diff options
author | David Malcolm <dmalcolm@redhat.com> | 2023-03-03 17:59:21 -0500 |
---|---|---|
committer | David Malcolm <dmalcolm@redhat.com> | 2023-03-03 17:59:21 -0500 |
commit | 56572a08ec4a0fc1a7802d3737cd7f7cc9089c4b (patch) | |
tree | eab4594d22b277acd4d3b265e32935ab231d9ba7 /gcc/analyzer | |
parent | d3ef73867e3f70a343ad5aa4e00b270be85fa572 (diff) | |
download | gcc-56572a08ec4a0fc1a7802d3737cd7f7cc9089c4b.zip gcc-56572a08ec4a0fc1a7802d3737cd7f7cc9089c4b.tar.gz gcc-56572a08ec4a0fc1a7802d3737cd7f7cc9089c4b.tar.bz2 |
analyzer: provide placeholder implementation of sprintf
Previously, the analyzer lacked a known_function implementation of
sprintf, and thus would handle calls to sprintf with the "anything could
happen" fallback.
Whilst working on PR analyzer/107565 I noticed that this was preventing
a lot of genuine memory leaks from being reported for Doom; fixing
thusly.
Integration testing of the effect of the patch shows a big increase in
true positives due to the case mentioned in Doom, and one new false
positive (in pcre2), which I'm tracking as PR analyzer/109014.
Comparison:
GOOD: 67 -> 123 (+56); 10.91% -> 18.33%
BAD: 547 -> 548 (+1)
where the affected warnings/projects are:
-Wanalyzer-malloc-leak:
GOOD: 0 -> 56 (+56); 0.00% -> 41.48%
BAD: 79
True positives: 0 -> 56 (+56)
(all in Doom)
-Wanalyzer-use-of-uninitialized-value:
GOOD: 0; 0.00%
BAD: 80 -> 81 (+1)
False positives:
pcre2-10.42: 0 -> 1 (+1)
gcc/analyzer/ChangeLog:
* kf.cc (class kf_sprintf): New.
(register_known_functions): Register it.
gcc/testsuite/ChangeLog:
* gcc.dg/analyzer/doom-d_main-IdentifyVersion.c: New test.
* gcc.dg/analyzer/sprintf-1.c: New test.
* gcc.dg/analyzer/sprintf-concat.c: New test.
Signed-off-by: David Malcolm <dmalcolm@redhat.com>
Diffstat (limited to 'gcc/analyzer')
-rw-r--r-- | gcc/analyzer/kf.cc | 29 |
1 files changed, 29 insertions, 0 deletions
diff --git a/gcc/analyzer/kf.cc b/gcc/analyzer/kf.cc index ed5f703..93c4663 100644 --- a/gcc/analyzer/kf.cc +++ b/gcc/analyzer/kf.cc @@ -778,6 +778,34 @@ kf_strchr::impl_call_post (const call_details &cd) const } } +/* Handler for "sprintf". + int sprintf(char *str, const char *format, ...); +*/ + +class kf_sprintf : public known_function +{ +public: + bool matches_call_types_p (const call_details &cd) const final override + { + return (cd.num_args () >= 2 + && cd.arg_is_pointer_p (0) + && cd.arg_is_pointer_p (1)); + } + + void impl_call_pre (const call_details &cd) const final override + { + /* For now, merely assume that the destination buffer gets set to a + new svalue. */ + region_model *model = cd.get_model (); + region_model_context *ctxt = cd.get_ctxt (); + const svalue *dst_ptr = cd.get_arg_svalue (0); + const region *dst_reg + = model->deref_rvalue (dst_ptr, cd.get_arg_tree (0), ctxt); + const svalue *content = cd.get_or_create_conjured_svalue (dst_reg); + model->set_value (dst_reg, content, ctxt); + } +}; + /* Handler for "__builtin_stack_restore". */ class kf_stack_restore : public known_function @@ -990,6 +1018,7 @@ register_known_functions (known_function_manager &kfm) kfm.add (BUILT_IN_MEMSET, make_unique<kf_memset> ()); kfm.add (BUILT_IN_MEMSET_CHK, make_unique<kf_memset> ()); kfm.add (BUILT_IN_REALLOC, make_unique<kf_realloc> ()); + kfm.add (BUILT_IN_SPRINTF, make_unique<kf_sprintf> ()); kfm.add (BUILT_IN_STACK_RESTORE, make_unique<kf_stack_restore> ()); kfm.add (BUILT_IN_STACK_SAVE, make_unique<kf_stack_save> ()); kfm.add (BUILT_IN_STRCHR, make_unique<kf_strchr> ()); |