security-syntax-checks.m revision b63d8d8f7b2d101838af992749411dd79c2ed116 
1// RUN: %clang_cc1 -triple i386-apple-darwin10 -analyze -analyzer-checker=security.insecureAPI,security.FloatLoopCounter %s -verify
2// RUN: %clang_cc1 -triple i386-apple-darwin10 -analyze -DUSE_BUILTINS -analyzer-checker=security.insecureAPI,security.FloatLoopCounter %s -verify
3// RUN: %clang_cc1 -triple i386-apple-darwin10 -analyze -DVARIANT -analyzer-checker=security.insecureAPI,security.FloatLoopCounter %s -verify
4// RUN: %clang_cc1 -triple i386-apple-darwin10 -analyze -DUSE_BUILTINS -DVARIANT -analyzer-checker=security.insecureAPI,security.FloatLoopCounter %s -verify
5
6#ifdef USE_BUILTINS
7# define BUILTIN(f) __builtin_ ## f
8#else /* USE_BUILTINS */
9# define BUILTIN(f) f
10#endif /* USE_BUILTINS */
11
12typedef typeof(sizeof(int)) size_t;
13
14
15// <rdar://problem/6336718> rule request: floating point used as loop 
16//  condition (FLP30-C, FLP-30-CPP)
17//
18// For reference: https://www.securecoding.cert.org/confluence/display/seccode/FLP30-C.+Do+not+use+floating+point+variables+as+loop+counters
19//
20void test_float_condition() {
21  for (float x = 0.1f; x <= 1.0f; x += 0.1f) {} // expected-warning{{Variable 'x' with floating point type 'float'}}
22  for (float x = 100000001.0f; x <= 100000010.0f; x += 1.0f) {} // expected-warning{{Variable 'x' with floating point type 'float'}}
23  for (float x = 100000001.0f; x <= 100000010.0f; x++ ) {} // expected-warning{{Variable 'x' with floating point type 'float'}}
24  for (double x = 100000001.0; x <= 100000010.0; x++ ) {} // expected-warning{{Variable 'x' with floating point type 'double'}}
25  for (double x = 100000001.0; ((x)) <= 100000010.0; ((x))++ ) {} // expected-warning{{Variable 'x' with floating point type 'double'}}
26  
27  for (double x = 100000001.0; 100000010.0 >= x; x = x + 1.0 ) {} // expected-warning{{Variable 'x' with floating point type 'double'}}
28  
29  int i = 0;
30  for (double x = 100000001.0; ((x)) <= 100000010.0; ((x))++, ++i ) {} // expected-warning{{Variable 'x' with floating point type 'double'}}
31  
32  typedef float FooType;
33  for (FooType x = 100000001.0f; x <= 100000010.0f; x++ ) {} // expected-warning{{Variable 'x' with floating point type 'FooType'}}
34}
35
36// <rdar://problem/6335715> rule request: gets() buffer overflow
37// Part of recommendation: 300-BSI (buildsecurityin.us-cert.gov)
38char* gets(char *buf);
39
40void test_gets() {
41  char buff[1024];
42  gets(buff); // expected-warning{{Call to function 'gets' is extremely insecure as it can always result in a buffer overflow}}
43}
44
45int getpw(unsigned int uid, char *buf);
46
47void test_getpw() {
48  char buff[1024];
49  getpw(2, buff); // expected-warning{{The getpw() function is dangerous as it may overflow the provided buffer. It is obsoleted by getpwuid().}}
50}
51
52// <rdar://problem/6337132> CWE-273: Failure to Check Whether Privileges Were
53//  Dropped Successfully
54typedef unsigned int __uint32_t;
55typedef __uint32_t __darwin_uid_t;
56typedef __uint32_t __darwin_gid_t;
57typedef __darwin_uid_t uid_t;
58typedef __darwin_gid_t gid_t;
59int setuid(uid_t);
60int setregid(gid_t, gid_t);
61int setreuid(uid_t, uid_t);
62extern void check(int);
63void abort(void);
64
65void test_setuid() 
66{
67  setuid(2); // expected-warning{{The return value from the call to 'setuid' is not checked.  If an error occurs in 'setuid', the following code may execute with unexpected privileges}}
68  setuid(0); // expected-warning{{The return value from the call to 'setuid' is not checked.  If an error occurs in 'setuid', the following code may execute with unexpected privileges}}
69  if (setuid (2) != 0)
70    abort();
71
72  // Currently the 'setuid' check is not flow-sensitive, and only looks
73  // at whether the function was called in a compound statement.  This
74  // will lead to false negatives, but there should be no false positives.
75  int t = setuid(2);  // no-warning
76  (void)setuid (2); // no-warning
77
78  check(setuid (2)); // no-warning
79
80  setreuid(2,2); // expected-warning{{The return value from the call to 'setreuid' is not checked.  If an error occurs in 'setreuid', the following code may execute with unexpected privileges}}
81  setregid(2,2); // expected-warning{{The return value from the call to 'setregid' is not checked.  If an error occurs in 'setregid', the following code may execute with unexpected privileges}}
82}
83
84// <rdar://problem/6337100> CWE-338: Use of cryptographically weak prng
85int      rand(void);
86double   drand48(void);
87double   erand48(unsigned short[3]);
88long     jrand48(unsigned short[3]);
89void     lcong48(unsigned short[7]);
90long     lrand48(void);
91long     mrand48(void);
92long     nrand48(unsigned short[3]);
93long     random(void);
94int      rand_r(unsigned *);
95
96void test_rand()
97{
98  unsigned short a[7];
99  unsigned b;
100  
101  rand();	// expected-warning{{Function 'rand' is obsolete because it implements a poor random number generator.  Use 'arc4random' instead}}
102  drand48();	// expected-warning{{Function 'drand48' is obsolete because it implements a poor random number generator.  Use 'arc4random' instead}}
103  erand48(a);	// expected-warning{{Function 'erand48' is obsolete because it implements a poor random number generator.  Use 'arc4random' instead}}
104  jrand48(a);	// expected-warning{{Function 'jrand48' is obsolete because it implements a poor random number generator.  Use 'arc4random' instead}}
105  lcong48(a);	// expected-warning{{Function 'lcong48' is obsolete because it implements a poor random number generator.  Use 'arc4random' instead}}
106  lrand48();	// expected-warning{{Function 'lrand48' is obsolete because it implements a poor random number generator.  Use 'arc4random' instead}}
107  mrand48();	// expected-warning{{Function 'mrand48' is obsolete because it implements a poor random number generator.  Use 'arc4random' instead}}
108  nrand48(a);	// expected-warning{{Function 'nrand48' is obsolete because it implements a poor random number generator.  Use 'arc4random' instead}}
109  rand_r(&b);	// expected-warning{{Function 'rand_r' is obsolete because it implements a poor random number generator.  Use 'arc4random' instead}}
110  random();	// expected-warning{{The 'random' function produces a sequence of values that an adversary may be able to predict.  Use 'arc4random' instead}}
111}
112
113char *mktemp(char *buf);
114
115void test_mktemp() {
116  char *x = mktemp("/tmp/zxcv"); // expected-warning{{Call to function 'mktemp' is insecure as it always creates or uses insecure temporary file}}
117}
118
119
120//===----------------------------------------------------------------------===
121// strcpy()
122//===----------------------------------------------------------------------===
123#ifdef VARIANT
124
125#define __strcpy_chk BUILTIN(__strcpy_chk)
126char *__strcpy_chk(char *restrict s1, const char *restrict s2, size_t destlen);
127
128#define strcpy(a,b) __strcpy_chk(a,b,(size_t)-1)
129
130#else /* VARIANT */
131
132#define strcpy BUILTIN(strcpy)
133char *strcpy(char *restrict s1, const char *restrict s2);
134
135#endif /* VARIANT */
136
137void test_strcpy() {
138  char x[4];
139  char *y;
140
141  strcpy(x, y); //expected-warning{{Call to function 'strcpy' is insecure as it does not provide bounding of the memory buffer. Replace unbounded copy functions with analogous functions that support length arguments such as 'strncpy'. CWE-119.}}
142}
143
144//===----------------------------------------------------------------------===
145// strcat()
146//===----------------------------------------------------------------------===
147#ifdef VARIANT
148
149#define __strcat_chk BUILTIN(__strcat_chk)
150char *__strcat_chk(char *restrict s1, const char *restrict s2, size_t destlen);
151
152#define strcat(a,b) __strcat_chk(a,b,(size_t)-1)
153
154#else /* VARIANT */
155
156#define strcat BUILTIN(strcat)
157char *strcat(char *restrict s1, const char *restrict s2);
158
159#endif /* VARIANT */
160
161void test_strcat() {
162  char x[4];
163  char *y;
164
165  strcat(x, y); //expected-warning{{Call to function 'strcat' is insecure as it does not provide bounding of the memory buffer. Replace unbounded copy functions with analogous functions that support length arguments such as 'strncat'. CWE-119.}}
166}
167
168//===----------------------------------------------------------------------===
169// vfork()
170//===----------------------------------------------------------------------===
171typedef int __int32_t;
172typedef __int32_t pid_t;
173pid_t vfork(void);
174
175void test_vfork() {
176  vfork(); //expected-warning{{Call to function 'vfork' is insecure as it can lead to denial of service situations in the parent process.}}
177}
178
179//===----------------------------------------------------------------------===
180// mkstemp()
181//===----------------------------------------------------------------------===
182
183char *mkdtemp(char *template);
184int mkstemps(char *template, int suffixlen);
185int mkstemp(char *template);
186char *mktemp(char *template);
187
188void test_mkstemp() {
189  mkstemp("XX"); // expected-warning {{Call to 'mkstemp' should have at least 6 'X's in the format string to be secure (2 'X's seen)}}
190  mkstemp("XXXXXX");
191  mkstemp("XXXXXXX");
192  mkstemps("XXXXXX", 0);
193  mkstemps("XXXXXX", 1); // expected-warning {{5 'X's seen}}
194  mkstemps("XXXXXX", 2); // expected-warning {{Call to 'mkstemps' should have at least 6 'X's in the format string to be secure (4 'X's seen, 2 characters used as a suffix)}}
195  mkdtemp("XX"); // expected-warning {{2 'X's seen}}
196  mkstemp("X"); // expected-warning {{Call to 'mkstemp' should have at least 6 'X's in the format string to be secure (1 'X' seen)}}
197  mkdtemp("XXXXXX");
198}
199
200