From patchwork Thu Aug 24 14:38:55 2023 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: David Malcolm X-Patchwork-Id: 136831 Return-Path: Delivered-To: ouuuleilei@gmail.com Received: by 2002:a59:a7d1:0:b0:3f2:4152:657d with SMTP id p17csp1167531vqm; Thu, 24 Aug 2023 07:41:01 -0700 (PDT) X-Google-Smtp-Source: AGHT+IGvSXPeA0U1dvLGyj24ZKU5rQJwUY9UGfDOwlXlcxj+I99u3hHzZ/sTBLTXW+eymnpOAFpG X-Received: by 2002:a05:6402:34cf:b0:51d:b184:efd with SMTP id w15-20020a05640234cf00b0051db1840efdmr16938235edc.20.1692888061218; Thu, 24 Aug 2023 07:41:01 -0700 (PDT) ARC-Seal: i=1; a=rsa-sha256; t=1692888061; cv=none; d=google.com; s=arc-20160816; b=Tx+9mAjnouGX1nG99V6ZwDo6nUWWIFWdksusimilRwk4witzD2B3s/QXPuMOQErecy YM3d/IonOUelJ8hU2j7HRFDA/KO37oNqvyfyTKqIidNpEMQ10v0T/44UZCDD8cDrgwQm Qwq0c2E47DQLHO3678ebLysJJ61eZIW6OsANSGPwMjy74xTeD7UccT7tAcuW1VNKC1fo h/E1a+UxdsoQZCwd2302/qKZvdwf/Ftsb+D13EzS8tBcLDU4Il3u7OGdnfTDowbT4dXd atRUqBinO2WCHPF+NcbZva9a4lk3ByzcRuMGvI3KM16BDyRTvH4f4Z1EGvXiMGWWCQvU sRDA== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=arc-20160816; h=sender:errors-to:reply-to:from:list-subscribe:list-help:list-post :list-archive:list-unsubscribe:list-id:precedence :content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:cc:to:dmarc-filter:delivered-to :dkim-signature:dkim-filter; bh=JBsvKAB0kg5PtZC1GwAGQAAxTZybXy7EdQeOl8dfxVM=; fh=fa0YJSH7y4k0snNuxsKgOI6vGP7j2f0jR9F1WHC95UA=; b=FXjBCqOT+oy1qJc9QdvKR0oie7AyVH+Wpkvk4/j5l4ycQThnvU5+JF2gYm60auI2M9 0gyqj7OfhjszKXaXh6xiHN8wJwLqAzRZXpKQoNVqldQoSaeRWAqyBi9Hu3bjx1qoN7Rw eJuEelJldStBhpfdkixul2XO+LSOFJl3aG2PtaWnWW/7ILOoGQyuk8MX8qL6oIT47GCI 5hZHTIZXRmHNQhQgBc7LeHIXSYrXZ472AA7zGU6EuCjeGIqtQwsUn9SiNQfyWXyDMozs zjijMAQH7YrKJ68QnIbeMmYco4F5fo8Im8IHuPlcwHeAlf13DVhvNMOpWhxxa9funOh5 Q3Tg== ARC-Authentication-Results: i=1; mx.google.com; dkim=pass header.i=@gcc.gnu.org header.s=default header.b=aL2FSj5f; spf=pass (google.com: domain of gcc-patches-bounces+ouuuleilei=gmail.com@gcc.gnu.org designates 8.43.85.97 as permitted sender) smtp.mailfrom="gcc-patches-bounces+ouuuleilei=gmail.com@gcc.gnu.org"; dmarc=pass (p=NONE sp=NONE dis=NONE) header.from=gnu.org Received: from server2.sourceware.org (ip-8-43-85-97.sourceware.org. [8.43.85.97]) by mx.google.com with ESMTPS id j18-20020aa7c0d2000000b0052a17f2c85csi4842681edp.494.2023.08.24.07.41.00 for (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Thu, 24 Aug 2023 07:41:01 -0700 (PDT) Received-SPF: pass (google.com: domain of gcc-patches-bounces+ouuuleilei=gmail.com@gcc.gnu.org designates 8.43.85.97 as permitted sender) client-ip=8.43.85.97; Authentication-Results: mx.google.com; dkim=pass header.i=@gcc.gnu.org header.s=default header.b=aL2FSj5f; spf=pass (google.com: domain of gcc-patches-bounces+ouuuleilei=gmail.com@gcc.gnu.org designates 8.43.85.97 as permitted sender) smtp.mailfrom="gcc-patches-bounces+ouuuleilei=gmail.com@gcc.gnu.org"; dmarc=pass (p=NONE sp=NONE dis=NONE) header.from=gnu.org Received: from server2.sourceware.org (localhost [IPv6:::1]) by sourceware.org (Postfix) with ESMTP id BFEFD3853568 for ; Thu, 24 Aug 2023 14:39:56 +0000 (GMT) DKIM-Filter: OpenDKIM Filter v2.11.0 sourceware.org BFEFD3853568 DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gcc.gnu.org; s=default; t=1692887996; bh=JBsvKAB0kg5PtZC1GwAGQAAxTZybXy7EdQeOl8dfxVM=; h=To:Cc:Subject:Date:In-Reply-To:References:List-Id: List-Unsubscribe:List-Archive:List-Post:List-Help:List-Subscribe: From:Reply-To:From; b=aL2FSj5fJ9DfioSTAViIvnqTI5TNnS0Kldh8dJq8fsMYbcYAc5Q8IqrlWmzuP96p2 6lEnvHIw4AbknHBIlXhUYskF/bMDvFlT3OQmcmeh2tQFmLm4Blul9+qhn+6/wDl5rl awpcTepXOwZMpOHTArogQvvD+pxYerqrIhnhNQME= X-Original-To: gcc-patches@gcc.gnu.org Delivered-To: gcc-patches@gcc.gnu.org Received: from us-smtp-delivery-124.mimecast.com (us-smtp-delivery-124.mimecast.com [170.10.129.124]) by sourceware.org (Postfix) with ESMTPS id DD1E23858C2B for ; Thu, 24 Aug 2023 14:39:07 +0000 (GMT) DMARC-Filter: OpenDMARC Filter v1.4.2 sourceware.org DD1E23858C2B Received: from mimecast-mx02.redhat.com (66.187.233.73 [66.187.233.73]) by relay.mimecast.com with ESMTP with STARTTLS (version=TLSv1.2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id us-mta-311-XIkD-TZGMzmmmKc0nnNgWg-1; Thu, 24 Aug 2023 10:39:06 -0400 X-MC-Unique: XIkD-TZGMzmmmKc0nnNgWg-1 Received: from smtp.corp.redhat.com (int-mx02.intmail.prod.int.rdu2.redhat.com [10.11.54.2]) (using TLSv1.2 with cipher AECDH-AES256-SHA (256/256 bits)) (No client certificate requested) by mimecast-mx02.redhat.com (Postfix) with ESMTPS id 09C8C3C14AAA for ; Thu, 24 Aug 2023 14:39:06 +0000 (UTC) Received: from t14s.localdomain.com (unknown [10.22.32.117]) by smtp.corp.redhat.com (Postfix) with ESMTP id D738340D283C; Thu, 24 Aug 2023 14:39:05 +0000 (UTC) To: gcc-patches@gcc.gnu.org Cc: David Malcolm Subject: [PATCH 1/9] analyzer: add logging to impl_path_context Date: Thu, 24 Aug 2023 10:38:55 -0400 Message-Id: <20230824143903.3161185-2-dmalcolm@redhat.com> In-Reply-To: <20230824143903.3161185-1-dmalcolm@redhat.com> References: <20230824143903.3161185-1-dmalcolm@redhat.com> MIME-Version: 1.0 X-Scanned-By: MIMEDefang 3.1 on 10.11.54.2 X-Mimecast-Spam-Score: 0 X-Mimecast-Originator: redhat.com X-Spam-Status: No, score=-11.7 required=5.0 tests=BAYES_00, DKIMWL_WL_HIGH, DKIM_SIGNED, DKIM_VALID, DKIM_VALID_AU, DKIM_VALID_EF, GIT_PATCH_0, RCVD_IN_DNSWL_NONE, RCVD_IN_MSPIKE_H4, RCVD_IN_MSPIKE_WL, SPF_HELO_NONE, SPF_NONE, TXREP autolearn=ham autolearn_force=no version=3.4.6 X-Spam-Checker-Version: SpamAssassin 3.4.6 (2021-04-09) on server2.sourceware.org X-BeenThere: gcc-patches@gcc.gnu.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: Gcc-patches mailing list List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-Patchwork-Original-From: David Malcolm via Gcc-patches From: David Malcolm Reply-To: David Malcolm Errors-To: gcc-patches-bounces+ouuuleilei=gmail.com@gcc.gnu.org Sender: "Gcc-patches" X-getmail-retrieved-from-mailbox: INBOX X-GMAIL-THRID: 1775121791827313544 X-GMAIL-MSGID: 1775121791827313544 gcc/analyzer/ChangeLog: * engine.cc (impl_path_context::impl_path_context): Add logger param. (impl_path_context::bifurcate): Add log message. (impl_path_context::terminate_path): Likewise. (impl_path_context::m_logger): New field. (exploded_graph::process_node): Pass logger to path_ctxt ctor. --- gcc/analyzer/engine.cc | 13 +++++++++++-- 1 file changed, 11 insertions(+), 2 deletions(-) diff --git a/gcc/analyzer/engine.cc b/gcc/analyzer/engine.cc index 3700154eec2c..a1908cdb364e 100644 --- a/gcc/analyzer/engine.cc +++ b/gcc/analyzer/engine.cc @@ -3848,8 +3848,10 @@ exploded_graph::maybe_create_dynamic_call (const gcall *call, class impl_path_context : public path_context { public: - impl_path_context (const program_state *cur_state) + impl_path_context (const program_state *cur_state, + logger *logger) : m_cur_state (cur_state), + m_logger (logger), m_terminate_path (false) { } @@ -3868,6 +3870,9 @@ public: void bifurcate (std::unique_ptr info) final override { + if (m_logger) + m_logger->log ("bifurcating path"); + if (m_state_at_bifurcation) /* Verify that the state at bifurcation is consistent when we split into multiple out-edges. */ @@ -3884,6 +3889,8 @@ public: void terminate_path () final override { + if (m_logger) + m_logger->log ("terminating path"); m_terminate_path = true; } @@ -3900,6 +3907,8 @@ public: private: const program_state *m_cur_state; + logger *m_logger; + /* Lazily-created copy of the state before the split. */ std::unique_ptr m_state_at_bifurcation; @@ -4044,7 +4053,7 @@ exploded_graph::process_node (exploded_node *node) exactly one stmt, the one that caused the change. */ program_state next_state (state); - impl_path_context path_ctxt (&next_state); + impl_path_context path_ctxt (&next_state, logger); uncertainty_t uncertainty; const supernode *snode = point.get_supernode (); From patchwork Thu Aug 24 14:38:56 2023 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: David Malcolm X-Patchwork-Id: 136837 Return-Path: Delivered-To: ouuuleilei@gmail.com Received: by 2002:a59:a7d1:0:b0:3f2:4152:657d with SMTP id p17csp1168846vqm; Thu, 24 Aug 2023 07:43:30 -0700 (PDT) X-Google-Smtp-Source: AGHT+IGrKpckmt+ZfQetMQmMbVZNyuics3kuC6IArB47adRRbcwB7Ke889kdDAgy3D+BwZ+n3eMr X-Received: by 2002:a17:906:3287:b0:992:a836:a194 with SMTP id 7-20020a170906328700b00992a836a194mr11602435ejw.59.1692888209733; Thu, 24 Aug 2023 07:43:29 -0700 (PDT) ARC-Seal: i=1; a=rsa-sha256; t=1692888209; cv=none; d=google.com; s=arc-20160816; b=nN3to8FH8z76ylXUO7JQyDkn53H89VuXr110dg7LJm37Ge99vcyevcOFSH6b2VcPqu yvekjiMMADrx93m+5vz4L9XeQjP6oEK3Sf5iltpkglFZ8tK4AkefRlceD/Dm++E7YeiI 6HKZVm4zZlmH4fie72nxy+6hQbmNuiDXfDECRvz3y+mTHAwqo66nB1aLHlUe7qSc11eS P/tAY13DAB25eJKnDoemOOqfixI8OoNwOHDFZl8V6R/oUSYFwL0q7+Fy1JRvMQGaTrbw 96f+qfQkE3e5PA8BJ2Q+uzZgHm2AF5MWSI5wAHRGzOFYMsp4eHmPcV3J7YMjHIAgYmBX yZBg== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=arc-20160816; h=sender:errors-to:reply-to:from:list-subscribe:list-help:list-post :list-archive:list-unsubscribe:list-id:precedence :content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:cc:to:dmarc-filter:delivered-to :dkim-signature:dkim-filter; bh=Z4E2knWIGXsB7WSi2FY93w6+ERrhewuZo5XJNbbKtq0=; fh=fa0YJSH7y4k0snNuxsKgOI6vGP7j2f0jR9F1WHC95UA=; b=MqzXS96GgBm9HjpCNCc66oTxoFVrHSsWg1cE7u3NjUfVVPYYshDltayosBGDrKbpKK CX4QhA1x78HCpuZHUhNddNhy2Ce/B+sH29IiF/zoYJyiJG4iuF+BUr8DAAb+mkxNJBJe FrlsopzmGE7+LLu+FIMxGbLuix/dluCv2MEUVTzLYqwiIhPeWj2MFnS99QF2pyMcGovh INCkEaBGIb5DeLj9bSKGwCv6poV4Zs/9hD06TAUQWvP9fwVwleYhA8kG3k4knczGLotG QF0sLJaoFv5VumxxMJuiOsQoJvAZx8ewP4k7Zuq7l5Zk8OL/IdNr3kCjYWt2A9URMyRh gLHA== ARC-Authentication-Results: i=1; mx.google.com; dkim=pass header.i=@gcc.gnu.org header.s=default header.b=TMbXgzEQ; spf=pass (google.com: domain of gcc-patches-bounces+ouuuleilei=gmail.com@gcc.gnu.org designates 8.43.85.97 as permitted sender) smtp.mailfrom="gcc-patches-bounces+ouuuleilei=gmail.com@gcc.gnu.org"; dmarc=pass (p=NONE sp=NONE dis=NONE) header.from=gnu.org Received: from server2.sourceware.org (ip-8-43-85-97.sourceware.org. [8.43.85.97]) by mx.google.com with ESMTPS id q20-20020a170906941400b009a1e73f2b52si2278452ejx.717.2023.08.24.07.43.29 for (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Thu, 24 Aug 2023 07:43:29 -0700 (PDT) Received-SPF: pass (google.com: domain of gcc-patches-bounces+ouuuleilei=gmail.com@gcc.gnu.org designates 8.43.85.97 as permitted sender) client-ip=8.43.85.97; Authentication-Results: mx.google.com; dkim=pass header.i=@gcc.gnu.org header.s=default header.b=TMbXgzEQ; spf=pass (google.com: domain of gcc-patches-bounces+ouuuleilei=gmail.com@gcc.gnu.org designates 8.43.85.97 as permitted sender) smtp.mailfrom="gcc-patches-bounces+ouuuleilei=gmail.com@gcc.gnu.org"; dmarc=pass (p=NONE sp=NONE dis=NONE) header.from=gnu.org Received: from server2.sourceware.org (localhost [IPv6:::1]) by sourceware.org (Postfix) with ESMTP id 249983882042 for ; Thu, 24 Aug 2023 14:40:57 +0000 (GMT) DKIM-Filter: OpenDKIM Filter v2.11.0 sourceware.org 249983882042 DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gcc.gnu.org; s=default; t=1692888057; bh=Z4E2knWIGXsB7WSi2FY93w6+ERrhewuZo5XJNbbKtq0=; h=To:Cc:Subject:Date:In-Reply-To:References:List-Id: List-Unsubscribe:List-Archive:List-Post:List-Help:List-Subscribe: From:Reply-To:From; b=TMbXgzEQIHeNUsQhJSRNPSjeBaGjrTetnK3sJgNXcjMhM/wz5RIyf2Gm+9Nh+9eb4 oMDnAlhzoBMrTAeLBSBjv3cp88BI913UPfteANUfc2jWgeVQI/TakWeSJZBiH4KAJj rBOEWVx9TAZUOqw0rLIbTMlUFViGb/Vc+OaS51CQ= X-Original-To: gcc-patches@gcc.gnu.org Delivered-To: gcc-patches@gcc.gnu.org Received: from us-smtp-delivery-124.mimecast.com (us-smtp-delivery-124.mimecast.com [170.10.129.124]) by sourceware.org (Postfix) with ESMTPS id 307503858401 for ; Thu, 24 Aug 2023 14:39:08 +0000 (GMT) DMARC-Filter: OpenDMARC Filter v1.4.2 sourceware.org 307503858401 Received: from mimecast-mx02.redhat.com (66.187.233.73 [66.187.233.73]) by relay.mimecast.com with ESMTP with STARTTLS (version=TLSv1.2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id us-mta-107-6LAL6cVmNGuCC0Pyc1Fa_w-1; Thu, 24 Aug 2023 10:39:06 -0400 X-MC-Unique: 6LAL6cVmNGuCC0Pyc1Fa_w-1 Received: from smtp.corp.redhat.com (int-mx02.intmail.prod.int.rdu2.redhat.com [10.11.54.2]) (using TLSv1.2 with cipher AECDH-AES256-SHA (256/256 bits)) (No client certificate requested) by mimecast-mx02.redhat.com (Postfix) with ESMTPS id 3F8C73C14AA9 for ; Thu, 24 Aug 2023 14:39:06 +0000 (UTC) Received: from t14s.localdomain.com (unknown [10.22.32.117]) by smtp.corp.redhat.com (Postfix) with ESMTP id 1B0FC40D283A; Thu, 24 Aug 2023 14:39:06 +0000 (UTC) To: gcc-patches@gcc.gnu.org Cc: David Malcolm Subject: [PATCH 2/9] analyzer: handle symbolic bindings in scan_for_null_terminator [PR105899] Date: Thu, 24 Aug 2023 10:38:56 -0400 Message-Id: <20230824143903.3161185-3-dmalcolm@redhat.com> In-Reply-To: <20230824143903.3161185-1-dmalcolm@redhat.com> References: <20230824143903.3161185-1-dmalcolm@redhat.com> MIME-Version: 1.0 X-Scanned-By: MIMEDefang 3.1 on 10.11.54.2 X-Mimecast-Spam-Score: 0 X-Mimecast-Originator: redhat.com X-Spam-Status: No, score=-11.7 required=5.0 tests=BAYES_00, DKIMWL_WL_HIGH, DKIM_SIGNED, DKIM_VALID, DKIM_VALID_AU, DKIM_VALID_EF, GIT_PATCH_0, RCVD_IN_DNSWL_NONE, RCVD_IN_MSPIKE_H4, RCVD_IN_MSPIKE_WL, SPF_HELO_NONE, SPF_NONE, TXREP autolearn=ham autolearn_force=no version=3.4.6 X-Spam-Checker-Version: SpamAssassin 3.4.6 (2021-04-09) on server2.sourceware.org X-BeenThere: gcc-patches@gcc.gnu.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: Gcc-patches mailing list List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-Patchwork-Original-From: David Malcolm via Gcc-patches From: David Malcolm Reply-To: David Malcolm Errors-To: gcc-patches-bounces+ouuuleilei=gmail.com@gcc.gnu.org Sender: "Gcc-patches" X-getmail-retrieved-from-mailbox: INBOX X-GMAIL-THRID: 1775121947105427128 X-GMAIL-MSGID: 1775121947105427128 gcc/analyzer/ChangeLog: PR analyzer/105899 * region-model.cc (iterable_cluster::iterable_cluster): Add symbolic binding keys to m_symbolic_bindings. (iterable_cluster::has_symbolic_bindings_p): New. (iterable_cluster::m_symbolic_bindings): New field. (region_model::scan_for_null_terminator): Treat clusters with symbolic bindings as having unknown strlen. gcc/testsuite/ChangeLog: PR analyzer/105899 * gcc.dg/analyzer/sprintf-1.c: Include "analyzer-decls.h". (test_strlen_1): New. --- gcc/analyzer/region-model.cc | 15 +++++++++++++++ gcc/testsuite/gcc.dg/analyzer/sprintf-1.c | 11 +++++++++++ 2 files changed, 26 insertions(+) diff --git a/gcc/analyzer/region-model.cc b/gcc/analyzer/region-model.cc index 99817aee3a93..7a2f81f36e0f 100644 --- a/gcc/analyzer/region-model.cc +++ b/gcc/analyzer/region-model.cc @@ -3420,6 +3420,8 @@ public: if (concrete_key->get_byte_range (&fragment_bytes)) m_fragments.safe_push (fragment (fragment_bytes, sval)); } + else + m_symbolic_bindings.safe_push (key); } m_fragments.qsort (fragment::cmp_ptrs); } @@ -3440,8 +3442,14 @@ public: return false; } + bool has_symbolic_bindings_p () const + { + return !m_symbolic_bindings.is_empty (); + } + private: auto_vec m_fragments; + auto_vec m_symbolic_bindings; }; /* Simulate reading the bytes at BYTES from BASE_REG. @@ -3610,6 +3618,13 @@ region_model::scan_for_null_terminator (const region *reg, /* No binding for this base_region, or no binding at src_byte_offset (or a symbolic binding). */ + if (c.has_symbolic_bindings_p ()) + { + if (out_sval) + *out_sval = m_mgr->get_or_create_unknown_svalue (NULL_TREE); + return m_mgr->get_or_create_unknown_svalue (size_type_node); + } + /* TODO: the various special-cases seen in region_model::get_store_value. */ diff --git a/gcc/testsuite/gcc.dg/analyzer/sprintf-1.c b/gcc/testsuite/gcc.dg/analyzer/sprintf-1.c index f8dc806d6192..e7c2b3089c5b 100644 --- a/gcc/testsuite/gcc.dg/analyzer/sprintf-1.c +++ b/gcc/testsuite/gcc.dg/analyzer/sprintf-1.c @@ -1,6 +1,8 @@ /* See e.g. https://en.cppreference.com/w/c/io/fprintf and https://www.man7.org/linux/man-pages/man3/sprintf.3.html */ +#include "analyzer-decls.h" + extern int sprintf(char* dst, const char* fmt, ...) __attribute__((__nothrow__)); @@ -64,3 +66,12 @@ test_fmt_not_terminated (char *dst) return sprintf (dst, fmt); /* { dg-warning "stack-based buffer over-read" } */ /* { dg-message "while looking for null terminator for argument 2 \\('&fmt'\\) of 'sprintf'..." "event" { target *-*-* } .-1 } */ } + +void +test_strlen_1 (void) +{ + char buf[10]; + sprintf (buf, "msg: %s\n", "abc"); + __analyzer_eval (__builtin_strlen (buf) == 8); /* { dg-warning "UNKNOWN" } */ + // TODO: ideally would be TRUE +} From patchwork Thu Aug 24 14:38:57 2023 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 8bit X-Patchwork-Submitter: David Malcolm X-Patchwork-Id: 136834 Return-Path: Delivered-To: ouuuleilei@gmail.com Received: by 2002:a59:a7d1:0:b0:3f2:4152:657d with SMTP id p17csp1167832vqm; Thu, 24 Aug 2023 07:41:35 -0700 (PDT) X-Google-Smtp-Source: AGHT+IExPJEr5Hbn/6J6ic5uxWHvXGdY/3siqmnk/5qtjXJcovQSJA/LOqlxaiSyKhX9zmDXO8Mx X-Received: by 2002:a17:906:73c7:b0:9a1:e758:fc70 with SMTP id n7-20020a17090673c700b009a1e758fc70mr3400215ejl.77.1692888095318; Thu, 24 Aug 2023 07:41:35 -0700 (PDT) ARC-Seal: i=1; a=rsa-sha256; t=1692888095; cv=none; d=google.com; s=arc-20160816; b=kBVRfku5+ZwPgV85DpumVXa3+bA/l6D+47fXEMDTJchqT8PTXHg5I1FTuD042CzEcE 4uuQ00PhdKjY143O9M4pYQlhv/ve7kEVJ+tuEIEkI8qMLiJ7GuiJJ8SsOvbtitECdKUM RdsP8xVmZtqhzrZE0RJoKgN7SI3uC+E2u6jKFhr/itJ9Xd85h38sdq30KIdANHHmKJtY Z992n4cO2dfiRtmJr9SnbEx1rle3BxzsLJZgdcLhUm8gNPnnWpZq8V445PDtGjX+cNE9 2cifTdLX912uZG1Cyo4KQKfgJ68eTkTtuaBcVUMWxvgDeY7ps/qzPkQPbuE/UbndMGkP PgFg== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=arc-20160816; h=sender:errors-to:reply-to:from:list-subscribe:list-help:list-post :list-archive:list-unsubscribe:list-id:precedence :content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:cc:to:dmarc-filter:delivered-to :dkim-signature:dkim-filter; bh=qGIGaD6YBdmZGN/6uJarchBi1a4r8Y3kZHwdb3tLpNk=; fh=fa0YJSH7y4k0snNuxsKgOI6vGP7j2f0jR9F1WHC95UA=; b=mY7ihHV1Y37+Gyltyj6ObWtoJHA6TbGI+6Al3hkRKKe+z0K3yVQ4O5b1Y7X5vMlYCa IzdIEJnHqX6UOgQuNyN1Wet7NQaES8HtmwcCVygkt+quugboi+OBb7vcBr4KSEAbNmDF P0WAweLmTOH2p7C5/34c9jBPAryi9YKal0yPUaTTTD0C/wmRALVXOnnsg5FE63C9XI88 x2mRReTJC2dihHCkboDO3R5ZnujeafnyFKyqwT1TgbXn6fkQ+nLRvPhDBu7sBgerHVGr 6jCjAy0Hcd7xf51uOBiuswPIGz6qjISEBymtUSTkh2e4T6yX49zHBpVJt3sKxodxeFiF KZpg== ARC-Authentication-Results: i=1; mx.google.com; dkim=pass header.i=@gcc.gnu.org header.s=default header.b=TVvYUOWw; spf=pass (google.com: domain of gcc-patches-bounces+ouuuleilei=gmail.com@gcc.gnu.org designates 8.43.85.97 as permitted sender) smtp.mailfrom="gcc-patches-bounces+ouuuleilei=gmail.com@gcc.gnu.org"; dmarc=pass (p=NONE sp=NONE dis=NONE) header.from=gnu.org Received: from server2.sourceware.org (ip-8-43-85-97.sourceware.org. [8.43.85.97]) by mx.google.com with ESMTPS id qw22-20020a170906fcb600b0099bc2493e79si10986481ejb.585.2023.08.24.07.41.34 for (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Thu, 24 Aug 2023 07:41:35 -0700 (PDT) Received-SPF: pass (google.com: domain of gcc-patches-bounces+ouuuleilei=gmail.com@gcc.gnu.org designates 8.43.85.97 as permitted sender) client-ip=8.43.85.97; Authentication-Results: mx.google.com; dkim=pass header.i=@gcc.gnu.org header.s=default header.b=TVvYUOWw; spf=pass (google.com: domain of gcc-patches-bounces+ouuuleilei=gmail.com@gcc.gnu.org designates 8.43.85.97 as permitted sender) smtp.mailfrom="gcc-patches-bounces+ouuuleilei=gmail.com@gcc.gnu.org"; dmarc=pass (p=NONE sp=NONE dis=NONE) header.from=gnu.org Received: from server2.sourceware.org (localhost [IPv6:::1]) by sourceware.org (Postfix) with ESMTP id 9CB883883029 for ; Thu, 24 Aug 2023 14:40:08 +0000 (GMT) DKIM-Filter: OpenDKIM Filter v2.11.0 sourceware.org 9CB883883029 DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gcc.gnu.org; s=default; t=1692888008; bh=qGIGaD6YBdmZGN/6uJarchBi1a4r8Y3kZHwdb3tLpNk=; h=To:Cc:Subject:Date:In-Reply-To:References:List-Id: List-Unsubscribe:List-Archive:List-Post:List-Help:List-Subscribe: From:Reply-To:From; b=TVvYUOWwv4O98mGvIUSxP1+pRDzewTTeS4nHhT4galI1ZM19CRewWTnrG74y9HWZ4 Rm/4MnFnHLsc/O3fMhT1O/2Xiq+uxBtYE+WzSXTDIP5ibL8xVtk1z4+XwZSDO3YeJn UfVOlT3PvOMcKc2gNGx9RmPZUT97jOpO2XrmbWKw= X-Original-To: gcc-patches@gcc.gnu.org Delivered-To: gcc-patches@gcc.gnu.org Received: from us-smtp-delivery-124.mimecast.com (us-smtp-delivery-124.mimecast.com [170.10.133.124]) by sourceware.org (Postfix) with ESMTPS id 68F17385734B for ; Thu, 24 Aug 2023 14:39:12 +0000 (GMT) DMARC-Filter: OpenDMARC Filter v1.4.2 sourceware.org 68F17385734B Received: from mimecast-mx02.redhat.com (66.187.233.73 [66.187.233.73]) by relay.mimecast.com with ESMTP with STARTTLS (version=TLSv1.2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id us-mta-164-6654A2t5O1KV9h9gjsEfjA-1; Thu, 24 Aug 2023 10:39:06 -0400 X-MC-Unique: 6654A2t5O1KV9h9gjsEfjA-1 Received: from smtp.corp.redhat.com (int-mx02.intmail.prod.int.rdu2.redhat.com [10.11.54.2]) (using TLSv1.2 with cipher AECDH-AES256-SHA (256/256 bits)) (No client certificate requested) by mimecast-mx02.redhat.com (Postfix) with ESMTPS id 7240A1C06EE5 for ; Thu, 24 Aug 2023 14:39:06 +0000 (UTC) Received: from t14s.localdomain.com (unknown [10.22.32.117]) by smtp.corp.redhat.com (Postfix) with ESMTP id 4E51840D2839; Thu, 24 Aug 2023 14:39:06 +0000 (UTC) To: gcc-patches@gcc.gnu.org Cc: David Malcolm Subject: [PATCH 3/9] analyzer: reimplement kf_strcpy [PR105899] Date: Thu, 24 Aug 2023 10:38:57 -0400 Message-Id: <20230824143903.3161185-4-dmalcolm@redhat.com> In-Reply-To: <20230824143903.3161185-1-dmalcolm@redhat.com> References: <20230824143903.3161185-1-dmalcolm@redhat.com> MIME-Version: 1.0 X-Scanned-By: MIMEDefang 3.1 on 10.11.54.2 X-Mimecast-Spam-Score: 0 X-Mimecast-Originator: redhat.com X-Spam-Status: No, score=-10.2 required=5.0 tests=BAYES_00, BODY_8BITS, DKIMWL_WL_HIGH, DKIM_SIGNED, DKIM_VALID, DKIM_VALID_AU, DKIM_VALID_EF, GIT_PATCH_0, RCVD_IN_DNSWL_NONE, RCVD_IN_MSPIKE_H4, RCVD_IN_MSPIKE_WL, SPF_HELO_NONE, SPF_NONE, TXREP autolearn=ham autolearn_force=no version=3.4.6 X-Spam-Checker-Version: SpamAssassin 3.4.6 (2021-04-09) on server2.sourceware.org X-BeenThere: gcc-patches@gcc.gnu.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: Gcc-patches mailing list List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-Patchwork-Original-From: David Malcolm via Gcc-patches From: David Malcolm Reply-To: David Malcolm Errors-To: gcc-patches-bounces+ouuuleilei=gmail.com@gcc.gnu.org Sender: "Gcc-patches" X-getmail-retrieved-from-mailbox: INBOX X-GMAIL-THRID: 1775121827438611856 X-GMAIL-MSGID: 1775121827438611856 This patch reimplements the analyzer's implementation of strcpy using the region_model::scan_for_null_terminator infrastructure, so that e.g. it can complain about out-of-bounds reads/writes, unterminated strings, etc. gcc/analyzer/ChangeLog: PR analyzer/105899 * kf.cc (kf_strcpy::impl_call_pre): Reimplement using check_for_null_terminated_string_arg. * region-model.cc (region_model::get_store_bytes): Shortcut reading all of a string_region. (region_model::scan_for_null_terminator): Use get_store_value for the bytes rather than "unknown" when returning an unknown length. (region_model::write_bytes): New. * region-model.h (region_model::write_bytes): New decl. gcc/testsuite/ChangeLog: PR analyzer/105899 * gcc.dg/analyzer/out-of-bounds-diagram-16.c: New test. * gcc.dg/analyzer/strcpy-1.c: Add test coverage. * gcc.dg/analyzer/strcpy-3.c: Likewise. * gcc.dg/analyzer/strcpy-4.c: New test. --- gcc/analyzer/kf.cc | 32 +++++------- gcc/analyzer/region-model.cc | 32 ++++++++++-- gcc/analyzer/region-model.h | 4 ++ .../analyzer/out-of-bounds-diagram-16.c | 31 +++++++++++ gcc/testsuite/gcc.dg/analyzer/strcpy-1.c | 22 ++++++++ gcc/testsuite/gcc.dg/analyzer/strcpy-3.c | 1 + gcc/testsuite/gcc.dg/analyzer/strcpy-4.c | 51 +++++++++++++++++++ 7 files changed, 150 insertions(+), 23 deletions(-) create mode 100644 gcc/testsuite/gcc.dg/analyzer/out-of-bounds-diagram-16.c create mode 100644 gcc/testsuite/gcc.dg/analyzer/strcpy-4.c diff --git a/gcc/analyzer/kf.cc b/gcc/analyzer/kf.cc index 59f46bab581c..6b33cd159dac 100644 --- a/gcc/analyzer/kf.cc +++ b/gcc/analyzer/kf.cc @@ -1135,29 +1135,25 @@ void kf_strcpy::impl_call_pre (const call_details &cd) const { region_model *model = cd.get_model (); - region_model_manager *mgr = cd.get_manager (); + region_model_context *ctxt = cd.get_ctxt (); const svalue *dest_sval = cd.get_arg_svalue (0); const region *dest_reg = model->deref_rvalue (dest_sval, cd.get_arg_tree (0), - cd.get_ctxt ()); - const svalue *src_sval = cd.get_arg_svalue (1); - const region *src_reg = model->deref_rvalue (src_sval, cd.get_arg_tree (1), - cd.get_ctxt ()); - const svalue *src_contents_sval = model->get_store_value (src_reg, - cd.get_ctxt ()); - cd.check_for_null_terminated_string_arg (1); - + ctxt); + /* strcpy returns the initial param. */ cd.maybe_set_lhs (dest_sval); - /* Try to get the string size if SRC_REG is a string_region. */ - const svalue *copied_bytes_sval = model->get_string_size (src_reg); - /* Otherwise, check if the contents of SRC_REG is a string. */ - if (copied_bytes_sval->get_kind () == SK_UNKNOWN) - copied_bytes_sval = model->get_string_size (src_contents_sval); - - const region *sized_dest_reg - = mgr->get_sized_region (dest_reg, NULL_TREE, copied_bytes_sval); - model->set_value (sized_dest_reg, src_contents_sval, cd.get_ctxt ()); + const svalue *bytes_to_copy; + if (const svalue *num_bytes_read_sval + = cd.check_for_null_terminated_string_arg (1, &bytes_to_copy)) + { + model->write_bytes (dest_reg, num_bytes_read_sval, bytes_to_copy, ctxt); + } + else + { + if (cd.get_ctxt ()) + cd.get_ctxt ()->terminate_path (); + } } /* Handler for "strdup" and "__builtin_strdup". */ diff --git a/gcc/analyzer/region-model.cc b/gcc/analyzer/region-model.cc index 7a2f81f36e0f..cc8d895d9665 100644 --- a/gcc/analyzer/region-model.cc +++ b/gcc/analyzer/region-model.cc @@ -3460,6 +3460,13 @@ region_model::get_store_bytes (const region *base_reg, const byte_range &bytes, region_model_context *ctxt) const { + /* Shortcut reading all of a string_region. */ + if (bytes.get_start_byte_offset () == 0) + if (const string_region *string_reg = base_reg->dyn_cast_string_region ()) + if (bytes.m_size_in_bytes + == TREE_STRING_LENGTH (string_reg->get_string_cst ())) + return m_mgr->get_or_create_initial_value (base_reg); + const svalue *index_sval = m_mgr->get_or_create_int_cst (size_type_node, bytes.get_start_byte_offset ()); @@ -3533,14 +3540,14 @@ region_model::scan_for_null_terminator (const region *reg, if (offset.symbolic_p ()) { if (out_sval) - *out_sval = m_mgr->get_or_create_unknown_svalue (NULL_TREE); + *out_sval = get_store_value (reg, nullptr); return m_mgr->get_or_create_unknown_svalue (size_type_node); } byte_offset_t src_byte_offset; if (!offset.get_concrete_byte_offset (&src_byte_offset)) { if (out_sval) - *out_sval = m_mgr->get_or_create_unknown_svalue (NULL_TREE); + *out_sval = get_store_value (reg, nullptr); return m_mgr->get_or_create_unknown_svalue (size_type_node); } const byte_offset_t initial_src_byte_offset = src_byte_offset; @@ -3582,7 +3589,7 @@ region_model::scan_for_null_terminator (const region *reg, if (is_terminated.is_unknown ()) { if (out_sval) - *out_sval = m_mgr->get_or_create_unknown_svalue (NULL_TREE); + *out_sval = get_store_value (reg, nullptr); return m_mgr->get_or_create_unknown_svalue (size_type_node); } @@ -3621,7 +3628,7 @@ region_model::scan_for_null_terminator (const region *reg, if (c.has_symbolic_bindings_p ()) { if (out_sval) - *out_sval = m_mgr->get_or_create_unknown_svalue (NULL_TREE); + *out_sval = get_store_value (reg, nullptr); return m_mgr->get_or_create_unknown_svalue (size_type_node); } @@ -3638,7 +3645,7 @@ region_model::scan_for_null_terminator (const region *reg, if (base_reg->can_have_initial_svalue_p ()) { if (out_sval) - *out_sval = m_mgr->get_or_create_unknown_svalue (NULL_TREE); + *out_sval = get_store_value (reg, nullptr); return m_mgr->get_or_create_unknown_svalue (size_type_node); } else @@ -3801,6 +3808,21 @@ region_model::zero_fill_region (const region *reg) m_store.zero_fill_region (m_mgr->get_store_manager(), reg); } +/* Copy NUM_BYTES_SVAL of SVAL to DEST_REG. + Use CTXT to report any warnings associated with the copy + (e.g. out-of-bounds writes). */ + +void +region_model::write_bytes (const region *dest_reg, + const svalue *num_bytes_sval, + const svalue *sval, + region_model_context *ctxt) +{ + const region *sized_dest_reg + = m_mgr->get_sized_region (dest_reg, NULL_TREE, num_bytes_sval); + set_value (sized_dest_reg, sval, ctxt); +} + /* Mark REG as having unknown content. */ void diff --git a/gcc/analyzer/region-model.h b/gcc/analyzer/region-model.h index 3979bf124783..9c6e60bbe824 100644 --- a/gcc/analyzer/region-model.h +++ b/gcc/analyzer/region-model.h @@ -367,6 +367,10 @@ class region_model void purge_region (const region *reg); void fill_region (const region *reg, const svalue *sval); void zero_fill_region (const region *reg); + void write_bytes (const region *dest_reg, + const svalue *num_bytes_sval, + const svalue *sval, + region_model_context *ctxt); void mark_region_as_unknown (const region *reg, uncertainty_t *uncertainty); tristate eval_condition (const svalue *lhs, diff --git a/gcc/testsuite/gcc.dg/analyzer/out-of-bounds-diagram-16.c b/gcc/testsuite/gcc.dg/analyzer/out-of-bounds-diagram-16.c new file mode 100644 index 000000000000..b0fb409267ea --- /dev/null +++ b/gcc/testsuite/gcc.dg/analyzer/out-of-bounds-diagram-16.c @@ -0,0 +1,31 @@ +/* { dg-additional-options "-fdiagnostics-text-art-charset=unicode" } */ + +#include +#include "analyzer-decls.h" + +char *test_fixed_size_heap_2_invalid (void) +{ + char str[] = "abc"; + char *p = __builtin_malloc (strlen (str)); /* { dg-message "\\(1\\) capacity: 3 bytes" } */ + if (!p) + return NULL; + strcpy (p, str); /* { dg-warning "heap-based buffer overflow" } */ + return p; +} + +/* { dg-begin-multiline-output "" } + ┌──────────────────────────────────────────────────────────────────────┐ + │ write of 4 bytes │ + └──────────────────────────────────────────────────────────────────────┘ + │ │ + │ │ + v v + ┌───────────────────────────────────────────────────┐┌─────────────────┐ + │ buffer allocated on heap at (1) ││after valid range│ + └───────────────────────────────────────────────────┘└─────────────────┘ + ├─────────────────────────┬─────────────────────────┤├────────┬────────┤ + │ │ + ╭────────┴────────╮ ╭─────────┴────────╮ + │capacity: 3 bytes│ │overflow of 1 byte│ + ╰─────────────────╯ ╰──────────────────╯ + { dg-end-multiline-output "" } */ diff --git a/gcc/testsuite/gcc.dg/analyzer/strcpy-1.c b/gcc/testsuite/gcc.dg/analyzer/strcpy-1.c index d21e77175119..30341061f4cc 100644 --- a/gcc/testsuite/gcc.dg/analyzer/strcpy-1.c +++ b/gcc/testsuite/gcc.dg/analyzer/strcpy-1.c @@ -30,3 +30,25 @@ char *test_uninitialized (char *dst) return strcpy (dst, buf); /* { dg-warning "use of uninitialized value 'buf\\\[0\\\]'" } */ /* { dg-message "while looking for null terminator for argument 2 \\('&buf'\\) of 'strcpy'..." "event" { target *-*-* } .-1 } */ } + +extern void external_fn (void *ptr); + +char *test_external_fn (void) +{ + char src[10]; + char dst[10]; + external_fn (src); + strcpy (dst, src); + __analyzer_eval (strlen (dst) == strlen (src)); /* { dg-warning "UNKNOWN" } */ + // TODO: ideally would be TRUE +} + +void test_sprintf_strcpy (const char *a, const char *b) +{ + char buf_1[10]; + char buf_2[10]; + __builtin_sprintf (buf_1, "%s/%s", a, b); + strcpy (buf_2, buf_1); + __analyzer_eval (strlen (buf_1) == strlen (buf_2)); /* { dg-warning "UNKNOWN" } */ + // TODO: ideally would be TRUE +} diff --git a/gcc/testsuite/gcc.dg/analyzer/strcpy-3.c b/gcc/testsuite/gcc.dg/analyzer/strcpy-3.c index a38f9a7641fe..abb49bc39f27 100644 --- a/gcc/testsuite/gcc.dg/analyzer/strcpy-3.c +++ b/gcc/testsuite/gcc.dg/analyzer/strcpy-3.c @@ -20,4 +20,5 @@ void test_1 (void) __analyzer_eval (result[3] == 'l'); /* { dg-warning "TRUE" } */ __analyzer_eval (result[4] == 'o'); /* { dg-warning "TRUE" } */ __analyzer_eval (result[5] == 0); /* { dg-warning "TRUE" } */ + __analyzer_eval (strlen (result) == 5); /* { dg-warning "TRUE" } */ } diff --git a/gcc/testsuite/gcc.dg/analyzer/strcpy-4.c b/gcc/testsuite/gcc.dg/analyzer/strcpy-4.c new file mode 100644 index 000000000000..435a4cadee9d --- /dev/null +++ b/gcc/testsuite/gcc.dg/analyzer/strcpy-4.c @@ -0,0 +1,51 @@ +/* { dg-additional-options "-Wno-stringop-overflow" } */ + +#include +#include "analyzer-decls.h" + +void +test_fixed_size_stack_1 (void) +{ + char buf[3]; + strcpy (buf, "abc"); /* { dg-warning "stack-based buffer overflow" } */ +} + +char *test_fixed_size_heap_1 (void) +{ + char str[] = "abc"; + char *p = __builtin_malloc (3); + if (!p) + return NULL; + strcpy (p, str); /* { dg-warning "heap-based buffer overflow" } */ + return p; +} + +char *test_fixed_size_heap_2_invalid (void) +{ + char str[] = "abc"; + char *p = __builtin_malloc (strlen (str)); + if (!p) + return NULL; + strcpy (p, str); /* { dg-warning "heap-based buffer overflow" } */ + return p; +} + +char *test_fixed_size_heap_2_valid (void) +{ + char str[] = "abc"; + char *p = __builtin_malloc (strlen (str) + 1); + if (!p) + return NULL; + strcpy (p, str); /* { dg-bogus "" } */ + __analyzer_eval (strlen (p) == 3); /* { dg-warning "TRUE" } */ + return p; +} + +char *test_dynamic_size_heap_1 (const char *src) +{ + char *p = __builtin_malloc (strlen (src)); + if (!p) + return NULL; + strcpy (p, src); // TODO: write of null terminator is oob + return p; +} From patchwork Thu Aug 24 14:38:58 2023 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: David Malcolm X-Patchwork-Id: 136832 Return-Path: Delivered-To: ouuuleilei@gmail.com Received: by 2002:a59:a7d1:0:b0:3f2:4152:657d with SMTP id p17csp1167617vqm; Thu, 24 Aug 2023 07:41:10 -0700 (PDT) X-Google-Smtp-Source: AGHT+IHBFJe+AlW3IR8GemYaIQ1S1VFUt+gK9YL2mTG0fTwKD/5Gh/eiaWfW6AgId3K9yoNbjY7V X-Received: by 2002:ac2:5b5b:0:b0:500:8fe8:7e82 with SMTP id i27-20020ac25b5b000000b005008fe87e82mr5691162lfp.68.1692888070117; Thu, 24 Aug 2023 07:41:10 -0700 (PDT) ARC-Seal: i=1; a=rsa-sha256; t=1692888070; cv=none; d=google.com; s=arc-20160816; b=GpuvD8neyz0E7cqkUERTS84s4UBvKq2ynIofbKWxsqgBUG9qsdpc0JUMcNKAYkw3HJ vbXl+xzqKDvpiRq9Pi3kOSVZP7LpFQRXy89wG3PtcH53CJEe7l6s26EXYtam0QLIsjF4 BU+ursDUnFv8Dy2YtLg/1H0/0fWyUe+YXX7Q9uvezaIhmxppMFeHWuWBql3Jqwzc1a3R A74mj1JdX5gMV33BI4wmWg9Hl8+5GZvUypoOt5rzgcEbpzXe7p/6eoRKp3ZclaMjlm3L Ffh6yQWA5bQVwOyStH6qJ+/m0Cxbo5ma7eUibzTt7YpIAeGGQsqbR7cAKQo6b7xkDeF1 DSOQ== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=arc-20160816; h=sender:errors-to:reply-to:from:list-subscribe:list-help:list-post :list-archive:list-unsubscribe:list-id:precedence :content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:cc:to:dmarc-filter:delivered-to :dkim-signature:dkim-filter; bh=7edK7MlF4oycdMXkbYFPByfq2+FNJgBE9s336N7/nJs=; fh=fa0YJSH7y4k0snNuxsKgOI6vGP7j2f0jR9F1WHC95UA=; b=DsuDhGla3TSY3OeBXvGjIAl/PDcYJUTaNVW6PzVVTOOy/FZ0Bsp8R+85GZbvw73Pj1 ZpMUW8Zz7BwYRugfI9B3Ix6N4fL8PVD9Lg1oEGsNnbtL47piFzyJo2/sByiMD5uIWd7r rJDH4IhNgt54jUqCj9V7H4zWV1p2WhJYkHOQCcZWslVhKQUyhIVWA4jFp7Twj3nUly+D XHgFadk+AE8C/Qa/+uHlLJTsF/v1/4LTW3/r0ZzZoEv0VTuUmWPSuNKstHJv3W6OMmvw 3+hBmxWiRZN2jGaOnOwd1tjicOt6jNmU+WVXw1j4SpNa/x7QB2uolLHrXw+1srRyal5S O+bQ== ARC-Authentication-Results: i=1; mx.google.com; dkim=pass header.i=@gcc.gnu.org header.s=default header.b=JT3OsTrf; spf=pass (google.com: domain of gcc-patches-bounces+ouuuleilei=gmail.com@gcc.gnu.org designates 8.43.85.97 as permitted sender) smtp.mailfrom="gcc-patches-bounces+ouuuleilei=gmail.com@gcc.gnu.org"; dmarc=pass (p=NONE sp=NONE dis=NONE) header.from=gnu.org Received: from server2.sourceware.org (ip-8-43-85-97.sourceware.org. [8.43.85.97]) by mx.google.com with ESMTPS id m23-20020aa7d357000000b0052a3c4c5be4si2201138edr.48.2023.08.24.07.41.09 for (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Thu, 24 Aug 2023 07:41:10 -0700 (PDT) Received-SPF: pass (google.com: domain of gcc-patches-bounces+ouuuleilei=gmail.com@gcc.gnu.org designates 8.43.85.97 as permitted sender) client-ip=8.43.85.97; Authentication-Results: mx.google.com; dkim=pass header.i=@gcc.gnu.org header.s=default header.b=JT3OsTrf; spf=pass (google.com: domain of gcc-patches-bounces+ouuuleilei=gmail.com@gcc.gnu.org designates 8.43.85.97 as permitted sender) smtp.mailfrom="gcc-patches-bounces+ouuuleilei=gmail.com@gcc.gnu.org"; dmarc=pass (p=NONE sp=NONE dis=NONE) header.from=gnu.org Received: from server2.sourceware.org (localhost [IPv6:::1]) by sourceware.org (Postfix) with ESMTP id 4A1D83853D02 for ; Thu, 24 Aug 2023 14:39:59 +0000 (GMT) DKIM-Filter: OpenDKIM Filter v2.11.0 sourceware.org 4A1D83853D02 DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gcc.gnu.org; s=default; t=1692887999; bh=7edK7MlF4oycdMXkbYFPByfq2+FNJgBE9s336N7/nJs=; h=To:Cc:Subject:Date:In-Reply-To:References:List-Id: List-Unsubscribe:List-Archive:List-Post:List-Help:List-Subscribe: From:Reply-To:From; b=JT3OsTrfFDAnM7V61oKWDO+42Oh/hHiBXKdOBUhDBbT+ZYwWPB4kgiFk1377in9qn GMLLGe79vncUq+Bg6lUr5PAxtu7badOAd9WDa36+aiV+lyBGyh11xfa1r6WBr5NbyW hZGe30oJbw19sboJgmts+j3FJQGCzumcU+Bt5mnc= X-Original-To: gcc-patches@gcc.gnu.org Delivered-To: gcc-patches@gcc.gnu.org Received: from us-smtp-delivery-124.mimecast.com (us-smtp-delivery-124.mimecast.com [170.10.133.124]) by sourceware.org (Postfix) with ESMTPS id 807CF3858402 for ; Thu, 24 Aug 2023 14:39:08 +0000 (GMT) DMARC-Filter: OpenDMARC Filter v1.4.2 sourceware.org 807CF3858402 Received: from mimecast-mx02.redhat.com (66.187.233.73 [66.187.233.73]) by relay.mimecast.com with ESMTP with STARTTLS (version=TLSv1.2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id us-mta-70-jGCT9VwTNmuwjYnci6peuQ-1; Thu, 24 Aug 2023 10:39:06 -0400 X-MC-Unique: jGCT9VwTNmuwjYnci6peuQ-1 Received: from smtp.corp.redhat.com (int-mx02.intmail.prod.int.rdu2.redhat.com [10.11.54.2]) (using TLSv1.2 with cipher AECDH-AES256-SHA (256/256 bits)) (No client certificate requested) by mimecast-mx02.redhat.com (Postfix) with ESMTPS id A40F02807D62 for ; Thu, 24 Aug 2023 14:39:06 +0000 (UTC) Received: from t14s.localdomain.com (unknown [10.22.32.117]) by smtp.corp.redhat.com (Postfix) with ESMTP id 80B5D40D2839; Thu, 24 Aug 2023 14:39:06 +0000 (UTC) To: gcc-patches@gcc.gnu.org Cc: David Malcolm Subject: [PATCH 4/9] analyzer: eliminate region_model::get_string_size [PR105899] Date: Thu, 24 Aug 2023 10:38:58 -0400 Message-Id: <20230824143903.3161185-5-dmalcolm@redhat.com> In-Reply-To: <20230824143903.3161185-1-dmalcolm@redhat.com> References: <20230824143903.3161185-1-dmalcolm@redhat.com> MIME-Version: 1.0 X-Scanned-By: MIMEDefang 3.1 on 10.11.54.2 X-Mimecast-Spam-Score: 0 X-Mimecast-Originator: redhat.com X-Spam-Status: No, score=-11.7 required=5.0 tests=BAYES_00, DKIMWL_WL_HIGH, DKIM_SIGNED, DKIM_VALID, DKIM_VALID_AU, DKIM_VALID_EF, GIT_PATCH_0, RCVD_IN_DNSWL_NONE, RCVD_IN_MSPIKE_H4, RCVD_IN_MSPIKE_WL, SPF_HELO_NONE, SPF_NONE, TXREP autolearn=ham autolearn_force=no version=3.4.6 X-Spam-Checker-Version: SpamAssassin 3.4.6 (2021-04-09) on server2.sourceware.org X-BeenThere: gcc-patches@gcc.gnu.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: Gcc-patches mailing list List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-Patchwork-Original-From: David Malcolm via Gcc-patches From: David Malcolm Reply-To: David Malcolm Errors-To: gcc-patches-bounces+ouuuleilei=gmail.com@gcc.gnu.org Sender: "Gcc-patches" X-getmail-retrieved-from-mailbox: INBOX X-GMAIL-THRID: 1775121800687857519 X-GMAIL-MSGID: 1775121800687857519 gcc/analyzer/ChangeLog: PR analyzer/105899 * region-model.cc (region_model::get_string_size): Delete both. * region-model.h (region_model::get_string_size): Delete both decls. --- gcc/analyzer/region-model.cc | 29 ----------------------------- gcc/analyzer/region-model.h | 3 --- 2 files changed, 32 deletions(-) diff --git a/gcc/analyzer/region-model.cc b/gcc/analyzer/region-model.cc index cc8d895d9665..1fe66f4719fa 100644 --- a/gcc/analyzer/region-model.cc +++ b/gcc/analyzer/region-model.cc @@ -2794,35 +2794,6 @@ region_model::get_capacity (const region *reg) const return m_mgr->get_or_create_unknown_svalue (sizetype); } -/* Return the string size, including the 0-terminator, if SVAL is a - constant_svalue holding a string. Otherwise, return an unknown_svalue. */ - -const svalue * -region_model::get_string_size (const svalue *sval) const -{ - tree cst = sval->maybe_get_constant (); - if (!cst || TREE_CODE (cst) != STRING_CST) - return m_mgr->get_or_create_unknown_svalue (size_type_node); - - tree out = build_int_cst (size_type_node, TREE_STRING_LENGTH (cst)); - return m_mgr->get_or_create_constant_svalue (out); -} - -/* Return the string size, including the 0-terminator, if REG is a - string_region. Otherwise, return an unknown_svalue. */ - -const svalue * -region_model::get_string_size (const region *reg) const -{ - const string_region *str_reg = dyn_cast (reg); - if (!str_reg) - return m_mgr->get_or_create_unknown_svalue (size_type_node); - - tree cst = str_reg->get_string_cst (); - tree out = build_int_cst (size_type_node, TREE_STRING_LENGTH (cst)); - return m_mgr->get_or_create_constant_svalue (out); -} - /* If CTXT is non-NULL, use it to warn about any problems accessing REG, using DIR to determine if this access is a read or write. Return TRUE if an OOB access was detected. diff --git a/gcc/analyzer/region-model.h b/gcc/analyzer/region-model.h index 9c6e60bbe824..41df1885ad5b 100644 --- a/gcc/analyzer/region-model.h +++ b/gcc/analyzer/region-model.h @@ -469,9 +469,6 @@ class region_model const svalue *get_capacity (const region *reg) const; - const svalue *get_string_size (const svalue *sval) const; - const svalue *get_string_size (const region *reg) const; - bool replay_call_summary (call_summary_replay &r, const region_model &summary); From patchwork Thu Aug 24 14:38:59 2023 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: David Malcolm X-Patchwork-Id: 136833 Return-Path: Delivered-To: ouuuleilei@gmail.com Received: by 2002:a59:a7d1:0:b0:3f2:4152:657d with SMTP id p17csp1167694vqm; Thu, 24 Aug 2023 07:41:19 -0700 (PDT) X-Google-Smtp-Source: AGHT+IH5Ct1TfaUD1zay/ZWJC6QIacG9jevn6E3LlBXJsM6/J8JwU/PS1DiqDHyRV3W7NMX3iind X-Received: by 2002:a17:907:7617:b0:9a1:d79a:4193 with SMTP id jx23-20020a170907761700b009a1d79a4193mr3925462ejc.23.1692888079222; Thu, 24 Aug 2023 07:41:19 -0700 (PDT) ARC-Seal: i=1; a=rsa-sha256; t=1692888079; cv=none; d=google.com; s=arc-20160816; b=0XU37h3zcFOjQkL3mDaqCf4iGR4uwSh0v4N6XzIfRwJtLOOQkHdDKHOjRkX1I0uAda n30+Y2tJ10M7QrAwd21klHqboA72PRPyFgaF60MKYdJCTqrDh4zJrkS8njhYjcnZ7WgH +LAA5NjkzbbWKGTgra9HFfPoHiiQdthyrctZXETCSDszW9mVdZyVn75UPXsyvC8O7PC7 LsByx2i9YArypr/HyVToPJxXeJ02byTmimw+sYspiCroJosBlAYkdZM4jht6idT0ovN7 6vBNnREmKY7R9pY3ZYGOrPP+XMmeSA530bjnSqACRTx6+y7G06sIXzpfvVOY6oHLf+tL Ab0g== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=arc-20160816; h=sender:errors-to:reply-to:from:list-subscribe:list-help:list-post :list-archive:list-unsubscribe:list-id:precedence :content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:cc:to:dmarc-filter:delivered-to :dkim-signature:dkim-filter; bh=pfNN9YxmNTfH5ihTJs57LCqj+0dbbJAOoXPldfC9+mg=; fh=fa0YJSH7y4k0snNuxsKgOI6vGP7j2f0jR9F1WHC95UA=; b=xIGFqnFqD0OwdDSSVl+U9vkchV9+jpXiD5XhZO326gIJmu/p+Tp6CCGlKGn9j2CqWp QMdD3SXOhbpTyb69B+Kg6a24YaqN1pOmVjvCKkqMIZ1tW/qQ5MGdLBG6TUc1M93cOK/b t8TgGdKB6/DlQ7xms9HjhhDEZUlfBpmCy0h1K5wdQtWcuJmeKKEVwoPkAlXCunG/Yjjt DNtbCOe9M5QXm8J03/TdfsdnN/NzFxMHsKT4cPBuVaVlCIlYnuinRUdY0iP8ZdSghxgI HX2ilfKHKC/c3zS7BnTFttCyDq9rB4fR8udRuX6FhxfGxqGKBRXxgwlB6+oAhqq4TaHN tBbg== ARC-Authentication-Results: i=1; mx.google.com; dkim=pass header.i=@gcc.gnu.org header.s=default header.b=IfX8u7Wb; spf=pass (google.com: domain of gcc-patches-bounces+ouuuleilei=gmail.com@gcc.gnu.org designates 2620:52:3:1:0:246e:9693:128c as permitted sender) smtp.mailfrom="gcc-patches-bounces+ouuuleilei=gmail.com@gcc.gnu.org"; dmarc=pass (p=NONE sp=NONE dis=NONE) header.from=gnu.org Received: from server2.sourceware.org (server2.sourceware.org. [2620:52:3:1:0:246e:9693:128c]) by mx.google.com with ESMTPS id x2-20020a170906804200b0099cb9d70178si10514392ejw.869.2023.08.24.07.41.18 for (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Thu, 24 Aug 2023 07:41:19 -0700 (PDT) Received-SPF: pass (google.com: domain of gcc-patches-bounces+ouuuleilei=gmail.com@gcc.gnu.org designates 2620:52:3:1:0:246e:9693:128c as permitted sender) client-ip=2620:52:3:1:0:246e:9693:128c; Authentication-Results: mx.google.com; dkim=pass header.i=@gcc.gnu.org header.s=default header.b=IfX8u7Wb; spf=pass (google.com: domain of gcc-patches-bounces+ouuuleilei=gmail.com@gcc.gnu.org designates 2620:52:3:1:0:246e:9693:128c as permitted sender) smtp.mailfrom="gcc-patches-bounces+ouuuleilei=gmail.com@gcc.gnu.org"; dmarc=pass (p=NONE sp=NONE dis=NONE) header.from=gnu.org Received: from server2.sourceware.org (localhost [IPv6:::1]) by sourceware.org (Postfix) with ESMTP id BD348388266E for ; Thu, 24 Aug 2023 14:40:02 +0000 (GMT) DKIM-Filter: OpenDKIM Filter v2.11.0 sourceware.org BD348388266E DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gcc.gnu.org; s=default; t=1692888002; bh=pfNN9YxmNTfH5ihTJs57LCqj+0dbbJAOoXPldfC9+mg=; h=To:Cc:Subject:Date:In-Reply-To:References:List-Id: List-Unsubscribe:List-Archive:List-Post:List-Help:List-Subscribe: From:Reply-To:From; b=IfX8u7WbiCVmYhQWSzwV8vSkJrgkgyHT0uREP6zvxTlXe+F+v0ywpkeybSImheQ73 Kvkgwb9xhHOhwlfh+25mtEM5SgENpUNsL8E4ExWd2l05CPESUrTkiJTGDFBjd5nl0a OE425p858J03p/LwHJau7W7gEsTbP64+g4eQ/Mxs= X-Original-To: gcc-patches@gcc.gnu.org Delivered-To: gcc-patches@gcc.gnu.org Received: from us-smtp-delivery-124.mimecast.com (us-smtp-delivery-124.mimecast.com [170.10.133.124]) by sourceware.org (Postfix) with ESMTPS id 48F51385841C for ; Thu, 24 Aug 2023 14:39:09 +0000 (GMT) DMARC-Filter: OpenDMARC Filter v1.4.2 sourceware.org 48F51385841C Received: from mimecast-mx02.redhat.com (66.187.233.73 [66.187.233.73]) by relay.mimecast.com with ESMTP with STARTTLS (version=TLSv1.2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id us-mta-212-T6j2sL12OGuGGvTrQVzwvw-1; Thu, 24 Aug 2023 10:39:07 -0400 X-MC-Unique: T6j2sL12OGuGGvTrQVzwvw-1 Received: from smtp.corp.redhat.com (int-mx02.intmail.prod.int.rdu2.redhat.com [10.11.54.2]) (using TLSv1.2 with cipher AECDH-AES256-SHA (256/256 bits)) (No client certificate requested) by mimecast-mx02.redhat.com (Postfix) with ESMTPS id E29C82807D6C for ; Thu, 24 Aug 2023 14:39:06 +0000 (UTC) Received: from t14s.localdomain.com (unknown [10.22.32.117]) by smtp.corp.redhat.com (Postfix) with ESMTP id B346040D2840; Thu, 24 Aug 2023 14:39:06 +0000 (UTC) To: gcc-patches@gcc.gnu.org Cc: David Malcolm Subject: [PATCH 5/9] analyzer: reimplement kf_memcpy_memmove Date: Thu, 24 Aug 2023 10:38:59 -0400 Message-Id: <20230824143903.3161185-6-dmalcolm@redhat.com> In-Reply-To: <20230824143903.3161185-1-dmalcolm@redhat.com> References: <20230824143903.3161185-1-dmalcolm@redhat.com> MIME-Version: 1.0 X-Scanned-By: MIMEDefang 3.1 on 10.11.54.2 X-Mimecast-Spam-Score: 0 X-Mimecast-Originator: redhat.com X-Spam-Status: No, score=-11.7 required=5.0 tests=BAYES_00, DKIMWL_WL_HIGH, DKIM_SIGNED, DKIM_VALID, DKIM_VALID_AU, DKIM_VALID_EF, GIT_PATCH_0, RCVD_IN_DNSWL_NONE, RCVD_IN_MSPIKE_H4, RCVD_IN_MSPIKE_WL, SPF_HELO_NONE, SPF_NONE, TXREP autolearn=ham autolearn_force=no version=3.4.6 X-Spam-Checker-Version: SpamAssassin 3.4.6 (2021-04-09) on server2.sourceware.org X-BeenThere: gcc-patches@gcc.gnu.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: Gcc-patches mailing list List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-Patchwork-Original-From: David Malcolm via Gcc-patches From: David Malcolm Reply-To: David Malcolm Errors-To: gcc-patches-bounces+ouuuleilei=gmail.com@gcc.gnu.org Sender: "Gcc-patches" X-getmail-retrieved-from-mailbox: INBOX X-GMAIL-THRID: 1775121810209213176 X-GMAIL-MSGID: 1775121810209213176 gcc/analyzer/ChangeLog: * kf.cc (kf_memcpy_memmove::impl_call_pre): Reimplement using region_model::copy_bytes. * region-model.cc (region_model::read_bytes): New. (region_model::copy_bytes): New. * region-model.h (region_model::read_bytes): New decl. (region_model::copy_bytes): New decl. --- gcc/analyzer/kf.cc | 14 ++++---------- gcc/analyzer/region-model.cc | 35 +++++++++++++++++++++++++++++++++++ gcc/analyzer/region-model.h | 9 +++++++++ 3 files changed, 48 insertions(+), 10 deletions(-) diff --git a/gcc/analyzer/kf.cc b/gcc/analyzer/kf.cc index 6b33cd159dac..3eddbe200387 100644 --- a/gcc/analyzer/kf.cc +++ b/gcc/analyzer/kf.cc @@ -541,7 +541,6 @@ kf_memcpy_memmove::impl_call_pre (const call_details &cd) const const svalue *num_bytes_sval = cd.get_arg_svalue (2); region_model *model = cd.get_model (); - region_model_manager *mgr = cd.get_manager (); const region *dest_reg = model->deref_rvalue (dest_ptr_sval, cd.get_arg_tree (0), cd.get_ctxt ()); @@ -550,15 +549,10 @@ kf_memcpy_memmove::impl_call_pre (const call_details &cd) const cd.maybe_set_lhs (dest_ptr_sval); - const region *sized_src_reg - = mgr->get_sized_region (src_reg, NULL_TREE, num_bytes_sval); - const region *sized_dest_reg - = mgr->get_sized_region (dest_reg, NULL_TREE, num_bytes_sval); - const svalue *src_contents_sval - = model->get_store_value (sized_src_reg, cd.get_ctxt ()); - model->check_for_poison (src_contents_sval, cd.get_arg_tree (1), - sized_src_reg, cd.get_ctxt ()); - model->set_value (sized_dest_reg, src_contents_sval, cd.get_ctxt ()); + model->copy_bytes (dest_reg, + src_reg, cd.get_arg_tree (1), + num_bytes_sval, + cd.get_ctxt ()); } /* Handler for "memset" and "__builtin_memset". */ diff --git a/gcc/analyzer/region-model.cc b/gcc/analyzer/region-model.cc index 1fe66f4719fa..00c306ab7dae 100644 --- a/gcc/analyzer/region-model.cc +++ b/gcc/analyzer/region-model.cc @@ -3794,6 +3794,41 @@ region_model::write_bytes (const region *dest_reg, set_value (sized_dest_reg, sval, ctxt); } +/* Read NUM_BYTES_SVAL from SRC_REG. + Use CTXT to report any warnings associated with the copy + (e.g. out-of-bounds reads, copying of uninitialized values, etc). */ + +const svalue * +region_model::read_bytes (const region *src_reg, + tree src_ptr_expr, + const svalue *num_bytes_sval, + region_model_context *ctxt) const +{ + const region *sized_src_reg + = m_mgr->get_sized_region (src_reg, NULL_TREE, num_bytes_sval); + const svalue *src_contents_sval = get_store_value (sized_src_reg, ctxt); + check_for_poison (src_contents_sval, src_ptr_expr, + sized_src_reg, ctxt); + return src_contents_sval; +} + +/* Copy NUM_BYTES_SVAL bytes from SRC_REG to DEST_REG. + Use CTXT to report any warnings associated with the copy + (e.g. out-of-bounds reads/writes, copying of uninitialized values, + etc). */ + +void +region_model::copy_bytes (const region *dest_reg, + const region *src_reg, + tree src_ptr_expr, + const svalue *num_bytes_sval, + region_model_context *ctxt) +{ + const svalue *data_sval + = read_bytes (src_reg, src_ptr_expr, num_bytes_sval, ctxt); + write_bytes (dest_reg, num_bytes_sval, data_sval, ctxt); +} + /* Mark REG as having unknown content. */ void diff --git a/gcc/analyzer/region-model.h b/gcc/analyzer/region-model.h index 41df1885ad5b..b1c705e22c28 100644 --- a/gcc/analyzer/region-model.h +++ b/gcc/analyzer/region-model.h @@ -371,6 +371,15 @@ class region_model const svalue *num_bytes_sval, const svalue *sval, region_model_context *ctxt); + const svalue *read_bytes (const region *src_reg, + tree src_ptr_expr, + const svalue *num_bytes_sval, + region_model_context *ctxt) const; + void copy_bytes (const region *dest_reg, + const region *src_reg, + tree src_ptr_expr, + const svalue *num_bytes_sval, + region_model_context *ctxt); void mark_region_as_unknown (const region *reg, uncertainty_t *uncertainty); tristate eval_condition (const svalue *lhs, From patchwork Thu Aug 24 14:39:00 2023 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: David Malcolm X-Patchwork-Id: 136838 Return-Path: Delivered-To: ouuuleilei@gmail.com Received: by 2002:a59:a7d1:0:b0:3f2:4152:657d with SMTP id p17csp1168900vqm; Thu, 24 Aug 2023 07:43:36 -0700 (PDT) X-Google-Smtp-Source: AGHT+IGL9wIg+GILvX9aUDUWvFhzYDlzn7N3DhzGaEk84erkw+s0xxFp3AIhBx5Mp4wEpTxSXjf/ X-Received: by 2002:a05:6512:3406:b0:4f8:7781:9870 with SMTP id i6-20020a056512340600b004f877819870mr13385980lfr.60.1692888215807; Thu, 24 Aug 2023 07:43:35 -0700 (PDT) ARC-Seal: i=1; a=rsa-sha256; t=1692888215; cv=none; d=google.com; s=arc-20160816; b=VJaOZKEW/3i5JfDQMSEsD5KLPSyaW/rUHzjvUELRmc9JRznce53aOdwxYrs+kCwiFy 2pHc/3Y4pKmEBU2coQ/xjIQ6mFP93KGJaCrrY9WKGrhBBxVjsNIh5RpiXAQ3bSEQskv3 scdhIIjn6HHzpvMgh9CBHSzvMCya+JlS6Sj7vwF4vyiJ6iDHVjA9/NSBWAXYvH9gSYv/ F3xH5H8goXtxm0dtYs8YJV1nnuGMPotpk/TRTCZ+KGdkly3mB92PO8Gf2ScTMda0XqEE OpCk5dJuFooEh4CKMlzjLthATKontUQE29JSY7xin++r3Qw5LLPdBMjABg0JuEYgwPHO lroQ== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=arc-20160816; h=sender:errors-to:reply-to:from:list-subscribe:list-help:list-post :list-archive:list-unsubscribe:list-id:precedence :content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:cc:to:dmarc-filter:delivered-to :dkim-signature:dkim-filter; bh=xqGuJARd4NLsbiTKIN/l8fhdX7YVMkkxVm4SOKch7mo=; fh=fa0YJSH7y4k0snNuxsKgOI6vGP7j2f0jR9F1WHC95UA=; b=vqtC4Q8FNKM9FQwDRJYfdOHj1rZ5QbU2yZwBe+aUHBv4bNXqh9l+gNVOU9ufxt1TuD R5fV2XOB4nJwve1D47vN9MUK7PjiXyxw2kzsZ8HOQ1yJSRl8S8wMN9eAuVGqXBFhiGlj C6dWhyGPuDDVx5EnIF37XSTuDWprnNOvAPhE2HghWL/ZxoxlqMzy66Yim/6s32UypTmr ypQ9AI5cPQW4CW1sY+nAtGExndwaB99NMZrSKLJ0JrCzs2TXS5g9xZ0hOi46FPlPJ3Gr GfzpIU1YVW6CzLKVVIa/ssQFaz1jw8C3F10V0TKus/2Zht4I7VraX8k38TAgwlKibJlF GPIw== ARC-Authentication-Results: i=1; mx.google.com; dkim=pass header.i=@gcc.gnu.org header.s=default header.b=jZJjIyyT; spf=pass (google.com: domain of gcc-patches-bounces+ouuuleilei=gmail.com@gcc.gnu.org designates 8.43.85.97 as permitted sender) smtp.mailfrom="gcc-patches-bounces+ouuuleilei=gmail.com@gcc.gnu.org"; dmarc=pass (p=NONE sp=NONE dis=NONE) header.from=gnu.org Received: from server2.sourceware.org (ip-8-43-85-97.sourceware.org. [8.43.85.97]) by mx.google.com with ESMTPS id j6-20020a50ed06000000b0052a025456e6si7635894eds.148.2023.08.24.07.43.35 for (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Thu, 24 Aug 2023 07:43:35 -0700 (PDT) Received-SPF: pass (google.com: domain of gcc-patches-bounces+ouuuleilei=gmail.com@gcc.gnu.org designates 8.43.85.97 as permitted sender) client-ip=8.43.85.97; Authentication-Results: mx.google.com; dkim=pass header.i=@gcc.gnu.org header.s=default header.b=jZJjIyyT; spf=pass (google.com: domain of gcc-patches-bounces+ouuuleilei=gmail.com@gcc.gnu.org designates 8.43.85.97 as permitted sender) smtp.mailfrom="gcc-patches-bounces+ouuuleilei=gmail.com@gcc.gnu.org"; dmarc=pass (p=NONE sp=NONE dis=NONE) header.from=gnu.org Received: from server2.sourceware.org (localhost [IPv6:::1]) by sourceware.org (Postfix) with ESMTP id 1E5603882024 for ; Thu, 24 Aug 2023 14:41:00 +0000 (GMT) DKIM-Filter: OpenDKIM Filter v2.11.0 sourceware.org 1E5603882024 DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gcc.gnu.org; s=default; t=1692888060; bh=xqGuJARd4NLsbiTKIN/l8fhdX7YVMkkxVm4SOKch7mo=; h=To:Cc:Subject:Date:In-Reply-To:References:List-Id: List-Unsubscribe:List-Archive:List-Post:List-Help:List-Subscribe: From:Reply-To:From; b=jZJjIyyT0dmwlInRD2Iv2wH3SS0TC+OdNry49FfWMwuic5yfXKHZC5FDP+wigt84c nJMssrSw8850rILRXfeMPSZqkKozfTUPBt4HcHXWcXeMMN7uQgGbw5RwORPSomsDwT CEDRsC8xX+TTmi5lkXhVnCEjL6P8R3eI+iDpaF60= X-Original-To: gcc-patches@gcc.gnu.org Delivered-To: gcc-patches@gcc.gnu.org Received: from us-smtp-delivery-124.mimecast.com (us-smtp-delivery-124.mimecast.com [170.10.129.124]) by sourceware.org (Postfix) with ESMTPS id B10773858296 for ; Thu, 24 Aug 2023 14:39:10 +0000 (GMT) DMARC-Filter: OpenDMARC Filter v1.4.2 sourceware.org B10773858296 Received: from mimecast-mx02.redhat.com (mimecast-mx02.redhat.com [66.187.233.88]) by relay.mimecast.com with ESMTP with STARTTLS (version=TLSv1.2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id us-mta-447-dFAwcLjNNMe9w2OV2lj_bg-1; Thu, 24 Aug 2023 10:39:07 -0400 X-MC-Unique: dFAwcLjNNMe9w2OV2lj_bg-1 Received: from smtp.corp.redhat.com (int-mx02.intmail.prod.int.rdu2.redhat.com [10.11.54.2]) (using TLSv1.2 with cipher AECDH-AES256-SHA (256/256 bits)) (No client certificate requested) by mimecast-mx02.redhat.com (Postfix) with ESMTPS id 5478810AFD03 for ; Thu, 24 Aug 2023 14:39:07 +0000 (UTC) Received: from t14s.localdomain.com (unknown [10.22.32.117]) by smtp.corp.redhat.com (Postfix) with ESMTP id 045EE40D2839; Thu, 24 Aug 2023 14:39:06 +0000 (UTC) To: gcc-patches@gcc.gnu.org Cc: David Malcolm Subject: [PATCH 6/9] analyzer: handle strlen(INIT_VAL(STRING_REG)) [PR105899] Date: Thu, 24 Aug 2023 10:39:00 -0400 Message-Id: <20230824143903.3161185-7-dmalcolm@redhat.com> In-Reply-To: <20230824143903.3161185-1-dmalcolm@redhat.com> References: <20230824143903.3161185-1-dmalcolm@redhat.com> MIME-Version: 1.0 X-Scanned-By: MIMEDefang 3.1 on 10.11.54.2 X-Mimecast-Spam-Score: 0 X-Mimecast-Originator: redhat.com X-Spam-Status: No, score=-11.4 required=5.0 tests=BAYES_00, DKIMWL_WL_HIGH, DKIM_SIGNED, DKIM_VALID, DKIM_VALID_AU, DKIM_VALID_EF, GIT_PATCH_0, RCVD_IN_DNSWL_NONE, RCVD_IN_MSPIKE_H4, RCVD_IN_MSPIKE_WL, SPF_HELO_NONE, SPF_NONE, TXREP autolearn=ham autolearn_force=no version=3.4.6 X-Spam-Checker-Version: SpamAssassin 3.4.6 (2021-04-09) on server2.sourceware.org X-BeenThere: gcc-patches@gcc.gnu.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: Gcc-patches mailing list List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-Patchwork-Original-From: David Malcolm via Gcc-patches From: David Malcolm Reply-To: David Malcolm Errors-To: gcc-patches-bounces+ouuuleilei=gmail.com@gcc.gnu.org Sender: "Gcc-patches" X-getmail-retrieved-from-mailbox: INBOX X-GMAIL-THRID: 1775121953857485321 X-GMAIL-MSGID: 1775121953857485321 gcc/analyzer/ChangeLog: PR analyzer/105899 * region-model.cc (fragment::has_null_terminator): Move STRING_CST handling to fragment::string_cst_has_null_terminator; also use it to handle INIT_VAL(STRING_REG). (fragment::string_cst_has_null_terminator): New, from above. gcc/testsuite/ChangeLog: PR analyzer/105899 * gcc.dg/analyzer/strcpy-3.c (test_2): New. --- gcc/analyzer/region-model.cc | 68 ++++++++++++++++-------- gcc/testsuite/gcc.dg/analyzer/strcpy-3.c | 7 +++ 2 files changed, 54 insertions(+), 21 deletions(-) diff --git a/gcc/analyzer/region-model.cc b/gcc/analyzer/region-model.cc index 00c306ab7dae..6574ec140074 100644 --- a/gcc/analyzer/region-model.cc +++ b/gcc/analyzer/region-model.cc @@ -3310,27 +3310,10 @@ struct fragment switch (TREE_CODE (cst)) { case STRING_CST: - { - /* Look for the first 0 byte within STRING_CST - from START_READ_OFFSET onwards. */ - const HOST_WIDE_INT num_bytes_to_search - = std::min ((TREE_STRING_LENGTH (cst) - - rel_start_read_offset_hwi), - available_bytes_hwi); - const char *start = (TREE_STRING_POINTER (cst) - + rel_start_read_offset_hwi); - if (num_bytes_to_search >= 0) - if (const void *p = memchr (start, 0, - num_bytes_to_search)) - { - *out_bytes_read = (const char *)p - start + 1; - return tristate (true); - } - - *out_bytes_read = available_bytes; - return tristate (false); - } - break; + return string_cst_has_null_terminator (cst, + rel_start_read_offset_hwi, + available_bytes_hwi, + out_bytes_read); case INTEGER_CST: if (rel_start_read_offset_hwi == 0 && integer_onep (TYPE_SIZE_UNIT (TREE_TYPE (cst)))) @@ -3357,12 +3340,55 @@ struct fragment } } break; + + case SK_INITIAL: + { + const initial_svalue *initial_sval = (const initial_svalue *)m_sval; + const region *reg = initial_sval->get_region (); + if (const string_region *string_reg = reg->dyn_cast_string_region ()) + { + tree string_cst = string_reg->get_string_cst (); + return string_cst_has_null_terminator (string_cst, + rel_start_read_offset_hwi, + available_bytes_hwi, + out_bytes_read); + } + return tristate::TS_UNKNOWN; + } + break; + default: // TODO: it may be possible to handle other cases here. return tristate::TS_UNKNOWN; } } + static tristate + string_cst_has_null_terminator (tree string_cst, + HOST_WIDE_INT rel_start_read_offset_hwi, + HOST_WIDE_INT available_bytes_hwi, + byte_offset_t *out_bytes_read) + { + /* Look for the first 0 byte within STRING_CST + from START_READ_OFFSET onwards. */ + const HOST_WIDE_INT num_bytes_to_search + = std::min ((TREE_STRING_LENGTH (string_cst) + - rel_start_read_offset_hwi), + available_bytes_hwi); + const char *start = (TREE_STRING_POINTER (string_cst) + + rel_start_read_offset_hwi); + if (num_bytes_to_search >= 0) + if (const void *p = memchr (start, 0, + num_bytes_to_search)) + { + *out_bytes_read = (const char *)p - start + 1; + return tristate (true); + } + + *out_bytes_read = available_bytes_hwi; + return tristate (false); + } + byte_range m_byte_range; const svalue *m_sval; }; diff --git a/gcc/testsuite/gcc.dg/analyzer/strcpy-3.c b/gcc/testsuite/gcc.dg/analyzer/strcpy-3.c index abb49bc39f27..a7b324fc445e 100644 --- a/gcc/testsuite/gcc.dg/analyzer/strcpy-3.c +++ b/gcc/testsuite/gcc.dg/analyzer/strcpy-3.c @@ -22,3 +22,10 @@ void test_1 (void) __analyzer_eval (result[5] == 0); /* { dg-warning "TRUE" } */ __analyzer_eval (strlen (result) == 5); /* { dg-warning "TRUE" } */ } + +void test_2 (void) +{ + char buf[16]; + __builtin_strcpy (buf, "abc"); + __analyzer_eval (strlen (buf) == 3); /* { dg-warning "TRUE" } */ +} From patchwork Thu Aug 24 14:39:01 2023 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: David Malcolm X-Patchwork-Id: 136839 Return-Path: Delivered-To: ouuuleilei@gmail.com Received: by 2002:a59:a7d1:0:b0:3f2:4152:657d with SMTP id p17csp1169566vqm; Thu, 24 Aug 2023 07:44:44 -0700 (PDT) X-Google-Smtp-Source: AGHT+IE1sCh/kj2JKk/MuvXUm04ZlS13G4HEd8rxj3GBwtM4KoQbKuC5UwMh0H75Ch9qYvUphG1I X-Received: by 2002:aa7:cd8f:0:b0:523:1053:9b50 with SMTP id x15-20020aa7cd8f000000b0052310539b50mr13410515edv.20.1692888283969; Thu, 24 Aug 2023 07:44:43 -0700 (PDT) ARC-Seal: i=1; a=rsa-sha256; t=1692888283; cv=none; d=google.com; s=arc-20160816; b=cnaqtlbvJ2iH1HgsW67sBKVJWhFLhdB8i3mH74MSUSK/9SkJ2RhCfiPlAT8UAo/+DC nPlD7xaq0jJfHyIMnNj1B1CyYSXwbzt99w66HrynYzBaVUJw2F080MEmdk6oQ8I1/ZLt vntuUCcH5LzAkPXhcXpcXf1MqNXgTzofmp5rZ3UI5Z8vll/06NG2yqNSDdhVlaTiVDNP 0exq9UhMZdumohI/A/Y2KOIcMy/E7mUIk8y2mSKMEs0DtdE71lAhacHlWFtRH7CsWUpf yesxkqkOmeqfgVw2Io+eySpjbZlTY2JJ4sXxnVzlpOc6cU5DyeOKRKRpHlGdOA8BGUz/ 4jMA== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=arc-20160816; h=sender:errors-to:reply-to:from:list-subscribe:list-help:list-post :list-archive:list-unsubscribe:list-id:precedence :content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:cc:to:dmarc-filter:delivered-to :dkim-signature:dkim-filter; bh=wHFTTs838t7IBbRa+a5a3pDkWvMdxlNsiLF0sv3PzaY=; fh=fa0YJSH7y4k0snNuxsKgOI6vGP7j2f0jR9F1WHC95UA=; b=rEL8KjBj72rb5XQLXoZ+UadE9+T3akXae9l/tXi5YtfAoX+nAQnV/Ao+xYf1wc1fcA //ttvYbnHW27KOD5Kv0cV2z3LRdOz4q46dqzA1m1z7deqUIOhO07fOIJ7uu1sVVV2muo L9iFXVdYClOa5sUBWXZZ30HYVg1dU/W02388qSm+TLF1pw0bb0xeX7BxZ4BYd1fXW4sm boDafQitEHj0X8fQCcEE+LJ2sjICMpL2KjmH3U3mch3suGQMiofrDEGiTYlTHrTXu/Lw pVt1lFAEiY00vAUxgjUcGtqNMuq+APQjKnslN14qtXTm6Q5Cz0G3XJ3L0QVWpzw89Mbl uuMA== ARC-Authentication-Results: i=1; mx.google.com; dkim=pass header.i=@gcc.gnu.org header.s=default header.b=AcAhNJny; spf=pass (google.com: domain of gcc-patches-bounces+ouuuleilei=gmail.com@gcc.gnu.org designates 8.43.85.97 as permitted sender) smtp.mailfrom="gcc-patches-bounces+ouuuleilei=gmail.com@gcc.gnu.org"; dmarc=pass (p=NONE sp=NONE dis=NONE) header.from=gnu.org Received: from server2.sourceware.org (ip-8-43-85-97.sourceware.org. [8.43.85.97]) by mx.google.com with ESMTPS id f19-20020a056402069300b00525774c622asi10406003edy.347.2023.08.24.07.44.43 for (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Thu, 24 Aug 2023 07:44:43 -0700 (PDT) Received-SPF: pass (google.com: domain of gcc-patches-bounces+ouuuleilei=gmail.com@gcc.gnu.org designates 8.43.85.97 as permitted sender) client-ip=8.43.85.97; Authentication-Results: mx.google.com; dkim=pass header.i=@gcc.gnu.org header.s=default header.b=AcAhNJny; spf=pass (google.com: domain of gcc-patches-bounces+ouuuleilei=gmail.com@gcc.gnu.org designates 8.43.85.97 as permitted sender) smtp.mailfrom="gcc-patches-bounces+ouuuleilei=gmail.com@gcc.gnu.org"; dmarc=pass (p=NONE sp=NONE dis=NONE) header.from=gnu.org Received: from server2.sourceware.org (localhost [IPv6:::1]) by sourceware.org (Postfix) with ESMTP id 7C4C33839073 for ; Thu, 24 Aug 2023 14:41:52 +0000 (GMT) DKIM-Filter: OpenDKIM Filter v2.11.0 sourceware.org 7C4C33839073 DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gcc.gnu.org; s=default; t=1692888112; bh=wHFTTs838t7IBbRa+a5a3pDkWvMdxlNsiLF0sv3PzaY=; h=To:Cc:Subject:Date:In-Reply-To:References:List-Id: List-Unsubscribe:List-Archive:List-Post:List-Help:List-Subscribe: From:Reply-To:From; b=AcAhNJnylRnhjaEuCaw7Y0/N6uKLdNpc9jB8h+/cSYERZyEDy3XLuWCjhTsEHdgJu oJKfEtkfXotddllLHBnpKC9DWlz+JKTeFh5SyDecriafs5IMB0TbFkffHHirO79erb s0nybIH7os4dmVYAuOhNGV2dyheD4a5XmJPKj6+Y= X-Original-To: gcc-patches@gcc.gnu.org Delivered-To: gcc-patches@gcc.gnu.org Received: from us-smtp-delivery-124.mimecast.com (us-smtp-delivery-124.mimecast.com [170.10.133.124]) by sourceware.org (Postfix) with ESMTPS id B6CE53858426 for ; Thu, 24 Aug 2023 14:39:09 +0000 (GMT) DMARC-Filter: OpenDMARC Filter v1.4.2 sourceware.org B6CE53858426 Received: from mimecast-mx02.redhat.com (66.187.233.73 [66.187.233.73]) by relay.mimecast.com with ESMTP with STARTTLS (version=TLSv1.2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id us-mta-304-wX2hjxMHMluQ1j6HBmxYig-1; Thu, 24 Aug 2023 10:39:07 -0400 X-MC-Unique: wX2hjxMHMluQ1j6HBmxYig-1 Received: from smtp.corp.redhat.com (int-mx02.intmail.prod.int.rdu2.redhat.com [10.11.54.2]) (using TLSv1.2 with cipher AECDH-AES256-SHA (256/256 bits)) (No client certificate requested) by mimecast-mx02.redhat.com (Postfix) with ESMTPS id A039F2807D62 for ; Thu, 24 Aug 2023 14:39:07 +0000 (UTC) Received: from t14s.localdomain.com (unknown [10.22.32.117]) by smtp.corp.redhat.com (Postfix) with ESMTP id 7E0C440C6F4C; Thu, 24 Aug 2023 14:39:07 +0000 (UTC) To: gcc-patches@gcc.gnu.org Cc: David Malcolm Subject: [PATCH 7/9] analyzer: handle INIT_VAL(ELEMENT_REG(STRING_REG), CONSTANT_SVAL) [PR105899] Date: Thu, 24 Aug 2023 10:39:01 -0400 Message-Id: <20230824143903.3161185-8-dmalcolm@redhat.com> In-Reply-To: <20230824143903.3161185-1-dmalcolm@redhat.com> References: <20230824143903.3161185-1-dmalcolm@redhat.com> MIME-Version: 1.0 X-Scanned-By: MIMEDefang 3.1 on 10.11.54.2 X-Mimecast-Spam-Score: 0 X-Mimecast-Originator: redhat.com X-Spam-Status: No, score=-11.7 required=5.0 tests=BAYES_00, DKIMWL_WL_HIGH, DKIM_SIGNED, DKIM_VALID, DKIM_VALID_AU, DKIM_VALID_EF, GIT_PATCH_0, RCVD_IN_DNSWL_NONE, RCVD_IN_MSPIKE_H4, RCVD_IN_MSPIKE_WL, SPF_HELO_NONE, SPF_NONE, TXREP autolearn=ham autolearn_force=no version=3.4.6 X-Spam-Checker-Version: SpamAssassin 3.4.6 (2021-04-09) on server2.sourceware.org X-BeenThere: gcc-patches@gcc.gnu.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: Gcc-patches mailing list List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-Patchwork-Original-From: David Malcolm via Gcc-patches From: David Malcolm Reply-To: David Malcolm Errors-To: gcc-patches-bounces+ouuuleilei=gmail.com@gcc.gnu.org Sender: "Gcc-patches" X-getmail-retrieved-from-mailbox: INBOX X-GMAIL-THRID: 1775122025386881299 X-GMAIL-MSGID: 1775122025386881299 gcc/analyzer/ChangeLog: PR analyzer/105899 * region-model-manager.cc (region_model_manager::get_or_create_initial_value): Simplify INIT_VAL(ELEMENT_REG(STRING_REG), CONSTANT_SVAL) to CONSTANT_SVAL(STRING[N]). --- gcc/analyzer/region-model-manager.cc | 19 +++++++++++++++++++ 1 file changed, 19 insertions(+) diff --git a/gcc/analyzer/region-model-manager.cc b/gcc/analyzer/region-model-manager.cc index 65b719056c84..22246876f8f9 100644 --- a/gcc/analyzer/region-model-manager.cc +++ b/gcc/analyzer/region-model-manager.cc @@ -310,6 +310,25 @@ region_model_manager::get_or_create_initial_value (const region *reg, get_or_create_initial_value (original_reg)); } + /* Simplify: + INIT_VAL(ELEMENT_REG(STRING_REG), CONSTANT_SVAL) + to: + CONSTANT_SVAL(STRING[N]). */ + if (const element_region *element_reg = reg->dyn_cast_element_region ()) + if (tree cst_idx = element_reg->get_index ()->maybe_get_constant ()) + if (const string_region *string_reg + = element_reg->get_parent_region ()->dyn_cast_string_region ()) + if (tree_fits_shwi_p (cst_idx)) + { + HOST_WIDE_INT idx = tree_to_shwi (cst_idx); + tree string_cst = string_reg->get_string_cst (); + if (idx >= 0 && idx <= TREE_STRING_LENGTH (string_cst)) + { + int ch = TREE_STRING_POINTER (string_cst)[idx]; + return get_or_create_int_cst (reg->get_type (), ch); + } + } + /* INIT_VAL (*UNKNOWN_PTR) -> UNKNOWN_VAL. */ if (reg->symbolic_for_unknown_ptr_p ()) return get_or_create_unknown_svalue (reg->get_type ()); From patchwork Thu Aug 24 14:39:02 2023 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: David Malcolm X-Patchwork-Id: 136840 Return-Path: Delivered-To: ouuuleilei@gmail.com Received: by 2002:a59:a7d1:0:b0:3f2:4152:657d with SMTP id p17csp1169635vqm; Thu, 24 Aug 2023 07:44:52 -0700 (PDT) X-Google-Smtp-Source: AGHT+IEo0tKbnAceMJyK9DLY0QZCB0j8g6pCV9fNykOeeCv9AUmtYWqrJ3+PN6WRwAT62Z6Uh9Mf X-Received: by 2002:a17:907:789a:b0:99c:e037:e4b8 with SMTP id ku26-20020a170907789a00b0099ce037e4b8mr12714397ejc.72.1692888291955; Thu, 24 Aug 2023 07:44:51 -0700 (PDT) ARC-Seal: i=1; a=rsa-sha256; t=1692888291; cv=none; d=google.com; s=arc-20160816; b=js2OCcXMbgp16Hstpxbfm5V22riRcJDjFJtAFSbvZMV5oWFZBtpR/8vELlfCoztnzX KDkUFJCrZviQeqa1NWfcRoQpeuA17/mUYGfbc2V2k6QAoaDZfZN8WryIJ9+SXoOLwVWi W9siQjK+Y7z9QlpkUcDskiOc0E5OxzKBM0YxP82H8GqRkGYyqpC93WiwF1q7Ra2pKors ohHVw9LxhQPy/YyWKNrPeVNMH8eKMCUgopCHBOo6aPNPaFlopnB2+DKBUl3JdX723ltj xcH3Bf9iPFYJnvPMYkPwaP3iyJHztlzUwraJzrTqy3bZ+a8SYM42XXtNjIWe++daHt/b A1JA== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=arc-20160816; h=sender:errors-to:reply-to:from:list-subscribe:list-help:list-post :list-archive:list-unsubscribe:list-id:precedence :content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:cc:to:dmarc-filter:delivered-to :dkim-signature:dkim-filter; bh=nrW4e+3ON3lb5Xe/C1HogOGvHbHNBbXwBcUO2GWtlG8=; fh=fa0YJSH7y4k0snNuxsKgOI6vGP7j2f0jR9F1WHC95UA=; b=s51PPBiOsZivu5pMrJgLgQTQ0n9FR9wsjIH0oNzRnPOL/ClYmEzstsD2schCjyvYxl UCRh7uSFvCSBXb/eYWlzHs7r43n1X2DQJA1c4X0Brn6HacYgAQQcLvkbSgBlLGsfF4uz WUYawdrOyN5ckOJGaZgKQeccAv5sFnP1LV3dMKEl5TmY8rkztrUQpHHl0rX+cgh8kCdE YQm4NZ5t3myiJZlBQx+cXB/BqKg2dC2eicbzzITxEGq2yKW+HKoo0ZOG9cKbPMIXiSSm XsDcASuY4ppBikGAeC005mWN8YYz/AxbQj+MXaDrZdPp3LcAn6Z+MiJu4rF/LoaCq4aC imfA== ARC-Authentication-Results: i=1; mx.google.com; dkim=pass header.i=@gcc.gnu.org header.s=default header.b=PNPey2GL; spf=pass (google.com: domain of gcc-patches-bounces+ouuuleilei=gmail.com@gcc.gnu.org designates 8.43.85.97 as permitted sender) smtp.mailfrom="gcc-patches-bounces+ouuuleilei=gmail.com@gcc.gnu.org"; dmarc=pass (p=NONE sp=NONE dis=NONE) header.from=gnu.org Received: from server2.sourceware.org (ip-8-43-85-97.sourceware.org. [8.43.85.97]) by mx.google.com with ESMTPS id q14-20020a170906144e00b00992dce29d4csi10535312ejc.874.2023.08.24.07.44.51 for (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Thu, 24 Aug 2023 07:44:51 -0700 (PDT) Received-SPF: pass (google.com: domain of gcc-patches-bounces+ouuuleilei=gmail.com@gcc.gnu.org designates 8.43.85.97 as permitted sender) client-ip=8.43.85.97; Authentication-Results: mx.google.com; dkim=pass header.i=@gcc.gnu.org header.s=default header.b=PNPey2GL; spf=pass (google.com: domain of gcc-patches-bounces+ouuuleilei=gmail.com@gcc.gnu.org designates 8.43.85.97 as permitted sender) smtp.mailfrom="gcc-patches-bounces+ouuuleilei=gmail.com@gcc.gnu.org"; dmarc=pass (p=NONE sp=NONE dis=NONE) header.from=gnu.org Received: from server2.sourceware.org (localhost [IPv6:::1]) by sourceware.org (Postfix) with ESMTP id 0AD1C38845F9 for ; Thu, 24 Aug 2023 14:41:58 +0000 (GMT) DKIM-Filter: OpenDKIM Filter v2.11.0 sourceware.org 0AD1C38845F9 DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gcc.gnu.org; s=default; t=1692888118; bh=nrW4e+3ON3lb5Xe/C1HogOGvHbHNBbXwBcUO2GWtlG8=; h=To:Cc:Subject:Date:In-Reply-To:References:List-Id: List-Unsubscribe:List-Archive:List-Post:List-Help:List-Subscribe: From:Reply-To:From; b=PNPey2GLns2JzJbewy51QI287FCn9w5ZwgO7GaRUoLS6TlpmvK8lT7pd57S6gdsns TZbft06Lg8Ysdmxh+54a5okmdABQCdN37tjIoNpWZyu0umo3sSequtZQO8H2aXx7M/ LsKOwK1mMt+U5PLbR/7PijF4J3KbiemQA6fMAPL4= X-Original-To: gcc-patches@gcc.gnu.org Delivered-To: gcc-patches@gcc.gnu.org Received: from us-smtp-delivery-124.mimecast.com (us-smtp-delivery-124.mimecast.com [170.10.129.124]) by sourceware.org (Postfix) with ESMTPS id A01093858401 for ; Thu, 24 Aug 2023 14:39:15 +0000 (GMT) DMARC-Filter: OpenDMARC Filter v1.4.2 sourceware.org A01093858401 Received: from mimecast-mx02.redhat.com (mimecast-mx02.redhat.com [66.187.233.88]) by relay.mimecast.com with ESMTP with STARTTLS (version=TLSv1.2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id us-mta-539-QkwoSXqvMACIgzzGzzCx5Q-1; Thu, 24 Aug 2023 10:39:13 -0400 X-MC-Unique: QkwoSXqvMACIgzzGzzCx5Q-1 Received: from smtp.corp.redhat.com (int-mx02.intmail.prod.int.rdu2.redhat.com [10.11.54.2]) (using TLSv1.2 with cipher AECDH-AES256-SHA (256/256 bits)) (No client certificate requested) by mimecast-mx02.redhat.com (Postfix) with ESMTPS id D4A6780557A for ; Thu, 24 Aug 2023 14:39:07 +0000 (UTC) Received: from t14s.localdomain.com (unknown [10.22.32.117]) by smtp.corp.redhat.com (Postfix) with ESMTP id AF65D40C6F4C; Thu, 24 Aug 2023 14:39:07 +0000 (UTC) To: gcc-patches@gcc.gnu.org Cc: David Malcolm Subject: [PATCH 8/9] analyzer: handle strlen(BITS_WITHIN) [PR105899] Date: Thu, 24 Aug 2023 10:39:02 -0400 Message-Id: <20230824143903.3161185-9-dmalcolm@redhat.com> In-Reply-To: <20230824143903.3161185-1-dmalcolm@redhat.com> References: <20230824143903.3161185-1-dmalcolm@redhat.com> MIME-Version: 1.0 X-Scanned-By: MIMEDefang 3.1 on 10.11.54.2 X-Mimecast-Spam-Score: 0 X-Mimecast-Originator: redhat.com X-Spam-Status: No, score=-11.4 required=5.0 tests=BAYES_00, DKIMWL_WL_HIGH, DKIM_SIGNED, DKIM_VALID, DKIM_VALID_AU, DKIM_VALID_EF, GIT_PATCH_0, RCVD_IN_DNSWL_NONE, RCVD_IN_MSPIKE_H4, RCVD_IN_MSPIKE_WL, SPF_HELO_NONE, SPF_NONE, TXREP autolearn=ham autolearn_force=no version=3.4.6 X-Spam-Checker-Version: SpamAssassin 3.4.6 (2021-04-09) on server2.sourceware.org X-BeenThere: gcc-patches@gcc.gnu.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: Gcc-patches mailing list List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-Patchwork-Original-From: David Malcolm via Gcc-patches From: David Malcolm Reply-To: David Malcolm Errors-To: gcc-patches-bounces+ouuuleilei=gmail.com@gcc.gnu.org Sender: "Gcc-patches" X-getmail-retrieved-from-mailbox: INBOX X-GMAIL-THRID: 1775122033770545069 X-GMAIL-MSGID: 1775122033770545069 gcc/analyzer/ChangeLog: PR analyzer/105899 * region-model.cc (fragment::has_null_terminator): Handle SK_BITS_WITHIN. --- gcc/analyzer/region-model.cc | 21 ++++++++++++++++++++- 1 file changed, 20 insertions(+), 1 deletion(-) diff --git a/gcc/analyzer/region-model.cc b/gcc/analyzer/region-model.cc index 6574ec140074..025b555d7b97 100644 --- a/gcc/analyzer/region-model.cc +++ b/gcc/analyzer/region-model.cc @@ -3357,10 +3357,29 @@ struct fragment } break; + case SK_BITS_WITHIN: + { + const bits_within_svalue *bits_within_sval + = (const bits_within_svalue *)m_sval; + byte_range bytes (0, 0); + if (bits_within_sval->get_bits ().as_byte_range (&bytes)) + { + const svalue *inner_sval = bits_within_sval->get_inner_svalue (); + fragment f (byte_range + (start_read_offset - bytes.get_start_bit_offset (), + std::max (bytes.m_size_in_bytes, + available_bytes)), + inner_sval); + return f.has_null_terminator (start_read_offset, out_bytes_read); + } + } + break; + default: // TODO: it may be possible to handle other cases here. - return tristate::TS_UNKNOWN; + break; } + return tristate::TS_UNKNOWN; } static tristate From patchwork Thu Aug 24 14:39:03 2023 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: David Malcolm X-Patchwork-Id: 136835 Return-Path: Delivered-To: ouuuleilei@gmail.com Received: by 2002:a59:a7d1:0:b0:3f2:4152:657d with SMTP id p17csp1167945vqm; Thu, 24 Aug 2023 07:41:47 -0700 (PDT) X-Google-Smtp-Source: AGHT+IFZzo0bvlWUzai43kWTuCUk7yLbhZ1/bE/ekB4pwLYKcyitk/njx18kwjjnIMFAyuw8rfN1 X-Received: by 2002:a19:9157:0:b0:500:7e12:c48b with SMTP id y23-20020a199157000000b005007e12c48bmr8736509lfj.44.1692888107267; Thu, 24 Aug 2023 07:41:47 -0700 (PDT) ARC-Seal: i=1; a=rsa-sha256; t=1692888107; cv=none; d=google.com; s=arc-20160816; b=bemhpOTy15jcsAUmjYTdTRpSrSf9ftcfrNifRsElHr9c451ZWg4rJem5foSKSqhMO+ 6AEDDpdYJFSjeoLQx6tXLoqWPnIqmguCz3YO7xIx8aDcL/unQ4zF5jUSaos/joRvyqro SeOujP2H5YUjRybGN7L3FIUvFfnztb9tXo+9HyFoWF2Q/oWJMsIsftHDp0WQEG6/d4g6 v+5VQ0iK5Ceouw5yuiE6ueYlmj5HuVV++ozMMinmYIxd4H4y7t/9F8Wl5XnDR6yj/wGX yue8IJxraw5e2n2vLMK0t9CsFDRxR3XEim5blpdzrMSKaHVZNwjPmrwy0OTPITKvkGQE WP2A== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=arc-20160816; h=sender:errors-to:reply-to:from:list-subscribe:list-help:list-post :list-archive:list-unsubscribe:list-id:precedence :content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:cc:to:dmarc-filter:delivered-to :dkim-signature:dkim-filter; bh=XLI0fFt5R4Ett469OOesLw842tsXnOVAFKHokTd/tVY=; fh=fa0YJSH7y4k0snNuxsKgOI6vGP7j2f0jR9F1WHC95UA=; b=W6AbxVj36uDPDceSy5v8G8H1AIOmrUhh6Xp9J/hiOlPFSzNa3wmwUkHPqioY73QGbd zBSqG2Tz+SHc2Cc5lECVLoh7e0MgeYG/ka/HDWf5gBYiFA9hv80FlR/o+/j8GiVLGoAh ShUsa6DouLeiC72wIdm3d3sREvzyfvGSA8W4wWlamB/FLCnxyIviegofeIetcwUmkLr8 yB+20ekWfgyIiq4OOIdqFwDZMZxnlMRz61IoBU/OCrFzTX7LGKASZ3cIahtsA4c8BLSe jkznKBEJcD1DWNvm4F6kpT+QPinFRWl1eYpq3mkxFL1Cwn/WPyi0U39BCdYiq+FzOOIi 9cOA== ARC-Authentication-Results: i=1; mx.google.com; dkim=pass header.i=@gcc.gnu.org header.s=default header.b=KTbkhszO; spf=pass (google.com: domain of gcc-patches-bounces+ouuuleilei=gmail.com@gcc.gnu.org designates 2620:52:3:1:0:246e:9693:128c as permitted sender) smtp.mailfrom="gcc-patches-bounces+ouuuleilei=gmail.com@gcc.gnu.org"; dmarc=pass (p=NONE sp=NONE dis=NONE) header.from=gnu.org Received: from server2.sourceware.org (server2.sourceware.org. [2620:52:3:1:0:246e:9693:128c]) by mx.google.com with ESMTPS id q15-20020aa7d44f000000b0052348d74868si10694494edr.238.2023.08.24.07.41.46 for (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Thu, 24 Aug 2023 07:41:47 -0700 (PDT) Received-SPF: pass (google.com: domain of gcc-patches-bounces+ouuuleilei=gmail.com@gcc.gnu.org designates 2620:52:3:1:0:246e:9693:128c as permitted sender) client-ip=2620:52:3:1:0:246e:9693:128c; Authentication-Results: mx.google.com; dkim=pass header.i=@gcc.gnu.org header.s=default header.b=KTbkhszO; spf=pass (google.com: domain of gcc-patches-bounces+ouuuleilei=gmail.com@gcc.gnu.org designates 2620:52:3:1:0:246e:9693:128c as permitted sender) smtp.mailfrom="gcc-patches-bounces+ouuuleilei=gmail.com@gcc.gnu.org"; dmarc=pass (p=NONE sp=NONE dis=NONE) header.from=gnu.org Received: from server2.sourceware.org (localhost [IPv6:::1]) by sourceware.org (Postfix) with ESMTP id 34ABB3853D06 for ; Thu, 24 Aug 2023 14:40:13 +0000 (GMT) DKIM-Filter: OpenDKIM Filter v2.11.0 sourceware.org 34ABB3853D06 DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gcc.gnu.org; s=default; t=1692888013; bh=XLI0fFt5R4Ett469OOesLw842tsXnOVAFKHokTd/tVY=; h=To:Cc:Subject:Date:In-Reply-To:References:List-Id: List-Unsubscribe:List-Archive:List-Post:List-Help:List-Subscribe: From:Reply-To:From; b=KTbkhszOCdN8MmzRtpkQEG44ubjkryUKzJv8iDJve2X5N1MCutAr5voY0UneNnElm 9Tbw+J5THTsIHDalkhRp4O/ktKVde8Krrun8A19eEhvF5d/mJOd0BldIpAOZ+l4Axp /FPeBO1TnNNQQIOvuy1gkPi6w+bmdjGr8D+TRZwU= X-Original-To: gcc-patches@gcc.gnu.org Delivered-To: gcc-patches@gcc.gnu.org Received: from us-smtp-delivery-124.mimecast.com (us-smtp-delivery-124.mimecast.com [170.10.129.124]) by sourceware.org (Postfix) with ESMTPS id 12B8D3857704 for ; Thu, 24 Aug 2023 14:39:12 +0000 (GMT) DMARC-Filter: OpenDMARC Filter v1.4.2 sourceware.org 12B8D3857704 Received: from mimecast-mx02.redhat.com (66.187.233.73 [66.187.233.73]) by relay.mimecast.com with ESMTP with STARTTLS (version=TLSv1.2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id us-mta-251-L1rsrqN_MWGyb7nTOChLBQ-1; Thu, 24 Aug 2023 10:39:10 -0400 X-MC-Unique: L1rsrqN_MWGyb7nTOChLBQ-1 Received: from smtp.corp.redhat.com (int-mx02.intmail.prod.int.rdu2.redhat.com [10.11.54.2]) (using TLSv1.2 with cipher AECDH-AES256-SHA (256/256 bits)) (No client certificate requested) by mimecast-mx02.redhat.com (Postfix) with ESMTPS id 1E89A2807D69 for ; Thu, 24 Aug 2023 14:39:08 +0000 (UTC) Received: from t14s.localdomain.com (unknown [10.22.32.117]) by smtp.corp.redhat.com (Postfix) with ESMTP id E5614400E02F; Thu, 24 Aug 2023 14:39:07 +0000 (UTC) To: gcc-patches@gcc.gnu.org Cc: David Malcolm Subject: [PATCH 9/9] analyzer: implement kf_strcat [PR105899] Date: Thu, 24 Aug 2023 10:39:03 -0400 Message-Id: <20230824143903.3161185-10-dmalcolm@redhat.com> In-Reply-To: <20230824143903.3161185-1-dmalcolm@redhat.com> References: <20230824143903.3161185-1-dmalcolm@redhat.com> MIME-Version: 1.0 X-Scanned-By: MIMEDefang 3.1 on 10.11.54.2 X-Mimecast-Spam-Score: 0 X-Mimecast-Originator: redhat.com X-Spam-Status: No, score=-11.7 required=5.0 tests=BAYES_00, DKIMWL_WL_HIGH, DKIM_SIGNED, DKIM_VALID, DKIM_VALID_AU, DKIM_VALID_EF, GIT_PATCH_0, RCVD_IN_DNSWL_NONE, RCVD_IN_MSPIKE_H4, RCVD_IN_MSPIKE_WL, SPF_HELO_NONE, SPF_NONE, TXREP autolearn=ham autolearn_force=no version=3.4.6 X-Spam-Checker-Version: SpamAssassin 3.4.6 (2021-04-09) on server2.sourceware.org X-BeenThere: gcc-patches@gcc.gnu.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: Gcc-patches mailing list List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-Patchwork-Original-From: David Malcolm via Gcc-patches From: David Malcolm Reply-To: David Malcolm Errors-To: gcc-patches-bounces+ouuuleilei=gmail.com@gcc.gnu.org Sender: "Gcc-patches" X-getmail-retrieved-from-mailbox: INBOX X-GMAIL-THRID: 1775121840202046404 X-GMAIL-MSGID: 1775121840202046404 gcc/analyzer/ChangeLog: PR analyzer/105899 * call-details.cc (call_details::check_for_null_terminated_string_arg): Split into overloads, one taking just an arg_idx, the other a new "include_terminator" param. * call-details.h: Likewise. * kf.cc (class kf_strcat): New. (kf_strcpy::impl_call_pre): Update for change to check_for_null_terminated_string_arg. (register_known_functions): Register kf_strcat. * region-model.cc (region_model::check_for_null_terminated_string_arg): Split into overloads, one taking just an arg_idx, the other a new "include_terminator" param. When returning an svalue, handle "include_terminator" being false by subtracting one. * region-model.h (region_model::check_for_null_terminated_string_arg): Split into overloads, one taking just an arg_idx, the other a new "include_terminator" param. gcc/ChangeLog: PR analyzer/105899 * doc/invoke.texi (Static Analyzer Options): Add "strcat" to the list of functions known to the analyzer. gcc/testsuite/ChangeLog: PR analyzer/105899 * gcc.dg/analyzer/strcat-1.c: New test. --- gcc/analyzer/call-details.cc | 12 +- gcc/analyzer/call-details.h | 5 +- gcc/analyzer/kf.cc | 72 ++++++++++-- gcc/analyzer/region-model.cc | 63 +++++++++-- gcc/analyzer/region-model.h | 6 +- gcc/doc/invoke.texi | 1 + gcc/testsuite/gcc.dg/analyzer/strcat-1.c | 136 +++++++++++++++++++++++ 7 files changed, 275 insertions(+), 20 deletions(-) create mode 100644 gcc/testsuite/gcc.dg/analyzer/strcat-1.c diff --git a/gcc/analyzer/call-details.cc b/gcc/analyzer/call-details.cc index 8f5b28ce6c26..ce1f859c9996 100644 --- a/gcc/analyzer/call-details.cc +++ b/gcc/analyzer/call-details.cc @@ -386,13 +386,23 @@ call_details::lookup_function_attribute (const char *attr_name) const return lookup_attribute (attr_name, TYPE_ATTRIBUTES (allocfntype)); } +void +call_details::check_for_null_terminated_string_arg (unsigned arg_idx) const +{ + check_for_null_terminated_string_arg (arg_idx, false, nullptr); +} + const svalue * call_details:: check_for_null_terminated_string_arg (unsigned arg_idx, + bool include_terminator, const svalue **out_sval) const { region_model *model = get_model (); - return model->check_for_null_terminated_string_arg (*this, arg_idx, out_sval); + return model->check_for_null_terminated_string_arg (*this, + arg_idx, + include_terminator, + out_sval); } } // namespace ana diff --git a/gcc/analyzer/call-details.h b/gcc/analyzer/call-details.h index 58b5ccd2acde..ae528e4ab116 100644 --- a/gcc/analyzer/call-details.h +++ b/gcc/analyzer/call-details.h @@ -72,9 +72,12 @@ public: tree lookup_function_attribute (const char *attr_name) const; + void + check_for_null_terminated_string_arg (unsigned arg_idx) const; const svalue * check_for_null_terminated_string_arg (unsigned arg_idx, - const svalue **out_sval = nullptr) const; + bool include_terminator, + const svalue **out_sval) const; private: const gcall *m_call; diff --git a/gcc/analyzer/kf.cc b/gcc/analyzer/kf.cc index 3eddbe200387..36d9d10bb013 100644 --- a/gcc/analyzer/kf.cc +++ b/gcc/analyzer/kf.cc @@ -1106,6 +1106,61 @@ public: /* Currently a no-op. */ }; +/* Handler for "strcat" and "__builtin_strcat_chk". */ + +class kf_strcat : public known_function +{ +public: + kf_strcat (unsigned int num_args) : m_num_args (num_args) {} + bool matches_call_types_p (const call_details &cd) const final override + { + return (cd.num_args () == m_num_args + && cd.arg_is_pointer_p (0) + && cd.arg_is_pointer_p (1)); + } + + void impl_call_pre (const call_details &cd) const final override + { + region_model *model = cd.get_model (); + region_model_manager *mgr = cd.get_manager (); + + const svalue *dest_sval = cd.get_arg_svalue (0); + const region *dest_reg = model->deref_rvalue (dest_sval, cd.get_arg_tree (0), + cd.get_ctxt ()); + + const svalue *dst_strlen_sval + = cd.check_for_null_terminated_string_arg (0, false, nullptr); + if (!dst_strlen_sval) + { + if (cd.get_ctxt ()) + cd.get_ctxt ()->terminate_path (); + return; + } + + const svalue *bytes_to_copy; + const svalue *num_src_bytes_read_sval + = cd.check_for_null_terminated_string_arg (1, true, &bytes_to_copy); + if (!num_src_bytes_read_sval) + { + if (cd.get_ctxt ()) + cd.get_ctxt ()->terminate_path (); + return; + } + + cd.maybe_set_lhs (dest_sval); + + const region *offset_reg + = mgr->get_offset_region (dest_reg, NULL_TREE, dst_strlen_sval); + model->write_bytes (offset_reg, + num_src_bytes_read_sval, + bytes_to_copy, + cd.get_ctxt ()); + } + +private: + unsigned int m_num_args; +}; + /* Handler for "strcpy" and "__builtin_strcpy_chk". */ class kf_strcpy : public known_function @@ -1139,7 +1194,7 @@ kf_strcpy::impl_call_pre (const call_details &cd) const const svalue *bytes_to_copy; if (const svalue *num_bytes_read_sval - = cd.check_for_null_terminated_string_arg (1, &bytes_to_copy)) + = cd.check_for_null_terminated_string_arg (1, true, &bytes_to_copy)) { model->write_bytes (dest_reg, num_bytes_read_sval, bytes_to_copy, ctxt); } @@ -1188,16 +1243,10 @@ public: } void impl_call_pre (const call_details &cd) const final override { - if (const svalue *bytes_read = cd.check_for_null_terminated_string_arg (0)) - if (bytes_read->get_kind () != SK_UNKNOWN) + if (const svalue *strlen_sval + = cd.check_for_null_terminated_string_arg (0, false, nullptr)) + if (strlen_sval->get_kind () != SK_UNKNOWN) { - region_model_manager *mgr = cd.get_manager (); - /* strlen is (bytes_read - 1). */ - const svalue *one = mgr->get_or_create_int_cst (size_type_node, 1); - const svalue *strlen_sval = mgr->get_or_create_binop (size_type_node, - MINUS_EXPR, - bytes_read, - one); cd.maybe_set_lhs (strlen_sval); return; } @@ -1415,6 +1464,8 @@ register_known_functions (known_function_manager &kfm) kfm.add (BUILT_IN_SPRINTF, make_unique ()); kfm.add (BUILT_IN_STACK_RESTORE, make_unique ()); kfm.add (BUILT_IN_STACK_SAVE, make_unique ()); + kfm.add (BUILT_IN_STRCAT, make_unique (2)); + kfm.add (BUILT_IN_STRCAT_CHK, make_unique (3)); kfm.add (BUILT_IN_STRCHR, make_unique ()); kfm.add (BUILT_IN_STRCPY, make_unique (2)); kfm.add (BUILT_IN_STRCPY_CHK, make_unique (3)); @@ -1429,6 +1480,7 @@ register_known_functions (known_function_manager &kfm) /* Known builtins and C standard library functions. */ { kfm.add ("memset", make_unique ()); + kfm.add ("strcat", make_unique (2)); kfm.add ("strdup", make_unique ()); kfm.add ("strndup", make_unique ()); } diff --git a/gcc/analyzer/region-model.cc b/gcc/analyzer/region-model.cc index 025b555d7b97..02c073c15bcc 100644 --- a/gcc/analyzer/region-model.cc +++ b/gcc/analyzer/region-model.cc @@ -3679,9 +3679,41 @@ region_model::scan_for_null_terminator (const region *reg, - the buffer pointed to has any uninitalized bytes before any 0-terminator - any of the reads aren't within the bounds of the underlying base region - Otherwise, return a svalue for the number of bytes read (strlen + 1), - and, if OUT_SVAL is non-NULL, write to *OUT_SVAL with an svalue - representing the content of the buffer up to and including the terminator. + Otherwise, return a svalue for strlen of the buffer (*not* including + the null terminator). + + TODO: we should also complain if: + - the pointer is NULL (or could be). */ + +void +region_model::check_for_null_terminated_string_arg (const call_details &cd, + unsigned arg_idx) +{ + check_for_null_terminated_string_arg (cd, + arg_idx, + false, /* include_terminator */ + nullptr); // out_sval +} + + +/* Check that argument ARG_IDX (0-based) to the call described by CD + is a pointer to a valid null-terminated string. + + Simulate scanning through the buffer, reading until we find a 0 byte + (equivalent to calling strlen). + + Complain and return NULL if: + - the buffer pointed to isn't null-terminated + - the buffer pointed to has any uninitalized bytes before any 0-terminator + - any of the reads aren't within the bounds of the underlying base region + + Otherwise, return a svalue. This will be the number of bytes read + (including the null terminator) if INCLUDE_TERMINATOR is true, or strlen + of the buffer (not including the null terminator) if it is false. + + Also, when returning an svalue, if OUT_SVAL is non-NULL, write to + *OUT_SVAL with an svalue representing the content of the buffer up to + and including the terminator. TODO: we should also complain if: - the pointer is NULL (or could be). */ @@ -3689,6 +3721,7 @@ region_model::scan_for_null_terminator (const region *reg, const svalue * region_model::check_for_null_terminated_string_arg (const call_details &cd, unsigned arg_idx, + bool include_terminator, const svalue **out_sval) { class null_terminator_check_event : public custom_event @@ -3786,10 +3819,26 @@ region_model::check_for_null_terminated_string_arg (const call_details &cd, const region *buf_reg = deref_rvalue (arg_sval, cd.get_arg_tree (arg_idx), &my_ctxt); - return scan_for_null_terminator (buf_reg, - cd.get_arg_tree (arg_idx), - out_sval, - &my_ctxt); + if (const svalue *num_bytes_read_sval + = scan_for_null_terminator (buf_reg, + cd.get_arg_tree (arg_idx), + out_sval, + &my_ctxt)) + { + if (include_terminator) + return num_bytes_read_sval; + else + { + /* strlen is (bytes_read - 1). */ + const svalue *one = m_mgr->get_or_create_int_cst (size_type_node, 1); + return m_mgr->get_or_create_binop (size_type_node, + MINUS_EXPR, + num_bytes_read_sval, + one); + } + } + else + return nullptr; } /* Remove all bindings overlapping REG within the store. */ diff --git a/gcc/analyzer/region-model.h b/gcc/analyzer/region-model.h index b1c705e22c28..40259625fb06 100644 --- a/gcc/analyzer/region-model.h +++ b/gcc/analyzer/region-model.h @@ -519,10 +519,14 @@ class region_model const svalue *sval_hint, region_model_context *ctxt) const; + void + check_for_null_terminated_string_arg (const call_details &cd, + unsigned idx); const svalue * check_for_null_terminated_string_arg (const call_details &cd, unsigned idx, - const svalue **out_sval = nullptr); + bool include_terminator, + const svalue **out_sval); private: const region *get_lvalue_1 (path_var pv, region_model_context *ctxt) const; diff --git a/gcc/doc/invoke.texi b/gcc/doc/invoke.texi index ef3f40989860..209d6b0ce4d3 100644 --- a/gcc/doc/invoke.texi +++ b/gcc/doc/invoke.texi @@ -11109,6 +11109,7 @@ and of the following functions: @item @code{siglongjmp} @item @code{signal} @item @code{sigsetjmp} +@item @code{strcat} @item @code{strchr} @item @code{strlen} @end itemize diff --git a/gcc/testsuite/gcc.dg/analyzer/strcat-1.c b/gcc/testsuite/gcc.dg/analyzer/strcat-1.c new file mode 100644 index 000000000000..e3b698ae73d3 --- /dev/null +++ b/gcc/testsuite/gcc.dg/analyzer/strcat-1.c @@ -0,0 +1,136 @@ +/* See e.g. https://en.cppreference.com/w/c/string/byte/strcat */ + +#include "analyzer-decls.h" + +char *strcat (char *dest, const char *src); +#define NULL ((void *)0) + +char * +test_passthrough (char *dest, const char *src) +{ + return strcat (dest, src); +} + +char * +test_null_dest (const char *src) +{ + return strcat (NULL, src); /* { dg-warning "use of NULL where non-null expected" } */ +} + +char * +test_null_src (char *dest) +{ + return strcat (dest, NULL); /* { dg-warning "use of NULL where non-null expected" } */ +} + +char * +test_uninit_dest (const char *src) +{ + char dest[10]; + return strcat (dest, src); /* { dg-warning "use of uninitialized value 'dest\\\[0\\\]'" } */ +} + +char * +test_uninit_src (char *dest) +{ + const char src[10]; + return strcat (dest, src); /* { dg-warning "use of uninitialized value 'src\\\[0\\\]'" } */ +} + +char * +test_dest_not_terminated (char *src) +{ + char dest[3] = "foo"; + return strcat (dest, src); /* { dg-warning "stack-based buffer over-read" } */ + /* { dg-message "while looking for null terminator for argument 1 \\('&dest'\\) of 'strcat'" "" { target *-*-* } .-1 } */ +} + +char * +test_src_not_terminated (char *dest) +{ + const char src[3] = "foo"; + return strcat (dest, src); /* { dg-warning "stack-based buffer over-read" } */ + /* { dg-message "while looking for null terminator for argument 2 \\('&src'\\) of 'strcat'" "" { target *-*-* } .-1 } */ +} + +char * __attribute__((noinline)) +call_strcat (char *dest, const char *src) +{ + return strcat (dest, src); +} + +void +test_concrete_valid_static_size (void) +{ + char buf[16]; + char *p1 = __builtin_strcpy (buf, "abc"); + char *p2 = call_strcat (buf, "def"); + __analyzer_eval (p1 == buf); /* { dg-warning "TRUE" } */ + __analyzer_eval (p2 == buf); /* { dg-warning "TRUE" } */ + __analyzer_eval (buf[0] == 'a'); /* { dg-warning "TRUE" } */ + __analyzer_eval (buf[1] == 'b'); /* { dg-warning "TRUE" } */ + __analyzer_eval (buf[2] == 'c'); /* { dg-warning "TRUE" } */ + __analyzer_eval (buf[3] == 'd'); /* { dg-warning "TRUE" } */ + __analyzer_eval (buf[4] == 'e'); /* { dg-warning "TRUE" } */ + __analyzer_eval (buf[5] == 'f'); /* { dg-warning "TRUE" } */ + __analyzer_eval (buf[6] == '\0'); /* { dg-warning "TRUE" } */ + __analyzer_eval (__builtin_strlen (buf) == 6); /* { dg-warning "TRUE" } */ +} + +void +test_concrete_valid_static_size_2 (void) +{ + char buf[16]; + char *p1 = __builtin_strcpy (buf, "abc"); + char *p2 = call_strcat (buf, "def"); + char *p3 = call_strcat (buf, "ghi"); + __analyzer_eval (p1 == buf); /* { dg-warning "TRUE" } */ + __analyzer_eval (p2 == buf); /* { dg-warning "TRUE" } */ + __analyzer_eval (p3 == buf); /* { dg-warning "TRUE" } */ + __analyzer_eval (buf[0] == 'a'); /* { dg-warning "TRUE" } */ + __analyzer_eval (buf[1] == 'b'); /* { dg-warning "TRUE" } */ + __analyzer_eval (buf[2] == 'c'); /* { dg-warning "TRUE" } */ + __analyzer_eval (buf[3] == 'd'); /* { dg-warning "TRUE" } */ + __analyzer_eval (buf[4] == 'e'); /* { dg-warning "TRUE" } */ + __analyzer_eval (buf[5] == 'f'); /* { dg-warning "TRUE" } */ + __analyzer_eval (buf[6] == 'g'); /* { dg-warning "TRUE" } */ + __analyzer_eval (buf[7] == 'h'); /* { dg-warning "TRUE" } */ + __analyzer_eval (buf[8] == 'i'); /* { dg-warning "TRUE" } */ + __analyzer_eval (buf[9] == '\0'); /* { dg-warning "TRUE" } */ + __analyzer_eval (__builtin_strlen (buf) == 9); /* { dg-warning "TRUE" } */ + __analyzer_eval (__builtin_strlen (buf + 1) == 8); /* { dg-warning "TRUE" } */ + __analyzer_eval (__builtin_strlen (buf + 2) == 7); /* { dg-warning "TRUE" } */ + __analyzer_eval (__builtin_strlen (buf + 3) == 6); /* { dg-warning "TRUE" } */ + __analyzer_eval (__builtin_strlen (buf + 4) == 5); /* { dg-warning "TRUE" } */ + __analyzer_eval (__builtin_strlen (buf + 5) == 4); /* { dg-warning "TRUE" } */ + __analyzer_eval (__builtin_strlen (buf + 6) == 3); /* { dg-warning "TRUE" } */ + __analyzer_eval (__builtin_strlen (buf + 7) == 2); /* { dg-warning "TRUE" } */ + __analyzer_eval (__builtin_strlen (buf + 8) == 1); /* { dg-warning "TRUE" } */ + __analyzer_eval (__builtin_strlen (buf + 9) == 0); /* { dg-warning "TRUE" } */ +} + +char * __attribute__((noinline)) +call_strcat_invalid (char *dest, const char *src) +{ + return strcat (dest, src); /* { dg-warning "stack-based buffer overflow" } */ +} + +void +test_concrete_invalid_static_size (void) +{ + char buf[3]; + buf[0] = '\0'; + call_strcat_invalid (buf, "abc"); +} + +void +test_concrete_symbolic (const char *suffix) +{ + char buf[10]; + buf[0] = '\0'; + call_strcat (buf, suffix); +} + +/* TODO: + - "The behavior is undefined if the strings overlap." +*/