1 //== ValistChecker.cpp - stdarg.h macro usage checker -----------*- C++ -*--==// 2 // 3 // Part of the LLVM Project, under the Apache License v2.0 with LLVM Exceptions. 4 // See https://llvm.org/LICENSE.txt for license information. 5 // SPDX-License-Identifier: Apache-2.0 WITH LLVM-exception 6 // 7 //===----------------------------------------------------------------------===// 8 // 9 // This defines checkers which detect usage of uninitialized va_list values 10 // and va_start calls with no matching va_end. 11 // 12 //===----------------------------------------------------------------------===// 13 14 #include "clang/StaticAnalyzer/Checkers/BuiltinCheckerRegistration.h" 15 #include "clang/StaticAnalyzer/Core/BugReporter/BugType.h" 16 #include "clang/StaticAnalyzer/Core/Checker.h" 17 #include "clang/StaticAnalyzer/Core/CheckerManager.h" 18 #include "clang/StaticAnalyzer/Core/PathSensitive/CallEvent.h" 19 #include "clang/StaticAnalyzer/Core/PathSensitive/CheckerContext.h" 20 21 using namespace clang; 22 using namespace ento; 23 24 REGISTER_SET_WITH_PROGRAMSTATE(InitializedVALists, const MemRegion *) 25 26 namespace { 27 typedef SmallVector<const MemRegion *, 2> RegionVector; 28 29 class ValistChecker : public Checker<check::PreCall, check::PreStmt<VAArgExpr>, 30 check::DeadSymbols> { 31 mutable std::unique_ptr<BugType> BT_leakedvalist, BT_uninitaccess; 32 33 struct VAListAccepter { 34 CallDescription Func; 35 int VAListPos; 36 }; 37 static const SmallVector<VAListAccepter, 15> VAListAccepters; 38 static const CallDescription VaStart, VaEnd, VaCopy; 39 40 public: 41 enum CheckKind { 42 CK_Uninitialized, 43 CK_Unterminated, 44 CK_CopyToSelf, 45 CK_NumCheckKinds 46 }; 47 48 DefaultBool ChecksEnabled[CK_NumCheckKinds]; 49 CheckerNameRef CheckNames[CK_NumCheckKinds]; 50 51 void checkPreStmt(const VAArgExpr *VAA, CheckerContext &C) const; 52 void checkPreCall(const CallEvent &Call, CheckerContext &C) const; 53 void checkDeadSymbols(SymbolReaper &SR, CheckerContext &C) const; 54 55 private: 56 const MemRegion *getVAListAsRegion(SVal SV, const Expr *VAExpr, 57 bool &IsSymbolic, CheckerContext &C) const; 58 const ExplodedNode *getStartCallSite(const ExplodedNode *N, 59 const MemRegion *Reg) const; 60 61 void reportUninitializedAccess(const MemRegion *VAList, StringRef Msg, 62 CheckerContext &C) const; 63 void reportLeakedVALists(const RegionVector &LeakedVALists, StringRef Msg1, 64 StringRef Msg2, CheckerContext &C, ExplodedNode *N, 65 bool ReportUninit = false) const; 66 67 void checkVAListStartCall(const CallEvent &Call, CheckerContext &C, 68 bool IsCopy) const; 69 void checkVAListEndCall(const CallEvent &Call, CheckerContext &C) const; 70 71 class ValistBugVisitor : public BugReporterVisitor { 72 public: 73 ValistBugVisitor(const MemRegion *Reg, bool IsLeak = false) 74 : Reg(Reg), IsLeak(IsLeak) {} 75 void Profile(llvm::FoldingSetNodeID &ID) const override { 76 static int X = 0; 77 ID.AddPointer(&X); 78 ID.AddPointer(Reg); 79 } 80 PathDiagnosticPieceRef getEndPath(BugReporterContext &BRC, 81 const ExplodedNode *EndPathNode, 82 PathSensitiveBugReport &BR) override { 83 if (!IsLeak) 84 return nullptr; 85 86 PathDiagnosticLocation L = BR.getLocation(); 87 // Do not add the statement itself as a range in case of leak. 88 return std::make_shared<PathDiagnosticEventPiece>(L, BR.getDescription(), 89 false); 90 } 91 PathDiagnosticPieceRef VisitNode(const ExplodedNode *N, 92 BugReporterContext &BRC, 93 PathSensitiveBugReport &BR) override; 94 95 private: 96 const MemRegion *Reg; 97 bool IsLeak; 98 }; 99 }; 100 101 const SmallVector<ValistChecker::VAListAccepter, 15> 102 ValistChecker::VAListAccepters = { 103 {{"vfprintf", 3}, 2}, 104 {{"vfscanf", 3}, 2}, 105 {{"vprintf", 2}, 1}, 106 {{"vscanf", 2}, 1}, 107 {{"vsnprintf", 4}, 3}, 108 {{"vsprintf", 3}, 2}, 109 {{"vsscanf", 3}, 2}, 110 {{"vfwprintf", 3}, 2}, 111 {{"vfwscanf", 3}, 2}, 112 {{"vwprintf", 2}, 1}, 113 {{"vwscanf", 2}, 1}, 114 {{"vswprintf", 4}, 3}, 115 // vswprintf is the wide version of vsnprintf, 116 // vsprintf has no wide version 117 {{"vswscanf", 3}, 2}}; 118 119 const CallDescription 120 ValistChecker::VaStart("__builtin_va_start", /*Args=*/2, /*Params=*/1), 121 ValistChecker::VaCopy("__builtin_va_copy", 2), 122 ValistChecker::VaEnd("__builtin_va_end", 1); 123 } // end anonymous namespace 124 125 void ValistChecker::checkPreCall(const CallEvent &Call, 126 CheckerContext &C) const { 127 if (!Call.isGlobalCFunction()) 128 return; 129 if (Call.isCalled(VaStart)) 130 checkVAListStartCall(Call, C, false); 131 else if (Call.isCalled(VaCopy)) 132 checkVAListStartCall(Call, C, true); 133 else if (Call.isCalled(VaEnd)) 134 checkVAListEndCall(Call, C); 135 else { 136 for (auto FuncInfo : VAListAccepters) { 137 if (!Call.isCalled(FuncInfo.Func)) 138 continue; 139 bool Symbolic; 140 const MemRegion *VAList = 141 getVAListAsRegion(Call.getArgSVal(FuncInfo.VAListPos), 142 Call.getArgExpr(FuncInfo.VAListPos), Symbolic, C); 143 if (!VAList) 144 return; 145 146 if (C.getState()->contains<InitializedVALists>(VAList)) 147 return; 148 149 // We did not see va_start call, but the source of the region is unknown. 150 // Be conservative and assume the best. 151 if (Symbolic) 152 return; 153 154 SmallString<80> Errmsg("Function '"); 155 Errmsg += FuncInfo.Func.getFunctionName(); 156 Errmsg += "' is called with an uninitialized va_list argument"; 157 reportUninitializedAccess(VAList, Errmsg.c_str(), C); 158 break; 159 } 160 } 161 } 162 163 const MemRegion *ValistChecker::getVAListAsRegion(SVal SV, const Expr *E, 164 bool &IsSymbolic, 165 CheckerContext &C) const { 166 const MemRegion *Reg = SV.getAsRegion(); 167 if (!Reg) 168 return nullptr; 169 // TODO: In the future this should be abstracted away by the analyzer. 170 bool VaListModelledAsArray = false; 171 if (const auto *Cast = dyn_cast<CastExpr>(E)) { 172 QualType Ty = Cast->getType(); 173 VaListModelledAsArray = 174 Ty->isPointerType() && Ty->getPointeeType()->isRecordType(); 175 } 176 if (const auto *DeclReg = Reg->getAs<DeclRegion>()) { 177 if (isa<ParmVarDecl>(DeclReg->getDecl())) 178 Reg = C.getState()->getSVal(SV.castAs<Loc>()).getAsRegion(); 179 } 180 IsSymbolic = Reg && Reg->getAs<SymbolicRegion>(); 181 // Some VarRegion based VA lists reach here as ElementRegions. 182 const auto *EReg = dyn_cast_or_null<ElementRegion>(Reg); 183 return (EReg && VaListModelledAsArray) ? EReg->getSuperRegion() : Reg; 184 } 185 186 void ValistChecker::checkPreStmt(const VAArgExpr *VAA, 187 CheckerContext &C) const { 188 ProgramStateRef State = C.getState(); 189 const Expr *VASubExpr = VAA->getSubExpr(); 190 SVal VAListSVal = C.getSVal(VASubExpr); 191 bool Symbolic; 192 const MemRegion *VAList = 193 getVAListAsRegion(VAListSVal, VASubExpr, Symbolic, C); 194 if (!VAList) 195 return; 196 if (Symbolic) 197 return; 198 if (!State->contains<InitializedVALists>(VAList)) 199 reportUninitializedAccess( 200 VAList, "va_arg() is called on an uninitialized va_list", C); 201 } 202 203 void ValistChecker::checkDeadSymbols(SymbolReaper &SR, 204 CheckerContext &C) const { 205 ProgramStateRef State = C.getState(); 206 InitializedVAListsTy TrackedVALists = State->get<InitializedVALists>(); 207 RegionVector LeakedVALists; 208 for (auto Reg : TrackedVALists) { 209 if (SR.isLiveRegion(Reg)) 210 continue; 211 LeakedVALists.push_back(Reg); 212 State = State->remove<InitializedVALists>(Reg); 213 } 214 if (ExplodedNode *N = C.addTransition(State)) 215 reportLeakedVALists(LeakedVALists, "Initialized va_list", " is leaked", C, 216 N); 217 } 218 219 // This function traverses the exploded graph backwards and finds the node where 220 // the va_list is initialized. That node is used for uniquing the bug paths. 221 // It is not likely that there are several different va_lists that belongs to 222 // different stack frames, so that case is not yet handled. 223 const ExplodedNode * 224 ValistChecker::getStartCallSite(const ExplodedNode *N, 225 const MemRegion *Reg) const { 226 const LocationContext *LeakContext = N->getLocationContext(); 227 const ExplodedNode *StartCallNode = N; 228 229 bool FoundInitializedState = false; 230 231 while (N) { 232 ProgramStateRef State = N->getState(); 233 if (!State->contains<InitializedVALists>(Reg)) { 234 if (FoundInitializedState) 235 break; 236 } else { 237 FoundInitializedState = true; 238 } 239 const LocationContext *NContext = N->getLocationContext(); 240 if (NContext == LeakContext || NContext->isParentOf(LeakContext)) 241 StartCallNode = N; 242 N = N->pred_empty() ? nullptr : *(N->pred_begin()); 243 } 244 245 return StartCallNode; 246 } 247 248 void ValistChecker::reportUninitializedAccess(const MemRegion *VAList, 249 StringRef Msg, 250 CheckerContext &C) const { 251 if (!ChecksEnabled[CK_Uninitialized]) 252 return; 253 if (ExplodedNode *N = C.generateErrorNode()) { 254 if (!BT_uninitaccess) 255 BT_uninitaccess.reset(new BugType(CheckNames[CK_Uninitialized], 256 "Uninitialized va_list", 257 categories::MemoryError)); 258 auto R = std::make_unique<PathSensitiveBugReport>(*BT_uninitaccess, Msg, N); 259 R->markInteresting(VAList); 260 R->addVisitor(std::make_unique<ValistBugVisitor>(VAList)); 261 C.emitReport(std::move(R)); 262 } 263 } 264 265 void ValistChecker::reportLeakedVALists(const RegionVector &LeakedVALists, 266 StringRef Msg1, StringRef Msg2, 267 CheckerContext &C, ExplodedNode *N, 268 bool ReportUninit) const { 269 if (!(ChecksEnabled[CK_Unterminated] || 270 (ChecksEnabled[CK_Uninitialized] && ReportUninit))) 271 return; 272 for (auto Reg : LeakedVALists) { 273 if (!BT_leakedvalist) { 274 // FIXME: maybe creating a new check name for this type of bug is a better 275 // solution. 276 BT_leakedvalist.reset( 277 new BugType(CheckNames[CK_Unterminated].getName().empty() 278 ? CheckNames[CK_Uninitialized] 279 : CheckNames[CK_Unterminated], 280 "Leaked va_list", categories::MemoryError, 281 /*SuppressOnSink=*/true)); 282 } 283 284 const ExplodedNode *StartNode = getStartCallSite(N, Reg); 285 PathDiagnosticLocation LocUsedForUniqueing; 286 287 if (const Stmt *StartCallStmt = StartNode->getStmtForDiagnostics()) 288 LocUsedForUniqueing = PathDiagnosticLocation::createBegin( 289 StartCallStmt, C.getSourceManager(), StartNode->getLocationContext()); 290 291 SmallString<100> Buf; 292 llvm::raw_svector_ostream OS(Buf); 293 OS << Msg1; 294 std::string VariableName = Reg->getDescriptiveName(); 295 if (!VariableName.empty()) 296 OS << " " << VariableName; 297 OS << Msg2; 298 299 auto R = std::make_unique<PathSensitiveBugReport>( 300 *BT_leakedvalist, OS.str(), N, LocUsedForUniqueing, 301 StartNode->getLocationContext()->getDecl()); 302 R->markInteresting(Reg); 303 R->addVisitor(std::make_unique<ValistBugVisitor>(Reg, true)); 304 C.emitReport(std::move(R)); 305 } 306 } 307 308 void ValistChecker::checkVAListStartCall(const CallEvent &Call, 309 CheckerContext &C, bool IsCopy) const { 310 bool Symbolic; 311 const MemRegion *VAList = 312 getVAListAsRegion(Call.getArgSVal(0), Call.getArgExpr(0), Symbolic, C); 313 if (!VAList) 314 return; 315 316 ProgramStateRef State = C.getState(); 317 318 if (IsCopy) { 319 const MemRegion *Arg2 = 320 getVAListAsRegion(Call.getArgSVal(1), Call.getArgExpr(1), Symbolic, C); 321 if (Arg2) { 322 if (ChecksEnabled[CK_CopyToSelf] && VAList == Arg2) { 323 RegionVector LeakedVALists{VAList}; 324 if (ExplodedNode *N = C.addTransition(State)) 325 reportLeakedVALists(LeakedVALists, "va_list", 326 " is copied onto itself", C, N, true); 327 return; 328 } else if (!State->contains<InitializedVALists>(Arg2) && !Symbolic) { 329 if (State->contains<InitializedVALists>(VAList)) { 330 State = State->remove<InitializedVALists>(VAList); 331 RegionVector LeakedVALists{VAList}; 332 if (ExplodedNode *N = C.addTransition(State)) 333 reportLeakedVALists(LeakedVALists, "Initialized va_list", 334 " is overwritten by an uninitialized one", C, N, 335 true); 336 } else { 337 reportUninitializedAccess(Arg2, "Uninitialized va_list is copied", C); 338 } 339 return; 340 } 341 } 342 } 343 if (State->contains<InitializedVALists>(VAList)) { 344 RegionVector LeakedVALists{VAList}; 345 if (ExplodedNode *N = C.addTransition(State)) 346 reportLeakedVALists(LeakedVALists, "Initialized va_list", 347 " is initialized again", C, N); 348 return; 349 } 350 351 State = State->add<InitializedVALists>(VAList); 352 C.addTransition(State); 353 } 354 355 void ValistChecker::checkVAListEndCall(const CallEvent &Call, 356 CheckerContext &C) const { 357 bool Symbolic; 358 const MemRegion *VAList = 359 getVAListAsRegion(Call.getArgSVal(0), Call.getArgExpr(0), Symbolic, C); 360 if (!VAList) 361 return; 362 363 // We did not see va_start call, but the source of the region is unknown. 364 // Be conservative and assume the best. 365 if (Symbolic) 366 return; 367 368 if (!C.getState()->contains<InitializedVALists>(VAList)) { 369 reportUninitializedAccess( 370 VAList, "va_end() is called on an uninitialized va_list", C); 371 return; 372 } 373 ProgramStateRef State = C.getState(); 374 State = State->remove<InitializedVALists>(VAList); 375 C.addTransition(State); 376 } 377 378 PathDiagnosticPieceRef ValistChecker::ValistBugVisitor::VisitNode( 379 const ExplodedNode *N, BugReporterContext &BRC, PathSensitiveBugReport &) { 380 ProgramStateRef State = N->getState(); 381 ProgramStateRef StatePrev = N->getFirstPred()->getState(); 382 383 const Stmt *S = N->getStmtForDiagnostics(); 384 if (!S) 385 return nullptr; 386 387 StringRef Msg; 388 if (State->contains<InitializedVALists>(Reg) && 389 !StatePrev->contains<InitializedVALists>(Reg)) 390 Msg = "Initialized va_list"; 391 else if (!State->contains<InitializedVALists>(Reg) && 392 StatePrev->contains<InitializedVALists>(Reg)) 393 Msg = "Ended va_list"; 394 395 if (Msg.empty()) 396 return nullptr; 397 398 PathDiagnosticLocation Pos(S, BRC.getSourceManager(), 399 N->getLocationContext()); 400 return std::make_shared<PathDiagnosticEventPiece>(Pos, Msg, true); 401 } 402 403 void ento::registerValistBase(CheckerManager &mgr) { 404 mgr.registerChecker<ValistChecker>(); 405 } 406 407 bool ento::shouldRegisterValistBase(const CheckerManager &mgr) { 408 return true; 409 } 410 411 #define REGISTER_CHECKER(name) \ 412 void ento::register##name##Checker(CheckerManager &mgr) { \ 413 ValistChecker *checker = mgr.getChecker<ValistChecker>(); \ 414 checker->ChecksEnabled[ValistChecker::CK_##name] = true; \ 415 checker->CheckNames[ValistChecker::CK_##name] = \ 416 mgr.getCurrentCheckerName(); \ 417 } \ 418 \ 419 bool ento::shouldRegister##name##Checker(const CheckerManager &mgr) { \ 420 return true; \ 421 } 422 423 REGISTER_CHECKER(Uninitialized) 424 REGISTER_CHECKER(Unterminated) 425 REGISTER_CHECKER(CopyToSelf) 426