2009-11-12 16:38:56 +08:00
|
|
|
//=== MallocChecker.cpp - A malloc/free checker -------------------*- C++ -*--//
|
|
|
|
//
|
|
|
|
// The LLVM Compiler Infrastructure
|
|
|
|
//
|
|
|
|
// This file is distributed under the University of Illinois Open Source
|
|
|
|
// License. See LICENSE.TXT for details.
|
|
|
|
//
|
|
|
|
//===----------------------------------------------------------------------===//
|
|
|
|
//
|
|
|
|
// This file defines malloc/free checker, which checks for potential memory
|
|
|
|
// leaks, double free, and use-after-free problems.
|
|
|
|
//
|
|
|
|
//===----------------------------------------------------------------------===//
|
|
|
|
|
2009-11-13 15:25:27 +08:00
|
|
|
#include "GRExprEngineExperimentalChecks.h"
|
2010-01-25 12:41:41 +08:00
|
|
|
#include "clang/Checker/PathSensitive/CheckerVisitor.h"
|
|
|
|
#include "clang/Checker/PathSensitive/GRState.h"
|
|
|
|
#include "clang/Checker/PathSensitive/GRStateTrait.h"
|
|
|
|
#include "clang/Checker/PathSensitive/SymbolManager.h"
|
2009-11-12 16:38:56 +08:00
|
|
|
#include "llvm/ADT/ImmutableMap.h"
|
|
|
|
using namespace clang;
|
|
|
|
|
|
|
|
namespace {
|
|
|
|
|
2009-12-11 08:55:44 +08:00
|
|
|
class RefState {
|
2009-12-31 14:13:07 +08:00
|
|
|
enum Kind { AllocateUnchecked, AllocateFailed, Released, Escaped } K;
|
2009-11-17 15:54:15 +08:00
|
|
|
const Stmt *S;
|
|
|
|
|
2009-12-11 08:55:44 +08:00
|
|
|
public:
|
2009-11-17 15:54:15 +08:00
|
|
|
RefState(Kind k, const Stmt *s) : K(k), S(s) {}
|
|
|
|
|
2009-12-31 14:13:07 +08:00
|
|
|
bool isAllocated() const { return K == AllocateUnchecked; }
|
2009-11-17 15:54:15 +08:00
|
|
|
bool isReleased() const { return K == Released; }
|
|
|
|
bool isEscaped() const { return K == Escaped; }
|
|
|
|
|
|
|
|
bool operator==(const RefState &X) const {
|
|
|
|
return K == X.K && S == X.S;
|
|
|
|
}
|
|
|
|
|
2009-12-31 14:13:07 +08:00
|
|
|
static RefState getAllocateUnchecked(const Stmt *s) {
|
|
|
|
return RefState(AllocateUnchecked, s);
|
|
|
|
}
|
|
|
|
static RefState getAllocateFailed() {
|
|
|
|
return RefState(AllocateFailed, 0);
|
|
|
|
}
|
2009-11-17 15:54:15 +08:00
|
|
|
static RefState getReleased(const Stmt *s) { return RefState(Released, s); }
|
|
|
|
static RefState getEscaped(const Stmt *s) { return RefState(Escaped, s); }
|
|
|
|
|
|
|
|
void Profile(llvm::FoldingSetNodeID &ID) const {
|
|
|
|
ID.AddInteger(K);
|
|
|
|
ID.AddPointer(S);
|
|
|
|
}
|
2009-11-12 16:38:56 +08:00
|
|
|
};
|
|
|
|
|
2009-11-28 14:07:30 +08:00
|
|
|
class RegionState {};
|
2009-11-12 16:38:56 +08:00
|
|
|
|
2009-11-28 14:07:30 +08:00
|
|
|
class MallocChecker : public CheckerVisitor<MallocChecker> {
|
2009-11-12 16:38:56 +08:00
|
|
|
BuiltinBug *BT_DoubleFree;
|
2009-11-13 15:48:11 +08:00
|
|
|
BuiltinBug *BT_Leak;
|
2010-03-10 12:58:55 +08:00
|
|
|
BuiltinBug *BT_UseFree;
|
2009-12-12 20:29:38 +08:00
|
|
|
IdentifierInfo *II_malloc, *II_free, *II_realloc;
|
2009-11-12 16:38:56 +08:00
|
|
|
|
|
|
|
public:
|
2009-12-12 20:29:38 +08:00
|
|
|
MallocChecker()
|
2010-03-10 12:58:55 +08:00
|
|
|
: BT_DoubleFree(0), BT_Leak(0), BT_UseFree(0),
|
|
|
|
II_malloc(0), II_free(0), II_realloc(0) {}
|
2009-11-12 16:38:56 +08:00
|
|
|
static void *getTag();
|
2009-12-11 11:09:01 +08:00
|
|
|
bool EvalCallExpr(CheckerContext &C, const CallExpr *CE);
|
2009-11-13 15:25:27 +08:00
|
|
|
void EvalDeadSymbols(CheckerContext &C,const Stmt *S,SymbolReaper &SymReaper);
|
2009-11-17 15:54:15 +08:00
|
|
|
void EvalEndPath(GREndPathNodeBuilder &B, void *tag, GRExprEngine &Eng);
|
2009-11-17 16:58:18 +08:00
|
|
|
void PreVisitReturnStmt(CheckerContext &C, const ReturnStmt *S);
|
2009-12-31 14:13:07 +08:00
|
|
|
const GRState *EvalAssume(const GRState *state, SVal Cond, bool Assumption);
|
2010-03-10 12:58:55 +08:00
|
|
|
void VisitLocation(CheckerContext &C, const Stmt *S, SVal l);
|
2009-12-31 14:13:07 +08:00
|
|
|
|
2009-11-13 15:25:27 +08:00
|
|
|
private:
|
2009-11-12 16:38:56 +08:00
|
|
|
void MallocMem(CheckerContext &C, const CallExpr *CE);
|
2009-12-12 20:29:38 +08:00
|
|
|
const GRState *MallocMemAux(CheckerContext &C, const CallExpr *CE,
|
2010-01-18 16:54:31 +08:00
|
|
|
const Expr *SizeEx, const GRState *state);
|
2009-11-12 16:38:56 +08:00
|
|
|
void FreeMem(CheckerContext &C, const CallExpr *CE);
|
2009-12-12 20:29:38 +08:00
|
|
|
const GRState *FreeMemAux(CheckerContext &C, const CallExpr *CE,
|
|
|
|
const GRState *state);
|
|
|
|
|
|
|
|
void ReallocMem(CheckerContext &C, const CallExpr *CE);
|
2009-11-12 16:38:56 +08:00
|
|
|
};
|
2009-11-28 14:07:30 +08:00
|
|
|
} // end anonymous namespace
|
2009-11-12 16:38:56 +08:00
|
|
|
|
2009-12-31 14:13:07 +08:00
|
|
|
typedef llvm::ImmutableMap<SymbolRef, RefState> RegionStateTy;
|
|
|
|
|
2009-11-12 16:38:56 +08:00
|
|
|
namespace clang {
|
2009-11-17 15:54:15 +08:00
|
|
|
template <>
|
2009-11-12 16:38:56 +08:00
|
|
|
struct GRStateTrait<RegionState>
|
|
|
|
: public GRStatePartialTrait<llvm::ImmutableMap<SymbolRef, RefState> > {
|
|
|
|
static void *GDMIndex() { return MallocChecker::getTag(); }
|
|
|
|
};
|
|
|
|
}
|
|
|
|
|
2009-11-13 15:25:27 +08:00
|
|
|
void clang::RegisterMallocChecker(GRExprEngine &Eng) {
|
|
|
|
Eng.registerCheck(new MallocChecker());
|
|
|
|
}
|
|
|
|
|
2009-11-12 16:38:56 +08:00
|
|
|
void *MallocChecker::getTag() {
|
|
|
|
static int x;
|
|
|
|
return &x;
|
|
|
|
}
|
|
|
|
|
2009-12-11 11:09:01 +08:00
|
|
|
bool MallocChecker::EvalCallExpr(CheckerContext &C, const CallExpr *CE) {
|
|
|
|
const GRState *state = C.getState();
|
|
|
|
const Expr *Callee = CE->getCallee();
|
2010-02-09 00:18:51 +08:00
|
|
|
SVal L = state->getSVal(Callee);
|
2009-12-11 11:09:01 +08:00
|
|
|
|
|
|
|
const FunctionDecl *FD = L.getAsFunctionDecl();
|
2009-11-12 16:38:56 +08:00
|
|
|
if (!FD)
|
2009-12-11 11:09:01 +08:00
|
|
|
return false;
|
2009-11-12 16:38:56 +08:00
|
|
|
|
|
|
|
ASTContext &Ctx = C.getASTContext();
|
|
|
|
if (!II_malloc)
|
|
|
|
II_malloc = &Ctx.Idents.get("malloc");
|
|
|
|
if (!II_free)
|
2009-11-13 15:48:11 +08:00
|
|
|
II_free = &Ctx.Idents.get("free");
|
2009-12-12 20:29:38 +08:00
|
|
|
if (!II_realloc)
|
|
|
|
II_realloc = &Ctx.Idents.get("realloc");
|
2009-11-12 16:38:56 +08:00
|
|
|
|
|
|
|
if (FD->getIdentifier() == II_malloc) {
|
|
|
|
MallocMem(C, CE);
|
2009-12-11 11:09:01 +08:00
|
|
|
return true;
|
2009-11-12 16:38:56 +08:00
|
|
|
}
|
|
|
|
|
|
|
|
if (FD->getIdentifier() == II_free) {
|
|
|
|
FreeMem(C, CE);
|
2009-12-11 11:09:01 +08:00
|
|
|
return true;
|
2009-11-12 16:38:56 +08:00
|
|
|
}
|
2009-12-11 11:09:01 +08:00
|
|
|
|
2009-12-12 20:29:38 +08:00
|
|
|
if (FD->getIdentifier() == II_realloc) {
|
|
|
|
ReallocMem(C, CE);
|
|
|
|
return true;
|
|
|
|
}
|
|
|
|
|
2009-12-11 11:09:01 +08:00
|
|
|
return false;
|
2009-11-12 16:38:56 +08:00
|
|
|
}
|
|
|
|
|
|
|
|
void MallocChecker::MallocMem(CheckerContext &C, const CallExpr *CE) {
|
2010-01-18 16:54:31 +08:00
|
|
|
const GRState *state = MallocMemAux(C, CE, CE->getArg(0), C.getState());
|
2009-12-12 20:29:38 +08:00
|
|
|
C.addTransition(state);
|
|
|
|
}
|
|
|
|
|
|
|
|
const GRState *MallocChecker::MallocMemAux(CheckerContext &C,
|
|
|
|
const CallExpr *CE,
|
2010-01-18 16:54:31 +08:00
|
|
|
const Expr *SizeEx,
|
2009-12-12 20:29:38 +08:00
|
|
|
const GRState *state) {
|
2009-12-11 11:09:01 +08:00
|
|
|
unsigned Count = C.getNodeBuilder().getCurrentBlockCount();
|
|
|
|
ValueManager &ValMgr = C.getValueManager();
|
|
|
|
|
|
|
|
SVal RetVal = ValMgr.getConjuredSymbolVal(NULL, CE, CE->getType(), Count);
|
|
|
|
|
2010-02-09 00:18:51 +08:00
|
|
|
SVal Size = state->getSVal(SizeEx);
|
2010-01-18 16:54:31 +08:00
|
|
|
|
|
|
|
state = C.getEngine().getStoreManager().setExtent(state, RetVal.getAsRegion(),
|
|
|
|
Size);
|
|
|
|
|
2009-12-11 11:09:01 +08:00
|
|
|
state = state->BindExpr(CE, RetVal);
|
|
|
|
|
|
|
|
SymbolRef Sym = RetVal.getAsLocSymbol();
|
2009-11-12 16:38:56 +08:00
|
|
|
assert(Sym);
|
|
|
|
// Set the symbol's state to Allocated.
|
2009-12-31 14:13:07 +08:00
|
|
|
return state->set<RegionState>(Sym, RefState::getAllocateUnchecked(CE));
|
2009-11-12 16:38:56 +08:00
|
|
|
}
|
|
|
|
|
|
|
|
void MallocChecker::FreeMem(CheckerContext &C, const CallExpr *CE) {
|
2009-12-12 20:29:38 +08:00
|
|
|
const GRState *state = FreeMemAux(C, CE, C.getState());
|
|
|
|
|
|
|
|
if (state)
|
|
|
|
C.addTransition(state);
|
|
|
|
}
|
|
|
|
|
|
|
|
const GRState *MallocChecker::FreeMemAux(CheckerContext &C, const CallExpr *CE,
|
|
|
|
const GRState *state) {
|
2010-02-09 00:18:51 +08:00
|
|
|
SVal ArgVal = state->getSVal(CE->getArg(0));
|
2010-02-14 14:49:48 +08:00
|
|
|
|
|
|
|
// If ptr is NULL, no operation is preformed.
|
|
|
|
if (ArgVal.isZeroConstant())
|
|
|
|
return state;
|
|
|
|
|
2009-11-12 16:38:56 +08:00
|
|
|
SymbolRef Sym = ArgVal.getAsLocSymbol();
|
|
|
|
assert(Sym);
|
|
|
|
|
|
|
|
const RefState *RS = state->get<RegionState>(Sym);
|
2010-01-18 11:27:34 +08:00
|
|
|
|
|
|
|
// If the symbol has not been tracked, return. This is possible when free() is
|
|
|
|
// called on a pointer that does not get its pointee directly from malloc().
|
|
|
|
// Full support of this requires inter-procedural analysis.
|
|
|
|
if (!RS)
|
|
|
|
return state;
|
2009-11-12 16:38:56 +08:00
|
|
|
|
|
|
|
// Check double free.
|
2009-11-17 15:54:15 +08:00
|
|
|
if (RS->isReleased()) {
|
2009-11-24 06:22:01 +08:00
|
|
|
ExplodedNode *N = C.GenerateSink();
|
2009-11-12 16:38:56 +08:00
|
|
|
if (N) {
|
|
|
|
if (!BT_DoubleFree)
|
|
|
|
BT_DoubleFree = new BuiltinBug("Double free",
|
|
|
|
"Try to free a memory block that has been released");
|
|
|
|
// FIXME: should find where it's freed last time.
|
|
|
|
BugReport *R = new BugReport(*BT_DoubleFree,
|
2009-11-14 20:08:24 +08:00
|
|
|
BT_DoubleFree->getDescription(), N);
|
2009-11-12 16:38:56 +08:00
|
|
|
C.EmitReport(R);
|
|
|
|
}
|
2009-12-12 20:29:38 +08:00
|
|
|
return NULL;
|
2009-11-12 16:38:56 +08:00
|
|
|
}
|
|
|
|
|
|
|
|
// Normal free.
|
2009-12-12 20:29:38 +08:00
|
|
|
return state->set<RegionState>(Sym, RefState::getReleased(CE));
|
|
|
|
}
|
|
|
|
|
|
|
|
void MallocChecker::ReallocMem(CheckerContext &C, const CallExpr *CE) {
|
|
|
|
const GRState *state = C.getState();
|
|
|
|
const Expr *Arg0 = CE->getArg(0);
|
2010-02-09 00:18:51 +08:00
|
|
|
DefinedOrUnknownSVal Arg0Val=cast<DefinedOrUnknownSVal>(state->getSVal(Arg0));
|
2009-12-12 20:29:38 +08:00
|
|
|
|
|
|
|
ValueManager &ValMgr = C.getValueManager();
|
|
|
|
SValuator &SVator = C.getSValuator();
|
|
|
|
|
|
|
|
DefinedOrUnknownSVal PtrEQ = SVator.EvalEQ(state, Arg0Val, ValMgr.makeNull());
|
|
|
|
|
|
|
|
// If the ptr is NULL, the call is equivalent to malloc(size).
|
|
|
|
if (const GRState *stateEqual = state->Assume(PtrEQ, true)) {
|
|
|
|
// Hack: set the NULL symbolic region to released to suppress false warning.
|
|
|
|
// In the future we should add more states for allocated regions, e.g.,
|
|
|
|
// CheckedNull, CheckedNonNull.
|
|
|
|
|
|
|
|
SymbolRef Sym = Arg0Val.getAsLocSymbol();
|
|
|
|
if (Sym)
|
|
|
|
stateEqual = stateEqual->set<RegionState>(Sym, RefState::getReleased(CE));
|
|
|
|
|
2010-01-18 16:54:31 +08:00
|
|
|
const GRState *stateMalloc = MallocMemAux(C, CE, CE->getArg(1), stateEqual);
|
2009-12-12 20:29:38 +08:00
|
|
|
C.addTransition(stateMalloc);
|
|
|
|
}
|
|
|
|
|
|
|
|
if (const GRState *stateNotEqual = state->Assume(PtrEQ, false)) {
|
|
|
|
const Expr *Arg1 = CE->getArg(1);
|
|
|
|
DefinedOrUnknownSVal Arg1Val =
|
2010-02-09 00:18:51 +08:00
|
|
|
cast<DefinedOrUnknownSVal>(stateNotEqual->getSVal(Arg1));
|
2009-12-12 20:29:38 +08:00
|
|
|
DefinedOrUnknownSVal SizeZero = SVator.EvalEQ(stateNotEqual, Arg1Val,
|
|
|
|
ValMgr.makeIntValWithPtrWidth(0, false));
|
|
|
|
|
|
|
|
if (const GRState *stateSizeZero = stateNotEqual->Assume(SizeZero, true)) {
|
|
|
|
const GRState *stateFree = FreeMemAux(C, CE, stateSizeZero);
|
|
|
|
if (stateFree)
|
|
|
|
C.addTransition(stateFree->BindExpr(CE, UndefinedVal(), true));
|
|
|
|
}
|
|
|
|
|
|
|
|
if (const GRState *stateSizeNotZero=stateNotEqual->Assume(SizeZero,false)) {
|
|
|
|
const GRState *stateFree = FreeMemAux(C, CE, stateSizeNotZero);
|
|
|
|
if (stateFree) {
|
|
|
|
// FIXME: We should copy the content of the original buffer.
|
2010-01-18 16:54:31 +08:00
|
|
|
const GRState *stateRealloc = MallocMemAux(C, CE, CE->getArg(1),
|
|
|
|
stateFree);
|
2009-12-12 20:29:38 +08:00
|
|
|
C.addTransition(stateRealloc);
|
|
|
|
}
|
|
|
|
}
|
|
|
|
}
|
2009-11-12 16:38:56 +08:00
|
|
|
}
|
2009-11-13 15:25:27 +08:00
|
|
|
|
|
|
|
void MallocChecker::EvalDeadSymbols(CheckerContext &C, const Stmt *S,
|
|
|
|
SymbolReaper &SymReaper) {
|
2009-11-13 15:48:11 +08:00
|
|
|
for (SymbolReaper::dead_iterator I = SymReaper.dead_begin(),
|
|
|
|
E = SymReaper.dead_end(); I != E; ++I) {
|
|
|
|
SymbolRef Sym = *I;
|
|
|
|
const GRState *state = C.getState();
|
|
|
|
const RefState *RS = state->get<RegionState>(Sym);
|
|
|
|
if (!RS)
|
|
|
|
return;
|
|
|
|
|
2009-11-17 15:54:15 +08:00
|
|
|
if (RS->isAllocated()) {
|
2009-11-24 06:22:01 +08:00
|
|
|
ExplodedNode *N = C.GenerateSink();
|
2009-11-13 15:48:11 +08:00
|
|
|
if (N) {
|
|
|
|
if (!BT_Leak)
|
|
|
|
BT_Leak = new BuiltinBug("Memory leak",
|
|
|
|
"Allocated memory never released. Potential memory leak.");
|
|
|
|
// FIXME: where it is allocated.
|
2009-11-17 15:54:15 +08:00
|
|
|
BugReport *R = new BugReport(*BT_Leak, BT_Leak->getDescription(), N);
|
2009-11-13 15:48:11 +08:00
|
|
|
C.EmitReport(R);
|
|
|
|
}
|
|
|
|
}
|
|
|
|
}
|
2009-11-13 15:25:27 +08:00
|
|
|
}
|
2009-11-17 15:54:15 +08:00
|
|
|
|
|
|
|
void MallocChecker::EvalEndPath(GREndPathNodeBuilder &B, void *tag,
|
|
|
|
GRExprEngine &Eng) {
|
2009-11-22 21:22:34 +08:00
|
|
|
SaveAndRestore<bool> OldHasGen(B.HasGeneratedNode);
|
2009-11-17 15:54:15 +08:00
|
|
|
const GRState *state = B.getState();
|
|
|
|
typedef llvm::ImmutableMap<SymbolRef, RefState> SymMap;
|
|
|
|
SymMap M = state->get<RegionState>();
|
|
|
|
|
|
|
|
for (SymMap::iterator I = M.begin(), E = M.end(); I != E; ++I) {
|
|
|
|
RefState RS = I->second;
|
|
|
|
if (RS.isAllocated()) {
|
|
|
|
ExplodedNode *N = B.generateNode(state, tag, B.getPredecessor());
|
|
|
|
if (N) {
|
|
|
|
if (!BT_Leak)
|
|
|
|
BT_Leak = new BuiltinBug("Memory leak",
|
|
|
|
"Allocated memory never released. Potential memory leak.");
|
|
|
|
BugReport *R = new BugReport(*BT_Leak, BT_Leak->getDescription(), N);
|
|
|
|
Eng.getBugReporter().EmitReport(R);
|
|
|
|
}
|
|
|
|
}
|
|
|
|
}
|
|
|
|
}
|
2009-11-17 16:58:18 +08:00
|
|
|
|
|
|
|
void MallocChecker::PreVisitReturnStmt(CheckerContext &C, const ReturnStmt *S) {
|
|
|
|
const Expr *RetE = S->getRetValue();
|
|
|
|
if (!RetE)
|
|
|
|
return;
|
|
|
|
|
|
|
|
const GRState *state = C.getState();
|
|
|
|
|
2010-02-09 00:18:51 +08:00
|
|
|
SymbolRef Sym = state->getSVal(RetE).getAsSymbol();
|
2009-11-17 16:58:18 +08:00
|
|
|
|
|
|
|
if (!Sym)
|
|
|
|
return;
|
|
|
|
|
|
|
|
const RefState *RS = state->get<RegionState>(Sym);
|
|
|
|
if (!RS)
|
|
|
|
return;
|
|
|
|
|
|
|
|
// FIXME: check other cases.
|
|
|
|
if (RS->isAllocated())
|
|
|
|
state = state->set<RegionState>(Sym, RefState::getEscaped(S));
|
|
|
|
|
2009-11-24 06:22:01 +08:00
|
|
|
C.addTransition(state);
|
2009-11-17 16:58:18 +08:00
|
|
|
}
|
2009-12-31 14:13:07 +08:00
|
|
|
|
|
|
|
const GRState *MallocChecker::EvalAssume(const GRState *state, SVal Cond,
|
|
|
|
bool Assumption) {
|
|
|
|
// If a symblic region is assumed to NULL, set its state to AllocateFailed.
|
|
|
|
// FIXME: should also check symbols assumed to non-null.
|
|
|
|
|
|
|
|
RegionStateTy RS = state->get<RegionState>();
|
|
|
|
|
|
|
|
for (RegionStateTy::iterator I = RS.begin(), E = RS.end(); I != E; ++I) {
|
|
|
|
if (state->getSymVal(I.getKey()))
|
|
|
|
state = state->set<RegionState>(I.getKey(),RefState::getAllocateFailed());
|
|
|
|
}
|
|
|
|
|
|
|
|
return state;
|
|
|
|
}
|
2010-03-10 12:58:55 +08:00
|
|
|
|
|
|
|
// Check if the location is a freed symbolic region.
|
|
|
|
void MallocChecker::VisitLocation(CheckerContext &C, const Stmt *S, SVal l) {
|
|
|
|
SymbolRef Sym = l.getLocSymbolInBase();
|
|
|
|
if (Sym) {
|
|
|
|
const RefState *RS = C.getState()->get<RegionState>(Sym);
|
|
|
|
if (RS)
|
|
|
|
if (RS->isReleased()) {
|
|
|
|
ExplodedNode *N = C.GenerateSink();
|
|
|
|
if (!BT_UseFree)
|
|
|
|
BT_UseFree = new BuiltinBug("Use dynamically allocated memory after"
|
|
|
|
" it is freed.");
|
|
|
|
|
|
|
|
BugReport *R = new BugReport(*BT_UseFree, BT_UseFree->getDescription(),
|
|
|
|
N);
|
|
|
|
C.EmitReport(R);
|
|
|
|
}
|
|
|
|
}
|
|
|
|
}
|