check_get_user_overflow.c

   1 /*
   2  * sparse/check_get_user_overflow.c
   3  *
   4  * Copyright (C) 2010 Dan Carpenter.
   5  *
   6  * Licensed under the Open Software License version 1.1
   7  *
   8  */
   9
  10 /*
  11  * Looks for integers that we get from the user which can be attacked
  12  * with an integer overflow.
  13  *
  14  */
  15
  16 #include "smatch.h"
  17 #include "smatch_slist.h"
  18
  19 static int my_max_id;
  20 static int my_min_id;
  21
  22 STATE(capped);
  23 STATE(user_data);
  24
  25 static void match_condition(struct expression *expr)
  26 {
  27         struct smatch_state *left_max_true = NULL;
  28         struct smatch_state *left_max_false = NULL;
  29         struct smatch_state *right_max_true = NULL;
  30         struct smatch_state *right_max_false = NULL;
  31
  32         struct smatch_state *left_min_true = NULL;
  33         struct smatch_state *left_min_false = NULL;
  34         struct smatch_state *right_min_true = NULL;
  35         struct smatch_state *right_min_false = NULL;
  36
  37
  38         switch (expr->op) {
  39         case '<':
  40         case SPECIAL_LTE:
  41         case SPECIAL_UNSIGNED_LT:
  42         case SPECIAL_UNSIGNED_LTE:
  43                 left_max_true = &capped;
  44                 right_max_false = &capped;
  45                 right_min_true = &capped;
  46                 left_min_false = &capped;
  47                 break;
  48         case '>':
  49         case SPECIAL_GTE:
  50         case SPECIAL_UNSIGNED_GT:
  51         case SPECIAL_UNSIGNED_GTE:
  52                 left_max_false = &capped;
  53                 right_max_true = &capped;
  54                 left_min_true = &capped;
  55                 right_min_false = &capped;
  56                 break;
  57         case SPECIAL_EQUAL:
  58                 left_max_true = &capped;
  59                 right_max_true = &capped;
  60                 left_min_true = &capped;
  61                 right_min_true = &capped;
  62                 break;
  63         case SPECIAL_NOTEQUAL:
  64                 left_max_false = &capped;
  65                 right_max_false = &capped;
  66                 left_min_false = &capped;
  67                 right_min_false = &capped;
  68                 break;
  69         default:
  70                 return;
  71         }
  72
  73         if (get_state_expr(my_max_id, expr->left)) {
  74                 set_true_false_states_expr(my_max_id, expr->left, left_max_true, left_max_false);
  75                 set_true_false_states_expr(my_min_id, expr->left, left_min_true, left_min_false);
  76         }
  77         if (get_state_expr(my_max_id, expr->right)) {
  78                 set_true_false_states_expr(my_max_id, expr->right, right_max_true, right_max_false);
  79                 set_true_false_states_expr(my_min_id, expr->right, right_min_true, right_min_false);
  80         }
  81 }
  82
  83 static void match_normal_assign(struct expression *expr)
  84 {
  85         if (get_state_expr(my_max_id, expr->left)) {
  86                 set_state_expr(my_max_id, expr->left, &capped);
  87                 set_state_expr(my_min_id, expr->left, &capped);
  88         }
  89 }
  90
  91 static void match_assign(struct expression *expr)
  92 {
  93         char *name;
  94
  95         name = get_macro_name(expr->pos);
  96         if (!name || strcmp(name, "get_user") != 0) {
  97                 match_normal_assign(expr);
  98                 return;
  99         }
 100         name = get_variable_from_expr(expr->right, NULL);
 101         if (!name || strcmp(name, "__val_gu") != 0)
 102                 goto free;
 103         set_state_expr(my_max_id, expr->left, &user_data);
 104         set_state_expr(my_min_id, expr->left, &user_data);
 105 free:
 106         free_string(name);
 107 }
 108
 109 static void check_expr(struct expression *expr)
 110 {
 111         struct sm_state *sm;
 112         long long val;
 113         char *name;
 114         int overflow = 0;
 115         int underflow = 0;
 116
 117         sm = get_sm_state_expr(my_max_id, expr);
 118         if (sm && slist_has_state(sm->possible, &user_data)) {
 119                 if (!get_absolute_max(expr, &val) || val > 20000)
 120                         overflow = 1;
 121         }
 122
 123         sm = get_sm_state_expr(my_min_id, expr);
 124         if (sm && slist_has_state(sm->possible, &user_data)) {
 125                 if (!get_absolute_min(expr, &val) || val < -20000)
 126                         underflow = 1;
 127         }
 128
 129         if (!overflow && !underflow)
 130                 return;
 131
 132         name = get_variable_from_expr(expr, NULL);
 133         if (overflow && underflow)
 134                 sm_msg("warn: check for integer over/underflow '%s'", name);
 135         else if (underflow)
 136                 sm_msg("warn: check for integer underflow '%s'", name);
 137         else
 138                 sm_msg("warn: check for integer overflow '%s'", name);
 139         free_string(name);
 140
 141         set_state_expr(my_max_id, expr, &capped);
 142         set_state_expr(my_min_id, expr, &capped);
 143 }
 144
 145 static void match_binop(struct expression *expr)
 146 {
 147         if (expr->op == '^')
 148                 return;
 149         if (expr->op == '&')
 150                 return;
 151         if (expr->op == '|')
 152                 return;
 153         if (expr->op == SPECIAL_RIGHTSHIFT)
 154                 return;
 155         if (expr->op == SPECIAL_LEFTSHIFT)
 156                 return;
 157
 158         check_expr(expr->left);
 159         check_expr(expr->right);
 160 }
 161
 162 void check_get_user_overflow(int id)
 163 {
 164         if (option_project != PROJ_KERNEL)
 165                 return;
 166         my_max_id = id;
 167         add_hook(&match_condition, CONDITION_HOOK);
 168         add_hook(&match_assign, ASSIGNMENT_HOOK);
 169         add_hook(&match_binop, BINOP_HOOK);
 170 }
 171
 172 void check_get_user_overflow2(int id)
 173 {
 174         my_min_id = id;
 175 }