1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
| //===--- StringLiteralWithEmbeddedNulCheck.cpp - clang-tidy----------------===//
//
// Part of the LLVM Project, under the Apache License v2.0 with LLVM Exceptions.
// See https://llvm.org/LICENSE.txt for license information.
// SPDX-License-Identifier: Apache-2.0 WITH LLVM-exception
//
//===----------------------------------------------------------------------===//
#include "StringLiteralWithEmbeddedNulCheck.h"
#include "clang/AST/ASTContext.h"
#include "clang/ASTMatchers/ASTMatchFinder.h"
using namespace clang::ast_matchers;
namespace clang {
namespace tidy {
namespace bugprone {
namespace {
AST_MATCHER(StringLiteral, containsNul) {
for (size_t i = 0; i < Node.getLength(); ++i)
if (Node.getCodeUnit(i) == '\0')
return true;
return false;
}
} // namespace
void StringLiteralWithEmbeddedNulCheck::registerMatchers(MatchFinder *Finder) {
// Match a string that contains embedded NUL character. Extra-checks are
// applied in |check| to find incorectly escaped characters.
Finder->addMatcher(stringLiteral(containsNul()).bind("strlit"), this);
// The remaining checks only apply to C++.
if (!getLangOpts().CPlusPlus)
return;
const auto StrLitWithNul =
ignoringParenImpCasts(stringLiteral(containsNul()).bind("truncated"));
// Match string constructor.
const auto StringConstructorExpr = expr(anyOf(
cxxConstructExpr(argumentCountIs(1),
hasDeclaration(cxxMethodDecl(hasName("basic_string")))),
// If present, the second argument is the alloc object which must not
// be present explicitly.
cxxConstructExpr(argumentCountIs(2),
hasDeclaration(cxxMethodDecl(hasName("basic_string"))),
hasArgument(1, cxxDefaultArgExpr()))));
// Detect passing a suspicious string literal to a string constructor.
// example: std::string str = "abc\0def";
Finder->addMatcher(
cxxConstructExpr(StringConstructorExpr, hasArgument(0, StrLitWithNul)),
this);
// Detect passing a suspicious string literal through an overloaded operator.
Finder->addMatcher(cxxOperatorCallExpr(hasAnyArgument(StrLitWithNul)), this);
}
void StringLiteralWithEmbeddedNulCheck::check(
const MatchFinder::MatchResult &Result) {
if (const auto *SL = Result.Nodes.getNodeAs<StringLiteral>("strlit")) {
for (size_t Offset = 0, Length = SL->getLength(); Offset < Length;
++Offset) {
// Find a sequence of character like "\0x12".
if (Offset + 3 < Length && SL->getCodeUnit(Offset) == '\0' &&
SL->getCodeUnit(Offset + 1) == 'x' &&
isDigit(SL->getCodeUnit(Offset + 2)) &&
isDigit(SL->getCodeUnit(Offset + 3))) {
diag(SL->getBeginLoc(), "suspicious embedded NUL character");
return;
}
}
}
if (const auto *SL = Result.Nodes.getNodeAs<StringLiteral>("truncated")) {
diag(SL->getBeginLoc(),
"truncated string literal with embedded NUL character");
}
}
} // namespace bugprone
} // namespace tidy
} // namespace clang
|