22 using namespace clang;
30 class ValistChecker :
public Checker<check::PreCall, check::PreStmt<VAArgExpr>,
32 mutable std::unique_ptr<BugType> BT_leakedvalist, BT_uninitaccess;
34 struct VAListAccepter {
59 StringRef getVariableNameFromRegion(
const MemRegion *Reg)
const;
63 void reportUninitializedAccess(
const MemRegion *VAList, StringRef Msg,
65 void reportLeakedVALists(
const RegionVector &LeakedVALists, StringRef Msg1,
67 bool ReportUninit =
false)
const;
75 ValistBugVisitor(
const MemRegion *Reg,
bool IsLeak =
false)
76 : Reg(Reg), IsLeak(IsLeak) {}
77 void Profile(llvm::FoldingSetNodeID &
ID)
const override {
82 std::unique_ptr<PathDiagnosticPiece>
91 return llvm::make_unique<PathDiagnosticEventPiece>(L, BR.
getDescription(),
94 std::shared_ptr<PathDiagnosticPiece> VisitNode(
const ExplodedNode *N,
106 ValistChecker::VAListAccepters = {
107 {{
"vfprintf", 3}, 2},
111 {{
"vsnprintf", 4}, 3},
112 {{
"vsprintf", 3}, 2},
114 {{
"vfwprintf", 3}, 2},
115 {{
"vfwscanf", 3}, 2},
116 {{
"vwprintf", 2}, 1},
118 {{
"vswprintf", 4}, 3},
121 {{
"vswscanf", 3}, 2}};
123 ValistChecker::VaCopy(
"__builtin_va_copy", 2),
124 ValistChecker::VaEnd(
"__builtin_va_end", 1);
127 void ValistChecker::checkPreCall(
const CallEvent &Call,
132 checkVAListStartCall(Call, C,
false);
134 checkVAListStartCall(Call, C,
true);
136 checkVAListEndCall(Call, C);
138 for (
auto FuncInfo : VAListAccepters) {
143 getVAListAsRegion(Call.
getArgSVal(FuncInfo.VAListPos),
144 Call.
getArgExpr(FuncInfo.VAListPos), Symbolic, C);
148 if (C.
getState()->contains<InitializedVALists>(VAList))
157 Errmsg += FuncInfo.Func.getFunctionName();
158 Errmsg +=
"' is called with an uninitialized va_list argument";
159 reportUninitializedAccess(VAList, Errmsg.c_str(), C);
172 bool VaListModelledAsArray =
false;
173 if (
const auto *Cast = dyn_cast<CastExpr>(E)) {
175 VaListModelledAsArray =
179 if (isa<ParmVarDecl>(DeclReg->getDecl()))
184 const auto *EReg = dyn_cast_or_null<ElementRegion>(Reg);
185 return (EReg && VaListModelledAsArray) ? EReg->
getSuperRegion() : Reg;
188 void ValistChecker::checkPreStmt(
const VAArgExpr *VAA,
195 getVAListAsRegion(VAListSVal, VASubExpr, Symbolic, C);
200 if (!State->contains<InitializedVALists>(VAList))
201 reportUninitializedAccess(
202 VAList,
"va_arg() is called on an uninitialized va_list", C);
208 InitializedVAListsTy TrackedVALists = State->get<InitializedVALists>();
209 RegionVector LeakedVALists;
210 for (
auto Reg : TrackedVALists) {
213 LeakedVALists.push_back(Reg);
214 State = State->remove<InitializedVALists>(Reg);
217 reportLeakedVALists(LeakedVALists,
"Initialized va_list",
" is leaked", C,
231 bool FoundInitializedState =
false;
235 if (!State->contains<InitializedVALists>(Reg)) {
236 if (FoundInitializedState)
239 FoundInitializedState =
true;
242 if (NContext == LeakContext || NContext->
isParentOf(LeakContext))
247 return StartCallNode;
250 void ValistChecker::reportUninitializedAccess(
const MemRegion *VAList,
253 if (!ChecksEnabled[CK_Uninitialized])
256 if (!BT_uninitaccess)
257 BT_uninitaccess.reset(
new BugType(CheckNames[CK_Uninitialized],
258 "Uninitialized va_list",
260 auto R = llvm::make_unique<BugReport>(*BT_uninitaccess, Msg, N);
261 R->markInteresting(VAList);
262 R->addVisitor(llvm::make_unique<ValistBugVisitor>(VAList));
267 void ValistChecker::reportLeakedVALists(
const RegionVector &LeakedVALists,
268 StringRef Msg1, StringRef Msg2,
270 bool ReportUninit)
const {
271 if (!(ChecksEnabled[CK_Unterminated] ||
272 (ChecksEnabled[CK_Uninitialized] && ReportUninit)))
274 for (
auto Reg : LeakedVALists) {
275 if (!BT_leakedvalist) {
278 BT_leakedvalist.reset(
279 new BugType(CheckNames[CK_Unterminated].getName().empty()
280 ? CheckNames[CK_Uninitialized]
281 : CheckNames[CK_Unterminated],
283 BT_leakedvalist->setSuppressOnSink(
true);
286 const ExplodedNode *StartNode = getStartCallSite(N, Reg);
294 llvm::raw_svector_ostream OS(Buf);
297 if (!VariableName.empty())
298 OS <<
" " << VariableName;
301 auto R = llvm::make_unique<BugReport>(
302 *BT_leakedvalist, OS.str(), N, LocUsedForUniqueing,
304 R->markInteresting(Reg);
305 R->addVisitor(llvm::make_unique<ValistBugVisitor>(Reg,
true));
310 void ValistChecker::checkVAListStartCall(
const CallEvent &Call,
324 if (ChecksEnabled[CK_CopyToSelf] && VAList == Arg2) {
325 RegionVector LeakedVALists{VAList};
327 reportLeakedVALists(LeakedVALists,
"va_list",
328 " is copied onto itself", C, N,
true);
330 }
else if (!State->contains<InitializedVALists>(Arg2) && !Symbolic) {
331 if (State->contains<InitializedVALists>(VAList)) {
332 State = State->remove<InitializedVALists>(VAList);
333 RegionVector LeakedVALists{VAList};
335 reportLeakedVALists(LeakedVALists,
"Initialized va_list",
336 " is overwritten by an uninitialized one", C, N,
339 reportUninitializedAccess(Arg2,
"Uninitialized va_list is copied", C);
345 if (State->contains<InitializedVALists>(VAList)) {
346 RegionVector LeakedVALists{VAList};
348 reportLeakedVALists(LeakedVALists,
"Initialized va_list",
349 " is initialized again", C, N);
353 State = State->add<InitializedVALists>(VAList);
357 void ValistChecker::checkVAListEndCall(
const CallEvent &Call,
370 if (!C.
getState()->contains<InitializedVALists>(VAList)) {
371 reportUninitializedAccess(
372 VAList,
"va_end() is called on an uninitialized va_list", C);
376 State = State->remove<InitializedVALists>(VAList);
380 std::shared_ptr<PathDiagnosticPiece> ValistChecker::ValistBugVisitor::VisitNode(
391 if (State->contains<InitializedVALists>(Reg) &&
392 !StatePrev->contains<InitializedVALists>(Reg))
393 Msg =
"Initialized va_list";
394 else if (!State->contains<InitializedVALists>(Reg) &&
395 StatePrev->contains<InitializedVALists>(Reg))
396 Msg =
"Ended va_list";
403 return std::make_shared<PathDiagnosticEventPiece>(Pos, Msg,
true);
406 #define REGISTER_CHECKER(name) \ 407 void ento::register##name##Checker(CheckerManager &mgr) { \ 408 ValistChecker *checker = mgr.registerChecker<ValistChecker>(); \ 409 checker->ChecksEnabled[ValistChecker::CK_##name] = true; \ 410 checker->CheckNames[ValistChecker::CK_##name] = mgr.getCurrentCheckName(); \
A (possibly-)qualified type.
MemRegion - The root abstract class for all memory regions.
ExplodedNode * generateErrorNode(ProgramStateRef State=nullptr, const ProgramPointTag *Tag=nullptr)
Generate a transition to a node that will be used to report an error.
const char *const MemoryError
Stmt - This represents one statement.
A helper class which wraps a boolean value set to false by default.
QualType getPointeeType() const
If this is a pointer, ObjC object pointer, or block pointer, this returns the respective pointee...
bool isRecordType() const
ExplodedNode * addTransition(ProgramStateRef State=nullptr, const ProgramPointTag *Tag=nullptr)
Generates a new transition in the program state graph (ExplodedGraph).
StringRef getDescription() const
const Expr * getSubExpr() const
const ProgramStateRef & getState() const
#define REGISTER_SET_WITH_PROGRAMSTATE(Name, Elem)
Declares an immutable set of type NameTy, suitable for placement into the ProgramState.
bool isParentOf(const LocationContext *LC) const
const MemRegion * getSuperRegion() const
This class provides a convenience implementation for clone() using the Curiously-Recurring Template P...
virtual const Expr * getArgExpr(unsigned Index) const
Returns the expression associated with a given argument.
bool isLiveRegion(const MemRegion *region)
const LocationContext * getLocationContext() const
Represents a call to the builtin function __builtin_va_arg.
const RegionTy * getAs() const
SymbolicRegion - A special, "non-concrete" region.
Expr - This represents one expression.
void emitReport(std::unique_ptr< BugReport > R)
Emit the diagnostics report.
static const Stmt * getStmt(const ExplodedNode *N)
Given an exploded node, retrieve the statement that should be used for the diagnostic location...
static PathDiagnosticLocation createBegin(const Decl *D, const SourceManager &SM)
Create a location for the beginning of the declaration.
This class represents a description of a function call using the number of arguments and the name of ...
const MemRegion * getAsRegion() const
SVal - This represents a symbolic expression, which can be either an L-value or an R-value...
A class responsible for cleaning up unused symbols.
std::string getDescriptiveName(bool UseQuotes=true) const
Get descriptive name for memory region.
Dataflow Directional Tag Classes.
Represents an abstract call to a function or method along a particular path.
const Decl * getDecl() const
T castAs() const
Convert to the specified SVal type, asserting that this SVal is of the desired type.
const ProgramStateRef & getState() const
bool isGlobalCFunction(StringRef SpecificName=StringRef()) const
Returns true if the callee is an externally-visible function in the top-level namespace, such as malloc.
#define REGISTER_CHECKER(name)
X
Add a minimal nested name specifier fixit hint to allow lookup of a tag name from an outer enclosing ...
bool isCalled(const CallDescription &CD) const
Returns true if the CallEvent is a call to a function that matches the CallDescription.
pred_iterator pred_begin()
SourceManager & getSourceManager()
static PathDiagnosticLocation createEndOfPath(const ExplodedNode *N, const SourceManager &SM)
Create a location corresponding to the next valid ExplodedNode as end of path location.
bool isPointerType() const
virtual SVal getArgSVal(unsigned Index) const
Returns the value of a given argument at the time of the call.
This class provides an interface through which checkers can create individual bug reports...
const LocationContext * getLocationContext() const
SourceManager & getSourceManager()