『CSA』CSA Checker 编写指北

class MyVisitor : public BugReporterVisitorImpl<MyVisitor> {
    void Profile(llvm::FoldingSetNodeID &ID) const {
        /* 
        Give your Bug reporter a profile so that you can identify your 
        targeted Bug information stored in the LLVM folding set of 
        path diagnostic callbacks! 
        */
    }
    PathDiagnosticPiece *VisiNode (const ExplodedNode *N, 
                                   const ExplodedNode *PrevN, 
                                   BugReporterContext &BRC, 
                                   BugReport &BR) {
        /* 
        Identify the node of interest, construct a path diagnostic 
        for it and return it, or return a null pointer if the node 
        should be skipped. 
        */
        if (const Stmt *S = /* A statement for diagnostic */) {
            PathDiagnosticLocation Pos(S, BRC.getSourceManager(), 
                                      N->getLocationContext());
            return new PathDiagnosticEventPiece(Pos, "Bug Message");
        }
        /* 
        It is not uncommon to identify nodes by statements 
        in their program points. In this case, the static helper 
        method getStmt(...) of PathDiagnosticLocation class should be 
        useful: 

        /// const Stmt *S = PathDiagnosticLocation::getStmt(N); ///

        But remember: there are most likely multiple nodes 
        corresponding to the same statement. 
        */
        return NULL;
    }
}

int foo(int x) {
    int y = x * 2;
    int z = x;
    // ......
}

struct StreamState {
    enum Kind {
        Opened, 
        Closed
    } K;

    StreamState(Kind InK) : K(InK) { }

    bool operator==(const StreamState &SS) const {
        return K == SS.K;
    }
    void Profile(llvm::FoldingSetNodeID &ID) const {
        ID.AddInteger(K);
    }

    bool isOpened() const {
        return K == Opened;
    }
    bool isClosed() const {
        return K == Closed;
    }

    static StreamState getOpened() {
        return StreamState(Opened);
    }
    static StreamState getClosed() {
        return StreamState(Closed);
    }
}

// Register a map from tracked stream symbols to their state
// The map will be recorded in the GenericDataMap of ProgramState
REGISTER_MAP_WITH_PROGRAMSTATE(StreamMap, SymbolRef, StreamState);

// "State" is the current ProgramState, which contain many maps
// "FileDesc" is the returnValue of function fopen or fclose
State = State->set<StreamMap>(FileDesc, StreamState::getOpened());

const StreamState *SS = State->get<StreamMap>(FileDesc);

// Register the Checker callback
class SimpleStreamChecker : public Checker<check::PostCall> {
    public:
    // Process fopen function
    void checkPostCall(const CallEvent &Call, CheckerContext &C) const;
};

// Process fopen
void SimpleStreamChecker::checkPostCall(const CallEvent &Call, 
                                       CheckerContext &C) const {
    if (!Call.isGlobalFunction("fopen")) {
        return;
    }
    // Get the symbolic value corresponding to the file handle
    SymbolRef FileDesc = Call.getReturnValue().getAsSymbol();
    if (!FileDesc) {
        return;
    }
    // Generate the transition
    // It will generate an edge in the explodedGraph
    ProgramStateRef State = C.getState();
    State = State->set<StreamMap>(FileDesc, StreamState::getOpened());
    C.addTransition(State);
    // The transition part will be handled automatically 
    // by static analyzer engine. We can see that Checkers add
    // new nodes to the explodedGraph with 'addTransition'
}

// Register the Checker callback
class SimpleStreamChecker : public Checker<check::PostCall, 
                                        check::PreCall> {
    public:
    // Process fopen function
    void checkPostCall(const CallEvent &Call, CheckerContext &C) const;
    // Process fclose function
    void checkPreCall(const CallEvent &Call, CheckerContext &C) const;
};

void SimpleStreamChecker::checkPreCall(const CallEvent &Call, 
                                      CheckerContext &C) const {
    if (!Call.isGlobalFunction("fclose") || Call.getNumArgs() != 1) {
        return;
    }
    // Get the symbolic value corresponding to the file handle
    SymbolRef FileDesc = Call.getArgSVal(0).getAsSymbol();
    if (!FileDesc) {
        return;
    }
    // Generate the transition
    // It will generate an edge in the explodedGraph
    ProgramStateRef State = C.getState();
    State = State->set<StreamMap>(FileDesc, StreamState::getClosed());
    C.addTransition(State);
    // The transition part will be handled automatically 
    // by static analyzer engine. We can see that Checkers add
    // new nodes to the explodedGraph with 'addTransition'
}

void SimpleStreamChecker::checkPreCall(const CallEvent &Call, 
                                    CheckerContext &C) const {
  // ......
  // Check double close error
  const StreamState *SS = C.getState()->get<StreamMap>(FileDesc);
  if (SS && SS->isClosed()) {
      reportDoubleClose(FileDesc, Call, C);
      return;
  }
  // ......
}

void SimpleStreamChecker::reportDoubleClose(SymbolRef FilDescSym, 
                                           const CallEvent &Call, 
                                           CheckerContext &C) const {
    // When we reach a Bug, we should stop exploring the path here
    // by generating a sink node
    ExplodedNode *ErrNode = C.generateSink();

    // If we've already reached this node on another path, return
    if (!ErrNode) {
        return;
    }

    // Generate the report
    BugReport *R = new BugReport(*DoubleCloseBugType, 
                                 "Closing a previously closed file stream", 
                                 ErrNode);
    R->addRange(Call.getSourceRange());
    R->markInteresting(FileDescSym);
    C.emitReport(R);
}

// Register the Checker callback
class SimpleStreamChecker : public Checker<check::PostCall, 
                                        check::PreCall, 
                                        check::DeadSymbols> {
    public:
    // Process fopen function
    void checkPostCall(const CallEvent &Call, CheckerContext &C) const;
    // Process fclose function
    void checkPreCall(const CallEvent &Call, CheckerContext &C) const;
    // Process Leaked bugReport
    void checkDeadSymbols(SymbolReaper &SymReaper, CheckerContext &C) const;
};

void SimpleStreamChecker::checkDeadSymbols(SymbolReaper &SymReaper, 
                                          CheckerContext &C) const {
    ProgramStateRef State = C.getState();
    SymbolVector LeakedStreams;
    StreamMapTy TrackedStreams = State->get<StreamMap>();
    for (StreamMapTy::iterator I = TrackedStreams.begin(), 
         E = TrackedStreams.end(); I != E; I++) {
        // I is a pair stored in the map: <SymbolicValue, StreamState>
        SymbolRef Sym = I->first;
        bool IsSymDead = SymReaper.isDead(Sym);
        // core
        if (isLeaked(Sym, I->second, IsSymDead)) {
            LeakedStreams.push_back(Sym);
        }
        // Remember to clean out the State 'cause we will
        // never refer to the deadSymbols again
        if (IsSymDead) {
            State = State->remove<StreamMap>(Sym);
        }
    }
    ExplodedNode *N = C.addTransition(State);
    reportLeaks(LeakedStreams, C, N);
}

static bool isLeaked(SymbolRef Sym, const StreamState &SS, bool IsSymDead) {
    if (IsSymDead && SS.isOpened()) {
        // If a symbol is NULL, assume that fopen failed on this path.
        // A symbol should only be considered leaked if it is non-null.
        ConstraintManager &CMgr = State->getConstraintManager();
        ConditionTruthVal OpenFailed = CMgr.isNull(State, Sym);
        return !OpenFailed.isConstrainedTrue();
    } else {
        return false;
    }
}

void SimpleStreamChecker::reportLeaks(ArrayRef<SymbolRef> LeakedStreams,
                                      CheckerContext &C,
                                      ExplodedNode *ErrNode) const {
  // Attach Bug reports to the leak node.
  // TODO: Identify the leaked file descriptor.
  for (SymbolRef LeakedStream : LeakedStreams) {
    auto R = std::make_unique<PathSensitiveBugReport>(
        *LeakBugType, "Opened file is never closed; potential resource leak",
        ErrNode);
    R->markInteresting(LeakedStream);
    C.emitReport(std::move(R));
  }
}

void ento::registerSimpleStreamChecker(CheckerManager &mgr) {
  mgr.registerChecker<SimpleStreamChecker>();
}

// This Checker should be enabled regardless of how language options are set.
bool ento::shouldRegisterSimpleStreamChecker(const CheckerManager &mgr) {
  return true;
}

#include "clang/StaticAnalyzer/Checkers/BuiltinCheckerRegistration.h"
#include "clang/StaticAnalyzer/Core/BugReporter/BugType.h"
#include "clang/StaticAnalyzer/Core/Checker.h"
#include "clang/StaticAnalyzer/Core/PathSensitive/CallDescription.h"
#include "clang/StaticAnalyzer/Core/PathSensitive/CallEvent.h"
#include "clang/StaticAnalyzer/Core/PathSensitive/CheckerContext.h"
#include <utility>

using namespace clang;
using namespace ento;

namespace {
typedef SmallVector<SymbolRef, 2> SymbolVector;

struct StreamState {
private:
  enum Kind { Opened, Closed } K;
  StreamState(Kind InK) : K(InK) { }

public:
  bool isOpened() const { return K == Opened; }
  bool isClosed() const { return K == Closed; }

  static StreamState getOpened() { return StreamState(Opened); }
  static StreamState getClosed() { return StreamState(Closed); }

  bool operator==(const StreamState &X) const {
    return K == X.K;
  }
  void Profile(llvm::FoldingSetNodeID &ID) const {
    ID.AddInteger(K);
  }
};

class SimpleStreamChecker : public Checker<check::PostCall,
                                           check::PreCall,
                                           check::DeadSymbols,
                                           check::PointerEscape> {
  CallDescription OpenFn, CloseFn;

  std::unique_ptr<BugType> DoubleCloseBugType;
  std::unique_ptr<BugType> LeakBugType;

  void reportDoubleClose(SymbolRef FileDescSym,
                         const CallEvent &Call,
                         CheckerContext &C) const;

  void reportLeaks(ArrayRef<SymbolRef> LeakedStreams, CheckerContext &C,
                   ExplodedNode *ErrNode) const;

  bool guaranteedNotToCloseFile(const CallEvent &Call) const;

public:
  SimpleStreamChecker();

  /// Process fopen.
  void checkPostCall(const CallEvent &Call, CheckerContext &C) const;
  /// Process fclose.
  void checkPreCall(const CallEvent &Call, CheckerContext &C) const;

  void checkDeadSymbols(SymbolReaper &SymReaper, CheckerContext &C) const;

  /// Stop tracking addresses which escape.
  ProgramStateRef checkPointerEscape(ProgramStateRef State,
                                    const InvalidatedSymbols &Escaped,
                                    const CallEvent *Call,
                                    PointerEscapeKind Kind) const;
};

} // end anonymous namespace

/// The state of the Checker is a map from tracked stream symbols to their
/// state. Let's store it in the ProgramState.
REGISTER_MAP_WITH_PROGRAMSTATE(StreamMap, SymbolRef, StreamState)

SimpleStreamChecker::SimpleStreamChecker()
    : OpenFn({"fopen"}), CloseFn({"fclose"}, 1) {
  // Initialize the Bug types.
  DoubleCloseBugType.reset(
      new BugType(this, "Double fclose", "Unix Stream API Error"));

  // Sinks are higher importance bugs as well as calls to assert() or exit(0).
  LeakBugType.reset(
      new BugType(this, "Resource Leak", "Unix Stream API Error",
                  /*SuppressOnSink=*/true));
}

void SimpleStreamChecker::checkPostCall(const CallEvent &Call,
                                        CheckerContext &C) const {
  if (!Call.isGlobalCFunction())
    return;

  if (!OpenFn.matches(Call))
    return;

  // Get the symbolic value corresponding to the file handle.
  SymbolRef FileDesc = Call.getReturnValue().getAsSymbol();
  if (!FileDesc)
    return;

  // Generate the next transition (an edge in the exploded graph).
  ProgramStateRef State = C.getState();
  State = State->set<StreamMap>(FileDesc, StreamState::getOpened());
  C.addTransition(State);
}

void SimpleStreamChecker::checkPreCall(const CallEvent &Call,
                                       CheckerContext &C) const {
  if (!Call.isGlobalCFunction())
    return;

  if (!CloseFn.matches(Call))
    return;

  // Get the symbolic value corresponding to the file handle.
  SymbolRef FileDesc = Call.getArgSVal(0).getAsSymbol();
  if (!FileDesc)
    return;

  // Check if the stream has already been closed.
  ProgramStateRef State = C.getState();
  const StreamState *SS = State->get<StreamMap>(FileDesc);
  if (SS && SS->isClosed()) {
    reportDoubleClose(FileDesc, Call, C);
    return;
  }

  // Generate the next transition, in which the stream is closed.
  State = State->set<StreamMap>(FileDesc, StreamState::getClosed());
  C.addTransition(State);
}

static bool isLeaked(SymbolRef Sym, const StreamState &SS,
                     bool IsSymDead, ProgramStateRef State) {
  if (IsSymDead && SS.isOpened()) {
    // If a symbol is NULL, assume that fopen failed on this path.
    // A symbol should only be considered leaked if it is non-null.
    ConstraintManager &CMgr = State->getConstraintManager();
    ConditionTruthVal OpenFailed = CMgr.isNull(State, Sym);
    return !OpenFailed.isConstrainedTrue();
  }
  return false;
}

void SimpleStreamChecker::checkDeadSymbols(SymbolReaper &SymReaper,
                                           CheckerContext &C) const {
  ProgramStateRef State = C.getState();
  SymbolVector LeakedStreams;
  StreamMapTy TrackedStreams = State->get<StreamMap>();
  for (StreamMapTy::iterator I = TrackedStreams.begin(),
                             E = TrackedStreams.end(); I != E; ++I) {
    SymbolRef Sym = I->first;
    bool IsSymDead = SymReaper.isDead(Sym);

    // Collect leaked symbols.
    if (isLeaked(Sym, I->second, IsSymDead, State))
      LeakedStreams.push_back(Sym);

    // Remove the dead symbol from the streams map.
    if (IsSymDead)
      State = State->remove<StreamMap>(Sym);
  }

  ExplodedNode *N = C.generateNonFatalErrorNode(State);
  if (!N)
    return;
  reportLeaks(LeakedStreams, C, N);
}

void SimpleStreamChecker::reportDoubleClose(SymbolRef FileDescSym,
                                            const CallEvent &Call,
                                            CheckerContext &C) const {
  // We reached a Bug, stop exploring the path here by generating a sink.
  ExplodedNode *ErrNode = C.generateErrorNode();
  // If we've already reached this node on another path, return.
  if (!ErrNode)
    return;

  // Generate the report.
  auto R = std::make_unique<PathSensitiveBugReport>(
      *DoubleCloseBugType, "Closing a previously closed file stream", ErrNode);
  R->addRange(Call.getSourceRange());
  R->markInteresting(FileDescSym);
  C.emitReport(std::move(R));
}

void SimpleStreamChecker::reportLeaks(ArrayRef<SymbolRef> LeakedStreams,
                                      CheckerContext &C,
                                      ExplodedNode *ErrNode) const {
  // Attach Bug reports to the leak node.
  // TODO: Identify the leaked file descriptor.
  for (SymbolRef LeakedStream : LeakedStreams) {
    auto R = std::make_unique<PathSensitiveBugReport>(
        *LeakBugType, "Opened file is never closed; potential resource leak",
        ErrNode);
    R->markInteresting(LeakedStream);
    C.emitReport(std::move(R));
  }
}

bool SimpleStreamChecker::guaranteedNotToCloseFile(const CallEvent &Call) const{
  // If it's not in a system header, assume it might close a file.
  if (!Call.isInSystemHeader())
    return false;

  // Handle cases where we know a buffer's /address/ can escape.
  if (Call.argumentsMayEscape())
    return false;

  // Note, even though fclose closes the file, we do not list it here
  // since the Checker is modeling the call.

  return true;
}

// If the pointer we are tracking escaped, do not track the symbol as
// we cannot reason about it anymore.
ProgramStateRef
SimpleStreamChecker::checkPointerEscape(ProgramStateRef State,
                                        const InvalidatedSymbols &Escaped,
                                        const CallEvent *Call,
                                        PointerEscapeKind Kind) const {
  // If we know that the call cannot close a file, there is nothing to do.
  if (Kind == PSK_DirectEscapeOnCall && guaranteedNotToCloseFile(*Call)) {
    return State;
  }

  for (InvalidatedSymbols::const_iterator I = Escaped.begin(),
                                          E = Escaped.end();
                                          I != E; ++I) {
    SymbolRef Sym = *I;

    // The symbol escaped. Optimistically, assume that the corresponding file
    // handle will be closed somewhere else.
    State = State->remove<StreamMap>(Sym);
  }
  return State;
}

void ento::registerSimpleStreamChecker(CheckerManager &mgr) {
  mgr.registerChecker<SimpleStreamChecker>();
}

// This Checker should be enabled regardless of how language options are set.
bool ento::shouldRegisterSimpleStreamChecker(const CheckerManager &mgr) {
  return true;
}