76a21502fd
ClangCheckerRegistry is a very non-obvious, poorly documented, weird concept. It derives from CheckerRegistry, and is placed in lib/StaticAnalyzer/Frontend, whereas it's base is located in lib/StaticAnalyzer/Core. It was, from what I can imagine, used to circumvent the problem that the registry functions of the checkers are located in the clangStaticAnalyzerCheckers library, but that library depends on clangStaticAnalyzerCore. However, clangStaticAnalyzerFrontend depends on both of those libraries. One can make the observation however, that CheckerRegistry has no place in Core, it isn't used there at all! The only place where it is used is Frontend, which is where it ultimately belongs. This move implies that since include/clang/StaticAnalyzer/Checkers/ClangCheckers.h only contained a single function: class CheckerRegistry; void registerBuiltinCheckers(CheckerRegistry ®istry); it had to re purposed, as CheckerRegistry is no longer available to clangStaticAnalyzerCheckers. It was renamed to BuiltinCheckerRegistration.h, which actually describes it a lot better -- it does not contain the registration functions for checkers, but only those generated by the tblgen files. Differential Revision: https://reviews.llvm.org/D54436 llvm-svn: 349275
91 lines
3.1 KiB
C++
91 lines
3.1 KiB
C++
// MmapWriteExecChecker.cpp - Check for the prot argument -----------------===//
|
|
//
|
|
// The LLVM Compiler Infrastructure
|
|
//
|
|
// This file is distributed under the University of Illinois Open Source
|
|
// License. See LICENSE.TXT for details.
|
|
//
|
|
//===----------------------------------------------------------------------===//
|
|
//
|
|
// This checker tests the 3rd argument of mmap's calls to check if
|
|
// it is writable and executable in the same time. It's somehow
|
|
// an optional checker since for example in JIT libraries it is pretty common.
|
|
//
|
|
//===----------------------------------------------------------------------===//
|
|
|
|
#include "clang/StaticAnalyzer/Checkers/BuiltinCheckerRegistration.h"
|
|
|
|
#include "clang/StaticAnalyzer/Core/BugReporter/BugType.h"
|
|
#include "clang/StaticAnalyzer/Core/Checker.h"
|
|
#include "clang/StaticAnalyzer/Core/CheckerManager.h"
|
|
#include "clang/StaticAnalyzer/Core/PathSensitive/CallEvent.h"
|
|
#include "clang/StaticAnalyzer/Core/PathSensitive/CheckerContext.h"
|
|
|
|
using namespace clang;
|
|
using namespace ento;
|
|
using llvm::APSInt;
|
|
|
|
namespace {
|
|
class MmapWriteExecChecker : public Checker<check::PreCall> {
|
|
CallDescription MmapFn;
|
|
CallDescription MprotectFn;
|
|
static int ProtWrite;
|
|
static int ProtExec;
|
|
static int ProtRead;
|
|
mutable std::unique_ptr<BugType> BT;
|
|
public:
|
|
MmapWriteExecChecker() : MmapFn("mmap", 6), MprotectFn("mprotect", 3) {}
|
|
void checkPreCall(const CallEvent &Call, CheckerContext &C) const;
|
|
int ProtExecOv;
|
|
int ProtReadOv;
|
|
};
|
|
}
|
|
|
|
int MmapWriteExecChecker::ProtWrite = 0x02;
|
|
int MmapWriteExecChecker::ProtExec = 0x04;
|
|
int MmapWriteExecChecker::ProtRead = 0x01;
|
|
|
|
void MmapWriteExecChecker::checkPreCall(const CallEvent &Call,
|
|
CheckerContext &C) const {
|
|
if (Call.isCalled(MmapFn) || Call.isCalled(MprotectFn)) {
|
|
SVal ProtVal = Call.getArgSVal(2);
|
|
Optional<nonloc::ConcreteInt> ProtLoc = ProtVal.getAs<nonloc::ConcreteInt>();
|
|
int64_t Prot = ProtLoc->getValue().getSExtValue();
|
|
if (ProtExecOv != ProtExec)
|
|
ProtExec = ProtExecOv;
|
|
if (ProtReadOv != ProtRead)
|
|
ProtRead = ProtReadOv;
|
|
|
|
// Wrong settings
|
|
if (ProtRead == ProtExec)
|
|
return;
|
|
|
|
if ((Prot & (ProtWrite | ProtExec)) == (ProtWrite | ProtExec)) {
|
|
if (!BT)
|
|
BT.reset(new BugType(this, "W^X check fails, Write Exec prot flags set", "Security"));
|
|
|
|
ExplodedNode *N = C.generateNonFatalErrorNode();
|
|
if (!N)
|
|
return;
|
|
|
|
auto Report = llvm::make_unique<BugReport>(
|
|
*BT, "Both PROT_WRITE and PROT_EXEC flags are set. This can "
|
|
"lead to exploitable memory regions, which could be overwritten "
|
|
"with malicious code", N);
|
|
Report->addRange(Call.getArgSourceRange(2));
|
|
C.emitReport(std::move(Report));
|
|
}
|
|
}
|
|
}
|
|
|
|
void ento::registerMmapWriteExecChecker(CheckerManager &mgr) {
|
|
MmapWriteExecChecker *Mwec =
|
|
mgr.registerChecker<MmapWriteExecChecker>();
|
|
Mwec->ProtExecOv =
|
|
mgr.getAnalyzerOptions()
|
|
.getCheckerIntegerOption("MmapProtExec", 0x04, Mwec);
|
|
Mwec->ProtReadOv =
|
|
mgr.getAnalyzerOptions()
|
|
.getCheckerIntegerOption("MmapProtRead", 0x01, Mwec);
|
|
}
|