//== InvalidPtrChecker.cpp ------------------------------------- -*- C++ -*--=//

//

// Part of the LLVM Project, under the Apache License v2.0 with LLVM Exceptions.

// See https://llvm.org/LICENSE.txt for license information.

// SPDX-License-Identifier: Apache-2.0 WITH LLVM-exception

//

//===----------------------------------------------------------------------===//

//

// This file defines InvalidPtrChecker which finds usages of possibly

// invalidated pointer.

// CERT SEI Rules ENV31-C and ENV34-C

// For more information see:

// https://wiki.sei.cmu.edu/confluence/x/8tYxBQ

// https://wiki.sei.cmu.edu/confluence/x/5NUxBQ

//===----------------------------------------------------------------------===//

#include "clang/StaticAnalyzer/Checkers/BuiltinCheckerRegistration.h"

#include "clang/StaticAnalyzer/Core/BugReporter/BugType.h"

#include "clang/StaticAnalyzer/Core/Checker.h"

#include "clang/StaticAnalyzer/Core/CheckerManager.h"

#include "clang/StaticAnalyzer/Core/PathSensitive/CallDescription.h"

#include "clang/StaticAnalyzer/Core/PathSensitive/CallEvent.h"

#include "clang/StaticAnalyzer/Core/PathSensitive/CheckerContext.h"

using namespace clang;

using namespace ento;

namespace {

class InvalidPtrChecker

    : public Checker<check::Location, check::BeginFunction, check::PostCall> {

private:

  BugType BT{this, "Use of invalidated pointer", categories::MemoryError};

  void EnvpInvalidatingCall(const CallEvent &Call, CheckerContext &C) const;

  using HandlerFn = void (InvalidPtrChecker::*)(const CallEvent &Call,

                                                CheckerContext &C) const;

  // SEI CERT ENV31-C

  const CallDescriptionMap<HandlerFn> EnvpInvalidatingFunctions = {

      {{{"setenv"}, 3}, &InvalidPtrChecker::EnvpInvalidatingCall},

      {{{"unsetenv"}, 1}, &InvalidPtrChecker::EnvpInvalidatingCall},

      {{{"putenv"}, 1}, &InvalidPtrChecker::EnvpInvalidatingCall},

      {{{"_putenv_s"}, 2}, &InvalidPtrChecker::EnvpInvalidatingCall},

      {{{"_wputenv_s"}, 2}, &InvalidPtrChecker::EnvpInvalidatingCall},

  };

  void postPreviousReturnInvalidatingCall(const CallEvent &Call,

                                          CheckerContext &C) const;

  // SEI CERT ENV34-C

  const CallDescriptionMap<HandlerFn> PreviousCallInvalidatingFunctions = {

      {{{"getenv"}, 1}, &InvalidPtrChecker::postPreviousReturnInvalidatingCall},

      {{{"setlocale"}, 2},

       &InvalidPtrChecker::postPreviousReturnInvalidatingCall},

      {{{"strerror"}, 1},

       &InvalidPtrChecker::postPreviousReturnInvalidatingCall},

      {{{"localeconv"}, 0},

       &InvalidPtrChecker::postPreviousReturnInvalidatingCall},

      {{{"asctime"}, 1},

       &InvalidPtrChecker::postPreviousReturnInvalidatingCall},

  };

public:

  // Obtain the environment pointer from 'main()' (if present).

  void checkBeginFunction(CheckerContext &C) const;

  // Handle functions in EnvpInvalidatingFunctions, that invalidate environment

  // pointer from 'main()'

  // Handle functions in PreviousCallInvalidatingFunctions.

  // Also, check if invalidated region is passed to a

  // conservatively evaluated function call as an argument.

  void checkPostCall(const CallEvent &Call, CheckerContext &C) const;

  // Check if invalidated region is being dereferenced.

  void checkLocation(SVal l, bool isLoad, const Stmt *S,

                     CheckerContext &C) const;

};

} // namespace

// Set of memory regions that were invalidated

REGISTER_SET_WITH_PROGRAMSTATE(InvalidMemoryRegions, const MemRegion *)

// Stores the region of the environment pointer of 'main' (if present).

REGISTER_TRAIT_WITH_PROGRAMSTATE(EnvPtrRegion, const MemRegion *)

// Stores key-value pairs, where key is function declaration and value is

// pointer to memory region returned by previous call of this function

REGISTER_MAP_WITH_PROGRAMSTATE(PreviousCallResultMap, const FunctionDecl *,

                               const MemRegion *)

void InvalidPtrChecker::EnvpInvalidatingCall(const CallEvent &Call,

                                             CheckerContext &C) const {

  StringRef FunctionName = Call.getCalleeIdentifier()->getName();

  ProgramStateRef State = C.getState();

  const MemRegion *SymbolicEnvPtrRegion = State->get<EnvPtrRegion>();

  if (!SymbolicEnvPtrRegion)

    return;

  State = State->add<InvalidMemoryRegions>(SymbolicEnvPtrRegion);

  const NoteTag *Note =

      C.getNoteTag([SymbolicEnvPtrRegion, FunctionName](

                       PathSensitiveBugReport &BR, llvm::raw_ostream &Out) {

        if (!BR.isInteresting(SymbolicEnvPtrRegion))

          return;

        Out << '\'' << FunctionName

            << "' call may invalidate the environment parameter of 'main'";

      });

  C.addTransition(State, Note);

}

void InvalidPtrChecker::postPreviousReturnInvalidatingCall(

    const CallEvent &Call, CheckerContext &C) const {

  ProgramStateRef State = C.getState();

  const NoteTag *Note = nullptr;

  const FunctionDecl *FD = dyn_cast_or_null<FunctionDecl>(Call.getDecl());

  // Invalidate the region of the previously returned pointer - if there was

  // one.

  if (const MemRegion *const *Reg = State->get<PreviousCallResultMap>(FD)) {

    const MemRegion *PrevReg = *Reg;

    State = State->add<InvalidMemoryRegions>(PrevReg);

    Note = C.getNoteTag([PrevReg, FD](PathSensitiveBugReport &BR,

                                      llvm::raw_ostream &Out) {

      if (!BR.isInteresting(PrevReg))

        return;

      Out << '\'';

      FD->getNameForDiagnostic(Out, FD->getASTContext().getLangOpts(), true);

      Out << "' call may invalidate the result of the previous " << '\'';

      FD->getNameForDiagnostic(Out, FD->getASTContext().getLangOpts(), true);

      Out << '\'';

    });

  }

  const LocationContext *LCtx = C.getLocationContext();

  const auto *CE = cast<CallExpr>(Call.getOriginExpr());

  // Function call will return a pointer to the new symbolic region.

  DefinedOrUnknownSVal RetVal = C.getSValBuilder().conjureSymbolVal(

      CE, LCtx, CE->getType(), C.blockCount());

  State = State->BindExpr(CE, LCtx, RetVal);

  // Remember to this region.

  const auto *SymRegOfRetVal = cast<SymbolicRegion>(RetVal.getAsRegion());

  const MemRegion *MR =

      const_cast<MemRegion *>(SymRegOfRetVal->getBaseRegion());

  State = State->set<PreviousCallResultMap>(FD, MR);

  ExplodedNode *Node = C.addTransition(State, Note);

  const NoteTag *PreviousCallNote =

      C.getNoteTag([MR](PathSensitiveBugReport &BR, llvm::raw_ostream &Out) {

        if (!BR.isInteresting(MR))

          return;

        Out << '\'' << "'previous function call was here" << '\'';

      });

  C.addTransition(State, Node, PreviousCallNote);

}

// TODO: This seems really ugly. Simplify this.

static const MemRegion *findInvalidatedSymbolicBase(ProgramStateRef State,

                                                    const MemRegion *Reg) {

  while (Reg) {

    if (State->contains<InvalidMemoryRegions>(Reg))

      return Reg;

    const auto *SymBase = Reg->getSymbolicBase();

    if (!SymBase)

      break;

    const auto *SRV = dyn_cast<SymbolRegionValue>(SymBase->getSymbol());

    if (!SRV)

      break;

    Reg = SRV->getRegion();

    if (const auto *VarReg = dyn_cast<VarRegion>(SRV->getRegion()))

      Reg = VarReg;

  }

  return nullptr;

}

// Handle functions in EnvpInvalidatingFunctions, that invalidate environment

// pointer from 'main()' Also, check if invalidated region is passed to a

// function call as an argument.

void InvalidPtrChecker::checkPostCall(const CallEvent &Call,

                                      CheckerContext &C) const {

  // Check if function invalidates 'envp' argument of 'main'

  if (const auto *Handler = EnvpInvalidatingFunctions.lookup(Call))

    (this->**Handler)(Call, C);

  // Check if function invalidates the result of previous call

  if (const auto *Handler = PreviousCallInvalidatingFunctions.lookup(Call))

    (this->**Handler)(Call, C);

  // Check if one of the arguments of the function call is invalidated

  // If call was inlined, don't report invalidated argument

  if (C.wasInlined)

    return;

  ProgramStateRef State = C.getState();

  for (unsigned I = 0, NumArgs = Call.getNumArgs(); I < NumArgs; 
++I97
) {

    if (const auto *SR = dyn_cast_or_null<SymbolicRegion>(

            Call.getArgSVal(I).getAsRegion())) {

      if (const MemRegion *InvalidatedSymbolicBase =

              findInvalidatedSymbolicBase(State, SR)) {

        ExplodedNode *ErrorNode = C.generateNonFatalErrorNode();

        if (!ErrorNode)

          return;

        SmallString<256> Msg;

        llvm::raw_svector_ostream Out(Msg);

        Out << "use of invalidated pointer '";

        Call.getArgExpr(I)->printPretty(Out, /*Helper=*/nullptr,

                                        C.getASTContext().getPrintingPolicy());

        Out << "' in a function call";

        auto Report =

            std::make_unique<PathSensitiveBugReport>(BT, Out.str(), ErrorNode);

        Report->markInteresting(InvalidatedSymbolicBase);

        Report->addRange(Call.getArgSourceRange(I));

        C.emitReport(std::move(Report));

      }

    }

  }

}

// Obtain the environment pointer from 'main()', if present.

void InvalidPtrChecker::checkBeginFunction(CheckerContext &C) const {

  if (!C.inTopFrame())

    return;

  const auto *FD = dyn_cast<FunctionDecl>(C.getLocationContext()->getDecl());

  if (!FD || FD->param_size() != 3 || 
!FD->isMain()5
)

    return;

  ProgramStateRef State = C.getState();

  const MemRegion *EnvpReg =

      State->getRegion(FD->parameters()[2], C.getLocationContext());

  // Save the memory region pointed by the environment pointer parameter of

  // 'main'.

  C.addTransition(State->set<EnvPtrRegion>(EnvpReg));

}

// Check if invalidated region is being dereferenced.

void InvalidPtrChecker::checkLocation(SVal Loc, bool isLoad, const Stmt *S,

                                      CheckerContext &C) const {

  ProgramStateRef State = C.getState();

  // Ignore memory operations involving 'non-invalidated' locations.

  const MemRegion *InvalidatedSymbolicBase =

      findInvalidatedSymbolicBase(State, Loc.getAsRegion());

  if (!InvalidatedSymbolicBase)

    return;

  ExplodedNode *ErrorNode = C.generateNonFatalErrorNode();

  if (!ErrorNode)

    return;

  auto Report = std::make_unique<PathSensitiveBugReport>(

      BT, "dereferencing an invalid pointer", ErrorNode);

  Report->markInteresting(InvalidatedSymbolicBase);

  C.emitReport(std::move(Report));

}

void ento::registerInvalidPtrChecker(CheckerManager &Mgr) {

  Mgr.registerChecker<InvalidPtrChecker>();

}

bool ento::shouldRegisterInvalidPtrChecker(const CheckerManager &) {

  return true;

}