blob: 17fc6d7c32ed911a26299fd246e0b83ee8ae1df6 [file] [log] [blame]
Ted Kremenekdbfb5f82009-07-23 01:07:19 +00001//==- CheckSecuritySyntaxOnly.cpp - Basic security checks --------*- C++ -*-==//
2//
3// The LLVM Compiler Infrastructure
4//
5// This file is distributed under the University of Illinois Open Source
6// License. See LICENSE.TXT for details.
7//
8//===----------------------------------------------------------------------===//
9//
10// This file defines a set of flow-insensitive security checks.
11//
12//===----------------------------------------------------------------------===//
13
14#include "clang/Analysis/PathSensitive/BugReporter.h"
15#include "clang/Analysis/LocalCheckers.h"
16#include "clang/AST/StmtVisitor.h"
17#include "llvm/Support/Compiler.h"
Ted Kremenek8baf86d2009-07-23 21:34:35 +000018#include "llvm/Support/raw_ostream.h"
Ted Kremenekdbfb5f82009-07-23 01:07:19 +000019
20using namespace clang;
21
22namespace {
23class VISIBILITY_HIDDEN WalkAST : public StmtVisitor<WalkAST> {
Ted Kremenekefcbb152009-07-23 22:29:41 +000024 BugReporter &BR;
25 IdentifierInfo *II_gets;
Ted Kremenekdbfb5f82009-07-23 01:07:19 +000026public:
Ted Kremenekefcbb152009-07-23 22:29:41 +000027 WalkAST(BugReporter &br) : BR(br),
28 II_gets(0) {}
Ted Kremenekdbfb5f82009-07-23 01:07:19 +000029
30 // Statement visitor methods.
Ted Kremenekefcbb152009-07-23 22:29:41 +000031 void VisitCallExpr(CallExpr *CE);
Ted Kremenekdbfb5f82009-07-23 01:07:19 +000032 void VisitForStmt(ForStmt *S);
Ted Kremenek8baf86d2009-07-23 21:34:35 +000033 void VisitStmt(Stmt *S) { VisitChildren(S); }
Ted Kremenekdbfb5f82009-07-23 01:07:19 +000034
35 void VisitChildren(Stmt *S);
Ted Kremenekdbfb5f82009-07-23 01:07:19 +000036
Ted Kremenekefcbb152009-07-23 22:29:41 +000037 // Helpers.
38 IdentifierInfo *GetIdentifier(IdentifierInfo *& II, const char *str);
39
Ted Kremenekdbfb5f82009-07-23 01:07:19 +000040 // Checker-specific methods.
Ted Kremenek8baf86d2009-07-23 21:34:35 +000041 void CheckLoopConditionForFloat(const ForStmt *FS);
Ted Kremenekefcbb152009-07-23 22:29:41 +000042 void CheckCall_gets(const CallExpr *CE, const FunctionDecl *FD);
Ted Kremenekdbfb5f82009-07-23 01:07:19 +000043};
44} // end anonymous namespace
45
46//===----------------------------------------------------------------------===//
Ted Kremenekefcbb152009-07-23 22:29:41 +000047// Helper methods.
48//===----------------------------------------------------------------------===//
49
50IdentifierInfo *WalkAST::GetIdentifier(IdentifierInfo *& II, const char *str) {
51 if (!II)
52 II = &BR.getContext().Idents.get(str);
53
54 return II;
55}
56
57//===----------------------------------------------------------------------===//
Ted Kremenekdbfb5f82009-07-23 01:07:19 +000058// AST walking.
59//===----------------------------------------------------------------------===//
60
61void WalkAST::VisitChildren(Stmt *S) {
62 for (Stmt::child_iterator I = S->child_begin(), E = S->child_end(); I!=E; ++I)
63 if (Stmt *child = *I)
64 Visit(child);
65}
66
Ted Kremenekefcbb152009-07-23 22:29:41 +000067void WalkAST::VisitCallExpr(CallExpr *CE) {
68 if (const FunctionDecl *FD = CE->getDirectCallee()) {
69 CheckCall_gets(CE, FD);
70 }
71
72 // Recurse and check children.
73 VisitChildren(CE);
74}
75
Ted Kremenek8baf86d2009-07-23 21:34:35 +000076void WalkAST::VisitForStmt(ForStmt *FS) {
77 CheckLoopConditionForFloat(FS);
Ted Kremenekdbfb5f82009-07-23 01:07:19 +000078
Ted Kremenek8baf86d2009-07-23 21:34:35 +000079 // Recurse and check children.
80 VisitChildren(FS);
Ted Kremenekdbfb5f82009-07-23 01:07:19 +000081}
82
83//===----------------------------------------------------------------------===//
Ted Kremenek8baf86d2009-07-23 21:34:35 +000084// Check: floating poing variable used as loop counter.
Ted Kremenek5abeb522009-07-23 21:44:18 +000085// Originally: <rdar://problem/6336718>
86// Implements: CERT security coding advisory FLP-30.
Ted Kremenekdbfb5f82009-07-23 01:07:19 +000087//===----------------------------------------------------------------------===//
88
Ted Kremenek8baf86d2009-07-23 21:34:35 +000089static const DeclRefExpr*
90GetIncrementedVar(const Expr *expr, const VarDecl *x, const VarDecl *y) {
91 expr = expr->IgnoreParenCasts();
92
93 if (const BinaryOperator *B = dyn_cast<BinaryOperator>(expr)) {
94 if (!(B->isAssignmentOp() || B->isCompoundAssignmentOp() ||
95 B->getOpcode() == BinaryOperator::Comma))
96 return NULL;
97
98 if (const DeclRefExpr *lhs = GetIncrementedVar(B->getLHS(), x, y))
99 return lhs;
100
101 if (const DeclRefExpr *rhs = GetIncrementedVar(B->getRHS(), x, y))
102 return rhs;
103
104 return NULL;
Ted Kremenekdbfb5f82009-07-23 01:07:19 +0000105 }
Ted Kremenek8baf86d2009-07-23 21:34:35 +0000106
107 if (const DeclRefExpr *DR = dyn_cast<DeclRefExpr>(expr)) {
108 const NamedDecl *ND = DR->getDecl();
109 return ND == x || ND == y ? DR : NULL;
110 }
111
112 if (const UnaryOperator *U = dyn_cast<UnaryOperator>(expr))
113 return U->isIncrementDecrementOp()
114 ? GetIncrementedVar(U->getSubExpr(), x, y) : NULL;
115
Ted Kremenekdbfb5f82009-07-23 01:07:19 +0000116 return NULL;
117}
118
Ted Kremenek8baf86d2009-07-23 21:34:35 +0000119/// CheckLoopConditionForFloat - This check looks for 'for' statements that
120/// use a floating point variable as a loop counter.
121/// CERT: FLP30-C, FLP30-CPP.
122///
123void WalkAST::CheckLoopConditionForFloat(const ForStmt *FS) {
124 // Does the loop have a condition?
125 const Expr *condition = FS->getCond();
126
127 if (!condition)
128 return;
129
130 // Does the loop have an increment?
131 const Expr *increment = FS->getInc();
132
133 if (!increment)
134 return;
135
136 // Strip away '()' and casts.
137 condition = condition->IgnoreParenCasts();
138 increment = increment->IgnoreParenCasts();
139
140 // Is the loop condition a comparison?
141 const BinaryOperator *B = dyn_cast<BinaryOperator>(condition);
142
143 if (!B)
144 return;
145
Ted Kremenekcad9f412009-07-24 20:26:31 +0000146 // Is this a comparison?
147 if (!(B->isRelationalOp() || B->isEqualityOp()))
Ted Kremenek8baf86d2009-07-23 21:34:35 +0000148 return;
Ted Kremenekcad9f412009-07-24 20:26:31 +0000149
Ted Kremenek8baf86d2009-07-23 21:34:35 +0000150 // Are we comparing variables?
151 const DeclRefExpr *drLHS = dyn_cast<DeclRefExpr>(B->getLHS()->IgnoreParens());
152 const DeclRefExpr *drRHS = dyn_cast<DeclRefExpr>(B->getRHS()->IgnoreParens());
153
Ted Kremenekcad9f412009-07-24 20:26:31 +0000154 // Does at least one of the variables have a floating point type?
155 drLHS = drLHS && drLHS->getType()->isFloatingType() ? drLHS : NULL;
156 drRHS = drRHS && drRHS->getType()->isFloatingType() ? drRHS : NULL;
157
Ted Kremenek8baf86d2009-07-23 21:34:35 +0000158 if (!drLHS && !drRHS)
159 return;
160
161 const VarDecl *vdLHS = drLHS ? dyn_cast<VarDecl>(drLHS->getDecl()) : NULL;
162 const VarDecl *vdRHS = drRHS ? dyn_cast<VarDecl>(drRHS->getDecl()) : NULL;
163
164 if (!vdLHS && !vdRHS)
165 return;
166
167 // Does either variable appear in increment?
168 const DeclRefExpr *drInc = GetIncrementedVar(increment, vdLHS, vdRHS);
169
170 if (!drInc)
171 return;
172
173 // Emit the error. First figure out which DeclRefExpr in the condition
174 // referenced the compared variable.
175 const DeclRefExpr *drCond = vdLHS == drInc->getDecl() ? drLHS : drRHS;
176
177 llvm::SmallVector<SourceRange, 2> ranges;
178 std::string sbuf;
179 llvm::raw_string_ostream os(sbuf);
180
181 os << "Variable '" << drCond->getDecl()->getNameAsCString()
182 << "' with floating point type '" << drCond->getType().getAsString()
183 << "' should not be used as a loop counter";
184
185 ranges.push_back(drCond->getSourceRange());
186 ranges.push_back(drInc->getSourceRange());
187
188 const char *bugType = "Floating point variable used as loop counter";
189 BR.EmitBasicReport(bugType, "Security", os.str().c_str(),
190 FS->getLocStart(), ranges.data(), ranges.size());
Ted Kremenekdbfb5f82009-07-23 01:07:19 +0000191}
192
193//===----------------------------------------------------------------------===//
Ted Kremenekefcbb152009-07-23 22:29:41 +0000194// Check: Any use of 'gets' is insecure.
195// Originally: <rdar://problem/6335715>
196// Implements (part of): 300-BSI (buildsecurityin.us-cert.gov)
197//===----------------------------------------------------------------------===//
198
199void WalkAST::CheckCall_gets(const CallExpr *CE, const FunctionDecl *FD) {
200 if (FD->getIdentifier() != GetIdentifier(II_gets, "gets"))
201 return;
202
203 const FunctionProtoType *FTP = dyn_cast<FunctionProtoType>(FD->getType());
204 if (!FTP)
205 return;
206
207 // Verify that the function takes a single argument.
208 if (FTP->getNumArgs() != 1)
209 return;
210
211 // Is the argument a 'char*'?
212 const PointerType *PT = dyn_cast<PointerType>(FTP->getArgType(0));
213 if (!PT)
214 return;
215
216 if (PT->getPointeeType().getUnqualifiedType() != BR.getContext().CharTy)
217 return;
218
219 // Issue a warning.
220 SourceRange R = CE->getCallee()->getSourceRange();
221 BR.EmitBasicReport("Potential buffer overflow in call to 'gets'",
222 "Security",
223 "Call to function 'gets' is extremely insecure as it can "
224 "always result in a buffer overflow",
225 CE->getLocStart(), &R, 1);
226}
227
228//===----------------------------------------------------------------------===//
Ted Kremenekdbfb5f82009-07-23 01:07:19 +0000229// Entry point for check.
230//===----------------------------------------------------------------------===//
231
232void clang::CheckSecuritySyntaxOnly(Decl *D, BugReporter &BR) {
233 WalkAST walker(BR);
234 walker.Visit(D->getBody());
235}