Peter Collingbourne | dc30967 | 2011-12-08 08:31:14 +0000 | [diff] [blame] | 1 | // MallocSizeofChecker.cpp - Check for dubious malloc arguments ---*- C++ -*-=// |
| 2 | // |
| 3 | // The LLVM Compiler Infrastructure |
| 4 | // |
| 5 | // This file is distributed under the University of Illinois Open Source |
| 6 | // License. See LICENSE.TXT for details. |
| 7 | // |
| 8 | //===----------------------------------------------------------------------===// |
| 9 | // |
| 10 | // Reports inconsistencies between the casted type of the return value of a |
| 11 | // malloc/calloc/realloc call and the operand of any sizeof expressions |
| 12 | // contained within its argument(s). |
| 13 | // |
| 14 | //===----------------------------------------------------------------------===// |
| 15 | |
| 16 | #include "ClangSACheckers.h" |
| 17 | #include "clang/StaticAnalyzer/Core/BugReporter/BugReporter.h" |
| 18 | #include "clang/StaticAnalyzer/Core/Checker.h" |
| 19 | #include "clang/StaticAnalyzer/Core/CheckerManager.h" |
| 20 | #include "clang/StaticAnalyzer/Core/PathSensitive/AnalysisManager.h" |
| 21 | #include "clang/AST/StmtVisitor.h" |
| 22 | #include "clang/AST/TypeLoc.h" |
Benjamin Kramer | 8fe83e1 | 2012-02-04 13:45:25 +0000 | [diff] [blame] | 23 | #include "llvm/ADT/SmallString.h" |
Peter Collingbourne | dc30967 | 2011-12-08 08:31:14 +0000 | [diff] [blame] | 24 | |
| 25 | using namespace clang; |
| 26 | using namespace ento; |
| 27 | |
| 28 | namespace { |
| 29 | |
| 30 | typedef std::pair<const TypeSourceInfo *, const CallExpr *> TypeCallPair; |
| 31 | typedef llvm::PointerUnion<const Stmt *, const VarDecl *> ExprParent; |
| 32 | |
| 33 | class CastedAllocFinder |
| 34 | : public ConstStmtVisitor<CastedAllocFinder, TypeCallPair> { |
| 35 | IdentifierInfo *II_malloc, *II_calloc, *II_realloc; |
| 36 | |
| 37 | public: |
| 38 | struct CallRecord { |
| 39 | ExprParent CastedExprParent; |
| 40 | const Expr *CastedExpr; |
| 41 | const TypeSourceInfo *ExplicitCastType; |
| 42 | const CallExpr *AllocCall; |
| 43 | |
| 44 | CallRecord(ExprParent CastedExprParent, const Expr *CastedExpr, |
| 45 | const TypeSourceInfo *ExplicitCastType, |
| 46 | const CallExpr *AllocCall) |
| 47 | : CastedExprParent(CastedExprParent), CastedExpr(CastedExpr), |
| 48 | ExplicitCastType(ExplicitCastType), AllocCall(AllocCall) {} |
| 49 | }; |
| 50 | |
| 51 | typedef std::vector<CallRecord> CallVec; |
| 52 | CallVec Calls; |
| 53 | |
| 54 | CastedAllocFinder(ASTContext *Ctx) : |
| 55 | II_malloc(&Ctx->Idents.get("malloc")), |
| 56 | II_calloc(&Ctx->Idents.get("calloc")), |
| 57 | II_realloc(&Ctx->Idents.get("realloc")) {} |
| 58 | |
| 59 | void VisitChild(ExprParent Parent, const Stmt *S) { |
| 60 | TypeCallPair AllocCall = Visit(S); |
| 61 | if (AllocCall.second && AllocCall.second != S) |
| 62 | Calls.push_back(CallRecord(Parent, cast<Expr>(S), AllocCall.first, |
| 63 | AllocCall.second)); |
| 64 | } |
| 65 | |
| 66 | void VisitChildren(const Stmt *S) { |
| 67 | for (Stmt::const_child_iterator I = S->child_begin(), E = S->child_end(); |
| 68 | I!=E; ++I) |
| 69 | if (const Stmt *child = *I) |
| 70 | VisitChild(S, child); |
| 71 | } |
| 72 | |
| 73 | TypeCallPair VisitCastExpr(const CastExpr *E) { |
| 74 | return Visit(E->getSubExpr()); |
| 75 | } |
| 76 | |
| 77 | TypeCallPair VisitExplicitCastExpr(const ExplicitCastExpr *E) { |
| 78 | return TypeCallPair(E->getTypeInfoAsWritten(), |
| 79 | Visit(E->getSubExpr()).second); |
| 80 | } |
| 81 | |
| 82 | TypeCallPair VisitParenExpr(const ParenExpr *E) { |
| 83 | return Visit(E->getSubExpr()); |
| 84 | } |
| 85 | |
| 86 | TypeCallPair VisitStmt(const Stmt *S) { |
| 87 | VisitChildren(S); |
| 88 | return TypeCallPair(); |
| 89 | } |
| 90 | |
| 91 | TypeCallPair VisitCallExpr(const CallExpr *E) { |
| 92 | VisitChildren(E); |
| 93 | const FunctionDecl *FD = E->getDirectCallee(); |
| 94 | if (FD) { |
| 95 | IdentifierInfo *II = FD->getIdentifier(); |
| 96 | if (II == II_malloc || II == II_calloc || II == II_realloc) |
Francois Pichet | f4e8a12 | 2011-12-08 09:32:22 +0000 | [diff] [blame] | 97 | return TypeCallPair((const TypeSourceInfo *)0, E); |
Peter Collingbourne | dc30967 | 2011-12-08 08:31:14 +0000 | [diff] [blame] | 98 | } |
| 99 | return TypeCallPair(); |
| 100 | } |
| 101 | |
| 102 | TypeCallPair VisitDeclStmt(const DeclStmt *S) { |
| 103 | for (DeclStmt::const_decl_iterator I = S->decl_begin(), E = S->decl_end(); |
| 104 | I!=E; ++I) |
| 105 | if (const VarDecl *VD = dyn_cast<VarDecl>(*I)) |
| 106 | if (const Expr *Init = VD->getInit()) |
| 107 | VisitChild(VD, Init); |
| 108 | return TypeCallPair(); |
| 109 | } |
| 110 | }; |
| 111 | |
| 112 | class SizeofFinder : public ConstStmtVisitor<SizeofFinder> { |
| 113 | public: |
| 114 | std::vector<const UnaryExprOrTypeTraitExpr *> Sizeofs; |
| 115 | |
| 116 | void VisitBinMul(const BinaryOperator *E) { |
| 117 | Visit(E->getLHS()); |
| 118 | Visit(E->getRHS()); |
| 119 | } |
| 120 | |
Peter Collingbourne | dc30967 | 2011-12-08 08:31:14 +0000 | [diff] [blame] | 121 | void VisitImplicitCastExpr(const ImplicitCastExpr *E) { |
| 122 | return Visit(E->getSubExpr()); |
| 123 | } |
| 124 | |
| 125 | void VisitParenExpr(const ParenExpr *E) { |
| 126 | return Visit(E->getSubExpr()); |
| 127 | } |
| 128 | |
| 129 | void VisitUnaryExprOrTypeTraitExpr(const UnaryExprOrTypeTraitExpr *E) { |
| 130 | if (E->getKind() != UETT_SizeOf) |
| 131 | return; |
| 132 | |
| 133 | Sizeofs.push_back(E); |
| 134 | } |
| 135 | }; |
| 136 | |
Ted Kremenek | 88db6a2 | 2012-05-01 00:10:19 +0000 | [diff] [blame] | 137 | // Determine if the pointee and sizeof types are compatible. Here |
| 138 | // we ignore constness of pointer types. |
| 139 | static bool typesCompatible(ASTContext &C, QualType A, QualType B) { |
| 140 | while (true) { |
| 141 | A = A.getCanonicalType(); |
| 142 | B = B.getCanonicalType(); |
| 143 | |
| 144 | if (A.getTypePtr() == B.getTypePtr()) |
| 145 | return true; |
| 146 | |
| 147 | if (const PointerType *ptrA = A->getAs<PointerType>()) |
| 148 | if (const PointerType *ptrB = B->getAs<PointerType>()) { |
| 149 | A = ptrA->getPointeeType(); |
| 150 | B = ptrB->getPointeeType(); |
| 151 | continue; |
| 152 | } |
| 153 | |
| 154 | break; |
| 155 | } |
| 156 | |
| 157 | return false; |
| 158 | } |
| 159 | |
Peter Collingbourne | dc30967 | 2011-12-08 08:31:14 +0000 | [diff] [blame] | 160 | class MallocSizeofChecker : public Checker<check::ASTCodeBody> { |
| 161 | public: |
| 162 | void checkASTCodeBody(const Decl *D, AnalysisManager& mgr, |
| 163 | BugReporter &BR) const { |
| 164 | AnalysisDeclContext *ADC = mgr.getAnalysisDeclContext(D); |
| 165 | CastedAllocFinder Finder(&BR.getContext()); |
| 166 | Finder.Visit(D->getBody()); |
| 167 | for (CastedAllocFinder::CallVec::iterator i = Finder.Calls.begin(), |
| 168 | e = Finder.Calls.end(); i != e; ++i) { |
| 169 | QualType CastedType = i->CastedExpr->getType(); |
| 170 | if (!CastedType->isPointerType()) |
| 171 | continue; |
| 172 | QualType PointeeType = CastedType->getAs<PointerType>()->getPointeeType(); |
| 173 | if (PointeeType->isVoidType()) |
| 174 | continue; |
| 175 | |
| 176 | for (CallExpr::const_arg_iterator ai = i->AllocCall->arg_begin(), |
| 177 | ae = i->AllocCall->arg_end(); ai != ae; ++ai) { |
| 178 | if (!(*ai)->getType()->isIntegerType()) |
| 179 | continue; |
| 180 | |
| 181 | SizeofFinder SFinder; |
| 182 | SFinder.Visit(*ai); |
| 183 | if (SFinder.Sizeofs.size() != 1) |
| 184 | continue; |
| 185 | |
| 186 | QualType SizeofType = SFinder.Sizeofs[0]->getTypeOfArgument(); |
Ted Kremenek | 88db6a2 | 2012-05-01 00:10:19 +0000 | [diff] [blame] | 187 | if (!typesCompatible(BR.getContext(), PointeeType, SizeofType)) { |
Peter Collingbourne | dc30967 | 2011-12-08 08:31:14 +0000 | [diff] [blame] | 188 | const TypeSourceInfo *TSI = 0; |
| 189 | if (i->CastedExprParent.is<const VarDecl *>()) { |
| 190 | TSI = |
| 191 | i->CastedExprParent.get<const VarDecl *>()->getTypeSourceInfo(); |
| 192 | } else { |
| 193 | TSI = i->ExplicitCastType; |
| 194 | } |
| 195 | |
Dylan Noblesmith | f7ccbad | 2012-02-05 02:13:05 +0000 | [diff] [blame] | 196 | SmallString<64> buf; |
Peter Collingbourne | dc30967 | 2011-12-08 08:31:14 +0000 | [diff] [blame] | 197 | llvm::raw_svector_ostream OS(buf); |
| 198 | |
| 199 | OS << "Result of '" |
| 200 | << i->AllocCall->getDirectCallee()->getIdentifier()->getName() |
Anna Zaks | ca11510 | 2012-05-07 23:30:29 +0000 | [diff] [blame] | 201 | << "' is converted to a pointer of type '" |
| 202 | << PointeeType.getAsString() << "', which is incompatible with " |
Peter Collingbourne | dc30967 | 2011-12-08 08:31:14 +0000 | [diff] [blame] | 203 | << "sizeof operand type '" << SizeofType.getAsString() << "'"; |
| 204 | llvm::SmallVector<SourceRange, 4> Ranges; |
| 205 | Ranges.push_back(i->AllocCall->getCallee()->getSourceRange()); |
| 206 | Ranges.push_back(SFinder.Sizeofs[0]->getSourceRange()); |
| 207 | if (TSI) |
| 208 | Ranges.push_back(TSI->getTypeLoc().getSourceRange()); |
| 209 | |
| 210 | PathDiagnosticLocation L = |
| 211 | PathDiagnosticLocation::createBegin(i->AllocCall->getCallee(), |
| 212 | BR.getSourceManager(), ADC); |
| 213 | |
Anna Zaks | ca11510 | 2012-05-07 23:30:29 +0000 | [diff] [blame] | 214 | BR.EmitBasicReport(D, "Allocator sizeof operand mismatch", |
Ted Kremenek | 6fd4505 | 2012-04-05 20:43:28 +0000 | [diff] [blame] | 215 | categories::UnixAPI, |
| 216 | OS.str(), |
Ted Kremenek | 0718952 | 2012-04-04 18:11:35 +0000 | [diff] [blame] | 217 | L, Ranges.data(), Ranges.size()); |
Peter Collingbourne | dc30967 | 2011-12-08 08:31:14 +0000 | [diff] [blame] | 218 | } |
| 219 | } |
| 220 | } |
| 221 | } |
| 222 | }; |
| 223 | |
| 224 | } |
| 225 | |
| 226 | void ento::registerMallocSizeofChecker(CheckerManager &mgr) { |
| 227 | mgr.registerChecker<MallocSizeofChecker>(); |
| 228 | } |