1 //== InvalidPtrChecker.cpp ------------------------------------- -*- C++ -*--=//
2 //
3 // Part of the LLVM Project, under the Apache License v2.0 with LLVM Exceptions.
4 // See https://llvm.org/LICENSE.txt for license information.
5 // SPDX-License-Identifier: Apache-2.0 WITH LLVM-exception
6 //
7 //===----------------------------------------------------------------------===//
8 //
9 // This file defines InvalidPtrChecker which finds usages of possibly
10 // invalidated pointer.
11 // CERT SEI Rules ENV31-C and ENV34-C
12 // For more information see:
13 // https://wiki.sei.cmu.edu/confluence/x/8tYxBQ
14 // https://wiki.sei.cmu.edu/confluence/x/5NUxBQ
15 //===----------------------------------------------------------------------===//
16
17 #include "clang/StaticAnalyzer/Checkers/BuiltinCheckerRegistration.h"
18 #include "clang/StaticAnalyzer/Core/BugReporter/BugType.h"
19 #include "clang/StaticAnalyzer/Core/Checker.h"
20 #include "clang/StaticAnalyzer/Core/CheckerManager.h"
21 #include "clang/StaticAnalyzer/Core/PathSensitive/CallDescription.h"
22 #include "clang/StaticAnalyzer/Core/PathSensitive/CallEvent.h"
23 #include "clang/StaticAnalyzer/Core/PathSensitive/CheckerContext.h"
24
25 using namespace clang;
26 using namespace ento;
27
28 namespace {
29
30 class InvalidPtrChecker
31 : public Checker<check::Location, check::BeginFunction, check::PostCall> {
32 private:
33 // For accurate emission of NoteTags, the BugType of this checker should have
34 // a unique address.
35 BugType InvalidPtrBugType{this, "Use of invalidated pointer",
36 categories::MemoryError};
37
38 void EnvpInvalidatingCall(const CallEvent &Call, CheckerContext &C) const;
39
40 using HandlerFn = void (InvalidPtrChecker::*)(const CallEvent &Call,
41 CheckerContext &C) const;
42
43 // SEI CERT ENV31-C
44
45 // If set to true, consider getenv calls as invalidating operations on the
46 // environment variable buffer. This is implied in the standard, but in
47 // practice does not cause problems (in the commonly used environments).
48 bool InvalidatingGetEnv = false;
49
50 // GetEnv can be treated invalidating and non-invalidating as well.
51 const CallDescription GetEnvCall{{"getenv"}, 1};
52
53 const CallDescriptionMap<HandlerFn> EnvpInvalidatingFunctions = {
54 {{{"setenv"}, 3}, &InvalidPtrChecker::EnvpInvalidatingCall},
55 {{{"unsetenv"}, 1}, &InvalidPtrChecker::EnvpInvalidatingCall},
56 {{{"putenv"}, 1}, &InvalidPtrChecker::EnvpInvalidatingCall},
57 {{{"_putenv_s"}, 2}, &InvalidPtrChecker::EnvpInvalidatingCall},
58 {{{"_wputenv_s"}, 2}, &InvalidPtrChecker::EnvpInvalidatingCall},
59 };
60
61 void postPreviousReturnInvalidatingCall(const CallEvent &Call,
62 CheckerContext &C) const;
63
64 // SEI CERT ENV34-C
65 const CallDescriptionMap<HandlerFn> PreviousCallInvalidatingFunctions = {
66 {{{"setlocale"}, 2},
67 &InvalidPtrChecker::postPreviousReturnInvalidatingCall},
68 {{{"strerror"}, 1},
69 &InvalidPtrChecker::postPreviousReturnInvalidatingCall},
70 {{{"localeconv"}, 0},
71 &InvalidPtrChecker::postPreviousReturnInvalidatingCall},
72 {{{"asctime"}, 1},
73 &InvalidPtrChecker::postPreviousReturnInvalidatingCall},
74 };
75
76 // The private members of this checker corresponding to commandline options
77 // are set in this function.
78 friend void ento::registerInvalidPtrChecker(CheckerManager &);
79
80 public:
81 // Obtain the environment pointer from 'main()' (if present).
82 void checkBeginFunction(CheckerContext &C) const;
83
84 // Handle functions in EnvpInvalidatingFunctions, that invalidate environment
85 // pointer from 'main()'
86 // Handle functions in PreviousCallInvalidatingFunctions.
87 // Also, check if invalidated region is passed to a
88 // conservatively evaluated function call as an argument.
89 void checkPostCall(const CallEvent &Call, CheckerContext &C) const;
90
91 // Check if invalidated region is being dereferenced.
92 void checkLocation(SVal l, bool isLoad, const Stmt *S,
93 CheckerContext &C) const;
94
95 private:
96 const NoteTag *createEnvInvalidationNote(CheckerContext &C,
97 ProgramStateRef State,
98 StringRef FunctionName) const;
99 };
100
101 } // namespace
102
103 // Set of memory regions that were invalidated
REGISTER_SET_WITH_PROGRAMSTATE(InvalidMemoryRegions,const MemRegion *)104 REGISTER_SET_WITH_PROGRAMSTATE(InvalidMemoryRegions, const MemRegion *)
105
106 // Stores the region of the environment pointer of 'main' (if present).
107 REGISTER_TRAIT_WITH_PROGRAMSTATE(MainEnvPtrRegion, const MemRegion *)
108
109 // Stores the regions of environments returned by getenv calls.
110 REGISTER_SET_WITH_PROGRAMSTATE(GetenvEnvPtrRegions, const MemRegion *)
111
112 // Stores key-value pairs, where key is function declaration and value is
113 // pointer to memory region returned by previous call of this function
114 REGISTER_MAP_WITH_PROGRAMSTATE(PreviousCallResultMap, const FunctionDecl *,
115 const MemRegion *)
116
117 const NoteTag *InvalidPtrChecker::createEnvInvalidationNote(
118 CheckerContext &C, ProgramStateRef State, StringRef FunctionName) const {
119
120 const MemRegion *MainRegion = State->get<MainEnvPtrRegion>();
121 const auto GetenvRegions = State->get<GetenvEnvPtrRegions>();
122
123 return C.getNoteTag([this, MainRegion, GetenvRegions,
124 FunctionName = std::string{FunctionName}](
125 PathSensitiveBugReport &BR, llvm::raw_ostream &Out) {
126 // Only handle the BugType of this checker.
127 if (&BR.getBugType() != &InvalidPtrBugType)
128 return;
129
130 // Mark all regions that were interesting before as NOT interesting now
131 // to avoid extra notes coming from invalidation points higher up the
132 // bugpath. This ensures that only the last invalidation point is marked
133 // with a note tag.
134 llvm::SmallVector<std::string, 2> InvalidLocationNames;
135 if (BR.isInteresting(MainRegion)) {
136 BR.markNotInteresting(MainRegion);
137 InvalidLocationNames.push_back("the environment parameter of 'main'");
138 }
139 bool InterestingGetenvFound = false;
140 for (const MemRegion *MR : GetenvRegions) {
141 if (BR.isInteresting(MR)) {
142 BR.markNotInteresting(MR);
143 if (!InterestingGetenvFound) {
144 InterestingGetenvFound = true;
145 InvalidLocationNames.push_back(
146 "the environment returned by 'getenv'");
147 }
148 }
149 }
150
151 // Emit note tag message.
152 if (InvalidLocationNames.size() >= 1)
153 Out << '\'' << FunctionName << "' call may invalidate "
154 << InvalidLocationNames[0];
155 if (InvalidLocationNames.size() == 2)
156 Out << ", and " << InvalidLocationNames[1];
157 });
158 }
159
EnvpInvalidatingCall(const CallEvent & Call,CheckerContext & C) const160 void InvalidPtrChecker::EnvpInvalidatingCall(const CallEvent &Call,
161 CheckerContext &C) const {
162 // This callevent invalidates all previously generated pointers to the
163 // environment.
164 ProgramStateRef State = C.getState();
165 if (const MemRegion *MainEnvPtr = State->get<MainEnvPtrRegion>())
166 State = State->add<InvalidMemoryRegions>(MainEnvPtr);
167 for (const MemRegion *EnvPtr : State->get<GetenvEnvPtrRegions>())
168 State = State->add<InvalidMemoryRegions>(EnvPtr);
169
170 StringRef FunctionName = Call.getCalleeIdentifier()->getName();
171 const NoteTag *InvalidationNote =
172 createEnvInvalidationNote(C, State, FunctionName);
173
174 C.addTransition(State, InvalidationNote);
175 }
176
postPreviousReturnInvalidatingCall(const CallEvent & Call,CheckerContext & C) const177 void InvalidPtrChecker::postPreviousReturnInvalidatingCall(
178 const CallEvent &Call, CheckerContext &C) const {
179 ProgramStateRef State = C.getState();
180
181 const NoteTag *Note = nullptr;
182 const FunctionDecl *FD = dyn_cast_or_null<FunctionDecl>(Call.getDecl());
183 // Invalidate the region of the previously returned pointer - if there was
184 // one.
185 if (const MemRegion *const *Reg = State->get<PreviousCallResultMap>(FD)) {
186 const MemRegion *PrevReg = *Reg;
187 State = State->add<InvalidMemoryRegions>(PrevReg);
188 Note = C.getNoteTag([this, PrevReg, FD](PathSensitiveBugReport &BR,
189 llvm::raw_ostream &Out) {
190 if (!BR.isInteresting(PrevReg) || &BR.getBugType() != &InvalidPtrBugType)
191 return;
192 Out << '\'';
193 FD->getNameForDiagnostic(Out, FD->getASTContext().getLangOpts(), true);
194 Out << "' call may invalidate the result of the previous " << '\'';
195 FD->getNameForDiagnostic(Out, FD->getASTContext().getLangOpts(), true);
196 Out << '\'';
197 });
198 }
199
200 const LocationContext *LCtx = C.getLocationContext();
201 const auto *CE = cast<CallExpr>(Call.getOriginExpr());
202
203 // Function call will return a pointer to the new symbolic region.
204 DefinedOrUnknownSVal RetVal = C.getSValBuilder().conjureSymbolVal(
205 CE, LCtx, CE->getType(), C.blockCount());
206 State = State->BindExpr(CE, LCtx, RetVal);
207
208 const auto *SymRegOfRetVal =
209 dyn_cast_or_null<SymbolicRegion>(RetVal.getAsRegion());
210 if (!SymRegOfRetVal)
211 return;
212
213 // Remember to this region.
214 const MemRegion *MR = SymRegOfRetVal->getBaseRegion();
215 State = State->set<PreviousCallResultMap>(FD, MR);
216
217 ExplodedNode *Node = C.addTransition(State, Note);
218 const NoteTag *PreviousCallNote = C.getNoteTag(
219 [this, MR](PathSensitiveBugReport &BR, llvm::raw_ostream &Out) {
220 if (!BR.isInteresting(MR) || &BR.getBugType() != &InvalidPtrBugType)
221 return;
222 Out << "previous function call was here";
223 });
224
225 C.addTransition(State, Node, PreviousCallNote);
226 }
227
228 // TODO: This seems really ugly. Simplify this.
findInvalidatedSymbolicBase(ProgramStateRef State,const MemRegion * Reg)229 static const MemRegion *findInvalidatedSymbolicBase(ProgramStateRef State,
230 const MemRegion *Reg) {
231 while (Reg) {
232 if (State->contains<InvalidMemoryRegions>(Reg))
233 return Reg;
234 const auto *SymBase = Reg->getSymbolicBase();
235 if (!SymBase)
236 break;
237 const auto *SRV = dyn_cast<SymbolRegionValue>(SymBase->getSymbol());
238 if (!SRV)
239 break;
240 Reg = SRV->getRegion();
241 if (const auto *VarReg = dyn_cast<VarRegion>(SRV->getRegion()))
242 Reg = VarReg;
243 }
244 return nullptr;
245 }
246
247 // Handle functions in EnvpInvalidatingFunctions, that invalidate environment
248 // pointer from 'main()' Also, check if invalidated region is passed to a
249 // function call as an argument.
checkPostCall(const CallEvent & Call,CheckerContext & C) const250 void InvalidPtrChecker::checkPostCall(const CallEvent &Call,
251 CheckerContext &C) const {
252
253 ProgramStateRef State = C.getState();
254
255 // Model 'getenv' calls
256 if (GetEnvCall.matches(Call)) {
257 const MemRegion *Region = Call.getReturnValue().getAsRegion();
258 if (Region) {
259 State = State->add<GetenvEnvPtrRegions>(Region);
260 C.addTransition(State);
261 }
262 }
263
264 // Check if function invalidates 'envp' argument of 'main'
265 if (const auto *Handler = EnvpInvalidatingFunctions.lookup(Call))
266 (this->**Handler)(Call, C);
267
268 // Check if function invalidates the result of previous call
269 if (const auto *Handler = PreviousCallInvalidatingFunctions.lookup(Call))
270 (this->**Handler)(Call, C);
271
272 // If pedantic mode is on, regard 'getenv' calls invalidating as well
273 if (InvalidatingGetEnv && GetEnvCall.matches(Call))
274 postPreviousReturnInvalidatingCall(Call, C);
275
276 // Check if one of the arguments of the function call is invalidated
277
278 // If call was inlined, don't report invalidated argument
279 if (C.wasInlined)
280 return;
281
282 for (unsigned I = 0, NumArgs = Call.getNumArgs(); I < NumArgs; ++I) {
283
284 if (const auto *SR = dyn_cast_or_null<SymbolicRegion>(
285 Call.getArgSVal(I).getAsRegion())) {
286 if (const MemRegion *InvalidatedSymbolicBase =
287 findInvalidatedSymbolicBase(State, SR)) {
288 ExplodedNode *ErrorNode = C.generateNonFatalErrorNode();
289 if (!ErrorNode)
290 return;
291
292 SmallString<256> Msg;
293 llvm::raw_svector_ostream Out(Msg);
294 Out << "use of invalidated pointer '";
295 Call.getArgExpr(I)->printPretty(Out, /*Helper=*/nullptr,
296 C.getASTContext().getPrintingPolicy());
297 Out << "' in a function call";
298
299 auto Report = std::make_unique<PathSensitiveBugReport>(
300 InvalidPtrBugType, Out.str(), ErrorNode);
301 Report->markInteresting(InvalidatedSymbolicBase);
302 Report->addRange(Call.getArgSourceRange(I));
303 C.emitReport(std::move(Report));
304 }
305 }
306 }
307 }
308
309 // Obtain the environment pointer from 'main()', if present.
checkBeginFunction(CheckerContext & C) const310 void InvalidPtrChecker::checkBeginFunction(CheckerContext &C) const {
311 if (!C.inTopFrame())
312 return;
313
314 const auto *FD = dyn_cast<FunctionDecl>(C.getLocationContext()->getDecl());
315 if (!FD || FD->param_size() != 3 || !FD->isMain())
316 return;
317
318 ProgramStateRef State = C.getState();
319 const MemRegion *EnvpReg =
320 State->getRegion(FD->parameters()[2], C.getLocationContext());
321
322 // Save the memory region pointed by the environment pointer parameter of
323 // 'main'.
324 C.addTransition(State->set<MainEnvPtrRegion>(EnvpReg));
325 }
326
327 // Check if invalidated region is being dereferenced.
checkLocation(SVal Loc,bool isLoad,const Stmt * S,CheckerContext & C) const328 void InvalidPtrChecker::checkLocation(SVal Loc, bool isLoad, const Stmt *S,
329 CheckerContext &C) const {
330 ProgramStateRef State = C.getState();
331
332 // Ignore memory operations involving 'non-invalidated' locations.
333 const MemRegion *InvalidatedSymbolicBase =
334 findInvalidatedSymbolicBase(State, Loc.getAsRegion());
335 if (!InvalidatedSymbolicBase)
336 return;
337
338 ExplodedNode *ErrorNode = C.generateNonFatalErrorNode();
339 if (!ErrorNode)
340 return;
341
342 auto Report = std::make_unique<PathSensitiveBugReport>(
343 InvalidPtrBugType, "dereferencing an invalid pointer", ErrorNode);
344 Report->markInteresting(InvalidatedSymbolicBase);
345 C.emitReport(std::move(Report));
346 }
347
registerInvalidPtrChecker(CheckerManager & Mgr)348 void ento::registerInvalidPtrChecker(CheckerManager &Mgr) {
349 auto *Checker = Mgr.registerChecker<InvalidPtrChecker>();
350 Checker->InvalidatingGetEnv =
351 Mgr.getAnalyzerOptions().getCheckerBooleanOption(Checker,
352 "InvalidatingGetEnv");
353 }
354
shouldRegisterInvalidPtrChecker(const CheckerManager &)355 bool ento::shouldRegisterInvalidPtrChecker(const CheckerManager &) {
356 return true;
357 }
358