summaryrefslogtreecommitdiff
path: root/clang/lib/StaticAnalyzer/Checkers/VLASizeChecker.cpp
diff options
context:
space:
mode:
Diffstat (limited to 'clang/lib/StaticAnalyzer/Checkers/VLASizeChecker.cpp')
-rw-r--r--clang/lib/StaticAnalyzer/Checkers/VLASizeChecker.cpp298
1 files changed, 224 insertions, 74 deletions
diff --git a/clang/lib/StaticAnalyzer/Checkers/VLASizeChecker.cpp b/clang/lib/StaticAnalyzer/Checkers/VLASizeChecker.cpp
index b92757312dc65..d76b2a06aba52 100644
--- a/clang/lib/StaticAnalyzer/Checkers/VLASizeChecker.cpp
+++ b/clang/lib/StaticAnalyzer/Checkers/VLASizeChecker.cpp
@@ -14,12 +14,13 @@
//===----------------------------------------------------------------------===//
#include "Taint.h"
-#include "clang/StaticAnalyzer/Checkers/BuiltinCheckerRegistration.h"
#include "clang/AST/CharUnits.h"
+#include "clang/StaticAnalyzer/Checkers/BuiltinCheckerRegistration.h"
#include "clang/StaticAnalyzer/Core/BugReporter/BugType.h"
#include "clang/StaticAnalyzer/Core/Checker.h"
#include "clang/StaticAnalyzer/Core/CheckerManager.h"
#include "clang/StaticAnalyzer/Core/PathSensitive/CheckerContext.h"
+#include "clang/StaticAnalyzer/Core/PathSensitive/DynamicSize.h"
#include "llvm/ADT/STLExtras.h"
#include "llvm/ADT/SmallString.h"
#include "llvm/Support/raw_ostream.h"
@@ -29,9 +30,28 @@ using namespace ento;
using namespace taint;
namespace {
-class VLASizeChecker : public Checker< check::PreStmt<DeclStmt> > {
+class VLASizeChecker
+ : public Checker<check::PreStmt<DeclStmt>,
+ check::PreStmt<UnaryExprOrTypeTraitExpr>> {
mutable std::unique_ptr<BugType> BT;
- enum VLASize_Kind { VLA_Garbage, VLA_Zero, VLA_Tainted, VLA_Negative };
+ enum VLASize_Kind {
+ VLA_Garbage,
+ VLA_Zero,
+ VLA_Tainted,
+ VLA_Negative,
+ VLA_Overflow
+ };
+
+ /// Check a VLA for validity.
+ /// Every dimension of the array and the total size is checked for validity.
+ /// Returns null or a new state where the size is validated.
+ /// 'ArraySize' will contain SVal that refers to the total size (in char)
+ /// of the array.
+ ProgramStateRef checkVLA(CheckerContext &C, ProgramStateRef State,
+ const VariableArrayType *VLA, SVal &ArraySize) const;
+ /// Check a single VLA index size expression for validity.
+ ProgramStateRef checkVLAIndexSize(CheckerContext &C, ProgramStateRef State,
+ const Expr *SizeE) const;
void reportBug(VLASize_Kind Kind, const Expr *SizeE, ProgramStateRef State,
CheckerContext &C,
@@ -39,9 +59,155 @@ class VLASizeChecker : public Checker< check::PreStmt<DeclStmt> > {
public:
void checkPreStmt(const DeclStmt *DS, CheckerContext &C) const;
+ void checkPreStmt(const UnaryExprOrTypeTraitExpr *UETTE,
+ CheckerContext &C) const;
};
} // end anonymous namespace
+ProgramStateRef VLASizeChecker::checkVLA(CheckerContext &C,
+ ProgramStateRef State,
+ const VariableArrayType *VLA,
+ SVal &ArraySize) const {
+ assert(VLA && "Function should be called with non-null VLA argument.");
+
+ const VariableArrayType *VLALast = nullptr;
+ llvm::SmallVector<const Expr *, 2> VLASizes;
+
+ // Walk over the VLAs for every dimension until a non-VLA is found.
+ // There is a VariableArrayType for every dimension (fixed or variable) until
+ // the most inner array that is variably modified.
+ // Dimension sizes are collected into 'VLASizes'. 'VLALast' is set to the
+ // innermost VLA that was encountered.
+ // In "int vla[x][2][y][3]" this will be the array for index "y" (with type
+ // int[3]). 'VLASizes' contains 'x', '2', and 'y'.
+ while (VLA) {
+ const Expr *SizeE = VLA->getSizeExpr();
+ State = checkVLAIndexSize(C, State, SizeE);
+ if (!State)
+ return nullptr;
+ VLASizes.push_back(SizeE);
+ VLALast = VLA;
+ VLA = C.getASTContext().getAsVariableArrayType(VLA->getElementType());
+ };
+ assert(VLALast &&
+ "Array should have at least one variably-modified dimension.");
+
+ ASTContext &Ctx = C.getASTContext();
+ SValBuilder &SVB = C.getSValBuilder();
+ CanQualType SizeTy = Ctx.getSizeType();
+ uint64_t SizeMax =
+ SVB.getBasicValueFactory().getMaxValue(SizeTy).getZExtValue();
+
+ // Get the element size.
+ CharUnits EleSize = Ctx.getTypeSizeInChars(VLALast->getElementType());
+ NonLoc ArrSize =
+ SVB.makeIntVal(EleSize.getQuantity(), SizeTy).castAs<NonLoc>();
+
+ // Try to calculate the known real size of the array in KnownSize.
+ uint64_t KnownSize = 0;
+ if (const llvm::APSInt *KV = SVB.getKnownValue(State, ArrSize))
+ KnownSize = KV->getZExtValue();
+
+ for (const Expr *SizeE : VLASizes) {
+ auto SizeD = C.getSVal(SizeE).castAs<DefinedSVal>();
+ // Convert the array length to size_t.
+ NonLoc IndexLength =
+ SVB.evalCast(SizeD, SizeTy, SizeE->getType()).castAs<NonLoc>();
+ // Multiply the array length by the element size.
+ SVal Mul = SVB.evalBinOpNN(State, BO_Mul, ArrSize, IndexLength, SizeTy);
+ if (auto MulNonLoc = Mul.getAs<NonLoc>())
+ ArrSize = *MulNonLoc;
+ else
+ // Extent could not be determined.
+ return State;
+
+ if (const llvm::APSInt *IndexLVal = SVB.getKnownValue(State, IndexLength)) {
+ // Check if the array size will overflow.
+ // Size overflow check does not work with symbolic expressions because a
+ // overflow situation can not be detected easily.
+ uint64_t IndexL = IndexLVal->getZExtValue();
+ // FIXME: See https://reviews.llvm.org/D80903 for discussion of
+ // some difference in assume and getKnownValue that leads to
+ // unexpected behavior. Just bail on IndexL == 0 at this point.
+ if (IndexL == 0)
+ return nullptr;
+
+ if (KnownSize <= SizeMax / IndexL) {
+ KnownSize *= IndexL;
+ } else {
+ // Array size does not fit into size_t.
+ reportBug(VLA_Overflow, SizeE, State, C);
+ return nullptr;
+ }
+ } else {
+ KnownSize = 0;
+ }
+ }
+
+ ArraySize = ArrSize;
+
+ return State;
+}
+
+ProgramStateRef VLASizeChecker::checkVLAIndexSize(CheckerContext &C,
+ ProgramStateRef State,
+ const Expr *SizeE) const {
+ SVal SizeV = C.getSVal(SizeE);
+
+ if (SizeV.isUndef()) {
+ reportBug(VLA_Garbage, SizeE, State, C);
+ return nullptr;
+ }
+
+ // See if the size value is known. It can't be undefined because we would have
+ // warned about that already.
+ if (SizeV.isUnknown())
+ return nullptr;
+
+ // Check if the size is tainted.
+ if (isTainted(State, SizeV)) {
+ reportBug(VLA_Tainted, SizeE, nullptr, C,
+ std::make_unique<TaintBugVisitor>(SizeV));
+ return nullptr;
+ }
+
+ // Check if the size is zero.
+ DefinedSVal SizeD = SizeV.castAs<DefinedSVal>();
+
+ ProgramStateRef StateNotZero, StateZero;
+ std::tie(StateNotZero, StateZero) = State->assume(SizeD);
+
+ if (StateZero && !StateNotZero) {
+ reportBug(VLA_Zero, SizeE, StateZero, C);
+ return nullptr;
+ }
+
+ // From this point on, assume that the size is not zero.
+ State = StateNotZero;
+
+ // Check if the size is negative.
+ SValBuilder &SVB = C.getSValBuilder();
+
+ QualType SizeTy = SizeE->getType();
+ DefinedOrUnknownSVal Zero = SVB.makeZeroVal(SizeTy);
+
+ SVal LessThanZeroVal = SVB.evalBinOp(State, BO_LT, SizeD, Zero, SizeTy);
+ if (Optional<DefinedSVal> LessThanZeroDVal =
+ LessThanZeroVal.getAs<DefinedSVal>()) {
+ ConstraintManager &CM = C.getConstraintManager();
+ ProgramStateRef StatePos, StateNeg;
+
+ std::tie(StateNeg, StatePos) = CM.assumeDual(State, *LessThanZeroDVal);
+ if (StateNeg && !StatePos) {
+ reportBug(VLA_Negative, SizeE, State, C);
+ return nullptr;
+ }
+ State = StatePos;
+ }
+
+ return State;
+}
+
void VLASizeChecker::reportBug(
VLASize_Kind Kind, const Expr *SizeE, ProgramStateRef State,
CheckerContext &C, std::unique_ptr<BugReporterVisitor> Visitor) const {
@@ -70,6 +236,9 @@ void VLASizeChecker::reportBug(
case VLA_Negative:
os << "has negative size";
break;
+ case VLA_Overflow:
+ os << "has too large size";
+ break;
}
auto report = std::make_unique<PathSensitiveBugReport>(*BT, os.str(), N);
@@ -83,108 +252,89 @@ void VLASizeChecker::checkPreStmt(const DeclStmt *DS, CheckerContext &C) const {
if (!DS->isSingleDecl())
return;
- const VarDecl *VD = dyn_cast<VarDecl>(DS->getSingleDecl());
- if (!VD)
- return;
-
ASTContext &Ctx = C.getASTContext();
- const VariableArrayType *VLA = Ctx.getAsVariableArrayType(VD->getType());
- if (!VLA)
- return;
+ SValBuilder &SVB = C.getSValBuilder();
+ ProgramStateRef State = C.getState();
+ QualType TypeToCheck;
- // FIXME: Handle multi-dimensional VLAs.
- const Expr *SE = VLA->getSizeExpr();
- ProgramStateRef state = C.getState();
- SVal sizeV = C.getSVal(SE);
+ const VarDecl *VD = dyn_cast<VarDecl>(DS->getSingleDecl());
- if (sizeV.isUndef()) {
- reportBug(VLA_Garbage, SE, state, C);
+ if (VD)
+ TypeToCheck = VD->getType().getCanonicalType();
+ else if (const auto *TND = dyn_cast<TypedefNameDecl>(DS->getSingleDecl()))
+ TypeToCheck = TND->getUnderlyingType().getCanonicalType();
+ else
return;
- }
- // See if the size value is known. It can't be undefined because we would have
- // warned about that already.
- if (sizeV.isUnknown())
+ const VariableArrayType *VLA = Ctx.getAsVariableArrayType(TypeToCheck);
+ if (!VLA)
return;
- // Check if the size is tainted.
- if (isTainted(state, sizeV)) {
- reportBug(VLA_Tainted, SE, nullptr, C,
- std::make_unique<TaintBugVisitor>(sizeV));
- return;
- }
+ // Check the VLA sizes for validity.
- // Check if the size is zero.
- DefinedSVal sizeD = sizeV.castAs<DefinedSVal>();
+ SVal ArraySize;
- ProgramStateRef stateNotZero, stateZero;
- std::tie(stateNotZero, stateZero) = state->assume(sizeD);
+ State = checkVLA(C, State, VLA, ArraySize);
+ if (!State)
+ return;
- if (stateZero && !stateNotZero) {
- reportBug(VLA_Zero, SE, stateZero, C);
+ auto ArraySizeNL = ArraySize.getAs<NonLoc>();
+ if (!ArraySizeNL) {
+ // Array size could not be determined but state may contain new assumptions.
+ C.addTransition(State);
return;
}
- // From this point on, assume that the size is not zero.
- state = stateNotZero;
-
// VLASizeChecker is responsible for defining the extent of the array being
// declared. We do this by multiplying the array length by the element size,
// then matching that with the array region's extent symbol.
- // Check if the size is negative.
- SValBuilder &svalBuilder = C.getSValBuilder();
+ if (VD) {
+ // Assume that the array's size matches the region size.
+ const LocationContext *LC = C.getLocationContext();
+ DefinedOrUnknownSVal DynSize =
+ getDynamicSize(State, State->getRegion(VD, LC), SVB);
- QualType Ty = SE->getType();
- DefinedOrUnknownSVal Zero = svalBuilder.makeZeroVal(Ty);
+ DefinedOrUnknownSVal SizeIsKnown = SVB.evalEQ(State, DynSize, *ArraySizeNL);
+ State = State->assume(SizeIsKnown, true);
- SVal LessThanZeroVal = svalBuilder.evalBinOp(state, BO_LT, sizeD, Zero, Ty);
- if (Optional<DefinedSVal> LessThanZeroDVal =
- LessThanZeroVal.getAs<DefinedSVal>()) {
- ConstraintManager &CM = C.getConstraintManager();
- ProgramStateRef StatePos, StateNeg;
-
- std::tie(StateNeg, StatePos) = CM.assumeDual(state, *LessThanZeroDVal);
- if (StateNeg && !StatePos) {
- reportBug(VLA_Negative, SE, state, C);
- return;
- }
- state = StatePos;
+ // Assume should not fail at this point.
+ assert(State);
}
- // Convert the array length to size_t.
- QualType SizeTy = Ctx.getSizeType();
- NonLoc ArrayLength =
- svalBuilder.evalCast(sizeD, SizeTy, SE->getType()).castAs<NonLoc>();
+ // Remember our assumptions!
+ C.addTransition(State);
+}
- // Get the element size.
- CharUnits EleSize = Ctx.getTypeSizeInChars(VLA->getElementType());
- SVal EleSizeVal = svalBuilder.makeIntVal(EleSize.getQuantity(), SizeTy);
+void VLASizeChecker::checkPreStmt(const UnaryExprOrTypeTraitExpr *UETTE,
+ CheckerContext &C) const {
+ // Want to check for sizeof.
+ if (UETTE->getKind() != UETT_SizeOf)
+ return;
- // Multiply the array length by the element size.
- SVal ArraySizeVal = svalBuilder.evalBinOpNN(
- state, BO_Mul, ArrayLength, EleSizeVal.castAs<NonLoc>(), SizeTy);
+ // Ensure a type argument.
+ if (!UETTE->isArgumentType())
+ return;
- // Finally, assume that the array's extent matches the given size.
- const LocationContext *LC = C.getLocationContext();
- DefinedOrUnknownSVal Extent =
- state->getRegion(VD, LC)->getExtent(svalBuilder);
- DefinedOrUnknownSVal ArraySize = ArraySizeVal.castAs<DefinedOrUnknownSVal>();
- DefinedOrUnknownSVal sizeIsKnown =
- svalBuilder.evalEQ(state, Extent, ArraySize);
- state = state->assume(sizeIsKnown, true);
+ const VariableArrayType *VLA = C.getASTContext().getAsVariableArrayType(
+ UETTE->getTypeOfArgument().getCanonicalType());
+ // Ensure that the type is a VLA.
+ if (!VLA)
+ return;
- // Assume should not fail at this point.
- assert(state);
+ ProgramStateRef State = C.getState();
+ SVal ArraySize;
+ State = checkVLA(C, State, VLA, ArraySize);
+ if (!State)
+ return;
- // Remember our assumptions!
- C.addTransition(state);
+ C.addTransition(State);
}
void ento::registerVLASizeChecker(CheckerManager &mgr) {
mgr.registerChecker<VLASizeChecker>();
}
-bool ento::shouldRegisterVLASizeChecker(const LangOptions &LO) {
+bool ento::shouldRegisterVLASizeChecker(const CheckerManager &mgr) {
return true;
}
generated by cgit v1.2.3 (git 2.25.1) at 2025-07-31 04:43:58 +0000