clang/lib/StaticAnalyzer/Checkers/SimpleStreamChecker.cpp

   1 //===-- SimpleStreamChecker.cpp -----------------------------------------*- C++ -*--//
   2 //
   3 // Part of the LLVM Project, under the Apache License v2.0 with LLVM Exceptions.
   4 // See https://llvm.org/LICENSE.txt for license information.
   5 // SPDX-License-Identifier: Apache-2.0 WITH LLVM-exception
   6 //
   7 //===----------------------------------------------------------------------===//
   8 //
   9 // Defines a checker for proper use of fopen/fclose APIs.
  10 //   - If a file has been closed with fclose, it should not be accessed again.
  11 //   Accessing a closed file results in undefined behavior.
  12 //   - If a file was opened with fopen, it must be closed with fclose before
  13 //   the execution ends. Failing to do so results in a resource leak.
  14 //
  15 //===----------------------------------------------------------------------===//
  16
  17 #include "clang/StaticAnalyzer/Checkers/BuiltinCheckerRegistration.h"
  18 #include "clang/StaticAnalyzer/Core/BugReporter/BugType.h"
  19 #include "clang/StaticAnalyzer/Core/Checker.h"
  20 #include "clang/StaticAnalyzer/Core/PathSensitive/CallDescription.h"
  21 #include "clang/StaticAnalyzer/Core/PathSensitive/CallEvent.h"
  22 #include "clang/StaticAnalyzer/Core/PathSensitive/CheckerContext.h"
  23 #include <utility>
  24
  25 using namespace clang;
  26 using namespace ento;
  27
  28 namespace {
  29 typedef SmallVector<SymbolRef, 2> SymbolVector;
  30
  31 struct StreamState {
  32 private:
  33   enum Kind { Opened, Closed } K;
  34   StreamState(Kind InK) : K(InK) { }
  35
  36 public:
  37   bool isOpened() const { return K == Opened; }
  38   bool isClosed() const { return K == Closed; }
  39
  40   static StreamState getOpened() { return StreamState(Opened); }
  41   static StreamState getClosed() { return StreamState(Closed); }
  42
  43   bool operator==(const StreamState &X) const {
  44     return K == X.K;
  45   }
  46   void Profile(llvm::FoldingSetNodeID &ID) const {
  47     ID.AddInteger(K);
  48   }
  49 };
  50
  51 class SimpleStreamChecker : public Checker<check::PostCall,
  52                                            check::PreCall,
  53                                            check::DeadSymbols,
  54                                            check::PointerEscape> {
  55   CallDescription OpenFn, CloseFn;
  56
  57   std::unique_ptr<BugType> DoubleCloseBugType;
  58   std::unique_ptr<BugType> LeakBugType;
  59
  60   void reportDoubleClose(SymbolRef FileDescSym,
  61                          const CallEvent &Call,
  62                          CheckerContext &C) const;
  63
  64   void reportLeaks(ArrayRef<SymbolRef> LeakedStreams, CheckerContext &C,
  65                    ExplodedNode *ErrNode) const;
  66
  67   bool guaranteedNotToCloseFile(const CallEvent &Call) const;
  68
  69 public:
  70   SimpleStreamChecker();
  71
  72   /// Process fopen.
  73   void checkPostCall(const CallEvent &Call, CheckerContext &C) const;
  74   /// Process fclose.
  75   void checkPreCall(const CallEvent &Call, CheckerContext &C) const;
  76
  77   void checkDeadSymbols(SymbolReaper &SymReaper, CheckerContext &C) const;
  78
  79   /// Stop tracking addresses which escape.
  80   ProgramStateRef checkPointerEscape(ProgramStateRef State,
  81                                     const InvalidatedSymbols &Escaped,
  82                                     const CallEvent *Call,
  83                                     PointerEscapeKind Kind) const;
  84 };
  85
  86 } // end anonymous namespace
  87
  88 /// The state of the checker is a map from tracked stream symbols to their
  89 /// state. Let's store it in the ProgramState.
  90 REGISTER_MAP_WITH_PROGRAMSTATE(StreamMap, SymbolRef, StreamState)
  91
  92 SimpleStreamChecker::SimpleStreamChecker()
  93     : OpenFn({"fopen"}), CloseFn({"fclose"}, 1) {
  94   // Initialize the bug types.
  95   DoubleCloseBugType.reset(
  96       new BugType(this, "Double fclose", "Unix Stream API Error"));
  97
  98   // Sinks are higher importance bugs as well as calls to assert() or exit(0).
  99   LeakBugType.reset(
 100       new BugType(this, "Resource Leak", "Unix Stream API Error",
 101                   /*SuppressOnSink=*/true));
 102 }
 103
 104 void SimpleStreamChecker::checkPostCall(const CallEvent &Call,
 105                                         CheckerContext &C) const {
 106   if (!Call.isGlobalCFunction())
 107     return;
 108
 109   if (!OpenFn.matches(Call))
 110     return;
 111
 112   // Get the symbolic value corresponding to the file handle.
 113   SymbolRef FileDesc = Call.getReturnValue().getAsSymbol();
 114   if (!FileDesc)
 115     return;
 116
 117   // Generate the next transition (an edge in the exploded graph).
 118   ProgramStateRef State = C.getState();
 119   State = State->set<StreamMap>(FileDesc, StreamState::getOpened());
 120   C.addTransition(State);
 121 }
 122
 123 void SimpleStreamChecker::checkPreCall(const CallEvent &Call,
 124                                        CheckerContext &C) const {
 125   if (!Call.isGlobalCFunction())
 126     return;
 127
 128   if (!CloseFn.matches(Call))
 129     return;
 130
 131   // Get the symbolic value corresponding to the file handle.
 132   SymbolRef FileDesc = Call.getArgSVal(0).getAsSymbol();
 133   if (!FileDesc)
 134     return;
 135
 136   // Check if the stream has already been closed.
 137   ProgramStateRef State = C.getState();
 138   const StreamState *SS = State->get<StreamMap>(FileDesc);
 139   if (SS && SS->isClosed()) {
 140     reportDoubleClose(FileDesc, Call, C);
 141     return;
 142   }
 143
 144   // Generate the next transition, in which the stream is closed.
 145   State = State->set<StreamMap>(FileDesc, StreamState::getClosed());
 146   C.addTransition(State);
 147 }
 148
 149 static bool isLeaked(SymbolRef Sym, const StreamState &SS,
 150                      bool IsSymDead, ProgramStateRef State) {
 151   if (IsSymDead && SS.isOpened()) {
 152     // If a symbol is NULL, assume that fopen failed on this path.
 153     // A symbol should only be considered leaked if it is non-null.
 154     ConstraintManager &CMgr = State->getConstraintManager();
 155     ConditionTruthVal OpenFailed = CMgr.isNull(State, Sym);
 156     return !OpenFailed.isConstrainedTrue();
 157   }
 158   return false;
 159 }
 160
 161 void SimpleStreamChecker::checkDeadSymbols(SymbolReaper &SymReaper,
 162                                            CheckerContext &C) const {
 163   ProgramStateRef State = C.getState();
 164   SymbolVector LeakedStreams;
 165   StreamMapTy TrackedStreams = State->get<StreamMap>();
 166   for (auto [Sym, StreamStatus] : TrackedStreams) {
 167     bool IsSymDead = SymReaper.isDead(Sym);
 168
 169     // Collect leaked symbols.
 170     if (isLeaked(Sym, StreamStatus, IsSymDead, State))
 171       LeakedStreams.push_back(Sym);
 172
 173     // Remove the dead symbol from the streams map.
 174     if (IsSymDead)
 175       State = State->remove<StreamMap>(Sym);
 176   }
 177
 178   ExplodedNode *N = C.generateNonFatalErrorNode(State);
 179   if (!N)
 180     return;
 181   reportLeaks(LeakedStreams, C, N);
 182 }
 183
 184 void SimpleStreamChecker::reportDoubleClose(SymbolRef FileDescSym,
 185                                             const CallEvent &Call,
 186                                             CheckerContext &C) const {
 187   // We reached a bug, stop exploring the path here by generating a sink.
 188   ExplodedNode *ErrNode = C.generateErrorNode();
 189   // If we've already reached this node on another path, return.
 190   if (!ErrNode)
 191     return;
 192
 193   // Generate the report.
 194   auto R = std::make_unique<PathSensitiveBugReport>(
 195       *DoubleCloseBugType, "Closing a previously closed file stream", ErrNode);
 196   R->addRange(Call.getSourceRange());
 197   R->markInteresting(FileDescSym);
 198   C.emitReport(std::move(R));
 199 }
 200
 201 void SimpleStreamChecker::reportLeaks(ArrayRef<SymbolRef> LeakedStreams,
 202                                       CheckerContext &C,
 203                                       ExplodedNode *ErrNode) const {
 204   // Attach bug reports to the leak node.
 205   // TODO: Identify the leaked file descriptor.
 206   for (SymbolRef LeakedStream : LeakedStreams) {
 207     auto R = std::make_unique<PathSensitiveBugReport>(
 208         *LeakBugType, "Opened file is never closed; potential resource leak",
 209         ErrNode);
 210     R->markInteresting(LeakedStream);
 211     C.emitReport(std::move(R));
 212   }
 213 }
 214
 215 bool SimpleStreamChecker::guaranteedNotToCloseFile(const CallEvent &Call) const{
 216   // If it's not in a system header, assume it might close a file.
 217   if (!Call.isInSystemHeader())
 218     return false;
 219
 220   // Handle cases where we know a buffer's /address/ can escape.
 221   if (Call.argumentsMayEscape())
 222     return false;
 223
 224   // Note, even though fclose closes the file, we do not list it here
 225   // since the checker is modeling the call.
 226
 227   return true;
 228 }
 229
 230 // If the pointer we are tracking escaped, do not track the symbol as
 231 // we cannot reason about it anymore.
 232 ProgramStateRef
 233 SimpleStreamChecker::checkPointerEscape(ProgramStateRef State,
 234                                         const InvalidatedSymbols &Escaped,
 235                                         const CallEvent *Call,
 236                                         PointerEscapeKind Kind) const {
 237   // If we know that the call cannot close a file, there is nothing to do.
 238   if (Kind == PSK_DirectEscapeOnCall && guaranteedNotToCloseFile(*Call)) {
 239     return State;
 240   }
 241
 242   for (SymbolRef Sym : Escaped) {
 243     // The symbol escaped. Optimistically, assume that the corresponding file
 244     // handle will be closed somewhere else.
 245     State = State->remove<StreamMap>(Sym);
 246   }
 247   return State;
 248 }
 249
 250 void ento::registerSimpleStreamChecker(CheckerManager &mgr) {
 251   mgr.registerChecker<SimpleStreamChecker>();
 252 }
 253
 254 // This checker should be enabled regardless of how language options are set.
 255 bool ento::shouldRegisterSimpleStreamChecker(const CheckerManager &mgr) {
 256   return true;
 257 }