StreamChecker.cpp 15 KB

123456789101112131415161718192021222324252627282930313233343536373839404142434445464748495051525354555657585960616263646566676869707172737475767778798081828384858687888990919293949596979899100101102103104105106107108109110111112113114115116117118119120121122123124125126127128129130131132133134135136137138139140141142143144145146147148149150151152153154155156157158159160161162163164165166167168169170171172173174175176177178179180181182183184185186187188189190191192193194195196197198199200201202203204205206207208209210211212213214215216217218219220221222223224225226227228229230231232233234235236237238239240241242243244245246247248249250251252253254255256257258259260261262263264265266267268269270271272273274275276277278279280281282283284285286287288289290291292293294295296297298299300301302303304305306307308309310311312313314315316317318319320321322323324325326327328329330331332333334335336337338339340341342343344345346347348349350351352353354355356357358359360361362363364365366367368369370371372373374375376377378379380381382383384385386387388389390391392393394395396397398399400401402403404405406407408409410411412413414415416417418419420421422423424425426427428429430431432433434435436437438439440441442443444445446447448449450451452453454455456457458459460461462
  1. //===-- StreamChecker.cpp -----------------------------------------*- C++ -*--//
  2. //
  3. // The LLVM Compiler Infrastructure
  4. //
  5. // This file is distributed under the University of Illinois Open Source
  6. // License. See LICENSE.TXT for details.
  7. //
  8. //===----------------------------------------------------------------------===//
  9. //
  10. // This file defines checkers that model and check stream handling functions.
  11. //
  12. //===----------------------------------------------------------------------===//
  13. #include "ClangSACheckers.h"
  14. #include "clang/StaticAnalyzer/Core/Checker.h"
  15. #include "clang/StaticAnalyzer/Core/CheckerManager.h"
  16. #include "clang/StaticAnalyzer/Core/PathSensitive/CheckerContext.h"
  17. #include "clang/StaticAnalyzer/Core/BugReporter/BugType.h"
  18. #include "clang/StaticAnalyzer/Core/PathSensitive/ProgramState.h"
  19. #include "clang/StaticAnalyzer/Core/PathSensitive/ProgramStateTrait.h"
  20. #include "clang/StaticAnalyzer/Core/PathSensitive/SymbolManager.h"
  21. #include "llvm/ADT/ImmutableMap.h"
  22. using namespace clang;
  23. using namespace ento;
  24. namespace {
  25. struct StreamState {
  26. enum Kind { Opened, Closed, OpenFailed, Escaped } K;
  27. const Stmt *S;
  28. StreamState(Kind k, const Stmt *s) : K(k), S(s) {}
  29. bool isOpened() const { return K == Opened; }
  30. bool isClosed() const { return K == Closed; }
  31. //bool isOpenFailed() const { return K == OpenFailed; }
  32. //bool isEscaped() const { return K == Escaped; }
  33. bool operator==(const StreamState &X) const {
  34. return K == X.K && S == X.S;
  35. }
  36. static StreamState getOpened(const Stmt *s) { return StreamState(Opened, s); }
  37. static StreamState getClosed(const Stmt *s) { return StreamState(Closed, s); }
  38. static StreamState getOpenFailed(const Stmt *s) {
  39. return StreamState(OpenFailed, s);
  40. }
  41. static StreamState getEscaped(const Stmt *s) {
  42. return StreamState(Escaped, s);
  43. }
  44. void Profile(llvm::FoldingSetNodeID &ID) const {
  45. ID.AddInteger(K);
  46. ID.AddPointer(S);
  47. }
  48. };
  49. class StreamChecker : public Checker<eval::Call,
  50. check::DeadSymbols,
  51. check::EndPath,
  52. check::PreStmt<ReturnStmt> > {
  53. mutable IdentifierInfo *II_fopen, *II_tmpfile, *II_fclose, *II_fread,
  54. *II_fwrite,
  55. *II_fseek, *II_ftell, *II_rewind, *II_fgetpos, *II_fsetpos,
  56. *II_clearerr, *II_feof, *II_ferror, *II_fileno;
  57. mutable llvm::OwningPtr<BuiltinBug> BT_nullfp, BT_illegalwhence,
  58. BT_doubleclose, BT_ResourceLeak;
  59. public:
  60. StreamChecker()
  61. : II_fopen(0), II_tmpfile(0) ,II_fclose(0), II_fread(0), II_fwrite(0),
  62. II_fseek(0), II_ftell(0), II_rewind(0), II_fgetpos(0), II_fsetpos(0),
  63. II_clearerr(0), II_feof(0), II_ferror(0), II_fileno(0) {}
  64. bool evalCall(const CallExpr *CE, CheckerContext &C) const;
  65. void checkDeadSymbols(SymbolReaper &SymReaper, CheckerContext &C) const;
  66. void checkEndPath(CheckerContext &Ctx) const;
  67. void checkPreStmt(const ReturnStmt *S, CheckerContext &C) const;
  68. private:
  69. void Fopen(CheckerContext &C, const CallExpr *CE) const;
  70. void Tmpfile(CheckerContext &C, const CallExpr *CE) const;
  71. void Fclose(CheckerContext &C, const CallExpr *CE) const;
  72. void Fread(CheckerContext &C, const CallExpr *CE) const;
  73. void Fwrite(CheckerContext &C, const CallExpr *CE) const;
  74. void Fseek(CheckerContext &C, const CallExpr *CE) const;
  75. void Ftell(CheckerContext &C, const CallExpr *CE) const;
  76. void Rewind(CheckerContext &C, const CallExpr *CE) const;
  77. void Fgetpos(CheckerContext &C, const CallExpr *CE) const;
  78. void Fsetpos(CheckerContext &C, const CallExpr *CE) const;
  79. void Clearerr(CheckerContext &C, const CallExpr *CE) const;
  80. void Feof(CheckerContext &C, const CallExpr *CE) const;
  81. void Ferror(CheckerContext &C, const CallExpr *CE) const;
  82. void Fileno(CheckerContext &C, const CallExpr *CE) const;
  83. void OpenFileAux(CheckerContext &C, const CallExpr *CE) const;
  84. const ProgramState *CheckNullStream(SVal SV, const ProgramState *state,
  85. CheckerContext &C) const;
  86. const ProgramState *CheckDoubleClose(const CallExpr *CE, const ProgramState *state,
  87. CheckerContext &C) const;
  88. };
  89. } // end anonymous namespace
  90. namespace clang {
  91. namespace ento {
  92. template <>
  93. struct ProgramStateTrait<StreamState>
  94. : public ProgramStatePartialTrait<llvm::ImmutableMap<SymbolRef, StreamState> > {
  95. static void *GDMIndex() { static int x; return &x; }
  96. };
  97. }
  98. }
  99. bool StreamChecker::evalCall(const CallExpr *CE, CheckerContext &C) const {
  100. const FunctionDecl *FD = C.getCalleeDecl(CE);
  101. if (!FD)
  102. return false;
  103. ASTContext &Ctx = C.getASTContext();
  104. if (!II_fopen)
  105. II_fopen = &Ctx.Idents.get("fopen");
  106. if (!II_tmpfile)
  107. II_tmpfile = &Ctx.Idents.get("tmpfile");
  108. if (!II_fclose)
  109. II_fclose = &Ctx.Idents.get("fclose");
  110. if (!II_fread)
  111. II_fread = &Ctx.Idents.get("fread");
  112. if (!II_fwrite)
  113. II_fwrite = &Ctx.Idents.get("fwrite");
  114. if (!II_fseek)
  115. II_fseek = &Ctx.Idents.get("fseek");
  116. if (!II_ftell)
  117. II_ftell = &Ctx.Idents.get("ftell");
  118. if (!II_rewind)
  119. II_rewind = &Ctx.Idents.get("rewind");
  120. if (!II_fgetpos)
  121. II_fgetpos = &Ctx.Idents.get("fgetpos");
  122. if (!II_fsetpos)
  123. II_fsetpos = &Ctx.Idents.get("fsetpos");
  124. if (!II_clearerr)
  125. II_clearerr = &Ctx.Idents.get("clearerr");
  126. if (!II_feof)
  127. II_feof = &Ctx.Idents.get("feof");
  128. if (!II_ferror)
  129. II_ferror = &Ctx.Idents.get("ferror");
  130. if (!II_fileno)
  131. II_fileno = &Ctx.Idents.get("fileno");
  132. if (FD->getIdentifier() == II_fopen) {
  133. Fopen(C, CE);
  134. return true;
  135. }
  136. if (FD->getIdentifier() == II_tmpfile) {
  137. Tmpfile(C, CE);
  138. return true;
  139. }
  140. if (FD->getIdentifier() == II_fclose) {
  141. Fclose(C, CE);
  142. return true;
  143. }
  144. if (FD->getIdentifier() == II_fread) {
  145. Fread(C, CE);
  146. return true;
  147. }
  148. if (FD->getIdentifier() == II_fwrite) {
  149. Fwrite(C, CE);
  150. return true;
  151. }
  152. if (FD->getIdentifier() == II_fseek) {
  153. Fseek(C, CE);
  154. return true;
  155. }
  156. if (FD->getIdentifier() == II_ftell) {
  157. Ftell(C, CE);
  158. return true;
  159. }
  160. if (FD->getIdentifier() == II_rewind) {
  161. Rewind(C, CE);
  162. return true;
  163. }
  164. if (FD->getIdentifier() == II_fgetpos) {
  165. Fgetpos(C, CE);
  166. return true;
  167. }
  168. if (FD->getIdentifier() == II_fsetpos) {
  169. Fsetpos(C, CE);
  170. return true;
  171. }
  172. if (FD->getIdentifier() == II_clearerr) {
  173. Clearerr(C, CE);
  174. return true;
  175. }
  176. if (FD->getIdentifier() == II_feof) {
  177. Feof(C, CE);
  178. return true;
  179. }
  180. if (FD->getIdentifier() == II_ferror) {
  181. Ferror(C, CE);
  182. return true;
  183. }
  184. if (FD->getIdentifier() == II_fileno) {
  185. Fileno(C, CE);
  186. return true;
  187. }
  188. return false;
  189. }
  190. void StreamChecker::Fopen(CheckerContext &C, const CallExpr *CE) const {
  191. OpenFileAux(C, CE);
  192. }
  193. void StreamChecker::Tmpfile(CheckerContext &C, const CallExpr *CE) const {
  194. OpenFileAux(C, CE);
  195. }
  196. void StreamChecker::OpenFileAux(CheckerContext &C, const CallExpr *CE) const {
  197. const ProgramState *state = C.getState();
  198. unsigned Count = C.getCurrentBlockCount();
  199. SValBuilder &svalBuilder = C.getSValBuilder();
  200. DefinedSVal RetVal =
  201. cast<DefinedSVal>(svalBuilder.getConjuredSymbolVal(0, CE, Count));
  202. state = state->BindExpr(CE, RetVal);
  203. ConstraintManager &CM = C.getConstraintManager();
  204. // Bifurcate the state into two: one with a valid FILE* pointer, the other
  205. // with a NULL.
  206. const ProgramState *stateNotNull, *stateNull;
  207. llvm::tie(stateNotNull, stateNull) = CM.assumeDual(state, RetVal);
  208. if (SymbolRef Sym = RetVal.getAsSymbol()) {
  209. // if RetVal is not NULL, set the symbol's state to Opened.
  210. stateNotNull =
  211. stateNotNull->set<StreamState>(Sym,StreamState::getOpened(CE));
  212. stateNull =
  213. stateNull->set<StreamState>(Sym, StreamState::getOpenFailed(CE));
  214. C.addTransition(stateNotNull);
  215. C.addTransition(stateNull);
  216. }
  217. }
  218. void StreamChecker::Fclose(CheckerContext &C, const CallExpr *CE) const {
  219. const ProgramState *state = CheckDoubleClose(CE, C.getState(), C);
  220. if (state)
  221. C.addTransition(state);
  222. }
  223. void StreamChecker::Fread(CheckerContext &C, const CallExpr *CE) const {
  224. const ProgramState *state = C.getState();
  225. if (!CheckNullStream(state->getSVal(CE->getArg(3)), state, C))
  226. return;
  227. }
  228. void StreamChecker::Fwrite(CheckerContext &C, const CallExpr *CE) const {
  229. const ProgramState *state = C.getState();
  230. if (!CheckNullStream(state->getSVal(CE->getArg(3)), state, C))
  231. return;
  232. }
  233. void StreamChecker::Fseek(CheckerContext &C, const CallExpr *CE) const {
  234. const ProgramState *state = C.getState();
  235. if (!(state = CheckNullStream(state->getSVal(CE->getArg(0)), state, C)))
  236. return;
  237. // Check the legality of the 'whence' argument of 'fseek'.
  238. SVal Whence = state->getSVal(CE->getArg(2));
  239. const nonloc::ConcreteInt *CI = dyn_cast<nonloc::ConcreteInt>(&Whence);
  240. if (!CI)
  241. return;
  242. int64_t x = CI->getValue().getSExtValue();
  243. if (x >= 0 && x <= 2)
  244. return;
  245. if (ExplodedNode *N = C.addTransition(state)) {
  246. if (!BT_illegalwhence)
  247. BT_illegalwhence.reset(new BuiltinBug("Illegal whence argument",
  248. "The whence argument to fseek() should be "
  249. "SEEK_SET, SEEK_END, or SEEK_CUR."));
  250. BugReport *R = new BugReport(*BT_illegalwhence,
  251. BT_illegalwhence->getDescription(), N);
  252. C.EmitReport(R);
  253. }
  254. }
  255. void StreamChecker::Ftell(CheckerContext &C, const CallExpr *CE) const {
  256. const ProgramState *state = C.getState();
  257. if (!CheckNullStream(state->getSVal(CE->getArg(0)), state, C))
  258. return;
  259. }
  260. void StreamChecker::Rewind(CheckerContext &C, const CallExpr *CE) const {
  261. const ProgramState *state = C.getState();
  262. if (!CheckNullStream(state->getSVal(CE->getArg(0)), state, C))
  263. return;
  264. }
  265. void StreamChecker::Fgetpos(CheckerContext &C, const CallExpr *CE) const {
  266. const ProgramState *state = C.getState();
  267. if (!CheckNullStream(state->getSVal(CE->getArg(0)), state, C))
  268. return;
  269. }
  270. void StreamChecker::Fsetpos(CheckerContext &C, const CallExpr *CE) const {
  271. const ProgramState *state = C.getState();
  272. if (!CheckNullStream(state->getSVal(CE->getArg(0)), state, C))
  273. return;
  274. }
  275. void StreamChecker::Clearerr(CheckerContext &C, const CallExpr *CE) const {
  276. const ProgramState *state = C.getState();
  277. if (!CheckNullStream(state->getSVal(CE->getArg(0)), state, C))
  278. return;
  279. }
  280. void StreamChecker::Feof(CheckerContext &C, const CallExpr *CE) const {
  281. const ProgramState *state = C.getState();
  282. if (!CheckNullStream(state->getSVal(CE->getArg(0)), state, C))
  283. return;
  284. }
  285. void StreamChecker::Ferror(CheckerContext &C, const CallExpr *CE) const {
  286. const ProgramState *state = C.getState();
  287. if (!CheckNullStream(state->getSVal(CE->getArg(0)), state, C))
  288. return;
  289. }
  290. void StreamChecker::Fileno(CheckerContext &C, const CallExpr *CE) const {
  291. const ProgramState *state = C.getState();
  292. if (!CheckNullStream(state->getSVal(CE->getArg(0)), state, C))
  293. return;
  294. }
  295. const ProgramState *StreamChecker::CheckNullStream(SVal SV, const ProgramState *state,
  296. CheckerContext &C) const {
  297. const DefinedSVal *DV = dyn_cast<DefinedSVal>(&SV);
  298. if (!DV)
  299. return 0;
  300. ConstraintManager &CM = C.getConstraintManager();
  301. const ProgramState *stateNotNull, *stateNull;
  302. llvm::tie(stateNotNull, stateNull) = CM.assumeDual(state, *DV);
  303. if (!stateNotNull && stateNull) {
  304. if (ExplodedNode *N = C.generateSink(stateNull)) {
  305. if (!BT_nullfp)
  306. BT_nullfp.reset(new BuiltinBug("NULL stream pointer",
  307. "Stream pointer might be NULL."));
  308. BugReport *R =new BugReport(*BT_nullfp, BT_nullfp->getDescription(), N);
  309. C.EmitReport(R);
  310. }
  311. return 0;
  312. }
  313. return stateNotNull;
  314. }
  315. const ProgramState *StreamChecker::CheckDoubleClose(const CallExpr *CE,
  316. const ProgramState *state,
  317. CheckerContext &C) const {
  318. SymbolRef Sym = state->getSVal(CE->getArg(0)).getAsSymbol();
  319. if (!Sym)
  320. return state;
  321. const StreamState *SS = state->get<StreamState>(Sym);
  322. // If the file stream is not tracked, return.
  323. if (!SS)
  324. return state;
  325. // Check: Double close a File Descriptor could cause undefined behaviour.
  326. // Conforming to man-pages
  327. if (SS->isClosed()) {
  328. ExplodedNode *N = C.generateSink();
  329. if (N) {
  330. if (!BT_doubleclose)
  331. BT_doubleclose.reset(new BuiltinBug("Double fclose",
  332. "Try to close a file Descriptor already"
  333. " closed. Cause undefined behaviour."));
  334. BugReport *R = new BugReport(*BT_doubleclose,
  335. BT_doubleclose->getDescription(), N);
  336. C.EmitReport(R);
  337. }
  338. return NULL;
  339. }
  340. // Close the File Descriptor.
  341. return state->set<StreamState>(Sym, StreamState::getClosed(CE));
  342. }
  343. void StreamChecker::checkDeadSymbols(SymbolReaper &SymReaper,
  344. CheckerContext &C) const {
  345. for (SymbolReaper::dead_iterator I = SymReaper.dead_begin(),
  346. E = SymReaper.dead_end(); I != E; ++I) {
  347. SymbolRef Sym = *I;
  348. const ProgramState *state = C.getState();
  349. const StreamState *SS = state->get<StreamState>(Sym);
  350. if (!SS)
  351. return;
  352. if (SS->isOpened()) {
  353. ExplodedNode *N = C.generateSink();
  354. if (N) {
  355. if (!BT_ResourceLeak)
  356. BT_ResourceLeak.reset(new BuiltinBug("Resource Leak",
  357. "Opened File never closed. Potential Resource leak."));
  358. BugReport *R = new BugReport(*BT_ResourceLeak,
  359. BT_ResourceLeak->getDescription(), N);
  360. C.EmitReport(R);
  361. }
  362. }
  363. }
  364. }
  365. void StreamChecker::checkEndPath(CheckerContext &Ctx) const {
  366. const ProgramState *state = Ctx.getState();
  367. typedef llvm::ImmutableMap<SymbolRef, StreamState> SymMap;
  368. SymMap M = state->get<StreamState>();
  369. for (SymMap::iterator I = M.begin(), E = M.end(); I != E; ++I) {
  370. StreamState SS = I->second;
  371. if (SS.isOpened()) {
  372. ExplodedNode *N = Ctx.addTransition(state);
  373. if (N) {
  374. if (!BT_ResourceLeak)
  375. BT_ResourceLeak.reset(new BuiltinBug("Resource Leak",
  376. "Opened File never closed. Potential Resource leak."));
  377. BugReport *R = new BugReport(*BT_ResourceLeak,
  378. BT_ResourceLeak->getDescription(), N);
  379. Ctx.EmitReport(R);
  380. }
  381. }
  382. }
  383. }
  384. void StreamChecker::checkPreStmt(const ReturnStmt *S, CheckerContext &C) const {
  385. const Expr *RetE = S->getRetValue();
  386. if (!RetE)
  387. return;
  388. const ProgramState *state = C.getState();
  389. SymbolRef Sym = state->getSVal(RetE).getAsSymbol();
  390. if (!Sym)
  391. return;
  392. const StreamState *SS = state->get<StreamState>(Sym);
  393. if(!SS)
  394. return;
  395. if (SS->isOpened())
  396. state = state->set<StreamState>(Sym, StreamState::getEscaped(S));
  397. C.addTransition(state);
  398. }
  399. void ento::registerStreamChecker(CheckerManager &mgr) {
  400. mgr.registerChecker<StreamChecker>();
  401. }