[BoundV2][Malloc] Place NoteTags when allocated an interesting tainted amount of memory

[gamesh411]

rebase onto dependency

clang/lib/StaticAnalyzer/Checkers/ArrayBoundCheckerV2.cpp

 namespace {
 class ArrayBoundCheckerV2 :
     public Checker<check::Location> {
   mutable std::unique_ptr<BuiltinBug> BT;
 
   enum OOB_Kind { OOB_Precedes, OOB_Excedes, OOB_Tainted };
 
   void reportOOB(CheckerContext &C, ProgramStateRef errorState, OOB_Kind kind,
+                 SVal InterestingValue = UndefinedVal(),
                  std::unique_ptr<BugReporterVisitor> Visitor = nullptr) const;
 
 public:
   void checkLocation(SVal l, bool isLoad, const Stmt*S,
                      CheckerContext &C) const;
 };
 
 // FIXME: Eventually replace RegionRawOffset with this class.
do {
     ProgramStateRef state_exceedsUpperBound, state_withinUpperBound;
     std::tie(state_exceedsUpperBound, state_withinUpperBound) =
       state->assume(*upperboundToCheck);
 
     // If we are under constrained and the index variables are tainted, report.
     if (state_exceedsUpperBound && state_withinUpperBound) {
       if (isTainted(state, *upperboundToCheck)) {
         reportOOB(checkerContext, state_exceedsUpperBound, OOB_Tainted,
+                  *upperboundToCheck,
                   std::make_unique<TaintBugVisitor>(*upperboundToCheck));
         return;
       }
     } else if (state_exceedsUpperBound) {
       // If we are constrained enough to definitely exceed the upper bound,
       // report.
       assert(!state_withinUpperBound);
       reportOOB(checkerContext, state_exceedsUpperBound, OOB_Excedes);
       return;
     }
 
     assert(state_withinUpperBound);
     state = state_withinUpperBound;
   }
   while (false);
 
   checkerContext.addTransition(state);
 }
 
 void ArrayBoundCheckerV2::reportOOB(
     CheckerContext &checkerContext, ProgramStateRef errorState, OOB_Kind kind,
-    std::unique_ptr<BugReporterVisitor> Visitor) const {
+    SVal InterestingValue, std::unique_ptr<BugReporterVisitor> Visitor) const {
 
   ExplodedNode *errorNode = checkerContext.generateErrorNode(errorState);
   if (!errorNode)
     return;
 
   if (!BT)
     BT.reset(new BuiltinBug(this, "Out-of-bound access"));
 
case OOB_Excedes:
     os << "(access exceeds upper limit of memory block)";
     break;
   case OOB_Tainted:
     os << "(index is tainted)";
     break;
   }
 
   auto BR = std::make_unique<PathSensitiveBugReport>(*BT, os.str(), errorNode);
+  BR->markInteresting(InterestingValue);
   BR->addVisitor(std::move(Visitor));
   checkerContext.emitReport(std::move(BR));
 }
 
 #ifndef NDEBUG
 LLVM_DUMP_METHOD void RegionRawOffsetV2::dump() const {
   dumpToStream(llvm::errs());
 }

clang/lib/StaticAnalyzer/Checkers/MallocChecker.cpp

 #include "clang/ASTMatchers/ASTMatchFinder.h"
 #include "clang/ASTMatchers/ASTMatchers.h"
 #include "clang/Analysis/ProgramPoint.h"
 #include "clang/Basic/LLVM.h"
 #include "clang/Basic/SourceManager.h"
 #include "clang/Basic/TargetInfo.h"
 #include "clang/Lex/Lexer.h"
 #include "clang/StaticAnalyzer/Checkers/BuiltinCheckerRegistration.h"
+#include "clang/StaticAnalyzer/Checkers/Taint.h"
 #include "clang/StaticAnalyzer/Core/BugReporter/BugType.h"
 #include "clang/StaticAnalyzer/Core/BugReporter/CommonBugCategories.h"
 #include "clang/StaticAnalyzer/Core/Checker.h"
 #include "clang/StaticAnalyzer/Core/CheckerManager.h"
 #include "clang/StaticAnalyzer/Core/PathSensitive/CallDescription.h"
 #include "clang/StaticAnalyzer/Core/PathSensitive/CallEvent.h"
 #include "clang/StaticAnalyzer/Core/PathSensitive/CheckerContext.h"
 #include "clang/StaticAnalyzer/Core/PathSensitive/CheckerHelpers.h"
StateAndPred MallocChecker::MallocMemAux(CheckerContext &C,
   State = State->BindExpr(CE, C.getLocationContext(), RetVal);
 
   // Fill the region with the initialization value.
   State = State->bindDefaultInitial(RetVal, Init, LCtx);
 
   // Set the region's extent.
   State = setDynamicExtent(State, RetVal.getAsRegion(),
                            Size.castAs<DefinedOrUnknownSVal>(), svalBuilder);
+  if (taint::isTainted(State, Size)) {
+    const NoteTag *Note =
+        C.getNoteTag([Size](PathSensitiveBugReport &BR) -> std::string {
+          if (BR.isInteresting(Size))
+            return "Allocating tainted amount of memory";
+          return "";
+        });
+    Pred = C.addTransition(State, Pred, Note);
+  }
 
   return MallocUpdateRefState(C, CE, State, Pred, Family);
 }
 
 static StateAndPred MallocUpdateRefState(CheckerContext &C, const Expr *E,
                                          ProgramStateRef State,
                                          ExplodedNode *Pred,
                                          AllocationFamily Family,

clang/test/Analysis/taint-diagnostic-visitor.c

 void taintDiagnosticMalloc(int conj) {
   int x;
   scanf("%d", &x);
   // expected-note@-1 2 {{Taint originated here}} Once for malloc(tainted), once for BoundsV2.
 
   int *p = (int *)malloc(x + conj); // Generic taint checker forbids tainted allocation.
   // expected-warning@-1 {{Untrusted data is used to specify the buffer size}}
   // expected-note@-2    {{Untrusted data is used to specify the buffer size}}
+  // expected-note@-3    {{Allocating tainted amount of memory}}
 
   p[1] = 1; // BoundsV2 checker can not prove that the access is safe.
   // expected-warning@-1 {{Out of bound memory access (index is tainted)}}
   // expected-note@-2    {{Out of bound memory access (index is tainted)}}
   free(p);
 }