21 using namespace clang;
29 class ValistChecker :
public Checker<check::PreCall, check::PreStmt<VAArgExpr>,
31 mutable std::unique_ptr<BugType> BT_leakedvalist, BT_uninitaccess;
33 struct VAListAccepter {
48 DefaultBool ChecksEnabled[CK_NumCheckKinds];
49 CheckerNameRef CheckNames[CK_NumCheckKinds];
51 void checkPreStmt(
const VAArgExpr *VAA, CheckerContext &C)
const;
52 void checkPreCall(
const CallEvent &Call, CheckerContext &C)
const;
53 void checkDeadSymbols(SymbolReaper &SR, CheckerContext &C)
const;
56 const MemRegion *getVAListAsRegion(SVal SV,
const Expr *VAExpr,
57 bool &IsSymbolic, CheckerContext &C)
const;
58 const ExplodedNode *getStartCallSite(
const ExplodedNode *N,
59 const MemRegion *Reg)
const;
61 void reportUninitializedAccess(
const MemRegion *VAList, StringRef Msg,
62 CheckerContext &C)
const;
63 void reportLeakedVALists(
const RegionVector &LeakedVALists, StringRef Msg1,
64 StringRef Msg2, CheckerContext &C, ExplodedNode *N,
65 bool ReportUninit =
false)
const;
67 void checkVAListStartCall(
const CallEvent &Call, CheckerContext &C,
69 void checkVAListEndCall(
const CallEvent &Call, CheckerContext &C)
const;
73 ValistBugVisitor(
const MemRegion *Reg,
bool IsLeak =
false)
74 : Reg(Reg), IsLeak(IsLeak) {}
75 void Profile(llvm::FoldingSetNodeID &
ID)
const override {
81 const ExplodedNode *EndPathNode,
82 PathSensitiveBugReport &BR)
override {
86 PathDiagnosticLocation L = BR.getLocation();
88 return std::make_shared<PathDiagnosticEventPiece>(L, BR.getDescription(),
92 BugReporterContext &BRC,
93 PathSensitiveBugReport &BR)
override;
102 ValistChecker::VAListAccepters = {
103 {{
"vfprintf", 3}, 2},
107 {{
"vsnprintf", 4}, 3},
108 {{
"vsprintf", 3}, 2},
110 {{
"vfwprintf", 3}, 2},
111 {{
"vfwscanf", 3}, 2},
112 {{
"vwprintf", 2}, 1},
114 {{
"vswprintf", 4}, 3},
117 {{
"vswscanf", 3}, 2}};
120 ValistChecker::VaStart(
"__builtin_va_start", 2, 1),
121 ValistChecker::VaCopy(
"__builtin_va_copy", 2),
122 ValistChecker::VaEnd(
"__builtin_va_end", 1);
125 void ValistChecker::checkPreCall(
const CallEvent &Call,
126 CheckerContext &C)
const {
127 if (!Call.isGlobalCFunction())
129 if (Call.isCalled(VaStart))
130 checkVAListStartCall(Call, C,
false);
131 else if (Call.isCalled(VaCopy))
132 checkVAListStartCall(Call, C,
true);
133 else if (Call.isCalled(VaEnd))
134 checkVAListEndCall(Call, C);
136 for (
auto FuncInfo : VAListAccepters) {
137 if (!Call.isCalled(FuncInfo.Func))
140 const MemRegion *VAList =
141 getVAListAsRegion(Call.getArgSVal(FuncInfo.VAListPos),
142 Call.getArgExpr(FuncInfo.VAListPos), Symbolic, C);
146 if (C.getState()->contains<InitializedVALists>(VAList))
155 Errmsg += FuncInfo.Func.getFunctionName();
156 Errmsg +=
"' is called with an uninitialized va_list argument";
157 reportUninitializedAccess(VAList, Errmsg.c_str(), C);
163 const MemRegion *ValistChecker::getVAListAsRegion(SVal SV,
const Expr *E,
165 CheckerContext &C)
const {
166 const MemRegion *Reg = SV.getAsRegion();
170 bool VaListModelledAsArray =
false;
171 if (
const auto *
Cast = dyn_cast<CastExpr>(E)) {
173 VaListModelledAsArray =
176 if (
const auto *DeclReg = Reg->getAs<DeclRegion>()) {
177 if (isa<ParmVarDecl>(DeclReg->getDecl()))
178 Reg = C.getState()->getSVal(SV.castAs<Loc>()).getAsRegion();
180 IsSymbolic = Reg && Reg->getAs<SymbolicRegion>();
182 const auto *EReg = dyn_cast_or_null<ElementRegion>(Reg);
183 return (EReg && VaListModelledAsArray) ? EReg->getSuperRegion() : Reg;
186 void ValistChecker::checkPreStmt(
const VAArgExpr *VAA,
187 CheckerContext &C)
const {
190 SVal VAListSVal = C.getSVal(VASubExpr);
192 const MemRegion *VAList =
193 getVAListAsRegion(VAListSVal, VASubExpr, Symbolic, C);
198 if (!State->contains<InitializedVALists>(VAList))
199 reportUninitializedAccess(
200 VAList,
"va_arg() is called on an uninitialized va_list", C);
203 void ValistChecker::checkDeadSymbols(SymbolReaper &SR,
204 CheckerContext &C)
const {
206 InitializedVAListsTy TrackedVALists = State->get<InitializedVALists>();
207 RegionVector LeakedVALists;
208 for (
auto Reg : TrackedVALists) {
209 if (SR.isLiveRegion(Reg))
211 LeakedVALists.push_back(Reg);
212 State = State->remove<InitializedVALists>(Reg);
214 if (ExplodedNode *N = C.addTransition(State))
215 reportLeakedVALists(LeakedVALists,
"Initialized va_list",
" is leaked", C,
224 ValistChecker::getStartCallSite(
const ExplodedNode *N,
225 const MemRegion *Reg)
const {
227 const ExplodedNode *StartCallNode = N;
229 bool FoundInitializedState =
false;
233 if (!State->contains<InitializedVALists>(Reg)) {
234 if (FoundInitializedState)
237 FoundInitializedState =
true;
240 if (NContext == LeakContext || NContext->
isParentOf(LeakContext))
242 N = N->pred_empty() ? nullptr : *(N->pred_begin());
245 return StartCallNode;
248 void ValistChecker::reportUninitializedAccess(
const MemRegion *VAList,
250 CheckerContext &C)
const {
251 if (!ChecksEnabled[CK_Uninitialized])
253 if (ExplodedNode *N = C.generateErrorNode()) {
254 if (!BT_uninitaccess)
255 BT_uninitaccess.reset(
new BugType(CheckNames[CK_Uninitialized],
256 "Uninitialized va_list",
258 auto R = std::make_unique<PathSensitiveBugReport>(*BT_uninitaccess, Msg, N);
259 R->markInteresting(VAList);
260 R->addVisitor(std::make_unique<ValistBugVisitor>(VAList));
261 C.emitReport(std::move(R));
265 void ValistChecker::reportLeakedVALists(
const RegionVector &LeakedVALists,
266 StringRef Msg1, StringRef Msg2,
267 CheckerContext &C, ExplodedNode *N,
268 bool ReportUninit)
const {
269 if (!(ChecksEnabled[CK_Unterminated] ||
270 (ChecksEnabled[CK_Uninitialized] && ReportUninit)))
272 for (
auto Reg : LeakedVALists) {
273 if (!BT_leakedvalist) {
276 BT_leakedvalist.reset(
277 new BugType(CheckNames[CK_Unterminated].
getName().empty()
278 ? CheckNames[CK_Uninitialized]
279 : CheckNames[CK_Unterminated],
284 const ExplodedNode *StartNode = getStartCallSite(N, Reg);
285 PathDiagnosticLocation LocUsedForUniqueing;
287 if (
const Stmt *StartCallStmt = StartNode->getStmtForDiagnostics())
289 StartCallStmt, C.getSourceManager(), StartNode->getLocationContext());
292 llvm::raw_svector_ostream
OS(Buf);
294 std::string VariableName = Reg->getDescriptiveName();
295 if (!VariableName.empty())
296 OS <<
" " << VariableName;
299 auto R = std::make_unique<PathSensitiveBugReport>(
300 *BT_leakedvalist,
OS.str(), N, LocUsedForUniqueing,
301 StartNode->getLocationContext()->getDecl());
302 R->markInteresting(Reg);
303 R->addVisitor(std::make_unique<ValistBugVisitor>(Reg,
true));
304 C.emitReport(std::move(R));
308 void ValistChecker::checkVAListStartCall(
const CallEvent &Call,
309 CheckerContext &C,
bool IsCopy)
const {
311 const MemRegion *VAList =
312 getVAListAsRegion(Call.getArgSVal(0), Call.getArgExpr(0), Symbolic, C);
319 const MemRegion *Arg2 =
320 getVAListAsRegion(Call.getArgSVal(1), Call.getArgExpr(1), Symbolic, C);
322 if (ChecksEnabled[CK_CopyToSelf] && VAList == Arg2) {
323 RegionVector LeakedVALists{VAList};
324 if (ExplodedNode *N = C.addTransition(State))
325 reportLeakedVALists(LeakedVALists,
"va_list",
326 " is copied onto itself", C, N,
true);
328 }
else if (!State->contains<InitializedVALists>(Arg2) && !Symbolic) {
329 if (State->contains<InitializedVALists>(VAList)) {
330 State = State->remove<InitializedVALists>(VAList);
331 RegionVector LeakedVALists{VAList};
332 if (ExplodedNode *N = C.addTransition(State))
333 reportLeakedVALists(LeakedVALists,
"Initialized va_list",
334 " is overwritten by an uninitialized one", C, N,
337 reportUninitializedAccess(Arg2,
"Uninitialized va_list is copied", C);
343 if (State->contains<InitializedVALists>(VAList)) {
344 RegionVector LeakedVALists{VAList};
345 if (ExplodedNode *N = C.addTransition(State))
346 reportLeakedVALists(LeakedVALists,
"Initialized va_list",
347 " is initialized again", C, N);
351 State = State->add<InitializedVALists>(VAList);
352 C.addTransition(State);
355 void ValistChecker::checkVAListEndCall(
const CallEvent &Call,
356 CheckerContext &C)
const {
358 const MemRegion *VAList =
359 getVAListAsRegion(Call.getArgSVal(0), Call.getArgExpr(0), Symbolic, C);
368 if (!C.getState()->contains<InitializedVALists>(VAList)) {
369 reportUninitializedAccess(
370 VAList,
"va_end() is called on an uninitialized va_list", C);
374 State = State->remove<InitializedVALists>(VAList);
375 C.addTransition(State);
379 const ExplodedNode *N, BugReporterContext &BRC, PathSensitiveBugReport &) {
383 const Stmt *S = N->getStmtForDiagnostics();
388 if (State->contains<InitializedVALists>(Reg) &&
389 !StatePrev->contains<InitializedVALists>(Reg))
390 Msg =
"Initialized va_list";
391 else if (!State->contains<InitializedVALists>(Reg) &&
392 StatePrev->contains<InitializedVALists>(Reg))
393 Msg =
"Ended va_list";
398 PathDiagnosticLocation Pos(S, BRC.getSourceManager(),
399 N->getLocationContext());
400 return std::make_shared<PathDiagnosticEventPiece>(Pos, Msg,
true);
403 void ento::registerValistBase(CheckerManager &mgr) {
404 mgr.registerChecker<ValistChecker>();
407 bool ento::shouldRegisterValistBase(
const LangOptions &LO) {
411 #define REGISTER_CHECKER(name) \ 412 void ento::register##name##Checker(CheckerManager &mgr) { \ 413 ValistChecker *checker = mgr.getChecker<ValistChecker>(); \ 414 checker->ChecksEnabled[ValistChecker::CK_##name] = true; \ 415 checker->CheckNames[ValistChecker::CK_##name] = \ 416 mgr.getCurrentCheckerName(); \ 419 bool ento::shouldRegister##name##Checker(const LangOptions &LO) { \
bool Cast(InterpState &S, CodePtr OpPC)
A (possibly-)qualified type.
const char *const MemoryError
Stmt - This represents one statement.
QualType getPointeeType() const
If this is a pointer, ObjC object pointer, or block pointer, this returns the respective pointee...
bool isRecordType() const
IntrusiveRefCntPtr< const ProgramState > ProgramStateRef
const Expr * getSubExpr() const
bool isParentOf(const LocationContext *LC) const
Keeps track of the various options that can be enabled, which controls the dialect of C or C++ that i...
std::shared_ptr< PathDiagnosticPiece > PathDiagnosticPieceRef
This class represents a description of a function call using the number of arguments and the name of ...
Represents a call to the builtin function __builtin_va_arg.
This represents one expression.
static PathDiagnosticLocation createBegin(const Decl *D, const SourceManager &SM)
Create a location for the beginning of the declaration.
#define REGISTER_SET_WITH_PROGRAMSTATE(Name, Elem)
Declares an immutable set of type NameTy, suitable for placement into the ProgramState.
Dataflow Directional Tag Classes.
static std::string getName(const CallEvent &Call)
Indicates that the tracking object is a descendant of a referenced-counted OSObject, used in the Darwin kernel.
#define REGISTER_CHECKER(name)
X
Add a minimal nested name specifier fixit hint to allow lookup of a tag name from an outer enclosing ...
bool isPointerType() const