1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
|
//=== PointerSubChecker.cpp - Pointer subtraction checker ------*- C++ -*--===//
//
// Part of the LLVM Project, under the Apache License v2.0 with LLVM Exceptions.
// See https://llvm.org/LICENSE.txt for license information.
// SPDX-License-Identifier: Apache-2.0 WITH LLVM-exception
//
//===----------------------------------------------------------------------===//
//
// This files defines PointerSubChecker, a builtin checker that checks for
// pointer subtractions on two pointers pointing to different memory chunks.
// This check corresponds to CWE-469.
//
//===----------------------------------------------------------------------===//
#include "clang/StaticAnalyzer/Checkers/BuiltinCheckerRegistration.h"
#include "clang/StaticAnalyzer/Core/BugReporter/BugType.h"
#include "clang/StaticAnalyzer/Core/Checker.h"
#include "clang/StaticAnalyzer/Core/CheckerManager.h"
#include "clang/StaticAnalyzer/Core/PathSensitive/CheckerContext.h"
#include "clang/StaticAnalyzer/Core/PathSensitive/DynamicExtent.h"
#include "llvm/ADT/StringRef.h"
#include "llvm/Support/FormatVariadic.h"
using namespace clang;
using namespace ento;
namespace {
class PointerSubChecker
: public Checker< check::PreStmt<BinaryOperator> > {
const BugType BT{this, "Pointer subtraction"};
const llvm::StringLiteral Msg_MemRegionDifferent =
"Subtraction of two pointers that do not point into the same array "
"is undefined behavior.";
public:
void checkPreStmt(const BinaryOperator *B, CheckerContext &C) const;
};
}
void PointerSubChecker::checkPreStmt(const BinaryOperator *B,
CheckerContext &C) const {
// When doing pointer subtraction, if the two pointers do not point to the
// same array, emit a warning.
if (B->getOpcode() != BO_Sub)
return;
SVal LV = C.getSVal(B->getLHS());
SVal RV = C.getSVal(B->getRHS());
const MemRegion *LR = LV.getAsRegion();
const MemRegion *RR = RV.getAsRegion();
if (!LR || !RR)
return;
// Allow subtraction of identical pointers.
if (LR == RR)
return;
// No warning if one operand is unknown or resides in a region that could be
// equal to the other.
if (LR->getSymbolicBase() || RR->getSymbolicBase())
return;
if (!B->getLHS()->getType()->isPointerType() ||
!B->getRHS()->getType()->isPointerType())
return;
const auto *ElemLR = dyn_cast<ElementRegion>(LR);
const auto *ElemRR = dyn_cast<ElementRegion>(RR);
// Allow cases like "(&x + 1) - &x".
if (ElemLR && ElemLR->getSuperRegion() == RR)
return;
// Allow cases like "&x - (&x + 1)".
if (ElemRR && ElemRR->getSuperRegion() == LR)
return;
const ValueDecl *DiffDeclL = nullptr;
const ValueDecl *DiffDeclR = nullptr;
if (ElemLR && ElemRR) {
const MemRegion *SuperLR = ElemLR->getSuperRegion();
const MemRegion *SuperRR = ElemRR->getSuperRegion();
if (SuperLR == SuperRR)
return;
// Allow arithmetic on different symbolic regions.
if (isa<SymbolicRegion>(SuperLR) || isa<SymbolicRegion>(SuperRR))
return;
if (const auto *SuperDLR = dyn_cast<DeclRegion>(SuperLR))
DiffDeclL = SuperDLR->getDecl();
if (const auto *SuperDRR = dyn_cast<DeclRegion>(SuperRR))
DiffDeclR = SuperDRR->getDecl();
}
if (ExplodedNode *N = C.generateNonFatalErrorNode()) {
auto R =
std::make_unique<PathSensitiveBugReport>(BT, Msg_MemRegionDifferent, N);
R->addRange(B->getSourceRange());
// The declarations may be identical even if the regions are different:
// struct { int array[10]; } a, b;
// do_something(&a.array[5] - &b.array[5]);
// In this case don't emit notes.
if (DiffDeclL != DiffDeclR) {
auto AddNote = [&R, &C](const ValueDecl *D, StringRef SideStr) {
if (D) {
std::string Msg = llvm::formatv(
"{0} at the {1}-hand side of subtraction",
D->getType()->isArrayType() ? "Array" : "Object", SideStr);
R->addNote(Msg, {D, C.getSourceManager()});
}
};
AddNote(DiffDeclL, "left");
AddNote(DiffDeclR, "right");
}
C.emitReport(std::move(R));
}
}
void ento::registerPointerSubChecker(CheckerManager &mgr) {
mgr.registerChecker<PointerSubChecker>();
}
bool ento::shouldRegisterPointerSubChecker(const CheckerManager &mgr) {
return true;
}
|
