1//== VAListChecker.cpp - stdarg.h macro usage checker -----------*- C++ -*--==//
2//
3// Part of the LLVM Project, under the Apache License v2.0 with LLVM Exceptions.
4// See https://llvm.org/LICENSE.txt for license information.
5// SPDX-License-Identifier: Apache-2.0 WITH LLVM-exception
6//
7//===----------------------------------------------------------------------===//
8//
9// This defines a checker which detects usage of uninitialized va_list values
10// and va_start calls with no matching va_end.
11//
12//===----------------------------------------------------------------------===//
13
14#include "clang/StaticAnalyzer/Checkers/BuiltinCheckerRegistration.h"
15#include "clang/StaticAnalyzer/Core/BugReporter/BugType.h"
16#include "clang/StaticAnalyzer/Core/Checker.h"
17#include "clang/StaticAnalyzer/Core/CheckerManager.h"
18#include "clang/StaticAnalyzer/Core/PathSensitive/CallDescription.h"
19#include "clang/StaticAnalyzer/Core/PathSensitive/CallEvent.h"
20#include "clang/StaticAnalyzer/Core/PathSensitive/CheckerContext.h"
21#include "llvm/Support/FormatVariadic.h"
22
23using namespace clang;
24using namespace ento;
25using llvm::formatv;
26
27namespace {
28enum class VAListState {
29 Uninitialized,
30 Unknown,
31 Initialized,
32 Released,
33};
34
35constexpr llvm::StringLiteral StateNames[] = {
36 "uninitialized", "unknown", "initialized", "already released"};
37} // end anonymous namespace
38
39static StringRef describeState(const VAListState S) {
40 return StateNames[static_cast<int>(S)];
41}
42
43REGISTER_MAP_WITH_PROGRAMSTATE(VAListStateMap, const MemRegion *, VAListState)
44
45static VAListState getVAListState(ProgramStateRef State, const MemRegion *Reg) {
46 if (const VAListState *Res = State->get<VAListStateMap>(key: Reg))
47 return *Res;
48 return Reg->getSymbolicBase() ? VAListState::Unknown
49 : VAListState::Uninitialized;
50}
51
52namespace {
53typedef SmallVector<const MemRegion *, 2> RegionVector;
54
55class VAListChecker : public Checker<check::PreCall, check::PreStmt<VAArgExpr>,
56 check::DeadSymbols> {
57 const BugType LeakBug{this, "Leaked va_list", categories::MemoryError,
58 /*SuppressOnSink=*/true};
59 const BugType UninitAccessBug{this, "Uninitialized va_list",
60 categories::MemoryError};
61
62 struct VAListAccepter {
63 CallDescription Func;
64 int ParamIndex;
65 };
66 static const SmallVector<VAListAccepter, 15> VAListAccepters;
67 static const CallDescriptionSet VaStart;
68 static const CallDescription VaEnd, VaCopy;
69
70public:
71 void checkPreStmt(const VAArgExpr *VAA, CheckerContext &C) const;
72 void checkPreCall(const CallEvent &Call, CheckerContext &C) const;
73 void checkDeadSymbols(SymbolReaper &SR, CheckerContext &C) const;
74
75private:
76 const MemRegion *getVAListAsRegion(SVal SV, const Expr *VAExpr,
77 CheckerContext &C) const;
78 const ExplodedNode *getStartCallSite(const ExplodedNode *N,
79 const MemRegion *Reg) const;
80
81 void reportUninitializedAccess(const MemRegion *VAList, StringRef Msg,
82 CheckerContext &C) const;
83 void reportLeaked(const RegionVector &Leaked, StringRef Msg1, StringRef Msg2,
84 CheckerContext &C, ExplodedNode *N) const;
85
86 void checkVAListStartCall(const CallEvent &Call, CheckerContext &C) const;
87 void checkVAListCopyCall(const CallEvent &Call, CheckerContext &C) const;
88 void checkVAListEndCall(const CallEvent &Call, CheckerContext &C) const;
89
90 class VAListBugVisitor : public BugReporterVisitor {
91 public:
92 VAListBugVisitor(const MemRegion *Reg, bool IsLeak = false)
93 : Reg(Reg), IsLeak(IsLeak) {}
94 void Profile(llvm::FoldingSetNodeID &ID) const override {
95 static int X = 0;
96 ID.AddPointer(Ptr: &X);
97 ID.AddPointer(Ptr: Reg);
98 }
99 PathDiagnosticPieceRef getEndPath(BugReporterContext &BRC,
100 const ExplodedNode *EndPathNode,
101 PathSensitiveBugReport &BR) override {
102 if (!IsLeak)
103 return nullptr;
104
105 PathDiagnosticLocation L = BR.getLocation();
106 // Do not add the statement itself as a range in case of leak.
107 return std::make_shared<PathDiagnosticEventPiece>(args&: L, args: BR.getDescription(),
108 args: false);
109 }
110 PathDiagnosticPieceRef VisitNode(const ExplodedNode *N,
111 BugReporterContext &BRC,
112 PathSensitiveBugReport &BR) override;
113
114 private:
115 const MemRegion *Reg;
116 bool IsLeak;
117 };
118};
119
120const SmallVector<VAListChecker::VAListAccepter, 15>
121 VAListChecker::VAListAccepters = {{.Func: {CDM::CLibrary, {"vfprintf"}, 3}, .ParamIndex: 2},
122 {.Func: {CDM::CLibrary, {"vfscanf"}, 3}, .ParamIndex: 2},
123 {.Func: {CDM::CLibrary, {"vprintf"}, 2}, .ParamIndex: 1},
124 {.Func: {CDM::CLibrary, {"vscanf"}, 2}, .ParamIndex: 1},
125 {.Func: {CDM::CLibrary, {"vsnprintf"}, 4}, .ParamIndex: 3},
126 {.Func: {CDM::CLibrary, {"vsprintf"}, 3}, .ParamIndex: 2},
127 {.Func: {CDM::CLibrary, {"vsscanf"}, 3}, .ParamIndex: 2},
128 {.Func: {CDM::CLibrary, {"vfwprintf"}, 3}, .ParamIndex: 2},
129 {.Func: {CDM::CLibrary, {"vfwscanf"}, 3}, .ParamIndex: 2},
130 {.Func: {CDM::CLibrary, {"vwprintf"}, 2}, .ParamIndex: 1},
131 {.Func: {CDM::CLibrary, {"vwscanf"}, 2}, .ParamIndex: 1},
132 {.Func: {CDM::CLibrary, {"vswprintf"}, 4}, .ParamIndex: 3},
133 // vswprintf is the wide version of
134 // vsnprintf, vsprintf has no wide version
135 {.Func: {CDM::CLibrary, {"vswscanf"}, 3}, .ParamIndex: 2}};
136
137const CallDescriptionSet VAListChecker::VaStart{
138 {CDM::CLibrary, {"__builtin_va_start"}},
139 {CDM::CLibrary, {"__builtin_c23_va_start"}}};
140
141const CallDescription VAListChecker::VaCopy(CDM::CLibrary,
142 {"__builtin_va_copy"}, 2),
143 VAListChecker::VaEnd(CDM::CLibrary, {"__builtin_va_end"}, 1);
144} // end anonymous namespace
145
146void VAListChecker::checkPreCall(const CallEvent &Call,
147 CheckerContext &C) const {
148 if (VaStart.contains(Call))
149 checkVAListStartCall(Call, C);
150 else if (VaCopy.matches(Call))
151 checkVAListCopyCall(Call, C);
152 else if (VaEnd.matches(Call))
153 checkVAListEndCall(Call, C);
154 else {
155 for (const auto &FuncInfo : VAListAccepters) {
156 if (!FuncInfo.Func.matches(Call))
157 continue;
158 const MemRegion *VAList =
159 getVAListAsRegion(SV: Call.getArgSVal(Index: FuncInfo.ParamIndex),
160 VAExpr: Call.getArgExpr(Index: FuncInfo.ParamIndex), C);
161 if (!VAList)
162 return;
163 VAListState S = getVAListState(State: C.getState(), Reg: VAList);
164
165 if (S == VAListState::Initialized || S == VAListState::Unknown)
166 return;
167
168 std::string ErrMsg =
169 formatv(Fmt: "Function '{0}' is called with an {1} va_list argument",
170 Vals: FuncInfo.Func.getFunctionName(), Vals: describeState(S));
171 reportUninitializedAccess(VAList, Msg: ErrMsg, C);
172 break;
173 }
174 }
175}
176
177const MemRegion *VAListChecker::getVAListAsRegion(SVal SV, const Expr *E,
178 CheckerContext &C) const {
179 const MemRegion *Reg = SV.getAsRegion();
180 if (!Reg)
181 return nullptr;
182 // TODO: In the future this should be abstracted away by the analyzer.
183 bool VAListModelledAsArray = false;
184 if (const auto *Cast = dyn_cast<CastExpr>(Val: E)) {
185 QualType Ty = Cast->getType();
186 VAListModelledAsArray =
187 Ty->isPointerType() && Ty->getPointeeType()->isRecordType();
188 }
189 if (const auto *DeclReg = Reg->getAs<DeclRegion>()) {
190 if (isa<ParmVarDecl>(Val: DeclReg->getDecl()))
191 Reg = C.getState()->getSVal(LV: SV.castAs<Loc>()).getAsRegion();
192 }
193 // Some VarRegion based VA lists reach here as ElementRegions.
194 const auto *EReg = dyn_cast_or_null<ElementRegion>(Val: Reg);
195 return (EReg && VAListModelledAsArray) ? EReg->getSuperRegion() : Reg;
196}
197
198void VAListChecker::checkPreStmt(const VAArgExpr *VAA,
199 CheckerContext &C) const {
200 ProgramStateRef State = C.getState();
201 const Expr *ArgExpr = VAA->getSubExpr();
202 const MemRegion *VAList = getVAListAsRegion(SV: C.getSVal(E: ArgExpr), E: ArgExpr, C);
203 if (!VAList)
204 return;
205 VAListState S = getVAListState(State: C.getState(), Reg: VAList);
206 if (S == VAListState::Initialized || S == VAListState::Unknown)
207 return;
208
209 std::string ErrMsg =
210 formatv(Fmt: "va_arg() is called on an {0} va_list", Vals: describeState(S));
211 reportUninitializedAccess(VAList, Msg: ErrMsg, C);
212}
213
214void VAListChecker::checkDeadSymbols(SymbolReaper &SR,
215 CheckerContext &C) const {
216 ProgramStateRef State = C.getState();
217 VAListStateMapTy Tracked = State->get<VAListStateMap>();
218 RegionVector Leaked;
219 for (const auto &[Reg, S] : Tracked) {
220 if (SR.isLiveRegion(region: Reg))
221 continue;
222 if (S == VAListState::Initialized)
223 Leaked.push_back(Elt: Reg);
224 State = State->remove<VAListStateMap>(K: Reg);
225 }
226 if (ExplodedNode *N = C.addTransition(State)) {
227 reportLeaked(Leaked, Msg1: "Initialized va_list", Msg2: " is leaked", C, N);
228 }
229}
230
231// This function traverses the exploded graph backwards and finds the node where
232// the va_list becomes initialized. That node is used for uniquing the bug
233// paths. It is not likely that there are several different va_lists that
234// belongs to different stack frames, so that case is not yet handled.
235const ExplodedNode *
236VAListChecker::getStartCallSite(const ExplodedNode *N,
237 const MemRegion *Reg) const {
238 const StackFrame *LeakSF = N->getStackFrame();
239 const ExplodedNode *StartCallNode = N;
240
241 bool SeenInitializedState = false;
242
243 while (N) {
244 VAListState S = getVAListState(State: N->getState(), Reg);
245 if (S == VAListState::Initialized) {
246 SeenInitializedState = true;
247 } else if (SeenInitializedState) {
248 break;
249 }
250 if (N->getStackFrame() == LeakSF || N->getStackFrame()->isParentOf(SF: LeakSF))
251 StartCallNode = N;
252 N = N->pred_empty() ? nullptr : *(N->pred_begin());
253 }
254
255 return StartCallNode;
256}
257
258void VAListChecker::reportUninitializedAccess(const MemRegion *VAList,
259 StringRef Msg,
260 CheckerContext &C) const {
261 if (ExplodedNode *N = C.generateErrorNode()) {
262 auto R = std::make_unique<PathSensitiveBugReport>(args: UninitAccessBug, args&: Msg, args&: N);
263 R->markInteresting(R: VAList);
264 R->addVisitor(visitor: std::make_unique<VAListBugVisitor>(args&: VAList));
265 C.emitReport(R: std::move(R));
266 }
267}
268
269void VAListChecker::reportLeaked(const RegionVector &Leaked, StringRef Msg1,
270 StringRef Msg2, CheckerContext &C,
271 ExplodedNode *N) const {
272 for (const MemRegion *Reg : Leaked) {
273 const ExplodedNode *StartNode = getStartCallSite(N, Reg);
274 PathDiagnosticLocation LocUsedForUniqueing;
275
276 if (const Stmt *StartCallStmt = StartNode->getStmtForDiagnostics())
277 LocUsedForUniqueing = PathDiagnosticLocation::createBegin(
278 S: StartCallStmt, SM: C.getSourceManager(), SFAC: StartNode->getStackFrame());
279
280 SmallString<100> Buf;
281 llvm::raw_svector_ostream OS(Buf);
282 OS << Msg1;
283 std::string VariableName = Reg->getDescriptiveName();
284 if (!VariableName.empty())
285 OS << " " << VariableName;
286 OS << Msg2;
287
288 auto R = std::make_unique<PathSensitiveBugReport>(
289 args: LeakBug, args: OS.str(), args&: N, args&: LocUsedForUniqueing,
290 args: StartNode->getStackFrame()->getDecl());
291 R->markInteresting(R: Reg);
292 R->addVisitor(visitor: std::make_unique<VAListBugVisitor>(args&: Reg, args: true));
293 C.emitReport(R: std::move(R));
294 }
295}
296
297void VAListChecker::checkVAListStartCall(const CallEvent &Call,
298 CheckerContext &C) const {
299 if (Call.getNumArgs() == 0)
300 return; // Prevent a crash on grossly invalid input.
301
302 const MemRegion *Arg =
303 getVAListAsRegion(SV: Call.getArgSVal(Index: 0), E: Call.getArgExpr(Index: 0), C);
304 if (!Arg)
305 return;
306
307 ProgramStateRef State = C.getState();
308 VAListState ArgState = getVAListState(State, Reg: Arg);
309
310 if (ArgState == VAListState::Initialized) {
311 RegionVector Leaked{Arg};
312 if (ExplodedNode *N = C.addTransition(State))
313 reportLeaked(Leaked, Msg1: "Initialized va_list", Msg2: " is initialized again", C,
314 N);
315 return;
316 }
317
318 State = State->set<VAListStateMap>(K: Arg, E: VAListState::Initialized);
319 C.addTransition(State);
320}
321
322void VAListChecker::checkVAListCopyCall(const CallEvent &Call,
323 CheckerContext &C) const {
324 const MemRegion *Arg1 =
325 getVAListAsRegion(SV: Call.getArgSVal(Index: 0), E: Call.getArgExpr(Index: 0), C);
326 const MemRegion *Arg2 =
327 getVAListAsRegion(SV: Call.getArgSVal(Index: 1), E: Call.getArgExpr(Index: 1), C);
328 if (!Arg1 || !Arg2)
329 return;
330
331 ProgramStateRef State = C.getState();
332 if (Arg1 == Arg2) {
333 RegionVector Leaked{Arg1};
334 if (ExplodedNode *N = C.addTransition(State))
335 reportLeaked(Leaked, Msg1: "va_list", Msg2: " is copied onto itself", C, N);
336 return;
337 }
338 VAListState State1 = getVAListState(State, Reg: Arg1);
339 VAListState State2 = getVAListState(State, Reg: Arg2);
340 // Update the ProgramState by copying the state of Arg2 to Arg1.
341 State = State->set<VAListStateMap>(K: Arg1, E: State2);
342 if (State1 == VAListState::Initialized) {
343 RegionVector Leaked{Arg1};
344 std::string Msg2 =
345 formatv(Fmt: " is overwritten by {0} {1} one",
346 Vals: (State2 == VAListState::Initialized) ? "another" : "an",
347 Vals: describeState(S: State2));
348 if (ExplodedNode *N = C.addTransition(State))
349 reportLeaked(Leaked, Msg1: "Initialized va_list", Msg2, C, N);
350 return;
351 }
352 if (State2 != VAListState::Initialized && State2 != VAListState::Unknown) {
353 std::string Msg = formatv(Fmt: "{0} va_list is copied", Vals: describeState(S: State2));
354 Msg[0] = toupper(c: Msg[0]);
355 reportUninitializedAccess(VAList: Arg2, Msg, C);
356 return;
357 }
358 C.addTransition(State);
359}
360
361void VAListChecker::checkVAListEndCall(const CallEvent &Call,
362 CheckerContext &C) const {
363 const MemRegion *Arg =
364 getVAListAsRegion(SV: Call.getArgSVal(Index: 0), E: Call.getArgExpr(Index: 0), C);
365 if (!Arg)
366 return;
367
368 ProgramStateRef State = C.getState();
369 VAListState ArgState = getVAListState(State, Reg: Arg);
370
371 if (ArgState != VAListState::Unknown &&
372 ArgState != VAListState::Initialized) {
373 std::string Msg = formatv(Fmt: "va_end() is called on an {0} va_list",
374 Vals: describeState(S: ArgState));
375 reportUninitializedAccess(VAList: Arg, Msg, C);
376 return;
377 }
378 State = State->set<VAListStateMap>(K: Arg, E: VAListState::Released);
379 C.addTransition(State);
380}
381
382PathDiagnosticPieceRef VAListChecker::VAListBugVisitor::VisitNode(
383 const ExplodedNode *N, BugReporterContext &BRC, PathSensitiveBugReport &) {
384 ProgramStateRef State = N->getState();
385 ProgramStateRef StatePrev = N->getFirstPred()->getState();
386
387 const Stmt *S = N->getStmtForDiagnostics();
388 if (!S)
389 return nullptr;
390
391 VAListState After = getVAListState(State, Reg);
392 VAListState Before = getVAListState(State: StatePrev, Reg);
393 if (Before == After)
394 return nullptr;
395
396 StringRef Msg;
397 switch (After) {
398 case VAListState::Uninitialized:
399 Msg = "Copied uninitialized contents into the va_list";
400 break;
401 case VAListState::Unknown:
402 Msg = "Copied unknown contents into the va_list";
403 break;
404 case VAListState::Initialized:
405 Msg = "Initialized va_list";
406 break;
407 case VAListState::Released:
408 Msg = "Ended va_list";
409 break;
410 }
411
412 if (Msg.empty())
413 return nullptr;
414
415 PathDiagnosticLocation Pos(S, BRC.getSourceManager(), N->getStackFrame());
416 return std::make_shared<PathDiagnosticEventPiece>(args&: Pos, args&: Msg, args: true);
417}
418
419void ento::registerVAListChecker(CheckerManager &Mgr) {
420 Mgr.registerChecker<VAListChecker>();
421}
422
423bool ento::shouldRegisterVAListChecker(const CheckerManager &) { return true; }
424