MallocChecker.cpp revision 7752d292c97fd4b78a954c9a027b2a862be50f8b
1//=== MallocChecker.cpp - A malloc/free checker -------------------*- C++ -*--// 2// 3// The LLVM Compiler Infrastructure 4// 5// This file is distributed under the University of Illinois Open Source 6// License. See LICENSE.TXT for details. 7// 8//===----------------------------------------------------------------------===// 9// 10// This file defines malloc/free checker, which checks for potential memory 11// leaks, double free, and use-after-free problems. 12// 13//===----------------------------------------------------------------------===// 14 15#include "ClangSACheckers.h" 16#include "InterCheckerAPI.h" 17#include "clang/StaticAnalyzer/Core/Checker.h" 18#include "clang/StaticAnalyzer/Core/CheckerManager.h" 19#include "clang/StaticAnalyzer/Core/PathSensitive/CheckerContext.h" 20#include "clang/StaticAnalyzer/Core/BugReporter/BugType.h" 21#include "clang/StaticAnalyzer/Core/PathSensitive/ObjCMessage.h" 22#include "clang/StaticAnalyzer/Core/PathSensitive/ProgramState.h" 23#include "clang/StaticAnalyzer/Core/PathSensitive/ProgramStateTrait.h" 24#include "clang/StaticAnalyzer/Core/PathSensitive/SymbolManager.h" 25#include "clang/Basic/SourceManager.h" 26#include "llvm/ADT/ImmutableMap.h" 27#include "llvm/ADT/SmallString.h" 28#include "llvm/ADT/STLExtras.h" 29#include <climits> 30 31using namespace clang; 32using namespace ento; 33 34namespace { 35 36class RefState { 37 enum Kind { AllocateUnchecked, AllocateFailed, Released, Escaped, 38 Relinquished } K; 39 const Stmt *S; 40 41public: 42 RefState(Kind k, const Stmt *s) : K(k), S(s) {} 43 44 bool isAllocated() const { return K == AllocateUnchecked; } 45 //bool isFailed() const { return K == AllocateFailed; } 46 bool isReleased() const { return K == Released; } 47 //bool isEscaped() const { return K == Escaped; } 48 //bool isRelinquished() const { return K == Relinquished; } 49 const Stmt *getStmt() const { return S; } 50 51 bool operator==(const RefState &X) const { 52 return K == X.K && S == X.S; 53 } 54 55 static RefState getAllocateUnchecked(const Stmt *s) { 56 return RefState(AllocateUnchecked, s); 57 } 58 static RefState getAllocateFailed() { 59 return RefState(AllocateFailed, 0); 60 } 61 static RefState getReleased(const Stmt *s) { return RefState(Released, s); } 62 static RefState getEscaped(const Stmt *s) { return RefState(Escaped, s); } 63 static RefState getRelinquished(const Stmt *s) { 64 return RefState(Relinquished, s); 65 } 66 67 void Profile(llvm::FoldingSetNodeID &ID) const { 68 ID.AddInteger(K); 69 ID.AddPointer(S); 70 } 71}; 72 73struct ReallocPair { 74 SymbolRef ReallocatedSym; 75 bool IsFreeOnFailure; 76 ReallocPair(SymbolRef S, bool F) : ReallocatedSym(S), IsFreeOnFailure(F) {} 77 void Profile(llvm::FoldingSetNodeID &ID) const { 78 ID.AddInteger(IsFreeOnFailure); 79 ID.AddPointer(ReallocatedSym); 80 } 81 bool operator==(const ReallocPair &X) const { 82 return ReallocatedSym == X.ReallocatedSym && 83 IsFreeOnFailure == X.IsFreeOnFailure; 84 } 85}; 86 87class MallocChecker : public Checker<check::DeadSymbols, 88 check::EndPath, 89 check::PreStmt<ReturnStmt>, 90 check::PreStmt<CallExpr>, 91 check::PostStmt<CallExpr>, 92 check::Location, 93 check::Bind, 94 eval::Assume, 95 check::RegionChanges> 96{ 97 mutable OwningPtr<BugType> BT_DoubleFree; 98 mutable OwningPtr<BugType> BT_Leak; 99 mutable OwningPtr<BugType> BT_UseFree; 100 mutable OwningPtr<BugType> BT_BadFree; 101 mutable IdentifierInfo *II_malloc, *II_free, *II_realloc, *II_calloc, 102 *II_valloc, *II_reallocf, *II_strndup, *II_strdup; 103 104 static const unsigned InvalidArgIndex = UINT_MAX; 105 106public: 107 MallocChecker() : II_malloc(0), II_free(0), II_realloc(0), II_calloc(0), 108 II_valloc(0), II_reallocf(0), II_strndup(0), II_strdup(0) {} 109 110 /// In pessimistic mode, the checker assumes that it does not know which 111 /// functions might free the memory. 112 struct ChecksFilter { 113 DefaultBool CMallocPessimistic; 114 DefaultBool CMallocOptimistic; 115 }; 116 117 ChecksFilter Filter; 118 119 void checkPreStmt(const CallExpr *S, CheckerContext &C) const; 120 void checkPostStmt(const CallExpr *CE, CheckerContext &C) const; 121 void checkDeadSymbols(SymbolReaper &SymReaper, CheckerContext &C) const; 122 void checkEndPath(CheckerContext &C) const; 123 void checkPreStmt(const ReturnStmt *S, CheckerContext &C) const; 124 ProgramStateRef evalAssume(ProgramStateRef state, SVal Cond, 125 bool Assumption) const; 126 void checkLocation(SVal l, bool isLoad, const Stmt *S, 127 CheckerContext &C) const; 128 void checkBind(SVal location, SVal val, const Stmt*S, 129 CheckerContext &C) const; 130 ProgramStateRef 131 checkRegionChanges(ProgramStateRef state, 132 const StoreManager::InvalidatedSymbols *invalidated, 133 ArrayRef<const MemRegion *> ExplicitRegions, 134 ArrayRef<const MemRegion *> Regions, 135 const CallOrObjCMessage *Call) const; 136 bool wantsRegionChangeUpdate(ProgramStateRef state) const { 137 return true; 138 } 139 140private: 141 void initIdentifierInfo(ASTContext &C) const; 142 143 /// Check if this is one of the functions which can allocate/reallocate memory 144 /// pointed to by one of its arguments. 145 bool isMemFunction(const FunctionDecl *FD, ASTContext &C) const; 146 147 static ProgramStateRef MallocMemReturnsAttr(CheckerContext &C, 148 const CallExpr *CE, 149 const OwnershipAttr* Att); 150 static ProgramStateRef MallocMemAux(CheckerContext &C, const CallExpr *CE, 151 const Expr *SizeEx, SVal Init, 152 ProgramStateRef state) { 153 return MallocMemAux(C, CE, 154 state->getSVal(SizeEx, C.getLocationContext()), 155 Init, state); 156 } 157 158 static ProgramStateRef MallocMemAux(CheckerContext &C, const CallExpr *CE, 159 SVal SizeEx, SVal Init, 160 ProgramStateRef state); 161 162 /// Update the RefState to reflect the new memory allocation. 163 static ProgramStateRef MallocUpdateRefState(CheckerContext &C, 164 const CallExpr *CE, 165 ProgramStateRef state); 166 167 ProgramStateRef FreeMemAttr(CheckerContext &C, const CallExpr *CE, 168 const OwnershipAttr* Att) const; 169 ProgramStateRef FreeMemAux(CheckerContext &C, const CallExpr *CE, 170 ProgramStateRef state, unsigned Num, 171 bool Hold) const; 172 173 ProgramStateRef ReallocMem(CheckerContext &C, const CallExpr *CE, 174 bool FreesMemOnFailure) const; 175 static ProgramStateRef CallocMem(CheckerContext &C, const CallExpr *CE); 176 177 bool checkEscape(SymbolRef Sym, const Stmt *S, CheckerContext &C) const; 178 bool checkUseAfterFree(SymbolRef Sym, CheckerContext &C, 179 const Stmt *S = 0) const; 180 181 /// Check if the function is not known to us. So, for example, we could 182 /// conservatively assume it can free/reallocate it's pointer arguments. 183 bool doesNotFreeMemory(const CallOrObjCMessage *Call, 184 ProgramStateRef State) const; 185 186 static bool SummarizeValue(raw_ostream &os, SVal V); 187 static bool SummarizeRegion(raw_ostream &os, const MemRegion *MR); 188 void ReportBadFree(CheckerContext &C, SVal ArgVal, SourceRange range) const; 189 190 /// Find the location of the allocation for Sym on the path leading to the 191 /// exploded node N. 192 const Stmt *getAllocationSite(const ExplodedNode *N, SymbolRef Sym, 193 CheckerContext &C) const; 194 195 void reportLeak(SymbolRef Sym, ExplodedNode *N, CheckerContext &C) const; 196 197 /// The bug visitor which allows us to print extra diagnostics along the 198 /// BugReport path. For example, showing the allocation site of the leaked 199 /// region. 200 class MallocBugVisitor : public BugReporterVisitor { 201 protected: 202 enum NotificationMode { 203 Normal, 204 Complete, 205 ReallocationFailed 206 }; 207 208 // The allocated region symbol tracked by the main analysis. 209 SymbolRef Sym; 210 NotificationMode Mode; 211 212 public: 213 MallocBugVisitor(SymbolRef S) : Sym(S), Mode(Normal) {} 214 virtual ~MallocBugVisitor() {} 215 216 void Profile(llvm::FoldingSetNodeID &ID) const { 217 static int X = 0; 218 ID.AddPointer(&X); 219 ID.AddPointer(Sym); 220 } 221 222 inline bool isAllocated(const RefState *S, const RefState *SPrev, 223 const Stmt *Stmt) { 224 // Did not track -> allocated. Other state (released) -> allocated. 225 return (Stmt && isa<CallExpr>(Stmt) && 226 (S && S->isAllocated()) && (!SPrev || !SPrev->isAllocated())); 227 } 228 229 inline bool isReleased(const RefState *S, const RefState *SPrev, 230 const Stmt *Stmt) { 231 // Did not track -> released. Other state (allocated) -> released. 232 return (Stmt && isa<CallExpr>(Stmt) && 233 (S && S->isReleased()) && (!SPrev || !SPrev->isReleased())); 234 } 235 236 inline bool isReallocFailedCheck(const RefState *S, const RefState *SPrev, 237 const Stmt *Stmt) { 238 // If the expression is not a call, and the state change is 239 // released -> allocated, it must be the realloc return value 240 // check. If we have to handle more cases here, it might be cleaner just 241 // to track this extra bit in the state itself. 242 return ((!Stmt || !isa<CallExpr>(Stmt)) && 243 (S && S->isAllocated()) && (SPrev && !SPrev->isAllocated())); 244 } 245 246 PathDiagnosticPiece *VisitNode(const ExplodedNode *N, 247 const ExplodedNode *PrevN, 248 BugReporterContext &BRC, 249 BugReport &BR); 250 }; 251}; 252} // end anonymous namespace 253 254typedef llvm::ImmutableMap<SymbolRef, RefState> RegionStateTy; 255typedef llvm::ImmutableMap<SymbolRef, ReallocPair > ReallocMap; 256class RegionState {}; 257class ReallocPairs {}; 258namespace clang { 259namespace ento { 260 template <> 261 struct ProgramStateTrait<RegionState> 262 : public ProgramStatePartialTrait<RegionStateTy> { 263 static void *GDMIndex() { static int x; return &x; } 264 }; 265 266 template <> 267 struct ProgramStateTrait<ReallocPairs> 268 : public ProgramStatePartialTrait<ReallocMap> { 269 static void *GDMIndex() { static int x; return &x; } 270 }; 271} 272} 273 274namespace { 275class StopTrackingCallback : public SymbolVisitor { 276 ProgramStateRef state; 277public: 278 StopTrackingCallback(ProgramStateRef st) : state(st) {} 279 ProgramStateRef getState() const { return state; } 280 281 bool VisitSymbol(SymbolRef sym) { 282 state = state->remove<RegionState>(sym); 283 return true; 284 } 285}; 286} // end anonymous namespace 287 288void MallocChecker::initIdentifierInfo(ASTContext &Ctx) const { 289 if (!II_malloc) 290 II_malloc = &Ctx.Idents.get("malloc"); 291 if (!II_free) 292 II_free = &Ctx.Idents.get("free"); 293 if (!II_realloc) 294 II_realloc = &Ctx.Idents.get("realloc"); 295 if (!II_reallocf) 296 II_reallocf = &Ctx.Idents.get("reallocf"); 297 if (!II_calloc) 298 II_calloc = &Ctx.Idents.get("calloc"); 299 if (!II_valloc) 300 II_valloc = &Ctx.Idents.get("valloc"); 301 if (!II_strdup) 302 II_strdup = &Ctx.Idents.get("strdup"); 303 if (!II_strndup) 304 II_strndup = &Ctx.Idents.get("strndup"); 305} 306 307bool MallocChecker::isMemFunction(const FunctionDecl *FD, ASTContext &C) const { 308 if (!FD) 309 return false; 310 IdentifierInfo *FunI = FD->getIdentifier(); 311 if (!FunI) 312 return false; 313 314 initIdentifierInfo(C); 315 316 if (FunI == II_malloc || FunI == II_free || FunI == II_realloc || 317 FunI == II_reallocf || FunI == II_calloc || FunI == II_valloc || 318 FunI == II_strdup || FunI == II_strndup) 319 return true; 320 321 if (Filter.CMallocOptimistic && FD->hasAttrs() && 322 FD->specific_attr_begin<OwnershipAttr>() != 323 FD->specific_attr_end<OwnershipAttr>()) 324 return true; 325 326 327 return false; 328} 329 330void MallocChecker::checkPostStmt(const CallExpr *CE, CheckerContext &C) const { 331 const FunctionDecl *FD = C.getCalleeDecl(CE); 332 if (!FD) 333 return; 334 335 initIdentifierInfo(C.getASTContext()); 336 IdentifierInfo *FunI = FD->getIdentifier(); 337 if (!FunI) 338 return; 339 340 ProgramStateRef State = C.getState(); 341 if (FunI == II_malloc || FunI == II_valloc) { 342 State = MallocMemAux(C, CE, CE->getArg(0), UndefinedVal(), State); 343 } else if (FunI == II_realloc) { 344 State = ReallocMem(C, CE, false); 345 } else if (FunI == II_reallocf) { 346 State = ReallocMem(C, CE, true); 347 } else if (FunI == II_calloc) { 348 State = CallocMem(C, CE); 349 } else if (FunI == II_free) { 350 State = FreeMemAux(C, CE, C.getState(), 0, false); 351 } else if (FunI == II_strdup) { 352 State = MallocUpdateRefState(C, CE, State); 353 } else if (FunI == II_strndup) { 354 State = MallocUpdateRefState(C, CE, State); 355 } else if (Filter.CMallocOptimistic) { 356 // Check all the attributes, if there are any. 357 // There can be multiple of these attributes. 358 if (FD->hasAttrs()) 359 for (specific_attr_iterator<OwnershipAttr> 360 i = FD->specific_attr_begin<OwnershipAttr>(), 361 e = FD->specific_attr_end<OwnershipAttr>(); 362 i != e; ++i) { 363 switch ((*i)->getOwnKind()) { 364 case OwnershipAttr::Returns: 365 State = MallocMemReturnsAttr(C, CE, *i); 366 break; 367 case OwnershipAttr::Takes: 368 case OwnershipAttr::Holds: 369 State = FreeMemAttr(C, CE, *i); 370 break; 371 } 372 } 373 } 374 C.addTransition(State); 375} 376 377ProgramStateRef MallocChecker::MallocMemReturnsAttr(CheckerContext &C, 378 const CallExpr *CE, 379 const OwnershipAttr* Att) { 380 if (Att->getModule() != "malloc") 381 return 0; 382 383 OwnershipAttr::args_iterator I = Att->args_begin(), E = Att->args_end(); 384 if (I != E) { 385 return MallocMemAux(C, CE, CE->getArg(*I), UndefinedVal(), C.getState()); 386 } 387 return MallocMemAux(C, CE, UnknownVal(), UndefinedVal(), C.getState()); 388} 389 390ProgramStateRef MallocChecker::MallocMemAux(CheckerContext &C, 391 const CallExpr *CE, 392 SVal Size, SVal Init, 393 ProgramStateRef state) { 394 // Get the return value. 395 SVal retVal = state->getSVal(CE, C.getLocationContext()); 396 397 // We expect the malloc functions to return a pointer. 398 if (!isa<Loc>(retVal)) 399 return 0; 400 401 // Fill the region with the initialization value. 402 state = state->bindDefault(retVal, Init); 403 404 // Set the region's extent equal to the Size parameter. 405 const SymbolicRegion *R = 406 dyn_cast_or_null<SymbolicRegion>(retVal.getAsRegion()); 407 if (!R) 408 return 0; 409 if (isa<DefinedOrUnknownSVal>(Size)) { 410 SValBuilder &svalBuilder = C.getSValBuilder(); 411 DefinedOrUnknownSVal Extent = R->getExtent(svalBuilder); 412 DefinedOrUnknownSVal DefinedSize = cast<DefinedOrUnknownSVal>(Size); 413 DefinedOrUnknownSVal extentMatchesSize = 414 svalBuilder.evalEQ(state, Extent, DefinedSize); 415 416 state = state->assume(extentMatchesSize, true); 417 assert(state); 418 } 419 420 return MallocUpdateRefState(C, CE, state); 421} 422 423ProgramStateRef MallocChecker::MallocUpdateRefState(CheckerContext &C, 424 const CallExpr *CE, 425 ProgramStateRef state) { 426 // Get the return value. 427 SVal retVal = state->getSVal(CE, C.getLocationContext()); 428 429 // We expect the malloc functions to return a pointer. 430 if (!isa<Loc>(retVal)) 431 return 0; 432 433 SymbolRef Sym = retVal.getAsLocSymbol(); 434 assert(Sym); 435 436 // Set the symbol's state to Allocated. 437 return state->set<RegionState>(Sym, RefState::getAllocateUnchecked(CE)); 438 439} 440 441ProgramStateRef MallocChecker::FreeMemAttr(CheckerContext &C, 442 const CallExpr *CE, 443 const OwnershipAttr* Att) const { 444 if (Att->getModule() != "malloc") 445 return 0; 446 447 for (OwnershipAttr::args_iterator I = Att->args_begin(), E = Att->args_end(); 448 I != E; ++I) { 449 return FreeMemAux(C, CE, C.getState(), *I, 450 Att->getOwnKind() == OwnershipAttr::Holds); 451 } 452 return 0; 453} 454 455ProgramStateRef MallocChecker::FreeMemAux(CheckerContext &C, 456 const CallExpr *CE, 457 ProgramStateRef state, 458 unsigned Num, 459 bool Hold) const { 460 const Expr *ArgExpr = CE->getArg(Num); 461 SVal ArgVal = state->getSVal(ArgExpr, C.getLocationContext()); 462 if (!isa<DefinedOrUnknownSVal>(ArgVal)) 463 return 0; 464 DefinedOrUnknownSVal location = cast<DefinedOrUnknownSVal>(ArgVal); 465 466 // Check for null dereferences. 467 if (!isa<Loc>(location)) 468 return 0; 469 470 // The explicit NULL case, no operation is performed. 471 ProgramStateRef notNullState, nullState; 472 llvm::tie(notNullState, nullState) = state->assume(location); 473 if (nullState && !notNullState) 474 return 0; 475 476 // Unknown values could easily be okay 477 // Undefined values are handled elsewhere 478 if (ArgVal.isUnknownOrUndef()) 479 return 0; 480 481 const MemRegion *R = ArgVal.getAsRegion(); 482 483 // Nonlocs can't be freed, of course. 484 // Non-region locations (labels and fixed addresses) also shouldn't be freed. 485 if (!R) { 486 ReportBadFree(C, ArgVal, ArgExpr->getSourceRange()); 487 return 0; 488 } 489 490 R = R->StripCasts(); 491 492 // Blocks might show up as heap data, but should not be free()d 493 if (isa<BlockDataRegion>(R)) { 494 ReportBadFree(C, ArgVal, ArgExpr->getSourceRange()); 495 return 0; 496 } 497 498 const MemSpaceRegion *MS = R->getMemorySpace(); 499 500 // Parameters, locals, statics, and globals shouldn't be freed. 501 if (!(isa<UnknownSpaceRegion>(MS) || isa<HeapSpaceRegion>(MS))) { 502 // FIXME: at the time this code was written, malloc() regions were 503 // represented by conjured symbols, which are all in UnknownSpaceRegion. 504 // This means that there isn't actually anything from HeapSpaceRegion 505 // that should be freed, even though we allow it here. 506 // Of course, free() can work on memory allocated outside the current 507 // function, so UnknownSpaceRegion is always a possibility. 508 // False negatives are better than false positives. 509 510 ReportBadFree(C, ArgVal, ArgExpr->getSourceRange()); 511 return 0; 512 } 513 514 const SymbolicRegion *SR = dyn_cast<SymbolicRegion>(R); 515 // Various cases could lead to non-symbol values here. 516 // For now, ignore them. 517 if (!SR) 518 return 0; 519 520 SymbolRef Sym = SR->getSymbol(); 521 const RefState *RS = state->get<RegionState>(Sym); 522 523 // If the symbol has not been tracked, return. This is possible when free() is 524 // called on a pointer that does not get its pointee directly from malloc(). 525 // Full support of this requires inter-procedural analysis. 526 if (!RS) 527 return 0; 528 529 // Check double free. 530 if (RS->isReleased()) { 531 if (ExplodedNode *N = C.generateSink()) { 532 if (!BT_DoubleFree) 533 BT_DoubleFree.reset( 534 new BugType("Double free", "Memory Error")); 535 BugReport *R = new BugReport(*BT_DoubleFree, 536 "Attempt to free released memory", N); 537 R->addRange(ArgExpr->getSourceRange()); 538 R->addVisitor(new MallocBugVisitor(Sym)); 539 C.EmitReport(R); 540 } 541 return 0; 542 } 543 544 // Normal free. 545 if (Hold) 546 return state->set<RegionState>(Sym, RefState::getRelinquished(CE)); 547 return state->set<RegionState>(Sym, RefState::getReleased(CE)); 548} 549 550bool MallocChecker::SummarizeValue(raw_ostream &os, SVal V) { 551 if (nonloc::ConcreteInt *IntVal = dyn_cast<nonloc::ConcreteInt>(&V)) 552 os << "an integer (" << IntVal->getValue() << ")"; 553 else if (loc::ConcreteInt *ConstAddr = dyn_cast<loc::ConcreteInt>(&V)) 554 os << "a constant address (" << ConstAddr->getValue() << ")"; 555 else if (loc::GotoLabel *Label = dyn_cast<loc::GotoLabel>(&V)) 556 os << "the address of the label '" << Label->getLabel()->getName() << "'"; 557 else 558 return false; 559 560 return true; 561} 562 563bool MallocChecker::SummarizeRegion(raw_ostream &os, 564 const MemRegion *MR) { 565 switch (MR->getKind()) { 566 case MemRegion::FunctionTextRegionKind: { 567 const FunctionDecl *FD = cast<FunctionTextRegion>(MR)->getDecl(); 568 if (FD) 569 os << "the address of the function '" << *FD << '\''; 570 else 571 os << "the address of a function"; 572 return true; 573 } 574 case MemRegion::BlockTextRegionKind: 575 os << "block text"; 576 return true; 577 case MemRegion::BlockDataRegionKind: 578 // FIXME: where the block came from? 579 os << "a block"; 580 return true; 581 default: { 582 const MemSpaceRegion *MS = MR->getMemorySpace(); 583 584 if (isa<StackLocalsSpaceRegion>(MS)) { 585 const VarRegion *VR = dyn_cast<VarRegion>(MR); 586 const VarDecl *VD; 587 if (VR) 588 VD = VR->getDecl(); 589 else 590 VD = NULL; 591 592 if (VD) 593 os << "the address of the local variable '" << VD->getName() << "'"; 594 else 595 os << "the address of a local stack variable"; 596 return true; 597 } 598 599 if (isa<StackArgumentsSpaceRegion>(MS)) { 600 const VarRegion *VR = dyn_cast<VarRegion>(MR); 601 const VarDecl *VD; 602 if (VR) 603 VD = VR->getDecl(); 604 else 605 VD = NULL; 606 607 if (VD) 608 os << "the address of the parameter '" << VD->getName() << "'"; 609 else 610 os << "the address of a parameter"; 611 return true; 612 } 613 614 if (isa<GlobalsSpaceRegion>(MS)) { 615 const VarRegion *VR = dyn_cast<VarRegion>(MR); 616 const VarDecl *VD; 617 if (VR) 618 VD = VR->getDecl(); 619 else 620 VD = NULL; 621 622 if (VD) { 623 if (VD->isStaticLocal()) 624 os << "the address of the static variable '" << VD->getName() << "'"; 625 else 626 os << "the address of the global variable '" << VD->getName() << "'"; 627 } else 628 os << "the address of a global variable"; 629 return true; 630 } 631 632 return false; 633 } 634 } 635} 636 637void MallocChecker::ReportBadFree(CheckerContext &C, SVal ArgVal, 638 SourceRange range) const { 639 if (ExplodedNode *N = C.generateSink()) { 640 if (!BT_BadFree) 641 BT_BadFree.reset(new BugType("Bad free", "Memory Error")); 642 643 SmallString<100> buf; 644 llvm::raw_svector_ostream os(buf); 645 646 const MemRegion *MR = ArgVal.getAsRegion(); 647 if (MR) { 648 while (const ElementRegion *ER = dyn_cast<ElementRegion>(MR)) 649 MR = ER->getSuperRegion(); 650 651 // Special case for alloca() 652 if (isa<AllocaRegion>(MR)) 653 os << "Argument to free() was allocated by alloca(), not malloc()"; 654 else { 655 os << "Argument to free() is "; 656 if (SummarizeRegion(os, MR)) 657 os << ", which is not memory allocated by malloc()"; 658 else 659 os << "not memory allocated by malloc()"; 660 } 661 } else { 662 os << "Argument to free() is "; 663 if (SummarizeValue(os, ArgVal)) 664 os << ", which is not memory allocated by malloc()"; 665 else 666 os << "not memory allocated by malloc()"; 667 } 668 669 BugReport *R = new BugReport(*BT_BadFree, os.str(), N); 670 R->addRange(range); 671 C.EmitReport(R); 672 } 673} 674 675ProgramStateRef MallocChecker::ReallocMem(CheckerContext &C, 676 const CallExpr *CE, 677 bool FreesOnFail) const { 678 ProgramStateRef state = C.getState(); 679 const Expr *arg0Expr = CE->getArg(0); 680 const LocationContext *LCtx = C.getLocationContext(); 681 SVal Arg0Val = state->getSVal(arg0Expr, LCtx); 682 if (!isa<DefinedOrUnknownSVal>(Arg0Val)) 683 return 0; 684 DefinedOrUnknownSVal arg0Val = cast<DefinedOrUnknownSVal>(Arg0Val); 685 686 SValBuilder &svalBuilder = C.getSValBuilder(); 687 688 DefinedOrUnknownSVal PtrEQ = 689 svalBuilder.evalEQ(state, arg0Val, svalBuilder.makeNull()); 690 691 // Get the size argument. If there is no size arg then give up. 692 const Expr *Arg1 = CE->getArg(1); 693 if (!Arg1) 694 return 0; 695 696 // Get the value of the size argument. 697 SVal Arg1ValG = state->getSVal(Arg1, LCtx); 698 if (!isa<DefinedOrUnknownSVal>(Arg1ValG)) 699 return 0; 700 DefinedOrUnknownSVal Arg1Val = cast<DefinedOrUnknownSVal>(Arg1ValG); 701 702 // Compare the size argument to 0. 703 DefinedOrUnknownSVal SizeZero = 704 svalBuilder.evalEQ(state, Arg1Val, 705 svalBuilder.makeIntValWithPtrWidth(0, false)); 706 707 ProgramStateRef StatePtrIsNull, StatePtrNotNull; 708 llvm::tie(StatePtrIsNull, StatePtrNotNull) = state->assume(PtrEQ); 709 ProgramStateRef StateSizeIsZero, StateSizeNotZero; 710 llvm::tie(StateSizeIsZero, StateSizeNotZero) = state->assume(SizeZero); 711 // We only assume exceptional states if they are definitely true; if the 712 // state is under-constrained, assume regular realloc behavior. 713 bool PrtIsNull = StatePtrIsNull && !StatePtrNotNull; 714 bool SizeIsZero = StateSizeIsZero && !StateSizeNotZero; 715 716 // If the ptr is NULL and the size is not 0, the call is equivalent to 717 // malloc(size). 718 if ( PrtIsNull && !SizeIsZero) { 719 ProgramStateRef stateMalloc = MallocMemAux(C, CE, CE->getArg(1), 720 UndefinedVal(), StatePtrIsNull); 721 return stateMalloc; 722 } 723 724 if (PrtIsNull && SizeIsZero) 725 return 0; 726 727 // Get the from and to pointer symbols as in toPtr = realloc(fromPtr, size). 728 assert(!PrtIsNull); 729 SymbolRef FromPtr = arg0Val.getAsSymbol(); 730 SVal RetVal = state->getSVal(CE, LCtx); 731 SymbolRef ToPtr = RetVal.getAsSymbol(); 732 if (!FromPtr || !ToPtr) 733 return 0; 734 735 // If the size is 0, free the memory. 736 if (SizeIsZero) 737 if (ProgramStateRef stateFree = FreeMemAux(C, CE, StateSizeIsZero,0,false)){ 738 // The semantics of the return value are: 739 // If size was equal to 0, either NULL or a pointer suitable to be passed 740 // to free() is returned. 741 stateFree = stateFree->set<ReallocPairs>(ToPtr, 742 ReallocPair(FromPtr, FreesOnFail)); 743 C.getSymbolManager().addSymbolDependency(ToPtr, FromPtr); 744 return stateFree; 745 } 746 747 // Default behavior. 748 if (ProgramStateRef stateFree = FreeMemAux(C, CE, state, 0, false)) { 749 // FIXME: We should copy the content of the original buffer. 750 ProgramStateRef stateRealloc = MallocMemAux(C, CE, CE->getArg(1), 751 UnknownVal(), stateFree); 752 if (!stateRealloc) 753 return 0; 754 stateRealloc = stateRealloc->set<ReallocPairs>(ToPtr, 755 ReallocPair(FromPtr, FreesOnFail)); 756 C.getSymbolManager().addSymbolDependency(ToPtr, FromPtr); 757 return stateRealloc; 758 } 759 return 0; 760} 761 762ProgramStateRef MallocChecker::CallocMem(CheckerContext &C, const CallExpr *CE){ 763 ProgramStateRef state = C.getState(); 764 SValBuilder &svalBuilder = C.getSValBuilder(); 765 const LocationContext *LCtx = C.getLocationContext(); 766 SVal count = state->getSVal(CE->getArg(0), LCtx); 767 SVal elementSize = state->getSVal(CE->getArg(1), LCtx); 768 SVal TotalSize = svalBuilder.evalBinOp(state, BO_Mul, count, elementSize, 769 svalBuilder.getContext().getSizeType()); 770 SVal zeroVal = svalBuilder.makeZeroVal(svalBuilder.getContext().CharTy); 771 772 return MallocMemAux(C, CE, TotalSize, zeroVal, state); 773} 774 775const Stmt * 776MallocChecker::getAllocationSite(const ExplodedNode *N, SymbolRef Sym, 777 CheckerContext &C) const { 778 const LocationContext *LeakContext = N->getLocationContext(); 779 // Walk the ExplodedGraph backwards and find the first node that referred to 780 // the tracked symbol. 781 const ExplodedNode *AllocNode = N; 782 783 while (N) { 784 if (!N->getState()->get<RegionState>(Sym)) 785 break; 786 // Allocation node, is the last node in the current context in which the 787 // symbol was tracked. 788 if (N->getLocationContext() == LeakContext) 789 AllocNode = N; 790 N = N->pred_empty() ? NULL : *(N->pred_begin()); 791 } 792 793 ProgramPoint P = AllocNode->getLocation(); 794 if (!isa<StmtPoint>(P)) 795 return 0; 796 797 return cast<StmtPoint>(P).getStmt(); 798} 799 800void MallocChecker::reportLeak(SymbolRef Sym, ExplodedNode *N, 801 CheckerContext &C) const { 802 assert(N); 803 if (!BT_Leak) { 804 BT_Leak.reset(new BugType("Memory leak", "Memory Error")); 805 // Leaks should not be reported if they are post-dominated by a sink: 806 // (1) Sinks are higher importance bugs. 807 // (2) NoReturnFunctionChecker uses sink nodes to represent paths ending 808 // with __noreturn functions such as assert() or exit(). We choose not 809 // to report leaks on such paths. 810 BT_Leak->setSuppressOnSink(true); 811 } 812 813 // Most bug reports are cached at the location where they occurred. 814 // With leaks, we want to unique them by the location where they were 815 // allocated, and only report a single path. 816 PathDiagnosticLocation LocUsedForUniqueing; 817 if (const Stmt *AllocStmt = getAllocationSite(N, Sym, C)) 818 LocUsedForUniqueing = PathDiagnosticLocation::createBegin(AllocStmt, 819 C.getSourceManager(), N->getLocationContext()); 820 821 BugReport *R = new BugReport(*BT_Leak, 822 "Memory is never released; potential memory leak", N, LocUsedForUniqueing); 823 R->addVisitor(new MallocBugVisitor(Sym)); 824 C.EmitReport(R); 825} 826 827void MallocChecker::checkDeadSymbols(SymbolReaper &SymReaper, 828 CheckerContext &C) const 829{ 830 if (!SymReaper.hasDeadSymbols()) 831 return; 832 833 ProgramStateRef state = C.getState(); 834 RegionStateTy RS = state->get<RegionState>(); 835 RegionStateTy::Factory &F = state->get_context<RegionState>(); 836 837 bool generateReport = false; 838 llvm::SmallVector<SymbolRef, 2> Errors; 839 for (RegionStateTy::iterator I = RS.begin(), E = RS.end(); I != E; ++I) { 840 if (SymReaper.isDead(I->first)) { 841 if (I->second.isAllocated()) { 842 generateReport = true; 843 Errors.push_back(I->first); 844 } 845 // Remove the dead symbol from the map. 846 RS = F.remove(RS, I->first); 847 848 } 849 } 850 851 // Cleanup the Realloc Pairs Map. 852 ReallocMap RP = state->get<ReallocPairs>(); 853 for (ReallocMap::iterator I = RP.begin(), E = RP.end(); I != E; ++I) { 854 if (SymReaper.isDead(I->first) || 855 SymReaper.isDead(I->second.ReallocatedSym)) { 856 state = state->remove<ReallocPairs>(I->first); 857 } 858 } 859 860 // Generate leak node. 861 static SimpleProgramPointTag Tag("MallocChecker : DeadSymbolsLeak"); 862 ExplodedNode *N = C.addTransition(C.getState(), C.getPredecessor(), &Tag); 863 864 if (generateReport) { 865 for (llvm::SmallVector<SymbolRef, 2>::iterator 866 I = Errors.begin(), E = Errors.end(); I != E; ++I) { 867 reportLeak(*I, N, C); 868 } 869 } 870 C.addTransition(state->set<RegionState>(RS), N); 871} 872 873void MallocChecker::checkEndPath(CheckerContext &C) const { 874 ProgramStateRef state = C.getState(); 875 RegionStateTy M = state->get<RegionState>(); 876 877 // If inside inlined call, skip it. 878 if (C.getLocationContext()->getParent() != 0) 879 return; 880 881 for (RegionStateTy::iterator I = M.begin(), E = M.end(); I != E; ++I) { 882 RefState RS = I->second; 883 if (RS.isAllocated()) { 884 ExplodedNode *N = C.addTransition(state); 885 if (N) 886 reportLeak(I->first, N, C); 887 } 888 } 889} 890 891bool MallocChecker::checkEscape(SymbolRef Sym, const Stmt *S, 892 CheckerContext &C) const { 893 ProgramStateRef state = C.getState(); 894 const RefState *RS = state->get<RegionState>(Sym); 895 if (!RS) 896 return false; 897 898 if (RS->isAllocated()) { 899 state = state->set<RegionState>(Sym, RefState::getEscaped(S)); 900 C.addTransition(state); 901 return true; 902 } 903 return false; 904} 905 906void MallocChecker::checkPreStmt(const CallExpr *CE, CheckerContext &C) const { 907 if (isMemFunction(C.getCalleeDecl(CE), C.getASTContext())) 908 return; 909 910 // Check use after free, when a freed pointer is passed to a call. 911 ProgramStateRef State = C.getState(); 912 for (CallExpr::const_arg_iterator I = CE->arg_begin(), 913 E = CE->arg_end(); I != E; ++I) { 914 const Expr *A = *I; 915 if (A->getType().getTypePtr()->isAnyPointerType()) { 916 SymbolRef Sym = State->getSVal(A, C.getLocationContext()).getAsSymbol(); 917 if (!Sym) 918 continue; 919 if (checkUseAfterFree(Sym, C, A)) 920 return; 921 } 922 } 923} 924 925void MallocChecker::checkPreStmt(const ReturnStmt *S, CheckerContext &C) const { 926 const Expr *E = S->getRetValue(); 927 if (!E) 928 return; 929 930 // Check if we are returning a symbol. 931 SVal RetVal = C.getState()->getSVal(E, C.getLocationContext()); 932 SymbolRef Sym = RetVal.getAsSymbol(); 933 if (!Sym) 934 // If we are returning a field of the allocated struct or an array element, 935 // the callee could still free the memory. 936 // TODO: This logic should be a part of generic symbol escape callback. 937 if (const MemRegion *MR = RetVal.getAsRegion()) 938 if (isa<FieldRegion>(MR) || isa<ElementRegion>(MR)) 939 if (const SymbolicRegion *BMR = 940 dyn_cast<SymbolicRegion>(MR->getBaseRegion())) 941 Sym = BMR->getSymbol(); 942 if (!Sym) 943 return; 944 945 // Check if we are returning freed memory. 946 if (checkUseAfterFree(Sym, C, E)) 947 return; 948 949 // If this function body is not inlined, check if the symbol is escaping. 950 if (C.getLocationContext()->getParent() == 0) 951 checkEscape(Sym, E, C); 952} 953 954bool MallocChecker::checkUseAfterFree(SymbolRef Sym, CheckerContext &C, 955 const Stmt *S) const { 956 assert(Sym); 957 const RefState *RS = C.getState()->get<RegionState>(Sym); 958 if (RS && RS->isReleased()) { 959 if (ExplodedNode *N = C.generateSink()) { 960 if (!BT_UseFree) 961 BT_UseFree.reset(new BugType("Use-after-free", "Memory Error")); 962 963 BugReport *R = new BugReport(*BT_UseFree, 964 "Use of memory after it is freed",N); 965 if (S) 966 R->addRange(S->getSourceRange()); 967 R->addVisitor(new MallocBugVisitor(Sym)); 968 C.EmitReport(R); 969 return true; 970 } 971 } 972 return false; 973} 974 975// Check if the location is a freed symbolic region. 976void MallocChecker::checkLocation(SVal l, bool isLoad, const Stmt *S, 977 CheckerContext &C) const { 978 SymbolRef Sym = l.getLocSymbolInBase(); 979 if (Sym) 980 checkUseAfterFree(Sym, C); 981} 982 983//===----------------------------------------------------------------------===// 984// Check various ways a symbol can be invalidated. 985// TODO: This logic (the next 3 functions) is copied/similar to the 986// RetainRelease checker. We might want to factor this out. 987//===----------------------------------------------------------------------===// 988 989// Stop tracking symbols when a value escapes as a result of checkBind. 990// A value escapes in three possible cases: 991// (1) we are binding to something that is not a memory region. 992// (2) we are binding to a memregion that does not have stack storage 993// (3) we are binding to a memregion with stack storage that the store 994// does not understand. 995void MallocChecker::checkBind(SVal loc, SVal val, const Stmt *S, 996 CheckerContext &C) const { 997 // Are we storing to something that causes the value to "escape"? 998 bool escapes = true; 999 ProgramStateRef state = C.getState(); 1000 1001 if (loc::MemRegionVal *regionLoc = dyn_cast<loc::MemRegionVal>(&loc)) { 1002 escapes = !regionLoc->getRegion()->hasStackStorage(); 1003 1004 if (!escapes) { 1005 // To test (3), generate a new state with the binding added. If it is 1006 // the same state, then it escapes (since the store cannot represent 1007 // the binding). 1008 escapes = (state == (state->bindLoc(*regionLoc, val))); 1009 } 1010 if (!escapes) { 1011 // Case 4: We do not currently model what happens when a symbol is 1012 // assigned to a struct field, so be conservative here and let the symbol 1013 // go. TODO: This could definitely be improved upon. 1014 escapes = !isa<VarRegion>(regionLoc->getRegion()); 1015 } 1016 } 1017 1018 // If our store can represent the binding and we aren't storing to something 1019 // that doesn't have local storage then just return and have the simulation 1020 // state continue as is. 1021 if (!escapes) 1022 return; 1023 1024 // Otherwise, find all symbols referenced by 'val' that we are tracking 1025 // and stop tracking them. 1026 state = state->scanReachableSymbols<StopTrackingCallback>(val).getState(); 1027 C.addTransition(state); 1028} 1029 1030// If a symbolic region is assumed to NULL (or another constant), stop tracking 1031// it - assuming that allocation failed on this path. 1032ProgramStateRef MallocChecker::evalAssume(ProgramStateRef state, 1033 SVal Cond, 1034 bool Assumption) const { 1035 RegionStateTy RS = state->get<RegionState>(); 1036 for (RegionStateTy::iterator I = RS.begin(), E = RS.end(); I != E; ++I) { 1037 // If the symbol is assumed to NULL or another constant, this will 1038 // return an APSInt*. 1039 if (state->getSymVal(I.getKey())) 1040 state = state->remove<RegionState>(I.getKey()); 1041 } 1042 1043 // Realloc returns 0 when reallocation fails, which means that we should 1044 // restore the state of the pointer being reallocated. 1045 ReallocMap RP = state->get<ReallocPairs>(); 1046 for (ReallocMap::iterator I = RP.begin(), E = RP.end(); I != E; ++I) { 1047 // If the symbol is assumed to NULL or another constant, this will 1048 // return an APSInt*. 1049 if (state->getSymVal(I.getKey())) { 1050 SymbolRef ReallocSym = I.getData().ReallocatedSym; 1051 const RefState *RS = state->get<RegionState>(ReallocSym); 1052 if (RS) { 1053 if (RS->isReleased() && ! I.getData().IsFreeOnFailure) 1054 state = state->set<RegionState>(ReallocSym, 1055 RefState::getAllocateUnchecked(RS->getStmt())); 1056 } 1057 state = state->remove<ReallocPairs>(I.getKey()); 1058 } 1059 } 1060 1061 return state; 1062} 1063 1064// Check if the function is known to us. So, for example, we could 1065// conservatively assume it can free/reallocate it's pointer arguments. 1066// (We assume that the pointers cannot escape through calls to system 1067// functions not handled by this checker.) 1068bool MallocChecker::doesNotFreeMemory(const CallOrObjCMessage *Call, 1069 ProgramStateRef State) const { 1070 if (!Call) 1071 return false; 1072 1073 // For now, assume that any C++ call can free memory. 1074 // TODO: If we want to be more optimistic here, we'll need to make sure that 1075 // regions escape to C++ containers. They seem to do that even now, but for 1076 // mysterious reasons. 1077 if (Call->isCXXCall()) 1078 return false; 1079 1080 const Decl *D = Call->getDecl(); 1081 if (!D) 1082 return false; 1083 1084 ASTContext &ASTC = State->getStateManager().getContext(); 1085 1086 // If it's one of the allocation functions we can reason about, we model 1087 // it's behavior explicitly. 1088 if (isa<FunctionDecl>(D) && isMemFunction(cast<FunctionDecl>(D), ASTC)) { 1089 return true; 1090 } 1091 1092 // If it's not a system call, assume it frees memory. 1093 SourceManager &SM = ASTC.getSourceManager(); 1094 if (!SM.isInSystemHeader(D->getLocation())) 1095 return false; 1096 1097 // Process C functions. 1098 if (const FunctionDecl *FD = dyn_cast_or_null<FunctionDecl>(D)) { 1099 // White list the system functions whose arguments escape. 1100 const IdentifierInfo *II = FD->getIdentifier(); 1101 if (II) { 1102 StringRef FName = II->getName(); 1103 if (FName.equals("pthread_setspecific")) 1104 return false; 1105 } 1106 1107 // Otherwise, assume that the function does not free memory. 1108 // Most system calls, do not free the memory. 1109 return true; 1110 1111 // Process ObjC functions. 1112 } else if (const ObjCMethodDecl * ObjCD = dyn_cast<ObjCMethodDecl>(D)) { 1113 Selector S = ObjCD->getSelector(); 1114 1115 // White list the ObjC functions which do free memory. 1116 // - Anything containing 'freeWhenDone' param set to 1. 1117 // Ex: dataWithBytesNoCopy:length:freeWhenDone. 1118 for (unsigned i = 1; i < S.getNumArgs(); ++i) { 1119 if (S.getNameForSlot(i).equals("freeWhenDone")) { 1120 if (Call->getArgSVal(i).isConstant(1)) 1121 return false; 1122 } 1123 } 1124 1125 // Otherwise, assume that the function does not free memory. 1126 // Most system calls, do not free the memory. 1127 return true; 1128 } 1129 1130 // Otherwise, assume that the function can free memory. 1131 return false; 1132 1133} 1134 1135// If the symbol we are tracking is invalidated, but not explicitly (ex: the &p 1136// escapes, when we are tracking p), do not track the symbol as we cannot reason 1137// about it anymore. 1138ProgramStateRef 1139MallocChecker::checkRegionChanges(ProgramStateRef State, 1140 const StoreManager::InvalidatedSymbols *invalidated, 1141 ArrayRef<const MemRegion *> ExplicitRegions, 1142 ArrayRef<const MemRegion *> Regions, 1143 const CallOrObjCMessage *Call) const { 1144 if (!invalidated || invalidated->empty()) 1145 return State; 1146 llvm::SmallPtrSet<SymbolRef, 8> WhitelistedSymbols; 1147 1148 // If it's a call which might free or reallocate memory, we assume that all 1149 // regions (explicit and implicit) escaped. 1150 1151 // Otherwise, whitelist explicit pointers; we still can track them. 1152 if (!Call || doesNotFreeMemory(Call, State)) { 1153 for (ArrayRef<const MemRegion *>::iterator I = ExplicitRegions.begin(), 1154 E = ExplicitRegions.end(); I != E; ++I) { 1155 if (const SymbolicRegion *R = (*I)->StripCasts()->getAs<SymbolicRegion>()) 1156 WhitelistedSymbols.insert(R->getSymbol()); 1157 } 1158 } 1159 1160 for (StoreManager::InvalidatedSymbols::const_iterator I=invalidated->begin(), 1161 E = invalidated->end(); I!=E; ++I) { 1162 SymbolRef sym = *I; 1163 if (WhitelistedSymbols.count(sym)) 1164 continue; 1165 // The symbol escaped. 1166 if (const RefState *RS = State->get<RegionState>(sym)) 1167 State = State->set<RegionState>(sym, RefState::getEscaped(RS->getStmt())); 1168 } 1169 return State; 1170} 1171 1172PathDiagnosticPiece * 1173MallocChecker::MallocBugVisitor::VisitNode(const ExplodedNode *N, 1174 const ExplodedNode *PrevN, 1175 BugReporterContext &BRC, 1176 BugReport &BR) { 1177 const RefState *RS = N->getState()->get<RegionState>(Sym); 1178 const RefState *RSPrev = PrevN->getState()->get<RegionState>(Sym); 1179 if (!RS && !RSPrev) 1180 return 0; 1181 1182 const Stmt *S = 0; 1183 const char *Msg = 0; 1184 1185 // Retrieve the associated statement. 1186 ProgramPoint ProgLoc = N->getLocation(); 1187 if (isa<StmtPoint>(ProgLoc)) 1188 S = cast<StmtPoint>(ProgLoc).getStmt(); 1189 // If an assumption was made on a branch, it should be caught 1190 // here by looking at the state transition. 1191 if (isa<BlockEdge>(ProgLoc)) { 1192 const CFGBlock *srcBlk = cast<BlockEdge>(ProgLoc).getSrc(); 1193 S = srcBlk->getTerminator(); 1194 } 1195 if (!S) 1196 return 0; 1197 1198 // Find out if this is an interesting point and what is the kind. 1199 if (Mode == Normal) { 1200 if (isAllocated(RS, RSPrev, S)) 1201 Msg = "Memory is allocated"; 1202 else if (isReleased(RS, RSPrev, S)) 1203 Msg = "Memory is released"; 1204 else if (isReallocFailedCheck(RS, RSPrev, S)) { 1205 Mode = ReallocationFailed; 1206 Msg = "Reallocation failed"; 1207 } 1208 1209 // We are in a special mode if a reallocation failed later in the path. 1210 } else if (Mode == ReallocationFailed) { 1211 // Generate a special diagnostic for the first realloc we find. 1212 if (!isAllocated(RS, RSPrev, S) && !isReleased(RS, RSPrev, S)) 1213 return 0; 1214 1215 // Check that the name of the function is realloc. 1216 const CallExpr *CE = dyn_cast<CallExpr>(S); 1217 if (!CE) 1218 return 0; 1219 const FunctionDecl *funDecl = CE->getDirectCallee(); 1220 if (!funDecl) 1221 return 0; 1222 StringRef FunName = funDecl->getName(); 1223 if (!(FunName.equals("realloc") || FunName.equals("reallocf"))) 1224 return 0; 1225 Msg = "Attempt to reallocate memory"; 1226 Mode = Normal; 1227 } 1228 1229 if (!Msg) 1230 return 0; 1231 1232 // Generate the extra diagnostic. 1233 PathDiagnosticLocation Pos(S, BRC.getSourceManager(), 1234 N->getLocationContext()); 1235 return new PathDiagnosticEventPiece(Pos, Msg); 1236} 1237 1238 1239#define REGISTER_CHECKER(name) \ 1240void ento::register##name(CheckerManager &mgr) {\ 1241 registerCStringCheckerBasic(mgr); \ 1242 mgr.registerChecker<MallocChecker>()->Filter.C##name = true;\ 1243} 1244 1245REGISTER_CHECKER(MallocPessimistic) 1246REGISTER_CHECKER(MallocOptimistic) 1247