1 //===-- SimpleStreamChecker.cpp -----------------------------------------*- C++ -*--//
3 // The LLVM Compiler Infrastructure
5 // This file is distributed under the University of Illinois Open Source
6 // License. See LICENSE.TXT for details.
8 //===----------------------------------------------------------------------===//
10 // Defines a checker for proper use of fopen/fclose APIs.
11 // - If a file has been closed with fclose, it should not be accessed again.
12 // Accessing a closed file results in undefined behavior.
13 // - If a file was opened with fopen, it must be closed with fclose before
14 // the execution ends. Failing to do so results in a resource leak.
16 //===----------------------------------------------------------------------===//
18 #include "ClangSACheckers.h"
19 #include "clang/StaticAnalyzer/Core/BugReporter/BugType.h"
20 #include "clang/StaticAnalyzer/Core/Checker.h"
21 #include "clang/StaticAnalyzer/Core/PathSensitive/CallEvent.h"
22 #include "clang/StaticAnalyzer/Core/PathSensitive/CheckerContext.h"
24 using namespace clang;
28 typedef SmallVector<SymbolRef, 2> SymbolVector;
32 enum Kind { Opened, Closed } K;
33 StreamState(Kind InK) : K(InK) { }
36 bool isOpened() const { return K == Opened; }
37 bool isClosed() const { return K == Closed; }
39 static StreamState getOpened() { return StreamState(Opened); }
40 static StreamState getClosed() { return StreamState(Closed); }
42 bool operator==(const StreamState &X) const {
45 void Profile(llvm::FoldingSetNodeID &ID) const {
50 class SimpleStreamChecker : public Checker<check::PostCall,
53 check::PointerEscape> {
55 mutable IdentifierInfo *IIfopen, *IIfclose;
57 std::unique_ptr<BugType> DoubleCloseBugType;
58 std::unique_ptr<BugType> LeakBugType;
60 void initIdentifierInfo(ASTContext &Ctx) const;
62 void reportDoubleClose(SymbolRef FileDescSym,
63 const CallEvent &Call,
64 CheckerContext &C) const;
66 void reportLeaks(ArrayRef<SymbolRef> LeakedStreams, CheckerContext &C,
67 ExplodedNode *ErrNode) const;
69 bool guaranteedNotToCloseFile(const CallEvent &Call) const;
72 SimpleStreamChecker();
75 void checkPostCall(const CallEvent &Call, CheckerContext &C) const;
77 void checkPreCall(const CallEvent &Call, CheckerContext &C) const;
79 void checkDeadSymbols(SymbolReaper &SymReaper, CheckerContext &C) const;
81 /// Stop tracking addresses which escape.
82 ProgramStateRef checkPointerEscape(ProgramStateRef State,
83 const InvalidatedSymbols &Escaped,
84 const CallEvent *Call,
85 PointerEscapeKind Kind) const;
88 } // end anonymous namespace
90 /// The state of the checker is a map from tracked stream symbols to their
91 /// state. Let's store it in the ProgramState.
92 REGISTER_MAP_WITH_PROGRAMSTATE(StreamMap, SymbolRef, StreamState)
95 class StopTrackingCallback : public SymbolVisitor {
96 ProgramStateRef state;
98 StopTrackingCallback(ProgramStateRef st) : state(st) {}
99 ProgramStateRef getState() const { return state; }
101 bool VisitSymbol(SymbolRef sym) override {
102 state = state->remove<StreamMap>(sym);
106 } // end anonymous namespace
108 SimpleStreamChecker::SimpleStreamChecker()
109 : IIfopen(nullptr), IIfclose(nullptr) {
110 // Initialize the bug types.
111 DoubleCloseBugType.reset(
112 new BugType(this, "Double fclose", "Unix Stream API Error"));
115 new BugType(this, "Resource Leak", "Unix Stream API Error"));
116 // Sinks are higher importance bugs as well as calls to assert() or exit(0).
117 LeakBugType->setSuppressOnSink(true);
120 void SimpleStreamChecker::checkPostCall(const CallEvent &Call,
121 CheckerContext &C) const {
122 initIdentifierInfo(C.getASTContext());
124 if (!Call.isGlobalCFunction())
127 if (Call.getCalleeIdentifier() != IIfopen)
130 // Get the symbolic value corresponding to the file handle.
131 SymbolRef FileDesc = Call.getReturnValue().getAsSymbol();
135 // Generate the next transition (an edge in the exploded graph).
136 ProgramStateRef State = C.getState();
137 State = State->set<StreamMap>(FileDesc, StreamState::getOpened());
138 C.addTransition(State);
141 void SimpleStreamChecker::checkPreCall(const CallEvent &Call,
142 CheckerContext &C) const {
143 initIdentifierInfo(C.getASTContext());
145 if (!Call.isGlobalCFunction())
148 if (Call.getCalleeIdentifier() != IIfclose)
151 if (Call.getNumArgs() != 1)
154 // Get the symbolic value corresponding to the file handle.
155 SymbolRef FileDesc = Call.getArgSVal(0).getAsSymbol();
159 // Check if the stream has already been closed.
160 ProgramStateRef State = C.getState();
161 const StreamState *SS = State->get<StreamMap>(FileDesc);
162 if (SS && SS->isClosed()) {
163 reportDoubleClose(FileDesc, Call, C);
167 // Generate the next transition, in which the stream is closed.
168 State = State->set<StreamMap>(FileDesc, StreamState::getClosed());
169 C.addTransition(State);
172 static bool isLeaked(SymbolRef Sym, const StreamState &SS,
173 bool IsSymDead, ProgramStateRef State) {
174 if (IsSymDead && SS.isOpened()) {
175 // If a symbol is NULL, assume that fopen failed on this path.
176 // A symbol should only be considered leaked if it is non-null.
177 ConstraintManager &CMgr = State->getConstraintManager();
178 ConditionTruthVal OpenFailed = CMgr.isNull(State, Sym);
179 return !OpenFailed.isConstrainedTrue();
184 void SimpleStreamChecker::checkDeadSymbols(SymbolReaper &SymReaper,
185 CheckerContext &C) const {
186 ProgramStateRef State = C.getState();
187 SymbolVector LeakedStreams;
188 StreamMapTy TrackedStreams = State->get<StreamMap>();
189 for (StreamMapTy::iterator I = TrackedStreams.begin(),
190 E = TrackedStreams.end(); I != E; ++I) {
191 SymbolRef Sym = I->first;
192 bool IsSymDead = SymReaper.isDead(Sym);
194 // Collect leaked symbols.
195 if (isLeaked(Sym, I->second, IsSymDead, State))
196 LeakedStreams.push_back(Sym);
198 // Remove the dead symbol from the streams map.
200 State = State->remove<StreamMap>(Sym);
203 ExplodedNode *N = C.addTransition(State);
204 reportLeaks(LeakedStreams, C, N);
207 void SimpleStreamChecker::reportDoubleClose(SymbolRef FileDescSym,
208 const CallEvent &Call,
209 CheckerContext &C) const {
210 // We reached a bug, stop exploring the path here by generating a sink.
211 ExplodedNode *ErrNode = C.generateSink();
212 // If we've already reached this node on another path, return.
216 // Generate the report.
217 auto R = llvm::make_unique<BugReport>(*DoubleCloseBugType,
218 "Closing a previously closed file stream", ErrNode);
219 R->addRange(Call.getSourceRange());
220 R->markInteresting(FileDescSym);
221 C.emitReport(std::move(R));
224 void SimpleStreamChecker::reportLeaks(ArrayRef<SymbolRef> LeakedStreams,
226 ExplodedNode *ErrNode) const {
227 // Attach bug reports to the leak node.
228 // TODO: Identify the leaked file descriptor.
229 for (SymbolRef LeakedStream : LeakedStreams) {
230 auto R = llvm::make_unique<BugReport>(*LeakBugType,
231 "Opened file is never closed; potential resource leak", ErrNode);
232 R->markInteresting(LeakedStream);
233 C.emitReport(std::move(R));
237 bool SimpleStreamChecker::guaranteedNotToCloseFile(const CallEvent &Call) const{
238 // If it's not in a system header, assume it might close a file.
239 if (!Call.isInSystemHeader())
242 // Handle cases where we know a buffer's /address/ can escape.
243 if (Call.argumentsMayEscape())
246 // Note, even though fclose closes the file, we do not list it here
247 // since the checker is modeling the call.
252 // If the pointer we are tracking escaped, do not track the symbol as
253 // we cannot reason about it anymore.
255 SimpleStreamChecker::checkPointerEscape(ProgramStateRef State,
256 const InvalidatedSymbols &Escaped,
257 const CallEvent *Call,
258 PointerEscapeKind Kind) const {
259 // If we know that the call cannot close a file, there is nothing to do.
260 if (Kind == PSK_DirectEscapeOnCall && guaranteedNotToCloseFile(*Call)) {
264 for (InvalidatedSymbols::const_iterator I = Escaped.begin(),
269 // The symbol escaped. Optimistically, assume that the corresponding file
270 // handle will be closed somewhere else.
271 State = State->remove<StreamMap>(Sym);
276 void SimpleStreamChecker::initIdentifierInfo(ASTContext &Ctx) const {
279 IIfopen = &Ctx.Idents.get("fopen");
280 IIfclose = &Ctx.Idents.get("fclose");
283 void ento::registerSimpleStreamChecker(CheckerManager &mgr) {
284 mgr.registerChecker<SimpleStreamChecker>();