Index: include/clang/StaticAnalyzer/Core/PathSensitive/ProgramState.h =================================================================== --- include/clang/StaticAnalyzer/Core/PathSensitive/ProgramState.h +++ include/clang/StaticAnalyzer/Core/PathSensitive/ProgramState.h @@ -369,27 +369,27 @@ /// Create a new state in which the statement is marked as tainted. LLVM_NODISCARD ProgramStateRef - addTaint(const Stmt *S, const LocationContext *LCtx, + setTaint(const Stmt *S, const LocationContext *LCtx, TaintTagType Kind = TaintTagGeneric) const; /// Create a new state in which the value is marked as tainted. LLVM_NODISCARD ProgramStateRef - addTaint(SVal V, TaintTagType Kind = TaintTagGeneric) const; + setTaint(SVal V, TaintTagType Kind = TaintTagGeneric) const; /// Create a new state in which the symbol is marked as tainted. - LLVM_NODISCARD ProgramStateRef addTaint(SymbolRef S, + LLVM_NODISCARD ProgramStateRef setTaint(SymbolRef S, TaintTagType Kind = TaintTagGeneric) const; /// Create a new state in which the region symbol is marked as tainted. LLVM_NODISCARD ProgramStateRef - addTaint(const MemRegion *R, TaintTagType Kind = TaintTagGeneric) const; + setTaint(const MemRegion *R, TaintTagType Kind = TaintTagGeneric) const; /// Create a new state in a which a sub-region of a given symbol is tainted. /// This might be necessary when referring to regions that can not have an /// individual symbol, e.g. if they are represented by the default binding of /// a LazyCompoundVal. LLVM_NODISCARD ProgramStateRef - addPartialTaint(SymbolRef ParentSym, const SubRegion *SubRegion, + setPartialTaint(SymbolRef ParentSym, const SubRegion *SubRegion, TaintTagType Kind = TaintTagGeneric) const; /// Check if the statement is tainted in the current state. Index: include/clang/StaticAnalyzer/Core/PathSensitive/TaintTag.h =================================================================== --- include/clang/StaticAnalyzer/Core/PathSensitive/TaintTag.h +++ include/clang/StaticAnalyzer/Core/PathSensitive/TaintTag.h @@ -21,7 +21,8 @@ /// taint. using TaintTagType = unsigned; -static const TaintTagType TaintTagGeneric = 0; +static const TaintTagType TaintTagNotTainted = 0; +static const TaintTagType TaintTagGeneric = 1; } // namespace ento } // namespace clang Index: lib/StaticAnalyzer/Checkers/GenericTaintChecker.cpp =================================================================== --- lib/StaticAnalyzer/Checkers/GenericTaintChecker.cpp +++ lib/StaticAnalyzer/Checkers/GenericTaintChecker.cpp @@ -31,6 +31,28 @@ using namespace ento; namespace { +/// A struct to store tainted argument and taint type as a pair in the program +/// state. +struct TaintArgTypePair { + unsigned Arg; + TaintTagType TagType; + + bool operator==(const TaintArgTypePair &X) const { + return Arg == X.Arg && TagType == X.TagType; + } + + bool operator<(const TaintArgTypePair &X) const { + if (Arg != X.Arg) + return Arg < X.Arg; + return TagType < X.TagType; + } + + void Profile(llvm::FoldingSetNodeID &ID) const { + ID.AddInteger(Arg); + ID.AddInteger(TagType); + } +}; + class GenericTaintChecker : public Checker, check::PreStmt> { public: @@ -83,10 +105,16 @@ /// Catch taint related bugs. Check if tainted data is passed to a /// system call etc. - bool checkPre(const CallExpr *CE, CheckerContext &C) const; + bool checkPre(const CallExpr *CE, const FunctionDecl *FDecl, StringRef Name, + CheckerContext &C) const; /// Add taint sources on a pre-visit. - void addSourcesPre(const CallExpr *CE, CheckerContext &C) const; + bool addSourcesPre(const CallExpr *CE, const FunctionDecl *FDecl, + StringRef Name, CheckerContext &C) const; + + /// Mark filter's arguments not tainted on a pre-visit. + bool addFiltersPre(const CallExpr *CE, StringRef Name, + CheckerContext &C) const; /// Propagate taint generated at pre-visit. bool propagateFromPre(const CallExpr *CE, CheckerContext &C) const; @@ -288,7 +316,7 @@ /// to the call post-visit. The values are unsigned integers, which are either /// ReturnValueIndex, or indexes of the pointer/reference argument, which /// points to data, which should be tainted on return. -REGISTER_SET_WITH_PROGRAMSTATE(TaintArgsOnPostVisit, unsigned) +REGISTER_SET_WITH_PROGRAMSTATE(TaintArgsOnPostVisit, TaintArgTypePair) void GenericTaintChecker::getConfiguration(StringRef ConfigFile) { if (ConfigFile.trim().empty()) @@ -437,14 +465,25 @@ void GenericTaintChecker::checkPreStmt(const CallExpr *CE, CheckerContext &C) const { + const FunctionDecl *FDecl = C.getCalleeDecl(CE); + if (!FDecl || FDecl->getKind() != Decl::Function) + return; + + StringRef Name = C.getCalleeName(FDecl); + if (Name.empty()) + return; + // Check for taintedness related errors first: system call, uncontrolled // format string, tainted buffer size. - if (checkPre(CE, C)) + if (checkPre(CE, FDecl, Name, C)) return; // Marks the function's arguments and/or return value tainted if it present in // the list. - addSourcesPre(CE, C); + if (addSourcesPre(CE, FDecl, Name, C)) + return; + + addFiltersPre(CE, Name, C); } void GenericTaintChecker::checkPostStmt(const CallExpr *CE, @@ -454,31 +493,45 @@ propagateFromPre(CE, C); } -void GenericTaintChecker::addSourcesPre(const CallExpr *CE, +bool GenericTaintChecker::addSourcesPre(const CallExpr *CE, + const FunctionDecl *FDecl, + StringRef Name, CheckerContext &C) const { - ProgramStateRef State = nullptr; - const FunctionDecl *FDecl = C.getCalleeDecl(CE); - if (!FDecl || FDecl->getKind() != Decl::Function) - return; - - StringRef Name = C.getCalleeName(FDecl); - if (Name.empty()) - return; - // First, try generating a propagation rule for this function. TaintPropagationRule Rule = TaintPropagationRule::getTaintPropagationRule(FDecl, Name, C); if (!Rule.isNull()) { - State = Rule.process(CE, C); + ProgramStateRef State = Rule.process(CE, C); if (!State) - return; + return false; C.addTransition(State); - return; } + return true; +} - if (!State) - return; - C.addTransition(State); +bool GenericTaintChecker::addFiltersPre(const CallExpr *CE, StringRef Name, + CheckerContext &C) const { + auto It = CustomFilters.find(Name); + if (It == CustomFilters.end()) + return false; + + ProgramStateRef State = C.getState(); + const GenericTaintChecker::ArgVector &Args = It->getValue(); + for (unsigned ArgNum : Args) { + if (ArgNum >= CE->getNumArgs()) { + llvm::errs() << "Skip out of bound filter Arg: " << Name << ":" << ArgNum + << '\n'; + continue; + } + + State = State->add({ArgNum, TaintTagNotTainted}); + } + + if (State != C.getState()) { + C.addTransition(State); + return true; + } + return false; } bool GenericTaintChecker::propagateFromPre(const CallExpr *CE, @@ -492,10 +545,12 @@ if (TaintArgs.isEmpty()) return false; - for (unsigned ArgNum : TaintArgs) { + for (auto ArgTypePair : TaintArgs) { + unsigned ArgNum = ArgTypePair.Arg; + TaintTagType TagType = ArgTypePair.TagType; // Special handling for the tainted return value. if (ArgNum == ReturnValueIndex) { - State = State->addTaint(CE, C.getLocationContext()); + State = State->setTaint(CE, C.getLocationContext(), TagType); continue; } @@ -506,7 +561,7 @@ const Expr *Arg = CE->getArg(ArgNum); Optional V = getPointedToSVal(C, Arg); if (V) - State = State->addTaint(*V); + State = State->setTaint(*V, TagType); } // Clear up the taint info from the state. @@ -520,19 +575,12 @@ } bool GenericTaintChecker::checkPre(const CallExpr *CE, + const FunctionDecl *FDecl, StringRef Name, CheckerContext &C) const { if (checkUncontrolledFormatString(CE, C)) return true; - const FunctionDecl *FDecl = C.getCalleeDecl(CE); - if (!FDecl || FDecl->getKind() != Decl::Function) - return false; - - StringRef Name = C.getCalleeName(FDecl); - if (Name.empty()) - return false; - if (checkSystemCall(CE, Name, C)) return true; @@ -607,7 +655,8 @@ for (unsigned ArgNum : DstArgs) { // Should mark the return value? if (ArgNum == ReturnValueIndex) { - State = State->add(ReturnValueIndex); + State = + State->add({ReturnValueIndex, TaintTagGeneric}); continue; } @@ -619,7 +668,7 @@ } // Mark the given argument. - State = State->add(ArgNum); + State = State->add({ArgNum, TaintTagGeneric}); } // Mark all variadic arguments tainted if present. @@ -635,7 +684,7 @@ QualType PType = ArgTy->getPointeeType(); if ((!PType.isNull() && !PType.isConstQualified()) || (ArgTy->isReferenceType() && !Arg->getType().isConstQualified())) - State = State->add(i); + State = State->add({i, TaintTagGeneric}); } } @@ -825,7 +874,7 @@ if (It == CustomSinks.end()) return false; - const GenericTaintChecker::ArgVector& Args = It->getValue(); + const GenericTaintChecker::ArgVector &Args = It->getValue(); for (unsigned ArgNum : Args) { if (ArgNum >= CE->getNumArgs()) { llvm::errs() << "Skip out of bound sink Arg: " << Name << ":" << ArgNum Index: lib/StaticAnalyzer/Core/ProgramState.cpp =================================================================== --- lib/StaticAnalyzer/Core/ProgramState.cpp +++ lib/StaticAnalyzer/Core/ProgramState.cpp @@ -658,20 +658,20 @@ return true; } -ProgramStateRef ProgramState::addTaint(const Stmt *S, +ProgramStateRef ProgramState::setTaint(const Stmt *S, const LocationContext *LCtx, TaintTagType Kind) const { if (const Expr *E = dyn_cast_or_null(S)) S = E->IgnoreParens(); - return addTaint(getSVal(S, LCtx), Kind); + return setTaint(getSVal(S, LCtx), Kind); } -ProgramStateRef ProgramState::addTaint(SVal V, +ProgramStateRef ProgramState::setTaint(SVal V, TaintTagType Kind) const { SymbolRef Sym = V.getAsSymbol(); if (Sym) - return addTaint(Sym, Kind); + return setTaint(Sym, Kind); // If the SVal represents a structure, try to mass-taint all values within the // structure. For now it only works efficiently on lazy compound values that @@ -685,22 +685,22 @@ if (auto LCV = V.getAs()) { if (Optional binding = getStateManager().StoreMgr->getDefaultBinding(*LCV)) { if (SymbolRef Sym = binding->getAsSymbol()) - return addPartialTaint(Sym, LCV->getRegion(), Kind); + return setPartialTaint(Sym, LCV->getRegion(), Kind); } } const MemRegion *R = V.getAsRegion(); - return addTaint(R, Kind); + return setTaint(R, Kind); } -ProgramStateRef ProgramState::addTaint(const MemRegion *R, +ProgramStateRef ProgramState::setTaint(const MemRegion *R, TaintTagType Kind) const { if (const SymbolicRegion *SR = dyn_cast_or_null(R)) - return addTaint(SR->getSymbol(), Kind); + return setTaint(SR->getSymbol(), Kind); return this; } -ProgramStateRef ProgramState::addTaint(SymbolRef Sym, +ProgramStateRef ProgramState::setTaint(SymbolRef Sym, TaintTagType Kind) const { // If this is a symbol cast, remove the cast before adding the taint. Taint // is cast agnostic. @@ -712,7 +712,7 @@ return NewState; } -ProgramStateRef ProgramState::addPartialTaint(SymbolRef ParentSym, +ProgramStateRef ProgramState::setPartialTaint(SymbolRef ParentSym, const SubRegion *SubRegion, TaintTagType Kind) const { // Ignore partial taint if the entire parent symbol is already tainted. @@ -721,7 +721,7 @@ // Partial taint applies if only a portion of the symbol is tainted. if (SubRegion == SubRegion->getBaseRegion()) - return addTaint(ParentSym, Kind); + return setTaint(ParentSym, Kind); const TaintedSubRegions *SavedRegs = get(ParentSym); TaintedSubRegions Regs = @@ -779,7 +779,7 @@ continue; if (const TaintTagType *Tag = get(*SI)) { - if (*Tag == Kind) + if (*Tag != TaintTagNotTainted && *Tag == Kind) return true; } Index: test/Analysis/taint-generic.c =================================================================== --- test/Analysis/taint-generic.c +++ test/Analysis/taint-generic.c @@ -296,13 +296,13 @@ *(volatile int *) 0; // no-warning } - // Test configuration int mySource1(); void mySource2(int*); void myScanf(const char*, ...); int myPropagator(int, int*); int mySnprintf(char*, size_t, const char*, ...); +void myFilter(int*); void mySink(int, int, int); void testConfigurationSources1() { @@ -329,6 +329,12 @@ Buffer[y] = 1; // expected-warning {{Out of bound memory access }} } +void testConfigurationFilter() { + int x = mySource1(); + myFilter(&x); + Buffer[x] = 1; // no-warning +} + void testConfigurationSinks() { int x = mySource1(); mySink(x, 1, 2); // expected-warning {{Untrusted data is passed to a user defined sink}}