Home | History | Annotate | Download | only in Checkers 
      1 //=== VLASizeChecker.cpp - Undefined dereference checker --------*- C++ -*-===//
      2 //
      3 //                     The LLVM Compiler Infrastructure
      4 //
      5 // This file is distributed under the University of Illinois Open Source
      6 // License. See LICENSE.TXT for details.
      7 //
      8 //===----------------------------------------------------------------------===//
      9 //
     10 // This defines VLASizeChecker, a builtin check in ExprEngine that
     11 // performs checks for declaration of VLA of undefined or zero size.
     12 // In addition, VLASizeChecker is responsible for defining the extent
     13 // of the MemRegion that represents a VLA.
     14 //
     15 //===----------------------------------------------------------------------===//
     16 
     17 #include "ClangSACheckers.h"
     18 #include "clang/StaticAnalyzer/Core/Checker.h"
     19 #include "clang/StaticAnalyzer/Core/CheckerManager.h"
     20 #include "clang/StaticAnalyzer/Core/PathSensitive/CheckerContext.h"
     21 #include "clang/StaticAnalyzer/Core/BugReporter/BugType.h"
     22 #include "clang/AST/CharUnits.h"
     23 #include "llvm/ADT/SmallString.h"
     24 #include "llvm/ADT/STLExtras.h"
     25 
     26 using namespace clang;
     27 using namespace ento;
     28 
     29 namespace {
     30 class VLASizeChecker : public Checker< check::PreStmt<DeclStmt> > {
     31   mutable OwningPtr<BugType> BT;
     32   enum VLASize_Kind { VLA_Garbage, VLA_Zero, VLA_Tainted };
     33 
     34   void reportBug(VLASize_Kind Kind,
     35                  const Expr *SizeE,
     36                  ProgramStateRef State,
     37                  CheckerContext &C) const;
     38 public:
     39   void checkPreStmt(const DeclStmt *DS, CheckerContext &C) const;
     40 };
     41 } // end anonymous namespace
     42 
     43 void VLASizeChecker::reportBug(VLASize_Kind Kind,
     44                                const Expr *SizeE,
     45                                ProgramStateRef State,
     46                                CheckerContext &C) const {
     47   // Generate an error node.
     48   ExplodedNode *N = C.generateSink(State);
     49   if (!N)
     50     return;
     51 
     52   if (!BT)
     53     BT.reset(new BuiltinBug("Dangerous variable-length array (VLA) declaration"));
     54 
     55   SmallString<256> buf;
     56   llvm::raw_svector_ostream os(buf);
     57   os << "Declared variable-length array (VLA) ";
     58   switch (Kind) {
     59   case VLA_Garbage:
     60     os << "uses a garbage value as its size";
     61     break;
     62   case VLA_Zero:
     63     os << "has zero size";
     64     break;
     65   case VLA_Tainted:
     66     os << "has tainted size";
     67     break;
     68   }
     69 
     70   BugReport *report = new BugReport(*BT, os.str(), N);
     71   report->addRange(SizeE->getSourceRange());
     72   report->addVisitor(bugreporter::getTrackNullOrUndefValueVisitor(N, SizeE,
     73                                                                   report));
     74   C.EmitReport(report);
     75   return;
     76 }
     77 
     78 void VLASizeChecker::checkPreStmt(const DeclStmt *DS, CheckerContext &C) const {
     79   if (!DS->isSingleDecl())
     80     return;
     81 
     82   const VarDecl *VD = dyn_cast<VarDecl>(DS->getSingleDecl());
     83   if (!VD)
     84     return;
     85 
     86   ASTContext &Ctx = C.getASTContext();
     87   const VariableArrayType *VLA = Ctx.getAsVariableArrayType(VD->getType());
     88   if (!VLA)
     89     return;
     90 
     91   // FIXME: Handle multi-dimensional VLAs.
     92   const Expr *SE = VLA->getSizeExpr();
     93   ProgramStateRef state = C.getState();
     94   SVal sizeV = state->getSVal(SE, C.getLocationContext());
     95 
     96   if (sizeV.isUndef()) {
     97     reportBug(VLA_Garbage, SE, state, C);
     98     return;
     99   }
    100 
    101   // See if the size value is known. It can't be undefined because we would have
    102   // warned about that already.
    103   if (sizeV.isUnknown())
    104     return;
    105 
    106   // Check if the size is tainted.
    107   if (state->isTainted(sizeV)) {
    108     reportBug(VLA_Tainted, SE, 0, C);
    109     return;
    110   }
    111 
    112   // Check if the size is zero.
    113   DefinedSVal sizeD = cast<DefinedSVal>(sizeV);
    114 
    115   ProgramStateRef stateNotZero, stateZero;
    116   llvm::tie(stateNotZero, stateZero) = state->assume(sizeD);
    117 
    118   if (stateZero && !stateNotZero) {
    119     reportBug(VLA_Zero, SE, stateZero, C);
    120     return;
    121   }
    122 
    123   // From this point on, assume that the size is not zero.
    124   state = stateNotZero;
    125 
    126   // VLASizeChecker is responsible for defining the extent of the array being
    127   // declared. We do this by multiplying the array length by the element size,
    128   // then matching that with the array region's extent symbol.
    129 
    130   // Convert the array length to size_t.
    131   SValBuilder &svalBuilder = C.getSValBuilder();
    132   QualType SizeTy = Ctx.getSizeType();
    133   NonLoc ArrayLength = cast<NonLoc>(svalBuilder.evalCast(sizeD, SizeTy,
    134                                                          SE->getType()));
    135 
    136   // Get the element size.
    137   CharUnits EleSize = Ctx.getTypeSizeInChars(VLA->getElementType());
    138   SVal EleSizeVal = svalBuilder.makeIntVal(EleSize.getQuantity(), SizeTy);
    139 
    140   // Multiply the array length by the element size.
    141   SVal ArraySizeVal = svalBuilder.evalBinOpNN(state, BO_Mul, ArrayLength,
    142                                               cast<NonLoc>(EleSizeVal), SizeTy);
    143 
    144   // Finally, assume that the array's extent matches the given size.
    145   const LocationContext *LC = C.getLocationContext();
    146   DefinedOrUnknownSVal Extent =
    147     state->getRegion(VD, LC)->getExtent(svalBuilder);
    148   DefinedOrUnknownSVal ArraySize = cast<DefinedOrUnknownSVal>(ArraySizeVal);
    149   DefinedOrUnknownSVal sizeIsKnown =
    150     svalBuilder.evalEQ(state, Extent, ArraySize);
    151   state = state->assume(sizeIsKnown, true);
    152 
    153   // Assume should not fail at this point.
    154   assert(state);
    155 
    156   // Remember our assumptions!
    157   C.addTransition(state);
    158 }
    159 
    160 void ento::registerVLASizeChecker(CheckerManager &mgr) {
    161   mgr.registerChecker<VLASizeChecker>();
    162 }
    163