scripts/coverity-model.c

   1 /* Coverity Scan model
   2  *
   3  * Copyright (C) 2014 Red Hat, Inc.
   4  *
   5  * Authors:
   6  *  Markus Armbruster <armbru@redhat.com>
   7  *  Paolo Bonzini <pbonzini@redhat.com>
   8  *
   9  * This work is licensed under the terms of the GNU GPL, version 2 or, at your
  10  * option, any later version.  See the COPYING file in the top-level directory.
  11  */
  12
  13
  14 /*
  15  * This is the source code for our Coverity user model file.  The
  16  * purpose of user models is to increase scanning accuracy by explaining
  17  * code Coverity can't see (out of tree libraries) or doesn't
  18  * sufficiently understand.  Better accuracy means both fewer false
  19  * positives and more true defects.  Memory leaks in particular.
  20  *
  21  * - A model file can't import any header files.  Some built-in primitives are
  22  *   available but not wchar_t, NULL etc.
  23  * - Modeling doesn't need full structs and typedefs. Rudimentary structs
  24  *   and similar types are sufficient.
  25  * - An uninitialized local variable signifies that the variable could be
  26  *   any value.
  27  *
  28  * The model file must be uploaded by an admin in the analysis settings of
  29  * http://scan.coverity.com/projects/378
  30  */
  31
  32 #define NULL ((void *)0)
  33
  34 typedef unsigned char uint8_t;
  35 typedef char int8_t;
  36 typedef unsigned int uint32_t;
  37 typedef int int32_t;
  38 typedef long ssize_t;
  39 typedef unsigned long long uint64_t;
  40 typedef long long int64_t;
  41 typedef _Bool bool;
  42
  43 /* exec.c */
  44
  45 typedef struct AddressSpace AddressSpace;
  46 typedef uint64_t hwaddr;
  47
  48 static void __write(uint8_t *buf, ssize_t len)
  49 {
  50     int first, last;
  51     __coverity_negative_sink__(len);
  52     if (len == 0) return;
  53     buf[0] = first;
  54     buf[len-1] = last;
  55     __coverity_writeall__(buf);
  56 }
  57
  58 static void __read(uint8_t *buf, ssize_t len)
  59 {
  60     __coverity_negative_sink__(len);
  61     if (len == 0) return;
  62     int first = buf[0];
  63     int last = buf[len-1];
  64 }
  65
  66 bool address_space_rw(AddressSpace *as, hwaddr addr, uint8_t *buf,
  67                       int len, bool is_write)
  68 {
  69     bool result;
  70
  71     // TODO: investigate impact of treating reads as producing
  72     // tainted data, with __coverity_tainted_data_argument__(buf).
  73     if (is_write) __write(buf, len); else __read(buf, len);
  74
  75     return result;
  76 }
  77
  78 /* Tainting */
  79
  80 typedef struct {} name2keysym_t;
  81 static int get_keysym(const name2keysym_t *table,
  82                       const char *name)
  83 {
  84     int result;
  85     if (result > 0) {
  86         __coverity_tainted_string_sanitize_content__(name);
  87         return result;
  88     } else {
  89         return 0;
  90     }
  91 }
  92
  93 /* glib memory allocation functions.
  94  *
  95  * Note that we ignore the fact that g_malloc of 0 bytes returns NULL,
  96  * and g_realloc of 0 bytes frees the pointer.
  97  *
  98  * Modeling this would result in Coverity flagging a lot of memory
  99  * allocations as potentially returning NULL, and asking us to check
 100  * whether the result of the allocation is NULL or not.  However, the
 101  * resulting pointer should never be dereferenced anyway, and in fact
 102  * it is not in the vast majority of cases.
 103  *
 104  * If a dereference did happen, this would suppress a defect report
 105  * for an actual null pointer dereference.  But it's too unlikely to
 106  * be worth wading through the false positives, and with some luck
 107  * we'll get a buffer overflow reported anyway.
 108  */
 109
 110 void *malloc(size_t);
 111 void *calloc(size_t, size_t);
 112 void *realloc(void *, size_t);
 113 void free(void *);
 114
 115 void *
 116 g_malloc(size_t n_bytes)
 117 {
 118     void *mem;
 119     __coverity_negative_sink__(n_bytes);
 120     mem = malloc(n_bytes == 0 ? 1 : n_bytes);
 121     if (!mem) __coverity_panic__();
 122     return mem;
 123 }
 124
 125 void *
 126 g_malloc0(size_t n_bytes)
 127 {
 128     void *mem;
 129     __coverity_negative_sink__(n_bytes);
 130     mem = calloc(1, n_bytes == 0 ? 1 : n_bytes);
 131     if (!mem) __coverity_panic__();
 132     return mem;
 133 }
 134
 135 void g_free(void *mem)
 136 {
 137     free(mem);
 138 }
 139
 140 void *g_realloc(void * mem, size_t n_bytes)
 141 {
 142     __coverity_negative_sink__(n_bytes);
 143     mem = realloc(mem, n_bytes == 0 ? 1 : n_bytes);
 144     if (!mem) __coverity_panic__();
 145     return mem;
 146 }
 147
 148 void *g_try_malloc(size_t n_bytes)
 149 {
 150     __coverity_negative_sink__(n_bytes);
 151     return malloc(n_bytes == 0 ? 1 : n_bytes);
 152 }
 153
 154 void *g_try_malloc0(size_t n_bytes)
 155 {
 156     __coverity_negative_sink__(n_bytes);
 157     return calloc(1, n_bytes == 0 ? 1 : n_bytes);
 158 }
 159
 160 void *g_try_realloc(void *mem, size_t n_bytes)
 161 {
 162     __coverity_negative_sink__(n_bytes);
 163     return realloc(mem, n_bytes == 0 ? 1 : n_bytes);
 164 }
 165
 166 /* Other glib functions */
 167
 168 typedef struct _GIOChannel GIOChannel;
 169 GIOChannel *g_io_channel_unix_new(int fd)
 170 {
 171     GIOChannel *c = g_malloc0(sizeof(GIOChannel));
 172     __coverity_escape__(fd);
 173     return c;
 174 }
 175
 176 void g_assertion_message_expr(const char     *domain,
 177                               const char     *file,
 178                               int             line,
 179                               const char     *func,
 180                               const char     *expr)
 181 {
 182     __coverity_panic__();
 183 }