[cfe-commits] r151220 - in /cfe/trunk: lib/StaticAnalyzer/Checkers/MallocChecker.cpp lib/StaticAnalyzer/Core/ExprEngineCallAndReturn.cpp test/Analysis/malloc.c test/Analysis/system-header-simulator.h

[Anna Zaks]

Author: zaks
Date: Wed Feb 22 19:05:27 2012
New Revision: 151220

URL: http://llvm.org/viewvc/llvm-project?rev=151220&view=rev
Log:
[analyzer] Invalidate the region passed to pthread_setspecific() call.

Make this call an exception in ExprEngine::invalidateArguments:
'int pthread_setspecific(ptheread_key k, const void *)' stores
a value into thread local storage. The value can later be retrieved
with 'void *ptheread_getspecific(pthread_key)'. So even thought the
parameter is 'const void *', the region escapes through the
call.

(Here we just blacklist the call in the ExprEngine's default
logic. Another option would be to add a checker which evaluates
the call and triggers the call to invalidate regions.)

Teach the Malloc Checker, which treats all system calls as safe about
the API.

Modified:
    cfe/trunk/lib/StaticAnalyzer/Checkers/MallocChecker.cpp
    cfe/trunk/lib/StaticAnalyzer/Core/ExprEngineCallAndReturn.cpp
    cfe/trunk/test/Analysis/malloc.c
    cfe/trunk/test/Analysis/system-header-simulator.h

Modified: cfe/trunk/lib/StaticAnalyzer/Checkers/MallocChecker.cpp
URL: http://llvm.org/viewvc/llvm-project/cfe/trunk/lib/StaticAnalyzer/Checkers/MallocChecker.cpp?rev=151220&r1=151219&r2=151220&view=diff
==============================================================================
--- cfe/trunk/lib/StaticAnalyzer/Checkers/MallocChecker.cpp (original)
+++ cfe/trunk/lib/StaticAnalyzer/Checkers/MallocChecker.cpp Wed Feb 22 19:05:27 2012
@@ -1033,9 +1033,19 @@
     return false;
   }
 
-  // If it's a system call, we know it does not free the memory.
+  // Most system calls, do not free the memory.
   SourceManager &SM = ASTC.getSourceManager();
   if (SM.isInSystemHeader(FD->getLocation())) {
+    const IdentifierInfo *II = FD->getIdentifier();
+
+    // White list the system functions whose arguments escape.
+    if (II) {
+      StringRef FName = II->getName();
+      if (FName.equals("pthread_setspecific"))
+        return true;
+    }
+
+    // Otherwise, assume that the function does not free memory.
     return false;
   }
 
@@ -1052,7 +1062,7 @@
                                     ArrayRef<const MemRegion *> ExplicitRegions,
                                     ArrayRef<const MemRegion *> Regions,
                                     const CallOrObjCMessage *Call) const {
-  if (!invalidated)
+  if (!invalidated || invalidated->empty())
     return State;
   llvm::SmallPtrSet<SymbolRef, 8> WhitelistedSymbols;
 

Modified: cfe/trunk/lib/StaticAnalyzer/Core/ExprEngineCallAndReturn.cpp
URL: http://llvm.org/viewvc/llvm-project/cfe/trunk/lib/StaticAnalyzer/Core/ExprEngineCallAndReturn.cpp?rev=151220&r1=151219&r2=151220&view=diff
==============================================================================
--- cfe/trunk/lib/StaticAnalyzer/Core/ExprEngineCallAndReturn.cpp (original)
+++ cfe/trunk/lib/StaticAnalyzer/Core/ExprEngineCallAndReturn.cpp Wed Feb 22 19:05:27 2012
@@ -187,6 +187,20 @@
     return;
 
   if (const FunctionDecl *FDecl = dyn_cast<FunctionDecl>(CallDecl)) {
+    const IdentifierInfo *II = FDecl->getIdentifier();
+
+    // List the cases, where the region should be invalidated even if the
+    // argument is const.
+    if (II) {
+      StringRef FName = II->getName();
+      // 'int pthread_setspecific(ptheread_key k, const void *)' stores a value
+      // into thread local storage. The value can later be retrieved with
+      // 'void *ptheread_getspecific(pthread_key)'. So even thought the
+      // parameter is 'const void *', the region escapes through the call.
+      if (FName.equals("pthread_setspecific"))
+        return;
+    }
+
     for (unsigned Idx = 0, E = Call.getNumArgs(); Idx != E; ++Idx) {
       if (FDecl && Idx < FDecl->getNumParams()) {
         if (isPointerToConst(FDecl->getParamDecl(Idx)))

Modified: cfe/trunk/test/Analysis/malloc.c
URL: http://llvm.org/viewvc/llvm-project/cfe/trunk/test/Analysis/malloc.c?rev=151220&r1=151219&r2=151220&view=diff
==============================================================================
--- cfe/trunk/test/Analysis/malloc.c (original)
+++ cfe/trunk/test/Analysis/malloc.c Wed Feb 22 19:05:27 2012
@@ -677,6 +677,16 @@
   free(s2);
 }
 
+// Test the system library functions to which the pointer can escape.
+
+// For now, we assume memory passed to pthread_specific escapes.
+// TODO: We could check that if a new pthread binding is set, the existing
+// binding must be freed; otherwise, a memory leak can occur.
+void testPthereadSpecificEscape(pthread_key_t key) {
+  void *buf = malloc(12);
+  pthread_setspecific(key, buf); // no warning
+}
+
 // Below are the known false positives.
 
 // TODO: There should be no warning here. This one might be difficult to get rid of.

Modified: cfe/trunk/test/Analysis/system-header-simulator.h
URL: http://llvm.org/viewvc/llvm-project/cfe/trunk/test/Analysis/system-header-simulator.h?rev=151220&r1=151219&r2=151220&view=diff
==============================================================================
--- cfe/trunk/test/Analysis/system-header-simulator.h (original)
+++ cfe/trunk/test/Analysis/system-header-simulator.h Wed Feb 22 19:05:27 2012
@@ -11,3 +11,7 @@
 
 char *strcpy(char *restrict s1, const char *restrict s2);
 
+typedef unsigned long __darwin_pthread_key_t;
+typedef __darwin_pthread_key_t pthread_key_t;
+int pthread_setspecific(pthread_key_t ,
+         const void *);