blob: 5a962ab7d15757a068ef75b661ac124e7da5e725 [file] [log] [blame]
Anna Zaksdf18c5a2011-11-16 19:58:13 +00001//== GenericTaintChecker.cpp ----------------------------------- -*- C++ -*--=//
2//
3// The LLVM Compiler Infrastructure
4//
5// This file is distributed under the University of Illinois Open Source
6// License. See LICENSE.TXT for details.
7//
8//===----------------------------------------------------------------------===//
9//
10// This checker defines the attack surface for generic taint propagation.
11//
12// The taint information produced by it might be useful to other checkers. For
13// example, checkers should report errors which involve tainted data more
14// aggressively, even if the involved symbols are under constrained.
15//
16//===----------------------------------------------------------------------===//
17#include "ClangSACheckers.h"
18#include "clang/StaticAnalyzer/Core/Checker.h"
19#include "clang/StaticAnalyzer/Core/CheckerManager.h"
20#include "clang/StaticAnalyzer/Core/PathSensitive/CheckerContext.h"
Anna Zaks9ffbe242011-12-17 00:26:34 +000021#include "clang/StaticAnalyzer/Core/PathSensitive/ProgramStateTrait.h"
Anna Zaksdf18c5a2011-11-16 19:58:13 +000022#include "clang/StaticAnalyzer/Core/BugReporter/BugType.h"
Anna Zaks9b0c7492012-01-18 02:45:07 +000023#include "clang/Basic/Builtins.h"
Anna Zaks1fb826a2012-01-12 02:22:34 +000024#include <climits>
Anna Zaksdf18c5a2011-11-16 19:58:13 +000025
26using namespace clang;
27using namespace ento;
28
29namespace {
Anna Zaksefd69892011-12-14 00:56:18 +000030class GenericTaintChecker : public Checker< check::PostStmt<CallExpr>,
Anna Zaks9ffbe242011-12-17 00:26:34 +000031 check::PreStmt<CallExpr> > {
32public:
Anna Zaks8568ee72012-01-14 02:48:40 +000033 static void *getTag() { static int Tag; return &Tag; }
34
35 void checkPostStmt(const CallExpr *CE, CheckerContext &C) const;
36 void checkPostStmt(const DeclRefExpr *DRE, CheckerContext &C) const;
37
38 void checkPreStmt(const CallExpr *CE, CheckerContext &C) const;
Anna Zaksdf18c5a2011-11-16 19:58:13 +000039
Anna Zaks9ffbe242011-12-17 00:26:34 +000040private:
Anna Zaks8568ee72012-01-14 02:48:40 +000041 static const unsigned ReturnValueIndex = UINT_MAX;
Anna Zaks022b3f42012-01-17 00:37:02 +000042 static const unsigned InvalidArgIndex = UINT_MAX - 1;
Anna Zaks8568ee72012-01-14 02:48:40 +000043
Anna Zaks8f4caf52011-11-18 02:26:36 +000044 mutable llvm::OwningPtr<BugType> BT;
Anna Zaks9b0c7492012-01-18 02:45:07 +000045 inline void initBugType() const {
46 if (!BT)
47 BT.reset(new BugType("Taint Analysis", "General"));
48 }
Anna Zaks8f4caf52011-11-18 02:26:36 +000049
Anna Zaks1fb826a2012-01-12 02:22:34 +000050 /// \brief Catch taint related bugs. Check if tainted data is passed to a
51 /// system call etc.
Anna Zaks9f03b622012-01-07 02:33:10 +000052 bool checkPre(const CallExpr *CE, CheckerContext &C) const;
53
Anna Zaks1fb826a2012-01-12 02:22:34 +000054 /// \brief Add taint sources on a pre-visit.
55 void addSourcesPre(const CallExpr *CE, CheckerContext &C) const;
56
57 /// \brief Propagate taint generated at pre-visit.
58 bool propagateFromPre(const CallExpr *CE, CheckerContext &C) const;
59
60 /// \brief Add taint sources on a post visit.
61 void addSourcesPost(const CallExpr *CE, CheckerContext &C) const;
62
63 /// \brief Given a pointer argument, get the symbol of the value it contains
Anna Zaks8f4caf52011-11-18 02:26:36 +000064 /// (points to).
Anna Zaks7cdfe292012-01-18 02:45:13 +000065 static SymbolRef getPointedToSymbol(CheckerContext &C, const Expr *Arg);
Anna Zaksdf18c5a2011-11-16 19:58:13 +000066
Anna Zaks7cdfe292012-01-18 02:45:13 +000067 static inline bool isTaintedOrPointsToTainted(const Expr *E,
68 const ProgramState *State,
69 CheckerContext &C) {
Anna Zaks022b3f42012-01-17 00:37:02 +000070 return (State->isTainted(E, C.getLocationContext()) ||
71 (E->getType().getTypePtr()->isPointerType() &&
72 State->isTainted(getPointedToSymbol(C, E))));
73 }
74
Anna Zaks9ffbe242011-12-17 00:26:34 +000075 /// Functions defining the attack surface.
76 typedef const ProgramState *(GenericTaintChecker::*FnCheck)(const CallExpr *,
77 CheckerContext &C) const;
78 const ProgramState *postScanf(const CallExpr *CE, CheckerContext &C) const;
Anna Zaks9ffbe242011-12-17 00:26:34 +000079 const ProgramState *postRetTaint(const CallExpr *CE, CheckerContext &C) const;
Anna Zaks9ffbe242011-12-17 00:26:34 +000080
81 /// Taint the scanned input if the file is tainted.
82 const ProgramState *preFscanf(const CallExpr *CE, CheckerContext &C) const;
Anna Zaksdf18c5a2011-11-16 19:58:13 +000083
Anna Zaksd3d85482011-12-16 18:28:50 +000084 /// Check if the region the expression evaluates to is the standard input,
85 /// and thus, is tainted.
Anna Zaksefd69892011-12-14 00:56:18 +000086 bool isStdin(const Expr *E, CheckerContext &C) const;
Anna Zaksefd69892011-12-14 00:56:18 +000087
Anna Zaks9f03b622012-01-07 02:33:10 +000088 /// Check for CWE-134: Uncontrolled Format String.
Anna Zaks8568ee72012-01-14 02:48:40 +000089 static const char MsgUncontrolledFormatString[];
Anna Zaks9f03b622012-01-07 02:33:10 +000090 bool checkUncontrolledFormatString(const CallExpr *CE,
91 CheckerContext &C) const;
92
Anna Zaks8568ee72012-01-14 02:48:40 +000093 /// Check for:
94 /// CERT/STR02-C. "Sanitize data passed to complex subsystems"
95 /// CWE-78, "Failure to Sanitize Data into an OS Command"
96 static const char MsgSanitizeSystemArgs[];
97 bool checkSystemCall(const CallExpr *CE, StringRef Name,
98 CheckerContext &C) const;
Anna Zaks9ffbe242011-12-17 00:26:34 +000099
Anna Zaks4e462212012-01-18 02:45:11 +0000100 /// Check if tainted data is used as a buffer size ins strn.. functions,
101 /// and allocators.
102 static const char MsgTaintedBufferSize[];
103 bool checkTaintedBufferSize(const CallExpr *CE, const FunctionDecl *FDecl,
104 CheckerContext &C) const;
105
Anna Zaks8568ee72012-01-14 02:48:40 +0000106 /// Generate a report if the expression is tainted or points to tainted data.
107 bool generateReportIfTainted(const Expr *E, const char Msg[],
108 CheckerContext &C) const;
Anna Zaks022b3f42012-01-17 00:37:02 +0000109
110
111 typedef llvm::SmallVector<unsigned, 2> ArgVector;
Anna Zaks9ffbe242011-12-17 00:26:34 +0000112
Anna Zaks022b3f42012-01-17 00:37:02 +0000113 /// \brief A struct used to specify taint propagation rules for a function.
114 ///
115 /// If any of the possible taint source arguments is tainted, all of the
116 /// destination arguments should also be tainted. Use InvalidArgIndex in the
117 /// src list to specify that all of the arguments can introduce taint. Use
118 /// InvalidArgIndex in the dst arguments to signify that all the non-const
119 /// pointer and reference arguments might be tainted on return. If
120 /// ReturnValueIndex is added to the dst list, the return value will be
121 /// tainted.
122 struct TaintPropagationRule {
123 /// List of arguments which can be taint sources and should be checked.
124 ArgVector SrcArgs;
125 /// List of arguments which should be tainted on function return.
126 ArgVector DstArgs;
Anna Zaks9b0c7492012-01-18 02:45:07 +0000127 // TODO: Check if using other data structures would be more optimal.
Anna Zaks022b3f42012-01-17 00:37:02 +0000128
129 TaintPropagationRule() {}
130
Anna Zaks9b0c7492012-01-18 02:45:07 +0000131 TaintPropagationRule(unsigned SArg,
132 unsigned DArg, bool TaintRet = false) {
Anna Zaks022b3f42012-01-17 00:37:02 +0000133 SrcArgs.push_back(SArg);
134 DstArgs.push_back(DArg);
Anna Zaks9b0c7492012-01-18 02:45:07 +0000135 if (TaintRet)
136 DstArgs.push_back(ReturnValueIndex);
Anna Zaks022b3f42012-01-17 00:37:02 +0000137 }
138
Anna Zaks9b0c7492012-01-18 02:45:07 +0000139 TaintPropagationRule(unsigned SArg1, unsigned SArg2,
140 unsigned DArg, bool TaintRet = false) {
141 SrcArgs.push_back(SArg1);
142 SrcArgs.push_back(SArg2);
143 DstArgs.push_back(DArg);
144 if (TaintRet)
145 DstArgs.push_back(ReturnValueIndex);
146 }
147
148 /// Get the propagation rule for a given function.
149 static TaintPropagationRule
150 getTaintPropagationRule(const FunctionDecl *FDecl,
151 StringRef Name,
152 CheckerContext &C);
153
Anna Zaks022b3f42012-01-17 00:37:02 +0000154 inline void addSrcArg(unsigned A) { SrcArgs.push_back(A); }
155 inline void addDstArg(unsigned A) { DstArgs.push_back(A); }
156
Anna Zaks9b0c7492012-01-18 02:45:07 +0000157 inline bool isNull() const { return SrcArgs.empty(); }
158
159 inline bool isDestinationArgument(unsigned ArgNum) const {
160 return (std::find(DstArgs.begin(),
161 DstArgs.end(), ArgNum) != DstArgs.end());
162 }
Anna Zaks022b3f42012-01-17 00:37:02 +0000163
Anna Zaks7cdfe292012-01-18 02:45:13 +0000164 /// \brief Pre-process a function which propagates taint according to the
165 /// taint rule.
166 const ProgramState *process(const CallExpr *CE, CheckerContext &C) const;
167
168 };
Anna Zaksdf18c5a2011-11-16 19:58:13 +0000169};
Anna Zaks9b0c7492012-01-18 02:45:07 +0000170
171const unsigned GenericTaintChecker::ReturnValueIndex;
172const unsigned GenericTaintChecker::InvalidArgIndex;
173
Anna Zaks8568ee72012-01-14 02:48:40 +0000174const char GenericTaintChecker::MsgUncontrolledFormatString[] =
175 "Tainted format string (CWE-134: Uncontrolled Format String)";
176
177const char GenericTaintChecker::MsgSanitizeSystemArgs[] =
178 "Tainted data passed to a system call "
179 "(CERT/STR02-C. Sanitize data passed to complex subsystems)";
Anna Zaks4e462212012-01-18 02:45:11 +0000180
181const char GenericTaintChecker::MsgTaintedBufferSize[] =
182 "Tainted data is used to specify the buffer size "
183 "(CERT/STR31-C. Guarantee that storage for strings has sufficient space for "
184 "character data and the null terminator)";
185
186} // end of anonymous namespace
Anna Zaksdf18c5a2011-11-16 19:58:13 +0000187
Anna Zaks1fb826a2012-01-12 02:22:34 +0000188/// A set which is used to pass information from call pre-visit instruction
189/// to the call post-visit. The values are unsigned integers, which are either
190/// ReturnValueIndex, or indexes of the pointer/reference argument, which
191/// points to data, which should be tainted on return.
192namespace { struct TaintArgsOnPostVisit{}; }
193namespace clang { namespace ento {
194template<> struct ProgramStateTrait<TaintArgsOnPostVisit>
195 : public ProgramStatePartialTrait<llvm::ImmutableSet<unsigned> > {
196 static void *GDMIndex() { return GenericTaintChecker::getTag(); }
197};
198}}
Anna Zaks9ffbe242011-12-17 00:26:34 +0000199
Anna Zaks9b0c7492012-01-18 02:45:07 +0000200GenericTaintChecker::TaintPropagationRule
201GenericTaintChecker::TaintPropagationRule::getTaintPropagationRule(
202 const FunctionDecl *FDecl,
203 StringRef Name,
204 CheckerContext &C) {
205 // Check for exact name match for functions without builtin substitutes.
206 TaintPropagationRule Rule = llvm::StringSwitch<TaintPropagationRule>(Name)
207 .Case("atoi", TaintPropagationRule(0, ReturnValueIndex))
208 .Case("atol", TaintPropagationRule(0, ReturnValueIndex))
209 .Case("atoll", TaintPropagationRule(0, ReturnValueIndex))
210 .Default(TaintPropagationRule());
211
212 if (!Rule.isNull())
213 return Rule;
214
215 // Check if it's one of the memory setting/copying functions.
216 // This check is specialized but faster then calling isCLibraryFunction.
217 unsigned BId = 0;
218 if ( (BId = FDecl->getMemoryFunctionKind()) )
219 switch(BId) {
220 case Builtin::BImemcpy:
221 case Builtin::BImemmove:
222 case Builtin::BIstrncpy:
223 case Builtin::BIstrncat:
224 return TaintPropagationRule(1, 2, 0, true);
225 break;
226 case Builtin::BIstrlcpy:
227 case Builtin::BIstrlcat:
228 return TaintPropagationRule(1, 2, 0, false);
229 break;
230 case Builtin::BIstrndup:
231 return TaintPropagationRule(0, 1, ReturnValueIndex);
232 break;
233
234 default:
235 break;
236 };
237
238 // Process all other functions which could be defined as builtins.
239 if (Rule.isNull()) {
240 if (C.isCLibraryFunction(FDecl, "snprintf") ||
241 C.isCLibraryFunction(FDecl, "sprintf"))
242 return TaintPropagationRule(InvalidArgIndex, 0, true);
243 else if (C.isCLibraryFunction(FDecl, "strcpy") ||
244 C.isCLibraryFunction(FDecl, "stpcpy") ||
245 C.isCLibraryFunction(FDecl, "strcat"))
246 return TaintPropagationRule(1, 0, true);
247 else if (C.isCLibraryFunction(FDecl, "bcopy"))
248 return TaintPropagationRule(0, 2, 1, false);
249 else if (C.isCLibraryFunction(FDecl, "strdup") ||
250 C.isCLibraryFunction(FDecl, "strdupa"))
251 return TaintPropagationRule(0, ReturnValueIndex);
Anna Zaks4e462212012-01-18 02:45:11 +0000252 else if (C.isCLibraryFunction(FDecl, "wcsdup"))
253 return TaintPropagationRule(0, ReturnValueIndex);
Anna Zaks9b0c7492012-01-18 02:45:07 +0000254 }
255
256 // Skipping the following functions, since they might be used for cleansing
257 // or smart memory copy:
258 // - memccpy - copying untill hitting a special character.
259
260 return TaintPropagationRule();
Anna Zaks8f4caf52011-11-18 02:26:36 +0000261}
262
Anna Zaks9ffbe242011-12-17 00:26:34 +0000263void GenericTaintChecker::checkPreStmt(const CallExpr *CE,
264 CheckerContext &C) const {
Anna Zaks9f03b622012-01-07 02:33:10 +0000265 // Check for errors first.
266 if (checkPre(CE, C))
267 return;
Anna Zaks9ffbe242011-12-17 00:26:34 +0000268
Anna Zaks9f03b622012-01-07 02:33:10 +0000269 // Add taint second.
Anna Zaks1fb826a2012-01-12 02:22:34 +0000270 addSourcesPre(CE, C);
Anna Zaks9f03b622012-01-07 02:33:10 +0000271}
272
273void GenericTaintChecker::checkPostStmt(const CallExpr *CE,
274 CheckerContext &C) const {
Anna Zaks1fb826a2012-01-12 02:22:34 +0000275 if (propagateFromPre(CE, C))
276 return;
277 addSourcesPost(CE, C);
Anna Zaks9f03b622012-01-07 02:33:10 +0000278}
279
Anna Zaks1fb826a2012-01-12 02:22:34 +0000280void GenericTaintChecker::addSourcesPre(const CallExpr *CE,
281 CheckerContext &C) const {
Anna Zaks9b0c7492012-01-18 02:45:07 +0000282 const ProgramState *State = 0;
283 const FunctionDecl *FDecl = C.getCalleeDecl(CE);
284 StringRef Name = C.getCalleeName(FDecl);
Anna Zaks1fb826a2012-01-12 02:22:34 +0000285 if (Name.empty())
286 return;
Anna Zaks022b3f42012-01-17 00:37:02 +0000287
Anna Zaks9b0c7492012-01-18 02:45:07 +0000288 // First, try generating a propagation rule for this function.
289 TaintPropagationRule Rule =
290 TaintPropagationRule::getTaintPropagationRule(FDecl, Name, C);
Anna Zaks022b3f42012-01-17 00:37:02 +0000291 if (!Rule.isNull()) {
Anna Zaks7cdfe292012-01-18 02:45:13 +0000292 State = Rule.process(CE, C);
Anna Zaks022b3f42012-01-17 00:37:02 +0000293 if (!State)
294 return;
295 C.addTransition(State);
Anna Zaks9b0c7492012-01-18 02:45:07 +0000296 return;
Anna Zaks022b3f42012-01-17 00:37:02 +0000297 }
298
Anna Zaks9b0c7492012-01-18 02:45:07 +0000299 // Otherwise, check if we have custom pre-processing implemented.
Anna Zaks9ffbe242011-12-17 00:26:34 +0000300 FnCheck evalFunction = llvm::StringSwitch<FnCheck>(Name)
Anna Zaks1fb826a2012-01-12 02:22:34 +0000301 .Case("fscanf", &GenericTaintChecker::preFscanf)
Anna Zaks9ffbe242011-12-17 00:26:34 +0000302 .Default(0);
Anna Zaks9ffbe242011-12-17 00:26:34 +0000303 // Check and evaluate the call.
304 if (evalFunction)
305 State = (this->*evalFunction)(CE, C);
306 if (!State)
Anna Zaksdf18c5a2011-11-16 19:58:13 +0000307 return;
Anna Zaks9ffbe242011-12-17 00:26:34 +0000308 C.addTransition(State);
Anna Zaks9b0c7492012-01-18 02:45:07 +0000309
Anna Zaks9ffbe242011-12-17 00:26:34 +0000310}
311
Anna Zaks1fb826a2012-01-12 02:22:34 +0000312bool GenericTaintChecker::propagateFromPre(const CallExpr *CE,
313 CheckerContext &C) const {
314 const ProgramState *State = C.getState();
315
316 // Depending on what was tainted at pre-visit, we determined a set of
317 // arguments which should be tainted after the function returns. These are
318 // stored in the state as TaintArgsOnPostVisit set.
319 llvm::ImmutableSet<unsigned> TaintArgs = State->get<TaintArgsOnPostVisit>();
320 for (llvm::ImmutableSet<unsigned>::iterator
321 I = TaintArgs.begin(), E = TaintArgs.end(); I != E; ++I) {
322 unsigned ArgNum = *I;
323
324 // Special handling for the tainted return value.
325 if (ArgNum == ReturnValueIndex) {
326 State = State->addTaint(CE, C.getLocationContext());
327 continue;
328 }
329
330 // The arguments are pointer arguments. The data they are pointing at is
331 // tainted after the call.
332 const Expr* Arg = CE->getArg(ArgNum);
Anna Zaks7cdfe292012-01-18 02:45:13 +0000333 SymbolRef Sym = getPointedToSymbol(C, Arg);
Anna Zaks1fb826a2012-01-12 02:22:34 +0000334 if (Sym)
335 State = State->addTaint(Sym);
336 }
337
338 // Clear up the taint info from the state.
339 State = State->remove<TaintArgsOnPostVisit>();
340
341 if (State != C.getState()) {
342 C.addTransition(State);
343 return true;
344 }
345 return false;
346}
347
348void GenericTaintChecker::addSourcesPost(const CallExpr *CE,
349 CheckerContext &C) const {
Anna Zaksdf18c5a2011-11-16 19:58:13 +0000350 // Define the attack surface.
351 // Set the evaluation function by switching on the callee name.
Anna Zaks9ffbe242011-12-17 00:26:34 +0000352 StringRef Name = C.getCalleeName(CE);
Anna Zaks1fb826a2012-01-12 02:22:34 +0000353 if (Name.empty())
354 return;
Anna Zaksdf18c5a2011-11-16 19:58:13 +0000355 FnCheck evalFunction = llvm::StringSwitch<FnCheck>(Name)
Anna Zaks9ffbe242011-12-17 00:26:34 +0000356 .Case("scanf", &GenericTaintChecker::postScanf)
Anna Zaks1009ac72011-12-14 00:56:02 +0000357 // TODO: Add support for vfscanf & family.
Anna Zaks9ffbe242011-12-17 00:26:34 +0000358 .Case("getchar", &GenericTaintChecker::postRetTaint)
359 .Case("getenv", &GenericTaintChecker::postRetTaint)
360 .Case("fopen", &GenericTaintChecker::postRetTaint)
361 .Case("fdopen", &GenericTaintChecker::postRetTaint)
362 .Case("freopen", &GenericTaintChecker::postRetTaint)
Anna Zaks1fb826a2012-01-12 02:22:34 +0000363 .Default(0);
Anna Zaksdf18c5a2011-11-16 19:58:13 +0000364
365 // If the callee isn't defined, it is not of security concern.
366 // Check and evaluate the call.
Anna Zaks9f03b622012-01-07 02:33:10 +0000367 const ProgramState *State = 0;
Anna Zaksdf18c5a2011-11-16 19:58:13 +0000368 if (evalFunction)
Anna Zaks9ffbe242011-12-17 00:26:34 +0000369 State = (this->*evalFunction)(CE, C);
370 if (!State)
371 return;
Anna Zaksdf18c5a2011-11-16 19:58:13 +0000372
Anna Zaks9ffbe242011-12-17 00:26:34 +0000373 C.addTransition(State);
Anna Zaksdf18c5a2011-11-16 19:58:13 +0000374}
Anna Zaks8f4caf52011-11-18 02:26:36 +0000375
Anna Zaks9f03b622012-01-07 02:33:10 +0000376bool GenericTaintChecker::checkPre(const CallExpr *CE, CheckerContext &C) const{
377
378 if (checkUncontrolledFormatString(CE, C))
379 return true;
380
Anna Zaks4e462212012-01-18 02:45:11 +0000381 const FunctionDecl *FDecl = C.getCalleeDecl(CE);
382 StringRef Name = C.getCalleeName(FDecl);
Anna Zaks8568ee72012-01-14 02:48:40 +0000383 if (Name.empty())
384 return false;
385
386 if (checkSystemCall(CE, Name, C))
387 return true;
388
Anna Zaks4e462212012-01-18 02:45:11 +0000389 if (checkTaintedBufferSize(CE, FDecl, C))
390 return true;
391
Anna Zaks9f03b622012-01-07 02:33:10 +0000392 return false;
393}
394
Anna Zaks8f4caf52011-11-18 02:26:36 +0000395SymbolRef GenericTaintChecker::getPointedToSymbol(CheckerContext &C,
Anna Zaks7cdfe292012-01-18 02:45:13 +0000396 const Expr* Arg) {
Anna Zaks8f4caf52011-11-18 02:26:36 +0000397 const ProgramState *State = C.getState();
Ted Kremenek5eca4822012-01-06 22:09:28 +0000398 SVal AddrVal = State->getSVal(Arg->IgnoreParens(), C.getLocationContext());
Anna Zaksd3d85482011-12-16 18:28:50 +0000399 if (AddrVal.isUnknownOrUndef())
Anna Zakse3d250e2011-12-11 18:43:40 +0000400 return 0;
401
Anna Zaksdf18c5a2011-11-16 19:58:13 +0000402 Loc *AddrLoc = dyn_cast<Loc>(&AddrVal);
Anna Zaks7cdfe292012-01-18 02:45:13 +0000403 if (!AddrLoc)
Anna Zaks8f4caf52011-11-18 02:26:36 +0000404 return 0;
405
Anna Zaks71d29092012-01-13 00:56:51 +0000406 const PointerType *ArgTy =
407 dyn_cast<PointerType>(Arg->getType().getCanonicalType().getTypePtr());
408 assert(ArgTy);
409 SVal Val = State->getSVal(*AddrLoc, ArgTy->getPointeeType());
Anna Zaksdf18c5a2011-11-16 19:58:13 +0000410 return Val.getAsSymbol();
411}
412
Anna Zaks022b3f42012-01-17 00:37:02 +0000413const ProgramState *
Anna Zaks7cdfe292012-01-18 02:45:13 +0000414GenericTaintChecker::TaintPropagationRule::process(const CallExpr *CE,
415 CheckerContext &C) const {
Anna Zaks022b3f42012-01-17 00:37:02 +0000416 const ProgramState *State = C.getState();
417
418 // Check for taint in arguments.
419 bool IsTainted = false;
Anna Zaks7cdfe292012-01-18 02:45:13 +0000420 for (ArgVector::const_iterator I = SrcArgs.begin(),
421 E = SrcArgs.end(); I != E; ++I) {
Anna Zaks022b3f42012-01-17 00:37:02 +0000422 unsigned ArgNum = *I;
423
424 if (ArgNum == InvalidArgIndex) {
Anna Zaks9b0c7492012-01-18 02:45:07 +0000425 // Check if any of the arguments is tainted, but skip the
426 // destination arguments.
427 for (unsigned int i = 0; i < CE->getNumArgs(); ++i) {
Anna Zaks7cdfe292012-01-18 02:45:13 +0000428 if (isDestinationArgument(i))
Anna Zaks9b0c7492012-01-18 02:45:07 +0000429 continue;
Anna Zaks7cdfe292012-01-18 02:45:13 +0000430 if ((IsTainted =
431 GenericTaintChecker::isTaintedOrPointsToTainted(CE->getArg(i),
432 State, C)))
Anna Zaks022b3f42012-01-17 00:37:02 +0000433 break;
Anna Zaks9b0c7492012-01-18 02:45:07 +0000434 }
Anna Zaks022b3f42012-01-17 00:37:02 +0000435 break;
436 }
437
438 assert(ArgNum < CE->getNumArgs());
Anna Zaks7cdfe292012-01-18 02:45:13 +0000439 if ((IsTainted =
440 GenericTaintChecker::isTaintedOrPointsToTainted(CE->getArg(ArgNum),
441 State, C)))
Anna Zaks022b3f42012-01-17 00:37:02 +0000442 break;
443 }
444 if (!IsTainted)
445 return State;
446
447 // Mark the arguments which should be tainted after the function returns.
Anna Zaks7cdfe292012-01-18 02:45:13 +0000448 for (ArgVector::const_iterator I = DstArgs.begin(),
449 E = DstArgs.end(); I != E; ++I) {
Anna Zaks022b3f42012-01-17 00:37:02 +0000450 unsigned ArgNum = *I;
451
452 // Should we mark all arguments as tainted?
453 if (ArgNum == InvalidArgIndex) {
454 // For all pointer and references that were passed in:
455 // If they are not pointing to const data, mark data as tainted.
456 // TODO: So far we are just going one level down; ideally we'd need to
457 // recurse here.
458 for (unsigned int i = 0; i < CE->getNumArgs(); ++i) {
459 const Expr *Arg = CE->getArg(i);
460 // Process pointer argument.
461 const Type *ArgTy = Arg->getType().getTypePtr();
462 QualType PType = ArgTy->getPointeeType();
463 if ((!PType.isNull() && !PType.isConstQualified())
464 || (ArgTy->isReferenceType() && !Arg->getType().isConstQualified()))
465 State = State->add<TaintArgsOnPostVisit>(i);
466 }
467 continue;
468 }
469
470 // Should mark the return value?
471 if (ArgNum == ReturnValueIndex) {
472 State = State->add<TaintArgsOnPostVisit>(ReturnValueIndex);
473 continue;
474 }
475
476 // Mark the given argument.
477 assert(ArgNum < CE->getNumArgs());
478 State = State->add<TaintArgsOnPostVisit>(ArgNum);
479 }
480
481 return State;
482}
483
484
Anna Zaks1fb826a2012-01-12 02:22:34 +0000485// If argument 0 (file descriptor) is tainted, all arguments except for arg 0
486// and arg 1 should get taint.
Anna Zaks9ffbe242011-12-17 00:26:34 +0000487const ProgramState *GenericTaintChecker::preFscanf(const CallExpr *CE,
488 CheckerContext &C) const {
489 assert(CE->getNumArgs() >= 2);
490 const ProgramState *State = C.getState();
491
492 // Check is the file descriptor is tainted.
Ted Kremenek5eca4822012-01-06 22:09:28 +0000493 if (State->isTainted(CE->getArg(0), C.getLocationContext()) ||
Anna Zaks1fb826a2012-01-12 02:22:34 +0000494 isStdin(CE->getArg(0), C)) {
495 // All arguments except for the first two should get taint.
496 for (unsigned int i = 2; i < CE->getNumArgs(); ++i)
497 State = State->add<TaintArgsOnPostVisit>(i);
498 return State;
499 }
500
Anna Zaks9ffbe242011-12-17 00:26:34 +0000501 return 0;
502}
503
Anna Zaks9ffbe242011-12-17 00:26:34 +0000504const ProgramState *GenericTaintChecker::postScanf(const CallExpr *CE,
505 CheckerContext &C) const {
Anna Zaksdf18c5a2011-11-16 19:58:13 +0000506 const ProgramState *State = C.getState();
Anna Zaks1009ac72011-12-14 00:56:02 +0000507 assert(CE->getNumArgs() >= 2);
Ted Kremenek5eca4822012-01-06 22:09:28 +0000508 SVal x = State->getSVal(CE->getArg(1), C.getLocationContext());
Anna Zaksdf18c5a2011-11-16 19:58:13 +0000509 // All arguments except for the very first one should get taint.
510 for (unsigned int i = 1; i < CE->getNumArgs(); ++i) {
511 // The arguments are pointer arguments. The data they are pointing at is
512 // tainted after the call.
513 const Expr* Arg = CE->getArg(i);
Anna Zaks7cdfe292012-01-18 02:45:13 +0000514 SymbolRef Sym = getPointedToSymbol(C, Arg);
Anna Zaks1009ac72011-12-14 00:56:02 +0000515 if (Sym)
516 State = State->addTaint(Sym);
517 }
Anna Zaks9ffbe242011-12-17 00:26:34 +0000518 return State;
Anna Zaksdf18c5a2011-11-16 19:58:13 +0000519}
520
Anna Zaks9ffbe242011-12-17 00:26:34 +0000521const ProgramState *GenericTaintChecker::postRetTaint(const CallExpr *CE,
522 CheckerContext &C) const {
Ted Kremenek5eca4822012-01-06 22:09:28 +0000523 return C.getState()->addTaint(CE, C.getLocationContext());
Anna Zaksdf18c5a2011-11-16 19:58:13 +0000524}
525
Anna Zaksefd69892011-12-14 00:56:18 +0000526bool GenericTaintChecker::isStdin(const Expr *E,
527 CheckerContext &C) const {
Anna Zaksd3d85482011-12-16 18:28:50 +0000528 const ProgramState *State = C.getState();
Ted Kremenek5eca4822012-01-06 22:09:28 +0000529 SVal Val = State->getSVal(E, C.getLocationContext());
Anna Zaksefd69892011-12-14 00:56:18 +0000530
Anna Zaksd3d85482011-12-16 18:28:50 +0000531 // stdin is a pointer, so it would be a region.
532 const MemRegion *MemReg = Val.getAsRegion();
533
534 // The region should be symbolic, we do not know it's value.
535 const SymbolicRegion *SymReg = dyn_cast_or_null<SymbolicRegion>(MemReg);
536 if (!SymReg)
Anna Zaksefd69892011-12-14 00:56:18 +0000537 return false;
538
Anna Zaksd3d85482011-12-16 18:28:50 +0000539 // Get it's symbol and find the declaration region it's pointing to.
540 const SymbolRegionValue *Sm =dyn_cast<SymbolRegionValue>(SymReg->getSymbol());
541 if (!Sm)
542 return false;
543 const DeclRegion *DeclReg = dyn_cast_or_null<DeclRegion>(Sm->getRegion());
544 if (!DeclReg)
545 return false;
Anna Zaksefd69892011-12-14 00:56:18 +0000546
Anna Zaksd3d85482011-12-16 18:28:50 +0000547 // This region corresponds to a declaration, find out if it's a global/extern
548 // variable named stdin with the proper type.
549 if (const VarDecl *D = dyn_cast_or_null<VarDecl>(DeclReg->getDecl())) {
550 D = D->getCanonicalDecl();
551 if ((D->getName().find("stdin") != StringRef::npos) && D->isExternC())
552 if (const PointerType * PtrTy =
553 dyn_cast<PointerType>(D->getType().getTypePtr()))
554 if (PtrTy->getPointeeType() == C.getASTContext().getFILEType())
555 return true;
556 }
Anna Zaksefd69892011-12-14 00:56:18 +0000557 return false;
558}
559
Anna Zaks9f03b622012-01-07 02:33:10 +0000560static bool getPrintfFormatArgumentNum(const CallExpr *CE,
561 const CheckerContext &C,
562 unsigned int &ArgNum) {
563 // Find if the function contains a format string argument.
564 // Handles: fprintf, printf, sprintf, snprintf, vfprintf, vprintf, vsprintf,
565 // vsnprintf, syslog, custom annotated functions.
566 const FunctionDecl *FDecl = C.getCalleeDecl(CE);
567 if (!FDecl)
568 return false;
569 for (specific_attr_iterator<FormatAttr>
570 i = FDecl->specific_attr_begin<FormatAttr>(),
571 e = FDecl->specific_attr_end<FormatAttr>(); i != e ; ++i) {
572
573 const FormatAttr *Format = *i;
574 ArgNum = Format->getFormatIdx() - 1;
575 if ((Format->getType() == "printf") && CE->getNumArgs() > ArgNum)
576 return true;
577 }
578
579 // Or if a function is named setproctitle (this is a heuristic).
580 if (C.getCalleeName(CE).find("setproctitle") != StringRef::npos) {
581 ArgNum = 0;
582 return true;
583 }
584
585 return false;
586}
587
Anna Zaks8568ee72012-01-14 02:48:40 +0000588bool GenericTaintChecker::generateReportIfTainted(const Expr *E,
589 const char Msg[],
590 CheckerContext &C) const {
591 assert(E);
592
593 // Check for taint.
594 const ProgramState *State = C.getState();
595 if (!State->isTainted(getPointedToSymbol(C, E)) &&
596 !State->isTainted(E, C.getLocationContext()))
597 return false;
598
599 // Generate diagnostic.
600 if (ExplodedNode *N = C.addTransition()) {
601 initBugType();
602 BugReport *report = new BugReport(*BT, Msg, N);
603 report->addRange(E->getSourceRange());
604 C.EmitReport(report);
605 return true;
606 }
607 return false;
608}
609
Anna Zaks9f03b622012-01-07 02:33:10 +0000610bool GenericTaintChecker::checkUncontrolledFormatString(const CallExpr *CE,
611 CheckerContext &C) const{
612 // Check if the function contains a format string argument.
613 unsigned int ArgNum = 0;
614 if (!getPrintfFormatArgumentNum(CE, C, ArgNum))
615 return false;
616
617 // If either the format string content or the pointer itself are tainted, warn.
Anna Zaks8568ee72012-01-14 02:48:40 +0000618 if (generateReportIfTainted(CE->getArg(ArgNum),
619 MsgUncontrolledFormatString, C))
620 return true;
621 return false;
622}
623
624bool GenericTaintChecker::checkSystemCall(const CallExpr *CE,
625 StringRef Name,
626 CheckerContext &C) const {
627 unsigned ArgNum = llvm::StringSwitch<unsigned>(Name)
628 .Case("system", 0)
629 .Case("popen", 0)
630 .Default(UINT_MAX);
631
632 if (ArgNum == UINT_MAX)
633 return false;
634
635 if (generateReportIfTainted(CE->getArg(ArgNum),
636 MsgSanitizeSystemArgs, C))
637 return true;
638
Anna Zaks9f03b622012-01-07 02:33:10 +0000639 return false;
640}
641
Anna Zaks4e462212012-01-18 02:45:11 +0000642// TODO: Should this check be a part of the CString checker?
643// If yes, should taint be a global setting?
644bool GenericTaintChecker::checkTaintedBufferSize(const CallExpr *CE,
645 const FunctionDecl *FDecl,
646 CheckerContext &C) const {
647 // If the function has a buffer size argument, set ArgNum.
648 unsigned ArgNum = InvalidArgIndex;
649 unsigned BId = 0;
650 if ( (BId = FDecl->getMemoryFunctionKind()) )
651 switch(BId) {
652 case Builtin::BImemcpy:
653 case Builtin::BImemmove:
654 case Builtin::BIstrncpy:
655 ArgNum = 2;
656 break;
657 case Builtin::BIstrndup:
658 ArgNum = 1;
659 break;
660 default:
661 break;
662 };
663
664 if (ArgNum == InvalidArgIndex) {
665 if (C.isCLibraryFunction(FDecl, "malloc") ||
666 C.isCLibraryFunction(FDecl, "calloc") ||
667 C.isCLibraryFunction(FDecl, "alloca"))
668 ArgNum = 0;
669 else if (C.isCLibraryFunction(FDecl, "memccpy"))
670 ArgNum = 3;
671 else if (C.isCLibraryFunction(FDecl, "realloc"))
672 ArgNum = 1;
673 else if (C.isCLibraryFunction(FDecl, "bcopy"))
674 ArgNum = 2;
675 }
676
677 if (ArgNum != InvalidArgIndex &&
678 generateReportIfTainted(CE->getArg(ArgNum), MsgTaintedBufferSize, C))
679 return true;
680
681 return false;
682}
683
Anna Zaksdf18c5a2011-11-16 19:58:13 +0000684void ento::registerGenericTaintChecker(CheckerManager &mgr) {
685 mgr.registerChecker<GenericTaintChecker>();
686}