clang  15.0.0git
ValistChecker.cpp
Go to the documentation of this file.
1 //== ValistChecker.cpp - stdarg.h macro usage checker -----------*- C++ -*--==//
2 //
3 // Part of the LLVM Project, under the Apache License v2.0 with LLVM Exceptions.
4 // See https://llvm.org/LICENSE.txt for license information.
5 // SPDX-License-Identifier: Apache-2.0 WITH LLVM-exception
6 //
7 //===----------------------------------------------------------------------===//
8 //
9 // This defines checkers which detect usage of uninitialized va_list values
10 // and va_start calls with no matching va_end.
11 //
12 //===----------------------------------------------------------------------===//
13 
21 
22 using namespace clang;
23 using namespace ento;
24 
25 REGISTER_SET_WITH_PROGRAMSTATE(InitializedVALists, const MemRegion *)
26 
27 namespace {
28 typedef SmallVector<const MemRegion *, 2> RegionVector;
29 
30 class ValistChecker : public Checker<check::PreCall, check::PreStmt<VAArgExpr>,
31  check::DeadSymbols> {
32  mutable std::unique_ptr<BugType> BT_leakedvalist, BT_uninitaccess;
33 
34  struct VAListAccepter {
35  CallDescription Func;
36  int VAListPos;
37  };
38  static const SmallVector<VAListAccepter, 15> VAListAccepters;
39  static const CallDescription VaStart, VaEnd, VaCopy;
40 
41 public:
42  enum CheckKind {
43  CK_Uninitialized,
44  CK_Unterminated,
45  CK_CopyToSelf,
46  CK_NumCheckKinds
47  };
48 
49  bool ChecksEnabled[CK_NumCheckKinds] = {false};
50  CheckerNameRef CheckNames[CK_NumCheckKinds];
51 
52  void checkPreStmt(const VAArgExpr *VAA, CheckerContext &C) const;
53  void checkPreCall(const CallEvent &Call, CheckerContext &C) const;
54  void checkDeadSymbols(SymbolReaper &SR, CheckerContext &C) const;
55 
56 private:
57  const MemRegion *getVAListAsRegion(SVal SV, const Expr *VAExpr,
58  bool &IsSymbolic, CheckerContext &C) const;
59  const ExplodedNode *getStartCallSite(const ExplodedNode *N,
60  const MemRegion *Reg) const;
61 
62  void reportUninitializedAccess(const MemRegion *VAList, StringRef Msg,
63  CheckerContext &C) const;
64  void reportLeakedVALists(const RegionVector &LeakedVALists, StringRef Msg1,
65  StringRef Msg2, CheckerContext &C, ExplodedNode *N,
66  bool ReportUninit = false) const;
67 
68  void checkVAListStartCall(const CallEvent &Call, CheckerContext &C,
69  bool IsCopy) const;
70  void checkVAListEndCall(const CallEvent &Call, CheckerContext &C) const;
71 
72  class ValistBugVisitor : public BugReporterVisitor {
73  public:
74  ValistBugVisitor(const MemRegion *Reg, bool IsLeak = false)
75  : Reg(Reg), IsLeak(IsLeak) {}
76  void Profile(llvm::FoldingSetNodeID &ID) const override {
77  static int X = 0;
78  ID.AddPointer(&X);
79  ID.AddPointer(Reg);
80  }
81  PathDiagnosticPieceRef getEndPath(BugReporterContext &BRC,
82  const ExplodedNode *EndPathNode,
83  PathSensitiveBugReport &BR) override {
84  if (!IsLeak)
85  return nullptr;
86 
87  PathDiagnosticLocation L = BR.getLocation();
88  // Do not add the statement itself as a range in case of leak.
89  return std::make_shared<PathDiagnosticEventPiece>(L, BR.getDescription(),
90  false);
91  }
92  PathDiagnosticPieceRef VisitNode(const ExplodedNode *N,
93  BugReporterContext &BRC,
94  PathSensitiveBugReport &BR) override;
95 
96  private:
97  const MemRegion *Reg;
98  bool IsLeak;
99  };
100 };
101 
103  ValistChecker::VAListAccepters = {
104  {{"vfprintf", 3}, 2},
105  {{"vfscanf", 3}, 2},
106  {{"vprintf", 2}, 1},
107  {{"vscanf", 2}, 1},
108  {{"vsnprintf", 4}, 3},
109  {{"vsprintf", 3}, 2},
110  {{"vsscanf", 3}, 2},
111  {{"vfwprintf", 3}, 2},
112  {{"vfwscanf", 3}, 2},
113  {{"vwprintf", 2}, 1},
114  {{"vwscanf", 2}, 1},
115  {{"vswprintf", 4}, 3},
116  // vswprintf is the wide version of vsnprintf,
117  // vsprintf has no wide version
118  {{"vswscanf", 3}, 2}};
119 
120 const CallDescription
121  ValistChecker::VaStart("__builtin_va_start", /*Args=*/2, /*Params=*/1),
122  ValistChecker::VaCopy("__builtin_va_copy", 2),
123  ValistChecker::VaEnd("__builtin_va_end", 1);
124 } // end anonymous namespace
125 
126 void ValistChecker::checkPreCall(const CallEvent &Call,
127  CheckerContext &C) const {
128  if (!Call.isGlobalCFunction())
129  return;
130  if (VaStart.matches(Call))
131  checkVAListStartCall(Call, C, false);
132  else if (VaCopy.matches(Call))
133  checkVAListStartCall(Call, C, true);
134  else if (VaEnd.matches(Call))
135  checkVAListEndCall(Call, C);
136  else {
137  for (auto FuncInfo : VAListAccepters) {
138  if (!FuncInfo.Func.matches(Call))
139  continue;
140  bool Symbolic;
141  const MemRegion *VAList =
142  getVAListAsRegion(Call.getArgSVal(FuncInfo.VAListPos),
143  Call.getArgExpr(FuncInfo.VAListPos), Symbolic, C);
144  if (!VAList)
145  return;
146 
147  if (C.getState()->contains<InitializedVALists>(VAList))
148  return;
149 
150  // We did not see va_start call, but the source of the region is unknown.
151  // Be conservative and assume the best.
152  if (Symbolic)
153  return;
154 
155  SmallString<80> Errmsg("Function '");
156  Errmsg += FuncInfo.Func.getFunctionName();
157  Errmsg += "' is called with an uninitialized va_list argument";
158  reportUninitializedAccess(VAList, Errmsg.c_str(), C);
159  break;
160  }
161  }
162 }
163 
164 const MemRegion *ValistChecker::getVAListAsRegion(SVal SV, const Expr *E,
165  bool &IsSymbolic,
166  CheckerContext &C) const {
167  const MemRegion *Reg = SV.getAsRegion();
168  if (!Reg)
169  return nullptr;
170  // TODO: In the future this should be abstracted away by the analyzer.
171  bool VaListModelledAsArray = false;
172  if (const auto *Cast = dyn_cast<CastExpr>(E)) {
173  QualType Ty = Cast->getType();
174  VaListModelledAsArray =
175  Ty->isPointerType() && Ty->getPointeeType()->isRecordType();
176  }
177  if (const auto *DeclReg = Reg->getAs<DeclRegion>()) {
178  if (isa<ParmVarDecl>(DeclReg->getDecl()))
179  Reg = C.getState()->getSVal(SV.castAs<Loc>()).getAsRegion();
180  }
181  IsSymbolic = Reg && Reg->getBaseRegion()->getAs<SymbolicRegion>();
182  // Some VarRegion based VA lists reach here as ElementRegions.
183  const auto *EReg = dyn_cast_or_null<ElementRegion>(Reg);
184  return (EReg && VaListModelledAsArray) ? EReg->getSuperRegion() : Reg;
185 }
186 
187 void ValistChecker::checkPreStmt(const VAArgExpr *VAA,
188  CheckerContext &C) const {
189  ProgramStateRef State = C.getState();
190  const Expr *VASubExpr = VAA->getSubExpr();
191  SVal VAListSVal = C.getSVal(VASubExpr);
192  bool Symbolic;
193  const MemRegion *VAList =
194  getVAListAsRegion(VAListSVal, VASubExpr, Symbolic, C);
195  if (!VAList)
196  return;
197  if (Symbolic)
198  return;
199  if (!State->contains<InitializedVALists>(VAList))
200  reportUninitializedAccess(
201  VAList, "va_arg() is called on an uninitialized va_list", C);
202 }
203 
204 void ValistChecker::checkDeadSymbols(SymbolReaper &SR,
205  CheckerContext &C) const {
206  ProgramStateRef State = C.getState();
207  InitializedVAListsTy TrackedVALists = State->get<InitializedVALists>();
208  RegionVector LeakedVALists;
209  for (auto Reg : TrackedVALists) {
210  if (SR.isLiveRegion(Reg))
211  continue;
212  LeakedVALists.push_back(Reg);
213  State = State->remove<InitializedVALists>(Reg);
214  }
215  if (ExplodedNode *N = C.addTransition(State))
216  reportLeakedVALists(LeakedVALists, "Initialized va_list", " is leaked", C,
217  N);
218 }
219 
220 // This function traverses the exploded graph backwards and finds the node where
221 // the va_list is initialized. That node is used for uniquing the bug paths.
222 // It is not likely that there are several different va_lists that belongs to
223 // different stack frames, so that case is not yet handled.
224 const ExplodedNode *
225 ValistChecker::getStartCallSite(const ExplodedNode *N,
226  const MemRegion *Reg) const {
227  const LocationContext *LeakContext = N->getLocationContext();
228  const ExplodedNode *StartCallNode = N;
229 
230  bool FoundInitializedState = false;
231 
232  while (N) {
233  ProgramStateRef State = N->getState();
234  if (!State->contains<InitializedVALists>(Reg)) {
235  if (FoundInitializedState)
236  break;
237  } else {
238  FoundInitializedState = true;
239  }
240  const LocationContext *NContext = N->getLocationContext();
241  if (NContext == LeakContext || NContext->isParentOf(LeakContext))
242  StartCallNode = N;
243  N = N->pred_empty() ? nullptr : *(N->pred_begin());
244  }
245 
246  return StartCallNode;
247 }
248 
249 void ValistChecker::reportUninitializedAccess(const MemRegion *VAList,
250  StringRef Msg,
251  CheckerContext &C) const {
252  if (!ChecksEnabled[CK_Uninitialized])
253  return;
254  if (ExplodedNode *N = C.generateErrorNode()) {
255  if (!BT_uninitaccess)
256  BT_uninitaccess.reset(new BugType(CheckNames[CK_Uninitialized],
257  "Uninitialized va_list",
259  auto R = std::make_unique<PathSensitiveBugReport>(*BT_uninitaccess, Msg, N);
260  R->markInteresting(VAList);
261  R->addVisitor(std::make_unique<ValistBugVisitor>(VAList));
262  C.emitReport(std::move(R));
263  }
264 }
265 
266 void ValistChecker::reportLeakedVALists(const RegionVector &LeakedVALists,
267  StringRef Msg1, StringRef Msg2,
268  CheckerContext &C, ExplodedNode *N,
269  bool ReportUninit) const {
270  if (!(ChecksEnabled[CK_Unterminated] ||
271  (ChecksEnabled[CK_Uninitialized] && ReportUninit)))
272  return;
273  for (auto Reg : LeakedVALists) {
274  if (!BT_leakedvalist) {
275  // FIXME: maybe creating a new check name for this type of bug is a better
276  // solution.
277  BT_leakedvalist.reset(
278  new BugType(CheckNames[CK_Unterminated].getName().empty()
279  ? CheckNames[CK_Uninitialized]
280  : CheckNames[CK_Unterminated],
281  "Leaked va_list", categories::MemoryError,
282  /*SuppressOnSink=*/true));
283  }
284 
285  const ExplodedNode *StartNode = getStartCallSite(N, Reg);
286  PathDiagnosticLocation LocUsedForUniqueing;
287 
288  if (const Stmt *StartCallStmt = StartNode->getStmtForDiagnostics())
289  LocUsedForUniqueing = PathDiagnosticLocation::createBegin(
290  StartCallStmt, C.getSourceManager(), StartNode->getLocationContext());
291 
292  SmallString<100> Buf;
293  llvm::raw_svector_ostream OS(Buf);
294  OS << Msg1;
295  std::string VariableName = Reg->getDescriptiveName();
296  if (!VariableName.empty())
297  OS << " " << VariableName;
298  OS << Msg2;
299 
300  auto R = std::make_unique<PathSensitiveBugReport>(
301  *BT_leakedvalist, OS.str(), N, LocUsedForUniqueing,
302  StartNode->getLocationContext()->getDecl());
303  R->markInteresting(Reg);
304  R->addVisitor(std::make_unique<ValistBugVisitor>(Reg, true));
305  C.emitReport(std::move(R));
306  }
307 }
308 
309 void ValistChecker::checkVAListStartCall(const CallEvent &Call,
310  CheckerContext &C, bool IsCopy) const {
311  bool Symbolic;
312  const MemRegion *VAList =
313  getVAListAsRegion(Call.getArgSVal(0), Call.getArgExpr(0), Symbolic, C);
314  if (!VAList)
315  return;
316 
317  ProgramStateRef State = C.getState();
318 
319  if (IsCopy) {
320  const MemRegion *Arg2 =
321  getVAListAsRegion(Call.getArgSVal(1), Call.getArgExpr(1), Symbolic, C);
322  if (Arg2) {
323  if (ChecksEnabled[CK_CopyToSelf] && VAList == Arg2) {
324  RegionVector LeakedVALists{VAList};
325  if (ExplodedNode *N = C.addTransition(State))
326  reportLeakedVALists(LeakedVALists, "va_list",
327  " is copied onto itself", C, N, true);
328  return;
329  } else if (!State->contains<InitializedVALists>(Arg2) && !Symbolic) {
330  if (State->contains<InitializedVALists>(VAList)) {
331  State = State->remove<InitializedVALists>(VAList);
332  RegionVector LeakedVALists{VAList};
333  if (ExplodedNode *N = C.addTransition(State))
334  reportLeakedVALists(LeakedVALists, "Initialized va_list",
335  " is overwritten by an uninitialized one", C, N,
336  true);
337  } else {
338  reportUninitializedAccess(Arg2, "Uninitialized va_list is copied", C);
339  }
340  return;
341  }
342  }
343  }
344  if (State->contains<InitializedVALists>(VAList)) {
345  RegionVector LeakedVALists{VAList};
346  if (ExplodedNode *N = C.addTransition(State))
347  reportLeakedVALists(LeakedVALists, "Initialized va_list",
348  " is initialized again", C, N);
349  return;
350  }
351 
352  State = State->add<InitializedVALists>(VAList);
353  C.addTransition(State);
354 }
355 
356 void ValistChecker::checkVAListEndCall(const CallEvent &Call,
357  CheckerContext &C) const {
358  bool Symbolic;
359  const MemRegion *VAList =
360  getVAListAsRegion(Call.getArgSVal(0), Call.getArgExpr(0), Symbolic, C);
361  if (!VAList)
362  return;
363 
364  // We did not see va_start call, but the source of the region is unknown.
365  // Be conservative and assume the best.
366  if (Symbolic)
367  return;
368 
369  if (!C.getState()->contains<InitializedVALists>(VAList)) {
370  reportUninitializedAccess(
371  VAList, "va_end() is called on an uninitialized va_list", C);
372  return;
373  }
374  ProgramStateRef State = C.getState();
375  State = State->remove<InitializedVALists>(VAList);
376  C.addTransition(State);
377 }
378 
379 PathDiagnosticPieceRef ValistChecker::ValistBugVisitor::VisitNode(
380  const ExplodedNode *N, BugReporterContext &BRC, PathSensitiveBugReport &) {
381  ProgramStateRef State = N->getState();
382  ProgramStateRef StatePrev = N->getFirstPred()->getState();
383 
384  const Stmt *S = N->getStmtForDiagnostics();
385  if (!S)
386  return nullptr;
387 
388  StringRef Msg;
389  if (State->contains<InitializedVALists>(Reg) &&
390  !StatePrev->contains<InitializedVALists>(Reg))
391  Msg = "Initialized va_list";
392  else if (!State->contains<InitializedVALists>(Reg) &&
393  StatePrev->contains<InitializedVALists>(Reg))
394  Msg = "Ended va_list";
395 
396  if (Msg.empty())
397  return nullptr;
398 
399  PathDiagnosticLocation Pos(S, BRC.getSourceManager(),
400  N->getLocationContext());
401  return std::make_shared<PathDiagnosticEventPiece>(Pos, Msg, true);
402 }
403 
404 void ento::registerValistBase(CheckerManager &mgr) {
405  mgr.registerChecker<ValistChecker>();
406 }
407 
408 bool ento::shouldRegisterValistBase(const CheckerManager &mgr) {
409  return true;
410 }
411 
412 #define REGISTER_CHECKER(name) \
413  void ento::register##name##Checker(CheckerManager &mgr) { \
414  ValistChecker *checker = mgr.getChecker<ValistChecker>(); \
415  checker->ChecksEnabled[ValistChecker::CK_##name] = true; \
416  checker->CheckNames[ValistChecker::CK_##name] = \
417  mgr.getCurrentCheckerName(); \
418  } \
419  \
420  bool ento::shouldRegister##name##Checker(const CheckerManager &mgr) { \
421  return true; \
422  }
423 
425 REGISTER_CHECKER(Unterminated)
426 REGISTER_CHECKER(CopyToSelf)
clang::Type::isRecordType
bool isRecordType() const
Definition: Type.h:6897
clang::LocationContext
It wraps the AnalysisDeclContext to represent both the call stack with the help of StackFrameContext ...
Definition: AnalysisDeclContext.h:215
clang::VAArgExpr::getSubExpr
const Expr * getSubExpr() const
Definition: Expr.h:4649
CallDescription.h
string
string(SUBSTRING ${CMAKE_CURRENT_BINARY_DIR} 0 ${PATH_LIB_START} PATH_HEAD) string(SUBSTRING $
Definition: CMakeLists.txt:22
clang::ento::PathDiagnosticPieceRef
std::shared_ptr< PathDiagnosticPiece > PathDiagnosticPieceRef
Definition: PathDiagnostic.h:492
llvm::SmallVector
Definition: LLVM.h:38
clang::ento::ProgramStateRef
IntrusiveRefCntPtr< const ProgramState > ProgramStateRef
Definition: ProgramState_Fwd.h:37
clang::QualType
A (possibly-)qualified type.
Definition: Type.h:731
AttributeLangSupport::C
@ C
Definition: SemaDeclAttr.cpp:55
clang::tooling::X
static ToolExecutorPluginRegistry::Add< AllTUsToolExecutorPlugin > X("all-TUs", "Runs FrontendActions on all TUs in the compilation database. " "Tool results are stored in memory.")
clang::index::SymbolRole::Call
@ Call
REGISTER_CHECKER
#define REGISTER_CHECKER(name)
Definition: ValistChecker.cpp:412
CallEvent.h
BuiltinCheckerRegistration.h
CheckerManager.h
clang::LocationContext::isParentOf
bool isParentOf(const LocationContext *LC) const
Definition: AnalysisDeclContext.cpp:477
llvm::SmallString
Definition: LLVM.h:37
clang::interp::Cast
bool Cast(InterpState &S, CodePtr OpPC)
Definition: Interp.h:802
REGISTER_SET_WITH_PROGRAMSTATE
#define REGISTER_SET_WITH_PROGRAMSTATE(Name, Elem)
Declares an immutable set of type NameTy, suitable for placement into the ProgramState.
Definition: ProgramStateTrait.h:112
clang::Type::getPointeeType
QualType getPointeeType() const
If this is a pointer, ObjC object pointer, or block pointer, this returns the respective pointee.
Definition: Type.cpp:625
getName
static std::string getName(const CallEvent &Call)
Definition: ReturnValueChecker.cpp:61
clang::ento::categories::MemoryError
const char *const MemoryError
Definition: CommonBugCategories.cpp:20
clang::Type::isPointerType
bool isPointerType() const
Definition: Type.h:6807
BugType.h
State
LineState State
Definition: UnwrappedLineFormatter.cpp:1126
CheckerContext.h
Checker.h
clang::Builtin::ID
ID
Definition: Builtins.h:52
clang
Definition: CalledOnceCheck.h:17
clang::Stmt
Stmt - This represents one statement.
Definition: Stmt.h:70
clang::ento::PathDiagnosticLocation::createBegin
static PathDiagnosticLocation createBegin(const Decl *D, const SourceManager &SM)
Create a location for the beginning of the declaration.
Definition: PathDiagnostic.cpp:580
Uninitialized
@ Uninitialized
Definition: UninitializedValues.cpp:104
clang::VAArgExpr
Represents a call to the builtin function __builtin_va_arg.
Definition: Expr.h:4633
clang::Expr
This represents one expression.
Definition: Expr.h:109
clang::ento::ObjKind::OS
@ OS
Indicates that the tracking object is a descendant of a referenced-counted OSObject,...