clang  7.0.0svn
ValistChecker.cpp
Go to the documentation of this file.
1 //== ValistChecker.cpp - stdarg.h macro usage checker -----------*- C++ -*--==//
2 //
3 // The LLVM Compiler Infrastructure
4 //
5 // This file is distributed under the University of Illinois Open Source
6 // License. See LICENSE.TXT for details.
7 //
8 //===----------------------------------------------------------------------===//
9 //
10 // This defines checkers which detect usage of uninitialized va_list values
11 // and va_start calls with no matching va_end.
12 //
13 //===----------------------------------------------------------------------===//
14 
15 #include "ClangSACheckers.h"
21 
22 using namespace clang;
23 using namespace ento;
24 
25 REGISTER_SET_WITH_PROGRAMSTATE(InitializedVALists, const MemRegion *)
26 
27 namespace {
28 typedef SmallVector<const MemRegion *, 2> RegionVector;
29 
30 class ValistChecker : public Checker<check::PreCall, check::PreStmt<VAArgExpr>,
31  check::DeadSymbols> {
32  mutable std::unique_ptr<BugType> BT_leakedvalist, BT_uninitaccess;
33 
34  struct VAListAccepter {
35  CallDescription Func;
36  int VAListPos;
37  };
38  static const SmallVector<VAListAccepter, 15> VAListAccepters;
39  static const CallDescription VaStart, VaEnd, VaCopy;
40 
41 public:
42  enum CheckKind {
43  CK_Uninitialized,
44  CK_Unterminated,
45  CK_CopyToSelf,
46  CK_NumCheckKinds
47  };
48 
49  DefaultBool ChecksEnabled[CK_NumCheckKinds];
50  CheckName CheckNames[CK_NumCheckKinds];
51 
52  void checkPreStmt(const VAArgExpr *VAA, CheckerContext &C) const;
53  void checkPreCall(const CallEvent &Call, CheckerContext &C) const;
54  void checkDeadSymbols(SymbolReaper &SR, CheckerContext &C) const;
55 
56 private:
57  const MemRegion *getVAListAsRegion(SVal SV, const Expr *VAExpr,
58  bool &IsSymbolic, CheckerContext &C) const;
59  StringRef getVariableNameFromRegion(const MemRegion *Reg) const;
60  const ExplodedNode *getStartCallSite(const ExplodedNode *N,
61  const MemRegion *Reg) const;
62 
63  void reportUninitializedAccess(const MemRegion *VAList, StringRef Msg,
64  CheckerContext &C) const;
65  void reportLeakedVALists(const RegionVector &LeakedVALists, StringRef Msg1,
66  StringRef Msg2, CheckerContext &C, ExplodedNode *N,
67  bool ReportUninit = false) const;
68 
69  void checkVAListStartCall(const CallEvent &Call, CheckerContext &C,
70  bool IsCopy) const;
71  void checkVAListEndCall(const CallEvent &Call, CheckerContext &C) const;
72 
73  class ValistBugVisitor : public BugReporterVisitorImpl<ValistBugVisitor> {
74  public:
75  ValistBugVisitor(const MemRegion *Reg, bool IsLeak = false)
76  : Reg(Reg), IsLeak(IsLeak) {}
77  void Profile(llvm::FoldingSetNodeID &ID) const override {
78  static int X = 0;
79  ID.AddPointer(&X);
80  ID.AddPointer(Reg);
81  }
82  std::unique_ptr<PathDiagnosticPiece>
83  getEndPath(BugReporterContext &BRC, const ExplodedNode *EndPathNode,
84  BugReport &BR) override {
85  if (!IsLeak)
86  return nullptr;
87 
89  EndPathNode, BRC.getSourceManager());
90  // Do not add the statement itself as a range in case of leak.
91  return llvm::make_unique<PathDiagnosticEventPiece>(L, BR.getDescription(),
92  false);
93  }
94  std::shared_ptr<PathDiagnosticPiece> VisitNode(const ExplodedNode *N,
95  const ExplodedNode *PrevN,
96  BugReporterContext &BRC,
97  BugReport &BR) override;
98 
99  private:
100  const MemRegion *Reg;
101  bool IsLeak;
102  };
103 };
104 
106  ValistChecker::VAListAccepters = {
107  {{"vfprintf", 3}, 2},
108  {{"vfscanf", 3}, 2},
109  {{"vprintf", 2}, 1},
110  {{"vscanf", 2}, 1},
111  {{"vsnprintf", 4}, 3},
112  {{"vsprintf", 3}, 2},
113  {{"vsscanf", 3}, 2},
114  {{"vfwprintf", 3}, 2},
115  {{"vfwscanf", 3}, 2},
116  {{"vwprintf", 2}, 1},
117  {{"vwscanf", 2}, 1},
118  {{"vswprintf", 4}, 3},
119  // vswprintf is the wide version of vsnprintf,
120  // vsprintf has no wide version
121  {{"vswscanf", 3}, 2}};
122 const CallDescription ValistChecker::VaStart("__builtin_va_start", 2),
123  ValistChecker::VaCopy("__builtin_va_copy", 2),
124  ValistChecker::VaEnd("__builtin_va_end", 1);
125 } // end anonymous namespace
126 
127 void ValistChecker::checkPreCall(const CallEvent &Call,
128  CheckerContext &C) const {
129  if (!Call.isGlobalCFunction())
130  return;
131  if (Call.isCalled(VaStart))
132  checkVAListStartCall(Call, C, false);
133  else if (Call.isCalled(VaCopy))
134  checkVAListStartCall(Call, C, true);
135  else if (Call.isCalled(VaEnd))
136  checkVAListEndCall(Call, C);
137  else {
138  for (auto FuncInfo : VAListAccepters) {
139  if (!Call.isCalled(FuncInfo.Func))
140  continue;
141  bool Symbolic;
142  const MemRegion *VAList =
143  getVAListAsRegion(Call.getArgSVal(FuncInfo.VAListPos),
144  Call.getArgExpr(FuncInfo.VAListPos), Symbolic, C);
145  if (!VAList)
146  return;
147 
148  if (C.getState()->contains<InitializedVALists>(VAList))
149  return;
150 
151  // We did not see va_start call, but the source of the region is unknown.
152  // Be conservative and assume the best.
153  if (Symbolic)
154  return;
155 
156  SmallString<80> Errmsg("Function '");
157  Errmsg += FuncInfo.Func.getFunctionName();
158  Errmsg += "' is called with an uninitialized va_list argument";
159  reportUninitializedAccess(VAList, Errmsg.c_str(), C);
160  break;
161  }
162  }
163 }
164 
165 const MemRegion *ValistChecker::getVAListAsRegion(SVal SV, const Expr *E,
166  bool &IsSymbolic,
167  CheckerContext &C) const {
168  const MemRegion *Reg = SV.getAsRegion();
169  if (!Reg)
170  return nullptr;
171  // TODO: In the future this should be abstracted away by the analyzer.
172  bool VaListModelledAsArray = false;
173  if (const auto *Cast = dyn_cast<CastExpr>(E)) {
174  QualType Ty = Cast->getType();
175  VaListModelledAsArray =
176  Ty->isPointerType() && Ty->getPointeeType()->isRecordType();
177  }
178  if (const auto *DeclReg = Reg->getAs<DeclRegion>()) {
179  if (isa<ParmVarDecl>(DeclReg->getDecl()))
180  Reg = C.getState()->getSVal(SV.castAs<Loc>()).getAsRegion();
181  }
182  IsSymbolic = Reg && Reg->getAs<SymbolicRegion>();
183  // Some VarRegion based VA lists reach here as ElementRegions.
184  const auto *EReg = dyn_cast_or_null<ElementRegion>(Reg);
185  return (EReg && VaListModelledAsArray) ? EReg->getSuperRegion() : Reg;
186 }
187 
188 void ValistChecker::checkPreStmt(const VAArgExpr *VAA,
189  CheckerContext &C) const {
191  const Expr *VASubExpr = VAA->getSubExpr();
192  SVal VAListSVal = C.getSVal(VASubExpr);
193  bool Symbolic;
194  const MemRegion *VAList =
195  getVAListAsRegion(VAListSVal, VASubExpr, Symbolic, C);
196  if (!VAList)
197  return;
198  if (Symbolic)
199  return;
200  if (!State->contains<InitializedVALists>(VAList))
201  reportUninitializedAccess(
202  VAList, "va_arg() is called on an uninitialized va_list", C);
203 }
204 
205 void ValistChecker::checkDeadSymbols(SymbolReaper &SR,
206  CheckerContext &C) const {
207  ProgramStateRef State = C.getState();
208  InitializedVAListsTy TrackedVALists = State->get<InitializedVALists>();
209  RegionVector LeakedVALists;
210  for (auto Reg : TrackedVALists) {
211  if (SR.isLiveRegion(Reg))
212  continue;
213  LeakedVALists.push_back(Reg);
214  State = State->remove<InitializedVALists>(Reg);
215  }
216  if (ExplodedNode *N = C.addTransition(State))
217  reportLeakedVALists(LeakedVALists, "Initialized va_list", " is leaked", C,
218  N);
219 }
220 
221 // This function traverses the exploded graph backwards and finds the node where
222 // the va_list is initialized. That node is used for uniquing the bug paths.
223 // It is not likely that there are several different va_lists that belongs to
224 // different stack frames, so that case is not yet handled.
225 const ExplodedNode *
226 ValistChecker::getStartCallSite(const ExplodedNode *N,
227  const MemRegion *Reg) const {
228  const LocationContext *LeakContext = N->getLocationContext();
229  const ExplodedNode *StartCallNode = N;
230 
231  bool FoundInitializedState = false;
232 
233  while (N) {
234  ProgramStateRef State = N->getState();
235  if (!State->contains<InitializedVALists>(Reg)) {
236  if (FoundInitializedState)
237  break;
238  } else {
239  FoundInitializedState = true;
240  }
241  const LocationContext *NContext = N->getLocationContext();
242  if (NContext == LeakContext || NContext->isParentOf(LeakContext))
243  StartCallNode = N;
244  N = N->pred_empty() ? nullptr : *(N->pred_begin());
245  }
246 
247  return StartCallNode;
248 }
249 
250 void ValistChecker::reportUninitializedAccess(const MemRegion *VAList,
251  StringRef Msg,
252  CheckerContext &C) const {
253  if (!ChecksEnabled[CK_Uninitialized])
254  return;
255  if (ExplodedNode *N = C.generateErrorNode()) {
256  if (!BT_uninitaccess)
257  BT_uninitaccess.reset(new BugType(CheckNames[CK_Uninitialized],
258  "Uninitialized va_list",
260  auto R = llvm::make_unique<BugReport>(*BT_uninitaccess, Msg, N);
261  R->markInteresting(VAList);
262  R->addVisitor(llvm::make_unique<ValistBugVisitor>(VAList));
263  C.emitReport(std::move(R));
264  }
265 }
266 
267 void ValistChecker::reportLeakedVALists(const RegionVector &LeakedVALists,
268  StringRef Msg1, StringRef Msg2,
270  bool ReportUninit) const {
271  if (!(ChecksEnabled[CK_Unterminated] ||
272  (ChecksEnabled[CK_Uninitialized] && ReportUninit)))
273  return;
274  for (auto Reg : LeakedVALists) {
275  if (!BT_leakedvalist) {
276  // FIXME: maybe creating a new check name for this type of bug is a better
277  // solution.
278  BT_leakedvalist.reset(
279  new BugType(CheckNames[CK_Unterminated].getName().empty()
280  ? CheckNames[CK_Uninitialized]
281  : CheckNames[CK_Unterminated],
282  "Leaked va_list", categories::MemoryError));
283  BT_leakedvalist->setSuppressOnSink(true);
284  }
285 
286  const ExplodedNode *StartNode = getStartCallSite(N, Reg);
287  PathDiagnosticLocation LocUsedForUniqueing;
288 
289  if (const Stmt *StartCallStmt = PathDiagnosticLocation::getStmt(StartNode))
290  LocUsedForUniqueing = PathDiagnosticLocation::createBegin(
291  StartCallStmt, C.getSourceManager(), StartNode->getLocationContext());
292 
293  SmallString<100> Buf;
294  llvm::raw_svector_ostream OS(Buf);
295  OS << Msg1;
296  std::string VariableName = Reg->getDescriptiveName();
297  if (!VariableName.empty())
298  OS << " " << VariableName;
299  OS << Msg2;
300 
301  auto R = llvm::make_unique<BugReport>(
302  *BT_leakedvalist, OS.str(), N, LocUsedForUniqueing,
303  StartNode->getLocationContext()->getDecl());
304  R->markInteresting(Reg);
305  R->addVisitor(llvm::make_unique<ValistBugVisitor>(Reg, true));
306  C.emitReport(std::move(R));
307  }
308 }
309 
310 void ValistChecker::checkVAListStartCall(const CallEvent &Call,
311  CheckerContext &C, bool IsCopy) const {
312  bool Symbolic;
313  const MemRegion *VAList =
314  getVAListAsRegion(Call.getArgSVal(0), Call.getArgExpr(0), Symbolic, C);
315  if (!VAList)
316  return;
317 
318  ProgramStateRef State = C.getState();
319 
320  if (IsCopy) {
321  const MemRegion *Arg2 =
322  getVAListAsRegion(Call.getArgSVal(1), Call.getArgExpr(1), Symbolic, C);
323  if (Arg2) {
324  if (ChecksEnabled[CK_CopyToSelf] && VAList == Arg2) {
325  RegionVector LeakedVALists{VAList};
326  if (ExplodedNode *N = C.addTransition(State))
327  reportLeakedVALists(LeakedVALists, "va_list",
328  " is copied onto itself", C, N, true);
329  return;
330  } else if (!State->contains<InitializedVALists>(Arg2) && !Symbolic) {
331  if (State->contains<InitializedVALists>(VAList)) {
332  State = State->remove<InitializedVALists>(VAList);
333  RegionVector LeakedVALists{VAList};
334  if (ExplodedNode *N = C.addTransition(State))
335  reportLeakedVALists(LeakedVALists, "Initialized va_list",
336  " is overwritten by an uninitialized one", C, N,
337  true);
338  } else {
339  reportUninitializedAccess(Arg2, "Uninitialized va_list is copied", C);
340  }
341  return;
342  }
343  }
344  }
345  if (State->contains<InitializedVALists>(VAList)) {
346  RegionVector LeakedVALists{VAList};
347  if (ExplodedNode *N = C.addTransition(State))
348  reportLeakedVALists(LeakedVALists, "Initialized va_list",
349  " is initialized again", C, N);
350  return;
351  }
352 
353  State = State->add<InitializedVALists>(VAList);
354  C.addTransition(State);
355 }
356 
357 void ValistChecker::checkVAListEndCall(const CallEvent &Call,
358  CheckerContext &C) const {
359  bool Symbolic;
360  const MemRegion *VAList =
361  getVAListAsRegion(Call.getArgSVal(0), Call.getArgExpr(0), Symbolic, C);
362  if (!VAList)
363  return;
364 
365  // We did not see va_start call, but the source of the region is unknown.
366  // Be conservative and assume the best.
367  if (Symbolic)
368  return;
369 
370  if (!C.getState()->contains<InitializedVALists>(VAList)) {
371  reportUninitializedAccess(
372  VAList, "va_end() is called on an uninitialized va_list", C);
373  return;
374  }
375  ProgramStateRef State = C.getState();
376  State = State->remove<InitializedVALists>(VAList);
377  C.addTransition(State);
378 }
379 
380 std::shared_ptr<PathDiagnosticPiece> ValistChecker::ValistBugVisitor::VisitNode(
381  const ExplodedNode *N, const ExplodedNode *PrevN, BugReporterContext &BRC,
382  BugReport &) {
383  ProgramStateRef State = N->getState();
384  ProgramStateRef StatePrev = PrevN->getState();
385 
387  if (!S)
388  return nullptr;
389 
390  StringRef Msg;
391  if (State->contains<InitializedVALists>(Reg) &&
392  !StatePrev->contains<InitializedVALists>(Reg))
393  Msg = "Initialized va_list";
394  else if (!State->contains<InitializedVALists>(Reg) &&
395  StatePrev->contains<InitializedVALists>(Reg))
396  Msg = "Ended va_list";
397 
398  if (Msg.empty())
399  return nullptr;
400 
402  N->getLocationContext());
403  return std::make_shared<PathDiagnosticEventPiece>(Pos, Msg, true);
404 }
405 
406 #define REGISTER_CHECKER(name) \
407  void ento::register##name##Checker(CheckerManager &mgr) { \
408  ValistChecker *checker = mgr.registerChecker<ValistChecker>(); \
409  checker->ChecksEnabled[ValistChecker::CK_##name] = true; \
410  checker->CheckNames[ValistChecker::CK_##name] = mgr.getCurrentCheckName(); \
411  }
412 
414 REGISTER_CHECKER(Unterminated)
415 REGISTER_CHECKER(CopyToSelf)
A (possibly-)qualified type.
Definition: Type.h:653
MemRegion - The root abstract class for all memory regions.
Definition: MemRegion.h:79
ExplodedNode * generateErrorNode(ProgramStateRef State=nullptr, const ProgramPointTag *Tag=nullptr)
Generate a transition to a node that will be used to report an error.
Stmt - This represents one statement.
Definition: Stmt.h:66
A helper class which wraps a boolean value set to false by default.
Definition: Checker.h:567
QualType getPointeeType() const
If this is a pointer, ObjC object pointer, or block pointer, this returns the respective pointee...
Definition: Type.cpp:456
bool isRecordType() const
Definition: Type.h:6021
ExplodedNode * addTransition(ProgramStateRef State=nullptr, const ProgramPointTag *Tag=nullptr)
Generates a new transition in the program state graph (ExplodedGraph).
StringRef getDescription() const
Definition: BugReporter.h:196
const Expr * getSubExpr() const
Definition: Expr.h:3809
const ProgramStateRef & getState() const
SVal getSVal(const Stmt *S) const
Get the value of arbitrary expressions at this point in the path.
#define REGISTER_SET_WITH_PROGRAMSTATE(Name, Elem)
Declares an immutable set of type NameTy, suitable for placement into the ProgramState.
bool isParentOf(const LocationContext *LC) const
const MemRegion * getSuperRegion() const
Definition: MemRegion.h:431
LineState State
This class provides a convenience implementation for clone() using the Curiously-Recurring Template P...
virtual const Expr * getArgExpr(unsigned Index) const
Returns the expression associated with a given argument.
Definition: CallEvent.h:275
bool isLiveRegion(const MemRegion *region)
const LocationContext * getLocationContext() const
Represents a call to the builtin function __builtin_va_arg.
Definition: Expr.h:3791
const RegionTy * getAs() const
Definition: MemRegion.h:1180
SymbolicRegion - A special, "non-concrete" region.
Definition: MemRegion.h:743
Expr - This represents one expression.
Definition: Expr.h:106
void emitReport(std::unique_ptr< BugReport > R)
Emit the diagnostics report.
static const Stmt * getStmt(const ExplodedNode *N)
Given an exploded node, retrieve the statement that should be used for the diagnostic location...
static PathDiagnosticLocation createBegin(const Decl *D, const SourceManager &SM)
Create a location for the beginning of the declaration.
This class represents a description of a function call using the number of arguments and the name of ...
Definition: CallEvent.h:55
const MemRegion * getAsRegion() const
Definition: SVals.cpp:140
SVal - This represents a symbolic expression, which can be either an L-value or an R-value...
Definition: SVals.h:63
A class responsible for cleaning up unused symbols.
std::string getDescriptiveName(bool UseQuotes=true) const
Get descriptive name for memory region.
Definition: MemRegion.cpp:595
Dataflow Directional Tag Classes.
Represents an abstract call to a function or method along a particular path.
Definition: CallEvent.h:140
const Decl * getDecl() const
T castAs() const
Convert to the specified SVal type, asserting that this SVal is of the desired type.
Definition: SVals.h:92
const ProgramStateRef & getState() const
bool isGlobalCFunction(StringRef SpecificName=StringRef()) const
Returns true if the callee is an externally-visible function in the top-level namespace, such as malloc.
Definition: CallEvent.cpp:121
#define REGISTER_CHECKER(name)
X
Add a minimal nested name specifier fixit hint to allow lookup of a tag name from an outer enclosing ...
Definition: SemaDecl.cpp:13401
bool isCalled(const CallDescription &CD) const
Returns true if the CallEvent is a call to a function that matches the CallDescription.
Definition: CallEvent.cpp:213
pred_iterator pred_begin()
SourceManager & getSourceManager()
static PathDiagnosticLocation createEndOfPath(const ExplodedNode *N, const SourceManager &SM)
Create a location corresponding to the next valid ExplodedNode as end of path location.
bool isPointerType() const
Definition: Type.h:5948
virtual SVal getArgSVal(unsigned Index) const
Returns the value of a given argument at the time of the call.
Definition: CallEvent.cpp:228
This class provides an interface through which checkers can create individual bug reports...
Definition: BugReporter.h:55
SourceManager & getSourceManager()
Definition: BugReporter.h:563