clang  10.0.0git
StreamChecker.cpp
Go to the documentation of this file.
1 //===-- StreamChecker.cpp -----------------------------------------*- C++ -*--//
2 //
3 // Part of the LLVM Project, under the Apache License v2.0 with LLVM Exceptions.
4 // See https://llvm.org/LICENSE.txt for license information.
5 // SPDX-License-Identifier: Apache-2.0 WITH LLVM-exception
6 //
7 //===----------------------------------------------------------------------===//
8 //
9 // This file defines checkers that model and check stream handling functions.
10 //
11 //===----------------------------------------------------------------------===//
12 
22 #include <functional>
23 
24 using namespace clang;
25 using namespace ento;
26 using namespace std::placeholders;
27 
28 namespace {
29 
30 struct StreamState {
31  enum Kind { Opened, Closed, OpenFailed, Escaped } K;
32 
33  StreamState(Kind k) : K(k) {}
34 
35  bool isOpened() const { return K == Opened; }
36  bool isClosed() const { return K == Closed; }
37  //bool isOpenFailed() const { return K == OpenFailed; }
38  //bool isEscaped() const { return K == Escaped; }
39 
40  bool operator==(const StreamState &X) const { return K == X.K; }
41 
42  static StreamState getOpened() { return StreamState(Opened); }
43  static StreamState getClosed() { return StreamState(Closed); }
44  static StreamState getOpenFailed() { return StreamState(OpenFailed); }
45  static StreamState getEscaped() { return StreamState(Escaped); }
46 
47  void Profile(llvm::FoldingSetNodeID &ID) const {
48  ID.AddInteger(K);
49  }
50 };
51 
52 class StreamChecker : public Checker<eval::Call,
53  check::DeadSymbols > {
54  mutable std::unique_ptr<BuiltinBug> BT_nullfp, BT_illegalwhence,
55  BT_doubleclose, BT_ResourceLeak;
56 
57 public:
58  bool evalCall(const CallEvent &Call, CheckerContext &C) const;
59  void checkDeadSymbols(SymbolReaper &SymReaper, CheckerContext &C) const;
60 
61 private:
62  using FnCheck = std::function<void(const StreamChecker *, const CallEvent &,
63  CheckerContext &)>;
64 
65  CallDescriptionMap<FnCheck> Callbacks = {
66  {{"fopen"}, &StreamChecker::evalFopen},
67  {{"freopen", 3}, &StreamChecker::evalFreopen},
68  {{"tmpfile"}, &StreamChecker::evalFopen},
69  {{"fclose", 1}, &StreamChecker::evalFclose},
70  {{"fread", 4},
71  std::bind(&StreamChecker::checkArgNullStream, _1, _2, _3, 3)},
72  {{"fwrite", 4},
73  std::bind(&StreamChecker::checkArgNullStream, _1, _2, _3, 3)},
74  {{"fseek", 3}, &StreamChecker::evalFseek},
75  {{"ftell", 1},
76  std::bind(&StreamChecker::checkArgNullStream, _1, _2, _3, 0)},
77  {{"rewind", 1},
78  std::bind(&StreamChecker::checkArgNullStream, _1, _2, _3, 0)},
79  {{"fgetpos", 2},
80  std::bind(&StreamChecker::checkArgNullStream, _1, _2, _3, 0)},
81  {{"fsetpos", 2},
82  std::bind(&StreamChecker::checkArgNullStream, _1, _2, _3, 0)},
83  {{"clearerr", 1},
84  std::bind(&StreamChecker::checkArgNullStream, _1, _2, _3, 0)},
85  {{"feof", 1},
86  std::bind(&StreamChecker::checkArgNullStream, _1, _2, _3, 0)},
87  {{"ferror", 1},
88  std::bind(&StreamChecker::checkArgNullStream, _1, _2, _3, 0)},
89  {{"fileno", 1},
90  std::bind(&StreamChecker::checkArgNullStream, _1, _2, _3, 0)},
91  };
92 
93  void evalFopen(const CallEvent &Call, CheckerContext &C) const;
94  void evalFreopen(const CallEvent &Call, CheckerContext &C) const;
95  void evalFclose(const CallEvent &Call, CheckerContext &C) const;
96  void evalFseek(const CallEvent &Call, CheckerContext &C) const;
97 
98  void checkArgNullStream(const CallEvent &Call, CheckerContext &C,
99  unsigned ArgI) const;
100  bool checkNullStream(SVal SV, CheckerContext &C,
101  ProgramStateRef &State) const;
102  void checkFseekWhence(SVal SV, CheckerContext &C,
103  ProgramStateRef &State) const;
104  bool checkDoubleClose(const CallEvent &Call, CheckerContext &C,
105  ProgramStateRef &State) const;
106 };
107 
108 } // end anonymous namespace
109 
110 REGISTER_MAP_WITH_PROGRAMSTATE(StreamMap, SymbolRef, StreamState)
111 
112 
113 bool StreamChecker::evalCall(const CallEvent &Call, CheckerContext &C) const {
114  const auto *FD = dyn_cast_or_null<FunctionDecl>(Call.getDecl());
115  if (!FD || FD->getKind() != Decl::Function)
116  return false;
117 
118  // Recognize "global C functions" with only integral or pointer arguments
119  // (and matching name) as stream functions.
120  if (!Call.isGlobalCFunction())
121  return false;
122  for (auto P : Call.parameters()) {
123  QualType T = P->getType();
124  if (!T->isIntegralOrEnumerationType() && !T->isPointerType())
125  return false;
126  }
127 
128  const FnCheck *Callback = Callbacks.lookup(Call);
129  if (!Callback)
130  return false;
131 
132  (*Callback)(this, Call, C);
133 
134  return C.isDifferent();
135 }
136 
137 void StreamChecker::evalFopen(const CallEvent &Call, CheckerContext &C) const {
138  ProgramStateRef state = C.getState();
139  SValBuilder &svalBuilder = C.getSValBuilder();
140  const LocationContext *LCtx = C.getPredecessor()->getLocationContext();
141  auto *CE = dyn_cast_or_null<CallExpr>(Call.getOriginExpr());
142  if (!CE)
143  return;
144 
145  DefinedSVal RetVal =
146  svalBuilder.conjureSymbolVal(nullptr, CE, LCtx, C.blockCount())
147  .castAs<DefinedSVal>();
148  state = state->BindExpr(CE, C.getLocationContext(), RetVal);
149 
150  ConstraintManager &CM = C.getConstraintManager();
151  // Bifurcate the state into two: one with a valid FILE* pointer, the other
152  // with a NULL.
153  ProgramStateRef stateNotNull, stateNull;
154  std::tie(stateNotNull, stateNull) = CM.assumeDual(state, RetVal);
155 
156  SymbolRef Sym = RetVal.getAsSymbol();
157  assert(Sym && "RetVal must be a symbol here.");
158  stateNotNull = stateNotNull->set<StreamMap>(Sym, StreamState::getOpened());
159  stateNull = stateNull->set<StreamMap>(Sym, StreamState::getOpenFailed());
160 
161  C.addTransition(stateNotNull);
162  C.addTransition(stateNull);
163 }
164 
165 void StreamChecker::evalFreopen(const CallEvent &Call,
166  CheckerContext &C) const {
167  ProgramStateRef State = C.getState();
168 
169  auto *CE = dyn_cast_or_null<CallExpr>(Call.getOriginExpr());
170  if (!CE)
171  return;
172 
173  Optional<DefinedSVal> StreamVal = Call.getArgSVal(2).getAs<DefinedSVal>();
174  if (!StreamVal)
175  return;
176  // Do not allow NULL as passed stream pointer.
177  // This is not specified in the man page but may crash on some system.
178  checkNullStream(*StreamVal, C, State);
179  // Check if error was generated.
180  if (C.isDifferent())
181  return;
182 
183  SymbolRef StreamSym = StreamVal->getAsSymbol();
184  // Do not care about special values for stream ("(FILE *)0x12345"?).
185  if (!StreamSym)
186  return;
187 
188  // Generate state for non-failed case.
189  // Return value is the passed stream pointer.
190  // According to the documentations, the stream is closed first
191  // but any close error is ignored. The state changes to (or remains) opened.
192  ProgramStateRef StateRetNotNull =
193  State->BindExpr(CE, C.getLocationContext(), *StreamVal);
194  // Generate state for NULL return value.
195  // Stream switches to OpenFailed state.
196  ProgramStateRef StateRetNull = State->BindExpr(CE, C.getLocationContext(),
197  C.getSValBuilder().makeNull());
198 
199  StateRetNotNull =
200  StateRetNotNull->set<StreamMap>(StreamSym, StreamState::getOpened());
201  StateRetNull =
202  StateRetNull->set<StreamMap>(StreamSym, StreamState::getOpenFailed());
203 
204  C.addTransition(StateRetNotNull);
205  C.addTransition(StateRetNull);
206 }
207 
208 void StreamChecker::evalFclose(const CallEvent &Call, CheckerContext &C) const {
209  ProgramStateRef State = C.getState();
210  if (checkDoubleClose(Call, C, State))
211  C.addTransition(State);
212 }
213 
214 void StreamChecker::evalFseek(const CallEvent &Call, CheckerContext &C) const {
215  const Expr *AE2 = Call.getArgExpr(2);
216  if (!AE2)
217  return;
218 
219  ProgramStateRef State = C.getState();
220 
221  bool StateChanged = checkNullStream(Call.getArgSVal(0), C, State);
222  // Check if error was generated.
223  if (C.isDifferent())
224  return;
225 
226  // Check the legality of the 'whence' argument of 'fseek'.
227  checkFseekWhence(State->getSVal(AE2, C.getLocationContext()), C, State);
228 
229  if (!C.isDifferent() && StateChanged)
230  C.addTransition(State);
231 
232  return;
233 }
234 
235 void StreamChecker::checkArgNullStream(const CallEvent &Call, CheckerContext &C,
236  unsigned ArgI) const {
237  ProgramStateRef State = C.getState();
238  if (checkNullStream(Call.getArgSVal(ArgI), C, State))
239  C.addTransition(State);
240 }
241 
242 bool StreamChecker::checkNullStream(SVal SV, CheckerContext &C,
243  ProgramStateRef &State) const {
244  Optional<DefinedSVal> DV = SV.getAs<DefinedSVal>();
245  if (!DV)
246  return false;
247 
248  ConstraintManager &CM = C.getConstraintManager();
249  ProgramStateRef StateNotNull, StateNull;
250  std::tie(StateNotNull, StateNull) = CM.assumeDual(C.getState(), *DV);
251 
252  if (!StateNotNull && StateNull) {
253  if (ExplodedNode *N = C.generateErrorNode(StateNull)) {
254  if (!BT_nullfp)
255  BT_nullfp.reset(new BuiltinBug(this, "NULL stream pointer",
256  "Stream pointer might be NULL."));
257  C.emitReport(std::make_unique<PathSensitiveBugReport>(
258  *BT_nullfp, BT_nullfp->getDescription(), N));
259  }
260  return false;
261  }
262 
263  if (StateNotNull) {
264  State = StateNotNull;
265  return true;
266  }
267 
268  return false;
269 }
270 
271 void StreamChecker::checkFseekWhence(SVal SV, CheckerContext &C,
272  ProgramStateRef &State) const {
273  Optional<nonloc::ConcreteInt> CI = SV.getAs<nonloc::ConcreteInt>();
274  if (!CI)
275  return;
276 
277  int64_t X = CI->getValue().getSExtValue();
278  if (X >= 0 && X <= 2)
279  return;
280 
281  if (ExplodedNode *N = C.generateNonFatalErrorNode(State)) {
282  if (!BT_illegalwhence)
283  BT_illegalwhence.reset(
284  new BuiltinBug(this, "Illegal whence argument",
285  "The whence argument to fseek() should be "
286  "SEEK_SET, SEEK_END, or SEEK_CUR."));
287  C.emitReport(std::make_unique<PathSensitiveBugReport>(
288  *BT_illegalwhence, BT_illegalwhence->getDescription(), N));
289  }
290 }
291 
292 bool StreamChecker::checkDoubleClose(const CallEvent &Call, CheckerContext &C,
293  ProgramStateRef &State) const {
294  SymbolRef Sym = Call.getArgSVal(0).getAsSymbol();
295  if (!Sym)
296  return false;
297 
298  const StreamState *SS = State->get<StreamMap>(Sym);
299 
300  // If the file stream is not tracked, return.
301  if (!SS)
302  return false;
303 
304  // Check: Double close a File Descriptor could cause undefined behaviour.
305  // Conforming to man-pages
306  if (SS->isClosed()) {
307  ExplodedNode *N = C.generateErrorNode();
308  if (N) {
309  if (!BT_doubleclose)
310  BT_doubleclose.reset(new BuiltinBug(
311  this, "Double fclose", "Try to close a file Descriptor already"
312  " closed. Cause undefined behaviour."));
313  C.emitReport(std::make_unique<PathSensitiveBugReport>(
314  *BT_doubleclose, BT_doubleclose->getDescription(), N));
315  }
316  return false;
317  }
318 
319  // Close the File Descriptor.
320  State = State->set<StreamMap>(Sym, StreamState::getClosed());
321 
322  return true;
323 }
324 
325 void StreamChecker::checkDeadSymbols(SymbolReaper &SymReaper,
326  CheckerContext &C) const {
327  ProgramStateRef State = C.getState();
328 
329  // TODO: Clean up the state.
330  const StreamMapTy &Map = State->get<StreamMap>();
331  for (const auto &I: Map) {
332  SymbolRef Sym = I.first;
333  const StreamState &SS = I.second;
334  if (!SymReaper.isDead(Sym) || !SS.isOpened())
335  continue;
336 
337  ExplodedNode *N = C.generateErrorNode();
338  if (!N)
339  continue;
340 
341  if (!BT_ResourceLeak)
342  BT_ResourceLeak.reset(
343  new BuiltinBug(this, "Resource Leak",
344  "Opened File never closed. Potential Resource leak."));
345  C.emitReport(std::make_unique<PathSensitiveBugReport>(
346  *BT_ResourceLeak, BT_ResourceLeak->getDescription(), N));
347  }
348 }
349 
350 void ento::registerStreamChecker(CheckerManager &mgr) {
351  mgr.registerChecker<StreamChecker>();
352 }
353 
354 bool ento::shouldRegisterStreamChecker(const LangOptions &LO) {
355  return true;
356 }
A (possibly-)qualified type.
Definition: Type.h:654
bool operator==(CanQual< T > x, CanQual< U > y)
IntrusiveRefCntPtr< const ProgramState > ProgramStateRef
StringRef P
constexpr XRayInstrMask Function
Definition: XRayInstr.h:38
const SymExpr * SymbolRef
Definition: SymExpr.h:110
LineState State
Keeps track of the various options that can be enabled, which controls the dialect of C or C++ that i...
Definition: LangOptions.h:53
i32 captured_struct **param SharedsTy A type which contains references the shared variables *param Shareds Context with the list of shared variables from the p *TaskFunction *param Data Additional data for task generation like final * state
bool isIntegralOrEnumerationType() const
Determine whether this type is an integral or enumeration type.
Definition: Type.h:6881
This represents one expression.
Definition: Expr.h:108
Kind
#define REGISTER_MAP_WITH_PROGRAMSTATE(Name, Key, Value)
Declares an immutable map of type NameTy, suitable for placement into the ProgramState.
Dataflow Directional Tag Classes.
X
Add a minimal nested name specifier fixit hint to allow lookup of a tag name from an outer enclosing ...
Definition: SemaDecl.cpp:14781
An immutable map from CallDescriptions to arbitrary data.
Definition: CallEvent.h:1110
bool isPointerType() const
Definition: Type.h:6504