Home | History | Annotate | Download | only in Checkers
      1 //=== VLASizeChecker.cpp - Undefined dereference checker --------*- C++ -*-===//
      2 //
      3 //                     The LLVM Compiler Infrastructure
      4 //
      5 // This file is distributed under the University of Illinois Open Source
      6 // License. See LICENSE.TXT for details.
      7 //
      8 //===----------------------------------------------------------------------===//
      9 //
     10 // This defines VLASizeChecker, a builtin check in ExprEngine that
     11 // performs checks for declaration of VLA of undefined or zero size.
     12 // In addition, VLASizeChecker is responsible for defining the extent
     13 // of the MemRegion that represents a VLA.
     14 //
     15 //===----------------------------------------------------------------------===//
     16 
     17 #include "ClangSACheckers.h"
     18 #include "clang/AST/CharUnits.h"
     19 #include "clang/StaticAnalyzer/Core/BugReporter/BugType.h"
     20 #include "clang/StaticAnalyzer/Core/Checker.h"
     21 #include "clang/StaticAnalyzer/Core/CheckerManager.h"
     22 #include "clang/StaticAnalyzer/Core/PathSensitive/CheckerContext.h"
     23 #include "llvm/ADT/STLExtras.h"
     24 #include "llvm/ADT/SmallString.h"
     25 #include "llvm/Support/raw_ostream.h"
     26 
     27 using namespace clang;
     28 using namespace ento;
     29 
     30 namespace {
     31 class VLASizeChecker : public Checker< check::PreStmt<DeclStmt> > {
     32   mutable OwningPtr<BugType> BT;
     33   enum VLASize_Kind { VLA_Garbage, VLA_Zero, VLA_Tainted };
     34 
     35   void reportBug(VLASize_Kind Kind,
     36                  const Expr *SizeE,
     37                  ProgramStateRef State,
     38                  CheckerContext &C) const;
     39 public:
     40   void checkPreStmt(const DeclStmt *DS, CheckerContext &C) const;
     41 };
     42 } // end anonymous namespace
     43 
     44 void VLASizeChecker::reportBug(VLASize_Kind Kind,
     45                                const Expr *SizeE,
     46                                ProgramStateRef State,
     47                                CheckerContext &C) const {
     48   // Generate an error node.
     49   ExplodedNode *N = C.generateSink(State);
     50   if (!N)
     51     return;
     52 
     53   if (!BT)
     54     BT.reset(new BuiltinBug("Dangerous variable-length array (VLA) declaration"));
     55 
     56   SmallString<256> buf;
     57   llvm::raw_svector_ostream os(buf);
     58   os << "Declared variable-length array (VLA) ";
     59   switch (Kind) {
     60   case VLA_Garbage:
     61     os << "uses a garbage value as its size";
     62     break;
     63   case VLA_Zero:
     64     os << "has zero size";
     65     break;
     66   case VLA_Tainted:
     67     os << "has tainted size";
     68     break;
     69   }
     70 
     71   BugReport *report = new BugReport(*BT, os.str(), N);
     72   report->addRange(SizeE->getSourceRange());
     73   bugreporter::trackNullOrUndefValue(N, SizeE, *report);
     74   C.emitReport(report);
     75   return;
     76 }
     77 
     78 void VLASizeChecker::checkPreStmt(const DeclStmt *DS, CheckerContext &C) const {
     79   if (!DS->isSingleDecl())
     80     return;
     81 
     82   const VarDecl *VD = dyn_cast<VarDecl>(DS->getSingleDecl());
     83   if (!VD)
     84     return;
     85 
     86   ASTContext &Ctx = C.getASTContext();
     87   const VariableArrayType *VLA = Ctx.getAsVariableArrayType(VD->getType());
     88   if (!VLA)
     89     return;
     90 
     91   // FIXME: Handle multi-dimensional VLAs.
     92   const Expr *SE = VLA->getSizeExpr();
     93   ProgramStateRef state = C.getState();
     94   SVal sizeV = state->getSVal(SE, C.getLocationContext());
     95 
     96   if (sizeV.isUndef()) {
     97     reportBug(VLA_Garbage, SE, state, C);
     98     return;
     99   }
    100 
    101   // See if the size value is known. It can't be undefined because we would have
    102   // warned about that already.
    103   if (sizeV.isUnknown())
    104     return;
    105 
    106   // Check if the size is tainted.
    107   if (state->isTainted(sizeV)) {
    108     reportBug(VLA_Tainted, SE, 0, C);
    109     return;
    110   }
    111 
    112   // Check if the size is zero.
    113   DefinedSVal sizeD = sizeV.castAs<DefinedSVal>();
    114 
    115   ProgramStateRef stateNotZero, stateZero;
    116   llvm::tie(stateNotZero, stateZero) = state->assume(sizeD);
    117 
    118   if (stateZero && !stateNotZero) {
    119     reportBug(VLA_Zero, SE, stateZero, C);
    120     return;
    121   }
    122 
    123   // From this point on, assume that the size is not zero.
    124   state = stateNotZero;
    125 
    126   // VLASizeChecker is responsible for defining the extent of the array being
    127   // declared. We do this by multiplying the array length by the element size,
    128   // then matching that with the array region's extent symbol.
    129 
    130   // Convert the array length to size_t.
    131   SValBuilder &svalBuilder = C.getSValBuilder();
    132   QualType SizeTy = Ctx.getSizeType();
    133   NonLoc ArrayLength =
    134       svalBuilder.evalCast(sizeD, SizeTy, SE->getType()).castAs<NonLoc>();
    135 
    136   // Get the element size.
    137   CharUnits EleSize = Ctx.getTypeSizeInChars(VLA->getElementType());
    138   SVal EleSizeVal = svalBuilder.makeIntVal(EleSize.getQuantity(), SizeTy);
    139 
    140   // Multiply the array length by the element size.
    141   SVal ArraySizeVal = svalBuilder.evalBinOpNN(
    142       state, BO_Mul, ArrayLength, EleSizeVal.castAs<NonLoc>(), SizeTy);
    143 
    144   // Finally, assume that the array's extent matches the given size.
    145   const LocationContext *LC = C.getLocationContext();
    146   DefinedOrUnknownSVal Extent =
    147     state->getRegion(VD, LC)->getExtent(svalBuilder);
    148   DefinedOrUnknownSVal ArraySize = ArraySizeVal.castAs<DefinedOrUnknownSVal>();
    149   DefinedOrUnknownSVal sizeIsKnown =
    150     svalBuilder.evalEQ(state, Extent, ArraySize);
    151   state = state->assume(sizeIsKnown, true);
    152 
    153   // Assume should not fail at this point.
    154   assert(state);
    155 
    156   // Remember our assumptions!
    157   C.addTransition(state);
    158 }
    159 
    160 void ento::registerVLASizeChecker(CheckerManager &mgr) {
    161   mgr.registerChecker<VLASizeChecker>();
    162 }
    163