clang/lib/StaticAnalyzer/Checkers/ErrnoChecker.cpp

   1 //=== ErrnoChecker.cpp ------------------------------------------*- C++ -*-===//
   2 //
   3 // Part of the LLVM Project, under the Apache License v2.0 with LLVM Exceptions.
   4 // See https://llvm.org/LICENSE.txt for license information.
   5 // SPDX-License-Identifier: Apache-2.0 WITH LLVM-exception
   6 //
   7 //===----------------------------------------------------------------------===//
   8 //
   9 // This defines an "errno checker" that can detect some invalid use of the
  10 // system-defined value 'errno'. This checker works together with the
  11 // ErrnoModeling checker and other checkers like StdCLibraryFunctions.
  12 //
  13 //===----------------------------------------------------------------------===//
  14
  15 #include "ErrnoModeling.h"
  16 #include "clang/AST/ParentMapContext.h"
  17 #include "clang/StaticAnalyzer/Checkers/BuiltinCheckerRegistration.h"
  18 #include "clang/StaticAnalyzer/Core/Checker.h"
  19 #include "clang/StaticAnalyzer/Core/CheckerManager.h"
  20 #include "clang/StaticAnalyzer/Core/PathSensitive/CallDescription.h"
  21 #include "clang/StaticAnalyzer/Core/PathSensitive/CheckerContext.h"
  22 #include "clang/StaticAnalyzer/Core/PathSensitive/ProgramState.h"
  23 #include "clang/StaticAnalyzer/Core/PathSensitive/SVals.h"
  24 #include "llvm/ADT/STLExtras.h"
  25 #include <optional>
  26
  27 using namespace clang;
  28 using namespace ento;
  29 using namespace errno_modeling;
  30
  31 namespace {
  32
  33 class ErrnoChecker
  34     : public Checker<check::Location, check::PreCall, check::RegionChanges> {
  35 public:
  36   void checkLocation(SVal Loc, bool IsLoad, const Stmt *S,
  37                      CheckerContext &) const;
  38   void checkPreCall(const CallEvent &Call, CheckerContext &C) const;
  39   ProgramStateRef
  40   checkRegionChanges(ProgramStateRef State,
  41                      const InvalidatedSymbols *Invalidated,
  42                      ArrayRef<const MemRegion *> ExplicitRegions,
  43                      ArrayRef<const MemRegion *> Regions,
  44                      const LocationContext *LCtx, const CallEvent *Call) const;
  45   void checkBranchCondition(const Stmt *Condition, CheckerContext &Ctx) const;
  46
  47   /// Indicates if a read (load) of \c errno is allowed in a non-condition part
  48   /// of \c if, \c switch, loop and conditional statements when the errno
  49   /// value may be undefined.
  50   bool AllowErrnoReadOutsideConditions = true;
  51
  52 private:
  53   void generateErrnoNotCheckedBug(CheckerContext &C, ProgramStateRef State,
  54                                   const MemRegion *ErrnoRegion,
  55                                   const CallEvent *CallMayChangeErrno) const;
  56
  57   BugType BT_InvalidErrnoRead{this, "Value of 'errno' could be undefined",
  58                               "Error handling"};
  59   BugType BT_ErrnoNotChecked{this, "Value of 'errno' was not checked",
  60                              "Error handling"};
  61 };
  62
  63 } // namespace
  64
  65 static ProgramStateRef setErrnoStateIrrelevant(ProgramStateRef State) {
  66   return setErrnoState(State, Irrelevant);
  67 }
  68
  69 /// Check if a statement (expression) or an ancestor of it is in a condition
  70 /// part of a (conditional, loop, switch) statement.
  71 static bool isInCondition(const Stmt *S, CheckerContext &C) {
  72   ParentMapContext &ParentCtx = C.getASTContext().getParentMapContext();
  73   bool CondFound = false;
  74   while (S && !CondFound) {
  75     const DynTypedNodeList Parents = ParentCtx.getParents(*S);
  76     if (Parents.empty())
  77       break;
  78     const auto *ParentS = Parents[0].get<Stmt>();
  79     if (!ParentS || isa<CallExpr>(ParentS))
  80       break;
  81     switch (ParentS->getStmtClass()) {
  82     case Expr::IfStmtClass:
  83       CondFound = (S == cast<IfStmt>(ParentS)->getCond());
  84       break;
  85     case Expr::ForStmtClass:
  86       CondFound = (S == cast<ForStmt>(ParentS)->getCond());
  87       break;
  88     case Expr::DoStmtClass:
  89       CondFound = (S == cast<DoStmt>(ParentS)->getCond());
  90       break;
  91     case Expr::WhileStmtClass:
  92       CondFound = (S == cast<WhileStmt>(ParentS)->getCond());
  93       break;
  94     case Expr::SwitchStmtClass:
  95       CondFound = (S == cast<SwitchStmt>(ParentS)->getCond());
  96       break;
  97     case Expr::ConditionalOperatorClass:
  98       CondFound = (S == cast<ConditionalOperator>(ParentS)->getCond());
  99       break;
 100     case Expr::BinaryConditionalOperatorClass:
 101       CondFound = (S == cast<BinaryConditionalOperator>(ParentS)->getCommon());
 102       break;
 103     default:
 104       break;
 105     }
 106     S = ParentS;
 107   }
 108   return CondFound;
 109 }
 110
 111 void ErrnoChecker::generateErrnoNotCheckedBug(
 112     CheckerContext &C, ProgramStateRef State, const MemRegion *ErrnoRegion,
 113     const CallEvent *CallMayChangeErrno) const {
 114   if (ExplodedNode *N = C.generateNonFatalErrorNode(State)) {
 115     SmallString<100> StrBuf;
 116     llvm::raw_svector_ostream OS(StrBuf);
 117     if (CallMayChangeErrno) {
 118       OS << "Value of 'errno' was not checked and may be overwritten by "
 119             "function '";
 120       const auto *CallD =
 121           dyn_cast_or_null<FunctionDecl>(CallMayChangeErrno->getDecl());
 122       assert(CallD && CallD->getIdentifier());
 123       OS << CallD->getIdentifier()->getName() << "'";
 124     } else {
 125       OS << "Value of 'errno' was not checked and is overwritten here";
 126     }
 127     auto BR = std::make_unique<PathSensitiveBugReport>(BT_ErrnoNotChecked,
 128                                                        OS.str(), N);
 129     BR->markInteresting(ErrnoRegion);
 130     C.emitReport(std::move(BR));
 131   }
 132 }
 133
 134 void ErrnoChecker::checkLocation(SVal Loc, bool IsLoad, const Stmt *S,
 135                                  CheckerContext &C) const {
 136   std::optional<ento::Loc> ErrnoLoc = getErrnoLoc(C.getState());
 137   if (!ErrnoLoc)
 138     return;
 139
 140   auto L = Loc.getAs<ento::Loc>();
 141   if (!L || *ErrnoLoc != *L)
 142     return;
 143
 144   ProgramStateRef State = C.getState();
 145   ErrnoCheckState EState = getErrnoState(State);
 146
 147   if (IsLoad) {
 148     switch (EState) {
 149     case MustNotBeChecked:
 150       // Read of 'errno' when it may have undefined value.
 151       if (!AllowErrnoReadOutsideConditions || isInCondition(S, C)) {
 152         if (ExplodedNode *N = C.generateErrorNode()) {
 153           auto BR = std::make_unique<PathSensitiveBugReport>(
 154               BT_InvalidErrnoRead,
 155               "An undefined value may be read from 'errno'", N);
 156           BR->markInteresting(ErrnoLoc->getAsRegion());
 157           C.emitReport(std::move(BR));
 158         }
 159       }
 160       break;
 161     case MustBeChecked:
 162       // 'errno' has to be checked. A load is required for this, with no more
 163       // information we can assume that it is checked somehow.
 164       // After this place 'errno' is allowed to be read and written.
 165       State = setErrnoStateIrrelevant(State);
 166       C.addTransition(State);
 167       break;
 168     default:
 169       break;
 170     }
 171   } else {
 172     switch (EState) {
 173     case MustBeChecked:
 174       // 'errno' is overwritten without a read before but it should have been
 175       // checked.
 176       generateErrnoNotCheckedBug(C, setErrnoStateIrrelevant(State),
 177                                  ErrnoLoc->getAsRegion(), nullptr);
 178       break;
 179     case MustNotBeChecked:
 180       // Write to 'errno' when it is not allowed to be read.
 181       // After this place 'errno' is allowed to be read and written.
 182       State = setErrnoStateIrrelevant(State);
 183       C.addTransition(State);
 184       break;
 185     default:
 186       break;
 187     }
 188   }
 189 }
 190
 191 void ErrnoChecker::checkPreCall(const CallEvent &Call,
 192                                 CheckerContext &C) const {
 193   const auto *CallF = dyn_cast_or_null<FunctionDecl>(Call.getDecl());
 194   if (!CallF)
 195     return;
 196
 197   CallF = CallF->getCanonicalDecl();
 198   // If 'errno' must be checked, it should be done as soon as possible, and
 199   // before any other call to a system function (something in a system header).
 200   // To avoid use of a long list of functions that may change 'errno'
 201   // (which may be different with standard library versions) assume that any
 202   // function can change it.
 203   // A list of special functions can be used that are allowed here without
 204   // generation of diagnostic. For now the only such case is 'errno' itself.
 205   // Probably 'strerror'?
 206   if (CallF->isExternC() && CallF->isGlobal() &&
 207       C.getSourceManager().isInSystemHeader(CallF->getLocation()) &&
 208       !isErrno(CallF)) {
 209     if (getErrnoState(C.getState()) == MustBeChecked) {
 210       std::optional<ento::Loc> ErrnoLoc = getErrnoLoc(C.getState());
 211       assert(ErrnoLoc && "ErrnoLoc should exist if an errno state is set.");
 212       generateErrnoNotCheckedBug(C, setErrnoStateIrrelevant(C.getState()),
 213                                  ErrnoLoc->getAsRegion(), &Call);
 214     }
 215   }
 216 }
 217
 218 ProgramStateRef ErrnoChecker::checkRegionChanges(
 219     ProgramStateRef State, const InvalidatedSymbols *Invalidated,
 220     ArrayRef<const MemRegion *> ExplicitRegions,
 221     ArrayRef<const MemRegion *> Regions, const LocationContext *LCtx,
 222     const CallEvent *Call) const {
 223   std::optional<ento::Loc> ErrnoLoc = getErrnoLoc(State);
 224   if (!ErrnoLoc)
 225     return State;
 226   const MemRegion *ErrnoRegion = ErrnoLoc->getAsRegion();
 227
 228   // If 'errno' is invalidated we can not know if it is checked or written into,
 229   // allow read and write without bug reports.
 230   if (llvm::is_contained(Regions, ErrnoRegion))
 231     return clearErrnoState(State);
 232
 233   // Always reset errno state when the system memory space is invalidated.
 234   // The ErrnoRegion is not always found in the list in this case.
 235   if (llvm::is_contained(Regions, ErrnoRegion->getMemorySpace()))
 236     return clearErrnoState(State);
 237
 238   return State;
 239 }
 240
 241 void ento::registerErrnoChecker(CheckerManager &mgr) {
 242   const AnalyzerOptions &Opts = mgr.getAnalyzerOptions();
 243   auto *Checker = mgr.registerChecker<ErrnoChecker>();
 244   Checker->AllowErrnoReadOutsideConditions = Opts.getCheckerBooleanOption(
 245       Checker, "AllowErrnoReadOutsideConditionExpressions");
 246 }
 247
 248 bool ento::shouldRegisterErrnoChecker(const CheckerManager &mgr) {
 249   return true;
 250 }