gcc/analyzer/sm.h

   1 /* Modeling API uses and misuses via state machines.
   2    Copyright (C) 2019-2020 Free Software Foundation, Inc.
   3    Contributed by David Malcolm <dmalcolm@redhat.com>.
   4
   5 This file is part of GCC.
   6
   7 GCC is free software; you can redistribute it and/or modify it
   8 under the terms of the GNU General Public License as published by
   9 the Free Software Foundation; either version 3, or (at your option)
  10 any later version.
  11
  12 GCC is distributed in the hope that it will be useful, but
  13 WITHOUT ANY WARRANTY; without even the implied warranty of
  14 MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
  15 General Public License for more details.
  16
  17 You should have received a copy of the GNU General Public License
  18 along with GCC; see the file COPYING3.  If not see
  19 <http://www.gnu.org/licenses/>.  */
  20
  21 #ifndef GCC_ANALYZER_SM_H
  22 #define GCC_ANALYZER_SM_H
  23
  24 /* Utility functions for use by state machines.  */
  25
  26 extern tree is_zero_assignment (const gimple *stmt);
  27 extern bool any_pointer_p (tree var);
  28
  29 namespace ana {
  30
  31 class state_machine;
  32 class sm_context;
  33 class pending_diagnostic;
  34
  35 /* An abstract base class for a state machine describing an API.
  36    A mapping from state IDs to names, and various virtual functions
  37    for pattern-matching on statements.  */
  38
  39 class state_machine : public log_user
  40 {
  41 public:
  42   typedef unsigned state_t;
  43
  44   state_machine (const char *name, logger *logger)
  45   : log_user (logger), m_name (name) {}
  46
  47   virtual ~state_machine () {}
  48
  49   /* Should states be inherited from a parent region to a child region,
  50      when first accessing a child region?
  51      For example we should inherit the taintedness of a subregion,
  52      but we should not inherit the "malloc:non-null" state of a field
  53      within a heap-allocated struct.  */
  54   virtual bool inherited_state_p () const = 0;
  55
  56   const char *get_name () const { return m_name; }
  57
  58   const char *get_state_name (state_t s) const;
  59
  60   /* Return true if STMT is a function call recognized by this sm.  */
  61   virtual bool on_stmt (sm_context *sm_ctxt,
  62                         const supernode *node,
  63                         const gimple *stmt) const = 0;
  64
  65   virtual void on_condition (sm_context *sm_ctxt,
  66                              const supernode *node,
  67                              const gimple *stmt,
  68                              tree lhs, enum tree_code op, tree rhs) const = 0;
  69
  70   /* Return true if it safe to discard the given state (to help
  71      when simplifying state objects).
  72      States that need leak detection should return false.  */
  73   virtual bool can_purge_p (state_t s) const = 0;
  74
  75   /* Called when VAR leaks (and !can_purge_p).  */
  76   virtual pending_diagnostic *on_leak (tree var ATTRIBUTE_UNUSED) const
  77   {
  78     return NULL;
  79   }
  80
  81   void validate (state_t s) const;
  82
  83 protected:
  84   state_t add_state (const char *name);
  85
  86 private:
  87   DISABLE_COPY_AND_ASSIGN (state_machine);
  88
  89   const char *m_name;
  90   auto_vec<const char *> m_state_names;
  91 };
  92
  93 /* Is STATE the start state?  (zero is hardcoded as the start state).  */
  94
  95 static inline bool
  96 start_start_p (state_machine::state_t state)
  97 {
  98   return state == 0;
  99 }
 100
 101 /* Abstract base class for state machines to pass to
 102    sm_context::on_custom_transition for handling non-standard transitions
 103    (e.g. adding a node and edge to simulate registering a callback and having
 104    the callback be called later).  */
 105
 106 class custom_transition
 107 {
 108 public:
 109   virtual ~custom_transition () {}
 110   virtual void impl_transition (exploded_graph *eg,
 111                                 exploded_node *src_enode,
 112                                 int sm_idx) = 0;
 113 };
 114
 115 /* Abstract base class giving an interface for the state machine to call
 116    the checker engine, at a particular stmt.  */
 117
 118 class sm_context
 119 {
 120 public:
 121   virtual ~sm_context () {}
 122
 123   /* Get the fndecl used at call, or NULL_TREE.
 124      Use in preference to gimple_call_fndecl (and gimple_call_addr_fndecl),
 125      since it can look through function pointer assignments and
 126      other callback handling.  */
 127   virtual tree get_fndecl_for_call (const gcall *call) = 0;
 128
 129   /* Called by state_machine in response to pattern matches:
 130      if VAR is in state FROM, transition it to state TO, potentially
 131      recording the "origin" of the state as ORIGIN.
 132      Use NODE and STMT for location information.  */
 133    virtual void on_transition (const supernode *node, const gimple *stmt,
 134                               tree var,
 135                               state_machine::state_t from,
 136                               state_machine::state_t to,
 137                               tree origin = NULL_TREE) = 0;
 138
 139   /* Called by state_machine in response to pattern matches:
 140      issue a diagnostic D if VAR is in state STATE, using NODE and STMT
 141      for location information.  */
 142   virtual void warn_for_state (const supernode *node, const gimple *stmt,
 143                                tree var, state_machine::state_t state,
 144                                pending_diagnostic *d) = 0;
 145
 146   virtual tree get_readable_tree (tree expr)
 147   {
 148     return expr;
 149   }
 150
 151   virtual state_machine::state_t get_global_state () const = 0;
 152   virtual void set_global_state (state_machine::state_t) = 0;
 153
 154   /* A vfunc for handling custom transitions, such as when registering
 155      a signal handler.  */
 156   virtual void on_custom_transition (custom_transition *transition) = 0;
 157
 158 protected:
 159   sm_context (int sm_idx, const state_machine &sm)
 160   : m_sm_idx (sm_idx), m_sm (sm) {}
 161
 162   int m_sm_idx;
 163   const state_machine &m_sm;
 164 };
 165
 166
 167 /* The various state_machine subclasses are hidden in their respective
 168    implementation files.  */
 169
 170 extern void make_checkers (auto_delete_vec <state_machine> &out,
 171                            logger *logger);
 172
 173 extern state_machine *make_malloc_state_machine (logger *logger);
 174 extern state_machine *make_fileptr_state_machine (logger *logger);
 175 extern state_machine *make_taint_state_machine (logger *logger);
 176 extern state_machine *make_sensitive_state_machine (logger *logger);
 177 extern state_machine *make_signal_state_machine (logger *logger);
 178 extern state_machine *make_pattern_test_state_machine (logger *logger);
 179
 180 } // namespace ana
 181
 182 #endif /* GCC_ANALYZER_SM_H */