Zhongxing Xu | 589c0f2 | 2009-11-12 08:38:56 +0000 | [diff] [blame] | 1 | //=== MallocChecker.cpp - A malloc/free checker -------------------*- C++ -*--// |
| 2 | // |
| 3 | // The LLVM Compiler Infrastructure |
| 4 | // |
| 5 | // This file is distributed under the University of Illinois Open Source |
| 6 | // License. See LICENSE.TXT for details. |
| 7 | // |
| 8 | //===----------------------------------------------------------------------===// |
| 9 | // |
| 10 | // This file defines malloc/free checker, which checks for potential memory |
| 11 | // leaks, double free, and use-after-free problems. |
| 12 | // |
| 13 | //===----------------------------------------------------------------------===// |
| 14 | |
Argyrios Kyrtzidis | 312dbec | 2011-02-28 01:26:35 +0000 | [diff] [blame] | 15 | #include "ClangSACheckers.h" |
Anna Zaks | f0dfc9c | 2012-02-17 22:35:31 +0000 | [diff] [blame] | 16 | #include "InterCheckerAPI.h" |
Chandler Carruth | 55fc873 | 2012-12-04 09:13:33 +0000 | [diff] [blame] | 17 | #include "clang/AST/Attr.h" |
| 18 | #include "clang/Basic/SourceManager.h" |
| 19 | #include "clang/StaticAnalyzer/Core/BugReporter/BugType.h" |
Argyrios Kyrtzidis | ec8605f | 2011-03-01 01:16:21 +0000 | [diff] [blame] | 20 | #include "clang/StaticAnalyzer/Core/Checker.h" |
Argyrios Kyrtzidis | 312dbec | 2011-02-28 01:26:35 +0000 | [diff] [blame] | 21 | #include "clang/StaticAnalyzer/Core/CheckerManager.h" |
Jordan Rose | f540c54 | 2012-07-26 21:39:41 +0000 | [diff] [blame] | 22 | #include "clang/StaticAnalyzer/Core/PathSensitive/CallEvent.h" |
Chandler Carruth | 55fc873 | 2012-12-04 09:13:33 +0000 | [diff] [blame] | 23 | #include "clang/StaticAnalyzer/Core/PathSensitive/CheckerContext.h" |
Ted Kremenek | 18c66fd | 2011-08-15 22:09:50 +0000 | [diff] [blame] | 24 | #include "clang/StaticAnalyzer/Core/PathSensitive/ProgramState.h" |
| 25 | #include "clang/StaticAnalyzer/Core/PathSensitive/ProgramStateTrait.h" |
Ted Kremenek | 9b66371 | 2011-02-10 01:03:03 +0000 | [diff] [blame] | 26 | #include "clang/StaticAnalyzer/Core/PathSensitive/SymbolManager.h" |
Zhongxing Xu | 589c0f2 | 2009-11-12 08:38:56 +0000 | [diff] [blame] | 27 | #include "llvm/ADT/ImmutableMap.h" |
Benjamin Kramer | 00bd44d | 2012-02-04 12:31:12 +0000 | [diff] [blame] | 28 | #include "llvm/ADT/STLExtras.h" |
Benjamin Kramer | 2fa67ef | 2012-12-01 15:09:41 +0000 | [diff] [blame] | 29 | #include "llvm/ADT/SmallString.h" |
Jordan Rose | 615a092 | 2012-09-22 01:24:42 +0000 | [diff] [blame] | 30 | #include "llvm/ADT/StringExtras.h" |
Anna Zaks | 60a1fa4 | 2012-02-22 03:14:20 +0000 | [diff] [blame] | 31 | #include <climits> |
| 32 | |
Zhongxing Xu | 589c0f2 | 2009-11-12 08:38:56 +0000 | [diff] [blame] | 33 | using namespace clang; |
Ted Kremenek | 9ef6537 | 2010-12-23 07:20:52 +0000 | [diff] [blame] | 34 | using namespace ento; |
Zhongxing Xu | 589c0f2 | 2009-11-12 08:38:56 +0000 | [diff] [blame] | 35 | |
| 36 | namespace { |
| 37 | |
Zhongxing Xu | 7fb1464 | 2009-12-11 00:55:44 +0000 | [diff] [blame] | 38 | class RefState { |
Anna Zaks | 050cdd7 | 2012-06-20 20:57:46 +0000 | [diff] [blame] | 39 | enum Kind { // Reference to allocated memory. |
| 40 | Allocated, |
| 41 | // Reference to released/freed memory. |
| 42 | Released, |
Anna Zaks | 050cdd7 | 2012-06-20 20:57:46 +0000 | [diff] [blame] | 43 | // The responsibility for freeing resources has transfered from |
| 44 | // this reference. A relinquished symbol should not be freed. |
Ted Kremenek | dde201b | 2010-08-06 21:12:55 +0000 | [diff] [blame] | 45 | Relinquished } K; |
Zhongxing Xu | 243fde9 | 2009-11-17 07:54:15 +0000 | [diff] [blame] | 46 | const Stmt *S; |
| 47 | |
Zhongxing Xu | 7fb1464 | 2009-12-11 00:55:44 +0000 | [diff] [blame] | 48 | public: |
Zhongxing Xu | 243fde9 | 2009-11-17 07:54:15 +0000 | [diff] [blame] | 49 | RefState(Kind k, const Stmt *s) : K(k), S(s) {} |
| 50 | |
Anna Zaks | 050cdd7 | 2012-06-20 20:57:46 +0000 | [diff] [blame] | 51 | bool isAllocated() const { return K == Allocated; } |
Zhongxing Xu | 243fde9 | 2009-11-17 07:54:15 +0000 | [diff] [blame] | 52 | bool isReleased() const { return K == Released; } |
Anna Zaks | 050cdd7 | 2012-06-20 20:57:46 +0000 | [diff] [blame] | 53 | bool isRelinquished() const { return K == Relinquished; } |
Anna Zaks | ca23eb2 | 2012-02-29 18:42:47 +0000 | [diff] [blame] | 54 | |
Anna Zaks | c8bb3be | 2012-02-13 18:05:39 +0000 | [diff] [blame] | 55 | const Stmt *getStmt() const { return S; } |
Zhongxing Xu | 243fde9 | 2009-11-17 07:54:15 +0000 | [diff] [blame] | 56 | |
| 57 | bool operator==(const RefState &X) const { |
| 58 | return K == X.K && S == X.S; |
| 59 | } |
| 60 | |
Anna Zaks | 050cdd7 | 2012-06-20 20:57:46 +0000 | [diff] [blame] | 61 | static RefState getAllocated(const Stmt *s) { |
| 62 | return RefState(Allocated, s); |
Zhongxing Xu | b94b81a | 2009-12-31 06:13:07 +0000 | [diff] [blame] | 63 | } |
Zhongxing Xu | 243fde9 | 2009-11-17 07:54:15 +0000 | [diff] [blame] | 64 | static RefState getReleased(const Stmt *s) { return RefState(Released, s); } |
Ted Kremenek | dde201b | 2010-08-06 21:12:55 +0000 | [diff] [blame] | 65 | static RefState getRelinquished(const Stmt *s) { |
| 66 | return RefState(Relinquished, s); |
| 67 | } |
Zhongxing Xu | 243fde9 | 2009-11-17 07:54:15 +0000 | [diff] [blame] | 68 | |
| 69 | void Profile(llvm::FoldingSetNodeID &ID) const { |
| 70 | ID.AddInteger(K); |
| 71 | ID.AddPointer(S); |
| 72 | } |
Ted Kremenek | c37fad6 | 2013-01-03 01:30:12 +0000 | [diff] [blame] | 73 | |
Dmitri Gribenko | cfa88f8 | 2013-01-12 19:30:44 +0000 | [diff] [blame] | 74 | void dump(raw_ostream &OS) const { |
Ted Kremenek | c37fad6 | 2013-01-03 01:30:12 +0000 | [diff] [blame] | 75 | static const char *Table[] = { |
| 76 | "Allocated", |
| 77 | "Released", |
| 78 | "Relinquished" |
| 79 | }; |
| 80 | OS << Table[(unsigned) K]; |
| 81 | } |
| 82 | |
| 83 | LLVM_ATTRIBUTE_USED void dump() const { |
| 84 | dump(llvm::errs()); |
| 85 | } |
Zhongxing Xu | 589c0f2 | 2009-11-12 08:38:56 +0000 | [diff] [blame] | 86 | }; |
| 87 | |
Anna Zaks | 9dc298b | 2012-09-12 22:57:34 +0000 | [diff] [blame] | 88 | enum ReallocPairKind { |
| 89 | RPToBeFreedAfterFailure, |
| 90 | // The symbol has been freed when reallocation failed. |
| 91 | RPIsFreeOnFailure, |
| 92 | // The symbol does not need to be freed after reallocation fails. |
| 93 | RPDoNotTrackAfterFailure |
| 94 | }; |
| 95 | |
Anna Zaks | 55dd956 | 2012-08-24 02:28:20 +0000 | [diff] [blame] | 96 | /// \class ReallocPair |
| 97 | /// \brief Stores information about the symbol being reallocated by a call to |
| 98 | /// 'realloc' to allow modeling failed reallocation later in the path. |
Anna Zaks | 40add29 | 2012-02-15 00:11:25 +0000 | [diff] [blame] | 99 | struct ReallocPair { |
Anna Zaks | 55dd956 | 2012-08-24 02:28:20 +0000 | [diff] [blame] | 100 | // \brief The symbol which realloc reallocated. |
Anna Zaks | 40add29 | 2012-02-15 00:11:25 +0000 | [diff] [blame] | 101 | SymbolRef ReallocatedSym; |
Anna Zaks | 9dc298b | 2012-09-12 22:57:34 +0000 | [diff] [blame] | 102 | ReallocPairKind Kind; |
Anna Zaks | 55dd956 | 2012-08-24 02:28:20 +0000 | [diff] [blame] | 103 | |
Anna Zaks | 9dc298b | 2012-09-12 22:57:34 +0000 | [diff] [blame] | 104 | ReallocPair(SymbolRef S, ReallocPairKind K) : |
| 105 | ReallocatedSym(S), Kind(K) {} |
Anna Zaks | 40add29 | 2012-02-15 00:11:25 +0000 | [diff] [blame] | 106 | void Profile(llvm::FoldingSetNodeID &ID) const { |
Anna Zaks | 9dc298b | 2012-09-12 22:57:34 +0000 | [diff] [blame] | 107 | ID.AddInteger(Kind); |
Anna Zaks | 40add29 | 2012-02-15 00:11:25 +0000 | [diff] [blame] | 108 | ID.AddPointer(ReallocatedSym); |
| 109 | } |
| 110 | bool operator==(const ReallocPair &X) const { |
| 111 | return ReallocatedSym == X.ReallocatedSym && |
Anna Zaks | 9dc298b | 2012-09-12 22:57:34 +0000 | [diff] [blame] | 112 | Kind == X.Kind; |
Anna Zaks | 40add29 | 2012-02-15 00:11:25 +0000 | [diff] [blame] | 113 | } |
| 114 | }; |
| 115 | |
Anna Zaks | 97bfb55 | 2013-01-08 00:25:29 +0000 | [diff] [blame] | 116 | typedef std::pair<const ExplodedNode*, const MemRegion*> LeakInfo; |
Anna Zaks | 3d7c44e | 2012-03-21 19:45:08 +0000 | [diff] [blame] | 117 | |
Anna Zaks | b319e02 | 2012-02-08 20:13:28 +0000 | [diff] [blame] | 118 | class MallocChecker : public Checker<check::DeadSymbols, |
Anna Zaks | bf53dfa | 2012-12-20 00:38:25 +0000 | [diff] [blame] | 119 | check::PointerEscape, |
Ted Kremenek | e3659a7 | 2012-01-04 23:48:37 +0000 | [diff] [blame] | 120 | check::PreStmt<ReturnStmt>, |
Anna Zaks | 66c4040 | 2012-02-14 21:55:24 +0000 | [diff] [blame] | 121 | check::PreStmt<CallExpr>, |
Anna Zaks | b319e02 | 2012-02-08 20:13:28 +0000 | [diff] [blame] | 122 | check::PostStmt<CallExpr>, |
Anna Zaks | f5aa3f5 | 2012-03-22 00:57:20 +0000 | [diff] [blame] | 123 | check::PostStmt<BlockExpr>, |
Anna Zaks | 4141e4d | 2012-11-13 03:18:01 +0000 | [diff] [blame] | 124 | check::PostObjCMessage, |
Ted Kremenek | e3659a7 | 2012-01-04 23:48:37 +0000 | [diff] [blame] | 125 | check::Location, |
Anna Zaks | bf53dfa | 2012-12-20 00:38:25 +0000 | [diff] [blame] | 126 | eval::Assume> |
Ted Kremenek | e3659a7 | 2012-01-04 23:48:37 +0000 | [diff] [blame] | 127 | { |
Anna Zaks | febdc32 | 2012-02-16 22:26:12 +0000 | [diff] [blame] | 128 | mutable OwningPtr<BugType> BT_DoubleFree; |
| 129 | mutable OwningPtr<BugType> BT_Leak; |
| 130 | mutable OwningPtr<BugType> BT_UseFree; |
| 131 | mutable OwningPtr<BugType> BT_BadFree; |
Anna Zaks | 118aa75 | 2013-02-07 23:05:47 +0000 | [diff] [blame] | 132 | mutable OwningPtr<BugType> BT_OffsetFree; |
Anna Zaks | b16ce45 | 2012-02-15 00:11:22 +0000 | [diff] [blame] | 133 | mutable IdentifierInfo *II_malloc, *II_free, *II_realloc, *II_calloc, |
Anna Zaks | 60a1fa4 | 2012-02-22 03:14:20 +0000 | [diff] [blame] | 134 | *II_valloc, *II_reallocf, *II_strndup, *II_strdup; |
| 135 | |
Zhongxing Xu | 589c0f2 | 2009-11-12 08:38:56 +0000 | [diff] [blame] | 136 | public: |
Anna Zaks | b16ce45 | 2012-02-15 00:11:22 +0000 | [diff] [blame] | 137 | MallocChecker() : II_malloc(0), II_free(0), II_realloc(0), II_calloc(0), |
Anna Zaks | 60a1fa4 | 2012-02-22 03:14:20 +0000 | [diff] [blame] | 138 | II_valloc(0), II_reallocf(0), II_strndup(0), II_strdup(0) {} |
Anna Zaks | 231361a | 2012-02-08 23:16:52 +0000 | [diff] [blame] | 139 | |
| 140 | /// In pessimistic mode, the checker assumes that it does not know which |
| 141 | /// functions might free the memory. |
| 142 | struct ChecksFilter { |
| 143 | DefaultBool CMallocPessimistic; |
| 144 | DefaultBool CMallocOptimistic; |
| 145 | }; |
| 146 | |
| 147 | ChecksFilter Filter; |
| 148 | |
Anna Zaks | 66c4040 | 2012-02-14 21:55:24 +0000 | [diff] [blame] | 149 | void checkPreStmt(const CallExpr *S, CheckerContext &C) const; |
Anna Zaks | b319e02 | 2012-02-08 20:13:28 +0000 | [diff] [blame] | 150 | void checkPostStmt(const CallExpr *CE, CheckerContext &C) const; |
Anna Zaks | 4141e4d | 2012-11-13 03:18:01 +0000 | [diff] [blame] | 151 | void checkPostObjCMessage(const ObjCMethodCall &Call, CheckerContext &C) const; |
Anna Zaks | f5aa3f5 | 2012-03-22 00:57:20 +0000 | [diff] [blame] | 152 | void checkPostStmt(const BlockExpr *BE, CheckerContext &C) const; |
Argyrios Kyrtzidis | 312dbec | 2011-02-28 01:26:35 +0000 | [diff] [blame] | 153 | void checkDeadSymbols(SymbolReaper &SymReaper, CheckerContext &C) const; |
Argyrios Kyrtzidis | 312dbec | 2011-02-28 01:26:35 +0000 | [diff] [blame] | 154 | void checkPreStmt(const ReturnStmt *S, CheckerContext &C) const; |
Ted Kremenek | 8bef823 | 2012-01-26 21:29:00 +0000 | [diff] [blame] | 155 | ProgramStateRef evalAssume(ProgramStateRef state, SVal Cond, |
Argyrios Kyrtzidis | 312dbec | 2011-02-28 01:26:35 +0000 | [diff] [blame] | 156 | bool Assumption) const; |
Anna Zaks | 390909c | 2011-10-06 00:43:15 +0000 | [diff] [blame] | 157 | void checkLocation(SVal l, bool isLoad, const Stmt *S, |
| 158 | CheckerContext &C) const; |
Anna Zaks | bf53dfa | 2012-12-20 00:38:25 +0000 | [diff] [blame] | 159 | |
| 160 | ProgramStateRef checkPointerEscape(ProgramStateRef State, |
| 161 | const InvalidatedSymbols &Escaped, |
Anna Zaks | 233e26a | 2013-02-07 23:05:43 +0000 | [diff] [blame] | 162 | const CallEvent *Call, |
| 163 | PointerEscapeKind Kind) const; |
Zhongxing Xu | b94b81a | 2009-12-31 06:13:07 +0000 | [diff] [blame] | 164 | |
Anna Zaks | 93c5a24 | 2012-05-02 00:05:20 +0000 | [diff] [blame] | 165 | void printState(raw_ostream &Out, ProgramStateRef State, |
| 166 | const char *NL, const char *Sep) const; |
| 167 | |
Zhongxing Xu | 7b76096 | 2009-11-13 07:25:27 +0000 | [diff] [blame] | 168 | private: |
Anna Zaks | 66c4040 | 2012-02-14 21:55:24 +0000 | [diff] [blame] | 169 | void initIdentifierInfo(ASTContext &C) const; |
| 170 | |
Jordan Rose | 9fe09f3 | 2013-03-09 00:59:10 +0000 | [diff] [blame^] | 171 | ///@{ |
Anna Zaks | 66c4040 | 2012-02-14 21:55:24 +0000 | [diff] [blame] | 172 | /// Check if this is one of the functions which can allocate/reallocate memory |
| 173 | /// pointed to by one of its arguments. |
| 174 | bool isMemFunction(const FunctionDecl *FD, ASTContext &C) const; |
Anna Zaks | 1434518 | 2012-05-18 01:16:10 +0000 | [diff] [blame] | 175 | bool isFreeFunction(const FunctionDecl *FD, ASTContext &C) const; |
| 176 | bool isAllocationFunction(const FunctionDecl *FD, ASTContext &C) const; |
Jordan Rose | 9fe09f3 | 2013-03-09 00:59:10 +0000 | [diff] [blame^] | 177 | ///@} |
Anna Zaks | 87cb5be | 2012-02-22 19:24:52 +0000 | [diff] [blame] | 178 | static ProgramStateRef MallocMemReturnsAttr(CheckerContext &C, |
| 179 | const CallExpr *CE, |
| 180 | const OwnershipAttr* Att); |
Ted Kremenek | 8bef823 | 2012-01-26 21:29:00 +0000 | [diff] [blame] | 181 | static ProgramStateRef MallocMemAux(CheckerContext &C, const CallExpr *CE, |
Argyrios Kyrtzidis | 312dbec | 2011-02-28 01:26:35 +0000 | [diff] [blame] | 182 | const Expr *SizeEx, SVal Init, |
Ted Kremenek | 8bef823 | 2012-01-26 21:29:00 +0000 | [diff] [blame] | 183 | ProgramStateRef state) { |
Ted Kremenek | 5eca482 | 2012-01-06 22:09:28 +0000 | [diff] [blame] | 184 | return MallocMemAux(C, CE, |
| 185 | state->getSVal(SizeEx, C.getLocationContext()), |
| 186 | Init, state); |
Zhongxing Xu | a5ce966 | 2010-06-01 03:01:33 +0000 | [diff] [blame] | 187 | } |
Anna Zaks | 87cb5be | 2012-02-22 19:24:52 +0000 | [diff] [blame] | 188 | |
Ted Kremenek | 8bef823 | 2012-01-26 21:29:00 +0000 | [diff] [blame] | 189 | static ProgramStateRef MallocMemAux(CheckerContext &C, const CallExpr *CE, |
Argyrios Kyrtzidis | 312dbec | 2011-02-28 01:26:35 +0000 | [diff] [blame] | 190 | SVal SizeEx, SVal Init, |
Ted Kremenek | 8bef823 | 2012-01-26 21:29:00 +0000 | [diff] [blame] | 191 | ProgramStateRef state); |
Zhongxing Xu | a5ce966 | 2010-06-01 03:01:33 +0000 | [diff] [blame] | 192 | |
Anna Zaks | 87cb5be | 2012-02-22 19:24:52 +0000 | [diff] [blame] | 193 | /// Update the RefState to reflect the new memory allocation. |
| 194 | static ProgramStateRef MallocUpdateRefState(CheckerContext &C, |
| 195 | const CallExpr *CE, |
| 196 | ProgramStateRef state); |
| 197 | |
| 198 | ProgramStateRef FreeMemAttr(CheckerContext &C, const CallExpr *CE, |
| 199 | const OwnershipAttr* Att) const; |
Ted Kremenek | 8bef823 | 2012-01-26 21:29:00 +0000 | [diff] [blame] | 200 | ProgramStateRef FreeMemAux(CheckerContext &C, const CallExpr *CE, |
Anna Zaks | 5b7aa34 | 2012-06-22 02:04:31 +0000 | [diff] [blame] | 201 | ProgramStateRef state, unsigned Num, |
Anna Zaks | 55dd956 | 2012-08-24 02:28:20 +0000 | [diff] [blame] | 202 | bool Hold, |
Anna Zaks | 4141e4d | 2012-11-13 03:18:01 +0000 | [diff] [blame] | 203 | bool &ReleasedAllocated, |
| 204 | bool ReturnsNullOnFailure = false) const; |
Anna Zaks | 5b7aa34 | 2012-06-22 02:04:31 +0000 | [diff] [blame] | 205 | ProgramStateRef FreeMemAux(CheckerContext &C, const Expr *Arg, |
| 206 | const Expr *ParentExpr, |
Anna Zaks | 4141e4d | 2012-11-13 03:18:01 +0000 | [diff] [blame] | 207 | ProgramStateRef State, |
Anna Zaks | 55dd956 | 2012-08-24 02:28:20 +0000 | [diff] [blame] | 208 | bool Hold, |
Anna Zaks | 4141e4d | 2012-11-13 03:18:01 +0000 | [diff] [blame] | 209 | bool &ReleasedAllocated, |
| 210 | bool ReturnsNullOnFailure = false) const; |
Zhongxing Xu | d9c84c8 | 2009-12-12 12:29:38 +0000 | [diff] [blame] | 211 | |
Anna Zaks | 87cb5be | 2012-02-22 19:24:52 +0000 | [diff] [blame] | 212 | ProgramStateRef ReallocMem(CheckerContext &C, const CallExpr *CE, |
| 213 | bool FreesMemOnFailure) const; |
| 214 | static ProgramStateRef CallocMem(CheckerContext &C, const CallExpr *CE); |
Jordy Rose | 43859f6 | 2010-06-07 19:32:37 +0000 | [diff] [blame] | 215 | |
Anna Zaks | 1434518 | 2012-05-18 01:16:10 +0000 | [diff] [blame] | 216 | ///\brief Check if the memory associated with this symbol was released. |
| 217 | bool isReleased(SymbolRef Sym, CheckerContext &C) const; |
| 218 | |
Anna Zaks | 91c2a11 | 2012-02-08 23:16:56 +0000 | [diff] [blame] | 219 | bool checkUseAfterFree(SymbolRef Sym, CheckerContext &C, |
| 220 | const Stmt *S = 0) const; |
| 221 | |
Jordan Rose | 9fe09f3 | 2013-03-09 00:59:10 +0000 | [diff] [blame^] | 222 | /// Check if the function is known not to free memory, or if it is |
| 223 | /// "interesting" and should be modeled explicitly. |
| 224 | /// |
| 225 | /// We assume that pointers do not escape through calls to system functions |
| 226 | /// not handled by this checker. |
| 227 | bool doesNotFreeMemOrInteresting(const CallEvent *Call, |
| 228 | ProgramStateRef State) const; |
Anna Zaks | 66c4040 | 2012-02-14 21:55:24 +0000 | [diff] [blame] | 229 | |
Ted Kremenek | 9c378f7 | 2011-08-12 23:37:29 +0000 | [diff] [blame] | 230 | static bool SummarizeValue(raw_ostream &os, SVal V); |
| 231 | static bool SummarizeRegion(raw_ostream &os, const MemRegion *MR); |
Argyrios Kyrtzidis | 312dbec | 2011-02-28 01:26:35 +0000 | [diff] [blame] | 232 | void ReportBadFree(CheckerContext &C, SVal ArgVal, SourceRange range) const; |
Anna Zaks | 118aa75 | 2013-02-07 23:05:47 +0000 | [diff] [blame] | 233 | void ReportOffsetFree(CheckerContext &C, SVal ArgVal, SourceRange Range)const; |
Anna Zaks | ff3b9fd | 2012-02-09 06:25:51 +0000 | [diff] [blame] | 234 | |
Anna Zaks | ca8e36e | 2012-02-23 21:38:21 +0000 | [diff] [blame] | 235 | /// Find the location of the allocation for Sym on the path leading to the |
| 236 | /// exploded node N. |
Anna Zaks | 3d7c44e | 2012-03-21 19:45:08 +0000 | [diff] [blame] | 237 | LeakInfo getAllocationSite(const ExplodedNode *N, SymbolRef Sym, |
| 238 | CheckerContext &C) const; |
Anna Zaks | ca8e36e | 2012-02-23 21:38:21 +0000 | [diff] [blame] | 239 | |
Anna Zaks | da04677 | 2012-02-11 21:02:40 +0000 | [diff] [blame] | 240 | void reportLeak(SymbolRef Sym, ExplodedNode *N, CheckerContext &C) const; |
| 241 | |
Anna Zaks | ff3b9fd | 2012-02-09 06:25:51 +0000 | [diff] [blame] | 242 | /// The bug visitor which allows us to print extra diagnostics along the |
| 243 | /// BugReport path. For example, showing the allocation site of the leaked |
| 244 | /// region. |
Jordy Rose | 0115349 | 2012-03-24 02:45:35 +0000 | [diff] [blame] | 245 | class MallocBugVisitor : public BugReporterVisitorImpl<MallocBugVisitor> { |
Anna Zaks | ff3b9fd | 2012-02-09 06:25:51 +0000 | [diff] [blame] | 246 | protected: |
Anna Zaks | fe57160 | 2012-02-16 22:26:07 +0000 | [diff] [blame] | 247 | enum NotificationMode { |
| 248 | Normal, |
Anna Zaks | fe57160 | 2012-02-16 22:26:07 +0000 | [diff] [blame] | 249 | ReallocationFailed |
| 250 | }; |
| 251 | |
Anna Zaks | ff3b9fd | 2012-02-09 06:25:51 +0000 | [diff] [blame] | 252 | // The allocated region symbol tracked by the main analysis. |
| 253 | SymbolRef Sym; |
| 254 | |
Anna Zaks | 88feba0 | 2012-05-10 01:37:40 +0000 | [diff] [blame] | 255 | // The mode we are in, i.e. what kind of diagnostics will be emitted. |
| 256 | NotificationMode Mode; |
Jordy Rose | b000fb5 | 2012-03-24 03:15:09 +0000 | [diff] [blame] | 257 | |
Anna Zaks | 88feba0 | 2012-05-10 01:37:40 +0000 | [diff] [blame] | 258 | // A symbol from when the primary region should have been reallocated. |
| 259 | SymbolRef FailedReallocSymbol; |
Jordy Rose | b000fb5 | 2012-03-24 03:15:09 +0000 | [diff] [blame] | 260 | |
Anna Zaks | 88feba0 | 2012-05-10 01:37:40 +0000 | [diff] [blame] | 261 | bool IsLeak; |
| 262 | |
| 263 | public: |
| 264 | MallocBugVisitor(SymbolRef S, bool isLeak = false) |
| 265 | : Sym(S), Mode(Normal), FailedReallocSymbol(0), IsLeak(isLeak) {} |
Jordy Rose | b000fb5 | 2012-03-24 03:15:09 +0000 | [diff] [blame] | 266 | |
Anna Zaks | ff3b9fd | 2012-02-09 06:25:51 +0000 | [diff] [blame] | 267 | virtual ~MallocBugVisitor() {} |
| 268 | |
| 269 | void Profile(llvm::FoldingSetNodeID &ID) const { |
| 270 | static int X = 0; |
| 271 | ID.AddPointer(&X); |
| 272 | ID.AddPointer(Sym); |
| 273 | } |
| 274 | |
Anna Zaks | fe57160 | 2012-02-16 22:26:07 +0000 | [diff] [blame] | 275 | inline bool isAllocated(const RefState *S, const RefState *SPrev, |
| 276 | const Stmt *Stmt) { |
Anna Zaks | ff3b9fd | 2012-02-09 06:25:51 +0000 | [diff] [blame] | 277 | // Did not track -> allocated. Other state (released) -> allocated. |
Anna Zaks | fe57160 | 2012-02-16 22:26:07 +0000 | [diff] [blame] | 278 | return (Stmt && isa<CallExpr>(Stmt) && |
| 279 | (S && S->isAllocated()) && (!SPrev || !SPrev->isAllocated())); |
Anna Zaks | ff3b9fd | 2012-02-09 06:25:51 +0000 | [diff] [blame] | 280 | } |
| 281 | |
Anna Zaks | fe57160 | 2012-02-16 22:26:07 +0000 | [diff] [blame] | 282 | inline bool isReleased(const RefState *S, const RefState *SPrev, |
| 283 | const Stmt *Stmt) { |
Anna Zaks | ff3b9fd | 2012-02-09 06:25:51 +0000 | [diff] [blame] | 284 | // Did not track -> released. Other state (allocated) -> released. |
Anna Zaks | fe57160 | 2012-02-16 22:26:07 +0000 | [diff] [blame] | 285 | return (Stmt && isa<CallExpr>(Stmt) && |
| 286 | (S && S->isReleased()) && (!SPrev || !SPrev->isReleased())); |
| 287 | } |
| 288 | |
Anna Zaks | 5b7aa34 | 2012-06-22 02:04:31 +0000 | [diff] [blame] | 289 | inline bool isRelinquished(const RefState *S, const RefState *SPrev, |
| 290 | const Stmt *Stmt) { |
| 291 | // Did not track -> relinquished. Other state (allocated) -> relinquished. |
| 292 | return (Stmt && (isa<CallExpr>(Stmt) || isa<ObjCMessageExpr>(Stmt) || |
| 293 | isa<ObjCPropertyRefExpr>(Stmt)) && |
| 294 | (S && S->isRelinquished()) && |
| 295 | (!SPrev || !SPrev->isRelinquished())); |
| 296 | } |
| 297 | |
Anna Zaks | fe57160 | 2012-02-16 22:26:07 +0000 | [diff] [blame] | 298 | inline bool isReallocFailedCheck(const RefState *S, const RefState *SPrev, |
| 299 | const Stmt *Stmt) { |
| 300 | // If the expression is not a call, and the state change is |
| 301 | // released -> allocated, it must be the realloc return value |
| 302 | // check. If we have to handle more cases here, it might be cleaner just |
| 303 | // to track this extra bit in the state itself. |
| 304 | return ((!Stmt || !isa<CallExpr>(Stmt)) && |
| 305 | (S && S->isAllocated()) && (SPrev && !SPrev->isAllocated())); |
Anna Zaks | ff3b9fd | 2012-02-09 06:25:51 +0000 | [diff] [blame] | 306 | } |
| 307 | |
| 308 | PathDiagnosticPiece *VisitNode(const ExplodedNode *N, |
| 309 | const ExplodedNode *PrevN, |
| 310 | BugReporterContext &BRC, |
| 311 | BugReport &BR); |
Anna Zaks | 88feba0 | 2012-05-10 01:37:40 +0000 | [diff] [blame] | 312 | |
| 313 | PathDiagnosticPiece* getEndPath(BugReporterContext &BRC, |
| 314 | const ExplodedNode *EndPathNode, |
| 315 | BugReport &BR) { |
| 316 | if (!IsLeak) |
| 317 | return 0; |
| 318 | |
| 319 | PathDiagnosticLocation L = |
| 320 | PathDiagnosticLocation::createEndOfPath(EndPathNode, |
| 321 | BRC.getSourceManager()); |
| 322 | // Do not add the statement itself as a range in case of leak. |
| 323 | return new PathDiagnosticEventPiece(L, BR.getDescription(), false); |
| 324 | } |
| 325 | |
Anna Zaks | 56a938f | 2012-03-16 23:24:20 +0000 | [diff] [blame] | 326 | private: |
| 327 | class StackHintGeneratorForReallocationFailed |
| 328 | : public StackHintGeneratorForSymbol { |
| 329 | public: |
| 330 | StackHintGeneratorForReallocationFailed(SymbolRef S, StringRef M) |
| 331 | : StackHintGeneratorForSymbol(S, M) {} |
| 332 | |
| 333 | virtual std::string getMessageForArg(const Expr *ArgE, unsigned ArgIndex) { |
Jordan Rose | 615a092 | 2012-09-22 01:24:42 +0000 | [diff] [blame] | 334 | // Printed parameters start at 1, not 0. |
| 335 | ++ArgIndex; |
| 336 | |
Anna Zaks | 56a938f | 2012-03-16 23:24:20 +0000 | [diff] [blame] | 337 | SmallString<200> buf; |
| 338 | llvm::raw_svector_ostream os(buf); |
| 339 | |
Jordan Rose | 615a092 | 2012-09-22 01:24:42 +0000 | [diff] [blame] | 340 | os << "Reallocation of " << ArgIndex << llvm::getOrdinalSuffix(ArgIndex) |
| 341 | << " parameter failed"; |
Anna Zaks | 56a938f | 2012-03-16 23:24:20 +0000 | [diff] [blame] | 342 | |
| 343 | return os.str(); |
| 344 | } |
| 345 | |
| 346 | virtual std::string getMessageForReturn(const CallExpr *CallExpr) { |
Anna Zaks | fbd5874 | 2012-03-16 23:44:28 +0000 | [diff] [blame] | 347 | return "Reallocation of returned value failed"; |
Anna Zaks | 56a938f | 2012-03-16 23:24:20 +0000 | [diff] [blame] | 348 | } |
| 349 | }; |
Anna Zaks | ff3b9fd | 2012-02-09 06:25:51 +0000 | [diff] [blame] | 350 | }; |
Zhongxing Xu | 589c0f2 | 2009-11-12 08:38:56 +0000 | [diff] [blame] | 351 | }; |
Kovarththanan Rajaratnam | ba5fb5a | 2009-11-28 06:07:30 +0000 | [diff] [blame] | 352 | } // end anonymous namespace |
Zhongxing Xu | 589c0f2 | 2009-11-12 08:38:56 +0000 | [diff] [blame] | 353 | |
Jordan Rose | 166d502 | 2012-11-02 01:54:06 +0000 | [diff] [blame] | 354 | REGISTER_MAP_WITH_PROGRAMSTATE(RegionState, SymbolRef, RefState) |
| 355 | REGISTER_MAP_WITH_PROGRAMSTATE(ReallocPairs, SymbolRef, ReallocPair) |
Zhongxing Xu | 589c0f2 | 2009-11-12 08:38:56 +0000 | [diff] [blame] | 356 | |
Anna Zaks | 4141e4d | 2012-11-13 03:18:01 +0000 | [diff] [blame] | 357 | // A map from the freed symbol to the symbol representing the return value of |
| 358 | // the free function. |
| 359 | REGISTER_MAP_WITH_PROGRAMSTATE(FreeReturnValue, SymbolRef, SymbolRef) |
| 360 | |
Anna Zaks | 4fb5487 | 2012-02-11 21:02:35 +0000 | [diff] [blame] | 361 | namespace { |
| 362 | class StopTrackingCallback : public SymbolVisitor { |
| 363 | ProgramStateRef state; |
| 364 | public: |
| 365 | StopTrackingCallback(ProgramStateRef st) : state(st) {} |
| 366 | ProgramStateRef getState() const { return state; } |
| 367 | |
| 368 | bool VisitSymbol(SymbolRef sym) { |
| 369 | state = state->remove<RegionState>(sym); |
| 370 | return true; |
| 371 | } |
| 372 | }; |
| 373 | } // end anonymous namespace |
| 374 | |
Anna Zaks | 66c4040 | 2012-02-14 21:55:24 +0000 | [diff] [blame] | 375 | void MallocChecker::initIdentifierInfo(ASTContext &Ctx) const { |
Anna Zaks | a38cb2c | 2012-05-18 22:47:40 +0000 | [diff] [blame] | 376 | if (II_malloc) |
| 377 | return; |
| 378 | II_malloc = &Ctx.Idents.get("malloc"); |
| 379 | II_free = &Ctx.Idents.get("free"); |
| 380 | II_realloc = &Ctx.Idents.get("realloc"); |
| 381 | II_reallocf = &Ctx.Idents.get("reallocf"); |
| 382 | II_calloc = &Ctx.Idents.get("calloc"); |
| 383 | II_valloc = &Ctx.Idents.get("valloc"); |
| 384 | II_strdup = &Ctx.Idents.get("strdup"); |
| 385 | II_strndup = &Ctx.Idents.get("strndup"); |
Anna Zaks | b319e02 | 2012-02-08 20:13:28 +0000 | [diff] [blame] | 386 | } |
| 387 | |
Anna Zaks | 66c4040 | 2012-02-14 21:55:24 +0000 | [diff] [blame] | 388 | bool MallocChecker::isMemFunction(const FunctionDecl *FD, ASTContext &C) const { |
Anna Zaks | 1434518 | 2012-05-18 01:16:10 +0000 | [diff] [blame] | 389 | if (isFreeFunction(FD, C)) |
| 390 | return true; |
| 391 | |
| 392 | if (isAllocationFunction(FD, C)) |
| 393 | return true; |
| 394 | |
| 395 | return false; |
| 396 | } |
| 397 | |
| 398 | bool MallocChecker::isAllocationFunction(const FunctionDecl *FD, |
| 399 | ASTContext &C) const { |
Anna Zaks | 1d6cc6a | 2012-02-15 02:12:00 +0000 | [diff] [blame] | 400 | if (!FD) |
| 401 | return false; |
Anna Zaks | 1434518 | 2012-05-18 01:16:10 +0000 | [diff] [blame] | 402 | |
Jordan Rose | 5ef6e94 | 2012-07-10 23:13:01 +0000 | [diff] [blame] | 403 | if (FD->getKind() == Decl::Function) { |
| 404 | IdentifierInfo *FunI = FD->getIdentifier(); |
| 405 | initIdentifierInfo(C); |
Anna Zaks | 66c4040 | 2012-02-14 21:55:24 +0000 | [diff] [blame] | 406 | |
Jordan Rose | 5ef6e94 | 2012-07-10 23:13:01 +0000 | [diff] [blame] | 407 | if (FunI == II_malloc || FunI == II_realloc || |
| 408 | FunI == II_reallocf || FunI == II_calloc || FunI == II_valloc || |
| 409 | FunI == II_strdup || FunI == II_strndup) |
| 410 | return true; |
| 411 | } |
Anna Zaks | 66c4040 | 2012-02-14 21:55:24 +0000 | [diff] [blame] | 412 | |
Anna Zaks | 1434518 | 2012-05-18 01:16:10 +0000 | [diff] [blame] | 413 | if (Filter.CMallocOptimistic && FD->hasAttrs()) |
| 414 | for (specific_attr_iterator<OwnershipAttr> |
| 415 | i = FD->specific_attr_begin<OwnershipAttr>(), |
| 416 | e = FD->specific_attr_end<OwnershipAttr>(); |
| 417 | i != e; ++i) |
| 418 | if ((*i)->getOwnKind() == OwnershipAttr::Returns) |
| 419 | return true; |
| 420 | return false; |
| 421 | } |
| 422 | |
| 423 | bool MallocChecker::isFreeFunction(const FunctionDecl *FD, ASTContext &C) const { |
| 424 | if (!FD) |
| 425 | return false; |
| 426 | |
Jordan Rose | 5ef6e94 | 2012-07-10 23:13:01 +0000 | [diff] [blame] | 427 | if (FD->getKind() == Decl::Function) { |
| 428 | IdentifierInfo *FunI = FD->getIdentifier(); |
| 429 | initIdentifierInfo(C); |
Anna Zaks | 1434518 | 2012-05-18 01:16:10 +0000 | [diff] [blame] | 430 | |
Jordan Rose | 5ef6e94 | 2012-07-10 23:13:01 +0000 | [diff] [blame] | 431 | if (FunI == II_free || FunI == II_realloc || FunI == II_reallocf) |
| 432 | return true; |
| 433 | } |
Anna Zaks | 66c4040 | 2012-02-14 21:55:24 +0000 | [diff] [blame] | 434 | |
Anna Zaks | 1434518 | 2012-05-18 01:16:10 +0000 | [diff] [blame] | 435 | if (Filter.CMallocOptimistic && FD->hasAttrs()) |
| 436 | for (specific_attr_iterator<OwnershipAttr> |
| 437 | i = FD->specific_attr_begin<OwnershipAttr>(), |
| 438 | e = FD->specific_attr_end<OwnershipAttr>(); |
| 439 | i != e; ++i) |
| 440 | if ((*i)->getOwnKind() == OwnershipAttr::Takes || |
| 441 | (*i)->getOwnKind() == OwnershipAttr::Holds) |
| 442 | return true; |
Anna Zaks | 66c4040 | 2012-02-14 21:55:24 +0000 | [diff] [blame] | 443 | return false; |
| 444 | } |
| 445 | |
Anna Zaks | b319e02 | 2012-02-08 20:13:28 +0000 | [diff] [blame] | 446 | void MallocChecker::checkPostStmt(const CallExpr *CE, CheckerContext &C) const { |
Jordan Rose | c20c727 | 2012-09-20 01:55:32 +0000 | [diff] [blame] | 447 | if (C.wasInlined) |
| 448 | return; |
| 449 | |
Anna Zaks | b319e02 | 2012-02-08 20:13:28 +0000 | [diff] [blame] | 450 | const FunctionDecl *FD = C.getCalleeDecl(CE); |
| 451 | if (!FD) |
| 452 | return; |
Zhongxing Xu | 589c0f2 | 2009-11-12 08:38:56 +0000 | [diff] [blame] | 453 | |
Anna Zaks | 87cb5be | 2012-02-22 19:24:52 +0000 | [diff] [blame] | 454 | ProgramStateRef State = C.getState(); |
Anna Zaks | 55dd956 | 2012-08-24 02:28:20 +0000 | [diff] [blame] | 455 | bool ReleasedAllocatedMemory = false; |
Jordan Rose | 5ef6e94 | 2012-07-10 23:13:01 +0000 | [diff] [blame] | 456 | |
| 457 | if (FD->getKind() == Decl::Function) { |
| 458 | initIdentifierInfo(C.getASTContext()); |
| 459 | IdentifierInfo *FunI = FD->getIdentifier(); |
| 460 | |
| 461 | if (FunI == II_malloc || FunI == II_valloc) { |
| 462 | if (CE->getNumArgs() < 1) |
| 463 | return; |
| 464 | State = MallocMemAux(C, CE, CE->getArg(0), UndefinedVal(), State); |
| 465 | } else if (FunI == II_realloc) { |
| 466 | State = ReallocMem(C, CE, false); |
| 467 | } else if (FunI == II_reallocf) { |
| 468 | State = ReallocMem(C, CE, true); |
| 469 | } else if (FunI == II_calloc) { |
| 470 | State = CallocMem(C, CE); |
| 471 | } else if (FunI == II_free) { |
Anna Zaks | 55dd956 | 2012-08-24 02:28:20 +0000 | [diff] [blame] | 472 | State = FreeMemAux(C, CE, State, 0, false, ReleasedAllocatedMemory); |
Jordan Rose | 5ef6e94 | 2012-07-10 23:13:01 +0000 | [diff] [blame] | 473 | } else if (FunI == II_strdup) { |
| 474 | State = MallocUpdateRefState(C, CE, State); |
| 475 | } else if (FunI == II_strndup) { |
| 476 | State = MallocUpdateRefState(C, CE, State); |
| 477 | } |
| 478 | } |
| 479 | |
| 480 | if (Filter.CMallocOptimistic) { |
Anna Zaks | 87cb5be | 2012-02-22 19:24:52 +0000 | [diff] [blame] | 481 | // Check all the attributes, if there are any. |
| 482 | // There can be multiple of these attributes. |
| 483 | if (FD->hasAttrs()) |
| 484 | for (specific_attr_iterator<OwnershipAttr> |
| 485 | i = FD->specific_attr_begin<OwnershipAttr>(), |
| 486 | e = FD->specific_attr_end<OwnershipAttr>(); |
| 487 | i != e; ++i) { |
| 488 | switch ((*i)->getOwnKind()) { |
| 489 | case OwnershipAttr::Returns: |
| 490 | State = MallocMemReturnsAttr(C, CE, *i); |
| 491 | break; |
| 492 | case OwnershipAttr::Takes: |
| 493 | case OwnershipAttr::Holds: |
| 494 | State = FreeMemAttr(C, CE, *i); |
| 495 | break; |
| 496 | } |
| 497 | } |
Zhongxing Xu | a5ce966 | 2010-06-01 03:01:33 +0000 | [diff] [blame] | 498 | } |
Anna Zaks | 60a1fa4 | 2012-02-22 03:14:20 +0000 | [diff] [blame] | 499 | C.addTransition(State); |
Zhongxing Xu | d9c84c8 | 2009-12-12 12:29:38 +0000 | [diff] [blame] | 500 | } |
| 501 | |
Jordan Rose | 9fe09f3 | 2013-03-09 00:59:10 +0000 | [diff] [blame^] | 502 | static bool isKnownDeallocObjCMethodName(const ObjCMethodCall &Call) { |
| 503 | // If the first selector piece is one of the names below, assume that the |
| 504 | // object takes ownership of the memory, promising to eventually deallocate it |
| 505 | // with free(). |
| 506 | // Ex: [NSData dataWithBytesNoCopy:bytes length:10]; |
| 507 | // (...unless a 'freeWhenDone' parameter is false, but that's checked later.) |
| 508 | StringRef FirstSlot = Call.getSelector().getNameForSlot(0); |
| 509 | if (FirstSlot == "dataWithBytesNoCopy" || |
| 510 | FirstSlot == "initWithBytesNoCopy" || |
| 511 | FirstSlot == "initWithCharactersNoCopy") |
| 512 | return true; |
Anna Zaks | 5b7aa34 | 2012-06-22 02:04:31 +0000 | [diff] [blame] | 513 | |
| 514 | return false; |
| 515 | } |
| 516 | |
Jordan Rose | 9fe09f3 | 2013-03-09 00:59:10 +0000 | [diff] [blame^] | 517 | static Optional<bool> getFreeWhenDoneArg(const ObjCMethodCall &Call) { |
| 518 | Selector S = Call.getSelector(); |
| 519 | |
| 520 | // FIXME: We should not rely on fully-constrained symbols being folded. |
| 521 | for (unsigned i = 1; i < S.getNumArgs(); ++i) |
| 522 | if (S.getNameForSlot(i).equals("freeWhenDone")) |
| 523 | return !Call.getArgSVal(i).isZeroConstant(); |
| 524 | |
| 525 | return None; |
| 526 | } |
| 527 | |
Anna Zaks | 4141e4d | 2012-11-13 03:18:01 +0000 | [diff] [blame] | 528 | void MallocChecker::checkPostObjCMessage(const ObjCMethodCall &Call, |
| 529 | CheckerContext &C) const { |
Anna Zaks | c2cca23 | 2012-12-11 00:17:53 +0000 | [diff] [blame] | 530 | if (C.wasInlined) |
| 531 | return; |
| 532 | |
Jordan Rose | 9fe09f3 | 2013-03-09 00:59:10 +0000 | [diff] [blame^] | 533 | if (!isKnownDeallocObjCMethodName(Call)) |
| 534 | return; |
Anna Zaks | 4141e4d | 2012-11-13 03:18:01 +0000 | [diff] [blame] | 535 | |
Jordan Rose | 9fe09f3 | 2013-03-09 00:59:10 +0000 | [diff] [blame^] | 536 | if (Optional<bool> FreeWhenDone = getFreeWhenDoneArg(Call)) |
| 537 | if (!*FreeWhenDone) |
| 538 | return; |
| 539 | |
| 540 | bool ReleasedAllocatedMemory; |
| 541 | ProgramStateRef State = FreeMemAux(C, Call.getArgExpr(0), |
| 542 | Call.getOriginExpr(), C.getState(), |
| 543 | /*Hold=*/true, ReleasedAllocatedMemory, |
| 544 | /*RetNullOnFailure=*/true); |
| 545 | |
| 546 | C.addTransition(State); |
Anna Zaks | 5b7aa34 | 2012-06-22 02:04:31 +0000 | [diff] [blame] | 547 | } |
| 548 | |
Anna Zaks | 87cb5be | 2012-02-22 19:24:52 +0000 | [diff] [blame] | 549 | ProgramStateRef MallocChecker::MallocMemReturnsAttr(CheckerContext &C, |
| 550 | const CallExpr *CE, |
| 551 | const OwnershipAttr* Att) { |
Sean Hunt | cf807c4 | 2010-08-18 23:23:40 +0000 | [diff] [blame] | 552 | if (Att->getModule() != "malloc") |
Anna Zaks | 87cb5be | 2012-02-22 19:24:52 +0000 | [diff] [blame] | 553 | return 0; |
Ted Kremenek | dd0e490 | 2010-07-31 01:52:11 +0000 | [diff] [blame] | 554 | |
Sean Hunt | cf807c4 | 2010-08-18 23:23:40 +0000 | [diff] [blame] | 555 | OwnershipAttr::args_iterator I = Att->args_begin(), E = Att->args_end(); |
Ted Kremenek | dd0e490 | 2010-07-31 01:52:11 +0000 | [diff] [blame] | 556 | if (I != E) { |
Anna Zaks | 87cb5be | 2012-02-22 19:24:52 +0000 | [diff] [blame] | 557 | return MallocMemAux(C, CE, CE->getArg(*I), UndefinedVal(), C.getState()); |
Ted Kremenek | dd0e490 | 2010-07-31 01:52:11 +0000 | [diff] [blame] | 558 | } |
Anna Zaks | 87cb5be | 2012-02-22 19:24:52 +0000 | [diff] [blame] | 559 | return MallocMemAux(C, CE, UnknownVal(), UndefinedVal(), C.getState()); |
Ted Kremenek | dd0e490 | 2010-07-31 01:52:11 +0000 | [diff] [blame] | 560 | } |
| 561 | |
Anna Zaks | b319e02 | 2012-02-08 20:13:28 +0000 | [diff] [blame] | 562 | ProgramStateRef MallocChecker::MallocMemAux(CheckerContext &C, |
Zhongxing Xu | d9c84c8 | 2009-12-12 12:29:38 +0000 | [diff] [blame] | 563 | const CallExpr *CE, |
Zhongxing Xu | a5ce966 | 2010-06-01 03:01:33 +0000 | [diff] [blame] | 564 | SVal Size, SVal Init, |
Ted Kremenek | 8bef823 | 2012-01-26 21:29:00 +0000 | [diff] [blame] | 565 | ProgramStateRef state) { |
Anna Zaks | e17fdb2 | 2012-06-07 03:57:32 +0000 | [diff] [blame] | 566 | |
| 567 | // Bind the return value to the symbolic value from the heap region. |
| 568 | // TODO: We could rewrite post visit to eval call; 'malloc' does not have |
| 569 | // side effects other than what we model here. |
Ted Kremenek | 66c486f | 2012-08-22 06:26:15 +0000 | [diff] [blame] | 570 | unsigned Count = C.blockCount(); |
Anna Zaks | e17fdb2 | 2012-06-07 03:57:32 +0000 | [diff] [blame] | 571 | SValBuilder &svalBuilder = C.getSValBuilder(); |
| 572 | const LocationContext *LCtx = C.getPredecessor()->getLocationContext(); |
David Blaikie | 5251abe | 2013-02-20 05:52:05 +0000 | [diff] [blame] | 573 | DefinedSVal RetVal = svalBuilder.getConjuredHeapSymbolVal(CE, LCtx, Count) |
| 574 | .castAs<DefinedSVal>(); |
Anna Zaks | e17fdb2 | 2012-06-07 03:57:32 +0000 | [diff] [blame] | 575 | state = state->BindExpr(CE, C.getLocationContext(), RetVal); |
Zhongxing Xu | a49c6b7 | 2009-12-11 03:09:01 +0000 | [diff] [blame] | 576 | |
Anna Zaks | b16ce45 | 2012-02-15 00:11:22 +0000 | [diff] [blame] | 577 | // We expect the malloc functions to return a pointer. |
David Blaikie | 5251abe | 2013-02-20 05:52:05 +0000 | [diff] [blame] | 578 | if (!RetVal.getAs<Loc>()) |
Anna Zaks | b16ce45 | 2012-02-15 00:11:22 +0000 | [diff] [blame] | 579 | return 0; |
| 580 | |
Jordy Rose | 32f2656 | 2010-07-04 00:00:41 +0000 | [diff] [blame] | 581 | // Fill the region with the initialization value. |
Anna Zaks | e17fdb2 | 2012-06-07 03:57:32 +0000 | [diff] [blame] | 582 | state = state->bindDefault(RetVal, Init); |
Zhongxing Xu | a5ce966 | 2010-06-01 03:01:33 +0000 | [diff] [blame] | 583 | |
Jordy Rose | 32f2656 | 2010-07-04 00:00:41 +0000 | [diff] [blame] | 584 | // Set the region's extent equal to the Size parameter. |
Anna Zaks | e9ef562 | 2012-02-10 01:11:00 +0000 | [diff] [blame] | 585 | const SymbolicRegion *R = |
Anna Zaks | e17fdb2 | 2012-06-07 03:57:32 +0000 | [diff] [blame] | 586 | dyn_cast_or_null<SymbolicRegion>(RetVal.getAsRegion()); |
Anna Zaks | 60a1fa4 | 2012-02-22 03:14:20 +0000 | [diff] [blame] | 587 | if (!R) |
Anna Zaks | e9ef562 | 2012-02-10 01:11:00 +0000 | [diff] [blame] | 588 | return 0; |
David Blaikie | dc84cd5 | 2013-02-20 22:23:23 +0000 | [diff] [blame] | 589 | if (Optional<DefinedOrUnknownSVal> DefinedSize = |
David Blaikie | 5251abe | 2013-02-20 05:52:05 +0000 | [diff] [blame] | 590 | Size.getAs<DefinedOrUnknownSVal>()) { |
Anna Zaks | 87cb5be | 2012-02-22 19:24:52 +0000 | [diff] [blame] | 591 | SValBuilder &svalBuilder = C.getSValBuilder(); |
Anna Zaks | 60a1fa4 | 2012-02-22 03:14:20 +0000 | [diff] [blame] | 592 | DefinedOrUnknownSVal Extent = R->getExtent(svalBuilder); |
Anna Zaks | 60a1fa4 | 2012-02-22 03:14:20 +0000 | [diff] [blame] | 593 | DefinedOrUnknownSVal extentMatchesSize = |
David Blaikie | 5251abe | 2013-02-20 05:52:05 +0000 | [diff] [blame] | 594 | svalBuilder.evalEQ(state, Extent, *DefinedSize); |
Anna Zaks | e9ef562 | 2012-02-10 01:11:00 +0000 | [diff] [blame] | 595 | |
Anna Zaks | 60a1fa4 | 2012-02-22 03:14:20 +0000 | [diff] [blame] | 596 | state = state->assume(extentMatchesSize, true); |
| 597 | assert(state); |
| 598 | } |
Ted Kremenek | c8413fd | 2010-12-02 07:49:45 +0000 | [diff] [blame] | 599 | |
Anna Zaks | 87cb5be | 2012-02-22 19:24:52 +0000 | [diff] [blame] | 600 | return MallocUpdateRefState(C, CE, state); |
| 601 | } |
| 602 | |
| 603 | ProgramStateRef MallocChecker::MallocUpdateRefState(CheckerContext &C, |
| 604 | const CallExpr *CE, |
| 605 | ProgramStateRef state) { |
| 606 | // Get the return value. |
| 607 | SVal retVal = state->getSVal(CE, C.getLocationContext()); |
| 608 | |
| 609 | // We expect the malloc functions to return a pointer. |
David Blaikie | 5251abe | 2013-02-20 05:52:05 +0000 | [diff] [blame] | 610 | if (!retVal.getAs<Loc>()) |
Anna Zaks | 87cb5be | 2012-02-22 19:24:52 +0000 | [diff] [blame] | 611 | return 0; |
| 612 | |
Ted Kremenek | c8413fd | 2010-12-02 07:49:45 +0000 | [diff] [blame] | 613 | SymbolRef Sym = retVal.getAsLocSymbol(); |
Zhongxing Xu | 589c0f2 | 2009-11-12 08:38:56 +0000 | [diff] [blame] | 614 | assert(Sym); |
Ted Kremenek | c8413fd | 2010-12-02 07:49:45 +0000 | [diff] [blame] | 615 | |
Zhongxing Xu | 589c0f2 | 2009-11-12 08:38:56 +0000 | [diff] [blame] | 616 | // Set the symbol's state to Allocated. |
Anna Zaks | 050cdd7 | 2012-06-20 20:57:46 +0000 | [diff] [blame] | 617 | return state->set<RegionState>(Sym, RefState::getAllocated(CE)); |
Anna Zaks | 87cb5be | 2012-02-22 19:24:52 +0000 | [diff] [blame] | 618 | |
Zhongxing Xu | 589c0f2 | 2009-11-12 08:38:56 +0000 | [diff] [blame] | 619 | } |
| 620 | |
Anna Zaks | 87cb5be | 2012-02-22 19:24:52 +0000 | [diff] [blame] | 621 | ProgramStateRef MallocChecker::FreeMemAttr(CheckerContext &C, |
| 622 | const CallExpr *CE, |
| 623 | const OwnershipAttr* Att) const { |
Sean Hunt | cf807c4 | 2010-08-18 23:23:40 +0000 | [diff] [blame] | 624 | if (Att->getModule() != "malloc") |
Anna Zaks | 87cb5be | 2012-02-22 19:24:52 +0000 | [diff] [blame] | 625 | return 0; |
Ted Kremenek | dd0e490 | 2010-07-31 01:52:11 +0000 | [diff] [blame] | 626 | |
Anna Zaks | b3d7275 | 2012-03-01 22:06:06 +0000 | [diff] [blame] | 627 | ProgramStateRef State = C.getState(); |
Anna Zaks | 55dd956 | 2012-08-24 02:28:20 +0000 | [diff] [blame] | 628 | bool ReleasedAllocated = false; |
Anna Zaks | b3d7275 | 2012-03-01 22:06:06 +0000 | [diff] [blame] | 629 | |
Sean Hunt | cf807c4 | 2010-08-18 23:23:40 +0000 | [diff] [blame] | 630 | for (OwnershipAttr::args_iterator I = Att->args_begin(), E = Att->args_end(); |
| 631 | I != E; ++I) { |
Anna Zaks | b3d7275 | 2012-03-01 22:06:06 +0000 | [diff] [blame] | 632 | ProgramStateRef StateI = FreeMemAux(C, CE, State, *I, |
Anna Zaks | 55dd956 | 2012-08-24 02:28:20 +0000 | [diff] [blame] | 633 | Att->getOwnKind() == OwnershipAttr::Holds, |
| 634 | ReleasedAllocated); |
Anna Zaks | b3d7275 | 2012-03-01 22:06:06 +0000 | [diff] [blame] | 635 | if (StateI) |
| 636 | State = StateI; |
Ted Kremenek | dd0e490 | 2010-07-31 01:52:11 +0000 | [diff] [blame] | 637 | } |
Anna Zaks | b3d7275 | 2012-03-01 22:06:06 +0000 | [diff] [blame] | 638 | return State; |
Ted Kremenek | dd0e490 | 2010-07-31 01:52:11 +0000 | [diff] [blame] | 639 | } |
| 640 | |
Ted Kremenek | 8bef823 | 2012-01-26 21:29:00 +0000 | [diff] [blame] | 641 | ProgramStateRef MallocChecker::FreeMemAux(CheckerContext &C, |
Anna Zaks | e9ef562 | 2012-02-10 01:11:00 +0000 | [diff] [blame] | 642 | const CallExpr *CE, |
| 643 | ProgramStateRef state, |
| 644 | unsigned Num, |
Anna Zaks | 55dd956 | 2012-08-24 02:28:20 +0000 | [diff] [blame] | 645 | bool Hold, |
Anna Zaks | 4141e4d | 2012-11-13 03:18:01 +0000 | [diff] [blame] | 646 | bool &ReleasedAllocated, |
| 647 | bool ReturnsNullOnFailure) const { |
Anna Zaks | 259052d | 2012-04-10 23:41:11 +0000 | [diff] [blame] | 648 | if (CE->getNumArgs() < (Num + 1)) |
| 649 | return 0; |
| 650 | |
Anna Zaks | 4141e4d | 2012-11-13 03:18:01 +0000 | [diff] [blame] | 651 | return FreeMemAux(C, CE->getArg(Num), CE, state, Hold, |
| 652 | ReleasedAllocated, ReturnsNullOnFailure); |
| 653 | } |
| 654 | |
Anna Zaks | 2ccecfa | 2012-11-13 19:47:40 +0000 | [diff] [blame] | 655 | /// Checks if the previous call to free on the given symbol failed - if free |
| 656 | /// failed, returns true. Also, returns the corresponding return value symbol. |
Benjamin Kramer | 4d9f4e5 | 2012-11-22 15:02:44 +0000 | [diff] [blame] | 657 | static bool didPreviousFreeFail(ProgramStateRef State, |
| 658 | SymbolRef Sym, SymbolRef &RetStatusSymbol) { |
Anna Zaks | 2ccecfa | 2012-11-13 19:47:40 +0000 | [diff] [blame] | 659 | const SymbolRef *Ret = State->get<FreeReturnValue>(Sym); |
Anna Zaks | 4141e4d | 2012-11-13 03:18:01 +0000 | [diff] [blame] | 660 | if (Ret) { |
| 661 | assert(*Ret && "We should not store the null return symbol"); |
| 662 | ConstraintManager &CMgr = State->getConstraintManager(); |
| 663 | ConditionTruthVal FreeFailed = CMgr.isNull(State, *Ret); |
Anna Zaks | 2ccecfa | 2012-11-13 19:47:40 +0000 | [diff] [blame] | 664 | RetStatusSymbol = *Ret; |
| 665 | return FreeFailed.isConstrainedTrue(); |
Anna Zaks | 4141e4d | 2012-11-13 03:18:01 +0000 | [diff] [blame] | 666 | } |
Anna Zaks | 2ccecfa | 2012-11-13 19:47:40 +0000 | [diff] [blame] | 667 | return false; |
Anna Zaks | 5b7aa34 | 2012-06-22 02:04:31 +0000 | [diff] [blame] | 668 | } |
| 669 | |
| 670 | ProgramStateRef MallocChecker::FreeMemAux(CheckerContext &C, |
| 671 | const Expr *ArgExpr, |
| 672 | const Expr *ParentExpr, |
Anna Zaks | 4141e4d | 2012-11-13 03:18:01 +0000 | [diff] [blame] | 673 | ProgramStateRef State, |
Anna Zaks | 55dd956 | 2012-08-24 02:28:20 +0000 | [diff] [blame] | 674 | bool Hold, |
Anna Zaks | 4141e4d | 2012-11-13 03:18:01 +0000 | [diff] [blame] | 675 | bool &ReleasedAllocated, |
| 676 | bool ReturnsNullOnFailure) const { |
Anna Zaks | 5b7aa34 | 2012-06-22 02:04:31 +0000 | [diff] [blame] | 677 | |
Anna Zaks | 4141e4d | 2012-11-13 03:18:01 +0000 | [diff] [blame] | 678 | SVal ArgVal = State->getSVal(ArgExpr, C.getLocationContext()); |
David Blaikie | 5251abe | 2013-02-20 05:52:05 +0000 | [diff] [blame] | 679 | if (!ArgVal.getAs<DefinedOrUnknownSVal>()) |
Anna Zaks | e9ef562 | 2012-02-10 01:11:00 +0000 | [diff] [blame] | 680 | return 0; |
David Blaikie | 5251abe | 2013-02-20 05:52:05 +0000 | [diff] [blame] | 681 | DefinedOrUnknownSVal location = ArgVal.castAs<DefinedOrUnknownSVal>(); |
Ted Kremenek | dd0e490 | 2010-07-31 01:52:11 +0000 | [diff] [blame] | 682 | |
| 683 | // Check for null dereferences. |
David Blaikie | 5251abe | 2013-02-20 05:52:05 +0000 | [diff] [blame] | 684 | if (!location.getAs<Loc>()) |
Anna Zaks | b319e02 | 2012-02-08 20:13:28 +0000 | [diff] [blame] | 685 | return 0; |
Ted Kremenek | dd0e490 | 2010-07-31 01:52:11 +0000 | [diff] [blame] | 686 | |
Anna Zaks | b276bd9 | 2012-02-14 00:26:13 +0000 | [diff] [blame] | 687 | // The explicit NULL case, no operation is performed. |
Ted Kremenek | 8bef823 | 2012-01-26 21:29:00 +0000 | [diff] [blame] | 688 | ProgramStateRef notNullState, nullState; |
Anna Zaks | 4141e4d | 2012-11-13 03:18:01 +0000 | [diff] [blame] | 689 | llvm::tie(notNullState, nullState) = State->assume(location); |
Ted Kremenek | dd0e490 | 2010-07-31 01:52:11 +0000 | [diff] [blame] | 690 | if (nullState && !notNullState) |
Anna Zaks | b319e02 | 2012-02-08 20:13:28 +0000 | [diff] [blame] | 691 | return 0; |
Ted Kremenek | dd0e490 | 2010-07-31 01:52:11 +0000 | [diff] [blame] | 692 | |
Jordy Rose | 43859f6 | 2010-06-07 19:32:37 +0000 | [diff] [blame] | 693 | // Unknown values could easily be okay |
| 694 | // Undefined values are handled elsewhere |
| 695 | if (ArgVal.isUnknownOrUndef()) |
Anna Zaks | b319e02 | 2012-02-08 20:13:28 +0000 | [diff] [blame] | 696 | return 0; |
Zhongxing Xu | 589c0f2 | 2009-11-12 08:38:56 +0000 | [diff] [blame] | 697 | |
Jordy Rose | 43859f6 | 2010-06-07 19:32:37 +0000 | [diff] [blame] | 698 | const MemRegion *R = ArgVal.getAsRegion(); |
| 699 | |
| 700 | // Nonlocs can't be freed, of course. |
| 701 | // Non-region locations (labels and fixed addresses) also shouldn't be freed. |
| 702 | if (!R) { |
| 703 | ReportBadFree(C, ArgVal, ArgExpr->getSourceRange()); |
Anna Zaks | b319e02 | 2012-02-08 20:13:28 +0000 | [diff] [blame] | 704 | return 0; |
Jordy Rose | 43859f6 | 2010-06-07 19:32:37 +0000 | [diff] [blame] | 705 | } |
| 706 | |
| 707 | R = R->StripCasts(); |
| 708 | |
| 709 | // Blocks might show up as heap data, but should not be free()d |
| 710 | if (isa<BlockDataRegion>(R)) { |
| 711 | ReportBadFree(C, ArgVal, ArgExpr->getSourceRange()); |
Anna Zaks | b319e02 | 2012-02-08 20:13:28 +0000 | [diff] [blame] | 712 | return 0; |
Jordy Rose | 43859f6 | 2010-06-07 19:32:37 +0000 | [diff] [blame] | 713 | } |
| 714 | |
| 715 | const MemSpaceRegion *MS = R->getMemorySpace(); |
| 716 | |
| 717 | // Parameters, locals, statics, and globals shouldn't be freed. |
| 718 | if (!(isa<UnknownSpaceRegion>(MS) || isa<HeapSpaceRegion>(MS))) { |
| 719 | // FIXME: at the time this code was written, malloc() regions were |
| 720 | // represented by conjured symbols, which are all in UnknownSpaceRegion. |
| 721 | // This means that there isn't actually anything from HeapSpaceRegion |
| 722 | // that should be freed, even though we allow it here. |
| 723 | // Of course, free() can work on memory allocated outside the current |
| 724 | // function, so UnknownSpaceRegion is always a possibility. |
| 725 | // False negatives are better than false positives. |
| 726 | |
| 727 | ReportBadFree(C, ArgVal, ArgExpr->getSourceRange()); |
Anna Zaks | b319e02 | 2012-02-08 20:13:28 +0000 | [diff] [blame] | 728 | return 0; |
Jordy Rose | 43859f6 | 2010-06-07 19:32:37 +0000 | [diff] [blame] | 729 | } |
Anna Zaks | 118aa75 | 2013-02-07 23:05:47 +0000 | [diff] [blame] | 730 | |
| 731 | const SymbolicRegion *SrBase = dyn_cast<SymbolicRegion>(R->getBaseRegion()); |
Jordy Rose | 43859f6 | 2010-06-07 19:32:37 +0000 | [diff] [blame] | 732 | // Various cases could lead to non-symbol values here. |
| 733 | // For now, ignore them. |
Anna Zaks | 118aa75 | 2013-02-07 23:05:47 +0000 | [diff] [blame] | 734 | if (!SrBase) |
Anna Zaks | b319e02 | 2012-02-08 20:13:28 +0000 | [diff] [blame] | 735 | return 0; |
Jordy Rose | 43859f6 | 2010-06-07 19:32:37 +0000 | [diff] [blame] | 736 | |
Anna Zaks | 118aa75 | 2013-02-07 23:05:47 +0000 | [diff] [blame] | 737 | SymbolRef SymBase = SrBase->getSymbol(); |
| 738 | const RefState *RsBase = State->get<RegionState>(SymBase); |
Anna Zaks | 2ccecfa | 2012-11-13 19:47:40 +0000 | [diff] [blame] | 739 | SymbolRef PreviousRetStatusSymbol = 0; |
Zhongxing Xu | 7e3cda9 | 2010-01-18 03:27:34 +0000 | [diff] [blame] | 740 | |
Zhongxing Xu | 589c0f2 | 2009-11-12 08:38:56 +0000 | [diff] [blame] | 741 | // Check double free. |
Anna Zaks | 118aa75 | 2013-02-07 23:05:47 +0000 | [diff] [blame] | 742 | if (RsBase && |
| 743 | (RsBase->isReleased() || RsBase->isRelinquished()) && |
| 744 | !didPreviousFreeFail(State, SymBase, PreviousRetStatusSymbol)) { |
Anna Zaks | 4141e4d | 2012-11-13 03:18:01 +0000 | [diff] [blame] | 745 | |
Ted Kremenek | d048c6e | 2010-12-20 21:19:09 +0000 | [diff] [blame] | 746 | if (ExplodedNode *N = C.generateSink()) { |
Zhongxing Xu | 589c0f2 | 2009-11-12 08:38:56 +0000 | [diff] [blame] | 747 | if (!BT_DoubleFree) |
Argyrios Kyrtzidis | 312dbec | 2011-02-28 01:26:35 +0000 | [diff] [blame] | 748 | BT_DoubleFree.reset( |
Anna Zaks | febdc32 | 2012-02-16 22:26:12 +0000 | [diff] [blame] | 749 | new BugType("Double free", "Memory Error")); |
Anna Zaks | 118aa75 | 2013-02-07 23:05:47 +0000 | [diff] [blame] | 750 | BugReport *R = new BugReport(*BT_DoubleFree, |
| 751 | (RsBase->isReleased() ? "Attempt to free released memory" |
| 752 | : "Attempt to free non-owned memory"), |
| 753 | N); |
Anna Zaks | fe57160 | 2012-02-16 22:26:07 +0000 | [diff] [blame] | 754 | R->addRange(ArgExpr->getSourceRange()); |
Anna Zaks | 118aa75 | 2013-02-07 23:05:47 +0000 | [diff] [blame] | 755 | R->markInteresting(SymBase); |
Anna Zaks | 2ccecfa | 2012-11-13 19:47:40 +0000 | [diff] [blame] | 756 | if (PreviousRetStatusSymbol) |
| 757 | R->markInteresting(PreviousRetStatusSymbol); |
Anna Zaks | 118aa75 | 2013-02-07 23:05:47 +0000 | [diff] [blame] | 758 | R->addVisitor(new MallocBugVisitor(SymBase)); |
Jordan Rose | 785950e | 2012-11-02 01:53:40 +0000 | [diff] [blame] | 759 | C.emitReport(R); |
Zhongxing Xu | 589c0f2 | 2009-11-12 08:38:56 +0000 | [diff] [blame] | 760 | } |
Anna Zaks | b319e02 | 2012-02-08 20:13:28 +0000 | [diff] [blame] | 761 | return 0; |
Zhongxing Xu | 589c0f2 | 2009-11-12 08:38:56 +0000 | [diff] [blame] | 762 | } |
| 763 | |
Anna Zaks | 118aa75 | 2013-02-07 23:05:47 +0000 | [diff] [blame] | 764 | // Check if the memory location being freed is the actual location |
| 765 | // allocated, or an offset. |
| 766 | RegionOffset Offset = R->getAsOffset(); |
| 767 | if (RsBase && RsBase->isAllocated() && |
| 768 | Offset.isValid() && |
| 769 | !Offset.hasSymbolicOffset() && |
| 770 | Offset.getOffset() != 0) { |
| 771 | ReportOffsetFree(C, ArgVal, ArgExpr->getSourceRange()); |
| 772 | return 0; |
| 773 | } |
| 774 | |
| 775 | ReleasedAllocated = (RsBase != 0); |
Anna Zaks | 55dd956 | 2012-08-24 02:28:20 +0000 | [diff] [blame] | 776 | |
Anna Zaks | 2ccecfa | 2012-11-13 19:47:40 +0000 | [diff] [blame] | 777 | // Clean out the info on previous call to free return info. |
Anna Zaks | 118aa75 | 2013-02-07 23:05:47 +0000 | [diff] [blame] | 778 | State = State->remove<FreeReturnValue>(SymBase); |
Anna Zaks | 2ccecfa | 2012-11-13 19:47:40 +0000 | [diff] [blame] | 779 | |
Anna Zaks | 4141e4d | 2012-11-13 03:18:01 +0000 | [diff] [blame] | 780 | // Keep track of the return value. If it is NULL, we will know that free |
| 781 | // failed. |
| 782 | if (ReturnsNullOnFailure) { |
| 783 | SVal RetVal = C.getSVal(ParentExpr); |
| 784 | SymbolRef RetStatusSymbol = RetVal.getAsSymbol(); |
| 785 | if (RetStatusSymbol) { |
Anna Zaks | 118aa75 | 2013-02-07 23:05:47 +0000 | [diff] [blame] | 786 | C.getSymbolManager().addSymbolDependency(SymBase, RetStatusSymbol); |
| 787 | State = State->set<FreeReturnValue>(SymBase, RetStatusSymbol); |
Anna Zaks | 4141e4d | 2012-11-13 03:18:01 +0000 | [diff] [blame] | 788 | } |
| 789 | } |
| 790 | |
Zhongxing Xu | 589c0f2 | 2009-11-12 08:38:56 +0000 | [diff] [blame] | 791 | // Normal free. |
Anna Zaks | 118aa75 | 2013-02-07 23:05:47 +0000 | [diff] [blame] | 792 | if (Hold) { |
| 793 | return State->set<RegionState>(SymBase, |
| 794 | RefState::getRelinquished(ParentExpr)); |
| 795 | } |
| 796 | return State->set<RegionState>(SymBase, RefState::getReleased(ParentExpr)); |
Zhongxing Xu | d9c84c8 | 2009-12-12 12:29:38 +0000 | [diff] [blame] | 797 | } |
| 798 | |
Ted Kremenek | 9c378f7 | 2011-08-12 23:37:29 +0000 | [diff] [blame] | 799 | bool MallocChecker::SummarizeValue(raw_ostream &os, SVal V) { |
David Blaikie | dc84cd5 | 2013-02-20 22:23:23 +0000 | [diff] [blame] | 800 | if (Optional<nonloc::ConcreteInt> IntVal = V.getAs<nonloc::ConcreteInt>()) |
Jordy Rose | 43859f6 | 2010-06-07 19:32:37 +0000 | [diff] [blame] | 801 | os << "an integer (" << IntVal->getValue() << ")"; |
David Blaikie | dc84cd5 | 2013-02-20 22:23:23 +0000 | [diff] [blame] | 802 | else if (Optional<loc::ConcreteInt> ConstAddr = V.getAs<loc::ConcreteInt>()) |
Jordy Rose | 43859f6 | 2010-06-07 19:32:37 +0000 | [diff] [blame] | 803 | os << "a constant address (" << ConstAddr->getValue() << ")"; |
David Blaikie | dc84cd5 | 2013-02-20 22:23:23 +0000 | [diff] [blame] | 804 | else if (Optional<loc::GotoLabel> Label = V.getAs<loc::GotoLabel>()) |
Chris Lattner | 6810630 | 2011-02-17 05:38:27 +0000 | [diff] [blame] | 805 | os << "the address of the label '" << Label->getLabel()->getName() << "'"; |
Jordy Rose | 43859f6 | 2010-06-07 19:32:37 +0000 | [diff] [blame] | 806 | else |
| 807 | return false; |
| 808 | |
| 809 | return true; |
| 810 | } |
| 811 | |
Ted Kremenek | 9c378f7 | 2011-08-12 23:37:29 +0000 | [diff] [blame] | 812 | bool MallocChecker::SummarizeRegion(raw_ostream &os, |
Jordy Rose | 43859f6 | 2010-06-07 19:32:37 +0000 | [diff] [blame] | 813 | const MemRegion *MR) { |
| 814 | switch (MR->getKind()) { |
| 815 | case MemRegion::FunctionTextRegionKind: { |
Anna Zaks | 5fc1d0c | 2012-09-17 19:13:56 +0000 | [diff] [blame] | 816 | const NamedDecl *FD = cast<FunctionTextRegion>(MR)->getDecl(); |
Jordy Rose | 43859f6 | 2010-06-07 19:32:37 +0000 | [diff] [blame] | 817 | if (FD) |
Benjamin Kramer | b8989f2 | 2011-10-14 18:45:37 +0000 | [diff] [blame] | 818 | os << "the address of the function '" << *FD << '\''; |
Jordy Rose | 43859f6 | 2010-06-07 19:32:37 +0000 | [diff] [blame] | 819 | else |
| 820 | os << "the address of a function"; |
| 821 | return true; |
| 822 | } |
| 823 | case MemRegion::BlockTextRegionKind: |
| 824 | os << "block text"; |
| 825 | return true; |
| 826 | case MemRegion::BlockDataRegionKind: |
| 827 | // FIXME: where the block came from? |
| 828 | os << "a block"; |
| 829 | return true; |
| 830 | default: { |
| 831 | const MemSpaceRegion *MS = MR->getMemorySpace(); |
| 832 | |
Anna Zaks | eb31a76 | 2012-01-04 23:54:01 +0000 | [diff] [blame] | 833 | if (isa<StackLocalsSpaceRegion>(MS)) { |
Jordy Rose | 43859f6 | 2010-06-07 19:32:37 +0000 | [diff] [blame] | 834 | const VarRegion *VR = dyn_cast<VarRegion>(MR); |
| 835 | const VarDecl *VD; |
| 836 | if (VR) |
| 837 | VD = VR->getDecl(); |
| 838 | else |
| 839 | VD = NULL; |
| 840 | |
| 841 | if (VD) |
| 842 | os << "the address of the local variable '" << VD->getName() << "'"; |
| 843 | else |
| 844 | os << "the address of a local stack variable"; |
| 845 | return true; |
| 846 | } |
Anna Zaks | eb31a76 | 2012-01-04 23:54:01 +0000 | [diff] [blame] | 847 | |
| 848 | if (isa<StackArgumentsSpaceRegion>(MS)) { |
Jordy Rose | 43859f6 | 2010-06-07 19:32:37 +0000 | [diff] [blame] | 849 | const VarRegion *VR = dyn_cast<VarRegion>(MR); |
| 850 | const VarDecl *VD; |
| 851 | if (VR) |
| 852 | VD = VR->getDecl(); |
| 853 | else |
| 854 | VD = NULL; |
| 855 | |
| 856 | if (VD) |
| 857 | os << "the address of the parameter '" << VD->getName() << "'"; |
| 858 | else |
| 859 | os << "the address of a parameter"; |
| 860 | return true; |
| 861 | } |
Anna Zaks | eb31a76 | 2012-01-04 23:54:01 +0000 | [diff] [blame] | 862 | |
| 863 | if (isa<GlobalsSpaceRegion>(MS)) { |
Jordy Rose | 43859f6 | 2010-06-07 19:32:37 +0000 | [diff] [blame] | 864 | const VarRegion *VR = dyn_cast<VarRegion>(MR); |
| 865 | const VarDecl *VD; |
| 866 | if (VR) |
| 867 | VD = VR->getDecl(); |
| 868 | else |
| 869 | VD = NULL; |
| 870 | |
| 871 | if (VD) { |
| 872 | if (VD->isStaticLocal()) |
| 873 | os << "the address of the static variable '" << VD->getName() << "'"; |
| 874 | else |
| 875 | os << "the address of the global variable '" << VD->getName() << "'"; |
| 876 | } else |
| 877 | os << "the address of a global variable"; |
| 878 | return true; |
| 879 | } |
Anna Zaks | eb31a76 | 2012-01-04 23:54:01 +0000 | [diff] [blame] | 880 | |
| 881 | return false; |
Jordy Rose | 43859f6 | 2010-06-07 19:32:37 +0000 | [diff] [blame] | 882 | } |
| 883 | } |
| 884 | } |
| 885 | |
| 886 | void MallocChecker::ReportBadFree(CheckerContext &C, SVal ArgVal, |
Argyrios Kyrtzidis | 312dbec | 2011-02-28 01:26:35 +0000 | [diff] [blame] | 887 | SourceRange range) const { |
Ted Kremenek | d048c6e | 2010-12-20 21:19:09 +0000 | [diff] [blame] | 888 | if (ExplodedNode *N = C.generateSink()) { |
Jordy Rose | 43859f6 | 2010-06-07 19:32:37 +0000 | [diff] [blame] | 889 | if (!BT_BadFree) |
Anna Zaks | febdc32 | 2012-02-16 22:26:12 +0000 | [diff] [blame] | 890 | BT_BadFree.reset(new BugType("Bad free", "Memory Error")); |
Jordy Rose | 43859f6 | 2010-06-07 19:32:37 +0000 | [diff] [blame] | 891 | |
Dylan Noblesmith | f7ccbad | 2012-02-05 02:13:05 +0000 | [diff] [blame] | 892 | SmallString<100> buf; |
Jordy Rose | 43859f6 | 2010-06-07 19:32:37 +0000 | [diff] [blame] | 893 | llvm::raw_svector_ostream os(buf); |
| 894 | |
| 895 | const MemRegion *MR = ArgVal.getAsRegion(); |
| 896 | if (MR) { |
| 897 | while (const ElementRegion *ER = dyn_cast<ElementRegion>(MR)) |
| 898 | MR = ER->getSuperRegion(); |
| 899 | |
| 900 | // Special case for alloca() |
| 901 | if (isa<AllocaRegion>(MR)) |
| 902 | os << "Argument to free() was allocated by alloca(), not malloc()"; |
| 903 | else { |
| 904 | os << "Argument to free() is "; |
| 905 | if (SummarizeRegion(os, MR)) |
| 906 | os << ", which is not memory allocated by malloc()"; |
| 907 | else |
| 908 | os << "not memory allocated by malloc()"; |
| 909 | } |
| 910 | } else { |
| 911 | os << "Argument to free() is "; |
| 912 | if (SummarizeValue(os, ArgVal)) |
| 913 | os << ", which is not memory allocated by malloc()"; |
| 914 | else |
| 915 | os << "not memory allocated by malloc()"; |
| 916 | } |
| 917 | |
Anna Zaks | e172e8b | 2011-08-17 23:00:25 +0000 | [diff] [blame] | 918 | BugReport *R = new BugReport(*BT_BadFree, os.str(), N); |
Ted Kremenek | 76aadc3 | 2012-03-09 01:13:14 +0000 | [diff] [blame] | 919 | R->markInteresting(MR); |
Jordy Rose | 43859f6 | 2010-06-07 19:32:37 +0000 | [diff] [blame] | 920 | R->addRange(range); |
Jordan Rose | 785950e | 2012-11-02 01:53:40 +0000 | [diff] [blame] | 921 | C.emitReport(R); |
Jordy Rose | 43859f6 | 2010-06-07 19:32:37 +0000 | [diff] [blame] | 922 | } |
| 923 | } |
| 924 | |
Anna Zaks | 118aa75 | 2013-02-07 23:05:47 +0000 | [diff] [blame] | 925 | void MallocChecker::ReportOffsetFree(CheckerContext &C, SVal ArgVal, |
| 926 | SourceRange Range) const { |
| 927 | ExplodedNode *N = C.generateSink(); |
| 928 | if (N == NULL) |
| 929 | return; |
| 930 | |
| 931 | if (!BT_OffsetFree) |
| 932 | BT_OffsetFree.reset(new BugType("Offset free", "Memory Error")); |
| 933 | |
| 934 | SmallString<100> buf; |
| 935 | llvm::raw_svector_ostream os(buf); |
| 936 | |
| 937 | const MemRegion *MR = ArgVal.getAsRegion(); |
| 938 | assert(MR && "Only MemRegion based symbols can have offset free errors"); |
| 939 | |
| 940 | RegionOffset Offset = MR->getAsOffset(); |
| 941 | assert((Offset.isValid() && |
| 942 | !Offset.hasSymbolicOffset() && |
| 943 | Offset.getOffset() != 0) && |
| 944 | "Only symbols with a valid offset can have offset free errors"); |
| 945 | |
| 946 | int offsetBytes = Offset.getOffset() / C.getASTContext().getCharWidth(); |
| 947 | |
| 948 | os << "Argument to free() is offset by " |
| 949 | << offsetBytes |
| 950 | << " " |
| 951 | << ((abs(offsetBytes) > 1) ? "bytes" : "byte") |
| 952 | << " from the start of memory allocated by malloc()"; |
| 953 | |
| 954 | BugReport *R = new BugReport(*BT_OffsetFree, os.str(), N); |
| 955 | R->markInteresting(MR->getBaseRegion()); |
| 956 | R->addRange(Range); |
| 957 | C.emitReport(R); |
| 958 | } |
| 959 | |
Anna Zaks | 87cb5be | 2012-02-22 19:24:52 +0000 | [diff] [blame] | 960 | ProgramStateRef MallocChecker::ReallocMem(CheckerContext &C, |
| 961 | const CallExpr *CE, |
| 962 | bool FreesOnFail) const { |
Anna Zaks | 259052d | 2012-04-10 23:41:11 +0000 | [diff] [blame] | 963 | if (CE->getNumArgs() < 2) |
| 964 | return 0; |
| 965 | |
Ted Kremenek | 8bef823 | 2012-01-26 21:29:00 +0000 | [diff] [blame] | 966 | ProgramStateRef state = C.getState(); |
Ted Kremenek | c8413fd | 2010-12-02 07:49:45 +0000 | [diff] [blame] | 967 | const Expr *arg0Expr = CE->getArg(0); |
Ted Kremenek | 5eca482 | 2012-01-06 22:09:28 +0000 | [diff] [blame] | 968 | const LocationContext *LCtx = C.getLocationContext(); |
Anna Zaks | e9ef562 | 2012-02-10 01:11:00 +0000 | [diff] [blame] | 969 | SVal Arg0Val = state->getSVal(arg0Expr, LCtx); |
David Blaikie | 5251abe | 2013-02-20 05:52:05 +0000 | [diff] [blame] | 970 | if (!Arg0Val.getAs<DefinedOrUnknownSVal>()) |
Anna Zaks | 87cb5be | 2012-02-22 19:24:52 +0000 | [diff] [blame] | 971 | return 0; |
David Blaikie | 5251abe | 2013-02-20 05:52:05 +0000 | [diff] [blame] | 972 | DefinedOrUnknownSVal arg0Val = Arg0Val.castAs<DefinedOrUnknownSVal>(); |
Zhongxing Xu | d9c84c8 | 2009-12-12 12:29:38 +0000 | [diff] [blame] | 973 | |
Ted Kremenek | 846eabd | 2010-12-01 21:28:31 +0000 | [diff] [blame] | 974 | SValBuilder &svalBuilder = C.getSValBuilder(); |
Zhongxing Xu | d9c84c8 | 2009-12-12 12:29:38 +0000 | [diff] [blame] | 975 | |
Ted Kremenek | c8413fd | 2010-12-02 07:49:45 +0000 | [diff] [blame] | 976 | DefinedOrUnknownSVal PtrEQ = |
| 977 | svalBuilder.evalEQ(state, arg0Val, svalBuilder.makeNull()); |
Zhongxing Xu | d9c84c8 | 2009-12-12 12:29:38 +0000 | [diff] [blame] | 978 | |
Lenny Maiorani | 4d8d803 | 2011-04-27 14:49:29 +0000 | [diff] [blame] | 979 | // Get the size argument. If there is no size arg then give up. |
| 980 | const Expr *Arg1 = CE->getArg(1); |
| 981 | if (!Arg1) |
Anna Zaks | 87cb5be | 2012-02-22 19:24:52 +0000 | [diff] [blame] | 982 | return 0; |
Lenny Maiorani | 4d8d803 | 2011-04-27 14:49:29 +0000 | [diff] [blame] | 983 | |
| 984 | // Get the value of the size argument. |
Anna Zaks | e9ef562 | 2012-02-10 01:11:00 +0000 | [diff] [blame] | 985 | SVal Arg1ValG = state->getSVal(Arg1, LCtx); |
David Blaikie | 5251abe | 2013-02-20 05:52:05 +0000 | [diff] [blame] | 986 | if (!Arg1ValG.getAs<DefinedOrUnknownSVal>()) |
Anna Zaks | 87cb5be | 2012-02-22 19:24:52 +0000 | [diff] [blame] | 987 | return 0; |
David Blaikie | 5251abe | 2013-02-20 05:52:05 +0000 | [diff] [blame] | 988 | DefinedOrUnknownSVal Arg1Val = Arg1ValG.castAs<DefinedOrUnknownSVal>(); |
Lenny Maiorani | 4d8d803 | 2011-04-27 14:49:29 +0000 | [diff] [blame] | 989 | |
| 990 | // Compare the size argument to 0. |
| 991 | DefinedOrUnknownSVal SizeZero = |
| 992 | svalBuilder.evalEQ(state, Arg1Val, |
| 993 | svalBuilder.makeIntValWithPtrWidth(0, false)); |
| 994 | |
Anna Zaks | c8bb3be | 2012-02-13 18:05:39 +0000 | [diff] [blame] | 995 | ProgramStateRef StatePtrIsNull, StatePtrNotNull; |
| 996 | llvm::tie(StatePtrIsNull, StatePtrNotNull) = state->assume(PtrEQ); |
| 997 | ProgramStateRef StateSizeIsZero, StateSizeNotZero; |
| 998 | llvm::tie(StateSizeIsZero, StateSizeNotZero) = state->assume(SizeZero); |
| 999 | // We only assume exceptional states if they are definitely true; if the |
| 1000 | // state is under-constrained, assume regular realloc behavior. |
| 1001 | bool PrtIsNull = StatePtrIsNull && !StatePtrNotNull; |
| 1002 | bool SizeIsZero = StateSizeIsZero && !StateSizeNotZero; |
| 1003 | |
Lenny Maiorani | 4d8d803 | 2011-04-27 14:49:29 +0000 | [diff] [blame] | 1004 | // If the ptr is NULL and the size is not 0, the call is equivalent to |
| 1005 | // malloc(size). |
Anna Zaks | c8bb3be | 2012-02-13 18:05:39 +0000 | [diff] [blame] | 1006 | if ( PrtIsNull && !SizeIsZero) { |
Anna Zaks | 87cb5be | 2012-02-22 19:24:52 +0000 | [diff] [blame] | 1007 | ProgramStateRef stateMalloc = MallocMemAux(C, CE, CE->getArg(1), |
Anna Zaks | c8bb3be | 2012-02-13 18:05:39 +0000 | [diff] [blame] | 1008 | UndefinedVal(), StatePtrIsNull); |
Anna Zaks | 87cb5be | 2012-02-22 19:24:52 +0000 | [diff] [blame] | 1009 | return stateMalloc; |
Zhongxing Xu | d9c84c8 | 2009-12-12 12:29:38 +0000 | [diff] [blame] | 1010 | } |
| 1011 | |
Anna Zaks | c8bb3be | 2012-02-13 18:05:39 +0000 | [diff] [blame] | 1012 | if (PrtIsNull && SizeIsZero) |
Anna Zaks | 87cb5be | 2012-02-22 19:24:52 +0000 | [diff] [blame] | 1013 | return 0; |
Zhongxing Xu | d9c84c8 | 2009-12-12 12:29:38 +0000 | [diff] [blame] | 1014 | |
Anna Zaks | 30838b9 | 2012-02-13 20:57:07 +0000 | [diff] [blame] | 1015 | // Get the from and to pointer symbols as in toPtr = realloc(fromPtr, size). |
Anna Zaks | c8bb3be | 2012-02-13 18:05:39 +0000 | [diff] [blame] | 1016 | assert(!PrtIsNull); |
Anna Zaks | 30838b9 | 2012-02-13 20:57:07 +0000 | [diff] [blame] | 1017 | SymbolRef FromPtr = arg0Val.getAsSymbol(); |
| 1018 | SVal RetVal = state->getSVal(CE, LCtx); |
| 1019 | SymbolRef ToPtr = RetVal.getAsSymbol(); |
| 1020 | if (!FromPtr || !ToPtr) |
Anna Zaks | 87cb5be | 2012-02-22 19:24:52 +0000 | [diff] [blame] | 1021 | return 0; |
Anna Zaks | c8bb3be | 2012-02-13 18:05:39 +0000 | [diff] [blame] | 1022 | |
Anna Zaks | 55dd956 | 2012-08-24 02:28:20 +0000 | [diff] [blame] | 1023 | bool ReleasedAllocated = false; |
| 1024 | |
Anna Zaks | c8bb3be | 2012-02-13 18:05:39 +0000 | [diff] [blame] | 1025 | // If the size is 0, free the memory. |
| 1026 | if (SizeIsZero) |
Anna Zaks | 55dd956 | 2012-08-24 02:28:20 +0000 | [diff] [blame] | 1027 | if (ProgramStateRef stateFree = FreeMemAux(C, CE, StateSizeIsZero, 0, |
| 1028 | false, ReleasedAllocated)){ |
Anna Zaks | c8bb3be | 2012-02-13 18:05:39 +0000 | [diff] [blame] | 1029 | // The semantics of the return value are: |
| 1030 | // If size was equal to 0, either NULL or a pointer suitable to be passed |
Anna Zaks | ede875b | 2012-08-03 18:30:18 +0000 | [diff] [blame] | 1031 | // to free() is returned. We just free the input pointer and do not add |
| 1032 | // any constrains on the output pointer. |
Anna Zaks | 87cb5be | 2012-02-22 19:24:52 +0000 | [diff] [blame] | 1033 | return stateFree; |
Anna Zaks | c8bb3be | 2012-02-13 18:05:39 +0000 | [diff] [blame] | 1034 | } |
| 1035 | |
| 1036 | // Default behavior. |
Anna Zaks | 55dd956 | 2012-08-24 02:28:20 +0000 | [diff] [blame] | 1037 | if (ProgramStateRef stateFree = |
| 1038 | FreeMemAux(C, CE, state, 0, false, ReleasedAllocated)) { |
| 1039 | |
Anna Zaks | c8bb3be | 2012-02-13 18:05:39 +0000 | [diff] [blame] | 1040 | ProgramStateRef stateRealloc = MallocMemAux(C, CE, CE->getArg(1), |
| 1041 | UnknownVal(), stateFree); |
Anna Zaks | 30838b9 | 2012-02-13 20:57:07 +0000 | [diff] [blame] | 1042 | if (!stateRealloc) |
Anna Zaks | 87cb5be | 2012-02-22 19:24:52 +0000 | [diff] [blame] | 1043 | return 0; |
Anna Zaks | 55dd956 | 2012-08-24 02:28:20 +0000 | [diff] [blame] | 1044 | |
Anna Zaks | 9dc298b | 2012-09-12 22:57:34 +0000 | [diff] [blame] | 1045 | ReallocPairKind Kind = RPToBeFreedAfterFailure; |
| 1046 | if (FreesOnFail) |
| 1047 | Kind = RPIsFreeOnFailure; |
| 1048 | else if (!ReleasedAllocated) |
| 1049 | Kind = RPDoNotTrackAfterFailure; |
| 1050 | |
Anna Zaks | 55dd956 | 2012-08-24 02:28:20 +0000 | [diff] [blame] | 1051 | // Record the info about the reallocated symbol so that we could properly |
| 1052 | // process failed reallocation. |
Anna Zaks | 40add29 | 2012-02-15 00:11:25 +0000 | [diff] [blame] | 1053 | stateRealloc = stateRealloc->set<ReallocPairs>(ToPtr, |
Anna Zaks | 9dc298b | 2012-09-12 22:57:34 +0000 | [diff] [blame] | 1054 | ReallocPair(FromPtr, Kind)); |
Anna Zaks | 55dd956 | 2012-08-24 02:28:20 +0000 | [diff] [blame] | 1055 | // The reallocated symbol should stay alive for as long as the new symbol. |
Anna Zaks | b276bd9 | 2012-02-14 00:26:13 +0000 | [diff] [blame] | 1056 | C.getSymbolManager().addSymbolDependency(ToPtr, FromPtr); |
Anna Zaks | 87cb5be | 2012-02-22 19:24:52 +0000 | [diff] [blame] | 1057 | return stateRealloc; |
Zhongxing Xu | d9c84c8 | 2009-12-12 12:29:38 +0000 | [diff] [blame] | 1058 | } |
Anna Zaks | 87cb5be | 2012-02-22 19:24:52 +0000 | [diff] [blame] | 1059 | return 0; |
Zhongxing Xu | 589c0f2 | 2009-11-12 08:38:56 +0000 | [diff] [blame] | 1060 | } |
Zhongxing Xu | 7b76096 | 2009-11-13 07:25:27 +0000 | [diff] [blame] | 1061 | |
Anna Zaks | 87cb5be | 2012-02-22 19:24:52 +0000 | [diff] [blame] | 1062 | ProgramStateRef MallocChecker::CallocMem(CheckerContext &C, const CallExpr *CE){ |
Anna Zaks | 259052d | 2012-04-10 23:41:11 +0000 | [diff] [blame] | 1063 | if (CE->getNumArgs() < 2) |
| 1064 | return 0; |
| 1065 | |
Ted Kremenek | 8bef823 | 2012-01-26 21:29:00 +0000 | [diff] [blame] | 1066 | ProgramStateRef state = C.getState(); |
Ted Kremenek | 846eabd | 2010-12-01 21:28:31 +0000 | [diff] [blame] | 1067 | SValBuilder &svalBuilder = C.getSValBuilder(); |
Ted Kremenek | 5eca482 | 2012-01-06 22:09:28 +0000 | [diff] [blame] | 1068 | const LocationContext *LCtx = C.getLocationContext(); |
| 1069 | SVal count = state->getSVal(CE->getArg(0), LCtx); |
| 1070 | SVal elementSize = state->getSVal(CE->getArg(1), LCtx); |
Ted Kremenek | c8413fd | 2010-12-02 07:49:45 +0000 | [diff] [blame] | 1071 | SVal TotalSize = svalBuilder.evalBinOp(state, BO_Mul, count, elementSize, |
| 1072 | svalBuilder.getContext().getSizeType()); |
| 1073 | SVal zeroVal = svalBuilder.makeZeroVal(svalBuilder.getContext().CharTy); |
Zhongxing Xu | a5ce966 | 2010-06-01 03:01:33 +0000 | [diff] [blame] | 1074 | |
Anna Zaks | 87cb5be | 2012-02-22 19:24:52 +0000 | [diff] [blame] | 1075 | return MallocMemAux(C, CE, TotalSize, zeroVal, state); |
Zhongxing Xu | a5ce966 | 2010-06-01 03:01:33 +0000 | [diff] [blame] | 1076 | } |
| 1077 | |
Anna Zaks | 3d7c44e | 2012-03-21 19:45:08 +0000 | [diff] [blame] | 1078 | LeakInfo |
Anna Zaks | ca8e36e | 2012-02-23 21:38:21 +0000 | [diff] [blame] | 1079 | MallocChecker::getAllocationSite(const ExplodedNode *N, SymbolRef Sym, |
| 1080 | CheckerContext &C) const { |
Anna Zaks | 7752d29 | 2012-02-27 23:40:55 +0000 | [diff] [blame] | 1081 | const LocationContext *LeakContext = N->getLocationContext(); |
Anna Zaks | ca8e36e | 2012-02-23 21:38:21 +0000 | [diff] [blame] | 1082 | // Walk the ExplodedGraph backwards and find the first node that referred to |
| 1083 | // the tracked symbol. |
| 1084 | const ExplodedNode *AllocNode = N; |
Anna Zaks | 3d7c44e | 2012-03-21 19:45:08 +0000 | [diff] [blame] | 1085 | const MemRegion *ReferenceRegion = 0; |
Anna Zaks | ca8e36e | 2012-02-23 21:38:21 +0000 | [diff] [blame] | 1086 | |
| 1087 | while (N) { |
Anna Zaks | 3d7c44e | 2012-03-21 19:45:08 +0000 | [diff] [blame] | 1088 | ProgramStateRef State = N->getState(); |
| 1089 | if (!State->get<RegionState>(Sym)) |
Anna Zaks | ca8e36e | 2012-02-23 21:38:21 +0000 | [diff] [blame] | 1090 | break; |
Anna Zaks | 3d7c44e | 2012-03-21 19:45:08 +0000 | [diff] [blame] | 1091 | |
| 1092 | // Find the most recent expression bound to the symbol in the current |
| 1093 | // context. |
Anna Zaks | 3d7c44e | 2012-03-21 19:45:08 +0000 | [diff] [blame] | 1094 | if (!ReferenceRegion) { |
Benjamin Kramer | 850f1b1 | 2012-03-21 21:03:48 +0000 | [diff] [blame] | 1095 | if (const MemRegion *MR = C.getLocationRegionIfPostStore(N)) { |
| 1096 | SVal Val = State->getSVal(MR); |
| 1097 | if (Val.getAsLocSymbol() == Sym) |
| 1098 | ReferenceRegion = MR; |
| 1099 | } |
Anna Zaks | 3d7c44e | 2012-03-21 19:45:08 +0000 | [diff] [blame] | 1100 | } |
| 1101 | |
Anna Zaks | 7752d29 | 2012-02-27 23:40:55 +0000 | [diff] [blame] | 1102 | // Allocation node, is the last node in the current context in which the |
| 1103 | // symbol was tracked. |
| 1104 | if (N->getLocationContext() == LeakContext) |
| 1105 | AllocNode = N; |
Anna Zaks | ca8e36e | 2012-02-23 21:38:21 +0000 | [diff] [blame] | 1106 | N = N->pred_empty() ? NULL : *(N->pred_begin()); |
| 1107 | } |
| 1108 | |
Anna Zaks | 97bfb55 | 2013-01-08 00:25:29 +0000 | [diff] [blame] | 1109 | return LeakInfo(AllocNode, ReferenceRegion); |
Anna Zaks | ca8e36e | 2012-02-23 21:38:21 +0000 | [diff] [blame] | 1110 | } |
| 1111 | |
Anna Zaks | da04677 | 2012-02-11 21:02:40 +0000 | [diff] [blame] | 1112 | void MallocChecker::reportLeak(SymbolRef Sym, ExplodedNode *N, |
| 1113 | CheckerContext &C) const { |
| 1114 | assert(N); |
| 1115 | if (!BT_Leak) { |
Anna Zaks | febdc32 | 2012-02-16 22:26:12 +0000 | [diff] [blame] | 1116 | BT_Leak.reset(new BugType("Memory leak", "Memory Error")); |
Anna Zaks | da04677 | 2012-02-11 21:02:40 +0000 | [diff] [blame] | 1117 | // Leaks should not be reported if they are post-dominated by a sink: |
| 1118 | // (1) Sinks are higher importance bugs. |
| 1119 | // (2) NoReturnFunctionChecker uses sink nodes to represent paths ending |
| 1120 | // with __noreturn functions such as assert() or exit(). We choose not |
| 1121 | // to report leaks on such paths. |
| 1122 | BT_Leak->setSuppressOnSink(true); |
| 1123 | } |
| 1124 | |
Anna Zaks | ca8e36e | 2012-02-23 21:38:21 +0000 | [diff] [blame] | 1125 | // Most bug reports are cached at the location where they occurred. |
| 1126 | // With leaks, we want to unique them by the location where they were |
| 1127 | // allocated, and only report a single path. |
Anna Zaks | 7752d29 | 2012-02-27 23:40:55 +0000 | [diff] [blame] | 1128 | PathDiagnosticLocation LocUsedForUniqueing; |
Anna Zaks | 97bfb55 | 2013-01-08 00:25:29 +0000 | [diff] [blame] | 1129 | const ExplodedNode *AllocNode = 0; |
Anna Zaks | 3d7c44e | 2012-03-21 19:45:08 +0000 | [diff] [blame] | 1130 | const MemRegion *Region = 0; |
Anna Zaks | 97bfb55 | 2013-01-08 00:25:29 +0000 | [diff] [blame] | 1131 | llvm::tie(AllocNode, Region) = getAllocationSite(N, Sym, C); |
| 1132 | |
| 1133 | ProgramPoint P = AllocNode->getLocation(); |
| 1134 | const Stmt *AllocationStmt = 0; |
David Blaikie | 7a95de6 | 2013-02-21 22:23:56 +0000 | [diff] [blame] | 1135 | if (Optional<CallExitEnd> Exit = P.getAs<CallExitEnd>()) |
Anna Zaks | 97bfb55 | 2013-01-08 00:25:29 +0000 | [diff] [blame] | 1136 | AllocationStmt = Exit->getCalleeContext()->getCallSite(); |
David Blaikie | 7a95de6 | 2013-02-21 22:23:56 +0000 | [diff] [blame] | 1137 | else if (Optional<StmtPoint> SP = P.getAs<StmtPoint>()) |
Anna Zaks | 97bfb55 | 2013-01-08 00:25:29 +0000 | [diff] [blame] | 1138 | AllocationStmt = SP->getStmt(); |
| 1139 | if (AllocationStmt) |
| 1140 | LocUsedForUniqueing = PathDiagnosticLocation::createBegin(AllocationStmt, |
| 1141 | C.getSourceManager(), |
| 1142 | AllocNode->getLocationContext()); |
Anna Zaks | ca8e36e | 2012-02-23 21:38:21 +0000 | [diff] [blame] | 1143 | |
Anna Zaks | 3d7c44e | 2012-03-21 19:45:08 +0000 | [diff] [blame] | 1144 | SmallString<200> buf; |
| 1145 | llvm::raw_svector_ostream os(buf); |
| 1146 | os << "Memory is never released; potential leak"; |
Jordan Rose | 919e8a1 | 2012-08-08 18:23:36 +0000 | [diff] [blame] | 1147 | if (Region && Region->canPrintPretty()) { |
Anna Zaks | 3d7c44e | 2012-03-21 19:45:08 +0000 | [diff] [blame] | 1148 | os << " of memory pointed to by '"; |
Jordan Rose | 919e8a1 | 2012-08-08 18:23:36 +0000 | [diff] [blame] | 1149 | Region->printPretty(os); |
Jordan Rose | 0d53ab4 | 2012-08-08 18:23:31 +0000 | [diff] [blame] | 1150 | os << '\''; |
Anna Zaks | 3d7c44e | 2012-03-21 19:45:08 +0000 | [diff] [blame] | 1151 | } |
| 1152 | |
Anna Zaks | 97bfb55 | 2013-01-08 00:25:29 +0000 | [diff] [blame] | 1153 | BugReport *R = new BugReport(*BT_Leak, os.str(), N, |
| 1154 | LocUsedForUniqueing, |
| 1155 | AllocNode->getLocationContext()->getDecl()); |
Ted Kremenek | 76aadc3 | 2012-03-09 01:13:14 +0000 | [diff] [blame] | 1156 | R->markInteresting(Sym); |
Anna Zaks | 88feba0 | 2012-05-10 01:37:40 +0000 | [diff] [blame] | 1157 | R->addVisitor(new MallocBugVisitor(Sym, true)); |
Jordan Rose | 785950e | 2012-11-02 01:53:40 +0000 | [diff] [blame] | 1158 | C.emitReport(R); |
Anna Zaks | da04677 | 2012-02-11 21:02:40 +0000 | [diff] [blame] | 1159 | } |
| 1160 | |
Argyrios Kyrtzidis | 312dbec | 2011-02-28 01:26:35 +0000 | [diff] [blame] | 1161 | void MallocChecker::checkDeadSymbols(SymbolReaper &SymReaper, |
| 1162 | CheckerContext &C) const |
Ted Kremenek | c8413fd | 2010-12-02 07:49:45 +0000 | [diff] [blame] | 1163 | { |
Zhongxing Xu | 173ff56 | 2010-08-15 08:19:57 +0000 | [diff] [blame] | 1164 | if (!SymReaper.hasDeadSymbols()) |
| 1165 | return; |
Zhongxing Xu | fc7ac8f | 2009-11-13 07:48:11 +0000 | [diff] [blame] | 1166 | |
Ted Kremenek | 8bef823 | 2012-01-26 21:29:00 +0000 | [diff] [blame] | 1167 | ProgramStateRef state = C.getState(); |
Zhongxing Xu | 173ff56 | 2010-08-15 08:19:57 +0000 | [diff] [blame] | 1168 | RegionStateTy RS = state->get<RegionState>(); |
Jordy Rose | 9076014 | 2010-08-18 04:33:47 +0000 | [diff] [blame] | 1169 | RegionStateTy::Factory &F = state->get_context<RegionState>(); |
Zhongxing Xu | 173ff56 | 2010-08-15 08:19:57 +0000 | [diff] [blame] | 1170 | |
Dmitri Gribenko | cfa88f8 | 2013-01-12 19:30:44 +0000 | [diff] [blame] | 1171 | SmallVector<SymbolRef, 2> Errors; |
Zhongxing Xu | 173ff56 | 2010-08-15 08:19:57 +0000 | [diff] [blame] | 1172 | for (RegionStateTy::iterator I = RS.begin(), E = RS.end(); I != E; ++I) { |
| 1173 | if (SymReaper.isDead(I->first)) { |
Anna Zaks | 5445870 | 2012-10-29 22:51:54 +0000 | [diff] [blame] | 1174 | if (I->second.isAllocated()) |
Anna Zaks | f8c17b7 | 2012-02-09 06:48:19 +0000 | [diff] [blame] | 1175 | Errors.push_back(I->first); |
Jordy Rose | 9076014 | 2010-08-18 04:33:47 +0000 | [diff] [blame] | 1176 | // Remove the dead symbol from the map. |
Ted Kremenek | 3baf672 | 2010-11-24 00:54:37 +0000 | [diff] [blame] | 1177 | RS = F.remove(RS, I->first); |
Ted Kremenek | 217470e | 2011-07-28 23:07:51 +0000 | [diff] [blame] | 1178 | |
Zhongxing Xu | fc7ac8f | 2009-11-13 07:48:11 +0000 | [diff] [blame] | 1179 | } |
| 1180 | } |
Ted Kremenek | 217470e | 2011-07-28 23:07:51 +0000 | [diff] [blame] | 1181 | |
Anna Zaks | c8bb3be | 2012-02-13 18:05:39 +0000 | [diff] [blame] | 1182 | // Cleanup the Realloc Pairs Map. |
Jordan Rose | 166d502 | 2012-11-02 01:54:06 +0000 | [diff] [blame] | 1183 | ReallocPairsTy RP = state->get<ReallocPairs>(); |
| 1184 | for (ReallocPairsTy::iterator I = RP.begin(), E = RP.end(); I != E; ++I) { |
Anna Zaks | 40add29 | 2012-02-15 00:11:25 +0000 | [diff] [blame] | 1185 | if (SymReaper.isDead(I->first) || |
| 1186 | SymReaper.isDead(I->second.ReallocatedSym)) { |
Anna Zaks | c8bb3be | 2012-02-13 18:05:39 +0000 | [diff] [blame] | 1187 | state = state->remove<ReallocPairs>(I->first); |
| 1188 | } |
| 1189 | } |
| 1190 | |
Anna Zaks | 4141e4d | 2012-11-13 03:18:01 +0000 | [diff] [blame] | 1191 | // Cleanup the FreeReturnValue Map. |
| 1192 | FreeReturnValueTy FR = state->get<FreeReturnValue>(); |
| 1193 | for (FreeReturnValueTy::iterator I = FR.begin(), E = FR.end(); I != E; ++I) { |
| 1194 | if (SymReaper.isDead(I->first) || |
| 1195 | SymReaper.isDead(I->second)) { |
| 1196 | state = state->remove<FreeReturnValue>(I->first); |
| 1197 | } |
| 1198 | } |
| 1199 | |
Anna Zaks | ca8e36e | 2012-02-23 21:38:21 +0000 | [diff] [blame] | 1200 | // Generate leak node. |
Anna Zaks | 5445870 | 2012-10-29 22:51:54 +0000 | [diff] [blame] | 1201 | ExplodedNode *N = C.getPredecessor(); |
| 1202 | if (!Errors.empty()) { |
| 1203 | static SimpleProgramPointTag Tag("MallocChecker : DeadSymbolsLeak"); |
| 1204 | N = C.addTransition(C.getState(), C.getPredecessor(), &Tag); |
Dmitri Gribenko | cfa88f8 | 2013-01-12 19:30:44 +0000 | [diff] [blame] | 1205 | for (SmallVector<SymbolRef, 2>::iterator |
Anna Zaks | 5445870 | 2012-10-29 22:51:54 +0000 | [diff] [blame] | 1206 | I = Errors.begin(), E = Errors.end(); I != E; ++I) { |
Anna Zaks | da04677 | 2012-02-11 21:02:40 +0000 | [diff] [blame] | 1207 | reportLeak(*I, N, C); |
Anna Zaks | f8c17b7 | 2012-02-09 06:48:19 +0000 | [diff] [blame] | 1208 | } |
Ted Kremenek | 217470e | 2011-07-28 23:07:51 +0000 | [diff] [blame] | 1209 | } |
Anna Zaks | 5445870 | 2012-10-29 22:51:54 +0000 | [diff] [blame] | 1210 | |
Anna Zaks | ca8e36e | 2012-02-23 21:38:21 +0000 | [diff] [blame] | 1211 | C.addTransition(state->set<RegionState>(RS), N); |
Zhongxing Xu | 7b76096 | 2009-11-13 07:25:27 +0000 | [diff] [blame] | 1212 | } |
Zhongxing Xu | 243fde9 | 2009-11-17 07:54:15 +0000 | [diff] [blame] | 1213 | |
Anna Zaks | 66c4040 | 2012-02-14 21:55:24 +0000 | [diff] [blame] | 1214 | void MallocChecker::checkPreStmt(const CallExpr *CE, CheckerContext &C) const { |
Anna Zaks | 1434518 | 2012-05-18 01:16:10 +0000 | [diff] [blame] | 1215 | // We will check for double free in the post visit. |
| 1216 | if (isFreeFunction(C.getCalleeDecl(CE), C.getASTContext())) |
Anna Zaks | 66c4040 | 2012-02-14 21:55:24 +0000 | [diff] [blame] | 1217 | return; |
| 1218 | |
| 1219 | // Check use after free, when a freed pointer is passed to a call. |
| 1220 | ProgramStateRef State = C.getState(); |
| 1221 | for (CallExpr::const_arg_iterator I = CE->arg_begin(), |
| 1222 | E = CE->arg_end(); I != E; ++I) { |
| 1223 | const Expr *A = *I; |
| 1224 | if (A->getType().getTypePtr()->isAnyPointerType()) { |
| 1225 | SymbolRef Sym = State->getSVal(A, C.getLocationContext()).getAsSymbol(); |
| 1226 | if (!Sym) |
| 1227 | continue; |
| 1228 | if (checkUseAfterFree(Sym, C, A)) |
| 1229 | return; |
| 1230 | } |
| 1231 | } |
| 1232 | } |
| 1233 | |
Anna Zaks | 91c2a11 | 2012-02-08 23:16:56 +0000 | [diff] [blame] | 1234 | void MallocChecker::checkPreStmt(const ReturnStmt *S, CheckerContext &C) const { |
| 1235 | const Expr *E = S->getRetValue(); |
| 1236 | if (!E) |
| 1237 | return; |
Anna Zaks | 0860cd0 | 2012-02-11 21:44:39 +0000 | [diff] [blame] | 1238 | |
| 1239 | // Check if we are returning a symbol. |
Jordan Rose | 0d53ab4 | 2012-08-08 18:23:31 +0000 | [diff] [blame] | 1240 | ProgramStateRef State = C.getState(); |
| 1241 | SVal RetVal = State->getSVal(E, C.getLocationContext()); |
Anna Zaks | d9ab7bb | 2012-02-22 02:36:01 +0000 | [diff] [blame] | 1242 | SymbolRef Sym = RetVal.getAsSymbol(); |
| 1243 | if (!Sym) |
| 1244 | // If we are returning a field of the allocated struct or an array element, |
| 1245 | // the callee could still free the memory. |
| 1246 | // TODO: This logic should be a part of generic symbol escape callback. |
| 1247 | if (const MemRegion *MR = RetVal.getAsRegion()) |
| 1248 | if (isa<FieldRegion>(MR) || isa<ElementRegion>(MR)) |
| 1249 | if (const SymbolicRegion *BMR = |
| 1250 | dyn_cast<SymbolicRegion>(MR->getBaseRegion())) |
| 1251 | Sym = BMR->getSymbol(); |
Zhongxing Xu | 4985e3e | 2009-11-17 08:58:18 +0000 | [diff] [blame] | 1252 | |
Anna Zaks | 0860cd0 | 2012-02-11 21:44:39 +0000 | [diff] [blame] | 1253 | // Check if we are returning freed memory. |
Jordan Rose | 0d53ab4 | 2012-08-08 18:23:31 +0000 | [diff] [blame] | 1254 | if (Sym) |
Jordan Rose | 65d4bd6 | 2012-11-15 19:11:33 +0000 | [diff] [blame] | 1255 | checkUseAfterFree(Sym, C, E); |
Zhongxing Xu | 4985e3e | 2009-11-17 08:58:18 +0000 | [diff] [blame] | 1256 | } |
Zhongxing Xu | b94b81a | 2009-12-31 06:13:07 +0000 | [diff] [blame] | 1257 | |
Anna Zaks | f5aa3f5 | 2012-03-22 00:57:20 +0000 | [diff] [blame] | 1258 | // TODO: Blocks should be either inlined or should call invalidate regions |
| 1259 | // upon invocation. After that's in place, special casing here will not be |
| 1260 | // needed. |
| 1261 | void MallocChecker::checkPostStmt(const BlockExpr *BE, |
| 1262 | CheckerContext &C) const { |
| 1263 | |
| 1264 | // Scan the BlockDecRefExprs for any object the retain count checker |
| 1265 | // may be tracking. |
| 1266 | if (!BE->getBlockDecl()->hasCaptures()) |
| 1267 | return; |
| 1268 | |
| 1269 | ProgramStateRef state = C.getState(); |
| 1270 | const BlockDataRegion *R = |
| 1271 | cast<BlockDataRegion>(state->getSVal(BE, |
| 1272 | C.getLocationContext()).getAsRegion()); |
| 1273 | |
| 1274 | BlockDataRegion::referenced_vars_iterator I = R->referenced_vars_begin(), |
| 1275 | E = R->referenced_vars_end(); |
| 1276 | |
| 1277 | if (I == E) |
| 1278 | return; |
| 1279 | |
| 1280 | SmallVector<const MemRegion*, 10> Regions; |
| 1281 | const LocationContext *LC = C.getLocationContext(); |
| 1282 | MemRegionManager &MemMgr = C.getSValBuilder().getRegionManager(); |
| 1283 | |
| 1284 | for ( ; I != E; ++I) { |
Ted Kremenek | e3ce2c1 | 2012-12-06 07:17:20 +0000 | [diff] [blame] | 1285 | const VarRegion *VR = I.getCapturedRegion(); |
Anna Zaks | f5aa3f5 | 2012-03-22 00:57:20 +0000 | [diff] [blame] | 1286 | if (VR->getSuperRegion() == R) { |
| 1287 | VR = MemMgr.getVarRegion(VR->getDecl(), LC); |
| 1288 | } |
| 1289 | Regions.push_back(VR); |
| 1290 | } |
| 1291 | |
| 1292 | state = |
| 1293 | state->scanReachableSymbols<StopTrackingCallback>(Regions.data(), |
| 1294 | Regions.data() + Regions.size()).getState(); |
| 1295 | C.addTransition(state); |
| 1296 | } |
| 1297 | |
Anna Zaks | 1434518 | 2012-05-18 01:16:10 +0000 | [diff] [blame] | 1298 | bool MallocChecker::isReleased(SymbolRef Sym, CheckerContext &C) const { |
Anna Zaks | 91c2a11 | 2012-02-08 23:16:56 +0000 | [diff] [blame] | 1299 | assert(Sym); |
| 1300 | const RefState *RS = C.getState()->get<RegionState>(Sym); |
Anna Zaks | 1434518 | 2012-05-18 01:16:10 +0000 | [diff] [blame] | 1301 | return (RS && RS->isReleased()); |
| 1302 | } |
| 1303 | |
| 1304 | bool MallocChecker::checkUseAfterFree(SymbolRef Sym, CheckerContext &C, |
| 1305 | const Stmt *S) const { |
| 1306 | if (isReleased(Sym, C)) { |
Anna Zaks | 15d0ae1 | 2012-02-11 23:46:36 +0000 | [diff] [blame] | 1307 | if (ExplodedNode *N = C.generateSink()) { |
Anna Zaks | 91c2a11 | 2012-02-08 23:16:56 +0000 | [diff] [blame] | 1308 | if (!BT_UseFree) |
Anna Zaks | febdc32 | 2012-02-16 22:26:12 +0000 | [diff] [blame] | 1309 | BT_UseFree.reset(new BugType("Use-after-free", "Memory Error")); |
Anna Zaks | 91c2a11 | 2012-02-08 23:16:56 +0000 | [diff] [blame] | 1310 | |
Anna Zaks | febdc32 | 2012-02-16 22:26:12 +0000 | [diff] [blame] | 1311 | BugReport *R = new BugReport(*BT_UseFree, |
| 1312 | "Use of memory after it is freed",N); |
Anna Zaks | 91c2a11 | 2012-02-08 23:16:56 +0000 | [diff] [blame] | 1313 | if (S) |
| 1314 | R->addRange(S->getSourceRange()); |
Ted Kremenek | 76aadc3 | 2012-03-09 01:13:14 +0000 | [diff] [blame] | 1315 | R->markInteresting(Sym); |
Anna Zaks | ff3b9fd | 2012-02-09 06:25:51 +0000 | [diff] [blame] | 1316 | R->addVisitor(new MallocBugVisitor(Sym)); |
Jordan Rose | 785950e | 2012-11-02 01:53:40 +0000 | [diff] [blame] | 1317 | C.emitReport(R); |
Anna Zaks | 91c2a11 | 2012-02-08 23:16:56 +0000 | [diff] [blame] | 1318 | return true; |
| 1319 | } |
| 1320 | } |
| 1321 | return false; |
| 1322 | } |
| 1323 | |
Zhongxing Xu | c802378 | 2010-03-10 04:58:55 +0000 | [diff] [blame] | 1324 | // Check if the location is a freed symbolic region. |
Anna Zaks | 390909c | 2011-10-06 00:43:15 +0000 | [diff] [blame] | 1325 | void MallocChecker::checkLocation(SVal l, bool isLoad, const Stmt *S, |
| 1326 | CheckerContext &C) const { |
Zhongxing Xu | c802378 | 2010-03-10 04:58:55 +0000 | [diff] [blame] | 1327 | SymbolRef Sym = l.getLocSymbolInBase(); |
Anna Zaks | 91c2a11 | 2012-02-08 23:16:56 +0000 | [diff] [blame] | 1328 | if (Sym) |
Anna Zaks | 1434518 | 2012-05-18 01:16:10 +0000 | [diff] [blame] | 1329 | checkUseAfterFree(Sym, C, S); |
Zhongxing Xu | c802378 | 2010-03-10 04:58:55 +0000 | [diff] [blame] | 1330 | } |
Ted Kremenek | dd0e490 | 2010-07-31 01:52:11 +0000 | [diff] [blame] | 1331 | |
Anna Zaks | 4fb5487 | 2012-02-11 21:02:35 +0000 | [diff] [blame] | 1332 | // If a symbolic region is assumed to NULL (or another constant), stop tracking |
| 1333 | // it - assuming that allocation failed on this path. |
| 1334 | ProgramStateRef MallocChecker::evalAssume(ProgramStateRef state, |
| 1335 | SVal Cond, |
| 1336 | bool Assumption) const { |
| 1337 | RegionStateTy RS = state->get<RegionState>(); |
Anna Zaks | 4fb5487 | 2012-02-11 21:02:35 +0000 | [diff] [blame] | 1338 | for (RegionStateTy::iterator I = RS.begin(), E = RS.end(); I != E; ++I) { |
Ted Kremenek | 47cbd0f | 2012-09-07 22:31:01 +0000 | [diff] [blame] | 1339 | // If the symbol is assumed to be NULL, remove it from consideration. |
Jordan Rose | ec8d420 | 2012-11-01 00:18:27 +0000 | [diff] [blame] | 1340 | ConstraintManager &CMgr = state->getConstraintManager(); |
| 1341 | ConditionTruthVal AllocFailed = CMgr.isNull(state, I.getKey()); |
| 1342 | if (AllocFailed.isConstrainedTrue()) |
Anna Zaks | 4fb5487 | 2012-02-11 21:02:35 +0000 | [diff] [blame] | 1343 | state = state->remove<RegionState>(I.getKey()); |
| 1344 | } |
| 1345 | |
Anna Zaks | c8bb3be | 2012-02-13 18:05:39 +0000 | [diff] [blame] | 1346 | // Realloc returns 0 when reallocation fails, which means that we should |
| 1347 | // restore the state of the pointer being reallocated. |
Jordan Rose | 166d502 | 2012-11-02 01:54:06 +0000 | [diff] [blame] | 1348 | ReallocPairsTy RP = state->get<ReallocPairs>(); |
| 1349 | for (ReallocPairsTy::iterator I = RP.begin(), E = RP.end(); I != E; ++I) { |
Ted Kremenek | 47cbd0f | 2012-09-07 22:31:01 +0000 | [diff] [blame] | 1350 | // If the symbol is assumed to be NULL, remove it from consideration. |
Jordan Rose | ec8d420 | 2012-11-01 00:18:27 +0000 | [diff] [blame] | 1351 | ConstraintManager &CMgr = state->getConstraintManager(); |
| 1352 | ConditionTruthVal AllocFailed = CMgr.isNull(state, I.getKey()); |
Jordan Rose | 79a29eb | 2012-11-01 00:25:15 +0000 | [diff] [blame] | 1353 | if (!AllocFailed.isConstrainedTrue()) |
Anna Zaks | 9dc298b | 2012-09-12 22:57:34 +0000 | [diff] [blame] | 1354 | continue; |
Jordan Rose | ec8d420 | 2012-11-01 00:18:27 +0000 | [diff] [blame] | 1355 | |
Anna Zaks | 9dc298b | 2012-09-12 22:57:34 +0000 | [diff] [blame] | 1356 | SymbolRef ReallocSym = I.getData().ReallocatedSym; |
| 1357 | if (const RefState *RS = state->get<RegionState>(ReallocSym)) { |
| 1358 | if (RS->isReleased()) { |
| 1359 | if (I.getData().Kind == RPToBeFreedAfterFailure) |
Anna Zaks | 40add29 | 2012-02-15 00:11:25 +0000 | [diff] [blame] | 1360 | state = state->set<RegionState>(ReallocSym, |
Anna Zaks | 9dc298b | 2012-09-12 22:57:34 +0000 | [diff] [blame] | 1361 | RefState::getAllocated(RS->getStmt())); |
| 1362 | else if (I.getData().Kind == RPDoNotTrackAfterFailure) |
| 1363 | state = state->remove<RegionState>(ReallocSym); |
| 1364 | else |
| 1365 | assert(I.getData().Kind == RPIsFreeOnFailure); |
Anna Zaks | c8bb3be | 2012-02-13 18:05:39 +0000 | [diff] [blame] | 1366 | } |
Anna Zaks | c8bb3be | 2012-02-13 18:05:39 +0000 | [diff] [blame] | 1367 | } |
Anna Zaks | 9dc298b | 2012-09-12 22:57:34 +0000 | [diff] [blame] | 1368 | state = state->remove<ReallocPairs>(I.getKey()); |
Anna Zaks | c8bb3be | 2012-02-13 18:05:39 +0000 | [diff] [blame] | 1369 | } |
| 1370 | |
Anna Zaks | 4fb5487 | 2012-02-11 21:02:35 +0000 | [diff] [blame] | 1371 | return state; |
| 1372 | } |
| 1373 | |
Jordan Rose | 9fe09f3 | 2013-03-09 00:59:10 +0000 | [diff] [blame^] | 1374 | bool MallocChecker::doesNotFreeMemOrInteresting(const CallEvent *Call, |
| 1375 | ProgramStateRef State) const { |
Jordan Rose | 85d7e01 | 2012-07-02 19:27:51 +0000 | [diff] [blame] | 1376 | assert(Call); |
Anna Zaks | 3cd89ad | 2012-02-24 23:56:53 +0000 | [diff] [blame] | 1377 | |
| 1378 | // For now, assume that any C++ call can free memory. |
| 1379 | // TODO: If we want to be more optimistic here, we'll need to make sure that |
| 1380 | // regions escape to C++ containers. They seem to do that even now, but for |
| 1381 | // mysterious reasons. |
Jordan Rose | cde8cdb | 2012-07-02 19:27:56 +0000 | [diff] [blame] | 1382 | if (!(isa<FunctionCall>(Call) || isa<ObjCMethodCall>(Call))) |
Anna Zaks | 3cd89ad | 2012-02-24 23:56:53 +0000 | [diff] [blame] | 1383 | return false; |
| 1384 | |
Jordan Rose | 740d490 | 2012-07-02 19:27:35 +0000 | [diff] [blame] | 1385 | // Check Objective-C messages by selector name. |
Jordan Rose | cde8cdb | 2012-07-02 19:27:56 +0000 | [diff] [blame] | 1386 | if (const ObjCMethodCall *Msg = dyn_cast<ObjCMethodCall>(Call)) { |
Jordan Rose | 85d7e01 | 2012-07-02 19:27:51 +0000 | [diff] [blame] | 1387 | // If it's not a framework call, or if it takes a callback, assume it |
| 1388 | // can free memory. |
| 1389 | if (!Call->isInSystemHeader() || Call->hasNonZeroCallbackArg()) |
Anna Zaks | 07d39a4 | 2012-02-28 01:54:22 +0000 | [diff] [blame] | 1390 | return false; |
| 1391 | |
Jordan Rose | 9fe09f3 | 2013-03-09 00:59:10 +0000 | [diff] [blame^] | 1392 | // If it's a method we know about, handle it explicitly post-call. |
| 1393 | // This should happen before the "freeWhenDone" check below. |
| 1394 | if (isKnownDeallocObjCMethodName(*Msg)) |
| 1395 | return true; |
Anna Zaks | 52a0481 | 2012-06-20 23:35:57 +0000 | [diff] [blame] | 1396 | |
Jordan Rose | 9fe09f3 | 2013-03-09 00:59:10 +0000 | [diff] [blame^] | 1397 | // If there's a "freeWhenDone" parameter, but the method isn't one we know |
| 1398 | // about, we can't be sure that the object will use free() to deallocate the |
| 1399 | // memory, so we can't model it explicitly. The best we can do is use it to |
| 1400 | // decide whether the pointer escapes. |
| 1401 | if (Optional<bool> FreeWhenDone = getFreeWhenDoneArg(*Msg)) |
| 1402 | return !*FreeWhenDone; |
Anna Zaks | 3cd89ad | 2012-02-24 23:56:53 +0000 | [diff] [blame] | 1403 | |
Jordan Rose | 9fe09f3 | 2013-03-09 00:59:10 +0000 | [diff] [blame^] | 1404 | // If the first selector piece ends with "NoCopy", and there is no |
| 1405 | // "freeWhenDone" parameter set to zero, we know ownership is being |
| 1406 | // transferred. Again, though, we can't be sure that the object will use |
| 1407 | // free() to deallocate the memory, so we can't model it explicitly. |
| 1408 | StringRef FirstSlot = Msg->getSelector().getNameForSlot(0); |
Jordan Rose | 740d490 | 2012-07-02 19:27:35 +0000 | [diff] [blame] | 1409 | if (FirstSlot.endswith("NoCopy")) |
Anna Zaks | fb7f76f | 2012-03-05 17:42:10 +0000 | [diff] [blame] | 1410 | return false; |
Anna Zaks | fb7f76f | 2012-03-05 17:42:10 +0000 | [diff] [blame] | 1411 | |
Anna Zaks | 5f75768 | 2012-06-19 05:10:32 +0000 | [diff] [blame] | 1412 | // If the first selector starts with addPointer, insertPointer, |
| 1413 | // or replacePointer, assume we are dealing with NSPointerArray or similar. |
| 1414 | // This is similar to C++ containers (vector); we still might want to check |
Jordan Rose | 740d490 | 2012-07-02 19:27:35 +0000 | [diff] [blame] | 1415 | // that the pointers get freed by following the container itself. |
| 1416 | if (FirstSlot.startswith("addPointer") || |
| 1417 | FirstSlot.startswith("insertPointer") || |
| 1418 | FirstSlot.startswith("replacePointer")) { |
Anna Zaks | 5f75768 | 2012-06-19 05:10:32 +0000 | [diff] [blame] | 1419 | return false; |
| 1420 | } |
| 1421 | |
Jordan Rose | 740d490 | 2012-07-02 19:27:35 +0000 | [diff] [blame] | 1422 | // Otherwise, assume that the method does not free memory. |
| 1423 | // Most framework methods do not free memory. |
Anna Zaks | 3cd89ad | 2012-02-24 23:56:53 +0000 | [diff] [blame] | 1424 | return true; |
Anna Zaks | 66c4040 | 2012-02-14 21:55:24 +0000 | [diff] [blame] | 1425 | } |
| 1426 | |
Jordan Rose | 740d490 | 2012-07-02 19:27:35 +0000 | [diff] [blame] | 1427 | // At this point the only thing left to handle is straight function calls. |
| 1428 | const FunctionDecl *FD = cast<FunctionCall>(Call)->getDecl(); |
| 1429 | if (!FD) |
| 1430 | return false; |
Anna Zaks | 3cd89ad | 2012-02-24 23:56:53 +0000 | [diff] [blame] | 1431 | |
Jordan Rose | 740d490 | 2012-07-02 19:27:35 +0000 | [diff] [blame] | 1432 | ASTContext &ASTC = State->getStateManager().getContext(); |
| 1433 | |
| 1434 | // If it's one of the allocation functions we can reason about, we model |
| 1435 | // its behavior explicitly. |
| 1436 | if (isMemFunction(FD, ASTC)) |
| 1437 | return true; |
| 1438 | |
| 1439 | // If it's not a system call, assume it frees memory. |
| 1440 | if (!Call->isInSystemHeader()) |
| 1441 | return false; |
| 1442 | |
| 1443 | // White list the system functions whose arguments escape. |
| 1444 | const IdentifierInfo *II = FD->getIdentifier(); |
| 1445 | if (!II) |
| 1446 | return false; |
| 1447 | StringRef FName = II->getName(); |
| 1448 | |
Jordan Rose | 740d490 | 2012-07-02 19:27:35 +0000 | [diff] [blame] | 1449 | // White list the 'XXXNoCopy' CoreFoundation functions. |
Jordan Rose | 85d7e01 | 2012-07-02 19:27:51 +0000 | [diff] [blame] | 1450 | // We specifically check these before |
Jordan Rose | 740d490 | 2012-07-02 19:27:35 +0000 | [diff] [blame] | 1451 | if (FName.endswith("NoCopy")) { |
| 1452 | // Look for the deallocator argument. We know that the memory ownership |
| 1453 | // is not transferred only if the deallocator argument is |
| 1454 | // 'kCFAllocatorNull'. |
| 1455 | for (unsigned i = 1; i < Call->getNumArgs(); ++i) { |
| 1456 | const Expr *ArgE = Call->getArgExpr(i)->IgnoreParenCasts(); |
| 1457 | if (const DeclRefExpr *DE = dyn_cast<DeclRefExpr>(ArgE)) { |
| 1458 | StringRef DeallocatorName = DE->getFoundDecl()->getName(); |
| 1459 | if (DeallocatorName == "kCFAllocatorNull") |
| 1460 | return true; |
| 1461 | } |
| 1462 | } |
| 1463 | return false; |
| 1464 | } |
| 1465 | |
Jordan Rose | 740d490 | 2012-07-02 19:27:35 +0000 | [diff] [blame] | 1466 | // Associating streams with malloced buffers. The pointer can escape if |
Jordan Rose | 85d7e01 | 2012-07-02 19:27:51 +0000 | [diff] [blame] | 1467 | // 'closefn' is specified (and if that function does free memory), |
| 1468 | // but it will not if closefn is not specified. |
Jordan Rose | 740d490 | 2012-07-02 19:27:35 +0000 | [diff] [blame] | 1469 | // Currently, we do not inspect the 'closefn' function (PR12101). |
| 1470 | if (FName == "funopen") |
Jordan Rose | 85d7e01 | 2012-07-02 19:27:51 +0000 | [diff] [blame] | 1471 | if (Call->getNumArgs() >= 4 && Call->getArgSVal(4).isConstant(0)) |
| 1472 | return true; |
Jordan Rose | 740d490 | 2012-07-02 19:27:35 +0000 | [diff] [blame] | 1473 | |
| 1474 | // Do not warn on pointers passed to 'setbuf' when used with std streams, |
| 1475 | // these leaks might be intentional when setting the buffer for stdio. |
| 1476 | // http://stackoverflow.com/questions/2671151/who-frees-setvbuf-buffer |
| 1477 | if (FName == "setbuf" || FName =="setbuffer" || |
| 1478 | FName == "setlinebuf" || FName == "setvbuf") { |
| 1479 | if (Call->getNumArgs() >= 1) { |
| 1480 | const Expr *ArgE = Call->getArgExpr(0)->IgnoreParenCasts(); |
| 1481 | if (const DeclRefExpr *ArgDRE = dyn_cast<DeclRefExpr>(ArgE)) |
| 1482 | if (const VarDecl *D = dyn_cast<VarDecl>(ArgDRE->getDecl())) |
| 1483 | if (D->getCanonicalDecl()->getName().find("std") != StringRef::npos) |
| 1484 | return false; |
| 1485 | } |
| 1486 | } |
| 1487 | |
| 1488 | // A bunch of other functions which either take ownership of a pointer or |
| 1489 | // wrap the result up in a struct or object, meaning it can be freed later. |
| 1490 | // (See RetainCountChecker.) Not all the parameters here are invalidated, |
| 1491 | // but the Malloc checker cannot differentiate between them. The right way |
| 1492 | // of doing this would be to implement a pointer escapes callback. |
| 1493 | if (FName == "CGBitmapContextCreate" || |
| 1494 | FName == "CGBitmapContextCreateWithData" || |
| 1495 | FName == "CVPixelBufferCreateWithBytes" || |
| 1496 | FName == "CVPixelBufferCreateWithPlanarBytes" || |
| 1497 | FName == "OSAtomicEnqueue") { |
| 1498 | return false; |
| 1499 | } |
| 1500 | |
Jordan Rose | 85d7e01 | 2012-07-02 19:27:51 +0000 | [diff] [blame] | 1501 | // Handle cases where we know a buffer's /address/ can escape. |
| 1502 | // Note that the above checks handle some special cases where we know that |
| 1503 | // even though the address escapes, it's still our responsibility to free the |
| 1504 | // buffer. |
| 1505 | if (Call->argumentsMayEscape()) |
Jordan Rose | 740d490 | 2012-07-02 19:27:35 +0000 | [diff] [blame] | 1506 | return false; |
| 1507 | |
| 1508 | // Otherwise, assume that the function does not free memory. |
| 1509 | // Most system calls do not free the memory. |
| 1510 | return true; |
Anna Zaks | 66c4040 | 2012-02-14 21:55:24 +0000 | [diff] [blame] | 1511 | } |
| 1512 | |
Anna Zaks | bf53dfa | 2012-12-20 00:38:25 +0000 | [diff] [blame] | 1513 | ProgramStateRef MallocChecker::checkPointerEscape(ProgramStateRef State, |
| 1514 | const InvalidatedSymbols &Escaped, |
Anna Zaks | 233e26a | 2013-02-07 23:05:43 +0000 | [diff] [blame] | 1515 | const CallEvent *Call, |
| 1516 | PointerEscapeKind Kind) const { |
Jordan Rose | 9fe09f3 | 2013-03-09 00:59:10 +0000 | [diff] [blame^] | 1517 | // If we know that the call does not free memory, or we want to process the |
| 1518 | // call later, keep tracking the top level arguments. |
Anna Zaks | 233e26a | 2013-02-07 23:05:43 +0000 | [diff] [blame] | 1519 | if ((Kind == PSK_DirectEscapeOnCall || |
| 1520 | Kind == PSK_IndirectEscapeOnCall) && |
Jordan Rose | 9fe09f3 | 2013-03-09 00:59:10 +0000 | [diff] [blame^] | 1521 | doesNotFreeMemOrInteresting(Call, State)) { |
Anna Zaks | 66c4040 | 2012-02-14 21:55:24 +0000 | [diff] [blame] | 1522 | return State; |
Anna Zaks | 233e26a | 2013-02-07 23:05:43 +0000 | [diff] [blame] | 1523 | } |
Anna Zaks | 66c4040 | 2012-02-14 21:55:24 +0000 | [diff] [blame] | 1524 | |
Anna Zaks | bf53dfa | 2012-12-20 00:38:25 +0000 | [diff] [blame] | 1525 | for (InvalidatedSymbols::const_iterator I = Escaped.begin(), |
| 1526 | E = Escaped.end(); |
| 1527 | I != E; ++I) { |
Anna Zaks | 4fb5487 | 2012-02-11 21:02:35 +0000 | [diff] [blame] | 1528 | SymbolRef sym = *I; |
Anna Zaks | bf53dfa | 2012-12-20 00:38:25 +0000 | [diff] [blame] | 1529 | |
Anna Zaks | 5b7aa34 | 2012-06-22 02:04:31 +0000 | [diff] [blame] | 1530 | if (const RefState *RS = State->get<RegionState>(sym)) { |
| 1531 | if (RS->isAllocated()) |
Anna Zaks | 431e35c | 2012-08-09 00:42:24 +0000 | [diff] [blame] | 1532 | State = State->remove<RegionState>(sym); |
Anna Zaks | 5b7aa34 | 2012-06-22 02:04:31 +0000 | [diff] [blame] | 1533 | } |
Anna Zaks | 4fb5487 | 2012-02-11 21:02:35 +0000 | [diff] [blame] | 1534 | } |
Anna Zaks | 66c4040 | 2012-02-14 21:55:24 +0000 | [diff] [blame] | 1535 | return State; |
Ted Kremenek | dd0e490 | 2010-07-31 01:52:11 +0000 | [diff] [blame] | 1536 | } |
Argyrios Kyrtzidis | 312dbec | 2011-02-28 01:26:35 +0000 | [diff] [blame] | 1537 | |
Jordy Rose | 393f98b | 2012-03-18 07:43:35 +0000 | [diff] [blame] | 1538 | static SymbolRef findFailedReallocSymbol(ProgramStateRef currState, |
| 1539 | ProgramStateRef prevState) { |
Jordan Rose | 166d502 | 2012-11-02 01:54:06 +0000 | [diff] [blame] | 1540 | ReallocPairsTy currMap = currState->get<ReallocPairs>(); |
| 1541 | ReallocPairsTy prevMap = prevState->get<ReallocPairs>(); |
Jordy Rose | 393f98b | 2012-03-18 07:43:35 +0000 | [diff] [blame] | 1542 | |
Jordan Rose | 166d502 | 2012-11-02 01:54:06 +0000 | [diff] [blame] | 1543 | for (ReallocPairsTy::iterator I = prevMap.begin(), E = prevMap.end(); |
Jordy Rose | 393f98b | 2012-03-18 07:43:35 +0000 | [diff] [blame] | 1544 | I != E; ++I) { |
| 1545 | SymbolRef sym = I.getKey(); |
| 1546 | if (!currMap.lookup(sym)) |
| 1547 | return sym; |
| 1548 | } |
| 1549 | |
| 1550 | return NULL; |
| 1551 | } |
| 1552 | |
Anna Zaks | ff3b9fd | 2012-02-09 06:25:51 +0000 | [diff] [blame] | 1553 | PathDiagnosticPiece * |
| 1554 | MallocChecker::MallocBugVisitor::VisitNode(const ExplodedNode *N, |
| 1555 | const ExplodedNode *PrevN, |
| 1556 | BugReporterContext &BRC, |
| 1557 | BugReport &BR) { |
Jordy Rose | 393f98b | 2012-03-18 07:43:35 +0000 | [diff] [blame] | 1558 | ProgramStateRef state = N->getState(); |
| 1559 | ProgramStateRef statePrev = PrevN->getState(); |
| 1560 | |
| 1561 | const RefState *RS = state->get<RegionState>(Sym); |
| 1562 | const RefState *RSPrev = statePrev->get<RegionState>(Sym); |
Anna Zaks | ede875b | 2012-08-03 18:30:18 +0000 | [diff] [blame] | 1563 | if (!RS) |
Anna Zaks | ff3b9fd | 2012-02-09 06:25:51 +0000 | [diff] [blame] | 1564 | return 0; |
| 1565 | |
Anna Zaks | fe57160 | 2012-02-16 22:26:07 +0000 | [diff] [blame] | 1566 | const Stmt *S = 0; |
| 1567 | const char *Msg = 0; |
Anna Zaks | 56a938f | 2012-03-16 23:24:20 +0000 | [diff] [blame] | 1568 | StackHintGeneratorForSymbol *StackHint = 0; |
Anna Zaks | fe57160 | 2012-02-16 22:26:07 +0000 | [diff] [blame] | 1569 | |
| 1570 | // Retrieve the associated statement. |
| 1571 | ProgramPoint ProgLoc = N->getLocation(); |
David Blaikie | 7a95de6 | 2013-02-21 22:23:56 +0000 | [diff] [blame] | 1572 | if (Optional<StmtPoint> SP = ProgLoc.getAs<StmtPoint>()) { |
Jordan Rose | 852aa0d | 2012-07-10 22:07:52 +0000 | [diff] [blame] | 1573 | S = SP->getStmt(); |
David Blaikie | 7a95de6 | 2013-02-21 22:23:56 +0000 | [diff] [blame] | 1574 | } else if (Optional<CallExitEnd> Exit = ProgLoc.getAs<CallExitEnd>()) { |
Jordan Rose | 852aa0d | 2012-07-10 22:07:52 +0000 | [diff] [blame] | 1575 | S = Exit->getCalleeContext()->getCallSite(); |
David Blaikie | 7a95de6 | 2013-02-21 22:23:56 +0000 | [diff] [blame] | 1576 | } else if (Optional<BlockEdge> Edge = ProgLoc.getAs<BlockEdge>()) { |
Ted Kremenek | a4a1759 | 2013-01-04 19:04:36 +0000 | [diff] [blame] | 1577 | // If an assumption was made on a branch, it should be caught |
| 1578 | // here by looking at the state transition. |
| 1579 | S = Edge->getSrc()->getTerminator(); |
Anna Zaks | fe57160 | 2012-02-16 22:26:07 +0000 | [diff] [blame] | 1580 | } |
Ted Kremenek | a4a1759 | 2013-01-04 19:04:36 +0000 | [diff] [blame] | 1581 | |
Anna Zaks | fe57160 | 2012-02-16 22:26:07 +0000 | [diff] [blame] | 1582 | if (!S) |
Anna Zaks | ff3b9fd | 2012-02-09 06:25:51 +0000 | [diff] [blame] | 1583 | return 0; |
Anna Zaks | ff3b9fd | 2012-02-09 06:25:51 +0000 | [diff] [blame] | 1584 | |
Jordan Rose | 28038f3 | 2012-07-10 22:07:42 +0000 | [diff] [blame] | 1585 | // FIXME: We will eventually need to handle non-statement-based events |
| 1586 | // (__attribute__((cleanup))). |
| 1587 | |
Anna Zaks | ff3b9fd | 2012-02-09 06:25:51 +0000 | [diff] [blame] | 1588 | // Find out if this is an interesting point and what is the kind. |
Anna Zaks | fe57160 | 2012-02-16 22:26:07 +0000 | [diff] [blame] | 1589 | if (Mode == Normal) { |
Anna Zaks | 368a0d5 | 2012-03-15 21:13:02 +0000 | [diff] [blame] | 1590 | if (isAllocated(RS, RSPrev, S)) { |
Anna Zaks | fe57160 | 2012-02-16 22:26:07 +0000 | [diff] [blame] | 1591 | Msg = "Memory is allocated"; |
Anna Zaks | fbd5874 | 2012-03-16 23:44:28 +0000 | [diff] [blame] | 1592 | StackHint = new StackHintGeneratorForSymbol(Sym, |
| 1593 | "Returned allocated memory"); |
Anna Zaks | 368a0d5 | 2012-03-15 21:13:02 +0000 | [diff] [blame] | 1594 | } else if (isReleased(RS, RSPrev, S)) { |
Anna Zaks | fe57160 | 2012-02-16 22:26:07 +0000 | [diff] [blame] | 1595 | Msg = "Memory is released"; |
Anna Zaks | fbd5874 | 2012-03-16 23:44:28 +0000 | [diff] [blame] | 1596 | StackHint = new StackHintGeneratorForSymbol(Sym, |
| 1597 | "Returned released memory"); |
Anna Zaks | 5b7aa34 | 2012-06-22 02:04:31 +0000 | [diff] [blame] | 1598 | } else if (isRelinquished(RS, RSPrev, S)) { |
| 1599 | Msg = "Memory ownership is transfered"; |
| 1600 | StackHint = new StackHintGeneratorForSymbol(Sym, ""); |
Anna Zaks | 368a0d5 | 2012-03-15 21:13:02 +0000 | [diff] [blame] | 1601 | } else if (isReallocFailedCheck(RS, RSPrev, S)) { |
Anna Zaks | fe57160 | 2012-02-16 22:26:07 +0000 | [diff] [blame] | 1602 | Mode = ReallocationFailed; |
| 1603 | Msg = "Reallocation failed"; |
Anna Zaks | 56a938f | 2012-03-16 23:24:20 +0000 | [diff] [blame] | 1604 | StackHint = new StackHintGeneratorForReallocationFailed(Sym, |
Anna Zaks | fbd5874 | 2012-03-16 23:44:28 +0000 | [diff] [blame] | 1605 | "Reallocation failed"); |
Jordy Rose | 393f98b | 2012-03-18 07:43:35 +0000 | [diff] [blame] | 1606 | |
Jordy Rose | b000fb5 | 2012-03-24 03:15:09 +0000 | [diff] [blame] | 1607 | if (SymbolRef sym = findFailedReallocSymbol(state, statePrev)) { |
| 1608 | // Is it possible to fail two reallocs WITHOUT testing in between? |
| 1609 | assert((!FailedReallocSymbol || FailedReallocSymbol == sym) && |
| 1610 | "We only support one failed realloc at a time."); |
Jordy Rose | 393f98b | 2012-03-18 07:43:35 +0000 | [diff] [blame] | 1611 | BR.markInteresting(sym); |
Jordy Rose | b000fb5 | 2012-03-24 03:15:09 +0000 | [diff] [blame] | 1612 | FailedReallocSymbol = sym; |
| 1613 | } |
Anna Zaks | fe57160 | 2012-02-16 22:26:07 +0000 | [diff] [blame] | 1614 | } |
| 1615 | |
| 1616 | // We are in a special mode if a reallocation failed later in the path. |
| 1617 | } else if (Mode == ReallocationFailed) { |
Jordy Rose | b000fb5 | 2012-03-24 03:15:09 +0000 | [diff] [blame] | 1618 | assert(FailedReallocSymbol && "No symbol to look for."); |
Anna Zaks | fe57160 | 2012-02-16 22:26:07 +0000 | [diff] [blame] | 1619 | |
Jordy Rose | b000fb5 | 2012-03-24 03:15:09 +0000 | [diff] [blame] | 1620 | // Is this is the first appearance of the reallocated symbol? |
| 1621 | if (!statePrev->get<RegionState>(FailedReallocSymbol)) { |
Jordy Rose | b000fb5 | 2012-03-24 03:15:09 +0000 | [diff] [blame] | 1622 | // We're at the reallocation point. |
| 1623 | Msg = "Attempt to reallocate memory"; |
| 1624 | StackHint = new StackHintGeneratorForSymbol(Sym, |
| 1625 | "Returned reallocated memory"); |
| 1626 | FailedReallocSymbol = NULL; |
| 1627 | Mode = Normal; |
| 1628 | } |
Anna Zaks | fe57160 | 2012-02-16 22:26:07 +0000 | [diff] [blame] | 1629 | } |
| 1630 | |
Anna Zaks | ff3b9fd | 2012-02-09 06:25:51 +0000 | [diff] [blame] | 1631 | if (!Msg) |
| 1632 | return 0; |
Anna Zaks | 56a938f | 2012-03-16 23:24:20 +0000 | [diff] [blame] | 1633 | assert(StackHint); |
Anna Zaks | ff3b9fd | 2012-02-09 06:25:51 +0000 | [diff] [blame] | 1634 | |
| 1635 | // Generate the extra diagnostic. |
Anna Zaks | fe57160 | 2012-02-16 22:26:07 +0000 | [diff] [blame] | 1636 | PathDiagnosticLocation Pos(S, BRC.getSourceManager(), |
Anna Zaks | ff3b9fd | 2012-02-09 06:25:51 +0000 | [diff] [blame] | 1637 | N->getLocationContext()); |
Anna Zaks | 56a938f | 2012-03-16 23:24:20 +0000 | [diff] [blame] | 1638 | return new PathDiagnosticEventPiece(Pos, Msg, true, StackHint); |
Anna Zaks | ff3b9fd | 2012-02-09 06:25:51 +0000 | [diff] [blame] | 1639 | } |
| 1640 | |
Anna Zaks | 93c5a24 | 2012-05-02 00:05:20 +0000 | [diff] [blame] | 1641 | void MallocChecker::printState(raw_ostream &Out, ProgramStateRef State, |
| 1642 | const char *NL, const char *Sep) const { |
| 1643 | |
| 1644 | RegionStateTy RS = State->get<RegionState>(); |
| 1645 | |
Ted Kremenek | c37fad6 | 2013-01-03 01:30:12 +0000 | [diff] [blame] | 1646 | if (!RS.isEmpty()) { |
| 1647 | Out << Sep << "MallocChecker:" << NL; |
| 1648 | for (RegionStateTy::iterator I = RS.begin(), E = RS.end(); I != E; ++I) { |
| 1649 | I.getKey()->dumpToStream(Out); |
| 1650 | Out << " : "; |
| 1651 | I.getData().dump(Out); |
| 1652 | Out << NL; |
| 1653 | } |
| 1654 | } |
Anna Zaks | 93c5a24 | 2012-05-02 00:05:20 +0000 | [diff] [blame] | 1655 | } |
Anna Zaks | ff3b9fd | 2012-02-09 06:25:51 +0000 | [diff] [blame] | 1656 | |
Anna Zaks | 231361a | 2012-02-08 23:16:52 +0000 | [diff] [blame] | 1657 | #define REGISTER_CHECKER(name) \ |
| 1658 | void ento::register##name(CheckerManager &mgr) {\ |
Anna Zaks | f0dfc9c | 2012-02-17 22:35:31 +0000 | [diff] [blame] | 1659 | registerCStringCheckerBasic(mgr); \ |
Anna Zaks | 231361a | 2012-02-08 23:16:52 +0000 | [diff] [blame] | 1660 | mgr.registerChecker<MallocChecker>()->Filter.C##name = true;\ |
Argyrios Kyrtzidis | 312dbec | 2011-02-28 01:26:35 +0000 | [diff] [blame] | 1661 | } |
Anna Zaks | 231361a | 2012-02-08 23:16:52 +0000 | [diff] [blame] | 1662 | |
| 1663 | REGISTER_CHECKER(MallocPessimistic) |
| 1664 | REGISTER_CHECKER(MallocOptimistic) |