//=== MallocChecker.cpp - A malloc/free checker -------------------*- C++ -*--// // // Part of the LLVM Project, under the Apache License v2.0 with LLVM Exceptions. // See https://llvm.org/LICENSE.txt for license information. // SPDX-License-Identifier: Apache-2.0 WITH LLVM-exception // //===----------------------------------------------------------------------===// // // This file defines a variety of memory management related checkers, such as // leak, double free, and use-after-free. // // The following checkers are defined here: // // * MallocChecker // Despite its name, it models all sorts of memory allocations and // de- or reallocation, including but not limited to malloc, free, // relloc, new, delete. It also reports on a variety of memory misuse // errors. // Many other checkers interact very closely with this checker, in fact, // most are merely options to this one. Other checkers may register // MallocChecker, but do not enable MallocChecker's reports (more details // to follow around its field, ChecksEnabled). // It also has a boolean "Optimistic" checker option, which if set to true // will cause the checker to model user defined memory management related // functions annotated via the attribute ownership_takes, ownership_holds // and ownership_returns. // // * NewDeleteChecker // Enables the modeling of new, new[], delete, delete[] in MallocChecker, // and checks for related double-free and use-after-free errors. // // * NewDeleteLeaksChecker // Checks for leaks related to new, new[], delete, delete[]. // Depends on NewDeleteChecker. // // * MismatchedDeallocatorChecker // Enables checking whether memory is deallocated with the correspending // allocation function in MallocChecker, such as malloc() allocated // regions are only freed by free(), new by delete, new[] by delete[]. // // InnerPointerChecker interacts very closely with MallocChecker, but unlike // the above checkers, it has it's own file, hence the many InnerPointerChecker // related headers and non-static functions. // //===----------------------------------------------------------------------===// #include "AllocationState.h" #include "InterCheckerAPI.h" #include "NoOwnershipChangeVisitor.h" #include "clang/AST/Attr.h" #include "clang/AST/DeclCXX.h" #include "clang/AST/DeclTemplate.h" #include "clang/AST/Expr.h" #include "clang/AST/ExprCXX.h" #include "clang/AST/ParentMap.h" #include "clang/ASTMatchers/ASTMatchFinder.h" #include "clang/ASTMatchers/ASTMatchers.h" #include "clang/Analysis/ProgramPoint.h" #include "clang/Basic/LLVM.h" #include "clang/Basic/SourceManager.h" #include "clang/Basic/TargetInfo.h" #include "clang/Lex/Lexer.h" #include "clang/StaticAnalyzer/Checkers/BuiltinCheckerRegistration.h" #include "clang/StaticAnalyzer/Checkers/Taint.h" #include "clang/StaticAnalyzer/Core/BugReporter/BugType.h" #include "clang/StaticAnalyzer/Core/BugReporter/CommonBugCategories.h" #include "clang/StaticAnalyzer/Core/Checker.h" #include "clang/StaticAnalyzer/Core/CheckerManager.h" #include "clang/StaticAnalyzer/Core/PathSensitive/CallDescription.h" #include "clang/StaticAnalyzer/Core/PathSensitive/CallEvent.h" #include "clang/StaticAnalyzer/Core/PathSensitive/CheckerContext.h" #include "clang/StaticAnalyzer/Core/PathSensitive/CheckerHelpers.h" #include "clang/StaticAnalyzer/Core/PathSensitive/DynamicExtent.h" #include "clang/StaticAnalyzer/Core/PathSensitive/ExplodedGraph.h" #include "clang/StaticAnalyzer/Core/PathSensitive/ProgramState.h" #include "clang/StaticAnalyzer/Core/PathSensitive/ProgramStateTrait.h" #include "clang/StaticAnalyzer/Core/PathSensitive/ProgramState_Fwd.h" #include "clang/StaticAnalyzer/Core/PathSensitive/SVals.h" #include "clang/StaticAnalyzer/Core/PathSensitive/StoreRef.h" #include "clang/StaticAnalyzer/Core/PathSensitive/SymbolManager.h" #include "llvm/ADT/STLExtras.h" #include "llvm/ADT/SetOperations.h" #include "llvm/ADT/StringExtras.h" #include "llvm/Support/Casting.h" #include "llvm/Support/Compiler.h" #include "llvm/Support/ErrorHandling.h" #include "llvm/Support/raw_ostream.h" #include <functional> #include <optional> #include <utility> usingnamespaceclang; usingnamespaceento; usingnamespacestd::placeholders; //===----------------------------------------------------------------------===// // The types of allocation we're modeling. This is used to check whether a // dynamically allocated object is deallocated with the correct function, like // not using operator delete on an object created by malloc(), or alloca regions // aren't ever deallocated manually. //===----------------------------------------------------------------------===// namespace { // Used to check correspondence between allocators and deallocators. enum AllocationFamilyKind { … }; struct AllocationFamily { … }; } // end of anonymous namespace /// Print names of allocators and deallocators. /// /// \returns true on success. static bool printMemFnName(raw_ostream &os, CheckerContext &C, const Expr *E); /// Print expected name of an allocator based on the deallocator's family /// derived from the DeallocExpr. static void printExpectedAllocName(raw_ostream &os, AllocationFamily Family); /// Print expected name of a deallocator based on the allocator's /// family. static void printExpectedDeallocName(raw_ostream &os, AllocationFamily Family); //===----------------------------------------------------------------------===// // The state of a symbol, in terms of memory management. //===----------------------------------------------------------------------===// namespace { class RefState { … }; } // end of anonymous namespace REGISTER_MAP_WITH_PROGRAMSTATE(…) /// Check if the memory associated with this symbol was released. static bool isReleased(SymbolRef Sym, CheckerContext &C); /// Update the RefState to reflect the new memory allocation. /// The optional \p RetVal parameter specifies the newly allocated pointer /// value; if unspecified, the value of expression \p E is used. static ProgramStateRef MallocUpdateRefState(CheckerContext &C, const Expr *E, ProgramStateRef State, AllocationFamily Family, std::optional<SVal> RetVal = std::nullopt); //===----------------------------------------------------------------------===// // The modeling of memory reallocation. // // The terminology 'toPtr' and 'fromPtr' will be used: // toPtr = realloc(fromPtr, 20); //===----------------------------------------------------------------------===// REGISTER_SET_WITH_PROGRAMSTATE(…) namespace { /// The state of 'fromPtr' after reallocation is known to have failed. enum OwnershipAfterReallocKind { … }; /// Stores information about the 'fromPtr' symbol after reallocation. /// /// This is important because realloc may fail, and that needs special modeling. /// Whether reallocation failed or not will not be known until later, so we'll /// store whether upon failure 'fromPtr' will be freed, or needs to be freed /// later, etc. struct ReallocPair { … }; } // end of anonymous namespace REGISTER_MAP_WITH_PROGRAMSTATE(…) static bool isStandardNew(const FunctionDecl *FD); static bool isStandardNew(const CallEvent &Call) { … } static bool isStandardDelete(const FunctionDecl *FD); static bool isStandardDelete(const CallEvent &Call) { … } /// Tells if the callee is one of the builtin new/delete operators, including /// placement operators and other standard overloads. template <typename T> static bool isStandardNewDelete(const T &FD) { … } //===----------------------------------------------------------------------===// // Definition of the MallocChecker class. //===----------------------------------------------------------------------===// namespace { class MallocChecker : public Checker<check::DeadSymbols, check::PointerEscape, check::ConstPointerEscape, check::PreStmt<ReturnStmt>, check::EndFunction, check::PreCall, check::PostCall, eval::Call, check::NewAllocator, check::PostStmt<BlockExpr>, check::PostObjCMessage, check::Location, eval::Assume> { … }; } // end anonymous namespace //===----------------------------------------------------------------------===// // Definition of NoOwnershipChangeVisitor. //===----------------------------------------------------------------------===// namespace { class NoMemOwnershipChangeVisitor final : public NoOwnershipChangeVisitor { … }; } // end anonymous namespace //===----------------------------------------------------------------------===// // Definition of MallocBugVisitor. //===----------------------------------------------------------------------===// namespace { /// The bug visitor which allows us to print extra diagnostics along the /// BugReport path. For example, showing the allocation site of the leaked /// region. class MallocBugVisitor final : public BugReporterVisitor { … }; } // end anonymous namespace // A map from the freed symbol to the symbol representing the return value of // the free function. REGISTER_MAP_WITH_PROGRAMSTATE(…) namespace { class StopTrackingCallback final : public SymbolVisitor { … }; } // end anonymous namespace static bool isStandardNew(const FunctionDecl *FD) { … } static bool isStandardDelete(const FunctionDecl *FD) { … } //===----------------------------------------------------------------------===// // Methods of MallocChecker and MallocBugVisitor. //===----------------------------------------------------------------------===// bool MallocChecker::isFreeingOwnershipAttrCall(const CallEvent &Call) { … } bool MallocChecker::isFreeingOwnershipAttrCall(const FunctionDecl *Func) { … } bool MallocChecker::isFreeingCall(const CallEvent &Call) const { … } bool MallocChecker::isAllocatingOwnershipAttrCall(const CallEvent &Call) { … } bool MallocChecker::isAllocatingOwnershipAttrCall(const FunctionDecl *Func) { … } bool MallocChecker::isMemCall(const CallEvent &Call) const { … } std::optional<ProgramStateRef> MallocChecker::performKernelMalloc(const CallEvent &Call, CheckerContext &C, const ProgramStateRef &State) const { … } SVal MallocChecker::evalMulForBufferSize(CheckerContext &C, const Expr *Blocks, const Expr *BlockBytes) { … } void MallocChecker::checkBasicAlloc(ProgramStateRef State, const CallEvent &Call, CheckerContext &C) const { … } void MallocChecker::checkKernelMalloc(ProgramStateRef State, const CallEvent &Call, CheckerContext &C) const { … } static bool isStandardRealloc(const CallEvent &Call) { … } static bool isGRealloc(const CallEvent &Call) { … } void MallocChecker::checkRealloc(ProgramStateRef State, const CallEvent &Call, CheckerContext &C, bool ShouldFreeOnFail) const { … } void MallocChecker::checkCalloc(ProgramStateRef State, const CallEvent &Call, CheckerContext &C) const { … } void MallocChecker::checkFree(ProgramStateRef State, const CallEvent &Call, CheckerContext &C) const { … } void MallocChecker::checkAlloca(ProgramStateRef State, const CallEvent &Call, CheckerContext &C) const { … } void MallocChecker::checkStrdup(ProgramStateRef State, const CallEvent &Call, CheckerContext &C) const { … } void MallocChecker::checkIfNameIndex(ProgramStateRef State, const CallEvent &Call, CheckerContext &C) const { … } void MallocChecker::checkIfFreeNameIndex(ProgramStateRef State, const CallEvent &Call, CheckerContext &C) const { … } void MallocChecker::checkCXXNewOrCXXDelete(ProgramStateRef State, const CallEvent &Call, CheckerContext &C) const { … } void MallocChecker::checkGMalloc0(ProgramStateRef State, const CallEvent &Call, CheckerContext &C) const { … } void MallocChecker::checkGMemdup(ProgramStateRef State, const CallEvent &Call, CheckerContext &C) const { … } void MallocChecker::checkGMallocN(ProgramStateRef State, const CallEvent &Call, CheckerContext &C) const { … } void MallocChecker::checkGMallocN0(ProgramStateRef State, const CallEvent &Call, CheckerContext &C) const { … } static bool isFromStdNamespace(const CallEvent &Call) { … } void MallocChecker::preGetdelim(ProgramStateRef State, const CallEvent &Call, CheckerContext &C) const { … } void MallocChecker::checkGetdelim(ProgramStateRef State, const CallEvent &Call, CheckerContext &C) const { … } void MallocChecker::checkReallocN(ProgramStateRef State, const CallEvent &Call, CheckerContext &C) const { … } void MallocChecker::checkOwnershipAttr(ProgramStateRef State, const CallEvent &Call, CheckerContext &C) const { … } bool MallocChecker::evalCall(const CallEvent &Call, CheckerContext &C) const { … } // Performs a 0-sized allocations check. ProgramStateRef MallocChecker::ProcessZeroAllocCheck( CheckerContext &C, const CallEvent &Call, const unsigned IndexOfSizeArg, ProgramStateRef State, std::optional<SVal> RetVal) { … } static QualType getDeepPointeeType(QualType T) { … } /// \returns true if the constructor invoked by \p NE has an argument of a /// pointer/reference to a record type. static bool hasNonTrivialConstructorCall(const CXXNewExpr *NE) { … } ProgramStateRef MallocChecker::processNewAllocation(const CXXAllocatorCall &Call, CheckerContext &C, AllocationFamily Family) const { … } void MallocChecker::checkNewAllocator(const CXXAllocatorCall &Call, CheckerContext &C) const { … } static bool isKnownDeallocObjCMethodName(const ObjCMethodCall &Call) { … } static std::optional<bool> getFreeWhenDoneArg(const ObjCMethodCall &Call) { … } void MallocChecker::checkPostObjCMessage(const ObjCMethodCall &Call, CheckerContext &C) const { … } ProgramStateRef MallocChecker::MallocMemReturnsAttr(CheckerContext &C, const CallEvent &Call, const OwnershipAttr *Att, ProgramStateRef State) const { … } ProgramStateRef MallocChecker::MallocBindRetVal(CheckerContext &C, const CallEvent &Call, ProgramStateRef State, bool isAlloca) const { … } ProgramStateRef MallocChecker::MallocMemAux(CheckerContext &C, const CallEvent &Call, const Expr *SizeEx, SVal Init, ProgramStateRef State, AllocationFamily Family) const { … } void MallocChecker::reportTaintBug(StringRef Msg, ProgramStateRef State, CheckerContext &C, llvm::ArrayRef<SymbolRef> TaintedSyms, AllocationFamily Family) const { … } void MallocChecker::checkTaintedness(CheckerContext &C, const CallEvent &Call, const SVal SizeSVal, ProgramStateRef State, AllocationFamily Family) const { … } ProgramStateRef MallocChecker::MallocMemAux(CheckerContext &C, const CallEvent &Call, SVal Size, SVal Init, ProgramStateRef State, AllocationFamily Family) const { … } static ProgramStateRef MallocUpdateRefState(CheckerContext &C, const Expr *E, ProgramStateRef State, AllocationFamily Family, std::optional<SVal> RetVal) { … } ProgramStateRef MallocChecker::FreeMemAttr(CheckerContext &C, const CallEvent &Call, const OwnershipAttr *Att, ProgramStateRef State) const { … } ProgramStateRef MallocChecker::FreeMemAux(CheckerContext &C, const CallEvent &Call, ProgramStateRef State, unsigned Num, bool Hold, bool &IsKnownToBeAllocated, AllocationFamily Family, bool ReturnsNullOnFailure) const { … } /// Checks if the previous call to free on the given symbol failed - if free /// failed, returns true. Also, returns the corresponding return value symbol. static bool didPreviousFreeFail(ProgramStateRef State, SymbolRef Sym, SymbolRef &RetStatusSymbol) { … } static void printOwnershipTakesList(raw_ostream &os, CheckerContext &C, const Expr *E) { … } static bool printMemFnName(raw_ostream &os, CheckerContext &C, const Expr *E) { … } static void printExpectedAllocName(raw_ostream &os, AllocationFamily Family) { … } static void printExpectedDeallocName(raw_ostream &os, AllocationFamily Family) { … } ProgramStateRef MallocChecker::FreeMemAux(CheckerContext &C, const Expr *ArgExpr, const CallEvent &Call, ProgramStateRef State, bool Hold, bool &IsKnownToBeAllocated, AllocationFamily Family, bool ReturnsNullOnFailure, std::optional<SVal> ArgValOpt) const { … } std::optional<MallocChecker::CheckKind> MallocChecker::getCheckIfTracked(AllocationFamily Family, bool IsALeakCheck) const { … } std::optional<MallocChecker::CheckKind> MallocChecker::getCheckIfTracked(CheckerContext &C, SymbolRef Sym, bool IsALeakCheck) const { … } bool MallocChecker::SummarizeValue(raw_ostream &os, SVal V) { … } bool MallocChecker::SummarizeRegion(raw_ostream &os, const MemRegion *MR) { … } void MallocChecker::HandleNonHeapDealloc(CheckerContext &C, SVal ArgVal, SourceRange Range, const Expr *DeallocExpr, AllocationFamily Family) const { … } void MallocChecker::HandleFreeAlloca(CheckerContext &C, SVal ArgVal, SourceRange Range) const { … } void MallocChecker::HandleMismatchedDealloc(CheckerContext &C, SourceRange Range, const Expr *DeallocExpr, const RefState *RS, SymbolRef Sym, bool OwnershipTransferred) const { … } void MallocChecker::HandleOffsetFree(CheckerContext &C, SVal ArgVal, SourceRange Range, const Expr *DeallocExpr, AllocationFamily Family, const Expr *AllocExpr) const { … } void MallocChecker::HandleUseAfterFree(CheckerContext &C, SourceRange Range, SymbolRef Sym) const { … } void MallocChecker::HandleDoubleFree(CheckerContext &C, SourceRange Range, bool Released, SymbolRef Sym, SymbolRef PrevSym) const { … } void MallocChecker::HandleDoubleDelete(CheckerContext &C, SymbolRef Sym) const { … } void MallocChecker::HandleUseZeroAlloc(CheckerContext &C, SourceRange Range, SymbolRef Sym) const { … } void MallocChecker::HandleFunctionPtrFree(CheckerContext &C, SVal ArgVal, SourceRange Range, const Expr *FreeExpr, AllocationFamily Family) const { … } ProgramStateRef MallocChecker::ReallocMemAux(CheckerContext &C, const CallEvent &Call, bool ShouldFreeOnFail, ProgramStateRef State, AllocationFamily Family, bool SuffixWithN) const { … } ProgramStateRef MallocChecker::CallocMem(CheckerContext &C, const CallEvent &Call, ProgramStateRef State) const { … } MallocChecker::LeakInfo MallocChecker::getAllocationSite(const ExplodedNode *N, SymbolRef Sym, CheckerContext &C) { … } void MallocChecker::HandleLeak(SymbolRef Sym, ExplodedNode *N, CheckerContext &C) const { … } void MallocChecker::checkDeadSymbols(SymbolReaper &SymReaper, CheckerContext &C) const { … } void MallocChecker::checkPostCall(const CallEvent &Call, CheckerContext &C) const { … } void MallocChecker::checkPreCall(const CallEvent &Call, CheckerContext &C) const { … } void MallocChecker::checkPreStmt(const ReturnStmt *S, CheckerContext &C) const { … } // In the CFG, automatic destructors come after the return statement. // This callback checks for returning memory that is freed by automatic // destructors, as those cannot be reached in checkPreStmt(). void MallocChecker::checkEndFunction(const ReturnStmt *S, CheckerContext &C) const { … } void MallocChecker::checkEscapeOnReturn(const ReturnStmt *S, CheckerContext &C) const { … } // TODO: Blocks should be either inlined or should call invalidate regions // upon invocation. After that's in place, special casing here will not be // needed. void MallocChecker::checkPostStmt(const BlockExpr *BE, CheckerContext &C) const { … } static bool isReleased(SymbolRef Sym, CheckerContext &C) { … } bool MallocChecker::suppressDeallocationsInSuspiciousContexts( const CallEvent &Call, CheckerContext &C) const { … } bool MallocChecker::checkUseAfterFree(SymbolRef Sym, CheckerContext &C, const Stmt *S) const { … } void MallocChecker::checkUseZeroAllocated(SymbolRef Sym, CheckerContext &C, const Stmt *S) const { … } bool MallocChecker::checkDoubleDelete(SymbolRef Sym, CheckerContext &C) const { … } // Check if the location is a freed symbolic region. void MallocChecker::checkLocation(SVal l, bool isLoad, const Stmt *S, CheckerContext &C) const { … } // If a symbolic region is assumed to NULL (or another constant), stop tracking // it - assuming that allocation failed on this path. ProgramStateRef MallocChecker::evalAssume(ProgramStateRef state, SVal Cond, bool Assumption) const { … } bool MallocChecker::mayFreeAnyEscapedMemoryOrIsModeledExplicitly( const CallEvent *Call, ProgramStateRef State, SymbolRef &EscapingSymbol) const { … } ProgramStateRef MallocChecker::checkPointerEscape(ProgramStateRef State, const InvalidatedSymbols &Escaped, const CallEvent *Call, PointerEscapeKind Kind) const { … } ProgramStateRef MallocChecker::checkConstPointerEscape(ProgramStateRef State, const InvalidatedSymbols &Escaped, const CallEvent *Call, PointerEscapeKind Kind) const { … } static bool checkIfNewOrNewArrayFamily(const RefState *RS) { … } ProgramStateRef MallocChecker::checkPointerEscapeAux( ProgramStateRef State, const InvalidatedSymbols &Escaped, const CallEvent *Call, PointerEscapeKind Kind, bool IsConstPointerEscape) const { … } bool MallocChecker::isArgZERO_SIZE_PTR(ProgramStateRef State, CheckerContext &C, SVal ArgVal) const { … } static SymbolRef findFailedReallocSymbol(ProgramStateRef currState, ProgramStateRef prevState) { … } static bool isReferenceCountingPointerDestructor(const CXXDestructorDecl *DD) { … } PathDiagnosticPieceRef MallocBugVisitor::VisitNode(const ExplodedNode *N, BugReporterContext &BRC, PathSensitiveBugReport &BR) { … } void MallocChecker::printState(raw_ostream &Out, ProgramStateRef State, const char *NL, const char *Sep) const { … } namespace clang { namespace ento { namespace allocation_state { ProgramStateRef markReleased(ProgramStateRef State, SymbolRef Sym, const Expr *Origin) { … } } // end namespace allocation_state } // end namespace ento } // end namespace clang // Intended to be used in InnerPointerChecker to register the part of // MallocChecker connected to it. void ento::registerInnerPointerCheckerAux(CheckerManager &mgr) { … } void ento::registerDynamicMemoryModeling(CheckerManager &mgr) { … } bool ento::shouldRegisterDynamicMemoryModeling(const CheckerManager &mgr) { … } #define REGISTER_CHECKER(name) … REGISTER_CHECKER(MallocChecker) REGISTER_CHECKER(NewDeleteChecker) REGISTER_CHECKER(NewDeleteLeaksChecker) REGISTER_CHECKER(MismatchedDeallocatorChecker) REGISTER_CHECKER(TaintedAllocChecker)
Codebase Browser
llvm