LeakChecker.cpp

Go to the documentation of this file.

//===- LeakChecker.cpp -- Memory leak detector ------------------------------//
//
//                     SVF: Static Value-Flow Analysis
//
// Copyright (C) <2013->  <Yulei Sui>
//
 
// This program is free software: you can redistribute it and/or modify
// it under the terms of the GNU Affero General Public License as published by
// the Free Software Foundation, either version 3 of the License, or
// (at your option) any later version.
 
// This program is distributed in the hope that it will be useful,
// but WITHOUT ANY WARRANTY; without even the implied warranty of
// MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
// GNU Affero General Public License for more details.
 
// You should have received a copy of the GNU Affero General Public License
// along with this program.  If not, see <http://www.gnu.org/licenses/>.
//
//===----------------------------------------------------------------------===//
 
/*
 * LeakChecker.cpp
 *
 *  Created on: Apr 2, 2014
 *      Author: Yulei Sui
 */
 
#include "Util/Options.h"
#include "SABER/LeakChecker.h"
 
using namespace SVF;
using namespace SVFUtil;
 

void LeakChecker::initSrcs()
{
 
    SVFIR* pag = getPAG();
    for(SVFIR::CSToRetMap::iterator it = pag->getCallSiteRets().begin(),
            eit = pag->getCallSiteRets().end(); it!=eit; ++it)
    {
        const RetICFGNode* cs = it->first;
        if(cs->getFun()->isUncalledFunction() || !cs->getType()->isPointerTy())
            continue;
 
        CallGraph::FunctionSet callees;
        getCallgraph()->getCallees(cs->getCallICFGNode(),callees);
        for(CallGraph::FunctionSet::const_iterator cit = callees.begin(), ecit = callees.end(); cit!=ecit; cit++)
        {
            const FunObjVar* fun = *cit;
            if (isSourceLikeFun(fun))
            {
                CSWorkList worklist;
                SVFGNodeBS visited;
                worklist.push(it->first->getCallICFGNode());
                while (!worklist.empty())
                {
                    const CallICFGNode* cs = worklist.pop();
                    const RetICFGNode* retBlockNode = cs->getRetICFGNode();
                    const ValVar* svfVar = pag->getCallSiteRet(retBlockNode);
                    const SVFGNode* node = getSVFG()->getDefSVFGNode(svfVar);
                    if (visited.test(node->getId()) == 0)
                        visited.set(node->getId());
                    else
                        continue;
 
                    CallSiteSet csSet;
                    // if this node is in an allocation wrapper, find all its call nodes
                    if (isInAWrapper(node, csSet))
                    {
                        for (CallSiteSet::iterator it = csSet.begin(), eit =
                                    csSet.end(); it != eit; ++it)
                        {
                            worklist.push(*it);
                        }
                    }
                    // otherwise, this is the source we are interested
                    else
                    {
                        // exclude sources in dead functions or sources in functions that have summary
                        if (!cs->getFun()->isUncalledFunction() && !isExtCall(cs->getBB()->getParent()))
                        {
                            addToSources(node);
                            addSrcToCSID(node, cs);
                        }
                    }
                }
            }
        }
    }
 
}

void LeakChecker::initSnks()
{
 
    SVFIR* pag = getPAG();
 
    for(SVFIR::CSToArgsListMap::iterator it = pag->getCallSiteArgsMap().begin(),
            eit = pag->getCallSiteArgsMap().end(); it!=eit; ++it)
    {
 
        CallGraph::FunctionSet callees;
        getCallgraph()->getCallees(it->first,callees);
        for(CallGraph::FunctionSet::const_iterator cit = callees.begin(), ecit = callees.end(); cit!=ecit; cit++)
        {
            const FunObjVar* fun = *cit;
            if (isSinkLikeFun(fun))
            {
                SVFIR::ValVarList &arglist = it->second;
                assert(!arglist.empty() && "no actual parameter at deallocation site?");
                for (SVFIR::ValVarList::const_iterator ait = arglist.begin(),
                        aeit = arglist.end(); ait != aeit; ++ait)
                {
                    const SVFVar *svfVar = *ait;
                    if (svfVar->isPointer())
                    {
                        const SVFGNode *snk = getSVFG()->getActualParmVFGNode(svfVar, it->first);
                        addToSinks(snk);
 
                        // For any multi-level pointer e.g., XFree(void** svfVar) that passed into a ExtAPI::EFT_FREE_MULTILEVEL function (e.g., XFree),
                        // we will add the DstNode of a load edge, i.e., dummy = *svfVar
                        SVFStmt::SVFStmtSetTy& loads = const_cast<SVFVar*>(svfVar)->getOutgoingEdges(SVFStmt::Load);
                        for(const SVFStmt* ld : loads)
                        {
                            if(SVFUtil::isa<DummyValVar>(ld->getDstNode()))
                                addToSinks(getSVFG()->getStmtVFGNode(ld));
                        }
                    }
                }
            }
        }
    }
}
 
void LeakChecker::reportBug(ProgSlice* slice)
{
 
    if(isAllPathReachable() == false && isSomePathReachable() == false)
    {
        // full leakage
        GenericBug::EventStack eventStack =
        {
            SVFBugEvent(SVFBugEvent::SourceInst, getSrcCSID(slice->getSource()))
        };
        report.addSaberBug(GenericBug::NEVERFREE, eventStack);
    }
    else if (isAllPathReachable() == false && isSomePathReachable() == true)
    {
        // partial leakage
        GenericBug::EventStack eventStack;
        slice->evalFinalCond2Event(eventStack);
        eventStack.push_back(
            SVFBugEvent(SVFBugEvent::SourceInst, getSrcCSID(slice->getSource())));
        report.addSaberBug(GenericBug::PARTIALLEAK, eventStack);
    }
 
    if(Options::ValidateTests())
        testsValidation(slice);
}
 

void LeakChecker::testsValidation(const ProgSlice* slice)
{
    const SVFGNode* source = slice->getSource();
    const CallICFGNode* cs = getSrcCSID(source);
    const FunObjVar* fun = cs->getCalledFunction();
    if(fun==nullptr)
        return;
 
    validateSuccessTests(source,fun);
    validateExpectedFailureTests(source,fun);
}
 
 
void LeakChecker::validateSuccessTests(const SVFGNode* source, const FunObjVar* fun)
{
 
    const CallICFGNode* cs = getSrcCSID(source);
 
    bool success = false;
 
    if(fun->getName() == "SAFEMALLOC")
    {
        if(isAllPathReachable() == true && isSomePathReachable() == true)
            success = true;
    }
    else if(fun->getName() == "NFRMALLOC")
    {
        if(isAllPathReachable() == false && isSomePathReachable() == false)
            success = true;
    }
    else if(fun->getName() == "PLKMALLOC")
    {
        if(isAllPathReachable() == false && isSomePathReachable() == true)
            success = true;
    }
    else if(fun->getName() == "CLKMALLOC")
    {
        if(isAllPathReachable() == false && isSomePathReachable() == false)
            success = true;
    }
    else if(fun->getName() == "NFRLEAKFP" || fun->getName() == "PLKLEAKFP"
            || fun->getName() == "LEAKFN")
    {
        return;
    }
    else
    {
        writeWrnMsg("\t can not validate, check function not found, please put it at the right place!!");
        return;
    }
 
    std::string funName = source->getFun()->getName();
 
    if (success)
    {
        if ((getSrcCSID(source))->hasLLVMValue())
        {
            outs() << sucMsg("\t SUCCESS :") << funName << " check <src id:" << source->getId()
                   << ", cs id:" << (getSrcCSID(source))->valueOnlyToString() << "> at ("
                   << cs->getSourceLoc() << ")\n";
        }
        else
        {
            outs() << sucMsg("\t SUCCESS :") << funName<<"\n";
        }
    }
    else
    {
        if ((getSrcCSID(source))->hasLLVMValue())
        {
            SVFUtil::errs() << errMsg("\t FAILURE :") << funName << " check <src id:" << source->getId()
                            << ", cs id:" << (getSrcCSID(source))->valueOnlyToString() << "> at ("
                            << cs->getSourceLoc() << ")\n";
            assert(false && "test case failed!");
        }
        else
        {
            SVFUtil::errs() << errMsg("\t FAILURE :") << funName <<  "\n";
            assert(false && "test case failed!");
        }
    }
}
 
void LeakChecker::validateExpectedFailureTests(const SVFGNode* source, const FunObjVar* fun)
{
 
    const CallICFGNode* cs = getSrcCSID(source);
 
    bool expectedFailure = false;
 
    if(fun->getName() == "NFRLEAKFP")
    {
        if(isAllPathReachable() == false && isSomePathReachable() == false)
            expectedFailure = true;
    }
    else if(fun->getName() == "PLKLEAKFP")
    {
        if(isAllPathReachable() == false && isSomePathReachable() == true)
            expectedFailure = true;
    }
    else if(fun->getName() == "LEAKFN")
    {
        if(isAllPathReachable() == true && isSomePathReachable() == true)
            expectedFailure = true;
    }
    else if(fun->getName() == "SAFEMALLOC" || fun->getName() == "NFRMALLOC"
            || fun->getName() == "PLKMALLOC" || fun->getName() == "CLKLEAKFN")
    {
        return;
    }
    else
    {
        writeWrnMsg("\t can not validate, check function not found, please put it at the right place!!");
        return;
    }
 
    std::string funName = source->getFun()->getName();
 
    if (expectedFailure)
    {
        if (!(getSrcCSID(source))->hasLLVMValue())
        {
            outs() << sucMsg("\t EXPECTED-FAILURE :") << funName <<"\n";
            return;
        }
        outs() << sucMsg("\t EXPECTED-FAILURE :") << funName << " check <src id:" << source->getId()
               << ", cs id:" << (getSrcCSID(source))->valueOnlyToString() << "> at ("
               << cs->getSourceLoc() << ")\n";
    }
    else
    {
        if (!(getSrcCSID(source))->hasLLVMValue())
        {
            SVFUtil::errs() << errMsg("\t UNEXPECTED FAILURE :") << funName <<"\n";
            assert(false && "test case failed!");
            return;
        }
        SVFUtil::errs() << errMsg("\t UNEXPECTED FAILURE :") << funName
                        << " check <src id:" << source->getId()
                        << ", cs id:" << (getSrcCSID(source))->valueOnlyToString() << "> at ("
                        << cs->getSourceLoc() << ")\n";
        assert(false && "test case failed!");
    }
}