[cfe-commits] r105264 - in /cfe/trunk: include/clang/Checker/PathSensitive/GRState.h include/clang/Checker/PathSensitive/Store.h lib/Checker/MallocChecker.cpp lib/Checker/RegionStore.cpp test/Analysis/malloc.c test/Analysis/outofbound.c test/Analysis/undef-buffers.c
Zhongxing Xu
xuzhongxing at gmail.com
Mon May 31 20:01:33 PDT 2010
Author: zhongxingxu
Date: Mon May 31 22:01:33 2010
New Revision: 105264
URL: http://llvm.org/viewvc/llvm-project?rev=105264&view=rev
Log:
Add support for calloc() in MallocChecker. Patch by Jordy Rose, with my
modification.
Added:
cfe/trunk/test/Analysis/undef-buffers.c
Modified:
cfe/trunk/include/clang/Checker/PathSensitive/GRState.h
cfe/trunk/include/clang/Checker/PathSensitive/Store.h
cfe/trunk/lib/Checker/MallocChecker.cpp
cfe/trunk/lib/Checker/RegionStore.cpp
cfe/trunk/test/Analysis/malloc.c
cfe/trunk/test/Analysis/outofbound.c
Modified: cfe/trunk/include/clang/Checker/PathSensitive/GRState.h
URL: http://llvm.org/viewvc/llvm-project/cfe/trunk/include/clang/Checker/PathSensitive/GRState.h?rev=105264&r1=105263&r2=105264&view=diff
==============================================================================
--- cfe/trunk/include/clang/Checker/PathSensitive/GRState.h (original)
+++ cfe/trunk/include/clang/Checker/PathSensitive/GRState.h Mon May 31 22:01:33 2010
@@ -211,6 +211,8 @@
const GRState *bindLoc(SVal location, SVal V) const;
+ const GRState *bindDefault(SVal loc, SVal V) const;
+
const GRState *unbindLoc(Loc LV) const;
/// Get the lvalue for a variable reference.
@@ -620,6 +622,12 @@
return !isa<Loc>(LV) ? this : bindLoc(cast<Loc>(LV), V);
}
+inline const GRState *GRState::bindDefault(SVal loc, SVal V) const {
+ const MemRegion *R = cast<loc::MemRegionVal>(loc).getRegion();
+ Store new_store = getStateManager().StoreMgr->BindDefault(St, R, V);
+ return makeWithStore(new_store);
+}
+
inline SVal GRState::getLValue(const VarDecl* VD,
const LocationContext *LC) const {
return getStateManager().StoreMgr->getLValueVar(VD, LC);
Modified: cfe/trunk/include/clang/Checker/PathSensitive/Store.h
URL: http://llvm.org/viewvc/llvm-project/cfe/trunk/include/clang/Checker/PathSensitive/Store.h?rev=105264&r1=105263&r2=105264&view=diff
==============================================================================
--- cfe/trunk/include/clang/Checker/PathSensitive/Store.h (original)
+++ cfe/trunk/include/clang/Checker/PathSensitive/Store.h Mon May 31 22:01:33 2010
@@ -64,6 +64,10 @@
/// to the location given for \c loc.
virtual Store Bind(Store store, Loc loc, SVal val) = 0;
+ virtual Store BindDefault(Store store, const MemRegion *R, SVal V) {
+ return store;
+ }
+
virtual Store Remove(Store St, Loc L) = 0;
/// BindCompoundLiteral - Return the store that has the bindings currently
Modified: cfe/trunk/lib/Checker/MallocChecker.cpp
URL: http://llvm.org/viewvc/llvm-project/cfe/trunk/lib/Checker/MallocChecker.cpp?rev=105264&r1=105263&r2=105264&view=diff
==============================================================================
--- cfe/trunk/lib/Checker/MallocChecker.cpp (original)
+++ cfe/trunk/lib/Checker/MallocChecker.cpp Mon May 31 22:01:33 2010
@@ -59,12 +59,12 @@
BuiltinBug *BT_DoubleFree;
BuiltinBug *BT_Leak;
BuiltinBug *BT_UseFree;
- IdentifierInfo *II_malloc, *II_free, *II_realloc;
+ IdentifierInfo *II_malloc, *II_free, *II_realloc, *II_calloc;
public:
MallocChecker()
: BT_DoubleFree(0), BT_Leak(0), BT_UseFree(0),
- II_malloc(0), II_free(0), II_realloc(0) {}
+ II_malloc(0), II_free(0), II_realloc(0), II_calloc(0) {}
static void *getTag();
bool EvalCallExpr(CheckerContext &C, const CallExpr *CE);
void EvalDeadSymbols(CheckerContext &C,const Stmt *S,SymbolReaper &SymReaper);
@@ -76,12 +76,20 @@
private:
void MallocMem(CheckerContext &C, const CallExpr *CE);
const GRState *MallocMemAux(CheckerContext &C, const CallExpr *CE,
- const Expr *SizeEx, const GRState *state);
+ const Expr *SizeEx, SVal Init,
+ const GRState *state) {
+ return MallocMemAux(C, CE, state->getSVal(SizeEx), Init, state);
+ }
+ const GRState *MallocMemAux(CheckerContext &C, const CallExpr *CE,
+ SVal SizeEx, SVal Init,
+ const GRState *state);
+
void FreeMem(CheckerContext &C, const CallExpr *CE);
const GRState *FreeMemAux(CheckerContext &C, const CallExpr *CE,
const GRState *state);
void ReallocMem(CheckerContext &C, const CallExpr *CE);
+ void CallocMem(CheckerContext &C, const CallExpr *CE);
};
} // end anonymous namespace
@@ -120,6 +128,8 @@
II_free = &Ctx.Idents.get("free");
if (!II_realloc)
II_realloc = &Ctx.Idents.get("realloc");
+ if (!II_calloc)
+ II_calloc = &Ctx.Idents.get("calloc");
if (FD->getIdentifier() == II_malloc) {
MallocMem(C, CE);
@@ -136,28 +146,34 @@
return true;
}
+ if (FD->getIdentifier() == II_calloc) {
+ CallocMem(C, CE);
+ return true;
+ }
+
return false;
}
void MallocChecker::MallocMem(CheckerContext &C, const CallExpr *CE) {
- const GRState *state = MallocMemAux(C, CE, CE->getArg(0), C.getState());
+ const GRState *state = MallocMemAux(C, CE, CE->getArg(0), UndefinedVal(),
+ C.getState());
C.addTransition(state);
}
const GRState *MallocChecker::MallocMemAux(CheckerContext &C,
const CallExpr *CE,
- const Expr *SizeEx,
+ SVal Size, SVal Init,
const GRState *state) {
unsigned Count = C.getNodeBuilder().getCurrentBlockCount();
ValueManager &ValMgr = C.getValueManager();
SVal RetVal = ValMgr.getConjuredSymbolVal(NULL, CE, CE->getType(), Count);
- SVal Size = state->getSVal(SizeEx);
-
state = C.getEngine().getStoreManager().setExtent(state, RetVal.getAsRegion(),
Size);
+ state = state->bindDefault(RetVal, Init);
+
state = state->BindExpr(CE, RetVal);
SymbolRef Sym = RetVal.getAsLocSymbol();
@@ -234,7 +250,8 @@
if (Sym)
stateEqual = stateEqual->set<RegionState>(Sym, RefState::getReleased(CE));
- const GRState *stateMalloc = MallocMemAux(C, CE, CE->getArg(1), stateEqual);
+ const GRState *stateMalloc = MallocMemAux(C, CE, CE->getArg(1),
+ UndefinedVal(), stateEqual);
C.addTransition(stateMalloc);
}
@@ -256,13 +273,30 @@
if (stateFree) {
// FIXME: We should copy the content of the original buffer.
const GRState *stateRealloc = MallocMemAux(C, CE, CE->getArg(1),
- stateFree);
+ UnknownVal(), stateFree);
C.addTransition(stateRealloc);
}
}
}
}
+void MallocChecker::CallocMem(CheckerContext &C, const CallExpr *CE) {
+ const GRState *state = C.getState();
+
+ ValueManager &ValMgr = C.getValueManager();
+ SValuator &SVator = C.getSValuator();
+
+ SVal Count = state->getSVal(CE->getArg(0));
+ SVal EleSize = state->getSVal(CE->getArg(1));
+ SVal TotalSize = SVator.EvalBinOp(state, BinaryOperator::Mul, Count, EleSize,
+ ValMgr.getContext().getSizeType());
+
+ SVal Zero = ValMgr.makeZeroVal(ValMgr.getContext().CharTy);
+
+ state = MallocMemAux(C, CE, TotalSize, Zero, state);
+ C.addTransition(state);
+}
+
void MallocChecker::EvalDeadSymbols(CheckerContext &C, const Stmt *S,
SymbolReaper &SymReaper) {
for (SymbolReaper::dead_iterator I = SymReaper.dead_begin(),
Modified: cfe/trunk/lib/Checker/RegionStore.cpp
URL: http://llvm.org/viewvc/llvm-project/cfe/trunk/lib/Checker/RegionStore.cpp?rev=105264&r1=105263&r2=105264&view=diff
==============================================================================
--- cfe/trunk/lib/Checker/RegionStore.cpp (original)
+++ cfe/trunk/lib/Checker/RegionStore.cpp Mon May 31 22:01:33 2010
@@ -280,6 +280,10 @@
Store Bind(Store store, Loc LV, SVal V);
+ Store BindDefault(Store store, const MemRegion *R, SVal V) {
+ return Add(GetRegionBindings(store), R, BindingKey::Default, V).getRoot();
+ }
+
Store BindCompoundLiteral(Store store, const CompoundLiteralExpr* CL,
const LocationContext *LC, SVal V);
@@ -1233,7 +1237,7 @@
if (D->isZeroConstant())
return ValMgr.makeZeroVal(Ty);
- if (D->isUnknown())
+ if (D->isUnknownOrUndef())
return *D;
assert(0 && "Unknown default value");
@@ -1456,6 +1460,7 @@
V);
}
+
Store RegionStoreManager::setImplicitDefaultValue(Store store,
const MemRegion *R,
QualType T) {
Modified: cfe/trunk/test/Analysis/malloc.c
URL: http://llvm.org/viewvc/llvm-project/cfe/trunk/test/Analysis/malloc.c?rev=105264&r1=105263&r2=105264&view=diff
==============================================================================
--- cfe/trunk/test/Analysis/malloc.c (original)
+++ cfe/trunk/test/Analysis/malloc.c Mon May 31 22:01:33 2010
@@ -77,3 +77,35 @@
buf[1] = 'c'; // not crash
}
+// This tests that malloc() buffers are undefined by default
+char mallocGarbage () {
+ char *buf = malloc(2);
+ char result = buf[1]; // expected-warning{{undefined}}
+ free(buf);
+ return result;
+}
+
+// This tests that calloc() buffers need to be freed
+void callocNoFree () {
+ char *buf = calloc(2,2);
+ return; // expected-warning{{never released}}
+}
+
+// These test that calloc() buffers are zeroed by default
+char callocZeroesGood () {
+ char *buf = calloc(2,2);
+ char result = buf[3]; // no-warning
+ if (buf[1] == 0) {
+ free(buf);
+ }
+ return result; // no-warning
+}
+
+char callocZeroesBad () {
+ char *buf = calloc(2,2);
+ char result = buf[3]; // no-warning
+ if (buf[1] != 0) {
+ free(buf);
+ }
+ return result; // expected-warning{{never released}}
+}
Modified: cfe/trunk/test/Analysis/outofbound.c
URL: http://llvm.org/viewvc/llvm-project/cfe/trunk/test/Analysis/outofbound.c?rev=105264&r1=105263&r2=105264&view=diff
==============================================================================
--- cfe/trunk/test/Analysis/outofbound.c (original)
+++ cfe/trunk/test/Analysis/outofbound.c Mon May 31 22:01:33 2010
@@ -2,6 +2,7 @@
typedef __typeof(sizeof(int)) size_t;
void *malloc(size_t);
+void *calloc(size_t, size_t);
char f1() {
char* s = "abcd";
@@ -36,3 +37,9 @@
p[1] = a; // no-warning
p[2] = a; // expected-warning{{Access out-of-bound array element (buffer overflow)}}
}
+
+void f5() {
+ char *p = calloc(2,2);
+ p[3] = '.'; // no-warning
+ p[4] = '!'; // expected-warning{{out-of-bound}}
+}
Added: cfe/trunk/test/Analysis/undef-buffers.c
URL: http://llvm.org/viewvc/llvm-project/cfe/trunk/test/Analysis/undef-buffers.c?rev=105264&view=auto
==============================================================================
--- cfe/trunk/test/Analysis/undef-buffers.c (added)
+++ cfe/trunk/test/Analysis/undef-buffers.c Mon May 31 22:01:33 2010
@@ -0,0 +1,32 @@
+// RUN: %clang_cc1 -analyze -analyzer-experimental-internal-checks -analyzer-check-objc-mem -analyzer-experimental-checks -analyzer-store=region -verify %s
+typedef __typeof(sizeof(int)) size_t;
+void *malloc(size_t);
+void free(void *);
+
+char stackBased1 () {
+ char buf[2];
+ buf[0] = 'a';
+ return buf[1]; // expected-warning{{Undefined}}
+}
+
+char stackBased2 () {
+ char buf[2];
+ buf[1] = 'a';
+ return buf[0]; // expected-warning{{Undefined}}
+}
+
+char heapBased1 () {
+ char *buf = malloc(2);
+ buf[0] = 'a';
+ char result = buf[1]; // expected-warning{{undefined}}
+ free(buf);
+ return result;
+}
+
+char heapBased2 () {
+ char *buf = malloc(2);
+ buf[1] = 'a';
+ char result = buf[0]; // expected-warning{{undefined}}
+ free(buf);
+ return result;
+}
More information about the cfe-commits
mailing list