check_overflow.c

   1 /*
   2  * sparse/check_deference.c
   3  *
   4  * Copyright (C) 2006 Dan Carpenter.
   5  *
   6  *  Licensed under the Open Software License version 1.1
   7  *
   8  */
   9
  10 #include <stdlib.h>
  11 #include "parse.h"
  12 #include "smatch.h"
  13 #include "smatch_slist.h"
  14
  15 struct bound {
  16         int param;
  17         int size;
  18 };
  19
  20 static int my_id;
  21
  22 static struct symbol *this_func;
  23
  24 static void match_function_def(struct symbol *sym)
  25 {
  26         this_func = sym;
  27 }
  28
  29 static void print_args(struct expression *expr, int size)
  30 {
  31         struct symbol *sym;
  32         char *name;
  33         struct symbol *arg;
  34         const char *arg_name;
  35         int i;
  36
  37         if (!option_spammy)
  38                 return;
  39
  40         name = get_variable_from_expr(expr, &sym);
  41         if (!name || !sym)
  42                 goto free;
  43
  44         i = 0;
  45         FOR_EACH_PTR(this_func->ctype.base_type->arguments, arg) {
  46                 arg_name = (arg->ident?arg->ident->name:"-");
  47                 if (sym == arg && !strcmp(name, arg_name)) {
  48                         sm_msg("param %d array index. size %d", i, size);
  49                         goto free;
  50                 }
  51                 i++;
  52         } END_FOR_EACH_PTR(arg);
  53 free:
  54         free_string(name);
  55 }
  56
  57 static char *alloc_num(long long num)
  58 {
  59         static char buff[256];
  60
  61         if (num == whole_range.min) {
  62                 snprintf(buff, 255, "min");
  63         } else if (num == whole_range.max) {
  64                 snprintf(buff, 255, "max");
  65         } else if (num < 0) {
  66                 snprintf(buff, 255, "(%lld)", num);
  67         } else {
  68                 snprintf(buff, 255, "%lld", num);
  69         }
  70         buff[255] = '\0';
  71         return alloc_sname(buff);
  72 }
  73
  74 static struct smatch_state *alloc_my_state(int val)
  75 {
  76         struct smatch_state *state;
  77
  78         state = malloc(sizeof(*state));
  79         state->name = alloc_num(val);
  80         state->data = malloc(sizeof(int));
  81         *(int *)state->data = val;
  82         return state;
  83 }
  84
  85 static void match_declaration(struct symbol *sym)
  86 {
  87         struct symbol *base_type;
  88         char *name;
  89         int size;
  90
  91         if (!sym->ident)
  92                 return;
  93
  94         name = sym->ident->name;
  95         base_type = get_base_type(sym);
  96
  97         if (base_type->type == SYM_ARRAY && base_type->bit_size > 0) {
  98                 set_state(my_id, name, NULL, alloc_my_state(base_type->bit_size));
  99         } else {
 100                 if (sym->initializer &&
 101                         sym->initializer->type == EXPR_STRING &&
 102                         sym->initializer->string) {
 103                         size = sym->initializer->string->length * 8;
 104                         set_state(my_id, name, NULL, alloc_my_state(size));
 105                 }
 106         }
 107 }
 108
 109 static int get_array_size(struct expression *expr)
 110 {
 111         char *name;
 112         struct symbol *tmp;
 113         struct smatch_state *state;
 114         int ret = 0;
 115
 116         if (expr->type != EXPR_SYMBOL)
 117                 return 0;
 118         tmp = get_base_type(expr->symbol);
 119         if (tmp->type == SYM_ARRAY) {
 120                 ret = get_expression_value(tmp->array_size);
 121                 if (ret)
 122                         return ret;
 123         }
 124         name = get_variable_from_expr(expr, NULL);
 125         if (!name)
 126                 return 0;
 127         state = get_state(my_id, name, NULL);
 128         if (!state || !state->data)
 129                 goto free;
 130         if (tmp->type == SYM_PTR)
 131                 tmp = get_base_type(tmp);
 132         ret = *(int *)state->data / 8 / tmp->ctype.alignment;
 133 free:
 134         free_string(name);
 135         return ret;
 136 }
 137
 138 extern int check_assigned_expr_id;
 139 static void print_assigned_expr(struct expression *expr)
 140 {
 141 #if 0
 142         struct state_list *slist;
 143         struct sm_state *tmp;
 144         char *name;
 145
 146         name = get_variable_from_expr(expr, NULL);
 147         slist = get_possible_states_expr(check_assigned_expr_id, expr);
 148         FOR_EACH_PTR(slist, tmp) {
 149                 if (tmp->state == &undefined || tmp->state == &merged)
 150                         continue;
 151                 smatch_msg("debug: unknown initializer %s = %s", name, show_state(tmp->state));
 152         } END_FOR_EACH_PTR(tmp);
 153         free_string(name);
 154 #endif
 155 }
 156
 157 static void array_check(struct expression *expr)
 158 {
 159         struct expression *dest;
 160         int array_size;
 161         struct expression *offset;
 162         long long max;
 163         char *name;
 164
 165         expr = strip_expr(expr);
 166         if (!is_array(expr))
 167                 return;
 168
 169         dest = get_array_name(expr);
 170         array_size = get_array_size(dest);
 171         if (!array_size) {
 172                 name = get_variable_from_expr(dest, NULL);
 173                 if (!name)
 174                         return;
 175 //              smatch_msg("debug: array '%s' unknown size", name);
 176                 print_assigned_expr(dest);
 177                 return;
 178         }
 179
 180         offset = get_array_offset(expr);
 181         if (!get_implied_max(offset, &max)) {
 182                 name = get_variable_from_expr(dest, NULL);
 183 //              smatch_msg("debug: offset '%s' unknown", name);
 184                 print_args(offset, array_size);
 185         } else if (array_size <= max) {
 186                 name = get_variable_from_expr(dest, NULL);
 187                 sm_msg("error: buffer overflow '%s' %d <= %lld", name, array_size, max);
 188                 free_string(name);
 189         }
 190 }
 191
 192 static void match_string_assignment(struct expression *expr)
 193 {
 194         struct expression *left;
 195         struct expression *right;
 196         char *name;
 197
 198         left = strip_expr(expr->left);
 199         right = strip_expr(expr->right);
 200         name = get_variable_from_expr(left, NULL);
 201         if (!name)
 202                 return;
 203         if (right->type != EXPR_STRING || !right->string)
 204                 goto free;
 205         set_state(my_id, name, NULL,
 206                 alloc_my_state(right->string->length * 8));
 207 free:
 208         free_string(name);
 209 }
 210
 211 static void match_malloc(const char *fn, struct expression *expr, void *unused)
 212 {
 213         char *name;
 214         struct expression *right;
 215         struct expression *arg;
 216         long long bytes;
 217
 218         name = get_variable_from_expr(expr->left, NULL);
 219         if (!name)
 220                 return;
 221
 222         right = strip_expr(expr->right);
 223         arg = get_argument_from_call_expr(right->args, 0);
 224         if (!get_implied_value(arg, &bytes))
 225                 goto free;
 226         set_state(my_id, name, NULL, alloc_my_state(bytes * 8));
 227 free:
 228         free_string(name);
 229 }
 230
 231 static void match_strcpy(const char *fn, struct expression *expr,
 232                          void *unused)
 233 {
 234         struct expression *dest;
 235         struct expression *data;
 236         char *dest_name = NULL;
 237         char *data_name = NULL;
 238         struct smatch_state *dest_state;
 239         struct smatch_state *data_state;
 240         int dest_size;
 241         int data_size;
 242
 243         dest = get_argument_from_call_expr(expr->args, 0);
 244         dest_name = get_variable_from_expr(dest, NULL);
 245
 246         data = get_argument_from_call_expr(expr->args, 1);
 247         data_name = get_variable_from_expr(data, NULL);
 248
 249         dest_state = get_state(my_id, dest_name, NULL);
 250         if (!dest_state || !dest_state->data)
 251                 goto free;
 252
 253         data_state = get_state(my_id, data_name, NULL);
 254         if (!data_state || !data_state->data)
 255                 goto free;
 256         dest_size = *(int *)dest_state->data / 8;
 257         data_size = *(int *)data_state->data / 8;
 258         if (dest_size < data_size)
 259                 sm_msg("error: %s (%d) too large for %s (%d)", data_name,
 260                            data_size, dest_name, dest_size);
 261 free:
 262         free_string(dest_name);
 263         free_string(data_name);
 264 }
 265
 266 static void match_limitted(const char *fn, struct expression *expr,
 267                            void *limit_arg)
 268 {
 269         struct expression *dest;
 270         struct expression *data;
 271         char *dest_name = NULL;
 272         struct smatch_state *state;
 273         long long needed;
 274         int has;
 275
 276         dest = get_argument_from_call_expr(expr->args, 0);
 277         dest_name = get_variable_from_expr(dest, NULL);
 278
 279         data = get_argument_from_call_expr(expr->args, PTR_INT(limit_arg));
 280         if (!get_value(data, &needed))
 281                 goto free;
 282         state = get_state(my_id, dest_name, NULL);
 283         if (!state || !state->data)
 284                 goto free;
 285         has = *(int *)state->data / 8;
 286         if (has < needed)
 287                 sm_msg("error: %s too small for %lld bytes.", dest_name,
 288                            needed);
 289 free:
 290         free_string(dest_name);
 291 }
 292
 293 static void match_array_func(const char *fn, struct expression *expr, void *info)
 294 {
 295         struct bound *bound_info = (struct bound *)info;
 296         struct expression *arg;
 297         long long offset;
 298
 299         arg = get_argument_from_call_expr(expr->args, bound_info->param);
 300         if (!get_implied_value(arg, &offset))
 301                 return;
 302         if (offset >= bound_info->size)
 303                 sm_msg("buffer overflow calling %s. param %d.  %lld >= %d", fn, bound_info->param, offset, bound_info->size);
 304 }
 305
 306 static void register_array_funcs(void)
 307 {
 308         struct token *token;
 309         const char *func;
 310         struct bound *bound_info;
 311
 312         token = get_tokens_file("kernel.array_bounds");
 313         if (!token)
 314                 return;
 315         if (token_type(token) != TOKEN_STREAMBEGIN)
 316                 return;
 317         token = token->next;
 318         while (token_type(token) != TOKEN_STREAMEND) {
 319                 bound_info = malloc(sizeof(*bound_info));
 320                 if (token_type(token) != TOKEN_IDENT)
 321                         return;
 322                 func = show_ident(token->ident);
 323                 token = token->next;
 324                 if (token_type(token) != TOKEN_NUMBER)
 325                         return;
 326                 bound_info->param = atoi(token->number);
 327                 token = token->next;
 328                 if (token_type(token) != TOKEN_NUMBER)
 329                         return;
 330                 bound_info->size = atoi(token->number);
 331                 add_function_hook(func, &match_array_func, bound_info);
 332                 token = token->next;
 333         }
 334         clear_token_alloc();
 335 }
 336
 337 void check_overflow(int id)
 338 {
 339         my_id = id;
 340         add_hook(&match_function_def, FUNC_DEF_HOOK);
 341         add_hook(&match_declaration, DECLARATION_HOOK);
 342         add_hook(&array_check, OP_HOOK);
 343         add_hook(&match_string_assignment, ASSIGNMENT_HOOK);
 344         add_function_assign_hook("malloc", &match_malloc, NULL);
 345         add_function_hook("strcpy", &match_strcpy, NULL);
 346         add_function_hook("strncpy", &match_limitted, (void *)2);
 347         if (option_project == PROJ_KERNEL) {
 348                 add_function_assign_hook("kmalloc", &match_malloc, NULL);
 349                 add_function_assign_hook("kzalloc", &match_malloc, NULL);
 350                 add_function_assign_hook("vmalloc", &match_malloc, NULL);
 351                 add_function_hook("copy_to_user", &match_limitted, (void *)2);
 352                 add_function_hook("copy_from_user", &match_limitted, (void *)2);
 353         }
 354         register_array_funcs();
 355 }