Anna Zaks | df18c5a | 2011-11-16 19:58:13 +0000 | [diff] [blame] | 1 | //== GenericTaintChecker.cpp ----------------------------------- -*- C++ -*--=// |
| 2 | // |
| 3 | // The LLVM Compiler Infrastructure |
| 4 | // |
| 5 | // This file is distributed under the University of Illinois Open Source |
| 6 | // License. See LICENSE.TXT for details. |
| 7 | // |
| 8 | //===----------------------------------------------------------------------===// |
| 9 | // |
| 10 | // This checker defines the attack surface for generic taint propagation. |
| 11 | // |
| 12 | // The taint information produced by it might be useful to other checkers. For |
| 13 | // example, checkers should report errors which involve tainted data more |
| 14 | // aggressively, even if the involved symbols are under constrained. |
| 15 | // |
| 16 | //===----------------------------------------------------------------------===// |
| 17 | #include "ClangSACheckers.h" |
| 18 | #include "clang/StaticAnalyzer/Core/Checker.h" |
| 19 | #include "clang/StaticAnalyzer/Core/CheckerManager.h" |
| 20 | #include "clang/StaticAnalyzer/Core/PathSensitive/CheckerContext.h" |
Anna Zaks | 9ffbe24 | 2011-12-17 00:26:34 +0000 | [diff] [blame] | 21 | #include "clang/StaticAnalyzer/Core/PathSensitive/ProgramStateTrait.h" |
Anna Zaks | df18c5a | 2011-11-16 19:58:13 +0000 | [diff] [blame] | 22 | #include "clang/StaticAnalyzer/Core/BugReporter/BugType.h" |
Anna Zaks | 9b0c749 | 2012-01-18 02:45:07 +0000 | [diff] [blame] | 23 | #include "clang/Basic/Builtins.h" |
Anna Zaks | 1fb826a | 2012-01-12 02:22:34 +0000 | [diff] [blame] | 24 | #include <climits> |
Anna Zaks | df18c5a | 2011-11-16 19:58:13 +0000 | [diff] [blame] | 25 | |
| 26 | using namespace clang; |
| 27 | using namespace ento; |
| 28 | |
| 29 | namespace { |
Anna Zaks | efd6989 | 2011-12-14 00:56:18 +0000 | [diff] [blame] | 30 | class GenericTaintChecker : public Checker< check::PostStmt<CallExpr>, |
Anna Zaks | 9ffbe24 | 2011-12-17 00:26:34 +0000 | [diff] [blame] | 31 | check::PreStmt<CallExpr> > { |
| 32 | public: |
Anna Zaks | 8568ee7 | 2012-01-14 02:48:40 +0000 | [diff] [blame] | 33 | static void *getTag() { static int Tag; return &Tag; } |
| 34 | |
| 35 | void checkPostStmt(const CallExpr *CE, CheckerContext &C) const; |
| 36 | void checkPostStmt(const DeclRefExpr *DRE, CheckerContext &C) const; |
| 37 | |
| 38 | void checkPreStmt(const CallExpr *CE, CheckerContext &C) const; |
Anna Zaks | df18c5a | 2011-11-16 19:58:13 +0000 | [diff] [blame] | 39 | |
Anna Zaks | 9ffbe24 | 2011-12-17 00:26:34 +0000 | [diff] [blame] | 40 | private: |
Anna Zaks | 8568ee7 | 2012-01-14 02:48:40 +0000 | [diff] [blame] | 41 | static const unsigned ReturnValueIndex = UINT_MAX; |
Anna Zaks | 022b3f4 | 2012-01-17 00:37:02 +0000 | [diff] [blame] | 42 | static const unsigned InvalidArgIndex = UINT_MAX - 1; |
Anna Zaks | 8568ee7 | 2012-01-14 02:48:40 +0000 | [diff] [blame] | 43 | |
Anna Zaks | 8f4caf5 | 2011-11-18 02:26:36 +0000 | [diff] [blame] | 44 | mutable llvm::OwningPtr<BugType> BT; |
Anna Zaks | 9b0c749 | 2012-01-18 02:45:07 +0000 | [diff] [blame] | 45 | inline void initBugType() const { |
| 46 | if (!BT) |
| 47 | BT.reset(new BugType("Taint Analysis", "General")); |
| 48 | } |
Anna Zaks | 8f4caf5 | 2011-11-18 02:26:36 +0000 | [diff] [blame] | 49 | |
Anna Zaks | 1fb826a | 2012-01-12 02:22:34 +0000 | [diff] [blame] | 50 | /// \brief Catch taint related bugs. Check if tainted data is passed to a |
| 51 | /// system call etc. |
Anna Zaks | 9f03b62 | 2012-01-07 02:33:10 +0000 | [diff] [blame] | 52 | bool checkPre(const CallExpr *CE, CheckerContext &C) const; |
| 53 | |
Anna Zaks | 1fb826a | 2012-01-12 02:22:34 +0000 | [diff] [blame] | 54 | /// \brief Add taint sources on a pre-visit. |
| 55 | void addSourcesPre(const CallExpr *CE, CheckerContext &C) const; |
| 56 | |
| 57 | /// \brief Propagate taint generated at pre-visit. |
| 58 | bool propagateFromPre(const CallExpr *CE, CheckerContext &C) const; |
| 59 | |
| 60 | /// \brief Add taint sources on a post visit. |
| 61 | void addSourcesPost(const CallExpr *CE, CheckerContext &C) const; |
| 62 | |
| 63 | /// \brief Given a pointer argument, get the symbol of the value it contains |
Anna Zaks | 8f4caf5 | 2011-11-18 02:26:36 +0000 | [diff] [blame] | 64 | /// (points to). |
Anna Zaks | 7cdfe29 | 2012-01-18 02:45:13 +0000 | [diff] [blame^] | 65 | static SymbolRef getPointedToSymbol(CheckerContext &C, const Expr *Arg); |
Anna Zaks | df18c5a | 2011-11-16 19:58:13 +0000 | [diff] [blame] | 66 | |
Anna Zaks | 7cdfe29 | 2012-01-18 02:45:13 +0000 | [diff] [blame^] | 67 | static inline bool isTaintedOrPointsToTainted(const Expr *E, |
| 68 | const ProgramState *State, |
| 69 | CheckerContext &C) { |
Anna Zaks | 022b3f4 | 2012-01-17 00:37:02 +0000 | [diff] [blame] | 70 | return (State->isTainted(E, C.getLocationContext()) || |
| 71 | (E->getType().getTypePtr()->isPointerType() && |
| 72 | State->isTainted(getPointedToSymbol(C, E)))); |
| 73 | } |
| 74 | |
Anna Zaks | 9ffbe24 | 2011-12-17 00:26:34 +0000 | [diff] [blame] | 75 | /// Functions defining the attack surface. |
| 76 | typedef const ProgramState *(GenericTaintChecker::*FnCheck)(const CallExpr *, |
| 77 | CheckerContext &C) const; |
| 78 | const ProgramState *postScanf(const CallExpr *CE, CheckerContext &C) const; |
Anna Zaks | 9ffbe24 | 2011-12-17 00:26:34 +0000 | [diff] [blame] | 79 | const ProgramState *postRetTaint(const CallExpr *CE, CheckerContext &C) const; |
Anna Zaks | 9ffbe24 | 2011-12-17 00:26:34 +0000 | [diff] [blame] | 80 | |
| 81 | /// Taint the scanned input if the file is tainted. |
| 82 | const ProgramState *preFscanf(const CallExpr *CE, CheckerContext &C) const; |
Anna Zaks | df18c5a | 2011-11-16 19:58:13 +0000 | [diff] [blame] | 83 | |
Anna Zaks | d3d8548 | 2011-12-16 18:28:50 +0000 | [diff] [blame] | 84 | /// Check if the region the expression evaluates to is the standard input, |
| 85 | /// and thus, is tainted. |
Anna Zaks | efd6989 | 2011-12-14 00:56:18 +0000 | [diff] [blame] | 86 | bool isStdin(const Expr *E, CheckerContext &C) const; |
Anna Zaks | efd6989 | 2011-12-14 00:56:18 +0000 | [diff] [blame] | 87 | |
Anna Zaks | 9f03b62 | 2012-01-07 02:33:10 +0000 | [diff] [blame] | 88 | /// Check for CWE-134: Uncontrolled Format String. |
Anna Zaks | 8568ee7 | 2012-01-14 02:48:40 +0000 | [diff] [blame] | 89 | static const char MsgUncontrolledFormatString[]; |
Anna Zaks | 9f03b62 | 2012-01-07 02:33:10 +0000 | [diff] [blame] | 90 | bool checkUncontrolledFormatString(const CallExpr *CE, |
| 91 | CheckerContext &C) const; |
| 92 | |
Anna Zaks | 8568ee7 | 2012-01-14 02:48:40 +0000 | [diff] [blame] | 93 | /// Check for: |
| 94 | /// CERT/STR02-C. "Sanitize data passed to complex subsystems" |
| 95 | /// CWE-78, "Failure to Sanitize Data into an OS Command" |
| 96 | static const char MsgSanitizeSystemArgs[]; |
| 97 | bool checkSystemCall(const CallExpr *CE, StringRef Name, |
| 98 | CheckerContext &C) const; |
Anna Zaks | 9ffbe24 | 2011-12-17 00:26:34 +0000 | [diff] [blame] | 99 | |
Anna Zaks | 4e46221 | 2012-01-18 02:45:11 +0000 | [diff] [blame] | 100 | /// Check if tainted data is used as a buffer size ins strn.. functions, |
| 101 | /// and allocators. |
| 102 | static const char MsgTaintedBufferSize[]; |
| 103 | bool checkTaintedBufferSize(const CallExpr *CE, const FunctionDecl *FDecl, |
| 104 | CheckerContext &C) const; |
| 105 | |
Anna Zaks | 8568ee7 | 2012-01-14 02:48:40 +0000 | [diff] [blame] | 106 | /// Generate a report if the expression is tainted or points to tainted data. |
| 107 | bool generateReportIfTainted(const Expr *E, const char Msg[], |
| 108 | CheckerContext &C) const; |
Anna Zaks | 022b3f4 | 2012-01-17 00:37:02 +0000 | [diff] [blame] | 109 | |
| 110 | |
| 111 | typedef llvm::SmallVector<unsigned, 2> ArgVector; |
Anna Zaks | 9ffbe24 | 2011-12-17 00:26:34 +0000 | [diff] [blame] | 112 | |
Anna Zaks | 022b3f4 | 2012-01-17 00:37:02 +0000 | [diff] [blame] | 113 | /// \brief A struct used to specify taint propagation rules for a function. |
| 114 | /// |
| 115 | /// If any of the possible taint source arguments is tainted, all of the |
| 116 | /// destination arguments should also be tainted. Use InvalidArgIndex in the |
| 117 | /// src list to specify that all of the arguments can introduce taint. Use |
| 118 | /// InvalidArgIndex in the dst arguments to signify that all the non-const |
| 119 | /// pointer and reference arguments might be tainted on return. If |
| 120 | /// ReturnValueIndex is added to the dst list, the return value will be |
| 121 | /// tainted. |
| 122 | struct TaintPropagationRule { |
| 123 | /// List of arguments which can be taint sources and should be checked. |
| 124 | ArgVector SrcArgs; |
| 125 | /// List of arguments which should be tainted on function return. |
| 126 | ArgVector DstArgs; |
Anna Zaks | 9b0c749 | 2012-01-18 02:45:07 +0000 | [diff] [blame] | 127 | // TODO: Check if using other data structures would be more optimal. |
Anna Zaks | 022b3f4 | 2012-01-17 00:37:02 +0000 | [diff] [blame] | 128 | |
| 129 | TaintPropagationRule() {} |
| 130 | |
Anna Zaks | 9b0c749 | 2012-01-18 02:45:07 +0000 | [diff] [blame] | 131 | TaintPropagationRule(unsigned SArg, |
| 132 | unsigned DArg, bool TaintRet = false) { |
Anna Zaks | 022b3f4 | 2012-01-17 00:37:02 +0000 | [diff] [blame] | 133 | SrcArgs.push_back(SArg); |
| 134 | DstArgs.push_back(DArg); |
Anna Zaks | 9b0c749 | 2012-01-18 02:45:07 +0000 | [diff] [blame] | 135 | if (TaintRet) |
| 136 | DstArgs.push_back(ReturnValueIndex); |
Anna Zaks | 022b3f4 | 2012-01-17 00:37:02 +0000 | [diff] [blame] | 137 | } |
| 138 | |
Anna Zaks | 9b0c749 | 2012-01-18 02:45:07 +0000 | [diff] [blame] | 139 | TaintPropagationRule(unsigned SArg1, unsigned SArg2, |
| 140 | unsigned DArg, bool TaintRet = false) { |
| 141 | SrcArgs.push_back(SArg1); |
| 142 | SrcArgs.push_back(SArg2); |
| 143 | DstArgs.push_back(DArg); |
| 144 | if (TaintRet) |
| 145 | DstArgs.push_back(ReturnValueIndex); |
| 146 | } |
| 147 | |
| 148 | /// Get the propagation rule for a given function. |
| 149 | static TaintPropagationRule |
| 150 | getTaintPropagationRule(const FunctionDecl *FDecl, |
| 151 | StringRef Name, |
| 152 | CheckerContext &C); |
| 153 | |
Anna Zaks | 022b3f4 | 2012-01-17 00:37:02 +0000 | [diff] [blame] | 154 | inline void addSrcArg(unsigned A) { SrcArgs.push_back(A); } |
| 155 | inline void addDstArg(unsigned A) { DstArgs.push_back(A); } |
| 156 | |
Anna Zaks | 9b0c749 | 2012-01-18 02:45:07 +0000 | [diff] [blame] | 157 | inline bool isNull() const { return SrcArgs.empty(); } |
| 158 | |
| 159 | inline bool isDestinationArgument(unsigned ArgNum) const { |
| 160 | return (std::find(DstArgs.begin(), |
| 161 | DstArgs.end(), ArgNum) != DstArgs.end()); |
| 162 | } |
Anna Zaks | 022b3f4 | 2012-01-17 00:37:02 +0000 | [diff] [blame] | 163 | |
Anna Zaks | 7cdfe29 | 2012-01-18 02:45:13 +0000 | [diff] [blame^] | 164 | /// \brief Pre-process a function which propagates taint according to the |
| 165 | /// taint rule. |
| 166 | const ProgramState *process(const CallExpr *CE, CheckerContext &C) const; |
| 167 | |
| 168 | }; |
Anna Zaks | df18c5a | 2011-11-16 19:58:13 +0000 | [diff] [blame] | 169 | }; |
Anna Zaks | 9b0c749 | 2012-01-18 02:45:07 +0000 | [diff] [blame] | 170 | |
| 171 | const unsigned GenericTaintChecker::ReturnValueIndex; |
| 172 | const unsigned GenericTaintChecker::InvalidArgIndex; |
| 173 | |
Anna Zaks | 8568ee7 | 2012-01-14 02:48:40 +0000 | [diff] [blame] | 174 | const char GenericTaintChecker::MsgUncontrolledFormatString[] = |
| 175 | "Tainted format string (CWE-134: Uncontrolled Format String)"; |
| 176 | |
| 177 | const char GenericTaintChecker::MsgSanitizeSystemArgs[] = |
| 178 | "Tainted data passed to a system call " |
| 179 | "(CERT/STR02-C. Sanitize data passed to complex subsystems)"; |
Anna Zaks | 4e46221 | 2012-01-18 02:45:11 +0000 | [diff] [blame] | 180 | |
| 181 | const char GenericTaintChecker::MsgTaintedBufferSize[] = |
| 182 | "Tainted data is used to specify the buffer size " |
| 183 | "(CERT/STR31-C. Guarantee that storage for strings has sufficient space for " |
| 184 | "character data and the null terminator)"; |
| 185 | |
| 186 | } // end of anonymous namespace |
Anna Zaks | df18c5a | 2011-11-16 19:58:13 +0000 | [diff] [blame] | 187 | |
Anna Zaks | 1fb826a | 2012-01-12 02:22:34 +0000 | [diff] [blame] | 188 | /// A set which is used to pass information from call pre-visit instruction |
| 189 | /// to the call post-visit. The values are unsigned integers, which are either |
| 190 | /// ReturnValueIndex, or indexes of the pointer/reference argument, which |
| 191 | /// points to data, which should be tainted on return. |
| 192 | namespace { struct TaintArgsOnPostVisit{}; } |
| 193 | namespace clang { namespace ento { |
| 194 | template<> struct ProgramStateTrait<TaintArgsOnPostVisit> |
| 195 | : public ProgramStatePartialTrait<llvm::ImmutableSet<unsigned> > { |
| 196 | static void *GDMIndex() { return GenericTaintChecker::getTag(); } |
| 197 | }; |
| 198 | }} |
Anna Zaks | 9ffbe24 | 2011-12-17 00:26:34 +0000 | [diff] [blame] | 199 | |
Anna Zaks | 9b0c749 | 2012-01-18 02:45:07 +0000 | [diff] [blame] | 200 | GenericTaintChecker::TaintPropagationRule |
| 201 | GenericTaintChecker::TaintPropagationRule::getTaintPropagationRule( |
| 202 | const FunctionDecl *FDecl, |
| 203 | StringRef Name, |
| 204 | CheckerContext &C) { |
| 205 | // Check for exact name match for functions without builtin substitutes. |
| 206 | TaintPropagationRule Rule = llvm::StringSwitch<TaintPropagationRule>(Name) |
| 207 | .Case("atoi", TaintPropagationRule(0, ReturnValueIndex)) |
| 208 | .Case("atol", TaintPropagationRule(0, ReturnValueIndex)) |
| 209 | .Case("atoll", TaintPropagationRule(0, ReturnValueIndex)) |
| 210 | .Default(TaintPropagationRule()); |
| 211 | |
| 212 | if (!Rule.isNull()) |
| 213 | return Rule; |
| 214 | |
| 215 | // Check if it's one of the memory setting/copying functions. |
| 216 | // This check is specialized but faster then calling isCLibraryFunction. |
| 217 | unsigned BId = 0; |
| 218 | if ( (BId = FDecl->getMemoryFunctionKind()) ) |
| 219 | switch(BId) { |
| 220 | case Builtin::BImemcpy: |
| 221 | case Builtin::BImemmove: |
| 222 | case Builtin::BIstrncpy: |
| 223 | case Builtin::BIstrncat: |
| 224 | return TaintPropagationRule(1, 2, 0, true); |
| 225 | break; |
| 226 | case Builtin::BIstrlcpy: |
| 227 | case Builtin::BIstrlcat: |
| 228 | return TaintPropagationRule(1, 2, 0, false); |
| 229 | break; |
| 230 | case Builtin::BIstrndup: |
| 231 | return TaintPropagationRule(0, 1, ReturnValueIndex); |
| 232 | break; |
| 233 | |
| 234 | default: |
| 235 | break; |
| 236 | }; |
| 237 | |
| 238 | // Process all other functions which could be defined as builtins. |
| 239 | if (Rule.isNull()) { |
| 240 | if (C.isCLibraryFunction(FDecl, "snprintf") || |
| 241 | C.isCLibraryFunction(FDecl, "sprintf")) |
| 242 | return TaintPropagationRule(InvalidArgIndex, 0, true); |
| 243 | else if (C.isCLibraryFunction(FDecl, "strcpy") || |
| 244 | C.isCLibraryFunction(FDecl, "stpcpy") || |
| 245 | C.isCLibraryFunction(FDecl, "strcat")) |
| 246 | return TaintPropagationRule(1, 0, true); |
| 247 | else if (C.isCLibraryFunction(FDecl, "bcopy")) |
| 248 | return TaintPropagationRule(0, 2, 1, false); |
| 249 | else if (C.isCLibraryFunction(FDecl, "strdup") || |
| 250 | C.isCLibraryFunction(FDecl, "strdupa")) |
| 251 | return TaintPropagationRule(0, ReturnValueIndex); |
Anna Zaks | 4e46221 | 2012-01-18 02:45:11 +0000 | [diff] [blame] | 252 | else if (C.isCLibraryFunction(FDecl, "wcsdup")) |
| 253 | return TaintPropagationRule(0, ReturnValueIndex); |
Anna Zaks | 9b0c749 | 2012-01-18 02:45:07 +0000 | [diff] [blame] | 254 | } |
| 255 | |
| 256 | // Skipping the following functions, since they might be used for cleansing |
| 257 | // or smart memory copy: |
| 258 | // - memccpy - copying untill hitting a special character. |
| 259 | |
| 260 | return TaintPropagationRule(); |
Anna Zaks | 8f4caf5 | 2011-11-18 02:26:36 +0000 | [diff] [blame] | 261 | } |
| 262 | |
Anna Zaks | 9ffbe24 | 2011-12-17 00:26:34 +0000 | [diff] [blame] | 263 | void GenericTaintChecker::checkPreStmt(const CallExpr *CE, |
| 264 | CheckerContext &C) const { |
Anna Zaks | 9f03b62 | 2012-01-07 02:33:10 +0000 | [diff] [blame] | 265 | // Check for errors first. |
| 266 | if (checkPre(CE, C)) |
| 267 | return; |
Anna Zaks | 9ffbe24 | 2011-12-17 00:26:34 +0000 | [diff] [blame] | 268 | |
Anna Zaks | 9f03b62 | 2012-01-07 02:33:10 +0000 | [diff] [blame] | 269 | // Add taint second. |
Anna Zaks | 1fb826a | 2012-01-12 02:22:34 +0000 | [diff] [blame] | 270 | addSourcesPre(CE, C); |
Anna Zaks | 9f03b62 | 2012-01-07 02:33:10 +0000 | [diff] [blame] | 271 | } |
| 272 | |
| 273 | void GenericTaintChecker::checkPostStmt(const CallExpr *CE, |
| 274 | CheckerContext &C) const { |
Anna Zaks | 1fb826a | 2012-01-12 02:22:34 +0000 | [diff] [blame] | 275 | if (propagateFromPre(CE, C)) |
| 276 | return; |
| 277 | addSourcesPost(CE, C); |
Anna Zaks | 9f03b62 | 2012-01-07 02:33:10 +0000 | [diff] [blame] | 278 | } |
| 279 | |
Anna Zaks | 1fb826a | 2012-01-12 02:22:34 +0000 | [diff] [blame] | 280 | void GenericTaintChecker::addSourcesPre(const CallExpr *CE, |
| 281 | CheckerContext &C) const { |
Anna Zaks | 9b0c749 | 2012-01-18 02:45:07 +0000 | [diff] [blame] | 282 | const ProgramState *State = 0; |
| 283 | const FunctionDecl *FDecl = C.getCalleeDecl(CE); |
| 284 | StringRef Name = C.getCalleeName(FDecl); |
Anna Zaks | 1fb826a | 2012-01-12 02:22:34 +0000 | [diff] [blame] | 285 | if (Name.empty()) |
| 286 | return; |
Anna Zaks | 022b3f4 | 2012-01-17 00:37:02 +0000 | [diff] [blame] | 287 | |
Anna Zaks | 9b0c749 | 2012-01-18 02:45:07 +0000 | [diff] [blame] | 288 | // First, try generating a propagation rule for this function. |
| 289 | TaintPropagationRule Rule = |
| 290 | TaintPropagationRule::getTaintPropagationRule(FDecl, Name, C); |
Anna Zaks | 022b3f4 | 2012-01-17 00:37:02 +0000 | [diff] [blame] | 291 | if (!Rule.isNull()) { |
Anna Zaks | 7cdfe29 | 2012-01-18 02:45:13 +0000 | [diff] [blame^] | 292 | State = Rule.process(CE, C); |
Anna Zaks | 022b3f4 | 2012-01-17 00:37:02 +0000 | [diff] [blame] | 293 | if (!State) |
| 294 | return; |
| 295 | C.addTransition(State); |
Anna Zaks | 9b0c749 | 2012-01-18 02:45:07 +0000 | [diff] [blame] | 296 | return; |
Anna Zaks | 022b3f4 | 2012-01-17 00:37:02 +0000 | [diff] [blame] | 297 | } |
| 298 | |
Anna Zaks | 9b0c749 | 2012-01-18 02:45:07 +0000 | [diff] [blame] | 299 | // Otherwise, check if we have custom pre-processing implemented. |
Anna Zaks | 9ffbe24 | 2011-12-17 00:26:34 +0000 | [diff] [blame] | 300 | FnCheck evalFunction = llvm::StringSwitch<FnCheck>(Name) |
Anna Zaks | 1fb826a | 2012-01-12 02:22:34 +0000 | [diff] [blame] | 301 | .Case("fscanf", &GenericTaintChecker::preFscanf) |
Anna Zaks | 9ffbe24 | 2011-12-17 00:26:34 +0000 | [diff] [blame] | 302 | .Default(0); |
Anna Zaks | 9ffbe24 | 2011-12-17 00:26:34 +0000 | [diff] [blame] | 303 | // Check and evaluate the call. |
| 304 | if (evalFunction) |
| 305 | State = (this->*evalFunction)(CE, C); |
| 306 | if (!State) |
Anna Zaks | df18c5a | 2011-11-16 19:58:13 +0000 | [diff] [blame] | 307 | return; |
Anna Zaks | 9ffbe24 | 2011-12-17 00:26:34 +0000 | [diff] [blame] | 308 | C.addTransition(State); |
Anna Zaks | 9b0c749 | 2012-01-18 02:45:07 +0000 | [diff] [blame] | 309 | |
Anna Zaks | 9ffbe24 | 2011-12-17 00:26:34 +0000 | [diff] [blame] | 310 | } |
| 311 | |
Anna Zaks | 1fb826a | 2012-01-12 02:22:34 +0000 | [diff] [blame] | 312 | bool GenericTaintChecker::propagateFromPre(const CallExpr *CE, |
| 313 | CheckerContext &C) const { |
| 314 | const ProgramState *State = C.getState(); |
| 315 | |
| 316 | // Depending on what was tainted at pre-visit, we determined a set of |
| 317 | // arguments which should be tainted after the function returns. These are |
| 318 | // stored in the state as TaintArgsOnPostVisit set. |
| 319 | llvm::ImmutableSet<unsigned> TaintArgs = State->get<TaintArgsOnPostVisit>(); |
| 320 | for (llvm::ImmutableSet<unsigned>::iterator |
| 321 | I = TaintArgs.begin(), E = TaintArgs.end(); I != E; ++I) { |
| 322 | unsigned ArgNum = *I; |
| 323 | |
| 324 | // Special handling for the tainted return value. |
| 325 | if (ArgNum == ReturnValueIndex) { |
| 326 | State = State->addTaint(CE, C.getLocationContext()); |
| 327 | continue; |
| 328 | } |
| 329 | |
| 330 | // The arguments are pointer arguments. The data they are pointing at is |
| 331 | // tainted after the call. |
| 332 | const Expr* Arg = CE->getArg(ArgNum); |
Anna Zaks | 7cdfe29 | 2012-01-18 02:45:13 +0000 | [diff] [blame^] | 333 | SymbolRef Sym = getPointedToSymbol(C, Arg); |
Anna Zaks | 1fb826a | 2012-01-12 02:22:34 +0000 | [diff] [blame] | 334 | if (Sym) |
| 335 | State = State->addTaint(Sym); |
| 336 | } |
| 337 | |
| 338 | // Clear up the taint info from the state. |
| 339 | State = State->remove<TaintArgsOnPostVisit>(); |
| 340 | |
| 341 | if (State != C.getState()) { |
| 342 | C.addTransition(State); |
| 343 | return true; |
| 344 | } |
| 345 | return false; |
| 346 | } |
| 347 | |
| 348 | void GenericTaintChecker::addSourcesPost(const CallExpr *CE, |
| 349 | CheckerContext &C) const { |
Anna Zaks | df18c5a | 2011-11-16 19:58:13 +0000 | [diff] [blame] | 350 | // Define the attack surface. |
| 351 | // Set the evaluation function by switching on the callee name. |
Anna Zaks | 9ffbe24 | 2011-12-17 00:26:34 +0000 | [diff] [blame] | 352 | StringRef Name = C.getCalleeName(CE); |
Anna Zaks | 1fb826a | 2012-01-12 02:22:34 +0000 | [diff] [blame] | 353 | if (Name.empty()) |
| 354 | return; |
Anna Zaks | df18c5a | 2011-11-16 19:58:13 +0000 | [diff] [blame] | 355 | FnCheck evalFunction = llvm::StringSwitch<FnCheck>(Name) |
Anna Zaks | 9ffbe24 | 2011-12-17 00:26:34 +0000 | [diff] [blame] | 356 | .Case("scanf", &GenericTaintChecker::postScanf) |
Anna Zaks | 1009ac7 | 2011-12-14 00:56:02 +0000 | [diff] [blame] | 357 | // TODO: Add support for vfscanf & family. |
Anna Zaks | 9ffbe24 | 2011-12-17 00:26:34 +0000 | [diff] [blame] | 358 | .Case("getchar", &GenericTaintChecker::postRetTaint) |
| 359 | .Case("getenv", &GenericTaintChecker::postRetTaint) |
| 360 | .Case("fopen", &GenericTaintChecker::postRetTaint) |
| 361 | .Case("fdopen", &GenericTaintChecker::postRetTaint) |
| 362 | .Case("freopen", &GenericTaintChecker::postRetTaint) |
Anna Zaks | 1fb826a | 2012-01-12 02:22:34 +0000 | [diff] [blame] | 363 | .Default(0); |
Anna Zaks | df18c5a | 2011-11-16 19:58:13 +0000 | [diff] [blame] | 364 | |
| 365 | // If the callee isn't defined, it is not of security concern. |
| 366 | // Check and evaluate the call. |
Anna Zaks | 9f03b62 | 2012-01-07 02:33:10 +0000 | [diff] [blame] | 367 | const ProgramState *State = 0; |
Anna Zaks | df18c5a | 2011-11-16 19:58:13 +0000 | [diff] [blame] | 368 | if (evalFunction) |
Anna Zaks | 9ffbe24 | 2011-12-17 00:26:34 +0000 | [diff] [blame] | 369 | State = (this->*evalFunction)(CE, C); |
| 370 | if (!State) |
| 371 | return; |
Anna Zaks | df18c5a | 2011-11-16 19:58:13 +0000 | [diff] [blame] | 372 | |
Anna Zaks | 9ffbe24 | 2011-12-17 00:26:34 +0000 | [diff] [blame] | 373 | C.addTransition(State); |
Anna Zaks | df18c5a | 2011-11-16 19:58:13 +0000 | [diff] [blame] | 374 | } |
Anna Zaks | 8f4caf5 | 2011-11-18 02:26:36 +0000 | [diff] [blame] | 375 | |
Anna Zaks | 9f03b62 | 2012-01-07 02:33:10 +0000 | [diff] [blame] | 376 | bool GenericTaintChecker::checkPre(const CallExpr *CE, CheckerContext &C) const{ |
| 377 | |
| 378 | if (checkUncontrolledFormatString(CE, C)) |
| 379 | return true; |
| 380 | |
Anna Zaks | 4e46221 | 2012-01-18 02:45:11 +0000 | [diff] [blame] | 381 | const FunctionDecl *FDecl = C.getCalleeDecl(CE); |
| 382 | StringRef Name = C.getCalleeName(FDecl); |
Anna Zaks | 8568ee7 | 2012-01-14 02:48:40 +0000 | [diff] [blame] | 383 | if (Name.empty()) |
| 384 | return false; |
| 385 | |
| 386 | if (checkSystemCall(CE, Name, C)) |
| 387 | return true; |
| 388 | |
Anna Zaks | 4e46221 | 2012-01-18 02:45:11 +0000 | [diff] [blame] | 389 | if (checkTaintedBufferSize(CE, FDecl, C)) |
| 390 | return true; |
| 391 | |
Anna Zaks | 9f03b62 | 2012-01-07 02:33:10 +0000 | [diff] [blame] | 392 | return false; |
| 393 | } |
| 394 | |
Anna Zaks | 8f4caf5 | 2011-11-18 02:26:36 +0000 | [diff] [blame] | 395 | SymbolRef GenericTaintChecker::getPointedToSymbol(CheckerContext &C, |
Anna Zaks | 7cdfe29 | 2012-01-18 02:45:13 +0000 | [diff] [blame^] | 396 | const Expr* Arg) { |
Anna Zaks | 8f4caf5 | 2011-11-18 02:26:36 +0000 | [diff] [blame] | 397 | const ProgramState *State = C.getState(); |
Ted Kremenek | 5eca482 | 2012-01-06 22:09:28 +0000 | [diff] [blame] | 398 | SVal AddrVal = State->getSVal(Arg->IgnoreParens(), C.getLocationContext()); |
Anna Zaks | d3d8548 | 2011-12-16 18:28:50 +0000 | [diff] [blame] | 399 | if (AddrVal.isUnknownOrUndef()) |
Anna Zaks | e3d250e | 2011-12-11 18:43:40 +0000 | [diff] [blame] | 400 | return 0; |
| 401 | |
Anna Zaks | df18c5a | 2011-11-16 19:58:13 +0000 | [diff] [blame] | 402 | Loc *AddrLoc = dyn_cast<Loc>(&AddrVal); |
Anna Zaks | 7cdfe29 | 2012-01-18 02:45:13 +0000 | [diff] [blame^] | 403 | if (!AddrLoc) |
Anna Zaks | 8f4caf5 | 2011-11-18 02:26:36 +0000 | [diff] [blame] | 404 | return 0; |
| 405 | |
Anna Zaks | 71d2909 | 2012-01-13 00:56:51 +0000 | [diff] [blame] | 406 | const PointerType *ArgTy = |
| 407 | dyn_cast<PointerType>(Arg->getType().getCanonicalType().getTypePtr()); |
| 408 | assert(ArgTy); |
| 409 | SVal Val = State->getSVal(*AddrLoc, ArgTy->getPointeeType()); |
Anna Zaks | df18c5a | 2011-11-16 19:58:13 +0000 | [diff] [blame] | 410 | return Val.getAsSymbol(); |
| 411 | } |
| 412 | |
Anna Zaks | 022b3f4 | 2012-01-17 00:37:02 +0000 | [diff] [blame] | 413 | const ProgramState * |
Anna Zaks | 7cdfe29 | 2012-01-18 02:45:13 +0000 | [diff] [blame^] | 414 | GenericTaintChecker::TaintPropagationRule::process(const CallExpr *CE, |
| 415 | CheckerContext &C) const { |
Anna Zaks | 022b3f4 | 2012-01-17 00:37:02 +0000 | [diff] [blame] | 416 | const ProgramState *State = C.getState(); |
| 417 | |
| 418 | // Check for taint in arguments. |
| 419 | bool IsTainted = false; |
Anna Zaks | 7cdfe29 | 2012-01-18 02:45:13 +0000 | [diff] [blame^] | 420 | for (ArgVector::const_iterator I = SrcArgs.begin(), |
| 421 | E = SrcArgs.end(); I != E; ++I) { |
Anna Zaks | 022b3f4 | 2012-01-17 00:37:02 +0000 | [diff] [blame] | 422 | unsigned ArgNum = *I; |
| 423 | |
| 424 | if (ArgNum == InvalidArgIndex) { |
Anna Zaks | 9b0c749 | 2012-01-18 02:45:07 +0000 | [diff] [blame] | 425 | // Check if any of the arguments is tainted, but skip the |
| 426 | // destination arguments. |
| 427 | for (unsigned int i = 0; i < CE->getNumArgs(); ++i) { |
Anna Zaks | 7cdfe29 | 2012-01-18 02:45:13 +0000 | [diff] [blame^] | 428 | if (isDestinationArgument(i)) |
Anna Zaks | 9b0c749 | 2012-01-18 02:45:07 +0000 | [diff] [blame] | 429 | continue; |
Anna Zaks | 7cdfe29 | 2012-01-18 02:45:13 +0000 | [diff] [blame^] | 430 | if ((IsTainted = |
| 431 | GenericTaintChecker::isTaintedOrPointsToTainted(CE->getArg(i), |
| 432 | State, C))) |
Anna Zaks | 022b3f4 | 2012-01-17 00:37:02 +0000 | [diff] [blame] | 433 | break; |
Anna Zaks | 9b0c749 | 2012-01-18 02:45:07 +0000 | [diff] [blame] | 434 | } |
Anna Zaks | 022b3f4 | 2012-01-17 00:37:02 +0000 | [diff] [blame] | 435 | break; |
| 436 | } |
| 437 | |
| 438 | assert(ArgNum < CE->getNumArgs()); |
Anna Zaks | 7cdfe29 | 2012-01-18 02:45:13 +0000 | [diff] [blame^] | 439 | if ((IsTainted = |
| 440 | GenericTaintChecker::isTaintedOrPointsToTainted(CE->getArg(ArgNum), |
| 441 | State, C))) |
Anna Zaks | 022b3f4 | 2012-01-17 00:37:02 +0000 | [diff] [blame] | 442 | break; |
| 443 | } |
| 444 | if (!IsTainted) |
| 445 | return State; |
| 446 | |
| 447 | // Mark the arguments which should be tainted after the function returns. |
Anna Zaks | 7cdfe29 | 2012-01-18 02:45:13 +0000 | [diff] [blame^] | 448 | for (ArgVector::const_iterator I = DstArgs.begin(), |
| 449 | E = DstArgs.end(); I != E; ++I) { |
Anna Zaks | 022b3f4 | 2012-01-17 00:37:02 +0000 | [diff] [blame] | 450 | unsigned ArgNum = *I; |
| 451 | |
| 452 | // Should we mark all arguments as tainted? |
| 453 | if (ArgNum == InvalidArgIndex) { |
| 454 | // For all pointer and references that were passed in: |
| 455 | // If they are not pointing to const data, mark data as tainted. |
| 456 | // TODO: So far we are just going one level down; ideally we'd need to |
| 457 | // recurse here. |
| 458 | for (unsigned int i = 0; i < CE->getNumArgs(); ++i) { |
| 459 | const Expr *Arg = CE->getArg(i); |
| 460 | // Process pointer argument. |
| 461 | const Type *ArgTy = Arg->getType().getTypePtr(); |
| 462 | QualType PType = ArgTy->getPointeeType(); |
| 463 | if ((!PType.isNull() && !PType.isConstQualified()) |
| 464 | || (ArgTy->isReferenceType() && !Arg->getType().isConstQualified())) |
| 465 | State = State->add<TaintArgsOnPostVisit>(i); |
| 466 | } |
| 467 | continue; |
| 468 | } |
| 469 | |
| 470 | // Should mark the return value? |
| 471 | if (ArgNum == ReturnValueIndex) { |
| 472 | State = State->add<TaintArgsOnPostVisit>(ReturnValueIndex); |
| 473 | continue; |
| 474 | } |
| 475 | |
| 476 | // Mark the given argument. |
| 477 | assert(ArgNum < CE->getNumArgs()); |
| 478 | State = State->add<TaintArgsOnPostVisit>(ArgNum); |
| 479 | } |
| 480 | |
| 481 | return State; |
| 482 | } |
| 483 | |
| 484 | |
Anna Zaks | 1fb826a | 2012-01-12 02:22:34 +0000 | [diff] [blame] | 485 | // If argument 0 (file descriptor) is tainted, all arguments except for arg 0 |
| 486 | // and arg 1 should get taint. |
Anna Zaks | 9ffbe24 | 2011-12-17 00:26:34 +0000 | [diff] [blame] | 487 | const ProgramState *GenericTaintChecker::preFscanf(const CallExpr *CE, |
| 488 | CheckerContext &C) const { |
| 489 | assert(CE->getNumArgs() >= 2); |
| 490 | const ProgramState *State = C.getState(); |
| 491 | |
| 492 | // Check is the file descriptor is tainted. |
Ted Kremenek | 5eca482 | 2012-01-06 22:09:28 +0000 | [diff] [blame] | 493 | if (State->isTainted(CE->getArg(0), C.getLocationContext()) || |
Anna Zaks | 1fb826a | 2012-01-12 02:22:34 +0000 | [diff] [blame] | 494 | isStdin(CE->getArg(0), C)) { |
| 495 | // All arguments except for the first two should get taint. |
| 496 | for (unsigned int i = 2; i < CE->getNumArgs(); ++i) |
| 497 | State = State->add<TaintArgsOnPostVisit>(i); |
| 498 | return State; |
| 499 | } |
| 500 | |
Anna Zaks | 9ffbe24 | 2011-12-17 00:26:34 +0000 | [diff] [blame] | 501 | return 0; |
| 502 | } |
| 503 | |
Anna Zaks | 9ffbe24 | 2011-12-17 00:26:34 +0000 | [diff] [blame] | 504 | const ProgramState *GenericTaintChecker::postScanf(const CallExpr *CE, |
| 505 | CheckerContext &C) const { |
Anna Zaks | df18c5a | 2011-11-16 19:58:13 +0000 | [diff] [blame] | 506 | const ProgramState *State = C.getState(); |
Anna Zaks | 1009ac7 | 2011-12-14 00:56:02 +0000 | [diff] [blame] | 507 | assert(CE->getNumArgs() >= 2); |
Ted Kremenek | 5eca482 | 2012-01-06 22:09:28 +0000 | [diff] [blame] | 508 | SVal x = State->getSVal(CE->getArg(1), C.getLocationContext()); |
Anna Zaks | df18c5a | 2011-11-16 19:58:13 +0000 | [diff] [blame] | 509 | // All arguments except for the very first one should get taint. |
| 510 | for (unsigned int i = 1; i < CE->getNumArgs(); ++i) { |
| 511 | // The arguments are pointer arguments. The data they are pointing at is |
| 512 | // tainted after the call. |
| 513 | const Expr* Arg = CE->getArg(i); |
Anna Zaks | 7cdfe29 | 2012-01-18 02:45:13 +0000 | [diff] [blame^] | 514 | SymbolRef Sym = getPointedToSymbol(C, Arg); |
Anna Zaks | 1009ac7 | 2011-12-14 00:56:02 +0000 | [diff] [blame] | 515 | if (Sym) |
| 516 | State = State->addTaint(Sym); |
| 517 | } |
Anna Zaks | 9ffbe24 | 2011-12-17 00:26:34 +0000 | [diff] [blame] | 518 | return State; |
Anna Zaks | df18c5a | 2011-11-16 19:58:13 +0000 | [diff] [blame] | 519 | } |
| 520 | |
Anna Zaks | 9ffbe24 | 2011-12-17 00:26:34 +0000 | [diff] [blame] | 521 | const ProgramState *GenericTaintChecker::postRetTaint(const CallExpr *CE, |
| 522 | CheckerContext &C) const { |
Ted Kremenek | 5eca482 | 2012-01-06 22:09:28 +0000 | [diff] [blame] | 523 | return C.getState()->addTaint(CE, C.getLocationContext()); |
Anna Zaks | df18c5a | 2011-11-16 19:58:13 +0000 | [diff] [blame] | 524 | } |
| 525 | |
Anna Zaks | efd6989 | 2011-12-14 00:56:18 +0000 | [diff] [blame] | 526 | bool GenericTaintChecker::isStdin(const Expr *E, |
| 527 | CheckerContext &C) const { |
Anna Zaks | d3d8548 | 2011-12-16 18:28:50 +0000 | [diff] [blame] | 528 | const ProgramState *State = C.getState(); |
Ted Kremenek | 5eca482 | 2012-01-06 22:09:28 +0000 | [diff] [blame] | 529 | SVal Val = State->getSVal(E, C.getLocationContext()); |
Anna Zaks | efd6989 | 2011-12-14 00:56:18 +0000 | [diff] [blame] | 530 | |
Anna Zaks | d3d8548 | 2011-12-16 18:28:50 +0000 | [diff] [blame] | 531 | // stdin is a pointer, so it would be a region. |
| 532 | const MemRegion *MemReg = Val.getAsRegion(); |
| 533 | |
| 534 | // The region should be symbolic, we do not know it's value. |
| 535 | const SymbolicRegion *SymReg = dyn_cast_or_null<SymbolicRegion>(MemReg); |
| 536 | if (!SymReg) |
Anna Zaks | efd6989 | 2011-12-14 00:56:18 +0000 | [diff] [blame] | 537 | return false; |
| 538 | |
Anna Zaks | d3d8548 | 2011-12-16 18:28:50 +0000 | [diff] [blame] | 539 | // Get it's symbol and find the declaration region it's pointing to. |
| 540 | const SymbolRegionValue *Sm =dyn_cast<SymbolRegionValue>(SymReg->getSymbol()); |
| 541 | if (!Sm) |
| 542 | return false; |
| 543 | const DeclRegion *DeclReg = dyn_cast_or_null<DeclRegion>(Sm->getRegion()); |
| 544 | if (!DeclReg) |
| 545 | return false; |
Anna Zaks | efd6989 | 2011-12-14 00:56:18 +0000 | [diff] [blame] | 546 | |
Anna Zaks | d3d8548 | 2011-12-16 18:28:50 +0000 | [diff] [blame] | 547 | // This region corresponds to a declaration, find out if it's a global/extern |
| 548 | // variable named stdin with the proper type. |
| 549 | if (const VarDecl *D = dyn_cast_or_null<VarDecl>(DeclReg->getDecl())) { |
| 550 | D = D->getCanonicalDecl(); |
| 551 | if ((D->getName().find("stdin") != StringRef::npos) && D->isExternC()) |
| 552 | if (const PointerType * PtrTy = |
| 553 | dyn_cast<PointerType>(D->getType().getTypePtr())) |
| 554 | if (PtrTy->getPointeeType() == C.getASTContext().getFILEType()) |
| 555 | return true; |
| 556 | } |
Anna Zaks | efd6989 | 2011-12-14 00:56:18 +0000 | [diff] [blame] | 557 | return false; |
| 558 | } |
| 559 | |
Anna Zaks | 9f03b62 | 2012-01-07 02:33:10 +0000 | [diff] [blame] | 560 | static bool getPrintfFormatArgumentNum(const CallExpr *CE, |
| 561 | const CheckerContext &C, |
| 562 | unsigned int &ArgNum) { |
| 563 | // Find if the function contains a format string argument. |
| 564 | // Handles: fprintf, printf, sprintf, snprintf, vfprintf, vprintf, vsprintf, |
| 565 | // vsnprintf, syslog, custom annotated functions. |
| 566 | const FunctionDecl *FDecl = C.getCalleeDecl(CE); |
| 567 | if (!FDecl) |
| 568 | return false; |
| 569 | for (specific_attr_iterator<FormatAttr> |
| 570 | i = FDecl->specific_attr_begin<FormatAttr>(), |
| 571 | e = FDecl->specific_attr_end<FormatAttr>(); i != e ; ++i) { |
| 572 | |
| 573 | const FormatAttr *Format = *i; |
| 574 | ArgNum = Format->getFormatIdx() - 1; |
| 575 | if ((Format->getType() == "printf") && CE->getNumArgs() > ArgNum) |
| 576 | return true; |
| 577 | } |
| 578 | |
| 579 | // Or if a function is named setproctitle (this is a heuristic). |
| 580 | if (C.getCalleeName(CE).find("setproctitle") != StringRef::npos) { |
| 581 | ArgNum = 0; |
| 582 | return true; |
| 583 | } |
| 584 | |
| 585 | return false; |
| 586 | } |
| 587 | |
Anna Zaks | 8568ee7 | 2012-01-14 02:48:40 +0000 | [diff] [blame] | 588 | bool GenericTaintChecker::generateReportIfTainted(const Expr *E, |
| 589 | const char Msg[], |
| 590 | CheckerContext &C) const { |
| 591 | assert(E); |
| 592 | |
| 593 | // Check for taint. |
| 594 | const ProgramState *State = C.getState(); |
| 595 | if (!State->isTainted(getPointedToSymbol(C, E)) && |
| 596 | !State->isTainted(E, C.getLocationContext())) |
| 597 | return false; |
| 598 | |
| 599 | // Generate diagnostic. |
| 600 | if (ExplodedNode *N = C.addTransition()) { |
| 601 | initBugType(); |
| 602 | BugReport *report = new BugReport(*BT, Msg, N); |
| 603 | report->addRange(E->getSourceRange()); |
| 604 | C.EmitReport(report); |
| 605 | return true; |
| 606 | } |
| 607 | return false; |
| 608 | } |
| 609 | |
Anna Zaks | 9f03b62 | 2012-01-07 02:33:10 +0000 | [diff] [blame] | 610 | bool GenericTaintChecker::checkUncontrolledFormatString(const CallExpr *CE, |
| 611 | CheckerContext &C) const{ |
| 612 | // Check if the function contains a format string argument. |
| 613 | unsigned int ArgNum = 0; |
| 614 | if (!getPrintfFormatArgumentNum(CE, C, ArgNum)) |
| 615 | return false; |
| 616 | |
| 617 | // If either the format string content or the pointer itself are tainted, warn. |
Anna Zaks | 8568ee7 | 2012-01-14 02:48:40 +0000 | [diff] [blame] | 618 | if (generateReportIfTainted(CE->getArg(ArgNum), |
| 619 | MsgUncontrolledFormatString, C)) |
| 620 | return true; |
| 621 | return false; |
| 622 | } |
| 623 | |
| 624 | bool GenericTaintChecker::checkSystemCall(const CallExpr *CE, |
| 625 | StringRef Name, |
| 626 | CheckerContext &C) const { |
| 627 | unsigned ArgNum = llvm::StringSwitch<unsigned>(Name) |
| 628 | .Case("system", 0) |
| 629 | .Case("popen", 0) |
| 630 | .Default(UINT_MAX); |
| 631 | |
| 632 | if (ArgNum == UINT_MAX) |
| 633 | return false; |
| 634 | |
| 635 | if (generateReportIfTainted(CE->getArg(ArgNum), |
| 636 | MsgSanitizeSystemArgs, C)) |
| 637 | return true; |
| 638 | |
Anna Zaks | 9f03b62 | 2012-01-07 02:33:10 +0000 | [diff] [blame] | 639 | return false; |
| 640 | } |
| 641 | |
Anna Zaks | 4e46221 | 2012-01-18 02:45:11 +0000 | [diff] [blame] | 642 | // TODO: Should this check be a part of the CString checker? |
| 643 | // If yes, should taint be a global setting? |
| 644 | bool GenericTaintChecker::checkTaintedBufferSize(const CallExpr *CE, |
| 645 | const FunctionDecl *FDecl, |
| 646 | CheckerContext &C) const { |
| 647 | // If the function has a buffer size argument, set ArgNum. |
| 648 | unsigned ArgNum = InvalidArgIndex; |
| 649 | unsigned BId = 0; |
| 650 | if ( (BId = FDecl->getMemoryFunctionKind()) ) |
| 651 | switch(BId) { |
| 652 | case Builtin::BImemcpy: |
| 653 | case Builtin::BImemmove: |
| 654 | case Builtin::BIstrncpy: |
| 655 | ArgNum = 2; |
| 656 | break; |
| 657 | case Builtin::BIstrndup: |
| 658 | ArgNum = 1; |
| 659 | break; |
| 660 | default: |
| 661 | break; |
| 662 | }; |
| 663 | |
| 664 | if (ArgNum == InvalidArgIndex) { |
| 665 | if (C.isCLibraryFunction(FDecl, "malloc") || |
| 666 | C.isCLibraryFunction(FDecl, "calloc") || |
| 667 | C.isCLibraryFunction(FDecl, "alloca")) |
| 668 | ArgNum = 0; |
| 669 | else if (C.isCLibraryFunction(FDecl, "memccpy")) |
| 670 | ArgNum = 3; |
| 671 | else if (C.isCLibraryFunction(FDecl, "realloc")) |
| 672 | ArgNum = 1; |
| 673 | else if (C.isCLibraryFunction(FDecl, "bcopy")) |
| 674 | ArgNum = 2; |
| 675 | } |
| 676 | |
| 677 | if (ArgNum != InvalidArgIndex && |
| 678 | generateReportIfTainted(CE->getArg(ArgNum), MsgTaintedBufferSize, C)) |
| 679 | return true; |
| 680 | |
| 681 | return false; |
| 682 | } |
| 683 | |
Anna Zaks | df18c5a | 2011-11-16 19:58:13 +0000 | [diff] [blame] | 684 | void ento::registerGenericTaintChecker(CheckerManager &mgr) { |
| 685 | mgr.registerChecker<GenericTaintChecker>(); |
| 686 | } |