mutable llvm::OwningPtr<BugType> BT;
void initBugType() const;
+ /// Add/propagate taint on a post visit.
+ void taintPost(const CallExpr *CE, CheckerContext &C) const;
+ /// Add/propagate taint on a pre visit.
+ void taintPre(const CallExpr *CE, CheckerContext &C) const;
+
+ /// Catch taint related bugs. Check if tainted data is passed to a system
+ /// call etc.
+ bool checkPre(const CallExpr *CE, CheckerContext &C) const;
+
/// Given a pointer argument, get the symbol of the value it contains
/// (points to).
SymbolRef getPointedToSymbol(CheckerContext &C,
/// and thus, is tainted.
bool isStdin(const Expr *E, CheckerContext &C) const;
+ /// Check for CWE-134: Uncontrolled Format String.
+ bool checkUncontrolledFormatString(const CallExpr *CE,
+ CheckerContext &C) const;
+
public:
static void *getTag() { static int Tag; return &Tag; }
inline void GenericTaintChecker::initBugType() const {
if (!BT)
- BT.reset(new BugType("Tainted data checking", "General"));
+ BT.reset(new BugType("Taint Analysis", "General"));
}
void GenericTaintChecker::checkPreStmt(const CallExpr *CE,
CheckerContext &C) const {
- const ProgramState *State = C.getState();
+ // Check for errors first.
+ if (checkPre(CE, C))
+ return;
+ // Add taint second.
+ taintPre(CE, C);
+}
+
+void GenericTaintChecker::checkPostStmt(const CallExpr *CE,
+ CheckerContext &C) const {
+ taintPost(CE, C);
+}
+
+void GenericTaintChecker::taintPre(const CallExpr *CE,
+ CheckerContext &C) const {
// Set the evaluation function by switching on the callee name.
StringRef Name = C.getCalleeName(CE);
FnCheck evalFunction = llvm::StringSwitch<FnCheck>(Name)
.Default(0);
// Check and evaluate the call.
+ const ProgramState *State = 0;
if (evalFunction)
State = (this->*evalFunction)(CE, C);
if (!State)
C.addTransition(State);
}
-void GenericTaintChecker::checkPostStmt(const CallExpr *CE,
- CheckerContext &C) const {
- const ProgramState *State = C.getState();
-
+void GenericTaintChecker::taintPost(const CallExpr *CE,
+ CheckerContext &C) const {
// Define the attack surface.
// Set the evaluation function by switching on the callee name.
StringRef Name = C.getCalleeName(CE);
// If the callee isn't defined, it is not of security concern.
// Check and evaluate the call.
+ const ProgramState *State = 0;
if (evalFunction)
State = (this->*evalFunction)(CE, C);
if (!State)
C.addTransition(State);
}
+bool GenericTaintChecker::checkPre(const CallExpr *CE, CheckerContext &C) const{
+
+ if (checkUncontrolledFormatString(CE, C))
+ return true;
+
+ StringRef Name = C.getCalleeName(CE);
+ return false;
+}
+
SymbolRef GenericTaintChecker::getPointedToSymbol(CheckerContext &C,
const Expr* Arg,
bool IssueWarning) const {
return false;
}
+static bool getPrintfFormatArgumentNum(const CallExpr *CE,
+ const CheckerContext &C,
+ unsigned int &ArgNum) {
+ // Find if the function contains a format string argument.
+ // Handles: fprintf, printf, sprintf, snprintf, vfprintf, vprintf, vsprintf,
+ // vsnprintf, syslog, custom annotated functions.
+ const FunctionDecl *FDecl = C.getCalleeDecl(CE);
+ if (!FDecl)
+ return false;
+ for (specific_attr_iterator<FormatAttr>
+ i = FDecl->specific_attr_begin<FormatAttr>(),
+ e = FDecl->specific_attr_end<FormatAttr>(); i != e ; ++i) {
+
+ const FormatAttr *Format = *i;
+ ArgNum = Format->getFormatIdx() - 1;
+ if ((Format->getType() == "printf") && CE->getNumArgs() > ArgNum)
+ return true;
+ }
+
+ // Or if a function is named setproctitle (this is a heuristic).
+ if (C.getCalleeName(CE).find("setproctitle") != StringRef::npos) {
+ ArgNum = 0;
+ return true;
+ }
+
+ return false;
+}
+
+bool GenericTaintChecker::checkUncontrolledFormatString(const CallExpr *CE,
+ CheckerContext &C) const{
+ // Check if the function contains a format string argument.
+ unsigned int ArgNum = 0;
+ if (!getPrintfFormatArgumentNum(CE, C, ArgNum))
+ return false;
+
+ // If either the format string content or the pointer itself are tainted, warn.
+ const ProgramState *State = C.getState();
+ const Expr *Arg = CE->getArg(ArgNum);
+ if (State->isTainted(getPointedToSymbol(C, Arg, false)) ||
+ State->isTainted(Arg, C.getLocationContext()))
+ if (ExplodedNode *N = C.addTransition()) {
+ initBugType();
+ BugReport *report = new BugReport(*BT,
+ "Tainted format string (CWE-134: Uncontrolled Format String)", N);
+ report->addRange(Arg->getSourceRange());
+ C.EmitReport(report);
+ return true;
+ }
+ return false;
+}
+
void ento::registerGenericTaintChecker(CheckerManager &mgr) {
mgr.registerChecker<GenericTaintChecker>();
}