blob: 3186abebc260d7b124f9982e2805a55abe3042f5 [file] [log] [blame]
Anna Zaks5c5bf9b2011-11-16 19:58:13 +00001//== GenericTaintChecker.cpp ----------------------------------- -*- C++ -*--=//
2//
3// The LLVM Compiler Infrastructure
4//
5// This file is distributed under the University of Illinois Open Source
6// License. See LICENSE.TXT for details.
7//
8//===----------------------------------------------------------------------===//
9//
10// This checker defines the attack surface for generic taint propagation.
11//
12// The taint information produced by it might be useful to other checkers. For
13// example, checkers should report errors which involve tainted data more
14// aggressively, even if the involved symbols are under constrained.
15//
16//===----------------------------------------------------------------------===//
17#include "ClangSACheckers.h"
Chandler Carruth3a022472012-12-04 09:13:33 +000018#include "clang/AST/Attr.h"
19#include "clang/Basic/Builtins.h"
20#include "clang/StaticAnalyzer/Core/BugReporter/BugType.h"
Anna Zaks5c5bf9b2011-11-16 19:58:13 +000021#include "clang/StaticAnalyzer/Core/Checker.h"
22#include "clang/StaticAnalyzer/Core/CheckerManager.h"
23#include "clang/StaticAnalyzer/Core/PathSensitive/CheckerContext.h"
Anna Zaks3b0ab202011-12-17 00:26:34 +000024#include "clang/StaticAnalyzer/Core/PathSensitive/ProgramStateTrait.h"
Anna Zaksb3fa8d72012-01-12 02:22:34 +000025#include <climits>
Anna Zaks5c5bf9b2011-11-16 19:58:13 +000026
27using namespace clang;
28using namespace ento;
29
30namespace {
Anna Zaks099fe3f2011-12-14 00:56:18 +000031class GenericTaintChecker : public Checker< check::PostStmt<CallExpr>,
Anna Zaks3b0ab202011-12-17 00:26:34 +000032 check::PreStmt<CallExpr> > {
33public:
Anna Zaks0244cd72012-01-14 02:48:40 +000034 static void *getTag() { static int Tag; return &Tag; }
35
36 void checkPostStmt(const CallExpr *CE, CheckerContext &C) const;
Anna Zaks0244cd72012-01-14 02:48:40 +000037
38 void checkPreStmt(const CallExpr *CE, CheckerContext &C) const;
Anna Zaks5c5bf9b2011-11-16 19:58:13 +000039
Anna Zaks3b0ab202011-12-17 00:26:34 +000040private:
Anna Zaksbf740512012-01-24 19:32:25 +000041 static const unsigned InvalidArgIndex = UINT_MAX;
42 /// Denotes the return vale.
43 static const unsigned ReturnValueIndex = UINT_MAX - 1;
Anna Zaks0244cd72012-01-14 02:48:40 +000044
Ahmed Charlesb8984322014-03-07 20:03:18 +000045 mutable std::unique_ptr<BugType> BT;
Anna Zaks5d324e52012-01-18 02:45:07 +000046 inline void initBugType() const {
47 if (!BT)
Alexander Kornienko4aca9b12014-02-11 21:49:21 +000048 BT.reset(new BugType(this, "Use of Untrusted Data", "Untrusted Data"));
Anna Zaks5d324e52012-01-18 02:45:07 +000049 }
Anna Zaks457c6872011-11-18 02:26:36 +000050
Anna Zaksb3fa8d72012-01-12 02:22:34 +000051 /// \brief Catch taint related bugs. Check if tainted data is passed to a
52 /// system call etc.
Anna Zaks126a2ef2012-01-07 02:33:10 +000053 bool checkPre(const CallExpr *CE, CheckerContext &C) const;
54
Anna Zaksb3fa8d72012-01-12 02:22:34 +000055 /// \brief Add taint sources on a pre-visit.
56 void addSourcesPre(const CallExpr *CE, CheckerContext &C) const;
57
58 /// \brief Propagate taint generated at pre-visit.
59 bool propagateFromPre(const CallExpr *CE, CheckerContext &C) const;
60
61 /// \brief Add taint sources on a post visit.
62 void addSourcesPost(const CallExpr *CE, CheckerContext &C) const;
63
Anna Zaksbf740512012-01-24 19:32:25 +000064 /// Check if the region the expression evaluates to is the standard input,
65 /// and thus, is tainted.
66 static bool isStdin(const Expr *E, CheckerContext &C);
67
Artem Dergacheveed7a312017-05-29 15:42:56 +000068 /// \brief Given a pointer argument, return the value it points to.
69 static Optional<SVal> getPointedToSVal(CheckerContext &C, const Expr *Arg);
Anna Zaks5c5bf9b2011-11-16 19:58:13 +000070
Anna Zaks3b0ab202011-12-17 00:26:34 +000071 /// Functions defining the attack surface.
Ted Kremenek49b1e382012-01-26 21:29:00 +000072 typedef ProgramStateRef (GenericTaintChecker::*FnCheck)(const CallExpr *,
Anna Zaks3b0ab202011-12-17 00:26:34 +000073 CheckerContext &C) const;
Ted Kremenek49b1e382012-01-26 21:29:00 +000074 ProgramStateRef postScanf(const CallExpr *CE, CheckerContext &C) const;
75 ProgramStateRef postSocket(const CallExpr *CE, CheckerContext &C) const;
76 ProgramStateRef postRetTaint(const CallExpr *CE, CheckerContext &C) const;
Anna Zaks3b0ab202011-12-17 00:26:34 +000077
78 /// Taint the scanned input if the file is tainted.
Ted Kremenek49b1e382012-01-26 21:29:00 +000079 ProgramStateRef preFscanf(const CallExpr *CE, CheckerContext &C) const;
Anna Zaks5c5bf9b2011-11-16 19:58:13 +000080
Anna Zaks126a2ef2012-01-07 02:33:10 +000081 /// Check for CWE-134: Uncontrolled Format String.
Anna Zaks0244cd72012-01-14 02:48:40 +000082 static const char MsgUncontrolledFormatString[];
Anna Zaks126a2ef2012-01-07 02:33:10 +000083 bool checkUncontrolledFormatString(const CallExpr *CE,
84 CheckerContext &C) const;
85
Anna Zaks0244cd72012-01-14 02:48:40 +000086 /// Check for:
87 /// CERT/STR02-C. "Sanitize data passed to complex subsystems"
88 /// CWE-78, "Failure to Sanitize Data into an OS Command"
89 static const char MsgSanitizeSystemArgs[];
90 bool checkSystemCall(const CallExpr *CE, StringRef Name,
91 CheckerContext &C) const;
Anna Zaks3b0ab202011-12-17 00:26:34 +000092
Anna Zaks560dbe92012-01-18 02:45:11 +000093 /// Check if tainted data is used as a buffer size ins strn.. functions,
94 /// and allocators.
95 static const char MsgTaintedBufferSize[];
96 bool checkTaintedBufferSize(const CallExpr *CE, const FunctionDecl *FDecl,
97 CheckerContext &C) const;
98
Anna Zaks0244cd72012-01-14 02:48:40 +000099 /// Generate a report if the expression is tainted or points to tainted data.
100 bool generateReportIfTainted(const Expr *E, const char Msg[],
101 CheckerContext &C) const;
Ted Kremenek3a0678e2015-09-08 03:50:52 +0000102
Anna Zaksd4e43ae2017-03-09 00:01:07 +0000103 /// The bug visitor prints a diagnostic message at the location where a given
104 /// variable was tainted.
105 class TaintBugVisitor
106 : public BugReporterVisitorImpl<TaintBugVisitor> {
107 private:
108 const SVal V;
109
110 public:
111 TaintBugVisitor(const SVal V) : V(V) {}
112 void Profile(llvm::FoldingSetNodeID &ID) const override { ID.Add(V); }
113
114 std::shared_ptr<PathDiagnosticPiece> VisitNode(const ExplodedNode *N,
115 const ExplodedNode *PrevN,
116 BugReporterContext &BRC,
117 BugReport &BR) override;
118 };
Ted Kremenek3a0678e2015-09-08 03:50:52 +0000119
Dmitri Gribenkof8579502013-01-12 19:30:44 +0000120 typedef SmallVector<unsigned, 2> ArgVector;
Anna Zaks3b0ab202011-12-17 00:26:34 +0000121
Anna Zaks3666d2c2012-01-17 00:37:02 +0000122 /// \brief A struct used to specify taint propagation rules for a function.
123 ///
124 /// If any of the possible taint source arguments is tainted, all of the
125 /// destination arguments should also be tainted. Use InvalidArgIndex in the
126 /// src list to specify that all of the arguments can introduce taint. Use
127 /// InvalidArgIndex in the dst arguments to signify that all the non-const
128 /// pointer and reference arguments might be tainted on return. If
129 /// ReturnValueIndex is added to the dst list, the return value will be
130 /// tainted.
131 struct TaintPropagationRule {
132 /// List of arguments which can be taint sources and should be checked.
133 ArgVector SrcArgs;
134 /// List of arguments which should be tainted on function return.
135 ArgVector DstArgs;
Anna Zaks5d324e52012-01-18 02:45:07 +0000136 // TODO: Check if using other data structures would be more optimal.
Anna Zaks3666d2c2012-01-17 00:37:02 +0000137
138 TaintPropagationRule() {}
139
Anna Zaks5d324e52012-01-18 02:45:07 +0000140 TaintPropagationRule(unsigned SArg,
141 unsigned DArg, bool TaintRet = false) {
Anna Zaks3666d2c2012-01-17 00:37:02 +0000142 SrcArgs.push_back(SArg);
143 DstArgs.push_back(DArg);
Anna Zaks5d324e52012-01-18 02:45:07 +0000144 if (TaintRet)
145 DstArgs.push_back(ReturnValueIndex);
Anna Zaks3666d2c2012-01-17 00:37:02 +0000146 }
147
Anna Zaks5d324e52012-01-18 02:45:07 +0000148 TaintPropagationRule(unsigned SArg1, unsigned SArg2,
149 unsigned DArg, bool TaintRet = false) {
150 SrcArgs.push_back(SArg1);
151 SrcArgs.push_back(SArg2);
152 DstArgs.push_back(DArg);
153 if (TaintRet)
154 DstArgs.push_back(ReturnValueIndex);
155 }
156
157 /// Get the propagation rule for a given function.
158 static TaintPropagationRule
159 getTaintPropagationRule(const FunctionDecl *FDecl,
160 StringRef Name,
161 CheckerContext &C);
162
Anna Zaks3666d2c2012-01-17 00:37:02 +0000163 inline void addSrcArg(unsigned A) { SrcArgs.push_back(A); }
164 inline void addDstArg(unsigned A) { DstArgs.push_back(A); }
165
Anna Zaks5d324e52012-01-18 02:45:07 +0000166 inline bool isNull() const { return SrcArgs.empty(); }
167
168 inline bool isDestinationArgument(unsigned ArgNum) const {
169 return (std::find(DstArgs.begin(),
170 DstArgs.end(), ArgNum) != DstArgs.end());
171 }
Anna Zaks3666d2c2012-01-17 00:37:02 +0000172
Anna Zaksbf740512012-01-24 19:32:25 +0000173 static inline bool isTaintedOrPointsToTainted(const Expr *E,
Ted Kremenek49b1e382012-01-26 21:29:00 +0000174 ProgramStateRef State,
Anna Zaksbf740512012-01-24 19:32:25 +0000175 CheckerContext &C) {
Artem Dergacheveed7a312017-05-29 15:42:56 +0000176 if (State->isTainted(E, C.getLocationContext()) || isStdin(E, C))
177 return true;
178
179 if (!E->getType().getTypePtr()->isPointerType())
180 return false;
181
182 Optional<SVal> V = getPointedToSVal(C, E);
183 return (V && State->isTainted(*V));
Anna Zaksbf740512012-01-24 19:32:25 +0000184 }
185
Anna Zaks7f6a6b72012-01-18 02:45:13 +0000186 /// \brief Pre-process a function which propagates taint according to the
187 /// taint rule.
Ted Kremenek49b1e382012-01-26 21:29:00 +0000188 ProgramStateRef process(const CallExpr *CE, CheckerContext &C) const;
Anna Zaks7f6a6b72012-01-18 02:45:13 +0000189
190 };
Anna Zaks5c5bf9b2011-11-16 19:58:13 +0000191};
Anna Zaks5d324e52012-01-18 02:45:07 +0000192
193const unsigned GenericTaintChecker::ReturnValueIndex;
194const unsigned GenericTaintChecker::InvalidArgIndex;
195
Anna Zaks0244cd72012-01-14 02:48:40 +0000196const char GenericTaintChecker::MsgUncontrolledFormatString[] =
Anna Zaks3705a1e2012-02-22 02:35:58 +0000197 "Untrusted data is used as a format string "
198 "(CWE-134: Uncontrolled Format String)";
Anna Zaks0244cd72012-01-14 02:48:40 +0000199
200const char GenericTaintChecker::MsgSanitizeSystemArgs[] =
Anna Zaks3705a1e2012-02-22 02:35:58 +0000201 "Untrusted data is passed to a system call "
Anna Zaks0244cd72012-01-14 02:48:40 +0000202 "(CERT/STR02-C. Sanitize data passed to complex subsystems)";
Anna Zaks560dbe92012-01-18 02:45:11 +0000203
204const char GenericTaintChecker::MsgTaintedBufferSize[] =
Anna Zaks3705a1e2012-02-22 02:35:58 +0000205 "Untrusted data is used to specify the buffer size "
Anna Zaks560dbe92012-01-18 02:45:11 +0000206 "(CERT/STR31-C. Guarantee that storage for strings has sufficient space for "
207 "character data and the null terminator)";
208
209} // end of anonymous namespace
Anna Zaks5c5bf9b2011-11-16 19:58:13 +0000210
Anna Zaksb3fa8d72012-01-12 02:22:34 +0000211/// A set which is used to pass information from call pre-visit instruction
212/// to the call post-visit. The values are unsigned integers, which are either
213/// ReturnValueIndex, or indexes of the pointer/reference argument, which
214/// points to data, which should be tainted on return.
Jordan Rose0c153cb2012-11-02 01:54:06 +0000215REGISTER_SET_WITH_PROGRAMSTATE(TaintArgsOnPostVisit, unsigned)
Anna Zaks3b0ab202011-12-17 00:26:34 +0000216
Anna Zaksd4e43ae2017-03-09 00:01:07 +0000217std::shared_ptr<PathDiagnosticPiece>
218GenericTaintChecker::TaintBugVisitor::VisitNode(const ExplodedNode *N,
219 const ExplodedNode *PrevN, BugReporterContext &BRC, BugReport &BR) {
220
221 // Find the ExplodedNode where the taint was first introduced
222 if (!N->getState()->isTainted(V) || PrevN->getState()->isTainted(V))
223 return nullptr;
224
225 const Stmt *S = PathDiagnosticLocation::getStmt(N);
226 if (!S)
227 return nullptr;
228
229 const LocationContext *NCtx = N->getLocationContext();
230 PathDiagnosticLocation L =
231 PathDiagnosticLocation::createBegin(S, BRC.getSourceManager(), NCtx);
232 if (!L.isValid() || !L.asLocation().isValid())
233 return nullptr;
234
235 return std::make_shared<PathDiagnosticEventPiece>(
236 L, "Taint originated here");
237}
238
Anna Zaks5d324e52012-01-18 02:45:07 +0000239GenericTaintChecker::TaintPropagationRule
240GenericTaintChecker::TaintPropagationRule::getTaintPropagationRule(
241 const FunctionDecl *FDecl,
242 StringRef Name,
243 CheckerContext &C) {
Enrico Pertoso4432d872015-06-03 09:10:58 +0000244 // TODO: Currently, we might lose precision here: we always mark a return
Anna Zaksbf740512012-01-24 19:32:25 +0000245 // value as tainted even if it's just a pointer, pointing to tainted data.
246
Anna Zaks5d324e52012-01-18 02:45:07 +0000247 // Check for exact name match for functions without builtin substitutes.
248 TaintPropagationRule Rule = llvm::StringSwitch<TaintPropagationRule>(Name)
249 .Case("atoi", TaintPropagationRule(0, ReturnValueIndex))
250 .Case("atol", TaintPropagationRule(0, ReturnValueIndex))
251 .Case("atoll", TaintPropagationRule(0, ReturnValueIndex))
Anna Zaksbf740512012-01-24 19:32:25 +0000252 .Case("getc", TaintPropagationRule(0, ReturnValueIndex))
253 .Case("fgetc", TaintPropagationRule(0, ReturnValueIndex))
254 .Case("getc_unlocked", TaintPropagationRule(0, ReturnValueIndex))
255 .Case("getw", TaintPropagationRule(0, ReturnValueIndex))
256 .Case("toupper", TaintPropagationRule(0, ReturnValueIndex))
257 .Case("tolower", TaintPropagationRule(0, ReturnValueIndex))
258 .Case("strchr", TaintPropagationRule(0, ReturnValueIndex))
259 .Case("strrchr", TaintPropagationRule(0, ReturnValueIndex))
Anna Zaks3b754b22012-01-20 00:11:19 +0000260 .Case("read", TaintPropagationRule(0, 2, 1, true))
261 .Case("pread", TaintPropagationRule(InvalidArgIndex, 1, true))
Anna Zaksbf740512012-01-24 19:32:25 +0000262 .Case("gets", TaintPropagationRule(InvalidArgIndex, 0, true))
263 .Case("fgets", TaintPropagationRule(2, 0, true))
264 .Case("getline", TaintPropagationRule(2, 0))
265 .Case("getdelim", TaintPropagationRule(3, 0))
266 .Case("fgetln", TaintPropagationRule(0, ReturnValueIndex))
Anna Zaks5d324e52012-01-18 02:45:07 +0000267 .Default(TaintPropagationRule());
268
269 if (!Rule.isNull())
270 return Rule;
271
272 // Check if it's one of the memory setting/copying functions.
273 // This check is specialized but faster then calling isCLibraryFunction.
274 unsigned BId = 0;
275 if ( (BId = FDecl->getMemoryFunctionKind()) )
276 switch(BId) {
277 case Builtin::BImemcpy:
278 case Builtin::BImemmove:
279 case Builtin::BIstrncpy:
280 case Builtin::BIstrncat:
281 return TaintPropagationRule(1, 2, 0, true);
Anna Zaks5d324e52012-01-18 02:45:07 +0000282 case Builtin::BIstrlcpy:
283 case Builtin::BIstrlcat:
284 return TaintPropagationRule(1, 2, 0, false);
Anna Zaks5d324e52012-01-18 02:45:07 +0000285 case Builtin::BIstrndup:
286 return TaintPropagationRule(0, 1, ReturnValueIndex);
Anna Zaks5d324e52012-01-18 02:45:07 +0000287
288 default:
289 break;
290 };
291
292 // Process all other functions which could be defined as builtins.
293 if (Rule.isNull()) {
294 if (C.isCLibraryFunction(FDecl, "snprintf") ||
295 C.isCLibraryFunction(FDecl, "sprintf"))
296 return TaintPropagationRule(InvalidArgIndex, 0, true);
297 else if (C.isCLibraryFunction(FDecl, "strcpy") ||
298 C.isCLibraryFunction(FDecl, "stpcpy") ||
299 C.isCLibraryFunction(FDecl, "strcat"))
300 return TaintPropagationRule(1, 0, true);
301 else if (C.isCLibraryFunction(FDecl, "bcopy"))
302 return TaintPropagationRule(0, 2, 1, false);
303 else if (C.isCLibraryFunction(FDecl, "strdup") ||
304 C.isCLibraryFunction(FDecl, "strdupa"))
305 return TaintPropagationRule(0, ReturnValueIndex);
Anna Zaks560dbe92012-01-18 02:45:11 +0000306 else if (C.isCLibraryFunction(FDecl, "wcsdup"))
307 return TaintPropagationRule(0, ReturnValueIndex);
Anna Zaks5d324e52012-01-18 02:45:07 +0000308 }
309
310 // Skipping the following functions, since they might be used for cleansing
311 // or smart memory copy:
Benjamin Kramer474261a2012-06-02 10:20:41 +0000312 // - memccpy - copying until hitting a special character.
Anna Zaks5d324e52012-01-18 02:45:07 +0000313
314 return TaintPropagationRule();
Anna Zaks457c6872011-11-18 02:26:36 +0000315}
316
Anna Zaks3b0ab202011-12-17 00:26:34 +0000317void GenericTaintChecker::checkPreStmt(const CallExpr *CE,
318 CheckerContext &C) const {
Anna Zaks126a2ef2012-01-07 02:33:10 +0000319 // Check for errors first.
320 if (checkPre(CE, C))
321 return;
Anna Zaks3b0ab202011-12-17 00:26:34 +0000322
Anna Zaks126a2ef2012-01-07 02:33:10 +0000323 // Add taint second.
Anna Zaksb3fa8d72012-01-12 02:22:34 +0000324 addSourcesPre(CE, C);
Anna Zaks126a2ef2012-01-07 02:33:10 +0000325}
326
327void GenericTaintChecker::checkPostStmt(const CallExpr *CE,
328 CheckerContext &C) const {
Anna Zaksb3fa8d72012-01-12 02:22:34 +0000329 if (propagateFromPre(CE, C))
330 return;
331 addSourcesPost(CE, C);
Anna Zaks126a2ef2012-01-07 02:33:10 +0000332}
333
Anna Zaksb3fa8d72012-01-12 02:22:34 +0000334void GenericTaintChecker::addSourcesPre(const CallExpr *CE,
335 CheckerContext &C) const {
Craig Topper0dbb7832014-05-27 02:45:47 +0000336 ProgramStateRef State = nullptr;
Anna Zaks5d324e52012-01-18 02:45:07 +0000337 const FunctionDecl *FDecl = C.getCalleeDecl(CE);
Jordan Rose6cd16c52012-07-10 23:13:01 +0000338 if (!FDecl || FDecl->getKind() != Decl::Function)
339 return;
340
Anna Zaks5d324e52012-01-18 02:45:07 +0000341 StringRef Name = C.getCalleeName(FDecl);
Anna Zaksb3fa8d72012-01-12 02:22:34 +0000342 if (Name.empty())
343 return;
Anna Zaks3666d2c2012-01-17 00:37:02 +0000344
Anna Zaks5d324e52012-01-18 02:45:07 +0000345 // First, try generating a propagation rule for this function.
346 TaintPropagationRule Rule =
347 TaintPropagationRule::getTaintPropagationRule(FDecl, Name, C);
Anna Zaks3666d2c2012-01-17 00:37:02 +0000348 if (!Rule.isNull()) {
Anna Zaks7f6a6b72012-01-18 02:45:13 +0000349 State = Rule.process(CE, C);
Anna Zaks3666d2c2012-01-17 00:37:02 +0000350 if (!State)
351 return;
352 C.addTransition(State);
Anna Zaks5d324e52012-01-18 02:45:07 +0000353 return;
Anna Zaks3666d2c2012-01-17 00:37:02 +0000354 }
355
Anna Zaks5d324e52012-01-18 02:45:07 +0000356 // Otherwise, check if we have custom pre-processing implemented.
Anna Zaks3b0ab202011-12-17 00:26:34 +0000357 FnCheck evalFunction = llvm::StringSwitch<FnCheck>(Name)
Anna Zaksb3fa8d72012-01-12 02:22:34 +0000358 .Case("fscanf", &GenericTaintChecker::preFscanf)
Craig Topper0dbb7832014-05-27 02:45:47 +0000359 .Default(nullptr);
Anna Zaks3b0ab202011-12-17 00:26:34 +0000360 // Check and evaluate the call.
361 if (evalFunction)
362 State = (this->*evalFunction)(CE, C);
363 if (!State)
Anna Zaks5c5bf9b2011-11-16 19:58:13 +0000364 return;
Anna Zaks3b0ab202011-12-17 00:26:34 +0000365 C.addTransition(State);
Anna Zaks5d324e52012-01-18 02:45:07 +0000366
Anna Zaks3b0ab202011-12-17 00:26:34 +0000367}
368
Anna Zaksb3fa8d72012-01-12 02:22:34 +0000369bool GenericTaintChecker::propagateFromPre(const CallExpr *CE,
370 CheckerContext &C) const {
Ted Kremenek49b1e382012-01-26 21:29:00 +0000371 ProgramStateRef State = C.getState();
Anna Zaksb3fa8d72012-01-12 02:22:34 +0000372
373 // Depending on what was tainted at pre-visit, we determined a set of
374 // arguments which should be tainted after the function returns. These are
375 // stored in the state as TaintArgsOnPostVisit set.
Jordan Rose0c153cb2012-11-02 01:54:06 +0000376 TaintArgsOnPostVisitTy TaintArgs = State->get<TaintArgsOnPostVisit>();
Anna Zaksbf740512012-01-24 19:32:25 +0000377 if (TaintArgs.isEmpty())
378 return false;
379
Anna Zaksb3fa8d72012-01-12 02:22:34 +0000380 for (llvm::ImmutableSet<unsigned>::iterator
381 I = TaintArgs.begin(), E = TaintArgs.end(); I != E; ++I) {
382 unsigned ArgNum = *I;
383
384 // Special handling for the tainted return value.
385 if (ArgNum == ReturnValueIndex) {
386 State = State->addTaint(CE, C.getLocationContext());
387 continue;
388 }
389
390 // The arguments are pointer arguments. The data they are pointing at is
391 // tainted after the call.
Anna Zaksb508d292012-04-10 23:41:11 +0000392 if (CE->getNumArgs() < (ArgNum + 1))
393 return false;
Anna Zaksb3fa8d72012-01-12 02:22:34 +0000394 const Expr* Arg = CE->getArg(ArgNum);
Artem Dergacheveed7a312017-05-29 15:42:56 +0000395 Optional<SVal> V = getPointedToSVal(C, Arg);
396 if (V)
397 State = State->addTaint(*V);
Anna Zaksb3fa8d72012-01-12 02:22:34 +0000398 }
399
400 // Clear up the taint info from the state.
401 State = State->remove<TaintArgsOnPostVisit>();
402
403 if (State != C.getState()) {
404 C.addTransition(State);
405 return true;
406 }
407 return false;
408}
409
410void GenericTaintChecker::addSourcesPost(const CallExpr *CE,
411 CheckerContext &C) const {
Anna Zaks5c5bf9b2011-11-16 19:58:13 +0000412 // Define the attack surface.
413 // Set the evaluation function by switching on the callee name.
Jordan Rose6cd16c52012-07-10 23:13:01 +0000414 const FunctionDecl *FDecl = C.getCalleeDecl(CE);
415 if (!FDecl || FDecl->getKind() != Decl::Function)
416 return;
417
418 StringRef Name = C.getCalleeName(FDecl);
Anna Zaksb3fa8d72012-01-12 02:22:34 +0000419 if (Name.empty())
420 return;
Anna Zaks5c5bf9b2011-11-16 19:58:13 +0000421 FnCheck evalFunction = llvm::StringSwitch<FnCheck>(Name)
Anna Zaks3b0ab202011-12-17 00:26:34 +0000422 .Case("scanf", &GenericTaintChecker::postScanf)
Anna Zakseefc0e92011-12-14 00:56:02 +0000423 // TODO: Add support for vfscanf & family.
Anna Zaks3b0ab202011-12-17 00:26:34 +0000424 .Case("getchar", &GenericTaintChecker::postRetTaint)
Anna Zaksbf740512012-01-24 19:32:25 +0000425 .Case("getchar_unlocked", &GenericTaintChecker::postRetTaint)
Anna Zaks3b0ab202011-12-17 00:26:34 +0000426 .Case("getenv", &GenericTaintChecker::postRetTaint)
427 .Case("fopen", &GenericTaintChecker::postRetTaint)
428 .Case("fdopen", &GenericTaintChecker::postRetTaint)
429 .Case("freopen", &GenericTaintChecker::postRetTaint)
Anna Zaksbf740512012-01-24 19:32:25 +0000430 .Case("getch", &GenericTaintChecker::postRetTaint)
431 .Case("wgetch", &GenericTaintChecker::postRetTaint)
Anna Zaks3b754b22012-01-20 00:11:19 +0000432 .Case("socket", &GenericTaintChecker::postSocket)
Craig Topper0dbb7832014-05-27 02:45:47 +0000433 .Default(nullptr);
Anna Zaks5c5bf9b2011-11-16 19:58:13 +0000434
435 // If the callee isn't defined, it is not of security concern.
436 // Check and evaluate the call.
Craig Topper0dbb7832014-05-27 02:45:47 +0000437 ProgramStateRef State = nullptr;
Anna Zaks5c5bf9b2011-11-16 19:58:13 +0000438 if (evalFunction)
Anna Zaks3b0ab202011-12-17 00:26:34 +0000439 State = (this->*evalFunction)(CE, C);
440 if (!State)
441 return;
Anna Zaks5c5bf9b2011-11-16 19:58:13 +0000442
Anna Zaks3b0ab202011-12-17 00:26:34 +0000443 C.addTransition(State);
Anna Zaks5c5bf9b2011-11-16 19:58:13 +0000444}
Anna Zaks457c6872011-11-18 02:26:36 +0000445
Anna Zaks126a2ef2012-01-07 02:33:10 +0000446bool GenericTaintChecker::checkPre(const CallExpr *CE, CheckerContext &C) const{
447
448 if (checkUncontrolledFormatString(CE, C))
449 return true;
450
Anna Zaks560dbe92012-01-18 02:45:11 +0000451 const FunctionDecl *FDecl = C.getCalleeDecl(CE);
Jordan Rose6cd16c52012-07-10 23:13:01 +0000452 if (!FDecl || FDecl->getKind() != Decl::Function)
453 return false;
454
Anna Zaks560dbe92012-01-18 02:45:11 +0000455 StringRef Name = C.getCalleeName(FDecl);
Anna Zaks0244cd72012-01-14 02:48:40 +0000456 if (Name.empty())
457 return false;
458
459 if (checkSystemCall(CE, Name, C))
460 return true;
461
Anna Zaks560dbe92012-01-18 02:45:11 +0000462 if (checkTaintedBufferSize(CE, FDecl, C))
463 return true;
464
Anna Zaks126a2ef2012-01-07 02:33:10 +0000465 return false;
466}
467
Artem Dergacheveed7a312017-05-29 15:42:56 +0000468Optional<SVal> GenericTaintChecker::getPointedToSVal(CheckerContext &C,
Artem Dergachev3ef5deb2017-12-12 02:27:55 +0000469 const Expr *Arg) {
Ted Kremenek49b1e382012-01-26 21:29:00 +0000470 ProgramStateRef State = C.getState();
George Karpenkovd703ec92018-01-17 20:27:29 +0000471 SVal AddrVal = C.getSVal(Arg->IgnoreParens());
Anna Zakse48ee502011-12-16 18:28:50 +0000472 if (AddrVal.isUnknownOrUndef())
Artem Dergacheveed7a312017-05-29 15:42:56 +0000473 return None;
Anna Zaks7c96b7d2011-12-11 18:43:40 +0000474
David Blaikie05785d12013-02-20 22:23:23 +0000475 Optional<Loc> AddrLoc = AddrVal.getAs<Loc>();
Anna Zaks7f6a6b72012-01-18 02:45:13 +0000476 if (!AddrLoc)
Artem Dergacheveed7a312017-05-29 15:42:56 +0000477 return None;
Anna Zaks457c6872011-11-18 02:26:36 +0000478
Artem Dergachev3ef5deb2017-12-12 02:27:55 +0000479 QualType ArgTy = Arg->getType().getCanonicalType();
480 if (!ArgTy->isPointerType())
481 return None;
482
483 QualType ValTy = ArgTy->getPointeeType();
484
485 // Do not dereference void pointers. Treat them as byte pointers instead.
486 // FIXME: we might want to consider more than just the first byte.
487 if (ValTy->isVoidType())
488 ValTy = C.getASTContext().CharTy;
489
490 return State->getSVal(*AddrLoc, ValTy);
Anna Zaks5c5bf9b2011-11-16 19:58:13 +0000491}
492
Ted Kremenek3a0678e2015-09-08 03:50:52 +0000493ProgramStateRef
Anna Zaks7f6a6b72012-01-18 02:45:13 +0000494GenericTaintChecker::TaintPropagationRule::process(const CallExpr *CE,
495 CheckerContext &C) const {
Ted Kremenek49b1e382012-01-26 21:29:00 +0000496 ProgramStateRef State = C.getState();
Anna Zaks3666d2c2012-01-17 00:37:02 +0000497
498 // Check for taint in arguments.
499 bool IsTainted = false;
Anna Zaks7f6a6b72012-01-18 02:45:13 +0000500 for (ArgVector::const_iterator I = SrcArgs.begin(),
501 E = SrcArgs.end(); I != E; ++I) {
Anna Zaks3666d2c2012-01-17 00:37:02 +0000502 unsigned ArgNum = *I;
503
504 if (ArgNum == InvalidArgIndex) {
Anna Zaks5d324e52012-01-18 02:45:07 +0000505 // Check if any of the arguments is tainted, but skip the
506 // destination arguments.
507 for (unsigned int i = 0; i < CE->getNumArgs(); ++i) {
Anna Zaks7f6a6b72012-01-18 02:45:13 +0000508 if (isDestinationArgument(i))
Anna Zaks5d324e52012-01-18 02:45:07 +0000509 continue;
Anna Zaksbf740512012-01-24 19:32:25 +0000510 if ((IsTainted = isTaintedOrPointsToTainted(CE->getArg(i), State, C)))
Anna Zaks3666d2c2012-01-17 00:37:02 +0000511 break;
Anna Zaks5d324e52012-01-18 02:45:07 +0000512 }
Anna Zaks3666d2c2012-01-17 00:37:02 +0000513 break;
514 }
515
Anna Zaksb508d292012-04-10 23:41:11 +0000516 if (CE->getNumArgs() < (ArgNum + 1))
517 return State;
Anna Zaksbf740512012-01-24 19:32:25 +0000518 if ((IsTainted = isTaintedOrPointsToTainted(CE->getArg(ArgNum), State, C)))
Anna Zaks3666d2c2012-01-17 00:37:02 +0000519 break;
520 }
521 if (!IsTainted)
522 return State;
523
524 // Mark the arguments which should be tainted after the function returns.
Anna Zaks7f6a6b72012-01-18 02:45:13 +0000525 for (ArgVector::const_iterator I = DstArgs.begin(),
526 E = DstArgs.end(); I != E; ++I) {
Anna Zaks3666d2c2012-01-17 00:37:02 +0000527 unsigned ArgNum = *I;
528
529 // Should we mark all arguments as tainted?
530 if (ArgNum == InvalidArgIndex) {
531 // For all pointer and references that were passed in:
532 // If they are not pointing to const data, mark data as tainted.
533 // TODO: So far we are just going one level down; ideally we'd need to
534 // recurse here.
535 for (unsigned int i = 0; i < CE->getNumArgs(); ++i) {
536 const Expr *Arg = CE->getArg(i);
537 // Process pointer argument.
538 const Type *ArgTy = Arg->getType().getTypePtr();
539 QualType PType = ArgTy->getPointeeType();
540 if ((!PType.isNull() && !PType.isConstQualified())
541 || (ArgTy->isReferenceType() && !Arg->getType().isConstQualified()))
542 State = State->add<TaintArgsOnPostVisit>(i);
543 }
544 continue;
545 }
546
547 // Should mark the return value?
548 if (ArgNum == ReturnValueIndex) {
549 State = State->add<TaintArgsOnPostVisit>(ReturnValueIndex);
550 continue;
551 }
552
553 // Mark the given argument.
554 assert(ArgNum < CE->getNumArgs());
555 State = State->add<TaintArgsOnPostVisit>(ArgNum);
556 }
557
558 return State;
559}
560
561
Anna Zaksb3fa8d72012-01-12 02:22:34 +0000562// If argument 0 (file descriptor) is tainted, all arguments except for arg 0
563// and arg 1 should get taint.
Ted Kremenek49b1e382012-01-26 21:29:00 +0000564ProgramStateRef GenericTaintChecker::preFscanf(const CallExpr *CE,
Anna Zaks3b0ab202011-12-17 00:26:34 +0000565 CheckerContext &C) const {
566 assert(CE->getNumArgs() >= 2);
Ted Kremenek49b1e382012-01-26 21:29:00 +0000567 ProgramStateRef State = C.getState();
Anna Zaks3b0ab202011-12-17 00:26:34 +0000568
569 // Check is the file descriptor is tainted.
Ted Kremenek632e3b72012-01-06 22:09:28 +0000570 if (State->isTainted(CE->getArg(0), C.getLocationContext()) ||
Anna Zaksb3fa8d72012-01-12 02:22:34 +0000571 isStdin(CE->getArg(0), C)) {
572 // All arguments except for the first two should get taint.
573 for (unsigned int i = 2; i < CE->getNumArgs(); ++i)
574 State = State->add<TaintArgsOnPostVisit>(i);
575 return State;
576 }
577
Craig Topper0dbb7832014-05-27 02:45:47 +0000578 return nullptr;
Anna Zaks3b0ab202011-12-17 00:26:34 +0000579}
580
Anna Zaks3b754b22012-01-20 00:11:19 +0000581
582// If argument 0(protocol domain) is network, the return value should get taint.
Ted Kremenek49b1e382012-01-26 21:29:00 +0000583ProgramStateRef GenericTaintChecker::postSocket(const CallExpr *CE,
Anna Zaksb508d292012-04-10 23:41:11 +0000584 CheckerContext &C) const {
Ted Kremenek49b1e382012-01-26 21:29:00 +0000585 ProgramStateRef State = C.getState();
Anna Zaksb508d292012-04-10 23:41:11 +0000586 if (CE->getNumArgs() < 3)
587 return State;
Anna Zaks3b754b22012-01-20 00:11:19 +0000588
589 SourceLocation DomLoc = CE->getArg(0)->getExprLoc();
590 StringRef DomName = C.getMacroNameOrSpelling(DomLoc);
591 // White list the internal communication protocols.
592 if (DomName.equals("AF_SYSTEM") || DomName.equals("AF_LOCAL") ||
593 DomName.equals("AF_UNIX") || DomName.equals("AF_RESERVED_36"))
594 return State;
595 State = State->addTaint(CE, C.getLocationContext());
596 return State;
597}
598
Ted Kremenek49b1e382012-01-26 21:29:00 +0000599ProgramStateRef GenericTaintChecker::postScanf(const CallExpr *CE,
Anna Zaks3b0ab202011-12-17 00:26:34 +0000600 CheckerContext &C) const {
Ted Kremenek49b1e382012-01-26 21:29:00 +0000601 ProgramStateRef State = C.getState();
Anna Zaksb508d292012-04-10 23:41:11 +0000602 if (CE->getNumArgs() < 2)
603 return State;
604
Anna Zaks5c5bf9b2011-11-16 19:58:13 +0000605 // All arguments except for the very first one should get taint.
606 for (unsigned int i = 1; i < CE->getNumArgs(); ++i) {
607 // The arguments are pointer arguments. The data they are pointing at is
608 // tainted after the call.
609 const Expr* Arg = CE->getArg(i);
Artem Dergacheveed7a312017-05-29 15:42:56 +0000610 Optional<SVal> V = getPointedToSVal(C, Arg);
611 if (V)
612 State = State->addTaint(*V);
Anna Zakseefc0e92011-12-14 00:56:02 +0000613 }
Anna Zaks3b0ab202011-12-17 00:26:34 +0000614 return State;
Anna Zaks5c5bf9b2011-11-16 19:58:13 +0000615}
616
Ted Kremenek49b1e382012-01-26 21:29:00 +0000617ProgramStateRef GenericTaintChecker::postRetTaint(const CallExpr *CE,
Anna Zaksb508d292012-04-10 23:41:11 +0000618 CheckerContext &C) const {
Ted Kremenek632e3b72012-01-06 22:09:28 +0000619 return C.getState()->addTaint(CE, C.getLocationContext());
Anna Zaks5c5bf9b2011-11-16 19:58:13 +0000620}
621
Anna Zaksbf740512012-01-24 19:32:25 +0000622bool GenericTaintChecker::isStdin(const Expr *E, CheckerContext &C) {
Ted Kremenek49b1e382012-01-26 21:29:00 +0000623 ProgramStateRef State = C.getState();
George Karpenkovd703ec92018-01-17 20:27:29 +0000624 SVal Val = C.getSVal(E);
Anna Zaks099fe3f2011-12-14 00:56:18 +0000625
Anna Zakse48ee502011-12-16 18:28:50 +0000626 // stdin is a pointer, so it would be a region.
627 const MemRegion *MemReg = Val.getAsRegion();
628
629 // The region should be symbolic, we do not know it's value.
630 const SymbolicRegion *SymReg = dyn_cast_or_null<SymbolicRegion>(MemReg);
631 if (!SymReg)
Anna Zaks099fe3f2011-12-14 00:56:18 +0000632 return false;
633
Anna Zakse48ee502011-12-16 18:28:50 +0000634 // Get it's symbol and find the declaration region it's pointing to.
635 const SymbolRegionValue *Sm =dyn_cast<SymbolRegionValue>(SymReg->getSymbol());
636 if (!Sm)
637 return false;
638 const DeclRegion *DeclReg = dyn_cast_or_null<DeclRegion>(Sm->getRegion());
639 if (!DeclReg)
640 return false;
Anna Zaks099fe3f2011-12-14 00:56:18 +0000641
Anna Zakse48ee502011-12-16 18:28:50 +0000642 // This region corresponds to a declaration, find out if it's a global/extern
643 // variable named stdin with the proper type.
644 if (const VarDecl *D = dyn_cast_or_null<VarDecl>(DeclReg->getDecl())) {
645 D = D->getCanonicalDecl();
646 if ((D->getName().find("stdin") != StringRef::npos) && D->isExternC())
647 if (const PointerType * PtrTy =
648 dyn_cast<PointerType>(D->getType().getTypePtr()))
Henry Wongcb2ad242018-03-05 15:41:15 +0000649 if (PtrTy->getPointeeType().getCanonicalType() ==
650 C.getASTContext().getFILEType().getCanonicalType())
Anna Zakse48ee502011-12-16 18:28:50 +0000651 return true;
652 }
Anna Zaks099fe3f2011-12-14 00:56:18 +0000653 return false;
654}
655
Anna Zaks126a2ef2012-01-07 02:33:10 +0000656static bool getPrintfFormatArgumentNum(const CallExpr *CE,
657 const CheckerContext &C,
658 unsigned int &ArgNum) {
659 // Find if the function contains a format string argument.
660 // Handles: fprintf, printf, sprintf, snprintf, vfprintf, vprintf, vsprintf,
661 // vsnprintf, syslog, custom annotated functions.
662 const FunctionDecl *FDecl = C.getCalleeDecl(CE);
663 if (!FDecl)
664 return false;
Aaron Ballmanbe22bcb2014-03-10 17:08:28 +0000665 for (const auto *Format : FDecl->specific_attrs<FormatAttr>()) {
Anna Zaks126a2ef2012-01-07 02:33:10 +0000666 ArgNum = Format->getFormatIdx() - 1;
Aaron Ballmanf58070b2013-09-03 21:02:22 +0000667 if ((Format->getType()->getName() == "printf") &&
668 CE->getNumArgs() > ArgNum)
Anna Zaks126a2ef2012-01-07 02:33:10 +0000669 return true;
670 }
671
672 // Or if a function is named setproctitle (this is a heuristic).
673 if (C.getCalleeName(CE).find("setproctitle") != StringRef::npos) {
674 ArgNum = 0;
675 return true;
676 }
677
678 return false;
679}
680
Anna Zaks0244cd72012-01-14 02:48:40 +0000681bool GenericTaintChecker::generateReportIfTainted(const Expr *E,
682 const char Msg[],
683 CheckerContext &C) const {
684 assert(E);
685
686 // Check for taint.
Ted Kremenek49b1e382012-01-26 21:29:00 +0000687 ProgramStateRef State = C.getState();
Artem Dergacheveed7a312017-05-29 15:42:56 +0000688 Optional<SVal> PointedToSVal = getPointedToSVal(C, E);
Anna Zaksd4e43ae2017-03-09 00:01:07 +0000689 SVal TaintedSVal;
Artem Dergacheveed7a312017-05-29 15:42:56 +0000690 if (PointedToSVal && State->isTainted(*PointedToSVal))
691 TaintedSVal = *PointedToSVal;
Anna Zaksd4e43ae2017-03-09 00:01:07 +0000692 else if (State->isTainted(E, C.getLocationContext()))
693 TaintedSVal = C.getSVal(E);
694 else
Anna Zaks0244cd72012-01-14 02:48:40 +0000695 return false;
696
697 // Generate diagnostic.
Devin Coughline39bd402015-09-16 22:03:05 +0000698 if (ExplodedNode *N = C.generateNonFatalErrorNode()) {
Anna Zaks0244cd72012-01-14 02:48:40 +0000699 initBugType();
Aaron Ballman8d3a7a52015-06-23 13:15:32 +0000700 auto report = llvm::make_unique<BugReport>(*BT, Msg, N);
Anna Zaks0244cd72012-01-14 02:48:40 +0000701 report->addRange(E->getSourceRange());
Anna Zaksd4e43ae2017-03-09 00:01:07 +0000702 report->addVisitor(llvm::make_unique<TaintBugVisitor>(TaintedSVal));
Aaron Ballman8d3a7a52015-06-23 13:15:32 +0000703 C.emitReport(std::move(report));
Anna Zaks0244cd72012-01-14 02:48:40 +0000704 return true;
705 }
706 return false;
707}
708
Anna Zaks126a2ef2012-01-07 02:33:10 +0000709bool GenericTaintChecker::checkUncontrolledFormatString(const CallExpr *CE,
710 CheckerContext &C) const{
711 // Check if the function contains a format string argument.
712 unsigned int ArgNum = 0;
713 if (!getPrintfFormatArgumentNum(CE, C, ArgNum))
714 return false;
715
716 // If either the format string content or the pointer itself are tainted, warn.
Alexander Kornienko9c104902015-12-28 13:06:58 +0000717 return generateReportIfTainted(CE->getArg(ArgNum),
718 MsgUncontrolledFormatString, C);
Anna Zaks0244cd72012-01-14 02:48:40 +0000719}
720
721bool GenericTaintChecker::checkSystemCall(const CallExpr *CE,
722 StringRef Name,
723 CheckerContext &C) const {
Ted Kremenek3a0678e2015-09-08 03:50:52 +0000724 // TODO: It might make sense to run this check on demand. In some cases,
725 // we should check if the environment has been cleansed here. We also might
Anna Zaksbf740512012-01-24 19:32:25 +0000726 // need to know if the user was reset before these calls(seteuid).
Anna Zaks0244cd72012-01-14 02:48:40 +0000727 unsigned ArgNum = llvm::StringSwitch<unsigned>(Name)
728 .Case("system", 0)
729 .Case("popen", 0)
Anna Zaks3b754b22012-01-20 00:11:19 +0000730 .Case("execl", 0)
731 .Case("execle", 0)
732 .Case("execlp", 0)
733 .Case("execv", 0)
734 .Case("execvp", 0)
735 .Case("execvP", 0)
Anna Zaksbf740512012-01-24 19:32:25 +0000736 .Case("execve", 0)
737 .Case("dlopen", 0)
Anna Zaks0244cd72012-01-14 02:48:40 +0000738 .Default(UINT_MAX);
739
Anna Zaksb508d292012-04-10 23:41:11 +0000740 if (ArgNum == UINT_MAX || CE->getNumArgs() < (ArgNum + 1))
Anna Zaks0244cd72012-01-14 02:48:40 +0000741 return false;
742
Alexander Kornienko9c104902015-12-28 13:06:58 +0000743 return generateReportIfTainted(CE->getArg(ArgNum), MsgSanitizeSystemArgs, C);
Anna Zaks126a2ef2012-01-07 02:33:10 +0000744}
745
Anna Zaks560dbe92012-01-18 02:45:11 +0000746// TODO: Should this check be a part of the CString checker?
747// If yes, should taint be a global setting?
748bool GenericTaintChecker::checkTaintedBufferSize(const CallExpr *CE,
749 const FunctionDecl *FDecl,
750 CheckerContext &C) const {
751 // If the function has a buffer size argument, set ArgNum.
752 unsigned ArgNum = InvalidArgIndex;
753 unsigned BId = 0;
754 if ( (BId = FDecl->getMemoryFunctionKind()) )
755 switch(BId) {
756 case Builtin::BImemcpy:
757 case Builtin::BImemmove:
758 case Builtin::BIstrncpy:
759 ArgNum = 2;
760 break;
761 case Builtin::BIstrndup:
762 ArgNum = 1;
763 break;
764 default:
765 break;
766 };
767
768 if (ArgNum == InvalidArgIndex) {
769 if (C.isCLibraryFunction(FDecl, "malloc") ||
770 C.isCLibraryFunction(FDecl, "calloc") ||
771 C.isCLibraryFunction(FDecl, "alloca"))
772 ArgNum = 0;
773 else if (C.isCLibraryFunction(FDecl, "memccpy"))
774 ArgNum = 3;
775 else if (C.isCLibraryFunction(FDecl, "realloc"))
776 ArgNum = 1;
777 else if (C.isCLibraryFunction(FDecl, "bcopy"))
778 ArgNum = 2;
779 }
780
Alexander Kornienko9c104902015-12-28 13:06:58 +0000781 return ArgNum != InvalidArgIndex && CE->getNumArgs() > ArgNum &&
782 generateReportIfTainted(CE->getArg(ArgNum), MsgTaintedBufferSize, C);
Anna Zaks560dbe92012-01-18 02:45:11 +0000783}
784
Anna Zaks5c5bf9b2011-11-16 19:58:13 +0000785void ento::registerGenericTaintChecker(CheckerManager &mgr) {
786 mgr.registerChecker<GenericTaintChecker>();
787}