2 * sparse/check_get_user_overflow.c
4 * Copyright (C) 2010 Dan Carpenter.
6 * Licensed under the Open Software License version 1.1
11 * Looks for integers that we get from the user which can be attacked
12 * with an integer overflow.
17 #include "smatch_slist.h"
25 static void match_condition(struct expression
*expr
)
27 struct smatch_state
*left_max_true
= NULL
;
28 struct smatch_state
*left_max_false
= NULL
;
29 struct smatch_state
*right_max_true
= NULL
;
30 struct smatch_state
*right_max_false
= NULL
;
32 struct smatch_state
*left_min_true
= NULL
;
33 struct smatch_state
*left_min_false
= NULL
;
34 struct smatch_state
*right_min_true
= NULL
;
35 struct smatch_state
*right_min_false
= NULL
;
40 case SPECIAL_UNSIGNED_LT
:
41 case SPECIAL_UNSIGNED_LTE
:
42 left_max_true
= &capped
;
43 right_max_false
= &capped
;
44 right_min_true
= &capped
;
45 left_min_false
= &capped
;
49 case SPECIAL_UNSIGNED_GT
:
50 case SPECIAL_UNSIGNED_GTE
:
51 left_max_false
= &capped
;
52 right_max_true
= &capped
;
53 left_min_true
= &capped
;
54 right_min_false
= &capped
;
57 left_max_true
= &capped
;
58 right_max_true
= &capped
;
59 left_min_true
= &capped
;
60 right_min_true
= &capped
;
62 case SPECIAL_NOTEQUAL
:
63 left_max_false
= &capped
;
64 right_max_false
= &capped
;
65 left_min_false
= &capped
;
66 right_min_false
= &capped
;
72 if (get_state_expr(my_max_id
, expr
->left
)) {
73 set_true_false_states_expr(my_max_id
, expr
->left
, left_max_true
, left_max_false
);
74 set_true_false_states_expr(my_min_id
, expr
->left
, left_min_true
, left_min_false
);
76 if (get_state_expr(my_max_id
, expr
->right
)) {
77 set_true_false_states_expr(my_max_id
, expr
->right
, right_max_true
, right_max_false
);
78 set_true_false_states_expr(my_min_id
, expr
->right
, right_min_true
, right_min_false
);
82 static void match_normal_assign(struct expression
*expr
)
84 if (get_state_expr(my_max_id
, expr
->left
)) {
85 set_state_expr(my_max_id
, expr
->left
, &capped
);
86 set_state_expr(my_min_id
, expr
->left
, &capped
);
90 static void match_assign(struct expression
*expr
)
94 name
= get_macro_name(expr
->pos
);
95 if (!name
|| strcmp(name
, "get_user") != 0) {
96 match_normal_assign(expr
);
99 name
= get_variable_from_expr(expr
->right
, NULL
);
100 if (!name
|| strcmp(name
, "__val_gu") != 0)
102 set_state_expr(my_max_id
, expr
->left
, &user_data
);
103 set_state_expr(my_min_id
, expr
->left
, &user_data
);
108 static void check_expr(struct expression
*expr
)
116 sm
= get_sm_state_expr(my_max_id
, expr
);
117 if (sm
&& slist_has_state(sm
->possible
, &user_data
)) {
118 if (!get_absolute_max(expr
, &val
) || val
> 20000)
122 sm
= get_sm_state_expr(my_min_id
, expr
);
123 if (sm
&& slist_has_state(sm
->possible
, &user_data
)) {
124 if (!get_absolute_min(expr
, &val
) || val
< -20000)
128 if (!overflow
&& !underflow
)
131 name
= get_variable_from_expr(expr
, NULL
);
132 if (overflow
&& underflow
)
133 sm_msg("warn: check for integer over/underflow '%s'", name
);
135 sm_msg("warn: check for integer underflow '%s'", name
);
137 sm_msg("warn: check for integer overflow '%s'", name
);
140 set_state_expr(my_max_id
, expr
, &capped
);
141 set_state_expr(my_min_id
, expr
, &capped
);
144 static void match_binop(struct expression
*expr
)
152 if (expr
->op
== SPECIAL_RIGHTSHIFT
)
154 if (expr
->op
== SPECIAL_LEFTSHIFT
)
157 check_expr(expr
->left
);
158 check_expr(expr
->right
);
161 void check_get_user_overflow(int id
)
163 if (option_project
!= PROJ_KERNEL
)
166 add_hook(&match_condition
, CONDITION_HOOK
);
167 add_hook(&match_assign
, ASSIGNMENT_HOOK
);
168 add_hook(&match_binop
, BINOP_HOOK
);
171 void check_get_user_overflow2(int id
)