const CallExpr *CE); 172 173 bool checkEscape(SymbolRef Sym, const Stmt *S, CheckerContext &C) const; 174 bool checkUseAfterFree(SymbolRef Sym, CheckerContext &C, 175 const Stmt *S = 0) const; 176 177 /// Check if the function is not known to us. So, for example, we could 178 /// conservatively assume it can free/reallocate it's pointer arguments. 179 bool doesNotFreeMemory(const CallOrObjCMessage *Call, 180 ProgramStateRef State) const; 181 182 static bool SummarizeValue(raw_ostream &os, SVal V); 183 static bool SummarizeRegion(raw_ostream &os, const MemRegion *MR); 184 void ReportBadFree(CheckerContext &C, SVal ArgVal, SourceRange range) const; 185 186 /// Find the location of the allocation for Sym on the path leading to the 187 /// exploded node N. 188 const Stmt *getAllocationSite(const ExplodedNode *N, SymbolRef Sym, 189 CheckerContext &C) const; 190 191 void reportLeak(SymbolRef Sym, ExplodedNode *N, CheckerContext &C) const; 192 193 /// The bug visitor which allows us to print extra diagnostics along the 194 /// BugReport path. For example, showing the allocation site of the leaked 195 /// region. 196 class MallocBugVisitor : public BugReporterVisitor { 197 protected: 198 enum NotificationMode { 199 Normal, 200 Complete, 201 ReallocationFailed 202 }; 203 204 // The allocated region symbol tracked by the main analysis. 205 SymbolRef Sym; 206 NotificationMode Mode; 207 208 public: 209 MallocBugVisitor(SymbolRef S) : Sym(S), Mode(Normal) {} 210 virtual ~MallocBugVisitor() {} 211 212 void Profile(llvm::FoldingSetNodeID &ID) const { 213 static int X = 0; 214 ID.AddPointer(&X); 215 ID.AddPointer(Sym); 216 } 217 218 inline bool isAllocated(const RefState *S, const RefState *SPrev, 219 const Stmt *Stmt) { 220 // Did not track -> allocated. Other state (released) -> allocated. 221 return (Stmt && isa<CallExpr>(Stmt) && 222 (S && S->isAllocated()) && (!SPrev || !SPrev->isAllocated())); 223 } 224 225 inline bool isReleased(const RefState *S, const RefState *SPrev, 226 const Stmt *Stmt) { 227 // Did not track -> released. Other state (allocated) -> released. 228 return (Stmt && isa<CallExpr>(Stmt) && 229 (S && S->isReleased()) && (!SPrev || !SPrev->isReleased())); 230 } 231 232 inline bool isReallocFailedCheck(const RefState *S, const RefState *SPrev, 233 const Stmt *Stmt) { 234 // If the expression is not a call, and the state change is 235 // released -> allocated, it must be the realloc return value 236 // check. If we have to handle more cases here, it might be cleaner just 237 // to track this extra bit in the state itself. 238 return ((!Stmt || !isa<CallExpr>(Stmt)) && 239 (S && S->isAllocated()) && (SPrev && !SPrev->isAllocated())); 240 } 241 242 PathDiagnosticPiece *VisitNode(const ExplodedNode *N, 243 const ExplodedNode *PrevN, 244 BugReporterContext &BRC, 245 BugReport &BR); 246 private: 247 class StackHintGeneratorForReallocationFailed 248 : public StackHintGeneratorForSymbol { 249 public: 250 StackHintGeneratorForReallocationFailed(SymbolRef S, StringRef M) 251 : StackHintGeneratorForSymbol(S, M) {} 252 253 virtual std::string getMessageForArg(const Expr *ArgE, unsigned ArgIndex) { 254 SmallString<200> buf; 255 llvm::raw_svector_ostream os(buf); 256 257 os << "Reallocation of "; 258 // Printed parameters start at 1, not 0. 259 printOrdinal(++ArgIndex, os); 260 os << " parameter failed"; 261 262 return os.str(); 263 } 264 265 virtual std::string getMessageForReturn(const CallExpr *CallExpr) { 266 return "Reallocation of returned value failed"; 267 } 268 }; 269 }; 270}; 271} // end anonymous namespace 272 273typedef llvm::ImmutableMap<SymbolRef, RefState> RegionStateTy; 274typedef llvm::ImmutableMap<SymbolRef, ReallocPair > ReallocMap; 275class RegionState {}; 276class ReallocPairs {}; 277namespace clang { 278namespace ento { 279 template <> 280 struct ProgramStateTrait<RegionState> 281 : public ProgramStatePartialTrait<RegionStateTy> { 282 static void *GDMIndex() { static int x; return &x; } 283 }; 284 285 template <> 286 struct ProgramStateTrait<ReallocPairs> 287 : public ProgramStatePartialTrait<ReallocMap> { 288 static void *GDMIndex() { static int x; return &x; } 289 }; 290} 291} 292 293namespace { 294class StopTrackingCallback : public SymbolVisitor { 295 ProgramStateRef state; 296public: 297 StopTrackingCallback(ProgramStateRef st) : state(st) {} 298 ProgramStateRef getState() const { return state; } 299 300 bool VisitSymbol(SymbolRef sym) { 301 state = state->remove<RegionState>(sym); 302 return true; 303 } 304}; 305} // end anonymous namespace 306 307void MallocChecker::initIdentifierInfo(ASTContext &Ctx) const { 308 if (!II_malloc) 309 II_malloc = &Ctx.Idents.get("malloc"); 310 if (!II_free) 311 II_free = &Ctx.Idents.get("free"); 312 if (!II_realloc) 313 II_realloc = &Ctx.Idents.get("realloc"); 314 if (!II_reallocf) 315 II_reallocf = &Ctx.Idents.get("reallocf"); 316 if (!II_calloc) 317 II_calloc = &Ctx.Idents.get("calloc"); 318 if (!II_valloc) 319 II_valloc = &Ctx.Idents.get("valloc"); 320 if (!II_strdup) 321 II_strdup = &Ctx.Idents.get("strdup"); 322 if (!II_strndup) 323 II_strndup = &Ctx.Idents.get("strndup"); 324} 325 326bool MallocChecker::isMemFunction(const FunctionDecl *FD, ASTContext &C) const { 327 if (!FD) 328 return false; 329 IdentifierInfo *FunI = FD->getIdentifier(); 330 if (!FunI) 331 return false; 332 333 initIdentifierInfo(C); 334 335 if (FunI == II_malloc || FunI == II_free || FunI == II_realloc || 336 FunI == II_reallocf || FunI == II_calloc || FunI == II_valloc || 337 FunI == II_strdup || FunI == II_strndup) 338 return true; 339 340 if (Filter.CMallocOptimistic && FD->hasAttrs() && 341 FD->specific_attr_begin<OwnershipAttr>() != 342 FD->specific_attr_end<OwnershipAttr>()) 343 return true; 344 345 346 return false; 347} 348 349void MallocChecker::checkPostStmt(const CallExpr *CE, CheckerContext &C) const { 350 const FunctionDecl *FD = C.getCalleeDecl(CE); 351 if (!FD) 352 return; 353 354 initIdentifierInfo(C.getASTContext()); 355 IdentifierInfo *FunI = FD->getIdentifier(); 356 if (!FunI) 357 return; 358 359 ProgramStateRef State = C.getState(); 360 if (FunI == II_malloc || FunI == II_valloc) { 361 State = MallocMemAux(C, CE, CE->getArg(0), UndefinedVal(), State); 362 } else if (FunI == II_realloc) { 363 State = ReallocMem(C, CE, false); 364 } else if (FunI == II_reallocf) { 365 State = ReallocMem(C, CE, true); 366 } else if (FunI == II_calloc) { 367 State = CallocMem(C, CE); 368 } else if (FunI == II_free) { 369 State = FreeMemAux(C, CE, C.getState(), 0, false); 370 } else if (FunI == II_strdup) { 371 State = MallocUpdateRefState(C, CE, State); 372 } else if (FunI == II_strndup) { 373 State = MallocUpdateRefState(C, CE, State); 374 } else if (Filter.CMallocOptimistic) { 375 // Check all the attributes, if there are any. 376 // There can be multiple of these attributes. 377 if (FD->hasAttrs()) 378 for (specific_attr_iterator<OwnershipAttr> 379 i = FD->specific_attr_begin<OwnershipAttr>(), 380 e = FD->specific_attr_end<OwnershipAttr>(); 381 i != e; ++i) { 382 switch ((*i)->getOwnKind()) { 383 case OwnershipAttr::Returns: 384 State = MallocMemReturnsAttr(C, CE, *i); 385 break; 386 case OwnershipAttr::Takes: 387 case OwnershipAttr::Holds: 388 State = FreeMemAttr(C, CE, *i); 389 break; 390 } 391 } 392 } 393 C.addTransition(State); 394} 395 396ProgramStateRef MallocChecker::MallocMemReturnsAttr(CheckerContext &C, 397 const CallExpr *CE, 398 const OwnershipAttr* Att) { 399 if (Att->getModule() != "malloc") 400 return 0; 401 402 OwnershipAttr::args_iterator I = Att->args_begin(), E = Att->args_end(); 403 if (I != E) { 404 return MallocMemAux(C, CE, CE->getArg(*I), UndefinedVal(), C.getState()); 405 } 406 return MallocMemAux(C, CE, UnknownVal(), UndefinedVal(), C.getState()); 407} 408 409ProgramStateRef MallocChecker::MallocMemAux(CheckerContext &C, 410 const CallExpr *CE, 411 SVal Size, SVal Init, 412 ProgramStateRef state) { 413 // Get the return value. 414 SVal retVal = state->getSVal(CE, C.getLocationContext()); 415 416 // We expect the malloc functions to return a pointer. 417 if (!isa<Loc>(retVal)) 418 return 0; 419 420 // Fill the region with the initialization value. 421 state = state->bindDefault(retVal, Init); 422 423 // Set the region's extent equal to the Size parameter. 424 const SymbolicRegion *R = 425 dyn_cast_or_null<SymbolicRegion>(retVal.getAsRegion()); 426 if (!R) 427 return 0; 428 if (isa<DefinedOrUnknownSVal>(Size)) { 429 SValBuilder &svalBuilder = C.getSValBuilder(); 430 DefinedOrUnknownSVal Extent = R->getExtent(svalBuilder); 431 DefinedOrUnknownSVal DefinedSize = cast<DefinedOrUnknownSVal>(Size); 432 DefinedOrUnknownSVal extentMatchesSize = 433 svalBuilder.evalEQ(state, Extent, DefinedSize); 434 435 state = state->assume(extentMatchesSize, true); 436 assert(state); 437 } 438 439 return MallocUpdateRefState(C, CE, state); 440} 441 442ProgramStateRef MallocChecker::MallocUpdateRefState(CheckerContext &C, 443 const CallExpr *CE, 444 ProgramStateRef state) { 445 // Get the return value. 446 SVal retVal = state->getSVal(CE, C.getLocationContext()); 447 448 // We expect the malloc functions to return a pointer. 449 if (!isa<Loc>(retVal)) 450 return 0; 451 452 SymbolRef Sym = retVal.getAsLocSymbol(); 453 assert(Sym); 454 455 // Set the symbol's state to Allocated. 456 return state->set<RegionState>(Sym, RefState::getAllocateUnchecked(CE)); 457 458} 459 460ProgramStateRef MallocChecker::FreeMemAttr(CheckerContext &C, 461 const CallExpr *CE, 462 const OwnershipAttr* Att) const { 463 if (Att->getModule() != "malloc") 464 return 0; 465 466 ProgramStateRef State = C.getState(); 467 468 for (OwnershipAttr::args_iterator I = Att->args_begin(), E = Att->args_end(); 469 I != E; ++I) { 470 ProgramStateRef StateI = FreeMemAux(C, CE, State, *I, 471 Att->getOwnKind() == OwnershipAttr::Holds); 472 if (StateI) 473 State = StateI; 474 } 475 return State; 476} 477 478ProgramStateRef MallocChecker::FreeMemAux(CheckerContext &C, 479 const CallExpr *CE, 480 ProgramStateRef state, 481 unsigned Num, 482 bool Hold) const { 483 const Expr *ArgExpr = CE->getArg(Num); 484 SVal ArgVal = state->getSVal(ArgExpr, C.getLocationContext()); 485 if (!isa<DefinedOrUnknownSVal>(ArgVal)) 486 return 0; 487 DefinedOrUnknownSVal location = cast<DefinedOrUnknownSVal>(ArgVal); 488 489 // Check for null dereferences. 490 if (!isa<Loc>(location)) 491 return 0; 492 493 // The explicit NULL case, no operation is performed. 494 ProgramStateRef notNullState, nullState; 495 llvm::tie(notNullState, nullState) = state->assume(location); 496 if (nullState && !notNullState) 497 return 0; 498 499 // Unknown values could easily be okay 500 // Undefined values are handled elsewhere 501 if (ArgVal.isUnknownOrUndef()) 502 return 0; 503 504 const MemRegion *R = ArgVal.getAsRegion(); 505 506 // Nonlocs can't be freed, of course. 507 // Non-region locations (labels and fixed addresses) also shouldn't be freed. 508 if (!R) { 509 ReportBadFree(C, ArgVal, ArgExpr->getSourceRange()); 510 return 0; 511 } 512 513 R = R->StripCasts(); 514 515 // Blocks might show up as heap data, but should not be free()d 516 if (isa<BlockDataRegion>(R)) { 517 ReportBadFree(C, ArgVal, ArgExpr->getSourceRange()); 518 return 0; 519 } 520 521 const MemSpaceRegion *MS = R->getMemorySpace(); 522 523 // Parameters, locals, statics, and globals shouldn't be freed. 524 if (!(isa<UnknownSpaceRegion>(MS) || isa<HeapSpaceRegion>(MS))) { 525 // FIXME: at the time this code was written, malloc() regions were 526 // represented by conjured symbols, which are all in UnknownSpaceRegion. 527 // This means that there isn't actually anything from HeapSpaceRegion 528 // that should be freed, even though we allow it here. 529 // Of course, free() can work on memory allocated outside the current 530 // function, so UnknownSpaceRegion is always a possibility. 531 // False negatives are better than false positives. 532 533 ReportBadFree(C, ArgVal, ArgExpr->getSourceRange()); 534 return 0; 535 } 536 537 const SymbolicRegion *SR = dyn_cast<SymbolicRegion>(R); 538 // Various cases could lead to non-symbol values here. 539 // For now, ignore them. 540 if (!SR) 541 return 0; 542 543 SymbolRef Sym = SR->getSymbol(); 544 const RefState *RS = state->get<RegionState>(Sym); 545 546 // If the symbol has not been tracked, return. This is possible when free() is 547 // called on a pointer that does not get its pointee directly from malloc(). 548 // Full support of this requires inter-procedural analysis. 549 if (!RS) 550 return 0; 551 552 // Check double free. 553 if (RS->isReleased()) { 554 if (ExplodedNode *N = C.generateSink()) { 555 if (!BT_DoubleFree) 556 BT_DoubleFree.reset( 557 new BugType("Double free", "Memory Error")); 558 BugReport *R = new BugReport(*BT_DoubleFree, 559 "Attempt to free released memory", N); 560 R->addRange(ArgExpr->getSourceRange()); 561 R->markInteresting(Sym); 562 R->addVisitor(new MallocBugVisitor(Sym)); 563 C.EmitReport(R); 564 } 565 return 0; 566 } 567 568 // Normal free. 569 if (Hold) 570 return state->set<RegionState>(Sym, RefState::getRelinquished(CE)); 571 return state->set<RegionState>(Sym, RefState::getReleased(CE)); 572} 573 574bool MallocChecker::SummarizeValue(raw_ostream &os, SVal V) { 575 if (nonloc::ConcreteInt *IntVal = dyn_cast<nonloc::ConcreteInt>(&V)) 576 os << "an integer (" << IntVal->getValue() << ")"; 577 else if (loc::ConcreteInt *ConstAddr = dyn_cast<loc::ConcreteInt>(&V)) 578 os << "a constant address (" << ConstAddr->getValue() << ")"; 579 else if (loc::GotoLabel *Label = dyn_cast<loc::GotoLabel>(&V)) 580 os << "the address of the label '" << Label->getLabel()->getName() << "'"; 581 else 582 return false; 583 584 return true; 585} 586 587bool MallocChecker::SummarizeRegion(raw_ostream &os, 588 const MemRegion *MR) { 589 switch (MR->getKind()) { 590 case MemRegion::FunctionTextRegionKind: { 591 const FunctionDecl *FD = cast<FunctionTextRegion>(MR)->getDecl(); 592 if (FD) 593 os << "the address of the function '" << *FD << '\''; 594 else 595 os << "the address of a function"; 596 return true; 597 } 598 case MemRegion::BlockTextRegionKind: 599 os << "block text"; 600 return true; 601 case MemRegion::BlockDataRegionKind: 602 // FIXME: where the block came from? 603 os << "a block"; 604 return true; 605 default: { 606 const MemSpaceRegion *MS = MR->getMemorySpace(); 607 608 if (isa<StackLocalsSpaceRegion>(MS)) { 609 const VarRegion *VR = dyn_cast<VarRegion>(MR); 610 const VarDecl *VD; 611 if (VR) 612 VD = VR->getDecl(); 613 else 614 VD = NULL; 615 616 if (VD) 617 os << "the address of the local variable '" << VD->getName() << "'"; 618 else 619 os << "the address of a local stack variable"; 620 return true; 621 } 622 623 if (isa<StackArgumentsSpaceRegion>(MS)) { 624 const VarRegion *VR = dyn_cast<VarRegion>(MR); 625 const VarDecl *VD; 626 if (VR) 627 VD = VR->getDecl(); 628 else 629 VD = NULL; 630 631 if (VD) 632 os << "the address of the parameter '" << VD->getName() << "'"; 633 else 634 os << "the address of a parameter"; 635 return true; 636 } 637 638 if (isa<GlobalsSpaceRegion>(MS)) { 639 const VarRegion *VR = dyn_cast<VarRegion>(MR); 640 const VarDecl *VD; 641 if (VR) 642 VD = VR->getDecl(); 643 else 644 VD = NULL; 645 646 if (VD) { 647 if (VD->isStaticLocal()) 648 os << "the address of the static variable '" << VD->getName() << "'"; 649 else 650 os << "the address of the global variable '" << VD->getName() << "'"; 651 } else 652 os << "the address of a global variable"; 653 return true; 654 } 655 656 return false; 657 } 658 } 659} 660 661void MallocChecker::ReportBadFree(CheckerContext &C, SVal ArgVal, 662 SourceRange range) const { 663 if (ExplodedNode *N = C.generateSink()) { 664 if (!BT_BadFree) 665 BT_BadFree.reset(new BugType("Bad free", "Memory Error")); 666 667 SmallString<100> buf; 668 llvm::raw_svector_ostream os(buf); 669 670 const MemRegion *MR = ArgVal.getAsRegion(); 671 if (MR) { 672 while (const ElementRegion *ER = dyn_cast<ElementRegion>(MR)) 673 MR = ER->getSuperRegion(); 674 675 // Special case for alloca() 676 if (isa<AllocaRegion>(MR)) 677 os << "Argument to free() was allocated by alloca(), not malloc()"; 678 else { 679 os << "Argument to free() is "; 680 if (SummarizeRegion(os, MR)) 681 os << ", which is not memory allocated by malloc()"; 682 else 683 os << "not memory allocated by malloc()"; 684 } 685 } else { 686 os << "Argument to free() is "; 687 if (SummarizeValue(os, ArgVal)) 688 os << ", which is not memory allocated by malloc()"; 689 else 690 os << "not memory allocated by malloc()"; 691 } 692 693 BugReport *R = new BugReport(*BT_BadFree, os.str(), N); 694 R->markInteresting(MR); 695 R->addRange(range); 696 C.EmitReport(R); 697 } 698} 699 700ProgramStateRef MallocChecker::ReallocMem(CheckerContext &C, 701 const CallExpr *CE, 702 bool FreesOnFail) const { 703 ProgramStateRef state = C.getState(); 704 const Expr *arg0Expr = CE->getArg(0); 705 const LocationContext *LCtx = C.getLocationContext(); 706 SVal Arg0Val = state->getSVal(arg0Expr, LCtx); 707 if (!isa<DefinedOrUnknownSVal>(Arg0Val)) 708 return 0; 709 DefinedOrUnknownSVal arg0Val = cast<DefinedOrUnknownSVal>(Arg0Val); 710 711 SValBuilder &svalBuilder = C.getSValBuilder(); 712 713 DefinedOrUnknownSVal PtrEQ = 714 svalBuilder.evalEQ(state, arg0Val, svalBuilder.makeNull()); 715 716 // Get the size argument. If there is no size arg then give up. 717 const Expr *Arg1 = CE->getArg(1); 718 if (!Arg1) 719 return 0; 720 721 // Get the value of the size argument. 722 SVal Arg1ValG = state->getSVal(Arg1, LCtx); 723 if (!isa<DefinedOrUnknownSVal>(Arg1ValG)) 724 return 0; 725 DefinedOrUnknownSVal Arg1Val = cast<DefinedOrUnknownSVal>(Arg1ValG); 726 727 // Compare the size argument to 0. 728 DefinedOrUnknownSVal SizeZero = 729 svalBuilder.evalEQ(state, Arg1Val, 730 svalBuilder.makeIntValWithPtrWidth(0, false)); 731 732 ProgramStateRef StatePtrIsNull, StatePtrNotNull; 733 llvm::tie(StatePtrIsNull, StatePtrNotNull) = state->assume(PtrEQ); 734 ProgramStateRef StateSizeIsZero, StateSizeNotZero; 735 llvm::tie(StateSizeIsZero, StateSizeNotZero) = state->assume(SizeZero); 736 // We only assume exceptional states if they are definitely true; if the 737 // state is under-constrained, assume regular realloc behavior. 738 bool PrtIsNull = StatePtrIsNull && !StatePtrNotNull; 739 bool SizeIsZero = StateSizeIsZero && !StateSizeNotZero; 740 741 // If the ptr is NULL and the size is not 0, the call is equivalent to 742 // malloc(size). 743 if ( PrtIsNull && !SizeIsZero) { 744 ProgramStateRef stateMalloc = MallocMemAux(C, CE, CE->getArg(1), 745 UndefinedVal(), StatePtrIsNull); 746 return stateMalloc; 747 } 748 749 if (PrtIsNull && SizeIsZero) 750 return 0; 751 752 // Get the from and to pointer symbols as in toPtr = realloc(fromPtr, size). 753 assert(!PrtIsNull); 754 SymbolRef FromPtr = arg0Val.getAsSymbol(); 755 SVal RetVal = state->getSVal(CE, LCtx); 756 SymbolRef ToPtr = RetVal.getAsSymbol(); 757 if (!FromPtr || !ToPtr) 758 return 0; 759 760 // If the size is 0, free the memory. 761 if (SizeIsZero) 762 if (ProgramStateRef stateFree = FreeMemAux(C, CE, StateSizeIsZero,0,false)){ 763 // The semantics of the return value are: 764 // If size was equal to 0, either NULL or a pointer suitable to be passed 765 // to free() is returned. 766 stateFree = stateFree->set<ReallocPairs>(ToPtr, 767 ReallocPair(FromPtr, FreesOnFail)); 768 C.getSymbolManager().addSymbolDependency(ToPtr, FromPtr); 769 return stateFree; 770 } 771 772 // Default behavior. 773 if (ProgramStateRef stateFree = FreeMemAux(C, CE, state, 0, false)) { 774 // FIXME: We should copy the content of the original buffer. 775 ProgramStateRef stateRealloc = MallocMemAux(C, CE, CE->getArg(1), 776 UnknownVal(), stateFree); 777 if (!stateRealloc) 778 return 0; 779 stateRealloc = stateRealloc->set<ReallocPairs>(ToPtr, 780 ReallocPair(FromPtr, FreesOnFail)); 781 C.getSymbolManager().addSymbolDependency(ToPtr, FromPtr); 782 return stateRealloc; 783 } 784 return 0; 785} 786 787ProgramStateRef MallocChecker::CallocMem(CheckerContext &C, const CallExpr *CE){ 788 ProgramStateRef state = C.getState(); 789 SValBuilder &svalBuilder = C.getSValBuilder(); 790 const LocationContext *LCtx = C.getLocationContext(); 791 SVal count = state->getSVal(CE->getArg(0), LCtx); 792 SVal elementSize = state->getSVal(CE->getArg(1), LCtx); 793 SVal TotalSize = svalBuilder.evalBinOp(state, BO_Mul, count, elementSize, 794 svalBuilder.getContext().getSizeType()); 795 SVal zeroVal = svalBuilder.makeZeroVal(svalBuilder.getContext().CharTy); 796 797 return MallocMemAux(C, CE, TotalSize, zeroVal, state); 798} 799 800const Stmt * 801MallocChecker::getAllocationSite(const ExplodedNode *N, SymbolRef Sym, 802 CheckerContext &C) const { 803 const LocationContext *LeakContext = N->getLocationContext(); 804 // Walk the ExplodedGraph backwards and find the first node that referred to 805 // the tracked symbol. 806 const ExplodedNode *AllocNode = N; 807 808 while (N) { 809 if (!N->getState()->get<RegionState>(Sym)) 810 break; 811 // Allocation node, is the last node in the current context in which the 812 // symbol was tracked. 813 if (N->getLocationContext() == LeakContext) 814 AllocNode = N; 815 N = N->pred_empty() ? NULL : *(N->pred_begin()); 816 } 817 818 ProgramPoint P = AllocNode->getLocation(); 819 if (!isa<StmtPoint>(P)) 820 return 0; 821 822 return cast<StmtPoint>(P).getStmt(); 823} 824 825void MallocChecker::reportLeak(SymbolRef Sym, ExplodedNode *N, 826 CheckerContext &C) const { 827 assert(N); 828 if (!BT_Leak) { 829 BT_Leak.reset(new BugType("Memory leak", "Memory Error")); 830 // Leaks should not be reported if they are post-dominated by a sink: 831 // (1) Sinks are higher importance bugs. 832 // (2) NoReturnFunctionChecker uses sink nodes to represent paths ending 833 // with __noreturn functions such as assert() or exit(). We choose not 834 // to report leaks on such paths. 835 BT_Leak->setSuppressOnSink(true); 836 } 837 838 // Most bug reports are cached at the location where they occurred. 839 // With leaks, we want to unique them by the location where they were 840 // allocated, and only report a single path. 841 PathDiagnosticLocation LocUsedForUniqueing; 842 if (const Stmt *AllocStmt = getAllocationSite(N, Sym, C)) 843 LocUsedForUniqueing = PathDiagnosticLocation::createBegin(AllocStmt, 844 C.getSourceManager(), N->getLocationContext()); 845 846 BugReport *R = new BugReport(*BT_Leak, 847 "Memory is never released; potential memory leak", N, LocUsedForUniqueing); 848 R->markInteresting(Sym); 849 // FIXME: This is a hack to make sure the MallocBugVisitor gets to look at 850 // the ExplodedNode chain first, in order to mark any failed realloc symbols 851 // as interesting for ConditionBRVisitor. 852 R->addVisitor(new ConditionBRVisitor()); 853 R->addVisitor(new MallocBugVisitor(Sym)); 854 C.EmitReport(R); 855} 856 857void MallocChecker::checkDeadSymbols(SymbolReaper &SymReaper, 858 CheckerContext &C) const 859{ 860 if (!SymReaper.hasDeadSymbols()) 861 return; 862 863 ProgramStateRef state = C.getState(); 864 RegionStateTy RS = state->get<RegionState>(); 865 RegionStateTy::Factory &F = state->get_context<RegionState>(); 866 867 bool generateReport = false; 868 llvm::SmallVector<SymbolRef, 2> Errors; 869 for (RegionStateTy::iterator I = RS.begin(), E = RS.end(); I != E; ++I) { 870 if (SymReaper.isDead(I->first)) { 871 if (I->second.isAllocated()) { 872 generateReport = true; 873 Errors.push_back(I->first); 874 } 875 // Remove the dead symbol from the map. 876 RS = F.remove(RS, I->first); 877 878 } 879 } 880 881 // Cleanup the Realloc Pairs Map. 882 ReallocMap RP = state->get<ReallocPairs>(); 883 for (ReallocMap::iterator I = RP.begin(), E = RP.end(); I != E; ++I) { 884 if (SymReaper.isDead(I->first) || 885 SymReaper.isDead(I->second.ReallocatedSym)) { 886 state = state->remove<ReallocPairs>(I->first); 887 } 888 } 889 890 // Generate leak node. 891 static SimpleProgramPointTag Tag("MallocChecker : DeadSymbolsLeak"); 892 ExplodedNode *N = C.addTransition(C.getState(), C.getPredecessor(), &Tag); 893 894 if (generateReport) { 895 for (llvm::SmallVector<SymbolRef, 2>::iterator 896 I = Errors.begin(), E = Errors.end(); I != E; ++I) { 897 reportLeak(*I, N, C); 898 } 899 } 900 C.addTransition(state->set<RegionState>(RS), N); 901} 902 903void MallocChecker::checkEndPath(CheckerContext &C) const { 904 ProgramStateRef state = C.getState(); 905 RegionStateTy M = state->get<RegionState>(); 906 907 // If inside inlined call, skip it. 908 if (C.getLocationContext()->getParent() != 0) 909 return; 910 911 for (RegionStateTy::iterator I = M.begin(), E = M.end(); I != E; ++I) { 912 RefState RS = I->second; 913 if (RS.isAllocated()) { 914 ExplodedNode *N = C.addTransition(state); 915 if (N) 916 reportLeak(I->first, N, C); 917 } 918 } 919} 920 921bool MallocChecker::checkEscape(SymbolRef Sym, const Stmt *S, 922 CheckerContext &C) const { 923 ProgramStateRef state = C.getState(); 924 const RefState *RS = state->get<RegionState>(Sym); 925 if (!RS) 926 return false; 927 928 if (RS->isAllocated()) { 929 state = state->set<RegionState>(Sym, RefState::getEscaped(S)); 930 C.addTransition(state); 931 return true; 932 } 933 return false; 934} 935 936void MallocChecker::checkPreStmt(const CallExpr *CE, CheckerContext &C) const { 937 if (isMemFunction(C.getCalleeDecl(CE), C.getASTContext())) 938 return; 939 940 // Check use after free, when a freed pointer is passed to a call. 941 ProgramStateRef State = C.getState(); 942 for (CallExpr::const_arg_iterator I = CE->arg_begin(), 943 E = CE->arg_end(); I != E; ++I) { 944 const Expr *A = *I; 945 if (A->getType().getTypePtr()->isAnyPointerType()) { 946 SymbolRef Sym = State->getSVal(A, C.getLocationContext()).getAsSymbol(); 947 if (!Sym) 948 continue; 949 if (checkUseAfterFree(Sym, C, A)) 950 return; 951 } 952 } 953} 954 955void MallocChecker::checkPreStmt(const ReturnStmt *S, CheckerContext &C) const { 956 const Expr *E = S->getRetValue(); 957 if (!E) 958 return; 959 960 // Check if we are returning a symbol. 961 SVal RetVal = C.getState()->getSVal(E, C.getLocationContext()); 962 SymbolRef Sym = RetVal.getAsSymbol(); 963 if (!Sym) 964 // If we are returning a field of the allocated struct or an array element, 965 // the callee could still free the memory. 966 // TODO: This logic should be a part of generic symbol escape callback. 967 if (const MemRegion *MR = RetVal.getAsRegion()) 968 if (isa<FieldRegion>(MR) || isa<ElementRegion>(MR)) 969 if (const SymbolicRegion *BMR = 970 dyn_cast<SymbolicRegion>(MR->getBaseRegion())) 971 Sym = BMR->getSymbol(); 972 if (!Sym) 973 return; 974 975 // Check if we are returning freed memory. 976 if (checkUseAfterFree(Sym, C, E)) 977 return; 978 979 // If this function body is not inlined, check if the symbol is escaping. 980 if (C.getLocationContext()->getParent() == 0) 981 checkEscape(Sym, E, C); 982} 983 984bool MallocChecker::checkUseAfterFree(SymbolRef Sym, CheckerContext &C, 985 const Stmt *S) const { 986 assert(Sym); 987 const RefState *RS = C.getState()->get<RegionState>(Sym); 988 if (RS && RS->isReleased()) { 989 if (ExplodedNode *N = C.generateSink()) { 990 if (!BT_UseFree) 991 BT_UseFree.reset(new BugType("Use-after-free", "Memory Error")); 992 993 BugReport *R = new BugReport(*BT_UseFree, 994 "Use of memory after it is freed",N); 995 if (S) 996 R->addRange(S->getSourceRange()); 997 R->markInteresting(Sym); 998 R->addVisitor(new MallocBugVisitor(Sym)); 999 C.EmitReport(R); 1000 return true; 1001 } 1002 } 1003 return false; 1004} 1005 1006// Check if the location is a freed symbolic region. 1007void MallocChecker::checkLocation(SVal l, bool isLoad, const Stmt *S, 1008 CheckerContext &C) const { 1009 SymbolRef Sym = l.getLocSymbolInBase(); 1010 if (Sym) 1011 checkUseAfterFree(Sym, C); 1012} 1013 1014//===----------------------------------------------------------------------===// 1015// Check various ways a symbol can be invalidated. 1016// TODO: This logic (the next 3 functions) is copied/similar to the 1017// RetainRelease checker. We might want to factor this out. 1018//===----------------------------------------------------------------------===// 1019 1020// Stop tracking symbols when a value escapes as a result of checkBind. 1021// A value escapes in three possible cases: 1022// (1) we are binding to something that is not a memory region. 1023// (2) we are binding to a memregion that does not have stack storage 1024// (3) we are binding to a memregion with stack storage that the store 1025// does not understand. 1026void MallocChecker::checkBind(SVal loc, SVal val, const Stmt *S, 1027 CheckerContext &C) const { 1028 // Are we storing to something that causes the value to "escape"? 1029 bool escapes = true; 1030 ProgramStateRef state = C.getState(); 1031 1032 if (loc::MemRegionVal *regionLoc = dyn_cast<loc::MemRegionVal>(&loc)) { 1033 escapes = !regionLoc->getRegion()->hasStackStorage(); 1034 1035 if (!escapes) { 1036 // To test (3), generate a new state with the binding added. If it is 1037 // the same state, then it escapes (since the store cannot represent 1038 // the binding). 1039 escapes = (state == (state->bindLoc(*regionLoc, val))); 1040 } 1041 if (!escapes) { 1042 // Case 4: We do not currently model what happens when a symbol is 1043 // assigned to a struct field, so be conservative here and let the symbol 1044 // go. TODO: This could definitely be improved upon. 1045 escapes = !isa<VarRegion>(regionLoc->getRegion()); 1046 } 1047 } 1048 1049 // If our store can represent the binding and we aren't storing to something 1050 // that doesn't have local storage then just return and have the simulation 1051 // state continue as is. 1052 if (!escapes) 1053 return; 1054 1055 // Otherwise, find all symbols referenced by 'val' that we are tracking 1056 // and stop tracking them. 1057 state = state->scanReachableSymbols<StopTrackingCallback>(val).getState(); 1058 C.addTransition(state); 1059} 1060 1061// If a symbolic region is assumed to NULL (or another constant), stop tracking 1062// it - assuming that allocation failed on this path. 1063ProgramStateRef MallocChecker::evalAssume(ProgramStateRef state, 1064 SVal Cond, 1065 bool Assumption) const { 1066 RegionStateTy RS = state->get<RegionState>(); 1067 for (RegionStateTy::iterator I = RS.begin(), E = RS.end(); I != E; ++I) { 1068 // If the symbol is assumed to NULL or another constant, this will 1069 // return an APSInt*. 1070 if (state->getSymVal(I.getKey())) 1071 state = state->remove<RegionState>(I.getKey()); 1072 } 1073 1074 // Realloc returns 0 when reallocation fails, which means that we should 1075 // restore the state of the pointer being reallocated. 1076 ReallocMap RP = state->get<ReallocPairs>(); 1077 for (ReallocMap::iterator I = RP.begin(), E = RP.end(); I != E; ++I) { 1078 // If the symbol is assumed to NULL or another constant, this will 1079 // return an APSInt*. 1080 if (state->getSymVal(I.getKey())) { 1081 SymbolRef ReallocSym = I.getData().ReallocatedSym; 1082 const RefState *RS = state->get<RegionState>(ReallocSym); 1083 if (RS) { 1084 if (RS->isReleased() && ! I.getData().IsFreeOnFailure) 1085 state = state->set<RegionState>(ReallocSym, 1086 RefState::getAllocateUnchecked(RS->getStmt())); 1087 } 1088 state = state->remove<ReallocPairs>(I.getKey()); 1089 } 1090 } 1091 1092 return state; 1093} 1094 1095// Check if the function is known to us. So, for example, we could 1096// conservatively assume it can free/reallocate it's pointer arguments. 1097// (We assume that the pointers cannot escape through calls to system 1098// functions not handled by this checker.) 1099bool MallocChecker::doesNotFreeMemory(const CallOrObjCMessage *Call, 1100 ProgramStateRef State) const { 1101 if (!Call) 1102 return false; 1103 1104 // For now, assume that any C++ call can free memory. 1105 // TODO: If we want to be more optimistic here, we'll need to make sure that 1106 // regions escape to C++ containers. They seem to do that even now, but for 1107 // mysterious reasons. 1108 if (Call->isCXXCall()) 1109 return false; 1110 1111 const Decl *D = Call->getDecl(); 1112 if (!D) 1113 return false; 1114 1115 ASTContext &ASTC = State->getStateManager().getContext(); 1116 1117 // If it's one of the allocation functions we can reason about, we model 1118 // its behavior explicitly. 1119 if (isa<FunctionDecl>(D) && isMemFunction(cast<FunctionDecl>(D), ASTC)) { 1120 return true; 1121 } 1122 1123 // If it's not a system call, assume it frees memory. 1124 SourceManager &SM = ASTC.getSourceManager(); 1125 if (!SM.isInSystemHeader(D->getLocation())) 1126 return false; 1127 1128 // Process C/ObjC functions. 1129 if (const FunctionDecl *FD = dyn_cast<FunctionDecl>(D)) { 1130 // White list the system functions whose arguments escape. 1131 const IdentifierInfo *II = FD->getIdentifier(); 1132 if (!II) 1133 return true; 1134 StringRef FName = II->getName(); 1135 1136 // White list thread local storage. 1137 if (FName.equals("pthread_setspecific")) 1138 return false; 1139 1140 // White list the 'XXXNoCopy' ObjC functions. 1141 if (FName.endswith("NoCopy")) { 1142 // Look for the deallocator argument. We know that the memory ownership 1143 // is not transfered only if the deallocator argument is 1144 // 'kCFAllocatorNull'. 1145 for (unsigned i = 1; i < Call->getNumArgs(); ++i) { 1146 const Expr *ArgE = Call->getArg(i)->IgnoreParenCasts(); 1147 if (const DeclRefExpr *DE = dyn_cast<DeclRefExpr>(ArgE)) { 1148 StringRef DeallocatorName = DE->getFoundDecl()->getName(); 1149 if (DeallocatorName == "kCFAllocatorNull") 1150 return true; 1151 } 1152 } 1153 return false; 1154 } 1155 1156 // PR12101 1157 // Many CoreFoundation and CoreGraphics might allow a tracked object 1158 // to escape. 1159 if (Call->isCFCGAllowingEscape(FName)) 1160 return false; 1161 1162 // Associating streams with malloced buffers. The pointer can escape if 1163 // 'closefn' is specified (and if that function does free memory). 1164 // Currently, we do not inspect the 'closefn' function (PR12101). 1165 if (FName == "funopen") 1166 if (Call->getNumArgs() >= 4 && !Call->getArgSVal(4).isConstant(0)) 1167 return false; 1168 1169 // Do not warn on pointers passed to 'setbuf' when used with std streams, 1170 // these leaks might be intentional when setting the buffer for stdio. 1171 // http://stackoverflow.com/questions/2671151/who-frees-setvbuf-buffer 1172 if (FName == "setbuf" || FName =="setbuffer" || 1173 FName == "setlinebuf" || FName == "setvbuf") { 1174 if (Call->getNumArgs() >= 1) 1175 if (const DeclRefExpr *Arg = 1176 dyn_cast<DeclRefExpr>(Call->getArg(0)->IgnoreParenCasts())) 1177 if (const VarDecl *D = dyn_cast<VarDecl>(Arg->getDecl())) 1178 if (D->getCanonicalDecl()->getName().find("std") 1179 != StringRef::npos) 1180 return false; 1181 } 1182 1183 // A bunch of other functions, which take ownership of a pointer (See retain 1184 // release checker). Not all the parameters here are invalidated, but the 1185 // Malloc checker cannot differentiate between them. The right way of doing 1186 // this would be to implement a pointer escapes callback. 1187 if (FName == "CVPixelBufferCreateWithBytes" || 1188 FName == "CGBitmapContextCreateWithData" || 1189 FName == "CVPixelBufferCreateWithPlanarBytes") { 1190 return false; 1191 } 1192 1193 // Otherwise, assume that the function does not free memory. 1194 // Most system calls, do not free the memory. 1195 return true; 1196 1197 // Process ObjC functions. 1198 } else if (const ObjCMethodDecl * ObjCD = dyn_cast<ObjCMethodDecl>(D)) { 1199 Selector S = ObjCD->getSelector(); 1200 1201 // White list the ObjC functions which do free memory. 1202 // - Anything containing 'freeWhenDone' param set to 1. 1203 // Ex: dataWithBytesNoCopy:length:freeWhenDone. 1204 for (unsigned i = 1; i < S.getNumArgs(); ++i) { 1205 if (S.getNameForSlot(i).equals("freeWhenDone")) { 1206 if (Call->getArgSVal(i).isConstant(1)) 1207 return false; 1208 else 1209 return true; 1210 } 1211 } 1212 1213 // If the first selector ends with NoCopy, assume that the ownership is 1214 // transfered as well. 1215 // Ex: [NSData dataWithBytesNoCopy:bytes length:10]; 1216 if (S.getNameForSlot(0).endswith("NoCopy")) { 1217 return false; 1218 } 1219 1220 // Otherwise, assume that the function does not free memory. 1221 // Most system calls, do not free the memory. 1222 return true; 1223 } 1224 1225 // Otherwise, assume that the function can free memory. 1226 return false; 1227 1228} 1229 1230// If the symbol we are tracking is invalidated, but not explicitly (ex: the &p 1231// escapes, when we are tracking p), do not track the symbol as we cannot reason 1232// about it anymore. 1233ProgramStateRef 1234MallocChecker::checkRegionChanges(ProgramStateRef State, 1235 const StoreManager::InvalidatedSymbols *invalidated, 1236 ArrayRef<const MemRegion *> ExplicitRegions, 1237 ArrayRef<const MemRegion *> Regions, 1238 const CallOrObjCMessage *Call) const { 1239 if (!invalidated || invalidated->empty()) 1240 return State; 1241 llvm::SmallPtrSet<SymbolRef, 8> WhitelistedSymbols; 1242 1243 // If it's a call which might free or reallocate memory, we assume that all 1244 // regions (explicit and implicit) escaped. 1245 1246 // Otherwise, whitelist explicit pointers; we still can track them. 1247 if (!Call || doesNotFreeMemory(Call, State)) { 1248 for (ArrayRef<const MemRegion *>::iterator I = ExplicitRegions.begin(), 1249 E = ExplicitRegions.end(); I != E; ++I) { 1250 if (const SymbolicRegion *R = (*I)->StripCasts()->getAs<SymbolicRegion>()) 1251 WhitelistedSymbols.insert(R->getSymbol()); 1252 } 1253 } 1254 1255 for (StoreManager::InvalidatedSymbols::const_iterator I=invalidated->begin(), 1256 E = invalidated->end(); I!=E; ++I) { 1257 SymbolRef sym = *I; 1258 if (WhitelistedSymbols.count(sym)) 1259 continue; 1260 // The symbol escaped. 1261 if (const RefState *RS = State->get<RegionState>(sym)) 1262 State = State->set<RegionState>(sym, RefState::getEscaped(RS->getStmt())); 1263 } 1264 return State; 1265} 1266 1267static SymbolRef findFailedReallocSymbol(ProgramStateRef currState, 1268 ProgramStateRef prevState) { 1269 ReallocMap currMap = currState->get<ReallocPairs>(); 1270 ReallocMap prevMap = prevState->get<ReallocPairs>(); 1271 1272 for (ReallocMap::iterator I = prevMap.begin(), E = prevMap.end(); 1273 I != E; ++I) { 1274 SymbolRef sym = I.getKey(); 1275 if (!currMap.lookup(sym)) 1276 return sym; 1277 } 1278 1279 return NULL; 1280} 1281 1282PathDiagnosticPiece * 1283MallocChecker::MallocBugVisitor::VisitNode(const ExplodedNode *N, 1284 const ExplodedNode *PrevN, 1285 BugReporterContext &BRC, 1286 BugReport &BR) { 1287 ProgramStateRef state = N->getState(); 1288 ProgramStateRef statePrev = PrevN->getState(); 1289 1290 const RefState *RS = state->get<RegionState>(Sym); 1291 const RefState *RSPrev = statePrev->get<RegionState>(Sym); 1292 if (!RS && !RSPrev) 1293 return 0; 1294 1295 const Stmt *S = 0; 1296 const char *Msg = 0; 1297 StackHintGeneratorForSymbol *StackHint = 0; 1298 1299 // Retrieve the associated statement. 1300 ProgramPoint ProgLoc = N->getLocation(); 1301 if (isa<StmtPoint>(ProgLoc)) 1302 S = cast<StmtPoint>(ProgLoc).getStmt(); 1303 // If an assumption was made on a branch, it should be caught 1304 // here by looking at the state transition. 1305 if (isa<BlockEdge>(ProgLoc)) { 1306 const CFGBlock *srcBlk = cast<BlockEdge>(ProgLoc).getSrc(); 1307 S = srcBlk->getTerminator(); 1308 } 1309 if (!S) 1310 return 0; 1311 1312 // Find out if this is an interesting point and what is the kind. 1313 if (Mode == Normal) { 1314 if (isAllocated(RS, RSPrev, S)) { 1315 Msg = "Memory is allocated"; 1316 StackHint = new StackHintGeneratorForSymbol(Sym, 1317 "Returned allocated memory"); 1318 } else if (isReleased(RS, RSPrev, S)) { 1319 Msg = "Memory is released"; 1320 StackHint = new StackHintGeneratorForSymbol(Sym, 1321 "Returned released memory"); 1322 } else if (isReallocFailedCheck(RS, RSPrev, S)) { 1323 Mode = ReallocationFailed; 1324 Msg = "Reallocation failed"; 1325 StackHint = new StackHintGeneratorForReallocationFailed(Sym, 1326 "Reallocation failed"); 1327 1328 if (SymbolRef sym = findFailedReallocSymbol(state, statePrev)) 1329 BR.markInteresting(sym); 1330 } 1331 1332 // We are in a special mode if a reallocation failed later in the path. 1333 } else if (Mode == ReallocationFailed) { 1334 // Generate a special diagnostic for the first realloc we find. 1335 if (!isAllocated(RS, RSPrev, S) && !isReleased(RS, RSPrev, S)) 1336 return 0; 1337 1338 // Check that the name of the function is realloc. 1339 const CallExpr *CE = dyn_cast<CallExpr>(S); 1340 if (!CE) 1341 return 0; 1342 const FunctionDecl *funDecl = CE->getDirectCallee(); 1343 if (!funDecl) 1344 return 0; 1345 StringRef FunName = funDecl->getName(); 1346 if (!(FunName.equals("realloc") || FunName.equals("reallocf"))) 1347 return 0; 1348 Msg = "Attempt to reallocate memory"; 1349 StackHint = new StackHintGeneratorForSymbol(Sym, 1350 "Returned reallocated memory"); 1351 Mode = Normal; 1352 } 1353 1354 if (!Msg) 1355 return 0; 1356 assert(StackHint); 1357 1358 // Generate the extra diagnostic. 1359 PathDiagnosticLocation Pos(S, BRC.getSourceManager(), 1360 N->getLocationContext()); 1361 return new PathDiagnosticEventPiece(Pos, Msg, true, StackHint); 1362} 1363 1364 1365#define REGISTER_CHECKER(name) \ 1366void ento::register##name(CheckerManager &mgr) {\ 1367 registerCStringCheckerBasic(mgr); \ 1368 mgr.registerChecker<MallocChecker>()->Filter.C##name = true;\ 1369} 1370 1371REGISTER_CHECKER(MallocPessimistic) 1372REGISTER_CHECKER(MallocOptimistic) 1373