Anna Zaks | d65e55d | 2012-10-29 22:51:50 +0000 | [diff] [blame] | 1 | //===-- SimpleStreamChecker.cpp -----------------------------------------*- C++ -*--// |
| 2 | // |
| 3 | // The LLVM Compiler Infrastructure |
| 4 | // |
| 5 | // This file is distributed under the University of Illinois Open Source |
| 6 | // License. See LICENSE.TXT for details. |
| 7 | // |
| 8 | //===----------------------------------------------------------------------===// |
| 9 | // |
| 10 | // Defines a checker for proper use of fopen/fclose APIs. |
| 11 | // - If a file has been closed with fclose, it should not be accessed again. |
| 12 | // Accessing a closed file results in undefined behavior. |
| 13 | // - If a file was opened with fopen, it must be closed with fclose before |
| 14 | // the execution ends. Failing to do so results in a resource leak. |
| 15 | // |
| 16 | //===----------------------------------------------------------------------===// |
| 17 | |
| 18 | #include "ClangSACheckers.h" |
Anna Zaks | d65e55d | 2012-10-29 22:51:50 +0000 | [diff] [blame] | 19 | #include "clang/StaticAnalyzer/Core/BugReporter/BugType.h" |
Chandler Carruth | 55fc873 | 2012-12-04 09:13:33 +0000 | [diff] [blame] | 20 | #include "clang/StaticAnalyzer/Core/Checker.h" |
Jordan Rose | 0c396d6 | 2012-11-02 23:49:35 +0000 | [diff] [blame] | 21 | #include "clang/StaticAnalyzer/Core/PathSensitive/CallEvent.h" |
Anna Zaks | d65e55d | 2012-10-29 22:51:50 +0000 | [diff] [blame] | 22 | #include "clang/StaticAnalyzer/Core/PathSensitive/CheckerContext.h" |
| 23 | |
| 24 | using namespace clang; |
| 25 | using namespace ento; |
| 26 | |
| 27 | namespace { |
Dmitri Gribenko | cfa88f8 | 2013-01-12 19:30:44 +0000 | [diff] [blame] | 28 | typedef SmallVector<SymbolRef, 2> SymbolVector; |
Anna Zaks | d65e55d | 2012-10-29 22:51:50 +0000 | [diff] [blame] | 29 | |
| 30 | struct StreamState { |
Anna Zaks | 32133cf | 2012-10-31 02:32:41 +0000 | [diff] [blame] | 31 | private: |
Anna Zaks | d65e55d | 2012-10-29 22:51:50 +0000 | [diff] [blame] | 32 | enum Kind { Opened, Closed } K; |
Anna Zaks | d65e55d | 2012-10-29 22:51:50 +0000 | [diff] [blame] | 33 | StreamState(Kind InK) : K(InK) { } |
| 34 | |
Anna Zaks | 32133cf | 2012-10-31 02:32:41 +0000 | [diff] [blame] | 35 | public: |
Anna Zaks | d65e55d | 2012-10-29 22:51:50 +0000 | [diff] [blame] | 36 | bool isOpened() const { return K == Opened; } |
| 37 | bool isClosed() const { return K == Closed; } |
| 38 | |
| 39 | static StreamState getOpened() { return StreamState(Opened); } |
| 40 | static StreamState getClosed() { return StreamState(Closed); } |
| 41 | |
| 42 | bool operator==(const StreamState &X) const { |
| 43 | return K == X.K; |
| 44 | } |
| 45 | void Profile(llvm::FoldingSetNodeID &ID) const { |
| 46 | ID.AddInteger(K); |
| 47 | } |
| 48 | }; |
| 49 | |
Jordan Rose | 0c396d6 | 2012-11-02 23:49:35 +0000 | [diff] [blame] | 50 | class SimpleStreamChecker : public Checker<check::PostCall, |
| 51 | check::PreCall, |
Anna Zaks | 35d4a09 | 2012-11-06 04:20:57 +0000 | [diff] [blame] | 52 | check::DeadSymbols, |
Anna Zaks | 4b6bb40 | 2012-12-22 00:18:39 +0000 | [diff] [blame] | 53 | check::PointerEscape> { |
Anna Zaks | d65e55d | 2012-10-29 22:51:50 +0000 | [diff] [blame] | 54 | |
| 55 | mutable IdentifierInfo *IIfopen, *IIfclose; |
| 56 | |
Stephen Hines | 651f13c | 2014-04-23 16:59:28 -0700 | [diff] [blame] | 57 | std::unique_ptr<BugType> DoubleCloseBugType; |
| 58 | std::unique_ptr<BugType> LeakBugType; |
Anna Zaks | d65e55d | 2012-10-29 22:51:50 +0000 | [diff] [blame] | 59 | |
| 60 | void initIdentifierInfo(ASTContext &Ctx) const; |
| 61 | |
| 62 | void reportDoubleClose(SymbolRef FileDescSym, |
Jordan Rose | 0c396d6 | 2012-11-02 23:49:35 +0000 | [diff] [blame] | 63 | const CallEvent &Call, |
Anna Zaks | d65e55d | 2012-10-29 22:51:50 +0000 | [diff] [blame] | 64 | CheckerContext &C) const; |
| 65 | |
Stephen Hines | 176edba | 2014-12-01 14:53:08 -0800 | [diff] [blame] | 66 | void reportLeaks(ArrayRef<SymbolRef> LeakedStreams, CheckerContext &C, |
Jordan Rose | 32f38c1 | 2012-11-01 00:18:41 +0000 | [diff] [blame] | 67 | ExplodedNode *ErrNode) const; |
Anna Zaks | d65e55d | 2012-10-29 22:51:50 +0000 | [diff] [blame] | 68 | |
Anna Zaks | 35d4a09 | 2012-11-06 04:20:57 +0000 | [diff] [blame] | 69 | bool guaranteedNotToCloseFile(const CallEvent &Call) const; |
| 70 | |
Anna Zaks | d65e55d | 2012-10-29 22:51:50 +0000 | [diff] [blame] | 71 | public: |
Anna Zaks | 32133cf | 2012-10-31 02:32:41 +0000 | [diff] [blame] | 72 | SimpleStreamChecker(); |
Anna Zaks | d65e55d | 2012-10-29 22:51:50 +0000 | [diff] [blame] | 73 | |
| 74 | /// Process fopen. |
Jordan Rose | 0c396d6 | 2012-11-02 23:49:35 +0000 | [diff] [blame] | 75 | void checkPostCall(const CallEvent &Call, CheckerContext &C) const; |
Anna Zaks | d65e55d | 2012-10-29 22:51:50 +0000 | [diff] [blame] | 76 | /// Process fclose. |
Jordan Rose | 0c396d6 | 2012-11-02 23:49:35 +0000 | [diff] [blame] | 77 | void checkPreCall(const CallEvent &Call, CheckerContext &C) const; |
Anna Zaks | d65e55d | 2012-10-29 22:51:50 +0000 | [diff] [blame] | 78 | |
| 79 | void checkDeadSymbols(SymbolReaper &SymReaper, CheckerContext &C) const; |
Anna Zaks | 35d4a09 | 2012-11-06 04:20:57 +0000 | [diff] [blame] | 80 | |
Anna Zaks | 4b6bb40 | 2012-12-22 00:18:39 +0000 | [diff] [blame] | 81 | /// Stop tracking addresses which escape. |
| 82 | ProgramStateRef checkPointerEscape(ProgramStateRef State, |
| 83 | const InvalidatedSymbols &Escaped, |
Anna Zaks | 233e26a | 2013-02-07 23:05:43 +0000 | [diff] [blame] | 84 | const CallEvent *Call, |
| 85 | PointerEscapeKind Kind) const; |
Anna Zaks | d65e55d | 2012-10-29 22:51:50 +0000 | [diff] [blame] | 86 | }; |
| 87 | |
| 88 | } // end anonymous namespace |
| 89 | |
| 90 | /// The state of the checker is a map from tracked stream symbols to their |
Anna Zaks | ac150f2 | 2012-10-30 04:17:18 +0000 | [diff] [blame] | 91 | /// state. Let's store it in the ProgramState. |
| 92 | REGISTER_MAP_WITH_PROGRAMSTATE(StreamMap, SymbolRef, StreamState) |
Anna Zaks | d65e55d | 2012-10-29 22:51:50 +0000 | [diff] [blame] | 93 | |
Anna Zaks | 35d4a09 | 2012-11-06 04:20:57 +0000 | [diff] [blame] | 94 | namespace { |
| 95 | class StopTrackingCallback : public SymbolVisitor { |
| 96 | ProgramStateRef state; |
| 97 | public: |
| 98 | StopTrackingCallback(ProgramStateRef st) : state(st) {} |
| 99 | ProgramStateRef getState() const { return state; } |
| 100 | |
Stephen Hines | 651f13c | 2014-04-23 16:59:28 -0700 | [diff] [blame] | 101 | bool VisitSymbol(SymbolRef sym) override { |
Anna Zaks | 35d4a09 | 2012-11-06 04:20:57 +0000 | [diff] [blame] | 102 | state = state->remove<StreamMap>(sym); |
| 103 | return true; |
| 104 | } |
| 105 | }; |
| 106 | } // end anonymous namespace |
| 107 | |
Stephen Hines | 6bcf27b | 2014-05-29 04:14:42 -0700 | [diff] [blame] | 108 | SimpleStreamChecker::SimpleStreamChecker() |
| 109 | : IIfopen(nullptr), IIfclose(nullptr) { |
Anna Zaks | 32133cf | 2012-10-31 02:32:41 +0000 | [diff] [blame] | 110 | // Initialize the bug types. |
Stephen Hines | 651f13c | 2014-04-23 16:59:28 -0700 | [diff] [blame] | 111 | DoubleCloseBugType.reset( |
| 112 | new BugType(this, "Double fclose", "Unix Stream API Error")); |
Anna Zaks | 32133cf | 2012-10-31 02:32:41 +0000 | [diff] [blame] | 113 | |
Stephen Hines | 651f13c | 2014-04-23 16:59:28 -0700 | [diff] [blame] | 114 | LeakBugType.reset( |
| 115 | new BugType(this, "Resource Leak", "Unix Stream API Error")); |
Anna Zaks | 32133cf | 2012-10-31 02:32:41 +0000 | [diff] [blame] | 116 | // Sinks are higher importance bugs as well as calls to assert() or exit(0). |
| 117 | LeakBugType->setSuppressOnSink(true); |
| 118 | } |
| 119 | |
Jordan Rose | 0c396d6 | 2012-11-02 23:49:35 +0000 | [diff] [blame] | 120 | void SimpleStreamChecker::checkPostCall(const CallEvent &Call, |
Anna Zaks | d65e55d | 2012-10-29 22:51:50 +0000 | [diff] [blame] | 121 | CheckerContext &C) const { |
| 122 | initIdentifierInfo(C.getASTContext()); |
| 123 | |
Jordan Rose | 0c396d6 | 2012-11-02 23:49:35 +0000 | [diff] [blame] | 124 | if (!Call.isGlobalCFunction()) |
| 125 | return; |
| 126 | |
| 127 | if (Call.getCalleeIdentifier() != IIfopen) |
Anna Zaks | d65e55d | 2012-10-29 22:51:50 +0000 | [diff] [blame] | 128 | return; |
| 129 | |
| 130 | // Get the symbolic value corresponding to the file handle. |
Jordan Rose | 0c396d6 | 2012-11-02 23:49:35 +0000 | [diff] [blame] | 131 | SymbolRef FileDesc = Call.getReturnValue().getAsSymbol(); |
Anna Zaks | d65e55d | 2012-10-29 22:51:50 +0000 | [diff] [blame] | 132 | if (!FileDesc) |
| 133 | return; |
| 134 | |
| 135 | // Generate the next transition (an edge in the exploded graph). |
| 136 | ProgramStateRef State = C.getState(); |
| 137 | State = State->set<StreamMap>(FileDesc, StreamState::getOpened()); |
| 138 | C.addTransition(State); |
| 139 | } |
| 140 | |
Jordan Rose | 0c396d6 | 2012-11-02 23:49:35 +0000 | [diff] [blame] | 141 | void SimpleStreamChecker::checkPreCall(const CallEvent &Call, |
Anna Zaks | d65e55d | 2012-10-29 22:51:50 +0000 | [diff] [blame] | 142 | CheckerContext &C) const { |
| 143 | initIdentifierInfo(C.getASTContext()); |
| 144 | |
Jordan Rose | 0c396d6 | 2012-11-02 23:49:35 +0000 | [diff] [blame] | 145 | if (!Call.isGlobalCFunction()) |
| 146 | return; |
| 147 | |
| 148 | if (Call.getCalleeIdentifier() != IIfclose) |
| 149 | return; |
| 150 | |
| 151 | if (Call.getNumArgs() != 1) |
Anna Zaks | d65e55d | 2012-10-29 22:51:50 +0000 | [diff] [blame] | 152 | return; |
| 153 | |
| 154 | // Get the symbolic value corresponding to the file handle. |
Jordan Rose | 0c396d6 | 2012-11-02 23:49:35 +0000 | [diff] [blame] | 155 | SymbolRef FileDesc = Call.getArgSVal(0).getAsSymbol(); |
Anna Zaks | d65e55d | 2012-10-29 22:51:50 +0000 | [diff] [blame] | 156 | if (!FileDesc) |
| 157 | return; |
| 158 | |
| 159 | // Check if the stream has already been closed. |
| 160 | ProgramStateRef State = C.getState(); |
| 161 | const StreamState *SS = State->get<StreamMap>(FileDesc); |
Anna Zaks | bbb751a | 2012-10-31 22:17:48 +0000 | [diff] [blame] | 162 | if (SS && SS->isClosed()) { |
Anna Zaks | d65e55d | 2012-10-29 22:51:50 +0000 | [diff] [blame] | 163 | reportDoubleClose(FileDesc, Call, C); |
Anna Zaks | bbb751a | 2012-10-31 22:17:48 +0000 | [diff] [blame] | 164 | return; |
| 165 | } |
Anna Zaks | d65e55d | 2012-10-29 22:51:50 +0000 | [diff] [blame] | 166 | |
| 167 | // Generate the next transition, in which the stream is closed. |
| 168 | State = State->set<StreamMap>(FileDesc, StreamState::getClosed()); |
| 169 | C.addTransition(State); |
| 170 | } |
| 171 | |
Anna Zaks | edd07f4 | 2012-11-02 21:30:04 +0000 | [diff] [blame] | 172 | static bool isLeaked(SymbolRef Sym, const StreamState &SS, |
| 173 | bool IsSymDead, ProgramStateRef State) { |
| 174 | if (IsSymDead && SS.isOpened()) { |
| 175 | // If a symbol is NULL, assume that fopen failed on this path. |
| 176 | // A symbol should only be considered leaked if it is non-null. |
| 177 | ConstraintManager &CMgr = State->getConstraintManager(); |
| 178 | ConditionTruthVal OpenFailed = CMgr.isNull(State, Sym); |
| 179 | return !OpenFailed.isConstrainedTrue(); |
| 180 | } |
| 181 | return false; |
| 182 | } |
| 183 | |
Anna Zaks | d65e55d | 2012-10-29 22:51:50 +0000 | [diff] [blame] | 184 | void SimpleStreamChecker::checkDeadSymbols(SymbolReaper &SymReaper, |
| 185 | CheckerContext &C) const { |
| 186 | ProgramStateRef State = C.getState(); |
Anna Zaks | d65e55d | 2012-10-29 22:51:50 +0000 | [diff] [blame] | 187 | SymbolVector LeakedStreams; |
Anna Zaks | edd07f4 | 2012-11-02 21:30:04 +0000 | [diff] [blame] | 188 | StreamMapTy TrackedStreams = State->get<StreamMap>(); |
Anna Zaks | 360b29c | 2012-10-30 04:17:40 +0000 | [diff] [blame] | 189 | for (StreamMapTy::iterator I = TrackedStreams.begin(), |
Jordan Rose | ec8d420 | 2012-11-01 00:18:27 +0000 | [diff] [blame] | 190 | E = TrackedStreams.end(); I != E; ++I) { |
Anna Zaks | d65e55d | 2012-10-29 22:51:50 +0000 | [diff] [blame] | 191 | SymbolRef Sym = I->first; |
Anna Zaks | edd07f4 | 2012-11-02 21:30:04 +0000 | [diff] [blame] | 192 | bool IsSymDead = SymReaper.isDead(Sym); |
Anna Zaks | d65e55d | 2012-10-29 22:51:50 +0000 | [diff] [blame] | 193 | |
Anna Zaks | edd07f4 | 2012-11-02 21:30:04 +0000 | [diff] [blame] | 194 | // Collect leaked symbols. |
| 195 | if (isLeaked(Sym, I->second, IsSymDead, State)) |
| 196 | LeakedStreams.push_back(Sym); |
| 197 | |
| 198 | // Remove the dead symbol from the streams map. |
| 199 | if (IsSymDead) |
Anna Zaks | d65e55d | 2012-10-29 22:51:50 +0000 | [diff] [blame] | 200 | State = State->remove<StreamMap>(Sym); |
Anna Zaks | d65e55d | 2012-10-29 22:51:50 +0000 | [diff] [blame] | 201 | } |
| 202 | |
Anna Zaks | 32133cf | 2012-10-31 02:32:41 +0000 | [diff] [blame] | 203 | ExplodedNode *N = C.addTransition(State); |
| 204 | reportLeaks(LeakedStreams, C, N); |
Anna Zaks | d65e55d | 2012-10-29 22:51:50 +0000 | [diff] [blame] | 205 | } |
| 206 | |
| 207 | void SimpleStreamChecker::reportDoubleClose(SymbolRef FileDescSym, |
Jordan Rose | 0c396d6 | 2012-11-02 23:49:35 +0000 | [diff] [blame] | 208 | const CallEvent &Call, |
Anna Zaks | d65e55d | 2012-10-29 22:51:50 +0000 | [diff] [blame] | 209 | CheckerContext &C) const { |
| 210 | // We reached a bug, stop exploring the path here by generating a sink. |
| 211 | ExplodedNode *ErrNode = C.generateSink(); |
Anna Zaks | 32133cf | 2012-10-31 02:32:41 +0000 | [diff] [blame] | 212 | // If we've already reached this node on another path, return. |
Anna Zaks | d65e55d | 2012-10-29 22:51:50 +0000 | [diff] [blame] | 213 | if (!ErrNode) |
| 214 | return; |
| 215 | |
Anna Zaks | d65e55d | 2012-10-29 22:51:50 +0000 | [diff] [blame] | 216 | // Generate the report. |
| 217 | BugReport *R = new BugReport(*DoubleCloseBugType, |
| 218 | "Closing a previously closed file stream", ErrNode); |
Jordan Rose | 0c396d6 | 2012-11-02 23:49:35 +0000 | [diff] [blame] | 219 | R->addRange(Call.getSourceRange()); |
Anna Zaks | d65e55d | 2012-10-29 22:51:50 +0000 | [diff] [blame] | 220 | R->markInteresting(FileDescSym); |
Jordan Rose | 785950e | 2012-11-02 01:53:40 +0000 | [diff] [blame] | 221 | C.emitReport(R); |
Anna Zaks | d65e55d | 2012-10-29 22:51:50 +0000 | [diff] [blame] | 222 | } |
| 223 | |
Stephen Hines | 176edba | 2014-12-01 14:53:08 -0800 | [diff] [blame] | 224 | void SimpleStreamChecker::reportLeaks(ArrayRef<SymbolRef> LeakedStreams, |
| 225 | CheckerContext &C, |
| 226 | ExplodedNode *ErrNode) const { |
Anna Zaks | d65e55d | 2012-10-29 22:51:50 +0000 | [diff] [blame] | 227 | // Attach bug reports to the leak node. |
Anna Zaks | bdbb17b | 2012-10-30 04:18:21 +0000 | [diff] [blame] | 228 | // TODO: Identify the leaked file descriptor. |
Stephen Hines | 176edba | 2014-12-01 14:53:08 -0800 | [diff] [blame] | 229 | for (SymbolRef LeakedStream : LeakedStreams) { |
Anna Zaks | d65e55d | 2012-10-29 22:51:50 +0000 | [diff] [blame] | 230 | BugReport *R = new BugReport(*LeakBugType, |
| 231 | "Opened file is never closed; potential resource leak", ErrNode); |
Stephen Hines | 176edba | 2014-12-01 14:53:08 -0800 | [diff] [blame] | 232 | R->markInteresting(LeakedStream); |
Jordan Rose | 785950e | 2012-11-02 01:53:40 +0000 | [diff] [blame] | 233 | C.emitReport(R); |
Anna Zaks | d65e55d | 2012-10-29 22:51:50 +0000 | [diff] [blame] | 234 | } |
Anna Zaks | d65e55d | 2012-10-29 22:51:50 +0000 | [diff] [blame] | 235 | } |
| 236 | |
Anna Zaks | 35d4a09 | 2012-11-06 04:20:57 +0000 | [diff] [blame] | 237 | bool SimpleStreamChecker::guaranteedNotToCloseFile(const CallEvent &Call) const{ |
| 238 | // If it's not in a system header, assume it might close a file. |
| 239 | if (!Call.isInSystemHeader()) |
| 240 | return false; |
| 241 | |
| 242 | // Handle cases where we know a buffer's /address/ can escape. |
| 243 | if (Call.argumentsMayEscape()) |
| 244 | return false; |
| 245 | |
| 246 | // Note, even though fclose closes the file, we do not list it here |
| 247 | // since the checker is modeling the call. |
| 248 | |
| 249 | return true; |
| 250 | } |
| 251 | |
Anna Zaks | 4b6bb40 | 2012-12-22 00:18:39 +0000 | [diff] [blame] | 252 | // If the pointer we are tracking escaped, do not track the symbol as |
Anna Zaks | 35d4a09 | 2012-11-06 04:20:57 +0000 | [diff] [blame] | 253 | // we cannot reason about it anymore. |
| 254 | ProgramStateRef |
Anna Zaks | 4b6bb40 | 2012-12-22 00:18:39 +0000 | [diff] [blame] | 255 | SimpleStreamChecker::checkPointerEscape(ProgramStateRef State, |
| 256 | const InvalidatedSymbols &Escaped, |
Anna Zaks | 233e26a | 2013-02-07 23:05:43 +0000 | [diff] [blame] | 257 | const CallEvent *Call, |
| 258 | PointerEscapeKind Kind) const { |
Anna Zaks | 4b6bb40 | 2012-12-22 00:18:39 +0000 | [diff] [blame] | 259 | // If we know that the call cannot close a file, there is nothing to do. |
Jordan Rose | 374ae32 | 2013-05-10 17:07:16 +0000 | [diff] [blame] | 260 | if (Kind == PSK_DirectEscapeOnCall && guaranteedNotToCloseFile(*Call)) { |
Anna Zaks | 35d4a09 | 2012-11-06 04:20:57 +0000 | [diff] [blame] | 261 | return State; |
Anna Zaks | 233e26a | 2013-02-07 23:05:43 +0000 | [diff] [blame] | 262 | } |
Anna Zaks | 35d4a09 | 2012-11-06 04:20:57 +0000 | [diff] [blame] | 263 | |
Anna Zaks | 4b6bb40 | 2012-12-22 00:18:39 +0000 | [diff] [blame] | 264 | for (InvalidatedSymbols::const_iterator I = Escaped.begin(), |
| 265 | E = Escaped.end(); |
| 266 | I != E; ++I) { |
| 267 | SymbolRef Sym = *I; |
Anna Zaks | 35d4a09 | 2012-11-06 04:20:57 +0000 | [diff] [blame] | 268 | |
Anna Zaks | 35d4a09 | 2012-11-06 04:20:57 +0000 | [diff] [blame] | 269 | // The symbol escaped. Optimistically, assume that the corresponding file |
| 270 | // handle will be closed somewhere else. |
Anna Zaks | 4b6bb40 | 2012-12-22 00:18:39 +0000 | [diff] [blame] | 271 | State = State->remove<StreamMap>(Sym); |
Anna Zaks | 35d4a09 | 2012-11-06 04:20:57 +0000 | [diff] [blame] | 272 | } |
| 273 | return State; |
| 274 | } |
| 275 | |
Anna Zaks | d65e55d | 2012-10-29 22:51:50 +0000 | [diff] [blame] | 276 | void SimpleStreamChecker::initIdentifierInfo(ASTContext &Ctx) const { |
| 277 | if (IIfopen) |
| 278 | return; |
| 279 | IIfopen = &Ctx.Idents.get("fopen"); |
| 280 | IIfclose = &Ctx.Idents.get("fclose"); |
| 281 | } |
| 282 | |
| 283 | void ento::registerSimpleStreamChecker(CheckerManager &mgr) { |
| 284 | mgr.registerChecker<SimpleStreamChecker>(); |
| 285 | } |