blob: b2423d3749cd042d0e7b1b3be8fb161ecab67b2e [file] [log] [blame]
Anna Zaksdf18c5a2011-11-16 19:58:13 +00001//== GenericTaintChecker.cpp ----------------------------------- -*- C++ -*--=//
2//
3// The LLVM Compiler Infrastructure
4//
5// This file is distributed under the University of Illinois Open Source
6// License. See LICENSE.TXT for details.
7//
8//===----------------------------------------------------------------------===//
9//
10// This checker defines the attack surface for generic taint propagation.
11//
12// The taint information produced by it might be useful to other checkers. For
13// example, checkers should report errors which involve tainted data more
14// aggressively, even if the involved symbols are under constrained.
15//
16//===----------------------------------------------------------------------===//
17#include "ClangSACheckers.h"
18#include "clang/StaticAnalyzer/Core/Checker.h"
19#include "clang/StaticAnalyzer/Core/CheckerManager.h"
20#include "clang/StaticAnalyzer/Core/PathSensitive/CheckerContext.h"
Anna Zaks9ffbe242011-12-17 00:26:34 +000021#include "clang/StaticAnalyzer/Core/PathSensitive/ProgramStateTrait.h"
Anna Zaksdf18c5a2011-11-16 19:58:13 +000022#include "clang/StaticAnalyzer/Core/BugReporter/BugType.h"
Anna Zaks9b0c7492012-01-18 02:45:07 +000023#include "clang/Basic/Builtins.h"
Anna Zaks1fb826a2012-01-12 02:22:34 +000024#include <climits>
Anna Zaksdf18c5a2011-11-16 19:58:13 +000025
26using namespace clang;
27using namespace ento;
28
29namespace {
Anna Zaksefd69892011-12-14 00:56:18 +000030class GenericTaintChecker : public Checker< check::PostStmt<CallExpr>,
Anna Zaks9ffbe242011-12-17 00:26:34 +000031 check::PreStmt<CallExpr> > {
32public:
Anna Zaks8568ee72012-01-14 02:48:40 +000033 static void *getTag() { static int Tag; return &Tag; }
34
35 void checkPostStmt(const CallExpr *CE, CheckerContext &C) const;
36 void checkPostStmt(const DeclRefExpr *DRE, CheckerContext &C) const;
37
38 void checkPreStmt(const CallExpr *CE, CheckerContext &C) const;
Anna Zaksdf18c5a2011-11-16 19:58:13 +000039
Anna Zaks9ffbe242011-12-17 00:26:34 +000040private:
Anna Zaksb9ac30c2012-01-24 19:32:25 +000041 static const unsigned InvalidArgIndex = UINT_MAX;
42 /// Denotes the return vale.
43 static const unsigned ReturnValueIndex = UINT_MAX - 1;
Anna Zaks8568ee72012-01-14 02:48:40 +000044
Anna Zaks8f4caf52011-11-18 02:26:36 +000045 mutable llvm::OwningPtr<BugType> BT;
Anna Zaks9b0c7492012-01-18 02:45:07 +000046 inline void initBugType() const {
47 if (!BT)
48 BT.reset(new BugType("Taint Analysis", "General"));
49 }
Anna Zaks8f4caf52011-11-18 02:26:36 +000050
Anna Zaks1fb826a2012-01-12 02:22:34 +000051 /// \brief Catch taint related bugs. Check if tainted data is passed to a
52 /// system call etc.
Anna Zaks9f03b622012-01-07 02:33:10 +000053 bool checkPre(const CallExpr *CE, CheckerContext &C) const;
54
Anna Zaks1fb826a2012-01-12 02:22:34 +000055 /// \brief Add taint sources on a pre-visit.
56 void addSourcesPre(const CallExpr *CE, CheckerContext &C) const;
57
58 /// \brief Propagate taint generated at pre-visit.
59 bool propagateFromPre(const CallExpr *CE, CheckerContext &C) const;
60
61 /// \brief Add taint sources on a post visit.
62 void addSourcesPost(const CallExpr *CE, CheckerContext &C) const;
63
Anna Zaksb9ac30c2012-01-24 19:32:25 +000064 /// Check if the region the expression evaluates to is the standard input,
65 /// and thus, is tainted.
66 static bool isStdin(const Expr *E, CheckerContext &C);
67
Anna Zaks1fb826a2012-01-12 02:22:34 +000068 /// \brief Given a pointer argument, get the symbol of the value it contains
Anna Zaks8f4caf52011-11-18 02:26:36 +000069 /// (points to).
Anna Zaks7cdfe292012-01-18 02:45:13 +000070 static SymbolRef getPointedToSymbol(CheckerContext &C, const Expr *Arg);
Anna Zaksdf18c5a2011-11-16 19:58:13 +000071
Anna Zaks9ffbe242011-12-17 00:26:34 +000072 /// Functions defining the attack surface.
73 typedef const ProgramState *(GenericTaintChecker::*FnCheck)(const CallExpr *,
74 CheckerContext &C) const;
75 const ProgramState *postScanf(const CallExpr *CE, CheckerContext &C) const;
Anna Zaks2bf8fd82012-01-20 00:11:19 +000076 const ProgramState *postSocket(const CallExpr *CE, CheckerContext &C) const;
Anna Zaks9ffbe242011-12-17 00:26:34 +000077 const ProgramState *postRetTaint(const CallExpr *CE, CheckerContext &C) const;
Anna Zaks9ffbe242011-12-17 00:26:34 +000078
79 /// Taint the scanned input if the file is tainted.
80 const ProgramState *preFscanf(const CallExpr *CE, CheckerContext &C) const;
Anna Zaksdf18c5a2011-11-16 19:58:13 +000081
Anna Zaks9f03b622012-01-07 02:33:10 +000082 /// Check for CWE-134: Uncontrolled Format String.
Anna Zaks8568ee72012-01-14 02:48:40 +000083 static const char MsgUncontrolledFormatString[];
Anna Zaks9f03b622012-01-07 02:33:10 +000084 bool checkUncontrolledFormatString(const CallExpr *CE,
85 CheckerContext &C) const;
86
Anna Zaks8568ee72012-01-14 02:48:40 +000087 /// Check for:
88 /// CERT/STR02-C. "Sanitize data passed to complex subsystems"
89 /// CWE-78, "Failure to Sanitize Data into an OS Command"
90 static const char MsgSanitizeSystemArgs[];
91 bool checkSystemCall(const CallExpr *CE, StringRef Name,
92 CheckerContext &C) const;
Anna Zaks9ffbe242011-12-17 00:26:34 +000093
Anna Zaks4e462212012-01-18 02:45:11 +000094 /// Check if tainted data is used as a buffer size ins strn.. functions,
95 /// and allocators.
96 static const char MsgTaintedBufferSize[];
97 bool checkTaintedBufferSize(const CallExpr *CE, const FunctionDecl *FDecl,
98 CheckerContext &C) const;
99
Anna Zaks8568ee72012-01-14 02:48:40 +0000100 /// Generate a report if the expression is tainted or points to tainted data.
101 bool generateReportIfTainted(const Expr *E, const char Msg[],
102 CheckerContext &C) const;
Anna Zaks022b3f42012-01-17 00:37:02 +0000103
104
105 typedef llvm::SmallVector<unsigned, 2> ArgVector;
Anna Zaks9ffbe242011-12-17 00:26:34 +0000106
Anna Zaks022b3f42012-01-17 00:37:02 +0000107 /// \brief A struct used to specify taint propagation rules for a function.
108 ///
109 /// If any of the possible taint source arguments is tainted, all of the
110 /// destination arguments should also be tainted. Use InvalidArgIndex in the
111 /// src list to specify that all of the arguments can introduce taint. Use
112 /// InvalidArgIndex in the dst arguments to signify that all the non-const
113 /// pointer and reference arguments might be tainted on return. If
114 /// ReturnValueIndex is added to the dst list, the return value will be
115 /// tainted.
116 struct TaintPropagationRule {
117 /// List of arguments which can be taint sources and should be checked.
118 ArgVector SrcArgs;
119 /// List of arguments which should be tainted on function return.
120 ArgVector DstArgs;
Anna Zaks9b0c7492012-01-18 02:45:07 +0000121 // TODO: Check if using other data structures would be more optimal.
Anna Zaks022b3f42012-01-17 00:37:02 +0000122
123 TaintPropagationRule() {}
124
Anna Zaks9b0c7492012-01-18 02:45:07 +0000125 TaintPropagationRule(unsigned SArg,
126 unsigned DArg, bool TaintRet = false) {
Anna Zaks022b3f42012-01-17 00:37:02 +0000127 SrcArgs.push_back(SArg);
128 DstArgs.push_back(DArg);
Anna Zaks9b0c7492012-01-18 02:45:07 +0000129 if (TaintRet)
130 DstArgs.push_back(ReturnValueIndex);
Anna Zaks022b3f42012-01-17 00:37:02 +0000131 }
132
Anna Zaks9b0c7492012-01-18 02:45:07 +0000133 TaintPropagationRule(unsigned SArg1, unsigned SArg2,
134 unsigned DArg, bool TaintRet = false) {
135 SrcArgs.push_back(SArg1);
136 SrcArgs.push_back(SArg2);
137 DstArgs.push_back(DArg);
138 if (TaintRet)
139 DstArgs.push_back(ReturnValueIndex);
140 }
141
142 /// Get the propagation rule for a given function.
143 static TaintPropagationRule
144 getTaintPropagationRule(const FunctionDecl *FDecl,
145 StringRef Name,
146 CheckerContext &C);
147
Anna Zaks022b3f42012-01-17 00:37:02 +0000148 inline void addSrcArg(unsigned A) { SrcArgs.push_back(A); }
149 inline void addDstArg(unsigned A) { DstArgs.push_back(A); }
150
Anna Zaks9b0c7492012-01-18 02:45:07 +0000151 inline bool isNull() const { return SrcArgs.empty(); }
152
153 inline bool isDestinationArgument(unsigned ArgNum) const {
154 return (std::find(DstArgs.begin(),
155 DstArgs.end(), ArgNum) != DstArgs.end());
156 }
Anna Zaks022b3f42012-01-17 00:37:02 +0000157
Anna Zaksb9ac30c2012-01-24 19:32:25 +0000158 static inline bool isTaintedOrPointsToTainted(const Expr *E,
159 const ProgramState *State,
160 CheckerContext &C) {
161 return (State->isTainted(E, C.getLocationContext()) || isStdin(E, C) ||
162 (E->getType().getTypePtr()->isPointerType() &&
163 State->isTainted(getPointedToSymbol(C, E))));
164 }
165
Anna Zaks7cdfe292012-01-18 02:45:13 +0000166 /// \brief Pre-process a function which propagates taint according to the
167 /// taint rule.
168 const ProgramState *process(const CallExpr *CE, CheckerContext &C) const;
169
170 };
Anna Zaksdf18c5a2011-11-16 19:58:13 +0000171};
Anna Zaks9b0c7492012-01-18 02:45:07 +0000172
173const unsigned GenericTaintChecker::ReturnValueIndex;
174const unsigned GenericTaintChecker::InvalidArgIndex;
175
Anna Zaks8568ee72012-01-14 02:48:40 +0000176const char GenericTaintChecker::MsgUncontrolledFormatString[] =
177 "Tainted format string (CWE-134: Uncontrolled Format String)";
178
179const char GenericTaintChecker::MsgSanitizeSystemArgs[] =
180 "Tainted data passed to a system call "
181 "(CERT/STR02-C. Sanitize data passed to complex subsystems)";
Anna Zaks4e462212012-01-18 02:45:11 +0000182
183const char GenericTaintChecker::MsgTaintedBufferSize[] =
184 "Tainted data is used to specify the buffer size "
185 "(CERT/STR31-C. Guarantee that storage for strings has sufficient space for "
186 "character data and the null terminator)";
187
188} // end of anonymous namespace
Anna Zaksdf18c5a2011-11-16 19:58:13 +0000189
Anna Zaks1fb826a2012-01-12 02:22:34 +0000190/// A set which is used to pass information from call pre-visit instruction
191/// to the call post-visit. The values are unsigned integers, which are either
192/// ReturnValueIndex, or indexes of the pointer/reference argument, which
193/// points to data, which should be tainted on return.
194namespace { struct TaintArgsOnPostVisit{}; }
195namespace clang { namespace ento {
196template<> struct ProgramStateTrait<TaintArgsOnPostVisit>
197 : public ProgramStatePartialTrait<llvm::ImmutableSet<unsigned> > {
198 static void *GDMIndex() { return GenericTaintChecker::getTag(); }
199};
200}}
Anna Zaks9ffbe242011-12-17 00:26:34 +0000201
Anna Zaks9b0c7492012-01-18 02:45:07 +0000202GenericTaintChecker::TaintPropagationRule
203GenericTaintChecker::TaintPropagationRule::getTaintPropagationRule(
204 const FunctionDecl *FDecl,
205 StringRef Name,
206 CheckerContext &C) {
Anna Zaksb9ac30c2012-01-24 19:32:25 +0000207 // TODO: Currently, we might loose precision here: we always mark a return
208 // value as tainted even if it's just a pointer, pointing to tainted data.
209
Anna Zaks9b0c7492012-01-18 02:45:07 +0000210 // Check for exact name match for functions without builtin substitutes.
211 TaintPropagationRule Rule = llvm::StringSwitch<TaintPropagationRule>(Name)
212 .Case("atoi", TaintPropagationRule(0, ReturnValueIndex))
213 .Case("atol", TaintPropagationRule(0, ReturnValueIndex))
214 .Case("atoll", TaintPropagationRule(0, ReturnValueIndex))
Anna Zaksb9ac30c2012-01-24 19:32:25 +0000215 .Case("getc", TaintPropagationRule(0, ReturnValueIndex))
216 .Case("fgetc", TaintPropagationRule(0, ReturnValueIndex))
217 .Case("getc_unlocked", TaintPropagationRule(0, ReturnValueIndex))
218 .Case("getw", TaintPropagationRule(0, ReturnValueIndex))
219 .Case("toupper", TaintPropagationRule(0, ReturnValueIndex))
220 .Case("tolower", TaintPropagationRule(0, ReturnValueIndex))
221 .Case("strchr", TaintPropagationRule(0, ReturnValueIndex))
222 .Case("strrchr", TaintPropagationRule(0, ReturnValueIndex))
Anna Zaks2bf8fd82012-01-20 00:11:19 +0000223 .Case("read", TaintPropagationRule(0, 2, 1, true))
224 .Case("pread", TaintPropagationRule(InvalidArgIndex, 1, true))
Anna Zaksb9ac30c2012-01-24 19:32:25 +0000225 .Case("gets", TaintPropagationRule(InvalidArgIndex, 0, true))
226 .Case("fgets", TaintPropagationRule(2, 0, true))
227 .Case("getline", TaintPropagationRule(2, 0))
228 .Case("getdelim", TaintPropagationRule(3, 0))
229 .Case("fgetln", TaintPropagationRule(0, ReturnValueIndex))
Anna Zaks9b0c7492012-01-18 02:45:07 +0000230 .Default(TaintPropagationRule());
231
232 if (!Rule.isNull())
233 return Rule;
234
235 // Check if it's one of the memory setting/copying functions.
236 // This check is specialized but faster then calling isCLibraryFunction.
237 unsigned BId = 0;
238 if ( (BId = FDecl->getMemoryFunctionKind()) )
239 switch(BId) {
240 case Builtin::BImemcpy:
241 case Builtin::BImemmove:
242 case Builtin::BIstrncpy:
243 case Builtin::BIstrncat:
244 return TaintPropagationRule(1, 2, 0, true);
Anna Zaks9b0c7492012-01-18 02:45:07 +0000245 case Builtin::BIstrlcpy:
246 case Builtin::BIstrlcat:
247 return TaintPropagationRule(1, 2, 0, false);
Anna Zaks9b0c7492012-01-18 02:45:07 +0000248 case Builtin::BIstrndup:
249 return TaintPropagationRule(0, 1, ReturnValueIndex);
Anna Zaks9b0c7492012-01-18 02:45:07 +0000250
251 default:
252 break;
253 };
254
255 // Process all other functions which could be defined as builtins.
256 if (Rule.isNull()) {
257 if (C.isCLibraryFunction(FDecl, "snprintf") ||
258 C.isCLibraryFunction(FDecl, "sprintf"))
259 return TaintPropagationRule(InvalidArgIndex, 0, true);
260 else if (C.isCLibraryFunction(FDecl, "strcpy") ||
261 C.isCLibraryFunction(FDecl, "stpcpy") ||
262 C.isCLibraryFunction(FDecl, "strcat"))
263 return TaintPropagationRule(1, 0, true);
264 else if (C.isCLibraryFunction(FDecl, "bcopy"))
265 return TaintPropagationRule(0, 2, 1, false);
266 else if (C.isCLibraryFunction(FDecl, "strdup") ||
267 C.isCLibraryFunction(FDecl, "strdupa"))
268 return TaintPropagationRule(0, ReturnValueIndex);
Anna Zaks4e462212012-01-18 02:45:11 +0000269 else if (C.isCLibraryFunction(FDecl, "wcsdup"))
270 return TaintPropagationRule(0, ReturnValueIndex);
Anna Zaks9b0c7492012-01-18 02:45:07 +0000271 }
272
273 // Skipping the following functions, since they might be used for cleansing
274 // or smart memory copy:
275 // - memccpy - copying untill hitting a special character.
276
277 return TaintPropagationRule();
Anna Zaks8f4caf52011-11-18 02:26:36 +0000278}
279
Anna Zaks9ffbe242011-12-17 00:26:34 +0000280void GenericTaintChecker::checkPreStmt(const CallExpr *CE,
281 CheckerContext &C) const {
Anna Zaks9f03b622012-01-07 02:33:10 +0000282 // Check for errors first.
283 if (checkPre(CE, C))
284 return;
Anna Zaks9ffbe242011-12-17 00:26:34 +0000285
Anna Zaks9f03b622012-01-07 02:33:10 +0000286 // Add taint second.
Anna Zaks1fb826a2012-01-12 02:22:34 +0000287 addSourcesPre(CE, C);
Anna Zaks9f03b622012-01-07 02:33:10 +0000288}
289
290void GenericTaintChecker::checkPostStmt(const CallExpr *CE,
291 CheckerContext &C) const {
Anna Zaks1fb826a2012-01-12 02:22:34 +0000292 if (propagateFromPre(CE, C))
293 return;
294 addSourcesPost(CE, C);
Anna Zaks9f03b622012-01-07 02:33:10 +0000295}
296
Anna Zaks1fb826a2012-01-12 02:22:34 +0000297void GenericTaintChecker::addSourcesPre(const CallExpr *CE,
298 CheckerContext &C) const {
Anna Zaks9b0c7492012-01-18 02:45:07 +0000299 const ProgramState *State = 0;
300 const FunctionDecl *FDecl = C.getCalleeDecl(CE);
301 StringRef Name = C.getCalleeName(FDecl);
Anna Zaks1fb826a2012-01-12 02:22:34 +0000302 if (Name.empty())
303 return;
Anna Zaks022b3f42012-01-17 00:37:02 +0000304
Anna Zaks9b0c7492012-01-18 02:45:07 +0000305 // First, try generating a propagation rule for this function.
306 TaintPropagationRule Rule =
307 TaintPropagationRule::getTaintPropagationRule(FDecl, Name, C);
Anna Zaks022b3f42012-01-17 00:37:02 +0000308 if (!Rule.isNull()) {
Anna Zaks7cdfe292012-01-18 02:45:13 +0000309 State = Rule.process(CE, C);
Anna Zaks022b3f42012-01-17 00:37:02 +0000310 if (!State)
311 return;
312 C.addTransition(State);
Anna Zaks9b0c7492012-01-18 02:45:07 +0000313 return;
Anna Zaks022b3f42012-01-17 00:37:02 +0000314 }
315
Anna Zaks9b0c7492012-01-18 02:45:07 +0000316 // Otherwise, check if we have custom pre-processing implemented.
Anna Zaks9ffbe242011-12-17 00:26:34 +0000317 FnCheck evalFunction = llvm::StringSwitch<FnCheck>(Name)
Anna Zaks1fb826a2012-01-12 02:22:34 +0000318 .Case("fscanf", &GenericTaintChecker::preFscanf)
Anna Zaks9ffbe242011-12-17 00:26:34 +0000319 .Default(0);
Anna Zaks9ffbe242011-12-17 00:26:34 +0000320 // Check and evaluate the call.
321 if (evalFunction)
322 State = (this->*evalFunction)(CE, C);
323 if (!State)
Anna Zaksdf18c5a2011-11-16 19:58:13 +0000324 return;
Anna Zaks9ffbe242011-12-17 00:26:34 +0000325 C.addTransition(State);
Anna Zaks9b0c7492012-01-18 02:45:07 +0000326
Anna Zaks9ffbe242011-12-17 00:26:34 +0000327}
328
Anna Zaks1fb826a2012-01-12 02:22:34 +0000329bool GenericTaintChecker::propagateFromPre(const CallExpr *CE,
330 CheckerContext &C) const {
331 const ProgramState *State = C.getState();
332
333 // Depending on what was tainted at pre-visit, we determined a set of
334 // arguments which should be tainted after the function returns. These are
335 // stored in the state as TaintArgsOnPostVisit set.
336 llvm::ImmutableSet<unsigned> TaintArgs = State->get<TaintArgsOnPostVisit>();
Anna Zaksb9ac30c2012-01-24 19:32:25 +0000337 if (TaintArgs.isEmpty())
338 return false;
339
Anna Zaks1fb826a2012-01-12 02:22:34 +0000340 for (llvm::ImmutableSet<unsigned>::iterator
341 I = TaintArgs.begin(), E = TaintArgs.end(); I != E; ++I) {
342 unsigned ArgNum = *I;
343
344 // Special handling for the tainted return value.
345 if (ArgNum == ReturnValueIndex) {
346 State = State->addTaint(CE, C.getLocationContext());
347 continue;
348 }
349
350 // The arguments are pointer arguments. The data they are pointing at is
351 // tainted after the call.
352 const Expr* Arg = CE->getArg(ArgNum);
Anna Zaks7cdfe292012-01-18 02:45:13 +0000353 SymbolRef Sym = getPointedToSymbol(C, Arg);
Anna Zaks1fb826a2012-01-12 02:22:34 +0000354 if (Sym)
355 State = State->addTaint(Sym);
356 }
357
358 // Clear up the taint info from the state.
359 State = State->remove<TaintArgsOnPostVisit>();
360
361 if (State != C.getState()) {
362 C.addTransition(State);
363 return true;
364 }
365 return false;
366}
367
368void GenericTaintChecker::addSourcesPost(const CallExpr *CE,
369 CheckerContext &C) const {
Anna Zaksdf18c5a2011-11-16 19:58:13 +0000370 // Define the attack surface.
371 // Set the evaluation function by switching on the callee name.
Anna Zaks9ffbe242011-12-17 00:26:34 +0000372 StringRef Name = C.getCalleeName(CE);
Anna Zaks1fb826a2012-01-12 02:22:34 +0000373 if (Name.empty())
374 return;
Anna Zaksdf18c5a2011-11-16 19:58:13 +0000375 FnCheck evalFunction = llvm::StringSwitch<FnCheck>(Name)
Anna Zaks9ffbe242011-12-17 00:26:34 +0000376 .Case("scanf", &GenericTaintChecker::postScanf)
Anna Zaks1009ac72011-12-14 00:56:02 +0000377 // TODO: Add support for vfscanf & family.
Anna Zaks9ffbe242011-12-17 00:26:34 +0000378 .Case("getchar", &GenericTaintChecker::postRetTaint)
Anna Zaksb9ac30c2012-01-24 19:32:25 +0000379 .Case("getchar_unlocked", &GenericTaintChecker::postRetTaint)
Anna Zaks9ffbe242011-12-17 00:26:34 +0000380 .Case("getenv", &GenericTaintChecker::postRetTaint)
381 .Case("fopen", &GenericTaintChecker::postRetTaint)
382 .Case("fdopen", &GenericTaintChecker::postRetTaint)
383 .Case("freopen", &GenericTaintChecker::postRetTaint)
Anna Zaksb9ac30c2012-01-24 19:32:25 +0000384 .Case("getch", &GenericTaintChecker::postRetTaint)
385 .Case("wgetch", &GenericTaintChecker::postRetTaint)
Anna Zaks2bf8fd82012-01-20 00:11:19 +0000386 .Case("socket", &GenericTaintChecker::postSocket)
Anna Zaks1fb826a2012-01-12 02:22:34 +0000387 .Default(0);
Anna Zaksdf18c5a2011-11-16 19:58:13 +0000388
389 // If the callee isn't defined, it is not of security concern.
390 // Check and evaluate the call.
Anna Zaks9f03b622012-01-07 02:33:10 +0000391 const ProgramState *State = 0;
Anna Zaksdf18c5a2011-11-16 19:58:13 +0000392 if (evalFunction)
Anna Zaks9ffbe242011-12-17 00:26:34 +0000393 State = (this->*evalFunction)(CE, C);
394 if (!State)
395 return;
Anna Zaksdf18c5a2011-11-16 19:58:13 +0000396
Anna Zaks9ffbe242011-12-17 00:26:34 +0000397 C.addTransition(State);
Anna Zaksdf18c5a2011-11-16 19:58:13 +0000398}
Anna Zaks8f4caf52011-11-18 02:26:36 +0000399
Anna Zaks9f03b622012-01-07 02:33:10 +0000400bool GenericTaintChecker::checkPre(const CallExpr *CE, CheckerContext &C) const{
401
402 if (checkUncontrolledFormatString(CE, C))
403 return true;
404
Anna Zaks4e462212012-01-18 02:45:11 +0000405 const FunctionDecl *FDecl = C.getCalleeDecl(CE);
406 StringRef Name = C.getCalleeName(FDecl);
Anna Zaks8568ee72012-01-14 02:48:40 +0000407 if (Name.empty())
408 return false;
409
410 if (checkSystemCall(CE, Name, C))
411 return true;
412
Anna Zaks4e462212012-01-18 02:45:11 +0000413 if (checkTaintedBufferSize(CE, FDecl, C))
414 return true;
415
Anna Zaks9f03b622012-01-07 02:33:10 +0000416 return false;
417}
418
Anna Zaks8f4caf52011-11-18 02:26:36 +0000419SymbolRef GenericTaintChecker::getPointedToSymbol(CheckerContext &C,
Anna Zaks7cdfe292012-01-18 02:45:13 +0000420 const Expr* Arg) {
Anna Zaks8f4caf52011-11-18 02:26:36 +0000421 const ProgramState *State = C.getState();
Ted Kremenek5eca4822012-01-06 22:09:28 +0000422 SVal AddrVal = State->getSVal(Arg->IgnoreParens(), C.getLocationContext());
Anna Zaksd3d85482011-12-16 18:28:50 +0000423 if (AddrVal.isUnknownOrUndef())
Anna Zakse3d250e2011-12-11 18:43:40 +0000424 return 0;
425
Anna Zaksdf18c5a2011-11-16 19:58:13 +0000426 Loc *AddrLoc = dyn_cast<Loc>(&AddrVal);
Anna Zaks7cdfe292012-01-18 02:45:13 +0000427 if (!AddrLoc)
Anna Zaks8f4caf52011-11-18 02:26:36 +0000428 return 0;
429
Anna Zaks71d29092012-01-13 00:56:51 +0000430 const PointerType *ArgTy =
431 dyn_cast<PointerType>(Arg->getType().getCanonicalType().getTypePtr());
Anna Zaks665b0022012-01-21 06:59:01 +0000432 SVal Val = State->getSVal(*AddrLoc,
433 ArgTy ? ArgTy->getPointeeType(): QualType());
Anna Zaksdf18c5a2011-11-16 19:58:13 +0000434 return Val.getAsSymbol();
435}
436
Anna Zaks022b3f42012-01-17 00:37:02 +0000437const ProgramState *
Anna Zaks7cdfe292012-01-18 02:45:13 +0000438GenericTaintChecker::TaintPropagationRule::process(const CallExpr *CE,
439 CheckerContext &C) const {
Anna Zaks022b3f42012-01-17 00:37:02 +0000440 const ProgramState *State = C.getState();
441
442 // Check for taint in arguments.
443 bool IsTainted = false;
Anna Zaks7cdfe292012-01-18 02:45:13 +0000444 for (ArgVector::const_iterator I = SrcArgs.begin(),
445 E = SrcArgs.end(); I != E; ++I) {
Anna Zaks022b3f42012-01-17 00:37:02 +0000446 unsigned ArgNum = *I;
447
448 if (ArgNum == InvalidArgIndex) {
Anna Zaks9b0c7492012-01-18 02:45:07 +0000449 // Check if any of the arguments is tainted, but skip the
450 // destination arguments.
451 for (unsigned int i = 0; i < CE->getNumArgs(); ++i) {
Anna Zaks7cdfe292012-01-18 02:45:13 +0000452 if (isDestinationArgument(i))
Anna Zaks9b0c7492012-01-18 02:45:07 +0000453 continue;
Anna Zaksb9ac30c2012-01-24 19:32:25 +0000454 if ((IsTainted = isTaintedOrPointsToTainted(CE->getArg(i), State, C)))
Anna Zaks022b3f42012-01-17 00:37:02 +0000455 break;
Anna Zaks9b0c7492012-01-18 02:45:07 +0000456 }
Anna Zaks022b3f42012-01-17 00:37:02 +0000457 break;
458 }
459
460 assert(ArgNum < CE->getNumArgs());
Anna Zaksb9ac30c2012-01-24 19:32:25 +0000461 if ((IsTainted = isTaintedOrPointsToTainted(CE->getArg(ArgNum), State, C)))
Anna Zaks022b3f42012-01-17 00:37:02 +0000462 break;
463 }
464 if (!IsTainted)
465 return State;
466
467 // Mark the arguments which should be tainted after the function returns.
Anna Zaks7cdfe292012-01-18 02:45:13 +0000468 for (ArgVector::const_iterator I = DstArgs.begin(),
469 E = DstArgs.end(); I != E; ++I) {
Anna Zaks022b3f42012-01-17 00:37:02 +0000470 unsigned ArgNum = *I;
471
472 // Should we mark all arguments as tainted?
473 if (ArgNum == InvalidArgIndex) {
474 // For all pointer and references that were passed in:
475 // If they are not pointing to const data, mark data as tainted.
476 // TODO: So far we are just going one level down; ideally we'd need to
477 // recurse here.
478 for (unsigned int i = 0; i < CE->getNumArgs(); ++i) {
479 const Expr *Arg = CE->getArg(i);
480 // Process pointer argument.
481 const Type *ArgTy = Arg->getType().getTypePtr();
482 QualType PType = ArgTy->getPointeeType();
483 if ((!PType.isNull() && !PType.isConstQualified())
484 || (ArgTy->isReferenceType() && !Arg->getType().isConstQualified()))
485 State = State->add<TaintArgsOnPostVisit>(i);
486 }
487 continue;
488 }
489
490 // Should mark the return value?
491 if (ArgNum == ReturnValueIndex) {
492 State = State->add<TaintArgsOnPostVisit>(ReturnValueIndex);
493 continue;
494 }
495
496 // Mark the given argument.
497 assert(ArgNum < CE->getNumArgs());
498 State = State->add<TaintArgsOnPostVisit>(ArgNum);
499 }
500
501 return State;
502}
503
504
Anna Zaks1fb826a2012-01-12 02:22:34 +0000505// If argument 0 (file descriptor) is tainted, all arguments except for arg 0
506// and arg 1 should get taint.
Anna Zaks9ffbe242011-12-17 00:26:34 +0000507const ProgramState *GenericTaintChecker::preFscanf(const CallExpr *CE,
508 CheckerContext &C) const {
509 assert(CE->getNumArgs() >= 2);
510 const ProgramState *State = C.getState();
511
512 // Check is the file descriptor is tainted.
Ted Kremenek5eca4822012-01-06 22:09:28 +0000513 if (State->isTainted(CE->getArg(0), C.getLocationContext()) ||
Anna Zaks1fb826a2012-01-12 02:22:34 +0000514 isStdin(CE->getArg(0), C)) {
515 // All arguments except for the first two should get taint.
516 for (unsigned int i = 2; i < CE->getNumArgs(); ++i)
517 State = State->add<TaintArgsOnPostVisit>(i);
518 return State;
519 }
520
Anna Zaks9ffbe242011-12-17 00:26:34 +0000521 return 0;
522}
523
Anna Zaks2bf8fd82012-01-20 00:11:19 +0000524
525// If argument 0(protocol domain) is network, the return value should get taint.
526const ProgramState *GenericTaintChecker::postSocket(const CallExpr *CE,
527 CheckerContext &C) const {
528 assert(CE->getNumArgs() >= 3);
529 const ProgramState *State = C.getState();
530
531 SourceLocation DomLoc = CE->getArg(0)->getExprLoc();
532 StringRef DomName = C.getMacroNameOrSpelling(DomLoc);
533 // White list the internal communication protocols.
534 if (DomName.equals("AF_SYSTEM") || DomName.equals("AF_LOCAL") ||
535 DomName.equals("AF_UNIX") || DomName.equals("AF_RESERVED_36"))
536 return State;
537 State = State->addTaint(CE, C.getLocationContext());
538 return State;
539}
540
Anna Zaks9ffbe242011-12-17 00:26:34 +0000541const ProgramState *GenericTaintChecker::postScanf(const CallExpr *CE,
542 CheckerContext &C) const {
Anna Zaksdf18c5a2011-11-16 19:58:13 +0000543 const ProgramState *State = C.getState();
Anna Zaks1009ac72011-12-14 00:56:02 +0000544 assert(CE->getNumArgs() >= 2);
Ted Kremenek5eca4822012-01-06 22:09:28 +0000545 SVal x = State->getSVal(CE->getArg(1), C.getLocationContext());
Anna Zaksdf18c5a2011-11-16 19:58:13 +0000546 // All arguments except for the very first one should get taint.
547 for (unsigned int i = 1; i < CE->getNumArgs(); ++i) {
548 // The arguments are pointer arguments. The data they are pointing at is
549 // tainted after the call.
550 const Expr* Arg = CE->getArg(i);
Anna Zaks7cdfe292012-01-18 02:45:13 +0000551 SymbolRef Sym = getPointedToSymbol(C, Arg);
Anna Zaks1009ac72011-12-14 00:56:02 +0000552 if (Sym)
553 State = State->addTaint(Sym);
554 }
Anna Zaks9ffbe242011-12-17 00:26:34 +0000555 return State;
Anna Zaksdf18c5a2011-11-16 19:58:13 +0000556}
557
Anna Zaks9ffbe242011-12-17 00:26:34 +0000558const ProgramState *GenericTaintChecker::postRetTaint(const CallExpr *CE,
559 CheckerContext &C) const {
Ted Kremenek5eca4822012-01-06 22:09:28 +0000560 return C.getState()->addTaint(CE, C.getLocationContext());
Anna Zaksdf18c5a2011-11-16 19:58:13 +0000561}
562
Anna Zaksb9ac30c2012-01-24 19:32:25 +0000563bool GenericTaintChecker::isStdin(const Expr *E, CheckerContext &C) {
Anna Zaksd3d85482011-12-16 18:28:50 +0000564 const ProgramState *State = C.getState();
Ted Kremenek5eca4822012-01-06 22:09:28 +0000565 SVal Val = State->getSVal(E, C.getLocationContext());
Anna Zaksefd69892011-12-14 00:56:18 +0000566
Anna Zaksd3d85482011-12-16 18:28:50 +0000567 // stdin is a pointer, so it would be a region.
568 const MemRegion *MemReg = Val.getAsRegion();
569
570 // The region should be symbolic, we do not know it's value.
571 const SymbolicRegion *SymReg = dyn_cast_or_null<SymbolicRegion>(MemReg);
572 if (!SymReg)
Anna Zaksefd69892011-12-14 00:56:18 +0000573 return false;
574
Anna Zaksd3d85482011-12-16 18:28:50 +0000575 // Get it's symbol and find the declaration region it's pointing to.
576 const SymbolRegionValue *Sm =dyn_cast<SymbolRegionValue>(SymReg->getSymbol());
577 if (!Sm)
578 return false;
579 const DeclRegion *DeclReg = dyn_cast_or_null<DeclRegion>(Sm->getRegion());
580 if (!DeclReg)
581 return false;
Anna Zaksefd69892011-12-14 00:56:18 +0000582
Anna Zaksd3d85482011-12-16 18:28:50 +0000583 // This region corresponds to a declaration, find out if it's a global/extern
584 // variable named stdin with the proper type.
585 if (const VarDecl *D = dyn_cast_or_null<VarDecl>(DeclReg->getDecl())) {
586 D = D->getCanonicalDecl();
587 if ((D->getName().find("stdin") != StringRef::npos) && D->isExternC())
588 if (const PointerType * PtrTy =
589 dyn_cast<PointerType>(D->getType().getTypePtr()))
590 if (PtrTy->getPointeeType() == C.getASTContext().getFILEType())
591 return true;
592 }
Anna Zaksefd69892011-12-14 00:56:18 +0000593 return false;
594}
595
Anna Zaks9f03b622012-01-07 02:33:10 +0000596static bool getPrintfFormatArgumentNum(const CallExpr *CE,
597 const CheckerContext &C,
598 unsigned int &ArgNum) {
599 // Find if the function contains a format string argument.
600 // Handles: fprintf, printf, sprintf, snprintf, vfprintf, vprintf, vsprintf,
601 // vsnprintf, syslog, custom annotated functions.
602 const FunctionDecl *FDecl = C.getCalleeDecl(CE);
603 if (!FDecl)
604 return false;
605 for (specific_attr_iterator<FormatAttr>
606 i = FDecl->specific_attr_begin<FormatAttr>(),
607 e = FDecl->specific_attr_end<FormatAttr>(); i != e ; ++i) {
608
609 const FormatAttr *Format = *i;
610 ArgNum = Format->getFormatIdx() - 1;
611 if ((Format->getType() == "printf") && CE->getNumArgs() > ArgNum)
612 return true;
613 }
614
615 // Or if a function is named setproctitle (this is a heuristic).
616 if (C.getCalleeName(CE).find("setproctitle") != StringRef::npos) {
617 ArgNum = 0;
618 return true;
619 }
620
621 return false;
622}
623
Anna Zaks8568ee72012-01-14 02:48:40 +0000624bool GenericTaintChecker::generateReportIfTainted(const Expr *E,
625 const char Msg[],
626 CheckerContext &C) const {
627 assert(E);
628
629 // Check for taint.
630 const ProgramState *State = C.getState();
631 if (!State->isTainted(getPointedToSymbol(C, E)) &&
632 !State->isTainted(E, C.getLocationContext()))
633 return false;
634
635 // Generate diagnostic.
636 if (ExplodedNode *N = C.addTransition()) {
637 initBugType();
638 BugReport *report = new BugReport(*BT, Msg, N);
639 report->addRange(E->getSourceRange());
640 C.EmitReport(report);
641 return true;
642 }
643 return false;
644}
645
Anna Zaks9f03b622012-01-07 02:33:10 +0000646bool GenericTaintChecker::checkUncontrolledFormatString(const CallExpr *CE,
647 CheckerContext &C) const{
648 // Check if the function contains a format string argument.
649 unsigned int ArgNum = 0;
650 if (!getPrintfFormatArgumentNum(CE, C, ArgNum))
651 return false;
652
653 // If either the format string content or the pointer itself are tainted, warn.
Anna Zaks8568ee72012-01-14 02:48:40 +0000654 if (generateReportIfTainted(CE->getArg(ArgNum),
655 MsgUncontrolledFormatString, C))
656 return true;
657 return false;
658}
659
660bool GenericTaintChecker::checkSystemCall(const CallExpr *CE,
661 StringRef Name,
662 CheckerContext &C) const {
Anna Zaksb9ac30c2012-01-24 19:32:25 +0000663 // TODO: It might make sense to run this check on demand. In some cases,
664 // we should check if the environment has been cleansed here. We also might
665 // need to know if the user was reset before these calls(seteuid).
Anna Zaks8568ee72012-01-14 02:48:40 +0000666 unsigned ArgNum = llvm::StringSwitch<unsigned>(Name)
667 .Case("system", 0)
668 .Case("popen", 0)
Anna Zaks2bf8fd82012-01-20 00:11:19 +0000669 .Case("execl", 0)
670 .Case("execle", 0)
671 .Case("execlp", 0)
672 .Case("execv", 0)
673 .Case("execvp", 0)
674 .Case("execvP", 0)
Anna Zaksb9ac30c2012-01-24 19:32:25 +0000675 .Case("execve", 0)
676 .Case("dlopen", 0)
Anna Zaks8568ee72012-01-14 02:48:40 +0000677 .Default(UINT_MAX);
678
679 if (ArgNum == UINT_MAX)
680 return false;
681
682 if (generateReportIfTainted(CE->getArg(ArgNum),
683 MsgSanitizeSystemArgs, C))
684 return true;
685
Anna Zaks9f03b622012-01-07 02:33:10 +0000686 return false;
687}
688
Anna Zaks4e462212012-01-18 02:45:11 +0000689// TODO: Should this check be a part of the CString checker?
690// If yes, should taint be a global setting?
691bool GenericTaintChecker::checkTaintedBufferSize(const CallExpr *CE,
692 const FunctionDecl *FDecl,
693 CheckerContext &C) const {
694 // If the function has a buffer size argument, set ArgNum.
695 unsigned ArgNum = InvalidArgIndex;
696 unsigned BId = 0;
697 if ( (BId = FDecl->getMemoryFunctionKind()) )
698 switch(BId) {
699 case Builtin::BImemcpy:
700 case Builtin::BImemmove:
701 case Builtin::BIstrncpy:
702 ArgNum = 2;
703 break;
704 case Builtin::BIstrndup:
705 ArgNum = 1;
706 break;
707 default:
708 break;
709 };
710
711 if (ArgNum == InvalidArgIndex) {
712 if (C.isCLibraryFunction(FDecl, "malloc") ||
713 C.isCLibraryFunction(FDecl, "calloc") ||
714 C.isCLibraryFunction(FDecl, "alloca"))
715 ArgNum = 0;
716 else if (C.isCLibraryFunction(FDecl, "memccpy"))
717 ArgNum = 3;
718 else if (C.isCLibraryFunction(FDecl, "realloc"))
719 ArgNum = 1;
720 else if (C.isCLibraryFunction(FDecl, "bcopy"))
721 ArgNum = 2;
722 }
723
724 if (ArgNum != InvalidArgIndex &&
725 generateReportIfTainted(CE->getArg(ArgNum), MsgTaintedBufferSize, C))
726 return true;
727
728 return false;
729}
730
Anna Zaksdf18c5a2011-11-16 19:58:13 +0000731void ento::registerGenericTaintChecker(CheckerManager &mgr) {
732 mgr.registerChecker<GenericTaintChecker>();
733}