0a1f91c80c
One of the reasons why AnalyzerOptions is so chaotic is that options can be retrieved from the command line whenever and wherever. This allowed for some options to be forgotten for a looooooong time. Have you ever heard of "region-store-small-struct-limit"? In order to prevent this in the future, I'm proposing to restrict AnalyzerOptions' interface so that only checker options can be retrieved without special getters. I would like to make every option be accessible only through a getter, but checkers from plugins are a thing, so I'll have to figure something out for that. This also forces developers who'd like to add a new option to register it properly in the .def file. This is done by * making the third checker pointer parameter non-optional, and checked by an assert to be non-null. * I added new, but private non-checkers option initializers, meant only for internal use, * Renamed these methods accordingly (mind the consistent name for once with getBooleanOption!): - getOptionAsString -> getCheckerStringOption, - getOptionAsInteger -> getCheckerIntegerOption * The 3 functions meant for initializing data members (with the not very descriptive getBooleanOption, getOptionAsString and getOptionAsUInt names) were renamed to be overloads of the getAndInitOption function name. * All options were in some way retrieved via getCheckerOption. I removed it, and moved the logic to getStringOption and getCheckerStringOption. This did cause some code duplication, but that's the only way I could do it, now that checker and non-checker options are separated. Note that the non-checker version inserts the new option to the ConfigTable with the default value, but the checker version only attempts to find already existing entries. This is how it always worked, but this is clunky and I might end reworking that too, so we can eventually get a ConfigTable that contains the entire configuration of the analyzer. Differential Revision: https://reviews.llvm.org/D53483 llvm-svn: 346113
91 lines
3.1 KiB
C++
91 lines
3.1 KiB
C++
// MmapWriteExecChecker.cpp - Check for the prot argument -----------------===//
|
|
//
|
|
// The LLVM Compiler Infrastructure
|
|
//
|
|
// This file is distributed under the University of Illinois Open Source
|
|
// License. See LICENSE.TXT for details.
|
|
//
|
|
//===----------------------------------------------------------------------===//
|
|
//
|
|
// This checker tests the 3rd argument of mmap's calls to check if
|
|
// it is writable and executable in the same time. It's somehow
|
|
// an optional checker since for example in JIT libraries it is pretty common.
|
|
//
|
|
//===----------------------------------------------------------------------===//
|
|
|
|
#include "ClangSACheckers.h"
|
|
|
|
#include "clang/StaticAnalyzer/Core/BugReporter/BugType.h"
|
|
#include "clang/StaticAnalyzer/Core/Checker.h"
|
|
#include "clang/StaticAnalyzer/Core/CheckerManager.h"
|
|
#include "clang/StaticAnalyzer/Core/PathSensitive/CallEvent.h"
|
|
#include "clang/StaticAnalyzer/Core/PathSensitive/CheckerContext.h"
|
|
|
|
using namespace clang;
|
|
using namespace ento;
|
|
using llvm::APSInt;
|
|
|
|
namespace {
|
|
class MmapWriteExecChecker : public Checker<check::PreCall> {
|
|
CallDescription MmapFn;
|
|
CallDescription MprotectFn;
|
|
static int ProtWrite;
|
|
static int ProtExec;
|
|
static int ProtRead;
|
|
mutable std::unique_ptr<BugType> BT;
|
|
public:
|
|
MmapWriteExecChecker() : MmapFn("mmap", 6), MprotectFn("mprotect", 3) {}
|
|
void checkPreCall(const CallEvent &Call, CheckerContext &C) const;
|
|
int ProtExecOv;
|
|
int ProtReadOv;
|
|
};
|
|
}
|
|
|
|
int MmapWriteExecChecker::ProtWrite = 0x02;
|
|
int MmapWriteExecChecker::ProtExec = 0x04;
|
|
int MmapWriteExecChecker::ProtRead = 0x01;
|
|
|
|
void MmapWriteExecChecker::checkPreCall(const CallEvent &Call,
|
|
CheckerContext &C) const {
|
|
if (Call.isCalled(MmapFn) || Call.isCalled(MprotectFn)) {
|
|
SVal ProtVal = Call.getArgSVal(2);
|
|
Optional<nonloc::ConcreteInt> ProtLoc = ProtVal.getAs<nonloc::ConcreteInt>();
|
|
int64_t Prot = ProtLoc->getValue().getSExtValue();
|
|
if (ProtExecOv != ProtExec)
|
|
ProtExec = ProtExecOv;
|
|
if (ProtReadOv != ProtRead)
|
|
ProtRead = ProtReadOv;
|
|
|
|
// Wrong settings
|
|
if (ProtRead == ProtExec)
|
|
return;
|
|
|
|
if ((Prot & (ProtWrite | ProtExec)) == (ProtWrite | ProtExec)) {
|
|
if (!BT)
|
|
BT.reset(new BugType(this, "W^X check fails, Write Exec prot flags set", "Security"));
|
|
|
|
ExplodedNode *N = C.generateNonFatalErrorNode();
|
|
if (!N)
|
|
return;
|
|
|
|
auto Report = llvm::make_unique<BugReport>(
|
|
*BT, "Both PROT_WRITE and PROT_EXEC flags are set. This can "
|
|
"lead to exploitable memory regions, which could be overwritten "
|
|
"with malicious code", N);
|
|
Report->addRange(Call.getArgSourceRange(2));
|
|
C.emitReport(std::move(Report));
|
|
}
|
|
}
|
|
}
|
|
|
|
void ento::registerMmapWriteExecChecker(CheckerManager &mgr) {
|
|
MmapWriteExecChecker *Mwec =
|
|
mgr.registerChecker<MmapWriteExecChecker>();
|
|
Mwec->ProtExecOv =
|
|
mgr.getAnalyzerOptions()
|
|
.getCheckerIntegerOption("MmapProtExec", 0x04, Mwec);
|
|
Mwec->ProtReadOv =
|
|
mgr.getAnalyzerOptions()
|
|
.getCheckerIntegerOption("MmapProtRead", 0x01, Mwec);
|
|
}
|