1 /*
2  * Copyright (C) 2010 Dan Carpenter.
3  *
4  * This program is free software; you can redistribute it and/or
5  * modify it under the terms of the GNU General Public License
6  * as published by the Free Software Foundation; either version 2
7  * of the License, or (at your option) any later version.
8  *
9  * This program is distributed in the hope that it will be useful,
10  * but WITHOUT ANY WARRANTY; without even the implied warranty of
11  * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
12  * GNU General Public License for more details.
13  *
14  * You should have received a copy of the GNU General Public License
15  * along with this program; if not, see http://www.gnu.org/copyleft/gpl.txt
16  */
17 
18 /*
19  * Looks for integers that we get from the user which can be attacked
20  * with an integer overflow.
21  *
22  */
23 
24 #include "smatch.h"
25 #include "smatch_slist.h"
26 
27 static int my_max_id;
28 static int my_min_id;
29 
30 STATE(capped);
31 STATE(user_data);
32 
match_condition(struct expression * expr)33 static void match_condition(struct expression *expr)
34 {
35 	struct smatch_state *left_max_true = NULL;
36 	struct smatch_state *left_max_false = NULL;
37 	struct smatch_state *right_max_true = NULL;
38 	struct smatch_state *right_max_false = NULL;
39 
40 	struct smatch_state *left_min_true = NULL;
41 	struct smatch_state *left_min_false = NULL;
42 	struct smatch_state *right_min_true = NULL;
43 	struct smatch_state *right_min_false = NULL;
44 
45 	if (expr->type != EXPR_COMPARE)
46 		return;
47 
48 	switch (expr->op) {
49 	case '<':
50 	case SPECIAL_LTE:
51 	case SPECIAL_UNSIGNED_LT:
52 	case SPECIAL_UNSIGNED_LTE:
53 		left_max_true = &capped;
54 		right_max_false = &capped;
55 		right_min_true = &capped;
56 		left_min_false = &capped;
57 		break;
58 	case '>':
59 	case SPECIAL_GTE:
60 	case SPECIAL_UNSIGNED_GT:
61 	case SPECIAL_UNSIGNED_GTE:
62 		left_max_false = &capped;
63 		right_max_true = &capped;
64 		left_min_true = &capped;
65 		right_min_false = &capped;
66 		break;
67 	case SPECIAL_EQUAL:
68 		left_max_true = &capped;
69 		right_max_true = &capped;
70 		left_min_true = &capped;
71 		right_min_true = &capped;
72 		break;
73 	case SPECIAL_NOTEQUAL:
74 		left_max_false = &capped;
75 		right_max_false = &capped;
76 		left_min_false = &capped;
77 		right_min_false = &capped;
78 		break;
79 	default:
80 		return;
81 	}
82 
83 	if (get_state_expr(my_max_id, expr->left)) {
84 		set_true_false_states_expr(my_max_id, expr->left, left_max_true, left_max_false);
85 		set_true_false_states_expr(my_min_id, expr->left, left_min_true, left_min_false);
86 	}
87 	if (get_state_expr(my_max_id, expr->right)) {
88 		set_true_false_states_expr(my_max_id, expr->right, right_max_true, right_max_false);
89 		set_true_false_states_expr(my_min_id, expr->right, right_min_true, right_min_false);
90 	}
91 }
92 
match_normal_assign(struct expression * expr)93 static void match_normal_assign(struct expression *expr)
94 {
95 	if (get_state_expr(my_max_id, expr->left)) {
96 		set_state_expr(my_max_id, expr->left, &capped);
97 		set_state_expr(my_min_id, expr->left, &capped);
98 	}
99 }
100 
match_assign(struct expression * expr)101 static void match_assign(struct expression *expr)
102 {
103 	char *name;
104 
105 	name = get_macro_name(expr->pos);
106 	if (!name || strcmp(name, "get_user") != 0) {
107 		match_normal_assign(expr);
108 		return;
109 	}
110 	name = expr_to_var(expr->right);
111 	if (!name || (strcmp(name, "__val_gu") != 0 && strcmp(name, "__gu_val")))
112 		goto free;
113 	set_state_expr(my_max_id, expr->left, &user_data);
114 	set_state_expr(my_min_id, expr->left, &user_data);
115 free:
116 	free_string(name);
117 }
118 
check_expr(struct expression * expr)119 static void check_expr(struct expression *expr)
120 {
121 	struct sm_state *sm;
122 	sval_t max;
123 	sval_t sval;
124 	char *name;
125 	int overflow = 0;
126 	int underflow = 0;
127 
128 	sm = get_sm_state_expr(my_max_id, expr);
129 	if (sm && slist_has_state(sm->possible, &user_data)) {
130 		get_absolute_max(expr, &max);
131 		if (sval_cmp_val(max, 20000) > 0)
132 			overflow = 1;
133 	}
134 
135 	sm = get_sm_state_expr(my_min_id, expr);
136 	if (sm && slist_has_state(sm->possible, &user_data)) {
137 		get_absolute_min(expr, &sval);
138 		if (sval_is_negative(sval) && sval_cmp_val(sval, -20000) < 0)
139 			underflow = 1;
140 	}
141 
142 	if (!overflow && !underflow)
143 		return;
144 
145 	name = expr_to_var_sym(expr, NULL);
146 	if (overflow && underflow)
147 		sm_warning("check for integer over/underflow '%s'", name);
148 	else if (underflow)
149 		sm_warning("check for integer underflow '%s'", name);
150 	else
151 		sm_warning("check for integer overflow '%s'", name);
152 	free_string(name);
153 
154 	set_state_expr(my_max_id, expr, &capped);
155 	set_state_expr(my_min_id, expr, &capped);
156 }
157 
match_binop(struct expression * expr)158 static void match_binop(struct expression *expr)
159 {
160 	if (expr->op == '^')
161 		return;
162 	if (expr->op == '&')
163 		return;
164 	if (expr->op == '|')
165 		return;
166 	if (expr->op == SPECIAL_RIGHTSHIFT)
167 		return;
168 	if (expr->op == SPECIAL_LEFTSHIFT)
169 		return;
170 
171 	check_expr(expr->left);
172 	check_expr(expr->right);
173 }
174 
check_get_user_overflow(int id)175 void check_get_user_overflow(int id)
176 {
177 	if (option_project != PROJ_KERNEL)
178 		return;
179 	my_max_id = id;
180 	add_hook(&match_condition, CONDITION_HOOK);
181 	add_hook(&match_assign, ASSIGNMENT_HOOK);
182 	add_hook(&match_binop, BINOP_HOOK);
183 }
184 
check_get_user_overflow2(int id)185 void check_get_user_overflow2(int id)
186 {
187 	my_min_id = id;
188 }
189