1 //===-- SimpleStreamChecker.cpp -----------------------------------------*- C++ -*--//
3 // The LLVM Compiler Infrastructure
5 // This file is distributed under the University of Illinois Open Source
6 // License. See LICENSE.TXT for details.
8 //===----------------------------------------------------------------------===//
10 // Defines a checker for proper use of fopen/fclose APIs.
11 // - If a file has been closed with fclose, it should not be accessed again.
12 // Accessing a closed file results in undefined behavior.
13 // - If a file was opened with fopen, it must be closed with fclose before
14 // the execution ends. Failing to do so results in a resource leak.
16 //===----------------------------------------------------------------------===//
18 #include "ClangSACheckers.h"
19 #include "clang/StaticAnalyzer/Core/Checker.h"
20 #include "clang/StaticAnalyzer/Core/BugReporter/BugType.h"
21 #include "clang/StaticAnalyzer/Core/PathSensitive/CallEvent.h"
22 #include "clang/StaticAnalyzer/Core/PathSensitive/CheckerContext.h"
24 using namespace clang;
28 typedef llvm::SmallVector<SymbolRef, 2> SymbolVector;
32 enum Kind { Opened, Closed } K;
33 StreamState(Kind InK) : K(InK) { }
36 bool isOpened() const { return K == Opened; }
37 bool isClosed() const { return K == Closed; }
39 static StreamState getOpened() { return StreamState(Opened); }
40 static StreamState getClosed() { return StreamState(Closed); }
42 bool operator==(const StreamState &X) const {
45 void Profile(llvm::FoldingSetNodeID &ID) const {
50 class SimpleStreamChecker : public Checker<check::PostCall,
54 check::RegionChanges> {
56 mutable IdentifierInfo *IIfopen, *IIfclose;
58 OwningPtr<BugType> DoubleCloseBugType;
59 OwningPtr<BugType> LeakBugType;
61 void initIdentifierInfo(ASTContext &Ctx) const;
63 void reportDoubleClose(SymbolRef FileDescSym,
64 const CallEvent &Call,
65 CheckerContext &C) const;
67 void reportLeaks(SymbolVector LeakedStreams,
69 ExplodedNode *ErrNode) const;
71 bool guaranteedNotToCloseFile(const CallEvent &Call) const;
74 SimpleStreamChecker();
77 void checkPostCall(const CallEvent &Call, CheckerContext &C) const;
79 void checkPreCall(const CallEvent &Call, CheckerContext &C) const;
81 void checkDeadSymbols(SymbolReaper &SymReaper, CheckerContext &C) const;
83 /// Deal with symbol escape as a byproduct of a bind.
84 void checkBind(SVal location, SVal val, const Stmt*S,
85 CheckerContext &C) const;
87 /// Deal with symbol escape as a byproduct of a region change.
89 checkRegionChanges(ProgramStateRef state,
90 const StoreManager::InvalidatedSymbols *invalidated,
91 ArrayRef<const MemRegion *> ExplicitRegions,
92 ArrayRef<const MemRegion *> Regions,
93 const CallEvent *Call) const;
94 bool wantsRegionChangeUpdate(ProgramStateRef state) const {
99 } // end anonymous namespace
101 /// The state of the checker is a map from tracked stream symbols to their
102 /// state. Let's store it in the ProgramState.
103 REGISTER_MAP_WITH_PROGRAMSTATE(StreamMap, SymbolRef, StreamState)
106 class StopTrackingCallback : public SymbolVisitor {
107 ProgramStateRef state;
109 StopTrackingCallback(ProgramStateRef st) : state(st) {}
110 ProgramStateRef getState() const { return state; }
112 bool VisitSymbol(SymbolRef sym) {
113 state = state->remove<StreamMap>(sym);
117 } // end anonymous namespace
120 SimpleStreamChecker::SimpleStreamChecker() : IIfopen(0), IIfclose(0) {
121 // Initialize the bug types.
122 DoubleCloseBugType.reset(new BugType("Double fclose",
123 "Unix Stream API Error"));
125 LeakBugType.reset(new BugType("Resource Leak",
126 "Unix Stream API Error"));
127 // Sinks are higher importance bugs as well as calls to assert() or exit(0).
128 LeakBugType->setSuppressOnSink(true);
131 void SimpleStreamChecker::checkPostCall(const CallEvent &Call,
132 CheckerContext &C) const {
133 initIdentifierInfo(C.getASTContext());
135 if (!Call.isGlobalCFunction())
138 if (Call.getCalleeIdentifier() != IIfopen)
141 // Get the symbolic value corresponding to the file handle.
142 SymbolRef FileDesc = Call.getReturnValue().getAsSymbol();
146 // Generate the next transition (an edge in the exploded graph).
147 ProgramStateRef State = C.getState();
148 State = State->set<StreamMap>(FileDesc, StreamState::getOpened());
149 C.addTransition(State);
152 void SimpleStreamChecker::checkPreCall(const CallEvent &Call,
153 CheckerContext &C) const {
154 initIdentifierInfo(C.getASTContext());
156 if (!Call.isGlobalCFunction())
159 if (Call.getCalleeIdentifier() != IIfclose)
162 if (Call.getNumArgs() != 1)
165 // Get the symbolic value corresponding to the file handle.
166 SymbolRef FileDesc = Call.getArgSVal(0).getAsSymbol();
170 // Check if the stream has already been closed.
171 ProgramStateRef State = C.getState();
172 const StreamState *SS = State->get<StreamMap>(FileDesc);
173 if (SS && SS->isClosed()) {
174 reportDoubleClose(FileDesc, Call, C);
178 // Generate the next transition, in which the stream is closed.
179 State = State->set<StreamMap>(FileDesc, StreamState::getClosed());
180 C.addTransition(State);
183 static bool isLeaked(SymbolRef Sym, const StreamState &SS,
184 bool IsSymDead, ProgramStateRef State) {
185 if (IsSymDead && SS.isOpened()) {
186 // If a symbol is NULL, assume that fopen failed on this path.
187 // A symbol should only be considered leaked if it is non-null.
188 ConstraintManager &CMgr = State->getConstraintManager();
189 ConditionTruthVal OpenFailed = CMgr.isNull(State, Sym);
190 return !OpenFailed.isConstrainedTrue();
195 void SimpleStreamChecker::checkDeadSymbols(SymbolReaper &SymReaper,
196 CheckerContext &C) const {
197 ProgramStateRef State = C.getState();
198 SymbolVector LeakedStreams;
199 StreamMapTy TrackedStreams = State->get<StreamMap>();
200 for (StreamMapTy::iterator I = TrackedStreams.begin(),
201 E = TrackedStreams.end(); I != E; ++I) {
202 SymbolRef Sym = I->first;
203 bool IsSymDead = SymReaper.isDead(Sym);
205 // Collect leaked symbols.
206 if (isLeaked(Sym, I->second, IsSymDead, State))
207 LeakedStreams.push_back(Sym);
209 // Remove the dead symbol from the streams map.
211 State = State->remove<StreamMap>(Sym);
214 ExplodedNode *N = C.addTransition(State);
215 reportLeaks(LeakedStreams, C, N);
218 void SimpleStreamChecker::reportDoubleClose(SymbolRef FileDescSym,
219 const CallEvent &Call,
220 CheckerContext &C) const {
221 // We reached a bug, stop exploring the path here by generating a sink.
222 ExplodedNode *ErrNode = C.generateSink();
223 // If we've already reached this node on another path, return.
227 // Generate the report.
228 BugReport *R = new BugReport(*DoubleCloseBugType,
229 "Closing a previously closed file stream", ErrNode);
230 R->addRange(Call.getSourceRange());
231 R->markInteresting(FileDescSym);
235 void SimpleStreamChecker::reportLeaks(SymbolVector LeakedStreams,
237 ExplodedNode *ErrNode) const {
238 // Attach bug reports to the leak node.
239 // TODO: Identify the leaked file descriptor.
240 for (llvm::SmallVector<SymbolRef, 2>::iterator
241 I = LeakedStreams.begin(), E = LeakedStreams.end(); I != E; ++I) {
242 BugReport *R = new BugReport(*LeakBugType,
243 "Opened file is never closed; potential resource leak", ErrNode);
244 R->markInteresting(*I);
249 // Check various ways a symbol can be invalidated.
250 // Stop tracking symbols when a value escapes as a result of checkBind.
251 // A value escapes in three possible cases:
252 // (1) We are binding to something that is not a memory region.
253 // (2) We are binding to a MemRegion that does not have stack storage
254 // (3) We are binding to a MemRegion with stack storage that the store
255 // does not understand.
256 void SimpleStreamChecker::checkBind(SVal loc, SVal val, const Stmt *S,
257 CheckerContext &C) const {
258 // Are we storing to something that causes the value to "escape"?
260 ProgramStateRef state = C.getState();
262 if (loc::MemRegionVal *regionLoc = dyn_cast<loc::MemRegionVal>(&loc)) {
263 escapes = !regionLoc->getRegion()->hasStackStorage();
266 // To test (3), generate a new state with the binding added. If it is
267 // the same state, then it escapes (since the store cannot represent
268 // the binding). Do this only if we know that the store is not supposed
269 // to generate the same state.
270 SVal StoredVal = state->getSVal(regionLoc->getRegion());
271 if (StoredVal != val)
272 escapes = (state == (state->bindLoc(*regionLoc, val)));
276 // If our store can represent the binding and we aren't storing to something
277 // that doesn't have local storage then just return the state and
282 // Otherwise, find all symbols referenced by 'val' that we are tracking
283 // and stop tracking them.
284 state = state->scanReachableSymbols<StopTrackingCallback>(val).getState();
285 C.addTransition(state);
288 bool SimpleStreamChecker::guaranteedNotToCloseFile(const CallEvent &Call) const{
289 // If it's not in a system header, assume it might close a file.
290 if (!Call.isInSystemHeader())
293 // Handle cases where we know a buffer's /address/ can escape.
294 if (Call.argumentsMayEscape())
297 // Note, even though fclose closes the file, we do not list it here
298 // since the checker is modeling the call.
303 // If the symbol we are tracking is invalidated, do not track the symbol as
304 // we cannot reason about it anymore.
306 SimpleStreamChecker::checkRegionChanges(ProgramStateRef State,
307 const StoreManager::InvalidatedSymbols *invalidated,
308 ArrayRef<const MemRegion *> ExplicitRegions,
309 ArrayRef<const MemRegion *> Regions,
310 const CallEvent *Call) const {
312 if (!invalidated || invalidated->empty())
315 // If it's a call which might close the file, we assume that all regions
316 // (explicit and implicit) escaped. Otherwise, whitelist explicit pointers
317 // (the parameters to the call); we still can track them.
318 llvm::SmallPtrSet<SymbolRef, 8> WhitelistedSymbols;
319 if (!Call || guaranteedNotToCloseFile(*Call)) {
320 for (ArrayRef<const MemRegion *>::iterator I = ExplicitRegions.begin(),
321 E = ExplicitRegions.end(); I != E; ++I) {
322 if (const SymbolicRegion *R = (*I)->StripCasts()->getAs<SymbolicRegion>())
323 WhitelistedSymbols.insert(R->getSymbol());
327 for (StoreManager::InvalidatedSymbols::const_iterator I=invalidated->begin(),
328 E = invalidated->end(); I!=E; ++I) {
330 if (WhitelistedSymbols.count(sym))
332 // The symbol escaped. Optimistically, assume that the corresponding file
333 // handle will be closed somewhere else.
334 State = State->remove<StreamMap>(sym);
339 void SimpleStreamChecker::initIdentifierInfo(ASTContext &Ctx) const {
342 IIfopen = &Ctx.Idents.get("fopen");
343 IIfclose = &Ctx.Idents.get("fclose");
346 void ento::registerSimpleStreamChecker(CheckerManager &mgr) {
347 mgr.registerChecker<SimpleStreamChecker>();