analyzer: handle function attribute "alloc_size" [PR110426]
This patch makes -fanalyzer make use of the function attribute "alloc_size", allowing -fanalyzer to emit -Wanalyzer-allocation-size, -Wanalyzer-out-of-bounds, and -Wanalyzer-tainted-allocation-size on execution paths involving allocations using such functions. gcc/analyzer/ChangeLog: PR analyzer/110426 * bounds-checking.cc (region_model::check_region_bounds): Handle symbolic base regions. * call-details.cc: Include "stringpool.h" and "attribs.h". (call_details::lookup_function_attribute): New function. * call-details.h (call_details::lookup_function_attribute): New function decl. * region-model-manager.cc (region_model_manager::maybe_fold_binop): Add reference to PR analyzer/110902. * region-model-reachability.cc (reachable_regions::handle_sval): Add symbolic regions for pointers that are conjured svalues for the LHS of a stmt. * region-model.cc (region_model::canonicalize): Purge dynamic extents for regions that aren't referenced. (get_result_size_in_bytes): New function. (region_model::on_call_pre): Use get_result_size_in_bytes and potentially set the dynamic extents of the region pointed to by the return value. (region_model::deref_rvalue): Add param "add_nonnull_constraint" and use it to conditionalize adding the constraint. (pending_diagnostic_subclass::dubious_allocation_size): Add "stmt" param to both ctors and use it to initialize new "m_stmt" field. (pending_diagnostic_subclass::operator==): Use m_stmt; don't use m_lhs or m_rhs. (pending_diagnostic_subclass::m_stmt): New field. (region_model::check_region_size): Generalize to any kind of pointer svalue by using deref_rvalue rather than checking for region_svalue. Pass stmt to dubious_allocation_size ctor. * region-model.h (region_model::deref_rvalue): Add param "add_nonnull_constraint". * svalue.cc (conjured_svalue::lhs_value_p): New function. * svalue.h (conjured_svalue::lhs_value_p): New decl. gcc/testsuite/ChangeLog: PR analyzer/110426 * gcc.dg/analyzer/allocation-size-1.c: Update expected message to reflect consolidation of size and assignment into a single event. * gcc.dg/analyzer/allocation-size-2.c: Likewise. * gcc.dg/analyzer/allocation-size-3.c: Likewise. * gcc.dg/analyzer/allocation-size-4.c: Likewise. * gcc.dg/analyzer/allocation-size-multiline-1.c: Likewise. * gcc.dg/analyzer/allocation-size-multiline-2.c: Likewise. * gcc.dg/analyzer/allocation-size-multiline-3.c: Likewise. * gcc.dg/analyzer/attr-alloc_size-1.c: New test. * gcc.dg/analyzer/attr-alloc_size-2.c: New test. * gcc.dg/analyzer/attr-alloc_size-3.c: New test. * gcc.dg/analyzer/explode-4.c: New test. * gcc.dg/analyzer/taint-size-1.c: Add test coverage for __attribute__ alloc_size. Signed-off-by: David Malcolm <dmalcolm@redhat.com>
This commit is contained in:
David Malcolm
parent
187b213ddb
commit
021077b947
21 changed files with 458 additions and 63 deletions
|
|
@ -981,12 +981,6 @@ region_model::check_region_bounds (const region *reg,
|
|||
region_offset reg_offset = reg->get_offset (m_mgr);
|
||||
const region *base_reg = reg_offset.get_base_region ();
|
||||
|
||||
/* Bail out on symbolic regions.
|
||||
(e.g. because the analyzer did not see previous offsets on the latter,
|
||||
it might think that a negative access is before the buffer). */
|
||||
if (base_reg->symbolic_p ())
|
||||
return true;
|
||||
|
||||
/* Find out how many bytes were accessed. */
|
||||
const svalue *num_bytes_sval = reg->get_byte_size_sval (m_mgr);
|
||||
tree num_bytes_tree = maybe_get_integer_cst_tree (num_bytes_sval);
|
||||
|
|
@ -1010,9 +1004,9 @@ region_model::check_region_bounds (const region *reg,
|
|||
offset = wi::sext (reg_offset.get_bit_offset () >> LOG2_BITS_PER_UNIT,
|
||||
TYPE_PRECISION (size_type_node));
|
||||
|
||||
/* If either the offset or the number of bytes accessed are symbolic,
|
||||
we have to reason about symbolic values. */
|
||||
if (reg_offset.symbolic_p () || !num_bytes_tree)
|
||||
/* If any of the base region, the offset, or the number of bytes accessed
|
||||
are symbolic, we have to reason about symbolic values. */
|
||||
if (base_reg->symbolic_p () || reg_offset.symbolic_p () || !num_bytes_tree)
|
||||
{
|
||||
const svalue* byte_offset_sval;
|
||||
if (!reg_offset.symbolic_p ())
|
||||
|
|
|
|||
|
|
@ -34,6 +34,8 @@ along with GCC; see the file COPYING3. If not see
|
|||
#include "gimple-pretty-print.h"
|
||||
#include "analyzer/region-model.h"
|
||||
#include "analyzer/call-details.h"
|
||||
#include "stringpool.h"
|
||||
#include "attribs.h"
|
||||
|
||||
#if ENABLE_ANALYZER
|
||||
|
||||
|
|
@ -226,6 +228,25 @@ call_details::get_or_create_conjured_svalue (const region *reg) const
|
|||
conjured_purge (m_model, m_ctxt));
|
||||
}
|
||||
|
||||
/* Look for a function attribute with name ATTR_NAME on the called
|
||||
function (or on its type).
|
||||
Return the attribute if one is found, otherwise return NULL_TREE. */
|
||||
|
||||
tree
|
||||
call_details::lookup_function_attribute (const char *attr_name) const
|
||||
{
|
||||
tree allocfntype;
|
||||
if (tree fndecl = get_fndecl_for_call ())
|
||||
allocfntype = TREE_TYPE (fndecl);
|
||||
else
|
||||
allocfntype = gimple_call_fntype (m_call);
|
||||
|
||||
if (!allocfntype)
|
||||
return NULL_TREE;
|
||||
|
||||
return lookup_attribute (attr_name, TYPE_ATTRIBUTES (allocfntype));
|
||||
}
|
||||
|
||||
} // namespace ana
|
||||
|
||||
#endif /* #if ENABLE_ANALYZER */
|
||||
|
|
|
|||
|
|
@ -64,6 +64,8 @@ public:
|
|||
|
||||
const svalue *get_or_create_conjured_svalue (const region *) const;
|
||||
|
||||
tree lookup_function_attribute (const char *attr_name) const;
|
||||
|
||||
private:
|
||||
const gcall *m_call;
|
||||
region_model *m_model;
|
||||
|
|
|
|||
|
|
@ -654,6 +654,8 @@ region_model_manager::maybe_fold_binop (tree type, enum tree_code op,
|
|||
return get_or_create_constant_svalue (build_int_cst (type, 0));
|
||||
/* (VAL * 1) -> VAL. */
|
||||
if (cst1 && integer_onep (cst1))
|
||||
/* TODO: we ought to have a cast to TYPE here, but doing so introduces
|
||||
regressions; see PR analyzer/110902. */
|
||||
return arg0;
|
||||
break;
|
||||
case BIT_AND_EXPR:
|
||||
|
|
|
|||
|
|
@ -184,6 +184,27 @@ reachable_regions::handle_sval (const svalue *sval)
|
|||
}
|
||||
add (pointee, ptr_is_mutable);
|
||||
}
|
||||
else if (sval->get_type ()
|
||||
&& TREE_CODE (sval->get_type ()) == POINTER_TYPE
|
||||
&& sval->get_kind () == SK_CONJURED)
|
||||
{
|
||||
/* Also add symbolic regions for pointers, but only for conjured svalues
|
||||
for the LHS of a stmt. Doing it for more leads to state explosions
|
||||
on chains of calls to external functions, due to each conjured svalue
|
||||
potentially being modified at each successive call, recursively. */
|
||||
const conjured_svalue *conjured_sval = (const conjured_svalue *)sval;
|
||||
if (conjured_sval->lhs_value_p ())
|
||||
{
|
||||
const region *pointee
|
||||
= m_model->get_manager ()->get_symbolic_region (sval);
|
||||
/* Use const-ness of pointer type to affect mutability. */
|
||||
bool ptr_is_mutable = true;
|
||||
if (TYPE_READONLY (TREE_TYPE (sval->get_type ())))
|
||||
ptr_is_mutable = false;
|
||||
add (pointee, ptr_is_mutable);
|
||||
}
|
||||
}
|
||||
|
||||
/* Treat all svalues within a compound_svalue as reachable. */
|
||||
if (const compound_svalue *compound_sval
|
||||
= sval->dyn_cast_compound_svalue ())
|
||||
|
|
|
|||
|
|
@ -441,6 +441,29 @@ region_model::canonicalize ()
|
|||
{
|
||||
m_store.canonicalize (m_mgr->get_store_manager ());
|
||||
m_constraints->canonicalize ();
|
||||
|
||||
if (!m_dynamic_extents.is_empty ())
|
||||
{
|
||||
/* Purge any dynamic extents for regions that aren't referenced.
|
||||
Normally these are eliminated when leaks are detected, but we
|
||||
can also gain stray heap_allocated_regions that aren't seen
|
||||
by the leak-detection code. This happens when
|
||||
region_model::on_call_pre provides a default result for a
|
||||
function with both attributes "malloc" and "alloc_size" that
|
||||
also has a known_function implementation.
|
||||
Purge dynamic extent information for such regions. */
|
||||
auto_bitmap referenced_base_region_ids;
|
||||
get_referenced_base_regions (referenced_base_region_ids);
|
||||
auto_vec<const region *> purgable_dyn_extents;
|
||||
for (auto iter : m_dynamic_extents)
|
||||
{
|
||||
const region *reg = iter.first;
|
||||
if (!bitmap_bit_p (referenced_base_region_ids, reg->get_id ()))
|
||||
purgable_dyn_extents.safe_push (reg);
|
||||
}
|
||||
for (auto reg : purgable_dyn_extents)
|
||||
m_dynamic_extents.remove (reg);
|
||||
}
|
||||
}
|
||||
|
||||
/* Return true if this region_model is in canonical form. */
|
||||
|
|
@ -1462,6 +1485,48 @@ region_model::get_known_function (enum internal_fn ifn) const
|
|||
return known_fn_mgr->get_internal_fn (ifn);
|
||||
}
|
||||
|
||||
/* Look for attribute "alloc_size" on the called function and, if found,
|
||||
return a symbolic value of type size_type_node for the allocation size
|
||||
based on the call's parameters.
|
||||
Otherwise, return null. */
|
||||
|
||||
static const svalue *
|
||||
get_result_size_in_bytes (const call_details &cd)
|
||||
{
|
||||
const tree attr = cd.lookup_function_attribute ("alloc_size");
|
||||
if (!attr)
|
||||
return nullptr;
|
||||
|
||||
const tree atval_1 = TREE_VALUE (attr);
|
||||
if (!atval_1)
|
||||
return nullptr;
|
||||
|
||||
unsigned argidx1 = TREE_INT_CST_LOW (TREE_VALUE (atval_1)) - 1;
|
||||
if (cd.num_args () <= argidx1)
|
||||
return nullptr;
|
||||
|
||||
const svalue *sval_arg1 = cd.get_arg_svalue (argidx1);
|
||||
|
||||
if (const tree atval_2 = TREE_CHAIN (atval_1))
|
||||
{
|
||||
/* Two arguments. */
|
||||
unsigned argidx2 = TREE_INT_CST_LOW (TREE_VALUE (atval_2)) - 1;
|
||||
if (cd.num_args () <= argidx2)
|
||||
return nullptr;
|
||||
const svalue *sval_arg2 = cd.get_arg_svalue (argidx2);
|
||||
/* TODO: ideally we shouldn't need this cast here;
|
||||
see PR analyzer/110902. */
|
||||
return cd.get_manager ()->get_or_create_cast
|
||||
(size_type_node,
|
||||
cd.get_manager ()->get_or_create_binop (size_type_node,
|
||||
MULT_EXPR,
|
||||
sval_arg1, sval_arg2));
|
||||
}
|
||||
else
|
||||
/* Single argument. */
|
||||
return cd.get_manager ()->get_or_create_cast (size_type_node, sval_arg1);
|
||||
}
|
||||
|
||||
/* Update this model for the CALL stmt, using CTXT to report any
|
||||
diagnostics - the first half.
|
||||
|
||||
|
|
@ -1522,6 +1587,11 @@ region_model::on_call_pre (const gcall *call, region_model_context *ctxt)
|
|||
lhs_region,
|
||||
conjured_purge (this,
|
||||
ctxt));
|
||||
if (const svalue *size_in_bytes = get_result_size_in_bytes (cd))
|
||||
{
|
||||
const region *reg = deref_rvalue (sval, NULL_TREE, ctxt, false);
|
||||
set_dynamic_extents (reg, size_in_bytes, ctxt);
|
||||
}
|
||||
}
|
||||
set_value (lhs_region, sval, ctxt);
|
||||
}
|
||||
|
|
@ -2461,7 +2531,8 @@ region_model::region_exists_p (const region *reg) const
|
|||
|
||||
const region *
|
||||
region_model::deref_rvalue (const svalue *ptr_sval, tree ptr_tree,
|
||||
region_model_context *ctxt) const
|
||||
region_model_context *ctxt,
|
||||
bool add_nonnull_constraint) const
|
||||
{
|
||||
gcc_assert (ptr_sval);
|
||||
gcc_assert (POINTER_TYPE_P (ptr_sval->get_type ()));
|
||||
|
|
@ -2471,9 +2542,13 @@ region_model::deref_rvalue (const svalue *ptr_sval, tree ptr_tree,
|
|||
-Wanalyzer-null-dereference for the case where we later have an
|
||||
if (PTR_SVAL) that would occur if we considered the false branch
|
||||
and transitioned the malloc state machine from start->null. */
|
||||
tree null_ptr_cst = build_int_cst (ptr_sval->get_type (), 0);
|
||||
const svalue *null_ptr = m_mgr->get_or_create_constant_svalue (null_ptr_cst);
|
||||
m_constraints->add_constraint (ptr_sval, NE_EXPR, null_ptr);
|
||||
if (add_nonnull_constraint)
|
||||
{
|
||||
tree null_ptr_cst = build_int_cst (ptr_sval->get_type (), 0);
|
||||
const svalue *null_ptr
|
||||
= m_mgr->get_or_create_constant_svalue (null_ptr_cst);
|
||||
m_constraints->add_constraint (ptr_sval, NE_EXPR, null_ptr);
|
||||
}
|
||||
|
||||
switch (ptr_sval->get_kind ())
|
||||
{
|
||||
|
|
@ -2851,14 +2926,15 @@ class dubious_allocation_size
|
|||
: public pending_diagnostic_subclass<dubious_allocation_size>
|
||||
{
|
||||
public:
|
||||
dubious_allocation_size (const region *lhs, const region *rhs)
|
||||
: m_lhs (lhs), m_rhs (rhs), m_expr (NULL_TREE),
|
||||
dubious_allocation_size (const region *lhs, const region *rhs,
|
||||
const gimple *stmt)
|
||||
: m_lhs (lhs), m_rhs (rhs), m_expr (NULL_TREE), m_stmt (stmt),
|
||||
m_has_allocation_event (false)
|
||||
{}
|
||||
|
||||
dubious_allocation_size (const region *lhs, const region *rhs,
|
||||
tree expr)
|
||||
: m_lhs (lhs), m_rhs (rhs), m_expr (expr),
|
||||
tree expr, const gimple *stmt)
|
||||
: m_lhs (lhs), m_rhs (rhs), m_expr (expr), m_stmt (stmt),
|
||||
m_has_allocation_event (false)
|
||||
{}
|
||||
|
||||
|
|
@ -2869,8 +2945,8 @@ public:
|
|||
|
||||
bool operator== (const dubious_allocation_size &other) const
|
||||
{
|
||||
return m_lhs == other.m_lhs && m_rhs == other.m_rhs
|
||||
&& pending_diagnostic::same_tree_p (m_expr, other.m_expr);
|
||||
return (m_stmt == other.m_stmt
|
||||
&& pending_diagnostic::same_tree_p (m_expr, other.m_expr));
|
||||
}
|
||||
|
||||
int get_controlling_option () const final override
|
||||
|
|
@ -2940,6 +3016,7 @@ private:
|
|||
const region *m_lhs;
|
||||
const region *m_rhs;
|
||||
const tree m_expr;
|
||||
const gimple *m_stmt;
|
||||
bool m_has_allocation_event;
|
||||
};
|
||||
|
||||
|
|
@ -3139,10 +3216,6 @@ region_model::check_region_size (const region *lhs_reg, const svalue *rhs_sval,
|
|||
if (!is_any_cast_p (ctxt->get_stmt ()))
|
||||
return;
|
||||
|
||||
const region_svalue *reg_sval = dyn_cast <const region_svalue *> (rhs_sval);
|
||||
if (!reg_sval)
|
||||
return;
|
||||
|
||||
tree pointer_type = lhs_reg->get_type ();
|
||||
if (pointer_type == NULL_TREE || !POINTER_TYPE_P (pointer_type))
|
||||
return;
|
||||
|
|
@ -3167,7 +3240,7 @@ region_model::check_region_size (const region *lhs_reg, const svalue *rhs_sval,
|
|||
|| integer_onep (pointee_size_tree))
|
||||
return;
|
||||
|
||||
const region *rhs_reg = reg_sval->get_pointee ();
|
||||
const region *rhs_reg = deref_rvalue (rhs_sval, NULL_TREE, ctxt, false);
|
||||
const svalue *capacity = get_capacity (rhs_reg);
|
||||
switch (capacity->get_kind ())
|
||||
{
|
||||
|
|
@ -3180,7 +3253,8 @@ region_model::check_region_size (const region *lhs_reg, const svalue *rhs_sval,
|
|||
&& !capacity_compatible_with_type (cst_cap, pointee_size_tree,
|
||||
is_struct))
|
||||
ctxt->warn (make_unique <dubious_allocation_size> (lhs_reg, rhs_reg,
|
||||
cst_cap));
|
||||
cst_cap,
|
||||
ctxt->get_stmt ()));
|
||||
}
|
||||
break;
|
||||
default:
|
||||
|
|
@ -3193,7 +3267,8 @@ region_model::check_region_size (const region *lhs_reg, const svalue *rhs_sval,
|
|||
tree expr = get_representative_tree (capacity);
|
||||
ctxt->warn (make_unique <dubious_allocation_size> (lhs_reg,
|
||||
rhs_reg,
|
||||
expr));
|
||||
expr,
|
||||
ctxt->get_stmt ()));
|
||||
}
|
||||
}
|
||||
break;
|
||||
|
|
|
|||
|
|
@ -352,7 +352,8 @@ class region_model
|
|||
const svalue *get_rvalue (tree expr, region_model_context *ctxt) const;
|
||||
|
||||
const region *deref_rvalue (const svalue *ptr_sval, tree ptr_tree,
|
||||
region_model_context *ctxt) const;
|
||||
region_model_context *ctxt,
|
||||
bool add_nonnull_constraint = true) const;
|
||||
|
||||
const svalue *get_rvalue_for_bits (tree type,
|
||||
const region *reg,
|
||||
|
|
|
|||
|
|
@ -1940,6 +1940,17 @@ conjured_svalue::accept (visitor *v) const
|
|||
v->visit_conjured_svalue (this);
|
||||
}
|
||||
|
||||
/* Return true iff this conjured_svalue is for the LHS of the
|
||||
stmt that conjured it. */
|
||||
|
||||
bool
|
||||
conjured_svalue::lhs_value_p () const
|
||||
{
|
||||
if (tree decl = m_id_reg->maybe_get_decl ())
|
||||
return decl == gimple_get_lhs (m_stmt);
|
||||
return false;
|
||||
}
|
||||
|
||||
/* class asm_output_svalue : public svalue. */
|
||||
|
||||
/* Implementation of svalue::dump_to_pp vfunc for asm_output_svalue. */
|
||||
|
|
|
|||
|
|
@ -1411,6 +1411,7 @@ public:
|
|||
|
||||
const gimple *get_stmt () const { return m_stmt; }
|
||||
const region *get_id_region () const { return m_id_reg; }
|
||||
bool lhs_value_p () const;
|
||||
|
||||
private:
|
||||
const gimple *m_stmt;
|
||||
|
|
|
|||
|
|
@ -16,8 +16,7 @@ void test_2 (void)
|
|||
free (ptr);
|
||||
|
||||
/* { dg-warning "allocated buffer size is not a multiple of the pointee's size \\\[CWE-131\\\]" "warning" { target *-*-* } malloc2 } */
|
||||
/* { dg-message "42 bytes" "note" { target *-*-* } malloc2 } */
|
||||
/* { dg-message "'int32_t \\*' (\\\{aka '(long )?int \\*'\\\})? here; 'sizeof \\(int32_t (\\\{aka (long )?int\\\})?\\)' is '4'" "note" { target *-*-* } malloc2 } */
|
||||
/* { dg-message "allocated 42 bytes and assigned to 'int32_t \\*' (\\\{aka '(long )?int \\*'\\\})? here; 'sizeof \\(int32_t (\\\{aka (long )?int\\\})?\\)' is '4'" "note" { target *-*-* } malloc2 } */
|
||||
}
|
||||
|
||||
void test_3 (void)
|
||||
|
|
|
|||
|
|
@ -19,8 +19,7 @@ void test_2 (int32_t n)
|
|||
free (ptr);
|
||||
|
||||
/* { dg-warning "allocated buffer size is not a multiple of the pointee's size \\\[CWE-131\\\]" "warning" { target *-*-* } malloc2 } */
|
||||
/* { dg-message "'\[a-z0-9\\*\\(\\)\\s\]*' bytes" "note" { target *-*-* } malloc2 } */
|
||||
/* { dg-message "'int32_t \\*' (\\\{aka '(long )?int \\*'\\\})? here; 'sizeof \\(int32_t (\\\{aka (long )?int\\\})?\\)' is '4" "note" { target *-*-* } malloc2 } */
|
||||
/* { dg-message "allocated '\[a-z0-9\\*\\(\\)\\s\]*' bytes and assigned to 'int32_t \\*' (\\\{aka '(long )?int \\*'\\\})? here; 'sizeof \\(int32_t (\\\{aka (long )?int\\\})?\\)' is '4" "note" { target *-*-* } malloc2 } */
|
||||
}
|
||||
|
||||
void test_3 (int32_t n)
|
||||
|
|
|
|||
|
|
@ -20,8 +20,7 @@ void test_1 (void)
|
|||
free (id_sequence);
|
||||
|
||||
/* { dg-warning "allocated buffer size is not a multiple of the pointee's size \\\[CWE-131\\\]" "warning" { target *-*-* } malloc1 } */
|
||||
/* { dg-message "3 bytes" "note" { target *-*-* } malloc1 } */
|
||||
/* { dg-message "'int32_t \\*' (\\\{aka '(long )?int \\*'\\\})? here; 'sizeof \\(int32_t (\\\{aka (long )?int\\\})?\\)' is '4'" "note" { target *-*-* } malloc1 } */
|
||||
/* { dg-message "allocated 3 bytes and assigned to 'int32_t \\*' (\\\{aka '(long )?int \\*'\\\})? here; 'sizeof \\(int32_t (\\\{aka (long )?int\\\})?\\)' is '4'" "note" { target *-*-* } malloc1 } */
|
||||
}
|
||||
|
||||
void test_2 (void)
|
||||
|
|
@ -30,8 +29,7 @@ void test_2 (void)
|
|||
free (ptr);
|
||||
|
||||
/* { dg-warning "allocated buffer size is not a multiple of the pointee's size \\\[CWE-131\\\]" "warning" { target *-*-* } malloc2 } */
|
||||
/* { dg-message "14 bytes" "note" { target *-*-* } malloc2 } */
|
||||
/* { dg-message "'int32_t \\*' (\\\{aka '(long )?int \\*'\\\})? here; 'sizeof \\(int32_t (\\\{aka (long )?int\\\})?\\)' is '4'" "note" { target *-*-* } malloc2 } */
|
||||
/* { dg-message "allocated 14 bytes and assigned to 'int32_t \\*' (\\\{aka '(long )?int \\*'\\\})? here; 'sizeof \\(int32_t (\\\{aka (long )?int\\\})?\\)' is '4'" "note" { target *-*-* } malloc2 } */
|
||||
}
|
||||
|
||||
void test_3 (int32_t n)
|
||||
|
|
@ -40,8 +38,7 @@ void test_3 (int32_t n)
|
|||
free (ptr);
|
||||
|
||||
/* { dg-warning "allocated buffer size is not a multiple of the pointee's size \\\[CWE-131\\\]" "warning" { target *-*-* } malloc3 } */
|
||||
/* { dg-message "'\[a-z0-9\\+\\(\\)\\s\]*' bytes" "note" { target *-*-* } malloc3 } */
|
||||
/* { dg-message "'int32_t \\*' (\\\{aka '(long )?int \\*'\\\})? here; 'sizeof \\(int32_t (\\\{aka (long )?int\\\})?\\)' is '4'" "note" { target *-*-* } malloc3 } */
|
||||
/* { dg-message "allocated '\[a-z0-9\\+\\(\\)\\s\]*' bytes and assigned to 'int32_t \\*' (\\\{aka '(long )?int \\*'\\\})? here; 'sizeof \\(int32_t (\\\{aka (long )?int\\\})?\\)' is '4'" "note" { target *-*-* } malloc3 } */
|
||||
}
|
||||
|
||||
void test_4 (int32_t n, int32_t m)
|
||||
|
|
|
|||
|
|
@ -30,8 +30,7 @@ void test_2 (void)
|
|||
free (ptr);
|
||||
|
||||
/* { dg-warning "allocated buffer size is not a multiple of the pointee's size \\\[CWE-131\\\]" "warning" { target *-*-* } malloc2 } */
|
||||
/* { dg-message "\\d+ bytes" "note" { target *-*-* } malloc2 } */
|
||||
/* { dg-message "'int32_t \\*' (\\\{aka '(long )?int \\*'\\\})? here; 'sizeof \\(int32_t (\\\{aka (long )?int\\\})?\\)' is '4'" "note" { target *-*-* } malloc2 } */
|
||||
/* { dg-message "allocated \\d+ bytes and assigned to 'int32_t \\*' (\\\{aka '(long )?int \\*'\\\})? here; 'sizeof \\(int32_t (\\\{aka (long )?int\\\})?\\)' is '4'" "note" { target *-*-* } malloc2 } */
|
||||
}
|
||||
|
||||
void test_3 (void)
|
||||
|
|
@ -56,6 +55,5 @@ void test_5 (void)
|
|||
free (ptr);
|
||||
|
||||
/* { dg-warning "allocated buffer size is not a multiple of the pointee's size \\\[CWE-131\\\]" "warning" { target *-*-* } malloc5 } */
|
||||
/* { dg-message "allocated 1 byte here" "note" { target *-*-* } malloc5 } */
|
||||
/* { dg-message "'struct base \\*' here; 'sizeof \\(struct base\\)' is '\\d+'" "note" { target *-*-* } malloc5 } */
|
||||
/* { dg-message "allocated 1 bytes and assigned to 'struct base \\*' here; 'sizeof \\(struct base\\)' is '\\d+'" "note" { target *-*-* } malloc5 } */
|
||||
}
|
||||
|
|
|
|||
|
|
@ -11,13 +11,12 @@ void test_constant_1 (void)
|
|||
/* { dg-begin-multiline-output "" }
|
||||
int32_t *ptr = __builtin_malloc (1);
|
||||
^~~~~~~~~~~~~~~~~~~~
|
||||
'test_constant_1': events 1-2
|
||||
'test_constant_1': event 1
|
||||
|
|
||||
| int32_t *ptr = __builtin_malloc (1);
|
||||
| ^~~~~~~~~~~~~~~~~~~~
|
||||
| |
|
||||
| (1) allocated 1 byte here
|
||||
| (2) assigned to 'int32_t *'
|
||||
| (1) allocated 1 bytes and assigned to 'int32_t *' {aka 'int *'} here; 'sizeof (int32_t {aka int})' is '4'
|
||||
|
|
||||
{ dg-end-multiline-output "" } */
|
||||
|
||||
|
|
@ -30,13 +29,12 @@ void test_constant_2 (void)
|
|||
/* { dg-begin-multiline-output "" }
|
||||
int32_t *ptr = __builtin_malloc (2);
|
||||
^~~~~~~~~~~~~~~~~~~~
|
||||
'test_constant_2': events 1-2
|
||||
'test_constant_2': event 1
|
||||
|
|
||||
| int32_t *ptr = __builtin_malloc (2);
|
||||
| ^~~~~~~~~~~~~~~~~~~~
|
||||
| |
|
||||
| (1) allocated 2 bytes here
|
||||
| (2) assigned to 'int32_t *'
|
||||
| (1) allocated 2 bytes and assigned to 'int32_t *' {aka 'int *'} here; 'sizeof (int32_t {aka int})' is '4'
|
||||
|
|
||||
{ dg-end-multiline-output "" } */
|
||||
|
||||
|
|
@ -54,6 +52,6 @@ void test_symbolic (int n)
|
|||
| int32_t *ptr = __builtin_malloc (n * 2);
|
||||
| ^~~~~~~~~~~~~~~~~~~~~~~~
|
||||
| |
|
||||
| (1) allocated 'n * 2' bytes and assigned to 'int32_t *'
|
||||
| (1) allocated 'n * 2' bytes and assigned to 'int32_t *' {aka 'int *'} here; 'sizeof (int32_t {aka int})' is '4'
|
||||
|
|
||||
{ dg-end-multiline-output "" } */
|
||||
|
|
|
|||
|
|
@ -11,13 +11,12 @@ void test_constant_1 (void)
|
|||
/* { dg-begin-multiline-output "" }
|
||||
int32_t *ptr = __builtin_alloca (1);
|
||||
^~~~~~~~~~~~~~~~~~~~
|
||||
'test_constant_1': events 1-2
|
||||
'test_constant_1': event 1
|
||||
|
|
||||
| int32_t *ptr = __builtin_alloca (1);
|
||||
| ^~~~~~~~~~~~~~~~~~~~
|
||||
| |
|
||||
| (1) allocated 1 byte here
|
||||
| (2) assigned to 'int32_t *'
|
||||
| (1) allocated 1 bytes and assigned to 'int32_t *' {aka 'int *'} here; 'sizeof (int32_t {aka int})' is '4'
|
||||
|
|
||||
{ dg-end-multiline-output "" } */
|
||||
|
||||
|
|
@ -29,13 +28,12 @@ void test_constant_2 (void)
|
|||
/* { dg-begin-multiline-output "" }
|
||||
int32_t *ptr = __builtin_alloca (2);
|
||||
^~~~~~~~~~~~~~~~~~~~
|
||||
'test_constant_2': events 1-2
|
||||
'test_constant_2': event 1
|
||||
|
|
||||
| int32_t *ptr = __builtin_alloca (2);
|
||||
| ^~~~~~~~~~~~~~~~~~~~
|
||||
| |
|
||||
| (1) allocated 2 bytes here
|
||||
| (2) assigned to 'int32_t *'
|
||||
| (1) allocated 2 bytes and assigned to 'int32_t *' {aka 'int *'} here; 'sizeof (int32_t {aka int})' is '4'
|
||||
|
|
||||
{ dg-end-multiline-output "" } */
|
||||
|
||||
|
|
@ -47,13 +45,12 @@ void test_symbolic (int n)
|
|||
/* { dg-begin-multiline-output "" }
|
||||
int32_t *ptr = __builtin_alloca (n * 2);
|
||||
^~~~~~~~~~~~~~~~~~~~~~~~
|
||||
'test_symbolic': events 1-2
|
||||
'test_symbolic': event 1
|
||||
|
|
||||
| int32_t *ptr = __builtin_alloca (n * 2);
|
||||
| ^~~~~~~~~~~~~~~~~~~~~~~~
|
||||
| |
|
||||
| (1) allocated 'n * 2' bytes here
|
||||
| (2) assigned to 'int32_t *'
|
||||
| (1) allocated 'n * 2' bytes and assigned to 'int32_t *' {aka 'int *'} here; 'sizeof (int32_t {aka int})' is '4'
|
||||
|
|
||||
{ dg-end-multiline-output "" } */
|
||||
|
||||
|
|
|
|||
|
|
@ -15,13 +15,12 @@ void test_constant_99 (void)
|
|||
/* { dg-begin-multiline-output "" }
|
||||
int32_t *ptr = alloca (99);
|
||||
^~~~~~
|
||||
'test_constant_99': events 1-2
|
||||
'test_constant_99': event 1
|
||||
|
|
||||
| int32_t *ptr = alloca (99);
|
||||
| ^~~~~~
|
||||
| |
|
||||
| (1) allocated 99 bytes here
|
||||
| (2) assigned to 'int32_t *' {aka '{re:long :re?}int *'} here; 'sizeof (int32_t {aka {re:long :re?}int})' is '4'
|
||||
| (1) allocated 99 bytes and assigned to 'int32_t *' {aka 'int *'} here; 'sizeof (int32_t {aka int})' is '4'
|
||||
|
|
||||
{ dg-end-multiline-output "" } */
|
||||
|
||||
|
|
@ -33,12 +32,11 @@ void test_symbolic (int n)
|
|||
/* { dg-begin-multiline-output "" }
|
||||
int32_t *ptr = alloca (n * 2);
|
||||
^~~~~~
|
||||
'test_symbolic': events 1-2
|
||||
'test_symbolic': event 1
|
||||
|
|
||||
| int32_t *ptr = alloca (n * 2);
|
||||
| ^~~~~~
|
||||
| |
|
||||
| (1) allocated 'n * 2' bytes here
|
||||
| (2) assigned to 'int32_t *' {aka '{re:long :re?}int *'} here; 'sizeof (int32_t {aka {re:long :re?}int})' is '4'
|
||||
| (1) allocated 'n * 2' bytes and assigned to 'int32_t *' {aka 'int *'} here; 'sizeof (int32_t {aka int})' is '4'
|
||||
|
|
||||
{ dg-end-multiline-output "" } */
|
||||
|
|
|
|||
81
gcc/testsuite/gcc.dg/analyzer/attr-alloc_size-1.c
Normal file
81
gcc/testsuite/gcc.dg/analyzer/attr-alloc_size-1.c
Normal file
|
|
@ -0,0 +1,81 @@
|
|||
#include "analyzer-decls.h"
|
||||
|
||||
typedef __SIZE_TYPE__ size_t;
|
||||
|
||||
extern void* (*my_alloc)(size_t) __attribute__ ((alloc_size (1)));
|
||||
extern void* (*my_alloc_2)(size_t, size_t) __attribute__ ((alloc_size (1, 2)));
|
||||
|
||||
int test_one_arg_concrete_int_ptr (void)
|
||||
{
|
||||
int *x = my_alloc (1); /* { dg-warning "allocated buffer size is not a multiple of the pointee's size" } */
|
||||
__analyzer_dump_capacity (x); /* { dg-warning "capacity: '\\(\[^\n\r\]*\\)1'" } */
|
||||
x[0] = 0; /* { dg-warning "buffer overflow" } */
|
||||
return 0;
|
||||
}
|
||||
|
||||
void test_one_arg_concrete (void)
|
||||
{
|
||||
char *p = my_alloc (10);
|
||||
__analyzer_dump_capacity (p); /* { dg-warning "capacity: '\\(\[^\n\r\]*\\)10'" } */
|
||||
p[0] = 'a';
|
||||
p[9] = 'b';
|
||||
p[10] = 'c'; /* { dg-warning "buffer overflow" } */
|
||||
p[11] = 'c'; /* { dg-warning "buffer overflow" } */
|
||||
}
|
||||
|
||||
void test_one_arg_symbolic (size_t sz)
|
||||
{
|
||||
char *p = my_alloc (sz);
|
||||
__analyzer_dump_capacity (p); /* { dg-warning "capacity: 'INIT_VAL\\(sz" } */
|
||||
}
|
||||
|
||||
void test_two_args_concrete (void)
|
||||
{
|
||||
char *p = my_alloc_2 (2, 5);
|
||||
__analyzer_dump_capacity (p); /* { dg-warning "capacity: '\\(\[^\n\r\]*\\)10'" } */
|
||||
p[0] = 'a';
|
||||
p[9] = 'b';
|
||||
p[10] = 'c'; /* { dg-warning "buffer overflow" } */
|
||||
p[11] = 'c'; /* { dg-warning "buffer overflow" } */
|
||||
}
|
||||
|
||||
void test_two_args_symbolic_first (size_t sz)
|
||||
{
|
||||
char *p = my_alloc_2 (sz, 5);
|
||||
__analyzer_dump_capacity (p); /* { dg-warning "capacity: '\\(INIT_VAL\\(sz\[^\n\r\]*\\*\\(size_t\\)5\\)'" } */
|
||||
}
|
||||
|
||||
void test_two_args_symbolic_second (size_t sz)
|
||||
{
|
||||
char *p = my_alloc_2 (5, sz);
|
||||
__analyzer_dump_capacity (p); /* { dg-warning "capacity: '\\(INIT_VAL\\(sz\[^\n\r\]*\\*\\(size_t\\)5\\)'" } */
|
||||
}
|
||||
|
||||
void test_two_args_symbolic_both (size_t a, size_t b)
|
||||
{
|
||||
char *p = my_alloc_2 (a, b);
|
||||
__analyzer_dump_capacity (p); /* { dg-warning "capacity: '\\(INIT_VAL\\(a\[^\n\r\]*\\*INIT_VAL\\(b" } */
|
||||
}
|
||||
|
||||
typedef void* (*my_alloc_t)(size_t) __attribute__ ((alloc_size (1)));
|
||||
typedef void* (*my_alloc_2_t)(size_t, size_t) __attribute__ ((alloc_size (1, 2)));
|
||||
|
||||
void test_one_arg_concrete_fnptr (my_alloc_t fnptr)
|
||||
{
|
||||
char *p = fnptr (10);
|
||||
__analyzer_dump_capacity (p); /* { dg-warning "capacity: '\\(\[^\n\r\]*\\)10'" } */
|
||||
p[0] = 'a';
|
||||
p[9] = 'b';
|
||||
p[10] = 'c'; /* { dg-warning "buffer overflow" } */
|
||||
p[11] = 'c'; /* { dg-warning "buffer overflow" } */
|
||||
}
|
||||
|
||||
void test_two_args_concrete_fnptr (my_alloc_2_t fnptr)
|
||||
{
|
||||
char *p = fnptr (2, 5);
|
||||
__analyzer_dump_capacity (p); /* { dg-warning "capacity: '\\(\[^\n\r\]*\\)10'" } */
|
||||
p[0] = 'a';
|
||||
p[9] = 'b';
|
||||
p[10] = 'c'; /* { dg-warning "buffer overflow" } */
|
||||
p[11] = 'c'; /* { dg-warning "buffer overflow" } */
|
||||
}
|
||||
19
gcc/testsuite/gcc.dg/analyzer/attr-alloc_size-2.c
Normal file
19
gcc/testsuite/gcc.dg/analyzer/attr-alloc_size-2.c
Normal file
|
|
@ -0,0 +1,19 @@
|
|||
typedef signed long idx_t;
|
||||
|
||||
void *xirealloc (void *p, idx_t s)
|
||||
__attribute__ ((__alloc_size__ (2))) __attribute__ ((__returns_nonnull__));
|
||||
|
||||
char *
|
||||
test_cast_1 (char *buf, idx_t buf_count)
|
||||
{
|
||||
return xirealloc (buf, buf_count + 1);
|
||||
}
|
||||
|
||||
void *alloc_cast_2 (signed char x, signed char y)
|
||||
__attribute__ ((__alloc_size__ (1, 2)));
|
||||
|
||||
void *
|
||||
test_cast_2 (signed char a, signed char b)
|
||||
{
|
||||
return alloc_cast_2 (a + 1, b + 1);
|
||||
}
|
||||
14
gcc/testsuite/gcc.dg/analyzer/attr-alloc_size-3.c
Normal file
14
gcc/testsuite/gcc.dg/analyzer/attr-alloc_size-3.c
Normal file
|
|
@ -0,0 +1,14 @@
|
|||
typedef long int idx_t;
|
||||
extern void rpl_free (void *ptr);
|
||||
|
||||
void *xicalloc (idx_t n, idx_t s)
|
||||
__attribute__ ((__malloc__))
|
||||
__attribute__ ((__malloc__ (rpl_free, 1)))
|
||||
__attribute__ ((__alloc_size__ (1, 2)))
|
||||
__attribute__ ((__returns_nonnull__));
|
||||
|
||||
void *
|
||||
xizalloc (idx_t s)
|
||||
{
|
||||
return xicalloc (s, 1);
|
||||
}
|
||||
157
gcc/testsuite/gcc.dg/analyzer/explode-4.c
Normal file
157
gcc/testsuite/gcc.dg/analyzer/explode-4.c
Normal file
|
|
@ -0,0 +1,157 @@
|
|||
/* Regression test for state explosion seen whilst implementing
|
||||
PR analyzer/110426, involving an explosion in the number of
|
||||
conjured_svalues whilst handling a long chain of external
|
||||
function calls. */
|
||||
|
||||
/* { dg-additional-options "-Wno-implicit-function-declaration -Wno-int-conversion -Wno-analyzer-too-complex" } */
|
||||
|
||||
#define NULL ((void *)0)
|
||||
typedef unsigned char uint8_t;
|
||||
typedef unsigned short int uint16_t;
|
||||
typedef unsigned int uint32_t;
|
||||
typedef struct Error Error;
|
||||
typedef struct QEMUTimer QEMUTimer;
|
||||
enum libusb_class_code {
|
||||
LIBUSB_CLASS_PER_INTERFACE = 0x00,
|
||||
};
|
||||
struct libusb_device_descriptor {};
|
||||
struct libusb_endpoint_descriptor {
|
||||
uint8_t bEndpointAddress;
|
||||
uint8_t bmAttributes;
|
||||
};
|
||||
struct libusb_interface_descriptor {
|
||||
uint8_t bNumEndpoints;
|
||||
const struct libusb_endpoint_descriptor *endpoint;
|
||||
};
|
||||
struct libusb_interface {
|
||||
const struct libusb_interface_descriptor *altsetting;
|
||||
};
|
||||
struct libusb_config_descriptor {
|
||||
uint8_t bNumInterfaces;
|
||||
const struct libusb_interface *interface;
|
||||
};
|
||||
typedef struct libusb_context libusb_context;
|
||||
typedef struct libusb_device libusb_device;
|
||||
typedef struct libusb_device_handle libusb_device_handle;
|
||||
enum libusb_speed {
|
||||
LIBUSB_SUCCESS = 0,
|
||||
LIBUSB_TRANSFER_TYPE_BULK = 2U,
|
||||
};
|
||||
typedef struct USBDevice USBDevice;
|
||||
typedef struct USBHostDevice USBHostDevice;
|
||||
struct USBAutoFilter {
|
||||
uint32_t bus_num;
|
||||
};
|
||||
struct USBHostDevice {
|
||||
struct USBAutoFilter match;
|
||||
struct USBHostDevice *tqe_next;
|
||||
int bus_num;
|
||||
int addr;
|
||||
char port[16];
|
||||
libusb_device *dev;
|
||||
libusb_device_handle *dh;
|
||||
struct libusb_device_descriptor ddesc;
|
||||
};
|
||||
static union { struct USBHostDevice *tqh_first; } hostdevs = {};
|
||||
static libusb_context *ctx;
|
||||
static void usb_host_ep_update(USBHostDevice *s) {
|
||||
static const char *tname[] = {};
|
||||
USBDevice *udev = USB_DEVICE(s);
|
||||
struct libusb_config_descriptor *conf;
|
||||
const struct libusb_interface_descriptor *intf;
|
||||
const struct libusb_endpoint_descriptor *endp;
|
||||
struct libusb_ss_endpoint_companion_descriptor *endp_ss_comp;
|
||||
uint8_t devep, type;
|
||||
int ep;
|
||||
int rc, i, e;
|
||||
usb_ep_reset(udev);
|
||||
rc = libusb_get_active_config_descriptor(s->dev, &conf);
|
||||
for (i = 0; i < conf->bNumInterfaces; i++) {
|
||||
intf = &conf->interface[i].altsetting[0];
|
||||
trace_usb_host_parse_interface();
|
||||
for (e = 0; e < intf->bNumEndpoints; e++) {
|
||||
endp = &intf->endpoint[e];
|
||||
devep = endp->bEndpointAddress;
|
||||
ep = devep & 0xf;
|
||||
type = endp->bmAttributes & 0x3;
|
||||
if (usb_ep_get_type(udev) != 255) {
|
||||
trace_usb_host_parse_error();
|
||||
}
|
||||
trace_usb_host_parse_endpoint(s->bus_num, s->addr);
|
||||
usb_ep_set_max_packet_size(udev);
|
||||
usb_ep_set_type(udev);
|
||||
usb_ep_set_ifnum(udev);
|
||||
usb_ep_set_halted(udev);
|
||||
if (type == LIBUSB_TRANSFER_TYPE_BULK &&
|
||||
libusb_get_ss_endpoint_companion_descriptor(
|
||||
ctx, endp, &endp_ss_comp) == LIBUSB_SUCCESS) {
|
||||
usb_ep_set_max_streams(udev);
|
||||
libusb_free_ss_endpoint_companion_descriptor(endp_ss_comp);
|
||||
}
|
||||
}
|
||||
}
|
||||
}
|
||||
static int usb_host_open(USBHostDevice *s, libusb_device *dev, int hostfd) {
|
||||
USBDevice *udev = USB_DEVICE(s);
|
||||
int bus_num = 0;
|
||||
int addr = 0;
|
||||
Error *local_err = NULL;
|
||||
if (dev) {
|
||||
bus_num = libusb_get_bus_number(dev);
|
||||
addr = libusb_get_device_address(dev);
|
||||
trace_usb_host_open_started(bus_num, addr);
|
||||
libusb_open(dev, &s->dh);
|
||||
trace_usb_host_open_hostfd(hostfd);
|
||||
libusb_wrap_sys_device(ctx, &s->dh);
|
||||
dev = libusb_get_device(s->dh);
|
||||
bus_num = libusb_get_bus_number(dev);
|
||||
addr = libusb_get_device_address(dev);
|
||||
}
|
||||
usb_host_detach_kernel(s);
|
||||
libusb_get_device_descriptor(dev, &s->ddesc);
|
||||
usb_host_get_port(s->dev, s->port, sizeof(s->port));
|
||||
usb_ep_init(udev);
|
||||
usb_host_ep_update(s);
|
||||
libusb_get_device_speed(dev);
|
||||
usb_device_attach(udev, &local_err);
|
||||
if (local_err) {
|
||||
error_report_err(local_err);
|
||||
goto fail;
|
||||
}
|
||||
return 0;
|
||||
fail:
|
||||
trace_usb_host_open_failure();
|
||||
if (s->dh != NULL) {
|
||||
usb_host_release_interfaces(s);
|
||||
libusb_reset_device(s->dh);
|
||||
usb_host_attach_kernel(s);
|
||||
}
|
||||
}
|
||||
static QEMUTimer *usb_auto_timer;
|
||||
static void usb_host_vm_state(void *unused, _Bool running) {}
|
||||
static void usb_host_auto_check(void *unused) {
|
||||
struct USBHostDevice *s;
|
||||
struct USBAutoFilter *f;
|
||||
libusb_device **devs = NULL;
|
||||
struct libusb_device_descriptor ddesc;
|
||||
int i, n;
|
||||
if (usb_host_init() != 0) {
|
||||
n = libusb_get_device_list(ctx, &devs);
|
||||
for (i = 0; i < n; i++) {
|
||||
if (libusb_get_device_descriptor(devs[i], &ddesc) != 0) {
|
||||
}
|
||||
for ((s) = ((&hostdevs)->tqh_first); (s); (s) = ((s)->tqe_next)) {
|
||||
f = &s->match;
|
||||
if (f->bus_num > 0 && f->bus_num != libusb_get_bus_number(devs[i])) {
|
||||
}
|
||||
if (usb_host_open(s, devs[i], 0) < 0) {
|
||||
}
|
||||
}
|
||||
}
|
||||
libusb_free_device_list(devs, 1);
|
||||
qemu_add_vm_change_state_handler(usb_host_vm_state, NULL);
|
||||
timer_new_ms(usb_host_auto_check, NULL);
|
||||
trace_usb_host_auto_scan_enabled();
|
||||
}
|
||||
timer_mod(usb_auto_timer, qemu_clock_get_ms() + 2000);
|
||||
}
|
||||
|
|
@ -39,3 +39,13 @@ test_2 (size_t sz)
|
|||
{
|
||||
memcpy (buf, buf2, sz); /* { dg-warning "use of attacker-controlled value 'sz' as size without upper-bounds checking" } */
|
||||
}
|
||||
|
||||
/* __attribute__ alloc_size with tainted size. */
|
||||
|
||||
extern void* (*my_alloc)(size_t) __attribute__ ((alloc_size (1)));
|
||||
|
||||
void * __attribute__((tainted_args))
|
||||
test_attr_alloc_size (size_t sz)
|
||||
{
|
||||
return my_alloc (sz); /* { dg-warning "use of attacker-controlled value 'sz' as allocation size without upper-bounds checking" } */
|
||||
}
|
||||
|
|
|
|||
Loading…
Add table
Reference in a new issue