Anna Zaks | 5c5bf9b | 2011-11-16 19:58:13 +0000 | [diff] [blame] | 1 | //== GenericTaintChecker.cpp ----------------------------------- -*- C++ -*--=// |
| 2 | // |
| 3 | // The LLVM Compiler Infrastructure |
| 4 | // |
| 5 | // This file is distributed under the University of Illinois Open Source |
| 6 | // License. See LICENSE.TXT for details. |
| 7 | // |
| 8 | //===----------------------------------------------------------------------===// |
| 9 | // |
| 10 | // This checker defines the attack surface for generic taint propagation. |
| 11 | // |
| 12 | // The taint information produced by it might be useful to other checkers. For |
| 13 | // example, checkers should report errors which involve tainted data more |
| 14 | // aggressively, even if the involved symbols are under constrained. |
| 15 | // |
| 16 | //===----------------------------------------------------------------------===// |
| 17 | #include "ClangSACheckers.h" |
Chandler Carruth | 3a02247 | 2012-12-04 09:13:33 +0000 | [diff] [blame] | 18 | #include "clang/AST/Attr.h" |
| 19 | #include "clang/Basic/Builtins.h" |
| 20 | #include "clang/StaticAnalyzer/Core/BugReporter/BugType.h" |
Anna Zaks | 5c5bf9b | 2011-11-16 19:58:13 +0000 | [diff] [blame] | 21 | #include "clang/StaticAnalyzer/Core/Checker.h" |
| 22 | #include "clang/StaticAnalyzer/Core/CheckerManager.h" |
| 23 | #include "clang/StaticAnalyzer/Core/PathSensitive/CheckerContext.h" |
Anna Zaks | 3b0ab20 | 2011-12-17 00:26:34 +0000 | [diff] [blame] | 24 | #include "clang/StaticAnalyzer/Core/PathSensitive/ProgramStateTrait.h" |
Anna Zaks | b3fa8d7 | 2012-01-12 02:22:34 +0000 | [diff] [blame] | 25 | #include <climits> |
Anna Zaks | 5c5bf9b | 2011-11-16 19:58:13 +0000 | [diff] [blame] | 26 | |
| 27 | using namespace clang; |
| 28 | using namespace ento; |
| 29 | |
| 30 | namespace { |
Anna Zaks | 099fe3f | 2011-12-14 00:56:18 +0000 | [diff] [blame] | 31 | class GenericTaintChecker : public Checker< check::PostStmt<CallExpr>, |
Anna Zaks | 3b0ab20 | 2011-12-17 00:26:34 +0000 | [diff] [blame] | 32 | check::PreStmt<CallExpr> > { |
| 33 | public: |
Anna Zaks | 0244cd7 | 2012-01-14 02:48:40 +0000 | [diff] [blame] | 34 | static void *getTag() { static int Tag; return &Tag; } |
| 35 | |
| 36 | void checkPostStmt(const CallExpr *CE, CheckerContext &C) const; |
Anna Zaks | 0244cd7 | 2012-01-14 02:48:40 +0000 | [diff] [blame] | 37 | |
| 38 | void checkPreStmt(const CallExpr *CE, CheckerContext &C) const; |
Anna Zaks | 5c5bf9b | 2011-11-16 19:58:13 +0000 | [diff] [blame] | 39 | |
Anna Zaks | 3b0ab20 | 2011-12-17 00:26:34 +0000 | [diff] [blame] | 40 | private: |
Anna Zaks | bf74051 | 2012-01-24 19:32:25 +0000 | [diff] [blame] | 41 | static const unsigned InvalidArgIndex = UINT_MAX; |
| 42 | /// Denotes the return vale. |
| 43 | static const unsigned ReturnValueIndex = UINT_MAX - 1; |
Anna Zaks | 0244cd7 | 2012-01-14 02:48:40 +0000 | [diff] [blame] | 44 | |
Ahmed Charles | b898432 | 2014-03-07 20:03:18 +0000 | [diff] [blame] | 45 | mutable std::unique_ptr<BugType> BT; |
Anna Zaks | 5d324e5 | 2012-01-18 02:45:07 +0000 | [diff] [blame] | 46 | inline void initBugType() const { |
| 47 | if (!BT) |
Alexander Kornienko | 4aca9b1 | 2014-02-11 21:49:21 +0000 | [diff] [blame] | 48 | BT.reset(new BugType(this, "Use of Untrusted Data", "Untrusted Data")); |
Anna Zaks | 5d324e5 | 2012-01-18 02:45:07 +0000 | [diff] [blame] | 49 | } |
Anna Zaks | 457c687 | 2011-11-18 02:26:36 +0000 | [diff] [blame] | 50 | |
Anna Zaks | b3fa8d7 | 2012-01-12 02:22:34 +0000 | [diff] [blame] | 51 | /// \brief Catch taint related bugs. Check if tainted data is passed to a |
| 52 | /// system call etc. |
Anna Zaks | 126a2ef | 2012-01-07 02:33:10 +0000 | [diff] [blame] | 53 | bool checkPre(const CallExpr *CE, CheckerContext &C) const; |
| 54 | |
Anna Zaks | b3fa8d7 | 2012-01-12 02:22:34 +0000 | [diff] [blame] | 55 | /// \brief Add taint sources on a pre-visit. |
| 56 | void addSourcesPre(const CallExpr *CE, CheckerContext &C) const; |
| 57 | |
| 58 | /// \brief Propagate taint generated at pre-visit. |
| 59 | bool propagateFromPre(const CallExpr *CE, CheckerContext &C) const; |
| 60 | |
| 61 | /// \brief Add taint sources on a post visit. |
| 62 | void addSourcesPost(const CallExpr *CE, CheckerContext &C) const; |
| 63 | |
Anna Zaks | bf74051 | 2012-01-24 19:32:25 +0000 | [diff] [blame] | 64 | /// Check if the region the expression evaluates to is the standard input, |
| 65 | /// and thus, is tainted. |
| 66 | static bool isStdin(const Expr *E, CheckerContext &C); |
| 67 | |
Artem Dergachev | eed7a31 | 2017-05-29 15:42:56 +0000 | [diff] [blame] | 68 | /// \brief Given a pointer argument, return the value it points to. |
| 69 | static Optional<SVal> getPointedToSVal(CheckerContext &C, const Expr *Arg); |
Anna Zaks | 5c5bf9b | 2011-11-16 19:58:13 +0000 | [diff] [blame] | 70 | |
Anna Zaks | 3b0ab20 | 2011-12-17 00:26:34 +0000 | [diff] [blame] | 71 | /// Functions defining the attack surface. |
Ted Kremenek | 49b1e38 | 2012-01-26 21:29:00 +0000 | [diff] [blame] | 72 | typedef ProgramStateRef (GenericTaintChecker::*FnCheck)(const CallExpr *, |
Anna Zaks | 3b0ab20 | 2011-12-17 00:26:34 +0000 | [diff] [blame] | 73 | CheckerContext &C) const; |
Ted Kremenek | 49b1e38 | 2012-01-26 21:29:00 +0000 | [diff] [blame] | 74 | ProgramStateRef postScanf(const CallExpr *CE, CheckerContext &C) const; |
| 75 | ProgramStateRef postSocket(const CallExpr *CE, CheckerContext &C) const; |
| 76 | ProgramStateRef postRetTaint(const CallExpr *CE, CheckerContext &C) const; |
Anna Zaks | 3b0ab20 | 2011-12-17 00:26:34 +0000 | [diff] [blame] | 77 | |
| 78 | /// Taint the scanned input if the file is tainted. |
Ted Kremenek | 49b1e38 | 2012-01-26 21:29:00 +0000 | [diff] [blame] | 79 | ProgramStateRef preFscanf(const CallExpr *CE, CheckerContext &C) const; |
Anna Zaks | 5c5bf9b | 2011-11-16 19:58:13 +0000 | [diff] [blame] | 80 | |
Anna Zaks | 126a2ef | 2012-01-07 02:33:10 +0000 | [diff] [blame] | 81 | /// Check for CWE-134: Uncontrolled Format String. |
Anna Zaks | 0244cd7 | 2012-01-14 02:48:40 +0000 | [diff] [blame] | 82 | static const char MsgUncontrolledFormatString[]; |
Anna Zaks | 126a2ef | 2012-01-07 02:33:10 +0000 | [diff] [blame] | 83 | bool checkUncontrolledFormatString(const CallExpr *CE, |
| 84 | CheckerContext &C) const; |
| 85 | |
Anna Zaks | 0244cd7 | 2012-01-14 02:48:40 +0000 | [diff] [blame] | 86 | /// Check for: |
| 87 | /// CERT/STR02-C. "Sanitize data passed to complex subsystems" |
| 88 | /// CWE-78, "Failure to Sanitize Data into an OS Command" |
| 89 | static const char MsgSanitizeSystemArgs[]; |
| 90 | bool checkSystemCall(const CallExpr *CE, StringRef Name, |
| 91 | CheckerContext &C) const; |
Anna Zaks | 3b0ab20 | 2011-12-17 00:26:34 +0000 | [diff] [blame] | 92 | |
Anna Zaks | 560dbe9 | 2012-01-18 02:45:11 +0000 | [diff] [blame] | 93 | /// Check if tainted data is used as a buffer size ins strn.. functions, |
| 94 | /// and allocators. |
| 95 | static const char MsgTaintedBufferSize[]; |
| 96 | bool checkTaintedBufferSize(const CallExpr *CE, const FunctionDecl *FDecl, |
| 97 | CheckerContext &C) const; |
| 98 | |
Anna Zaks | 0244cd7 | 2012-01-14 02:48:40 +0000 | [diff] [blame] | 99 | /// Generate a report if the expression is tainted or points to tainted data. |
| 100 | bool generateReportIfTainted(const Expr *E, const char Msg[], |
| 101 | CheckerContext &C) const; |
Ted Kremenek | 3a0678e | 2015-09-08 03:50:52 +0000 | [diff] [blame] | 102 | |
Anna Zaks | d4e43ae | 2017-03-09 00:01:07 +0000 | [diff] [blame] | 103 | /// The bug visitor prints a diagnostic message at the location where a given |
| 104 | /// variable was tainted. |
| 105 | class TaintBugVisitor |
| 106 | : public BugReporterVisitorImpl<TaintBugVisitor> { |
| 107 | private: |
| 108 | const SVal V; |
| 109 | |
| 110 | public: |
| 111 | TaintBugVisitor(const SVal V) : V(V) {} |
| 112 | void Profile(llvm::FoldingSetNodeID &ID) const override { ID.Add(V); } |
| 113 | |
| 114 | std::shared_ptr<PathDiagnosticPiece> VisitNode(const ExplodedNode *N, |
| 115 | const ExplodedNode *PrevN, |
| 116 | BugReporterContext &BRC, |
| 117 | BugReport &BR) override; |
| 118 | }; |
Ted Kremenek | 3a0678e | 2015-09-08 03:50:52 +0000 | [diff] [blame] | 119 | |
Dmitri Gribenko | f857950 | 2013-01-12 19:30:44 +0000 | [diff] [blame] | 120 | typedef SmallVector<unsigned, 2> ArgVector; |
Anna Zaks | 3b0ab20 | 2011-12-17 00:26:34 +0000 | [diff] [blame] | 121 | |
Anna Zaks | 3666d2c | 2012-01-17 00:37:02 +0000 | [diff] [blame] | 122 | /// \brief A struct used to specify taint propagation rules for a function. |
| 123 | /// |
| 124 | /// If any of the possible taint source arguments is tainted, all of the |
| 125 | /// destination arguments should also be tainted. Use InvalidArgIndex in the |
| 126 | /// src list to specify that all of the arguments can introduce taint. Use |
| 127 | /// InvalidArgIndex in the dst arguments to signify that all the non-const |
| 128 | /// pointer and reference arguments might be tainted on return. If |
| 129 | /// ReturnValueIndex is added to the dst list, the return value will be |
| 130 | /// tainted. |
| 131 | struct TaintPropagationRule { |
| 132 | /// List of arguments which can be taint sources and should be checked. |
| 133 | ArgVector SrcArgs; |
| 134 | /// List of arguments which should be tainted on function return. |
| 135 | ArgVector DstArgs; |
Anna Zaks | 5d324e5 | 2012-01-18 02:45:07 +0000 | [diff] [blame] | 136 | // TODO: Check if using other data structures would be more optimal. |
Anna Zaks | 3666d2c | 2012-01-17 00:37:02 +0000 | [diff] [blame] | 137 | |
| 138 | TaintPropagationRule() {} |
| 139 | |
Anna Zaks | 5d324e5 | 2012-01-18 02:45:07 +0000 | [diff] [blame] | 140 | TaintPropagationRule(unsigned SArg, |
| 141 | unsigned DArg, bool TaintRet = false) { |
Anna Zaks | 3666d2c | 2012-01-17 00:37:02 +0000 | [diff] [blame] | 142 | SrcArgs.push_back(SArg); |
| 143 | DstArgs.push_back(DArg); |
Anna Zaks | 5d324e5 | 2012-01-18 02:45:07 +0000 | [diff] [blame] | 144 | if (TaintRet) |
| 145 | DstArgs.push_back(ReturnValueIndex); |
Anna Zaks | 3666d2c | 2012-01-17 00:37:02 +0000 | [diff] [blame] | 146 | } |
| 147 | |
Anna Zaks | 5d324e5 | 2012-01-18 02:45:07 +0000 | [diff] [blame] | 148 | TaintPropagationRule(unsigned SArg1, unsigned SArg2, |
| 149 | unsigned DArg, bool TaintRet = false) { |
| 150 | SrcArgs.push_back(SArg1); |
| 151 | SrcArgs.push_back(SArg2); |
| 152 | DstArgs.push_back(DArg); |
| 153 | if (TaintRet) |
| 154 | DstArgs.push_back(ReturnValueIndex); |
| 155 | } |
| 156 | |
| 157 | /// Get the propagation rule for a given function. |
| 158 | static TaintPropagationRule |
| 159 | getTaintPropagationRule(const FunctionDecl *FDecl, |
| 160 | StringRef Name, |
| 161 | CheckerContext &C); |
| 162 | |
Anna Zaks | 3666d2c | 2012-01-17 00:37:02 +0000 | [diff] [blame] | 163 | inline void addSrcArg(unsigned A) { SrcArgs.push_back(A); } |
| 164 | inline void addDstArg(unsigned A) { DstArgs.push_back(A); } |
| 165 | |
Anna Zaks | 5d324e5 | 2012-01-18 02:45:07 +0000 | [diff] [blame] | 166 | inline bool isNull() const { return SrcArgs.empty(); } |
| 167 | |
| 168 | inline bool isDestinationArgument(unsigned ArgNum) const { |
| 169 | return (std::find(DstArgs.begin(), |
| 170 | DstArgs.end(), ArgNum) != DstArgs.end()); |
| 171 | } |
Anna Zaks | 3666d2c | 2012-01-17 00:37:02 +0000 | [diff] [blame] | 172 | |
Anna Zaks | bf74051 | 2012-01-24 19:32:25 +0000 | [diff] [blame] | 173 | static inline bool isTaintedOrPointsToTainted(const Expr *E, |
Ted Kremenek | 49b1e38 | 2012-01-26 21:29:00 +0000 | [diff] [blame] | 174 | ProgramStateRef State, |
Anna Zaks | bf74051 | 2012-01-24 19:32:25 +0000 | [diff] [blame] | 175 | CheckerContext &C) { |
Artem Dergachev | eed7a31 | 2017-05-29 15:42:56 +0000 | [diff] [blame] | 176 | if (State->isTainted(E, C.getLocationContext()) || isStdin(E, C)) |
| 177 | return true; |
| 178 | |
| 179 | if (!E->getType().getTypePtr()->isPointerType()) |
| 180 | return false; |
| 181 | |
| 182 | Optional<SVal> V = getPointedToSVal(C, E); |
| 183 | return (V && State->isTainted(*V)); |
Anna Zaks | bf74051 | 2012-01-24 19:32:25 +0000 | [diff] [blame] | 184 | } |
| 185 | |
Anna Zaks | 7f6a6b7 | 2012-01-18 02:45:13 +0000 | [diff] [blame] | 186 | /// \brief Pre-process a function which propagates taint according to the |
| 187 | /// taint rule. |
Ted Kremenek | 49b1e38 | 2012-01-26 21:29:00 +0000 | [diff] [blame] | 188 | ProgramStateRef process(const CallExpr *CE, CheckerContext &C) const; |
Anna Zaks | 7f6a6b7 | 2012-01-18 02:45:13 +0000 | [diff] [blame] | 189 | |
| 190 | }; |
Anna Zaks | 5c5bf9b | 2011-11-16 19:58:13 +0000 | [diff] [blame] | 191 | }; |
Anna Zaks | 5d324e5 | 2012-01-18 02:45:07 +0000 | [diff] [blame] | 192 | |
| 193 | const unsigned GenericTaintChecker::ReturnValueIndex; |
| 194 | const unsigned GenericTaintChecker::InvalidArgIndex; |
| 195 | |
Anna Zaks | 0244cd7 | 2012-01-14 02:48:40 +0000 | [diff] [blame] | 196 | const char GenericTaintChecker::MsgUncontrolledFormatString[] = |
Anna Zaks | 3705a1e | 2012-02-22 02:35:58 +0000 | [diff] [blame] | 197 | "Untrusted data is used as a format string " |
| 198 | "(CWE-134: Uncontrolled Format String)"; |
Anna Zaks | 0244cd7 | 2012-01-14 02:48:40 +0000 | [diff] [blame] | 199 | |
| 200 | const char GenericTaintChecker::MsgSanitizeSystemArgs[] = |
Anna Zaks | 3705a1e | 2012-02-22 02:35:58 +0000 | [diff] [blame] | 201 | "Untrusted data is passed to a system call " |
Anna Zaks | 0244cd7 | 2012-01-14 02:48:40 +0000 | [diff] [blame] | 202 | "(CERT/STR02-C. Sanitize data passed to complex subsystems)"; |
Anna Zaks | 560dbe9 | 2012-01-18 02:45:11 +0000 | [diff] [blame] | 203 | |
| 204 | const char GenericTaintChecker::MsgTaintedBufferSize[] = |
Anna Zaks | 3705a1e | 2012-02-22 02:35:58 +0000 | [diff] [blame] | 205 | "Untrusted data is used to specify the buffer size " |
Anna Zaks | 560dbe9 | 2012-01-18 02:45:11 +0000 | [diff] [blame] | 206 | "(CERT/STR31-C. Guarantee that storage for strings has sufficient space for " |
| 207 | "character data and the null terminator)"; |
| 208 | |
| 209 | } // end of anonymous namespace |
Anna Zaks | 5c5bf9b | 2011-11-16 19:58:13 +0000 | [diff] [blame] | 210 | |
Anna Zaks | b3fa8d7 | 2012-01-12 02:22:34 +0000 | [diff] [blame] | 211 | /// A set which is used to pass information from call pre-visit instruction |
| 212 | /// to the call post-visit. The values are unsigned integers, which are either |
| 213 | /// ReturnValueIndex, or indexes of the pointer/reference argument, which |
| 214 | /// points to data, which should be tainted on return. |
Jordan Rose | 0c153cb | 2012-11-02 01:54:06 +0000 | [diff] [blame] | 215 | REGISTER_SET_WITH_PROGRAMSTATE(TaintArgsOnPostVisit, unsigned) |
Anna Zaks | 3b0ab20 | 2011-12-17 00:26:34 +0000 | [diff] [blame] | 216 | |
Anna Zaks | d4e43ae | 2017-03-09 00:01:07 +0000 | [diff] [blame] | 217 | std::shared_ptr<PathDiagnosticPiece> |
| 218 | GenericTaintChecker::TaintBugVisitor::VisitNode(const ExplodedNode *N, |
| 219 | const ExplodedNode *PrevN, BugReporterContext &BRC, BugReport &BR) { |
| 220 | |
| 221 | // Find the ExplodedNode where the taint was first introduced |
| 222 | if (!N->getState()->isTainted(V) || PrevN->getState()->isTainted(V)) |
| 223 | return nullptr; |
| 224 | |
| 225 | const Stmt *S = PathDiagnosticLocation::getStmt(N); |
| 226 | if (!S) |
| 227 | return nullptr; |
| 228 | |
| 229 | const LocationContext *NCtx = N->getLocationContext(); |
| 230 | PathDiagnosticLocation L = |
| 231 | PathDiagnosticLocation::createBegin(S, BRC.getSourceManager(), NCtx); |
| 232 | if (!L.isValid() || !L.asLocation().isValid()) |
| 233 | return nullptr; |
| 234 | |
| 235 | return std::make_shared<PathDiagnosticEventPiece>( |
| 236 | L, "Taint originated here"); |
| 237 | } |
| 238 | |
Anna Zaks | 5d324e5 | 2012-01-18 02:45:07 +0000 | [diff] [blame] | 239 | GenericTaintChecker::TaintPropagationRule |
| 240 | GenericTaintChecker::TaintPropagationRule::getTaintPropagationRule( |
| 241 | const FunctionDecl *FDecl, |
| 242 | StringRef Name, |
| 243 | CheckerContext &C) { |
Enrico Pertoso | 4432d87 | 2015-06-03 09:10:58 +0000 | [diff] [blame] | 244 | // TODO: Currently, we might lose precision here: we always mark a return |
Anna Zaks | bf74051 | 2012-01-24 19:32:25 +0000 | [diff] [blame] | 245 | // value as tainted even if it's just a pointer, pointing to tainted data. |
| 246 | |
Anna Zaks | 5d324e5 | 2012-01-18 02:45:07 +0000 | [diff] [blame] | 247 | // Check for exact name match for functions without builtin substitutes. |
| 248 | TaintPropagationRule Rule = llvm::StringSwitch<TaintPropagationRule>(Name) |
| 249 | .Case("atoi", TaintPropagationRule(0, ReturnValueIndex)) |
| 250 | .Case("atol", TaintPropagationRule(0, ReturnValueIndex)) |
| 251 | .Case("atoll", TaintPropagationRule(0, ReturnValueIndex)) |
Anna Zaks | bf74051 | 2012-01-24 19:32:25 +0000 | [diff] [blame] | 252 | .Case("getc", TaintPropagationRule(0, ReturnValueIndex)) |
| 253 | .Case("fgetc", TaintPropagationRule(0, ReturnValueIndex)) |
| 254 | .Case("getc_unlocked", TaintPropagationRule(0, ReturnValueIndex)) |
| 255 | .Case("getw", TaintPropagationRule(0, ReturnValueIndex)) |
| 256 | .Case("toupper", TaintPropagationRule(0, ReturnValueIndex)) |
| 257 | .Case("tolower", TaintPropagationRule(0, ReturnValueIndex)) |
| 258 | .Case("strchr", TaintPropagationRule(0, ReturnValueIndex)) |
| 259 | .Case("strrchr", TaintPropagationRule(0, ReturnValueIndex)) |
Anna Zaks | 3b754b2 | 2012-01-20 00:11:19 +0000 | [diff] [blame] | 260 | .Case("read", TaintPropagationRule(0, 2, 1, true)) |
| 261 | .Case("pread", TaintPropagationRule(InvalidArgIndex, 1, true)) |
Anna Zaks | bf74051 | 2012-01-24 19:32:25 +0000 | [diff] [blame] | 262 | .Case("gets", TaintPropagationRule(InvalidArgIndex, 0, true)) |
| 263 | .Case("fgets", TaintPropagationRule(2, 0, true)) |
| 264 | .Case("getline", TaintPropagationRule(2, 0)) |
| 265 | .Case("getdelim", TaintPropagationRule(3, 0)) |
| 266 | .Case("fgetln", TaintPropagationRule(0, ReturnValueIndex)) |
Anna Zaks | 5d324e5 | 2012-01-18 02:45:07 +0000 | [diff] [blame] | 267 | .Default(TaintPropagationRule()); |
| 268 | |
| 269 | if (!Rule.isNull()) |
| 270 | return Rule; |
| 271 | |
| 272 | // Check if it's one of the memory setting/copying functions. |
| 273 | // This check is specialized but faster then calling isCLibraryFunction. |
| 274 | unsigned BId = 0; |
| 275 | if ( (BId = FDecl->getMemoryFunctionKind()) ) |
| 276 | switch(BId) { |
| 277 | case Builtin::BImemcpy: |
| 278 | case Builtin::BImemmove: |
| 279 | case Builtin::BIstrncpy: |
| 280 | case Builtin::BIstrncat: |
| 281 | return TaintPropagationRule(1, 2, 0, true); |
Anna Zaks | 5d324e5 | 2012-01-18 02:45:07 +0000 | [diff] [blame] | 282 | case Builtin::BIstrlcpy: |
| 283 | case Builtin::BIstrlcat: |
| 284 | return TaintPropagationRule(1, 2, 0, false); |
Anna Zaks | 5d324e5 | 2012-01-18 02:45:07 +0000 | [diff] [blame] | 285 | case Builtin::BIstrndup: |
| 286 | return TaintPropagationRule(0, 1, ReturnValueIndex); |
Anna Zaks | 5d324e5 | 2012-01-18 02:45:07 +0000 | [diff] [blame] | 287 | |
| 288 | default: |
| 289 | break; |
| 290 | }; |
| 291 | |
| 292 | // Process all other functions which could be defined as builtins. |
| 293 | if (Rule.isNull()) { |
| 294 | if (C.isCLibraryFunction(FDecl, "snprintf") || |
| 295 | C.isCLibraryFunction(FDecl, "sprintf")) |
| 296 | return TaintPropagationRule(InvalidArgIndex, 0, true); |
| 297 | else if (C.isCLibraryFunction(FDecl, "strcpy") || |
| 298 | C.isCLibraryFunction(FDecl, "stpcpy") || |
| 299 | C.isCLibraryFunction(FDecl, "strcat")) |
| 300 | return TaintPropagationRule(1, 0, true); |
| 301 | else if (C.isCLibraryFunction(FDecl, "bcopy")) |
| 302 | return TaintPropagationRule(0, 2, 1, false); |
| 303 | else if (C.isCLibraryFunction(FDecl, "strdup") || |
| 304 | C.isCLibraryFunction(FDecl, "strdupa")) |
| 305 | return TaintPropagationRule(0, ReturnValueIndex); |
Anna Zaks | 560dbe9 | 2012-01-18 02:45:11 +0000 | [diff] [blame] | 306 | else if (C.isCLibraryFunction(FDecl, "wcsdup")) |
| 307 | return TaintPropagationRule(0, ReturnValueIndex); |
Anna Zaks | 5d324e5 | 2012-01-18 02:45:07 +0000 | [diff] [blame] | 308 | } |
| 309 | |
| 310 | // Skipping the following functions, since they might be used for cleansing |
| 311 | // or smart memory copy: |
Benjamin Kramer | 474261a | 2012-06-02 10:20:41 +0000 | [diff] [blame] | 312 | // - memccpy - copying until hitting a special character. |
Anna Zaks | 5d324e5 | 2012-01-18 02:45:07 +0000 | [diff] [blame] | 313 | |
| 314 | return TaintPropagationRule(); |
Anna Zaks | 457c687 | 2011-11-18 02:26:36 +0000 | [diff] [blame] | 315 | } |
| 316 | |
Anna Zaks | 3b0ab20 | 2011-12-17 00:26:34 +0000 | [diff] [blame] | 317 | void GenericTaintChecker::checkPreStmt(const CallExpr *CE, |
| 318 | CheckerContext &C) const { |
Anna Zaks | 126a2ef | 2012-01-07 02:33:10 +0000 | [diff] [blame] | 319 | // Check for errors first. |
| 320 | if (checkPre(CE, C)) |
| 321 | return; |
Anna Zaks | 3b0ab20 | 2011-12-17 00:26:34 +0000 | [diff] [blame] | 322 | |
Anna Zaks | 126a2ef | 2012-01-07 02:33:10 +0000 | [diff] [blame] | 323 | // Add taint second. |
Anna Zaks | b3fa8d7 | 2012-01-12 02:22:34 +0000 | [diff] [blame] | 324 | addSourcesPre(CE, C); |
Anna Zaks | 126a2ef | 2012-01-07 02:33:10 +0000 | [diff] [blame] | 325 | } |
| 326 | |
| 327 | void GenericTaintChecker::checkPostStmt(const CallExpr *CE, |
| 328 | CheckerContext &C) const { |
Anna Zaks | b3fa8d7 | 2012-01-12 02:22:34 +0000 | [diff] [blame] | 329 | if (propagateFromPre(CE, C)) |
| 330 | return; |
| 331 | addSourcesPost(CE, C); |
Anna Zaks | 126a2ef | 2012-01-07 02:33:10 +0000 | [diff] [blame] | 332 | } |
| 333 | |
Anna Zaks | b3fa8d7 | 2012-01-12 02:22:34 +0000 | [diff] [blame] | 334 | void GenericTaintChecker::addSourcesPre(const CallExpr *CE, |
| 335 | CheckerContext &C) const { |
Craig Topper | 0dbb783 | 2014-05-27 02:45:47 +0000 | [diff] [blame] | 336 | ProgramStateRef State = nullptr; |
Anna Zaks | 5d324e5 | 2012-01-18 02:45:07 +0000 | [diff] [blame] | 337 | const FunctionDecl *FDecl = C.getCalleeDecl(CE); |
Jordan Rose | 6cd16c5 | 2012-07-10 23:13:01 +0000 | [diff] [blame] | 338 | if (!FDecl || FDecl->getKind() != Decl::Function) |
| 339 | return; |
| 340 | |
Anna Zaks | 5d324e5 | 2012-01-18 02:45:07 +0000 | [diff] [blame] | 341 | StringRef Name = C.getCalleeName(FDecl); |
Anna Zaks | b3fa8d7 | 2012-01-12 02:22:34 +0000 | [diff] [blame] | 342 | if (Name.empty()) |
| 343 | return; |
Anna Zaks | 3666d2c | 2012-01-17 00:37:02 +0000 | [diff] [blame] | 344 | |
Anna Zaks | 5d324e5 | 2012-01-18 02:45:07 +0000 | [diff] [blame] | 345 | // First, try generating a propagation rule for this function. |
| 346 | TaintPropagationRule Rule = |
| 347 | TaintPropagationRule::getTaintPropagationRule(FDecl, Name, C); |
Anna Zaks | 3666d2c | 2012-01-17 00:37:02 +0000 | [diff] [blame] | 348 | if (!Rule.isNull()) { |
Anna Zaks | 7f6a6b7 | 2012-01-18 02:45:13 +0000 | [diff] [blame] | 349 | State = Rule.process(CE, C); |
Anna Zaks | 3666d2c | 2012-01-17 00:37:02 +0000 | [diff] [blame] | 350 | if (!State) |
| 351 | return; |
| 352 | C.addTransition(State); |
Anna Zaks | 5d324e5 | 2012-01-18 02:45:07 +0000 | [diff] [blame] | 353 | return; |
Anna Zaks | 3666d2c | 2012-01-17 00:37:02 +0000 | [diff] [blame] | 354 | } |
| 355 | |
Anna Zaks | 5d324e5 | 2012-01-18 02:45:07 +0000 | [diff] [blame] | 356 | // Otherwise, check if we have custom pre-processing implemented. |
Anna Zaks | 3b0ab20 | 2011-12-17 00:26:34 +0000 | [diff] [blame] | 357 | FnCheck evalFunction = llvm::StringSwitch<FnCheck>(Name) |
Anna Zaks | b3fa8d7 | 2012-01-12 02:22:34 +0000 | [diff] [blame] | 358 | .Case("fscanf", &GenericTaintChecker::preFscanf) |
Craig Topper | 0dbb783 | 2014-05-27 02:45:47 +0000 | [diff] [blame] | 359 | .Default(nullptr); |
Anna Zaks | 3b0ab20 | 2011-12-17 00:26:34 +0000 | [diff] [blame] | 360 | // Check and evaluate the call. |
| 361 | if (evalFunction) |
| 362 | State = (this->*evalFunction)(CE, C); |
| 363 | if (!State) |
Anna Zaks | 5c5bf9b | 2011-11-16 19:58:13 +0000 | [diff] [blame] | 364 | return; |
Anna Zaks | 3b0ab20 | 2011-12-17 00:26:34 +0000 | [diff] [blame] | 365 | C.addTransition(State); |
Anna Zaks | 5d324e5 | 2012-01-18 02:45:07 +0000 | [diff] [blame] | 366 | |
Anna Zaks | 3b0ab20 | 2011-12-17 00:26:34 +0000 | [diff] [blame] | 367 | } |
| 368 | |
Anna Zaks | b3fa8d7 | 2012-01-12 02:22:34 +0000 | [diff] [blame] | 369 | bool GenericTaintChecker::propagateFromPre(const CallExpr *CE, |
| 370 | CheckerContext &C) const { |
Ted Kremenek | 49b1e38 | 2012-01-26 21:29:00 +0000 | [diff] [blame] | 371 | ProgramStateRef State = C.getState(); |
Anna Zaks | b3fa8d7 | 2012-01-12 02:22:34 +0000 | [diff] [blame] | 372 | |
| 373 | // Depending on what was tainted at pre-visit, we determined a set of |
| 374 | // arguments which should be tainted after the function returns. These are |
| 375 | // stored in the state as TaintArgsOnPostVisit set. |
Jordan Rose | 0c153cb | 2012-11-02 01:54:06 +0000 | [diff] [blame] | 376 | TaintArgsOnPostVisitTy TaintArgs = State->get<TaintArgsOnPostVisit>(); |
Anna Zaks | bf74051 | 2012-01-24 19:32:25 +0000 | [diff] [blame] | 377 | if (TaintArgs.isEmpty()) |
| 378 | return false; |
| 379 | |
Anna Zaks | b3fa8d7 | 2012-01-12 02:22:34 +0000 | [diff] [blame] | 380 | for (llvm::ImmutableSet<unsigned>::iterator |
| 381 | I = TaintArgs.begin(), E = TaintArgs.end(); I != E; ++I) { |
| 382 | unsigned ArgNum = *I; |
| 383 | |
| 384 | // Special handling for the tainted return value. |
| 385 | if (ArgNum == ReturnValueIndex) { |
| 386 | State = State->addTaint(CE, C.getLocationContext()); |
| 387 | continue; |
| 388 | } |
| 389 | |
| 390 | // The arguments are pointer arguments. The data they are pointing at is |
| 391 | // tainted after the call. |
Anna Zaks | b508d29 | 2012-04-10 23:41:11 +0000 | [diff] [blame] | 392 | if (CE->getNumArgs() < (ArgNum + 1)) |
| 393 | return false; |
Anna Zaks | b3fa8d7 | 2012-01-12 02:22:34 +0000 | [diff] [blame] | 394 | const Expr* Arg = CE->getArg(ArgNum); |
Artem Dergachev | eed7a31 | 2017-05-29 15:42:56 +0000 | [diff] [blame] | 395 | Optional<SVal> V = getPointedToSVal(C, Arg); |
| 396 | if (V) |
| 397 | State = State->addTaint(*V); |
Anna Zaks | b3fa8d7 | 2012-01-12 02:22:34 +0000 | [diff] [blame] | 398 | } |
| 399 | |
| 400 | // Clear up the taint info from the state. |
| 401 | State = State->remove<TaintArgsOnPostVisit>(); |
| 402 | |
| 403 | if (State != C.getState()) { |
| 404 | C.addTransition(State); |
| 405 | return true; |
| 406 | } |
| 407 | return false; |
| 408 | } |
| 409 | |
| 410 | void GenericTaintChecker::addSourcesPost(const CallExpr *CE, |
| 411 | CheckerContext &C) const { |
Anna Zaks | 5c5bf9b | 2011-11-16 19:58:13 +0000 | [diff] [blame] | 412 | // Define the attack surface. |
| 413 | // Set the evaluation function by switching on the callee name. |
Jordan Rose | 6cd16c5 | 2012-07-10 23:13:01 +0000 | [diff] [blame] | 414 | const FunctionDecl *FDecl = C.getCalleeDecl(CE); |
| 415 | if (!FDecl || FDecl->getKind() != Decl::Function) |
| 416 | return; |
| 417 | |
| 418 | StringRef Name = C.getCalleeName(FDecl); |
Anna Zaks | b3fa8d7 | 2012-01-12 02:22:34 +0000 | [diff] [blame] | 419 | if (Name.empty()) |
| 420 | return; |
Anna Zaks | 5c5bf9b | 2011-11-16 19:58:13 +0000 | [diff] [blame] | 421 | FnCheck evalFunction = llvm::StringSwitch<FnCheck>(Name) |
Anna Zaks | 3b0ab20 | 2011-12-17 00:26:34 +0000 | [diff] [blame] | 422 | .Case("scanf", &GenericTaintChecker::postScanf) |
Anna Zaks | eefc0e9 | 2011-12-14 00:56:02 +0000 | [diff] [blame] | 423 | // TODO: Add support for vfscanf & family. |
Anna Zaks | 3b0ab20 | 2011-12-17 00:26:34 +0000 | [diff] [blame] | 424 | .Case("getchar", &GenericTaintChecker::postRetTaint) |
Anna Zaks | bf74051 | 2012-01-24 19:32:25 +0000 | [diff] [blame] | 425 | .Case("getchar_unlocked", &GenericTaintChecker::postRetTaint) |
Anna Zaks | 3b0ab20 | 2011-12-17 00:26:34 +0000 | [diff] [blame] | 426 | .Case("getenv", &GenericTaintChecker::postRetTaint) |
| 427 | .Case("fopen", &GenericTaintChecker::postRetTaint) |
| 428 | .Case("fdopen", &GenericTaintChecker::postRetTaint) |
| 429 | .Case("freopen", &GenericTaintChecker::postRetTaint) |
Anna Zaks | bf74051 | 2012-01-24 19:32:25 +0000 | [diff] [blame] | 430 | .Case("getch", &GenericTaintChecker::postRetTaint) |
| 431 | .Case("wgetch", &GenericTaintChecker::postRetTaint) |
Anna Zaks | 3b754b2 | 2012-01-20 00:11:19 +0000 | [diff] [blame] | 432 | .Case("socket", &GenericTaintChecker::postSocket) |
Craig Topper | 0dbb783 | 2014-05-27 02:45:47 +0000 | [diff] [blame] | 433 | .Default(nullptr); |
Anna Zaks | 5c5bf9b | 2011-11-16 19:58:13 +0000 | [diff] [blame] | 434 | |
| 435 | // If the callee isn't defined, it is not of security concern. |
| 436 | // Check and evaluate the call. |
Craig Topper | 0dbb783 | 2014-05-27 02:45:47 +0000 | [diff] [blame] | 437 | ProgramStateRef State = nullptr; |
Anna Zaks | 5c5bf9b | 2011-11-16 19:58:13 +0000 | [diff] [blame] | 438 | if (evalFunction) |
Anna Zaks | 3b0ab20 | 2011-12-17 00:26:34 +0000 | [diff] [blame] | 439 | State = (this->*evalFunction)(CE, C); |
| 440 | if (!State) |
| 441 | return; |
Anna Zaks | 5c5bf9b | 2011-11-16 19:58:13 +0000 | [diff] [blame] | 442 | |
Anna Zaks | 3b0ab20 | 2011-12-17 00:26:34 +0000 | [diff] [blame] | 443 | C.addTransition(State); |
Anna Zaks | 5c5bf9b | 2011-11-16 19:58:13 +0000 | [diff] [blame] | 444 | } |
Anna Zaks | 457c687 | 2011-11-18 02:26:36 +0000 | [diff] [blame] | 445 | |
Anna Zaks | 126a2ef | 2012-01-07 02:33:10 +0000 | [diff] [blame] | 446 | bool GenericTaintChecker::checkPre(const CallExpr *CE, CheckerContext &C) const{ |
| 447 | |
| 448 | if (checkUncontrolledFormatString(CE, C)) |
| 449 | return true; |
| 450 | |
Anna Zaks | 560dbe9 | 2012-01-18 02:45:11 +0000 | [diff] [blame] | 451 | const FunctionDecl *FDecl = C.getCalleeDecl(CE); |
Jordan Rose | 6cd16c5 | 2012-07-10 23:13:01 +0000 | [diff] [blame] | 452 | if (!FDecl || FDecl->getKind() != Decl::Function) |
| 453 | return false; |
| 454 | |
Anna Zaks | 560dbe9 | 2012-01-18 02:45:11 +0000 | [diff] [blame] | 455 | StringRef Name = C.getCalleeName(FDecl); |
Anna Zaks | 0244cd7 | 2012-01-14 02:48:40 +0000 | [diff] [blame] | 456 | if (Name.empty()) |
| 457 | return false; |
| 458 | |
| 459 | if (checkSystemCall(CE, Name, C)) |
| 460 | return true; |
| 461 | |
Anna Zaks | 560dbe9 | 2012-01-18 02:45:11 +0000 | [diff] [blame] | 462 | if (checkTaintedBufferSize(CE, FDecl, C)) |
| 463 | return true; |
| 464 | |
Anna Zaks | 126a2ef | 2012-01-07 02:33:10 +0000 | [diff] [blame] | 465 | return false; |
| 466 | } |
| 467 | |
Artem Dergachev | eed7a31 | 2017-05-29 15:42:56 +0000 | [diff] [blame] | 468 | Optional<SVal> GenericTaintChecker::getPointedToSVal(CheckerContext &C, |
Artem Dergachev | 3ef5deb | 2017-12-12 02:27:55 +0000 | [diff] [blame] | 469 | const Expr *Arg) { |
Ted Kremenek | 49b1e38 | 2012-01-26 21:29:00 +0000 | [diff] [blame] | 470 | ProgramStateRef State = C.getState(); |
George Karpenkov | d703ec9 | 2018-01-17 20:27:29 +0000 | [diff] [blame] | 471 | SVal AddrVal = C.getSVal(Arg->IgnoreParens()); |
Anna Zaks | e48ee50 | 2011-12-16 18:28:50 +0000 | [diff] [blame] | 472 | if (AddrVal.isUnknownOrUndef()) |
Artem Dergachev | eed7a31 | 2017-05-29 15:42:56 +0000 | [diff] [blame] | 473 | return None; |
Anna Zaks | 7c96b7d | 2011-12-11 18:43:40 +0000 | [diff] [blame] | 474 | |
David Blaikie | 05785d1 | 2013-02-20 22:23:23 +0000 | [diff] [blame] | 475 | Optional<Loc> AddrLoc = AddrVal.getAs<Loc>(); |
Anna Zaks | 7f6a6b7 | 2012-01-18 02:45:13 +0000 | [diff] [blame] | 476 | if (!AddrLoc) |
Artem Dergachev | eed7a31 | 2017-05-29 15:42:56 +0000 | [diff] [blame] | 477 | return None; |
Anna Zaks | 457c687 | 2011-11-18 02:26:36 +0000 | [diff] [blame] | 478 | |
Artem Dergachev | 3ef5deb | 2017-12-12 02:27:55 +0000 | [diff] [blame] | 479 | QualType ArgTy = Arg->getType().getCanonicalType(); |
| 480 | if (!ArgTy->isPointerType()) |
| 481 | return None; |
| 482 | |
| 483 | QualType ValTy = ArgTy->getPointeeType(); |
| 484 | |
| 485 | // Do not dereference void pointers. Treat them as byte pointers instead. |
| 486 | // FIXME: we might want to consider more than just the first byte. |
| 487 | if (ValTy->isVoidType()) |
| 488 | ValTy = C.getASTContext().CharTy; |
| 489 | |
| 490 | return State->getSVal(*AddrLoc, ValTy); |
Anna Zaks | 5c5bf9b | 2011-11-16 19:58:13 +0000 | [diff] [blame] | 491 | } |
| 492 | |
Ted Kremenek | 3a0678e | 2015-09-08 03:50:52 +0000 | [diff] [blame] | 493 | ProgramStateRef |
Anna Zaks | 7f6a6b7 | 2012-01-18 02:45:13 +0000 | [diff] [blame] | 494 | GenericTaintChecker::TaintPropagationRule::process(const CallExpr *CE, |
| 495 | CheckerContext &C) const { |
Ted Kremenek | 49b1e38 | 2012-01-26 21:29:00 +0000 | [diff] [blame] | 496 | ProgramStateRef State = C.getState(); |
Anna Zaks | 3666d2c | 2012-01-17 00:37:02 +0000 | [diff] [blame] | 497 | |
| 498 | // Check for taint in arguments. |
| 499 | bool IsTainted = false; |
Anna Zaks | 7f6a6b7 | 2012-01-18 02:45:13 +0000 | [diff] [blame] | 500 | for (ArgVector::const_iterator I = SrcArgs.begin(), |
| 501 | E = SrcArgs.end(); I != E; ++I) { |
Anna Zaks | 3666d2c | 2012-01-17 00:37:02 +0000 | [diff] [blame] | 502 | unsigned ArgNum = *I; |
| 503 | |
| 504 | if (ArgNum == InvalidArgIndex) { |
Anna Zaks | 5d324e5 | 2012-01-18 02:45:07 +0000 | [diff] [blame] | 505 | // Check if any of the arguments is tainted, but skip the |
| 506 | // destination arguments. |
| 507 | for (unsigned int i = 0; i < CE->getNumArgs(); ++i) { |
Anna Zaks | 7f6a6b7 | 2012-01-18 02:45:13 +0000 | [diff] [blame] | 508 | if (isDestinationArgument(i)) |
Anna Zaks | 5d324e5 | 2012-01-18 02:45:07 +0000 | [diff] [blame] | 509 | continue; |
Anna Zaks | bf74051 | 2012-01-24 19:32:25 +0000 | [diff] [blame] | 510 | if ((IsTainted = isTaintedOrPointsToTainted(CE->getArg(i), State, C))) |
Anna Zaks | 3666d2c | 2012-01-17 00:37:02 +0000 | [diff] [blame] | 511 | break; |
Anna Zaks | 5d324e5 | 2012-01-18 02:45:07 +0000 | [diff] [blame] | 512 | } |
Anna Zaks | 3666d2c | 2012-01-17 00:37:02 +0000 | [diff] [blame] | 513 | break; |
| 514 | } |
| 515 | |
Anna Zaks | b508d29 | 2012-04-10 23:41:11 +0000 | [diff] [blame] | 516 | if (CE->getNumArgs() < (ArgNum + 1)) |
| 517 | return State; |
Anna Zaks | bf74051 | 2012-01-24 19:32:25 +0000 | [diff] [blame] | 518 | if ((IsTainted = isTaintedOrPointsToTainted(CE->getArg(ArgNum), State, C))) |
Anna Zaks | 3666d2c | 2012-01-17 00:37:02 +0000 | [diff] [blame] | 519 | break; |
| 520 | } |
| 521 | if (!IsTainted) |
| 522 | return State; |
| 523 | |
| 524 | // Mark the arguments which should be tainted after the function returns. |
Anna Zaks | 7f6a6b7 | 2012-01-18 02:45:13 +0000 | [diff] [blame] | 525 | for (ArgVector::const_iterator I = DstArgs.begin(), |
| 526 | E = DstArgs.end(); I != E; ++I) { |
Anna Zaks | 3666d2c | 2012-01-17 00:37:02 +0000 | [diff] [blame] | 527 | unsigned ArgNum = *I; |
| 528 | |
| 529 | // Should we mark all arguments as tainted? |
| 530 | if (ArgNum == InvalidArgIndex) { |
| 531 | // For all pointer and references that were passed in: |
| 532 | // If they are not pointing to const data, mark data as tainted. |
| 533 | // TODO: So far we are just going one level down; ideally we'd need to |
| 534 | // recurse here. |
| 535 | for (unsigned int i = 0; i < CE->getNumArgs(); ++i) { |
| 536 | const Expr *Arg = CE->getArg(i); |
| 537 | // Process pointer argument. |
| 538 | const Type *ArgTy = Arg->getType().getTypePtr(); |
| 539 | QualType PType = ArgTy->getPointeeType(); |
| 540 | if ((!PType.isNull() && !PType.isConstQualified()) |
| 541 | || (ArgTy->isReferenceType() && !Arg->getType().isConstQualified())) |
| 542 | State = State->add<TaintArgsOnPostVisit>(i); |
| 543 | } |
| 544 | continue; |
| 545 | } |
| 546 | |
| 547 | // Should mark the return value? |
| 548 | if (ArgNum == ReturnValueIndex) { |
| 549 | State = State->add<TaintArgsOnPostVisit>(ReturnValueIndex); |
| 550 | continue; |
| 551 | } |
| 552 | |
| 553 | // Mark the given argument. |
| 554 | assert(ArgNum < CE->getNumArgs()); |
| 555 | State = State->add<TaintArgsOnPostVisit>(ArgNum); |
| 556 | } |
| 557 | |
| 558 | return State; |
| 559 | } |
| 560 | |
| 561 | |
Anna Zaks | b3fa8d7 | 2012-01-12 02:22:34 +0000 | [diff] [blame] | 562 | // If argument 0 (file descriptor) is tainted, all arguments except for arg 0 |
| 563 | // and arg 1 should get taint. |
Ted Kremenek | 49b1e38 | 2012-01-26 21:29:00 +0000 | [diff] [blame] | 564 | ProgramStateRef GenericTaintChecker::preFscanf(const CallExpr *CE, |
Anna Zaks | 3b0ab20 | 2011-12-17 00:26:34 +0000 | [diff] [blame] | 565 | CheckerContext &C) const { |
| 566 | assert(CE->getNumArgs() >= 2); |
Ted Kremenek | 49b1e38 | 2012-01-26 21:29:00 +0000 | [diff] [blame] | 567 | ProgramStateRef State = C.getState(); |
Anna Zaks | 3b0ab20 | 2011-12-17 00:26:34 +0000 | [diff] [blame] | 568 | |
| 569 | // Check is the file descriptor is tainted. |
Ted Kremenek | 632e3b7 | 2012-01-06 22:09:28 +0000 | [diff] [blame] | 570 | if (State->isTainted(CE->getArg(0), C.getLocationContext()) || |
Anna Zaks | b3fa8d7 | 2012-01-12 02:22:34 +0000 | [diff] [blame] | 571 | isStdin(CE->getArg(0), C)) { |
| 572 | // All arguments except for the first two should get taint. |
| 573 | for (unsigned int i = 2; i < CE->getNumArgs(); ++i) |
| 574 | State = State->add<TaintArgsOnPostVisit>(i); |
| 575 | return State; |
| 576 | } |
| 577 | |
Craig Topper | 0dbb783 | 2014-05-27 02:45:47 +0000 | [diff] [blame] | 578 | return nullptr; |
Anna Zaks | 3b0ab20 | 2011-12-17 00:26:34 +0000 | [diff] [blame] | 579 | } |
| 580 | |
Anna Zaks | 3b754b2 | 2012-01-20 00:11:19 +0000 | [diff] [blame] | 581 | |
| 582 | // If argument 0(protocol domain) is network, the return value should get taint. |
Ted Kremenek | 49b1e38 | 2012-01-26 21:29:00 +0000 | [diff] [blame] | 583 | ProgramStateRef GenericTaintChecker::postSocket(const CallExpr *CE, |
Anna Zaks | b508d29 | 2012-04-10 23:41:11 +0000 | [diff] [blame] | 584 | CheckerContext &C) const { |
Ted Kremenek | 49b1e38 | 2012-01-26 21:29:00 +0000 | [diff] [blame] | 585 | ProgramStateRef State = C.getState(); |
Anna Zaks | b508d29 | 2012-04-10 23:41:11 +0000 | [diff] [blame] | 586 | if (CE->getNumArgs() < 3) |
| 587 | return State; |
Anna Zaks | 3b754b2 | 2012-01-20 00:11:19 +0000 | [diff] [blame] | 588 | |
| 589 | SourceLocation DomLoc = CE->getArg(0)->getExprLoc(); |
| 590 | StringRef DomName = C.getMacroNameOrSpelling(DomLoc); |
| 591 | // White list the internal communication protocols. |
| 592 | if (DomName.equals("AF_SYSTEM") || DomName.equals("AF_LOCAL") || |
| 593 | DomName.equals("AF_UNIX") || DomName.equals("AF_RESERVED_36")) |
| 594 | return State; |
| 595 | State = State->addTaint(CE, C.getLocationContext()); |
| 596 | return State; |
| 597 | } |
| 598 | |
Ted Kremenek | 49b1e38 | 2012-01-26 21:29:00 +0000 | [diff] [blame] | 599 | ProgramStateRef GenericTaintChecker::postScanf(const CallExpr *CE, |
Anna Zaks | 3b0ab20 | 2011-12-17 00:26:34 +0000 | [diff] [blame] | 600 | CheckerContext &C) const { |
Ted Kremenek | 49b1e38 | 2012-01-26 21:29:00 +0000 | [diff] [blame] | 601 | ProgramStateRef State = C.getState(); |
Anna Zaks | b508d29 | 2012-04-10 23:41:11 +0000 | [diff] [blame] | 602 | if (CE->getNumArgs() < 2) |
| 603 | return State; |
| 604 | |
Anna Zaks | 5c5bf9b | 2011-11-16 19:58:13 +0000 | [diff] [blame] | 605 | // All arguments except for the very first one should get taint. |
| 606 | for (unsigned int i = 1; i < CE->getNumArgs(); ++i) { |
| 607 | // The arguments are pointer arguments. The data they are pointing at is |
| 608 | // tainted after the call. |
| 609 | const Expr* Arg = CE->getArg(i); |
Artem Dergachev | eed7a31 | 2017-05-29 15:42:56 +0000 | [diff] [blame] | 610 | Optional<SVal> V = getPointedToSVal(C, Arg); |
| 611 | if (V) |
| 612 | State = State->addTaint(*V); |
Anna Zaks | eefc0e9 | 2011-12-14 00:56:02 +0000 | [diff] [blame] | 613 | } |
Anna Zaks | 3b0ab20 | 2011-12-17 00:26:34 +0000 | [diff] [blame] | 614 | return State; |
Anna Zaks | 5c5bf9b | 2011-11-16 19:58:13 +0000 | [diff] [blame] | 615 | } |
| 616 | |
Ted Kremenek | 49b1e38 | 2012-01-26 21:29:00 +0000 | [diff] [blame] | 617 | ProgramStateRef GenericTaintChecker::postRetTaint(const CallExpr *CE, |
Anna Zaks | b508d29 | 2012-04-10 23:41:11 +0000 | [diff] [blame] | 618 | CheckerContext &C) const { |
Ted Kremenek | 632e3b7 | 2012-01-06 22:09:28 +0000 | [diff] [blame] | 619 | return C.getState()->addTaint(CE, C.getLocationContext()); |
Anna Zaks | 5c5bf9b | 2011-11-16 19:58:13 +0000 | [diff] [blame] | 620 | } |
| 621 | |
Anna Zaks | bf74051 | 2012-01-24 19:32:25 +0000 | [diff] [blame] | 622 | bool GenericTaintChecker::isStdin(const Expr *E, CheckerContext &C) { |
Ted Kremenek | 49b1e38 | 2012-01-26 21:29:00 +0000 | [diff] [blame] | 623 | ProgramStateRef State = C.getState(); |
George Karpenkov | d703ec9 | 2018-01-17 20:27:29 +0000 | [diff] [blame] | 624 | SVal Val = C.getSVal(E); |
Anna Zaks | 099fe3f | 2011-12-14 00:56:18 +0000 | [diff] [blame] | 625 | |
Anna Zaks | e48ee50 | 2011-12-16 18:28:50 +0000 | [diff] [blame] | 626 | // stdin is a pointer, so it would be a region. |
| 627 | const MemRegion *MemReg = Val.getAsRegion(); |
| 628 | |
| 629 | // The region should be symbolic, we do not know it's value. |
| 630 | const SymbolicRegion *SymReg = dyn_cast_or_null<SymbolicRegion>(MemReg); |
| 631 | if (!SymReg) |
Anna Zaks | 099fe3f | 2011-12-14 00:56:18 +0000 | [diff] [blame] | 632 | return false; |
| 633 | |
Anna Zaks | e48ee50 | 2011-12-16 18:28:50 +0000 | [diff] [blame] | 634 | // Get it's symbol and find the declaration region it's pointing to. |
| 635 | const SymbolRegionValue *Sm =dyn_cast<SymbolRegionValue>(SymReg->getSymbol()); |
| 636 | if (!Sm) |
| 637 | return false; |
| 638 | const DeclRegion *DeclReg = dyn_cast_or_null<DeclRegion>(Sm->getRegion()); |
| 639 | if (!DeclReg) |
| 640 | return false; |
Anna Zaks | 099fe3f | 2011-12-14 00:56:18 +0000 | [diff] [blame] | 641 | |
Anna Zaks | e48ee50 | 2011-12-16 18:28:50 +0000 | [diff] [blame] | 642 | // This region corresponds to a declaration, find out if it's a global/extern |
| 643 | // variable named stdin with the proper type. |
| 644 | if (const VarDecl *D = dyn_cast_or_null<VarDecl>(DeclReg->getDecl())) { |
| 645 | D = D->getCanonicalDecl(); |
| 646 | if ((D->getName().find("stdin") != StringRef::npos) && D->isExternC()) |
| 647 | if (const PointerType * PtrTy = |
| 648 | dyn_cast<PointerType>(D->getType().getTypePtr())) |
Henry Wong | cb2ad24 | 2018-03-05 15:41:15 +0000 | [diff] [blame^] | 649 | if (PtrTy->getPointeeType().getCanonicalType() == |
| 650 | C.getASTContext().getFILEType().getCanonicalType()) |
Anna Zaks | e48ee50 | 2011-12-16 18:28:50 +0000 | [diff] [blame] | 651 | return true; |
| 652 | } |
Anna Zaks | 099fe3f | 2011-12-14 00:56:18 +0000 | [diff] [blame] | 653 | return false; |
| 654 | } |
| 655 | |
Anna Zaks | 126a2ef | 2012-01-07 02:33:10 +0000 | [diff] [blame] | 656 | static bool getPrintfFormatArgumentNum(const CallExpr *CE, |
| 657 | const CheckerContext &C, |
| 658 | unsigned int &ArgNum) { |
| 659 | // Find if the function contains a format string argument. |
| 660 | // Handles: fprintf, printf, sprintf, snprintf, vfprintf, vprintf, vsprintf, |
| 661 | // vsnprintf, syslog, custom annotated functions. |
| 662 | const FunctionDecl *FDecl = C.getCalleeDecl(CE); |
| 663 | if (!FDecl) |
| 664 | return false; |
Aaron Ballman | be22bcb | 2014-03-10 17:08:28 +0000 | [diff] [blame] | 665 | for (const auto *Format : FDecl->specific_attrs<FormatAttr>()) { |
Anna Zaks | 126a2ef | 2012-01-07 02:33:10 +0000 | [diff] [blame] | 666 | ArgNum = Format->getFormatIdx() - 1; |
Aaron Ballman | f58070b | 2013-09-03 21:02:22 +0000 | [diff] [blame] | 667 | if ((Format->getType()->getName() == "printf") && |
| 668 | CE->getNumArgs() > ArgNum) |
Anna Zaks | 126a2ef | 2012-01-07 02:33:10 +0000 | [diff] [blame] | 669 | return true; |
| 670 | } |
| 671 | |
| 672 | // Or if a function is named setproctitle (this is a heuristic). |
| 673 | if (C.getCalleeName(CE).find("setproctitle") != StringRef::npos) { |
| 674 | ArgNum = 0; |
| 675 | return true; |
| 676 | } |
| 677 | |
| 678 | return false; |
| 679 | } |
| 680 | |
Anna Zaks | 0244cd7 | 2012-01-14 02:48:40 +0000 | [diff] [blame] | 681 | bool GenericTaintChecker::generateReportIfTainted(const Expr *E, |
| 682 | const char Msg[], |
| 683 | CheckerContext &C) const { |
| 684 | assert(E); |
| 685 | |
| 686 | // Check for taint. |
Ted Kremenek | 49b1e38 | 2012-01-26 21:29:00 +0000 | [diff] [blame] | 687 | ProgramStateRef State = C.getState(); |
Artem Dergachev | eed7a31 | 2017-05-29 15:42:56 +0000 | [diff] [blame] | 688 | Optional<SVal> PointedToSVal = getPointedToSVal(C, E); |
Anna Zaks | d4e43ae | 2017-03-09 00:01:07 +0000 | [diff] [blame] | 689 | SVal TaintedSVal; |
Artem Dergachev | eed7a31 | 2017-05-29 15:42:56 +0000 | [diff] [blame] | 690 | if (PointedToSVal && State->isTainted(*PointedToSVal)) |
| 691 | TaintedSVal = *PointedToSVal; |
Anna Zaks | d4e43ae | 2017-03-09 00:01:07 +0000 | [diff] [blame] | 692 | else if (State->isTainted(E, C.getLocationContext())) |
| 693 | TaintedSVal = C.getSVal(E); |
| 694 | else |
Anna Zaks | 0244cd7 | 2012-01-14 02:48:40 +0000 | [diff] [blame] | 695 | return false; |
| 696 | |
| 697 | // Generate diagnostic. |
Devin Coughlin | e39bd40 | 2015-09-16 22:03:05 +0000 | [diff] [blame] | 698 | if (ExplodedNode *N = C.generateNonFatalErrorNode()) { |
Anna Zaks | 0244cd7 | 2012-01-14 02:48:40 +0000 | [diff] [blame] | 699 | initBugType(); |
Aaron Ballman | 8d3a7a5 | 2015-06-23 13:15:32 +0000 | [diff] [blame] | 700 | auto report = llvm::make_unique<BugReport>(*BT, Msg, N); |
Anna Zaks | 0244cd7 | 2012-01-14 02:48:40 +0000 | [diff] [blame] | 701 | report->addRange(E->getSourceRange()); |
Anna Zaks | d4e43ae | 2017-03-09 00:01:07 +0000 | [diff] [blame] | 702 | report->addVisitor(llvm::make_unique<TaintBugVisitor>(TaintedSVal)); |
Aaron Ballman | 8d3a7a5 | 2015-06-23 13:15:32 +0000 | [diff] [blame] | 703 | C.emitReport(std::move(report)); |
Anna Zaks | 0244cd7 | 2012-01-14 02:48:40 +0000 | [diff] [blame] | 704 | return true; |
| 705 | } |
| 706 | return false; |
| 707 | } |
| 708 | |
Anna Zaks | 126a2ef | 2012-01-07 02:33:10 +0000 | [diff] [blame] | 709 | bool GenericTaintChecker::checkUncontrolledFormatString(const CallExpr *CE, |
| 710 | CheckerContext &C) const{ |
| 711 | // Check if the function contains a format string argument. |
| 712 | unsigned int ArgNum = 0; |
| 713 | if (!getPrintfFormatArgumentNum(CE, C, ArgNum)) |
| 714 | return false; |
| 715 | |
| 716 | // If either the format string content or the pointer itself are tainted, warn. |
Alexander Kornienko | 9c10490 | 2015-12-28 13:06:58 +0000 | [diff] [blame] | 717 | return generateReportIfTainted(CE->getArg(ArgNum), |
| 718 | MsgUncontrolledFormatString, C); |
Anna Zaks | 0244cd7 | 2012-01-14 02:48:40 +0000 | [diff] [blame] | 719 | } |
| 720 | |
| 721 | bool GenericTaintChecker::checkSystemCall(const CallExpr *CE, |
| 722 | StringRef Name, |
| 723 | CheckerContext &C) const { |
Ted Kremenek | 3a0678e | 2015-09-08 03:50:52 +0000 | [diff] [blame] | 724 | // TODO: It might make sense to run this check on demand. In some cases, |
| 725 | // we should check if the environment has been cleansed here. We also might |
Anna Zaks | bf74051 | 2012-01-24 19:32:25 +0000 | [diff] [blame] | 726 | // need to know if the user was reset before these calls(seteuid). |
Anna Zaks | 0244cd7 | 2012-01-14 02:48:40 +0000 | [diff] [blame] | 727 | unsigned ArgNum = llvm::StringSwitch<unsigned>(Name) |
| 728 | .Case("system", 0) |
| 729 | .Case("popen", 0) |
Anna Zaks | 3b754b2 | 2012-01-20 00:11:19 +0000 | [diff] [blame] | 730 | .Case("execl", 0) |
| 731 | .Case("execle", 0) |
| 732 | .Case("execlp", 0) |
| 733 | .Case("execv", 0) |
| 734 | .Case("execvp", 0) |
| 735 | .Case("execvP", 0) |
Anna Zaks | bf74051 | 2012-01-24 19:32:25 +0000 | [diff] [blame] | 736 | .Case("execve", 0) |
| 737 | .Case("dlopen", 0) |
Anna Zaks | 0244cd7 | 2012-01-14 02:48:40 +0000 | [diff] [blame] | 738 | .Default(UINT_MAX); |
| 739 | |
Anna Zaks | b508d29 | 2012-04-10 23:41:11 +0000 | [diff] [blame] | 740 | if (ArgNum == UINT_MAX || CE->getNumArgs() < (ArgNum + 1)) |
Anna Zaks | 0244cd7 | 2012-01-14 02:48:40 +0000 | [diff] [blame] | 741 | return false; |
| 742 | |
Alexander Kornienko | 9c10490 | 2015-12-28 13:06:58 +0000 | [diff] [blame] | 743 | return generateReportIfTainted(CE->getArg(ArgNum), MsgSanitizeSystemArgs, C); |
Anna Zaks | 126a2ef | 2012-01-07 02:33:10 +0000 | [diff] [blame] | 744 | } |
| 745 | |
Anna Zaks | 560dbe9 | 2012-01-18 02:45:11 +0000 | [diff] [blame] | 746 | // TODO: Should this check be a part of the CString checker? |
| 747 | // If yes, should taint be a global setting? |
| 748 | bool GenericTaintChecker::checkTaintedBufferSize(const CallExpr *CE, |
| 749 | const FunctionDecl *FDecl, |
| 750 | CheckerContext &C) const { |
| 751 | // If the function has a buffer size argument, set ArgNum. |
| 752 | unsigned ArgNum = InvalidArgIndex; |
| 753 | unsigned BId = 0; |
| 754 | if ( (BId = FDecl->getMemoryFunctionKind()) ) |
| 755 | switch(BId) { |
| 756 | case Builtin::BImemcpy: |
| 757 | case Builtin::BImemmove: |
| 758 | case Builtin::BIstrncpy: |
| 759 | ArgNum = 2; |
| 760 | break; |
| 761 | case Builtin::BIstrndup: |
| 762 | ArgNum = 1; |
| 763 | break; |
| 764 | default: |
| 765 | break; |
| 766 | }; |
| 767 | |
| 768 | if (ArgNum == InvalidArgIndex) { |
| 769 | if (C.isCLibraryFunction(FDecl, "malloc") || |
| 770 | C.isCLibraryFunction(FDecl, "calloc") || |
| 771 | C.isCLibraryFunction(FDecl, "alloca")) |
| 772 | ArgNum = 0; |
| 773 | else if (C.isCLibraryFunction(FDecl, "memccpy")) |
| 774 | ArgNum = 3; |
| 775 | else if (C.isCLibraryFunction(FDecl, "realloc")) |
| 776 | ArgNum = 1; |
| 777 | else if (C.isCLibraryFunction(FDecl, "bcopy")) |
| 778 | ArgNum = 2; |
| 779 | } |
| 780 | |
Alexander Kornienko | 9c10490 | 2015-12-28 13:06:58 +0000 | [diff] [blame] | 781 | return ArgNum != InvalidArgIndex && CE->getNumArgs() > ArgNum && |
| 782 | generateReportIfTainted(CE->getArg(ArgNum), MsgTaintedBufferSize, C); |
Anna Zaks | 560dbe9 | 2012-01-18 02:45:11 +0000 | [diff] [blame] | 783 | } |
| 784 | |
Anna Zaks | 5c5bf9b | 2011-11-16 19:58:13 +0000 | [diff] [blame] | 785 | void ento::registerGenericTaintChecker(CheckerManager &mgr) { |
| 786 | mgr.registerChecker<GenericTaintChecker>(); |
| 787 | } |