1 //===-- StreamChecker.cpp -----------------------------------------*- C++ -*--// 2 // 3 // Part of the LLVM Project, under the Apache License v2.0 with LLVM Exceptions. 4 // See https://llvm.org/LICENSE.txt for license information. 5 // SPDX-License-Identifier: Apache-2.0 WITH LLVM-exception 6 // 7 //===----------------------------------------------------------------------===// 8 // 9 // This file defines checkers that model and check stream handling functions. 10 // 11 //===----------------------------------------------------------------------===// 12 13 #include "clang/StaticAnalyzer/Checkers/BuiltinCheckerRegistration.h" 14 #include "clang/StaticAnalyzer/Core/BugReporter/BugType.h" 15 #include "clang/StaticAnalyzer/Core/Checker.h" 16 #include "clang/StaticAnalyzer/Core/CheckerManager.h" 17 #include "clang/StaticAnalyzer/Core/PathSensitive/CallEvent.h" 18 #include "clang/StaticAnalyzer/Core/PathSensitive/CheckerContext.h" 19 #include "clang/StaticAnalyzer/Core/PathSensitive/ProgramState.h" 20 #include "clang/StaticAnalyzer/Core/PathSensitive/ProgramStateTrait.h" 21 #include "clang/StaticAnalyzer/Core/PathSensitive/SymbolManager.h" 22 #include <functional> 23 24 using namespace clang; 25 using namespace ento; 26 using namespace std::placeholders; 27 28 namespace { 29 30 struct FnDescription; 31 32 /// State of the stream error flags. 33 /// Sometimes it is not known to the checker what error flags are set. 34 /// This is indicated by setting more than one flag to true. 35 /// This is an optimization to avoid state splits. 36 /// A stream can either be in FEOF or FERROR but not both at the same time. 37 /// Multiple flags are set to handle the corresponding states together. 38 struct StreamErrorState { 39 /// The stream can be in state where none of the error flags set. 40 bool NoError = true; 41 /// The stream can be in state where the EOF indicator is set. 42 bool FEof = false; 43 /// The stream can be in state where the error indicator is set. 44 bool FError = false; 45 46 bool isNoError() const { return NoError && !FEof && !FError; } 47 bool isFEof() const { return !NoError && FEof && !FError; } 48 bool isFError() const { return !NoError && !FEof && FError; } 49 50 bool operator==(const StreamErrorState &ES) const { 51 return NoError == ES.NoError && FEof == ES.FEof && FError == ES.FError; 52 } 53 54 bool operator!=(const StreamErrorState &ES) const { return !(*this == ES); } 55 56 StreamErrorState operator|(const StreamErrorState &E) const { 57 return {NoError || E.NoError, FEof || E.FEof, FError || E.FError}; 58 } 59 60 StreamErrorState operator&(const StreamErrorState &E) const { 61 return {NoError && E.NoError, FEof && E.FEof, FError && E.FError}; 62 } 63 64 StreamErrorState operator~() const { return {!NoError, !FEof, !FError}; } 65 66 /// Returns if the StreamErrorState is a valid object. 67 operator bool() const { return NoError || FEof || FError; } 68 69 void Profile(llvm::FoldingSetNodeID &ID) const { 70 ID.AddBoolean(NoError); 71 ID.AddBoolean(FEof); 72 ID.AddBoolean(FError); 73 } 74 }; 75 76 const StreamErrorState ErrorNone{true, false, false}; 77 const StreamErrorState ErrorFEof{false, true, false}; 78 const StreamErrorState ErrorFError{false, false, true}; 79 80 /// Full state information about a stream pointer. 81 struct StreamState { 82 /// The last file operation called in the stream. 83 const FnDescription *LastOperation; 84 85 /// State of a stream symbol. 86 /// FIXME: We need maybe an "escaped" state later. 87 enum KindTy { 88 Opened, /// Stream is opened. 89 Closed, /// Closed stream (an invalid stream pointer after it was closed). 90 OpenFailed /// The last open operation has failed. 91 } State; 92 93 /// State of the error flags. 94 /// Ignored in non-opened stream state but must be NoError. 95 StreamErrorState const ErrorState; 96 97 /// Indicate if the file has an "indeterminate file position indicator". 98 /// This can be set at a failing read or write or seek operation. 99 /// If it is set no more read or write is allowed. 100 /// This value is not dependent on the stream error flags: 101 /// The error flag may be cleared with `clearerr` but the file position 102 /// remains still indeterminate. 103 /// This value applies to all error states in ErrorState except FEOF. 104 /// An EOF+indeterminate state is the same as EOF state. 105 bool const FilePositionIndeterminate = false; 106 107 StreamState(const FnDescription *L, KindTy S, const StreamErrorState &ES, 108 bool IsFilePositionIndeterminate) 109 : LastOperation(L), State(S), ErrorState(ES), 110 FilePositionIndeterminate(IsFilePositionIndeterminate) { 111 assert((!ES.isFEof() || !IsFilePositionIndeterminate) && 112 "FilePositionIndeterminate should be false in FEof case."); 113 assert((State == Opened || ErrorState.isNoError()) && 114 "ErrorState should be None in non-opened stream state."); 115 } 116 117 bool isOpened() const { return State == Opened; } 118 bool isClosed() const { return State == Closed; } 119 bool isOpenFailed() const { return State == OpenFailed; } 120 121 bool operator==(const StreamState &X) const { 122 // In not opened state error state should always NoError, so comparison 123 // here is no problem. 124 return LastOperation == X.LastOperation && State == X.State && 125 ErrorState == X.ErrorState && 126 FilePositionIndeterminate == X.FilePositionIndeterminate; 127 } 128 129 static StreamState getOpened(const FnDescription *L, 130 const StreamErrorState &ES = ErrorNone, 131 bool IsFilePositionIndeterminate = false) { 132 return StreamState{L, Opened, ES, IsFilePositionIndeterminate}; 133 } 134 static StreamState getClosed(const FnDescription *L) { 135 return StreamState{L, Closed, {}, false}; 136 } 137 static StreamState getOpenFailed(const FnDescription *L) { 138 return StreamState{L, OpenFailed, {}, false}; 139 } 140 141 void Profile(llvm::FoldingSetNodeID &ID) const { 142 ID.AddPointer(LastOperation); 143 ID.AddInteger(State); 144 ID.AddInteger(ErrorState); 145 ID.AddBoolean(FilePositionIndeterminate); 146 } 147 }; 148 149 class StreamChecker; 150 using FnCheck = std::function<void(const StreamChecker *, const FnDescription *, 151 const CallEvent &, CheckerContext &)>; 152 153 using ArgNoTy = unsigned int; 154 static const ArgNoTy ArgNone = std::numeric_limits<ArgNoTy>::max(); 155 156 struct FnDescription { 157 FnCheck PreFn; 158 FnCheck EvalFn; 159 ArgNoTy StreamArgNo; 160 }; 161 162 /// Get the value of the stream argument out of the passed call event. 163 /// The call should contain a function that is described by Desc. 164 SVal getStreamArg(const FnDescription *Desc, const CallEvent &Call) { 165 assert(Desc && Desc->StreamArgNo != ArgNone && 166 "Try to get a non-existing stream argument."); 167 return Call.getArgSVal(Desc->StreamArgNo); 168 } 169 170 /// Create a conjured symbol return value for a call expression. 171 DefinedSVal makeRetVal(CheckerContext &C, const CallExpr *CE) { 172 assert(CE && "Expecting a call expression."); 173 174 const LocationContext *LCtx = C.getLocationContext(); 175 return C.getSValBuilder() 176 .conjureSymbolVal(nullptr, CE, LCtx, C.blockCount()) 177 .castAs<DefinedSVal>(); 178 } 179 180 ProgramStateRef bindAndAssumeTrue(ProgramStateRef State, CheckerContext &C, 181 const CallExpr *CE) { 182 DefinedSVal RetVal = makeRetVal(C, CE); 183 State = State->BindExpr(CE, C.getLocationContext(), RetVal); 184 State = State->assume(RetVal, true); 185 assert(State && "Assumption on new value should not fail."); 186 return State; 187 } 188 189 ProgramStateRef bindInt(uint64_t Value, ProgramStateRef State, 190 CheckerContext &C, const CallExpr *CE) { 191 State = State->BindExpr(CE, C.getLocationContext(), 192 C.getSValBuilder().makeIntVal(Value, false)); 193 return State; 194 } 195 196 class StreamChecker : public Checker<check::PreCall, eval::Call, 197 check::DeadSymbols, check::PointerEscape> { 198 BugType BT_FileNull{this, "NULL stream pointer", "Stream handling error"}; 199 BugType BT_UseAfterClose{this, "Closed stream", "Stream handling error"}; 200 BugType BT_UseAfterOpenFailed{this, "Invalid stream", 201 "Stream handling error"}; 202 BugType BT_IndeterminatePosition{this, "Invalid stream state", 203 "Stream handling error"}; 204 BugType BT_IllegalWhence{this, "Illegal whence argument", 205 "Stream handling error"}; 206 BugType BT_StreamEof{this, "Stream already in EOF", "Stream handling error"}; 207 BugType BT_ResourceLeak{this, "Resource leak", "Stream handling error"}; 208 209 public: 210 void checkPreCall(const CallEvent &Call, CheckerContext &C) const; 211 bool evalCall(const CallEvent &Call, CheckerContext &C) const; 212 void checkDeadSymbols(SymbolReaper &SymReaper, CheckerContext &C) const; 213 ProgramStateRef checkPointerEscape(ProgramStateRef State, 214 const InvalidatedSymbols &Escaped, 215 const CallEvent *Call, 216 PointerEscapeKind Kind) const; 217 218 /// If true, evaluate special testing stream functions. 219 bool TestMode = false; 220 221 private: 222 CallDescriptionMap<FnDescription> FnDescriptions = { 223 {{"fopen"}, {nullptr, &StreamChecker::evalFopen, ArgNone}}, 224 {{"freopen", 3}, 225 {&StreamChecker::preFreopen, &StreamChecker::evalFreopen, 2}}, 226 {{"tmpfile"}, {nullptr, &StreamChecker::evalFopen, ArgNone}}, 227 {{"fclose", 1}, 228 {&StreamChecker::preDefault, &StreamChecker::evalFclose, 0}}, 229 {{"fread", 4}, 230 {&StreamChecker::preFread, 231 std::bind(&StreamChecker::evalFreadFwrite, _1, _2, _3, _4, true), 3}}, 232 {{"fwrite", 4}, 233 {&StreamChecker::preFwrite, 234 std::bind(&StreamChecker::evalFreadFwrite, _1, _2, _3, _4, false), 3}}, 235 {{"fseek", 3}, {&StreamChecker::preFseek, &StreamChecker::evalFseek, 0}}, 236 {{"ftell", 1}, {&StreamChecker::preDefault, nullptr, 0}}, 237 {{"rewind", 1}, {&StreamChecker::preDefault, nullptr, 0}}, 238 {{"fgetpos", 2}, {&StreamChecker::preDefault, nullptr, 0}}, 239 {{"fsetpos", 2}, {&StreamChecker::preDefault, nullptr, 0}}, 240 {{"clearerr", 1}, 241 {&StreamChecker::preDefault, &StreamChecker::evalClearerr, 0}}, 242 {{"feof", 1}, 243 {&StreamChecker::preDefault, 244 std::bind(&StreamChecker::evalFeofFerror, _1, _2, _3, _4, ErrorFEof), 245 0}}, 246 {{"ferror", 1}, 247 {&StreamChecker::preDefault, 248 std::bind(&StreamChecker::evalFeofFerror, _1, _2, _3, _4, ErrorFError), 249 0}}, 250 {{"fileno", 1}, {&StreamChecker::preDefault, nullptr, 0}}, 251 }; 252 253 CallDescriptionMap<FnDescription> FnTestDescriptions = { 254 {{"StreamTesterChecker_make_feof_stream", 1}, 255 {nullptr, 256 std::bind(&StreamChecker::evalSetFeofFerror, _1, _2, _3, _4, ErrorFEof), 257 0}}, 258 {{"StreamTesterChecker_make_ferror_stream", 1}, 259 {nullptr, 260 std::bind(&StreamChecker::evalSetFeofFerror, _1, _2, _3, _4, 261 ErrorFError), 262 0}}, 263 }; 264 265 void evalFopen(const FnDescription *Desc, const CallEvent &Call, 266 CheckerContext &C) const; 267 268 void preFreopen(const FnDescription *Desc, const CallEvent &Call, 269 CheckerContext &C) const; 270 void evalFreopen(const FnDescription *Desc, const CallEvent &Call, 271 CheckerContext &C) const; 272 273 void evalFclose(const FnDescription *Desc, const CallEvent &Call, 274 CheckerContext &C) const; 275 276 void preFread(const FnDescription *Desc, const CallEvent &Call, 277 CheckerContext &C) const; 278 279 void preFwrite(const FnDescription *Desc, const CallEvent &Call, 280 CheckerContext &C) const; 281 282 void evalFreadFwrite(const FnDescription *Desc, const CallEvent &Call, 283 CheckerContext &C, bool IsFread) const; 284 285 void preFseek(const FnDescription *Desc, const CallEvent &Call, 286 CheckerContext &C) const; 287 void evalFseek(const FnDescription *Desc, const CallEvent &Call, 288 CheckerContext &C) const; 289 290 void preDefault(const FnDescription *Desc, const CallEvent &Call, 291 CheckerContext &C) const; 292 293 void evalClearerr(const FnDescription *Desc, const CallEvent &Call, 294 CheckerContext &C) const; 295 296 void evalFeofFerror(const FnDescription *Desc, const CallEvent &Call, 297 CheckerContext &C, 298 const StreamErrorState &ErrorKind) const; 299 300 void evalSetFeofFerror(const FnDescription *Desc, const CallEvent &Call, 301 CheckerContext &C, 302 const StreamErrorState &ErrorKind) const; 303 304 /// Check that the stream (in StreamVal) is not NULL. 305 /// If it can only be NULL a fatal error is emitted and nullptr returned. 306 /// Otherwise the return value is a new state where the stream is constrained 307 /// to be non-null. 308 ProgramStateRef ensureStreamNonNull(SVal StreamVal, CheckerContext &C, 309 ProgramStateRef State) const; 310 311 /// Check that the stream is the opened state. 312 /// If the stream is known to be not opened an error is generated 313 /// and nullptr returned, otherwise the original state is returned. 314 ProgramStateRef ensureStreamOpened(SVal StreamVal, CheckerContext &C, 315 ProgramStateRef State) const; 316 317 /// Check that the stream has not an invalid ("indeterminate") file position, 318 /// generate warning for it. 319 /// (EOF is not an invalid position.) 320 /// The returned state can be nullptr if a fatal error was generated. 321 /// It can return non-null state if the stream has not an invalid position or 322 /// there is execution path with non-invalid position. 323 ProgramStateRef 324 ensureNoFilePositionIndeterminate(SVal StreamVal, CheckerContext &C, 325 ProgramStateRef State) const; 326 327 /// Check the legality of the 'whence' argument of 'fseek'. 328 /// Generate error and return nullptr if it is found to be illegal. 329 /// Otherwise returns the state. 330 /// (State is not changed here because the "whence" value is already known.) 331 ProgramStateRef ensureFseekWhenceCorrect(SVal WhenceVal, CheckerContext &C, 332 ProgramStateRef State) const; 333 334 /// Generate warning about stream in EOF state. 335 /// There will be always a state transition into the passed State, 336 /// by the new non-fatal error node or (if failed) a normal transition, 337 /// to ensure uniform handling. 338 void reportFEofWarning(CheckerContext &C, ProgramStateRef State) const; 339 340 /// Find the description data of the function called by a call event. 341 /// Returns nullptr if no function is recognized. 342 const FnDescription *lookupFn(const CallEvent &Call) const { 343 // Recognize "global C functions" with only integral or pointer arguments 344 // (and matching name) as stream functions. 345 if (!Call.isGlobalCFunction()) 346 return nullptr; 347 for (auto P : Call.parameters()) { 348 QualType T = P->getType(); 349 if (!T->isIntegralOrEnumerationType() && !T->isPointerType()) 350 return nullptr; 351 } 352 353 return FnDescriptions.lookup(Call); 354 } 355 356 /// Generate a message for BugReporterVisitor if the stored symbol is 357 /// marked as interesting by the actual bug report. 358 struct NoteFn { 359 const CheckerNameRef CheckerName; 360 SymbolRef StreamSym; 361 std::string Message; 362 363 std::string operator()(PathSensitiveBugReport &BR) const { 364 if (BR.isInteresting(StreamSym) && 365 CheckerName == BR.getBugType().getCheckerName()) 366 return Message; 367 368 return ""; 369 } 370 }; 371 372 const NoteTag *constructNoteTag(CheckerContext &C, SymbolRef StreamSym, 373 const std::string &Message) const { 374 return C.getNoteTag(NoteFn{getCheckerName(), StreamSym, Message}); 375 } 376 377 /// Searches for the ExplodedNode where the file descriptor was acquired for 378 /// StreamSym. 379 static const ExplodedNode *getAcquisitionSite(const ExplodedNode *N, 380 SymbolRef StreamSym, 381 CheckerContext &C); 382 }; 383 384 } // end anonymous namespace 385 386 REGISTER_MAP_WITH_PROGRAMSTATE(StreamMap, SymbolRef, StreamState) 387 388 inline void assertStreamStateOpened(const StreamState *SS) { 389 assert(SS->isOpened() && 390 "Previous create of error node for non-opened stream failed?"); 391 } 392 393 const ExplodedNode *StreamChecker::getAcquisitionSite(const ExplodedNode *N, 394 SymbolRef StreamSym, 395 CheckerContext &C) { 396 ProgramStateRef State = N->getState(); 397 // When bug type is resource leak, exploded node N may not have state info 398 // for leaked file descriptor, but predecessor should have it. 399 if (!State->get<StreamMap>(StreamSym)) 400 N = N->getFirstPred(); 401 402 const ExplodedNode *Pred = N; 403 while (N) { 404 State = N->getState(); 405 if (!State->get<StreamMap>(StreamSym)) 406 return Pred; 407 Pred = N; 408 N = N->getFirstPred(); 409 } 410 411 return nullptr; 412 } 413 414 void StreamChecker::checkPreCall(const CallEvent &Call, 415 CheckerContext &C) const { 416 const FnDescription *Desc = lookupFn(Call); 417 if (!Desc || !Desc->PreFn) 418 return; 419 420 Desc->PreFn(this, Desc, Call, C); 421 } 422 423 bool StreamChecker::evalCall(const CallEvent &Call, CheckerContext &C) const { 424 const FnDescription *Desc = lookupFn(Call); 425 if (!Desc && TestMode) 426 Desc = FnTestDescriptions.lookup(Call); 427 if (!Desc || !Desc->EvalFn) 428 return false; 429 430 Desc->EvalFn(this, Desc, Call, C); 431 432 return C.isDifferent(); 433 } 434 435 void StreamChecker::evalFopen(const FnDescription *Desc, const CallEvent &Call, 436 CheckerContext &C) const { 437 ProgramStateRef State = C.getState(); 438 const CallExpr *CE = dyn_cast_or_null<CallExpr>(Call.getOriginExpr()); 439 if (!CE) 440 return; 441 442 DefinedSVal RetVal = makeRetVal(C, CE); 443 SymbolRef RetSym = RetVal.getAsSymbol(); 444 assert(RetSym && "RetVal must be a symbol here."); 445 446 State = State->BindExpr(CE, C.getLocationContext(), RetVal); 447 448 // Bifurcate the state into two: one with a valid FILE* pointer, the other 449 // with a NULL. 450 ProgramStateRef StateNotNull, StateNull; 451 std::tie(StateNotNull, StateNull) = 452 C.getConstraintManager().assumeDual(State, RetVal); 453 454 StateNotNull = 455 StateNotNull->set<StreamMap>(RetSym, StreamState::getOpened(Desc)); 456 StateNull = 457 StateNull->set<StreamMap>(RetSym, StreamState::getOpenFailed(Desc)); 458 459 C.addTransition(StateNotNull, 460 constructNoteTag(C, RetSym, "Stream opened here")); 461 C.addTransition(StateNull); 462 } 463 464 void StreamChecker::preFreopen(const FnDescription *Desc, const CallEvent &Call, 465 CheckerContext &C) const { 466 // Do not allow NULL as passed stream pointer but allow a closed stream. 467 ProgramStateRef State = C.getState(); 468 State = ensureStreamNonNull(getStreamArg(Desc, Call), C, State); 469 if (!State) 470 return; 471 472 C.addTransition(State); 473 } 474 475 void StreamChecker::evalFreopen(const FnDescription *Desc, 476 const CallEvent &Call, 477 CheckerContext &C) const { 478 ProgramStateRef State = C.getState(); 479 480 auto *CE = dyn_cast_or_null<CallExpr>(Call.getOriginExpr()); 481 if (!CE) 482 return; 483 484 Optional<DefinedSVal> StreamVal = 485 getStreamArg(Desc, Call).getAs<DefinedSVal>(); 486 if (!StreamVal) 487 return; 488 489 SymbolRef StreamSym = StreamVal->getAsSymbol(); 490 // Do not care about concrete values for stream ("(FILE *)0x12345"?). 491 // FIXME: Can be stdin, stdout, stderr such values? 492 if (!StreamSym) 493 return; 494 495 // Do not handle untracked stream. It is probably escaped. 496 if (!State->get<StreamMap>(StreamSym)) 497 return; 498 499 // Generate state for non-failed case. 500 // Return value is the passed stream pointer. 501 // According to the documentations, the stream is closed first 502 // but any close error is ignored. The state changes to (or remains) opened. 503 ProgramStateRef StateRetNotNull = 504 State->BindExpr(CE, C.getLocationContext(), *StreamVal); 505 // Generate state for NULL return value. 506 // Stream switches to OpenFailed state. 507 ProgramStateRef StateRetNull = State->BindExpr(CE, C.getLocationContext(), 508 C.getSValBuilder().makeNull()); 509 510 StateRetNotNull = 511 StateRetNotNull->set<StreamMap>(StreamSym, StreamState::getOpened(Desc)); 512 StateRetNull = 513 StateRetNull->set<StreamMap>(StreamSym, StreamState::getOpenFailed(Desc)); 514 515 C.addTransition(StateRetNotNull, 516 constructNoteTag(C, StreamSym, "Stream reopened here")); 517 C.addTransition(StateRetNull); 518 } 519 520 void StreamChecker::evalFclose(const FnDescription *Desc, const CallEvent &Call, 521 CheckerContext &C) const { 522 ProgramStateRef State = C.getState(); 523 SymbolRef Sym = getStreamArg(Desc, Call).getAsSymbol(); 524 if (!Sym) 525 return; 526 527 const StreamState *SS = State->get<StreamMap>(Sym); 528 if (!SS) 529 return; 530 531 assertStreamStateOpened(SS); 532 533 // Close the File Descriptor. 534 // Regardless if the close fails or not, stream becomes "closed" 535 // and can not be used any more. 536 State = State->set<StreamMap>(Sym, StreamState::getClosed(Desc)); 537 538 C.addTransition(State); 539 } 540 541 void StreamChecker::preFread(const FnDescription *Desc, const CallEvent &Call, 542 CheckerContext &C) const { 543 ProgramStateRef State = C.getState(); 544 SVal StreamVal = getStreamArg(Desc, Call); 545 State = ensureStreamNonNull(StreamVal, C, State); 546 if (!State) 547 return; 548 State = ensureStreamOpened(StreamVal, C, State); 549 if (!State) 550 return; 551 State = ensureNoFilePositionIndeterminate(StreamVal, C, State); 552 if (!State) 553 return; 554 555 SymbolRef Sym = StreamVal.getAsSymbol(); 556 if (Sym && State->get<StreamMap>(Sym)) { 557 const StreamState *SS = State->get<StreamMap>(Sym); 558 if (SS->ErrorState & ErrorFEof) 559 reportFEofWarning(C, State); 560 } else { 561 C.addTransition(State); 562 } 563 } 564 565 void StreamChecker::preFwrite(const FnDescription *Desc, const CallEvent &Call, 566 CheckerContext &C) const { 567 ProgramStateRef State = C.getState(); 568 SVal StreamVal = getStreamArg(Desc, Call); 569 State = ensureStreamNonNull(StreamVal, C, State); 570 if (!State) 571 return; 572 State = ensureStreamOpened(StreamVal, C, State); 573 if (!State) 574 return; 575 State = ensureNoFilePositionIndeterminate(StreamVal, C, State); 576 if (!State) 577 return; 578 579 C.addTransition(State); 580 } 581 582 void StreamChecker::evalFreadFwrite(const FnDescription *Desc, 583 const CallEvent &Call, CheckerContext &C, 584 bool IsFread) const { 585 ProgramStateRef State = C.getState(); 586 SymbolRef StreamSym = getStreamArg(Desc, Call).getAsSymbol(); 587 if (!StreamSym) 588 return; 589 590 const CallExpr *CE = dyn_cast_or_null<CallExpr>(Call.getOriginExpr()); 591 if (!CE) 592 return; 593 594 Optional<NonLoc> SizeVal = Call.getArgSVal(1).getAs<NonLoc>(); 595 if (!SizeVal) 596 return; 597 Optional<NonLoc> NMembVal = Call.getArgSVal(2).getAs<NonLoc>(); 598 if (!NMembVal) 599 return; 600 601 const StreamState *SS = State->get<StreamMap>(StreamSym); 602 if (!SS) 603 return; 604 605 assertStreamStateOpened(SS); 606 607 // C'99 standard, §7.19.8.1.3, the return value of fread: 608 // The fread function returns the number of elements successfully read, which 609 // may be less than nmemb if a read error or end-of-file is encountered. If 610 // size or nmemb is zero, fread returns zero and the contents of the array and 611 // the state of the stream remain unchanged. 612 613 if (State->isNull(*SizeVal).isConstrainedTrue() || 614 State->isNull(*NMembVal).isConstrainedTrue()) { 615 // This is the "size or nmemb is zero" case. 616 // Just return 0, do nothing more (not clear the error flags). 617 State = bindInt(0, State, C, CE); 618 C.addTransition(State); 619 return; 620 } 621 622 // Generate a transition for the success state. 623 // If we know the state to be FEOF at fread, do not add a success state. 624 if (!IsFread || (SS->ErrorState != ErrorFEof)) { 625 ProgramStateRef StateNotFailed = 626 State->BindExpr(CE, C.getLocationContext(), *NMembVal); 627 if (StateNotFailed) { 628 StateNotFailed = StateNotFailed->set<StreamMap>( 629 StreamSym, StreamState::getOpened(Desc)); 630 C.addTransition(StateNotFailed); 631 } 632 } 633 634 // Add transition for the failed state. 635 Optional<NonLoc> RetVal = makeRetVal(C, CE).castAs<NonLoc>(); 636 assert(RetVal && "Value should be NonLoc."); 637 ProgramStateRef StateFailed = 638 State->BindExpr(CE, C.getLocationContext(), *RetVal); 639 if (!StateFailed) 640 return; 641 auto Cond = C.getSValBuilder() 642 .evalBinOpNN(State, BO_LT, *RetVal, *NMembVal, 643 C.getASTContext().IntTy) 644 .getAs<DefinedOrUnknownSVal>(); 645 if (!Cond) 646 return; 647 StateFailed = StateFailed->assume(*Cond, true); 648 if (!StateFailed) 649 return; 650 651 StreamErrorState NewES; 652 if (IsFread) 653 NewES = (SS->ErrorState == ErrorFEof) ? ErrorFEof : ErrorFEof | ErrorFError; 654 else 655 NewES = ErrorFError; 656 // If a (non-EOF) error occurs, the resulting value of the file position 657 // indicator for the stream is indeterminate. 658 StreamState NewState = StreamState::getOpened(Desc, NewES, !NewES.isFEof()); 659 StateFailed = StateFailed->set<StreamMap>(StreamSym, NewState); 660 C.addTransition(StateFailed); 661 } 662 663 void StreamChecker::preFseek(const FnDescription *Desc, const CallEvent &Call, 664 CheckerContext &C) const { 665 ProgramStateRef State = C.getState(); 666 SVal StreamVal = getStreamArg(Desc, Call); 667 State = ensureStreamNonNull(StreamVal, C, State); 668 if (!State) 669 return; 670 State = ensureStreamOpened(StreamVal, C, State); 671 if (!State) 672 return; 673 State = ensureFseekWhenceCorrect(Call.getArgSVal(2), C, State); 674 if (!State) 675 return; 676 677 C.addTransition(State); 678 } 679 680 void StreamChecker::evalFseek(const FnDescription *Desc, const CallEvent &Call, 681 CheckerContext &C) const { 682 ProgramStateRef State = C.getState(); 683 SymbolRef StreamSym = getStreamArg(Desc, Call).getAsSymbol(); 684 if (!StreamSym) 685 return; 686 687 const CallExpr *CE = dyn_cast_or_null<CallExpr>(Call.getOriginExpr()); 688 if (!CE) 689 return; 690 691 // Ignore the call if the stream is not tracked. 692 if (!State->get<StreamMap>(StreamSym)) 693 return; 694 695 DefinedSVal RetVal = makeRetVal(C, CE); 696 697 // Make expression result. 698 State = State->BindExpr(CE, C.getLocationContext(), RetVal); 699 700 // Bifurcate the state into failed and non-failed. 701 // Return zero on success, nonzero on error. 702 ProgramStateRef StateNotFailed, StateFailed; 703 std::tie(StateFailed, StateNotFailed) = 704 C.getConstraintManager().assumeDual(State, RetVal); 705 706 // Reset the state to opened with no error. 707 StateNotFailed = 708 StateNotFailed->set<StreamMap>(StreamSym, StreamState::getOpened(Desc)); 709 // We get error. 710 // It is possible that fseek fails but sets none of the error flags. 711 // If fseek failed, assume that the file position becomes indeterminate in any 712 // case. 713 StateFailed = StateFailed->set<StreamMap>( 714 StreamSym, 715 StreamState::getOpened(Desc, ErrorNone | ErrorFEof | ErrorFError, true)); 716 717 C.addTransition(StateNotFailed); 718 C.addTransition(StateFailed); 719 } 720 721 void StreamChecker::evalClearerr(const FnDescription *Desc, 722 const CallEvent &Call, 723 CheckerContext &C) const { 724 ProgramStateRef State = C.getState(); 725 SymbolRef StreamSym = getStreamArg(Desc, Call).getAsSymbol(); 726 if (!StreamSym) 727 return; 728 729 const StreamState *SS = State->get<StreamMap>(StreamSym); 730 if (!SS) 731 return; 732 733 assertStreamStateOpened(SS); 734 735 // FilePositionIndeterminate is not cleared. 736 State = State->set<StreamMap>( 737 StreamSym, 738 StreamState::getOpened(Desc, ErrorNone, SS->FilePositionIndeterminate)); 739 C.addTransition(State); 740 } 741 742 void StreamChecker::evalFeofFerror(const FnDescription *Desc, 743 const CallEvent &Call, CheckerContext &C, 744 const StreamErrorState &ErrorKind) const { 745 ProgramStateRef State = C.getState(); 746 SymbolRef StreamSym = getStreamArg(Desc, Call).getAsSymbol(); 747 if (!StreamSym) 748 return; 749 750 const CallExpr *CE = dyn_cast_or_null<CallExpr>(Call.getOriginExpr()); 751 if (!CE) 752 return; 753 754 const StreamState *SS = State->get<StreamMap>(StreamSym); 755 if (!SS) 756 return; 757 758 assertStreamStateOpened(SS); 759 760 if (SS->ErrorState & ErrorKind) { 761 // Execution path with error of ErrorKind. 762 // Function returns true. 763 // From now on it is the only one error state. 764 ProgramStateRef TrueState = bindAndAssumeTrue(State, C, CE); 765 C.addTransition(TrueState->set<StreamMap>( 766 StreamSym, StreamState::getOpened(Desc, ErrorKind, 767 SS->FilePositionIndeterminate && 768 !ErrorKind.isFEof()))); 769 } 770 if (StreamErrorState NewES = SS->ErrorState & (~ErrorKind)) { 771 // Execution path(s) with ErrorKind not set. 772 // Function returns false. 773 // New error state is everything before minus ErrorKind. 774 ProgramStateRef FalseState = bindInt(0, State, C, CE); 775 C.addTransition(FalseState->set<StreamMap>( 776 StreamSym, 777 StreamState::getOpened( 778 Desc, NewES, SS->FilePositionIndeterminate && !NewES.isFEof()))); 779 } 780 } 781 782 void StreamChecker::preDefault(const FnDescription *Desc, const CallEvent &Call, 783 CheckerContext &C) const { 784 ProgramStateRef State = C.getState(); 785 SVal StreamVal = getStreamArg(Desc, Call); 786 State = ensureStreamNonNull(StreamVal, C, State); 787 if (!State) 788 return; 789 State = ensureStreamOpened(StreamVal, C, State); 790 if (!State) 791 return; 792 793 C.addTransition(State); 794 } 795 796 void StreamChecker::evalSetFeofFerror(const FnDescription *Desc, 797 const CallEvent &Call, CheckerContext &C, 798 const StreamErrorState &ErrorKind) const { 799 ProgramStateRef State = C.getState(); 800 SymbolRef StreamSym = getStreamArg(Desc, Call).getAsSymbol(); 801 assert(StreamSym && "Operation not permitted on non-symbolic stream value."); 802 const StreamState *SS = State->get<StreamMap>(StreamSym); 803 assert(SS && "Stream should be tracked by the checker."); 804 State = State->set<StreamMap>( 805 StreamSym, StreamState::getOpened(SS->LastOperation, ErrorKind)); 806 C.addTransition(State); 807 } 808 809 ProgramStateRef 810 StreamChecker::ensureStreamNonNull(SVal StreamVal, CheckerContext &C, 811 ProgramStateRef State) const { 812 auto Stream = StreamVal.getAs<DefinedSVal>(); 813 if (!Stream) 814 return State; 815 816 ConstraintManager &CM = C.getConstraintManager(); 817 818 ProgramStateRef StateNotNull, StateNull; 819 std::tie(StateNotNull, StateNull) = CM.assumeDual(C.getState(), *Stream); 820 821 if (!StateNotNull && StateNull) { 822 if (ExplodedNode *N = C.generateErrorNode(StateNull)) { 823 C.emitReport(std::make_unique<PathSensitiveBugReport>( 824 BT_FileNull, "Stream pointer might be NULL.", N)); 825 } 826 return nullptr; 827 } 828 829 return StateNotNull; 830 } 831 832 ProgramStateRef StreamChecker::ensureStreamOpened(SVal StreamVal, 833 CheckerContext &C, 834 ProgramStateRef State) const { 835 SymbolRef Sym = StreamVal.getAsSymbol(); 836 if (!Sym) 837 return State; 838 839 const StreamState *SS = State->get<StreamMap>(Sym); 840 if (!SS) 841 return State; 842 843 if (SS->isClosed()) { 844 // Using a stream pointer after 'fclose' causes undefined behavior 845 // according to cppreference.com . 846 ExplodedNode *N = C.generateErrorNode(); 847 if (N) { 848 C.emitReport(std::make_unique<PathSensitiveBugReport>( 849 BT_UseAfterClose, 850 "Stream might be already closed. Causes undefined behaviour.", N)); 851 return nullptr; 852 } 853 854 return State; 855 } 856 857 if (SS->isOpenFailed()) { 858 // Using a stream that has failed to open is likely to cause problems. 859 // This should usually not occur because stream pointer is NULL. 860 // But freopen can cause a state when stream pointer remains non-null but 861 // failed to open. 862 ExplodedNode *N = C.generateErrorNode(); 863 if (N) { 864 C.emitReport(std::make_unique<PathSensitiveBugReport>( 865 BT_UseAfterOpenFailed, 866 "Stream might be invalid after " 867 "(re-)opening it has failed. " 868 "Can cause undefined behaviour.", 869 N)); 870 return nullptr; 871 } 872 return State; 873 } 874 875 return State; 876 } 877 878 ProgramStateRef StreamChecker::ensureNoFilePositionIndeterminate( 879 SVal StreamVal, CheckerContext &C, ProgramStateRef State) const { 880 static const char *BugMessage = 881 "File position of the stream might be 'indeterminate' " 882 "after a failed operation. " 883 "Can cause undefined behavior."; 884 885 SymbolRef Sym = StreamVal.getAsSymbol(); 886 if (!Sym) 887 return State; 888 889 const StreamState *SS = State->get<StreamMap>(Sym); 890 if (!SS) 891 return State; 892 893 assert(SS->isOpened() && "First ensure that stream is opened."); 894 895 if (SS->FilePositionIndeterminate) { 896 if (SS->ErrorState & ErrorFEof) { 897 // The error is unknown but may be FEOF. 898 // Continue analysis with the FEOF error state. 899 // Report warning because the other possible error states. 900 ExplodedNode *N = C.generateNonFatalErrorNode(State); 901 if (!N) 902 return nullptr; 903 904 C.emitReport(std::make_unique<PathSensitiveBugReport>( 905 BT_IndeterminatePosition, BugMessage, N)); 906 return State->set<StreamMap>( 907 Sym, StreamState::getOpened(SS->LastOperation, ErrorFEof, false)); 908 } 909 910 // Known or unknown error state without FEOF possible. 911 // Stop analysis, report error. 912 ExplodedNode *N = C.generateErrorNode(State); 913 if (N) 914 C.emitReport(std::make_unique<PathSensitiveBugReport>( 915 BT_IndeterminatePosition, BugMessage, N)); 916 917 return nullptr; 918 } 919 920 return State; 921 } 922 923 ProgramStateRef 924 StreamChecker::ensureFseekWhenceCorrect(SVal WhenceVal, CheckerContext &C, 925 ProgramStateRef State) const { 926 Optional<nonloc::ConcreteInt> CI = WhenceVal.getAs<nonloc::ConcreteInt>(); 927 if (!CI) 928 return State; 929 930 int64_t X = CI->getValue().getSExtValue(); 931 if (X >= 0 && X <= 2) 932 return State; 933 934 if (ExplodedNode *N = C.generateNonFatalErrorNode(State)) { 935 C.emitReport(std::make_unique<PathSensitiveBugReport>( 936 BT_IllegalWhence, 937 "The whence argument to fseek() should be " 938 "SEEK_SET, SEEK_END, or SEEK_CUR.", 939 N)); 940 return nullptr; 941 } 942 943 return State; 944 } 945 946 void StreamChecker::reportFEofWarning(CheckerContext &C, 947 ProgramStateRef State) const { 948 if (ExplodedNode *N = C.generateNonFatalErrorNode(State)) { 949 C.emitReport(std::make_unique<PathSensitiveBugReport>( 950 BT_StreamEof, 951 "Read function called when stream is in EOF state. " 952 "Function has no effect.", 953 N)); 954 return; 955 } 956 C.addTransition(State); 957 } 958 959 void StreamChecker::checkDeadSymbols(SymbolReaper &SymReaper, 960 CheckerContext &C) const { 961 ProgramStateRef State = C.getState(); 962 963 // TODO: Clean up the state. 964 const StreamMapTy &Map = State->get<StreamMap>(); 965 for (const auto &I : Map) { 966 SymbolRef Sym = I.first; 967 const StreamState &SS = I.second; 968 if (!SymReaper.isDead(Sym) || !SS.isOpened()) 969 continue; 970 971 ExplodedNode *N = C.generateErrorNode(); 972 if (!N) 973 continue; 974 975 // Do not warn for non-closed stream at program exit. 976 ExplodedNode *Pred = C.getPredecessor(); 977 if (Pred && Pred->getCFGBlock() && 978 Pred->getCFGBlock()->hasNoReturnElement()) 979 continue; 980 981 // Resource leaks can result in multiple warning that describe the same kind 982 // of programming error: 983 // void f() { 984 // FILE *F = fopen("a.txt"); 985 // if (rand()) // state split 986 // return; // warning 987 // } // warning 988 // While this isn't necessarily true (leaking the same stream could result 989 // from a different kinds of errors), the reduction in redundant reports 990 // makes this a worthwhile heuristic. 991 // FIXME: Add a checker option to turn this uniqueing feature off. 992 993 const ExplodedNode *StreamOpenNode = getAcquisitionSite(N, Sym, C); 994 assert(StreamOpenNode && "Could not find place of stream opening."); 995 PathDiagnosticLocation LocUsedForUniqueing = 996 PathDiagnosticLocation::createBegin( 997 StreamOpenNode->getStmtForDiagnostics(), C.getSourceManager(), 998 StreamOpenNode->getLocationContext()); 999 1000 std::unique_ptr<PathSensitiveBugReport> R = 1001 std::make_unique<PathSensitiveBugReport>( 1002 BT_ResourceLeak, 1003 "Opened stream never closed. Potential resource leak.", N, 1004 LocUsedForUniqueing, 1005 StreamOpenNode->getLocationContext()->getDecl()); 1006 R->markInteresting(Sym); 1007 C.emitReport(std::move(R)); 1008 } 1009 } 1010 1011 ProgramStateRef StreamChecker::checkPointerEscape( 1012 ProgramStateRef State, const InvalidatedSymbols &Escaped, 1013 const CallEvent *Call, PointerEscapeKind Kind) const { 1014 // Check for file-handling system call that is not handled by the checker. 1015 // FIXME: The checker should be updated to handle all system calls that take 1016 // 'FILE*' argument. These are now ignored. 1017 if (Kind == PSK_DirectEscapeOnCall && Call->isInSystemHeader()) 1018 return State; 1019 1020 for (SymbolRef Sym : Escaped) { 1021 // The symbol escaped. 1022 // From now the stream can be manipulated in unknown way to the checker, 1023 // it is not possible to handle it any more. 1024 // Optimistically, assume that the corresponding file handle will be closed 1025 // somewhere else. 1026 // Remove symbol from state so the following stream calls on this symbol are 1027 // not handled by the checker. 1028 State = State->remove<StreamMap>(Sym); 1029 } 1030 return State; 1031 } 1032 1033 void ento::registerStreamChecker(CheckerManager &Mgr) { 1034 Mgr.registerChecker<StreamChecker>(); 1035 } 1036 1037 bool ento::shouldRegisterStreamChecker(const CheckerManager &Mgr) { 1038 return true; 1039 } 1040 1041 void ento::registerStreamTesterChecker(CheckerManager &Mgr) { 1042 auto *Checker = Mgr.getChecker<StreamChecker>(); 1043 Checker->TestMode = true; 1044 } 1045 1046 bool ento::shouldRegisterStreamTesterChecker(const CheckerManager &Mgr) { 1047 return true; 1048 } 1049