1 //==--- MacOSKeychainAPIChecker.cpp ------------------------------*- C++ -*-==// 2 // 3 // The LLVM Compiler Infrastructure 4 // 5 // This file is distributed under the University of Illinois Open Source 6 // License. See LICENSE.TXT for details. 7 // 8 //===----------------------------------------------------------------------===// 9 // This checker flags misuses of KeyChainAPI. In particular, the password data 10 // allocated/returned by SecKeychainItemCopyContent, 11 // SecKeychainFindGenericPassword, SecKeychainFindInternetPassword functions has 12 // to be freed using a call to SecKeychainItemFreeContent. 13 //===----------------------------------------------------------------------===// 14 15 #include "ClangSACheckers.h" 16 #include "clang/StaticAnalyzer/Core/Checker.h" 17 #include "clang/StaticAnalyzer/Core/CheckerManager.h" 18 #include "clang/StaticAnalyzer/Core/BugReporter/BugType.h" 19 #include "clang/StaticAnalyzer/Core/PathSensitive/CheckerContext.h" 20 #include "clang/StaticAnalyzer/Core/PathSensitive/ProgramState.h" 21 #include "clang/StaticAnalyzer/Core/PathSensitive/ProgramStateTrait.h" 22 #include "llvm/ADT/SmallString.h" 23 24 using namespace clang; 25 using namespace ento; 26 27 namespace { 28 class MacOSKeychainAPIChecker : public Checker<check::PreStmt<CallExpr>, 29 check::PreStmt<ReturnStmt>, 30 check::PostStmt<CallExpr>, 31 check::EndPath, 32 check::DeadSymbols> { 33 mutable OwningPtr<BugType> BT; 34 35 public: 36 /// AllocationState is a part of the checker specific state together with the 37 /// MemRegion corresponding to the allocated data. 38 struct AllocationState { 39 /// The index of the allocator function. 40 unsigned int AllocatorIdx; 41 SymbolRef Region; 42 43 AllocationState(const Expr *E, unsigned int Idx, SymbolRef R) : 44 AllocatorIdx(Idx), 45 Region(R) {} 46 47 bool operator==(const AllocationState &X) const { 48 return (AllocatorIdx == X.AllocatorIdx && 49 Region == X.Region); 50 } 51 52 void Profile(llvm::FoldingSetNodeID &ID) const { 53 ID.AddInteger(AllocatorIdx); 54 ID.AddPointer(Region); 55 } 56 }; 57 58 void checkPreStmt(const CallExpr *S, CheckerContext &C) const; 59 void checkPreStmt(const ReturnStmt *S, CheckerContext &C) const; 60 void checkPostStmt(const CallExpr *S, CheckerContext &C) const; 61 void checkDeadSymbols(SymbolReaper &SR, CheckerContext &C) const; 62 void checkEndPath(CheckerContext &C) const; 63 64 private: 65 typedef std::pair<SymbolRef, const AllocationState*> AllocationPair; 66 typedef llvm::SmallVector<AllocationPair, 2> AllocationPairVec; 67 68 enum APIKind { 69 /// Denotes functions tracked by this checker. 70 ValidAPI = 0, 71 /// The functions commonly/mistakenly used in place of the given API. 72 ErrorAPI = 1, 73 /// The functions which may allocate the data. These are tracked to reduce 74 /// the false alarm rate. 75 PossibleAPI = 2 76 }; 77 /// Stores the information about the allocator and deallocator functions - 78 /// these are the functions the checker is tracking. 79 struct ADFunctionInfo { 80 const char* Name; 81 unsigned int Param; 82 unsigned int DeallocatorIdx; 83 APIKind Kind; 84 }; 85 static const unsigned InvalidIdx = 100000; 86 static const unsigned FunctionsToTrackSize = 8; 87 static const ADFunctionInfo FunctionsToTrack[FunctionsToTrackSize]; 88 /// The value, which represents no error return value for allocator functions. 89 static const unsigned NoErr = 0; 90 91 /// Given the function name, returns the index of the allocator/deallocator 92 /// function. 93 static unsigned getTrackedFunctionIndex(StringRef Name, bool IsAllocator); 94 95 inline void initBugType() const { 96 if (!BT) 97 BT.reset(new BugType("Improper use of SecKeychain API", "Mac OS API")); 98 } 99 100 void generateDeallocatorMismatchReport(const AllocationPair &AP, 101 const Expr *ArgExpr, 102 CheckerContext &C) const; 103 104 /// Find the allocation site for Sym on the path leading to the node N. 105 const Stmt *getAllocationSite(const ExplodedNode *N, SymbolRef Sym, 106 CheckerContext &C) const; 107 108 BugReport *generateAllocatedDataNotReleasedReport(const AllocationPair &AP, 109 ExplodedNode *N, 110 CheckerContext &C) const; 111 112 /// Check if RetSym evaluates to an error value in the current state. 113 bool definitelyReturnedError(SymbolRef RetSym, 114 ProgramStateRef State, 115 SValBuilder &Builder, 116 bool noError = false) const; 117 118 /// Check if RetSym evaluates to a NoErr value in the current state. 119 bool definitelyDidnotReturnError(SymbolRef RetSym, 120 ProgramStateRef State, 121 SValBuilder &Builder) const { 122 return definitelyReturnedError(RetSym, State, Builder, true); 123 } 124 125 /// Mark an AllocationPair interesting for diagnostic reporting. 126 void markInteresting(BugReport *R, const AllocationPair &AP) const { 127 R->markInteresting(AP.first); 128 R->markInteresting(AP.second->Region); 129 } 130 131 /// The bug visitor which allows us to print extra diagnostics along the 132 /// BugReport path. For example, showing the allocation site of the leaked 133 /// region. 134 class SecKeychainBugVisitor 135 : public BugReporterVisitorImpl<SecKeychainBugVisitor> { 136 protected: 137 // The allocated region symbol tracked by the main analysis. 138 SymbolRef Sym; 139 140 public: 141 SecKeychainBugVisitor(SymbolRef S) : Sym(S) {} 142 virtual ~SecKeychainBugVisitor() {} 143 144 void Profile(llvm::FoldingSetNodeID &ID) const { 145 static int X = 0; 146 ID.AddPointer(&X); 147 ID.AddPointer(Sym); 148 } 149 150 PathDiagnosticPiece *VisitNode(const ExplodedNode *N, 151 const ExplodedNode *PrevN, 152 BugReporterContext &BRC, 153 BugReport &BR); 154 }; 155 }; 156 } 157 158 /// ProgramState traits to store the currently allocated (and not yet freed) 159 /// symbols. This is a map from the allocated content symbol to the 160 /// corresponding AllocationState. 161 typedef llvm::ImmutableMap<SymbolRef, 162 MacOSKeychainAPIChecker::AllocationState> AllocatedSetTy; 163 164 namespace { struct AllocatedData {}; } 165 namespace clang { namespace ento { 166 template<> struct ProgramStateTrait<AllocatedData> 167 : public ProgramStatePartialTrait<AllocatedSetTy > { 168 static void *GDMIndex() { static int index = 0; return &index; } 169 }; 170 }} 171 172 static bool isEnclosingFunctionParam(const Expr *E) { 173 E = E->IgnoreParenCasts(); 174 if (const DeclRefExpr *DRE = dyn_cast<DeclRefExpr>(E)) { 175 const ValueDecl *VD = DRE->getDecl(); 176 if (isa<ImplicitParamDecl>(VD) || isa<ParmVarDecl>(VD)) 177 return true; 178 } 179 return false; 180 } 181 182 const MacOSKeychainAPIChecker::ADFunctionInfo 183 MacOSKeychainAPIChecker::FunctionsToTrack[FunctionsToTrackSize] = { 184 {"SecKeychainItemCopyContent", 4, 3, ValidAPI}, // 0 185 {"SecKeychainFindGenericPassword", 6, 3, ValidAPI}, // 1 186 {"SecKeychainFindInternetPassword", 13, 3, ValidAPI}, // 2 187 {"SecKeychainItemFreeContent", 1, InvalidIdx, ValidAPI}, // 3 188 {"SecKeychainItemCopyAttributesAndData", 5, 5, ValidAPI}, // 4 189 {"SecKeychainItemFreeAttributesAndData", 1, InvalidIdx, ValidAPI}, // 5 190 {"free", 0, InvalidIdx, ErrorAPI}, // 6 191 {"CFStringCreateWithBytesNoCopy", 1, InvalidIdx, PossibleAPI}, // 7 192 }; 193 194 unsigned MacOSKeychainAPIChecker::getTrackedFunctionIndex(StringRef Name, 195 bool IsAllocator) { 196 for (unsigned I = 0; I < FunctionsToTrackSize; ++I) { 197 ADFunctionInfo FI = FunctionsToTrack[I]; 198 if (FI.Name != Name) 199 continue; 200 // Make sure the function is of the right type (allocator vs deallocator). 201 if (IsAllocator && (FI.DeallocatorIdx == InvalidIdx)) 202 return InvalidIdx; 203 if (!IsAllocator && (FI.DeallocatorIdx != InvalidIdx)) 204 return InvalidIdx; 205 206 return I; 207 } 208 // The function is not tracked. 209 return InvalidIdx; 210 } 211 212 static bool isBadDeallocationArgument(const MemRegion *Arg) { 213 if (!Arg) 214 return false; 215 if (isa<AllocaRegion>(Arg) || 216 isa<BlockDataRegion>(Arg) || 217 isa<TypedRegion>(Arg)) { 218 return true; 219 } 220 return false; 221 } 222 223 /// Given the address expression, retrieve the value it's pointing to. Assume 224 /// that value is itself an address, and return the corresponding symbol. 225 static SymbolRef getAsPointeeSymbol(const Expr *Expr, 226 CheckerContext &C) { 227 ProgramStateRef State = C.getState(); 228 SVal ArgV = State->getSVal(Expr, C.getLocationContext()); 229 230 if (const loc::MemRegionVal *X = dyn_cast<loc::MemRegionVal>(&ArgV)) { 231 StoreManager& SM = C.getStoreManager(); 232 SymbolRef sym = SM.getBinding(State->getStore(), *X).getAsLocSymbol(); 233 if (sym) 234 return sym; 235 } 236 return 0; 237 } 238 239 // When checking for error code, we need to consider the following cases: 240 // 1) noErr / [0] 241 // 2) someErr / [1, inf] 242 // 3) unknown 243 // If noError, returns true iff (1). 244 // If !noError, returns true iff (2). 245 bool MacOSKeychainAPIChecker::definitelyReturnedError(SymbolRef RetSym, 246 ProgramStateRef State, 247 SValBuilder &Builder, 248 bool noError) const { 249 DefinedOrUnknownSVal NoErrVal = Builder.makeIntVal(NoErr, 250 Builder.getSymbolManager().getType(RetSym)); 251 DefinedOrUnknownSVal NoErr = Builder.evalEQ(State, NoErrVal, 252 nonloc::SymbolVal(RetSym)); 253 ProgramStateRef ErrState = State->assume(NoErr, noError); 254 if (ErrState == State) { 255 return true; 256 } 257 258 return false; 259 } 260 261 // Report deallocator mismatch. Remove the region from tracking - reporting a 262 // missing free error after this one is redundant. 263 void MacOSKeychainAPIChecker:: 264 generateDeallocatorMismatchReport(const AllocationPair &AP, 265 const Expr *ArgExpr, 266 CheckerContext &C) const { 267 ProgramStateRef State = C.getState(); 268 State = State->remove<AllocatedData>(AP.first); 269 ExplodedNode *N = C.addTransition(State); 270 271 if (!N) 272 return; 273 initBugType(); 274 SmallString<80> sbuf; 275 llvm::raw_svector_ostream os(sbuf); 276 unsigned int PDeallocIdx = 277 FunctionsToTrack[AP.second->AllocatorIdx].DeallocatorIdx; 278 279 os << "Deallocator doesn't match the allocator: '" 280 << FunctionsToTrack[PDeallocIdx].Name << "' should be used."; 281 BugReport *Report = new BugReport(*BT, os.str(), N); 282 Report->addVisitor(new SecKeychainBugVisitor(AP.first)); 283 Report->addRange(ArgExpr->getSourceRange()); 284 markInteresting(Report, AP); 285 C.EmitReport(Report); 286 } 287 288 void MacOSKeychainAPIChecker::checkPreStmt(const CallExpr *CE, 289 CheckerContext &C) const { 290 unsigned idx = InvalidIdx; 291 ProgramStateRef State = C.getState(); 292 293 StringRef funName = C.getCalleeName(CE); 294 if (funName.empty()) 295 return; 296 297 // If it is a call to an allocator function, it could be a double allocation. 298 idx = getTrackedFunctionIndex(funName, true); 299 if (idx != InvalidIdx) { 300 const Expr *ArgExpr = CE->getArg(FunctionsToTrack[idx].Param); 301 if (SymbolRef V = getAsPointeeSymbol(ArgExpr, C)) 302 if (const AllocationState *AS = State->get<AllocatedData>(V)) { 303 if (!definitelyReturnedError(AS->Region, State, C.getSValBuilder())) { 304 // Remove the value from the state. The new symbol will be added for 305 // tracking when the second allocator is processed in checkPostStmt(). 306 State = State->remove<AllocatedData>(V); 307 ExplodedNode *N = C.addTransition(State); 308 if (!N) 309 return; 310 initBugType(); 311 SmallString<128> sbuf; 312 llvm::raw_svector_ostream os(sbuf); 313 unsigned int DIdx = FunctionsToTrack[AS->AllocatorIdx].DeallocatorIdx; 314 os << "Allocated data should be released before another call to " 315 << "the allocator: missing a call to '" 316 << FunctionsToTrack[DIdx].Name 317 << "'."; 318 BugReport *Report = new BugReport(*BT, os.str(), N); 319 Report->addVisitor(new SecKeychainBugVisitor(V)); 320 Report->addRange(ArgExpr->getSourceRange()); 321 Report->markInteresting(AS->Region); 322 C.EmitReport(Report); 323 } 324 } 325 return; 326 } 327 328 // Is it a call to one of deallocator functions? 329 idx = getTrackedFunctionIndex(funName, false); 330 if (idx == InvalidIdx) 331 return; 332 333 // Check the argument to the deallocator. 334 const Expr *ArgExpr = CE->getArg(FunctionsToTrack[idx].Param); 335 SVal ArgSVal = State->getSVal(ArgExpr, C.getLocationContext()); 336 337 // Undef is reported by another checker. 338 if (ArgSVal.isUndef()) 339 return; 340 341 SymbolRef ArgSM = ArgSVal.getAsLocSymbol(); 342 343 // If the argument is coming from the heap, globals, or unknown, do not 344 // report it. 345 bool RegionArgIsBad = false; 346 if (!ArgSM) { 347 if (!isBadDeallocationArgument(ArgSVal.getAsRegion())) 348 return; 349 RegionArgIsBad = true; 350 } 351 352 // Is the argument to the call being tracked? 353 const AllocationState *AS = State->get<AllocatedData>(ArgSM); 354 if (!AS && FunctionsToTrack[idx].Kind != ValidAPI) { 355 return; 356 } 357 // If trying to free data which has not been allocated yet, report as a bug. 358 // TODO: We might want a more precise diagnostic for double free 359 // (that would involve tracking all the freed symbols in the checker state). 360 if (!AS || RegionArgIsBad) { 361 // It is possible that this is a false positive - the argument might 362 // have entered as an enclosing function parameter. 363 if (isEnclosingFunctionParam(ArgExpr)) 364 return; 365 366 ExplodedNode *N = C.addTransition(State); 367 if (!N) 368 return; 369 initBugType(); 370 BugReport *Report = new BugReport(*BT, 371 "Trying to free data which has not been allocated.", N); 372 Report->addRange(ArgExpr->getSourceRange()); 373 if (AS) 374 Report->markInteresting(AS->Region); 375 C.EmitReport(Report); 376 return; 377 } 378 379 // Process functions which might deallocate. 380 if (FunctionsToTrack[idx].Kind == PossibleAPI) { 381 382 if (funName == "CFStringCreateWithBytesNoCopy") { 383 const Expr *DeallocatorExpr = CE->getArg(5)->IgnoreParenCasts(); 384 // NULL ~ default deallocator, so warn. 385 if (DeallocatorExpr->isNullPointerConstant(C.getASTContext(), 386 Expr::NPC_ValueDependentIsNotNull)) { 387 const AllocationPair AP = std::make_pair(ArgSM, AS); 388 generateDeallocatorMismatchReport(AP, ArgExpr, C); 389 return; 390 } 391 // One of the default allocators, so warn. 392 if (const DeclRefExpr *DE = dyn_cast<DeclRefExpr>(DeallocatorExpr)) { 393 StringRef DeallocatorName = DE->getFoundDecl()->getName(); 394 if (DeallocatorName == "kCFAllocatorDefault" || 395 DeallocatorName == "kCFAllocatorSystemDefault" || 396 DeallocatorName == "kCFAllocatorMalloc") { 397 const AllocationPair AP = std::make_pair(ArgSM, AS); 398 generateDeallocatorMismatchReport(AP, ArgExpr, C); 399 return; 400 } 401 // If kCFAllocatorNull, which does not deallocate, we still have to 402 // find the deallocator. Otherwise, assume that the user had written a 403 // custom deallocator which does the right thing. 404 if (DE->getFoundDecl()->getName() != "kCFAllocatorNull") { 405 State = State->remove<AllocatedData>(ArgSM); 406 C.addTransition(State); 407 return; 408 } 409 } 410 } 411 return; 412 } 413 414 // The call is deallocating a value we previously allocated, so remove it 415 // from the next state. 416 State = State->remove<AllocatedData>(ArgSM); 417 418 // Check if the proper deallocator is used. 419 unsigned int PDeallocIdx = FunctionsToTrack[AS->AllocatorIdx].DeallocatorIdx; 420 if (PDeallocIdx != idx || (FunctionsToTrack[idx].Kind == ErrorAPI)) { 421 const AllocationPair AP = std::make_pair(ArgSM, AS); 422 generateDeallocatorMismatchReport(AP, ArgExpr, C); 423 return; 424 } 425 426 // If the buffer can be null and the return status can be an error, 427 // report a bad call to free. 428 if (State->assume(cast<DefinedSVal>(ArgSVal), false) && 429 !definitelyDidnotReturnError(AS->Region, State, C.getSValBuilder())) { 430 ExplodedNode *N = C.addTransition(State); 431 if (!N) 432 return; 433 initBugType(); 434 BugReport *Report = new BugReport(*BT, 435 "Only call free if a valid (non-NULL) buffer was returned.", N); 436 Report->addVisitor(new SecKeychainBugVisitor(ArgSM)); 437 Report->addRange(ArgExpr->getSourceRange()); 438 Report->markInteresting(AS->Region); 439 C.EmitReport(Report); 440 return; 441 } 442 443 C.addTransition(State); 444 } 445 446 void MacOSKeychainAPIChecker::checkPostStmt(const CallExpr *CE, 447 CheckerContext &C) const { 448 ProgramStateRef State = C.getState(); 449 StringRef funName = C.getCalleeName(CE); 450 451 // If a value has been allocated, add it to the set for tracking. 452 unsigned idx = getTrackedFunctionIndex(funName, true); 453 if (idx == InvalidIdx) 454 return; 455 456 const Expr *ArgExpr = CE->getArg(FunctionsToTrack[idx].Param); 457 // If the argument entered as an enclosing function parameter, skip it to 458 // avoid false positives. 459 if (isEnclosingFunctionParam(ArgExpr) && 460 C.getLocationContext()->getParent() == 0) 461 return; 462 463 if (SymbolRef V = getAsPointeeSymbol(ArgExpr, C)) { 464 // If the argument points to something that's not a symbolic region, it 465 // can be: 466 // - unknown (cannot reason about it) 467 // - undefined (already reported by other checker) 468 // - constant (null - should not be tracked, 469 // other constant will generate a compiler warning) 470 // - goto (should be reported by other checker) 471 472 // The call return value symbol should stay alive for as long as the 473 // allocated value symbol, since our diagnostics depend on the value 474 // returned by the call. Ex: Data should only be freed if noErr was 475 // returned during allocation.) 476 SymbolRef RetStatusSymbol = 477 State->getSVal(CE, C.getLocationContext()).getAsSymbol(); 478 C.getSymbolManager().addSymbolDependency(V, RetStatusSymbol); 479 480 // Track the allocated value in the checker state. 481 State = State->set<AllocatedData>(V, AllocationState(ArgExpr, idx, 482 RetStatusSymbol)); 483 assert(State); 484 C.addTransition(State); 485 } 486 } 487 488 void MacOSKeychainAPIChecker::checkPreStmt(const ReturnStmt *S, 489 CheckerContext &C) const { 490 const Expr *retExpr = S->getRetValue(); 491 if (!retExpr) 492 return; 493 494 // If inside inlined call, skip it. 495 const LocationContext *LC = C.getLocationContext(); 496 if (LC->getParent() != 0) 497 return; 498 499 // Check if the value is escaping through the return. 500 ProgramStateRef state = C.getState(); 501 SymbolRef sym = state->getSVal(retExpr, LC).getAsLocSymbol(); 502 if (!sym) 503 return; 504 state = state->remove<AllocatedData>(sym); 505 506 // Proceed from the new state. 507 C.addTransition(state); 508 } 509 510 // TODO: This logic is the same as in Malloc checker. 511 const Stmt * 512 MacOSKeychainAPIChecker::getAllocationSite(const ExplodedNode *N, 513 SymbolRef Sym, 514 CheckerContext &C) const { 515 const LocationContext *LeakContext = N->getLocationContext(); 516 // Walk the ExplodedGraph backwards and find the first node that referred to 517 // the tracked symbol. 518 const ExplodedNode *AllocNode = N; 519 520 while (N) { 521 if (!N->getState()->get<AllocatedData>(Sym)) 522 break; 523 // Allocation node, is the last node in the current context in which the 524 // symbol was tracked. 525 if (N->getLocationContext() == LeakContext) 526 AllocNode = N; 527 N = N->pred_empty() ? NULL : *(N->pred_begin()); 528 } 529 530 ProgramPoint P = AllocNode->getLocation(); 531 if (!isa<StmtPoint>(P)) 532 return 0; 533 return cast<clang::PostStmt>(P).getStmt(); 534 } 535 536 BugReport *MacOSKeychainAPIChecker:: 537 generateAllocatedDataNotReleasedReport(const AllocationPair &AP, 538 ExplodedNode *N, 539 CheckerContext &C) const { 540 const ADFunctionInfo &FI = FunctionsToTrack[AP.second->AllocatorIdx]; 541 initBugType(); 542 SmallString<70> sbuf; 543 llvm::raw_svector_ostream os(sbuf); 544 os << "Allocated data is not released: missing a call to '" 545 << FunctionsToTrack[FI.DeallocatorIdx].Name << "'."; 546 547 // Most bug reports are cached at the location where they occurred. 548 // With leaks, we want to unique them by the location where they were 549 // allocated, and only report a single path. 550 PathDiagnosticLocation LocUsedForUniqueing; 551 if (const Stmt *AllocStmt = getAllocationSite(N, AP.first, C)) 552 LocUsedForUniqueing = PathDiagnosticLocation::createBegin(AllocStmt, 553 C.getSourceManager(), N->getLocationContext()); 554 555 BugReport *Report = new BugReport(*BT, os.str(), N, LocUsedForUniqueing); 556 Report->addVisitor(new SecKeychainBugVisitor(AP.first)); 557 markInteresting(Report, AP); 558 return Report; 559 } 560 561 void MacOSKeychainAPIChecker::checkDeadSymbols(SymbolReaper &SR, 562 CheckerContext &C) const { 563 ProgramStateRef State = C.getState(); 564 AllocatedSetTy ASet = State->get<AllocatedData>(); 565 if (ASet.isEmpty()) 566 return; 567 568 bool Changed = false; 569 AllocationPairVec Errors; 570 for (AllocatedSetTy::iterator I = ASet.begin(), E = ASet.end(); I != E; ++I) { 571 if (SR.isLive(I->first)) 572 continue; 573 574 Changed = true; 575 State = State->remove<AllocatedData>(I->first); 576 // If the allocated symbol is null or if the allocation call might have 577 // returned an error, do not report. 578 if (State->getSymVal(I->first) || 579 definitelyReturnedError(I->second.Region, State, C.getSValBuilder())) 580 continue; 581 Errors.push_back(std::make_pair(I->first, &I->second)); 582 } 583 if (!Changed) { 584 // Generate the new, cleaned up state. 585 C.addTransition(State); 586 return; 587 } 588 589 static SimpleProgramPointTag Tag("MacOSKeychainAPIChecker : DeadSymbolsLeak"); 590 ExplodedNode *N = C.addTransition(C.getState(), C.getPredecessor(), &Tag); 591 592 // Generate the error reports. 593 for (AllocationPairVec::iterator I = Errors.begin(), E = Errors.end(); 594 I != E; ++I) { 595 C.EmitReport(generateAllocatedDataNotReleasedReport(*I, N, C)); 596 } 597 598 // Generate the new, cleaned up state. 599 C.addTransition(State, N); 600 } 601 602 // TODO: Remove this after we ensure that checkDeadSymbols are always called. 603 void MacOSKeychainAPIChecker::checkEndPath(CheckerContext &C) const { 604 ProgramStateRef state = C.getState(); 605 606 // If inside inlined call, skip it. 607 if (C.getLocationContext()->getParent() != 0) 608 return; 609 610 AllocatedSetTy AS = state->get<AllocatedData>(); 611 if (AS.isEmpty()) 612 return; 613 614 // Anything which has been allocated but not freed (nor escaped) will be 615 // found here, so report it. 616 bool Changed = false; 617 AllocationPairVec Errors; 618 for (AllocatedSetTy::iterator I = AS.begin(), E = AS.end(); I != E; ++I ) { 619 Changed = true; 620 state = state->remove<AllocatedData>(I->first); 621 // If the allocated symbol is null or if error code was returned at 622 // allocation, do not report. 623 if (state->getSymVal(I.getKey()) || 624 definitelyReturnedError(I->second.Region, state, 625 C.getSValBuilder())) { 626 continue; 627 } 628 Errors.push_back(std::make_pair(I->first, &I->second)); 629 } 630 631 // If no change, do not generate a new state. 632 if (!Changed) { 633 C.addTransition(state); 634 return; 635 } 636 637 static SimpleProgramPointTag Tag("MacOSKeychainAPIChecker : EndPathLeak"); 638 ExplodedNode *N = C.addTransition(C.getState(), C.getPredecessor(), &Tag); 639 640 // Generate the error reports. 641 for (AllocationPairVec::iterator I = Errors.begin(), E = Errors.end(); 642 I != E; ++I) { 643 C.EmitReport(generateAllocatedDataNotReleasedReport(*I, N, C)); 644 } 645 646 C.addTransition(state, N); 647 } 648 649 650 PathDiagnosticPiece *MacOSKeychainAPIChecker::SecKeychainBugVisitor::VisitNode( 651 const ExplodedNode *N, 652 const ExplodedNode *PrevN, 653 BugReporterContext &BRC, 654 BugReport &BR) { 655 const AllocationState *AS = N->getState()->get<AllocatedData>(Sym); 656 if (!AS) 657 return 0; 658 const AllocationState *ASPrev = PrevN->getState()->get<AllocatedData>(Sym); 659 if (ASPrev) 660 return 0; 661 662 // (!ASPrev && AS) ~ We started tracking symbol in node N, it must be the 663 // allocation site. 664 const CallExpr *CE = cast<CallExpr>(cast<StmtPoint>(N->getLocation()) 665 .getStmt()); 666 const FunctionDecl *funDecl = CE->getDirectCallee(); 667 assert(funDecl && "We do not support indirect function calls as of now."); 668 StringRef funName = funDecl->getName(); 669 670 // Get the expression of the corresponding argument. 671 unsigned Idx = getTrackedFunctionIndex(funName, true); 672 assert(Idx != InvalidIdx && "This should be a call to an allocator."); 673 const Expr *ArgExpr = CE->getArg(FunctionsToTrack[Idx].Param); 674 PathDiagnosticLocation Pos(ArgExpr, BRC.getSourceManager(), 675 N->getLocationContext()); 676 return new PathDiagnosticEventPiece(Pos, "Data is allocated here."); 677 } 678 679 void ento::registerMacOSKeychainAPIChecker(CheckerManager &mgr) { 680 mgr.registerChecker<MacOSKeychainAPIChecker>(); 681 } 682