Zhongxing Xu | 589c0f2 | 2009-11-12 08:38:56 +0000 | [diff] [blame] | 1 | //=== MallocChecker.cpp - A malloc/free checker -------------------*- C++ -*--// |
| 2 | // |
| 3 | // The LLVM Compiler Infrastructure |
| 4 | // |
| 5 | // This file is distributed under the University of Illinois Open Source |
| 6 | // License. See LICENSE.TXT for details. |
| 7 | // |
| 8 | //===----------------------------------------------------------------------===// |
| 9 | // |
| 10 | // This file defines malloc/free checker, which checks for potential memory |
| 11 | // leaks, double free, and use-after-free problems. |
| 12 | // |
| 13 | //===----------------------------------------------------------------------===// |
| 14 | |
Argyrios Kyrtzidis | d2592a3 | 2010-12-22 18:53:44 +0000 | [diff] [blame^] | 15 | #include "ExprEngineExperimentalChecks.h" |
Argyrios Kyrtzidis | 98cabba | 2010-12-22 18:51:49 +0000 | [diff] [blame] | 16 | #include "clang/GR/BugReporter/BugType.h" |
| 17 | #include "clang/GR/PathSensitive/CheckerVisitor.h" |
| 18 | #include "clang/GR/PathSensitive/GRState.h" |
| 19 | #include "clang/GR/PathSensitive/GRStateTrait.h" |
| 20 | #include "clang/GR/PathSensitive/SymbolManager.h" |
Zhongxing Xu | 589c0f2 | 2009-11-12 08:38:56 +0000 | [diff] [blame] | 21 | #include "llvm/ADT/ImmutableMap.h" |
| 22 | using namespace clang; |
Argyrios Kyrtzidis | 5a4f98f | 2010-12-22 18:53:20 +0000 | [diff] [blame] | 23 | using namespace GR; |
Zhongxing Xu | 589c0f2 | 2009-11-12 08:38:56 +0000 | [diff] [blame] | 24 | |
| 25 | namespace { |
| 26 | |
Zhongxing Xu | 7fb1464 | 2009-12-11 00:55:44 +0000 | [diff] [blame] | 27 | class RefState { |
Ted Kremenek | dde201b | 2010-08-06 21:12:55 +0000 | [diff] [blame] | 28 | enum Kind { AllocateUnchecked, AllocateFailed, Released, Escaped, |
| 29 | Relinquished } K; |
Zhongxing Xu | 243fde9 | 2009-11-17 07:54:15 +0000 | [diff] [blame] | 30 | const Stmt *S; |
| 31 | |
Zhongxing Xu | 7fb1464 | 2009-12-11 00:55:44 +0000 | [diff] [blame] | 32 | public: |
Zhongxing Xu | 243fde9 | 2009-11-17 07:54:15 +0000 | [diff] [blame] | 33 | RefState(Kind k, const Stmt *s) : K(k), S(s) {} |
| 34 | |
Zhongxing Xu | b94b81a | 2009-12-31 06:13:07 +0000 | [diff] [blame] | 35 | bool isAllocated() const { return K == AllocateUnchecked; } |
Chris Lattner | fae9622 | 2010-09-03 04:34:38 +0000 | [diff] [blame] | 36 | //bool isFailed() const { return K == AllocateFailed; } |
Zhongxing Xu | 243fde9 | 2009-11-17 07:54:15 +0000 | [diff] [blame] | 37 | bool isReleased() const { return K == Released; } |
Chris Lattner | fae9622 | 2010-09-03 04:34:38 +0000 | [diff] [blame] | 38 | //bool isEscaped() const { return K == Escaped; } |
| 39 | //bool isRelinquished() const { return K == Relinquished; } |
Zhongxing Xu | 243fde9 | 2009-11-17 07:54:15 +0000 | [diff] [blame] | 40 | |
| 41 | bool operator==(const RefState &X) const { |
| 42 | return K == X.K && S == X.S; |
| 43 | } |
| 44 | |
Zhongxing Xu | b94b81a | 2009-12-31 06:13:07 +0000 | [diff] [blame] | 45 | static RefState getAllocateUnchecked(const Stmt *s) { |
| 46 | return RefState(AllocateUnchecked, s); |
| 47 | } |
| 48 | static RefState getAllocateFailed() { |
| 49 | return RefState(AllocateFailed, 0); |
| 50 | } |
Zhongxing Xu | 243fde9 | 2009-11-17 07:54:15 +0000 | [diff] [blame] | 51 | static RefState getReleased(const Stmt *s) { return RefState(Released, s); } |
| 52 | static RefState getEscaped(const Stmt *s) { return RefState(Escaped, s); } |
Ted Kremenek | dde201b | 2010-08-06 21:12:55 +0000 | [diff] [blame] | 53 | static RefState getRelinquished(const Stmt *s) { |
| 54 | return RefState(Relinquished, s); |
| 55 | } |
Zhongxing Xu | 243fde9 | 2009-11-17 07:54:15 +0000 | [diff] [blame] | 56 | |
| 57 | void Profile(llvm::FoldingSetNodeID &ID) const { |
| 58 | ID.AddInteger(K); |
| 59 | ID.AddPointer(S); |
| 60 | } |
Zhongxing Xu | 589c0f2 | 2009-11-12 08:38:56 +0000 | [diff] [blame] | 61 | }; |
| 62 | |
Kovarththanan Rajaratnam | ba5fb5a | 2009-11-28 06:07:30 +0000 | [diff] [blame] | 63 | class RegionState {}; |
Zhongxing Xu | 589c0f2 | 2009-11-12 08:38:56 +0000 | [diff] [blame] | 64 | |
Kovarththanan Rajaratnam | ba5fb5a | 2009-11-28 06:07:30 +0000 | [diff] [blame] | 65 | class MallocChecker : public CheckerVisitor<MallocChecker> { |
Zhongxing Xu | 589c0f2 | 2009-11-12 08:38:56 +0000 | [diff] [blame] | 66 | BuiltinBug *BT_DoubleFree; |
Zhongxing Xu | fc7ac8f | 2009-11-13 07:48:11 +0000 | [diff] [blame] | 67 | BuiltinBug *BT_Leak; |
Zhongxing Xu | c802378 | 2010-03-10 04:58:55 +0000 | [diff] [blame] | 68 | BuiltinBug *BT_UseFree; |
Ted Kremenek | dd0e490 | 2010-07-31 01:52:11 +0000 | [diff] [blame] | 69 | BuiltinBug *BT_UseRelinquished; |
Jordy Rose | 43859f6 | 2010-06-07 19:32:37 +0000 | [diff] [blame] | 70 | BuiltinBug *BT_BadFree; |
Zhongxing Xu | a5ce966 | 2010-06-01 03:01:33 +0000 | [diff] [blame] | 71 | IdentifierInfo *II_malloc, *II_free, *II_realloc, *II_calloc; |
Zhongxing Xu | 589c0f2 | 2009-11-12 08:38:56 +0000 | [diff] [blame] | 72 | |
| 73 | public: |
Zhongxing Xu | d9c84c8 | 2009-12-12 12:29:38 +0000 | [diff] [blame] | 74 | MallocChecker() |
Ted Kremenek | dde201b | 2010-08-06 21:12:55 +0000 | [diff] [blame] | 75 | : BT_DoubleFree(0), BT_Leak(0), BT_UseFree(0), BT_UseRelinquished(0), |
| 76 | BT_BadFree(0), |
Zhongxing Xu | a5ce966 | 2010-06-01 03:01:33 +0000 | [diff] [blame] | 77 | II_malloc(0), II_free(0), II_realloc(0), II_calloc(0) {} |
Zhongxing Xu | 589c0f2 | 2009-11-12 08:38:56 +0000 | [diff] [blame] | 78 | static void *getTag(); |
Ted Kremenek | 9c14953 | 2010-12-01 21:57:22 +0000 | [diff] [blame] | 79 | bool evalCallExpr(CheckerContext &C, const CallExpr *CE); |
| 80 | void evalDeadSymbols(CheckerContext &C, SymbolReaper &SymReaper); |
Argyrios Kyrtzidis | d2592a3 | 2010-12-22 18:53:44 +0000 | [diff] [blame^] | 81 | void evalEndPath(EndPathNodeBuilder &B, void *tag, ExprEngine &Eng); |
Zhongxing Xu | 4985e3e | 2009-11-17 08:58:18 +0000 | [diff] [blame] | 82 | void PreVisitReturnStmt(CheckerContext &C, const ReturnStmt *S); |
Ted Kremenek | 9c14953 | 2010-12-01 21:57:22 +0000 | [diff] [blame] | 83 | const GRState *evalAssume(const GRState *state, SVal Cond, bool Assumption, |
Jordy Rose | 72905cf | 2010-08-04 07:10:57 +0000 | [diff] [blame] | 84 | bool *respondsToCallback); |
Ted Kremenek | 342e907 | 2010-12-20 21:22:47 +0000 | [diff] [blame] | 85 | void visitLocation(CheckerContext &C, const Stmt *S, SVal l); |
Ted Kremenek | 79d7304 | 2010-09-02 00:56:20 +0000 | [diff] [blame] | 86 | virtual void PreVisitBind(CheckerContext &C, const Stmt *StoreE, |
| 87 | SVal location, SVal val); |
Zhongxing Xu | b94b81a | 2009-12-31 06:13:07 +0000 | [diff] [blame] | 88 | |
Zhongxing Xu | 7b76096 | 2009-11-13 07:25:27 +0000 | [diff] [blame] | 89 | private: |
Zhongxing Xu | 589c0f2 | 2009-11-12 08:38:56 +0000 | [diff] [blame] | 90 | void MallocMem(CheckerContext &C, const CallExpr *CE); |
Ted Kremenek | dde201b | 2010-08-06 21:12:55 +0000 | [diff] [blame] | 91 | void MallocMemReturnsAttr(CheckerContext &C, const CallExpr *CE, |
| 92 | const OwnershipAttr* Att); |
Zhongxing Xu | d9c84c8 | 2009-12-12 12:29:38 +0000 | [diff] [blame] | 93 | const GRState *MallocMemAux(CheckerContext &C, const CallExpr *CE, |
Zhongxing Xu | a5ce966 | 2010-06-01 03:01:33 +0000 | [diff] [blame] | 94 | const Expr *SizeEx, SVal Init, |
| 95 | const GRState *state) { |
| 96 | return MallocMemAux(C, CE, state->getSVal(SizeEx), Init, state); |
| 97 | } |
| 98 | const GRState *MallocMemAux(CheckerContext &C, const CallExpr *CE, |
| 99 | SVal SizeEx, SVal Init, |
| 100 | const GRState *state); |
| 101 | |
Zhongxing Xu | 589c0f2 | 2009-11-12 08:38:56 +0000 | [diff] [blame] | 102 | void FreeMem(CheckerContext &C, const CallExpr *CE); |
Jordy Rose | 2a47992 | 2010-08-12 08:54:03 +0000 | [diff] [blame] | 103 | void FreeMemAttr(CheckerContext &C, const CallExpr *CE, |
| 104 | const OwnershipAttr* Att); |
Zhongxing Xu | d9c84c8 | 2009-12-12 12:29:38 +0000 | [diff] [blame] | 105 | const GRState *FreeMemAux(CheckerContext &C, const CallExpr *CE, |
Ted Kremenek | dd0e490 | 2010-07-31 01:52:11 +0000 | [diff] [blame] | 106 | const GRState *state, unsigned Num, bool Hold); |
Zhongxing Xu | d9c84c8 | 2009-12-12 12:29:38 +0000 | [diff] [blame] | 107 | |
| 108 | void ReallocMem(CheckerContext &C, const CallExpr *CE); |
Zhongxing Xu | a5ce966 | 2010-06-01 03:01:33 +0000 | [diff] [blame] | 109 | void CallocMem(CheckerContext &C, const CallExpr *CE); |
Jordy Rose | 43859f6 | 2010-06-07 19:32:37 +0000 | [diff] [blame] | 110 | |
| 111 | bool SummarizeValue(llvm::raw_ostream& os, SVal V); |
| 112 | bool SummarizeRegion(llvm::raw_ostream& os, const MemRegion *MR); |
| 113 | void ReportBadFree(CheckerContext &C, SVal ArgVal, SourceRange range); |
Zhongxing Xu | 589c0f2 | 2009-11-12 08:38:56 +0000 | [diff] [blame] | 114 | }; |
Kovarththanan Rajaratnam | ba5fb5a | 2009-11-28 06:07:30 +0000 | [diff] [blame] | 115 | } // end anonymous namespace |
Zhongxing Xu | 589c0f2 | 2009-11-12 08:38:56 +0000 | [diff] [blame] | 116 | |
Zhongxing Xu | b94b81a | 2009-12-31 06:13:07 +0000 | [diff] [blame] | 117 | typedef llvm::ImmutableMap<SymbolRef, RefState> RegionStateTy; |
| 118 | |
Zhongxing Xu | 589c0f2 | 2009-11-12 08:38:56 +0000 | [diff] [blame] | 119 | namespace clang { |
Argyrios Kyrtzidis | 5a4f98f | 2010-12-22 18:53:20 +0000 | [diff] [blame] | 120 | namespace GR { |
Zhongxing Xu | 243fde9 | 2009-11-17 07:54:15 +0000 | [diff] [blame] | 121 | template <> |
Zhongxing Xu | 589c0f2 | 2009-11-12 08:38:56 +0000 | [diff] [blame] | 122 | struct GRStateTrait<RegionState> |
Jordy Rose | 09cef09 | 2010-08-18 04:26:59 +0000 | [diff] [blame] | 123 | : public GRStatePartialTrait<RegionStateTy> { |
Zhongxing Xu | 589c0f2 | 2009-11-12 08:38:56 +0000 | [diff] [blame] | 124 | static void *GDMIndex() { return MallocChecker::getTag(); } |
| 125 | }; |
| 126 | } |
Argyrios Kyrtzidis | 5a4f98f | 2010-12-22 18:53:20 +0000 | [diff] [blame] | 127 | } |
Zhongxing Xu | 589c0f2 | 2009-11-12 08:38:56 +0000 | [diff] [blame] | 128 | |
Argyrios Kyrtzidis | d2592a3 | 2010-12-22 18:53:44 +0000 | [diff] [blame^] | 129 | void GR::RegisterMallocChecker(ExprEngine &Eng) { |
Zhongxing Xu | 7b76096 | 2009-11-13 07:25:27 +0000 | [diff] [blame] | 130 | Eng.registerCheck(new MallocChecker()); |
| 131 | } |
| 132 | |
Zhongxing Xu | 589c0f2 | 2009-11-12 08:38:56 +0000 | [diff] [blame] | 133 | void *MallocChecker::getTag() { |
| 134 | static int x; |
| 135 | return &x; |
| 136 | } |
| 137 | |
Ted Kremenek | 9c14953 | 2010-12-01 21:57:22 +0000 | [diff] [blame] | 138 | bool MallocChecker::evalCallExpr(CheckerContext &C, const CallExpr *CE) { |
Zhongxing Xu | a49c6b7 | 2009-12-11 03:09:01 +0000 | [diff] [blame] | 139 | const GRState *state = C.getState(); |
| 140 | const Expr *Callee = CE->getCallee(); |
Ted Kremenek | 1397663 | 2010-02-08 16:18:51 +0000 | [diff] [blame] | 141 | SVal L = state->getSVal(Callee); |
Zhongxing Xu | a49c6b7 | 2009-12-11 03:09:01 +0000 | [diff] [blame] | 142 | |
| 143 | const FunctionDecl *FD = L.getAsFunctionDecl(); |
Zhongxing Xu | 589c0f2 | 2009-11-12 08:38:56 +0000 | [diff] [blame] | 144 | if (!FD) |
Zhongxing Xu | a49c6b7 | 2009-12-11 03:09:01 +0000 | [diff] [blame] | 145 | return false; |
Zhongxing Xu | 589c0f2 | 2009-11-12 08:38:56 +0000 | [diff] [blame] | 146 | |
| 147 | ASTContext &Ctx = C.getASTContext(); |
| 148 | if (!II_malloc) |
| 149 | II_malloc = &Ctx.Idents.get("malloc"); |
| 150 | if (!II_free) |
Zhongxing Xu | fc7ac8f | 2009-11-13 07:48:11 +0000 | [diff] [blame] | 151 | II_free = &Ctx.Idents.get("free"); |
Zhongxing Xu | d9c84c8 | 2009-12-12 12:29:38 +0000 | [diff] [blame] | 152 | if (!II_realloc) |
| 153 | II_realloc = &Ctx.Idents.get("realloc"); |
Zhongxing Xu | a5ce966 | 2010-06-01 03:01:33 +0000 | [diff] [blame] | 154 | if (!II_calloc) |
| 155 | II_calloc = &Ctx.Idents.get("calloc"); |
Zhongxing Xu | 589c0f2 | 2009-11-12 08:38:56 +0000 | [diff] [blame] | 156 | |
| 157 | if (FD->getIdentifier() == II_malloc) { |
| 158 | MallocMem(C, CE); |
Zhongxing Xu | a49c6b7 | 2009-12-11 03:09:01 +0000 | [diff] [blame] | 159 | return true; |
Zhongxing Xu | 589c0f2 | 2009-11-12 08:38:56 +0000 | [diff] [blame] | 160 | } |
| 161 | |
| 162 | if (FD->getIdentifier() == II_free) { |
| 163 | FreeMem(C, CE); |
Zhongxing Xu | a49c6b7 | 2009-12-11 03:09:01 +0000 | [diff] [blame] | 164 | return true; |
Zhongxing Xu | 589c0f2 | 2009-11-12 08:38:56 +0000 | [diff] [blame] | 165 | } |
Zhongxing Xu | a49c6b7 | 2009-12-11 03:09:01 +0000 | [diff] [blame] | 166 | |
Zhongxing Xu | d9c84c8 | 2009-12-12 12:29:38 +0000 | [diff] [blame] | 167 | if (FD->getIdentifier() == II_realloc) { |
| 168 | ReallocMem(C, CE); |
| 169 | return true; |
| 170 | } |
| 171 | |
Zhongxing Xu | a5ce966 | 2010-06-01 03:01:33 +0000 | [diff] [blame] | 172 | if (FD->getIdentifier() == II_calloc) { |
| 173 | CallocMem(C, CE); |
| 174 | return true; |
| 175 | } |
| 176 | |
Ted Kremenek | dd0e490 | 2010-07-31 01:52:11 +0000 | [diff] [blame] | 177 | // Check all the attributes, if there are any. |
| 178 | // There can be multiple of these attributes. |
| 179 | bool rv = false; |
| 180 | if (FD->hasAttrs()) { |
Sean Hunt | cf807c4 | 2010-08-18 23:23:40 +0000 | [diff] [blame] | 181 | for (specific_attr_iterator<OwnershipAttr> |
| 182 | i = FD->specific_attr_begin<OwnershipAttr>(), |
| 183 | e = FD->specific_attr_end<OwnershipAttr>(); |
| 184 | i != e; ++i) { |
| 185 | switch ((*i)->getOwnKind()) { |
| 186 | case OwnershipAttr::Returns: { |
| 187 | MallocMemReturnsAttr(C, CE, *i); |
Jordy Rose | 2a47992 | 2010-08-12 08:54:03 +0000 | [diff] [blame] | 188 | rv = true; |
| 189 | break; |
Sean Hunt | cf807c4 | 2010-08-18 23:23:40 +0000 | [diff] [blame] | 190 | } |
| 191 | case OwnershipAttr::Takes: |
| 192 | case OwnershipAttr::Holds: { |
| 193 | FreeMemAttr(C, CE, *i); |
Jordy Rose | 2a47992 | 2010-08-12 08:54:03 +0000 | [diff] [blame] | 194 | rv = true; |
| 195 | break; |
Sean Hunt | cf807c4 | 2010-08-18 23:23:40 +0000 | [diff] [blame] | 196 | } |
Jordy Rose | 2a47992 | 2010-08-12 08:54:03 +0000 | [diff] [blame] | 197 | default: |
Jordy Rose | 2a47992 | 2010-08-12 08:54:03 +0000 | [diff] [blame] | 198 | break; |
Ted Kremenek | dd0e490 | 2010-07-31 01:52:11 +0000 | [diff] [blame] | 199 | } |
| 200 | } |
| 201 | } |
| 202 | return rv; |
Zhongxing Xu | 589c0f2 | 2009-11-12 08:38:56 +0000 | [diff] [blame] | 203 | } |
| 204 | |
| 205 | void MallocChecker::MallocMem(CheckerContext &C, const CallExpr *CE) { |
Zhongxing Xu | a5ce966 | 2010-06-01 03:01:33 +0000 | [diff] [blame] | 206 | const GRState *state = MallocMemAux(C, CE, CE->getArg(0), UndefinedVal(), |
| 207 | C.getState()); |
Zhongxing Xu | d9c84c8 | 2009-12-12 12:29:38 +0000 | [diff] [blame] | 208 | C.addTransition(state); |
| 209 | } |
| 210 | |
Ted Kremenek | dd0e490 | 2010-07-31 01:52:11 +0000 | [diff] [blame] | 211 | void MallocChecker::MallocMemReturnsAttr(CheckerContext &C, const CallExpr *CE, |
| 212 | const OwnershipAttr* Att) { |
Sean Hunt | cf807c4 | 2010-08-18 23:23:40 +0000 | [diff] [blame] | 213 | if (Att->getModule() != "malloc") |
Ted Kremenek | dd0e490 | 2010-07-31 01:52:11 +0000 | [diff] [blame] | 214 | return; |
| 215 | |
Sean Hunt | cf807c4 | 2010-08-18 23:23:40 +0000 | [diff] [blame] | 216 | OwnershipAttr::args_iterator I = Att->args_begin(), E = Att->args_end(); |
Ted Kremenek | dd0e490 | 2010-07-31 01:52:11 +0000 | [diff] [blame] | 217 | if (I != E) { |
| 218 | const GRState *state = |
| 219 | MallocMemAux(C, CE, CE->getArg(*I), UndefinedVal(), C.getState()); |
| 220 | C.addTransition(state); |
| 221 | return; |
| 222 | } |
| 223 | const GRState *state = MallocMemAux(C, CE, UnknownVal(), UndefinedVal(), |
| 224 | C.getState()); |
| 225 | C.addTransition(state); |
| 226 | } |
| 227 | |
Zhongxing Xu | d9c84c8 | 2009-12-12 12:29:38 +0000 | [diff] [blame] | 228 | const GRState *MallocChecker::MallocMemAux(CheckerContext &C, |
| 229 | const CallExpr *CE, |
Zhongxing Xu | a5ce966 | 2010-06-01 03:01:33 +0000 | [diff] [blame] | 230 | SVal Size, SVal Init, |
Zhongxing Xu | d9c84c8 | 2009-12-12 12:29:38 +0000 | [diff] [blame] | 231 | const GRState *state) { |
Zhongxing Xu | a49c6b7 | 2009-12-11 03:09:01 +0000 | [diff] [blame] | 232 | unsigned Count = C.getNodeBuilder().getCurrentBlockCount(); |
Ted Kremenek | c8413fd | 2010-12-02 07:49:45 +0000 | [diff] [blame] | 233 | SValBuilder &svalBuilder = C.getSValBuilder(); |
Zhongxing Xu | a49c6b7 | 2009-12-11 03:09:01 +0000 | [diff] [blame] | 234 | |
Jordy Rose | 32f2656 | 2010-07-04 00:00:41 +0000 | [diff] [blame] | 235 | // Set the return value. |
Ted Kremenek | c8413fd | 2010-12-02 07:49:45 +0000 | [diff] [blame] | 236 | SVal retVal = svalBuilder.getConjuredSymbolVal(NULL, CE, CE->getType(), Count); |
| 237 | state = state->BindExpr(CE, retVal); |
Zhongxing Xu | a49c6b7 | 2009-12-11 03:09:01 +0000 | [diff] [blame] | 238 | |
Jordy Rose | 32f2656 | 2010-07-04 00:00:41 +0000 | [diff] [blame] | 239 | // Fill the region with the initialization value. |
Ted Kremenek | c8413fd | 2010-12-02 07:49:45 +0000 | [diff] [blame] | 240 | state = state->bindDefault(retVal, Init); |
Zhongxing Xu | a5ce966 | 2010-06-01 03:01:33 +0000 | [diff] [blame] | 241 | |
Jordy Rose | 32f2656 | 2010-07-04 00:00:41 +0000 | [diff] [blame] | 242 | // Set the region's extent equal to the Size parameter. |
Ted Kremenek | c8413fd | 2010-12-02 07:49:45 +0000 | [diff] [blame] | 243 | const SymbolicRegion *R = cast<SymbolicRegion>(retVal.getAsRegion()); |
| 244 | DefinedOrUnknownSVal Extent = R->getExtent(svalBuilder); |
Jordy Rose | 32f2656 | 2010-07-04 00:00:41 +0000 | [diff] [blame] | 245 | DefinedOrUnknownSVal DefinedSize = cast<DefinedOrUnknownSVal>(Size); |
Ted Kremenek | c8413fd | 2010-12-02 07:49:45 +0000 | [diff] [blame] | 246 | DefinedOrUnknownSVal extentMatchesSize = |
Ted Kremenek | 9c14953 | 2010-12-01 21:57:22 +0000 | [diff] [blame] | 247 | svalBuilder.evalEQ(state, Extent, DefinedSize); |
Jordy Rose | 32f2656 | 2010-07-04 00:00:41 +0000 | [diff] [blame] | 248 | |
Ted Kremenek | c8413fd | 2010-12-02 07:49:45 +0000 | [diff] [blame] | 249 | state = state->assume(extentMatchesSize, true); |
| 250 | assert(state); |
| 251 | |
| 252 | SymbolRef Sym = retVal.getAsLocSymbol(); |
Zhongxing Xu | 589c0f2 | 2009-11-12 08:38:56 +0000 | [diff] [blame] | 253 | assert(Sym); |
Ted Kremenek | c8413fd | 2010-12-02 07:49:45 +0000 | [diff] [blame] | 254 | |
Zhongxing Xu | 589c0f2 | 2009-11-12 08:38:56 +0000 | [diff] [blame] | 255 | // Set the symbol's state to Allocated. |
Zhongxing Xu | b94b81a | 2009-12-31 06:13:07 +0000 | [diff] [blame] | 256 | return state->set<RegionState>(Sym, RefState::getAllocateUnchecked(CE)); |
Zhongxing Xu | 589c0f2 | 2009-11-12 08:38:56 +0000 | [diff] [blame] | 257 | } |
| 258 | |
| 259 | void MallocChecker::FreeMem(CheckerContext &C, const CallExpr *CE) { |
Ted Kremenek | dd0e490 | 2010-07-31 01:52:11 +0000 | [diff] [blame] | 260 | const GRState *state = FreeMemAux(C, CE, C.getState(), 0, false); |
Zhongxing Xu | d9c84c8 | 2009-12-12 12:29:38 +0000 | [diff] [blame] | 261 | |
| 262 | if (state) |
| 263 | C.addTransition(state); |
| 264 | } |
| 265 | |
Ted Kremenek | dd0e490 | 2010-07-31 01:52:11 +0000 | [diff] [blame] | 266 | void MallocChecker::FreeMemAttr(CheckerContext &C, const CallExpr *CE, |
Jordy Rose | 2a47992 | 2010-08-12 08:54:03 +0000 | [diff] [blame] | 267 | const OwnershipAttr* Att) { |
Sean Hunt | cf807c4 | 2010-08-18 23:23:40 +0000 | [diff] [blame] | 268 | if (Att->getModule() != "malloc") |
Ted Kremenek | dd0e490 | 2010-07-31 01:52:11 +0000 | [diff] [blame] | 269 | return; |
| 270 | |
Sean Hunt | cf807c4 | 2010-08-18 23:23:40 +0000 | [diff] [blame] | 271 | for (OwnershipAttr::args_iterator I = Att->args_begin(), E = Att->args_end(); |
| 272 | I != E; ++I) { |
| 273 | const GRState *state = FreeMemAux(C, CE, C.getState(), *I, |
| 274 | Att->getOwnKind() == OwnershipAttr::Holds); |
| 275 | if (state) |
| 276 | C.addTransition(state); |
Ted Kremenek | dd0e490 | 2010-07-31 01:52:11 +0000 | [diff] [blame] | 277 | } |
| 278 | } |
| 279 | |
Zhongxing Xu | d9c84c8 | 2009-12-12 12:29:38 +0000 | [diff] [blame] | 280 | const GRState *MallocChecker::FreeMemAux(CheckerContext &C, const CallExpr *CE, |
Ted Kremenek | dd0e490 | 2010-07-31 01:52:11 +0000 | [diff] [blame] | 281 | const GRState *state, unsigned Num, |
| 282 | bool Hold) { |
| 283 | const Expr *ArgExpr = CE->getArg(Num); |
Jordy Rose | 43859f6 | 2010-06-07 19:32:37 +0000 | [diff] [blame] | 284 | SVal ArgVal = state->getSVal(ArgExpr); |
Zhongxing Xu | 181cc3d | 2010-02-14 06:49:48 +0000 | [diff] [blame] | 285 | |
Ted Kremenek | dd0e490 | 2010-07-31 01:52:11 +0000 | [diff] [blame] | 286 | DefinedOrUnknownSVal location = cast<DefinedOrUnknownSVal>(ArgVal); |
| 287 | |
| 288 | // Check for null dereferences. |
| 289 | if (!isa<Loc>(location)) |
Zhongxing Xu | 181cc3d | 2010-02-14 06:49:48 +0000 | [diff] [blame] | 290 | return state; |
Ted Kremenek | dd0e490 | 2010-07-31 01:52:11 +0000 | [diff] [blame] | 291 | |
| 292 | // FIXME: Technically using 'Assume' here can result in a path |
| 293 | // bifurcation. In such cases we need to return two states, not just one. |
| 294 | const GRState *notNullState, *nullState; |
Ted Kremenek | 28f47b9 | 2010-12-01 22:16:56 +0000 | [diff] [blame] | 295 | llvm::tie(notNullState, nullState) = state->assume(location); |
Ted Kremenek | dd0e490 | 2010-07-31 01:52:11 +0000 | [diff] [blame] | 296 | |
| 297 | // The explicit NULL case, no operation is performed. |
| 298 | if (nullState && !notNullState) |
| 299 | return nullState; |
| 300 | |
| 301 | assert(notNullState); |
| 302 | |
Jordy Rose | 43859f6 | 2010-06-07 19:32:37 +0000 | [diff] [blame] | 303 | // Unknown values could easily be okay |
| 304 | // Undefined values are handled elsewhere |
| 305 | if (ArgVal.isUnknownOrUndef()) |
Ted Kremenek | dd0e490 | 2010-07-31 01:52:11 +0000 | [diff] [blame] | 306 | return notNullState; |
Zhongxing Xu | 589c0f2 | 2009-11-12 08:38:56 +0000 | [diff] [blame] | 307 | |
Jordy Rose | 43859f6 | 2010-06-07 19:32:37 +0000 | [diff] [blame] | 308 | const MemRegion *R = ArgVal.getAsRegion(); |
| 309 | |
| 310 | // Nonlocs can't be freed, of course. |
| 311 | // Non-region locations (labels and fixed addresses) also shouldn't be freed. |
| 312 | if (!R) { |
| 313 | ReportBadFree(C, ArgVal, ArgExpr->getSourceRange()); |
| 314 | return NULL; |
| 315 | } |
| 316 | |
| 317 | R = R->StripCasts(); |
| 318 | |
| 319 | // Blocks might show up as heap data, but should not be free()d |
| 320 | if (isa<BlockDataRegion>(R)) { |
| 321 | ReportBadFree(C, ArgVal, ArgExpr->getSourceRange()); |
| 322 | return NULL; |
| 323 | } |
| 324 | |
| 325 | const MemSpaceRegion *MS = R->getMemorySpace(); |
| 326 | |
| 327 | // Parameters, locals, statics, and globals shouldn't be freed. |
| 328 | if (!(isa<UnknownSpaceRegion>(MS) || isa<HeapSpaceRegion>(MS))) { |
| 329 | // FIXME: at the time this code was written, malloc() regions were |
| 330 | // represented by conjured symbols, which are all in UnknownSpaceRegion. |
| 331 | // This means that there isn't actually anything from HeapSpaceRegion |
| 332 | // that should be freed, even though we allow it here. |
| 333 | // Of course, free() can work on memory allocated outside the current |
| 334 | // function, so UnknownSpaceRegion is always a possibility. |
| 335 | // False negatives are better than false positives. |
| 336 | |
| 337 | ReportBadFree(C, ArgVal, ArgExpr->getSourceRange()); |
| 338 | return NULL; |
| 339 | } |
| 340 | |
| 341 | const SymbolicRegion *SR = dyn_cast<SymbolicRegion>(R); |
| 342 | // Various cases could lead to non-symbol values here. |
| 343 | // For now, ignore them. |
| 344 | if (!SR) |
Ted Kremenek | dd0e490 | 2010-07-31 01:52:11 +0000 | [diff] [blame] | 345 | return notNullState; |
Jordy Rose | 43859f6 | 2010-06-07 19:32:37 +0000 | [diff] [blame] | 346 | |
| 347 | SymbolRef Sym = SR->getSymbol(); |
Zhongxing Xu | 589c0f2 | 2009-11-12 08:38:56 +0000 | [diff] [blame] | 348 | const RefState *RS = state->get<RegionState>(Sym); |
Zhongxing Xu | 7e3cda9 | 2010-01-18 03:27:34 +0000 | [diff] [blame] | 349 | |
| 350 | // If the symbol has not been tracked, return. This is possible when free() is |
| 351 | // called on a pointer that does not get its pointee directly from malloc(). |
| 352 | // Full support of this requires inter-procedural analysis. |
| 353 | if (!RS) |
Ted Kremenek | dd0e490 | 2010-07-31 01:52:11 +0000 | [diff] [blame] | 354 | return notNullState; |
Zhongxing Xu | 589c0f2 | 2009-11-12 08:38:56 +0000 | [diff] [blame] | 355 | |
| 356 | // Check double free. |
Zhongxing Xu | 243fde9 | 2009-11-17 07:54:15 +0000 | [diff] [blame] | 357 | if (RS->isReleased()) { |
Ted Kremenek | d048c6e | 2010-12-20 21:19:09 +0000 | [diff] [blame] | 358 | if (ExplodedNode *N = C.generateSink()) { |
Zhongxing Xu | 589c0f2 | 2009-11-12 08:38:56 +0000 | [diff] [blame] | 359 | if (!BT_DoubleFree) |
Ted Kremenek | dd0e490 | 2010-07-31 01:52:11 +0000 | [diff] [blame] | 360 | BT_DoubleFree |
| 361 | = new BuiltinBug("Double free", |
Zhongxing Xu | 589c0f2 | 2009-11-12 08:38:56 +0000 | [diff] [blame] | 362 | "Try to free a memory block that has been released"); |
| 363 | // FIXME: should find where it's freed last time. |
| 364 | BugReport *R = new BugReport(*BT_DoubleFree, |
Benjamin Kramer | d02e232 | 2009-11-14 12:08:24 +0000 | [diff] [blame] | 365 | BT_DoubleFree->getDescription(), N); |
Zhongxing Xu | 589c0f2 | 2009-11-12 08:38:56 +0000 | [diff] [blame] | 366 | C.EmitReport(R); |
| 367 | } |
Zhongxing Xu | d9c84c8 | 2009-12-12 12:29:38 +0000 | [diff] [blame] | 368 | return NULL; |
Zhongxing Xu | 589c0f2 | 2009-11-12 08:38:56 +0000 | [diff] [blame] | 369 | } |
| 370 | |
| 371 | // Normal free. |
Ted Kremenek | dd0e490 | 2010-07-31 01:52:11 +0000 | [diff] [blame] | 372 | if (Hold) |
| 373 | return notNullState->set<RegionState>(Sym, RefState::getRelinquished(CE)); |
| 374 | return notNullState->set<RegionState>(Sym, RefState::getReleased(CE)); |
Zhongxing Xu | d9c84c8 | 2009-12-12 12:29:38 +0000 | [diff] [blame] | 375 | } |
| 376 | |
Jordy Rose | 43859f6 | 2010-06-07 19:32:37 +0000 | [diff] [blame] | 377 | bool MallocChecker::SummarizeValue(llvm::raw_ostream& os, SVal V) { |
| 378 | if (nonloc::ConcreteInt *IntVal = dyn_cast<nonloc::ConcreteInt>(&V)) |
| 379 | os << "an integer (" << IntVal->getValue() << ")"; |
| 380 | else if (loc::ConcreteInt *ConstAddr = dyn_cast<loc::ConcreteInt>(&V)) |
| 381 | os << "a constant address (" << ConstAddr->getValue() << ")"; |
| 382 | else if (loc::GotoLabel *Label = dyn_cast<loc::GotoLabel>(&V)) |
| 383 | os << "the address of the label '" |
| 384 | << Label->getLabel()->getID()->getName() |
| 385 | << "'"; |
| 386 | else |
| 387 | return false; |
| 388 | |
| 389 | return true; |
| 390 | } |
| 391 | |
| 392 | bool MallocChecker::SummarizeRegion(llvm::raw_ostream& os, |
| 393 | const MemRegion *MR) { |
| 394 | switch (MR->getKind()) { |
| 395 | case MemRegion::FunctionTextRegionKind: { |
| 396 | const FunctionDecl *FD = cast<FunctionTextRegion>(MR)->getDecl(); |
| 397 | if (FD) |
| 398 | os << "the address of the function '" << FD << "'"; |
| 399 | else |
| 400 | os << "the address of a function"; |
| 401 | return true; |
| 402 | } |
| 403 | case MemRegion::BlockTextRegionKind: |
| 404 | os << "block text"; |
| 405 | return true; |
| 406 | case MemRegion::BlockDataRegionKind: |
| 407 | // FIXME: where the block came from? |
| 408 | os << "a block"; |
| 409 | return true; |
| 410 | default: { |
| 411 | const MemSpaceRegion *MS = MR->getMemorySpace(); |
| 412 | |
| 413 | switch (MS->getKind()) { |
| 414 | case MemRegion::StackLocalsSpaceRegionKind: { |
| 415 | const VarRegion *VR = dyn_cast<VarRegion>(MR); |
| 416 | const VarDecl *VD; |
| 417 | if (VR) |
| 418 | VD = VR->getDecl(); |
| 419 | else |
| 420 | VD = NULL; |
| 421 | |
| 422 | if (VD) |
| 423 | os << "the address of the local variable '" << VD->getName() << "'"; |
| 424 | else |
| 425 | os << "the address of a local stack variable"; |
| 426 | return true; |
| 427 | } |
| 428 | case MemRegion::StackArgumentsSpaceRegionKind: { |
| 429 | const VarRegion *VR = dyn_cast<VarRegion>(MR); |
| 430 | const VarDecl *VD; |
| 431 | if (VR) |
| 432 | VD = VR->getDecl(); |
| 433 | else |
| 434 | VD = NULL; |
| 435 | |
| 436 | if (VD) |
| 437 | os << "the address of the parameter '" << VD->getName() << "'"; |
| 438 | else |
| 439 | os << "the address of a parameter"; |
| 440 | return true; |
| 441 | } |
Ted Kremenek | dcee3ce | 2010-07-01 20:16:50 +0000 | [diff] [blame] | 442 | case MemRegion::NonStaticGlobalSpaceRegionKind: |
| 443 | case MemRegion::StaticGlobalSpaceRegionKind: { |
Jordy Rose | 43859f6 | 2010-06-07 19:32:37 +0000 | [diff] [blame] | 444 | const VarRegion *VR = dyn_cast<VarRegion>(MR); |
| 445 | const VarDecl *VD; |
| 446 | if (VR) |
| 447 | VD = VR->getDecl(); |
| 448 | else |
| 449 | VD = NULL; |
| 450 | |
| 451 | if (VD) { |
| 452 | if (VD->isStaticLocal()) |
| 453 | os << "the address of the static variable '" << VD->getName() << "'"; |
| 454 | else |
| 455 | os << "the address of the global variable '" << VD->getName() << "'"; |
| 456 | } else |
| 457 | os << "the address of a global variable"; |
| 458 | return true; |
| 459 | } |
| 460 | default: |
| 461 | return false; |
| 462 | } |
| 463 | } |
| 464 | } |
| 465 | } |
| 466 | |
| 467 | void MallocChecker::ReportBadFree(CheckerContext &C, SVal ArgVal, |
| 468 | SourceRange range) { |
Ted Kremenek | d048c6e | 2010-12-20 21:19:09 +0000 | [diff] [blame] | 469 | if (ExplodedNode *N = C.generateSink()) { |
Jordy Rose | 43859f6 | 2010-06-07 19:32:37 +0000 | [diff] [blame] | 470 | if (!BT_BadFree) |
| 471 | BT_BadFree = new BuiltinBug("Bad free"); |
| 472 | |
| 473 | llvm::SmallString<100> buf; |
| 474 | llvm::raw_svector_ostream os(buf); |
| 475 | |
| 476 | const MemRegion *MR = ArgVal.getAsRegion(); |
| 477 | if (MR) { |
| 478 | while (const ElementRegion *ER = dyn_cast<ElementRegion>(MR)) |
| 479 | MR = ER->getSuperRegion(); |
| 480 | |
| 481 | // Special case for alloca() |
| 482 | if (isa<AllocaRegion>(MR)) |
| 483 | os << "Argument to free() was allocated by alloca(), not malloc()"; |
| 484 | else { |
| 485 | os << "Argument to free() is "; |
| 486 | if (SummarizeRegion(os, MR)) |
| 487 | os << ", which is not memory allocated by malloc()"; |
| 488 | else |
| 489 | os << "not memory allocated by malloc()"; |
| 490 | } |
| 491 | } else { |
| 492 | os << "Argument to free() is "; |
| 493 | if (SummarizeValue(os, ArgVal)) |
| 494 | os << ", which is not memory allocated by malloc()"; |
| 495 | else |
| 496 | os << "not memory allocated by malloc()"; |
| 497 | } |
| 498 | |
Jordy Rose | 3104124 | 2010-06-08 22:59:01 +0000 | [diff] [blame] | 499 | EnhancedBugReport *R = new EnhancedBugReport(*BT_BadFree, os.str(), N); |
Jordy Rose | 43859f6 | 2010-06-07 19:32:37 +0000 | [diff] [blame] | 500 | R->addRange(range); |
| 501 | C.EmitReport(R); |
| 502 | } |
| 503 | } |
| 504 | |
Zhongxing Xu | d9c84c8 | 2009-12-12 12:29:38 +0000 | [diff] [blame] | 505 | void MallocChecker::ReallocMem(CheckerContext &C, const CallExpr *CE) { |
| 506 | const GRState *state = C.getState(); |
Ted Kremenek | c8413fd | 2010-12-02 07:49:45 +0000 | [diff] [blame] | 507 | const Expr *arg0Expr = CE->getArg(0); |
| 508 | DefinedOrUnknownSVal arg0Val |
| 509 | = cast<DefinedOrUnknownSVal>(state->getSVal(arg0Expr)); |
Zhongxing Xu | d9c84c8 | 2009-12-12 12:29:38 +0000 | [diff] [blame] | 510 | |
Ted Kremenek | 846eabd | 2010-12-01 21:28:31 +0000 | [diff] [blame] | 511 | SValBuilder &svalBuilder = C.getSValBuilder(); |
Zhongxing Xu | d9c84c8 | 2009-12-12 12:29:38 +0000 | [diff] [blame] | 512 | |
Ted Kremenek | c8413fd | 2010-12-02 07:49:45 +0000 | [diff] [blame] | 513 | DefinedOrUnknownSVal PtrEQ = |
| 514 | svalBuilder.evalEQ(state, arg0Val, svalBuilder.makeNull()); |
Zhongxing Xu | d9c84c8 | 2009-12-12 12:29:38 +0000 | [diff] [blame] | 515 | |
| 516 | // If the ptr is NULL, the call is equivalent to malloc(size). |
Ted Kremenek | 28f47b9 | 2010-12-01 22:16:56 +0000 | [diff] [blame] | 517 | if (const GRState *stateEqual = state->assume(PtrEQ, true)) { |
Zhongxing Xu | d9c84c8 | 2009-12-12 12:29:38 +0000 | [diff] [blame] | 518 | // Hack: set the NULL symbolic region to released to suppress false warning. |
| 519 | // In the future we should add more states for allocated regions, e.g., |
| 520 | // CheckedNull, CheckedNonNull. |
| 521 | |
Ted Kremenek | c8413fd | 2010-12-02 07:49:45 +0000 | [diff] [blame] | 522 | SymbolRef Sym = arg0Val.getAsLocSymbol(); |
Zhongxing Xu | d9c84c8 | 2009-12-12 12:29:38 +0000 | [diff] [blame] | 523 | if (Sym) |
| 524 | stateEqual = stateEqual->set<RegionState>(Sym, RefState::getReleased(CE)); |
| 525 | |
Zhongxing Xu | a5ce966 | 2010-06-01 03:01:33 +0000 | [diff] [blame] | 526 | const GRState *stateMalloc = MallocMemAux(C, CE, CE->getArg(1), |
| 527 | UndefinedVal(), stateEqual); |
Zhongxing Xu | d9c84c8 | 2009-12-12 12:29:38 +0000 | [diff] [blame] | 528 | C.addTransition(stateMalloc); |
| 529 | } |
| 530 | |
Ted Kremenek | 28f47b9 | 2010-12-01 22:16:56 +0000 | [diff] [blame] | 531 | if (const GRState *stateNotEqual = state->assume(PtrEQ, false)) { |
Zhongxing Xu | d9c84c8 | 2009-12-12 12:29:38 +0000 | [diff] [blame] | 532 | const Expr *Arg1 = CE->getArg(1); |
| 533 | DefinedOrUnknownSVal Arg1Val = |
Ted Kremenek | 1397663 | 2010-02-08 16:18:51 +0000 | [diff] [blame] | 534 | cast<DefinedOrUnknownSVal>(stateNotEqual->getSVal(Arg1)); |
Ted Kremenek | c8413fd | 2010-12-02 07:49:45 +0000 | [diff] [blame] | 535 | DefinedOrUnknownSVal SizeZero = |
| 536 | svalBuilder.evalEQ(stateNotEqual, Arg1Val, |
| 537 | svalBuilder.makeIntValWithPtrWidth(0, false)); |
Zhongxing Xu | d9c84c8 | 2009-12-12 12:29:38 +0000 | [diff] [blame] | 538 | |
Ted Kremenek | c8413fd | 2010-12-02 07:49:45 +0000 | [diff] [blame] | 539 | if (const GRState *stateSizeZero = stateNotEqual->assume(SizeZero, true)) |
| 540 | if (const GRState *stateFree = FreeMemAux(C, CE, stateSizeZero, 0, false)) |
Zhongxing Xu | d9c84c8 | 2009-12-12 12:29:38 +0000 | [diff] [blame] | 541 | C.addTransition(stateFree->BindExpr(CE, UndefinedVal(), true)); |
Zhongxing Xu | d9c84c8 | 2009-12-12 12:29:38 +0000 | [diff] [blame] | 542 | |
Ted Kremenek | c8413fd | 2010-12-02 07:49:45 +0000 | [diff] [blame] | 543 | if (const GRState *stateSizeNotZero = stateNotEqual->assume(SizeZero,false)) |
| 544 | if (const GRState *stateFree = FreeMemAux(C, CE, stateSizeNotZero, |
| 545 | 0, false)) { |
Zhongxing Xu | d9c84c8 | 2009-12-12 12:29:38 +0000 | [diff] [blame] | 546 | // FIXME: We should copy the content of the original buffer. |
Zhongxing Xu | 3ed04d3 | 2010-01-18 08:54:31 +0000 | [diff] [blame] | 547 | const GRState *stateRealloc = MallocMemAux(C, CE, CE->getArg(1), |
Zhongxing Xu | a5ce966 | 2010-06-01 03:01:33 +0000 | [diff] [blame] | 548 | UnknownVal(), stateFree); |
Zhongxing Xu | d9c84c8 | 2009-12-12 12:29:38 +0000 | [diff] [blame] | 549 | C.addTransition(stateRealloc); |
| 550 | } |
Zhongxing Xu | d9c84c8 | 2009-12-12 12:29:38 +0000 | [diff] [blame] | 551 | } |
Zhongxing Xu | 589c0f2 | 2009-11-12 08:38:56 +0000 | [diff] [blame] | 552 | } |
Zhongxing Xu | 7b76096 | 2009-11-13 07:25:27 +0000 | [diff] [blame] | 553 | |
Zhongxing Xu | a5ce966 | 2010-06-01 03:01:33 +0000 | [diff] [blame] | 554 | void MallocChecker::CallocMem(CheckerContext &C, const CallExpr *CE) { |
| 555 | const GRState *state = C.getState(); |
Ted Kremenek | 846eabd | 2010-12-01 21:28:31 +0000 | [diff] [blame] | 556 | SValBuilder &svalBuilder = C.getSValBuilder(); |
Zhongxing Xu | a5ce966 | 2010-06-01 03:01:33 +0000 | [diff] [blame] | 557 | |
Ted Kremenek | c8413fd | 2010-12-02 07:49:45 +0000 | [diff] [blame] | 558 | SVal count = state->getSVal(CE->getArg(0)); |
| 559 | SVal elementSize = state->getSVal(CE->getArg(1)); |
| 560 | SVal TotalSize = svalBuilder.evalBinOp(state, BO_Mul, count, elementSize, |
| 561 | svalBuilder.getContext().getSizeType()); |
| 562 | SVal zeroVal = svalBuilder.makeZeroVal(svalBuilder.getContext().CharTy); |
Zhongxing Xu | a5ce966 | 2010-06-01 03:01:33 +0000 | [diff] [blame] | 563 | |
Ted Kremenek | c8413fd | 2010-12-02 07:49:45 +0000 | [diff] [blame] | 564 | C.addTransition(MallocMemAux(C, CE, TotalSize, zeroVal, state)); |
Zhongxing Xu | a5ce966 | 2010-06-01 03:01:33 +0000 | [diff] [blame] | 565 | } |
| 566 | |
Ted Kremenek | c8413fd | 2010-12-02 07:49:45 +0000 | [diff] [blame] | 567 | void MallocChecker::evalDeadSymbols(CheckerContext &C, SymbolReaper &SymReaper) |
| 568 | { |
Zhongxing Xu | 173ff56 | 2010-08-15 08:19:57 +0000 | [diff] [blame] | 569 | if (!SymReaper.hasDeadSymbols()) |
| 570 | return; |
Zhongxing Xu | fc7ac8f | 2009-11-13 07:48:11 +0000 | [diff] [blame] | 571 | |
Zhongxing Xu | 173ff56 | 2010-08-15 08:19:57 +0000 | [diff] [blame] | 572 | const GRState *state = C.getState(); |
| 573 | RegionStateTy RS = state->get<RegionState>(); |
Jordy Rose | 9076014 | 2010-08-18 04:33:47 +0000 | [diff] [blame] | 574 | RegionStateTy::Factory &F = state->get_context<RegionState>(); |
Zhongxing Xu | 173ff56 | 2010-08-15 08:19:57 +0000 | [diff] [blame] | 575 | |
| 576 | for (RegionStateTy::iterator I = RS.begin(), E = RS.end(); I != E; ++I) { |
| 577 | if (SymReaper.isDead(I->first)) { |
| 578 | if (I->second.isAllocated()) { |
Ted Kremenek | d048c6e | 2010-12-20 21:19:09 +0000 | [diff] [blame] | 579 | if (ExplodedNode *N = C.generateNode()) { |
Zhongxing Xu | 173ff56 | 2010-08-15 08:19:57 +0000 | [diff] [blame] | 580 | if (!BT_Leak) |
| 581 | BT_Leak = new BuiltinBug("Memory leak", |
Zhongxing Xu | fc7ac8f | 2009-11-13 07:48:11 +0000 | [diff] [blame] | 582 | "Allocated memory never released. Potential memory leak."); |
Zhongxing Xu | 173ff56 | 2010-08-15 08:19:57 +0000 | [diff] [blame] | 583 | // FIXME: where it is allocated. |
| 584 | BugReport *R = new BugReport(*BT_Leak, BT_Leak->getDescription(), N); |
| 585 | C.EmitReport(R); |
| 586 | } |
Zhongxing Xu | fc7ac8f | 2009-11-13 07:48:11 +0000 | [diff] [blame] | 587 | } |
Jordy Rose | 9076014 | 2010-08-18 04:33:47 +0000 | [diff] [blame] | 588 | |
| 589 | // Remove the dead symbol from the map. |
Ted Kremenek | 3baf672 | 2010-11-24 00:54:37 +0000 | [diff] [blame] | 590 | RS = F.remove(RS, I->first); |
Zhongxing Xu | fc7ac8f | 2009-11-13 07:48:11 +0000 | [diff] [blame] | 591 | } |
| 592 | } |
Ted Kremenek | d048c6e | 2010-12-20 21:19:09 +0000 | [diff] [blame] | 593 | C.generateNode(state->set<RegionState>(RS)); |
Zhongxing Xu | 7b76096 | 2009-11-13 07:25:27 +0000 | [diff] [blame] | 594 | } |
Zhongxing Xu | 243fde9 | 2009-11-17 07:54:15 +0000 | [diff] [blame] | 595 | |
Argyrios Kyrtzidis | d2592a3 | 2010-12-22 18:53:44 +0000 | [diff] [blame^] | 596 | void MallocChecker::evalEndPath(EndPathNodeBuilder &B, void *tag, |
| 597 | ExprEngine &Eng) { |
Zhongxing Xu | f605aae | 2009-11-22 13:22:34 +0000 | [diff] [blame] | 598 | SaveAndRestore<bool> OldHasGen(B.HasGeneratedNode); |
Zhongxing Xu | 243fde9 | 2009-11-17 07:54:15 +0000 | [diff] [blame] | 599 | const GRState *state = B.getState(); |
Jordy Rose | 09cef09 | 2010-08-18 04:26:59 +0000 | [diff] [blame] | 600 | RegionStateTy M = state->get<RegionState>(); |
Zhongxing Xu | 243fde9 | 2009-11-17 07:54:15 +0000 | [diff] [blame] | 601 | |
Jordy Rose | 09cef09 | 2010-08-18 04:26:59 +0000 | [diff] [blame] | 602 | for (RegionStateTy::iterator I = M.begin(), E = M.end(); I != E; ++I) { |
Zhongxing Xu | 243fde9 | 2009-11-17 07:54:15 +0000 | [diff] [blame] | 603 | RefState RS = I->second; |
| 604 | if (RS.isAllocated()) { |
| 605 | ExplodedNode *N = B.generateNode(state, tag, B.getPredecessor()); |
| 606 | if (N) { |
| 607 | if (!BT_Leak) |
| 608 | BT_Leak = new BuiltinBug("Memory leak", |
| 609 | "Allocated memory never released. Potential memory leak."); |
| 610 | BugReport *R = new BugReport(*BT_Leak, BT_Leak->getDescription(), N); |
| 611 | Eng.getBugReporter().EmitReport(R); |
| 612 | } |
| 613 | } |
| 614 | } |
| 615 | } |
Zhongxing Xu | 4985e3e | 2009-11-17 08:58:18 +0000 | [diff] [blame] | 616 | |
| 617 | void MallocChecker::PreVisitReturnStmt(CheckerContext &C, const ReturnStmt *S) { |
Ted Kremenek | c8413fd | 2010-12-02 07:49:45 +0000 | [diff] [blame] | 618 | const Expr *retExpr = S->getRetValue(); |
| 619 | if (!retExpr) |
Zhongxing Xu | 4985e3e | 2009-11-17 08:58:18 +0000 | [diff] [blame] | 620 | return; |
| 621 | |
| 622 | const GRState *state = C.getState(); |
| 623 | |
Ted Kremenek | c8413fd | 2010-12-02 07:49:45 +0000 | [diff] [blame] | 624 | SymbolRef Sym = state->getSVal(retExpr).getAsSymbol(); |
Zhongxing Xu | 4985e3e | 2009-11-17 08:58:18 +0000 | [diff] [blame] | 625 | if (!Sym) |
| 626 | return; |
| 627 | |
| 628 | const RefState *RS = state->get<RegionState>(Sym); |
| 629 | if (!RS) |
| 630 | return; |
| 631 | |
| 632 | // FIXME: check other cases. |
| 633 | if (RS->isAllocated()) |
| 634 | state = state->set<RegionState>(Sym, RefState::getEscaped(S)); |
| 635 | |
Ted Kremenek | 19d67b5 | 2009-11-23 22:22:01 +0000 | [diff] [blame] | 636 | C.addTransition(state); |
Zhongxing Xu | 4985e3e | 2009-11-17 08:58:18 +0000 | [diff] [blame] | 637 | } |
Zhongxing Xu | b94b81a | 2009-12-31 06:13:07 +0000 | [diff] [blame] | 638 | |
Ted Kremenek | 9c14953 | 2010-12-01 21:57:22 +0000 | [diff] [blame] | 639 | const GRState *MallocChecker::evalAssume(const GRState *state, SVal Cond, |
Jordy Rose | 72905cf | 2010-08-04 07:10:57 +0000 | [diff] [blame] | 640 | bool Assumption, |
| 641 | bool * /* respondsToCallback */) { |
Zhongxing Xu | b94b81a | 2009-12-31 06:13:07 +0000 | [diff] [blame] | 642 | // If a symblic region is assumed to NULL, set its state to AllocateFailed. |
| 643 | // FIXME: should also check symbols assumed to non-null. |
| 644 | |
| 645 | RegionStateTy RS = state->get<RegionState>(); |
| 646 | |
| 647 | for (RegionStateTy::iterator I = RS.begin(), E = RS.end(); I != E; ++I) { |
| 648 | if (state->getSymVal(I.getKey())) |
| 649 | state = state->set<RegionState>(I.getKey(),RefState::getAllocateFailed()); |
| 650 | } |
| 651 | |
| 652 | return state; |
| 653 | } |
Zhongxing Xu | c802378 | 2010-03-10 04:58:55 +0000 | [diff] [blame] | 654 | |
| 655 | // Check if the location is a freed symbolic region. |
Ted Kremenek | 342e907 | 2010-12-20 21:22:47 +0000 | [diff] [blame] | 656 | void MallocChecker::visitLocation(CheckerContext &C, const Stmt *S, SVal l) { |
Zhongxing Xu | c802378 | 2010-03-10 04:58:55 +0000 | [diff] [blame] | 657 | SymbolRef Sym = l.getLocSymbolInBase(); |
| 658 | if (Sym) { |
| 659 | const RefState *RS = C.getState()->get<RegionState>(Sym); |
Ted Kremenek | cea6865 | 2010-08-06 21:12:49 +0000 | [diff] [blame] | 660 | if (RS && RS->isReleased()) { |
Ted Kremenek | d048c6e | 2010-12-20 21:19:09 +0000 | [diff] [blame] | 661 | if (ExplodedNode *N = C.generateNode()) { |
Zhongxing Xu | c802378 | 2010-03-10 04:58:55 +0000 | [diff] [blame] | 662 | if (!BT_UseFree) |
| 663 | BT_UseFree = new BuiltinBug("Use dynamically allocated memory after" |
| 664 | " it is freed."); |
| 665 | |
| 666 | BugReport *R = new BugReport(*BT_UseFree, BT_UseFree->getDescription(), |
| 667 | N); |
| 668 | C.EmitReport(R); |
| 669 | } |
Ted Kremenek | cea6865 | 2010-08-06 21:12:49 +0000 | [diff] [blame] | 670 | } |
Zhongxing Xu | c802378 | 2010-03-10 04:58:55 +0000 | [diff] [blame] | 671 | } |
| 672 | } |
Ted Kremenek | dd0e490 | 2010-07-31 01:52:11 +0000 | [diff] [blame] | 673 | |
| 674 | void MallocChecker::PreVisitBind(CheckerContext &C, |
Ted Kremenek | dd0e490 | 2010-07-31 01:52:11 +0000 | [diff] [blame] | 675 | const Stmt *StoreE, |
| 676 | SVal location, |
| 677 | SVal val) { |
| 678 | // The PreVisitBind implements the same algorithm as already used by the |
| 679 | // Objective C ownership checker: if the pointer escaped from this scope by |
| 680 | // assignment, let it go. However, assigning to fields of a stack-storage |
| 681 | // structure does not transfer ownership. |
| 682 | |
| 683 | const GRState *state = C.getState(); |
| 684 | DefinedOrUnknownSVal l = cast<DefinedOrUnknownSVal>(location); |
| 685 | |
| 686 | // Check for null dereferences. |
| 687 | if (!isa<Loc>(l)) |
| 688 | return; |
| 689 | |
| 690 | // Before checking if the state is null, check if 'val' has a RefState. |
| 691 | // Only then should we check for null and bifurcate the state. |
| 692 | SymbolRef Sym = val.getLocSymbolInBase(); |
| 693 | if (Sym) { |
| 694 | if (const RefState *RS = state->get<RegionState>(Sym)) { |
| 695 | // If ptr is NULL, no operation is performed. |
| 696 | const GRState *notNullState, *nullState; |
Ted Kremenek | 28f47b9 | 2010-12-01 22:16:56 +0000 | [diff] [blame] | 697 | llvm::tie(notNullState, nullState) = state->assume(l); |
Ted Kremenek | dd0e490 | 2010-07-31 01:52:11 +0000 | [diff] [blame] | 698 | |
| 699 | // Generate a transition for 'nullState' to record the assumption |
| 700 | // that the state was null. |
| 701 | if (nullState) |
| 702 | C.addTransition(nullState); |
| 703 | |
| 704 | if (!notNullState) |
| 705 | return; |
| 706 | |
| 707 | if (RS->isAllocated()) { |
| 708 | // Something we presently own is being assigned somewhere. |
| 709 | const MemRegion *AR = location.getAsRegion(); |
| 710 | if (!AR) |
| 711 | return; |
| 712 | AR = AR->StripCasts()->getBaseRegion(); |
| 713 | do { |
| 714 | // If it is on the stack, we still own it. |
| 715 | if (AR->hasStackNonParametersStorage()) |
| 716 | break; |
| 717 | |
| 718 | // If the state can't represent this binding, we still own it. |
Ted Kremenek | dde201b | 2010-08-06 21:12:55 +0000 | [diff] [blame] | 719 | if (notNullState == (notNullState->bindLoc(cast<Loc>(location), |
| 720 | UnknownVal()))) |
Ted Kremenek | dd0e490 | 2010-07-31 01:52:11 +0000 | [diff] [blame] | 721 | break; |
| 722 | |
| 723 | // We no longer own this pointer. |
Ted Kremenek | dde201b | 2010-08-06 21:12:55 +0000 | [diff] [blame] | 724 | notNullState = |
| 725 | notNullState->set<RegionState>(Sym, |
| 726 | RefState::getRelinquished(StoreE)); |
Ted Kremenek | dd0e490 | 2010-07-31 01:52:11 +0000 | [diff] [blame] | 727 | } |
| 728 | while (false); |
| 729 | } |
| 730 | C.addTransition(notNullState); |
| 731 | } |
| 732 | } |
| 733 | } |