30class ValistChecker :
public Checker<check::PreCall, check::PreStmt<VAArgExpr>,
32 mutable std::unique_ptr<BugType> BT_leakedvalist, BT_uninitaccess;
34 struct VAListAccepter {
49 bool ChecksEnabled[CK_NumCheckKinds] = {
false};
62 void reportUninitializedAccess(
const MemRegion *VAList, StringRef Msg,
64 void reportLeakedVALists(
const RegionVector &LeakedVALists, StringRef Msg1,
66 bool ReportUninit =
false)
const;
74 ValistBugVisitor(
const MemRegion *Reg,
bool IsLeak =
false)
75 : Reg(Reg), IsLeak(IsLeak) {}
76 void Profile(llvm::FoldingSetNodeID &ID)
const override {
89 return std::make_shared<PathDiagnosticEventPiece>(L, BR.
getDescription(),
103 ValistChecker::VAListAccepters = {{{{
"vfprintf"}, 3}, 2},
104 {{{
"vfscanf"}, 3}, 2},
105 {{{
"vprintf"}, 2}, 1},
106 {{{
"vscanf"}, 2}, 1},
107 {{{
"vsnprintf"}, 4}, 3},
108 {{{
"vsprintf"}, 3}, 2},
109 {{{
"vsscanf"}, 3}, 2},
110 {{{
"vfwprintf"}, 3}, 2},
111 {{{
"vfwscanf"}, 3}, 2},
112 {{{
"vwprintf"}, 2}, 1},
113 {{{
"vwscanf"}, 2}, 1},
114 {{{
"vswprintf"}, 4}, 3},
117 {{{
"vswscanf"}, 3}, 2}};
121 ValistChecker::VaCopy({
"__builtin_va_copy"}, 2),
122 ValistChecker::VaEnd({
"__builtin_va_end"}, 1);
127 if (!
Call.isGlobalCFunction())
130 checkVAListStartCall(
Call,
C,
false);
132 checkVAListStartCall(
Call,
C,
true);
134 checkVAListEndCall(
Call,
C);
136 for (
auto FuncInfo : VAListAccepters) {
137 if (!FuncInfo.Func.matches(
Call))
141 getVAListAsRegion(
Call.getArgSVal(FuncInfo.VAListPos),
142 Call.getArgExpr(FuncInfo.VAListPos), Symbolic,
C);
146 if (
C.getState()->contains<InitializedVALists>(VAList))
155 Errmsg += FuncInfo.Func.getFunctionName();
156 Errmsg +=
"' is called with an uninitialized va_list argument";
157 reportUninitializedAccess(VAList, Errmsg.c_str(),
C);
170 bool VaListModelledAsArray =
false;
171 if (
const auto *Cast = dyn_cast<CastExpr>(E)) {
173 VaListModelledAsArray =
177 if (isa<ParmVarDecl>(DeclReg->getDecl()))
178 Reg =
C.getState()->getSVal(SV.
castAs<
Loc>()).getAsRegion();
182 const auto *EReg = dyn_cast_or_null<ElementRegion>(Reg);
183 return (EReg && VaListModelledAsArray) ? EReg->
getSuperRegion() : Reg;
186void ValistChecker::checkPreStmt(
const VAArgExpr *VAA,
190 SVal VAListSVal =
C.getSVal(VASubExpr);
193 getVAListAsRegion(VAListSVal, VASubExpr, Symbolic,
C);
198 if (!State->contains<InitializedVALists>(VAList))
199 reportUninitializedAccess(
200 VAList,
"va_arg() is called on an uninitialized va_list",
C);
206 InitializedVAListsTy TrackedVALists = State->get<InitializedVALists>();
207 RegionVector LeakedVALists;
208 for (
auto Reg : TrackedVALists) {
211 LeakedVALists.push_back(Reg);
212 State = State->remove<InitializedVALists>(Reg);
215 reportLeakedVALists(LeakedVALists,
"Initialized va_list",
" is leaked",
C,
229 bool FoundInitializedState =
false;
233 if (!State->contains<InitializedVALists>(Reg)) {
234 if (FoundInitializedState)
237 FoundInitializedState =
true;
240 if (NContext == LeakContext || NContext->
isParentOf(LeakContext))
245 return StartCallNode;
248void ValistChecker::reportUninitializedAccess(
const MemRegion *VAList,
251 if (!ChecksEnabled[CK_Uninitialized])
254 if (!BT_uninitaccess)
255 BT_uninitaccess.reset(
new BugType(CheckNames[CK_Uninitialized],
256 "Uninitialized va_list",
258 auto R = std::make_unique<PathSensitiveBugReport>(*BT_uninitaccess, Msg, N);
259 R->markInteresting(VAList);
260 R->addVisitor(std::make_unique<ValistBugVisitor>(VAList));
261 C.emitReport(std::move(R));
265void ValistChecker::reportLeakedVALists(
const RegionVector &LeakedVALists,
266 StringRef Msg1, StringRef Msg2,
268 bool ReportUninit)
const {
269 if (!(ChecksEnabled[CK_Unterminated] ||
270 (ChecksEnabled[CK_Uninitialized] && ReportUninit)))
272 for (
auto Reg : LeakedVALists) {
273 if (!BT_leakedvalist) {
276 BT_leakedvalist.reset(
278 ? CheckNames[CK_Uninitialized]
279 : CheckNames[CK_Unterminated],
284 const ExplodedNode *StartNode = getStartCallSite(N, Reg);
292 llvm::raw_svector_ostream OS(Buf);
295 if (!VariableName.empty())
296 OS <<
" " << VariableName;
299 auto R = std::make_unique<PathSensitiveBugReport>(
300 *BT_leakedvalist, OS.str(), N, LocUsedForUniqueing,
302 R->markInteresting(Reg);
303 R->addVisitor(std::make_unique<ValistBugVisitor>(Reg,
true));
304 C.emitReport(std::move(R));
308void ValistChecker::checkVAListStartCall(
const CallEvent &
Call,
312 getVAListAsRegion(
Call.getArgSVal(0),
Call.getArgExpr(0), Symbolic,
C);
320 getVAListAsRegion(
Call.getArgSVal(1),
Call.getArgExpr(1), Symbolic,
C);
322 if (ChecksEnabled[CK_CopyToSelf] && VAList == Arg2) {
323 RegionVector LeakedVALists{VAList};
325 reportLeakedVALists(LeakedVALists,
"va_list",
326 " is copied onto itself",
C, N,
true);
328 }
else if (!State->contains<InitializedVALists>(Arg2) && !Symbolic) {
329 if (State->contains<InitializedVALists>(VAList)) {
330 State = State->remove<InitializedVALists>(VAList);
331 RegionVector LeakedVALists{VAList};
333 reportLeakedVALists(LeakedVALists,
"Initialized va_list",
334 " is overwritten by an uninitialized one",
C, N,
337 reportUninitializedAccess(Arg2,
"Uninitialized va_list is copied",
C);
343 if (State->contains<InitializedVALists>(VAList)) {
344 RegionVector LeakedVALists{VAList};
346 reportLeakedVALists(LeakedVALists,
"Initialized va_list",
347 " is initialized again",
C, N);
351 State = State->add<InitializedVALists>(VAList);
352 C.addTransition(State);
359 getVAListAsRegion(
Call.getArgSVal(0),
Call.getArgExpr(0), Symbolic,
C);
368 if (!
C.getState()->contains<InitializedVALists>(VAList)) {
369 reportUninitializedAccess(
370 VAList,
"va_end() is called on an uninitialized va_list",
C);
374 State = State->remove<InitializedVALists>(VAList);
375 C.addTransition(State);
388 if (State->contains<InitializedVALists>(Reg) &&
389 !StatePrev->contains<InitializedVALists>(Reg))
390 Msg =
"Initialized va_list";
391 else if (!State->contains<InitializedVALists>(Reg) &&
392 StatePrev->contains<InitializedVALists>(Reg))
393 Msg =
"Ended va_list";
400 return std::make_shared<PathDiagnosticEventPiece>(Pos, Msg,
true);
411#define REGISTER_CHECKER(name) \
412 void ento::register##name##Checker(CheckerManager &mgr) { \
413 ValistChecker *checker = mgr.getChecker<ValistChecker>(); \
414 checker->ChecksEnabled[ValistChecker::CK_##name] = true; \
415 checker->CheckNames[ValistChecker::CK_##name] = \
416 mgr.getCurrentCheckerName(); \
419 bool ento::shouldRegister##name##Checker(const CheckerManager &mgr) { \
#define REGISTER_SET_WITH_PROGRAMSTATE(Name, Elem)
Declares an immutable set of type NameTy, suitable for placement into the ProgramState.
static std::string getName(const CallEvent &Call)
#define REGISTER_CHECKER(name)
This represents one expression.
It wraps the AnalysisDeclContext to represent both the call stack with the help of StackFrameContext ...
bool isParentOf(const LocationContext *LC) const
const Decl * getDecl() const
A (possibly-)qualified type.
Stmt - This represents one statement.
bool isPointerType() const
QualType getPointeeType() const
If this is a pointer, ObjC object pointer, or block pointer, this returns the respective pointee.
bool isRecordType() const
Represents a call to the builtin function __builtin_va_arg.
const Expr * getSubExpr() const
StringRef getDescription() const
A verbose warning message that is appropriate for displaying next to the source code that introduces ...
const SourceManager & getSourceManager() const
BugReporterVisitors are used to add custom diagnostics along a path.
This class represents a description of a function call using the number of arguments and the name of ...
bool matches(const CallEvent &Call) const
Returns true if the CallEvent is a call to a function that matches the CallDescription.
Represents an abstract call to a function or method along a particular path.
CHECKER * registerChecker(AT &&... Args)
Used to register checkers.
This wrapper is used to ensure that only StringRefs originating from the CheckerRegistry are used as ...
const ProgramStateRef & getState() const
pred_iterator pred_begin()
const Stmt * getStmtForDiagnostics() const
If the node's program point corresponds to a statement, retrieve that statement.
const LocationContext * getLocationContext() const
ExplodedNode * getFirstPred()
MemRegion - The root abstract class for all memory regions.
std::string getDescriptiveName(bool UseQuotes=true) const
Get descriptive name for memory region.
LLVM_ATTRIBUTE_RETURNS_NONNULL const MemRegion * getBaseRegion() const
const RegionTy * getAs() const
static PathDiagnosticLocation createBegin(const Decl *D, const SourceManager &SM)
Create a location for the beginning of the declaration.
PathDiagnosticLocation getLocation() const override
The primary location of the bug report that points at the undesirable behavior in the code.
SVal - This represents a symbolic expression, which can be either an L-value or an R-value.
const MemRegion * getAsRegion() const
T castAs() const
Convert to the specified SVal type, asserting that this SVal is of the desired type.
LLVM_ATTRIBUTE_RETURNS_NONNULL const MemRegion * getSuperRegion() const
A class responsible for cleaning up unused symbols.
bool isLiveRegion(const MemRegion *region)
SymbolicRegion - A special, "non-concrete" region.
const char *const MemoryError
std::shared_ptr< PathDiagnosticPiece > PathDiagnosticPieceRef
bool Cast(InterpState &S, CodePtr OpPC)