blob: 137b8cea98dc0b8b6b35165ea723200b84a3a20f [file] [log] [blame]
Zhongxing Xuc1960952010-06-16 05:38:05 +00001//===-- StreamChecker.cpp -----------------------------------------*- C++ -*--//
2//
3// The LLVM Compiler Infrastructure
4//
5// This file is distributed under the University of Illinois Open Source
6// License. See LICENSE.TXT for details.
7//
8//===----------------------------------------------------------------------===//
9//
10// This file defines checkers that model and check stream handling functions.
11//
12//===----------------------------------------------------------------------===//
13
Argyrios Kyrtzidisa0decc92011-02-15 21:25:03 +000014#include "ClangSACheckers.h"
Argyrios Kyrtzidisec8605f2011-03-01 01:16:21 +000015#include "clang/StaticAnalyzer/Core/Checker.h"
Argyrios Kyrtzidis695fb502011-02-17 21:39:17 +000016#include "clang/StaticAnalyzer/Core/CheckerManager.h"
Argyrios Kyrtzidis699bbf92011-02-24 01:05:33 +000017#include "clang/StaticAnalyzer/Core/PathSensitive/CheckerContext.h"
Ted Kremenek9b663712011-02-10 01:03:03 +000018#include "clang/StaticAnalyzer/Core/BugReporter/BugType.h"
Ted Kremenek18c66fd2011-08-15 22:09:50 +000019#include "clang/StaticAnalyzer/Core/PathSensitive/ProgramState.h"
20#include "clang/StaticAnalyzer/Core/PathSensitive/ProgramStateTrait.h"
Ted Kremenek9b663712011-02-10 01:03:03 +000021#include "clang/StaticAnalyzer/Core/PathSensitive/SymbolManager.h"
Zhongxing Xuc1960952010-06-16 05:38:05 +000022#include "llvm/ADT/ImmutableMap.h"
Benjamin Kramer00bd44d2012-02-04 12:31:12 +000023#include "llvm/ADT/STLExtras.h"
Zhongxing Xuc1960952010-06-16 05:38:05 +000024
25using namespace clang;
Ted Kremenek9ef65372010-12-23 07:20:52 +000026using namespace ento;
Zhongxing Xuc1960952010-06-16 05:38:05 +000027
28namespace {
29
Zhongxing Xu9843ba92010-07-19 01:52:29 +000030struct StreamState {
Zhongxing Xu766c2012010-07-23 14:14:59 +000031 enum Kind { Opened, Closed, OpenFailed, Escaped } K;
Zhongxing Xu9843ba92010-07-19 01:52:29 +000032 const Stmt *S;
33
34 StreamState(Kind k, const Stmt *s) : K(k), S(s) {}
35
36 bool isOpened() const { return K == Opened; }
37 bool isClosed() const { return K == Closed; }
Chris Lattnerfae96222010-09-03 04:34:38 +000038 //bool isOpenFailed() const { return K == OpenFailed; }
39 //bool isEscaped() const { return K == Escaped; }
Zhongxing Xu9843ba92010-07-19 01:52:29 +000040
41 bool operator==(const StreamState &X) const {
42 return K == X.K && S == X.S;
43 }
44
45 static StreamState getOpened(const Stmt *s) { return StreamState(Opened, s); }
46 static StreamState getClosed(const Stmt *s) { return StreamState(Closed, s); }
Zhongxing Xu47dc37f2010-07-22 14:01:01 +000047 static StreamState getOpenFailed(const Stmt *s) {
48 return StreamState(OpenFailed, s);
49 }
Zhongxing Xu766c2012010-07-23 14:14:59 +000050 static StreamState getEscaped(const Stmt *s) {
51 return StreamState(Escaped, s);
52 }
Zhongxing Xu9843ba92010-07-19 01:52:29 +000053
54 void Profile(llvm::FoldingSetNodeID &ID) const {
55 ID.AddInteger(K);
56 ID.AddPointer(S);
57 }
58};
59
Argyrios Kyrtzidisec8605f2011-03-01 01:16:21 +000060class StreamChecker : public Checker<eval::Call,
Argyrios Kyrtzidis699bbf92011-02-24 01:05:33 +000061 check::DeadSymbols,
62 check::EndPath,
63 check::PreStmt<ReturnStmt> > {
64 mutable IdentifierInfo *II_fopen, *II_tmpfile, *II_fclose, *II_fread,
65 *II_fwrite,
Zhongxing Xuc7de88b2010-06-22 07:50:21 +000066 *II_fseek, *II_ftell, *II_rewind, *II_fgetpos, *II_fsetpos,
67 *II_clearerr, *II_feof, *II_ferror, *II_fileno;
Dylan Noblesmith6f42b622012-02-05 02:12:40 +000068 mutable OwningPtr<BuiltinBug> BT_nullfp, BT_illegalwhence,
Argyrios Kyrtzidis699bbf92011-02-24 01:05:33 +000069 BT_doubleclose, BT_ResourceLeak;
Zhongxing Xuc1960952010-06-16 05:38:05 +000070
71public:
Zhongxing Xu23d90f92010-06-18 02:47:46 +000072 StreamChecker()
Zhongxing Xu47dc37f2010-07-22 14:01:01 +000073 : II_fopen(0), II_tmpfile(0) ,II_fclose(0), II_fread(0), II_fwrite(0),
Zhongxing Xuc7de88b2010-06-22 07:50:21 +000074 II_fseek(0), II_ftell(0), II_rewind(0), II_fgetpos(0), II_fsetpos(0),
Argyrios Kyrtzidis699bbf92011-02-24 01:05:33 +000075 II_clearerr(0), II_feof(0), II_ferror(0), II_fileno(0) {}
Zhongxing Xuc1960952010-06-16 05:38:05 +000076
Argyrios Kyrtzidis699bbf92011-02-24 01:05:33 +000077 bool evalCall(const CallExpr *CE, CheckerContext &C) const;
78 void checkDeadSymbols(SymbolReaper &SymReaper, CheckerContext &C) const;
Anna Zaksaf498a22011-10-25 19:56:48 +000079 void checkEndPath(CheckerContext &Ctx) const;
Argyrios Kyrtzidis699bbf92011-02-24 01:05:33 +000080 void checkPreStmt(const ReturnStmt *S, CheckerContext &C) const;
Zhongxing Xuc1960952010-06-16 05:38:05 +000081
82private:
Argyrios Kyrtzidis699bbf92011-02-24 01:05:33 +000083 void Fopen(CheckerContext &C, const CallExpr *CE) const;
84 void Tmpfile(CheckerContext &C, const CallExpr *CE) const;
85 void Fclose(CheckerContext &C, const CallExpr *CE) const;
86 void Fread(CheckerContext &C, const CallExpr *CE) const;
87 void Fwrite(CheckerContext &C, const CallExpr *CE) const;
88 void Fseek(CheckerContext &C, const CallExpr *CE) const;
89 void Ftell(CheckerContext &C, const CallExpr *CE) const;
90 void Rewind(CheckerContext &C, const CallExpr *CE) const;
91 void Fgetpos(CheckerContext &C, const CallExpr *CE) const;
92 void Fsetpos(CheckerContext &C, const CallExpr *CE) const;
93 void Clearerr(CheckerContext &C, const CallExpr *CE) const;
94 void Feof(CheckerContext &C, const CallExpr *CE) const;
95 void Ferror(CheckerContext &C, const CallExpr *CE) const;
96 void Fileno(CheckerContext &C, const CallExpr *CE) const;
Zhongxing Xu47dc37f2010-07-22 14:01:01 +000097
Argyrios Kyrtzidis699bbf92011-02-24 01:05:33 +000098 void OpenFileAux(CheckerContext &C, const CallExpr *CE) const;
Zhongxing Xuc7de88b2010-06-22 07:50:21 +000099
Ted Kremenek8bef8232012-01-26 21:29:00 +0000100 ProgramStateRef CheckNullStream(SVal SV, ProgramStateRef state,
Argyrios Kyrtzidis699bbf92011-02-24 01:05:33 +0000101 CheckerContext &C) const;
Ted Kremenek8bef8232012-01-26 21:29:00 +0000102 ProgramStateRef CheckDoubleClose(const CallExpr *CE, ProgramStateRef state,
Argyrios Kyrtzidis699bbf92011-02-24 01:05:33 +0000103 CheckerContext &C) const;
Zhongxing Xuc1960952010-06-16 05:38:05 +0000104};
105
Zhongxing Xu23d90f92010-06-18 02:47:46 +0000106} // end anonymous namespace
Zhongxing Xuc1960952010-06-16 05:38:05 +0000107
Zhongxing Xu9843ba92010-07-19 01:52:29 +0000108namespace clang {
Ted Kremenek9ef65372010-12-23 07:20:52 +0000109namespace ento {
Zhongxing Xu9843ba92010-07-19 01:52:29 +0000110 template <>
Ted Kremenek18c66fd2011-08-15 22:09:50 +0000111 struct ProgramStateTrait<StreamState>
112 : public ProgramStatePartialTrait<llvm::ImmutableMap<SymbolRef, StreamState> > {
Argyrios Kyrtzidis699bbf92011-02-24 01:05:33 +0000113 static void *GDMIndex() { static int x; return &x; }
Zhongxing Xu9843ba92010-07-19 01:52:29 +0000114 };
115}
Argyrios Kyrtzidis5a4f98f2010-12-22 18:53:20 +0000116}
Zhongxing Xu9843ba92010-07-19 01:52:29 +0000117
Argyrios Kyrtzidis699bbf92011-02-24 01:05:33 +0000118bool StreamChecker::evalCall(const CallExpr *CE, CheckerContext &C) const {
Anna Zaksb805c8f2011-12-01 05:57:37 +0000119 const FunctionDecl *FD = C.getCalleeDecl(CE);
Zhongxing Xuc1960952010-06-16 05:38:05 +0000120 if (!FD)
121 return false;
122
123 ASTContext &Ctx = C.getASTContext();
124 if (!II_fopen)
125 II_fopen = &Ctx.Idents.get("fopen");
Zhongxing Xu47dc37f2010-07-22 14:01:01 +0000126 if (!II_tmpfile)
127 II_tmpfile = &Ctx.Idents.get("tmpfile");
Zhongxing Xu9843ba92010-07-19 01:52:29 +0000128 if (!II_fclose)
129 II_fclose = &Ctx.Idents.get("fclose");
Zhongxing Xuc1960952010-06-16 05:38:05 +0000130 if (!II_fread)
131 II_fread = &Ctx.Idents.get("fread");
Zhongxing Xuc7de88b2010-06-22 07:50:21 +0000132 if (!II_fwrite)
133 II_fwrite = &Ctx.Idents.get("fwrite");
Zhongxing Xu23d90f92010-06-18 02:47:46 +0000134 if (!II_fseek)
135 II_fseek = &Ctx.Idents.get("fseek");
Zhongxing Xu23d90f92010-06-18 02:47:46 +0000136 if (!II_ftell)
137 II_ftell = &Ctx.Idents.get("ftell");
Zhongxing Xu23d90f92010-06-18 02:47:46 +0000138 if (!II_rewind)
139 II_rewind = &Ctx.Idents.get("rewind");
Zhongxing Xuc7de88b2010-06-22 07:50:21 +0000140 if (!II_fgetpos)
141 II_fgetpos = &Ctx.Idents.get("fgetpos");
142 if (!II_fsetpos)
143 II_fsetpos = &Ctx.Idents.get("fsetpos");
144 if (!II_clearerr)
145 II_clearerr = &Ctx.Idents.get("clearerr");
146 if (!II_feof)
147 II_feof = &Ctx.Idents.get("feof");
148 if (!II_ferror)
149 II_ferror = &Ctx.Idents.get("ferror");
150 if (!II_fileno)
151 II_fileno = &Ctx.Idents.get("fileno");
Zhongxing Xu23d90f92010-06-18 02:47:46 +0000152
Zhongxing Xuc1960952010-06-16 05:38:05 +0000153 if (FD->getIdentifier() == II_fopen) {
Zhongxing Xuc7de88b2010-06-22 07:50:21 +0000154 Fopen(C, CE);
Zhongxing Xuc1960952010-06-16 05:38:05 +0000155 return true;
156 }
Zhongxing Xu47dc37f2010-07-22 14:01:01 +0000157 if (FD->getIdentifier() == II_tmpfile) {
158 Tmpfile(C, CE);
159 return true;
160 }
Zhongxing Xu9843ba92010-07-19 01:52:29 +0000161 if (FD->getIdentifier() == II_fclose) {
162 Fclose(C, CE);
163 return true;
164 }
Zhongxing Xuc1960952010-06-16 05:38:05 +0000165 if (FD->getIdentifier() == II_fread) {
Zhongxing Xuc7de88b2010-06-22 07:50:21 +0000166 Fread(C, CE);
Zhongxing Xuc1960952010-06-16 05:38:05 +0000167 return true;
168 }
Zhongxing Xuc7de88b2010-06-22 07:50:21 +0000169 if (FD->getIdentifier() == II_fwrite) {
170 Fwrite(C, CE);
171 return true;
172 }
Zhongxing Xu23d90f92010-06-18 02:47:46 +0000173 if (FD->getIdentifier() == II_fseek) {
Zhongxing Xuc7de88b2010-06-22 07:50:21 +0000174 Fseek(C, CE);
Zhongxing Xu23d90f92010-06-18 02:47:46 +0000175 return true;
176 }
Zhongxing Xu23d90f92010-06-18 02:47:46 +0000177 if (FD->getIdentifier() == II_ftell) {
Zhongxing Xuc7de88b2010-06-22 07:50:21 +0000178 Ftell(C, CE);
Zhongxing Xu23d90f92010-06-18 02:47:46 +0000179 return true;
180 }
Zhongxing Xu23d90f92010-06-18 02:47:46 +0000181 if (FD->getIdentifier() == II_rewind) {
182 Rewind(C, CE);
183 return true;
184 }
Zhongxing Xuc7de88b2010-06-22 07:50:21 +0000185 if (FD->getIdentifier() == II_fgetpos) {
186 Fgetpos(C, CE);
187 return true;
188 }
189 if (FD->getIdentifier() == II_fsetpos) {
190 Fsetpos(C, CE);
191 return true;
192 }
193 if (FD->getIdentifier() == II_clearerr) {
194 Clearerr(C, CE);
195 return true;
196 }
197 if (FD->getIdentifier() == II_feof) {
198 Feof(C, CE);
199 return true;
200 }
201 if (FD->getIdentifier() == II_ferror) {
202 Ferror(C, CE);
203 return true;
204 }
205 if (FD->getIdentifier() == II_fileno) {
206 Fileno(C, CE);
207 return true;
208 }
Zhongxing Xu23d90f92010-06-18 02:47:46 +0000209
Zhongxing Xuc1960952010-06-16 05:38:05 +0000210 return false;
211}
212
Argyrios Kyrtzidis699bbf92011-02-24 01:05:33 +0000213void StreamChecker::Fopen(CheckerContext &C, const CallExpr *CE) const {
Zhongxing Xu47dc37f2010-07-22 14:01:01 +0000214 OpenFileAux(C, CE);
215}
216
Argyrios Kyrtzidis699bbf92011-02-24 01:05:33 +0000217void StreamChecker::Tmpfile(CheckerContext &C, const CallExpr *CE) const {
Zhongxing Xu47dc37f2010-07-22 14:01:01 +0000218 OpenFileAux(C, CE);
219}
220
Argyrios Kyrtzidis699bbf92011-02-24 01:05:33 +0000221void StreamChecker::OpenFileAux(CheckerContext &C, const CallExpr *CE) const {
Ted Kremenek8bef8232012-01-26 21:29:00 +0000222 ProgramStateRef state = C.getState();
Anna Zaks5d0ea6d2011-10-04 20:43:05 +0000223 unsigned Count = C.getCurrentBlockCount();
Ted Kremenekc8413fd2010-12-02 07:49:45 +0000224 SValBuilder &svalBuilder = C.getSValBuilder();
225 DefinedSVal RetVal =
226 cast<DefinedSVal>(svalBuilder.getConjuredSymbolVal(0, CE, Count));
Ted Kremenek5eca4822012-01-06 22:09:28 +0000227 state = state->BindExpr(CE, C.getLocationContext(), RetVal);
Zhongxing Xu47dc37f2010-07-22 14:01:01 +0000228
Zhongxing Xuc1960952010-06-16 05:38:05 +0000229 ConstraintManager &CM = C.getConstraintManager();
230 // Bifurcate the state into two: one with a valid FILE* pointer, the other
231 // with a NULL.
Ted Kremenek8bef8232012-01-26 21:29:00 +0000232 ProgramStateRef stateNotNull, stateNull;
Ted Kremenek28f47b92010-12-01 22:16:56 +0000233 llvm::tie(stateNotNull, stateNull) = CM.assumeDual(state, RetVal);
Zhongxing Xu47dc37f2010-07-22 14:01:01 +0000234
Ted Kremenek80460372010-09-03 01:07:04 +0000235 if (SymbolRef Sym = RetVal.getAsSymbol()) {
236 // if RetVal is not NULL, set the symbol's state to Opened.
237 stateNotNull =
238 stateNotNull->set<StreamState>(Sym,StreamState::getOpened(CE));
239 stateNull =
240 stateNull->set<StreamState>(Sym, StreamState::getOpenFailed(CE));
Zhongxing Xu9843ba92010-07-19 01:52:29 +0000241
Anna Zaks0bd6b112011-10-26 21:06:34 +0000242 C.addTransition(stateNotNull);
243 C.addTransition(stateNull);
Ted Kremenek80460372010-09-03 01:07:04 +0000244 }
Zhongxing Xuc1960952010-06-16 05:38:05 +0000245}
246
Argyrios Kyrtzidis699bbf92011-02-24 01:05:33 +0000247void StreamChecker::Fclose(CheckerContext &C, const CallExpr *CE) const {
Ted Kremenek8bef8232012-01-26 21:29:00 +0000248 ProgramStateRef state = CheckDoubleClose(CE, C.getState(), C);
Zhongxing Xu9843ba92010-07-19 01:52:29 +0000249 if (state)
Anna Zaks0bd6b112011-10-26 21:06:34 +0000250 C.addTransition(state);
Zhongxing Xu9843ba92010-07-19 01:52:29 +0000251}
252
Argyrios Kyrtzidis699bbf92011-02-24 01:05:33 +0000253void StreamChecker::Fread(CheckerContext &C, const CallExpr *CE) const {
Ted Kremenek8bef8232012-01-26 21:29:00 +0000254 ProgramStateRef state = C.getState();
Ted Kremenek5eca4822012-01-06 22:09:28 +0000255 if (!CheckNullStream(state->getSVal(CE->getArg(3), C.getLocationContext()),
256 state, C))
Zhongxing Xu23d90f92010-06-18 02:47:46 +0000257 return;
258}
Zhongxing Xuc1960952010-06-16 05:38:05 +0000259
Argyrios Kyrtzidis699bbf92011-02-24 01:05:33 +0000260void StreamChecker::Fwrite(CheckerContext &C, const CallExpr *CE) const {
Ted Kremenek8bef8232012-01-26 21:29:00 +0000261 ProgramStateRef state = C.getState();
Ted Kremenek5eca4822012-01-06 22:09:28 +0000262 if (!CheckNullStream(state->getSVal(CE->getArg(3), C.getLocationContext()),
263 state, C))
Zhongxing Xuc7de88b2010-06-22 07:50:21 +0000264 return;
265}
266
Argyrios Kyrtzidis699bbf92011-02-24 01:05:33 +0000267void StreamChecker::Fseek(CheckerContext &C, const CallExpr *CE) const {
Ted Kremenek8bef8232012-01-26 21:29:00 +0000268 ProgramStateRef state = C.getState();
Ted Kremenek5eca4822012-01-06 22:09:28 +0000269 if (!(state = CheckNullStream(state->getSVal(CE->getArg(0),
270 C.getLocationContext()), state, C)))
Zhongxing Xu23d90f92010-06-18 02:47:46 +0000271 return;
Zhongxing Xu0c2e8c82010-06-24 13:36:41 +0000272 // Check the legality of the 'whence' argument of 'fseek'.
Ted Kremenek5eca4822012-01-06 22:09:28 +0000273 SVal Whence = state->getSVal(CE->getArg(2), C.getLocationContext());
Zhongxing Xu0c2e8c82010-06-24 13:36:41 +0000274 const nonloc::ConcreteInt *CI = dyn_cast<nonloc::ConcreteInt>(&Whence);
Ted Kremenek02b49bb2010-09-07 20:45:26 +0000275
Zhongxing Xu0c2e8c82010-06-24 13:36:41 +0000276 if (!CI)
Ted Kremenek02b49bb2010-09-07 20:45:26 +0000277 return;
Zhongxing Xu0c2e8c82010-06-24 13:36:41 +0000278
279 int64_t x = CI->getValue().getSExtValue();
Ted Kremenek02b49bb2010-09-07 20:45:26 +0000280 if (x >= 0 && x <= 2)
Zhongxing Xu0c2e8c82010-06-24 13:36:41 +0000281 return;
Zhongxing Xu0c2e8c82010-06-24 13:36:41 +0000282
Anna Zaks0bd6b112011-10-26 21:06:34 +0000283 if (ExplodedNode *N = C.addTransition(state)) {
Ted Kremenek02b49bb2010-09-07 20:45:26 +0000284 if (!BT_illegalwhence)
Argyrios Kyrtzidis699bbf92011-02-24 01:05:33 +0000285 BT_illegalwhence.reset(new BuiltinBug("Illegal whence argument",
Ted Kremenek02b49bb2010-09-07 20:45:26 +0000286 "The whence argument to fseek() should be "
Argyrios Kyrtzidis699bbf92011-02-24 01:05:33 +0000287 "SEEK_SET, SEEK_END, or SEEK_CUR."));
Ted Kremenek02b49bb2010-09-07 20:45:26 +0000288 BugReport *R = new BugReport(*BT_illegalwhence,
289 BT_illegalwhence->getDescription(), N);
290 C.EmitReport(R);
291 }
Zhongxing Xu23d90f92010-06-18 02:47:46 +0000292}
Zhongxing Xuc1960952010-06-16 05:38:05 +0000293
Argyrios Kyrtzidis699bbf92011-02-24 01:05:33 +0000294void StreamChecker::Ftell(CheckerContext &C, const CallExpr *CE) const {
Ted Kremenek8bef8232012-01-26 21:29:00 +0000295 ProgramStateRef state = C.getState();
Ted Kremenek5eca4822012-01-06 22:09:28 +0000296 if (!CheckNullStream(state->getSVal(CE->getArg(0), C.getLocationContext()),
297 state, C))
Zhongxing Xu23d90f92010-06-18 02:47:46 +0000298 return;
299}
Zhongxing Xuc1960952010-06-16 05:38:05 +0000300
Argyrios Kyrtzidis699bbf92011-02-24 01:05:33 +0000301void StreamChecker::Rewind(CheckerContext &C, const CallExpr *CE) const {
Ted Kremenek8bef8232012-01-26 21:29:00 +0000302 ProgramStateRef state = C.getState();
Ted Kremenek5eca4822012-01-06 22:09:28 +0000303 if (!CheckNullStream(state->getSVal(CE->getArg(0), C.getLocationContext()),
304 state, C))
Zhongxing Xu23d90f92010-06-18 02:47:46 +0000305 return;
306}
307
Argyrios Kyrtzidis699bbf92011-02-24 01:05:33 +0000308void StreamChecker::Fgetpos(CheckerContext &C, const CallExpr *CE) const {
Ted Kremenek8bef8232012-01-26 21:29:00 +0000309 ProgramStateRef state = C.getState();
Ted Kremenek5eca4822012-01-06 22:09:28 +0000310 if (!CheckNullStream(state->getSVal(CE->getArg(0), C.getLocationContext()),
311 state, C))
Zhongxing Xuc7de88b2010-06-22 07:50:21 +0000312 return;
313}
314
Argyrios Kyrtzidis699bbf92011-02-24 01:05:33 +0000315void StreamChecker::Fsetpos(CheckerContext &C, const CallExpr *CE) const {
Ted Kremenek8bef8232012-01-26 21:29:00 +0000316 ProgramStateRef state = C.getState();
Ted Kremenek5eca4822012-01-06 22:09:28 +0000317 if (!CheckNullStream(state->getSVal(CE->getArg(0), C.getLocationContext()),
318 state, C))
Zhongxing Xuc7de88b2010-06-22 07:50:21 +0000319 return;
320}
321
Argyrios Kyrtzidis699bbf92011-02-24 01:05:33 +0000322void StreamChecker::Clearerr(CheckerContext &C, const CallExpr *CE) const {
Ted Kremenek8bef8232012-01-26 21:29:00 +0000323 ProgramStateRef state = C.getState();
Ted Kremenek5eca4822012-01-06 22:09:28 +0000324 if (!CheckNullStream(state->getSVal(CE->getArg(0), C.getLocationContext()),
325 state, C))
Zhongxing Xuc7de88b2010-06-22 07:50:21 +0000326 return;
327}
328
Argyrios Kyrtzidis699bbf92011-02-24 01:05:33 +0000329void StreamChecker::Feof(CheckerContext &C, const CallExpr *CE) const {
Ted Kremenek8bef8232012-01-26 21:29:00 +0000330 ProgramStateRef state = C.getState();
Ted Kremenek5eca4822012-01-06 22:09:28 +0000331 if (!CheckNullStream(state->getSVal(CE->getArg(0), C.getLocationContext()),
332 state, C))
Zhongxing Xuc7de88b2010-06-22 07:50:21 +0000333 return;
334}
335
Argyrios Kyrtzidis699bbf92011-02-24 01:05:33 +0000336void StreamChecker::Ferror(CheckerContext &C, const CallExpr *CE) const {
Ted Kremenek8bef8232012-01-26 21:29:00 +0000337 ProgramStateRef state = C.getState();
Ted Kremenek5eca4822012-01-06 22:09:28 +0000338 if (!CheckNullStream(state->getSVal(CE->getArg(0), C.getLocationContext()),
339 state, C))
Zhongxing Xuc7de88b2010-06-22 07:50:21 +0000340 return;
341}
342
Argyrios Kyrtzidis699bbf92011-02-24 01:05:33 +0000343void StreamChecker::Fileno(CheckerContext &C, const CallExpr *CE) const {
Ted Kremenek8bef8232012-01-26 21:29:00 +0000344 ProgramStateRef state = C.getState();
Ted Kremenek5eca4822012-01-06 22:09:28 +0000345 if (!CheckNullStream(state->getSVal(CE->getArg(0), C.getLocationContext()),
346 state, C))
Zhongxing Xuc7de88b2010-06-22 07:50:21 +0000347 return;
348}
349
Ted Kremenek8bef8232012-01-26 21:29:00 +0000350ProgramStateRef StreamChecker::CheckNullStream(SVal SV, ProgramStateRef state,
Argyrios Kyrtzidis699bbf92011-02-24 01:05:33 +0000351 CheckerContext &C) const {
Zhongxing Xu23d90f92010-06-18 02:47:46 +0000352 const DefinedSVal *DV = dyn_cast<DefinedSVal>(&SV);
353 if (!DV)
Ted Kremenek2b11fb22010-06-24 16:26:12 +0000354 return 0;
Zhongxing Xu23d90f92010-06-18 02:47:46 +0000355
356 ConstraintManager &CM = C.getConstraintManager();
Ted Kremenek8bef8232012-01-26 21:29:00 +0000357 ProgramStateRef stateNotNull, stateNull;
Ted Kremenek28f47b92010-12-01 22:16:56 +0000358 llvm::tie(stateNotNull, stateNull) = CM.assumeDual(state, *DV);
Zhongxing Xu23d90f92010-06-18 02:47:46 +0000359
360 if (!stateNotNull && stateNull) {
Ted Kremenekd048c6e2010-12-20 21:19:09 +0000361 if (ExplodedNode *N = C.generateSink(stateNull)) {
Zhongxing Xu23d90f92010-06-18 02:47:46 +0000362 if (!BT_nullfp)
Argyrios Kyrtzidis699bbf92011-02-24 01:05:33 +0000363 BT_nullfp.reset(new BuiltinBug("NULL stream pointer",
364 "Stream pointer might be NULL."));
Zhongxing Xu23d90f92010-06-18 02:47:46 +0000365 BugReport *R =new BugReport(*BT_nullfp, BT_nullfp->getDescription(), N);
366 C.EmitReport(R);
Zhongxing Xuc1960952010-06-16 05:38:05 +0000367 }
Zhongxing Xu12d213d2010-06-24 12:52:28 +0000368 return 0;
Zhongxing Xuc1960952010-06-16 05:38:05 +0000369 }
Zhongxing Xuab421302010-06-24 13:09:02 +0000370 return stateNotNull;
Zhongxing Xuc1960952010-06-16 05:38:05 +0000371}
Zhongxing Xu9843ba92010-07-19 01:52:29 +0000372
Ted Kremenek8bef8232012-01-26 21:29:00 +0000373ProgramStateRef StreamChecker::CheckDoubleClose(const CallExpr *CE,
374 ProgramStateRef state,
Argyrios Kyrtzidis699bbf92011-02-24 01:05:33 +0000375 CheckerContext &C) const {
Ted Kremenek5eca4822012-01-06 22:09:28 +0000376 SymbolRef Sym =
377 state->getSVal(CE->getArg(0), C.getLocationContext()).getAsSymbol();
Ted Kremenek80460372010-09-03 01:07:04 +0000378 if (!Sym)
379 return state;
Zhongxing Xu9843ba92010-07-19 01:52:29 +0000380
381 const StreamState *SS = state->get<StreamState>(Sym);
Zhongxing Xu1c7370f2010-08-05 23:24:13 +0000382
383 // If the file stream is not tracked, return.
384 if (!SS)
385 return state;
Zhongxing Xu9843ba92010-07-19 01:52:29 +0000386
387 // Check: Double close a File Descriptor could cause undefined behaviour.
388 // Conforming to man-pages
389 if (SS->isClosed()) {
Ted Kremenekd048c6e2010-12-20 21:19:09 +0000390 ExplodedNode *N = C.generateSink();
Zhongxing Xu9843ba92010-07-19 01:52:29 +0000391 if (N) {
392 if (!BT_doubleclose)
Argyrios Kyrtzidis699bbf92011-02-24 01:05:33 +0000393 BT_doubleclose.reset(new BuiltinBug("Double fclose",
Eli Friedmana7e68452010-08-22 01:00:03 +0000394 "Try to close a file Descriptor already"
Argyrios Kyrtzidis699bbf92011-02-24 01:05:33 +0000395 " closed. Cause undefined behaviour."));
Zhongxing Xu9843ba92010-07-19 01:52:29 +0000396 BugReport *R = new BugReport(*BT_doubleclose,
Eli Friedmana7e68452010-08-22 01:00:03 +0000397 BT_doubleclose->getDescription(), N);
Zhongxing Xu9843ba92010-07-19 01:52:29 +0000398 C.EmitReport(R);
399 }
400 return NULL;
401 }
402
403 // Close the File Descriptor.
404 return state->set<StreamState>(Sym, StreamState::getClosed(CE));
405}
Zhongxing Xu766c2012010-07-23 14:14:59 +0000406
Argyrios Kyrtzidis699bbf92011-02-24 01:05:33 +0000407void StreamChecker::checkDeadSymbols(SymbolReaper &SymReaper,
408 CheckerContext &C) const {
Zhongxing Xu766c2012010-07-23 14:14:59 +0000409 for (SymbolReaper::dead_iterator I = SymReaper.dead_begin(),
Eli Friedmana7e68452010-08-22 01:00:03 +0000410 E = SymReaper.dead_end(); I != E; ++I) {
Zhongxing Xu766c2012010-07-23 14:14:59 +0000411 SymbolRef Sym = *I;
Ted Kremenek8bef8232012-01-26 21:29:00 +0000412 ProgramStateRef state = C.getState();
Zhongxing Xu766c2012010-07-23 14:14:59 +0000413 const StreamState *SS = state->get<StreamState>(Sym);
414 if (!SS)
415 return;
416
417 if (SS->isOpened()) {
Ted Kremenekd048c6e2010-12-20 21:19:09 +0000418 ExplodedNode *N = C.generateSink();
Zhongxing Xu766c2012010-07-23 14:14:59 +0000419 if (N) {
Eli Friedmana7e68452010-08-22 01:00:03 +0000420 if (!BT_ResourceLeak)
Argyrios Kyrtzidis699bbf92011-02-24 01:05:33 +0000421 BT_ResourceLeak.reset(new BuiltinBug("Resource Leak",
422 "Opened File never closed. Potential Resource leak."));
Eli Friedmana7e68452010-08-22 01:00:03 +0000423 BugReport *R = new BugReport(*BT_ResourceLeak,
424 BT_ResourceLeak->getDescription(), N);
425 C.EmitReport(R);
Zhongxing Xu766c2012010-07-23 14:14:59 +0000426 }
427 }
428 }
429}
430
Anna Zaksaf498a22011-10-25 19:56:48 +0000431void StreamChecker::checkEndPath(CheckerContext &Ctx) const {
Ted Kremenek8bef8232012-01-26 21:29:00 +0000432 ProgramStateRef state = Ctx.getState();
Zhongxing Xu766c2012010-07-23 14:14:59 +0000433 typedef llvm::ImmutableMap<SymbolRef, StreamState> SymMap;
434 SymMap M = state->get<StreamState>();
435
436 for (SymMap::iterator I = M.begin(), E = M.end(); I != E; ++I) {
437 StreamState SS = I->second;
438 if (SS.isOpened()) {
Anna Zaks0bd6b112011-10-26 21:06:34 +0000439 ExplodedNode *N = Ctx.addTransition(state);
Zhongxing Xu766c2012010-07-23 14:14:59 +0000440 if (N) {
441 if (!BT_ResourceLeak)
Argyrios Kyrtzidis699bbf92011-02-24 01:05:33 +0000442 BT_ResourceLeak.reset(new BuiltinBug("Resource Leak",
443 "Opened File never closed. Potential Resource leak."));
Zhongxing Xu766c2012010-07-23 14:14:59 +0000444 BugReport *R = new BugReport(*BT_ResourceLeak,
Eli Friedmana7e68452010-08-22 01:00:03 +0000445 BT_ResourceLeak->getDescription(), N);
Anna Zaksaf498a22011-10-25 19:56:48 +0000446 Ctx.EmitReport(R);
Zhongxing Xu766c2012010-07-23 14:14:59 +0000447 }
448 }
449 }
450}
451
Argyrios Kyrtzidis699bbf92011-02-24 01:05:33 +0000452void StreamChecker::checkPreStmt(const ReturnStmt *S, CheckerContext &C) const {
Zhongxing Xu766c2012010-07-23 14:14:59 +0000453 const Expr *RetE = S->getRetValue();
454 if (!RetE)
455 return;
456
Ted Kremenek8bef8232012-01-26 21:29:00 +0000457 ProgramStateRef state = C.getState();
Ted Kremenek5eca4822012-01-06 22:09:28 +0000458 SymbolRef Sym = state->getSVal(RetE, C.getLocationContext()).getAsSymbol();
Zhongxing Xu766c2012010-07-23 14:14:59 +0000459
460 if (!Sym)
461 return;
462
463 const StreamState *SS = state->get<StreamState>(Sym);
464 if(!SS)
465 return;
466
467 if (SS->isOpened())
468 state = state->set<StreamState>(Sym, StreamState::getEscaped(S));
469
Anna Zaks0bd6b112011-10-26 21:06:34 +0000470 C.addTransition(state);
Zhongxing Xu766c2012010-07-23 14:14:59 +0000471}
Argyrios Kyrtzidis699bbf92011-02-24 01:05:33 +0000472
473void ento::registerStreamChecker(CheckerManager &mgr) {
474 mgr.registerChecker<StreamChecker>();
475}