[PATCH] D44250: MmapWriteExecChecker supporting mprotect call

[Phabricator via Phabricator via cfe-commits]

This revision was automatically updated to reflect the committed changes.
Closed by commit rL327098: [analyzer] MmapWriteExecChecker: Add support for 
mprotect(). (authored by dergachev, committed by ).
Herald added a subscriber: llvm-commits.

Changed prior to commit:
  https://reviews.llvm.org/D44250?vs=137557&id=137683#toc

Repository:
  rL LLVM

https://reviews.llvm.org/D44250

Files:
  cfe/trunk/lib/StaticAnalyzer/Checkers/MmapWriteExecChecker.cpp
  cfe/trunk/test/Analysis/mmap-writeexec.c


Index: cfe/trunk/lib/StaticAnalyzer/Checkers/MmapWriteExecChecker.cpp
===================================================================
--- cfe/trunk/lib/StaticAnalyzer/Checkers/MmapWriteExecChecker.cpp
+++ cfe/trunk/lib/StaticAnalyzer/Checkers/MmapWriteExecChecker.cpp
@@ -28,12 +28,13 @@
 namespace {
 class MmapWriteExecChecker : public Checker<check::PreCall> {
   CallDescription MmapFn;
+  CallDescription MprotectFn;
   static int ProtWrite;
   static int ProtExec;
   static int ProtRead;
   mutable std::unique_ptr<BugType> BT;
 public:
-  MmapWriteExecChecker() : MmapFn("mmap", 6) {}
+  MmapWriteExecChecker() : MmapFn("mmap", 6), MprotectFn("mprotect", 3) {}
   void checkPreCall(const CallEvent &Call, CheckerContext &C) const;
   int ProtExecOv;
   int ProtReadOv;
@@ -46,8 +47,8 @@
 
 void MmapWriteExecChecker::checkPreCall(const CallEvent &Call,
                                          CheckerContext &C) const {
-  if (Call.isCalled(MmapFn)) {
-    SVal ProtVal = Call.getArgSVal(2); 
+  if (Call.isCalled(MmapFn) || Call.isCalled(MprotectFn)) {
+    SVal ProtVal = Call.getArgSVal(2);
     Optional<nonloc::ConcreteInt> ProtLoc = 
ProtVal.getAs<nonloc::ConcreteInt>();
     int64_t Prot = ProtLoc->getValue().getSExtValue();
     if (ProtExecOv != ProtExec)
Index: cfe/trunk/test/Analysis/mmap-writeexec.c
===================================================================
--- cfe/trunk/test/Analysis/mmap-writeexec.c
+++ cfe/trunk/test/Analysis/mmap-writeexec.c
@@ -16,6 +16,7 @@
 
 typedef __typeof(sizeof(int)) size_t;
 void *mmap(void *, size_t, int, int, int, long);
+int mprotect(void *, size_t, int);
 
 void f1()
 {
@@ -34,3 +35,10 @@
   int prot = PROT_WRITE | PROT_EXEC;
   (void)callm(NULL, 1024, prot, MAP_PRIVATE | MAP_ANON, -1, 0); // 
expected-warning{{Both PROT_WRITE and PROT_EXEC flags are set. This can lead to 
exploitable memory regions, which could be overwritten with malicious code}}
 }
+
+void f3()
+{
+  void *p = mmap(NULL, 1024, PROT_WRITE, MAP_PRIVATE | MAP_ANON, -1, 0); // 
no-warning
+  int m = mprotect(p, 1024, PROT_WRITE | PROT_EXEC); // expected-warning{{Both 
PROT_WRITE and PROT_EXEC flags are set. This can lead to exploitable memory 
regions, which could be overwritten with malicious code}}
+  (void)m;
+}



Index: cfe/trunk/lib/StaticAnalyzer/Checkers/MmapWriteExecChecker.cpp
===================================================================
--- cfe/trunk/lib/StaticAnalyzer/Checkers/MmapWriteExecChecker.cpp
+++ cfe/trunk/lib/StaticAnalyzer/Checkers/MmapWriteExecChecker.cpp
@@ -28,12 +28,13 @@
 namespace {
 class MmapWriteExecChecker : public Checker<check::PreCall> {
   CallDescription MmapFn;
+  CallDescription MprotectFn;
   static int ProtWrite;
   static int ProtExec;
   static int ProtRead;
   mutable std::unique_ptr<BugType> BT;
 public:
-  MmapWriteExecChecker() : MmapFn("mmap", 6) {}
+  MmapWriteExecChecker() : MmapFn("mmap", 6), MprotectFn("mprotect", 3) {}
   void checkPreCall(const CallEvent &Call, CheckerContext &C) const;
   int ProtExecOv;
   int ProtReadOv;
@@ -46,8 +47,8 @@
 
 void MmapWriteExecChecker::checkPreCall(const CallEvent &Call,
                                          CheckerContext &C) const {
-  if (Call.isCalled(MmapFn)) {
-    SVal ProtVal = Call.getArgSVal(2); 
+  if (Call.isCalled(MmapFn) || Call.isCalled(MprotectFn)) {
+    SVal ProtVal = Call.getArgSVal(2);
     Optional<nonloc::ConcreteInt> ProtLoc = ProtVal.getAs<nonloc::ConcreteInt>();
     int64_t Prot = ProtLoc->getValue().getSExtValue();
     if (ProtExecOv != ProtExec)
Index: cfe/trunk/test/Analysis/mmap-writeexec.c
===================================================================
--- cfe/trunk/test/Analysis/mmap-writeexec.c
+++ cfe/trunk/test/Analysis/mmap-writeexec.c
@@ -16,6 +16,7 @@
 
 typedef __typeof(sizeof(int)) size_t;
 void *mmap(void *, size_t, int, int, int, long);
+int mprotect(void *, size_t, int);
 
 void f1()
 {
@@ -34,3 +35,10 @@
   int prot = PROT_WRITE | PROT_EXEC;
   (void)callm(NULL, 1024, prot, MAP_PRIVATE | MAP_ANON, -1, 0); // expected-warning{{Both PROT_WRITE and PROT_EXEC flags are set. This can lead to exploitable memory regions, which could be overwritten with malicious code}}
 }
+
+void f3()
+{
+  void *p = mmap(NULL, 1024, PROT_WRITE, MAP_PRIVATE | MAP_ANON, -1, 0); // no-warning
+  int m = mprotect(p, 1024, PROT_WRITE | PROT_EXEC); // expected-warning{{Both PROT_WRITE and PROT_EXEC flags are set. This can lead to exploitable memory regions, which could be overwritten with malicious code}}
+  (void)m;
+}

_______________________________________________
cfe-commits mailing list
cfe-commits@lists.llvm.org
http://lists.llvm.org/cgi-bin/mailman/listinfo/cfe-commits