check_overflow.c

   1 /*
   2  * sparse/check_deference.c
   3  *
   4  * Copyright (C) 2006 Dan Carpenter.
   5  *
   6  *  Licensed under the Open Software License version 1.1
   7  *
   8  */
   9
  10 #include <stdlib.h>
  11 #include "parse.h"
  12 #include "smatch.h"
  13 #include "smatch_slist.h"
  14
  15 struct bound {
  16         int param;
  17         int size;
  18 };
  19
  20 static int my_id;
  21
  22 static struct symbol *this_func;
  23
  24 static void match_function_def(struct symbol *sym)
  25 {
  26         this_func = sym;
  27 }
  28
  29 static void print_args(struct expression *expr, int size)
  30 {
  31         struct symbol *sym;
  32         char *name;
  33         struct symbol *arg;
  34         const char *arg_name;
  35         int i;
  36
  37         if (!option_spammy)
  38                 return;
  39
  40         name = get_variable_from_expr(expr, &sym);
  41         if (!name || !sym)
  42                 goto free;
  43
  44         i = 0;
  45         FOR_EACH_PTR(this_func->ctype.base_type->arguments, arg) {
  46                 arg_name = (arg->ident?arg->ident->name:"-");
  47                 if (sym == arg && !strcmp(name, arg_name)) {
  48                         sm_msg("param %d array index. size %d", i, size);
  49                         goto free;
  50                 }
  51                 i++;
  52         } END_FOR_EACH_PTR(arg);
  53 free:
  54         free_string(name);
  55 }
  56
  57 static char *alloc_num(long long num)
  58 {
  59         static char buff[256];
  60
  61         if (num == whole_range.min) {
  62                 snprintf(buff, 255, "min");
  63         } else if (num == whole_range.max) {
  64                 snprintf(buff, 255, "max");
  65         } else if (num < 0) {
  66                 snprintf(buff, 255, "(%lld)", num);
  67         } else {
  68                 snprintf(buff, 255, "%lld", num);
  69         }
  70         buff[255] = '\0';
  71         return alloc_sname(buff);
  72 }
  73
  74 static struct smatch_state *alloc_my_state(int val)
  75 {
  76         struct smatch_state *state;
  77
  78         state = malloc(sizeof(*state));
  79         state->name = alloc_num(val);
  80         state->data = malloc(sizeof(int));
  81         *(int *)state->data = val;
  82         return state;
  83 }
  84
  85 static void match_declaration(struct symbol *sym)
  86 {
  87         struct symbol *base_type;
  88         char *name;
  89         int size;
  90
  91         if (!sym->ident)
  92                 return;
  93
  94         name = sym->ident->name;
  95         base_type = get_base_type(sym);
  96
  97         if (base_type->type == SYM_ARRAY && base_type->bit_size > 0) {
  98                 set_state(my_id, name, NULL, alloc_my_state(base_type->bit_size));
  99         } else {
 100                 if (sym->initializer &&
 101                         sym->initializer->type == EXPR_STRING &&
 102                         sym->initializer->string) {
 103                         size = sym->initializer->string->length * 8;
 104                         set_state(my_id, name, NULL, alloc_my_state(size));
 105                 }
 106         }
 107 }
 108
 109 static int get_array_size(struct expression *expr)
 110 {
 111         char *name;
 112         struct symbol *tmp;
 113         struct smatch_state *state;
 114         int ret = 0;
 115
 116         if (expr->type != EXPR_SYMBOL)
 117                 return 0;
 118         tmp = get_base_type(expr->symbol);
 119         if (tmp->type == SYM_ARRAY) {
 120                 ret = get_expression_value(tmp->array_size);
 121                 if (ret)
 122                         return ret;
 123         }
 124         name = get_variable_from_expr(expr, NULL);
 125         if (!name)
 126                 return 0;
 127         state = get_state(my_id, name, NULL);
 128         if (!state || !state->data)
 129                 goto free;
 130         if (tmp->type == SYM_PTR)
 131                 tmp = get_base_type(tmp);
 132         ret = *(int *)state->data / 8 / tmp->ctype.alignment;
 133 free:
 134         free_string(name);
 135         return ret;
 136 }
 137
 138 extern int check_assigned_expr_id;
 139 static void print_assigned_expr(struct expression *expr)
 140 {
 141 #if 0
 142         struct state_list *slist;
 143         struct sm_state *tmp;
 144         char *name;
 145
 146         name = get_variable_from_expr(expr, NULL);
 147         slist = get_possible_states_expr(check_assigned_expr_id, expr);
 148         FOR_EACH_PTR(slist, tmp) {
 149                 if (tmp->state == &undefined || tmp->state == &merged)
 150                         continue;
 151                 smatch_msg("debug: unknown initializer %s = %s", name, show_state(tmp->state));
 152         } END_FOR_EACH_PTR(tmp);
 153         free_string(name);
 154 #endif
 155 }
 156
 157 static void array_check(struct expression *expr)
 158 {
 159         struct expression *dest;
 160         int array_size;
 161         struct expression *offset;
 162         int max;
 163         char *name;
 164
 165         expr = strip_expr(expr);
 166         if (!is_array(expr))
 167                 return;
 168
 169         dest = get_array_name(expr);
 170         array_size = get_array_size(dest);
 171         if (!array_size) {
 172                 name = get_variable_from_expr(dest, NULL);
 173                 if (!name)
 174                         return;
 175 //              smatch_msg("debug: array '%s' unknown size", name);
 176                 print_assigned_expr(dest);
 177                 return;
 178         }
 179
 180         offset = get_array_offset(expr);
 181         max = get_implied_max(offset);
 182         if (max == UNDEFINED) {
 183                 name = get_variable_from_expr(dest, NULL);
 184 //              smatch_msg("debug: offset '%s' unknown", name);
 185                 print_args(offset, array_size);
 186         }
 187
 188         if (max != UNDEFINED && array_size <= max) {
 189                 name = get_variable_from_expr(dest, NULL);
 190                 sm_msg("error: buffer overflow '%s' %d <= %d", name, array_size, max);
 191                 free_string(name);
 192         }
 193 }
 194
 195 static void match_string_assignment(struct expression *expr)
 196 {
 197         struct expression *left;
 198         struct expression *right;
 199         char *name;
 200
 201         left = strip_expr(expr->left);
 202         right = strip_expr(expr->right);
 203         name = get_variable_from_expr(left, NULL);
 204         if (!name)
 205                 return;
 206         if (right->type != EXPR_STRING || !right->string)
 207                 goto free;
 208         set_state(my_id, name, NULL,
 209                 alloc_my_state(right->string->length * 8));
 210 free:
 211         free_string(name);
 212 }
 213
 214 static void match_malloc(const char *fn, struct expression *expr, void *unused)
 215 {
 216         char *name;
 217         struct expression *right;
 218         struct expression *arg;
 219         int bytes;
 220
 221         name = get_variable_from_expr(expr->left, NULL);
 222         if (!name)
 223                 return;
 224
 225         right = strip_expr(expr->right);
 226         arg = get_argument_from_call_expr(right->args, 0);
 227         bytes = get_implied_value(arg);
 228         if (bytes == UNDEFINED)
 229                 goto free;
 230         set_state(my_id, name, NULL, alloc_my_state(bytes * 8));
 231 free:
 232         free_string(name);
 233 }
 234
 235 static void match_strcpy(const char *fn, struct expression *expr,
 236                          void *unused)
 237 {
 238         struct expression *dest;
 239         struct expression *data;
 240         char *dest_name = NULL;
 241         char *data_name = NULL;
 242         struct smatch_state *dest_state;
 243         struct smatch_state *data_state;
 244         int dest_size;
 245         int data_size;
 246
 247         dest = get_argument_from_call_expr(expr->args, 0);
 248         dest_name = get_variable_from_expr(dest, NULL);
 249
 250         data = get_argument_from_call_expr(expr->args, 1);
 251         data_name = get_variable_from_expr(data, NULL);
 252
 253         dest_state = get_state(my_id, dest_name, NULL);
 254         if (!dest_state || !dest_state->data)
 255                 goto free;
 256
 257         data_state = get_state(my_id, data_name, NULL);
 258         if (!data_state || !data_state->data)
 259                 goto free;
 260         dest_size = *(int *)dest_state->data / 8;
 261         data_size = *(int *)data_state->data / 8;
 262         if (dest_size < data_size)
 263                 sm_msg("error: %s (%d) too large for %s (%d)", data_name,
 264                            data_size, dest_name, dest_size);
 265 free:
 266         free_string(dest_name);
 267         free_string(data_name);
 268 }
 269
 270 static void match_limitted(const char *fn, struct expression *expr,
 271                            void *limit_arg)
 272 {
 273         struct expression *dest;
 274         struct expression *data;
 275         char *dest_name = NULL;
 276         struct smatch_state *state;
 277         int needed;
 278         int has;
 279
 280         dest = get_argument_from_call_expr(expr->args, 0);
 281         dest_name = get_variable_from_expr(dest, NULL);
 282
 283         data = get_argument_from_call_expr(expr->args, PTR_INT(limit_arg));
 284         needed = get_value(data);
 285         state = get_state(my_id, dest_name, NULL);
 286         if (!state || !state->data)
 287                 goto free;
 288         has = *(int *)state->data / 8;
 289         if (has < needed)
 290                 sm_msg("error: %s too small for %d bytes.", dest_name,
 291                            needed);
 292 free:
 293         free_string(dest_name);
 294 }
 295
 296 static void match_array_func(const char *fn, struct expression *expr, void *info)
 297 {
 298         struct bound *bound_info = (struct bound *)info;
 299         struct expression *arg;
 300         int offset;
 301
 302         arg = get_argument_from_call_expr(expr->args, bound_info->param);
 303         offset = get_implied_value(arg);
 304         if (offset == UNDEFINED)
 305                 return;
 306         if (offset >= bound_info->size)
 307                 sm_msg("buffer overflow calling %s. param %d.  %d >= %d", fn, bound_info->param, offset, bound_info->size);
 308 }
 309
 310 static void register_array_funcs(void)
 311 {
 312         struct token *token;
 313         const char *func;
 314         struct bound *bound_info;
 315
 316         token = get_tokens_file("kernel.array_bounds");
 317         if (!token)
 318                 return;
 319         if (token_type(token) != TOKEN_STREAMBEGIN)
 320                 return;
 321         token = token->next;
 322         while (token_type(token) != TOKEN_STREAMEND) {
 323                 bound_info = malloc(sizeof(*bound_info));
 324                 if (token_type(token) != TOKEN_IDENT)
 325                         return;
 326                 func = show_ident(token->ident);
 327                 token = token->next;
 328                 if (token_type(token) != TOKEN_NUMBER)
 329                         return;
 330                 bound_info->param = atoi(token->number);
 331                 token = token->next;
 332                 if (token_type(token) != TOKEN_NUMBER)
 333                         return;
 334                 bound_info->size = atoi(token->number);
 335                 add_function_hook(func, &match_array_func, bound_info);
 336                 token = token->next;
 337         }
 338         clear_token_alloc();
 339 }
 340
 341 void check_overflow(int id)
 342 {
 343         my_id = id;
 344         add_hook(&match_function_def, FUNC_DEF_HOOK);
 345         add_hook(&match_declaration, DECLARATION_HOOK);
 346         add_hook(&array_check, OP_HOOK);
 347         add_hook(&match_string_assignment, ASSIGNMENT_HOOK);
 348         add_function_assign_hook("malloc", &match_malloc, NULL);
 349         add_function_hook("strcpy", &match_strcpy, NULL);
 350         add_function_hook("strncpy", &match_limitted, (void *)2);
 351         if (option_project == PROJ_KERNEL) {
 352                 add_function_assign_hook("kmalloc", &match_malloc, NULL);
 353                 add_function_assign_hook("kzalloc", &match_malloc, NULL);
 354                 add_function_assign_hook("vmalloc", &match_malloc, NULL);
 355                 add_function_hook("copy_to_user", &match_limitted, (void *)2);
 356                 add_function_hook("copy_from_user", &match_limitted, (void *)2);
 357         }
 358         register_array_funcs();
 359 }