[cfe-commits] r167439 - in /cfe/trunk: lib/StaticAnalyzer/Checkers/SimpleStreamChecker.cpp test/Analysis/Inputs/system-header-simulator-for-simple-stream.h test/Analysis/simple-stream-checks.c
Anna Zaks
ganna at apple.com
Mon Nov 5 20:20:57 PST 2012
Author: zaks
Date: Mon Nov 5 22:20:57 2012
New Revision: 167439
URL: http://llvm.org/viewvc/llvm-project?rev=167439&view=rev
Log:
[analyzer] Add symbol escapes logic to the SimpleStreamChecker.
Added:
cfe/trunk/test/Analysis/Inputs/system-header-simulator-for-simple-stream.h
Modified:
cfe/trunk/lib/StaticAnalyzer/Checkers/SimpleStreamChecker.cpp
cfe/trunk/test/Analysis/simple-stream-checks.c
Modified: cfe/trunk/lib/StaticAnalyzer/Checkers/SimpleStreamChecker.cpp
URL: http://llvm.org/viewvc/llvm-project/cfe/trunk/lib/StaticAnalyzer/Checkers/SimpleStreamChecker.cpp?rev=167439&r1=167438&r2=167439&view=diff
==============================================================================
--- cfe/trunk/lib/StaticAnalyzer/Checkers/SimpleStreamChecker.cpp (original)
+++ cfe/trunk/lib/StaticAnalyzer/Checkers/SimpleStreamChecker.cpp Mon Nov 5 22:20:57 2012
@@ -49,7 +49,9 @@
class SimpleStreamChecker : public Checker<check::PostCall,
check::PreCall,
- check::DeadSymbols > {
+ check::DeadSymbols,
+ check::Bind,
+ check::RegionChanges> {
mutable IdentifierInfo *IIfopen, *IIfclose;
@@ -66,6 +68,8 @@
CheckerContext &C,
ExplodedNode *ErrNode) const;
+ bool guaranteedNotToCloseFile(const CallEvent &Call) const;
+
public:
SimpleStreamChecker();
@@ -75,6 +79,21 @@
void checkPreCall(const CallEvent &Call, CheckerContext &C) const;
void checkDeadSymbols(SymbolReaper &SymReaper, CheckerContext &C) const;
+
+ /// Deal with symbol escape as a byproduct of a bind.
+ void checkBind(SVal location, SVal val, const Stmt*S,
+ CheckerContext &C) const;
+
+ /// Deal with symbol escape as a byproduct of a region change.
+ ProgramStateRef
+ checkRegionChanges(ProgramStateRef state,
+ const StoreManager::InvalidatedSymbols *invalidated,
+ ArrayRef<const MemRegion *> ExplicitRegions,
+ ArrayRef<const MemRegion *> Regions,
+ const CallEvent *Call) const;
+ bool wantsRegionChangeUpdate(ProgramStateRef state) const {
+ return true;
+ }
};
} // end anonymous namespace
@@ -83,6 +102,21 @@
/// state. Let's store it in the ProgramState.
REGISTER_MAP_WITH_PROGRAMSTATE(StreamMap, SymbolRef, StreamState)
+namespace {
+class StopTrackingCallback : public SymbolVisitor {
+ ProgramStateRef state;
+public:
+ StopTrackingCallback(ProgramStateRef st) : state(st) {}
+ ProgramStateRef getState() const { return state; }
+
+ bool VisitSymbol(SymbolRef sym) {
+ state = state->remove<StreamMap>(sym);
+ return true;
+ }
+};
+} // end anonymous namespace
+
+
SimpleStreamChecker::SimpleStreamChecker() : IIfopen(0), IIfclose(0) {
// Initialize the bug types.
DoubleCloseBugType.reset(new BugType("Double fclose",
@@ -212,6 +246,96 @@
}
}
+// Check various ways a symbol can be invalidated.
+// Stop tracking symbols when a value escapes as a result of checkBind.
+// A value escapes in three possible cases:
+// (1) We are binding to something that is not a memory region.
+// (2) We are binding to a MemRegion that does not have stack storage
+// (3) We are binding to a MemRegion with stack storage that the store
+// does not understand.
+void SimpleStreamChecker::checkBind(SVal loc, SVal val, const Stmt *S,
+ CheckerContext &C) const {
+ // Are we storing to something that causes the value to "escape"?
+ bool escapes = true;
+ ProgramStateRef state = C.getState();
+
+ if (loc::MemRegionVal *regionLoc = dyn_cast<loc::MemRegionVal>(&loc)) {
+ escapes = !regionLoc->getRegion()->hasStackStorage();
+
+ if (!escapes) {
+ // To test (3), generate a new state with the binding added. If it is
+ // the same state, then it escapes (since the store cannot represent
+ // the binding). Do this only if we know that the store is not supposed
+ // to generate the same state.
+ SVal StoredVal = state->getSVal(regionLoc->getRegion());
+ if (StoredVal != val)
+ escapes = (state == (state->bindLoc(*regionLoc, val)));
+ }
+ }
+
+ // If our store can represent the binding and we aren't storing to something
+ // that doesn't have local storage then just return the state and
+ // continue as is.
+ if (!escapes)
+ return;
+
+ // Otherwise, find all symbols referenced by 'val' that we are tracking
+ // and stop tracking them.
+ state = state->scanReachableSymbols<StopTrackingCallback>(val).getState();
+ C.addTransition(state);
+}
+
+bool SimpleStreamChecker::guaranteedNotToCloseFile(const CallEvent &Call) const{
+ // If it's not in a system header, assume it might close a file.
+ if (!Call.isInSystemHeader())
+ return false;
+
+ // Handle cases where we know a buffer's /address/ can escape.
+ if (Call.argumentsMayEscape())
+ return false;
+
+ // Note, even though fclose closes the file, we do not list it here
+ // since the checker is modeling the call.
+
+ return true;
+}
+
+// If the symbol we are tracking is invalidated, do not track the symbol as
+// we cannot reason about it anymore.
+ProgramStateRef
+SimpleStreamChecker::checkRegionChanges(ProgramStateRef State,
+ const StoreManager::InvalidatedSymbols *invalidated,
+ ArrayRef<const MemRegion *> ExplicitRegions,
+ ArrayRef<const MemRegion *> Regions,
+ const CallEvent *Call) const {
+
+ if (!invalidated || invalidated->empty())
+ return State;
+
+ // If it's a call which might close the file, we assume that all regions
+ // (explicit and implicit) escaped. Otherwise, whitelist explicit pointers
+ // (the parameters to the call); we still can track them.
+ llvm::SmallPtrSet<SymbolRef, 8> WhitelistedSymbols;
+ if (!Call || guaranteedNotToCloseFile(*Call)) {
+ for (ArrayRef<const MemRegion *>::iterator I = ExplicitRegions.begin(),
+ E = ExplicitRegions.end(); I != E; ++I) {
+ if (const SymbolicRegion *R = (*I)->StripCasts()->getAs<SymbolicRegion>())
+ WhitelistedSymbols.insert(R->getSymbol());
+ }
+ }
+
+ for (StoreManager::InvalidatedSymbols::const_iterator I=invalidated->begin(),
+ E = invalidated->end(); I!=E; ++I) {
+ SymbolRef sym = *I;
+ if (WhitelistedSymbols.count(sym))
+ continue;
+ // The symbol escaped. Optimistically, assume that the corresponding file
+ // handle will be closed somewhere else.
+ State = State->remove<StreamMap>(sym);
+ }
+ return State;
+}
+
void SimpleStreamChecker::initIdentifierInfo(ASTContext &Ctx) const {
if (IIfopen)
return;
Added: cfe/trunk/test/Analysis/Inputs/system-header-simulator-for-simple-stream.h
URL: http://llvm.org/viewvc/llvm-project/cfe/trunk/test/Analysis/Inputs/system-header-simulator-for-simple-stream.h?rev=167439&view=auto
==============================================================================
--- cfe/trunk/test/Analysis/Inputs/system-header-simulator-for-simple-stream.h (added)
+++ cfe/trunk/test/Analysis/Inputs/system-header-simulator-for-simple-stream.h Mon Nov 5 22:20:57 2012
@@ -0,0 +1,11 @@
+
+#pragma clang system_header
+
+typedef struct __sFILE {
+ unsigned char *_p;
+} FILE;
+FILE *fopen(const char * restrict, const char * restrict) __asm("_" "fopen" );
+int fputc(int, FILE *);
+int fputs(const char * restrict, FILE * restrict) __asm("_" "fputs" );
+int fclose(FILE *);
+void exit(int);
Modified: cfe/trunk/test/Analysis/simple-stream-checks.c
URL: http://llvm.org/viewvc/llvm-project/cfe/trunk/test/Analysis/simple-stream-checks.c?rev=167439&r1=167438&r2=167439&view=diff
==============================================================================
--- cfe/trunk/test/Analysis/simple-stream-checks.c (original)
+++ cfe/trunk/test/Analysis/simple-stream-checks.c Mon Nov 5 22:20:57 2012
@@ -1,13 +1,6 @@
// RUN: %clang_cc1 -analyze -analyzer-checker=core,alpha.unix.SimpleStream -verify %s
-typedef struct __sFILE {
- unsigned char *_p;
-} FILE;
-FILE *fopen(const char * restrict, const char * restrict) __asm("_" "fopen" );
-int fputc(int, FILE *);
-int fputs(const char * restrict, FILE * restrict) __asm("_" "fputs" );
-int fclose(FILE *);
-void exit(int);
+#include "Inputs/system-header-simulator-for-simple-stream.h"
void checkDoubleFClose(int *Data) {
FILE *F = fopen("myfile.txt", "w");
@@ -63,3 +56,23 @@
FILE *F = fopen("myfile.txt", "w");
return F;
}
+
+void myfclose(FILE *F);
+void SymbolEscapedThroughFunctionCall() {
+ FILE *F = fopen("myfile.txt", "w");
+ myfclose(F);
+ return; // no warning
+}
+
+FILE *GlobalF;
+void SymbolEscapedThroughAssignmentToGloabl() {
+ FILE *F = fopen("myfile.txt", "w");
+ GlobalF = F;
+ return; // no warning
+}
+
+void SymbolDoesNotEscapeThoughStringAPIs(char *Data) {
+ FILE *F = fopen("myfile.txt", "w");
+ fputc(*Data, F);
+ return; // expected-warning {{Opened file is never closed; potential resource leak}}
+}
More information about the cfe-commits
mailing list