From patchwork Tue Aug 29 15:02:23 2023 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: David Malcolm X-Patchwork-Id: 137118 Return-Path: Delivered-To: ouuuleilei@gmail.com Received: by 2002:a59:a7d1:0:b0:3f2:4152:657d with SMTP id p17csp3984869vqm; Tue, 29 Aug 2023 08:09:34 -0700 (PDT) X-Google-Smtp-Source: AGHT+IFIhYN/G+msyJ41HmsvFUTnW11TyiGLcWhTDjbmdmjOX9yaMls+rVUQjKJcTJP9dHy2nEq6 X-Received: by 2002:a17:907:7845:b0:9a5:c5a8:a1a0 with SMTP id lb5-20020a170907784500b009a5c5a8a1a0mr2720181ejc.49.1693321774146; Tue, 29 Aug 2023 08:09:34 -0700 (PDT) ARC-Seal: i=1; a=rsa-sha256; t=1693321774; cv=none; d=google.com; s=arc-20160816; b=b4tGhAWLJPNERDAjgp8MfZoKTSmTCpeVEqKX9EqKAa+ZCQEyelri4frFh0qLfB+y8R kVkKARYvziYzyRNA7/eRnZhZaHBL1P1P8Aw70CacYlsZWYoVAi1FVeVTqoCy9gis9KUw ihSVatmZneuj7Tz3lY4tYQWY18jwXrudkpiyi8c7PG1PJe2u4hjBeBzSuTxTlWptaT2m nhxIkWpNUuHWF0n4jBJLPUTMFkO8KRYo2E/2sm0rg9Lr2cZHgxrp0DcRyf1Xl371u0pu lAPkOO6dypwitN07l1hKEZ4S3QSIjSX/6d++QPfOWIOhfxehbkPFNYIGiA4UndZnw/UT gFKA== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=arc-20160816; h=sender:errors-to:reply-to:from:list-subscribe:list-help:list-post :list-archive:list-unsubscribe:list-id:precedence :content-transfer-encoding:mime-version:message-id:date:subject:to :dmarc-filter:delivered-to:dkim-signature:dkim-filter; bh=ZQx0jorFbiMCwHU3fg2mtWyVuT9OFi1Ic8PwchKr1tc=; fh=hPrbWPhweUx4V0GV9uXJqbyAzg2ABmTz7kczrAQqMmM=; b=gYROV2sm/3Ko2qERb99csgPqg0LfjdSz9maWqnhU/lSfAJ+FvzmLBzSQX1lb+1Zvab 236U09VytxhwWxagGbaN88+hF6hW9VgzUOdljzZc7Buc8qxj39V4cJj8M2qqJX+qSyhq eSVSuRgy0TqFUCBdvB16dYdopzvKOTqb79gru3i7GK1vACmP7BjLAcdgVJ5fhnQHnQb2 JqSuq6xRTQTrsnMJIh3+g6tbXnTfy4r3LowcBWthFngDoXlG+WgBb4osk+DfjDgdPc1m Sp6TgZ9564i12BanCnK/DtpL1jlGzJLmf+j9Ei+tGEZHIoRVSJXnKABXw92l+zd+a0Yl sBxQ== ARC-Authentication-Results: i=1; mx.google.com; dkim=pass header.i=@gcc.gnu.org header.s=default header.b=N3uKOOQR; spf=pass (google.com: domain of gcc-patches-bounces+ouuuleilei=gmail.com@gcc.gnu.org designates 8.43.85.97 as permitted sender) smtp.mailfrom="gcc-patches-bounces+ouuuleilei=gmail.com@gcc.gnu.org"; dmarc=pass (p=NONE sp=NONE dis=NONE) header.from=gnu.org Received: from server2.sourceware.org (ip-8-43-85-97.sourceware.org. [8.43.85.97]) by mx.google.com with ESMTPS id d12-20020a170906344c00b0099329b35b84si6533051ejb.425.2023.08.29.08.09.33 for (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Tue, 29 Aug 2023 08:09:34 -0700 (PDT) Received-SPF: pass (google.com: domain of gcc-patches-bounces+ouuuleilei=gmail.com@gcc.gnu.org designates 8.43.85.97 as permitted sender) client-ip=8.43.85.97; Authentication-Results: mx.google.com; dkim=pass header.i=@gcc.gnu.org header.s=default header.b=N3uKOOQR; spf=pass (google.com: domain of gcc-patches-bounces+ouuuleilei=gmail.com@gcc.gnu.org designates 8.43.85.97 as permitted sender) smtp.mailfrom="gcc-patches-bounces+ouuuleilei=gmail.com@gcc.gnu.org"; dmarc=pass (p=NONE sp=NONE dis=NONE) header.from=gnu.org Received: from server2.sourceware.org (localhost [IPv6:::1]) by sourceware.org (Postfix) with ESMTP id 75FEA38582A1 for ; Tue, 29 Aug 2023 15:09:31 +0000 (GMT) DKIM-Filter: OpenDKIM Filter v2.11.0 sourceware.org 75FEA38582A1 DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gcc.gnu.org; s=default; t=1693321771; bh=ZQx0jorFbiMCwHU3fg2mtWyVuT9OFi1Ic8PwchKr1tc=; h=To:Subject:Date:List-Id:List-Unsubscribe:List-Archive:List-Post: List-Help:List-Subscribe:From:Reply-To:From; b=N3uKOOQRjmwpDjCEbvg6fiQe0/B5WOwATmq3kWY36wAnPne+s3B2h0C9BXoJ+/EaP YOYMfZl3ASQDnMa1k3lH1JnVeUftWISjbsdgohjf8nlqD3LHqMiJufQ8VBomsbAP2d DppvdtUUa1ADcMBaaSyvxqivzOF7PzhNP5ajAB+s= X-Original-To: gcc-patches@gcc.gnu.org Delivered-To: gcc-patches@gcc.gnu.org Received: from us-smtp-delivery-124.mimecast.com (us-smtp-delivery-124.mimecast.com [170.10.133.124]) by sourceware.org (Postfix) with ESMTPS id 3725B3858D28 for ; Tue, 29 Aug 2023 15:08:43 +0000 (GMT) DMARC-Filter: OpenDMARC Filter v1.4.2 sourceware.org 3725B3858D28 Received: from mimecast-mx02.redhat.com (mimecast-mx02.redhat.com [66.187.233.88]) by relay.mimecast.com with ESMTP with STARTTLS (version=TLSv1.2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id us-mta-519-2tk3_TRWN0yDWy4VUF6OGw-1; Tue, 29 Aug 2023 11:02:28 -0400 X-MC-Unique: 2tk3_TRWN0yDWy4VUF6OGw-1 Received: from smtp.corp.redhat.com (int-mx05.intmail.prod.int.rdu2.redhat.com [10.11.54.5]) (using TLSv1.2 with cipher AECDH-AES256-SHA (256/256 bits)) (No client certificate requested) by mimecast-mx02.redhat.com (Postfix) with ESMTPS id BB3C285C719 for ; Tue, 29 Aug 2023 15:02:24 +0000 (UTC) Received: from t14s.localdomain.com (unknown [10.22.34.135]) by smtp.corp.redhat.com (Postfix) with ESMTP id 9560E9A; Tue, 29 Aug 2023 15:02:24 +0000 (UTC) To: gcc-patches@gcc.gnu.org Subject: [pushed] analyzer: improve strdup handling [PR105899] Date: Tue, 29 Aug 2023 11:02:23 -0400 Message-Id: <20230829150223.3824839-1-dmalcolm@redhat.com> MIME-Version: 1.0 X-Scanned-By: MIMEDefang 3.1 on 10.11.54.5 X-Mimecast-Spam-Score: 0 X-Mimecast-Originator: redhat.com X-Spam-Status: No, score=-11.4 required=5.0 tests=BAYES_00, DKIMWL_WL_HIGH, DKIM_SIGNED, DKIM_VALID, DKIM_VALID_AU, DKIM_VALID_EF, GIT_PATCH_0, RCVD_IN_DNSWL_NONE, RCVD_IN_MSPIKE_H4, RCVD_IN_MSPIKE_WL, SPF_HELO_NONE, SPF_NONE, TXREP autolearn=ham autolearn_force=no version=3.4.6 X-Spam-Checker-Version: SpamAssassin 3.4.6 (2021-04-09) on server2.sourceware.org X-BeenThere: gcc-patches@gcc.gnu.org X-Mailman-Version: 2.1.30 Precedence: list List-Id: Gcc-patches mailing list List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-Patchwork-Original-From: David Malcolm via Gcc-patches From: David Malcolm Reply-To: David Malcolm Errors-To: gcc-patches-bounces+ouuuleilei=gmail.com@gcc.gnu.org Sender: "Gcc-patches" X-getmail-retrieved-from-mailbox: INBOX X-GMAIL-THRID: 1775576572912459276 X-GMAIL-MSGID: 1775576572912459276 Successfully bootstrapped & regrtested on x86_64-pc-linux-gnu. Pushed to trunk as r14-3549-gf687fc1ff6d4a4. gcc/analyzer/ChangeLog: PR analyzer/105899 * kf.cc (kf_strdup::impl_call_pre): Set size of dynamically-allocated buffer. Simulate copying the string from the source region to the new buffer. gcc/testsuite/ChangeLog: PR analyzer/105899 * c-c++-common/analyzer/pr99193-2.c: Add -Wno-analyzer-too-complex. * gcc.dg/analyzer/strdup-1.c: Include "analyzer-decls.h". (test_concrete_strlen): New. (test_symbolic_strlen): New. --- gcc/analyzer/kf.cc | 28 +++++++++++++------ .../c-c++-common/analyzer/pr99193-2.c | 2 ++ gcc/testsuite/gcc.dg/analyzer/strdup-1.c | 27 ++++++++++++++++++ 3 files changed, 48 insertions(+), 9 deletions(-) diff --git a/gcc/analyzer/kf.cc b/gcc/analyzer/kf.cc index 333ffd9751ae..37792aed909c 100644 --- a/gcc/analyzer/kf.cc +++ b/gcc/analyzer/kf.cc @@ -1301,17 +1301,27 @@ public: void impl_call_pre (const call_details &cd) const final override { region_model *model = cd.get_model (); + region_model_context *ctxt = cd.get_ctxt (); region_model_manager *mgr = cd.get_manager (); - cd.check_for_null_terminated_string_arg (0); - /* Ideally we'd get the size here, and simulate copying the bytes. */ - const region *new_reg - = model->get_or_create_region_for_heap_alloc (NULL, cd.get_ctxt ()); - model->mark_region_as_unknown (new_reg, NULL); - if (cd.get_lhs_type ()) + const svalue *bytes_to_copy; + if (const svalue *num_bytes_read_sval + = cd.check_for_null_terminated_string_arg (0, true, &bytes_to_copy)) { - const svalue *ptr_sval - = mgr->get_ptr_svalue (cd.get_lhs_type (), new_reg); - cd.maybe_set_lhs (ptr_sval); + const region *new_reg + = model->get_or_create_region_for_heap_alloc (num_bytes_read_sval, + ctxt); + model->write_bytes (new_reg, num_bytes_read_sval, bytes_to_copy, ctxt); + if (cd.get_lhs_type ()) + { + const svalue *ptr_sval + = mgr->get_ptr_svalue (cd.get_lhs_type (), new_reg); + cd.maybe_set_lhs (ptr_sval); + } + } + else + { + if (ctxt) + ctxt->terminate_path (); } } }; diff --git a/gcc/testsuite/c-c++-common/analyzer/pr99193-2.c b/gcc/testsuite/c-c++-common/analyzer/pr99193-2.c index 791b857dcc56..12326ef61f1c 100644 --- a/gcc/testsuite/c-c++-common/analyzer/pr99193-2.c +++ b/gcc/testsuite/c-c++-common/analyzer/pr99193-2.c @@ -3,6 +3,8 @@ Based on https://github.com/libguestfs/libguestfs/blob/f19fd566f6387ce7e4d82409528c9dde374d25e0/df/main.c#L404 which is GPLv2 or later. */ +/* { dg-additional-options "-Wno-analyzer-too-complex" } */ + typedef __SIZE_TYPE__ size_t; typedef __builtin_va_list va_list; diff --git a/gcc/testsuite/gcc.dg/analyzer/strdup-1.c b/gcc/testsuite/gcc.dg/analyzer/strdup-1.c index f6c176f174eb..11bc964922b5 100644 --- a/gcc/testsuite/gcc.dg/analyzer/strdup-1.c +++ b/gcc/testsuite/gcc.dg/analyzer/strdup-1.c @@ -1,6 +1,8 @@ #include #include +#include "analyzer-decls.h" + extern void requires_nonnull (void *ptr) __attribute__((nonnull)); @@ -52,3 +54,28 @@ char *test_uninitialized (void) return strdup (buf); /* { dg-warning "use of uninitialized value 'buf\\\[0\\\]'" } */ /* { dg-message "while looking for null terminator for argument 1 \\('&buf'\\) of 'strdup'..." "event" { target *-*-* } .-1 } */ } + +char *test_concrete_strlen (void) +{ + char *p = strdup ("abc"); + if (!p) + return p; + __analyzer_eval (__analyzer_get_strlen (p) == 3); /* { dg-warning "TRUE" } */ + __analyzer_eval (p[0] == 'a'); /* { dg-warning "TRUE" } */ + __analyzer_eval (p[1] == 'b'); /* { dg-warning "TRUE" } */ + __analyzer_eval (p[2] == 'c'); /* { dg-warning "TRUE" } */ + __analyzer_eval (p[3] == '\0'); /* { dg-warning "TRUE" } */ + return p; +} + +char *test_symbolic_strlen (const char *p) +{ + char *q = strdup (p); + if (!q) + return q; + __analyzer_eval (__analyzer_get_strlen (p) == __analyzer_get_strlen (q)); /* { dg-warning "UNKNOWN" } */ + // TODO: should be TRUE + __analyzer_eval (p[0] == q[0]); /* { dg-warning "UNKNOWN" } */ + // TODO: should be TRUE + return q; +}