420 lines · cpp
1//== VAListChecker.cpp - stdarg.h macro usage checker -----------*- C++ -*--==//2//3// Part of the LLVM Project, under the Apache License v2.0 with LLVM Exceptions.4// See https://llvm.org/LICENSE.txt for license information.5// SPDX-License-Identifier: Apache-2.0 WITH LLVM-exception6//7//===----------------------------------------------------------------------===//8//9// This defines checkers which detect usage of uninitialized va_list values10// and va_start calls with no matching va_end.11//12//===----------------------------------------------------------------------===//13 14#include "clang/StaticAnalyzer/Checkers/BuiltinCheckerRegistration.h"15#include "clang/StaticAnalyzer/Core/BugReporter/BugType.h"16#include "clang/StaticAnalyzer/Core/Checker.h"17#include "clang/StaticAnalyzer/Core/CheckerManager.h"18#include "clang/StaticAnalyzer/Core/PathSensitive/CallDescription.h"19#include "clang/StaticAnalyzer/Core/PathSensitive/CallEvent.h"20#include "clang/StaticAnalyzer/Core/PathSensitive/CheckerContext.h"21#include "llvm/Support/FormatVariadic.h"22 23using namespace clang;24using namespace ento;25using llvm::formatv;26 27namespace {28enum class VAListState {29 Uninitialized,30 Unknown,31 Initialized,32 Released,33};34 35constexpr llvm::StringLiteral StateNames[] = {36 "uninitialized", "unknown", "initialized", "already released"};37} // end anonymous namespace38 39static StringRef describeState(const VAListState S) {40 return StateNames[static_cast<int>(S)];41}42 43REGISTER_MAP_WITH_PROGRAMSTATE(VAListStateMap, const MemRegion *, VAListState)44 45static VAListState getVAListState(ProgramStateRef State, const MemRegion *Reg) {46 if (const VAListState *Res = State->get<VAListStateMap>(Reg))47 return *Res;48 return Reg->getSymbolicBase() ? VAListState::Unknown49 : VAListState::Uninitialized;50}51 52namespace {53typedef SmallVector<const MemRegion *, 2> RegionVector;54 55class VAListChecker : public Checker<check::PreCall, check::PreStmt<VAArgExpr>,56 check::DeadSymbols> {57 const BugType LeakBug{this, "Leaked va_list", categories::MemoryError,58 /*SuppressOnSink=*/true};59 const BugType UninitAccessBug{this, "Uninitialized va_list",60 categories::MemoryError};61 62 struct VAListAccepter {63 CallDescription Func;64 int ParamIndex;65 };66 static const SmallVector<VAListAccepter, 15> VAListAccepters;67 static const CallDescription VaStart, VaEnd, VaCopy;68 69public:70 void checkPreStmt(const VAArgExpr *VAA, CheckerContext &C) const;71 void checkPreCall(const CallEvent &Call, CheckerContext &C) const;72 void checkDeadSymbols(SymbolReaper &SR, CheckerContext &C) const;73 74private:75 const MemRegion *getVAListAsRegion(SVal SV, const Expr *VAExpr,76 CheckerContext &C) const;77 const ExplodedNode *getStartCallSite(const ExplodedNode *N,78 const MemRegion *Reg) const;79 80 void reportUninitializedAccess(const MemRegion *VAList, StringRef Msg,81 CheckerContext &C) const;82 void reportLeaked(const RegionVector &Leaked, StringRef Msg1, StringRef Msg2,83 CheckerContext &C, ExplodedNode *N) const;84 85 void checkVAListStartCall(const CallEvent &Call, CheckerContext &C) const;86 void checkVAListCopyCall(const CallEvent &Call, CheckerContext &C) const;87 void checkVAListEndCall(const CallEvent &Call, CheckerContext &C) const;88 89 class VAListBugVisitor : public BugReporterVisitor {90 public:91 VAListBugVisitor(const MemRegion *Reg, bool IsLeak = false)92 : Reg(Reg), IsLeak(IsLeak) {}93 void Profile(llvm::FoldingSetNodeID &ID) const override {94 static int X = 0;95 ID.AddPointer(&X);96 ID.AddPointer(Reg);97 }98 PathDiagnosticPieceRef getEndPath(BugReporterContext &BRC,99 const ExplodedNode *EndPathNode,100 PathSensitiveBugReport &BR) override {101 if (!IsLeak)102 return nullptr;103 104 PathDiagnosticLocation L = BR.getLocation();105 // Do not add the statement itself as a range in case of leak.106 return std::make_shared<PathDiagnosticEventPiece>(L, BR.getDescription(),107 false);108 }109 PathDiagnosticPieceRef VisitNode(const ExplodedNode *N,110 BugReporterContext &BRC,111 PathSensitiveBugReport &BR) override;112 113 private:114 const MemRegion *Reg;115 bool IsLeak;116 };117};118 119const SmallVector<VAListChecker::VAListAccepter, 15>120 VAListChecker::VAListAccepters = {{{CDM::CLibrary, {"vfprintf"}, 3}, 2},121 {{CDM::CLibrary, {"vfscanf"}, 3}, 2},122 {{CDM::CLibrary, {"vprintf"}, 2}, 1},123 {{CDM::CLibrary, {"vscanf"}, 2}, 1},124 {{CDM::CLibrary, {"vsnprintf"}, 4}, 3},125 {{CDM::CLibrary, {"vsprintf"}, 3}, 2},126 {{CDM::CLibrary, {"vsscanf"}, 3}, 2},127 {{CDM::CLibrary, {"vfwprintf"}, 3}, 2},128 {{CDM::CLibrary, {"vfwscanf"}, 3}, 2},129 {{CDM::CLibrary, {"vwprintf"}, 2}, 1},130 {{CDM::CLibrary, {"vwscanf"}, 2}, 1},131 {{CDM::CLibrary, {"vswprintf"}, 4}, 3},132 // vswprintf is the wide version of133 // vsnprintf, vsprintf has no wide version134 {{CDM::CLibrary, {"vswscanf"}, 3}, 2}};135 136const CallDescription VAListChecker::VaStart(CDM::CLibrary,137 {"__builtin_va_start"}, /*Args=*/2,138 /*Params=*/1),139 VAListChecker::VaCopy(CDM::CLibrary, {"__builtin_va_copy"}, 2),140 VAListChecker::VaEnd(CDM::CLibrary, {"__builtin_va_end"}, 1);141} // end anonymous namespace142 143void VAListChecker::checkPreCall(const CallEvent &Call,144 CheckerContext &C) const {145 if (VaStart.matches(Call))146 checkVAListStartCall(Call, C);147 else if (VaCopy.matches(Call))148 checkVAListCopyCall(Call, C);149 else if (VaEnd.matches(Call))150 checkVAListEndCall(Call, C);151 else {152 for (const auto &FuncInfo : VAListAccepters) {153 if (!FuncInfo.Func.matches(Call))154 continue;155 const MemRegion *VAList =156 getVAListAsRegion(Call.getArgSVal(FuncInfo.ParamIndex),157 Call.getArgExpr(FuncInfo.ParamIndex), C);158 if (!VAList)159 return;160 VAListState S = getVAListState(C.getState(), VAList);161 162 if (S == VAListState::Initialized || S == VAListState::Unknown)163 return;164 165 std::string ErrMsg =166 formatv("Function '{0}' is called with an {1} va_list argument",167 FuncInfo.Func.getFunctionName(), describeState(S));168 reportUninitializedAccess(VAList, ErrMsg, C);169 break;170 }171 }172}173 174const MemRegion *VAListChecker::getVAListAsRegion(SVal SV, const Expr *E,175 CheckerContext &C) const {176 const MemRegion *Reg = SV.getAsRegion();177 if (!Reg)178 return nullptr;179 // TODO: In the future this should be abstracted away by the analyzer.180 bool VAListModelledAsArray = false;181 if (const auto *Cast = dyn_cast<CastExpr>(E)) {182 QualType Ty = Cast->getType();183 VAListModelledAsArray =184 Ty->isPointerType() && Ty->getPointeeType()->isRecordType();185 }186 if (const auto *DeclReg = Reg->getAs<DeclRegion>()) {187 if (isa<ParmVarDecl>(DeclReg->getDecl()))188 Reg = C.getState()->getSVal(SV.castAs<Loc>()).getAsRegion();189 }190 // Some VarRegion based VA lists reach here as ElementRegions.191 const auto *EReg = dyn_cast_or_null<ElementRegion>(Reg);192 return (EReg && VAListModelledAsArray) ? EReg->getSuperRegion() : Reg;193}194 195void VAListChecker::checkPreStmt(const VAArgExpr *VAA,196 CheckerContext &C) const {197 ProgramStateRef State = C.getState();198 const Expr *ArgExpr = VAA->getSubExpr();199 const MemRegion *VAList = getVAListAsRegion(C.getSVal(ArgExpr), ArgExpr, C);200 if (!VAList)201 return;202 VAListState S = getVAListState(C.getState(), VAList);203 if (S == VAListState::Initialized || S == VAListState::Unknown)204 return;205 206 std::string ErrMsg =207 formatv("va_arg() is called on an {0} va_list", describeState(S));208 reportUninitializedAccess(VAList, ErrMsg, C);209}210 211void VAListChecker::checkDeadSymbols(SymbolReaper &SR,212 CheckerContext &C) const {213 ProgramStateRef State = C.getState();214 VAListStateMapTy Tracked = State->get<VAListStateMap>();215 RegionVector Leaked;216 for (const auto &[Reg, S] : Tracked) {217 if (SR.isLiveRegion(Reg))218 continue;219 if (S == VAListState::Initialized)220 Leaked.push_back(Reg);221 State = State->remove<VAListStateMap>(Reg);222 }223 if (ExplodedNode *N = C.addTransition(State)) {224 reportLeaked(Leaked, "Initialized va_list", " is leaked", C, N);225 }226}227 228// This function traverses the exploded graph backwards and finds the node where229// the va_list becomes initialized. That node is used for uniquing the bug230// paths. It is not likely that there are several different va_lists that231// belongs to different stack frames, so that case is not yet handled.232const ExplodedNode *233VAListChecker::getStartCallSite(const ExplodedNode *N,234 const MemRegion *Reg) const {235 const LocationContext *LeakContext = N->getLocationContext();236 const ExplodedNode *StartCallNode = N;237 238 bool SeenInitializedState = false;239 240 while (N) {241 VAListState S = getVAListState(N->getState(), Reg);242 if (S == VAListState::Initialized) {243 SeenInitializedState = true;244 } else if (SeenInitializedState) {245 break;246 }247 const LocationContext *NContext = N->getLocationContext();248 if (NContext == LeakContext || NContext->isParentOf(LeakContext))249 StartCallNode = N;250 N = N->pred_empty() ? nullptr : *(N->pred_begin());251 }252 253 return StartCallNode;254}255 256void VAListChecker::reportUninitializedAccess(const MemRegion *VAList,257 StringRef Msg,258 CheckerContext &C) const {259 if (ExplodedNode *N = C.generateErrorNode()) {260 auto R = std::make_unique<PathSensitiveBugReport>(UninitAccessBug, Msg, N);261 R->markInteresting(VAList);262 R->addVisitor(std::make_unique<VAListBugVisitor>(VAList));263 C.emitReport(std::move(R));264 }265}266 267void VAListChecker::reportLeaked(const RegionVector &Leaked, StringRef Msg1,268 StringRef Msg2, CheckerContext &C,269 ExplodedNode *N) const {270 for (const MemRegion *Reg : Leaked) {271 const ExplodedNode *StartNode = getStartCallSite(N, Reg);272 PathDiagnosticLocation LocUsedForUniqueing;273 274 if (const Stmt *StartCallStmt = StartNode->getStmtForDiagnostics())275 LocUsedForUniqueing = PathDiagnosticLocation::createBegin(276 StartCallStmt, C.getSourceManager(), StartNode->getLocationContext());277 278 SmallString<100> Buf;279 llvm::raw_svector_ostream OS(Buf);280 OS << Msg1;281 std::string VariableName = Reg->getDescriptiveName();282 if (!VariableName.empty())283 OS << " " << VariableName;284 OS << Msg2;285 286 auto R = std::make_unique<PathSensitiveBugReport>(287 LeakBug, OS.str(), N, LocUsedForUniqueing,288 StartNode->getLocationContext()->getDecl());289 R->markInteresting(Reg);290 R->addVisitor(std::make_unique<VAListBugVisitor>(Reg, true));291 C.emitReport(std::move(R));292 }293}294 295void VAListChecker::checkVAListStartCall(const CallEvent &Call,296 CheckerContext &C) const {297 const MemRegion *Arg =298 getVAListAsRegion(Call.getArgSVal(0), Call.getArgExpr(0), C);299 if (!Arg)300 return;301 302 ProgramStateRef State = C.getState();303 VAListState ArgState = getVAListState(State, Arg);304 305 if (ArgState == VAListState::Initialized) {306 RegionVector Leaked{Arg};307 if (ExplodedNode *N = C.addTransition(State))308 reportLeaked(Leaked, "Initialized va_list", " is initialized again", C,309 N);310 return;311 }312 313 State = State->set<VAListStateMap>(Arg, VAListState::Initialized);314 C.addTransition(State);315}316 317void VAListChecker::checkVAListCopyCall(const CallEvent &Call,318 CheckerContext &C) const {319 const MemRegion *Arg1 =320 getVAListAsRegion(Call.getArgSVal(0), Call.getArgExpr(0), C);321 const MemRegion *Arg2 =322 getVAListAsRegion(Call.getArgSVal(1), Call.getArgExpr(1), C);323 if (!Arg1 || !Arg2)324 return;325 326 ProgramStateRef State = C.getState();327 if (Arg1 == Arg2) {328 RegionVector Leaked{Arg1};329 if (ExplodedNode *N = C.addTransition(State))330 reportLeaked(Leaked, "va_list", " is copied onto itself", C, N);331 return;332 }333 VAListState State1 = getVAListState(State, Arg1);334 VAListState State2 = getVAListState(State, Arg2);335 // Update the ProgramState by copying the state of Arg2 to Arg1.336 State = State->set<VAListStateMap>(Arg1, State2);337 if (State1 == VAListState::Initialized) {338 RegionVector Leaked{Arg1};339 std::string Msg2 =340 formatv(" is overwritten by {0} {1} one",341 (State2 == VAListState::Initialized) ? "another" : "an",342 describeState(State2));343 if (ExplodedNode *N = C.addTransition(State))344 reportLeaked(Leaked, "Initialized va_list", Msg2, C, N);345 return;346 }347 if (State2 != VAListState::Initialized && State2 != VAListState::Unknown) {348 std::string Msg = formatv("{0} va_list is copied", describeState(State2));349 Msg[0] = toupper(Msg[0]);350 reportUninitializedAccess(Arg2, Msg, C);351 return;352 }353 C.addTransition(State);354}355 356void VAListChecker::checkVAListEndCall(const CallEvent &Call,357 CheckerContext &C) const {358 const MemRegion *Arg =359 getVAListAsRegion(Call.getArgSVal(0), Call.getArgExpr(0), C);360 if (!Arg)361 return;362 363 ProgramStateRef State = C.getState();364 VAListState ArgState = getVAListState(State, Arg);365 366 if (ArgState != VAListState::Unknown &&367 ArgState != VAListState::Initialized) {368 std::string Msg = formatv("va_end() is called on an {0} va_list",369 describeState(ArgState));370 reportUninitializedAccess(Arg, Msg, C);371 return;372 }373 State = State->set<VAListStateMap>(Arg, VAListState::Released);374 C.addTransition(State);375}376 377PathDiagnosticPieceRef VAListChecker::VAListBugVisitor::VisitNode(378 const ExplodedNode *N, BugReporterContext &BRC, PathSensitiveBugReport &) {379 ProgramStateRef State = N->getState();380 ProgramStateRef StatePrev = N->getFirstPred()->getState();381 382 const Stmt *S = N->getStmtForDiagnostics();383 if (!S)384 return nullptr;385 386 VAListState After = getVAListState(State, Reg);387 VAListState Before = getVAListState(StatePrev, Reg);388 if (Before == After)389 return nullptr;390 391 StringRef Msg;392 switch (After) {393 case VAListState::Uninitialized:394 Msg = "Copied uninitialized contents into the va_list";395 break;396 case VAListState::Unknown:397 Msg = "Copied unknown contents into the va_list";398 break;399 case VAListState::Initialized:400 Msg = "Initialized va_list";401 break;402 case VAListState::Released:403 Msg = "Ended va_list";404 break;405 }406 407 if (Msg.empty())408 return nullptr;409 410 PathDiagnosticLocation Pos(S, BRC.getSourceManager(),411 N->getLocationContext());412 return std::make_shared<PathDiagnosticEventPiece>(Pos, Msg, true);413}414 415void ento::registerVAListChecker(CheckerManager &Mgr) {416 Mgr.registerChecker<VAListChecker>();417}418 419bool ento::shouldRegisterVAListChecker(const CheckerManager &) { return true; }420