Commit Graph

55 Commits

Author SHA1 Message Date
Anna Zaks eefc0e9342 [analyzer] Mark output of fscanf and fopen as tainted.
llvm-svn: 146533
2011-12-14 00:56:02 +00:00
Anna Zaks d6bb3227de [analyzer] Mark getenv output as tainted.
Also, allow adding taint to a region (not only a symbolic value).

llvm-svn: 146532
2011-12-14 00:55:58 +00:00
Anna Zaks 7c96b7db96 [analyzer] CStringChecker should not rely on the analyzer generating UndefOrUnknown value when it cannot reason about the expression.
We are now often generating expressions even if the solver is not known to be able to simplify it. This is another cleanup of the existing code, where the rest of the analyzer and checkers should not base their logic on knowing ahead of the time what the solver can reason about. 

In this case, CStringChecker is performing a check for overflow of 'left+right' operation. The overflow can be checked with either 'maxVal-left' or 'maxVal-right'. Previously, the decision was based on whether the expresion evaluated to undef or not. With this patch, we check if one of the arguments is a constant, in which case we know that 'maxVal-const' is easily simplified. (Another option is to use canReasonAbout() method of the solver here, however, it's currently is protected.)

This patch also contains 2 small bug fixes:
 - swap the order of operators inside SValBuilder::makeGenericVal.
 - handle a case when AddeVal is unknown in GenericTaintChecker::getPointedToSymbol.

llvm-svn: 146343
2011-12-11 18:43:40 +00:00
Anna Zaks 457c68726c [analyzer] Warn when non pointer arguments are passed to scanf (only when running taint checker).
There is an open radar to implement better scanf checking as a Sema warning. However, a bit of redundancy is fine in this case.

llvm-svn: 144964
2011-11-18 02:26:36 +00:00
Anna Zaks 5c5bf9b634 [analyzer] Adding generic taint checker.
The checker is responsible for defining attack surface and adding taint to symbols.

llvm-svn: 144825
2011-11-16 19:58:13 +00:00