1 //=== FixedAddressChecker.cpp - Fixed address usage checker ----*- C++ -*--===// 2 // 3 // The LLVM Compiler Infrastructure 4 // 5 // This file is distributed under the University of Illinois Open Source 6 // License. See LICENSE.TXT for details. 7 // 8 //===----------------------------------------------------------------------===// 9 // 10 // This files defines FixedAddressChecker, a builtin checker that checks for 11 // assignment of a fixed address to a pointer. 12 // This check corresponds to CWE-587. 13 // 14 //===----------------------------------------------------------------------===// 15 16 #include "ClangSACheckers.h" 17 #include "clang/StaticAnalyzer/Core/Checker.h" 18 #include "clang/StaticAnalyzer/Core/CheckerManager.h" 19 #include "clang/StaticAnalyzer/Core/PathSensitive/CheckerContext.h" 20 #include "clang/StaticAnalyzer/Core/BugReporter/BugType.h" 21 22 using namespace clang; 23 using namespace ento; 24 25 namespace { 26 class FixedAddressChecker 27 : public Checker< check::PreStmt<BinaryOperator> > { 28 mutable llvm::OwningPtr<BuiltinBug> BT; 29 30 public: 31 void checkPreStmt(const BinaryOperator *B, CheckerContext &C) const; 32 }; 33 } 34 checkPreStmt(const BinaryOperator * B,CheckerContext & C) const35void FixedAddressChecker::checkPreStmt(const BinaryOperator *B, 36 CheckerContext &C) const { 37 // Using a fixed address is not portable because that address will probably 38 // not be valid in all environments or platforms. 39 40 if (B->getOpcode() != BO_Assign) 41 return; 42 43 QualType T = B->getType(); 44 if (!T->isPointerType()) 45 return; 46 47 const GRState *state = C.getState(); 48 49 SVal RV = state->getSVal(B->getRHS()); 50 51 if (!RV.isConstant() || RV.isZeroConstant()) 52 return; 53 54 if (ExplodedNode *N = C.generateNode()) { 55 if (!BT) 56 BT.reset(new BuiltinBug("Use fixed address", 57 "Using a fixed address is not portable because that " 58 "address will probably not be valid in all " 59 "environments or platforms.")); 60 RangedBugReport *R = new RangedBugReport(*BT, BT->getDescription(), N); 61 R->addRange(B->getRHS()->getSourceRange()); 62 C.EmitReport(R); 63 } 64 } 65 registerFixedAddressChecker(CheckerManager & mgr)66void ento::registerFixedAddressChecker(CheckerManager &mgr) { 67 mgr.registerChecker<FixedAddressChecker>(); 68 } 69