Zhongxing Xu | 589c0f2 | 2009-11-12 08:38:56 +0000 | [diff] [blame] | 1 | //=== MallocChecker.cpp - A malloc/free checker -------------------*- C++ -*--// |
| 2 | // |
| 3 | // The LLVM Compiler Infrastructure |
| 4 | // |
| 5 | // This file is distributed under the University of Illinois Open Source |
| 6 | // License. See LICENSE.TXT for details. |
| 7 | // |
| 8 | //===----------------------------------------------------------------------===// |
| 9 | // |
| 10 | // This file defines malloc/free checker, which checks for potential memory |
| 11 | // leaks, double free, and use-after-free problems. |
| 12 | // |
| 13 | //===----------------------------------------------------------------------===// |
| 14 | |
Argyrios Kyrtzidis | 312dbec | 2011-02-28 01:26:35 +0000 | [diff] [blame] | 15 | #include "ClangSACheckers.h" |
Argyrios Kyrtzidis | ec8605f | 2011-03-01 01:16:21 +0000 | [diff] [blame] | 16 | #include "clang/StaticAnalyzer/Core/Checker.h" |
Argyrios Kyrtzidis | 312dbec | 2011-02-28 01:26:35 +0000 | [diff] [blame] | 17 | #include "clang/StaticAnalyzer/Core/CheckerManager.h" |
| 18 | #include "clang/StaticAnalyzer/Core/PathSensitive/CheckerContext.h" |
Ted Kremenek | 9b66371 | 2011-02-10 01:03:03 +0000 | [diff] [blame] | 19 | #include "clang/StaticAnalyzer/Core/BugReporter/BugType.h" |
Anna Zaks | 66c4040 | 2012-02-14 21:55:24 +0000 | [diff] [blame] | 20 | #include "clang/StaticAnalyzer/Core/PathSensitive/ObjCMessage.h" |
Ted Kremenek | 18c66fd | 2011-08-15 22:09:50 +0000 | [diff] [blame] | 21 | #include "clang/StaticAnalyzer/Core/PathSensitive/ProgramState.h" |
| 22 | #include "clang/StaticAnalyzer/Core/PathSensitive/ProgramStateTrait.h" |
Ted Kremenek | 9b66371 | 2011-02-10 01:03:03 +0000 | [diff] [blame] | 23 | #include "clang/StaticAnalyzer/Core/PathSensitive/SymbolManager.h" |
Anna Zaks | 15d0ae1 | 2012-02-11 23:46:36 +0000 | [diff] [blame] | 24 | #include "clang/Basic/SourceManager.h" |
Zhongxing Xu | 589c0f2 | 2009-11-12 08:38:56 +0000 | [diff] [blame] | 25 | #include "llvm/ADT/ImmutableMap.h" |
Benjamin Kramer | 8fe83e1 | 2012-02-04 13:45:25 +0000 | [diff] [blame] | 26 | #include "llvm/ADT/SmallString.h" |
Benjamin Kramer | 00bd44d | 2012-02-04 12:31:12 +0000 | [diff] [blame] | 27 | #include "llvm/ADT/STLExtras.h" |
Zhongxing Xu | 589c0f2 | 2009-11-12 08:38:56 +0000 | [diff] [blame] | 28 | using namespace clang; |
Ted Kremenek | 9ef6537 | 2010-12-23 07:20:52 +0000 | [diff] [blame] | 29 | using namespace ento; |
Zhongxing Xu | 589c0f2 | 2009-11-12 08:38:56 +0000 | [diff] [blame] | 30 | |
| 31 | namespace { |
| 32 | |
Zhongxing Xu | 7fb1464 | 2009-12-11 00:55:44 +0000 | [diff] [blame] | 33 | class RefState { |
Ted Kremenek | dde201b | 2010-08-06 21:12:55 +0000 | [diff] [blame] | 34 | enum Kind { AllocateUnchecked, AllocateFailed, Released, Escaped, |
| 35 | Relinquished } K; |
Zhongxing Xu | 243fde9 | 2009-11-17 07:54:15 +0000 | [diff] [blame] | 36 | const Stmt *S; |
| 37 | |
Zhongxing Xu | 7fb1464 | 2009-12-11 00:55:44 +0000 | [diff] [blame] | 38 | public: |
Zhongxing Xu | 243fde9 | 2009-11-17 07:54:15 +0000 | [diff] [blame] | 39 | RefState(Kind k, const Stmt *s) : K(k), S(s) {} |
| 40 | |
Zhongxing Xu | b94b81a | 2009-12-31 06:13:07 +0000 | [diff] [blame] | 41 | bool isAllocated() const { return K == AllocateUnchecked; } |
Chris Lattner | fae9622 | 2010-09-03 04:34:38 +0000 | [diff] [blame] | 42 | //bool isFailed() const { return K == AllocateFailed; } |
Zhongxing Xu | 243fde9 | 2009-11-17 07:54:15 +0000 | [diff] [blame] | 43 | bool isReleased() const { return K == Released; } |
Chris Lattner | fae9622 | 2010-09-03 04:34:38 +0000 | [diff] [blame] | 44 | //bool isEscaped() const { return K == Escaped; } |
| 45 | //bool isRelinquished() const { return K == Relinquished; } |
Anna Zaks | c8bb3be | 2012-02-13 18:05:39 +0000 | [diff] [blame] | 46 | const Stmt *getStmt() const { return S; } |
Zhongxing Xu | 243fde9 | 2009-11-17 07:54:15 +0000 | [diff] [blame] | 47 | |
| 48 | bool operator==(const RefState &X) const { |
| 49 | return K == X.K && S == X.S; |
| 50 | } |
| 51 | |
Zhongxing Xu | b94b81a | 2009-12-31 06:13:07 +0000 | [diff] [blame] | 52 | static RefState getAllocateUnchecked(const Stmt *s) { |
| 53 | return RefState(AllocateUnchecked, s); |
| 54 | } |
| 55 | static RefState getAllocateFailed() { |
| 56 | return RefState(AllocateFailed, 0); |
| 57 | } |
Zhongxing Xu | 243fde9 | 2009-11-17 07:54:15 +0000 | [diff] [blame] | 58 | static RefState getReleased(const Stmt *s) { return RefState(Released, s); } |
| 59 | static RefState getEscaped(const Stmt *s) { return RefState(Escaped, s); } |
Ted Kremenek | dde201b | 2010-08-06 21:12:55 +0000 | [diff] [blame] | 60 | static RefState getRelinquished(const Stmt *s) { |
| 61 | return RefState(Relinquished, s); |
| 62 | } |
Zhongxing Xu | 243fde9 | 2009-11-17 07:54:15 +0000 | [diff] [blame] | 63 | |
| 64 | void Profile(llvm::FoldingSetNodeID &ID) const { |
| 65 | ID.AddInteger(K); |
| 66 | ID.AddPointer(S); |
| 67 | } |
Zhongxing Xu | 589c0f2 | 2009-11-12 08:38:56 +0000 | [diff] [blame] | 68 | }; |
| 69 | |
Anna Zaks | 40add29 | 2012-02-15 00:11:25 +0000 | [diff] [blame] | 70 | struct ReallocPair { |
| 71 | SymbolRef ReallocatedSym; |
| 72 | bool IsFreeOnFailure; |
| 73 | ReallocPair(SymbolRef S, bool F) : ReallocatedSym(S), IsFreeOnFailure(F) {} |
| 74 | void Profile(llvm::FoldingSetNodeID &ID) const { |
| 75 | ID.AddInteger(IsFreeOnFailure); |
| 76 | ID.AddPointer(ReallocatedSym); |
| 77 | } |
| 78 | bool operator==(const ReallocPair &X) const { |
| 79 | return ReallocatedSym == X.ReallocatedSym && |
| 80 | IsFreeOnFailure == X.IsFreeOnFailure; |
| 81 | } |
| 82 | }; |
| 83 | |
Anna Zaks | b319e02 | 2012-02-08 20:13:28 +0000 | [diff] [blame] | 84 | class MallocChecker : public Checker<check::DeadSymbols, |
Ted Kremenek | e3659a7 | 2012-01-04 23:48:37 +0000 | [diff] [blame] | 85 | check::EndPath, |
| 86 | check::PreStmt<ReturnStmt>, |
Anna Zaks | 66c4040 | 2012-02-14 21:55:24 +0000 | [diff] [blame] | 87 | check::PreStmt<CallExpr>, |
Anna Zaks | b319e02 | 2012-02-08 20:13:28 +0000 | [diff] [blame] | 88 | check::PostStmt<CallExpr>, |
Ted Kremenek | e3659a7 | 2012-01-04 23:48:37 +0000 | [diff] [blame] | 89 | check::Location, |
| 90 | check::Bind, |
Anna Zaks | 4fb5487 | 2012-02-11 21:02:35 +0000 | [diff] [blame] | 91 | eval::Assume, |
| 92 | check::RegionChanges> |
Ted Kremenek | e3659a7 | 2012-01-04 23:48:37 +0000 | [diff] [blame] | 93 | { |
Dylan Noblesmith | 6f42b62 | 2012-02-05 02:12:40 +0000 | [diff] [blame] | 94 | mutable OwningPtr<BuiltinBug> BT_DoubleFree; |
| 95 | mutable OwningPtr<BuiltinBug> BT_Leak; |
| 96 | mutable OwningPtr<BuiltinBug> BT_UseFree; |
| 97 | mutable OwningPtr<BuiltinBug> BT_UseRelinquished; |
| 98 | mutable OwningPtr<BuiltinBug> BT_BadFree; |
Anna Zaks | b16ce45 | 2012-02-15 00:11:22 +0000 | [diff] [blame] | 99 | mutable IdentifierInfo *II_malloc, *II_free, *II_realloc, *II_calloc, |
Anna Zaks | 40add29 | 2012-02-15 00:11:25 +0000 | [diff] [blame] | 100 | *II_valloc, *II_reallocf; |
Zhongxing Xu | 589c0f2 | 2009-11-12 08:38:56 +0000 | [diff] [blame] | 101 | |
| 102 | public: |
Anna Zaks | b16ce45 | 2012-02-15 00:11:22 +0000 | [diff] [blame] | 103 | MallocChecker() : II_malloc(0), II_free(0), II_realloc(0), II_calloc(0), |
Anna Zaks | 40add29 | 2012-02-15 00:11:25 +0000 | [diff] [blame] | 104 | II_valloc(0), II_reallocf(0) {} |
Anna Zaks | 231361a | 2012-02-08 23:16:52 +0000 | [diff] [blame] | 105 | |
| 106 | /// In pessimistic mode, the checker assumes that it does not know which |
| 107 | /// functions might free the memory. |
| 108 | struct ChecksFilter { |
| 109 | DefaultBool CMallocPessimistic; |
| 110 | DefaultBool CMallocOptimistic; |
| 111 | }; |
| 112 | |
| 113 | ChecksFilter Filter; |
| 114 | |
Anna Zaks | 66c4040 | 2012-02-14 21:55:24 +0000 | [diff] [blame] | 115 | void checkPreStmt(const CallExpr *S, CheckerContext &C) const; |
Anna Zaks | b319e02 | 2012-02-08 20:13:28 +0000 | [diff] [blame] | 116 | void checkPostStmt(const CallExpr *CE, CheckerContext &C) const; |
Argyrios Kyrtzidis | 312dbec | 2011-02-28 01:26:35 +0000 | [diff] [blame] | 117 | void checkDeadSymbols(SymbolReaper &SymReaper, CheckerContext &C) const; |
Anna Zaks | af498a2 | 2011-10-25 19:56:48 +0000 | [diff] [blame] | 118 | void checkEndPath(CheckerContext &C) const; |
Argyrios Kyrtzidis | 312dbec | 2011-02-28 01:26:35 +0000 | [diff] [blame] | 119 | void checkPreStmt(const ReturnStmt *S, CheckerContext &C) const; |
Ted Kremenek | 8bef823 | 2012-01-26 21:29:00 +0000 | [diff] [blame] | 120 | ProgramStateRef evalAssume(ProgramStateRef state, SVal Cond, |
Argyrios Kyrtzidis | 312dbec | 2011-02-28 01:26:35 +0000 | [diff] [blame] | 121 | bool Assumption) const; |
Anna Zaks | 390909c | 2011-10-06 00:43:15 +0000 | [diff] [blame] | 122 | void checkLocation(SVal l, bool isLoad, const Stmt *S, |
| 123 | CheckerContext &C) const; |
| 124 | void checkBind(SVal location, SVal val, const Stmt*S, |
| 125 | CheckerContext &C) const; |
Anna Zaks | 4fb5487 | 2012-02-11 21:02:35 +0000 | [diff] [blame] | 126 | ProgramStateRef |
| 127 | checkRegionChanges(ProgramStateRef state, |
| 128 | const StoreManager::InvalidatedSymbols *invalidated, |
| 129 | ArrayRef<const MemRegion *> ExplicitRegions, |
Anna Zaks | 66c4040 | 2012-02-14 21:55:24 +0000 | [diff] [blame] | 130 | ArrayRef<const MemRegion *> Regions, |
| 131 | const CallOrObjCMessage *Call) const; |
Anna Zaks | 4fb5487 | 2012-02-11 21:02:35 +0000 | [diff] [blame] | 132 | bool wantsRegionChangeUpdate(ProgramStateRef state) const { |
| 133 | return true; |
| 134 | } |
Zhongxing Xu | b94b81a | 2009-12-31 06:13:07 +0000 | [diff] [blame] | 135 | |
Zhongxing Xu | 7b76096 | 2009-11-13 07:25:27 +0000 | [diff] [blame] | 136 | private: |
Anna Zaks | 66c4040 | 2012-02-14 21:55:24 +0000 | [diff] [blame] | 137 | void initIdentifierInfo(ASTContext &C) const; |
| 138 | |
| 139 | /// Check if this is one of the functions which can allocate/reallocate memory |
| 140 | /// pointed to by one of its arguments. |
| 141 | bool isMemFunction(const FunctionDecl *FD, ASTContext &C) const; |
| 142 | |
Argyrios Kyrtzidis | 312dbec | 2011-02-28 01:26:35 +0000 | [diff] [blame] | 143 | static void MallocMem(CheckerContext &C, const CallExpr *CE); |
| 144 | static void MallocMemReturnsAttr(CheckerContext &C, const CallExpr *CE, |
| 145 | const OwnershipAttr* Att); |
Ted Kremenek | 8bef823 | 2012-01-26 21:29:00 +0000 | [diff] [blame] | 146 | static ProgramStateRef MallocMemAux(CheckerContext &C, const CallExpr *CE, |
Argyrios Kyrtzidis | 312dbec | 2011-02-28 01:26:35 +0000 | [diff] [blame] | 147 | const Expr *SizeEx, SVal Init, |
Ted Kremenek | 8bef823 | 2012-01-26 21:29:00 +0000 | [diff] [blame] | 148 | ProgramStateRef state) { |
Ted Kremenek | 5eca482 | 2012-01-06 22:09:28 +0000 | [diff] [blame] | 149 | return MallocMemAux(C, CE, |
| 150 | state->getSVal(SizeEx, C.getLocationContext()), |
| 151 | Init, state); |
Zhongxing Xu | a5ce966 | 2010-06-01 03:01:33 +0000 | [diff] [blame] | 152 | } |
Ted Kremenek | 8bef823 | 2012-01-26 21:29:00 +0000 | [diff] [blame] | 153 | static ProgramStateRef MallocMemAux(CheckerContext &C, const CallExpr *CE, |
Argyrios Kyrtzidis | 312dbec | 2011-02-28 01:26:35 +0000 | [diff] [blame] | 154 | SVal SizeEx, SVal Init, |
Ted Kremenek | 8bef823 | 2012-01-26 21:29:00 +0000 | [diff] [blame] | 155 | ProgramStateRef state); |
Zhongxing Xu | a5ce966 | 2010-06-01 03:01:33 +0000 | [diff] [blame] | 156 | |
Argyrios Kyrtzidis | 312dbec | 2011-02-28 01:26:35 +0000 | [diff] [blame] | 157 | void FreeMem(CheckerContext &C, const CallExpr *CE) const; |
Jordy Rose | 2a47992 | 2010-08-12 08:54:03 +0000 | [diff] [blame] | 158 | void FreeMemAttr(CheckerContext &C, const CallExpr *CE, |
Argyrios Kyrtzidis | 312dbec | 2011-02-28 01:26:35 +0000 | [diff] [blame] | 159 | const OwnershipAttr* Att) const; |
Ted Kremenek | 8bef823 | 2012-01-26 21:29:00 +0000 | [diff] [blame] | 160 | ProgramStateRef FreeMemAux(CheckerContext &C, const CallExpr *CE, |
| 161 | ProgramStateRef state, unsigned Num, |
Ted Kremenek | e3659a7 | 2012-01-04 23:48:37 +0000 | [diff] [blame] | 162 | bool Hold) const; |
Zhongxing Xu | d9c84c8 | 2009-12-12 12:29:38 +0000 | [diff] [blame] | 163 | |
Anna Zaks | 40add29 | 2012-02-15 00:11:25 +0000 | [diff] [blame] | 164 | void ReallocMem(CheckerContext &C, const CallExpr *CE, |
| 165 | bool FreesMemOnFailure) const; |
Argyrios Kyrtzidis | 312dbec | 2011-02-28 01:26:35 +0000 | [diff] [blame] | 166 | static void CallocMem(CheckerContext &C, const CallExpr *CE); |
Jordy Rose | 43859f6 | 2010-06-07 19:32:37 +0000 | [diff] [blame] | 167 | |
Anna Zaks | 91c2a11 | 2012-02-08 23:16:56 +0000 | [diff] [blame] | 168 | bool checkEscape(SymbolRef Sym, const Stmt *S, CheckerContext &C) const; |
| 169 | bool checkUseAfterFree(SymbolRef Sym, CheckerContext &C, |
| 170 | const Stmt *S = 0) const; |
| 171 | |
Anna Zaks | 66c4040 | 2012-02-14 21:55:24 +0000 | [diff] [blame] | 172 | /// Check if the function is not known to us. So, for example, we could |
| 173 | /// conservatively assume it can free/reallocate it's pointer arguments. |
| 174 | bool hasUnknownBehavior(const FunctionDecl *FD, ProgramStateRef State) const; |
| 175 | |
Ted Kremenek | 9c378f7 | 2011-08-12 23:37:29 +0000 | [diff] [blame] | 176 | static bool SummarizeValue(raw_ostream &os, SVal V); |
| 177 | static bool SummarizeRegion(raw_ostream &os, const MemRegion *MR); |
Argyrios Kyrtzidis | 312dbec | 2011-02-28 01:26:35 +0000 | [diff] [blame] | 178 | void ReportBadFree(CheckerContext &C, SVal ArgVal, SourceRange range) const; |
Anna Zaks | ff3b9fd | 2012-02-09 06:25:51 +0000 | [diff] [blame] | 179 | |
Anna Zaks | da04677 | 2012-02-11 21:02:40 +0000 | [diff] [blame] | 180 | void reportLeak(SymbolRef Sym, ExplodedNode *N, CheckerContext &C) const; |
| 181 | |
Anna Zaks | ff3b9fd | 2012-02-09 06:25:51 +0000 | [diff] [blame] | 182 | /// The bug visitor which allows us to print extra diagnostics along the |
| 183 | /// BugReport path. For example, showing the allocation site of the leaked |
| 184 | /// region. |
| 185 | class MallocBugVisitor : public BugReporterVisitor { |
| 186 | protected: |
Anna Zaks | fe57160 | 2012-02-16 22:26:07 +0000 | [diff] [blame^] | 187 | enum NotificationMode { |
| 188 | Normal, |
| 189 | Complete, |
| 190 | ReallocationFailed |
| 191 | }; |
| 192 | |
Anna Zaks | ff3b9fd | 2012-02-09 06:25:51 +0000 | [diff] [blame] | 193 | // The allocated region symbol tracked by the main analysis. |
| 194 | SymbolRef Sym; |
Anna Zaks | fe57160 | 2012-02-16 22:26:07 +0000 | [diff] [blame^] | 195 | NotificationMode Mode; |
Anna Zaks | ff3b9fd | 2012-02-09 06:25:51 +0000 | [diff] [blame] | 196 | |
| 197 | public: |
Anna Zaks | fe57160 | 2012-02-16 22:26:07 +0000 | [diff] [blame^] | 198 | MallocBugVisitor(SymbolRef S) : Sym(S), Mode(Normal) {} |
Anna Zaks | ff3b9fd | 2012-02-09 06:25:51 +0000 | [diff] [blame] | 199 | virtual ~MallocBugVisitor() {} |
| 200 | |
| 201 | void Profile(llvm::FoldingSetNodeID &ID) const { |
| 202 | static int X = 0; |
| 203 | ID.AddPointer(&X); |
| 204 | ID.AddPointer(Sym); |
| 205 | } |
| 206 | |
Anna Zaks | fe57160 | 2012-02-16 22:26:07 +0000 | [diff] [blame^] | 207 | inline bool isAllocated(const RefState *S, const RefState *SPrev, |
| 208 | const Stmt *Stmt) { |
Anna Zaks | ff3b9fd | 2012-02-09 06:25:51 +0000 | [diff] [blame] | 209 | // Did not track -> allocated. Other state (released) -> allocated. |
Anna Zaks | fe57160 | 2012-02-16 22:26:07 +0000 | [diff] [blame^] | 210 | return (Stmt && isa<CallExpr>(Stmt) && |
| 211 | (S && S->isAllocated()) && (!SPrev || !SPrev->isAllocated())); |
Anna Zaks | ff3b9fd | 2012-02-09 06:25:51 +0000 | [diff] [blame] | 212 | } |
| 213 | |
Anna Zaks | fe57160 | 2012-02-16 22:26:07 +0000 | [diff] [blame^] | 214 | inline bool isReleased(const RefState *S, const RefState *SPrev, |
| 215 | const Stmt *Stmt) { |
Anna Zaks | ff3b9fd | 2012-02-09 06:25:51 +0000 | [diff] [blame] | 216 | // Did not track -> released. Other state (allocated) -> released. |
Anna Zaks | fe57160 | 2012-02-16 22:26:07 +0000 | [diff] [blame^] | 217 | return (Stmt && isa<CallExpr>(Stmt) && |
| 218 | (S && S->isReleased()) && (!SPrev || !SPrev->isReleased())); |
| 219 | } |
| 220 | |
| 221 | inline bool isReallocFailedCheck(const RefState *S, const RefState *SPrev, |
| 222 | const Stmt *Stmt) { |
| 223 | // If the expression is not a call, and the state change is |
| 224 | // released -> allocated, it must be the realloc return value |
| 225 | // check. If we have to handle more cases here, it might be cleaner just |
| 226 | // to track this extra bit in the state itself. |
| 227 | return ((!Stmt || !isa<CallExpr>(Stmt)) && |
| 228 | (S && S->isAllocated()) && (SPrev && !SPrev->isAllocated())); |
Anna Zaks | ff3b9fd | 2012-02-09 06:25:51 +0000 | [diff] [blame] | 229 | } |
| 230 | |
| 231 | PathDiagnosticPiece *VisitNode(const ExplodedNode *N, |
| 232 | const ExplodedNode *PrevN, |
| 233 | BugReporterContext &BRC, |
| 234 | BugReport &BR); |
| 235 | }; |
Zhongxing Xu | 589c0f2 | 2009-11-12 08:38:56 +0000 | [diff] [blame] | 236 | }; |
Kovarththanan Rajaratnam | ba5fb5a | 2009-11-28 06:07:30 +0000 | [diff] [blame] | 237 | } // end anonymous namespace |
Zhongxing Xu | 589c0f2 | 2009-11-12 08:38:56 +0000 | [diff] [blame] | 238 | |
Zhongxing Xu | b94b81a | 2009-12-31 06:13:07 +0000 | [diff] [blame] | 239 | typedef llvm::ImmutableMap<SymbolRef, RefState> RegionStateTy; |
Anna Zaks | 40add29 | 2012-02-15 00:11:25 +0000 | [diff] [blame] | 240 | typedef llvm::ImmutableMap<SymbolRef, ReallocPair > ReallocMap; |
Anna Zaks | c8bb3be | 2012-02-13 18:05:39 +0000 | [diff] [blame] | 241 | class RegionState {}; |
| 242 | class ReallocPairs {}; |
Zhongxing Xu | 589c0f2 | 2009-11-12 08:38:56 +0000 | [diff] [blame] | 243 | namespace clang { |
Ted Kremenek | 9ef6537 | 2010-12-23 07:20:52 +0000 | [diff] [blame] | 244 | namespace ento { |
Zhongxing Xu | 243fde9 | 2009-11-17 07:54:15 +0000 | [diff] [blame] | 245 | template <> |
Ted Kremenek | 18c66fd | 2011-08-15 22:09:50 +0000 | [diff] [blame] | 246 | struct ProgramStateTrait<RegionState> |
| 247 | : public ProgramStatePartialTrait<RegionStateTy> { |
Argyrios Kyrtzidis | 312dbec | 2011-02-28 01:26:35 +0000 | [diff] [blame] | 248 | static void *GDMIndex() { static int x; return &x; } |
Zhongxing Xu | 589c0f2 | 2009-11-12 08:38:56 +0000 | [diff] [blame] | 249 | }; |
Anna Zaks | c8bb3be | 2012-02-13 18:05:39 +0000 | [diff] [blame] | 250 | |
| 251 | template <> |
| 252 | struct ProgramStateTrait<ReallocPairs> |
Anna Zaks | 40add29 | 2012-02-15 00:11:25 +0000 | [diff] [blame] | 253 | : public ProgramStatePartialTrait<ReallocMap> { |
Anna Zaks | c8bb3be | 2012-02-13 18:05:39 +0000 | [diff] [blame] | 254 | static void *GDMIndex() { static int x; return &x; } |
| 255 | }; |
Zhongxing Xu | 589c0f2 | 2009-11-12 08:38:56 +0000 | [diff] [blame] | 256 | } |
Argyrios Kyrtzidis | 5a4f98f | 2010-12-22 18:53:20 +0000 | [diff] [blame] | 257 | } |
Zhongxing Xu | 589c0f2 | 2009-11-12 08:38:56 +0000 | [diff] [blame] | 258 | |
Anna Zaks | 4fb5487 | 2012-02-11 21:02:35 +0000 | [diff] [blame] | 259 | namespace { |
| 260 | class StopTrackingCallback : public SymbolVisitor { |
| 261 | ProgramStateRef state; |
| 262 | public: |
| 263 | StopTrackingCallback(ProgramStateRef st) : state(st) {} |
| 264 | ProgramStateRef getState() const { return state; } |
| 265 | |
| 266 | bool VisitSymbol(SymbolRef sym) { |
| 267 | state = state->remove<RegionState>(sym); |
| 268 | return true; |
| 269 | } |
| 270 | }; |
| 271 | } // end anonymous namespace |
| 272 | |
Anna Zaks | 66c4040 | 2012-02-14 21:55:24 +0000 | [diff] [blame] | 273 | void MallocChecker::initIdentifierInfo(ASTContext &Ctx) const { |
Zhongxing Xu | 589c0f2 | 2009-11-12 08:38:56 +0000 | [diff] [blame] | 274 | if (!II_malloc) |
| 275 | II_malloc = &Ctx.Idents.get("malloc"); |
| 276 | if (!II_free) |
Zhongxing Xu | fc7ac8f | 2009-11-13 07:48:11 +0000 | [diff] [blame] | 277 | II_free = &Ctx.Idents.get("free"); |
Zhongxing Xu | d9c84c8 | 2009-12-12 12:29:38 +0000 | [diff] [blame] | 278 | if (!II_realloc) |
| 279 | II_realloc = &Ctx.Idents.get("realloc"); |
Anna Zaks | 40add29 | 2012-02-15 00:11:25 +0000 | [diff] [blame] | 280 | if (!II_reallocf) |
| 281 | II_reallocf = &Ctx.Idents.get("reallocf"); |
Zhongxing Xu | a5ce966 | 2010-06-01 03:01:33 +0000 | [diff] [blame] | 282 | if (!II_calloc) |
| 283 | II_calloc = &Ctx.Idents.get("calloc"); |
Anna Zaks | b16ce45 | 2012-02-15 00:11:22 +0000 | [diff] [blame] | 284 | if (!II_valloc) |
| 285 | II_valloc = &Ctx.Idents.get("valloc"); |
Anna Zaks | b319e02 | 2012-02-08 20:13:28 +0000 | [diff] [blame] | 286 | } |
| 287 | |
Anna Zaks | 66c4040 | 2012-02-14 21:55:24 +0000 | [diff] [blame] | 288 | bool MallocChecker::isMemFunction(const FunctionDecl *FD, ASTContext &C) const { |
Anna Zaks | 1d6cc6a | 2012-02-15 02:12:00 +0000 | [diff] [blame] | 289 | if (!FD) |
| 290 | return false; |
Anna Zaks | 66c4040 | 2012-02-14 21:55:24 +0000 | [diff] [blame] | 291 | IdentifierInfo *FunI = FD->getIdentifier(); |
| 292 | if (!FunI) |
| 293 | return false; |
| 294 | |
Anna Zaks | 1d6cc6a | 2012-02-15 02:12:00 +0000 | [diff] [blame] | 295 | initIdentifierInfo(C); |
| 296 | |
Anna Zaks | 66c4040 | 2012-02-14 21:55:24 +0000 | [diff] [blame] | 297 | // TODO: Add more here : ex: reallocf! |
Anna Zaks | 40add29 | 2012-02-15 00:11:25 +0000 | [diff] [blame] | 298 | if (FunI == II_malloc || FunI == II_free || FunI == II_realloc || |
| 299 | FunI == II_reallocf || FunI == II_calloc || FunI == II_valloc) |
Anna Zaks | 66c4040 | 2012-02-14 21:55:24 +0000 | [diff] [blame] | 300 | return true; |
| 301 | |
| 302 | if (Filter.CMallocOptimistic && FD->hasAttrs() && |
| 303 | FD->specific_attr_begin<OwnershipAttr>() != |
| 304 | FD->specific_attr_end<OwnershipAttr>()) |
| 305 | return true; |
| 306 | |
| 307 | |
| 308 | return false; |
| 309 | } |
| 310 | |
Anna Zaks | b319e02 | 2012-02-08 20:13:28 +0000 | [diff] [blame] | 311 | void MallocChecker::checkPostStmt(const CallExpr *CE, CheckerContext &C) const { |
| 312 | const FunctionDecl *FD = C.getCalleeDecl(CE); |
| 313 | if (!FD) |
| 314 | return; |
Zhongxing Xu | 589c0f2 | 2009-11-12 08:38:56 +0000 | [diff] [blame] | 315 | |
Anna Zaks | b16ce45 | 2012-02-15 00:11:22 +0000 | [diff] [blame] | 316 | initIdentifierInfo(C.getASTContext()); |
| 317 | IdentifierInfo *FunI = FD->getIdentifier(); |
| 318 | if (!FunI) |
| 319 | return; |
| 320 | |
| 321 | if (FunI == II_malloc || FunI == II_valloc) { |
Zhongxing Xu | 589c0f2 | 2009-11-12 08:38:56 +0000 | [diff] [blame] | 322 | MallocMem(C, CE); |
Anna Zaks | b319e02 | 2012-02-08 20:13:28 +0000 | [diff] [blame] | 323 | return; |
Anna Zaks | b16ce45 | 2012-02-15 00:11:22 +0000 | [diff] [blame] | 324 | } else if (FunI == II_realloc) { |
Anna Zaks | 40add29 | 2012-02-15 00:11:25 +0000 | [diff] [blame] | 325 | ReallocMem(C, CE, false); |
| 326 | return; |
| 327 | } else if (FunI == II_reallocf) { |
| 328 | ReallocMem(C, CE, true); |
Anna Zaks | b319e02 | 2012-02-08 20:13:28 +0000 | [diff] [blame] | 329 | return; |
Anna Zaks | b16ce45 | 2012-02-15 00:11:22 +0000 | [diff] [blame] | 330 | } else if (FunI == II_calloc) { |
Zhongxing Xu | a5ce966 | 2010-06-01 03:01:33 +0000 | [diff] [blame] | 331 | CallocMem(C, CE); |
Anna Zaks | b319e02 | 2012-02-08 20:13:28 +0000 | [diff] [blame] | 332 | return; |
Anna Zaks | b16ce45 | 2012-02-15 00:11:22 +0000 | [diff] [blame] | 333 | }else if (FunI == II_free) { |
Anna Zaks | b319e02 | 2012-02-08 20:13:28 +0000 | [diff] [blame] | 334 | FreeMem(C, CE); |
| 335 | return; |
Zhongxing Xu | a5ce966 | 2010-06-01 03:01:33 +0000 | [diff] [blame] | 336 | } |
| 337 | |
Anna Zaks | 91c2a11 | 2012-02-08 23:16:56 +0000 | [diff] [blame] | 338 | if (Filter.CMallocOptimistic) |
Ted Kremenek | dd0e490 | 2010-07-31 01:52:11 +0000 | [diff] [blame] | 339 | // Check all the attributes, if there are any. |
| 340 | // There can be multiple of these attributes. |
Ted Kremenek | dd0e490 | 2010-07-31 01:52:11 +0000 | [diff] [blame] | 341 | if (FD->hasAttrs()) { |
Sean Hunt | cf807c4 | 2010-08-18 23:23:40 +0000 | [diff] [blame] | 342 | for (specific_attr_iterator<OwnershipAttr> |
| 343 | i = FD->specific_attr_begin<OwnershipAttr>(), |
| 344 | e = FD->specific_attr_end<OwnershipAttr>(); |
| 345 | i != e; ++i) { |
| 346 | switch ((*i)->getOwnKind()) { |
| 347 | case OwnershipAttr::Returns: { |
| 348 | MallocMemReturnsAttr(C, CE, *i); |
Anna Zaks | 15d0ae1 | 2012-02-11 23:46:36 +0000 | [diff] [blame] | 349 | return; |
Sean Hunt | cf807c4 | 2010-08-18 23:23:40 +0000 | [diff] [blame] | 350 | } |
| 351 | case OwnershipAttr::Takes: |
| 352 | case OwnershipAttr::Holds: { |
| 353 | FreeMemAttr(C, CE, *i); |
Anna Zaks | 15d0ae1 | 2012-02-11 23:46:36 +0000 | [diff] [blame] | 354 | return; |
Sean Hunt | cf807c4 | 2010-08-18 23:23:40 +0000 | [diff] [blame] | 355 | } |
Ted Kremenek | dd0e490 | 2010-07-31 01:52:11 +0000 | [diff] [blame] | 356 | } |
| 357 | } |
| 358 | } |
Zhongxing Xu | 589c0f2 | 2009-11-12 08:38:56 +0000 | [diff] [blame] | 359 | } |
| 360 | |
| 361 | void MallocChecker::MallocMem(CheckerContext &C, const CallExpr *CE) { |
Ted Kremenek | 8bef823 | 2012-01-26 21:29:00 +0000 | [diff] [blame] | 362 | ProgramStateRef state = MallocMemAux(C, CE, CE->getArg(0), UndefinedVal(), |
Zhongxing Xu | a5ce966 | 2010-06-01 03:01:33 +0000 | [diff] [blame] | 363 | C.getState()); |
Anna Zaks | 0bd6b11 | 2011-10-26 21:06:34 +0000 | [diff] [blame] | 364 | C.addTransition(state); |
Zhongxing Xu | d9c84c8 | 2009-12-12 12:29:38 +0000 | [diff] [blame] | 365 | } |
| 366 | |
Ted Kremenek | dd0e490 | 2010-07-31 01:52:11 +0000 | [diff] [blame] | 367 | void MallocChecker::MallocMemReturnsAttr(CheckerContext &C, const CallExpr *CE, |
| 368 | const OwnershipAttr* Att) { |
Sean Hunt | cf807c4 | 2010-08-18 23:23:40 +0000 | [diff] [blame] | 369 | if (Att->getModule() != "malloc") |
Ted Kremenek | dd0e490 | 2010-07-31 01:52:11 +0000 | [diff] [blame] | 370 | return; |
| 371 | |
Sean Hunt | cf807c4 | 2010-08-18 23:23:40 +0000 | [diff] [blame] | 372 | OwnershipAttr::args_iterator I = Att->args_begin(), E = Att->args_end(); |
Ted Kremenek | dd0e490 | 2010-07-31 01:52:11 +0000 | [diff] [blame] | 373 | if (I != E) { |
Ted Kremenek | 8bef823 | 2012-01-26 21:29:00 +0000 | [diff] [blame] | 374 | ProgramStateRef state = |
Ted Kremenek | dd0e490 | 2010-07-31 01:52:11 +0000 | [diff] [blame] | 375 | MallocMemAux(C, CE, CE->getArg(*I), UndefinedVal(), C.getState()); |
Anna Zaks | 0bd6b11 | 2011-10-26 21:06:34 +0000 | [diff] [blame] | 376 | C.addTransition(state); |
Ted Kremenek | dd0e490 | 2010-07-31 01:52:11 +0000 | [diff] [blame] | 377 | return; |
| 378 | } |
Ted Kremenek | 8bef823 | 2012-01-26 21:29:00 +0000 | [diff] [blame] | 379 | ProgramStateRef state = MallocMemAux(C, CE, UnknownVal(), UndefinedVal(), |
Ted Kremenek | dd0e490 | 2010-07-31 01:52:11 +0000 | [diff] [blame] | 380 | C.getState()); |
Anna Zaks | 0bd6b11 | 2011-10-26 21:06:34 +0000 | [diff] [blame] | 381 | C.addTransition(state); |
Ted Kremenek | dd0e490 | 2010-07-31 01:52:11 +0000 | [diff] [blame] | 382 | } |
| 383 | |
Anna Zaks | b319e02 | 2012-02-08 20:13:28 +0000 | [diff] [blame] | 384 | ProgramStateRef MallocChecker::MallocMemAux(CheckerContext &C, |
Zhongxing Xu | d9c84c8 | 2009-12-12 12:29:38 +0000 | [diff] [blame] | 385 | const CallExpr *CE, |
Zhongxing Xu | a5ce966 | 2010-06-01 03:01:33 +0000 | [diff] [blame] | 386 | SVal Size, SVal Init, |
Ted Kremenek | 8bef823 | 2012-01-26 21:29:00 +0000 | [diff] [blame] | 387 | ProgramStateRef state) { |
Ted Kremenek | c8413fd | 2010-12-02 07:49:45 +0000 | [diff] [blame] | 388 | SValBuilder &svalBuilder = C.getSValBuilder(); |
Zhongxing Xu | a49c6b7 | 2009-12-11 03:09:01 +0000 | [diff] [blame] | 389 | |
Anna Zaks | b319e02 | 2012-02-08 20:13:28 +0000 | [diff] [blame] | 390 | // Get the return value. |
| 391 | SVal retVal = state->getSVal(CE, C.getLocationContext()); |
Zhongxing Xu | a49c6b7 | 2009-12-11 03:09:01 +0000 | [diff] [blame] | 392 | |
Anna Zaks | b16ce45 | 2012-02-15 00:11:22 +0000 | [diff] [blame] | 393 | // We expect the malloc functions to return a pointer. |
| 394 | if (!isa<Loc>(retVal)) |
| 395 | return 0; |
| 396 | |
Jordy Rose | 32f2656 | 2010-07-04 00:00:41 +0000 | [diff] [blame] | 397 | // Fill the region with the initialization value. |
Ted Kremenek | c8413fd | 2010-12-02 07:49:45 +0000 | [diff] [blame] | 398 | state = state->bindDefault(retVal, Init); |
Zhongxing Xu | a5ce966 | 2010-06-01 03:01:33 +0000 | [diff] [blame] | 399 | |
Jordy Rose | 32f2656 | 2010-07-04 00:00:41 +0000 | [diff] [blame] | 400 | // Set the region's extent equal to the Size parameter. |
Anna Zaks | e9ef562 | 2012-02-10 01:11:00 +0000 | [diff] [blame] | 401 | const SymbolicRegion *R = |
| 402 | dyn_cast_or_null<SymbolicRegion>(retVal.getAsRegion()); |
| 403 | if (!R || !isa<DefinedOrUnknownSVal>(Size)) |
| 404 | return 0; |
| 405 | |
Ted Kremenek | c8413fd | 2010-12-02 07:49:45 +0000 | [diff] [blame] | 406 | DefinedOrUnknownSVal Extent = R->getExtent(svalBuilder); |
Jordy Rose | 32f2656 | 2010-07-04 00:00:41 +0000 | [diff] [blame] | 407 | DefinedOrUnknownSVal DefinedSize = cast<DefinedOrUnknownSVal>(Size); |
Ted Kremenek | c8413fd | 2010-12-02 07:49:45 +0000 | [diff] [blame] | 408 | DefinedOrUnknownSVal extentMatchesSize = |
Ted Kremenek | 9c14953 | 2010-12-01 21:57:22 +0000 | [diff] [blame] | 409 | svalBuilder.evalEQ(state, Extent, DefinedSize); |
Jordy Rose | 32f2656 | 2010-07-04 00:00:41 +0000 | [diff] [blame] | 410 | |
Ted Kremenek | c8413fd | 2010-12-02 07:49:45 +0000 | [diff] [blame] | 411 | state = state->assume(extentMatchesSize, true); |
| 412 | assert(state); |
| 413 | |
| 414 | SymbolRef Sym = retVal.getAsLocSymbol(); |
Zhongxing Xu | 589c0f2 | 2009-11-12 08:38:56 +0000 | [diff] [blame] | 415 | assert(Sym); |
Ted Kremenek | c8413fd | 2010-12-02 07:49:45 +0000 | [diff] [blame] | 416 | |
Zhongxing Xu | 589c0f2 | 2009-11-12 08:38:56 +0000 | [diff] [blame] | 417 | // Set the symbol's state to Allocated. |
Zhongxing Xu | b94b81a | 2009-12-31 06:13:07 +0000 | [diff] [blame] | 418 | return state->set<RegionState>(Sym, RefState::getAllocateUnchecked(CE)); |
Zhongxing Xu | 589c0f2 | 2009-11-12 08:38:56 +0000 | [diff] [blame] | 419 | } |
| 420 | |
Argyrios Kyrtzidis | 312dbec | 2011-02-28 01:26:35 +0000 | [diff] [blame] | 421 | void MallocChecker::FreeMem(CheckerContext &C, const CallExpr *CE) const { |
Ted Kremenek | 8bef823 | 2012-01-26 21:29:00 +0000 | [diff] [blame] | 422 | ProgramStateRef state = FreeMemAux(C, CE, C.getState(), 0, false); |
Zhongxing Xu | d9c84c8 | 2009-12-12 12:29:38 +0000 | [diff] [blame] | 423 | |
| 424 | if (state) |
Anna Zaks | 0bd6b11 | 2011-10-26 21:06:34 +0000 | [diff] [blame] | 425 | C.addTransition(state); |
Zhongxing Xu | d9c84c8 | 2009-12-12 12:29:38 +0000 | [diff] [blame] | 426 | } |
| 427 | |
Ted Kremenek | dd0e490 | 2010-07-31 01:52:11 +0000 | [diff] [blame] | 428 | void MallocChecker::FreeMemAttr(CheckerContext &C, const CallExpr *CE, |
Argyrios Kyrtzidis | 312dbec | 2011-02-28 01:26:35 +0000 | [diff] [blame] | 429 | const OwnershipAttr* Att) const { |
Sean Hunt | cf807c4 | 2010-08-18 23:23:40 +0000 | [diff] [blame] | 430 | if (Att->getModule() != "malloc") |
Ted Kremenek | dd0e490 | 2010-07-31 01:52:11 +0000 | [diff] [blame] | 431 | return; |
| 432 | |
Sean Hunt | cf807c4 | 2010-08-18 23:23:40 +0000 | [diff] [blame] | 433 | for (OwnershipAttr::args_iterator I = Att->args_begin(), E = Att->args_end(); |
| 434 | I != E; ++I) { |
Ted Kremenek | 8bef823 | 2012-01-26 21:29:00 +0000 | [diff] [blame] | 435 | ProgramStateRef state = |
Ted Kremenek | e3659a7 | 2012-01-04 23:48:37 +0000 | [diff] [blame] | 436 | FreeMemAux(C, CE, C.getState(), *I, |
| 437 | Att->getOwnKind() == OwnershipAttr::Holds); |
Sean Hunt | cf807c4 | 2010-08-18 23:23:40 +0000 | [diff] [blame] | 438 | if (state) |
Anna Zaks | 0bd6b11 | 2011-10-26 21:06:34 +0000 | [diff] [blame] | 439 | C.addTransition(state); |
Ted Kremenek | dd0e490 | 2010-07-31 01:52:11 +0000 | [diff] [blame] | 440 | } |
| 441 | } |
| 442 | |
Ted Kremenek | 8bef823 | 2012-01-26 21:29:00 +0000 | [diff] [blame] | 443 | ProgramStateRef MallocChecker::FreeMemAux(CheckerContext &C, |
Anna Zaks | e9ef562 | 2012-02-10 01:11:00 +0000 | [diff] [blame] | 444 | const CallExpr *CE, |
| 445 | ProgramStateRef state, |
| 446 | unsigned Num, |
| 447 | bool Hold) const { |
Ted Kremenek | dd0e490 | 2010-07-31 01:52:11 +0000 | [diff] [blame] | 448 | const Expr *ArgExpr = CE->getArg(Num); |
Ted Kremenek | 5eca482 | 2012-01-06 22:09:28 +0000 | [diff] [blame] | 449 | SVal ArgVal = state->getSVal(ArgExpr, C.getLocationContext()); |
Anna Zaks | e9ef562 | 2012-02-10 01:11:00 +0000 | [diff] [blame] | 450 | if (!isa<DefinedOrUnknownSVal>(ArgVal)) |
| 451 | return 0; |
Ted Kremenek | dd0e490 | 2010-07-31 01:52:11 +0000 | [diff] [blame] | 452 | DefinedOrUnknownSVal location = cast<DefinedOrUnknownSVal>(ArgVal); |
| 453 | |
| 454 | // Check for null dereferences. |
| 455 | if (!isa<Loc>(location)) |
Anna Zaks | b319e02 | 2012-02-08 20:13:28 +0000 | [diff] [blame] | 456 | return 0; |
Ted Kremenek | dd0e490 | 2010-07-31 01:52:11 +0000 | [diff] [blame] | 457 | |
Anna Zaks | b276bd9 | 2012-02-14 00:26:13 +0000 | [diff] [blame] | 458 | // The explicit NULL case, no operation is performed. |
Ted Kremenek | 8bef823 | 2012-01-26 21:29:00 +0000 | [diff] [blame] | 459 | ProgramStateRef notNullState, nullState; |
Ted Kremenek | 28f47b9 | 2010-12-01 22:16:56 +0000 | [diff] [blame] | 460 | llvm::tie(notNullState, nullState) = state->assume(location); |
Ted Kremenek | dd0e490 | 2010-07-31 01:52:11 +0000 | [diff] [blame] | 461 | if (nullState && !notNullState) |
Anna Zaks | b319e02 | 2012-02-08 20:13:28 +0000 | [diff] [blame] | 462 | return 0; |
Ted Kremenek | dd0e490 | 2010-07-31 01:52:11 +0000 | [diff] [blame] | 463 | |
Jordy Rose | 43859f6 | 2010-06-07 19:32:37 +0000 | [diff] [blame] | 464 | // Unknown values could easily be okay |
| 465 | // Undefined values are handled elsewhere |
| 466 | if (ArgVal.isUnknownOrUndef()) |
Anna Zaks | b319e02 | 2012-02-08 20:13:28 +0000 | [diff] [blame] | 467 | return 0; |
Zhongxing Xu | 589c0f2 | 2009-11-12 08:38:56 +0000 | [diff] [blame] | 468 | |
Jordy Rose | 43859f6 | 2010-06-07 19:32:37 +0000 | [diff] [blame] | 469 | const MemRegion *R = ArgVal.getAsRegion(); |
| 470 | |
| 471 | // Nonlocs can't be freed, of course. |
| 472 | // Non-region locations (labels and fixed addresses) also shouldn't be freed. |
| 473 | if (!R) { |
| 474 | ReportBadFree(C, ArgVal, ArgExpr->getSourceRange()); |
Anna Zaks | b319e02 | 2012-02-08 20:13:28 +0000 | [diff] [blame] | 475 | return 0; |
Jordy Rose | 43859f6 | 2010-06-07 19:32:37 +0000 | [diff] [blame] | 476 | } |
| 477 | |
| 478 | R = R->StripCasts(); |
| 479 | |
| 480 | // Blocks might show up as heap data, but should not be free()d |
| 481 | if (isa<BlockDataRegion>(R)) { |
| 482 | ReportBadFree(C, ArgVal, ArgExpr->getSourceRange()); |
Anna Zaks | b319e02 | 2012-02-08 20:13:28 +0000 | [diff] [blame] | 483 | return 0; |
Jordy Rose | 43859f6 | 2010-06-07 19:32:37 +0000 | [diff] [blame] | 484 | } |
| 485 | |
| 486 | const MemSpaceRegion *MS = R->getMemorySpace(); |
| 487 | |
| 488 | // Parameters, locals, statics, and globals shouldn't be freed. |
| 489 | if (!(isa<UnknownSpaceRegion>(MS) || isa<HeapSpaceRegion>(MS))) { |
| 490 | // FIXME: at the time this code was written, malloc() regions were |
| 491 | // represented by conjured symbols, which are all in UnknownSpaceRegion. |
| 492 | // This means that there isn't actually anything from HeapSpaceRegion |
| 493 | // that should be freed, even though we allow it here. |
| 494 | // Of course, free() can work on memory allocated outside the current |
| 495 | // function, so UnknownSpaceRegion is always a possibility. |
| 496 | // False negatives are better than false positives. |
| 497 | |
| 498 | ReportBadFree(C, ArgVal, ArgExpr->getSourceRange()); |
Anna Zaks | b319e02 | 2012-02-08 20:13:28 +0000 | [diff] [blame] | 499 | return 0; |
Jordy Rose | 43859f6 | 2010-06-07 19:32:37 +0000 | [diff] [blame] | 500 | } |
| 501 | |
| 502 | const SymbolicRegion *SR = dyn_cast<SymbolicRegion>(R); |
| 503 | // Various cases could lead to non-symbol values here. |
| 504 | // For now, ignore them. |
| 505 | if (!SR) |
Anna Zaks | b319e02 | 2012-02-08 20:13:28 +0000 | [diff] [blame] | 506 | return 0; |
Jordy Rose | 43859f6 | 2010-06-07 19:32:37 +0000 | [diff] [blame] | 507 | |
| 508 | SymbolRef Sym = SR->getSymbol(); |
Zhongxing Xu | 589c0f2 | 2009-11-12 08:38:56 +0000 | [diff] [blame] | 509 | const RefState *RS = state->get<RegionState>(Sym); |
Zhongxing Xu | 7e3cda9 | 2010-01-18 03:27:34 +0000 | [diff] [blame] | 510 | |
| 511 | // If the symbol has not been tracked, return. This is possible when free() is |
| 512 | // called on a pointer that does not get its pointee directly from malloc(). |
| 513 | // Full support of this requires inter-procedural analysis. |
| 514 | if (!RS) |
Anna Zaks | b319e02 | 2012-02-08 20:13:28 +0000 | [diff] [blame] | 515 | return 0; |
Zhongxing Xu | 589c0f2 | 2009-11-12 08:38:56 +0000 | [diff] [blame] | 516 | |
| 517 | // Check double free. |
Zhongxing Xu | 243fde9 | 2009-11-17 07:54:15 +0000 | [diff] [blame] | 518 | if (RS->isReleased()) { |
Ted Kremenek | d048c6e | 2010-12-20 21:19:09 +0000 | [diff] [blame] | 519 | if (ExplodedNode *N = C.generateSink()) { |
Zhongxing Xu | 589c0f2 | 2009-11-12 08:38:56 +0000 | [diff] [blame] | 520 | if (!BT_DoubleFree) |
Argyrios Kyrtzidis | 312dbec | 2011-02-28 01:26:35 +0000 | [diff] [blame] | 521 | BT_DoubleFree.reset( |
| 522 | new BuiltinBug("Double free", |
| 523 | "Try to free a memory block that has been released")); |
Zhongxing Xu | 589c0f2 | 2009-11-12 08:38:56 +0000 | [diff] [blame] | 524 | BugReport *R = new BugReport(*BT_DoubleFree, |
Benjamin Kramer | d02e232 | 2009-11-14 12:08:24 +0000 | [diff] [blame] | 525 | BT_DoubleFree->getDescription(), N); |
Anna Zaks | fe57160 | 2012-02-16 22:26:07 +0000 | [diff] [blame^] | 526 | R->addRange(ArgExpr->getSourceRange()); |
Anna Zaks | ff3b9fd | 2012-02-09 06:25:51 +0000 | [diff] [blame] | 527 | R->addVisitor(new MallocBugVisitor(Sym)); |
Zhongxing Xu | 589c0f2 | 2009-11-12 08:38:56 +0000 | [diff] [blame] | 528 | C.EmitReport(R); |
| 529 | } |
Anna Zaks | b319e02 | 2012-02-08 20:13:28 +0000 | [diff] [blame] | 530 | return 0; |
Zhongxing Xu | 589c0f2 | 2009-11-12 08:38:56 +0000 | [diff] [blame] | 531 | } |
| 532 | |
| 533 | // Normal free. |
Ted Kremenek | dd0e490 | 2010-07-31 01:52:11 +0000 | [diff] [blame] | 534 | if (Hold) |
Anna Zaks | b276bd9 | 2012-02-14 00:26:13 +0000 | [diff] [blame] | 535 | return state->set<RegionState>(Sym, RefState::getRelinquished(CE)); |
| 536 | return state->set<RegionState>(Sym, RefState::getReleased(CE)); |
Zhongxing Xu | d9c84c8 | 2009-12-12 12:29:38 +0000 | [diff] [blame] | 537 | } |
| 538 | |
Ted Kremenek | 9c378f7 | 2011-08-12 23:37:29 +0000 | [diff] [blame] | 539 | bool MallocChecker::SummarizeValue(raw_ostream &os, SVal V) { |
Jordy Rose | 43859f6 | 2010-06-07 19:32:37 +0000 | [diff] [blame] | 540 | if (nonloc::ConcreteInt *IntVal = dyn_cast<nonloc::ConcreteInt>(&V)) |
| 541 | os << "an integer (" << IntVal->getValue() << ")"; |
| 542 | else if (loc::ConcreteInt *ConstAddr = dyn_cast<loc::ConcreteInt>(&V)) |
| 543 | os << "a constant address (" << ConstAddr->getValue() << ")"; |
| 544 | else if (loc::GotoLabel *Label = dyn_cast<loc::GotoLabel>(&V)) |
Chris Lattner | 6810630 | 2011-02-17 05:38:27 +0000 | [diff] [blame] | 545 | os << "the address of the label '" << Label->getLabel()->getName() << "'"; |
Jordy Rose | 43859f6 | 2010-06-07 19:32:37 +0000 | [diff] [blame] | 546 | else |
| 547 | return false; |
| 548 | |
| 549 | return true; |
| 550 | } |
| 551 | |
Ted Kremenek | 9c378f7 | 2011-08-12 23:37:29 +0000 | [diff] [blame] | 552 | bool MallocChecker::SummarizeRegion(raw_ostream &os, |
Jordy Rose | 43859f6 | 2010-06-07 19:32:37 +0000 | [diff] [blame] | 553 | const MemRegion *MR) { |
| 554 | switch (MR->getKind()) { |
| 555 | case MemRegion::FunctionTextRegionKind: { |
| 556 | const FunctionDecl *FD = cast<FunctionTextRegion>(MR)->getDecl(); |
| 557 | if (FD) |
Benjamin Kramer | b8989f2 | 2011-10-14 18:45:37 +0000 | [diff] [blame] | 558 | os << "the address of the function '" << *FD << '\''; |
Jordy Rose | 43859f6 | 2010-06-07 19:32:37 +0000 | [diff] [blame] | 559 | else |
| 560 | os << "the address of a function"; |
| 561 | return true; |
| 562 | } |
| 563 | case MemRegion::BlockTextRegionKind: |
| 564 | os << "block text"; |
| 565 | return true; |
| 566 | case MemRegion::BlockDataRegionKind: |
| 567 | // FIXME: where the block came from? |
| 568 | os << "a block"; |
| 569 | return true; |
| 570 | default: { |
| 571 | const MemSpaceRegion *MS = MR->getMemorySpace(); |
| 572 | |
Anna Zaks | eb31a76 | 2012-01-04 23:54:01 +0000 | [diff] [blame] | 573 | if (isa<StackLocalsSpaceRegion>(MS)) { |
Jordy Rose | 43859f6 | 2010-06-07 19:32:37 +0000 | [diff] [blame] | 574 | const VarRegion *VR = dyn_cast<VarRegion>(MR); |
| 575 | const VarDecl *VD; |
| 576 | if (VR) |
| 577 | VD = VR->getDecl(); |
| 578 | else |
| 579 | VD = NULL; |
| 580 | |
| 581 | if (VD) |
| 582 | os << "the address of the local variable '" << VD->getName() << "'"; |
| 583 | else |
| 584 | os << "the address of a local stack variable"; |
| 585 | return true; |
| 586 | } |
Anna Zaks | eb31a76 | 2012-01-04 23:54:01 +0000 | [diff] [blame] | 587 | |
| 588 | if (isa<StackArgumentsSpaceRegion>(MS)) { |
Jordy Rose | 43859f6 | 2010-06-07 19:32:37 +0000 | [diff] [blame] | 589 | const VarRegion *VR = dyn_cast<VarRegion>(MR); |
| 590 | const VarDecl *VD; |
| 591 | if (VR) |
| 592 | VD = VR->getDecl(); |
| 593 | else |
| 594 | VD = NULL; |
| 595 | |
| 596 | if (VD) |
| 597 | os << "the address of the parameter '" << VD->getName() << "'"; |
| 598 | else |
| 599 | os << "the address of a parameter"; |
| 600 | return true; |
| 601 | } |
Anna Zaks | eb31a76 | 2012-01-04 23:54:01 +0000 | [diff] [blame] | 602 | |
| 603 | if (isa<GlobalsSpaceRegion>(MS)) { |
Jordy Rose | 43859f6 | 2010-06-07 19:32:37 +0000 | [diff] [blame] | 604 | const VarRegion *VR = dyn_cast<VarRegion>(MR); |
| 605 | const VarDecl *VD; |
| 606 | if (VR) |
| 607 | VD = VR->getDecl(); |
| 608 | else |
| 609 | VD = NULL; |
| 610 | |
| 611 | if (VD) { |
| 612 | if (VD->isStaticLocal()) |
| 613 | os << "the address of the static variable '" << VD->getName() << "'"; |
| 614 | else |
| 615 | os << "the address of the global variable '" << VD->getName() << "'"; |
| 616 | } else |
| 617 | os << "the address of a global variable"; |
| 618 | return true; |
| 619 | } |
Anna Zaks | eb31a76 | 2012-01-04 23:54:01 +0000 | [diff] [blame] | 620 | |
| 621 | return false; |
Jordy Rose | 43859f6 | 2010-06-07 19:32:37 +0000 | [diff] [blame] | 622 | } |
| 623 | } |
| 624 | } |
| 625 | |
| 626 | void MallocChecker::ReportBadFree(CheckerContext &C, SVal ArgVal, |
Argyrios Kyrtzidis | 312dbec | 2011-02-28 01:26:35 +0000 | [diff] [blame] | 627 | SourceRange range) const { |
Ted Kremenek | d048c6e | 2010-12-20 21:19:09 +0000 | [diff] [blame] | 628 | if (ExplodedNode *N = C.generateSink()) { |
Jordy Rose | 43859f6 | 2010-06-07 19:32:37 +0000 | [diff] [blame] | 629 | if (!BT_BadFree) |
Argyrios Kyrtzidis | 312dbec | 2011-02-28 01:26:35 +0000 | [diff] [blame] | 630 | BT_BadFree.reset(new BuiltinBug("Bad free")); |
Jordy Rose | 43859f6 | 2010-06-07 19:32:37 +0000 | [diff] [blame] | 631 | |
Dylan Noblesmith | f7ccbad | 2012-02-05 02:13:05 +0000 | [diff] [blame] | 632 | SmallString<100> buf; |
Jordy Rose | 43859f6 | 2010-06-07 19:32:37 +0000 | [diff] [blame] | 633 | llvm::raw_svector_ostream os(buf); |
| 634 | |
| 635 | const MemRegion *MR = ArgVal.getAsRegion(); |
| 636 | if (MR) { |
| 637 | while (const ElementRegion *ER = dyn_cast<ElementRegion>(MR)) |
| 638 | MR = ER->getSuperRegion(); |
| 639 | |
| 640 | // Special case for alloca() |
| 641 | if (isa<AllocaRegion>(MR)) |
| 642 | os << "Argument to free() was allocated by alloca(), not malloc()"; |
| 643 | else { |
| 644 | os << "Argument to free() is "; |
| 645 | if (SummarizeRegion(os, MR)) |
| 646 | os << ", which is not memory allocated by malloc()"; |
| 647 | else |
| 648 | os << "not memory allocated by malloc()"; |
| 649 | } |
| 650 | } else { |
| 651 | os << "Argument to free() is "; |
| 652 | if (SummarizeValue(os, ArgVal)) |
| 653 | os << ", which is not memory allocated by malloc()"; |
| 654 | else |
| 655 | os << "not memory allocated by malloc()"; |
| 656 | } |
| 657 | |
Anna Zaks | e172e8b | 2011-08-17 23:00:25 +0000 | [diff] [blame] | 658 | BugReport *R = new BugReport(*BT_BadFree, os.str(), N); |
Jordy Rose | 43859f6 | 2010-06-07 19:32:37 +0000 | [diff] [blame] | 659 | R->addRange(range); |
| 660 | C.EmitReport(R); |
| 661 | } |
| 662 | } |
| 663 | |
Anna Zaks | 40add29 | 2012-02-15 00:11:25 +0000 | [diff] [blame] | 664 | void MallocChecker::ReallocMem(CheckerContext &C, const CallExpr *CE, |
| 665 | bool FreesOnFail) const { |
Ted Kremenek | 8bef823 | 2012-01-26 21:29:00 +0000 | [diff] [blame] | 666 | ProgramStateRef state = C.getState(); |
Ted Kremenek | c8413fd | 2010-12-02 07:49:45 +0000 | [diff] [blame] | 667 | const Expr *arg0Expr = CE->getArg(0); |
Ted Kremenek | 5eca482 | 2012-01-06 22:09:28 +0000 | [diff] [blame] | 668 | const LocationContext *LCtx = C.getLocationContext(); |
Anna Zaks | e9ef562 | 2012-02-10 01:11:00 +0000 | [diff] [blame] | 669 | SVal Arg0Val = state->getSVal(arg0Expr, LCtx); |
| 670 | if (!isa<DefinedOrUnknownSVal>(Arg0Val)) |
| 671 | return; |
| 672 | DefinedOrUnknownSVal arg0Val = cast<DefinedOrUnknownSVal>(Arg0Val); |
Zhongxing Xu | d9c84c8 | 2009-12-12 12:29:38 +0000 | [diff] [blame] | 673 | |
Ted Kremenek | 846eabd | 2010-12-01 21:28:31 +0000 | [diff] [blame] | 674 | SValBuilder &svalBuilder = C.getSValBuilder(); |
Zhongxing Xu | d9c84c8 | 2009-12-12 12:29:38 +0000 | [diff] [blame] | 675 | |
Ted Kremenek | c8413fd | 2010-12-02 07:49:45 +0000 | [diff] [blame] | 676 | DefinedOrUnknownSVal PtrEQ = |
| 677 | svalBuilder.evalEQ(state, arg0Val, svalBuilder.makeNull()); |
Zhongxing Xu | d9c84c8 | 2009-12-12 12:29:38 +0000 | [diff] [blame] | 678 | |
Lenny Maiorani | 4d8d803 | 2011-04-27 14:49:29 +0000 | [diff] [blame] | 679 | // Get the size argument. If there is no size arg then give up. |
| 680 | const Expr *Arg1 = CE->getArg(1); |
| 681 | if (!Arg1) |
| 682 | return; |
| 683 | |
| 684 | // Get the value of the size argument. |
Anna Zaks | e9ef562 | 2012-02-10 01:11:00 +0000 | [diff] [blame] | 685 | SVal Arg1ValG = state->getSVal(Arg1, LCtx); |
| 686 | if (!isa<DefinedOrUnknownSVal>(Arg1ValG)) |
| 687 | return; |
| 688 | DefinedOrUnknownSVal Arg1Val = cast<DefinedOrUnknownSVal>(Arg1ValG); |
Lenny Maiorani | 4d8d803 | 2011-04-27 14:49:29 +0000 | [diff] [blame] | 689 | |
| 690 | // Compare the size argument to 0. |
| 691 | DefinedOrUnknownSVal SizeZero = |
| 692 | svalBuilder.evalEQ(state, Arg1Val, |
| 693 | svalBuilder.makeIntValWithPtrWidth(0, false)); |
| 694 | |
Anna Zaks | c8bb3be | 2012-02-13 18:05:39 +0000 | [diff] [blame] | 695 | ProgramStateRef StatePtrIsNull, StatePtrNotNull; |
| 696 | llvm::tie(StatePtrIsNull, StatePtrNotNull) = state->assume(PtrEQ); |
| 697 | ProgramStateRef StateSizeIsZero, StateSizeNotZero; |
| 698 | llvm::tie(StateSizeIsZero, StateSizeNotZero) = state->assume(SizeZero); |
| 699 | // We only assume exceptional states if they are definitely true; if the |
| 700 | // state is under-constrained, assume regular realloc behavior. |
| 701 | bool PrtIsNull = StatePtrIsNull && !StatePtrNotNull; |
| 702 | bool SizeIsZero = StateSizeIsZero && !StateSizeNotZero; |
| 703 | |
Lenny Maiorani | 4d8d803 | 2011-04-27 14:49:29 +0000 | [diff] [blame] | 704 | // If the ptr is NULL and the size is not 0, the call is equivalent to |
| 705 | // malloc(size). |
Anna Zaks | c8bb3be | 2012-02-13 18:05:39 +0000 | [diff] [blame] | 706 | if ( PrtIsNull && !SizeIsZero) { |
Ted Kremenek | 8bef823 | 2012-01-26 21:29:00 +0000 | [diff] [blame] | 707 | ProgramStateRef stateMalloc = MallocMemAux(C, CE, CE->getArg(1), |
Anna Zaks | c8bb3be | 2012-02-13 18:05:39 +0000 | [diff] [blame] | 708 | UndefinedVal(), StatePtrIsNull); |
Anna Zaks | 0bd6b11 | 2011-10-26 21:06:34 +0000 | [diff] [blame] | 709 | C.addTransition(stateMalloc); |
Anna Zaks | c8bb3be | 2012-02-13 18:05:39 +0000 | [diff] [blame] | 710 | return; |
Zhongxing Xu | d9c84c8 | 2009-12-12 12:29:38 +0000 | [diff] [blame] | 711 | } |
| 712 | |
Anna Zaks | c8bb3be | 2012-02-13 18:05:39 +0000 | [diff] [blame] | 713 | if (PrtIsNull && SizeIsZero) |
| 714 | return; |
Zhongxing Xu | d9c84c8 | 2009-12-12 12:29:38 +0000 | [diff] [blame] | 715 | |
Anna Zaks | 30838b9 | 2012-02-13 20:57:07 +0000 | [diff] [blame] | 716 | // Get the from and to pointer symbols as in toPtr = realloc(fromPtr, size). |
Anna Zaks | c8bb3be | 2012-02-13 18:05:39 +0000 | [diff] [blame] | 717 | assert(!PrtIsNull); |
Anna Zaks | 30838b9 | 2012-02-13 20:57:07 +0000 | [diff] [blame] | 718 | SymbolRef FromPtr = arg0Val.getAsSymbol(); |
| 719 | SVal RetVal = state->getSVal(CE, LCtx); |
| 720 | SymbolRef ToPtr = RetVal.getAsSymbol(); |
| 721 | if (!FromPtr || !ToPtr) |
| 722 | return; |
Anna Zaks | c8bb3be | 2012-02-13 18:05:39 +0000 | [diff] [blame] | 723 | |
| 724 | // If the size is 0, free the memory. |
| 725 | if (SizeIsZero) |
| 726 | if (ProgramStateRef stateFree = FreeMemAux(C, CE, StateSizeIsZero,0,false)){ |
Anna Zaks | c8bb3be | 2012-02-13 18:05:39 +0000 | [diff] [blame] | 727 | // The semantics of the return value are: |
| 728 | // If size was equal to 0, either NULL or a pointer suitable to be passed |
| 729 | // to free() is returned. |
Anna Zaks | 40add29 | 2012-02-15 00:11:25 +0000 | [diff] [blame] | 730 | stateFree = stateFree->set<ReallocPairs>(ToPtr, |
| 731 | ReallocPair(FromPtr, FreesOnFail)); |
Anna Zaks | b276bd9 | 2012-02-14 00:26:13 +0000 | [diff] [blame] | 732 | C.getSymbolManager().addSymbolDependency(ToPtr, FromPtr); |
Anna Zaks | 30838b9 | 2012-02-13 20:57:07 +0000 | [diff] [blame] | 733 | C.addTransition(stateFree); |
Anna Zaks | c8bb3be | 2012-02-13 18:05:39 +0000 | [diff] [blame] | 734 | return; |
| 735 | } |
| 736 | |
| 737 | // Default behavior. |
| 738 | if (ProgramStateRef stateFree = FreeMemAux(C, CE, state, 0, false)) { |
| 739 | // FIXME: We should copy the content of the original buffer. |
| 740 | ProgramStateRef stateRealloc = MallocMemAux(C, CE, CE->getArg(1), |
| 741 | UnknownVal(), stateFree); |
Anna Zaks | 30838b9 | 2012-02-13 20:57:07 +0000 | [diff] [blame] | 742 | if (!stateRealloc) |
Anna Zaks | c8bb3be | 2012-02-13 18:05:39 +0000 | [diff] [blame] | 743 | return; |
Anna Zaks | 40add29 | 2012-02-15 00:11:25 +0000 | [diff] [blame] | 744 | stateRealloc = stateRealloc->set<ReallocPairs>(ToPtr, |
| 745 | ReallocPair(FromPtr, FreesOnFail)); |
Anna Zaks | b276bd9 | 2012-02-14 00:26:13 +0000 | [diff] [blame] | 746 | C.getSymbolManager().addSymbolDependency(ToPtr, FromPtr); |
Anna Zaks | c8bb3be | 2012-02-13 18:05:39 +0000 | [diff] [blame] | 747 | C.addTransition(stateRealloc); |
| 748 | return; |
Zhongxing Xu | d9c84c8 | 2009-12-12 12:29:38 +0000 | [diff] [blame] | 749 | } |
Zhongxing Xu | 589c0f2 | 2009-11-12 08:38:56 +0000 | [diff] [blame] | 750 | } |
Zhongxing Xu | 7b76096 | 2009-11-13 07:25:27 +0000 | [diff] [blame] | 751 | |
Zhongxing Xu | a5ce966 | 2010-06-01 03:01:33 +0000 | [diff] [blame] | 752 | void MallocChecker::CallocMem(CheckerContext &C, const CallExpr *CE) { |
Ted Kremenek | 8bef823 | 2012-01-26 21:29:00 +0000 | [diff] [blame] | 753 | ProgramStateRef state = C.getState(); |
Ted Kremenek | 846eabd | 2010-12-01 21:28:31 +0000 | [diff] [blame] | 754 | SValBuilder &svalBuilder = C.getSValBuilder(); |
Ted Kremenek | 5eca482 | 2012-01-06 22:09:28 +0000 | [diff] [blame] | 755 | const LocationContext *LCtx = C.getLocationContext(); |
| 756 | SVal count = state->getSVal(CE->getArg(0), LCtx); |
| 757 | SVal elementSize = state->getSVal(CE->getArg(1), LCtx); |
Ted Kremenek | c8413fd | 2010-12-02 07:49:45 +0000 | [diff] [blame] | 758 | SVal TotalSize = svalBuilder.evalBinOp(state, BO_Mul, count, elementSize, |
| 759 | svalBuilder.getContext().getSizeType()); |
| 760 | SVal zeroVal = svalBuilder.makeZeroVal(svalBuilder.getContext().CharTy); |
Zhongxing Xu | a5ce966 | 2010-06-01 03:01:33 +0000 | [diff] [blame] | 761 | |
Anna Zaks | 0bd6b11 | 2011-10-26 21:06:34 +0000 | [diff] [blame] | 762 | C.addTransition(MallocMemAux(C, CE, TotalSize, zeroVal, state)); |
Zhongxing Xu | a5ce966 | 2010-06-01 03:01:33 +0000 | [diff] [blame] | 763 | } |
| 764 | |
Anna Zaks | da04677 | 2012-02-11 21:02:40 +0000 | [diff] [blame] | 765 | void MallocChecker::reportLeak(SymbolRef Sym, ExplodedNode *N, |
| 766 | CheckerContext &C) const { |
| 767 | assert(N); |
| 768 | if (!BT_Leak) { |
| 769 | BT_Leak.reset(new BuiltinBug("Memory leak", |
| 770 | "Allocated memory never released. Potential memory leak.")); |
| 771 | // Leaks should not be reported if they are post-dominated by a sink: |
| 772 | // (1) Sinks are higher importance bugs. |
| 773 | // (2) NoReturnFunctionChecker uses sink nodes to represent paths ending |
| 774 | // with __noreturn functions such as assert() or exit(). We choose not |
| 775 | // to report leaks on such paths. |
| 776 | BT_Leak->setSuppressOnSink(true); |
| 777 | } |
| 778 | |
| 779 | BugReport *R = new BugReport(*BT_Leak, BT_Leak->getDescription(), N); |
| 780 | R->addVisitor(new MallocBugVisitor(Sym)); |
| 781 | C.EmitReport(R); |
| 782 | } |
| 783 | |
Argyrios Kyrtzidis | 312dbec | 2011-02-28 01:26:35 +0000 | [diff] [blame] | 784 | void MallocChecker::checkDeadSymbols(SymbolReaper &SymReaper, |
| 785 | CheckerContext &C) const |
Ted Kremenek | c8413fd | 2010-12-02 07:49:45 +0000 | [diff] [blame] | 786 | { |
Zhongxing Xu | 173ff56 | 2010-08-15 08:19:57 +0000 | [diff] [blame] | 787 | if (!SymReaper.hasDeadSymbols()) |
| 788 | return; |
Zhongxing Xu | fc7ac8f | 2009-11-13 07:48:11 +0000 | [diff] [blame] | 789 | |
Ted Kremenek | 8bef823 | 2012-01-26 21:29:00 +0000 | [diff] [blame] | 790 | ProgramStateRef state = C.getState(); |
Zhongxing Xu | 173ff56 | 2010-08-15 08:19:57 +0000 | [diff] [blame] | 791 | RegionStateTy RS = state->get<RegionState>(); |
Jordy Rose | 9076014 | 2010-08-18 04:33:47 +0000 | [diff] [blame] | 792 | RegionStateTy::Factory &F = state->get_context<RegionState>(); |
Zhongxing Xu | 173ff56 | 2010-08-15 08:19:57 +0000 | [diff] [blame] | 793 | |
Ted Kremenek | 217470e | 2011-07-28 23:07:51 +0000 | [diff] [blame] | 794 | bool generateReport = false; |
Anna Zaks | f8c17b7 | 2012-02-09 06:48:19 +0000 | [diff] [blame] | 795 | llvm::SmallVector<SymbolRef, 2> Errors; |
Zhongxing Xu | 173ff56 | 2010-08-15 08:19:57 +0000 | [diff] [blame] | 796 | for (RegionStateTy::iterator I = RS.begin(), E = RS.end(); I != E; ++I) { |
| 797 | if (SymReaper.isDead(I->first)) { |
Anna Zaks | f8c17b7 | 2012-02-09 06:48:19 +0000 | [diff] [blame] | 798 | if (I->second.isAllocated()) { |
Ted Kremenek | 217470e | 2011-07-28 23:07:51 +0000 | [diff] [blame] | 799 | generateReport = true; |
Anna Zaks | f8c17b7 | 2012-02-09 06:48:19 +0000 | [diff] [blame] | 800 | Errors.push_back(I->first); |
| 801 | } |
Jordy Rose | 9076014 | 2010-08-18 04:33:47 +0000 | [diff] [blame] | 802 | // Remove the dead symbol from the map. |
Ted Kremenek | 3baf672 | 2010-11-24 00:54:37 +0000 | [diff] [blame] | 803 | RS = F.remove(RS, I->first); |
Ted Kremenek | 217470e | 2011-07-28 23:07:51 +0000 | [diff] [blame] | 804 | |
Zhongxing Xu | fc7ac8f | 2009-11-13 07:48:11 +0000 | [diff] [blame] | 805 | } |
| 806 | } |
Ted Kremenek | 217470e | 2011-07-28 23:07:51 +0000 | [diff] [blame] | 807 | |
Anna Zaks | c8bb3be | 2012-02-13 18:05:39 +0000 | [diff] [blame] | 808 | // Cleanup the Realloc Pairs Map. |
Anna Zaks | 40add29 | 2012-02-15 00:11:25 +0000 | [diff] [blame] | 809 | ReallocMap RP = state->get<ReallocPairs>(); |
| 810 | for (ReallocMap::iterator I = RP.begin(), E = RP.end(); I != E; ++I) { |
| 811 | if (SymReaper.isDead(I->first) || |
| 812 | SymReaper.isDead(I->second.ReallocatedSym)) { |
Anna Zaks | c8bb3be | 2012-02-13 18:05:39 +0000 | [diff] [blame] | 813 | state = state->remove<ReallocPairs>(I->first); |
| 814 | } |
| 815 | } |
| 816 | |
Anna Zaks | 0bd6b11 | 2011-10-26 21:06:34 +0000 | [diff] [blame] | 817 | ExplodedNode *N = C.addTransition(state->set<RegionState>(RS)); |
Ted Kremenek | 217470e | 2011-07-28 23:07:51 +0000 | [diff] [blame] | 818 | |
Ted Kremenek | 217470e | 2011-07-28 23:07:51 +0000 | [diff] [blame] | 819 | if (N && generateReport) { |
Anna Zaks | f8c17b7 | 2012-02-09 06:48:19 +0000 | [diff] [blame] | 820 | for (llvm::SmallVector<SymbolRef, 2>::iterator |
Anna Zaks | da04677 | 2012-02-11 21:02:40 +0000 | [diff] [blame] | 821 | I = Errors.begin(), E = Errors.end(); I != E; ++I) { |
| 822 | reportLeak(*I, N, C); |
Anna Zaks | f8c17b7 | 2012-02-09 06:48:19 +0000 | [diff] [blame] | 823 | } |
Ted Kremenek | 217470e | 2011-07-28 23:07:51 +0000 | [diff] [blame] | 824 | } |
Zhongxing Xu | 7b76096 | 2009-11-13 07:25:27 +0000 | [diff] [blame] | 825 | } |
Zhongxing Xu | 243fde9 | 2009-11-17 07:54:15 +0000 | [diff] [blame] | 826 | |
Anna Zaks | da04677 | 2012-02-11 21:02:40 +0000 | [diff] [blame] | 827 | void MallocChecker::checkEndPath(CheckerContext &C) const { |
| 828 | ProgramStateRef state = C.getState(); |
Jordy Rose | 09cef09 | 2010-08-18 04:26:59 +0000 | [diff] [blame] | 829 | RegionStateTy M = state->get<RegionState>(); |
Zhongxing Xu | 243fde9 | 2009-11-17 07:54:15 +0000 | [diff] [blame] | 830 | |
Jordy Rose | 09cef09 | 2010-08-18 04:26:59 +0000 | [diff] [blame] | 831 | for (RegionStateTy::iterator I = M.begin(), E = M.end(); I != E; ++I) { |
Zhongxing Xu | 243fde9 | 2009-11-17 07:54:15 +0000 | [diff] [blame] | 832 | RefState RS = I->second; |
| 833 | if (RS.isAllocated()) { |
Anna Zaks | da04677 | 2012-02-11 21:02:40 +0000 | [diff] [blame] | 834 | ExplodedNode *N = C.addTransition(state); |
| 835 | if (N) |
| 836 | reportLeak(I->first, N, C); |
Zhongxing Xu | 243fde9 | 2009-11-17 07:54:15 +0000 | [diff] [blame] | 837 | } |
| 838 | } |
| 839 | } |
Zhongxing Xu | 4985e3e | 2009-11-17 08:58:18 +0000 | [diff] [blame] | 840 | |
Anna Zaks | 91c2a11 | 2012-02-08 23:16:56 +0000 | [diff] [blame] | 841 | bool MallocChecker::checkEscape(SymbolRef Sym, const Stmt *S, |
| 842 | CheckerContext &C) const { |
Ted Kremenek | 8bef823 | 2012-01-26 21:29:00 +0000 | [diff] [blame] | 843 | ProgramStateRef state = C.getState(); |
Anna Zaks | 91c2a11 | 2012-02-08 23:16:56 +0000 | [diff] [blame] | 844 | const RefState *RS = state->get<RegionState>(Sym); |
| 845 | if (!RS) |
| 846 | return false; |
Zhongxing Xu | 4985e3e | 2009-11-17 08:58:18 +0000 | [diff] [blame] | 847 | |
Anna Zaks | 91c2a11 | 2012-02-08 23:16:56 +0000 | [diff] [blame] | 848 | if (RS->isAllocated()) { |
| 849 | state = state->set<RegionState>(Sym, RefState::getEscaped(S)); |
| 850 | C.addTransition(state); |
| 851 | return true; |
| 852 | } |
| 853 | return false; |
| 854 | } |
| 855 | |
Anna Zaks | 66c4040 | 2012-02-14 21:55:24 +0000 | [diff] [blame] | 856 | void MallocChecker::checkPreStmt(const CallExpr *CE, CheckerContext &C) const { |
| 857 | if (isMemFunction(C.getCalleeDecl(CE), C.getASTContext())) |
| 858 | return; |
| 859 | |
| 860 | // Check use after free, when a freed pointer is passed to a call. |
| 861 | ProgramStateRef State = C.getState(); |
| 862 | for (CallExpr::const_arg_iterator I = CE->arg_begin(), |
| 863 | E = CE->arg_end(); I != E; ++I) { |
| 864 | const Expr *A = *I; |
| 865 | if (A->getType().getTypePtr()->isAnyPointerType()) { |
| 866 | SymbolRef Sym = State->getSVal(A, C.getLocationContext()).getAsSymbol(); |
| 867 | if (!Sym) |
| 868 | continue; |
| 869 | if (checkUseAfterFree(Sym, C, A)) |
| 870 | return; |
| 871 | } |
| 872 | } |
| 873 | } |
| 874 | |
Anna Zaks | 91c2a11 | 2012-02-08 23:16:56 +0000 | [diff] [blame] | 875 | void MallocChecker::checkPreStmt(const ReturnStmt *S, CheckerContext &C) const { |
| 876 | const Expr *E = S->getRetValue(); |
| 877 | if (!E) |
| 878 | return; |
Anna Zaks | 0860cd0 | 2012-02-11 21:44:39 +0000 | [diff] [blame] | 879 | |
| 880 | // Check if we are returning a symbol. |
Anna Zaks | 91c2a11 | 2012-02-08 23:16:56 +0000 | [diff] [blame] | 881 | SymbolRef Sym = C.getState()->getSVal(E, C.getLocationContext()).getAsSymbol(); |
Zhongxing Xu | 4985e3e | 2009-11-17 08:58:18 +0000 | [diff] [blame] | 882 | if (!Sym) |
| 883 | return; |
| 884 | |
Anna Zaks | 0860cd0 | 2012-02-11 21:44:39 +0000 | [diff] [blame] | 885 | // Check if we are returning freed memory. |
Anna Zaks | fe57160 | 2012-02-16 22:26:07 +0000 | [diff] [blame^] | 886 | if (checkUseAfterFree(Sym, C, E)) |
Anna Zaks | 15d0ae1 | 2012-02-11 23:46:36 +0000 | [diff] [blame] | 887 | return; |
Anna Zaks | 0860cd0 | 2012-02-11 21:44:39 +0000 | [diff] [blame] | 888 | |
| 889 | // Check if the symbol is escaping. |
Anna Zaks | fe57160 | 2012-02-16 22:26:07 +0000 | [diff] [blame^] | 890 | checkEscape(Sym, E, C); |
Zhongxing Xu | 4985e3e | 2009-11-17 08:58:18 +0000 | [diff] [blame] | 891 | } |
Zhongxing Xu | b94b81a | 2009-12-31 06:13:07 +0000 | [diff] [blame] | 892 | |
Anna Zaks | 91c2a11 | 2012-02-08 23:16:56 +0000 | [diff] [blame] | 893 | bool MallocChecker::checkUseAfterFree(SymbolRef Sym, CheckerContext &C, |
| 894 | const Stmt *S) const { |
| 895 | assert(Sym); |
| 896 | const RefState *RS = C.getState()->get<RegionState>(Sym); |
| 897 | if (RS && RS->isReleased()) { |
Anna Zaks | 15d0ae1 | 2012-02-11 23:46:36 +0000 | [diff] [blame] | 898 | if (ExplodedNode *N = C.generateSink()) { |
Anna Zaks | 91c2a11 | 2012-02-08 23:16:56 +0000 | [diff] [blame] | 899 | if (!BT_UseFree) |
Anna Zaks | e9ef562 | 2012-02-10 01:11:00 +0000 | [diff] [blame] | 900 | BT_UseFree.reset(new BuiltinBug("Use of dynamically allocated memory " |
Anna Zaks | 91c2a11 | 2012-02-08 23:16:56 +0000 | [diff] [blame] | 901 | "after it is freed.")); |
| 902 | |
| 903 | BugReport *R = new BugReport(*BT_UseFree, BT_UseFree->getDescription(),N); |
| 904 | if (S) |
| 905 | R->addRange(S->getSourceRange()); |
Anna Zaks | ff3b9fd | 2012-02-09 06:25:51 +0000 | [diff] [blame] | 906 | R->addVisitor(new MallocBugVisitor(Sym)); |
Anna Zaks | 91c2a11 | 2012-02-08 23:16:56 +0000 | [diff] [blame] | 907 | C.EmitReport(R); |
| 908 | return true; |
| 909 | } |
| 910 | } |
| 911 | return false; |
| 912 | } |
| 913 | |
Zhongxing Xu | c802378 | 2010-03-10 04:58:55 +0000 | [diff] [blame] | 914 | // Check if the location is a freed symbolic region. |
Anna Zaks | 390909c | 2011-10-06 00:43:15 +0000 | [diff] [blame] | 915 | void MallocChecker::checkLocation(SVal l, bool isLoad, const Stmt *S, |
| 916 | CheckerContext &C) const { |
Zhongxing Xu | c802378 | 2010-03-10 04:58:55 +0000 | [diff] [blame] | 917 | SymbolRef Sym = l.getLocSymbolInBase(); |
Anna Zaks | 91c2a11 | 2012-02-08 23:16:56 +0000 | [diff] [blame] | 918 | if (Sym) |
| 919 | checkUseAfterFree(Sym, C); |
Zhongxing Xu | c802378 | 2010-03-10 04:58:55 +0000 | [diff] [blame] | 920 | } |
Ted Kremenek | dd0e490 | 2010-07-31 01:52:11 +0000 | [diff] [blame] | 921 | |
Anna Zaks | 4fb5487 | 2012-02-11 21:02:35 +0000 | [diff] [blame] | 922 | //===----------------------------------------------------------------------===// |
| 923 | // Check various ways a symbol can be invalidated. |
| 924 | // TODO: This logic (the next 3 functions) is copied/similar to the |
| 925 | // RetainRelease checker. We might want to factor this out. |
| 926 | //===----------------------------------------------------------------------===// |
Ted Kremenek | dd0e490 | 2010-07-31 01:52:11 +0000 | [diff] [blame] | 927 | |
Anna Zaks | 4fb5487 | 2012-02-11 21:02:35 +0000 | [diff] [blame] | 928 | // Stop tracking symbols when a value escapes as a result of checkBind. |
| 929 | // A value escapes in three possible cases: |
| 930 | // (1) we are binding to something that is not a memory region. |
| 931 | // (2) we are binding to a memregion that does not have stack storage |
| 932 | // (3) we are binding to a memregion with stack storage that the store |
| 933 | // does not understand. |
| 934 | void MallocChecker::checkBind(SVal loc, SVal val, const Stmt *S, |
| 935 | CheckerContext &C) const { |
| 936 | // Are we storing to something that causes the value to "escape"? |
| 937 | bool escapes = true; |
Ted Kremenek | 8bef823 | 2012-01-26 21:29:00 +0000 | [diff] [blame] | 938 | ProgramStateRef state = C.getState(); |
Ted Kremenek | dd0e490 | 2010-07-31 01:52:11 +0000 | [diff] [blame] | 939 | |
Anna Zaks | 4fb5487 | 2012-02-11 21:02:35 +0000 | [diff] [blame] | 940 | if (loc::MemRegionVal *regionLoc = dyn_cast<loc::MemRegionVal>(&loc)) { |
| 941 | escapes = !regionLoc->getRegion()->hasStackStorage(); |
Ted Kremenek | dd0e490 | 2010-07-31 01:52:11 +0000 | [diff] [blame] | 942 | |
Anna Zaks | 4fb5487 | 2012-02-11 21:02:35 +0000 | [diff] [blame] | 943 | if (!escapes) { |
| 944 | // To test (3), generate a new state with the binding added. If it is |
| 945 | // the same state, then it escapes (since the store cannot represent |
| 946 | // the binding). |
| 947 | escapes = (state == (state->bindLoc(*regionLoc, val))); |
Ted Kremenek | dd0e490 | 2010-07-31 01:52:11 +0000 | [diff] [blame] | 948 | } |
Anna Zaks | ac59300 | 2012-02-16 03:40:57 +0000 | [diff] [blame] | 949 | if (!escapes) { |
| 950 | // Case 4: We do not currently model what happens when a symbol is |
| 951 | // assigned to a struct field, so be conservative here and let the symbol |
| 952 | // go. TODO: This could definitely be improved upon. |
| 953 | escapes = !isa<VarRegion>(regionLoc->getRegion()); |
| 954 | } |
Ted Kremenek | dd0e490 | 2010-07-31 01:52:11 +0000 | [diff] [blame] | 955 | } |
Anna Zaks | 4fb5487 | 2012-02-11 21:02:35 +0000 | [diff] [blame] | 956 | |
| 957 | // If our store can represent the binding and we aren't storing to something |
| 958 | // that doesn't have local storage then just return and have the simulation |
| 959 | // state continue as is. |
| 960 | if (!escapes) |
| 961 | return; |
| 962 | |
| 963 | // Otherwise, find all symbols referenced by 'val' that we are tracking |
| 964 | // and stop tracking them. |
| 965 | state = state->scanReachableSymbols<StopTrackingCallback>(val).getState(); |
| 966 | C.addTransition(state); |
| 967 | } |
| 968 | |
| 969 | // If a symbolic region is assumed to NULL (or another constant), stop tracking |
| 970 | // it - assuming that allocation failed on this path. |
| 971 | ProgramStateRef MallocChecker::evalAssume(ProgramStateRef state, |
| 972 | SVal Cond, |
| 973 | bool Assumption) const { |
| 974 | RegionStateTy RS = state->get<RegionState>(); |
Anna Zaks | 4fb5487 | 2012-02-11 21:02:35 +0000 | [diff] [blame] | 975 | for (RegionStateTy::iterator I = RS.begin(), E = RS.end(); I != E; ++I) { |
| 976 | // If the symbol is assumed to NULL or another constant, this will |
| 977 | // return an APSInt*. |
| 978 | if (state->getSymVal(I.getKey())) |
| 979 | state = state->remove<RegionState>(I.getKey()); |
| 980 | } |
| 981 | |
Anna Zaks | c8bb3be | 2012-02-13 18:05:39 +0000 | [diff] [blame] | 982 | // Realloc returns 0 when reallocation fails, which means that we should |
| 983 | // restore the state of the pointer being reallocated. |
Anna Zaks | 40add29 | 2012-02-15 00:11:25 +0000 | [diff] [blame] | 984 | ReallocMap RP = state->get<ReallocPairs>(); |
| 985 | for (ReallocMap::iterator I = RP.begin(), E = RP.end(); I != E; ++I) { |
Anna Zaks | c8bb3be | 2012-02-13 18:05:39 +0000 | [diff] [blame] | 986 | // If the symbol is assumed to NULL or another constant, this will |
| 987 | // return an APSInt*. |
| 988 | if (state->getSymVal(I.getKey())) { |
Anna Zaks | 40add29 | 2012-02-15 00:11:25 +0000 | [diff] [blame] | 989 | SymbolRef ReallocSym = I.getData().ReallocatedSym; |
| 990 | const RefState *RS = state->get<RegionState>(ReallocSym); |
Anna Zaks | c8bb3be | 2012-02-13 18:05:39 +0000 | [diff] [blame] | 991 | if (RS) { |
Anna Zaks | 40add29 | 2012-02-15 00:11:25 +0000 | [diff] [blame] | 992 | if (RS->isReleased() && ! I.getData().IsFreeOnFailure) |
| 993 | state = state->set<RegionState>(ReallocSym, |
Anna Zaks | c8bb3be | 2012-02-13 18:05:39 +0000 | [diff] [blame] | 994 | RefState::getAllocateUnchecked(RS->getStmt())); |
Anna Zaks | c8bb3be | 2012-02-13 18:05:39 +0000 | [diff] [blame] | 995 | } |
| 996 | state = state->remove<ReallocPairs>(I.getKey()); |
| 997 | } |
| 998 | } |
| 999 | |
Anna Zaks | 4fb5487 | 2012-02-11 21:02:35 +0000 | [diff] [blame] | 1000 | return state; |
| 1001 | } |
| 1002 | |
Anna Zaks | 66c4040 | 2012-02-14 21:55:24 +0000 | [diff] [blame] | 1003 | // Check if the function is not known to us. So, for example, we could |
| 1004 | // conservatively assume it can free/reallocate it's pointer arguments. |
| 1005 | // (We assume that the pointers cannot escape through calls to system |
| 1006 | // functions not handled by this checker.) |
| 1007 | bool MallocChecker::hasUnknownBehavior(const FunctionDecl *FD, |
| 1008 | ProgramStateRef State) const { |
| 1009 | ASTContext &ASTC = State->getStateManager().getContext(); |
| 1010 | |
| 1011 | // If it's one of the allocation functions we can reason about, we model it's |
| 1012 | // behavior explicitly. |
| 1013 | if (isMemFunction(FD, ASTC)) { |
| 1014 | return false; |
| 1015 | } |
| 1016 | |
| 1017 | // If it's a system call, we know it does not free the memory. |
| 1018 | SourceManager &SM = ASTC.getSourceManager(); |
| 1019 | if (SM.isInSystemHeader(FD->getLocation())) { |
| 1020 | return false; |
| 1021 | } |
| 1022 | |
| 1023 | // Otherwise, assume that the function can free memory. |
| 1024 | return true; |
| 1025 | } |
| 1026 | |
Anna Zaks | 4fb5487 | 2012-02-11 21:02:35 +0000 | [diff] [blame] | 1027 | // If the symbol we are tracking is invalidated, but not explicitly (ex: the &p |
| 1028 | // escapes, when we are tracking p), do not track the symbol as we cannot reason |
| 1029 | // about it anymore. |
| 1030 | ProgramStateRef |
Anna Zaks | 66c4040 | 2012-02-14 21:55:24 +0000 | [diff] [blame] | 1031 | MallocChecker::checkRegionChanges(ProgramStateRef State, |
Anna Zaks | 4fb5487 | 2012-02-11 21:02:35 +0000 | [diff] [blame] | 1032 | const StoreManager::InvalidatedSymbols *invalidated, |
| 1033 | ArrayRef<const MemRegion *> ExplicitRegions, |
Anna Zaks | 66c4040 | 2012-02-14 21:55:24 +0000 | [diff] [blame] | 1034 | ArrayRef<const MemRegion *> Regions, |
| 1035 | const CallOrObjCMessage *Call) const { |
Anna Zaks | 4fb5487 | 2012-02-11 21:02:35 +0000 | [diff] [blame] | 1036 | if (!invalidated) |
Anna Zaks | 66c4040 | 2012-02-14 21:55:24 +0000 | [diff] [blame] | 1037 | return State; |
Anna Zaks | 4fb5487 | 2012-02-11 21:02:35 +0000 | [diff] [blame] | 1038 | llvm::SmallPtrSet<SymbolRef, 8> WhitelistedSymbols; |
Anna Zaks | 66c4040 | 2012-02-14 21:55:24 +0000 | [diff] [blame] | 1039 | |
Anna Zaks | 1d6cc6a | 2012-02-15 02:12:00 +0000 | [diff] [blame] | 1040 | const FunctionDecl *FD = (Call ? |
| 1041 | dyn_cast_or_null<FunctionDecl>(Call->getDecl()) :0); |
Anna Zaks | 66c4040 | 2012-02-14 21:55:24 +0000 | [diff] [blame] | 1042 | |
| 1043 | // If it's a call which might free or reallocate memory, we assume that all |
| 1044 | // regions (explicit and implicit) escaped. Otherwise, whitelist explicit |
| 1045 | // pointers; we still can track them. |
| 1046 | if (!(FD && hasUnknownBehavior(FD, State))) { |
| 1047 | for (ArrayRef<const MemRegion *>::iterator I = ExplicitRegions.begin(), |
| 1048 | E = ExplicitRegions.end(); I != E; ++I) { |
| 1049 | if (const SymbolicRegion *R = (*I)->StripCasts()->getAs<SymbolicRegion>()) |
| 1050 | WhitelistedSymbols.insert(R->getSymbol()); |
| 1051 | } |
Anna Zaks | 4fb5487 | 2012-02-11 21:02:35 +0000 | [diff] [blame] | 1052 | } |
| 1053 | |
| 1054 | for (StoreManager::InvalidatedSymbols::const_iterator I=invalidated->begin(), |
| 1055 | E = invalidated->end(); I!=E; ++I) { |
| 1056 | SymbolRef sym = *I; |
| 1057 | if (WhitelistedSymbols.count(sym)) |
| 1058 | continue; |
Anna Zaks | 66c4040 | 2012-02-14 21:55:24 +0000 | [diff] [blame] | 1059 | // The symbol escaped. |
| 1060 | if (const RefState *RS = State->get<RegionState>(sym)) |
| 1061 | State = State->set<RegionState>(sym, RefState::getEscaped(RS->getStmt())); |
Anna Zaks | 4fb5487 | 2012-02-11 21:02:35 +0000 | [diff] [blame] | 1062 | } |
Anna Zaks | 66c4040 | 2012-02-14 21:55:24 +0000 | [diff] [blame] | 1063 | return State; |
Ted Kremenek | dd0e490 | 2010-07-31 01:52:11 +0000 | [diff] [blame] | 1064 | } |
Argyrios Kyrtzidis | 312dbec | 2011-02-28 01:26:35 +0000 | [diff] [blame] | 1065 | |
Anna Zaks | ff3b9fd | 2012-02-09 06:25:51 +0000 | [diff] [blame] | 1066 | PathDiagnosticPiece * |
| 1067 | MallocChecker::MallocBugVisitor::VisitNode(const ExplodedNode *N, |
| 1068 | const ExplodedNode *PrevN, |
| 1069 | BugReporterContext &BRC, |
| 1070 | BugReport &BR) { |
| 1071 | const RefState *RS = N->getState()->get<RegionState>(Sym); |
| 1072 | const RefState *RSPrev = PrevN->getState()->get<RegionState>(Sym); |
| 1073 | if (!RS && !RSPrev) |
| 1074 | return 0; |
| 1075 | |
Anna Zaks | fe57160 | 2012-02-16 22:26:07 +0000 | [diff] [blame^] | 1076 | const Stmt *S = 0; |
| 1077 | const char *Msg = 0; |
| 1078 | |
| 1079 | // Retrieve the associated statement. |
| 1080 | ProgramPoint ProgLoc = N->getLocation(); |
| 1081 | if (isa<StmtPoint>(ProgLoc)) |
| 1082 | S = cast<StmtPoint>(ProgLoc).getStmt(); |
| 1083 | // If an assumption was made on a branch, it should be caught |
| 1084 | // here by looking at the state transition. |
| 1085 | if (isa<BlockEdge>(ProgLoc)) { |
| 1086 | const CFGBlock *srcBlk = cast<BlockEdge>(ProgLoc).getSrc(); |
| 1087 | S = srcBlk->getTerminator(); |
| 1088 | } |
| 1089 | if (!S) |
Anna Zaks | ff3b9fd | 2012-02-09 06:25:51 +0000 | [diff] [blame] | 1090 | return 0; |
Anna Zaks | ff3b9fd | 2012-02-09 06:25:51 +0000 | [diff] [blame] | 1091 | |
| 1092 | // Find out if this is an interesting point and what is the kind. |
Anna Zaks | fe57160 | 2012-02-16 22:26:07 +0000 | [diff] [blame^] | 1093 | if (Mode == Normal) { |
| 1094 | if (isAllocated(RS, RSPrev, S)) |
| 1095 | Msg = "Memory is allocated"; |
| 1096 | else if (isReleased(RS, RSPrev, S)) |
| 1097 | Msg = "Memory is released"; |
| 1098 | else if (isReallocFailedCheck(RS, RSPrev, S)) { |
| 1099 | Mode = ReallocationFailed; |
| 1100 | Msg = "Reallocation failed"; |
| 1101 | } |
| 1102 | |
| 1103 | // We are in a special mode if a reallocation failed later in the path. |
| 1104 | } else if (Mode == ReallocationFailed) { |
| 1105 | // Generate a special diagnostic for the first realloc we find. |
| 1106 | if (!isAllocated(RS, RSPrev, S) && !isReleased(RS, RSPrev, S)) |
| 1107 | return 0; |
| 1108 | |
| 1109 | // Check that the name of the function is realloc. |
| 1110 | const CallExpr *CE = dyn_cast<CallExpr>(S); |
| 1111 | if (!CE) |
| 1112 | return 0; |
| 1113 | const FunctionDecl *funDecl = CE->getDirectCallee(); |
| 1114 | if (!funDecl) |
| 1115 | return 0; |
| 1116 | StringRef FunName = funDecl->getName(); |
| 1117 | if (!(FunName.equals("realloc") || FunName.equals("reallocf"))) |
| 1118 | return 0; |
| 1119 | Msg = "Attempt to reallocate memory"; |
| 1120 | Mode = Normal; |
| 1121 | } |
| 1122 | |
Anna Zaks | ff3b9fd | 2012-02-09 06:25:51 +0000 | [diff] [blame] | 1123 | if (!Msg) |
| 1124 | return 0; |
| 1125 | |
| 1126 | // Generate the extra diagnostic. |
Anna Zaks | fe57160 | 2012-02-16 22:26:07 +0000 | [diff] [blame^] | 1127 | PathDiagnosticLocation Pos(S, BRC.getSourceManager(), |
Anna Zaks | ff3b9fd | 2012-02-09 06:25:51 +0000 | [diff] [blame] | 1128 | N->getLocationContext()); |
| 1129 | return new PathDiagnosticEventPiece(Pos, Msg); |
| 1130 | } |
| 1131 | |
| 1132 | |
Anna Zaks | 231361a | 2012-02-08 23:16:52 +0000 | [diff] [blame] | 1133 | #define REGISTER_CHECKER(name) \ |
| 1134 | void ento::register##name(CheckerManager &mgr) {\ |
| 1135 | mgr.registerChecker<MallocChecker>()->Filter.C##name = true;\ |
Argyrios Kyrtzidis | 312dbec | 2011-02-28 01:26:35 +0000 | [diff] [blame] | 1136 | } |
Anna Zaks | 231361a | 2012-02-08 23:16:52 +0000 | [diff] [blame] | 1137 | |
| 1138 | REGISTER_CHECKER(MallocPessimistic) |
| 1139 | REGISTER_CHECKER(MallocOptimistic) |