check_get_user_overflow.c

   1 /*
   2  * sparse/check_get_user_overflow.c
   3  *
   4  * Copyright (C) 2010 Dan Carpenter.
   5  *
   6  * Licensed under the Open Software License version 1.1
   7  *
   8  */
   9
  10 /*
  11  * Looks for integers that we get from the user which can be attacked
  12  * with an integer overflow.
  13  *
  14  */
  15
  16 #include "smatch.h"
  17 #include "smatch_slist.h"
  18
  19 static int my_max_id;
  20 static int my_min_id;
  21
  22 STATE(capped);
  23 STATE(user_data);
  24
  25 static void match_condition(struct expression *expr)
  26 {
  27         struct smatch_state *left_max_true = NULL;
  28         struct smatch_state *left_max_false = NULL;
  29         struct smatch_state *right_max_true = NULL;
  30         struct smatch_state *right_max_false = NULL;
  31
  32         struct smatch_state *left_min_true = NULL;
  33         struct smatch_state *left_min_false = NULL;
  34         struct smatch_state *right_min_true = NULL;
  35         struct smatch_state *right_min_false = NULL;
  36
  37         switch (expr->op) {
  38         case '<':
  39         case SPECIAL_LTE:
  40         case SPECIAL_UNSIGNED_LT:
  41         case SPECIAL_UNSIGNED_LTE:
  42                 left_max_true = &capped;
  43                 right_max_false = &capped;
  44                 right_min_true = &capped;
  45                 left_min_false = &capped;
  46                 break;
  47         case '>':
  48         case SPECIAL_GTE:
  49         case SPECIAL_UNSIGNED_GT:
  50         case SPECIAL_UNSIGNED_GTE:
  51                 left_max_false = &capped;
  52                 right_max_true = &capped;
  53                 left_min_true = &capped;
  54                 right_min_false = &capped;
  55                 break;
  56         case SPECIAL_EQUAL:
  57                 left_max_true = &capped;
  58                 right_max_true = &capped;
  59                 left_min_true = &capped;
  60                 right_min_true = &capped;
  61                 break;
  62         case SPECIAL_NOTEQUAL:
  63                 left_max_false = &capped;
  64                 right_max_false = &capped;
  65                 left_min_false = &capped;
  66                 right_min_false = &capped;
  67                 break;
  68         default:
  69                 return;
  70         }
  71
  72         if (get_state_expr(my_max_id, expr->left)) {
  73                 set_true_false_states_expr(my_max_id, expr->left, left_max_true, left_max_false);
  74                 set_true_false_states_expr(my_min_id, expr->left, left_min_true, left_min_false);
  75         }
  76         if (get_state_expr(my_max_id, expr->right)) {
  77                 set_true_false_states_expr(my_max_id, expr->right, right_max_true, right_max_false);
  78                 set_true_false_states_expr(my_min_id, expr->right, right_min_true, right_min_false);
  79         }
  80 }
  81
  82 static void match_normal_assign(struct expression *expr)
  83 {
  84         if (get_state_expr(my_max_id, expr->left)) {
  85                 set_state_expr(my_max_id, expr->left, &capped);
  86                 set_state_expr(my_min_id, expr->left, &capped);
  87         }
  88 }
  89
  90 static void match_assign(struct expression *expr)
  91 {
  92         char *name;
  93
  94         name = get_macro_name(expr->pos);
  95         if (!name || strcmp(name, "get_user") != 0) {
  96                 match_normal_assign(expr);
  97                 return;
  98         }
  99         name = get_variable_from_expr(expr->right, NULL);
 100         if (!name || strcmp(name, "__val_gu") != 0)
 101                 goto free;
 102         set_state_expr(my_max_id, expr->left, &user_data);
 103         set_state_expr(my_min_id, expr->left, &user_data);
 104 free:
 105         free_string(name);
 106 }
 107
 108 static void check_expr(struct expression *expr)
 109 {
 110         struct sm_state *sm;
 111         sval_t max;
 112         sval_t sval;
 113         char *name;
 114         int overflow = 0;
 115         int underflow = 0;
 116
 117         sm = get_sm_state_expr(my_max_id, expr);
 118         if (sm && slist_has_state(sm->possible, &user_data)) {
 119                 if (!get_absolute_max(expr, &max) || sval_cmp_val(max, 20000) > 0)
 120                         overflow = 1;
 121         }
 122
 123         sm = get_sm_state_expr(my_min_id, expr);
 124         if (sm && slist_has_state(sm->possible, &user_data)) {
 125                 if (!get_absolute_min(expr, &sval) || sval_cmp_val(sval, -20000) < 0)
 126                         underflow = 1;
 127         }
 128
 129         if (!overflow && !underflow)
 130                 return;
 131
 132         name = get_variable_from_expr(expr, NULL);
 133         if (overflow && underflow)
 134                 sm_msg("warn: check for integer over/underflow '%s'", name);
 135         else if (underflow)
 136                 sm_msg("warn: check for integer underflow '%s'", name);
 137         else
 138                 sm_msg("warn: check for integer overflow '%s'", name);
 139         free_string(name);
 140
 141         set_state_expr(my_max_id, expr, &capped);
 142         set_state_expr(my_min_id, expr, &capped);
 143 }
 144
 145 static void match_binop(struct expression *expr)
 146 {
 147         if (expr->op == '^')
 148                 return;
 149         if (expr->op == '&')
 150                 return;
 151         if (expr->op == '|')
 152                 return;
 153         if (expr->op == SPECIAL_RIGHTSHIFT)
 154                 return;
 155         if (expr->op == SPECIAL_LEFTSHIFT)
 156                 return;
 157
 158         check_expr(expr->left);
 159         check_expr(expr->right);
 160 }
 161
 162 void check_get_user_overflow(int id)
 163 {
 164         if (option_project != PROJ_KERNEL)
 165                 return;
 166         my_max_id = id;
 167         add_hook(&match_condition, CONDITION_HOOK);
 168         add_hook(&match_assign, ASSIGNMENT_HOOK);
 169         add_hook(&match_binop, BINOP_HOOK);
 170 }
 171
 172 void check_get_user_overflow2(int id)
 173 {
 174         my_min_id = id;
 175 }