1 /* Implementation of <stdarg.h> within analyzer.
2 Copyright (C) 2022-2023 Free Software Foundation, Inc.
3 Contributed by David Malcolm <dmalcolm@redhat.com>.
5 This file is part of GCC.
7 GCC is free software; you can redistribute it and/or modify it
8 under the terms of the GNU General Public License as published by
9 the Free Software Foundation; either version 3, or (at your option)
12 GCC is distributed in the hope that it will be useful, but
13 WITHOUT ANY WARRANTY; without even the implied warranty of
14 MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU
15 General Public License for more details.
17 You should have received a copy of the GNU General Public License
18 along with GCC; see the file COPYING3. If not see
19 <http://www.gnu.org/licenses/>. */
22 #define INCLUDE_MEMORY
24 #include "coretypes.h"
25 #include "make-unique.h"
28 #include "basic-block.h"
30 #include "diagnostic-path.h"
31 #include "analyzer/analyzer.h"
32 #include "analyzer/analyzer-logging.h"
33 #include "analyzer/sm.h"
34 #include "analyzer/pending-diagnostic.h"
35 #include "analyzer/call-string.h"
36 #include "analyzer/program-point.h"
37 #include "analyzer/store.h"
38 #include "analyzer/region-model.h"
39 #include "analyzer/program-state.h"
40 #include "analyzer/checker-path.h"
41 #include "analyzer/supergraph.h"
42 #include "analyzer/diagnostic-manager.h"
43 #include "analyzer/exploded-graph.h"
44 #include "analyzer/call-details.h"
50 /* Implementation of <stdarg.h> within analyzer.
53 - detection of interprocedural type errors involving va_arg
54 - tracking of symbolic values interprocedurally from variadic call
55 through to va_arg unpacking
56 - detection of missing va_end
57 - detection of va_arg outside of a va_start/va_end pair
58 - detection of uses of a va_list after the frame in containing the
61 The analyzer runs *before* the "stdarg" and "lower_vaarg" gimple
62 passes, which have target-dependent effects.
64 This file implements a state machine on svalues for tracking when
65 va_start has been called, so that we can detect missing va_end,
66 and misplaced va_arg, etc.
67 To do this requires an svalue that can have state, so we implement va_start
68 by creating a stack-allocated region, and use a pointer to that region
69 as the svalue that has state.
71 We call this stack-allocated region the "impl_reg". Allocating it on
72 the stack ensures that it is invalidated when the frame containing
73 the va_start returns, leading to
74 -Wanalyzer-use-of-pointer-in-stale-stack-frame on attempts to use such
77 To track svalues from variadic calls interprocedurally, we implement
78 variadic arguments via new child regions of the callee's frame_region,
79 var_arg_region, each one representing a storage slot for one of the
80 variadic arguments, accessed by index.
86 'impl_reg': pointer to next var_arg_region
87 var_arg_region for arg 0
89 var_arg_region for arg N-1
91 Hence given test_1 in stdarg-1.c, at the call to:
93 __analyzer_called_by_test_1 (int placeholder, ...);
97 __analyzer_called_by_test_1 (42, "foo", 1066, '@');
99 we push this frame for the called function:
100 clusters within frame: ‘__analyzer_called_by_test_1’@2
101 cluster for: placeholder: (int)42
102 cluster for: VAR_ARG_REG(frame: ‘__analyzer_called_by_test_1’@2, arg_idx: 0): &"foo" (TOUCHED)
103 cluster for: VAR_ARG_REG(frame: ‘__analyzer_called_by_test_1’@2, arg_idx: 1): (int)1066 (TOUCHED)
104 cluster for: VAR_ARG_REG(frame: ‘__analyzer_called_by_test_1’@2, arg_idx: 2): (int)64 (TOUCHED)
105 where the called function's frame has been populated with both the value
106 of the regular argument "placeholder", and with values for 3 variadic
110 va_start (ap, placeholder);
111 we allocate a region ALLOCA_REGION for ap to point to, populate that
112 region with the address of variadic argument 0, and set sm-state of
113 &ALLOCA_REGION to "started":
114 clusters within frame: ‘__analyzer_called_by_test_1’@2
115 cluster for: placeholder: (int)42
116 cluster for: VAR_ARG_REG(frame: ‘__analyzer_called_by_test_1’@2, arg_idx: 0): &"foo" (TOUCHED)
117 cluster for: VAR_ARG_REG(frame: ‘__analyzer_called_by_test_1’@2, arg_idx: 1): (int)1066 (TOUCHED)
118 cluster for: VAR_ARG_REG(frame: ‘__analyzer_called_by_test_1’@2, arg_idx: 2): (int)64 (TOUCHED)
119 cluster for: ap: &ALLOCA_REGION
120 cluster for: ALLOCA_REGION: &VAR_ARG_REG(frame: ‘__analyzer_called_by_test_1’@2, arg_idx: 0) (TOUCHED)
122 0x4c83700: &ALLOCA_REGION: started
126 we can look within *ap, locate the region holding the next variadic
127 argument to be extracted, extract the svalue, and advance the index
128 by effectively updating *ap.
130 At the va_end, we can set &ALLOCA_REGION's state to "ended".
132 The various __builtin_va_* accept ap by pointer, so we have e.g.:
134 __builtin_va_start (&ap, [...]);
136 except for the 2nd param of __builtin_va_copy, where the type
137 is already target-dependent (see the discussion of get_va_copy_arg
140 /* Get a tree for diagnostics.
141 Typically we have "&ap", but it will make more sense to
142 the user as just "ap", so strip off the ADDR_EXPR. */
145 get_va_list_diag_arg (tree va_list_tree
)
147 if (TREE_CODE (va_list_tree
) == ADDR_EXPR
)
148 va_list_tree
= TREE_OPERAND (va_list_tree
, 0);
152 /* Get argument ARG_IDX of va_copy.
154 builtin-types.def has:
155 DEF_PRIMITIVE_TYPE (BT_VALIST_ARG, va_list_arg_type_node)
157 and c_common_nodes_and_builtins initializes va_list_arg_type_node
158 based on whether TREE_CODE (va_list_type_node) is of ARRAY_TYPE or
159 not, giving either one or zero levels of indirection.
161 Alternatively we could be dealing with __builtin_ms_va_copy or
162 __builtin_sysv_va_copy.
164 Handle this by looking at the types of the argument in question. */
166 static const svalue
*
167 get_va_copy_arg (const region_model
*model
,
168 region_model_context
*ctxt
,
172 tree arg
= gimple_call_arg (call
, arg_idx
);
173 const svalue
*arg_sval
= model
->get_rvalue (arg
, ctxt
);
174 if (const svalue
*cast
= arg_sval
->maybe_undo_cast ())
176 if (TREE_CODE (TREE_TYPE (arg
)) == POINTER_TYPE
177 && TREE_CODE (TREE_TYPE (TREE_TYPE (arg
))) == ARRAY_TYPE
)
179 /* va_list_arg_type_node is a pointer to a va_list;
181 const region
*src_reg
= model
->deref_rvalue (arg_sval
, arg
, ctxt
);
182 const svalue
*src_reg_sval
= model
->get_store_value (src_reg
, ctxt
);
183 if (const svalue
*cast
= src_reg_sval
->maybe_undo_cast ())
189 /* va_list_arg_type_node is a va_list; return ARG_SVAL. */
196 /* A state machine for tracking the state of a va_list, so that
197 we can enforce that each va_start is paired with a va_end,
198 and va_arg only happens within a va_start/va_end pair.
199 Specifically, this tracks the state of the &ALLOCA_BUFFER
200 that va_start/va_copy allocate. */
202 class va_list_state_machine
: public state_machine
205 va_list_state_machine (logger
*logger
);
207 bool inherited_state_p () const final override
{ return false; }
209 bool on_stmt (sm_context
*sm_ctxt
,
210 const supernode
*node
,
211 const gimple
*stmt
) const final override
;
213 bool can_purge_p (state_t s
) const final override
215 return s
!= m_started
;
217 std::unique_ptr
<pending_diagnostic
> on_leak (tree var
) const final override
;
219 /* State for a va_list that is the result of a va_start or va_copy. */
222 /* State for a va_list that has had va_end called on it. */
226 void on_va_start (sm_context
*sm_ctxt
, const supernode
*node
,
227 const gcall
*call
) const;
228 void on_va_copy (sm_context
*sm_ctxt
, const supernode
*node
,
229 const gcall
*call
) const;
230 void on_va_arg (sm_context
*sm_ctxt
, const supernode
*node
,
231 const gcall
*call
) const;
232 void on_va_end (sm_context
*sm_ctxt
, const supernode
*node
,
233 const gcall
*call
) const;
234 void check_for_ended_va_list (sm_context
*sm_ctxt
,
235 const supernode
*node
,
238 const char *usage_fnname
) const;
241 /* va_list_state_machine's ctor. */
243 va_list_state_machine::va_list_state_machine (logger
*logger
)
244 : state_machine ("va_list", logger
)
246 m_started
= add_state ("started");
247 m_ended
= add_state ("ended");
250 /* Implementation of the various "va_*" functions for
251 va_list_state_machine. */
254 va_list_state_machine::on_stmt (sm_context
*sm_ctxt
,
255 const supernode
*node
,
256 const gimple
*stmt
) const
258 if (const gcall
*call
= dyn_cast
<const gcall
*> (stmt
))
260 if (gimple_call_internal_p (call
)
261 && gimple_call_internal_fn (call
) == IFN_VA_ARG
)
263 on_va_arg (sm_ctxt
, node
, call
);
267 if (tree callee_fndecl
= sm_ctxt
->get_fndecl_for_call (call
))
268 if (fndecl_built_in_p (callee_fndecl
, BUILT_IN_NORMAL
)
269 && gimple_builtin_call_types_compatible_p (call
, callee_fndecl
))
270 switch (DECL_UNCHECKED_FUNCTION_CODE (callee_fndecl
))
275 case BUILT_IN_VA_START
:
276 on_va_start (sm_ctxt
, node
, call
);
279 case BUILT_IN_VA_COPY
:
280 on_va_copy (sm_ctxt
, node
, call
);
283 case BUILT_IN_VA_END
:
284 on_va_end (sm_ctxt
, node
, call
);
291 /* Get the svalue for which va_list_state_machine holds state on argument ARG_
294 static const svalue
*
295 get_stateful_arg (sm_context
*sm_ctxt
, const gcall
*call
, unsigned arg_idx
)
297 tree ap
= gimple_call_arg (call
, arg_idx
);
299 && POINTER_TYPE_P (TREE_TYPE (ap
)))
301 if (const program_state
*new_state
= sm_ctxt
->get_new_program_state ())
303 const region_model
*new_model
= new_state
->m_region_model
;
304 const svalue
*ptr_sval
= new_model
->get_rvalue (ap
, NULL
);
305 const region
*reg
= new_model
->deref_rvalue (ptr_sval
, ap
, NULL
);
306 const svalue
*impl_sval
= new_model
->get_store_value (reg
, NULL
);
307 if (const svalue
*cast
= impl_sval
->maybe_undo_cast ())
315 /* Abstract class for diagnostics relating to va_list_state_machine. */
317 class va_list_sm_diagnostic
: public pending_diagnostic
320 bool subclass_equal_p (const pending_diagnostic
&base_other
) const override
322 const va_list_sm_diagnostic
&other
323 = (const va_list_sm_diagnostic
&)base_other
;
324 return (m_ap_sval
== other
.m_ap_sval
325 && same_tree_p (m_ap_tree
, other
.m_ap_tree
));
328 label_text
describe_state_change (const evdesc::state_change
&change
)
331 if (const char *fnname
= maybe_get_fnname (change
))
332 return change
.formatted_print ("%qs called here", fnname
);
333 return label_text ();
336 diagnostic_event::meaning
337 get_meaning_for_state_change (const evdesc::state_change
&change
)
340 if (change
.m_new_state
== m_sm
.m_started
)
341 return diagnostic_event::meaning (diagnostic_event::VERB_acquire
,
342 diagnostic_event::NOUN_resource
);
343 if (change
.m_new_state
== m_sm
.m_ended
)
344 return diagnostic_event::meaning (diagnostic_event::VERB_release
,
345 diagnostic_event::NOUN_resource
);
346 return diagnostic_event::meaning ();
350 va_list_sm_diagnostic (const va_list_state_machine
&sm
,
351 const svalue
*ap_sval
, tree ap_tree
)
352 : m_sm (sm
), m_ap_sval (ap_sval
), m_ap_tree (ap_tree
)
355 static const char *maybe_get_fnname (const evdesc::state_change
&change
)
357 if (change
.m_event
.m_stmt
)
358 if (const gcall
*call
= as_a
<const gcall
*> (change
.m_event
.m_stmt
))
359 if (tree callee_fndecl
= gimple_call_fndecl (call
))
361 if (fndecl_built_in_p (callee_fndecl
, BUILT_IN_NORMAL
))
362 switch (DECL_UNCHECKED_FUNCTION_CODE (callee_fndecl
))
364 case BUILT_IN_VA_START
:
366 case BUILT_IN_VA_COPY
:
368 case BUILT_IN_VA_END
:
375 const va_list_state_machine
&m_sm
;
376 const svalue
*m_ap_sval
;
380 /* Concrete class for -Wanalyzer-va-list-use-after-va-end:
381 complain about use of a va_list after va_end has been called on it. */
383 class va_list_use_after_va_end
: public va_list_sm_diagnostic
386 va_list_use_after_va_end (const va_list_state_machine
&sm
,
387 const svalue
*ap_sval
, tree ap_tree
,
388 const char *usage_fnname
)
389 : va_list_sm_diagnostic (sm
, ap_sval
, ap_tree
),
390 m_usage_fnname (usage_fnname
)
394 int get_controlling_option () const final override
396 return OPT_Wanalyzer_va_list_use_after_va_end
;
399 bool operator== (const va_list_use_after_va_end
&other
) const
401 return (va_list_sm_diagnostic::subclass_equal_p (other
)
402 && 0 == strcmp (m_usage_fnname
, other
.m_usage_fnname
));
405 bool emit (diagnostic_emission_context
&ctxt
) final override
407 return ctxt
.warn ("%qs after %qs", m_usage_fnname
, "va_end");
410 const char *get_kind () const final override
412 return "va_list_use_after_va_end";
415 label_text
describe_state_change (const evdesc::state_change
&change
)
418 if (change
.m_new_state
== m_sm
.m_ended
)
419 m_va_end_event
= change
.m_event_id
;
420 return va_list_sm_diagnostic::describe_state_change (change
);
423 label_text
describe_final_event (const evdesc::final_event
&ev
) final override
427 if (m_va_end_event
.known_p ())
428 return ev
.formatted_print
429 ("%qs on %qE after %qs at %@",
430 m_usage_fnname
, ev
.m_expr
, "va_end", &m_va_end_event
);
432 return ev
.formatted_print
433 ("%qs on %qE after %qs",
434 m_usage_fnname
, ev
.m_expr
, "va_end");
438 if (m_va_end_event
.known_p ())
439 return ev
.formatted_print
440 ("%qs after %qs at %@",
441 m_usage_fnname
, "va_end", &m_va_end_event
);
443 return ev
.formatted_print
445 m_usage_fnname
, "va_end");
450 diagnostic_event_id_t m_va_end_event
;
451 const char *m_usage_fnname
;
454 /* Concrete class for -Wanalyzer-va-list-leak:
455 complain about a va_list in the "started" state that doesn't get after
456 va_end called on it. */
458 class va_list_leak
: public va_list_sm_diagnostic
461 va_list_leak (const va_list_state_machine
&sm
,
462 const svalue
*ap_sval
, tree ap_tree
)
463 : va_list_sm_diagnostic (sm
, ap_sval
, ap_tree
),
464 m_start_event_fnname (NULL
)
468 int get_controlling_option () const final override
470 return OPT_Wanalyzer_va_list_leak
;
473 bool operator== (const va_list_leak
&other
) const
475 return va_list_sm_diagnostic::subclass_equal_p (other
);
478 bool emit (diagnostic_emission_context
&ctxt
) final override
480 return ctxt
.warn ("missing call to %qs", "va_end");
483 const char *get_kind () const final override
{ return "va_list_leak"; }
485 label_text
describe_state_change (const evdesc::state_change
&change
)
488 if (change
.m_new_state
== m_sm
.m_started
)
490 m_start_event
= change
.m_event_id
;
491 m_start_event_fnname
= maybe_get_fnname (change
);
493 return va_list_sm_diagnostic::describe_state_change (change
);
496 label_text
describe_final_event (const evdesc::final_event
&ev
) final override
500 if (m_start_event
.known_p () && m_start_event_fnname
)
501 return ev
.formatted_print
502 ("missing call to %qs on %qE to match %qs at %@",
503 "va_end", ev
.m_expr
, m_start_event_fnname
, &m_start_event
);
505 return ev
.formatted_print
506 ("missing call to %qs on %qE",
507 "va_end", ev
.m_expr
);
511 if (m_start_event
.known_p () && m_start_event_fnname
)
512 return ev
.formatted_print
513 ("missing call to %qs to match %qs at %@",
514 "va_end", m_start_event_fnname
, &m_start_event
);
516 return ev
.formatted_print
517 ("missing call to %qs",
523 diagnostic_event_id_t m_start_event
;
524 const char *m_start_event_fnname
;
527 /* Update state machine for a "va_start" call. */
530 va_list_state_machine::on_va_start (sm_context
*sm_ctxt
,
532 const gcall
*call
) const
534 const svalue
*arg
= get_stateful_arg (sm_ctxt
, call
, 0);
537 /* Transition from start state to "started". */
538 if (sm_ctxt
->get_state (call
, arg
) == m_start
)
539 sm_ctxt
->set_next_state (call
, arg
, m_started
);
543 /* Complain if ARG is in the "ended" state. */
546 va_list_state_machine::check_for_ended_va_list (sm_context
*sm_ctxt
,
547 const supernode
*node
,
550 const char *usage_fnname
) const
552 if (sm_ctxt
->get_state (call
, arg
) == m_ended
)
553 sm_ctxt
->warn (node
, call
, arg
,
554 make_unique
<va_list_use_after_va_end
>
555 (*this, arg
, NULL_TREE
, usage_fnname
));
558 /* Get the svalue with associated va_list_state_machine state for
559 ARG_IDX of CALL to va_copy, if SM_CTXT supports this,
560 or NULL otherwise. */
562 static const svalue
*
563 get_stateful_va_copy_arg (sm_context
*sm_ctxt
,
567 if (const program_state
*new_state
= sm_ctxt
->get_new_program_state ())
569 const region_model
*new_model
= new_state
->m_region_model
;
570 const svalue
*arg
= get_va_copy_arg (new_model
, NULL
, call
, arg_idx
);
576 /* Update state machine for a "va_copy" call. */
579 va_list_state_machine::on_va_copy (sm_context
*sm_ctxt
,
580 const supernode
*node
,
581 const gcall
*call
) const
583 const svalue
*src_arg
= get_stateful_va_copy_arg (sm_ctxt
, call
, 1);
585 check_for_ended_va_list (sm_ctxt
, node
, call
, src_arg
, "va_copy");
587 const svalue
*dst_arg
= get_stateful_arg (sm_ctxt
, call
, 0);
590 /* Transition from start state to "started". */
591 if (sm_ctxt
->get_state (call
, dst_arg
) == m_start
)
592 sm_ctxt
->set_next_state (call
, dst_arg
, m_started
);
596 /* Update state machine for a "va_arg" call. */
599 va_list_state_machine::on_va_arg (sm_context
*sm_ctxt
,
600 const supernode
*node
,
601 const gcall
*call
) const
603 const svalue
*arg
= get_stateful_arg (sm_ctxt
, call
, 0);
605 check_for_ended_va_list (sm_ctxt
, node
, call
, arg
, "va_arg");
608 /* Update state machine for a "va_end" call. */
611 va_list_state_machine::on_va_end (sm_context
*sm_ctxt
,
612 const supernode
*node
,
613 const gcall
*call
) const
615 const svalue
*arg
= get_stateful_arg (sm_ctxt
, call
, 0);
618 state_t s
= sm_ctxt
->get_state (call
, arg
);
619 /* Transition from "started" to "ended". */
621 sm_ctxt
->set_next_state (call
, arg
, m_ended
);
622 else if (s
== m_ended
)
623 check_for_ended_va_list (sm_ctxt
, node
, call
, arg
, "va_end");
627 /* Implementation of state_machine::on_leak vfunc for va_list_state_machine
628 (for complaining about leaks of values in state 'started'). */
630 std::unique_ptr
<pending_diagnostic
>
631 va_list_state_machine::on_leak (tree var
) const
633 return make_unique
<va_list_leak
> (*this, NULL
, var
);
636 } // anonymous namespace
638 /* Internal interface to this file. */
641 make_va_list_state_machine (logger
*logger
)
643 return new va_list_state_machine (logger
);
646 /* Handler for "__builtin_va_start". */
648 class kf_va_start
: public known_function
651 bool matches_call_types_p (const call_details
&) const final override
655 void impl_call_pre (const call_details
&cd
) const final override
;
659 kf_va_start::impl_call_pre (const call_details
&cd
) const
661 region_model
*model
= cd
.get_model ();
662 region_model_manager
*mgr
= cd
.get_manager ();
663 const svalue
*out_ptr
= cd
.get_arg_svalue (0);
664 const region
*out_reg
665 = model
->deref_rvalue (out_ptr
, cd
.get_arg_tree (0), cd
.get_ctxt ());
666 const frame_region
*frame
= model
->get_current_frame ();
668 /* "*out_ptr = &IMPL_REGION;". */
669 const region
*impl_reg
= mgr
->create_region_for_alloca (frame
);
671 /* We abuse the types here, since va_list_type isn't
672 necessarily anything to do with a pointer. */
673 const svalue
*ptr_to_impl_reg
= mgr
->get_ptr_svalue (NULL_TREE
, impl_reg
);
674 model
->set_value (out_reg
, ptr_to_impl_reg
, cd
.get_ctxt ());
676 if (model
->get_stack_depth () > 1)
678 /* The interprocedural case: the frame containing the va_start call
679 will have been populated with any variadic aruguments.
680 Initialize IMPL_REGION with a ptr to var_arg_region 0. */
681 const region
*init_var_arg_reg
= mgr
->get_var_arg_region (frame
, 0);
682 const svalue
*ap_sval
683 = mgr
->get_ptr_svalue (NULL_TREE
, init_var_arg_reg
);
684 model
->set_value (impl_reg
, ap_sval
, cd
.get_ctxt ());
688 /* The frame containing va_start is an entry-point to the analysis,
689 so there won't be any specific var_arg_regions populated within it.
690 Initialize IMPL_REGION as the UNKNOWN_SVALUE to avoid state
691 explosions on repeated calls to va_arg. */
692 const svalue
*unknown_sval
693 = mgr
->get_or_create_unknown_svalue (NULL_TREE
);
694 model
->set_value (impl_reg
, unknown_sval
, cd
.get_ctxt ());
698 /* Handler for "__builtin_va_copy". */
700 class kf_va_copy
: public known_function
703 bool matches_call_types_p (const call_details
&) const final override
707 void impl_call_pre (const call_details
&cd
) const final override
;
711 kf_va_copy::impl_call_pre (const call_details
&cd
) const
713 region_model
*model
= cd
.get_model ();
714 region_model_manager
*mgr
= cd
.get_manager ();
715 const svalue
*out_dst_ptr
= cd
.get_arg_svalue (0);
716 const svalue
*in_va_list
717 = get_va_copy_arg (model
, cd
.get_ctxt (), cd
.get_call_stmt (), 1);
719 = model
->check_for_poison (in_va_list
,
720 get_va_list_diag_arg (cd
.get_arg_tree (1)),
724 const region
*out_dst_reg
725 = model
->deref_rvalue (out_dst_ptr
, cd
.get_arg_tree (0), cd
.get_ctxt ());
727 /* "*out_dst_ptr = &NEW_IMPL_REGION;". */
728 const region
*new_impl_reg
729 = mgr
->create_region_for_alloca (model
->get_current_frame ());
730 const svalue
*ptr_to_new_impl_reg
731 = mgr
->get_ptr_svalue (NULL_TREE
, new_impl_reg
);
732 model
->set_value (out_dst_reg
, ptr_to_new_impl_reg
, cd
.get_ctxt ());
734 if (const region
*old_impl_reg
= in_va_list
->maybe_get_region ())
736 /* "(NEW_IMPL_REGION) = (OLD_IMPL_REGION);". */
737 const svalue
*existing_sval
738 = model
->get_store_value (old_impl_reg
, cd
.get_ctxt ());
739 model
->set_value (new_impl_reg
, existing_sval
, cd
.get_ctxt ());
743 /* Get the number of variadic arguments to CALLEE_FNDECL at CALL_STMT. */
746 get_num_variadic_arguments (tree callee_fndecl
,
747 const gcall
*call_stmt
)
749 int num_positional
= 0;
750 for (tree iter_parm
= DECL_ARGUMENTS (callee_fndecl
); iter_parm
;
751 iter_parm
= DECL_CHAIN (iter_parm
))
753 return gimple_call_num_args (call_stmt
) - num_positional
;
756 /* An abstract subclass of pending_diagnostic for diagnostics relating
757 to bad va_arg invocations.
759 This shows the number of variadic arguments at the call of interest.
760 Ideally we'd also be able to highlight individual arguments, but
761 that location information isn't generally available from the middle end. */
763 class va_arg_diagnostic
: public pending_diagnostic
766 /* Override of pending_diagnostic::add_call_event,
767 adding a custom call_event subclass. */
768 void add_call_event (const exploded_edge
&eedge
,
769 checker_path
*emission_path
) override
771 /* As per call_event, but show the number of variadic arguments
773 class va_arg_call_event
: public call_event
776 va_arg_call_event (const exploded_edge
&eedge
,
777 const event_loc_info
&loc_info
,
778 int num_variadic_arguments
)
779 : call_event (eedge
, loc_info
),
780 m_num_variadic_arguments (num_variadic_arguments
)
784 label_text
get_desc (bool can_colorize
) const override
786 return make_label_text_n
787 (can_colorize
, m_num_variadic_arguments
,
788 "calling %qE from %qE with %i variadic argument",
789 "calling %qE from %qE with %i variadic arguments",
790 get_callee_fndecl (),
791 get_caller_fndecl (),
792 m_num_variadic_arguments
);
795 int m_num_variadic_arguments
;
798 const frame_region
*frame_reg
= m_var_arg_reg
->get_frame_region ();
799 const exploded_node
*dst_node
= eedge
.m_dest
;
800 if (dst_node
->get_state ().m_region_model
->get_current_frame ()
803 const exploded_node
*src_node
= eedge
.m_src
;
804 const program_point
&src_point
= src_node
->get_point ();
805 const int src_stack_depth
= src_point
.get_stack_depth ();
806 const gimple
*last_stmt
= src_point
.get_supernode ()->get_last_stmt ();
807 const gcall
*call_stmt
= as_a
<const gcall
*> (last_stmt
);
808 int num_variadic_arguments
809 = get_num_variadic_arguments (dst_node
->get_function ()->decl
,
811 emission_path
->add_event
812 (make_unique
<va_arg_call_event
>
814 event_loc_info (last_stmt
? last_stmt
->location
: UNKNOWN_LOCATION
,
815 src_point
.get_fndecl (),
817 num_variadic_arguments
));
820 pending_diagnostic::add_call_event (eedge
, emission_path
);
824 va_arg_diagnostic (tree va_list_tree
, const var_arg_region
*var_arg_reg
)
825 : m_va_list_tree (va_list_tree
), m_var_arg_reg (var_arg_reg
)
828 bool subclass_equal_p (const pending_diagnostic
&base_other
) const override
830 const va_arg_diagnostic
&other
= (const va_arg_diagnostic
&)base_other
;
831 return (same_tree_p (m_va_list_tree
, other
.m_va_list_tree
)
832 && m_var_arg_reg
== other
.m_var_arg_reg
);
835 /* Get the number of arguments consumed so far from the va_list
836 (*before* this va_arg call). */
837 unsigned get_num_consumed () const
839 return m_var_arg_reg
->get_index ();
842 /* Get a 1-based index of which variadic argument is being consumed. */
843 unsigned get_variadic_index_for_diagnostic () const
845 return get_num_consumed () + 1;
848 /* User-readable expr for the va_list argument to va_arg. */
851 /* The region that the va_arg attempted to access. */
852 const var_arg_region
*m_var_arg_reg
;
855 /* A subclass of pending_diagnostic for complaining about a type mismatch
856 between the result of:
858 and the type of the argument that was passed to the variadic call. */
860 class va_arg_type_mismatch
: public va_arg_diagnostic
863 va_arg_type_mismatch (tree va_list_tree
, const var_arg_region
*var_arg_reg
,
864 tree expected_type
, tree actual_type
)
865 : va_arg_diagnostic (va_list_tree
, var_arg_reg
),
866 m_expected_type (expected_type
), m_actual_type (actual_type
)
869 const char *get_kind () const final override
871 return "va_arg_type_mismatch";
874 bool subclass_equal_p (const pending_diagnostic
&base_other
)
877 if (!va_arg_diagnostic::subclass_equal_p (base_other
))
879 const va_arg_type_mismatch
&other
880 = (const va_arg_type_mismatch
&)base_other
;
881 return (same_tree_p (m_expected_type
, other
.m_expected_type
)
882 && same_tree_p (m_actual_type
, other
.m_actual_type
));
885 int get_controlling_option () const final override
887 return OPT_Wanalyzer_va_arg_type_mismatch
;
890 bool emit (diagnostic_emission_context
&ctxt
) final override
892 /* "CWE-686: Function Call With Incorrect Argument Type". */
895 = ctxt
.warn ("%<va_arg%> expected %qT but received %qT"
896 " for variadic argument %i of %qE",
897 m_expected_type
, m_actual_type
,
898 get_variadic_index_for_diagnostic (), m_va_list_tree
);
902 label_text
describe_final_event (const evdesc::final_event
&ev
) final override
904 return ev
.formatted_print ("%<va_arg%> expected %qT but received %qT"
905 " for variadic argument %i of %qE",
906 m_expected_type
, m_actual_type
,
907 get_variadic_index_for_diagnostic (),
912 tree m_expected_type
;
916 /* A subclass of pending_diagnostic for complaining about a
918 after all of the args in AP have been consumed. */
920 class va_list_exhausted
: public va_arg_diagnostic
923 va_list_exhausted (tree va_list_tree
, const var_arg_region
*var_arg_reg
)
924 : va_arg_diagnostic (va_list_tree
, var_arg_reg
)
927 const char *get_kind () const final override
929 return "va_list_exhausted";
932 int get_controlling_option () const final override
934 return OPT_Wanalyzer_va_list_exhausted
;
937 bool emit (diagnostic_emission_context
&ctxt
) final override
939 /* CWE-685: Function Call With Incorrect Number of Arguments. */
941 bool warned
= ctxt
.warn ("%qE has no more arguments (%i consumed)",
942 m_va_list_tree
, get_num_consumed ());
946 label_text
describe_final_event (const evdesc::final_event
&ev
) final override
948 return ev
.formatted_print ("%qE has no more arguments (%i consumed)",
949 m_va_list_tree
, get_num_consumed ());
953 /* Return true if it's OK to copy a value from ARG_TYPE to LHS_TYPE via
954 va_arg (where argument promotion has already happened). */
957 va_arg_compatible_types_p (tree lhs_type
, tree arg_type
)
959 return compat_types_p (arg_type
, lhs_type
);
962 /* If AP_SVAL is a pointer to a var_arg_region, return that var_arg_region.
963 Otherwise return NULL. */
965 static const var_arg_region
*
966 maybe_get_var_arg_region (const svalue
*ap_sval
)
968 if (const region
*reg
= ap_sval
->maybe_get_region ())
969 return reg
->dyn_cast_var_arg_region ();
973 /* Handler for "__builtin_va_arg". */
975 class kf_va_arg
: public internal_known_function
978 void impl_call_pre (const call_details
&cd
) const final override
;
982 kf_va_arg::impl_call_pre (const call_details
&cd
) const
984 region_model_context
*ctxt
= cd
.get_ctxt ();
985 region_model
*model
= cd
.get_model ();
986 region_model_manager
*mgr
= cd
.get_manager ();
988 const svalue
*in_ptr
= cd
.get_arg_svalue (0);
990 = model
->deref_rvalue (in_ptr
, cd
.get_arg_tree (0), ctxt
);
992 const svalue
*ap_sval
= model
->get_store_value (ap_reg
, ctxt
);
993 if (const svalue
*cast
= ap_sval
->maybe_undo_cast ())
996 tree va_list_tree
= get_va_list_diag_arg (cd
.get_arg_tree (0));
997 ap_sval
= model
->check_for_poison (ap_sval
, va_list_tree
, ap_reg
, ctxt
);
999 cd
.set_any_lhs_with_defaults ();
1001 if (const region
*impl_reg
= ap_sval
->maybe_get_region ())
1003 const svalue
*old_impl_sval
= model
->get_store_value (impl_reg
, ctxt
);
1004 if (const var_arg_region
*arg_reg
1005 = maybe_get_var_arg_region (old_impl_sval
))
1007 bool saw_problem
= false;
1009 const frame_region
*frame_reg
= arg_reg
->get_frame_region ();
1010 unsigned next_arg_idx
= arg_reg
->get_index ();
1012 if (frame_reg
->get_stack_depth () > 1)
1014 /* The interprocedural case: the called frame will have been
1015 populated with any variadic aruguments.
1016 Attempt to extract arg_reg to cd's return region (which already
1017 has a conjured_svalue), or warn if there's a problem
1018 (incompatible types, or if we've run out of args). */
1019 if (const svalue
*arg_sval
1020 = model
->get_store ()->get_any_binding
1021 (mgr
->get_store_manager (), arg_reg
))
1023 tree lhs_type
= cd
.get_lhs_type ();
1024 tree arg_type
= arg_sval
->get_type ();
1025 if (va_arg_compatible_types_p (lhs_type
, arg_type
))
1026 cd
.maybe_set_lhs (arg_sval
);
1030 ctxt
->warn (make_unique
<va_arg_type_mismatch
>
1041 ctxt
->warn (make_unique
<va_list_exhausted
> (va_list_tree
,
1048 /* This frame is an entry-point to the analysis, so there won't be
1049 any specific var_arg_regions populated within it.
1050 We already have a conjured_svalue for the result, so leave
1052 gcc_assert (frame_reg
->get_stack_depth () == 1);
1057 /* Set impl_reg to UNKNOWN to suppress further warnings. */
1058 const svalue
*new_ap_sval
1059 = mgr
->get_or_create_unknown_svalue (impl_reg
->get_type ());
1060 model
->set_value (impl_reg
, new_ap_sval
, ctxt
);
1064 /* Update impl_reg to advance to the next arg. */
1065 const region
*next_var_arg_region
1066 = mgr
->get_var_arg_region (frame_reg
, next_arg_idx
+ 1);
1067 const svalue
*new_ap_sval
1068 = mgr
->get_ptr_svalue (NULL_TREE
, next_var_arg_region
);
1069 model
->set_value (impl_reg
, new_ap_sval
, ctxt
);
1075 /* Handler for "__builtin_va_end". */
1077 class kf_va_end
: public known_function
1080 bool matches_call_types_p (const call_details
&) const
1086 /* Populate KFM with instances of known functions relating to varargs. */
1089 register_varargs_builtins (known_function_manager
&kfm
)
1091 kfm
.add (BUILT_IN_VA_START
, make_unique
<kf_va_start
> ());
1092 kfm
.add (BUILT_IN_VA_COPY
, make_unique
<kf_va_copy
> ());
1093 kfm
.add (IFN_VA_ARG
, make_unique
<kf_va_arg
> ());
1094 kfm
.add (BUILT_IN_VA_END
, make_unique
<kf_va_end
> ());
1099 #endif /* #if ENABLE_ANALYZER */