1 // RUN: %clang_analyze_cc1 -triple i686-unknown-linux -analyzer-checker=alpha.security.MmapWriteExec -analyzer-config alpha.security.MmapWriteExec:MmapProtExec=1 -analyzer-config alpha.security.MmapWriteExec:MmapProtRead=4 -DUSE_ALTERNATIVE_PROT_EXEC_DEFINITION -verify %s
2 // RUN: %clang_analyze_cc1 -triple x86_64-unknown-apple-darwin10 -analyzer-checker=alpha.security.MmapWriteExec -verify %s
3
4 #define PROT_WRITE 0x02
5 #ifndef USE_ALTERNATIVE_PROT_EXEC_DEFINITION
6 #define PROT_EXEC 0x04
7 #define PROT_READ 0x01
8 #else
9 #define PROT_EXEC 0x01
10 #define PROT_READ 0x04
11 #endif
12 #define MAP_PRIVATE 0x0002
13 #define MAP_ANON 0x1000
14 #define MAP_FIXED 0x0010
15 #define NULL ((void *)0)
16
17 typedef __typeof(sizeof(int)) size_t;
18 void *mmap(void *, size_t, int, int, int, long);
19 int mprotect(void *, size_t, int);
20
f1()21 void f1()
22 {
23 void *a = mmap(NULL, 16, PROT_READ | PROT_EXEC, MAP_PRIVATE | MAP_ANON, -1, 0); // no-warning
24 void *b = mmap(a, 16, PROT_READ | PROT_WRITE, MAP_PRIVATE | MAP_FIXED | MAP_ANON, -1, 0); // no-warning
25 void *c = mmap(NULL, 32, PROT_READ | PROT_WRITE | PROT_EXEC, MAP_PRIVATE | MAP_ANON, -1, 0); // expected-warning{{Both PROT_WRITE and PROT_EXEC flags are set. This can lead to exploitable memory regions, which could be overwritten with malicious code}}
26 (void)a;
27 (void)b;
28 (void)c;
29 }
30
f2()31 void f2()
32 {
33 void *(*callm)(void *, size_t, int, int, int, long);
34 callm = mmap;
35 int prot = PROT_WRITE | PROT_EXEC;
36 (void)callm(NULL, 1024, prot, MAP_PRIVATE | MAP_ANON, -1, 0); // expected-warning{{Both PROT_WRITE and PROT_EXEC flags are set. This can lead to exploitable memory regions, which could be overwritten with malicious code}}
37 }
38
f3()39 void f3()
40 {
41 void *p = mmap(NULL, 1024, PROT_WRITE, MAP_PRIVATE | MAP_ANON, -1, 0); // no-warning
42 int m = mprotect(p, 1024, PROT_WRITE | PROT_EXEC); // expected-warning{{Both PROT_WRITE and PROT_EXEC flags are set. This can lead to exploitable memory regions, which could be overwritten with malicious code}}
43 (void)m;
44 }
45