check_get_user_overflow.c

   1 /*
   2  * sparse/check_get_user_overflow.c
   3  *
   4  * Copyright (C) 2010 Dan Carpenter.
   5  *
   6  * Licensed under the Open Software License version 1.1
   7  *
   8  */
   9
  10 /*
  11  * Looks for integers that we get from the user which can be attacked
  12  * with an integer overflow.
  13  *
  14  */
  15
  16 #include "smatch.h"
  17 #include "smatch_slist.h"
  18
  19 static int my_max_id;
  20 static int my_min_id;
  21
  22 STATE(capped);
  23 STATE(user_data);
  24
  25 static void match_condition(struct expression *expr)
  26 {
  27         struct smatch_state *left_max_true = NULL;
  28         struct smatch_state *left_max_false = NULL;
  29         struct smatch_state *right_max_true = NULL;
  30         struct smatch_state *right_max_false = NULL;
  31
  32         struct smatch_state *left_min_true = NULL;
  33         struct smatch_state *left_min_false = NULL;
  34         struct smatch_state *right_min_true = NULL;
  35         struct smatch_state *right_min_false = NULL;
  36
  37         switch (expr->op) {
  38         case '<':
  39         case SPECIAL_LTE:
  40         case SPECIAL_UNSIGNED_LT:
  41         case SPECIAL_UNSIGNED_LTE:
  42                 left_max_true = &capped;
  43                 right_max_false = &capped;
  44                 right_min_true = &capped;
  45                 left_min_false = &capped;
  46                 break;
  47         case '>':
  48         case SPECIAL_GTE:
  49         case SPECIAL_UNSIGNED_GT:
  50         case SPECIAL_UNSIGNED_GTE:
  51                 left_max_false = &capped;
  52                 right_max_true = &capped;
  53                 left_min_true = &capped;
  54                 right_min_false = &capped;
  55                 break;
  56         case SPECIAL_EQUAL:
  57                 left_max_true = &capped;
  58                 right_max_true = &capped;
  59                 left_min_true = &capped;
  60                 right_min_true = &capped;
  61                 break;
  62         case SPECIAL_NOTEQUAL:
  63                 left_max_false = &capped;
  64                 right_max_false = &capped;
  65                 left_min_false = &capped;
  66                 right_min_false = &capped;
  67                 break;
  68         default:
  69                 return;
  70         }
  71
  72         if (get_state_expr(my_max_id, expr->left)) {
  73                 set_true_false_states_expr(my_max_id, expr->left, left_max_true, left_max_false);
  74                 set_true_false_states_expr(my_min_id, expr->left, left_min_true, left_min_false);
  75         }
  76         if (get_state_expr(my_max_id, expr->right)) {
  77                 set_true_false_states_expr(my_max_id, expr->right, right_max_true, right_max_false);
  78                 set_true_false_states_expr(my_min_id, expr->right, right_min_true, right_min_false);
  79         }
  80 }
  81
  82 static void match_normal_assign(struct expression *expr)
  83 {
  84         if (get_state_expr(my_max_id, expr->left)) {
  85                 set_state_expr(my_max_id, expr->left, &capped);
  86                 set_state_expr(my_min_id, expr->left, &capped);
  87         }
  88 }
  89
  90 static void match_assign(struct expression *expr)
  91 {
  92         char *name;
  93
  94         name = get_macro_name(expr->pos);
  95         if (!name || strcmp(name, "get_user") != 0) {
  96                 match_normal_assign(expr);
  97                 return;
  98         }
  99         name = expr_to_var(expr->right);
 100         if (!name || strcmp(name, "__val_gu") != 0)
 101                 goto free;
 102         set_state_expr(my_max_id, expr->left, &user_data);
 103         set_state_expr(my_min_id, expr->left, &user_data);
 104 free:
 105         free_string(name);
 106 }
 107
 108 static void check_expr(struct expression *expr)
 109 {
 110         struct sm_state *sm;
 111         sval_t max;
 112         sval_t sval;
 113         char *name;
 114         int overflow = 0;
 115         int underflow = 0;
 116
 117         sm = get_sm_state_expr(my_max_id, expr);
 118         if (sm && slist_has_state(sm->possible, &user_data)) {
 119                 if (!get_absolute_max(expr, &max) || sval_cmp_val(max, 20000) > 0)
 120                         overflow = 1;
 121         }
 122
 123         sm = get_sm_state_expr(my_min_id, expr);
 124         if (sm && slist_has_state(sm->possible, &user_data)) {
 125                 if (!get_absolute_min(expr, &sval) ||
 126                     (sval_is_negative(sval) && sval_cmp_val(sval, -20000) < 0))
 127                         underflow = 1;
 128         }
 129
 130         if (!overflow && !underflow)
 131                 return;
 132
 133         name = expr_to_var_sym(expr, NULL);
 134         if (overflow && underflow)
 135                 sm_msg("warn: check for integer over/underflow '%s'", name);
 136         else if (underflow)
 137                 sm_msg("warn: check for integer underflow '%s'", name);
 138         else
 139                 sm_msg("warn: check for integer overflow '%s'", name);
 140         free_string(name);
 141
 142         set_state_expr(my_max_id, expr, &capped);
 143         set_state_expr(my_min_id, expr, &capped);
 144 }
 145
 146 static void match_binop(struct expression *expr)
 147 {
 148         if (expr->op == '^')
 149                 return;
 150         if (expr->op == '&')
 151                 return;
 152         if (expr->op == '|')
 153                 return;
 154         if (expr->op == SPECIAL_RIGHTSHIFT)
 155                 return;
 156         if (expr->op == SPECIAL_LEFTSHIFT)
 157                 return;
 158
 159         check_expr(expr->left);
 160         check_expr(expr->right);
 161 }
 162
 163 void check_get_user_overflow(int id)
 164 {
 165         if (option_project != PROJ_KERNEL)
 166                 return;
 167         my_max_id = id;
 168         add_hook(&match_condition, CONDITION_HOOK);
 169         add_hook(&match_assign, ASSIGNMENT_HOOK);
 170         add_hook(&match_binop, BINOP_HOOK);
 171 }
 172
 173 void check_get_user_overflow2(int id)
 174 {
 175         my_min_id = id;
 176 }