check_overflow.c

   1 /*
   2  * smatch/check_overflow.c
   3  *
   4  * Copyright (C) 2010 Dan Carpenter.
   5  *
   6  * Licensed under the Open Software License version 1.1
   7  *
   8  */
   9
  10 #include <stdlib.h>
  11 #include "parse.h"
  12 #include "smatch.h"
  13 #include "smatch_slist.h"
  14 #include "smatch_extra.h"
  15
  16 struct bound {
  17         int param;
  18         int size;
  19 };
  20
  21 /*
  22  * This check has two smatch IDs.
  23  * my_used_id - keeps a record of array offsets that have been used.
  24  *              If the code checks that they are within bounds later on,
  25  *              we complain about using an array offset before checking
  26  *              that it is within bounds.
  27  */
  28 static int my_used_id;
  29
  30 static struct symbol *this_func;
  31
  32 static void match_function_def(struct symbol *sym)
  33 {
  34         this_func = sym;
  35 }
  36
  37 struct limiter {
  38         int buf_arg;
  39         int limit_arg;
  40 };
  41 static struct limiter b0_l2 = {0, 2};
  42 static struct limiter b1_l2 = {1, 2};
  43
  44 static void delete(struct sm_state *sm, struct expression *mod_expr)
  45 {
  46         set_state(my_used_id, sm->name, sm->sym, &undefined);
  47 }
  48
  49 static int definitely_just_used_as_limiter(struct expression *array, struct expression *offset)
  50 {
  51         sval_t sval;
  52         struct expression *tmp;
  53         int step = 0;
  54         int dot_ops = 0;
  55
  56         if (!get_implied_value(offset, &sval))
  57                 return 0;
  58         if (get_array_size(array) != sval.value)
  59                 return 0;
  60
  61         FOR_EACH_PTR_REVERSE(big_expression_stack, tmp) {
  62                 if (step == 0) {
  63                         step = 1;
  64                         continue;
  65                 }
  66                 if (tmp->type == EXPR_PREOP && tmp->op == '(')
  67                         continue;
  68                 if (tmp->op == '.' && !dot_ops++)
  69                         continue;
  70                 if (step == 1 && tmp->op == '&') {
  71                         step = 2;
  72                         continue;
  73                 }
  74                 if (step == 2 && tmp->type == EXPR_COMPARE)
  75                         return 1;
  76                 if (step == 2 && tmp->type == EXPR_ASSIGNMENT)
  77                         return 1;
  78                 return 0;
  79         } END_FOR_EACH_PTR_REVERSE(tmp);
  80         return 0;
  81 }
  82
  83 static int get_the_max(struct expression *expr, sval_t *sval)
  84 {
  85         if (get_hard_max(expr, sval))
  86                 return 1;
  87         if (!option_spammy)
  88                 return 0;
  89         if (get_fuzzy_max(expr, sval))
  90                 return 1;
  91         if (is_user_data(expr))
  92                 return get_absolute_max(expr, sval);
  93         return 0;
  94 }
  95
  96 static int common_false_positives(char *name)
  97 {
  98         if (!name)
  99                 return 0;
 100
 101         /* Smatch can't figure out glibc's strcmp __strcmp_cg()
 102          * so it prints an error every time you compare to a string
 103          * literal array with 4 or less chars.
 104          */
 105         if (strcmp(name, "__s1") == 0 || strcmp(name, "__s2") == 0)
 106                 return 1;
 107
 108         /*
 109          * passing WORK_CPU_UNBOUND is idiomatic but Smatch doesn't understand
 110          * how it's used so it causes a bunch of false positives.
 111          */
 112         if (option_project == PROJ_KERNEL &&
 113             strcmp(name, "__per_cpu_offset") == 0)
 114                 return 1;
 115         return 0;
 116 }
 117
 118 static void array_check(struct expression *expr)
 119 {
 120         struct expression *array_expr;
 121         int array_size;
 122         struct expression *offset;
 123         sval_t max;
 124         char *name;
 125
 126         expr = strip_expr(expr);
 127         if (!is_array(expr))
 128                 return;
 129
 130         array_expr = strip_parens(expr->unop->left);
 131         array_size = get_array_size(array_expr);
 132         if (!array_size || array_size == 1)
 133                 return;
 134
 135         offset = get_array_offset(expr);
 136         if (!get_the_max(offset, &max)) {
 137                 if (getting_address())
 138                         return;
 139                 if (is_capped(offset))
 140                         return;
 141                 set_state_expr(my_used_id, offset, alloc_state_num(array_size));
 142         } else if (array_size <= max.value) {
 143                 const char *level = "error";
 144
 145                 if (getting_address())
 146                         level = "warn";
 147
 148                 if (definitely_just_used_as_limiter(array_expr, offset))
 149                         return;
 150
 151                 name = expr_to_str(array_expr);
 152                 if (!common_false_positives(name)) {
 153                         sm_msg("%s: buffer overflow '%s' %d <= %s",
 154                                 level, name, array_size, sval_to_str(max));
 155                 }
 156                 free_string(name);
 157         }
 158 }
 159
 160 static void match_condition(struct expression *expr)
 161 {
 162         int left;
 163         sval_t sval;
 164         struct state_list *slist;
 165         struct sm_state *tmp;
 166         int boundary;
 167
 168         if (!expr || expr->type != EXPR_COMPARE)
 169                 return;
 170         if (get_macro_name(expr->pos))
 171                 return;
 172         if (get_implied_value(expr->left, &sval))
 173                 left = 1;
 174         else if (get_implied_value(expr->right, &sval))
 175                 left = 0;
 176         else
 177                 return;
 178
 179         if (left)
 180                 slist = get_possible_states_expr(my_used_id, expr->right);
 181         else
 182                 slist = get_possible_states_expr(my_used_id, expr->left);
 183         if (!slist)
 184                 return;
 185         FOR_EACH_PTR(slist, tmp) {
 186                 if (tmp->state == &merged || tmp->state == &undefined)
 187                         continue;
 188                 boundary = PTR_INT(tmp->state->data);
 189                 boundary -= sval.value;
 190                 if (boundary < 1 && boundary > -1) {
 191                         char *name;
 192
 193                         name = expr_to_var(left ? expr->right : expr->left);
 194                         sm_msg("error: testing array offset '%s' after use.", name);
 195                         return;
 196                 }
 197         } END_FOR_EACH_PTR(tmp);
 198 }
 199
 200 static void match_strcpy(const char *fn, struct expression *expr, void *unused)
 201 {
 202         struct expression *dest;
 203         struct expression *data;
 204         char *dest_name = NULL;
 205         char *data_name = NULL;
 206         int dest_size;
 207         int data_size;
 208
 209         dest = get_argument_from_call_expr(expr->args, 0);
 210         data = get_argument_from_call_expr(expr->args, 1);
 211         dest_size = get_array_size_bytes(dest);
 212         data_size = get_array_size_bytes(data);
 213
 214         if (!dest_size)
 215                 return;
 216
 217         /* If the size of both arrays is known and the destination
 218          * buffer is larger than the source buffer, we're okay.
 219          */
 220         if (data_size && dest_size >= data_size)
 221                 return;
 222
 223         dest_name = expr_to_str(dest);
 224         data_name = expr_to_str(data);
 225
 226         if (data_size)
 227                 sm_msg("error: %s() '%s' too large for '%s' (%d vs %d)",
 228                         fn, data_name, dest_name, data_size, dest_size);
 229         else if (option_spammy)
 230                 sm_msg("warn: %s() '%s' of unknown size might be too large for '%s'",
 231                         fn, data_name, dest_name);
 232
 233         free_string(dest_name);
 234         free_string(data_name);
 235 }
 236
 237 static void match_snprintf(const char *fn, struct expression *expr, void *unused)
 238 {
 239         struct expression *dest;
 240         struct expression *dest_size_expr;
 241         struct expression *format_string;
 242         struct expression *data;
 243         char *data_name = NULL;
 244         int dest_size;
 245         sval_t limit_size;
 246         char *format;
 247         int data_size;
 248
 249         dest = get_argument_from_call_expr(expr->args, 0);
 250         dest_size_expr = get_argument_from_call_expr(expr->args, 1);
 251         format_string = get_argument_from_call_expr(expr->args, 2);
 252         data = get_argument_from_call_expr(expr->args, 3);
 253
 254         dest_size = get_array_size_bytes(dest);
 255         if (!get_implied_value(dest_size_expr, &limit_size))
 256                 return;
 257         if (dest_size && dest_size < limit_size.value)
 258                 sm_msg("error: snprintf() is printing too much %s vs %d",
 259                        sval_to_str(limit_size), dest_size);
 260         format = expr_to_var(format_string);
 261         if (!format)
 262                 return;
 263         if (strcmp(format, "\"%s\""))
 264                 goto free;
 265         data_name = expr_to_str(data);
 266         data_size = get_array_size_bytes(data);
 267         if (limit_size.value < data_size)
 268                 sm_msg("error: snprintf() chops off the last chars of '%s': %d vs %s",
 269                        data_name, data_size, sval_to_str(limit_size));
 270 free:
 271         free_string(data_name);
 272         free_string(format);
 273 }
 274
 275 static void match_sprintf(const char *fn, struct expression *expr, void *unused)
 276 {
 277         struct expression *dest;
 278         struct expression *format_string;
 279         struct expression *data;
 280         char *data_name = NULL;
 281         int dest_size;
 282         char *format;
 283         int data_size;
 284
 285         dest = get_argument_from_call_expr(expr->args, 0);
 286         format_string = get_argument_from_call_expr(expr->args, 1);
 287         data = get_argument_from_call_expr(expr->args, 2);
 288
 289         dest_size = get_array_size_bytes(dest);
 290         if (!dest_size)
 291                 return;
 292         format = expr_to_var(format_string);
 293         if (!format)
 294                 return;
 295         if (strcmp(format, "\"%s\""))
 296                 goto free;
 297         data_name = expr_to_str(data);
 298         data_size = get_array_size_bytes(data);
 299         if (dest_size < data_size)
 300                 sm_msg("error: sprintf() copies too much data from '%s': %d vs %d",
 301                        data_name, data_size, dest_size);
 302 free:
 303         free_string(data_name);
 304         free_string(format);
 305 }
 306
 307 static void match_limited(const char *fn, struct expression *expr, void *_limiter)
 308 {
 309         struct limiter *limiter = (struct limiter *)_limiter;
 310         struct expression *dest;
 311         struct expression *data;
 312         char *dest_name = NULL;
 313         sval_t needed;
 314         int has;
 315
 316         dest = get_argument_from_call_expr(expr->args, limiter->buf_arg);
 317         data = get_argument_from_call_expr(expr->args, limiter->limit_arg);
 318         if (!get_the_max(data, &needed))
 319                 return;
 320         has = get_array_size_bytes_max(dest);
 321         if (!has)
 322                 return;
 323         if (has >= needed.value)
 324                 return;
 325
 326         dest_name = expr_to_str(dest);
 327         sm_msg("error: %s() '%s' too small (%d vs %s)", fn, dest_name, has, sval_to_str(needed));
 328         free_string(dest_name);
 329 }
 330
 331 static void db_returns_buf_size(struct expression *expr, int param, char *unused, char *math)
 332 {
 333         struct expression *call;
 334         struct symbol *left_type, *right_type;
 335         int bytes;
 336         sval_t sval;
 337
 338         if (expr->type != EXPR_ASSIGNMENT)
 339                 return;
 340         right_type = get_pointer_type(expr->right);
 341         if (!right_type || right_type->bit_size != -1)
 342                 return;
 343
 344         call = strip_expr(expr->right);
 345         left_type = get_pointer_type(expr->left);
 346
 347         if (!parse_call_math(call, math, &sval) || sval.value == 0)
 348                 return;
 349         if (!left_type)
 350                 return;
 351         bytes = bits_to_bytes(left_type->bit_size);
 352         if (bytes <= 0)
 353                 return;
 354         if (sval.uvalue >= bytes)
 355                 return;
 356         sm_msg("error: not allocating enough data %d vs %s", bytes, sval_to_str(sval));
 357 }
 358
 359 static void register_funcs_from_file(void)
 360 {
 361         char name[256];
 362         struct token *token;
 363         const char *func;
 364         int size, buf;
 365         struct limiter *limiter;
 366
 367         snprintf(name, 256, "%s.sizeof_param", option_project_str);
 368         name[255] = '\0';
 369         token = get_tokens_file(name);
 370         if (!token)
 371                 return;
 372         if (token_type(token) != TOKEN_STREAMBEGIN)
 373                 return;
 374         token = token->next;
 375         while (token_type(token) != TOKEN_STREAMEND) {
 376                 if (token_type(token) != TOKEN_IDENT)
 377                         return;
 378                 func = show_ident(token->ident);
 379
 380                 token = token->next;
 381                 if (token_type(token) != TOKEN_NUMBER)
 382                         return;
 383                 size = atoi(token->number);
 384
 385                 token = token->next;
 386                 if (token_type(token) != TOKEN_NUMBER)
 387                         return;
 388                 buf = atoi(token->number);
 389
 390                 limiter = malloc(sizeof(*limiter));
 391                 limiter->limit_arg = size;
 392                 limiter->buf_arg = buf;
 393
 394                 add_function_hook(func, &match_limited, limiter);
 395
 396                 token = token->next;
 397         }
 398         clear_token_alloc();
 399 }
 400
 401 void check_overflow(int id)
 402 {
 403         my_used_id = id;
 404         register_funcs_from_file();
 405         add_hook(&match_function_def, FUNC_DEF_HOOK);
 406         add_hook(&array_check, OP_HOOK);
 407         add_hook(&match_condition, CONDITION_HOOK);
 408         add_function_hook("strcpy", &match_strcpy, NULL);
 409         add_function_hook("snprintf", &match_snprintf, NULL);
 410         add_function_hook("sprintf", &match_sprintf, NULL);
 411         add_function_hook("memcmp", &match_limited, &b0_l2);
 412         add_function_hook("memcmp", &match_limited, &b1_l2);
 413         select_return_states_hook(BUF_SIZE, &db_returns_buf_size);
 414         add_modification_hook(my_used_id, &delete);
 415         if (option_project == PROJ_KERNEL) {
 416                 add_function_hook("copy_to_user", &match_limited, &b0_l2);
 417                 add_function_hook("copy_to_user", &match_limited, &b1_l2);
 418                 add_function_hook("_copy_to_user", &match_limited, &b0_l2);
 419                 add_function_hook("_copy_to_user", &match_limited, &b1_l2);
 420                 add_function_hook("__copy_to_user", &match_limited, &b0_l2);
 421                 add_function_hook("__copy_to_user", &match_limited, &b1_l2);
 422                 add_function_hook("copy_from_user", &match_limited, &b0_l2);
 423                 add_function_hook("copy_from_user", &match_limited, &b1_l2);
 424                 add_function_hook("_copy_from_user", &match_limited, &b0_l2);
 425                 add_function_hook("_copy_from_user", &match_limited, &b1_l2);
 426                 add_function_hook("__copy_from_user", &match_limited, &b0_l2);
 427                 add_function_hook("__copy_from_user", &match_limited, &b1_l2);
 428         }
 429 }