blob: 044db2840087c278af2e4141368087dd5ea1c6cd [file] [log] [blame]
Zhongxing Xu589c0f22009-11-12 08:38:56 +00001//=== MallocChecker.cpp - A malloc/free checker -------------------*- C++ -*--//
2//
3// The LLVM Compiler Infrastructure
4//
5// This file is distributed under the University of Illinois Open Source
6// License. See LICENSE.TXT for details.
7//
8//===----------------------------------------------------------------------===//
9//
10// This file defines malloc/free checker, which checks for potential memory
11// leaks, double free, and use-after-free problems.
12//
13//===----------------------------------------------------------------------===//
14
Argyrios Kyrtzidis312dbec2011-02-28 01:26:35 +000015#include "ClangSACheckers.h"
Argyrios Kyrtzidisec8605f2011-03-01 01:16:21 +000016#include "clang/StaticAnalyzer/Core/Checker.h"
Argyrios Kyrtzidis312dbec2011-02-28 01:26:35 +000017#include "clang/StaticAnalyzer/Core/CheckerManager.h"
18#include "clang/StaticAnalyzer/Core/PathSensitive/CheckerContext.h"
Ted Kremenek9b663712011-02-10 01:03:03 +000019#include "clang/StaticAnalyzer/Core/BugReporter/BugType.h"
Anna Zaks66c40402012-02-14 21:55:24 +000020#include "clang/StaticAnalyzer/Core/PathSensitive/ObjCMessage.h"
Ted Kremenek18c66fd2011-08-15 22:09:50 +000021#include "clang/StaticAnalyzer/Core/PathSensitive/ProgramState.h"
22#include "clang/StaticAnalyzer/Core/PathSensitive/ProgramStateTrait.h"
Ted Kremenek9b663712011-02-10 01:03:03 +000023#include "clang/StaticAnalyzer/Core/PathSensitive/SymbolManager.h"
Anna Zaks15d0ae12012-02-11 23:46:36 +000024#include "clang/Basic/SourceManager.h"
Zhongxing Xu589c0f22009-11-12 08:38:56 +000025#include "llvm/ADT/ImmutableMap.h"
Benjamin Kramer8fe83e12012-02-04 13:45:25 +000026#include "llvm/ADT/SmallString.h"
Benjamin Kramer00bd44d2012-02-04 12:31:12 +000027#include "llvm/ADT/STLExtras.h"
Zhongxing Xu589c0f22009-11-12 08:38:56 +000028using namespace clang;
Ted Kremenek9ef65372010-12-23 07:20:52 +000029using namespace ento;
Zhongxing Xu589c0f22009-11-12 08:38:56 +000030
31namespace {
32
Zhongxing Xu7fb14642009-12-11 00:55:44 +000033class RefState {
Ted Kremenekdde201b2010-08-06 21:12:55 +000034 enum Kind { AllocateUnchecked, AllocateFailed, Released, Escaped,
35 Relinquished } K;
Zhongxing Xu243fde92009-11-17 07:54:15 +000036 const Stmt *S;
37
Zhongxing Xu7fb14642009-12-11 00:55:44 +000038public:
Zhongxing Xu243fde92009-11-17 07:54:15 +000039 RefState(Kind k, const Stmt *s) : K(k), S(s) {}
40
Zhongxing Xub94b81a2009-12-31 06:13:07 +000041 bool isAllocated() const { return K == AllocateUnchecked; }
Chris Lattnerfae96222010-09-03 04:34:38 +000042 //bool isFailed() const { return K == AllocateFailed; }
Zhongxing Xu243fde92009-11-17 07:54:15 +000043 bool isReleased() const { return K == Released; }
Chris Lattnerfae96222010-09-03 04:34:38 +000044 //bool isEscaped() const { return K == Escaped; }
45 //bool isRelinquished() const { return K == Relinquished; }
Anna Zaksc8bb3be2012-02-13 18:05:39 +000046 const Stmt *getStmt() const { return S; }
Zhongxing Xu243fde92009-11-17 07:54:15 +000047
48 bool operator==(const RefState &X) const {
49 return K == X.K && S == X.S;
50 }
51
Zhongxing Xub94b81a2009-12-31 06:13:07 +000052 static RefState getAllocateUnchecked(const Stmt *s) {
53 return RefState(AllocateUnchecked, s);
54 }
55 static RefState getAllocateFailed() {
56 return RefState(AllocateFailed, 0);
57 }
Zhongxing Xu243fde92009-11-17 07:54:15 +000058 static RefState getReleased(const Stmt *s) { return RefState(Released, s); }
59 static RefState getEscaped(const Stmt *s) { return RefState(Escaped, s); }
Ted Kremenekdde201b2010-08-06 21:12:55 +000060 static RefState getRelinquished(const Stmt *s) {
61 return RefState(Relinquished, s);
62 }
Zhongxing Xu243fde92009-11-17 07:54:15 +000063
64 void Profile(llvm::FoldingSetNodeID &ID) const {
65 ID.AddInteger(K);
66 ID.AddPointer(S);
67 }
Zhongxing Xu589c0f22009-11-12 08:38:56 +000068};
69
Anna Zaks40add292012-02-15 00:11:25 +000070struct ReallocPair {
71 SymbolRef ReallocatedSym;
72 bool IsFreeOnFailure;
73 ReallocPair(SymbolRef S, bool F) : ReallocatedSym(S), IsFreeOnFailure(F) {}
74 void Profile(llvm::FoldingSetNodeID &ID) const {
75 ID.AddInteger(IsFreeOnFailure);
76 ID.AddPointer(ReallocatedSym);
77 }
78 bool operator==(const ReallocPair &X) const {
79 return ReallocatedSym == X.ReallocatedSym &&
80 IsFreeOnFailure == X.IsFreeOnFailure;
81 }
82};
83
Anna Zaksb319e022012-02-08 20:13:28 +000084class MallocChecker : public Checker<check::DeadSymbols,
Ted Kremeneke3659a72012-01-04 23:48:37 +000085 check::EndPath,
86 check::PreStmt<ReturnStmt>,
Anna Zaks66c40402012-02-14 21:55:24 +000087 check::PreStmt<CallExpr>,
Anna Zaksb319e022012-02-08 20:13:28 +000088 check::PostStmt<CallExpr>,
Ted Kremeneke3659a72012-01-04 23:48:37 +000089 check::Location,
90 check::Bind,
Anna Zaks4fb54872012-02-11 21:02:35 +000091 eval::Assume,
92 check::RegionChanges>
Ted Kremeneke3659a72012-01-04 23:48:37 +000093{
Dylan Noblesmith6f42b622012-02-05 02:12:40 +000094 mutable OwningPtr<BuiltinBug> BT_DoubleFree;
95 mutable OwningPtr<BuiltinBug> BT_Leak;
96 mutable OwningPtr<BuiltinBug> BT_UseFree;
97 mutable OwningPtr<BuiltinBug> BT_UseRelinquished;
98 mutable OwningPtr<BuiltinBug> BT_BadFree;
Anna Zaksb16ce452012-02-15 00:11:22 +000099 mutable IdentifierInfo *II_malloc, *II_free, *II_realloc, *II_calloc,
Anna Zaks40add292012-02-15 00:11:25 +0000100 *II_valloc, *II_reallocf;
Zhongxing Xu589c0f22009-11-12 08:38:56 +0000101
102public:
Anna Zaksb16ce452012-02-15 00:11:22 +0000103 MallocChecker() : II_malloc(0), II_free(0), II_realloc(0), II_calloc(0),
Anna Zaks40add292012-02-15 00:11:25 +0000104 II_valloc(0), II_reallocf(0) {}
Anna Zaks231361a2012-02-08 23:16:52 +0000105
106 /// In pessimistic mode, the checker assumes that it does not know which
107 /// functions might free the memory.
108 struct ChecksFilter {
109 DefaultBool CMallocPessimistic;
110 DefaultBool CMallocOptimistic;
111 };
112
113 ChecksFilter Filter;
114
Anna Zaks66c40402012-02-14 21:55:24 +0000115 void checkPreStmt(const CallExpr *S, CheckerContext &C) const;
Anna Zaksb319e022012-02-08 20:13:28 +0000116 void checkPostStmt(const CallExpr *CE, CheckerContext &C) const;
Argyrios Kyrtzidis312dbec2011-02-28 01:26:35 +0000117 void checkDeadSymbols(SymbolReaper &SymReaper, CheckerContext &C) const;
Anna Zaksaf498a22011-10-25 19:56:48 +0000118 void checkEndPath(CheckerContext &C) const;
Argyrios Kyrtzidis312dbec2011-02-28 01:26:35 +0000119 void checkPreStmt(const ReturnStmt *S, CheckerContext &C) const;
Ted Kremenek8bef8232012-01-26 21:29:00 +0000120 ProgramStateRef evalAssume(ProgramStateRef state, SVal Cond,
Argyrios Kyrtzidis312dbec2011-02-28 01:26:35 +0000121 bool Assumption) const;
Anna Zaks390909c2011-10-06 00:43:15 +0000122 void checkLocation(SVal l, bool isLoad, const Stmt *S,
123 CheckerContext &C) const;
124 void checkBind(SVal location, SVal val, const Stmt*S,
125 CheckerContext &C) const;
Anna Zaks4fb54872012-02-11 21:02:35 +0000126 ProgramStateRef
127 checkRegionChanges(ProgramStateRef state,
128 const StoreManager::InvalidatedSymbols *invalidated,
129 ArrayRef<const MemRegion *> ExplicitRegions,
Anna Zaks66c40402012-02-14 21:55:24 +0000130 ArrayRef<const MemRegion *> Regions,
131 const CallOrObjCMessage *Call) const;
Anna Zaks4fb54872012-02-11 21:02:35 +0000132 bool wantsRegionChangeUpdate(ProgramStateRef state) const {
133 return true;
134 }
Zhongxing Xub94b81a2009-12-31 06:13:07 +0000135
Zhongxing Xu7b760962009-11-13 07:25:27 +0000136private:
Anna Zaks66c40402012-02-14 21:55:24 +0000137 void initIdentifierInfo(ASTContext &C) const;
138
139 /// Check if this is one of the functions which can allocate/reallocate memory
140 /// pointed to by one of its arguments.
141 bool isMemFunction(const FunctionDecl *FD, ASTContext &C) const;
142
Argyrios Kyrtzidis312dbec2011-02-28 01:26:35 +0000143 static void MallocMem(CheckerContext &C, const CallExpr *CE);
144 static void MallocMemReturnsAttr(CheckerContext &C, const CallExpr *CE,
145 const OwnershipAttr* Att);
Ted Kremenek8bef8232012-01-26 21:29:00 +0000146 static ProgramStateRef MallocMemAux(CheckerContext &C, const CallExpr *CE,
Argyrios Kyrtzidis312dbec2011-02-28 01:26:35 +0000147 const Expr *SizeEx, SVal Init,
Ted Kremenek8bef8232012-01-26 21:29:00 +0000148 ProgramStateRef state) {
Ted Kremenek5eca4822012-01-06 22:09:28 +0000149 return MallocMemAux(C, CE,
150 state->getSVal(SizeEx, C.getLocationContext()),
151 Init, state);
Zhongxing Xua5ce9662010-06-01 03:01:33 +0000152 }
Ted Kremenek8bef8232012-01-26 21:29:00 +0000153 static ProgramStateRef MallocMemAux(CheckerContext &C, const CallExpr *CE,
Argyrios Kyrtzidis312dbec2011-02-28 01:26:35 +0000154 SVal SizeEx, SVal Init,
Ted Kremenek8bef8232012-01-26 21:29:00 +0000155 ProgramStateRef state);
Zhongxing Xua5ce9662010-06-01 03:01:33 +0000156
Argyrios Kyrtzidis312dbec2011-02-28 01:26:35 +0000157 void FreeMem(CheckerContext &C, const CallExpr *CE) const;
Jordy Rose2a479922010-08-12 08:54:03 +0000158 void FreeMemAttr(CheckerContext &C, const CallExpr *CE,
Argyrios Kyrtzidis312dbec2011-02-28 01:26:35 +0000159 const OwnershipAttr* Att) const;
Ted Kremenek8bef8232012-01-26 21:29:00 +0000160 ProgramStateRef FreeMemAux(CheckerContext &C, const CallExpr *CE,
161 ProgramStateRef state, unsigned Num,
Ted Kremeneke3659a72012-01-04 23:48:37 +0000162 bool Hold) const;
Zhongxing Xud9c84c82009-12-12 12:29:38 +0000163
Anna Zaks40add292012-02-15 00:11:25 +0000164 void ReallocMem(CheckerContext &C, const CallExpr *CE,
165 bool FreesMemOnFailure) const;
Argyrios Kyrtzidis312dbec2011-02-28 01:26:35 +0000166 static void CallocMem(CheckerContext &C, const CallExpr *CE);
Jordy Rose43859f62010-06-07 19:32:37 +0000167
Anna Zaks91c2a112012-02-08 23:16:56 +0000168 bool checkEscape(SymbolRef Sym, const Stmt *S, CheckerContext &C) const;
169 bool checkUseAfterFree(SymbolRef Sym, CheckerContext &C,
170 const Stmt *S = 0) const;
171
Anna Zaks66c40402012-02-14 21:55:24 +0000172 /// Check if the function is not known to us. So, for example, we could
173 /// conservatively assume it can free/reallocate it's pointer arguments.
174 bool hasUnknownBehavior(const FunctionDecl *FD, ProgramStateRef State) const;
175
Ted Kremenek9c378f72011-08-12 23:37:29 +0000176 static bool SummarizeValue(raw_ostream &os, SVal V);
177 static bool SummarizeRegion(raw_ostream &os, const MemRegion *MR);
Argyrios Kyrtzidis312dbec2011-02-28 01:26:35 +0000178 void ReportBadFree(CheckerContext &C, SVal ArgVal, SourceRange range) const;
Anna Zaksff3b9fd2012-02-09 06:25:51 +0000179
Anna Zaksda046772012-02-11 21:02:40 +0000180 void reportLeak(SymbolRef Sym, ExplodedNode *N, CheckerContext &C) const;
181
Anna Zaksff3b9fd2012-02-09 06:25:51 +0000182 /// The bug visitor which allows us to print extra diagnostics along the
183 /// BugReport path. For example, showing the allocation site of the leaked
184 /// region.
185 class MallocBugVisitor : public BugReporterVisitor {
186 protected:
Anna Zaksfe571602012-02-16 22:26:07 +0000187 enum NotificationMode {
188 Normal,
189 Complete,
190 ReallocationFailed
191 };
192
Anna Zaksff3b9fd2012-02-09 06:25:51 +0000193 // The allocated region symbol tracked by the main analysis.
194 SymbolRef Sym;
Anna Zaksfe571602012-02-16 22:26:07 +0000195 NotificationMode Mode;
Anna Zaksff3b9fd2012-02-09 06:25:51 +0000196
197 public:
Anna Zaksfe571602012-02-16 22:26:07 +0000198 MallocBugVisitor(SymbolRef S) : Sym(S), Mode(Normal) {}
Anna Zaksff3b9fd2012-02-09 06:25:51 +0000199 virtual ~MallocBugVisitor() {}
200
201 void Profile(llvm::FoldingSetNodeID &ID) const {
202 static int X = 0;
203 ID.AddPointer(&X);
204 ID.AddPointer(Sym);
205 }
206
Anna Zaksfe571602012-02-16 22:26:07 +0000207 inline bool isAllocated(const RefState *S, const RefState *SPrev,
208 const Stmt *Stmt) {
Anna Zaksff3b9fd2012-02-09 06:25:51 +0000209 // Did not track -> allocated. Other state (released) -> allocated.
Anna Zaksfe571602012-02-16 22:26:07 +0000210 return (Stmt && isa<CallExpr>(Stmt) &&
211 (S && S->isAllocated()) && (!SPrev || !SPrev->isAllocated()));
Anna Zaksff3b9fd2012-02-09 06:25:51 +0000212 }
213
Anna Zaksfe571602012-02-16 22:26:07 +0000214 inline bool isReleased(const RefState *S, const RefState *SPrev,
215 const Stmt *Stmt) {
Anna Zaksff3b9fd2012-02-09 06:25:51 +0000216 // Did not track -> released. Other state (allocated) -> released.
Anna Zaksfe571602012-02-16 22:26:07 +0000217 return (Stmt && isa<CallExpr>(Stmt) &&
218 (S && S->isReleased()) && (!SPrev || !SPrev->isReleased()));
219 }
220
221 inline bool isReallocFailedCheck(const RefState *S, const RefState *SPrev,
222 const Stmt *Stmt) {
223 // If the expression is not a call, and the state change is
224 // released -> allocated, it must be the realloc return value
225 // check. If we have to handle more cases here, it might be cleaner just
226 // to track this extra bit in the state itself.
227 return ((!Stmt || !isa<CallExpr>(Stmt)) &&
228 (S && S->isAllocated()) && (SPrev && !SPrev->isAllocated()));
Anna Zaksff3b9fd2012-02-09 06:25:51 +0000229 }
230
231 PathDiagnosticPiece *VisitNode(const ExplodedNode *N,
232 const ExplodedNode *PrevN,
233 BugReporterContext &BRC,
234 BugReport &BR);
235 };
Zhongxing Xu589c0f22009-11-12 08:38:56 +0000236};
Kovarththanan Rajaratnamba5fb5a2009-11-28 06:07:30 +0000237} // end anonymous namespace
Zhongxing Xu589c0f22009-11-12 08:38:56 +0000238
Zhongxing Xub94b81a2009-12-31 06:13:07 +0000239typedef llvm::ImmutableMap<SymbolRef, RefState> RegionStateTy;
Anna Zaks40add292012-02-15 00:11:25 +0000240typedef llvm::ImmutableMap<SymbolRef, ReallocPair > ReallocMap;
Anna Zaksc8bb3be2012-02-13 18:05:39 +0000241class RegionState {};
242class ReallocPairs {};
Zhongxing Xu589c0f22009-11-12 08:38:56 +0000243namespace clang {
Ted Kremenek9ef65372010-12-23 07:20:52 +0000244namespace ento {
Zhongxing Xu243fde92009-11-17 07:54:15 +0000245 template <>
Ted Kremenek18c66fd2011-08-15 22:09:50 +0000246 struct ProgramStateTrait<RegionState>
247 : public ProgramStatePartialTrait<RegionStateTy> {
Argyrios Kyrtzidis312dbec2011-02-28 01:26:35 +0000248 static void *GDMIndex() { static int x; return &x; }
Zhongxing Xu589c0f22009-11-12 08:38:56 +0000249 };
Anna Zaksc8bb3be2012-02-13 18:05:39 +0000250
251 template <>
252 struct ProgramStateTrait<ReallocPairs>
Anna Zaks40add292012-02-15 00:11:25 +0000253 : public ProgramStatePartialTrait<ReallocMap> {
Anna Zaksc8bb3be2012-02-13 18:05:39 +0000254 static void *GDMIndex() { static int x; return &x; }
255 };
Zhongxing Xu589c0f22009-11-12 08:38:56 +0000256}
Argyrios Kyrtzidis5a4f98f2010-12-22 18:53:20 +0000257}
Zhongxing Xu589c0f22009-11-12 08:38:56 +0000258
Anna Zaks4fb54872012-02-11 21:02:35 +0000259namespace {
260class StopTrackingCallback : public SymbolVisitor {
261 ProgramStateRef state;
262public:
263 StopTrackingCallback(ProgramStateRef st) : state(st) {}
264 ProgramStateRef getState() const { return state; }
265
266 bool VisitSymbol(SymbolRef sym) {
267 state = state->remove<RegionState>(sym);
268 return true;
269 }
270};
271} // end anonymous namespace
272
Anna Zaks66c40402012-02-14 21:55:24 +0000273void MallocChecker::initIdentifierInfo(ASTContext &Ctx) const {
Zhongxing Xu589c0f22009-11-12 08:38:56 +0000274 if (!II_malloc)
275 II_malloc = &Ctx.Idents.get("malloc");
276 if (!II_free)
Zhongxing Xufc7ac8f2009-11-13 07:48:11 +0000277 II_free = &Ctx.Idents.get("free");
Zhongxing Xud9c84c82009-12-12 12:29:38 +0000278 if (!II_realloc)
279 II_realloc = &Ctx.Idents.get("realloc");
Anna Zaks40add292012-02-15 00:11:25 +0000280 if (!II_reallocf)
281 II_reallocf = &Ctx.Idents.get("reallocf");
Zhongxing Xua5ce9662010-06-01 03:01:33 +0000282 if (!II_calloc)
283 II_calloc = &Ctx.Idents.get("calloc");
Anna Zaksb16ce452012-02-15 00:11:22 +0000284 if (!II_valloc)
285 II_valloc = &Ctx.Idents.get("valloc");
Anna Zaksb319e022012-02-08 20:13:28 +0000286}
287
Anna Zaks66c40402012-02-14 21:55:24 +0000288bool MallocChecker::isMemFunction(const FunctionDecl *FD, ASTContext &C) const {
Anna Zaks1d6cc6a2012-02-15 02:12:00 +0000289 if (!FD)
290 return false;
Anna Zaks66c40402012-02-14 21:55:24 +0000291 IdentifierInfo *FunI = FD->getIdentifier();
292 if (!FunI)
293 return false;
294
Anna Zaks1d6cc6a2012-02-15 02:12:00 +0000295 initIdentifierInfo(C);
296
Anna Zaks66c40402012-02-14 21:55:24 +0000297 // TODO: Add more here : ex: reallocf!
Anna Zaks40add292012-02-15 00:11:25 +0000298 if (FunI == II_malloc || FunI == II_free || FunI == II_realloc ||
299 FunI == II_reallocf || FunI == II_calloc || FunI == II_valloc)
Anna Zaks66c40402012-02-14 21:55:24 +0000300 return true;
301
302 if (Filter.CMallocOptimistic && FD->hasAttrs() &&
303 FD->specific_attr_begin<OwnershipAttr>() !=
304 FD->specific_attr_end<OwnershipAttr>())
305 return true;
306
307
308 return false;
309}
310
Anna Zaksb319e022012-02-08 20:13:28 +0000311void MallocChecker::checkPostStmt(const CallExpr *CE, CheckerContext &C) const {
312 const FunctionDecl *FD = C.getCalleeDecl(CE);
313 if (!FD)
314 return;
Zhongxing Xu589c0f22009-11-12 08:38:56 +0000315
Anna Zaksb16ce452012-02-15 00:11:22 +0000316 initIdentifierInfo(C.getASTContext());
317 IdentifierInfo *FunI = FD->getIdentifier();
318 if (!FunI)
319 return;
320
321 if (FunI == II_malloc || FunI == II_valloc) {
Zhongxing Xu589c0f22009-11-12 08:38:56 +0000322 MallocMem(C, CE);
Anna Zaksb319e022012-02-08 20:13:28 +0000323 return;
Anna Zaksb16ce452012-02-15 00:11:22 +0000324 } else if (FunI == II_realloc) {
Anna Zaks40add292012-02-15 00:11:25 +0000325 ReallocMem(C, CE, false);
326 return;
327 } else if (FunI == II_reallocf) {
328 ReallocMem(C, CE, true);
Anna Zaksb319e022012-02-08 20:13:28 +0000329 return;
Anna Zaksb16ce452012-02-15 00:11:22 +0000330 } else if (FunI == II_calloc) {
Zhongxing Xua5ce9662010-06-01 03:01:33 +0000331 CallocMem(C, CE);
Anna Zaksb319e022012-02-08 20:13:28 +0000332 return;
Anna Zaksb16ce452012-02-15 00:11:22 +0000333 }else if (FunI == II_free) {
Anna Zaksb319e022012-02-08 20:13:28 +0000334 FreeMem(C, CE);
335 return;
Zhongxing Xua5ce9662010-06-01 03:01:33 +0000336 }
337
Anna Zaks91c2a112012-02-08 23:16:56 +0000338 if (Filter.CMallocOptimistic)
Ted Kremenekdd0e4902010-07-31 01:52:11 +0000339 // Check all the attributes, if there are any.
340 // There can be multiple of these attributes.
Ted Kremenekdd0e4902010-07-31 01:52:11 +0000341 if (FD->hasAttrs()) {
Sean Huntcf807c42010-08-18 23:23:40 +0000342 for (specific_attr_iterator<OwnershipAttr>
343 i = FD->specific_attr_begin<OwnershipAttr>(),
344 e = FD->specific_attr_end<OwnershipAttr>();
345 i != e; ++i) {
346 switch ((*i)->getOwnKind()) {
347 case OwnershipAttr::Returns: {
348 MallocMemReturnsAttr(C, CE, *i);
Anna Zaks15d0ae12012-02-11 23:46:36 +0000349 return;
Sean Huntcf807c42010-08-18 23:23:40 +0000350 }
351 case OwnershipAttr::Takes:
352 case OwnershipAttr::Holds: {
353 FreeMemAttr(C, CE, *i);
Anna Zaks15d0ae12012-02-11 23:46:36 +0000354 return;
Sean Huntcf807c42010-08-18 23:23:40 +0000355 }
Ted Kremenekdd0e4902010-07-31 01:52:11 +0000356 }
357 }
358 }
Zhongxing Xu589c0f22009-11-12 08:38:56 +0000359}
360
361void MallocChecker::MallocMem(CheckerContext &C, const CallExpr *CE) {
Ted Kremenek8bef8232012-01-26 21:29:00 +0000362 ProgramStateRef state = MallocMemAux(C, CE, CE->getArg(0), UndefinedVal(),
Zhongxing Xua5ce9662010-06-01 03:01:33 +0000363 C.getState());
Anna Zaks0bd6b112011-10-26 21:06:34 +0000364 C.addTransition(state);
Zhongxing Xud9c84c82009-12-12 12:29:38 +0000365}
366
Ted Kremenekdd0e4902010-07-31 01:52:11 +0000367void MallocChecker::MallocMemReturnsAttr(CheckerContext &C, const CallExpr *CE,
368 const OwnershipAttr* Att) {
Sean Huntcf807c42010-08-18 23:23:40 +0000369 if (Att->getModule() != "malloc")
Ted Kremenekdd0e4902010-07-31 01:52:11 +0000370 return;
371
Sean Huntcf807c42010-08-18 23:23:40 +0000372 OwnershipAttr::args_iterator I = Att->args_begin(), E = Att->args_end();
Ted Kremenekdd0e4902010-07-31 01:52:11 +0000373 if (I != E) {
Ted Kremenek8bef8232012-01-26 21:29:00 +0000374 ProgramStateRef state =
Ted Kremenekdd0e4902010-07-31 01:52:11 +0000375 MallocMemAux(C, CE, CE->getArg(*I), UndefinedVal(), C.getState());
Anna Zaks0bd6b112011-10-26 21:06:34 +0000376 C.addTransition(state);
Ted Kremenekdd0e4902010-07-31 01:52:11 +0000377 return;
378 }
Ted Kremenek8bef8232012-01-26 21:29:00 +0000379 ProgramStateRef state = MallocMemAux(C, CE, UnknownVal(), UndefinedVal(),
Ted Kremenekdd0e4902010-07-31 01:52:11 +0000380 C.getState());
Anna Zaks0bd6b112011-10-26 21:06:34 +0000381 C.addTransition(state);
Ted Kremenekdd0e4902010-07-31 01:52:11 +0000382}
383
Anna Zaksb319e022012-02-08 20:13:28 +0000384ProgramStateRef MallocChecker::MallocMemAux(CheckerContext &C,
Zhongxing Xud9c84c82009-12-12 12:29:38 +0000385 const CallExpr *CE,
Zhongxing Xua5ce9662010-06-01 03:01:33 +0000386 SVal Size, SVal Init,
Ted Kremenek8bef8232012-01-26 21:29:00 +0000387 ProgramStateRef state) {
Ted Kremenekc8413fd2010-12-02 07:49:45 +0000388 SValBuilder &svalBuilder = C.getSValBuilder();
Zhongxing Xua49c6b72009-12-11 03:09:01 +0000389
Anna Zaksb319e022012-02-08 20:13:28 +0000390 // Get the return value.
391 SVal retVal = state->getSVal(CE, C.getLocationContext());
Zhongxing Xua49c6b72009-12-11 03:09:01 +0000392
Anna Zaksb16ce452012-02-15 00:11:22 +0000393 // We expect the malloc functions to return a pointer.
394 if (!isa<Loc>(retVal))
395 return 0;
396
Jordy Rose32f26562010-07-04 00:00:41 +0000397 // Fill the region with the initialization value.
Ted Kremenekc8413fd2010-12-02 07:49:45 +0000398 state = state->bindDefault(retVal, Init);
Zhongxing Xua5ce9662010-06-01 03:01:33 +0000399
Jordy Rose32f26562010-07-04 00:00:41 +0000400 // Set the region's extent equal to the Size parameter.
Anna Zakse9ef5622012-02-10 01:11:00 +0000401 const SymbolicRegion *R =
402 dyn_cast_or_null<SymbolicRegion>(retVal.getAsRegion());
403 if (!R || !isa<DefinedOrUnknownSVal>(Size))
404 return 0;
405
Ted Kremenekc8413fd2010-12-02 07:49:45 +0000406 DefinedOrUnknownSVal Extent = R->getExtent(svalBuilder);
Jordy Rose32f26562010-07-04 00:00:41 +0000407 DefinedOrUnknownSVal DefinedSize = cast<DefinedOrUnknownSVal>(Size);
Ted Kremenekc8413fd2010-12-02 07:49:45 +0000408 DefinedOrUnknownSVal extentMatchesSize =
Ted Kremenek9c149532010-12-01 21:57:22 +0000409 svalBuilder.evalEQ(state, Extent, DefinedSize);
Jordy Rose32f26562010-07-04 00:00:41 +0000410
Ted Kremenekc8413fd2010-12-02 07:49:45 +0000411 state = state->assume(extentMatchesSize, true);
412 assert(state);
413
414 SymbolRef Sym = retVal.getAsLocSymbol();
Zhongxing Xu589c0f22009-11-12 08:38:56 +0000415 assert(Sym);
Ted Kremenekc8413fd2010-12-02 07:49:45 +0000416
Zhongxing Xu589c0f22009-11-12 08:38:56 +0000417 // Set the symbol's state to Allocated.
Zhongxing Xub94b81a2009-12-31 06:13:07 +0000418 return state->set<RegionState>(Sym, RefState::getAllocateUnchecked(CE));
Zhongxing Xu589c0f22009-11-12 08:38:56 +0000419}
420
Argyrios Kyrtzidis312dbec2011-02-28 01:26:35 +0000421void MallocChecker::FreeMem(CheckerContext &C, const CallExpr *CE) const {
Ted Kremenek8bef8232012-01-26 21:29:00 +0000422 ProgramStateRef state = FreeMemAux(C, CE, C.getState(), 0, false);
Zhongxing Xud9c84c82009-12-12 12:29:38 +0000423
424 if (state)
Anna Zaks0bd6b112011-10-26 21:06:34 +0000425 C.addTransition(state);
Zhongxing Xud9c84c82009-12-12 12:29:38 +0000426}
427
Ted Kremenekdd0e4902010-07-31 01:52:11 +0000428void MallocChecker::FreeMemAttr(CheckerContext &C, const CallExpr *CE,
Argyrios Kyrtzidis312dbec2011-02-28 01:26:35 +0000429 const OwnershipAttr* Att) const {
Sean Huntcf807c42010-08-18 23:23:40 +0000430 if (Att->getModule() != "malloc")
Ted Kremenekdd0e4902010-07-31 01:52:11 +0000431 return;
432
Sean Huntcf807c42010-08-18 23:23:40 +0000433 for (OwnershipAttr::args_iterator I = Att->args_begin(), E = Att->args_end();
434 I != E; ++I) {
Ted Kremenek8bef8232012-01-26 21:29:00 +0000435 ProgramStateRef state =
Ted Kremeneke3659a72012-01-04 23:48:37 +0000436 FreeMemAux(C, CE, C.getState(), *I,
437 Att->getOwnKind() == OwnershipAttr::Holds);
Sean Huntcf807c42010-08-18 23:23:40 +0000438 if (state)
Anna Zaks0bd6b112011-10-26 21:06:34 +0000439 C.addTransition(state);
Ted Kremenekdd0e4902010-07-31 01:52:11 +0000440 }
441}
442
Ted Kremenek8bef8232012-01-26 21:29:00 +0000443ProgramStateRef MallocChecker::FreeMemAux(CheckerContext &C,
Anna Zakse9ef5622012-02-10 01:11:00 +0000444 const CallExpr *CE,
445 ProgramStateRef state,
446 unsigned Num,
447 bool Hold) const {
Ted Kremenekdd0e4902010-07-31 01:52:11 +0000448 const Expr *ArgExpr = CE->getArg(Num);
Ted Kremenek5eca4822012-01-06 22:09:28 +0000449 SVal ArgVal = state->getSVal(ArgExpr, C.getLocationContext());
Anna Zakse9ef5622012-02-10 01:11:00 +0000450 if (!isa<DefinedOrUnknownSVal>(ArgVal))
451 return 0;
Ted Kremenekdd0e4902010-07-31 01:52:11 +0000452 DefinedOrUnknownSVal location = cast<DefinedOrUnknownSVal>(ArgVal);
453
454 // Check for null dereferences.
455 if (!isa<Loc>(location))
Anna Zaksb319e022012-02-08 20:13:28 +0000456 return 0;
Ted Kremenekdd0e4902010-07-31 01:52:11 +0000457
Anna Zaksb276bd92012-02-14 00:26:13 +0000458 // The explicit NULL case, no operation is performed.
Ted Kremenek8bef8232012-01-26 21:29:00 +0000459 ProgramStateRef notNullState, nullState;
Ted Kremenek28f47b92010-12-01 22:16:56 +0000460 llvm::tie(notNullState, nullState) = state->assume(location);
Ted Kremenekdd0e4902010-07-31 01:52:11 +0000461 if (nullState && !notNullState)
Anna Zaksb319e022012-02-08 20:13:28 +0000462 return 0;
Ted Kremenekdd0e4902010-07-31 01:52:11 +0000463
Jordy Rose43859f62010-06-07 19:32:37 +0000464 // Unknown values could easily be okay
465 // Undefined values are handled elsewhere
466 if (ArgVal.isUnknownOrUndef())
Anna Zaksb319e022012-02-08 20:13:28 +0000467 return 0;
Zhongxing Xu589c0f22009-11-12 08:38:56 +0000468
Jordy Rose43859f62010-06-07 19:32:37 +0000469 const MemRegion *R = ArgVal.getAsRegion();
470
471 // Nonlocs can't be freed, of course.
472 // Non-region locations (labels and fixed addresses) also shouldn't be freed.
473 if (!R) {
474 ReportBadFree(C, ArgVal, ArgExpr->getSourceRange());
Anna Zaksb319e022012-02-08 20:13:28 +0000475 return 0;
Jordy Rose43859f62010-06-07 19:32:37 +0000476 }
477
478 R = R->StripCasts();
479
480 // Blocks might show up as heap data, but should not be free()d
481 if (isa<BlockDataRegion>(R)) {
482 ReportBadFree(C, ArgVal, ArgExpr->getSourceRange());
Anna Zaksb319e022012-02-08 20:13:28 +0000483 return 0;
Jordy Rose43859f62010-06-07 19:32:37 +0000484 }
485
486 const MemSpaceRegion *MS = R->getMemorySpace();
487
488 // Parameters, locals, statics, and globals shouldn't be freed.
489 if (!(isa<UnknownSpaceRegion>(MS) || isa<HeapSpaceRegion>(MS))) {
490 // FIXME: at the time this code was written, malloc() regions were
491 // represented by conjured symbols, which are all in UnknownSpaceRegion.
492 // This means that there isn't actually anything from HeapSpaceRegion
493 // that should be freed, even though we allow it here.
494 // Of course, free() can work on memory allocated outside the current
495 // function, so UnknownSpaceRegion is always a possibility.
496 // False negatives are better than false positives.
497
498 ReportBadFree(C, ArgVal, ArgExpr->getSourceRange());
Anna Zaksb319e022012-02-08 20:13:28 +0000499 return 0;
Jordy Rose43859f62010-06-07 19:32:37 +0000500 }
501
502 const SymbolicRegion *SR = dyn_cast<SymbolicRegion>(R);
503 // Various cases could lead to non-symbol values here.
504 // For now, ignore them.
505 if (!SR)
Anna Zaksb319e022012-02-08 20:13:28 +0000506 return 0;
Jordy Rose43859f62010-06-07 19:32:37 +0000507
508 SymbolRef Sym = SR->getSymbol();
Zhongxing Xu589c0f22009-11-12 08:38:56 +0000509 const RefState *RS = state->get<RegionState>(Sym);
Zhongxing Xu7e3cda92010-01-18 03:27:34 +0000510
511 // If the symbol has not been tracked, return. This is possible when free() is
512 // called on a pointer that does not get its pointee directly from malloc().
513 // Full support of this requires inter-procedural analysis.
514 if (!RS)
Anna Zaksb319e022012-02-08 20:13:28 +0000515 return 0;
Zhongxing Xu589c0f22009-11-12 08:38:56 +0000516
517 // Check double free.
Zhongxing Xu243fde92009-11-17 07:54:15 +0000518 if (RS->isReleased()) {
Ted Kremenekd048c6e2010-12-20 21:19:09 +0000519 if (ExplodedNode *N = C.generateSink()) {
Zhongxing Xu589c0f22009-11-12 08:38:56 +0000520 if (!BT_DoubleFree)
Argyrios Kyrtzidis312dbec2011-02-28 01:26:35 +0000521 BT_DoubleFree.reset(
522 new BuiltinBug("Double free",
523 "Try to free a memory block that has been released"));
Zhongxing Xu589c0f22009-11-12 08:38:56 +0000524 BugReport *R = new BugReport(*BT_DoubleFree,
Benjamin Kramerd02e2322009-11-14 12:08:24 +0000525 BT_DoubleFree->getDescription(), N);
Anna Zaksfe571602012-02-16 22:26:07 +0000526 R->addRange(ArgExpr->getSourceRange());
Anna Zaksff3b9fd2012-02-09 06:25:51 +0000527 R->addVisitor(new MallocBugVisitor(Sym));
Zhongxing Xu589c0f22009-11-12 08:38:56 +0000528 C.EmitReport(R);
529 }
Anna Zaksb319e022012-02-08 20:13:28 +0000530 return 0;
Zhongxing Xu589c0f22009-11-12 08:38:56 +0000531 }
532
533 // Normal free.
Ted Kremenekdd0e4902010-07-31 01:52:11 +0000534 if (Hold)
Anna Zaksb276bd92012-02-14 00:26:13 +0000535 return state->set<RegionState>(Sym, RefState::getRelinquished(CE));
536 return state->set<RegionState>(Sym, RefState::getReleased(CE));
Zhongxing Xud9c84c82009-12-12 12:29:38 +0000537}
538
Ted Kremenek9c378f72011-08-12 23:37:29 +0000539bool MallocChecker::SummarizeValue(raw_ostream &os, SVal V) {
Jordy Rose43859f62010-06-07 19:32:37 +0000540 if (nonloc::ConcreteInt *IntVal = dyn_cast<nonloc::ConcreteInt>(&V))
541 os << "an integer (" << IntVal->getValue() << ")";
542 else if (loc::ConcreteInt *ConstAddr = dyn_cast<loc::ConcreteInt>(&V))
543 os << "a constant address (" << ConstAddr->getValue() << ")";
544 else if (loc::GotoLabel *Label = dyn_cast<loc::GotoLabel>(&V))
Chris Lattner68106302011-02-17 05:38:27 +0000545 os << "the address of the label '" << Label->getLabel()->getName() << "'";
Jordy Rose43859f62010-06-07 19:32:37 +0000546 else
547 return false;
548
549 return true;
550}
551
Ted Kremenek9c378f72011-08-12 23:37:29 +0000552bool MallocChecker::SummarizeRegion(raw_ostream &os,
Jordy Rose43859f62010-06-07 19:32:37 +0000553 const MemRegion *MR) {
554 switch (MR->getKind()) {
555 case MemRegion::FunctionTextRegionKind: {
556 const FunctionDecl *FD = cast<FunctionTextRegion>(MR)->getDecl();
557 if (FD)
Benjamin Kramerb8989f22011-10-14 18:45:37 +0000558 os << "the address of the function '" << *FD << '\'';
Jordy Rose43859f62010-06-07 19:32:37 +0000559 else
560 os << "the address of a function";
561 return true;
562 }
563 case MemRegion::BlockTextRegionKind:
564 os << "block text";
565 return true;
566 case MemRegion::BlockDataRegionKind:
567 // FIXME: where the block came from?
568 os << "a block";
569 return true;
570 default: {
571 const MemSpaceRegion *MS = MR->getMemorySpace();
572
Anna Zakseb31a762012-01-04 23:54:01 +0000573 if (isa<StackLocalsSpaceRegion>(MS)) {
Jordy Rose43859f62010-06-07 19:32:37 +0000574 const VarRegion *VR = dyn_cast<VarRegion>(MR);
575 const VarDecl *VD;
576 if (VR)
577 VD = VR->getDecl();
578 else
579 VD = NULL;
580
581 if (VD)
582 os << "the address of the local variable '" << VD->getName() << "'";
583 else
584 os << "the address of a local stack variable";
585 return true;
586 }
Anna Zakseb31a762012-01-04 23:54:01 +0000587
588 if (isa<StackArgumentsSpaceRegion>(MS)) {
Jordy Rose43859f62010-06-07 19:32:37 +0000589 const VarRegion *VR = dyn_cast<VarRegion>(MR);
590 const VarDecl *VD;
591 if (VR)
592 VD = VR->getDecl();
593 else
594 VD = NULL;
595
596 if (VD)
597 os << "the address of the parameter '" << VD->getName() << "'";
598 else
599 os << "the address of a parameter";
600 return true;
601 }
Anna Zakseb31a762012-01-04 23:54:01 +0000602
603 if (isa<GlobalsSpaceRegion>(MS)) {
Jordy Rose43859f62010-06-07 19:32:37 +0000604 const VarRegion *VR = dyn_cast<VarRegion>(MR);
605 const VarDecl *VD;
606 if (VR)
607 VD = VR->getDecl();
608 else
609 VD = NULL;
610
611 if (VD) {
612 if (VD->isStaticLocal())
613 os << "the address of the static variable '" << VD->getName() << "'";
614 else
615 os << "the address of the global variable '" << VD->getName() << "'";
616 } else
617 os << "the address of a global variable";
618 return true;
619 }
Anna Zakseb31a762012-01-04 23:54:01 +0000620
621 return false;
Jordy Rose43859f62010-06-07 19:32:37 +0000622 }
623 }
624}
625
626void MallocChecker::ReportBadFree(CheckerContext &C, SVal ArgVal,
Argyrios Kyrtzidis312dbec2011-02-28 01:26:35 +0000627 SourceRange range) const {
Ted Kremenekd048c6e2010-12-20 21:19:09 +0000628 if (ExplodedNode *N = C.generateSink()) {
Jordy Rose43859f62010-06-07 19:32:37 +0000629 if (!BT_BadFree)
Argyrios Kyrtzidis312dbec2011-02-28 01:26:35 +0000630 BT_BadFree.reset(new BuiltinBug("Bad free"));
Jordy Rose43859f62010-06-07 19:32:37 +0000631
Dylan Noblesmithf7ccbad2012-02-05 02:13:05 +0000632 SmallString<100> buf;
Jordy Rose43859f62010-06-07 19:32:37 +0000633 llvm::raw_svector_ostream os(buf);
634
635 const MemRegion *MR = ArgVal.getAsRegion();
636 if (MR) {
637 while (const ElementRegion *ER = dyn_cast<ElementRegion>(MR))
638 MR = ER->getSuperRegion();
639
640 // Special case for alloca()
641 if (isa<AllocaRegion>(MR))
642 os << "Argument to free() was allocated by alloca(), not malloc()";
643 else {
644 os << "Argument to free() is ";
645 if (SummarizeRegion(os, MR))
646 os << ", which is not memory allocated by malloc()";
647 else
648 os << "not memory allocated by malloc()";
649 }
650 } else {
651 os << "Argument to free() is ";
652 if (SummarizeValue(os, ArgVal))
653 os << ", which is not memory allocated by malloc()";
654 else
655 os << "not memory allocated by malloc()";
656 }
657
Anna Zakse172e8b2011-08-17 23:00:25 +0000658 BugReport *R = new BugReport(*BT_BadFree, os.str(), N);
Jordy Rose43859f62010-06-07 19:32:37 +0000659 R->addRange(range);
660 C.EmitReport(R);
661 }
662}
663
Anna Zaks40add292012-02-15 00:11:25 +0000664void MallocChecker::ReallocMem(CheckerContext &C, const CallExpr *CE,
665 bool FreesOnFail) const {
Ted Kremenek8bef8232012-01-26 21:29:00 +0000666 ProgramStateRef state = C.getState();
Ted Kremenekc8413fd2010-12-02 07:49:45 +0000667 const Expr *arg0Expr = CE->getArg(0);
Ted Kremenek5eca4822012-01-06 22:09:28 +0000668 const LocationContext *LCtx = C.getLocationContext();
Anna Zakse9ef5622012-02-10 01:11:00 +0000669 SVal Arg0Val = state->getSVal(arg0Expr, LCtx);
670 if (!isa<DefinedOrUnknownSVal>(Arg0Val))
671 return;
672 DefinedOrUnknownSVal arg0Val = cast<DefinedOrUnknownSVal>(Arg0Val);
Zhongxing Xud9c84c82009-12-12 12:29:38 +0000673
Ted Kremenek846eabd2010-12-01 21:28:31 +0000674 SValBuilder &svalBuilder = C.getSValBuilder();
Zhongxing Xud9c84c82009-12-12 12:29:38 +0000675
Ted Kremenekc8413fd2010-12-02 07:49:45 +0000676 DefinedOrUnknownSVal PtrEQ =
677 svalBuilder.evalEQ(state, arg0Val, svalBuilder.makeNull());
Zhongxing Xud9c84c82009-12-12 12:29:38 +0000678
Lenny Maiorani4d8d8032011-04-27 14:49:29 +0000679 // Get the size argument. If there is no size arg then give up.
680 const Expr *Arg1 = CE->getArg(1);
681 if (!Arg1)
682 return;
683
684 // Get the value of the size argument.
Anna Zakse9ef5622012-02-10 01:11:00 +0000685 SVal Arg1ValG = state->getSVal(Arg1, LCtx);
686 if (!isa<DefinedOrUnknownSVal>(Arg1ValG))
687 return;
688 DefinedOrUnknownSVal Arg1Val = cast<DefinedOrUnknownSVal>(Arg1ValG);
Lenny Maiorani4d8d8032011-04-27 14:49:29 +0000689
690 // Compare the size argument to 0.
691 DefinedOrUnknownSVal SizeZero =
692 svalBuilder.evalEQ(state, Arg1Val,
693 svalBuilder.makeIntValWithPtrWidth(0, false));
694
Anna Zaksc8bb3be2012-02-13 18:05:39 +0000695 ProgramStateRef StatePtrIsNull, StatePtrNotNull;
696 llvm::tie(StatePtrIsNull, StatePtrNotNull) = state->assume(PtrEQ);
697 ProgramStateRef StateSizeIsZero, StateSizeNotZero;
698 llvm::tie(StateSizeIsZero, StateSizeNotZero) = state->assume(SizeZero);
699 // We only assume exceptional states if they are definitely true; if the
700 // state is under-constrained, assume regular realloc behavior.
701 bool PrtIsNull = StatePtrIsNull && !StatePtrNotNull;
702 bool SizeIsZero = StateSizeIsZero && !StateSizeNotZero;
703
Lenny Maiorani4d8d8032011-04-27 14:49:29 +0000704 // If the ptr is NULL and the size is not 0, the call is equivalent to
705 // malloc(size).
Anna Zaksc8bb3be2012-02-13 18:05:39 +0000706 if ( PrtIsNull && !SizeIsZero) {
Ted Kremenek8bef8232012-01-26 21:29:00 +0000707 ProgramStateRef stateMalloc = MallocMemAux(C, CE, CE->getArg(1),
Anna Zaksc8bb3be2012-02-13 18:05:39 +0000708 UndefinedVal(), StatePtrIsNull);
Anna Zaks0bd6b112011-10-26 21:06:34 +0000709 C.addTransition(stateMalloc);
Anna Zaksc8bb3be2012-02-13 18:05:39 +0000710 return;
Zhongxing Xud9c84c82009-12-12 12:29:38 +0000711 }
712
Anna Zaksc8bb3be2012-02-13 18:05:39 +0000713 if (PrtIsNull && SizeIsZero)
714 return;
Zhongxing Xud9c84c82009-12-12 12:29:38 +0000715
Anna Zaks30838b92012-02-13 20:57:07 +0000716 // Get the from and to pointer symbols as in toPtr = realloc(fromPtr, size).
Anna Zaksc8bb3be2012-02-13 18:05:39 +0000717 assert(!PrtIsNull);
Anna Zaks30838b92012-02-13 20:57:07 +0000718 SymbolRef FromPtr = arg0Val.getAsSymbol();
719 SVal RetVal = state->getSVal(CE, LCtx);
720 SymbolRef ToPtr = RetVal.getAsSymbol();
721 if (!FromPtr || !ToPtr)
722 return;
Anna Zaksc8bb3be2012-02-13 18:05:39 +0000723
724 // If the size is 0, free the memory.
725 if (SizeIsZero)
726 if (ProgramStateRef stateFree = FreeMemAux(C, CE, StateSizeIsZero,0,false)){
Anna Zaksc8bb3be2012-02-13 18:05:39 +0000727 // The semantics of the return value are:
728 // If size was equal to 0, either NULL or a pointer suitable to be passed
729 // to free() is returned.
Anna Zaks40add292012-02-15 00:11:25 +0000730 stateFree = stateFree->set<ReallocPairs>(ToPtr,
731 ReallocPair(FromPtr, FreesOnFail));
Anna Zaksb276bd92012-02-14 00:26:13 +0000732 C.getSymbolManager().addSymbolDependency(ToPtr, FromPtr);
Anna Zaks30838b92012-02-13 20:57:07 +0000733 C.addTransition(stateFree);
Anna Zaksc8bb3be2012-02-13 18:05:39 +0000734 return;
735 }
736
737 // Default behavior.
738 if (ProgramStateRef stateFree = FreeMemAux(C, CE, state, 0, false)) {
739 // FIXME: We should copy the content of the original buffer.
740 ProgramStateRef stateRealloc = MallocMemAux(C, CE, CE->getArg(1),
741 UnknownVal(), stateFree);
Anna Zaks30838b92012-02-13 20:57:07 +0000742 if (!stateRealloc)
Anna Zaksc8bb3be2012-02-13 18:05:39 +0000743 return;
Anna Zaks40add292012-02-15 00:11:25 +0000744 stateRealloc = stateRealloc->set<ReallocPairs>(ToPtr,
745 ReallocPair(FromPtr, FreesOnFail));
Anna Zaksb276bd92012-02-14 00:26:13 +0000746 C.getSymbolManager().addSymbolDependency(ToPtr, FromPtr);
Anna Zaksc8bb3be2012-02-13 18:05:39 +0000747 C.addTransition(stateRealloc);
748 return;
Zhongxing Xud9c84c82009-12-12 12:29:38 +0000749 }
Zhongxing Xu589c0f22009-11-12 08:38:56 +0000750}
Zhongxing Xu7b760962009-11-13 07:25:27 +0000751
Zhongxing Xua5ce9662010-06-01 03:01:33 +0000752void MallocChecker::CallocMem(CheckerContext &C, const CallExpr *CE) {
Ted Kremenek8bef8232012-01-26 21:29:00 +0000753 ProgramStateRef state = C.getState();
Ted Kremenek846eabd2010-12-01 21:28:31 +0000754 SValBuilder &svalBuilder = C.getSValBuilder();
Ted Kremenek5eca4822012-01-06 22:09:28 +0000755 const LocationContext *LCtx = C.getLocationContext();
756 SVal count = state->getSVal(CE->getArg(0), LCtx);
757 SVal elementSize = state->getSVal(CE->getArg(1), LCtx);
Ted Kremenekc8413fd2010-12-02 07:49:45 +0000758 SVal TotalSize = svalBuilder.evalBinOp(state, BO_Mul, count, elementSize,
759 svalBuilder.getContext().getSizeType());
760 SVal zeroVal = svalBuilder.makeZeroVal(svalBuilder.getContext().CharTy);
Zhongxing Xua5ce9662010-06-01 03:01:33 +0000761
Anna Zaks0bd6b112011-10-26 21:06:34 +0000762 C.addTransition(MallocMemAux(C, CE, TotalSize, zeroVal, state));
Zhongxing Xua5ce9662010-06-01 03:01:33 +0000763}
764
Anna Zaksda046772012-02-11 21:02:40 +0000765void MallocChecker::reportLeak(SymbolRef Sym, ExplodedNode *N,
766 CheckerContext &C) const {
767 assert(N);
768 if (!BT_Leak) {
769 BT_Leak.reset(new BuiltinBug("Memory leak",
770 "Allocated memory never released. Potential memory leak."));
771 // Leaks should not be reported if they are post-dominated by a sink:
772 // (1) Sinks are higher importance bugs.
773 // (2) NoReturnFunctionChecker uses sink nodes to represent paths ending
774 // with __noreturn functions such as assert() or exit(). We choose not
775 // to report leaks on such paths.
776 BT_Leak->setSuppressOnSink(true);
777 }
778
779 BugReport *R = new BugReport(*BT_Leak, BT_Leak->getDescription(), N);
780 R->addVisitor(new MallocBugVisitor(Sym));
781 C.EmitReport(R);
782}
783
Argyrios Kyrtzidis312dbec2011-02-28 01:26:35 +0000784void MallocChecker::checkDeadSymbols(SymbolReaper &SymReaper,
785 CheckerContext &C) const
Ted Kremenekc8413fd2010-12-02 07:49:45 +0000786{
Zhongxing Xu173ff562010-08-15 08:19:57 +0000787 if (!SymReaper.hasDeadSymbols())
788 return;
Zhongxing Xufc7ac8f2009-11-13 07:48:11 +0000789
Ted Kremenek8bef8232012-01-26 21:29:00 +0000790 ProgramStateRef state = C.getState();
Zhongxing Xu173ff562010-08-15 08:19:57 +0000791 RegionStateTy RS = state->get<RegionState>();
Jordy Rose90760142010-08-18 04:33:47 +0000792 RegionStateTy::Factory &F = state->get_context<RegionState>();
Zhongxing Xu173ff562010-08-15 08:19:57 +0000793
Ted Kremenek217470e2011-07-28 23:07:51 +0000794 bool generateReport = false;
Anna Zaksf8c17b72012-02-09 06:48:19 +0000795 llvm::SmallVector<SymbolRef, 2> Errors;
Zhongxing Xu173ff562010-08-15 08:19:57 +0000796 for (RegionStateTy::iterator I = RS.begin(), E = RS.end(); I != E; ++I) {
797 if (SymReaper.isDead(I->first)) {
Anna Zaksf8c17b72012-02-09 06:48:19 +0000798 if (I->second.isAllocated()) {
Ted Kremenek217470e2011-07-28 23:07:51 +0000799 generateReport = true;
Anna Zaksf8c17b72012-02-09 06:48:19 +0000800 Errors.push_back(I->first);
801 }
Jordy Rose90760142010-08-18 04:33:47 +0000802 // Remove the dead symbol from the map.
Ted Kremenek3baf6722010-11-24 00:54:37 +0000803 RS = F.remove(RS, I->first);
Ted Kremenek217470e2011-07-28 23:07:51 +0000804
Zhongxing Xufc7ac8f2009-11-13 07:48:11 +0000805 }
806 }
Ted Kremenek217470e2011-07-28 23:07:51 +0000807
Anna Zaksc8bb3be2012-02-13 18:05:39 +0000808 // Cleanup the Realloc Pairs Map.
Anna Zaks40add292012-02-15 00:11:25 +0000809 ReallocMap RP = state->get<ReallocPairs>();
810 for (ReallocMap::iterator I = RP.begin(), E = RP.end(); I != E; ++I) {
811 if (SymReaper.isDead(I->first) ||
812 SymReaper.isDead(I->second.ReallocatedSym)) {
Anna Zaksc8bb3be2012-02-13 18:05:39 +0000813 state = state->remove<ReallocPairs>(I->first);
814 }
815 }
816
Anna Zaks0bd6b112011-10-26 21:06:34 +0000817 ExplodedNode *N = C.addTransition(state->set<RegionState>(RS));
Ted Kremenek217470e2011-07-28 23:07:51 +0000818
Ted Kremenek217470e2011-07-28 23:07:51 +0000819 if (N && generateReport) {
Anna Zaksf8c17b72012-02-09 06:48:19 +0000820 for (llvm::SmallVector<SymbolRef, 2>::iterator
Anna Zaksda046772012-02-11 21:02:40 +0000821 I = Errors.begin(), E = Errors.end(); I != E; ++I) {
822 reportLeak(*I, N, C);
Anna Zaksf8c17b72012-02-09 06:48:19 +0000823 }
Ted Kremenek217470e2011-07-28 23:07:51 +0000824 }
Zhongxing Xu7b760962009-11-13 07:25:27 +0000825}
Zhongxing Xu243fde92009-11-17 07:54:15 +0000826
Anna Zaksda046772012-02-11 21:02:40 +0000827void MallocChecker::checkEndPath(CheckerContext &C) const {
828 ProgramStateRef state = C.getState();
Jordy Rose09cef092010-08-18 04:26:59 +0000829 RegionStateTy M = state->get<RegionState>();
Zhongxing Xu243fde92009-11-17 07:54:15 +0000830
Jordy Rose09cef092010-08-18 04:26:59 +0000831 for (RegionStateTy::iterator I = M.begin(), E = M.end(); I != E; ++I) {
Zhongxing Xu243fde92009-11-17 07:54:15 +0000832 RefState RS = I->second;
833 if (RS.isAllocated()) {
Anna Zaksda046772012-02-11 21:02:40 +0000834 ExplodedNode *N = C.addTransition(state);
835 if (N)
836 reportLeak(I->first, N, C);
Zhongxing Xu243fde92009-11-17 07:54:15 +0000837 }
838 }
839}
Zhongxing Xu4985e3e2009-11-17 08:58:18 +0000840
Anna Zaks91c2a112012-02-08 23:16:56 +0000841bool MallocChecker::checkEscape(SymbolRef Sym, const Stmt *S,
842 CheckerContext &C) const {
Ted Kremenek8bef8232012-01-26 21:29:00 +0000843 ProgramStateRef state = C.getState();
Anna Zaks91c2a112012-02-08 23:16:56 +0000844 const RefState *RS = state->get<RegionState>(Sym);
845 if (!RS)
846 return false;
Zhongxing Xu4985e3e2009-11-17 08:58:18 +0000847
Anna Zaks91c2a112012-02-08 23:16:56 +0000848 if (RS->isAllocated()) {
849 state = state->set<RegionState>(Sym, RefState::getEscaped(S));
850 C.addTransition(state);
851 return true;
852 }
853 return false;
854}
855
Anna Zaks66c40402012-02-14 21:55:24 +0000856void MallocChecker::checkPreStmt(const CallExpr *CE, CheckerContext &C) const {
857 if (isMemFunction(C.getCalleeDecl(CE), C.getASTContext()))
858 return;
859
860 // Check use after free, when a freed pointer is passed to a call.
861 ProgramStateRef State = C.getState();
862 for (CallExpr::const_arg_iterator I = CE->arg_begin(),
863 E = CE->arg_end(); I != E; ++I) {
864 const Expr *A = *I;
865 if (A->getType().getTypePtr()->isAnyPointerType()) {
866 SymbolRef Sym = State->getSVal(A, C.getLocationContext()).getAsSymbol();
867 if (!Sym)
868 continue;
869 if (checkUseAfterFree(Sym, C, A))
870 return;
871 }
872 }
873}
874
Anna Zaks91c2a112012-02-08 23:16:56 +0000875void MallocChecker::checkPreStmt(const ReturnStmt *S, CheckerContext &C) const {
876 const Expr *E = S->getRetValue();
877 if (!E)
878 return;
Anna Zaks0860cd02012-02-11 21:44:39 +0000879
880 // Check if we are returning a symbol.
Anna Zaks91c2a112012-02-08 23:16:56 +0000881 SymbolRef Sym = C.getState()->getSVal(E, C.getLocationContext()).getAsSymbol();
Zhongxing Xu4985e3e2009-11-17 08:58:18 +0000882 if (!Sym)
883 return;
884
Anna Zaks0860cd02012-02-11 21:44:39 +0000885 // Check if we are returning freed memory.
Anna Zaksfe571602012-02-16 22:26:07 +0000886 if (checkUseAfterFree(Sym, C, E))
Anna Zaks15d0ae12012-02-11 23:46:36 +0000887 return;
Anna Zaks0860cd02012-02-11 21:44:39 +0000888
889 // Check if the symbol is escaping.
Anna Zaksfe571602012-02-16 22:26:07 +0000890 checkEscape(Sym, E, C);
Zhongxing Xu4985e3e2009-11-17 08:58:18 +0000891}
Zhongxing Xub94b81a2009-12-31 06:13:07 +0000892
Anna Zaks91c2a112012-02-08 23:16:56 +0000893bool MallocChecker::checkUseAfterFree(SymbolRef Sym, CheckerContext &C,
894 const Stmt *S) const {
895 assert(Sym);
896 const RefState *RS = C.getState()->get<RegionState>(Sym);
897 if (RS && RS->isReleased()) {
Anna Zaks15d0ae12012-02-11 23:46:36 +0000898 if (ExplodedNode *N = C.generateSink()) {
Anna Zaks91c2a112012-02-08 23:16:56 +0000899 if (!BT_UseFree)
Anna Zakse9ef5622012-02-10 01:11:00 +0000900 BT_UseFree.reset(new BuiltinBug("Use of dynamically allocated memory "
Anna Zaks91c2a112012-02-08 23:16:56 +0000901 "after it is freed."));
902
903 BugReport *R = new BugReport(*BT_UseFree, BT_UseFree->getDescription(),N);
904 if (S)
905 R->addRange(S->getSourceRange());
Anna Zaksff3b9fd2012-02-09 06:25:51 +0000906 R->addVisitor(new MallocBugVisitor(Sym));
Anna Zaks91c2a112012-02-08 23:16:56 +0000907 C.EmitReport(R);
908 return true;
909 }
910 }
911 return false;
912}
913
Zhongxing Xuc8023782010-03-10 04:58:55 +0000914// Check if the location is a freed symbolic region.
Anna Zaks390909c2011-10-06 00:43:15 +0000915void MallocChecker::checkLocation(SVal l, bool isLoad, const Stmt *S,
916 CheckerContext &C) const {
Zhongxing Xuc8023782010-03-10 04:58:55 +0000917 SymbolRef Sym = l.getLocSymbolInBase();
Anna Zaks91c2a112012-02-08 23:16:56 +0000918 if (Sym)
919 checkUseAfterFree(Sym, C);
Zhongxing Xuc8023782010-03-10 04:58:55 +0000920}
Ted Kremenekdd0e4902010-07-31 01:52:11 +0000921
Anna Zaks4fb54872012-02-11 21:02:35 +0000922//===----------------------------------------------------------------------===//
923// Check various ways a symbol can be invalidated.
924// TODO: This logic (the next 3 functions) is copied/similar to the
925// RetainRelease checker. We might want to factor this out.
926//===----------------------------------------------------------------------===//
Ted Kremenekdd0e4902010-07-31 01:52:11 +0000927
Anna Zaks4fb54872012-02-11 21:02:35 +0000928// Stop tracking symbols when a value escapes as a result of checkBind.
929// A value escapes in three possible cases:
930// (1) we are binding to something that is not a memory region.
931// (2) we are binding to a memregion that does not have stack storage
932// (3) we are binding to a memregion with stack storage that the store
933// does not understand.
934void MallocChecker::checkBind(SVal loc, SVal val, const Stmt *S,
935 CheckerContext &C) const {
936 // Are we storing to something that causes the value to "escape"?
937 bool escapes = true;
Ted Kremenek8bef8232012-01-26 21:29:00 +0000938 ProgramStateRef state = C.getState();
Ted Kremenekdd0e4902010-07-31 01:52:11 +0000939
Anna Zaks4fb54872012-02-11 21:02:35 +0000940 if (loc::MemRegionVal *regionLoc = dyn_cast<loc::MemRegionVal>(&loc)) {
941 escapes = !regionLoc->getRegion()->hasStackStorage();
Ted Kremenekdd0e4902010-07-31 01:52:11 +0000942
Anna Zaks4fb54872012-02-11 21:02:35 +0000943 if (!escapes) {
944 // To test (3), generate a new state with the binding added. If it is
945 // the same state, then it escapes (since the store cannot represent
946 // the binding).
947 escapes = (state == (state->bindLoc(*regionLoc, val)));
Ted Kremenekdd0e4902010-07-31 01:52:11 +0000948 }
Anna Zaksac593002012-02-16 03:40:57 +0000949 if (!escapes) {
950 // Case 4: We do not currently model what happens when a symbol is
951 // assigned to a struct field, so be conservative here and let the symbol
952 // go. TODO: This could definitely be improved upon.
953 escapes = !isa<VarRegion>(regionLoc->getRegion());
954 }
Ted Kremenekdd0e4902010-07-31 01:52:11 +0000955 }
Anna Zaks4fb54872012-02-11 21:02:35 +0000956
957 // If our store can represent the binding and we aren't storing to something
958 // that doesn't have local storage then just return and have the simulation
959 // state continue as is.
960 if (!escapes)
961 return;
962
963 // Otherwise, find all symbols referenced by 'val' that we are tracking
964 // and stop tracking them.
965 state = state->scanReachableSymbols<StopTrackingCallback>(val).getState();
966 C.addTransition(state);
967}
968
969// If a symbolic region is assumed to NULL (or another constant), stop tracking
970// it - assuming that allocation failed on this path.
971ProgramStateRef MallocChecker::evalAssume(ProgramStateRef state,
972 SVal Cond,
973 bool Assumption) const {
974 RegionStateTy RS = state->get<RegionState>();
Anna Zaks4fb54872012-02-11 21:02:35 +0000975 for (RegionStateTy::iterator I = RS.begin(), E = RS.end(); I != E; ++I) {
976 // If the symbol is assumed to NULL or another constant, this will
977 // return an APSInt*.
978 if (state->getSymVal(I.getKey()))
979 state = state->remove<RegionState>(I.getKey());
980 }
981
Anna Zaksc8bb3be2012-02-13 18:05:39 +0000982 // Realloc returns 0 when reallocation fails, which means that we should
983 // restore the state of the pointer being reallocated.
Anna Zaks40add292012-02-15 00:11:25 +0000984 ReallocMap RP = state->get<ReallocPairs>();
985 for (ReallocMap::iterator I = RP.begin(), E = RP.end(); I != E; ++I) {
Anna Zaksc8bb3be2012-02-13 18:05:39 +0000986 // If the symbol is assumed to NULL or another constant, this will
987 // return an APSInt*.
988 if (state->getSymVal(I.getKey())) {
Anna Zaks40add292012-02-15 00:11:25 +0000989 SymbolRef ReallocSym = I.getData().ReallocatedSym;
990 const RefState *RS = state->get<RegionState>(ReallocSym);
Anna Zaksc8bb3be2012-02-13 18:05:39 +0000991 if (RS) {
Anna Zaks40add292012-02-15 00:11:25 +0000992 if (RS->isReleased() && ! I.getData().IsFreeOnFailure)
993 state = state->set<RegionState>(ReallocSym,
Anna Zaksc8bb3be2012-02-13 18:05:39 +0000994 RefState::getAllocateUnchecked(RS->getStmt()));
Anna Zaksc8bb3be2012-02-13 18:05:39 +0000995 }
996 state = state->remove<ReallocPairs>(I.getKey());
997 }
998 }
999
Anna Zaks4fb54872012-02-11 21:02:35 +00001000 return state;
1001}
1002
Anna Zaks66c40402012-02-14 21:55:24 +00001003// Check if the function is not known to us. So, for example, we could
1004// conservatively assume it can free/reallocate it's pointer arguments.
1005// (We assume that the pointers cannot escape through calls to system
1006// functions not handled by this checker.)
1007bool MallocChecker::hasUnknownBehavior(const FunctionDecl *FD,
1008 ProgramStateRef State) const {
1009 ASTContext &ASTC = State->getStateManager().getContext();
1010
1011 // If it's one of the allocation functions we can reason about, we model it's
1012 // behavior explicitly.
1013 if (isMemFunction(FD, ASTC)) {
1014 return false;
1015 }
1016
1017 // If it's a system call, we know it does not free the memory.
1018 SourceManager &SM = ASTC.getSourceManager();
1019 if (SM.isInSystemHeader(FD->getLocation())) {
1020 return false;
1021 }
1022
1023 // Otherwise, assume that the function can free memory.
1024 return true;
1025}
1026
Anna Zaks4fb54872012-02-11 21:02:35 +00001027// If the symbol we are tracking is invalidated, but not explicitly (ex: the &p
1028// escapes, when we are tracking p), do not track the symbol as we cannot reason
1029// about it anymore.
1030ProgramStateRef
Anna Zaks66c40402012-02-14 21:55:24 +00001031MallocChecker::checkRegionChanges(ProgramStateRef State,
Anna Zaks4fb54872012-02-11 21:02:35 +00001032 const StoreManager::InvalidatedSymbols *invalidated,
1033 ArrayRef<const MemRegion *> ExplicitRegions,
Anna Zaks66c40402012-02-14 21:55:24 +00001034 ArrayRef<const MemRegion *> Regions,
1035 const CallOrObjCMessage *Call) const {
Anna Zaks4fb54872012-02-11 21:02:35 +00001036 if (!invalidated)
Anna Zaks66c40402012-02-14 21:55:24 +00001037 return State;
Anna Zaks4fb54872012-02-11 21:02:35 +00001038 llvm::SmallPtrSet<SymbolRef, 8> WhitelistedSymbols;
Anna Zaks66c40402012-02-14 21:55:24 +00001039
Anna Zaks1d6cc6a2012-02-15 02:12:00 +00001040 const FunctionDecl *FD = (Call ?
1041 dyn_cast_or_null<FunctionDecl>(Call->getDecl()) :0);
Anna Zaks66c40402012-02-14 21:55:24 +00001042
1043 // If it's a call which might free or reallocate memory, we assume that all
1044 // regions (explicit and implicit) escaped. Otherwise, whitelist explicit
1045 // pointers; we still can track them.
1046 if (!(FD && hasUnknownBehavior(FD, State))) {
1047 for (ArrayRef<const MemRegion *>::iterator I = ExplicitRegions.begin(),
1048 E = ExplicitRegions.end(); I != E; ++I) {
1049 if (const SymbolicRegion *R = (*I)->StripCasts()->getAs<SymbolicRegion>())
1050 WhitelistedSymbols.insert(R->getSymbol());
1051 }
Anna Zaks4fb54872012-02-11 21:02:35 +00001052 }
1053
1054 for (StoreManager::InvalidatedSymbols::const_iterator I=invalidated->begin(),
1055 E = invalidated->end(); I!=E; ++I) {
1056 SymbolRef sym = *I;
1057 if (WhitelistedSymbols.count(sym))
1058 continue;
Anna Zaks66c40402012-02-14 21:55:24 +00001059 // The symbol escaped.
1060 if (const RefState *RS = State->get<RegionState>(sym))
1061 State = State->set<RegionState>(sym, RefState::getEscaped(RS->getStmt()));
Anna Zaks4fb54872012-02-11 21:02:35 +00001062 }
Anna Zaks66c40402012-02-14 21:55:24 +00001063 return State;
Ted Kremenekdd0e4902010-07-31 01:52:11 +00001064}
Argyrios Kyrtzidis312dbec2011-02-28 01:26:35 +00001065
Anna Zaksff3b9fd2012-02-09 06:25:51 +00001066PathDiagnosticPiece *
1067MallocChecker::MallocBugVisitor::VisitNode(const ExplodedNode *N,
1068 const ExplodedNode *PrevN,
1069 BugReporterContext &BRC,
1070 BugReport &BR) {
1071 const RefState *RS = N->getState()->get<RegionState>(Sym);
1072 const RefState *RSPrev = PrevN->getState()->get<RegionState>(Sym);
1073 if (!RS && !RSPrev)
1074 return 0;
1075
Anna Zaksfe571602012-02-16 22:26:07 +00001076 const Stmt *S = 0;
1077 const char *Msg = 0;
1078
1079 // Retrieve the associated statement.
1080 ProgramPoint ProgLoc = N->getLocation();
1081 if (isa<StmtPoint>(ProgLoc))
1082 S = cast<StmtPoint>(ProgLoc).getStmt();
1083 // If an assumption was made on a branch, it should be caught
1084 // here by looking at the state transition.
1085 if (isa<BlockEdge>(ProgLoc)) {
1086 const CFGBlock *srcBlk = cast<BlockEdge>(ProgLoc).getSrc();
1087 S = srcBlk->getTerminator();
1088 }
1089 if (!S)
Anna Zaksff3b9fd2012-02-09 06:25:51 +00001090 return 0;
Anna Zaksff3b9fd2012-02-09 06:25:51 +00001091
1092 // Find out if this is an interesting point and what is the kind.
Anna Zaksfe571602012-02-16 22:26:07 +00001093 if (Mode == Normal) {
1094 if (isAllocated(RS, RSPrev, S))
1095 Msg = "Memory is allocated";
1096 else if (isReleased(RS, RSPrev, S))
1097 Msg = "Memory is released";
1098 else if (isReallocFailedCheck(RS, RSPrev, S)) {
1099 Mode = ReallocationFailed;
1100 Msg = "Reallocation failed";
1101 }
1102
1103 // We are in a special mode if a reallocation failed later in the path.
1104 } else if (Mode == ReallocationFailed) {
1105 // Generate a special diagnostic for the first realloc we find.
1106 if (!isAllocated(RS, RSPrev, S) && !isReleased(RS, RSPrev, S))
1107 return 0;
1108
1109 // Check that the name of the function is realloc.
1110 const CallExpr *CE = dyn_cast<CallExpr>(S);
1111 if (!CE)
1112 return 0;
1113 const FunctionDecl *funDecl = CE->getDirectCallee();
1114 if (!funDecl)
1115 return 0;
1116 StringRef FunName = funDecl->getName();
1117 if (!(FunName.equals("realloc") || FunName.equals("reallocf")))
1118 return 0;
1119 Msg = "Attempt to reallocate memory";
1120 Mode = Normal;
1121 }
1122
Anna Zaksff3b9fd2012-02-09 06:25:51 +00001123 if (!Msg)
1124 return 0;
1125
1126 // Generate the extra diagnostic.
Anna Zaksfe571602012-02-16 22:26:07 +00001127 PathDiagnosticLocation Pos(S, BRC.getSourceManager(),
Anna Zaksff3b9fd2012-02-09 06:25:51 +00001128 N->getLocationContext());
1129 return new PathDiagnosticEventPiece(Pos, Msg);
1130}
1131
1132
Anna Zaks231361a2012-02-08 23:16:52 +00001133#define REGISTER_CHECKER(name) \
1134void ento::register##name(CheckerManager &mgr) {\
1135 mgr.registerChecker<MallocChecker>()->Filter.C##name = true;\
Argyrios Kyrtzidis312dbec2011-02-28 01:26:35 +00001136}
Anna Zaks231361a2012-02-08 23:16:52 +00001137
1138REGISTER_CHECKER(MallocPessimistic)
1139REGISTER_CHECKER(MallocOptimistic)