1 //=== StackAddrEscapeChecker.cpp ----------------------------------*- C++ -*--//
2 //
3 // Part of the LLVM Project, under the Apache License v2.0 with LLVM Exceptions.
4 // See https://llvm.org/LICENSE.txt for license information.
5 // SPDX-License-Identifier: Apache-2.0 WITH LLVM-exception
6 //
7 //===----------------------------------------------------------------------===//
8 //
9 // This file defines stack address leak checker, which checks if an invalid
10 // stack address is stored into a global or heap location. See CERT DCL30-C.
11 //
12 //===----------------------------------------------------------------------===//
13 
14 #include "clang/AST/ExprCXX.h"
15 #include "clang/Basic/SourceManager.h"
16 #include "clang/StaticAnalyzer/Checkers/BuiltinCheckerRegistration.h"
17 #include "clang/StaticAnalyzer/Core/BugReporter/BugType.h"
18 #include "clang/StaticAnalyzer/Core/Checker.h"
19 #include "clang/StaticAnalyzer/Core/CheckerManager.h"
20 #include "clang/StaticAnalyzer/Core/PathSensitive/CallEvent.h"
21 #include "clang/StaticAnalyzer/Core/PathSensitive/CheckerContext.h"
22 #include "clang/StaticAnalyzer/Core/PathSensitive/ProgramState.h"
23 #include "llvm/ADT/SmallString.h"
24 #include "llvm/Support/raw_ostream.h"
25 using namespace clang;
26 using namespace ento;
27 
28 namespace {
29 class StackAddrEscapeChecker
30     : public Checker<check::PreCall, check::PreStmt<ReturnStmt>,
31                      check::EndFunction> {
32   mutable IdentifierInfo *dispatch_semaphore_tII;
33   mutable std::unique_ptr<BuiltinBug> BT_stackleak;
34   mutable std::unique_ptr<BuiltinBug> BT_returnstack;
35   mutable std::unique_ptr<BuiltinBug> BT_capturedstackasync;
36   mutable std::unique_ptr<BuiltinBug> BT_capturedstackret;
37 
38 public:
39   enum CheckKind {
40     CK_StackAddrEscapeChecker,
41     CK_StackAddrAsyncEscapeChecker,
42     CK_NumCheckKinds
43   };
44 
45   bool ChecksEnabled[CK_NumCheckKinds] = {false};
46   CheckerNameRef CheckNames[CK_NumCheckKinds];
47 
48   void checkPreCall(const CallEvent &Call, CheckerContext &C) const;
49   void checkPreStmt(const ReturnStmt *RS, CheckerContext &C) const;
50   void checkEndFunction(const ReturnStmt *RS, CheckerContext &Ctx) const;
51 
52 private:
53   void checkReturnedBlockCaptures(const BlockDataRegion &B,
54                                   CheckerContext &C) const;
55   void checkAsyncExecutedBlockCaptures(const BlockDataRegion &B,
56                                        CheckerContext &C) const;
57   void EmitStackError(CheckerContext &C, const MemRegion *R,
58                       const Expr *RetE) const;
59   bool isSemaphoreCaptured(const BlockDecl &B) const;
60   static SourceRange genName(raw_ostream &os, const MemRegion *R,
61                              ASTContext &Ctx);
62   static SmallVector<const MemRegion *, 4>
63   getCapturedStackRegions(const BlockDataRegion &B, CheckerContext &C);
64   static bool isNotInCurrentFrame(const MemRegion *R, CheckerContext &C);
65 };
66 } // namespace
67 
genName(raw_ostream & os,const MemRegion * R,ASTContext & Ctx)68 SourceRange StackAddrEscapeChecker::genName(raw_ostream &os, const MemRegion *R,
69                                             ASTContext &Ctx) {
70   // Get the base region, stripping away fields and elements.
71   R = R->getBaseRegion();
72   SourceManager &SM = Ctx.getSourceManager();
73   SourceRange range;
74   os << "Address of ";
75 
76   // Check if the region is a compound literal.
77   if (const auto *CR = dyn_cast<CompoundLiteralRegion>(R)) {
78     const CompoundLiteralExpr *CL = CR->getLiteralExpr();
79     os << "stack memory associated with a compound literal "
80           "declared on line "
81        << SM.getExpansionLineNumber(CL->getBeginLoc()) << " returned to caller";
82     range = CL->getSourceRange();
83   } else if (const auto *AR = dyn_cast<AllocaRegion>(R)) {
84     const Expr *ARE = AR->getExpr();
85     SourceLocation L = ARE->getBeginLoc();
86     range = ARE->getSourceRange();
87     os << "stack memory allocated by call to alloca() on line "
88        << SM.getExpansionLineNumber(L);
89   } else if (const auto *BR = dyn_cast<BlockDataRegion>(R)) {
90     const BlockDecl *BD = BR->getCodeRegion()->getDecl();
91     SourceLocation L = BD->getBeginLoc();
92     range = BD->getSourceRange();
93     os << "stack-allocated block declared on line "
94        << SM.getExpansionLineNumber(L);
95   } else if (const auto *VR = dyn_cast<VarRegion>(R)) {
96     os << "stack memory associated with local variable '" << VR->getString()
97        << '\'';
98     range = VR->getDecl()->getSourceRange();
99   } else if (const auto *TOR = dyn_cast<CXXTempObjectRegion>(R)) {
100     QualType Ty = TOR->getValueType().getLocalUnqualifiedType();
101     os << "stack memory associated with temporary object of type '";
102     Ty.print(os, Ctx.getPrintingPolicy());
103     os << "'";
104     range = TOR->getExpr()->getSourceRange();
105   } else {
106     llvm_unreachable("Invalid region in ReturnStackAddressChecker.");
107   }
108 
109   return range;
110 }
111 
isNotInCurrentFrame(const MemRegion * R,CheckerContext & C)112 bool StackAddrEscapeChecker::isNotInCurrentFrame(const MemRegion *R,
113                                                  CheckerContext &C) {
114   const StackSpaceRegion *S = cast<StackSpaceRegion>(R->getMemorySpace());
115   return S->getStackFrame() != C.getStackFrame();
116 }
117 
isSemaphoreCaptured(const BlockDecl & B) const118 bool StackAddrEscapeChecker::isSemaphoreCaptured(const BlockDecl &B) const {
119   if (!dispatch_semaphore_tII)
120     dispatch_semaphore_tII = &B.getASTContext().Idents.get("dispatch_semaphore_t");
121   for (const auto &C : B.captures()) {
122     const auto *T = C.getVariable()->getType()->getAs<TypedefType>();
123     if (T && T->getDecl()->getIdentifier() == dispatch_semaphore_tII)
124       return true;
125   }
126   return false;
127 }
128 
129 SmallVector<const MemRegion *, 4>
getCapturedStackRegions(const BlockDataRegion & B,CheckerContext & C)130 StackAddrEscapeChecker::getCapturedStackRegions(const BlockDataRegion &B,
131                                                 CheckerContext &C) {
132   SmallVector<const MemRegion *, 4> Regions;
133   BlockDataRegion::referenced_vars_iterator I = B.referenced_vars_begin();
134   BlockDataRegion::referenced_vars_iterator E = B.referenced_vars_end();
135   for (; I != E; ++I) {
136     SVal Val = C.getState()->getSVal(I.getCapturedRegion());
137     const MemRegion *Region = Val.getAsRegion();
138     if (Region && isa<StackSpaceRegion>(Region->getMemorySpace()))
139       Regions.push_back(Region);
140   }
141   return Regions;
142 }
143 
EmitStackError(CheckerContext & C,const MemRegion * R,const Expr * RetE) const144 void StackAddrEscapeChecker::EmitStackError(CheckerContext &C,
145                                             const MemRegion *R,
146                                             const Expr *RetE) const {
147   ExplodedNode *N = C.generateNonFatalErrorNode();
148   if (!N)
149     return;
150   if (!BT_returnstack)
151     BT_returnstack = std::make_unique<BuiltinBug>(
152         CheckNames[CK_StackAddrEscapeChecker],
153         "Return of address to stack-allocated memory");
154   // Generate a report for this bug.
155   SmallString<128> buf;
156   llvm::raw_svector_ostream os(buf);
157   SourceRange range = genName(os, R, C.getASTContext());
158   os << " returned to caller";
159   auto report =
160       std::make_unique<PathSensitiveBugReport>(*BT_returnstack, os.str(), N);
161   report->addRange(RetE->getSourceRange());
162   if (range.isValid())
163     report->addRange(range);
164   C.emitReport(std::move(report));
165 }
166 
checkAsyncExecutedBlockCaptures(const BlockDataRegion & B,CheckerContext & C) const167 void StackAddrEscapeChecker::checkAsyncExecutedBlockCaptures(
168     const BlockDataRegion &B, CheckerContext &C) const {
169   // There is a not-too-uncommon idiom
170   // where a block passed to dispatch_async captures a semaphore
171   // and then the thread (which called dispatch_async) is blocked on waiting
172   // for the completion of the execution of the block
173   // via dispatch_semaphore_wait. To avoid false-positives (for now)
174   // we ignore all the blocks which have captured
175   // a variable of the type "dispatch_semaphore_t".
176   if (isSemaphoreCaptured(*B.getDecl()))
177     return;
178   for (const MemRegion *Region : getCapturedStackRegions(B, C)) {
179     // The block passed to dispatch_async may capture another block
180     // created on the stack. However, there is no leak in this situaton,
181     // no matter if ARC or no ARC is enabled:
182     // dispatch_async copies the passed "outer" block (via Block_copy)
183     // and if the block has captured another "inner" block,
184     // the "inner" block will be copied as well.
185     if (isa<BlockDataRegion>(Region))
186       continue;
187     ExplodedNode *N = C.generateNonFatalErrorNode();
188     if (!N)
189       continue;
190     if (!BT_capturedstackasync)
191       BT_capturedstackasync = std::make_unique<BuiltinBug>(
192           CheckNames[CK_StackAddrAsyncEscapeChecker],
193           "Address of stack-allocated memory is captured");
194     SmallString<128> Buf;
195     llvm::raw_svector_ostream Out(Buf);
196     SourceRange Range = genName(Out, Region, C.getASTContext());
197     Out << " is captured by an asynchronously-executed block";
198     auto Report = std::make_unique<PathSensitiveBugReport>(
199         *BT_capturedstackasync, Out.str(), N);
200     if (Range.isValid())
201       Report->addRange(Range);
202     C.emitReport(std::move(Report));
203   }
204 }
205 
checkReturnedBlockCaptures(const BlockDataRegion & B,CheckerContext & C) const206 void StackAddrEscapeChecker::checkReturnedBlockCaptures(
207     const BlockDataRegion &B, CheckerContext &C) const {
208   for (const MemRegion *Region : getCapturedStackRegions(B, C)) {
209     if (isNotInCurrentFrame(Region, C))
210       continue;
211     ExplodedNode *N = C.generateNonFatalErrorNode();
212     if (!N)
213       continue;
214     if (!BT_capturedstackret)
215       BT_capturedstackret = std::make_unique<BuiltinBug>(
216           CheckNames[CK_StackAddrEscapeChecker],
217           "Address of stack-allocated memory is captured");
218     SmallString<128> Buf;
219     llvm::raw_svector_ostream Out(Buf);
220     SourceRange Range = genName(Out, Region, C.getASTContext());
221     Out << " is captured by a returned block";
222     auto Report = std::make_unique<PathSensitiveBugReport>(*BT_capturedstackret,
223                                                            Out.str(), N);
224     if (Range.isValid())
225       Report->addRange(Range);
226     C.emitReport(std::move(Report));
227   }
228 }
229 
checkPreCall(const CallEvent & Call,CheckerContext & C) const230 void StackAddrEscapeChecker::checkPreCall(const CallEvent &Call,
231                                           CheckerContext &C) const {
232   if (!ChecksEnabled[CK_StackAddrAsyncEscapeChecker])
233     return;
234   if (!Call.isGlobalCFunction("dispatch_after") &&
235       !Call.isGlobalCFunction("dispatch_async"))
236     return;
237   for (unsigned Idx = 0, NumArgs = Call.getNumArgs(); Idx < NumArgs; ++Idx) {
238     if (const BlockDataRegion *B = dyn_cast_or_null<BlockDataRegion>(
239             Call.getArgSVal(Idx).getAsRegion()))
240       checkAsyncExecutedBlockCaptures(*B, C);
241   }
242 }
243 
checkPreStmt(const ReturnStmt * RS,CheckerContext & C) const244 void StackAddrEscapeChecker::checkPreStmt(const ReturnStmt *RS,
245                                           CheckerContext &C) const {
246   if (!ChecksEnabled[CK_StackAddrEscapeChecker])
247     return;
248 
249   const Expr *RetE = RS->getRetValue();
250   if (!RetE)
251     return;
252   RetE = RetE->IgnoreParens();
253 
254   SVal V = C.getSVal(RetE);
255   const MemRegion *R = V.getAsRegion();
256   if (!R)
257     return;
258 
259   if (const BlockDataRegion *B = dyn_cast<BlockDataRegion>(R))
260     checkReturnedBlockCaptures(*B, C);
261 
262   if (!isa<StackSpaceRegion>(R->getMemorySpace()) || isNotInCurrentFrame(R, C))
263     return;
264 
265   // Returning a record by value is fine. (In this case, the returned
266   // expression will be a copy-constructor, possibly wrapped in an
267   // ExprWithCleanups node.)
268   if (const ExprWithCleanups *Cleanup = dyn_cast<ExprWithCleanups>(RetE))
269     RetE = Cleanup->getSubExpr();
270   if (isa<CXXConstructExpr>(RetE) && RetE->getType()->isRecordType())
271     return;
272 
273   // The CK_CopyAndAutoreleaseBlockObject cast causes the block to be copied
274   // so the stack address is not escaping here.
275   if (const auto *ICE = dyn_cast<ImplicitCastExpr>(RetE)) {
276     if (isa<BlockDataRegion>(R) &&
277         ICE->getCastKind() == CK_CopyAndAutoreleaseBlockObject) {
278       return;
279     }
280   }
281 
282   EmitStackError(C, R, RetE);
283 }
284 
checkEndFunction(const ReturnStmt * RS,CheckerContext & Ctx) const285 void StackAddrEscapeChecker::checkEndFunction(const ReturnStmt *RS,
286                                               CheckerContext &Ctx) const {
287   if (!ChecksEnabled[CK_StackAddrEscapeChecker])
288     return;
289 
290   ProgramStateRef State = Ctx.getState();
291 
292   // Iterate over all bindings to global variables and see if it contains
293   // a memory region in the stack space.
294   class CallBack : public StoreManager::BindingsHandler {
295   private:
296     CheckerContext &Ctx;
297     const StackFrameContext *PoppedFrame;
298 
299     /// Look for stack variables referring to popped stack variables.
300     /// Returns true only if it found some dangling stack variables
301     /// referred by an other stack variable from different stack frame.
302     bool checkForDanglingStackVariable(const MemRegion *Referrer,
303                                        const MemRegion *Referred) {
304       const auto *ReferrerMemSpace =
305           Referrer->getMemorySpace()->getAs<StackSpaceRegion>();
306       const auto *ReferredMemSpace =
307           Referred->getMemorySpace()->getAs<StackSpaceRegion>();
308 
309       if (!ReferrerMemSpace || !ReferredMemSpace)
310         return false;
311 
312       const auto *ReferrerFrame = ReferrerMemSpace->getStackFrame();
313       const auto *ReferredFrame = ReferredMemSpace->getStackFrame();
314 
315       if (ReferrerMemSpace && ReferredMemSpace) {
316         if (ReferredFrame == PoppedFrame &&
317             ReferrerFrame->isParentOf(PoppedFrame)) {
318           V.emplace_back(Referrer, Referred);
319           return true;
320         }
321       }
322       return false;
323     }
324 
325   public:
326     SmallVector<std::pair<const MemRegion *, const MemRegion *>, 10> V;
327 
328     CallBack(CheckerContext &CC) : Ctx(CC), PoppedFrame(CC.getStackFrame()) {}
329 
330     bool HandleBinding(StoreManager &SMgr, Store S, const MemRegion *Region,
331                        SVal Val) override {
332       const MemRegion *VR = Val.getAsRegion();
333       if (!VR)
334         return true;
335 
336       if (checkForDanglingStackVariable(Region, VR))
337         return true;
338 
339       // Check the globals for the same.
340       if (!isa<GlobalsSpaceRegion>(Region->getMemorySpace()))
341         return true;
342       if (VR && VR->hasStackStorage() && !isNotInCurrentFrame(VR, Ctx))
343         V.emplace_back(Region, VR);
344       return true;
345     }
346   };
347 
348   CallBack Cb(Ctx);
349   State->getStateManager().getStoreManager().iterBindings(State->getStore(),
350                                                           Cb);
351 
352   if (Cb.V.empty())
353     return;
354 
355   // Generate an error node.
356   ExplodedNode *N = Ctx.generateNonFatalErrorNode(State);
357   if (!N)
358     return;
359 
360   if (!BT_stackleak)
361     BT_stackleak = std::make_unique<BuiltinBug>(
362         CheckNames[CK_StackAddrEscapeChecker],
363         "Stack address stored into global variable",
364         "Stack address was saved into a global variable. "
365         "This is dangerous because the address will become "
366         "invalid after returning from the function");
367 
368   for (const auto &P : Cb.V) {
369     const MemRegion *Referrer = P.first;
370     const MemRegion *Referred = P.second;
371 
372     // Generate a report for this bug.
373     const StringRef CommonSuffix =
374         "upon returning to the caller.  This will be a dangling reference";
375     SmallString<128> Buf;
376     llvm::raw_svector_ostream Out(Buf);
377     const SourceRange Range = genName(Out, Referred, Ctx.getASTContext());
378 
379     if (isa<CXXTempObjectRegion>(Referrer)) {
380       Out << " is still referred to by a temporary object on the stack "
381           << CommonSuffix;
382       auto Report =
383           std::make_unique<PathSensitiveBugReport>(*BT_stackleak, Out.str(), N);
384       Ctx.emitReport(std::move(Report));
385       return;
386     }
387 
388     const StringRef ReferrerMemorySpace = [](const MemSpaceRegion *Space) {
389       if (isa<StaticGlobalSpaceRegion>(Space))
390         return "static";
391       if (isa<GlobalsSpaceRegion>(Space))
392         return "global";
393       assert(isa<StackSpaceRegion>(Space));
394       return "stack";
395     }(Referrer->getMemorySpace());
396 
397     // This cast supposed to succeed.
398     const VarRegion *ReferrerVar = cast<VarRegion>(Referrer->getBaseRegion());
399     const std::string ReferrerVarName =
400         ReferrerVar->getDecl()->getDeclName().getAsString();
401 
402     Out << " is still referred to by the " << ReferrerMemorySpace
403         << " variable '" << ReferrerVarName << "' " << CommonSuffix;
404     auto Report =
405         std::make_unique<PathSensitiveBugReport>(*BT_stackleak, Out.str(), N);
406     if (Range.isValid())
407       Report->addRange(Range);
408 
409     Ctx.emitReport(std::move(Report));
410   }
411 }
412 
registerStackAddrEscapeBase(CheckerManager & mgr)413 void ento::registerStackAddrEscapeBase(CheckerManager &mgr) {
414   mgr.registerChecker<StackAddrEscapeChecker>();
415 }
416 
shouldRegisterStackAddrEscapeBase(const CheckerManager & mgr)417 bool ento::shouldRegisterStackAddrEscapeBase(const CheckerManager &mgr) {
418   return true;
419 }
420 
421 #define REGISTER_CHECKER(name)                                                 \
422   void ento::register##name(CheckerManager &Mgr) {                             \
423     StackAddrEscapeChecker *Chk = Mgr.getChecker<StackAddrEscapeChecker>();    \
424     Chk->ChecksEnabled[StackAddrEscapeChecker::CK_##name] = true;              \
425     Chk->CheckNames[StackAddrEscapeChecker::CK_##name] =                       \
426         Mgr.getCurrentCheckerName();                                           \
427   }                                                                            \
428                                                                                \
429   bool ento::shouldRegister##name(const CheckerManager &mgr) { return true; }
430 
431 REGISTER_CHECKER(StackAddrEscapeChecker)
432 REGISTER_CHECKER(StackAddrAsyncEscapeChecker)
433