1// RUN: %clang_cc1 -triple i386-apple-darwin10 -analyze -analyzer-checker=security.insecureAPI,security.FloatLoopCounter %s -verify 2// RUN: %clang_cc1 -triple i386-apple-darwin10 -analyze -DUSE_BUILTINS -analyzer-checker=security.insecureAPI,security.FloatLoopCounter %s -verify 3// RUN: %clang_cc1 -triple i386-apple-darwin10 -analyze -DVARIANT -analyzer-checker=security.insecureAPI,security.FloatLoopCounter %s -verify 4// RUN: %clang_cc1 -triple i386-apple-darwin10 -analyze -DUSE_BUILTINS -DVARIANT -analyzer-checker=security.insecureAPI,security.FloatLoopCounter %s -verify 5 6#ifdef USE_BUILTINS 7# define BUILTIN(f) __builtin_ ## f 8#else /* USE_BUILTINS */ 9# define BUILTIN(f) f 10#endif /* USE_BUILTINS */ 11 12typedef typeof(sizeof(int)) size_t; 13 14 15// <rdar://problem/6336718> rule request: floating point used as loop 16// condition (FLP30-C, FLP-30-CPP) 17// 18// For reference: https://www.securecoding.cert.org/confluence/display/seccode/FLP30-C.+Do+not+use+floating+point+variables+as+loop+counters 19// 20void test_float_condition() { 21 for (float x = 0.1f; x <= 1.0f; x += 0.1f) {} // expected-warning{{Variable 'x' with floating point type 'float'}} 22 for (float x = 100000001.0f; x <= 100000010.0f; x += 1.0f) {} // expected-warning{{Variable 'x' with floating point type 'float'}} 23 for (float x = 100000001.0f; x <= 100000010.0f; x++ ) {} // expected-warning{{Variable 'x' with floating point type 'float'}} 24 for (double x = 100000001.0; x <= 100000010.0; x++ ) {} // expected-warning{{Variable 'x' with floating point type 'double'}} 25 for (double x = 100000001.0; ((x)) <= 100000010.0; ((x))++ ) {} // expected-warning{{Variable 'x' with floating point type 'double'}} 26 27 for (double x = 100000001.0; 100000010.0 >= x; x = x + 1.0 ) {} // expected-warning{{Variable 'x' with floating point type 'double'}} 28 29 int i = 0; 30 for (double x = 100000001.0; ((x)) <= 100000010.0; ((x))++, ++i ) {} // expected-warning{{Variable 'x' with floating point type 'double'}} 31 32 typedef float FooType; 33 for (FooType x = 100000001.0f; x <= 100000010.0f; x++ ) {} // expected-warning{{Variable 'x' with floating point type 'FooType'}} 34} 35 36// <rdar://problem/6335715> rule request: gets() buffer overflow 37// Part of recommendation: 300-BSI (buildsecurityin.us-cert.gov) 38char* gets(char *buf); 39 40void test_gets() { 41 char buff[1024]; 42 gets(buff); // expected-warning{{Call to function 'gets' is extremely insecure as it can always result in a buffer overflow}} 43} 44 45int getpw(unsigned int uid, char *buf); 46 47void test_getpw() { 48 char buff[1024]; 49 getpw(2, buff); // expected-warning{{The getpw() function is dangerous as it may overflow the provided buffer. It is obsoleted by getpwuid()}} 50} 51 52// <rdar://problem/6337132> CWE-273: Failure to Check Whether Privileges Were 53// Dropped Successfully 54typedef unsigned int __uint32_t; 55typedef __uint32_t __darwin_uid_t; 56typedef __uint32_t __darwin_gid_t; 57typedef __darwin_uid_t uid_t; 58typedef __darwin_gid_t gid_t; 59int setuid(uid_t); 60int setregid(gid_t, gid_t); 61int setreuid(uid_t, uid_t); 62extern void check(int); 63void abort(void); 64 65void test_setuid() 66{ 67 setuid(2); // expected-warning{{The return value from the call to 'setuid' is not checked. If an error occurs in 'setuid', the following code may execute with unexpected privileges}} 68 setuid(0); // expected-warning{{The return value from the call to 'setuid' is not checked. If an error occurs in 'setuid', the following code may execute with unexpected privileges}} 69 if (setuid (2) != 0) 70 abort(); 71 72 // Currently the 'setuid' check is not flow-sensitive, and only looks 73 // at whether the function was called in a compound statement. This 74 // will lead to false negatives, but there should be no false positives. 75 int t = setuid(2); // no-warning 76 (void)setuid (2); // no-warning 77 78 check(setuid (2)); // no-warning 79 80 setreuid(2,2); // expected-warning{{The return value from the call to 'setreuid' is not checked. If an error occurs in 'setreuid', the following code may execute with unexpected privileges}} 81 setregid(2,2); // expected-warning{{The return value from the call to 'setregid' is not checked. If an error occurs in 'setregid', the following code may execute with unexpected privileges}} 82} 83 84// <rdar://problem/6337100> CWE-338: Use of cryptographically weak prng 85int rand(void); 86double drand48(void); 87double erand48(unsigned short[3]); 88long jrand48(unsigned short[3]); 89void lcong48(unsigned short[7]); 90long lrand48(void); 91long mrand48(void); 92long nrand48(unsigned short[3]); 93long random(void); 94int rand_r(unsigned *); 95 96void test_rand() 97{ 98 unsigned short a[7]; 99 unsigned b; 100 101 rand(); // expected-warning{{Function 'rand' is obsolete because it implements a poor random number generator. Use 'arc4random' instead}} 102 drand48(); // expected-warning{{Function 'drand48' is obsolete because it implements a poor random number generator. Use 'arc4random' instead}} 103 erand48(a); // expected-warning{{Function 'erand48' is obsolete because it implements a poor random number generator. Use 'arc4random' instead}} 104 jrand48(a); // expected-warning{{Function 'jrand48' is obsolete because it implements a poor random number generator. Use 'arc4random' instead}} 105 lcong48(a); // expected-warning{{Function 'lcong48' is obsolete because it implements a poor random number generator. Use 'arc4random' instead}} 106 lrand48(); // expected-warning{{Function 'lrand48' is obsolete because it implements a poor random number generator. Use 'arc4random' instead}} 107 mrand48(); // expected-warning{{Function 'mrand48' is obsolete because it implements a poor random number generator. Use 'arc4random' instead}} 108 nrand48(a); // expected-warning{{Function 'nrand48' is obsolete because it implements a poor random number generator. Use 'arc4random' instead}} 109 rand_r(&b); // expected-warning{{Function 'rand_r' is obsolete because it implements a poor random number generator. Use 'arc4random' instead}} 110 random(); // expected-warning{{The 'random' function produces a sequence of values that an adversary may be able to predict. Use 'arc4random' instead}} 111} 112 113char *mktemp(char *buf); 114 115void test_mktemp() { 116 char *x = mktemp("/tmp/zxcv"); // expected-warning{{Call to function 'mktemp' is insecure as it always creates or uses insecure temporary file}} 117} 118 119 120//===----------------------------------------------------------------------=== 121// strcpy() 122//===----------------------------------------------------------------------=== 123#ifdef VARIANT 124 125#define __strcpy_chk BUILTIN(__strcpy_chk) 126char *__strcpy_chk(char *restrict s1, const char *restrict s2, size_t destlen); 127 128#define strcpy(a,b) __strcpy_chk(a,b,(size_t)-1) 129 130#else /* VARIANT */ 131 132#define strcpy BUILTIN(strcpy) 133char *strcpy(char *restrict s1, const char *restrict s2); 134 135#endif /* VARIANT */ 136 137void test_strcpy() { 138 char x[4]; 139 char *y; 140 141 strcpy(x, y); //expected-warning{{Call to function 'strcpy' is insecure as it does not provide bounding of the memory buffer. Replace unbounded copy functions with analogous functions that support length arguments such as 'strlcpy'. CWE-119}} 142} 143 144//===----------------------------------------------------------------------=== 145// strcat() 146//===----------------------------------------------------------------------=== 147#ifdef VARIANT 148 149#define __strcat_chk BUILTIN(__strcat_chk) 150char *__strcat_chk(char *restrict s1, const char *restrict s2, size_t destlen); 151 152#define strcat(a,b) __strcat_chk(a,b,(size_t)-1) 153 154#else /* VARIANT */ 155 156#define strcat BUILTIN(strcat) 157char *strcat(char *restrict s1, const char *restrict s2); 158 159#endif /* VARIANT */ 160 161void test_strcat() { 162 char x[4]; 163 char *y; 164 165 strcat(x, y); //expected-warning{{Call to function 'strcat' is insecure as it does not provide bounding of the memory buffer. Replace unbounded copy functions with analogous functions that support length arguments such as 'strlcat'. CWE-119}} 166} 167 168//===----------------------------------------------------------------------=== 169// vfork() 170//===----------------------------------------------------------------------=== 171typedef int __int32_t; 172typedef __int32_t pid_t; 173pid_t vfork(void); 174 175void test_vfork() { 176 vfork(); //expected-warning{{Call to function 'vfork' is insecure as it can lead to denial of service situations in the parent process}} 177} 178 179//===----------------------------------------------------------------------=== 180// mkstemp() 181//===----------------------------------------------------------------------=== 182 183char *mkdtemp(char *template); 184int mkstemps(char *template, int suffixlen); 185int mkstemp(char *template); 186char *mktemp(char *template); 187 188void test_mkstemp() { 189 mkstemp("XX"); // expected-warning {{Call to 'mkstemp' should have at least 6 'X's in the format string to be secure (2 'X's seen)}} 190 mkstemp("XXXXXX"); 191 mkstemp("XXXXXXX"); 192 mkstemps("XXXXXX", 0); 193 mkstemps("XXXXXX", 1); // expected-warning {{5 'X's seen}} 194 mkstemps("XXXXXX", 2); // expected-warning {{Call to 'mkstemps' should have at least 6 'X's in the format string to be secure (4 'X's seen, 2 characters used as a suffix)}} 195 mkdtemp("XX"); // expected-warning {{2 'X's seen}} 196 mkstemp("X"); // expected-warning {{Call to 'mkstemp' should have at least 6 'X's in the format string to be secure (1 'X' seen)}} 197 mkdtemp("XXXXXX"); 198} 199 200