1 //==--- MacOSKeychainAPIChecker.cpp ------------------------------*- C++ -*-==//
3 // The LLVM Compiler Infrastructure
5 // This file is distributed under the University of Illinois Open Source
6 // License. See LICENSE.TXT for details.
8 //===----------------------------------------------------------------------===//
9 // This checker flags misuses of KeyChainAPI. In particular, the password data
10 // allocated/returned by SecKeychainItemCopyContent,
11 // SecKeychainFindGenericPassword, SecKeychainFindInternetPassword functions has
12 // to be freed using a call to SecKeychainItemFreeContent.
13 //===----------------------------------------------------------------------===//
15 #include "ClangSACheckers.h"
16 #include "clang/StaticAnalyzer/Core/BugReporter/BugType.h"
17 #include "clang/StaticAnalyzer/Core/Checker.h"
18 #include "clang/StaticAnalyzer/Core/CheckerManager.h"
19 #include "clang/StaticAnalyzer/Core/PathSensitive/CheckerContext.h"
20 #include "clang/StaticAnalyzer/Core/PathSensitive/ProgramState.h"
21 #include "clang/StaticAnalyzer/Core/PathSensitive/ProgramStateTrait.h"
22 #include "llvm/ADT/SmallString.h"
23 #include "llvm/Support/raw_ostream.h"
25 using namespace clang;
29 class MacOSKeychainAPIChecker : public Checker<check::PreStmt<CallExpr>,
30 check::PostStmt<CallExpr>,
33 mutable std::unique_ptr<BugType> BT;
36 /// AllocationState is a part of the checker specific state together with the
37 /// MemRegion corresponding to the allocated data.
38 struct AllocationState {
39 /// The index of the allocator function.
40 unsigned int AllocatorIdx;
43 AllocationState(const Expr *E, unsigned int Idx, SymbolRef R) :
47 bool operator==(const AllocationState &X) const {
48 return (AllocatorIdx == X.AllocatorIdx &&
52 void Profile(llvm::FoldingSetNodeID &ID) const {
53 ID.AddInteger(AllocatorIdx);
54 ID.AddPointer(Region);
58 void checkPreStmt(const CallExpr *S, CheckerContext &C) const;
59 void checkPostStmt(const CallExpr *S, CheckerContext &C) const;
60 void checkDeadSymbols(SymbolReaper &SR, CheckerContext &C) const;
61 ProgramStateRef evalAssume(ProgramStateRef state, SVal Cond,
62 bool Assumption) const;
63 void printState(raw_ostream &Out, ProgramStateRef State,
64 const char *NL, const char *Sep) const;
67 typedef std::pair<SymbolRef, const AllocationState*> AllocationPair;
68 typedef SmallVector<AllocationPair, 2> AllocationPairVec;
71 /// Denotes functions tracked by this checker.
73 /// The functions commonly/mistakenly used in place of the given API.
75 /// The functions which may allocate the data. These are tracked to reduce
76 /// the false alarm rate.
79 /// Stores the information about the allocator and deallocator functions -
80 /// these are the functions the checker is tracking.
81 struct ADFunctionInfo {
84 unsigned int DeallocatorIdx;
87 static const unsigned InvalidIdx = 100000;
88 static const unsigned FunctionsToTrackSize = 8;
89 static const ADFunctionInfo FunctionsToTrack[FunctionsToTrackSize];
90 /// The value, which represents no error return value for allocator functions.
91 static const unsigned NoErr = 0;
93 /// Given the function name, returns the index of the allocator/deallocator
95 static unsigned getTrackedFunctionIndex(StringRef Name, bool IsAllocator);
97 inline void initBugType() const {
99 BT.reset(new BugType(this, "Improper use of SecKeychain API",
100 "API Misuse (Apple)"));
103 void generateDeallocatorMismatchReport(const AllocationPair &AP,
105 CheckerContext &C) const;
107 /// Find the allocation site for Sym on the path leading to the node N.
108 const ExplodedNode *getAllocationNode(const ExplodedNode *N, SymbolRef Sym,
109 CheckerContext &C) const;
111 std::unique_ptr<BugReport> generateAllocatedDataNotReleasedReport(
112 const AllocationPair &AP, ExplodedNode *N, CheckerContext &C) const;
114 /// Mark an AllocationPair interesting for diagnostic reporting.
115 void markInteresting(BugReport *R, const AllocationPair &AP) const {
116 R->markInteresting(AP.first);
117 R->markInteresting(AP.second->Region);
120 /// The bug visitor which allows us to print extra diagnostics along the
121 /// BugReport path. For example, showing the allocation site of the leaked
123 class SecKeychainBugVisitor
124 : public BugReporterVisitorImpl<SecKeychainBugVisitor> {
126 // The allocated region symbol tracked by the main analysis.
130 SecKeychainBugVisitor(SymbolRef S) : Sym(S) {}
132 void Profile(llvm::FoldingSetNodeID &ID) const override {
138 std::shared_ptr<PathDiagnosticPiece> VisitNode(const ExplodedNode *N,
139 const ExplodedNode *PrevN,
140 BugReporterContext &BRC,
141 BugReport &BR) override;
146 /// ProgramState traits to store the currently allocated (and not yet freed)
147 /// symbols. This is a map from the allocated content symbol to the
148 /// corresponding AllocationState.
149 REGISTER_MAP_WITH_PROGRAMSTATE(AllocatedData,
151 MacOSKeychainAPIChecker::AllocationState)
153 static bool isEnclosingFunctionParam(const Expr *E) {
154 E = E->IgnoreParenCasts();
155 if (const DeclRefExpr *DRE = dyn_cast<DeclRefExpr>(E)) {
156 const ValueDecl *VD = DRE->getDecl();
157 if (isa<ImplicitParamDecl>(VD) || isa<ParmVarDecl>(VD))
163 const MacOSKeychainAPIChecker::ADFunctionInfo
164 MacOSKeychainAPIChecker::FunctionsToTrack[FunctionsToTrackSize] = {
165 {"SecKeychainItemCopyContent", 4, 3, ValidAPI}, // 0
166 {"SecKeychainFindGenericPassword", 6, 3, ValidAPI}, // 1
167 {"SecKeychainFindInternetPassword", 13, 3, ValidAPI}, // 2
168 {"SecKeychainItemFreeContent", 1, InvalidIdx, ValidAPI}, // 3
169 {"SecKeychainItemCopyAttributesAndData", 5, 5, ValidAPI}, // 4
170 {"SecKeychainItemFreeAttributesAndData", 1, InvalidIdx, ValidAPI}, // 5
171 {"free", 0, InvalidIdx, ErrorAPI}, // 6
172 {"CFStringCreateWithBytesNoCopy", 1, InvalidIdx, PossibleAPI}, // 7
175 unsigned MacOSKeychainAPIChecker::getTrackedFunctionIndex(StringRef Name,
177 for (unsigned I = 0; I < FunctionsToTrackSize; ++I) {
178 ADFunctionInfo FI = FunctionsToTrack[I];
181 // Make sure the function is of the right type (allocator vs deallocator).
182 if (IsAllocator && (FI.DeallocatorIdx == InvalidIdx))
184 if (!IsAllocator && (FI.DeallocatorIdx != InvalidIdx))
189 // The function is not tracked.
193 static bool isBadDeallocationArgument(const MemRegion *Arg) {
196 return isa<AllocaRegion>(Arg) || isa<BlockDataRegion>(Arg) ||
197 isa<TypedRegion>(Arg);
200 /// Given the address expression, retrieve the value it's pointing to. Assume
201 /// that value is itself an address, and return the corresponding symbol.
202 static SymbolRef getAsPointeeSymbol(const Expr *Expr,
204 ProgramStateRef State = C.getState();
205 SVal ArgV = State->getSVal(Expr, C.getLocationContext());
207 if (Optional<loc::MemRegionVal> X = ArgV.getAs<loc::MemRegionVal>()) {
208 StoreManager& SM = C.getStoreManager();
209 SymbolRef sym = SM.getBinding(State->getStore(), *X).getAsLocSymbol();
216 // Report deallocator mismatch. Remove the region from tracking - reporting a
217 // missing free error after this one is redundant.
218 void MacOSKeychainAPIChecker::
219 generateDeallocatorMismatchReport(const AllocationPair &AP,
221 CheckerContext &C) const {
222 ProgramStateRef State = C.getState();
223 State = State->remove<AllocatedData>(AP.first);
224 ExplodedNode *N = C.generateNonFatalErrorNode(State);
229 SmallString<80> sbuf;
230 llvm::raw_svector_ostream os(sbuf);
231 unsigned int PDeallocIdx =
232 FunctionsToTrack[AP.second->AllocatorIdx].DeallocatorIdx;
234 os << "Deallocator doesn't match the allocator: '"
235 << FunctionsToTrack[PDeallocIdx].Name << "' should be used.";
236 auto Report = llvm::make_unique<BugReport>(*BT, os.str(), N);
237 Report->addVisitor(llvm::make_unique<SecKeychainBugVisitor>(AP.first));
238 Report->addRange(ArgExpr->getSourceRange());
239 markInteresting(Report.get(), AP);
240 C.emitReport(std::move(Report));
243 void MacOSKeychainAPIChecker::checkPreStmt(const CallExpr *CE,
244 CheckerContext &C) const {
245 unsigned idx = InvalidIdx;
246 ProgramStateRef State = C.getState();
248 const FunctionDecl *FD = C.getCalleeDecl(CE);
249 if (!FD || FD->getKind() != Decl::Function)
252 StringRef funName = C.getCalleeName(FD);
256 // If it is a call to an allocator function, it could be a double allocation.
257 idx = getTrackedFunctionIndex(funName, true);
258 if (idx != InvalidIdx) {
259 unsigned paramIdx = FunctionsToTrack[idx].Param;
260 if (CE->getNumArgs() <= paramIdx)
263 const Expr *ArgExpr = CE->getArg(paramIdx);
264 if (SymbolRef V = getAsPointeeSymbol(ArgExpr, C))
265 if (const AllocationState *AS = State->get<AllocatedData>(V)) {
266 // Remove the value from the state. The new symbol will be added for
267 // tracking when the second allocator is processed in checkPostStmt().
268 State = State->remove<AllocatedData>(V);
269 ExplodedNode *N = C.generateNonFatalErrorNode(State);
273 SmallString<128> sbuf;
274 llvm::raw_svector_ostream os(sbuf);
275 unsigned int DIdx = FunctionsToTrack[AS->AllocatorIdx].DeallocatorIdx;
276 os << "Allocated data should be released before another call to "
277 << "the allocator: missing a call to '"
278 << FunctionsToTrack[DIdx].Name
280 auto Report = llvm::make_unique<BugReport>(*BT, os.str(), N);
281 Report->addVisitor(llvm::make_unique<SecKeychainBugVisitor>(V));
282 Report->addRange(ArgExpr->getSourceRange());
283 Report->markInteresting(AS->Region);
284 C.emitReport(std::move(Report));
289 // Is it a call to one of deallocator functions?
290 idx = getTrackedFunctionIndex(funName, false);
291 if (idx == InvalidIdx)
294 unsigned paramIdx = FunctionsToTrack[idx].Param;
295 if (CE->getNumArgs() <= paramIdx)
298 // Check the argument to the deallocator.
299 const Expr *ArgExpr = CE->getArg(paramIdx);
300 SVal ArgSVal = State->getSVal(ArgExpr, C.getLocationContext());
302 // Undef is reported by another checker.
303 if (ArgSVal.isUndef())
306 SymbolRef ArgSM = ArgSVal.getAsLocSymbol();
308 // If the argument is coming from the heap, globals, or unknown, do not
310 bool RegionArgIsBad = false;
312 if (!isBadDeallocationArgument(ArgSVal.getAsRegion()))
314 RegionArgIsBad = true;
317 // Is the argument to the call being tracked?
318 const AllocationState *AS = State->get<AllocatedData>(ArgSM);
322 // TODO: We might want to report double free here.
323 // (that would involve tracking all the freed symbols in the checker state).
324 if (RegionArgIsBad) {
325 // It is possible that this is a false positive - the argument might
326 // have entered as an enclosing function parameter.
327 if (isEnclosingFunctionParam(ArgExpr))
330 ExplodedNode *N = C.generateNonFatalErrorNode(State);
334 auto Report = llvm::make_unique<BugReport>(
335 *BT, "Trying to free data which has not been allocated.", N);
336 Report->addRange(ArgExpr->getSourceRange());
338 Report->markInteresting(AS->Region);
339 C.emitReport(std::move(Report));
343 // Process functions which might deallocate.
344 if (FunctionsToTrack[idx].Kind == PossibleAPI) {
346 if (funName == "CFStringCreateWithBytesNoCopy") {
347 const Expr *DeallocatorExpr = CE->getArg(5)->IgnoreParenCasts();
348 // NULL ~ default deallocator, so warn.
349 if (DeallocatorExpr->isNullPointerConstant(C.getASTContext(),
350 Expr::NPC_ValueDependentIsNotNull)) {
351 const AllocationPair AP = std::make_pair(ArgSM, AS);
352 generateDeallocatorMismatchReport(AP, ArgExpr, C);
355 // One of the default allocators, so warn.
356 if (const DeclRefExpr *DE = dyn_cast<DeclRefExpr>(DeallocatorExpr)) {
357 StringRef DeallocatorName = DE->getFoundDecl()->getName();
358 if (DeallocatorName == "kCFAllocatorDefault" ||
359 DeallocatorName == "kCFAllocatorSystemDefault" ||
360 DeallocatorName == "kCFAllocatorMalloc") {
361 const AllocationPair AP = std::make_pair(ArgSM, AS);
362 generateDeallocatorMismatchReport(AP, ArgExpr, C);
365 // If kCFAllocatorNull, which does not deallocate, we still have to
366 // find the deallocator.
367 if (DE->getFoundDecl()->getName() == "kCFAllocatorNull")
370 // In all other cases, assume the user supplied a correct deallocator
371 // that will free memory so stop tracking.
372 State = State->remove<AllocatedData>(ArgSM);
373 C.addTransition(State);
377 llvm_unreachable("We know of no other possible APIs.");
380 // The call is deallocating a value we previously allocated, so remove it
381 // from the next state.
382 State = State->remove<AllocatedData>(ArgSM);
384 // Check if the proper deallocator is used.
385 unsigned int PDeallocIdx = FunctionsToTrack[AS->AllocatorIdx].DeallocatorIdx;
386 if (PDeallocIdx != idx || (FunctionsToTrack[idx].Kind == ErrorAPI)) {
387 const AllocationPair AP = std::make_pair(ArgSM, AS);
388 generateDeallocatorMismatchReport(AP, ArgExpr, C);
392 C.addTransition(State);
395 void MacOSKeychainAPIChecker::checkPostStmt(const CallExpr *CE,
396 CheckerContext &C) const {
397 ProgramStateRef State = C.getState();
398 const FunctionDecl *FD = C.getCalleeDecl(CE);
399 if (!FD || FD->getKind() != Decl::Function)
402 StringRef funName = C.getCalleeName(FD);
404 // If a value has been allocated, add it to the set for tracking.
405 unsigned idx = getTrackedFunctionIndex(funName, true);
406 if (idx == InvalidIdx)
409 const Expr *ArgExpr = CE->getArg(FunctionsToTrack[idx].Param);
410 // If the argument entered as an enclosing function parameter, skip it to
411 // avoid false positives.
412 if (isEnclosingFunctionParam(ArgExpr) &&
413 C.getLocationContext()->getParent() == nullptr)
416 if (SymbolRef V = getAsPointeeSymbol(ArgExpr, C)) {
417 // If the argument points to something that's not a symbolic region, it
419 // - unknown (cannot reason about it)
420 // - undefined (already reported by other checker)
421 // - constant (null - should not be tracked,
422 // other constant will generate a compiler warning)
423 // - goto (should be reported by other checker)
425 // The call return value symbol should stay alive for as long as the
426 // allocated value symbol, since our diagnostics depend on the value
427 // returned by the call. Ex: Data should only be freed if noErr was
428 // returned during allocation.)
429 SymbolRef RetStatusSymbol =
430 State->getSVal(CE, C.getLocationContext()).getAsSymbol();
431 C.getSymbolManager().addSymbolDependency(V, RetStatusSymbol);
433 // Track the allocated value in the checker state.
434 State = State->set<AllocatedData>(V, AllocationState(ArgExpr, idx,
437 C.addTransition(State);
441 // TODO: This logic is the same as in Malloc checker.
443 MacOSKeychainAPIChecker::getAllocationNode(const ExplodedNode *N,
445 CheckerContext &C) const {
446 const LocationContext *LeakContext = N->getLocationContext();
447 // Walk the ExplodedGraph backwards and find the first node that referred to
448 // the tracked symbol.
449 const ExplodedNode *AllocNode = N;
452 if (!N->getState()->get<AllocatedData>(Sym))
454 // Allocation node, is the last node in the current or parent context in
455 // which the symbol was tracked.
456 const LocationContext *NContext = N->getLocationContext();
457 if (NContext == LeakContext ||
458 NContext->isParentOf(LeakContext))
460 N = N->pred_empty() ? nullptr : *(N->pred_begin());
466 std::unique_ptr<BugReport>
467 MacOSKeychainAPIChecker::generateAllocatedDataNotReleasedReport(
468 const AllocationPair &AP, ExplodedNode *N, CheckerContext &C) const {
469 const ADFunctionInfo &FI = FunctionsToTrack[AP.second->AllocatorIdx];
471 SmallString<70> sbuf;
472 llvm::raw_svector_ostream os(sbuf);
473 os << "Allocated data is not released: missing a call to '"
474 << FunctionsToTrack[FI.DeallocatorIdx].Name << "'.";
476 // Most bug reports are cached at the location where they occurred.
477 // With leaks, we want to unique them by the location where they were
478 // allocated, and only report a single path.
479 PathDiagnosticLocation LocUsedForUniqueing;
480 const ExplodedNode *AllocNode = getAllocationNode(N, AP.first, C);
481 const Stmt *AllocStmt = PathDiagnosticLocation::getStmt(AllocNode);
484 LocUsedForUniqueing = PathDiagnosticLocation::createBegin(AllocStmt,
485 C.getSourceManager(),
486 AllocNode->getLocationContext());
489 llvm::make_unique<BugReport>(*BT, os.str(), N, LocUsedForUniqueing,
490 AllocNode->getLocationContext()->getDecl());
492 Report->addVisitor(llvm::make_unique<SecKeychainBugVisitor>(AP.first));
493 markInteresting(Report.get(), AP);
497 /// If the return symbol is assumed to be error, remove the allocated info
498 /// from consideration.
499 ProgramStateRef MacOSKeychainAPIChecker::evalAssume(ProgramStateRef State,
501 bool Assumption) const {
502 AllocatedDataTy AMap = State->get<AllocatedData>();
506 auto *CondBSE = dyn_cast_or_null<BinarySymExpr>(Cond.getAsSymExpr());
509 BinaryOperator::Opcode OpCode = CondBSE->getOpcode();
510 if (OpCode != BO_EQ && OpCode != BO_NE)
513 // Match for a restricted set of patterns for cmparison of error codes.
514 // Note, the comparisons of type '0 == st' are transformed into SymIntExpr.
515 SymbolRef ReturnSymbol = nullptr;
516 if (auto *SIE = dyn_cast<SymIntExpr>(CondBSE)) {
517 const llvm::APInt &RHS = SIE->getRHS();
518 bool ErrorIsReturned = (OpCode == BO_EQ && RHS != NoErr) ||
519 (OpCode == BO_NE && RHS == NoErr);
521 ErrorIsReturned = !ErrorIsReturned;
523 ReturnSymbol = SIE->getLHS();
527 for (auto I = AMap.begin(), E = AMap.end(); I != E; ++I) {
528 if (ReturnSymbol == I->second.Region)
529 State = State->remove<AllocatedData>(I->first);
535 void MacOSKeychainAPIChecker::checkDeadSymbols(SymbolReaper &SR,
536 CheckerContext &C) const {
537 ProgramStateRef State = C.getState();
538 AllocatedDataTy AMap = State->get<AllocatedData>();
542 bool Changed = false;
543 AllocationPairVec Errors;
544 for (auto I = AMap.begin(), E = AMap.end(); I != E; ++I) {
545 if (!SR.isDead(I->first))
549 State = State->remove<AllocatedData>(I->first);
550 // If the allocated symbol is null do not report.
551 ConstraintManager &CMgr = State->getConstraintManager();
552 ConditionTruthVal AllocFailed = CMgr.isNull(State, I.getKey());
553 if (AllocFailed.isConstrainedTrue())
555 Errors.push_back(std::make_pair(I->first, &I->second));
558 // Generate the new, cleaned up state.
559 C.addTransition(State);
563 static CheckerProgramPointTag Tag(this, "DeadSymbolsLeak");
564 ExplodedNode *N = C.generateNonFatalErrorNode(C.getState(), &Tag);
568 // Generate the error reports.
569 for (const auto &P : Errors)
570 C.emitReport(generateAllocatedDataNotReleasedReport(P, N, C));
572 // Generate the new, cleaned up state.
573 C.addTransition(State, N);
576 std::shared_ptr<PathDiagnosticPiece>
577 MacOSKeychainAPIChecker::SecKeychainBugVisitor::VisitNode(
578 const ExplodedNode *N, const ExplodedNode *PrevN, BugReporterContext &BRC,
580 const AllocationState *AS = N->getState()->get<AllocatedData>(Sym);
583 const AllocationState *ASPrev = PrevN->getState()->get<AllocatedData>(Sym);
587 // (!ASPrev && AS) ~ We started tracking symbol in node N, it must be the
590 cast<CallExpr>(N->getLocation().castAs<StmtPoint>().getStmt());
591 const FunctionDecl *funDecl = CE->getDirectCallee();
592 assert(funDecl && "We do not support indirect function calls as of now.");
593 StringRef funName = funDecl->getName();
595 // Get the expression of the corresponding argument.
596 unsigned Idx = getTrackedFunctionIndex(funName, true);
597 assert(Idx != InvalidIdx && "This should be a call to an allocator.");
598 const Expr *ArgExpr = CE->getArg(FunctionsToTrack[Idx].Param);
599 PathDiagnosticLocation Pos(ArgExpr, BRC.getSourceManager(),
600 N->getLocationContext());
601 return std::make_shared<PathDiagnosticEventPiece>(Pos,
602 "Data is allocated here.");
605 void MacOSKeychainAPIChecker::printState(raw_ostream &Out,
606 ProgramStateRef State,
608 const char *Sep) const {
610 AllocatedDataTy AMap = State->get<AllocatedData>();
612 if (!AMap.isEmpty()) {
613 Out << Sep << "KeychainAPIChecker :" << NL;
614 for (auto I = AMap.begin(), E = AMap.end(); I != E; ++I) {
615 I.getKey()->dumpToStream(Out);
621 void ento::registerMacOSKeychainAPIChecker(CheckerManager &mgr) {
622 mgr.registerChecker<MacOSKeychainAPIChecker>();