Zhongxing Xu | c196095 | 2010-06-16 05:38:05 +0000 | [diff] [blame] | 1 | //===-- StreamChecker.cpp -----------------------------------------*- C++ -*--// |
| 2 | // |
| 3 | // The LLVM Compiler Infrastructure |
| 4 | // |
| 5 | // This file is distributed under the University of Illinois Open Source |
| 6 | // License. See LICENSE.TXT for details. |
| 7 | // |
| 8 | //===----------------------------------------------------------------------===// |
| 9 | // |
| 10 | // This file defines checkers that model and check stream handling functions. |
| 11 | // |
| 12 | //===----------------------------------------------------------------------===// |
| 13 | |
| 14 | #include "GRExprEngineExperimentalChecks.h" |
| 15 | #include "clang/Checker/BugReporter/BugType.h" |
| 16 | #include "clang/Checker/PathSensitive/CheckerVisitor.h" |
| 17 | #include "clang/Checker/PathSensitive/GRState.h" |
| 18 | #include "clang/Checker/PathSensitive/GRStateTrait.h" |
| 19 | #include "clang/Checker/PathSensitive/SymbolManager.h" |
| 20 | #include "llvm/ADT/ImmutableMap.h" |
| 21 | |
| 22 | using namespace clang; |
| 23 | |
| 24 | namespace { |
| 25 | |
Zhongxing Xu | 9843ba9 | 2010-07-19 01:52:29 +0000 | [diff] [blame] | 26 | struct StreamState { |
Zhongxing Xu | 766c201 | 2010-07-23 14:14:59 +0000 | [diff] [blame] | 27 | enum Kind { Opened, Closed, OpenFailed, Escaped } K; |
Zhongxing Xu | 9843ba9 | 2010-07-19 01:52:29 +0000 | [diff] [blame] | 28 | const Stmt *S; |
| 29 | |
| 30 | StreamState(Kind k, const Stmt *s) : K(k), S(s) {} |
| 31 | |
| 32 | bool isOpened() const { return K == Opened; } |
| 33 | bool isClosed() const { return K == Closed; } |
Chris Lattner | fae9622 | 2010-09-03 04:34:38 +0000 | [diff] [blame] | 34 | //bool isOpenFailed() const { return K == OpenFailed; } |
| 35 | //bool isEscaped() const { return K == Escaped; } |
Zhongxing Xu | 9843ba9 | 2010-07-19 01:52:29 +0000 | [diff] [blame] | 36 | |
| 37 | bool operator==(const StreamState &X) const { |
| 38 | return K == X.K && S == X.S; |
| 39 | } |
| 40 | |
| 41 | static StreamState getOpened(const Stmt *s) { return StreamState(Opened, s); } |
| 42 | static StreamState getClosed(const Stmt *s) { return StreamState(Closed, s); } |
Zhongxing Xu | 47dc37f | 2010-07-22 14:01:01 +0000 | [diff] [blame] | 43 | static StreamState getOpenFailed(const Stmt *s) { |
| 44 | return StreamState(OpenFailed, s); |
| 45 | } |
Zhongxing Xu | 766c201 | 2010-07-23 14:14:59 +0000 | [diff] [blame] | 46 | static StreamState getEscaped(const Stmt *s) { |
| 47 | return StreamState(Escaped, s); |
| 48 | } |
Zhongxing Xu | 9843ba9 | 2010-07-19 01:52:29 +0000 | [diff] [blame] | 49 | |
| 50 | void Profile(llvm::FoldingSetNodeID &ID) const { |
| 51 | ID.AddInteger(K); |
| 52 | ID.AddPointer(S); |
| 53 | } |
| 54 | }; |
| 55 | |
Zhongxing Xu | c196095 | 2010-06-16 05:38:05 +0000 | [diff] [blame] | 56 | class StreamChecker : public CheckerVisitor<StreamChecker> { |
Zhongxing Xu | 47dc37f | 2010-07-22 14:01:01 +0000 | [diff] [blame] | 57 | IdentifierInfo *II_fopen, *II_tmpfile, *II_fclose, *II_fread, *II_fwrite, |
Zhongxing Xu | c7de88b | 2010-06-22 07:50:21 +0000 | [diff] [blame] | 58 | *II_fseek, *II_ftell, *II_rewind, *II_fgetpos, *II_fsetpos, |
| 59 | *II_clearerr, *II_feof, *II_ferror, *II_fileno; |
Zhongxing Xu | 766c201 | 2010-07-23 14:14:59 +0000 | [diff] [blame] | 60 | BuiltinBug *BT_nullfp, *BT_illegalwhence, *BT_doubleclose, *BT_ResourceLeak; |
Zhongxing Xu | c196095 | 2010-06-16 05:38:05 +0000 | [diff] [blame] | 61 | |
| 62 | public: |
Zhongxing Xu | 23d90f9 | 2010-06-18 02:47:46 +0000 | [diff] [blame] | 63 | StreamChecker() |
Zhongxing Xu | 47dc37f | 2010-07-22 14:01:01 +0000 | [diff] [blame] | 64 | : II_fopen(0), II_tmpfile(0) ,II_fclose(0), II_fread(0), II_fwrite(0), |
Zhongxing Xu | c7de88b | 2010-06-22 07:50:21 +0000 | [diff] [blame] | 65 | II_fseek(0), II_ftell(0), II_rewind(0), II_fgetpos(0), II_fsetpos(0), |
| 66 | II_clearerr(0), II_feof(0), II_ferror(0), II_fileno(0), |
Zhongxing Xu | 766c201 | 2010-07-23 14:14:59 +0000 | [diff] [blame] | 67 | BT_nullfp(0), BT_illegalwhence(0), BT_doubleclose(0), |
| 68 | BT_ResourceLeak(0) {} |
Zhongxing Xu | c196095 | 2010-06-16 05:38:05 +0000 | [diff] [blame] | 69 | |
| 70 | static void *getTag() { |
| 71 | static int x; |
| 72 | return &x; |
| 73 | } |
| 74 | |
Ted Kremenek | 9c14953 | 2010-12-01 21:57:22 +0000 | [diff] [blame] | 75 | virtual bool evalCallExpr(CheckerContext &C, const CallExpr *CE); |
| 76 | void evalDeadSymbols(CheckerContext &C, SymbolReaper &SymReaper); |
| 77 | void evalEndPath(GREndPathNodeBuilder &B, void *tag, GRExprEngine &Eng); |
Zhongxing Xu | 766c201 | 2010-07-23 14:14:59 +0000 | [diff] [blame] | 78 | void PreVisitReturnStmt(CheckerContext &C, const ReturnStmt *S); |
Zhongxing Xu | c196095 | 2010-06-16 05:38:05 +0000 | [diff] [blame] | 79 | |
| 80 | private: |
Zhongxing Xu | c7de88b | 2010-06-22 07:50:21 +0000 | [diff] [blame] | 81 | void Fopen(CheckerContext &C, const CallExpr *CE); |
Zhongxing Xu | 47dc37f | 2010-07-22 14:01:01 +0000 | [diff] [blame] | 82 | void Tmpfile(CheckerContext &C, const CallExpr *CE); |
Zhongxing Xu | 9843ba9 | 2010-07-19 01:52:29 +0000 | [diff] [blame] | 83 | void Fclose(CheckerContext &C, const CallExpr *CE); |
Zhongxing Xu | c7de88b | 2010-06-22 07:50:21 +0000 | [diff] [blame] | 84 | void Fread(CheckerContext &C, const CallExpr *CE); |
| 85 | void Fwrite(CheckerContext &C, const CallExpr *CE); |
| 86 | void Fseek(CheckerContext &C, const CallExpr *CE); |
| 87 | void Ftell(CheckerContext &C, const CallExpr *CE); |
Zhongxing Xu | 23d90f9 | 2010-06-18 02:47:46 +0000 | [diff] [blame] | 88 | void Rewind(CheckerContext &C, const CallExpr *CE); |
Zhongxing Xu | c7de88b | 2010-06-22 07:50:21 +0000 | [diff] [blame] | 89 | void Fgetpos(CheckerContext &C, const CallExpr *CE); |
| 90 | void Fsetpos(CheckerContext &C, const CallExpr *CE); |
| 91 | void Clearerr(CheckerContext &C, const CallExpr *CE); |
| 92 | void Feof(CheckerContext &C, const CallExpr *CE); |
| 93 | void Ferror(CheckerContext &C, const CallExpr *CE); |
| 94 | void Fileno(CheckerContext &C, const CallExpr *CE); |
Zhongxing Xu | 47dc37f | 2010-07-22 14:01:01 +0000 | [diff] [blame] | 95 | |
| 96 | void OpenFileAux(CheckerContext &C, const CallExpr *CE); |
Zhongxing Xu | c7de88b | 2010-06-22 07:50:21 +0000 | [diff] [blame] | 97 | |
Zhongxing Xu | 12d213d | 2010-06-24 12:52:28 +0000 | [diff] [blame] | 98 | const GRState *CheckNullStream(SVal SV, const GRState *state, |
| 99 | CheckerContext &C); |
Zhongxing Xu | 9843ba9 | 2010-07-19 01:52:29 +0000 | [diff] [blame] | 100 | const GRState *CheckDoubleClose(const CallExpr *CE, const GRState *state, |
| 101 | CheckerContext &C); |
Zhongxing Xu | c196095 | 2010-06-16 05:38:05 +0000 | [diff] [blame] | 102 | }; |
| 103 | |
Zhongxing Xu | 23d90f9 | 2010-06-18 02:47:46 +0000 | [diff] [blame] | 104 | } // end anonymous namespace |
Zhongxing Xu | c196095 | 2010-06-16 05:38:05 +0000 | [diff] [blame] | 105 | |
Zhongxing Xu | 9843ba9 | 2010-07-19 01:52:29 +0000 | [diff] [blame] | 106 | namespace clang { |
| 107 | template <> |
| 108 | struct GRStateTrait<StreamState> |
| 109 | : public GRStatePartialTrait<llvm::ImmutableMap<SymbolRef, StreamState> > { |
| 110 | static void *GDMIndex() { return StreamChecker::getTag(); } |
| 111 | }; |
| 112 | } |
| 113 | |
Zhongxing Xu | c196095 | 2010-06-16 05:38:05 +0000 | [diff] [blame] | 114 | void clang::RegisterStreamChecker(GRExprEngine &Eng) { |
| 115 | Eng.registerCheck(new StreamChecker()); |
| 116 | } |
| 117 | |
Ted Kremenek | 9c14953 | 2010-12-01 21:57:22 +0000 | [diff] [blame] | 118 | bool StreamChecker::evalCallExpr(CheckerContext &C, const CallExpr *CE) { |
Zhongxing Xu | c196095 | 2010-06-16 05:38:05 +0000 | [diff] [blame] | 119 | const GRState *state = C.getState(); |
| 120 | const Expr *Callee = CE->getCallee(); |
| 121 | SVal L = state->getSVal(Callee); |
| 122 | const FunctionDecl *FD = L.getAsFunctionDecl(); |
| 123 | if (!FD) |
| 124 | return false; |
| 125 | |
| 126 | ASTContext &Ctx = C.getASTContext(); |
| 127 | if (!II_fopen) |
| 128 | II_fopen = &Ctx.Idents.get("fopen"); |
Zhongxing Xu | 47dc37f | 2010-07-22 14:01:01 +0000 | [diff] [blame] | 129 | if (!II_tmpfile) |
| 130 | II_tmpfile = &Ctx.Idents.get("tmpfile"); |
Zhongxing Xu | 9843ba9 | 2010-07-19 01:52:29 +0000 | [diff] [blame] | 131 | if (!II_fclose) |
| 132 | II_fclose = &Ctx.Idents.get("fclose"); |
Zhongxing Xu | c196095 | 2010-06-16 05:38:05 +0000 | [diff] [blame] | 133 | if (!II_fread) |
| 134 | II_fread = &Ctx.Idents.get("fread"); |
Zhongxing Xu | c7de88b | 2010-06-22 07:50:21 +0000 | [diff] [blame] | 135 | if (!II_fwrite) |
| 136 | II_fwrite = &Ctx.Idents.get("fwrite"); |
Zhongxing Xu | 23d90f9 | 2010-06-18 02:47:46 +0000 | [diff] [blame] | 137 | if (!II_fseek) |
| 138 | II_fseek = &Ctx.Idents.get("fseek"); |
Zhongxing Xu | 23d90f9 | 2010-06-18 02:47:46 +0000 | [diff] [blame] | 139 | if (!II_ftell) |
| 140 | II_ftell = &Ctx.Idents.get("ftell"); |
Zhongxing Xu | 23d90f9 | 2010-06-18 02:47:46 +0000 | [diff] [blame] | 141 | if (!II_rewind) |
| 142 | II_rewind = &Ctx.Idents.get("rewind"); |
Zhongxing Xu | c7de88b | 2010-06-22 07:50:21 +0000 | [diff] [blame] | 143 | if (!II_fgetpos) |
| 144 | II_fgetpos = &Ctx.Idents.get("fgetpos"); |
| 145 | if (!II_fsetpos) |
| 146 | II_fsetpos = &Ctx.Idents.get("fsetpos"); |
| 147 | if (!II_clearerr) |
| 148 | II_clearerr = &Ctx.Idents.get("clearerr"); |
| 149 | if (!II_feof) |
| 150 | II_feof = &Ctx.Idents.get("feof"); |
| 151 | if (!II_ferror) |
| 152 | II_ferror = &Ctx.Idents.get("ferror"); |
| 153 | if (!II_fileno) |
| 154 | II_fileno = &Ctx.Idents.get("fileno"); |
Zhongxing Xu | 23d90f9 | 2010-06-18 02:47:46 +0000 | [diff] [blame] | 155 | |
Zhongxing Xu | c196095 | 2010-06-16 05:38:05 +0000 | [diff] [blame] | 156 | if (FD->getIdentifier() == II_fopen) { |
Zhongxing Xu | c7de88b | 2010-06-22 07:50:21 +0000 | [diff] [blame] | 157 | Fopen(C, CE); |
Zhongxing Xu | c196095 | 2010-06-16 05:38:05 +0000 | [diff] [blame] | 158 | return true; |
| 159 | } |
Zhongxing Xu | 47dc37f | 2010-07-22 14:01:01 +0000 | [diff] [blame] | 160 | if (FD->getIdentifier() == II_tmpfile) { |
| 161 | Tmpfile(C, CE); |
| 162 | return true; |
| 163 | } |
Zhongxing Xu | 9843ba9 | 2010-07-19 01:52:29 +0000 | [diff] [blame] | 164 | if (FD->getIdentifier() == II_fclose) { |
| 165 | Fclose(C, CE); |
| 166 | return true; |
| 167 | } |
Zhongxing Xu | c196095 | 2010-06-16 05:38:05 +0000 | [diff] [blame] | 168 | if (FD->getIdentifier() == II_fread) { |
Zhongxing Xu | c7de88b | 2010-06-22 07:50:21 +0000 | [diff] [blame] | 169 | Fread(C, CE); |
Zhongxing Xu | c196095 | 2010-06-16 05:38:05 +0000 | [diff] [blame] | 170 | return true; |
| 171 | } |
Zhongxing Xu | c7de88b | 2010-06-22 07:50:21 +0000 | [diff] [blame] | 172 | if (FD->getIdentifier() == II_fwrite) { |
| 173 | Fwrite(C, CE); |
| 174 | return true; |
| 175 | } |
Zhongxing Xu | 23d90f9 | 2010-06-18 02:47:46 +0000 | [diff] [blame] | 176 | if (FD->getIdentifier() == II_fseek) { |
Zhongxing Xu | c7de88b | 2010-06-22 07:50:21 +0000 | [diff] [blame] | 177 | Fseek(C, CE); |
Zhongxing Xu | 23d90f9 | 2010-06-18 02:47:46 +0000 | [diff] [blame] | 178 | return true; |
| 179 | } |
Zhongxing Xu | 23d90f9 | 2010-06-18 02:47:46 +0000 | [diff] [blame] | 180 | if (FD->getIdentifier() == II_ftell) { |
Zhongxing Xu | c7de88b | 2010-06-22 07:50:21 +0000 | [diff] [blame] | 181 | Ftell(C, CE); |
Zhongxing Xu | 23d90f9 | 2010-06-18 02:47:46 +0000 | [diff] [blame] | 182 | return true; |
| 183 | } |
Zhongxing Xu | 23d90f9 | 2010-06-18 02:47:46 +0000 | [diff] [blame] | 184 | if (FD->getIdentifier() == II_rewind) { |
| 185 | Rewind(C, CE); |
| 186 | return true; |
| 187 | } |
Zhongxing Xu | c7de88b | 2010-06-22 07:50:21 +0000 | [diff] [blame] | 188 | if (FD->getIdentifier() == II_fgetpos) { |
| 189 | Fgetpos(C, CE); |
| 190 | return true; |
| 191 | } |
| 192 | if (FD->getIdentifier() == II_fsetpos) { |
| 193 | Fsetpos(C, CE); |
| 194 | return true; |
| 195 | } |
| 196 | if (FD->getIdentifier() == II_clearerr) { |
| 197 | Clearerr(C, CE); |
| 198 | return true; |
| 199 | } |
| 200 | if (FD->getIdentifier() == II_feof) { |
| 201 | Feof(C, CE); |
| 202 | return true; |
| 203 | } |
| 204 | if (FD->getIdentifier() == II_ferror) { |
| 205 | Ferror(C, CE); |
| 206 | return true; |
| 207 | } |
| 208 | if (FD->getIdentifier() == II_fileno) { |
| 209 | Fileno(C, CE); |
| 210 | return true; |
| 211 | } |
Zhongxing Xu | 23d90f9 | 2010-06-18 02:47:46 +0000 | [diff] [blame] | 212 | |
Zhongxing Xu | c196095 | 2010-06-16 05:38:05 +0000 | [diff] [blame] | 213 | return false; |
| 214 | } |
| 215 | |
Zhongxing Xu | c7de88b | 2010-06-22 07:50:21 +0000 | [diff] [blame] | 216 | void StreamChecker::Fopen(CheckerContext &C, const CallExpr *CE) { |
Zhongxing Xu | 47dc37f | 2010-07-22 14:01:01 +0000 | [diff] [blame] | 217 | OpenFileAux(C, CE); |
| 218 | } |
| 219 | |
| 220 | void StreamChecker::Tmpfile(CheckerContext &C, const CallExpr *CE) { |
| 221 | OpenFileAux(C, CE); |
| 222 | } |
| 223 | |
| 224 | void StreamChecker::OpenFileAux(CheckerContext &C, const CallExpr *CE) { |
Zhongxing Xu | c196095 | 2010-06-16 05:38:05 +0000 | [diff] [blame] | 225 | const GRState *state = C.getState(); |
| 226 | unsigned Count = C.getNodeBuilder().getCurrentBlockCount(); |
| 227 | ValueManager &ValMgr = C.getValueManager(); |
Zhongxing Xu | 7015485 | 2010-06-16 05:52:03 +0000 | [diff] [blame] | 228 | DefinedSVal RetVal = cast<DefinedSVal>(ValMgr.getConjuredSymbolVal(0, CE, |
| 229 | Count)); |
Zhongxing Xu | c196095 | 2010-06-16 05:38:05 +0000 | [diff] [blame] | 230 | state = state->BindExpr(CE, RetVal); |
Zhongxing Xu | 47dc37f | 2010-07-22 14:01:01 +0000 | [diff] [blame] | 231 | |
Zhongxing Xu | c196095 | 2010-06-16 05:38:05 +0000 | [diff] [blame] | 232 | ConstraintManager &CM = C.getConstraintManager(); |
| 233 | // Bifurcate the state into two: one with a valid FILE* pointer, the other |
| 234 | // with a NULL. |
| 235 | const GRState *stateNotNull, *stateNull; |
Ted Kremenek | 28f47b9 | 2010-12-01 22:16:56 +0000 | [diff] [blame] | 236 | llvm::tie(stateNotNull, stateNull) = CM.assumeDual(state, RetVal); |
Zhongxing Xu | 47dc37f | 2010-07-22 14:01:01 +0000 | [diff] [blame] | 237 | |
Ted Kremenek | 8046037 | 2010-09-03 01:07:04 +0000 | [diff] [blame] | 238 | if (SymbolRef Sym = RetVal.getAsSymbol()) { |
| 239 | // if RetVal is not NULL, set the symbol's state to Opened. |
| 240 | stateNotNull = |
| 241 | stateNotNull->set<StreamState>(Sym,StreamState::getOpened(CE)); |
| 242 | stateNull = |
| 243 | stateNull->set<StreamState>(Sym, StreamState::getOpenFailed(CE)); |
Zhongxing Xu | 9843ba9 | 2010-07-19 01:52:29 +0000 | [diff] [blame] | 244 | |
Ted Kremenek | 8046037 | 2010-09-03 01:07:04 +0000 | [diff] [blame] | 245 | C.addTransition(stateNotNull); |
| 246 | C.addTransition(stateNull); |
| 247 | } |
Zhongxing Xu | c196095 | 2010-06-16 05:38:05 +0000 | [diff] [blame] | 248 | } |
| 249 | |
Zhongxing Xu | 9843ba9 | 2010-07-19 01:52:29 +0000 | [diff] [blame] | 250 | void StreamChecker::Fclose(CheckerContext &C, const CallExpr *CE) { |
| 251 | const GRState *state = CheckDoubleClose(CE, C.getState(), C); |
| 252 | if (state) |
| 253 | C.addTransition(state); |
| 254 | } |
| 255 | |
Zhongxing Xu | c7de88b | 2010-06-22 07:50:21 +0000 | [diff] [blame] | 256 | void StreamChecker::Fread(CheckerContext &C, const CallExpr *CE) { |
Zhongxing Xu | c196095 | 2010-06-16 05:38:05 +0000 | [diff] [blame] | 257 | const GRState *state = C.getState(); |
Zhongxing Xu | 12d213d | 2010-06-24 12:52:28 +0000 | [diff] [blame] | 258 | if (!CheckNullStream(state->getSVal(CE->getArg(3)), state, C)) |
Zhongxing Xu | 23d90f9 | 2010-06-18 02:47:46 +0000 | [diff] [blame] | 259 | return; |
| 260 | } |
Zhongxing Xu | c196095 | 2010-06-16 05:38:05 +0000 | [diff] [blame] | 261 | |
Zhongxing Xu | c7de88b | 2010-06-22 07:50:21 +0000 | [diff] [blame] | 262 | void StreamChecker::Fwrite(CheckerContext &C, const CallExpr *CE) { |
| 263 | const GRState *state = C.getState(); |
Zhongxing Xu | 12d213d | 2010-06-24 12:52:28 +0000 | [diff] [blame] | 264 | if (!CheckNullStream(state->getSVal(CE->getArg(3)), state, C)) |
Zhongxing Xu | c7de88b | 2010-06-22 07:50:21 +0000 | [diff] [blame] | 265 | return; |
| 266 | } |
| 267 | |
| 268 | void StreamChecker::Fseek(CheckerContext &C, const CallExpr *CE) { |
Zhongxing Xu | 23d90f9 | 2010-06-18 02:47:46 +0000 | [diff] [blame] | 269 | const GRState *state = C.getState(); |
Zhongxing Xu | 0c2e8c8 | 2010-06-24 13:36:41 +0000 | [diff] [blame] | 270 | if (!(state = CheckNullStream(state->getSVal(CE->getArg(0)), state, C))) |
Zhongxing Xu | 23d90f9 | 2010-06-18 02:47:46 +0000 | [diff] [blame] | 271 | return; |
Zhongxing Xu | 0c2e8c8 | 2010-06-24 13:36:41 +0000 | [diff] [blame] | 272 | // Check the legality of the 'whence' argument of 'fseek'. |
| 273 | SVal Whence = state->getSVal(CE->getArg(2)); |
Zhongxing Xu | 0c2e8c8 | 2010-06-24 13:36:41 +0000 | [diff] [blame] | 274 | const nonloc::ConcreteInt *CI = dyn_cast<nonloc::ConcreteInt>(&Whence); |
Ted Kremenek | 02b49bb | 2010-09-07 20:45:26 +0000 | [diff] [blame] | 275 | |
Zhongxing Xu | 0c2e8c8 | 2010-06-24 13:36:41 +0000 | [diff] [blame] | 276 | if (!CI) |
Ted Kremenek | 02b49bb | 2010-09-07 20:45:26 +0000 | [diff] [blame] | 277 | return; |
Zhongxing Xu | 0c2e8c8 | 2010-06-24 13:36:41 +0000 | [diff] [blame] | 278 | |
| 279 | int64_t x = CI->getValue().getSExtValue(); |
Ted Kremenek | 02b49bb | 2010-09-07 20:45:26 +0000 | [diff] [blame] | 280 | if (x >= 0 && x <= 2) |
Zhongxing Xu | 0c2e8c8 | 2010-06-24 13:36:41 +0000 | [diff] [blame] | 281 | return; |
Zhongxing Xu | 0c2e8c8 | 2010-06-24 13:36:41 +0000 | [diff] [blame] | 282 | |
Ted Kremenek | 02b49bb | 2010-09-07 20:45:26 +0000 | [diff] [blame] | 283 | if (ExplodedNode *N = C.GenerateNode(state)) { |
| 284 | if (!BT_illegalwhence) |
| 285 | BT_illegalwhence = new BuiltinBug("Illegal whence argument", |
| 286 | "The whence argument to fseek() should be " |
| 287 | "SEEK_SET, SEEK_END, or SEEK_CUR."); |
| 288 | BugReport *R = new BugReport(*BT_illegalwhence, |
| 289 | BT_illegalwhence->getDescription(), N); |
| 290 | C.EmitReport(R); |
| 291 | } |
Zhongxing Xu | 23d90f9 | 2010-06-18 02:47:46 +0000 | [diff] [blame] | 292 | } |
Zhongxing Xu | c196095 | 2010-06-16 05:38:05 +0000 | [diff] [blame] | 293 | |
Zhongxing Xu | c7de88b | 2010-06-22 07:50:21 +0000 | [diff] [blame] | 294 | void StreamChecker::Ftell(CheckerContext &C, const CallExpr *CE) { |
Zhongxing Xu | 23d90f9 | 2010-06-18 02:47:46 +0000 | [diff] [blame] | 295 | const GRState *state = C.getState(); |
Zhongxing Xu | 12d213d | 2010-06-24 12:52:28 +0000 | [diff] [blame] | 296 | if (!CheckNullStream(state->getSVal(CE->getArg(0)), state, C)) |
Zhongxing Xu | 23d90f9 | 2010-06-18 02:47:46 +0000 | [diff] [blame] | 297 | return; |
| 298 | } |
Zhongxing Xu | c196095 | 2010-06-16 05:38:05 +0000 | [diff] [blame] | 299 | |
Zhongxing Xu | 23d90f9 | 2010-06-18 02:47:46 +0000 | [diff] [blame] | 300 | void StreamChecker::Rewind(CheckerContext &C, const CallExpr *CE) { |
| 301 | const GRState *state = C.getState(); |
Zhongxing Xu | 12d213d | 2010-06-24 12:52:28 +0000 | [diff] [blame] | 302 | if (!CheckNullStream(state->getSVal(CE->getArg(0)), state, C)) |
Zhongxing Xu | 23d90f9 | 2010-06-18 02:47:46 +0000 | [diff] [blame] | 303 | return; |
| 304 | } |
| 305 | |
Zhongxing Xu | c7de88b | 2010-06-22 07:50:21 +0000 | [diff] [blame] | 306 | void StreamChecker::Fgetpos(CheckerContext &C, const CallExpr *CE) { |
| 307 | const GRState *state = C.getState(); |
Zhongxing Xu | 12d213d | 2010-06-24 12:52:28 +0000 | [diff] [blame] | 308 | if (!CheckNullStream(state->getSVal(CE->getArg(0)), state, C)) |
Zhongxing Xu | c7de88b | 2010-06-22 07:50:21 +0000 | [diff] [blame] | 309 | return; |
| 310 | } |
| 311 | |
| 312 | void StreamChecker::Fsetpos(CheckerContext &C, const CallExpr *CE) { |
| 313 | const GRState *state = C.getState(); |
Zhongxing Xu | 12d213d | 2010-06-24 12:52:28 +0000 | [diff] [blame] | 314 | if (!CheckNullStream(state->getSVal(CE->getArg(0)), state, C)) |
Zhongxing Xu | c7de88b | 2010-06-22 07:50:21 +0000 | [diff] [blame] | 315 | return; |
| 316 | } |
| 317 | |
| 318 | void StreamChecker::Clearerr(CheckerContext &C, const CallExpr *CE) { |
| 319 | const GRState *state = C.getState(); |
Zhongxing Xu | 12d213d | 2010-06-24 12:52:28 +0000 | [diff] [blame] | 320 | if (!CheckNullStream(state->getSVal(CE->getArg(0)), state, C)) |
Zhongxing Xu | c7de88b | 2010-06-22 07:50:21 +0000 | [diff] [blame] | 321 | return; |
| 322 | } |
| 323 | |
| 324 | void StreamChecker::Feof(CheckerContext &C, const CallExpr *CE) { |
| 325 | const GRState *state = C.getState(); |
Zhongxing Xu | 12d213d | 2010-06-24 12:52:28 +0000 | [diff] [blame] | 326 | if (!CheckNullStream(state->getSVal(CE->getArg(0)), state, C)) |
Zhongxing Xu | c7de88b | 2010-06-22 07:50:21 +0000 | [diff] [blame] | 327 | return; |
| 328 | } |
| 329 | |
| 330 | void StreamChecker::Ferror(CheckerContext &C, const CallExpr *CE) { |
| 331 | const GRState *state = C.getState(); |
Zhongxing Xu | 12d213d | 2010-06-24 12:52:28 +0000 | [diff] [blame] | 332 | if (!CheckNullStream(state->getSVal(CE->getArg(0)), state, C)) |
Zhongxing Xu | c7de88b | 2010-06-22 07:50:21 +0000 | [diff] [blame] | 333 | return; |
| 334 | } |
| 335 | |
| 336 | void StreamChecker::Fileno(CheckerContext &C, const CallExpr *CE) { |
| 337 | const GRState *state = C.getState(); |
Zhongxing Xu | 12d213d | 2010-06-24 12:52:28 +0000 | [diff] [blame] | 338 | if (!CheckNullStream(state->getSVal(CE->getArg(0)), state, C)) |
Zhongxing Xu | c7de88b | 2010-06-22 07:50:21 +0000 | [diff] [blame] | 339 | return; |
| 340 | } |
| 341 | |
Zhongxing Xu | 12d213d | 2010-06-24 12:52:28 +0000 | [diff] [blame] | 342 | const GRState *StreamChecker::CheckNullStream(SVal SV, const GRState *state, |
Zhongxing Xu | 23d90f9 | 2010-06-18 02:47:46 +0000 | [diff] [blame] | 343 | CheckerContext &C) { |
| 344 | const DefinedSVal *DV = dyn_cast<DefinedSVal>(&SV); |
| 345 | if (!DV) |
Ted Kremenek | 2b11fb2 | 2010-06-24 16:26:12 +0000 | [diff] [blame] | 346 | return 0; |
Zhongxing Xu | 23d90f9 | 2010-06-18 02:47:46 +0000 | [diff] [blame] | 347 | |
| 348 | ConstraintManager &CM = C.getConstraintManager(); |
| 349 | const GRState *stateNotNull, *stateNull; |
Ted Kremenek | 28f47b9 | 2010-12-01 22:16:56 +0000 | [diff] [blame] | 350 | llvm::tie(stateNotNull, stateNull) = CM.assumeDual(state, *DV); |
Zhongxing Xu | 23d90f9 | 2010-06-18 02:47:46 +0000 | [diff] [blame] | 351 | |
| 352 | if (!stateNotNull && stateNull) { |
| 353 | if (ExplodedNode *N = C.GenerateSink(stateNull)) { |
| 354 | if (!BT_nullfp) |
| 355 | BT_nullfp = new BuiltinBug("NULL stream pointer", |
Zhongxing Xu | b3f4031 | 2010-06-16 05:56:39 +0000 | [diff] [blame] | 356 | "Stream pointer might be NULL."); |
Zhongxing Xu | 23d90f9 | 2010-06-18 02:47:46 +0000 | [diff] [blame] | 357 | BugReport *R =new BugReport(*BT_nullfp, BT_nullfp->getDescription(), N); |
| 358 | C.EmitReport(R); |
Zhongxing Xu | c196095 | 2010-06-16 05:38:05 +0000 | [diff] [blame] | 359 | } |
Zhongxing Xu | 12d213d | 2010-06-24 12:52:28 +0000 | [diff] [blame] | 360 | return 0; |
Zhongxing Xu | c196095 | 2010-06-16 05:38:05 +0000 | [diff] [blame] | 361 | } |
Zhongxing Xu | ab42130 | 2010-06-24 13:09:02 +0000 | [diff] [blame] | 362 | return stateNotNull; |
Zhongxing Xu | c196095 | 2010-06-16 05:38:05 +0000 | [diff] [blame] | 363 | } |
Zhongxing Xu | 9843ba9 | 2010-07-19 01:52:29 +0000 | [diff] [blame] | 364 | |
| 365 | const GRState *StreamChecker::CheckDoubleClose(const CallExpr *CE, |
Eli Friedman | a7e6845 | 2010-08-22 01:00:03 +0000 | [diff] [blame] | 366 | const GRState *state, |
| 367 | CheckerContext &C) { |
Zhongxing Xu | 9843ba9 | 2010-07-19 01:52:29 +0000 | [diff] [blame] | 368 | SymbolRef Sym = state->getSVal(CE->getArg(0)).getAsSymbol(); |
Ted Kremenek | 8046037 | 2010-09-03 01:07:04 +0000 | [diff] [blame] | 369 | if (!Sym) |
| 370 | return state; |
Zhongxing Xu | 9843ba9 | 2010-07-19 01:52:29 +0000 | [diff] [blame] | 371 | |
| 372 | const StreamState *SS = state->get<StreamState>(Sym); |
Zhongxing Xu | 1c7370f | 2010-08-05 23:24:13 +0000 | [diff] [blame] | 373 | |
| 374 | // If the file stream is not tracked, return. |
| 375 | if (!SS) |
| 376 | return state; |
Zhongxing Xu | 9843ba9 | 2010-07-19 01:52:29 +0000 | [diff] [blame] | 377 | |
| 378 | // Check: Double close a File Descriptor could cause undefined behaviour. |
| 379 | // Conforming to man-pages |
| 380 | if (SS->isClosed()) { |
| 381 | ExplodedNode *N = C.GenerateSink(); |
| 382 | if (N) { |
| 383 | if (!BT_doubleclose) |
Eli Friedman | a7e6845 | 2010-08-22 01:00:03 +0000 | [diff] [blame] | 384 | BT_doubleclose = new BuiltinBug("Double fclose", |
| 385 | "Try to close a file Descriptor already" |
| 386 | " closed. Cause undefined behaviour."); |
Zhongxing Xu | 9843ba9 | 2010-07-19 01:52:29 +0000 | [diff] [blame] | 387 | BugReport *R = new BugReport(*BT_doubleclose, |
Eli Friedman | a7e6845 | 2010-08-22 01:00:03 +0000 | [diff] [blame] | 388 | BT_doubleclose->getDescription(), N); |
Zhongxing Xu | 9843ba9 | 2010-07-19 01:52:29 +0000 | [diff] [blame] | 389 | C.EmitReport(R); |
| 390 | } |
| 391 | return NULL; |
| 392 | } |
| 393 | |
| 394 | // Close the File Descriptor. |
| 395 | return state->set<StreamState>(Sym, StreamState::getClosed(CE)); |
| 396 | } |
Zhongxing Xu | 766c201 | 2010-07-23 14:14:59 +0000 | [diff] [blame] | 397 | |
Ted Kremenek | 9c14953 | 2010-12-01 21:57:22 +0000 | [diff] [blame] | 398 | void StreamChecker::evalDeadSymbols(CheckerContext &C,SymbolReaper &SymReaper) { |
Zhongxing Xu | 766c201 | 2010-07-23 14:14:59 +0000 | [diff] [blame] | 399 | for (SymbolReaper::dead_iterator I = SymReaper.dead_begin(), |
Eli Friedman | a7e6845 | 2010-08-22 01:00:03 +0000 | [diff] [blame] | 400 | E = SymReaper.dead_end(); I != E; ++I) { |
Zhongxing Xu | 766c201 | 2010-07-23 14:14:59 +0000 | [diff] [blame] | 401 | SymbolRef Sym = *I; |
| 402 | const GRState *state = C.getState(); |
| 403 | const StreamState *SS = state->get<StreamState>(Sym); |
| 404 | if (!SS) |
| 405 | return; |
| 406 | |
| 407 | if (SS->isOpened()) { |
| 408 | ExplodedNode *N = C.GenerateSink(); |
| 409 | if (N) { |
Eli Friedman | a7e6845 | 2010-08-22 01:00:03 +0000 | [diff] [blame] | 410 | if (!BT_ResourceLeak) |
| 411 | BT_ResourceLeak = new BuiltinBug("Resource Leak", |
| 412 | "Opened File never closed. Potential Resource leak."); |
| 413 | BugReport *R = new BugReport(*BT_ResourceLeak, |
| 414 | BT_ResourceLeak->getDescription(), N); |
| 415 | C.EmitReport(R); |
Zhongxing Xu | 766c201 | 2010-07-23 14:14:59 +0000 | [diff] [blame] | 416 | } |
| 417 | } |
| 418 | } |
| 419 | } |
| 420 | |
Ted Kremenek | 9c14953 | 2010-12-01 21:57:22 +0000 | [diff] [blame] | 421 | void StreamChecker::evalEndPath(GREndPathNodeBuilder &B, void *tag, |
Eli Friedman | a7e6845 | 2010-08-22 01:00:03 +0000 | [diff] [blame] | 422 | GRExprEngine &Eng) { |
Zhongxing Xu | 766c201 | 2010-07-23 14:14:59 +0000 | [diff] [blame] | 423 | SaveAndRestore<bool> OldHasGen(B.HasGeneratedNode); |
| 424 | const GRState *state = B.getState(); |
| 425 | typedef llvm::ImmutableMap<SymbolRef, StreamState> SymMap; |
| 426 | SymMap M = state->get<StreamState>(); |
| 427 | |
| 428 | for (SymMap::iterator I = M.begin(), E = M.end(); I != E; ++I) { |
| 429 | StreamState SS = I->second; |
| 430 | if (SS.isOpened()) { |
| 431 | ExplodedNode *N = B.generateNode(state, tag, B.getPredecessor()); |
| 432 | if (N) { |
| 433 | if (!BT_ResourceLeak) |
| 434 | BT_ResourceLeak = new BuiltinBug("Resource Leak", |
Eli Friedman | a7e6845 | 2010-08-22 01:00:03 +0000 | [diff] [blame] | 435 | "Opened File never closed. Potential Resource leak."); |
Zhongxing Xu | 766c201 | 2010-07-23 14:14:59 +0000 | [diff] [blame] | 436 | BugReport *R = new BugReport(*BT_ResourceLeak, |
Eli Friedman | a7e6845 | 2010-08-22 01:00:03 +0000 | [diff] [blame] | 437 | BT_ResourceLeak->getDescription(), N); |
Zhongxing Xu | 766c201 | 2010-07-23 14:14:59 +0000 | [diff] [blame] | 438 | Eng.getBugReporter().EmitReport(R); |
| 439 | } |
| 440 | } |
| 441 | } |
| 442 | } |
| 443 | |
| 444 | void StreamChecker::PreVisitReturnStmt(CheckerContext &C, const ReturnStmt *S) { |
| 445 | const Expr *RetE = S->getRetValue(); |
| 446 | if (!RetE) |
| 447 | return; |
| 448 | |
| 449 | const GRState *state = C.getState(); |
| 450 | SymbolRef Sym = state->getSVal(RetE).getAsSymbol(); |
| 451 | |
| 452 | if (!Sym) |
| 453 | return; |
| 454 | |
| 455 | const StreamState *SS = state->get<StreamState>(Sym); |
| 456 | if(!SS) |
| 457 | return; |
| 458 | |
| 459 | if (SS->isOpened()) |
| 460 | state = state->set<StreamState>(Sym, StreamState::getEscaped(S)); |
| 461 | |
| 462 | C.addTransition(state); |
| 463 | } |