clang 22.0.0git
VAListChecker.cpp
Go to the documentation of this file.
1//== VAListChecker.cpp - stdarg.h macro usage checker -----------*- C++ -*--==//
2//
3// Part of the LLVM Project, under the Apache License v2.0 with LLVM Exceptions.
4// See https://llvm.org/LICENSE.txt for license information.
5// SPDX-License-Identifier: Apache-2.0 WITH LLVM-exception
6//
7//===----------------------------------------------------------------------===//
8//
9// This defines checkers which detect usage of uninitialized va_list values
10// and va_start calls with no matching va_end.
11//
12//===----------------------------------------------------------------------===//
13
21#include "llvm/Support/FormatVariadic.h"
22
23using namespace clang;
24using namespace ento;
25using llvm::formatv;
26
27namespace {
28enum class VAListState {
30 Unknown,
32 Released,
33};
34
35constexpr llvm::StringLiteral StateNames[] = {
36 "uninitialized", "unknown", "initialized", "already released"};
37} // end anonymous namespace
38
39static StringRef describeState(const VAListState S) {
40 return StateNames[static_cast<int>(S)];
41}
42
43REGISTER_MAP_WITH_PROGRAMSTATE(VAListStateMap, const MemRegion *, VAListState)
44
45static VAListState getVAListState(ProgramStateRef State, const MemRegion *Reg) {
46 if (const VAListState *Res = State->get<VAListStateMap>(Reg))
47 return *Res;
48 return Reg->getSymbolicBase() ? VAListState::Unknown
49 : VAListState::Uninitialized;
50}
51
52namespace {
53typedef SmallVector<const MemRegion *, 2> RegionVector;
54
55class VAListChecker : public Checker<check::PreCall, check::PreStmt<VAArgExpr>,
56 check::DeadSymbols> {
57 const BugType LeakBug{this, "Leaked va_list", categories::MemoryError,
58 /*SuppressOnSink=*/true};
59 const BugType UninitAccessBug{this, "Uninitialized va_list",
61
62 struct VAListAccepter {
63 CallDescription Func;
64 int ParamIndex;
65 };
66 static const SmallVector<VAListAccepter, 15> VAListAccepters;
67 static const CallDescription VaStart, VaEnd, VaCopy;
68
69public:
70 void checkPreStmt(const VAArgExpr *VAA, CheckerContext &C) const;
71 void checkPreCall(const CallEvent &Call, CheckerContext &C) const;
72 void checkDeadSymbols(SymbolReaper &SR, CheckerContext &C) const;
73
74private:
75 const MemRegion *getVAListAsRegion(SVal SV, const Expr *VAExpr,
76 CheckerContext &C) const;
77 const ExplodedNode *getStartCallSite(const ExplodedNode *N,
78 const MemRegion *Reg) const;
79
80 void reportUninitializedAccess(const MemRegion *VAList, StringRef Msg,
81 CheckerContext &C) const;
82 void reportLeaked(const RegionVector &Leaked, StringRef Msg1, StringRef Msg2,
83 CheckerContext &C, ExplodedNode *N) const;
84
85 void checkVAListStartCall(const CallEvent &Call, CheckerContext &C) const;
86 void checkVAListCopyCall(const CallEvent &Call, CheckerContext &C) const;
87 void checkVAListEndCall(const CallEvent &Call, CheckerContext &C) const;
88
89 class VAListBugVisitor : public BugReporterVisitor {
90 public:
91 VAListBugVisitor(const MemRegion *Reg, bool IsLeak = false)
92 : Reg(Reg), IsLeak(IsLeak) {}
93 void Profile(llvm::FoldingSetNodeID &ID) const override {
94 static int X = 0;
95 ID.AddPointer(&X);
96 ID.AddPointer(Reg);
97 }
98 PathDiagnosticPieceRef getEndPath(BugReporterContext &BRC,
99 const ExplodedNode *EndPathNode,
100 PathSensitiveBugReport &BR) override {
101 if (!IsLeak)
102 return nullptr;
103
104 PathDiagnosticLocation L = BR.getLocation();
105 // Do not add the statement itself as a range in case of leak.
106 return std::make_shared<PathDiagnosticEventPiece>(L, BR.getDescription(),
107 false);
108 }
109 PathDiagnosticPieceRef VisitNode(const ExplodedNode *N,
110 BugReporterContext &BRC,
111 PathSensitiveBugReport &BR) override;
112
113 private:
114 const MemRegion *Reg;
115 bool IsLeak;
116 };
117};
118
120 VAListChecker::VAListAccepters = {{{CDM::CLibrary, {"vfprintf"}, 3}, 2},
121 {{CDM::CLibrary, {"vfscanf"}, 3}, 2},
122 {{CDM::CLibrary, {"vprintf"}, 2}, 1},
123 {{CDM::CLibrary, {"vscanf"}, 2}, 1},
124 {{CDM::CLibrary, {"vsnprintf"}, 4}, 3},
125 {{CDM::CLibrary, {"vsprintf"}, 3}, 2},
126 {{CDM::CLibrary, {"vsscanf"}, 3}, 2},
127 {{CDM::CLibrary, {"vfwprintf"}, 3}, 2},
128 {{CDM::CLibrary, {"vfwscanf"}, 3}, 2},
129 {{CDM::CLibrary, {"vwprintf"}, 2}, 1},
130 {{CDM::CLibrary, {"vwscanf"}, 2}, 1},
131 {{CDM::CLibrary, {"vswprintf"}, 4}, 3},
132 // vswprintf is the wide version of
133 // vsnprintf, vsprintf has no wide version
134 {{CDM::CLibrary, {"vswscanf"}, 3}, 2}};
135
136const CallDescription VAListChecker::VaStart(CDM::CLibrary,
137 {"__builtin_va_start"}, /*Args=*/2,
138 /*Params=*/1),
139 VAListChecker::VaCopy(CDM::CLibrary, {"__builtin_va_copy"}, 2),
140 VAListChecker::VaEnd(CDM::CLibrary, {"__builtin_va_end"}, 1);
141} // end anonymous namespace
142
143void VAListChecker::checkPreCall(const CallEvent &Call,
144 CheckerContext &C) const {
145 if (VaStart.matches(Call))
146 checkVAListStartCall(Call, C);
147 else if (VaCopy.matches(Call))
148 checkVAListCopyCall(Call, C);
149 else if (VaEnd.matches(Call))
150 checkVAListEndCall(Call, C);
151 else {
152 for (auto FuncInfo : VAListAccepters) {
153 if (!FuncInfo.Func.matches(Call))
154 continue;
155 const MemRegion *VAList =
156 getVAListAsRegion(Call.getArgSVal(FuncInfo.ParamIndex),
157 Call.getArgExpr(FuncInfo.ParamIndex), C);
158 if (!VAList)
159 return;
160 VAListState S = getVAListState(C.getState(), VAList);
161
162 if (S == VAListState::Initialized || S == VAListState::Unknown)
163 return;
164
165 std::string ErrMsg =
166 formatv("Function '{0}' is called with an {1} va_list argument",
167 FuncInfo.Func.getFunctionName(), describeState(S));
168 reportUninitializedAccess(VAList, ErrMsg, C);
169 break;
170 }
171 }
172}
173
174const MemRegion *VAListChecker::getVAListAsRegion(SVal SV, const Expr *E,
175 CheckerContext &C) const {
176 const MemRegion *Reg = SV.getAsRegion();
177 if (!Reg)
178 return nullptr;
179 // TODO: In the future this should be abstracted away by the analyzer.
180 bool VAListModelledAsArray = false;
181 if (const auto *Cast = dyn_cast<CastExpr>(E)) {
182 QualType Ty = Cast->getType();
183 VAListModelledAsArray =
184 Ty->isPointerType() && Ty->getPointeeType()->isRecordType();
185 }
186 if (const auto *DeclReg = Reg->getAs<DeclRegion>()) {
187 if (isa<ParmVarDecl>(DeclReg->getDecl()))
188 Reg = C.getState()->getSVal(SV.castAs<Loc>()).getAsRegion();
189 }
190 // Some VarRegion based VA lists reach here as ElementRegions.
191 const auto *EReg = dyn_cast_or_null<ElementRegion>(Reg);
192 return (EReg && VAListModelledAsArray) ? EReg->getSuperRegion() : Reg;
193}
194
195void VAListChecker::checkPreStmt(const VAArgExpr *VAA,
196 CheckerContext &C) const {
197 ProgramStateRef State = C.getState();
198 const Expr *ArgExpr = VAA->getSubExpr();
199 const MemRegion *VAList = getVAListAsRegion(C.getSVal(ArgExpr), ArgExpr, C);
200 if (!VAList)
201 return;
202 VAListState S = getVAListState(C.getState(), VAList);
203 if (S == VAListState::Initialized || S == VAListState::Unknown)
204 return;
205
206 std::string ErrMsg =
207 formatv("va_arg() is called on an {0} va_list", describeState(S));
208 reportUninitializedAccess(VAList, ErrMsg, C);
209}
210
211void VAListChecker::checkDeadSymbols(SymbolReaper &SR,
212 CheckerContext &C) const {
213 ProgramStateRef State = C.getState();
214 VAListStateMapTy Tracked = State->get<VAListStateMap>();
215 RegionVector Leaked;
216 for (const auto &[Reg, S] : Tracked) {
217 if (SR.isLiveRegion(Reg))
218 continue;
219 if (S == VAListState::Initialized)
220 Leaked.push_back(Reg);
221 State = State->remove<VAListStateMap>(Reg);
222 }
223 if (ExplodedNode *N = C.addTransition(State)) {
224 reportLeaked(Leaked, "Initialized va_list", " is leaked", C, N);
225 }
226}
227
228// This function traverses the exploded graph backwards and finds the node where
229// the va_list becomes initialized. That node is used for uniquing the bug
230// paths. It is not likely that there are several different va_lists that
231// belongs to different stack frames, so that case is not yet handled.
232const ExplodedNode *
233VAListChecker::getStartCallSite(const ExplodedNode *N,
234 const MemRegion *Reg) const {
235 const LocationContext *LeakContext = N->getLocationContext();
236 const ExplodedNode *StartCallNode = N;
237
238 bool SeenInitializedState = false;
239
240 while (N) {
241 VAListState S = getVAListState(N->getState(), Reg);
242 if (S == VAListState::Initialized) {
243 SeenInitializedState = true;
244 } else if (SeenInitializedState) {
245 break;
246 }
247 const LocationContext *NContext = N->getLocationContext();
248 if (NContext == LeakContext || NContext->isParentOf(LeakContext))
249 StartCallNode = N;
250 N = N->pred_empty() ? nullptr : *(N->pred_begin());
251 }
252
253 return StartCallNode;
254}
255
256void VAListChecker::reportUninitializedAccess(const MemRegion *VAList,
257 StringRef Msg,
258 CheckerContext &C) const {
259 if (ExplodedNode *N = C.generateErrorNode()) {
260 auto R = std::make_unique<PathSensitiveBugReport>(UninitAccessBug, Msg, N);
261 R->markInteresting(VAList);
262 R->addVisitor(std::make_unique<VAListBugVisitor>(VAList));
263 C.emitReport(std::move(R));
264 }
265}
266
267void VAListChecker::reportLeaked(const RegionVector &Leaked, StringRef Msg1,
268 StringRef Msg2, CheckerContext &C,
269 ExplodedNode *N) const {
270 for (const MemRegion *Reg : Leaked) {
271 const ExplodedNode *StartNode = getStartCallSite(N, Reg);
272 PathDiagnosticLocation LocUsedForUniqueing;
273
274 if (const Stmt *StartCallStmt = StartNode->getStmtForDiagnostics())
275 LocUsedForUniqueing = PathDiagnosticLocation::createBegin(
276 StartCallStmt, C.getSourceManager(), StartNode->getLocationContext());
277
278 SmallString<100> Buf;
279 llvm::raw_svector_ostream OS(Buf);
280 OS << Msg1;
281 std::string VariableName = Reg->getDescriptiveName();
282 if (!VariableName.empty())
283 OS << " " << VariableName;
284 OS << Msg2;
285
286 auto R = std::make_unique<PathSensitiveBugReport>(
287 LeakBug, OS.str(), N, LocUsedForUniqueing,
288 StartNode->getLocationContext()->getDecl());
289 R->markInteresting(Reg);
290 R->addVisitor(std::make_unique<VAListBugVisitor>(Reg, true));
291 C.emitReport(std::move(R));
292 }
293}
294
295void VAListChecker::checkVAListStartCall(const CallEvent &Call,
296 CheckerContext &C) const {
297 const MemRegion *Arg =
298 getVAListAsRegion(Call.getArgSVal(0), Call.getArgExpr(0), C);
299 if (!Arg)
300 return;
301
302 ProgramStateRef State = C.getState();
303 VAListState ArgState = getVAListState(State, Arg);
304
305 if (ArgState == VAListState::Initialized) {
306 RegionVector Leaked{Arg};
307 if (ExplodedNode *N = C.addTransition(State))
308 reportLeaked(Leaked, "Initialized va_list", " is initialized again", C,
309 N);
310 return;
311 }
312
313 State = State->set<VAListStateMap>(Arg, VAListState::Initialized);
314 C.addTransition(State);
315}
316
317void VAListChecker::checkVAListCopyCall(const CallEvent &Call,
318 CheckerContext &C) const {
319 const MemRegion *Arg1 =
320 getVAListAsRegion(Call.getArgSVal(0), Call.getArgExpr(0), C);
321 const MemRegion *Arg2 =
322 getVAListAsRegion(Call.getArgSVal(1), Call.getArgExpr(1), C);
323 if (!Arg1 || !Arg2)
324 return;
325
326 ProgramStateRef State = C.getState();
327 if (Arg1 == Arg2) {
328 RegionVector Leaked{Arg1};
329 if (ExplodedNode *N = C.addTransition(State))
330 reportLeaked(Leaked, "va_list", " is copied onto itself", C, N);
331 return;
332 }
333 VAListState State1 = getVAListState(State, Arg1);
334 VAListState State2 = getVAListState(State, Arg2);
335 // Update the ProgramState by copying the state of Arg2 to Arg1.
336 State = State->set<VAListStateMap>(Arg1, State2);
337 if (State1 == VAListState::Initialized) {
338 RegionVector Leaked{Arg1};
339 std::string Msg2 =
340 formatv(" is overwritten by {0} {1} one",
341 (State2 == VAListState::Initialized) ? "another" : "an",
342 describeState(State2));
343 if (ExplodedNode *N = C.addTransition(State))
344 reportLeaked(Leaked, "Initialized va_list", Msg2, C, N);
345 return;
346 }
347 if (State2 != VAListState::Initialized && State2 != VAListState::Unknown) {
348 std::string Msg = formatv("{0} va_list is copied", describeState(State2));
349 Msg[0] = toupper(Msg[0]);
350 reportUninitializedAccess(Arg2, Msg, C);
351 return;
352 }
353 C.addTransition(State);
354}
355
356void VAListChecker::checkVAListEndCall(const CallEvent &Call,
357 CheckerContext &C) const {
358 const MemRegion *Arg =
359 getVAListAsRegion(Call.getArgSVal(0), Call.getArgExpr(0), C);
360 if (!Arg)
361 return;
362
363 ProgramStateRef State = C.getState();
364 VAListState ArgState = getVAListState(State, Arg);
365
366 if (ArgState != VAListState::Unknown &&
367 ArgState != VAListState::Initialized) {
368 std::string Msg = formatv("va_end() is called on an {0} va_list",
369 describeState(ArgState));
370 reportUninitializedAccess(Arg, Msg, C);
371 return;
372 }
373 State = State->set<VAListStateMap>(Arg, VAListState::Released);
374 C.addTransition(State);
375}
376
377PathDiagnosticPieceRef VAListChecker::VAListBugVisitor::VisitNode(
378 const ExplodedNode *N, BugReporterContext &BRC, PathSensitiveBugReport &) {
379 ProgramStateRef State = N->getState();
380 ProgramStateRef StatePrev = N->getFirstPred()->getState();
381
382 const Stmt *S = N->getStmtForDiagnostics();
383 if (!S)
384 return nullptr;
385
386 VAListState After = getVAListState(State, Reg);
387 VAListState Before = getVAListState(StatePrev, Reg);
388 if (Before == After)
389 return nullptr;
390
391 StringRef Msg;
392 switch (After) {
393 case VAListState::Uninitialized:
394 Msg = "Copied uninitialized contents into the va_list";
395 break;
396 case VAListState::Unknown:
397 Msg = "Copied unknown contents into the va_list";
398 break;
399 case VAListState::Initialized:
400 Msg = "Initialized va_list";
401 break;
402 case VAListState::Released:
403 Msg = "Ended va_list";
404 break;
405 }
406
407 if (Msg.empty())
408 return nullptr;
409
410 PathDiagnosticLocation Pos(S, BRC.getSourceManager(),
411 N->getLocationContext());
412 return std::make_shared<PathDiagnosticEventPiece>(Pos, Msg, true);
413}
414
415void ento::registerVAListChecker(CheckerManager &Mgr) {
416 Mgr.registerChecker<VAListChecker>();
417}
418
419bool ento::shouldRegisterVAListChecker(const CheckerManager &) { return true; }
#define X(type, name)
Definition Value.h:97
#define REGISTER_MAP_WITH_PROGRAMSTATE(Name, Key, Value)
Declares an immutable map of type NameTy, suitable for placement into the ProgramState.
static VAListState getVAListState(ProgramStateRef State, const MemRegion *Reg)
static StringRef describeState(const VAListState S)
bool isParentOf(const LocationContext *LC) const
const Decl * getDecl() const
bool isPointerType() const
Definition TypeBase.h:8522
QualType getPointeeType() const
If this is a pointer, ObjC object pointer, or block pointer, this returns the respective pointee.
Definition Type.cpp:752
bool isRecordType() const
Definition TypeBase.h:8649
const Expr * getSubExpr() const
Definition Expr.h:4907
StringRef getDescription() const
A verbose warning message that is appropriate for displaying next to the source code that introduces ...
const SourceManager & getSourceManager() const
A CallDescription is a pattern that can be used to match calls based on the qualified name and the ar...
bool matches(const CallEvent &Call) const
Returns true if the CallEvent is a call to a function that matches the CallDescription.
Represents an abstract call to a function or method along a particular path.
Definition CallEvent.h:153
CHECKER * registerChecker(AT &&...Args)
Register a single-part checker (derived from Checker): construct its singleton instance,...
Simple checker classes that implement one frontend (i.e.
Definition Checker.h:553
const ProgramStateRef & getState() const
const Stmt * getStmtForDiagnostics() const
If the node's program point corresponds to a statement, retrieve that statement.
const LocationContext * getLocationContext() const
ExplodedNode * getFirstPred()
MemRegion - The root abstract class for all memory regions.
Definition MemRegion.h:98
std::string getDescriptiveName(bool UseQuotes=true) const
Get descriptive name for memory region.
const RegionTy * getAs() const
Definition MemRegion.h:1416
static PathDiagnosticLocation createBegin(const Decl *D, const SourceManager &SM)
Create a location for the beginning of the declaration.
PathDiagnosticLocation getLocation() const override
The primary location of the bug report that points at the undesirable behavior in the code.
const MemRegion * getAsRegion() const
Definition SVals.cpp:119
T castAs() const
Convert to the specified SVal type, asserting that this SVal is of the desired type.
Definition SVals.h:83
bool isLiveRegion(const MemRegion *region)
IntrusiveRefCntPtr< const ProgramState > ProgramStateRef
@ OS
Indicates that the tracking object is a descendant of a referenced-counted OSObject,...
std::shared_ptr< PathDiagnosticPiece > PathDiagnosticPieceRef
@ After
Like System, but searched after the system directories.
bool Cast(InterpState &S, CodePtr OpPC)
Definition Interp.h:2502
The JSON file list parser is used to communicate input to InstallAPI.
bool isa(CodeGen::Address addr)
Definition Address.h:330
nullptr
This class represents a compute construct, representing a 'Kind' of ‘parallel’, 'serial',...