gcc/analyzer/sm.cc

   1 /* Modeling API uses and misuses via state machines.
   2    Copyright (C) 2019-2023 Free Software Foundation, Inc.
   3    Contributed by David Malcolm <dmalcolm@redhat.com>.
   4
   5 This file is part of GCC.
   6
   7 GCC is free software; you can redistribute it and/or modify it
   8 under the terms of the GNU General Public License as published by
   9 the Free Software Foundation; either version 3, or (at your option)
  10 any later version.
  11
  12 GCC is distributed in the hope that it will be useful, but
  13 WITHOUT ANY WARRANTY; without even the implied warranty of
  14 MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
  15 General Public License for more details.
  16
  17 You should have received a copy of the GNU General Public License
  18 along with GCC; see the file COPYING3.  If not see
  19 <http://www.gnu.org/licenses/>.  */
  20
  21 #include "config.h"
  22 #define INCLUDE_MEMORY
  23 #include "system.h"
  24 #include "coretypes.h"
  25 #include "tree.h"
  26 #include "function.h"
  27 #include "basic-block.h"
  28 #include "gimple.h"
  29 #include "options.h"
  30 #include "function.h"
  31 #include "diagnostic-core.h"
  32 #include "pretty-print.h"
  33 #include "diagnostic.h"
  34 #include "tree-diagnostic.h"
  35 #include "analyzer/analyzer.h"
  36 #include "analyzer/analyzer-logging.h"
  37 #include "analyzer/sm.h"
  38 #include "analyzer/call-string.h"
  39 #include "analyzer/program-point.h"
  40 #include "analyzer/store.h"
  41 #include "analyzer/svalue.h"
  42 #include "analyzer/program-state.h"
  43 #include "analyzer/pending-diagnostic.h"
  44
  45 #if ENABLE_ANALYZER
  46
  47 namespace ana {
  48
  49 /* Return true if VAR has pointer or reference type.  */
  50
  51 bool
  52 any_pointer_p (tree var)
  53 {
  54   return POINTER_TYPE_P (TREE_TYPE (var));
  55 }
  56
  57 /* Return true if SVAL has pointer or reference type.  */
  58
  59 bool
  60 any_pointer_p (const svalue *sval)
  61 {
  62   if (!sval->get_type ())
  63     return false;
  64   return POINTER_TYPE_P (sval->get_type ());
  65 }
  66
  67 /* class state_machine::state.  */
  68
  69 /* Base implementation of dump_to_pp vfunc.  */
  70
  71 void
  72 state_machine::state::dump_to_pp (pretty_printer *pp) const
  73 {
  74   pp_string (pp, m_name);
  75 }
  76
  77 /* Return a new json::string describing the state.  */
  78
  79 json::value *
  80 state_machine::state::to_json () const
  81 {
  82   pretty_printer pp;
  83   pp_format_decoder (&pp) = default_tree_printer;
  84   dump_to_pp (&pp);
  85   return new json::string (pp_formatted_text (&pp));
  86 }
  87
  88 /* class state_machine.  */
  89
  90 /* state_machine's ctor.  */
  91
  92 state_machine::state_machine (const char *name, logger *logger)
  93 : log_user (logger), m_name (name), m_next_state_id (0),
  94   m_start (add_state ("start"))
  95 {
  96 }
  97
  98 /* Add a state with name NAME to this state_machine.
  99    The string is required to outlive the state_machine.
 100
 101    Return the state_t for the new state.  */
 102
 103 state_machine::state_t
 104 state_machine::add_state (const char *name)
 105 {
 106   state *s = new state (name, alloc_state_id ());
 107   m_states.safe_push (s);
 108   return s;
 109 }
 110
 111 /* Get the state with name NAME, which must exist.
 112    This is purely intended for use in selftests.  */
 113
 114 state_machine::state_t
 115 state_machine::get_state_by_name (const char *name) const
 116 {
 117   unsigned i;
 118   state *s;
 119   FOR_EACH_VEC_ELT (m_states, i, s)
 120     if (!strcmp (name, s->get_name ()))
 121       return s;
 122   /* Name not found.  */
 123   gcc_unreachable ();
 124 }
 125
 126 /* Base implementation of state_machine::on_leak.  */
 127
 128 std::unique_ptr<pending_diagnostic>
 129 state_machine::on_leak (tree var ATTRIBUTE_UNUSED) const
 130 {
 131   return NULL;
 132 }
 133
 134 /* Dump a multiline representation of this state machine to PP.  */
 135
 136 void
 137 state_machine::dump_to_pp (pretty_printer *pp) const
 138 {
 139   unsigned i;
 140   state *s;
 141   FOR_EACH_VEC_ELT (m_states, i, s)
 142     {
 143       pp_printf (pp, "  state %i: ", i);
 144       s->dump_to_pp (pp);
 145       pp_newline (pp);
 146     }
 147 }
 148
 149 /* Return a new json::object of the form
 150    {"name" : str,
 151     "states" : [str]}.  */
 152
 153 json::object *
 154 state_machine::to_json () const
 155 {
 156   json::object *sm_obj = new json::object ();
 157
 158   sm_obj->set ("name", new json::string (m_name));
 159   {
 160     json::array *states_arr = new json::array ();
 161     unsigned i;
 162     state *s;
 163     FOR_EACH_VEC_ELT (m_states, i, s)
 164       states_arr->append (s->to_json ());
 165     sm_obj->set ("states", states_arr);
 166   }
 167
 168   return sm_obj;
 169 }
 170
 171 /* class sm_context.  */
 172
 173 const region_model *
 174 sm_context::get_old_region_model () const
 175 {
 176   if (const program_state *old_state = get_old_program_state ())
 177     return old_state->m_region_model;
 178   else
 179     return NULL;
 180 }
 181
 182 /* Create instances of the various state machines, each using LOGGER,
 183    and populate OUT with them.  */
 184
 185 void
 186 make_checkers (auto_delete_vec <state_machine> &out, logger *logger)
 187 {
 188   out.safe_push (make_malloc_state_machine (logger));
 189   out.safe_push (make_fileptr_state_machine (logger));
 190   out.safe_push (make_fd_state_machine (logger));
 191   /* The "taint" checker must be explicitly enabled (as it currently
 192      leads to state explosions that stop the other checkers working).  */
 193   if (flag_analyzer_checker)
 194     out.safe_push (make_taint_state_machine (logger));
 195   out.safe_push (make_sensitive_state_machine (logger));
 196   out.safe_push (make_signal_state_machine (logger));
 197   out.safe_push (make_va_list_state_machine (logger));
 198
 199   /* We only attempt to run the pattern tests if it might have been manually
 200      enabled (for DejaGnu purposes).  */
 201   if (flag_analyzer_checker)
 202     out.safe_push (make_pattern_test_state_machine (logger));
 203
 204   if (flag_analyzer_checker)
 205     {
 206       unsigned read_index, write_index;
 207       state_machine **sm;
 208
 209       /* TODO: this leaks the machines
 210          Would be nice to log the things that were removed.  */
 211       VEC_ORDERED_REMOVE_IF (out, read_index, write_index, sm,
 212                              0 != strcmp (flag_analyzer_checker,
 213                                           (*sm)->get_name ()));
 214     }
 215 }
 216
 217 } // namespace ana
 218
 219 #endif /* #if ENABLE_ANALYZER */