[clang] [analyzer] Refine invalidation caused by `fread` (PR #93408)
Balazs Benics via cfe-commits
cfe-commits at lists.llvm.org
Fri Jun 7 05:14:38 PDT 2024
================
@@ -0,0 +1,443 @@
+// RUN: %clang_analyze_cc1 -verify %s \
+// RUN: -triple x86_64-linux-gnu \
+// RUN: -analyzer-checker=core,unix.Stream,alpha.security.taint \
+// RUN: -analyzer-checker=debug.ExprInspection
+
+#include "Inputs/system-header-simulator-for-simple-stream.h"
+
+#define EOF (-1)
+
+void clang_analyzer_dump(int);
+void clang_analyzer_isTainted(int);
+void clang_analyzer_warnIfReached(void);
+
+// A stream is only tracked by StreamChecker if it results from a call to "fopen".
+// Otherwise, there is no specific modelling of "fread".
+void untracked_stream(FILE *fp) {
+ char c;
+ if (1 == fread(&c, 1, 1, fp)) {
+ char p = c; // Unknown value but not garbage and not modeled by checker.
+ } else {
+ char p = c; // Possibly indeterminate value but not modeled by checker.
+ }
+}
+
+void fgetc_props_taint(void) {
+ FILE *fp = fopen("/home/test", "rb+");
+ if (fp) {
+ int c = fgetc(fp); // c is tainted.
+ if (c != EOF) {
+ clang_analyzer_isTainted(c); // expected-warning{{YES}}
+ }
+ fclose(fp);
+ }
+}
+
+void fread_props_taint(void) {
+ FILE *fp = fopen("/home/test", "rb+");
+ if (fp) {
+ char buffer[10];
+ int c = fread(buffer, 1, 10, fp); // c is tainted.
+ if (c != 10) {
+ // If the read failed, then the number of bytes successfully read should be tainted.
+ clang_analyzer_isTainted(c); // expected-warning{{YES}}
+ }
+ fclose(fp);
+ }
+}
+
+void read_one_byte1(void) {
+ FILE *fp = fopen("/home/test", "rb+");
+ if (fp) {
+ char c;
+ if (1 == fread(&c, 1, 1, fp)) {
+ char p = c; // Unknown value but not garbage.
+ clang_analyzer_isTainted(p); // expected-warning{{YES}}
+ } else {
+ char p = c; // Possibly indeterminate value but not modeled by checker.
+ clang_analyzer_isTainted(p); // expected-warning{{YES}}
+ }
+ fclose(fp);
+ }
+}
+
+void read_one_byte2(char *buffer) {
+ FILE *fp = fopen("/home/test", "rb+");
+ if (fp) {
+ if (1 == fread(buffer, 1, 1, fp)) {
+ char p = buffer[0]; // Unknown value but not garbage.
+ clang_analyzer_isTainted(p); // expected-warning{{YES}}
+ } else {
+ char p = buffer[0]; // Possibly indeterminate value but not modeled by checker.
+ clang_analyzer_isTainted(p); // expected-warning{{YES}}
+ }
+ fclose(fp);
+ }
+}
+
+void read_one_byte3(char *buffer) {
+ buffer[1] = 10;
+ FILE *fp = fopen("/home/test", "rb+");
+ if (fp) {
+ // buffer[1] is not mutated by fread and remains not tainted.
+ fread(buffer, 1, 1, fp);
+ char p = buffer[1];
+ clang_analyzer_isTainted(p); // expected-warning{{NO}}
+ clang_analyzer_dump(buffer[1]); // expected-warning{{10 S32b}}
+ fclose(fp);
+ }
+}
+
+void read_many_bytes(char *buffer) {
+ FILE *fp = fopen("/home/test", "rb+");
+ if (fp) {
+ if (42 == fread(buffer, 1, 42, fp)) {
+ char p = buffer[0]; // Unknown value but not garbage.
+ clang_analyzer_isTainted(p); // expected-warning{{YES}}
+ } else {
+ char p = buffer[0]; // Possibly indeterminate value but not modeled.
+ clang_analyzer_isTainted(p); // expected-warning{{YES}}
+ }
+ fclose(fp);
+ }
+}
+
+void random_access_read1(int index) {
+ FILE *fp = fopen("/home/test", "rb+");
+ if (fp) {
+ long c[4];
+ int success = 2 == fread(c + 1, sizeof(long), 2, fp);
+
+ switch (index) {
+ case 0:
+ // c[0] is not mutated by fread.
+ if (success) {
+ char p = c[0]; // expected-warning {{Assigned value is garbage or undefined}} We kept the first byte intact.
+ } else {
+ char p = c[0]; // expected-warning {{Assigned value is garbage or undefined}} We kept the first byte intact.
+ }
+ break;
+
+ case 1:
+ if (success) {
+ // Unknown value but not garbage.
+ clang_analyzer_isTainted(c[1]); // expected-warning {{YES}}
+ clang_analyzer_dump(c[1]); // expected-warning {{conj_}}
+ } else {
+ // Possibly indeterminate value but not modeled.
+ clang_analyzer_isTainted(c[1]); // expected-warning {{YES}}
+ clang_analyzer_dump(c[1]); // expected-warning {{conj_}}
+ }
+ break;
+
+ case 2:
+ if (success) {
+ long p = c[2]; // Unknown value but not garbage.
+ // FIXME: Taint analysis only marks the first byte of a memory region. See getPointeeOf in GenericTaintChecker.cpp.
+ clang_analyzer_isTainted(c[2]); // expected-warning {{NO}}
+ clang_analyzer_dump(c[2]); // expected-warning {{conj_}}
+ } else {
+ // Possibly indeterminate value but not modeled.
+ clang_analyzer_isTainted(c[2]); // expected-warning {{NO}} // FIXME: See above.
+ clang_analyzer_dump(c[2]); // expected-warning {{conj_}}
+ }
+ break;
+
+ case 3:
+ // c[3] is not mutated by fread.
+ if (success) {
+ long p = c[3]; // expected-warning {{Assigned value is garbage or undefined}}
+ } else {
+ long p = c[3]; // expected-warning {{Assigned value is garbage or undefined}}
+ }
+ break;
+ }
+
+ fclose(fp);
+ }
+}
+
+void random_access_read2(int b) {
+ FILE *fp = fopen("/home/test", "rb+");
+ if (fp) {
+ int buffer[10];
+ int *ptr = buffer + 2;
+ if (5 == fread(ptr - 1, sizeof(int), 5, fp)) {
+ if (b) {
+ int p = buffer[1]; // Unknown value but not garbage.
+ clang_analyzer_isTainted(p); // expected-warning {{YES}}
+ clang_analyzer_dump(p); // expected-warning {{conj_}}
+ } else {
+ int p = buffer[0]; // expected-warning {{Assigned value is garbage or undefined}}
+ }
+ } else {
+ int p = buffer[0]; // expected-warning {{Assigned value is garbage or undefined}}
+ }
+ fclose(fp);
+ }
+}
+
+void random_access_read_symbolic_count(size_t count) {
+ // Cover a case that used to crash (symbolic count).
+ if (count > 2)
+ return;
+
+ FILE *fp = fopen("/home/test", "rb+");
+ if (fp) {
+ long c[4];
+ fread(c + 1, sizeof(long), count, fp);
+
+ // c[0] and c[3] are never mutated by fread, but because "count" is a symbolic value, the checker doesn't know that.
+ long p = c[0];
+ clang_analyzer_isTainted(p); // expected-warning {{NO}}
+ clang_analyzer_dump(p); // expected-warning {{derived_}}
+
+ p = c[3];
+ clang_analyzer_isTainted(p); // expected-warning {{NO}}
+ clang_analyzer_dump(p); // expected-warning {{derived_}}
+
+ p = c[1];
+ clang_analyzer_isTainted(p); // expected-warning {{YES}}
+ clang_analyzer_dump(p); // expected-warning {{derived_}}
+
+ fclose(fp);
+ }
+}
+
+void dynamic_random_access_read(int startIndex) {
+ FILE *fp = fopen("/home/test", "rb+");
+ if (fp) {
+ long buffer[10];
+ // Cannot reason about index.
+ size_t res = fread(buffer + startIndex, sizeof(long), 5, fp);
+ long *p = &buffer[startIndex];
+ long v = 0;
+
+ // If all 5 elements were successfully read, then all 5 elements should be tainted and considered initialized.
+ if (5 == res) {
+ // FIXME: These should be tainted.
+ clang_analyzer_isTainted((v = p[0])); // expected-warning {{NO}}
+ clang_analyzer_isTainted((v = p[1])); // expected-warning {{NO}}
+ clang_analyzer_isTainted((v = p[2])); // expected-warning {{NO}}
+ clang_analyzer_isTainted((v = p[3])); // expected-warning {{NO}}
+ clang_analyzer_isTainted((v = p[4])); // expected-warning {{NO}}
+ clang_analyzer_dump((v = p[0])); // expected-warning {{conj_}} ok
+ clang_analyzer_dump((v = p[1])); // expected-warning {{conj_}} ok
+ clang_analyzer_dump((v = p[2])); // expected-warning {{conj_}} ok
+ clang_analyzer_dump((v = p[3])); // expected-warning {{conj_}} ok
+ clang_analyzer_dump((v = p[4])); // expected-warning {{conj_}} ok
+ clang_analyzer_dump((v = p[5])); // expected-warning {{conj_}} FIXME: This should raise an uninit read.
+ } else if (res == 4) {
+ // If only the first 4 elements were successfully read,
+ // then only the first 4 elements should be tainted and considered initialized.
+ // FIXME: These should be tainted.
+ clang_analyzer_isTainted((v = p[0])); // expected-warning {{NO}}
+ clang_analyzer_isTainted((v = p[1])); // expected-warning {{NO}}
+ clang_analyzer_isTainted((v = p[2])); // expected-warning {{NO}}
+ clang_analyzer_isTainted((v = p[3])); // expected-warning {{NO}}
+ clang_analyzer_dump((v = p[0])); // expected-warning {{conj_}} ok
+ clang_analyzer_dump((v = p[1])); // expected-warning {{conj_}} ok
+ clang_analyzer_dump((v = p[2])); // expected-warning {{conj_}} ok
+ clang_analyzer_dump((v = p[3])); // expected-warning {{conj_}} ok
+ clang_analyzer_dump((v = p[4])); // expected-warning {{conj_}} FIXME: This should raise an uninit read.
+ } else {
+ // Neither 5, or 4 elements were successfully read, so we must have read from 0 up to 3 elements.
+ // FIXME: These should be tainted.
+ clang_analyzer_isTainted((v = p[0])); // expected-warning {{NO}}
+ clang_analyzer_isTainted((v = p[1])); // expected-warning {{NO}}
+ clang_analyzer_isTainted((v = p[2])); // expected-warning {{NO}}
+ clang_analyzer_dump((v = p[0])); // expected-warning {{conj_}} ok
+ clang_analyzer_dump((v = p[1])); // expected-warning {{conj_}} ok
+ clang_analyzer_dump((v = p[2])); // expected-warning {{conj_}} ok
+ clang_analyzer_dump((v = p[3])); // expected-warning {{conj_}} FIXME: This should raise an uninit read.
+ }
+ fclose(fp);
+ }
+}
+
+struct S {
+ int a;
+ long b;
+};
+
+void compound_read1(void) {
+ FILE *fp = fopen("/home/test", "rb+");
+ if (fp) {
+ struct S s; // s.a is not touched by fread.
+ if (1 == fread(&s.b, sizeof(s.b), 1, fp)) {
+ long p = s.b;
+ clang_analyzer_isTainted(p); // expected-warning {{YES}}
+ clang_analyzer_dump(p); // expected-warning {{conj_}}
+ } else {
+ long p = s.b;
+ clang_analyzer_isTainted(p); // expected-warning {{YES}}
+ clang_analyzer_dump(p); // expected-warning {{conj_}}
+ }
+ fclose(fp);
+ }
+}
+
+void compound_read2(void) {
+ FILE *fp = fopen("/home/test", "rb+");
+ if (fp) {
+ struct S s; // s.a is not touched by fread.
+ if (1 == fread(&s.b, sizeof(s.b), 1, fp)) {
+ long p = s.a; // expected-warning {{Assigned value is garbage or undefined}}
+ } else {
+ long p = s.a; // expected-warning {{Assigned value is garbage or undefined}}
+ }
+ fclose(fp);
+ }
+}
+
+void var_read(void) {
+ FILE *fp = fopen("/home/test", "rb+");
+ if (fp) {
+ int a, b; // 'a' is not touched by fread.
+ if (1 == fread(&b, sizeof(b), 1, fp)) {
+ long p = a; // expected-warning{{Assigned value is garbage or undefined}}
+ } else {
+ long p = a; // expected-warning{{Assigned value is garbage or undefined}}
+ }
+ fclose(fp);
+ }
+}
+
+// When reading a lot of data, invalidating all elements is too time-consuming.
+// Instead, the knowledge of the whole array is lost.
+#define MaxInvalidatedElementRegion 64 // See StreamChecker::evalFreadFwrite in StreamChecker.cpp.
+#define PastMaxComplexity MaxInvalidatedElementRegion + 1
+void test_large_read(void) {
+ int buffer[PastMaxComplexity + 1];
+ buffer[PastMaxComplexity] = 42;
+ FILE *fp = fopen("/home/test", "rb+");
+ if (fp) {
+ if (buffer[PastMaxComplexity] != 42) {
+ clang_analyzer_warnIfReached(); // Unreachable.
+ }
+ if (1 == fread(buffer, sizeof(int), PastMaxComplexity, fp)) {
+ if (buffer[PastMaxComplexity] != 42) {
+ clang_analyzer_warnIfReached(); // expected-warning{{REACHABLE}}
+ }
+ }
+ fclose(fp);
+ }
+}
+
+void test_small_read(void) {
+ int buffer[10];
+ buffer[5] = 42;
+ FILE *fp = fopen("/home/test", "rb+");
+ if (fp) {
+ clang_analyzer_dump(buffer[5]); // expected-warning{{42 S32b}}
+ if (1 == fread(buffer, sizeof(int), 5, fp)) {
+ clang_analyzer_dump(buffer[5]); // expected-warning{{42 S32b}}
+ }
+ fclose(fp);
+ }
+}
+
+void test_partial_elements_read(void) {
+ clang_analyzer_dump(sizeof(int)); // expected-warning {{4 S32b}}
+
+ int buffer[100];
+ buffer[0] = 1;
+ buffer[1] = 2;
+ buffer[2] = 3;
+ buffer[3] = 4;
+ buffer[4] = 5;
+ FILE *fp = fopen("/home/test", "rb+");
+ if (fp) {
+ // 3*5: 15 bytes read; which is not exactly 4 integers, thus we invalidate the whole buffer.
+ if (5 == fread(buffer + 1, 3, 5, fp)) {
+ void clang_analyzer_printState(void);
+ clang_analyzer_printState();
+ clang_analyzer_dump(buffer[0]); // expected-warning{{1 S32b}}
+ clang_analyzer_dump(buffer[1]); // expected-warning{{conj_}}
+ clang_analyzer_dump(buffer[2]); // expected-warning{{conj_}}
+ clang_analyzer_dump(buffer[3]); // expected-warning{{conj_}}
+ clang_analyzer_dump(buffer[4]); // expected-warning{{conj_}}
+
+ char *c = (char*)buffer;
+ clang_analyzer_dump(c[4+12]); // expected-warning{{conj_}} 16th byte of buffer, which is the beginning of the 4th 'int' in the buffer.
+
+ // FIXME: The store should have returned a partial binding for the 17th byte of the buffer, which is the 2nd byte of the previous int.
+ // This byte should have been initialized by the 'fread' earlier. However, the Store lies to us and says it's uninitialized.
+ clang_analyzer_dump(c[4+13]); // expected-warning{{1st function call argument is an uninitialized value}} should be initialized.
+ clang_analyzer_dump(c[4+16]); // This should be the first byte that 'fread' leaves uninitialized. This should raise the uninit read diag.
+ } else {
+ clang_analyzer_dump(buffer[0]); // expected-warning{{1 S32b}} ok
+ clang_analyzer_dump(buffer[1]); // expected-warning{{conj_}} ok
+ clang_analyzer_dump(buffer[2]); // expected-warning{{conj_}} ok
+ clang_analyzer_dump(buffer[3]); // expected-warning{{conj_}} ok
+ clang_analyzer_dump(buffer[4]); // expected-warning{{conj_}} ok, but an uninit warning would be also fine.
+ clang_analyzer_dump(buffer[5]); // expected-warning{{1st function call argument is an uninitialized value}} ok
+ }
+ fclose(fp);
+ }
+}
+
+void test_whole_elements_read(void) {
+ clang_analyzer_dump(sizeof(int)); // expected-warning {{4 S32b}}
+
+ int buffer[100];
+ buffer[0] = 1;
+ buffer[15] = 2;
+ buffer[16] = 3;
+ FILE *fp = fopen("/home/test", "rb+");
+ if (fp) {
+ // 3*20: 60 bytes read; which is basically 15 integers.
+ if (20 == fread(buffer + 1, 3, 20, fp)) {
+ clang_analyzer_dump(buffer[0]); // expected-warning{{1 S32b}}
+ clang_analyzer_dump(buffer[15]); // expected-warning{{conj_}}
+ clang_analyzer_dump(buffer[16]); // expected-warning{{3 S32b}}
+ clang_analyzer_dump(buffer[17]); // expected-warning{{1st function call argument is an uninitialized value}}
+ } else {
+ clang_analyzer_dump(buffer[0]); // expected-warning{{1 S32b}}
+ clang_analyzer_dump(buffer[15]); // expected-warning{{conj_}}
+ clang_analyzer_dump(buffer[16]); // expected-warning{{3 S32b}}
+ clang_analyzer_dump(buffer[17]); // expected-warning{{1st function call argument is an uninitialized value}}
+ }
+ fclose(fp);
+ }
+}
+
+void test_unaligned_start_read(void) {
+ clang_analyzer_dump(sizeof(int)); // expected-warning {{4 S32b}}
+
+ int buffer[100];
+ buffer[0] = 3;
+ buffer[1] = 4;
+ buffer[2] = 5;
+ char *asChar = (char*)buffer;
+
+ FILE *fp = fopen("/home/test", "rb+");
+ if (fp) {
+ // We have an 'int' binding at offset 0 of value 3.
+ // We read 4 bytes at byte offset: 1,2,3,4.
+ if (4 == fread(asChar + 1, 1, 4, fp)) {
+ clang_analyzer_dump(buffer[0]); // expected-warning{{3 S32b}} FIXME Reading a 8 bit 'char' should not result in a 'S32b' value.
----------------
steakhal wrote:
You are right. I copypasted the reasoning from the `asChar[0]`. In fact, the reason is: `FIXME The int binding should have been partially overwritten by the read call. This definitely should not be 3.`.
Fixed the description of the FIXME.
https://github.com/llvm/llvm-project/pull/93408
More information about the cfe-commits
mailing list