check_get_user_overflow.c

   1 /*
   2  * sparse/check_get_user_overflow.c
   3  *
   4  * Copyright (C) 2010 Dan Carpenter.
   5  *
   6  * Licensed under the Open Software License version 1.1
   7  *
   8  */
   9
  10 /*
  11  * Looks for integers that we get from the user which can be attacked
  12  * with an integer overflow.
  13  *
  14  */
  15
  16 #include "smatch.h"
  17 #include "smatch_slist.h"
  18
  19 static int my_max_id;
  20 static int my_min_id;
  21
  22 STATE(capped);
  23 STATE(user_data);
  24
  25 static void match_condition(struct expression *expr)
  26 {
  27         struct smatch_state *left_max_true = NULL;
  28         struct smatch_state *left_max_false = NULL;
  29         struct smatch_state *right_max_true = NULL;
  30         struct smatch_state *right_max_false = NULL;
  31
  32         struct smatch_state *left_min_true = NULL;
  33         struct smatch_state *left_min_false = NULL;
  34         struct smatch_state *right_min_true = NULL;
  35         struct smatch_state *right_min_false = NULL;
  36
  37         switch (expr->op) {
  38         case '<':
  39         case SPECIAL_LTE:
  40         case SPECIAL_UNSIGNED_LT:
  41         case SPECIAL_UNSIGNED_LTE:
  42                 left_max_true = &capped;
  43                 right_max_false = &capped;
  44                 right_min_true = &capped;
  45                 left_min_false = &capped;
  46                 break;
  47         case '>':
  48         case SPECIAL_GTE:
  49         case SPECIAL_UNSIGNED_GT:
  50         case SPECIAL_UNSIGNED_GTE:
  51                 left_max_false = &capped;
  52                 right_max_true = &capped;
  53                 left_min_true = &capped;
  54                 right_min_false = &capped;
  55                 break;
  56         case SPECIAL_EQUAL:
  57                 left_max_true = &capped;
  58                 right_max_true = &capped;
  59                 left_min_true = &capped;
  60                 right_min_true = &capped;
  61                 break;
  62         case SPECIAL_NOTEQUAL:
  63                 left_max_false = &capped;
  64                 right_max_false = &capped;
  65                 left_min_false = &capped;
  66                 right_min_false = &capped;
  67                 break;
  68         default:
  69                 return;
  70         }
  71
  72         if (get_state_expr(my_max_id, expr->left)) {
  73                 set_true_false_states_expr(my_max_id, expr->left, left_max_true, left_max_false);
  74                 set_true_false_states_expr(my_min_id, expr->left, left_min_true, left_min_false);
  75         }
  76         if (get_state_expr(my_max_id, expr->right)) {
  77                 set_true_false_states_expr(my_max_id, expr->right, right_max_true, right_max_false);
  78                 set_true_false_states_expr(my_min_id, expr->right, right_min_true, right_min_false);
  79         }
  80 }
  81
  82 static void match_normal_assign(struct expression *expr)
  83 {
  84         if (get_state_expr(my_max_id, expr->left)) {
  85                 set_state_expr(my_max_id, expr->left, &capped);
  86                 set_state_expr(my_min_id, expr->left, &capped);
  87         }
  88 }
  89
  90 static void match_assign(struct expression *expr)
  91 {
  92         char *name;
  93
  94         name = get_macro_name(expr->pos);
  95         if (!name || strcmp(name, "get_user") != 0) {
  96                 match_normal_assign(expr);
  97                 return;
  98         }
  99         name = get_variable_from_expr(expr->right, NULL);
 100         if (!name || strcmp(name, "__val_gu") != 0)
 101                 goto free;
 102         set_state_expr(my_max_id, expr->left, &user_data);
 103         set_state_expr(my_min_id, expr->left, &user_data);
 104 free:
 105         free_string(name);
 106 }
 107
 108 static void check_expr(struct expression *expr)
 109 {
 110         struct sm_state *sm;
 111         long long val;
 112         char *name;
 113         int overflow = 0;
 114         int underflow = 0;
 115
 116         sm = get_sm_state_expr(my_max_id, expr);
 117         if (sm && slist_has_state(sm->possible, &user_data)) {
 118                 if (!get_absolute_max(expr, &val) || val > 20000)
 119                         overflow = 1;
 120         }
 121
 122         sm = get_sm_state_expr(my_min_id, expr);
 123         if (sm && slist_has_state(sm->possible, &user_data)) {
 124                 if (!get_absolute_min(expr, &val) || val < -20000)
 125                         underflow = 1;
 126         }
 127
 128         if (!overflow && !underflow)
 129                 return;
 130
 131         name = get_variable_from_expr(expr, NULL);
 132         if (overflow && underflow)
 133                 sm_msg("warn: check for integer over/underflow '%s'", name);
 134         else if (underflow)
 135                 sm_msg("warn: check for integer underflow '%s'", name);
 136         else
 137                 sm_msg("warn: check for integer overflow '%s'", name);
 138         free_string(name);
 139
 140         set_state_expr(my_max_id, expr, &capped);
 141         set_state_expr(my_min_id, expr, &capped);
 142 }
 143
 144 static void match_binop(struct expression *expr)
 145 {
 146         if (expr->op == '^')
 147                 return;
 148         if (expr->op == '&')
 149                 return;
 150         if (expr->op == '|')
 151                 return;
 152         if (expr->op == SPECIAL_RIGHTSHIFT)
 153                 return;
 154         if (expr->op == SPECIAL_LEFTSHIFT)
 155                 return;
 156
 157         check_expr(expr->left);
 158         check_expr(expr->right);
 159 }
 160
 161 void check_get_user_overflow(int id)
 162 {
 163         if (option_project != PROJ_KERNEL)
 164                 return;
 165         my_max_id = id;
 166         add_hook(&match_condition, CONDITION_HOOK);
 167         add_hook(&match_assign, ASSIGNMENT_HOOK);
 168         add_hook(&match_binop, BINOP_HOOK);
 169 }
 170
 171 void check_get_user_overflow2(int id)
 172 {
 173         my_min_id = id;
 174 }